1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2025 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 const struct ieee80211_ext *ext;
233 unsigned int fixedlen, hdrlen;
234 bool s1g_bcn;
235
236 if (len < offsetofend(typeof(*mgmt), frame_control))
237 goto err;
238
239 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
240 if (s1g_bcn) {
241 ext = (struct ieee80211_ext *)mgmt;
242 fixedlen =
243 offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
244 ieee80211_s1g_optional_len(ext->frame_control);
245 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
246 } else {
247 fixedlen = offsetof(struct ieee80211_mgmt,
248 u.beacon.variable);
249 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
250 }
251
252 if (len < fixedlen)
253 goto err;
254
255 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
256 goto err;
257
258 data += fixedlen;
259 len -= fixedlen;
260
261 for_each_element(elem, data, len) {
262 /* nothing */
263 }
264
265 if (for_each_element_completed(elem, data, len))
266 return 0;
267
268 err:
269 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
270 return -EINVAL;
271 }
272
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)273 static int validate_ie_attr(const struct nlattr *attr,
274 struct netlink_ext_ack *extack)
275 {
276 const u8 *data = nla_data(attr);
277 unsigned int len = nla_len(attr);
278 const struct element *elem;
279
280 for_each_element(elem, data, len) {
281 /* nothing */
282 }
283
284 if (for_each_element_completed(elem, data, len))
285 return 0;
286
287 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
288 return -EINVAL;
289 }
290
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)291 static int validate_he_capa(const struct nlattr *attr,
292 struct netlink_ext_ack *extack)
293 {
294 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
295 return -EINVAL;
296
297 return 0;
298 }
299
validate_supported_selectors(const struct nlattr * attr,struct netlink_ext_ack * extack)300 static int validate_supported_selectors(const struct nlattr *attr,
301 struct netlink_ext_ack *extack)
302 {
303 const u8 *supported_selectors = nla_data(attr);
304 u8 supported_selectors_len = nla_len(attr);
305
306 /* The top bit must not be set as it is not part of the selector */
307 for (int i = 0; i < supported_selectors_len; i++) {
308 if (supported_selectors[i] & 0x80)
309 return -EINVAL;
310 }
311
312 return 0;
313 }
314
validate_nan_cluster_id(const struct nlattr * attr,struct netlink_ext_ack * extack)315 static int validate_nan_cluster_id(const struct nlattr *attr,
316 struct netlink_ext_ack *extack)
317 {
318 const u8 *data = nla_data(attr);
319 unsigned int len = nla_len(attr);
320 static const u8 cluster_id_prefix[4] = {0x50, 0x6f, 0x9a, 0x1};
321
322 if (len != ETH_ALEN) {
323 NL_SET_ERR_MSG_ATTR(extack, attr, "bad cluster id length");
324 return -EINVAL;
325 }
326
327 if (memcmp(data, cluster_id_prefix, sizeof(cluster_id_prefix))) {
328 NL_SET_ERR_MSG_ATTR(extack, attr, "invalid cluster id prefix");
329 return -EINVAL;
330 }
331
332 return 0;
333 }
334
335 /* policy for the attributes */
336 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
337
338 static const struct nla_policy
339 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
340 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
341 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
342 .len = U8_MAX },
343 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
344 .len = U8_MAX },
345 };
346
347 static const struct nla_policy
348 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
349 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
350 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
351 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
352 NLA_POLICY_MAX(NLA_U8, 15),
353 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
354 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
355 NLA_POLICY_MAX(NLA_U8, 15),
356 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
357 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
358 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
359 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
360 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
361 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
362 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
363 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
364 };
365
366 static const struct nla_policy
367 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
368 [NL80211_PMSR_TYPE_FTM] =
369 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
370 };
371
372 static const struct nla_policy
373 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
374 [NL80211_PMSR_REQ_ATTR_DATA] =
375 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
376 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
377 };
378
379 static const struct nla_policy
380 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
381 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
382 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
383 [NL80211_PMSR_PEER_ATTR_REQ] =
384 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
385 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
386 };
387
388 static const struct nla_policy
389 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
390 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
391 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
392 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
393 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
394 [NL80211_PMSR_ATTR_PEERS] =
395 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
396 };
397
398 static const struct nla_policy
399 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
400 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
401 NLA_POLICY_RANGE(NLA_U8, 1, 20),
402 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
403 NLA_POLICY_RANGE(NLA_U8, 1, 20),
404 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
405 NLA_POLICY_RANGE(NLA_U8, 1, 20),
406 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
407 NLA_POLICY_EXACT_LEN(8),
408 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
409 NLA_POLICY_EXACT_LEN(8),
410 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
411 };
412
413 static const struct nla_policy
414 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
415 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
416 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
417 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
418 };
419
420 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
421 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
422 .len = NL80211_MAX_SUPP_RATES },
423 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
424 .len = NL80211_MAX_SUPP_HT_RATES },
425 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
426 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
427 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
428 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
429 NL80211_RATE_INFO_HE_GI_0_8,
430 NL80211_RATE_INFO_HE_GI_3_2),
431 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
432 NL80211_RATE_INFO_HE_1XLTF,
433 NL80211_RATE_INFO_HE_4XLTF),
434 [NL80211_TXRATE_EHT] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_eht)),
435 [NL80211_TXRATE_EHT_GI] = NLA_POLICY_RANGE(NLA_U8,
436 NL80211_RATE_INFO_EHT_GI_0_8,
437 NL80211_RATE_INFO_EHT_GI_3_2),
438 [NL80211_TXRATE_EHT_LTF] = NLA_POLICY_RANGE(NLA_U8,
439 NL80211_RATE_INFO_EHT_1XLTF,
440 NL80211_RATE_INFO_EHT_8XLTF),
441
442 };
443
444 static const struct nla_policy
445 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
446 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
447 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
448 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
449 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
450 [NL80211_TID_CONFIG_ATTR_NOACK] =
451 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
452 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
453 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
454 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
455 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
456 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
457 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
458 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
459 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
460 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
461 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
462 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
463 NLA_POLICY_NESTED(nl80211_txattr_policy),
464 };
465
466 static const struct nla_policy
467 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
468 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
469 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
470 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
471 NLA_POLICY_RANGE(NLA_BINARY,
472 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
473 IEEE80211_MAX_DATA_LEN),
474 };
475
476 static const struct nla_policy
477 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
478 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
479 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
480 .len = IEEE80211_MAX_DATA_LEN }
481 };
482
483 static const struct nla_policy
484 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
485 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
486 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
487 };
488
489 static const struct nla_policy
490 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
491 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
492 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
493 };
494
495 static const struct nla_policy
496 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
497 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
498 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
499 NLA_POLICY_MIN(NLA_U8, 1),
500 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
501 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
502 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
503 [NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
504 NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
505 };
506
507 static const struct nla_policy
508 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
509 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
510 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
511 };
512
513 static const struct nla_policy
514 nl80211_s1g_short_beacon[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1] = {
515 [NL80211_S1G_SHORT_BEACON_ATTR_HEAD] =
516 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
517 IEEE80211_MAX_DATA_LEN),
518 [NL80211_S1G_SHORT_BEACON_ATTR_TAIL] =
519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
520 IEEE80211_MAX_DATA_LEN),
521 };
522
523 static const struct nla_policy
524 nl80211_nan_band_conf_policy[NL80211_NAN_BAND_CONF_ATTR_MAX + 1] = {
525 [NL80211_NAN_BAND_CONF_BAND] = NLA_POLICY_MAX(NLA_U8,
526 NUM_NL80211_BANDS - 1),
527 [NL80211_NAN_BAND_CONF_FREQ] = { .type = NLA_U16 },
528 [NL80211_NAN_BAND_CONF_RSSI_CLOSE] = NLA_POLICY_MIN(NLA_S8, -59),
529 [NL80211_NAN_BAND_CONF_RSSI_MIDDLE] = NLA_POLICY_MIN(NLA_S8, -74),
530 [NL80211_NAN_BAND_CONF_WAKE_DW] = NLA_POLICY_MAX(NLA_U8, 5),
531 [NL80211_NAN_BAND_CONF_DISABLE_SCAN] = { .type = NLA_FLAG },
532 };
533
534 static const struct nla_policy
535 nl80211_nan_conf_policy[NL80211_NAN_CONF_ATTR_MAX + 1] = {
536 [NL80211_NAN_CONF_CLUSTER_ID] =
537 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_nan_cluster_id,
538 ETH_ALEN),
539 [NL80211_NAN_CONF_EXTRA_ATTRS] = { .type = NLA_BINARY,
540 .len = IEEE80211_MAX_DATA_LEN},
541 [NL80211_NAN_CONF_VENDOR_ELEMS] =
542 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
543 IEEE80211_MAX_DATA_LEN),
544 [NL80211_NAN_CONF_BAND_CONFIGS] =
545 NLA_POLICY_NESTED_ARRAY(nl80211_nan_band_conf_policy),
546 [NL80211_NAN_CONF_SCAN_PERIOD] = { .type = NLA_U16 },
547 [NL80211_NAN_CONF_SCAN_DWELL_TIME] = NLA_POLICY_RANGE(NLA_U16, 50, 512),
548 [NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL] =
549 NLA_POLICY_RANGE(NLA_U8, 50, 200),
550 [NL80211_NAN_CONF_NOTIFY_DW] = { .type = NLA_FLAG },
551 };
552
553 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
554 .min = 0,
555 .max = 0xffff,
556 };
557
558 static const struct netlink_range_validation q_range = {
559 .max = INT_MAX,
560 };
561
562 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
563 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
564 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
565 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
566 .len = 20-1 },
567 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
568
569 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
570 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
571 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
572 NL80211_EDMG_CHANNELS_MIN,
573 NL80211_EDMG_CHANNELS_MAX),
574 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
575 NL80211_EDMG_BW_CONFIG_MIN,
576 NL80211_EDMG_BW_CONFIG_MAX),
577
578 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
579 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
580 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
581 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
582
583 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
584 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
585 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
586 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
587 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
588 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
589
590 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
591 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
592 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
593
594 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
595 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
596
597 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
598 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
599 .len = WLAN_MAX_KEY_LEN },
600 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
601 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
602 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
603 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
604 [NL80211_ATTR_KEY_TYPE] =
605 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
606
607 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
608 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
609 [NL80211_ATTR_BEACON_HEAD] =
610 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
611 IEEE80211_MAX_DATA_LEN),
612 [NL80211_ATTR_BEACON_TAIL] =
613 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
614 IEEE80211_MAX_DATA_LEN),
615 [NL80211_ATTR_STA_AID] =
616 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
617 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
618 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
619 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
620 .len = NL80211_MAX_SUPP_RATES },
621 [NL80211_ATTR_STA_PLINK_ACTION] =
622 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
623 [NL80211_ATTR_STA_TX_POWER_SETTING] =
624 NLA_POLICY_RANGE(NLA_U8,
625 NL80211_TX_POWER_AUTOMATIC,
626 NL80211_TX_POWER_FIXED),
627 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
628 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
629 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
630 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
631 .len = IEEE80211_MAX_MESH_ID_LEN },
632 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
633
634 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
635 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
636 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
637
638 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
639 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
640 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
641 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
642 .len = NL80211_MAX_SUPP_RATES },
643 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
644
645 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
646 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
647
648 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
649
650 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
651 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
652 validate_ie_attr,
653 IEEE80211_MAX_DATA_LEN),
654 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
655 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
656
657 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
658 .len = IEEE80211_MAX_SSID_LEN },
659 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
660 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
661 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
662 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
663 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
664 NL80211_MFP_NO,
665 NL80211_MFP_OPTIONAL),
666 [NL80211_ATTR_STA_FLAGS2] =
667 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
668 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
669 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
670 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
671 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
672 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
673 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
674 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
675 [NL80211_ATTR_WPA_VERSIONS] =
676 NLA_POLICY_RANGE(NLA_U32, 0,
677 NL80211_WPA_VERSION_1 |
678 NL80211_WPA_VERSION_2 |
679 NL80211_WPA_VERSION_3),
680 [NL80211_ATTR_PID] = { .type = NLA_U32 },
681 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
682 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
683 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
684 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
685 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
686 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
687 .len = IEEE80211_MAX_DATA_LEN },
688 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
689 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
690 NL80211_PS_DISABLED,
691 NL80211_PS_ENABLED),
692 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
693 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
694 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
695 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
696 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
697 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
698 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
699 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
700 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
701 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
702 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
703 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
704 [NL80211_ATTR_STA_PLINK_STATE] =
705 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
706 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
707 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
708 [NL80211_ATTR_MESH_PEER_AID] =
709 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
710 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
711 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
712 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
713 [NL80211_ATTR_HIDDEN_SSID] =
714 NLA_POLICY_RANGE(NLA_U32,
715 NL80211_HIDDEN_SSID_NOT_IN_USE,
716 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
717 [NL80211_ATTR_IE_PROBE_RESP] =
718 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
719 IEEE80211_MAX_DATA_LEN),
720 [NL80211_ATTR_IE_ASSOC_RESP] =
721 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
722 IEEE80211_MAX_DATA_LEN),
723 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
724 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
725 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
726 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
727 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
728 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
729 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
730 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
731 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
732 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
733 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
734 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
735 .len = IEEE80211_MAX_DATA_LEN },
736 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
737 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
738 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
739 .len = NL80211_HT_CAPABILITY_LEN
740 },
741 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
742 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
743 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
744 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
745 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
746
747 /* need to include at least Auth Transaction and Status Code */
748 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
749
750 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
751 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
752 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
753 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
754 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
755 NLA_POLICY_RANGE(NLA_U32,
756 NL80211_MESH_POWER_UNKNOWN + 1,
757 NL80211_MESH_POWER_MAX),
758 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
759 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
760 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
761 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
762 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
763 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
764 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
765 .len = NL80211_VHT_CAPABILITY_LEN,
766 },
767 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
768 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
769 .len = IEEE80211_MAX_DATA_LEN },
770 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
771 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
772 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
773 [NL80211_ATTR_PEER_AID] =
774 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
775 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
776 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
777 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
778 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
779 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
780 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
781 /*
782 * The value of the Length field of the Supported Operating
783 * Classes element is between 2 and 253.
784 */
785 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
786 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
787 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
788 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
789 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
790 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
791 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
792 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
793 IEEE80211_QOS_MAP_LEN_MIN,
794 IEEE80211_QOS_MAP_LEN_MAX),
795 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
796 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
797 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
798 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
799 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
800 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
801 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
802 [NL80211_ATTR_USER_PRIO] =
803 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
804 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
805 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
806 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
807 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
808 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
809 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
810 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
811 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
812 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
813 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
814 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
815 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
816 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
817 .len = VHT_MUMIMO_GROUPS_DATA_LEN
818 },
819 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
820 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
821 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
822 [NL80211_ATTR_NAN_CONFIG] = NLA_POLICY_NESTED(nl80211_nan_conf_policy),
823 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
824 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
825 .len = FILS_MAX_KEK_LEN },
826 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
827 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
828 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
829 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
830 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
831 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
832 },
833 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
834 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
835 .len = FILS_ERP_MAX_USERNAME_LEN },
836 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
837 .len = FILS_ERP_MAX_REALM_LEN },
838 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
839 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
840 .len = FILS_ERP_MAX_RRK_LEN },
841 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
842 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
843 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
844 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
845 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
846
847 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
848 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
849 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
850 [NL80211_ATTR_HE_CAPABILITY] =
851 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
852 NL80211_HE_MAX_CAPABILITY_LEN),
853 [NL80211_ATTR_FTM_RESPONDER] =
854 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
855 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
856 [NL80211_ATTR_PEER_MEASUREMENTS] =
857 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
858 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
859 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
860 .len = SAE_PASSWORD_MAX_LEN },
861 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
862 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
863 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
864 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
865 [NL80211_ATTR_TID_CONFIG] =
866 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
867 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
868 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
869 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
870 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
871 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
872 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
873 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
874 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
875 [NL80211_ATTR_FILS_DISCOVERY] =
876 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
877 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
878 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
879 [NL80211_ATTR_S1G_CAPABILITY] =
880 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
881 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
882 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
883 [NL80211_ATTR_SAE_PWE] =
884 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
885 NL80211_SAE_PWE_BOTH),
886 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
887 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
888 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
889 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
890 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
891 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
892 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
893 [NL80211_ATTR_MBSSID_CONFIG] =
894 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
895 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
896 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
897 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
898 [NL80211_ATTR_EHT_CAPABILITY] =
899 NLA_POLICY_RANGE(NLA_BINARY,
900 NL80211_EHT_MIN_CAPABILITY_LEN,
901 NL80211_EHT_MAX_CAPABILITY_LEN),
902 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
903 [NL80211_ATTR_MLO_LINKS] =
904 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
905 [NL80211_ATTR_MLO_LINK_ID] =
906 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
907 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
908 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
909 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
910 [NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
911 [NL80211_ATTR_PUNCT_BITMAP] =
912 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
913
914 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
915 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
916 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
917 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
918 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
919 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
920 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
921 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
922 [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
923 [NL80211_ATTR_SUPPORTED_SELECTORS] =
924 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
925 NL80211_MAX_SUPP_SELECTORS),
926 [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
927 [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
928 [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
929 [NL80211_ATTR_WIPHY_RADIO_INDEX] = { .type = NLA_U8 },
930 [NL80211_ATTR_S1G_LONG_BEACON_PERIOD] = NLA_POLICY_MIN(NLA_U8, 2),
931 [NL80211_ATTR_S1G_SHORT_BEACON] =
932 NLA_POLICY_NESTED(nl80211_s1g_short_beacon),
933 [NL80211_ATTR_BSS_PARAM] = { .type = NLA_FLAG },
934 [NL80211_ATTR_S1G_PRIMARY_2MHZ] = { .type = NLA_FLAG },
935 };
936
937 /* policy for the key attributes */
938 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
939 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
940 [NL80211_KEY_IDX] = { .type = NLA_U8 },
941 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
942 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
943 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
944 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
945 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
946 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
947 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
948 };
949
950 /* policy for the key default flags */
951 static const struct nla_policy
952 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
953 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
954 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
955 };
956
957 #ifdef CONFIG_PM
958 /* policy for WoWLAN attributes */
959 static const struct nla_policy
960 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
961 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
962 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
963 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
964 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
965 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
966 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
967 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
968 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
969 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
970 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
971 };
972
973 static const struct nla_policy
974 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
975 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
976 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
977 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
978 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
979 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
980 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
981 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
982 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
983 },
984 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
985 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
986 },
987 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
988 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
989 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
990 };
991 #endif /* CONFIG_PM */
992
993 /* policy for coalesce rule attributes */
994 static const struct nla_policy
995 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
996 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
997 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
998 NLA_POLICY_RANGE(NLA_U32,
999 NL80211_COALESCE_CONDITION_MATCH,
1000 NL80211_COALESCE_CONDITION_NO_MATCH),
1001 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
1002 };
1003
1004 /* policy for GTK rekey offload attributes */
1005 static const struct nla_policy
1006 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
1007 [NL80211_REKEY_DATA_KEK] = {
1008 .type = NLA_BINARY,
1009 .len = NL80211_KEK_EXT_LEN
1010 },
1011 [NL80211_REKEY_DATA_KCK] = {
1012 .type = NLA_BINARY,
1013 .len = NL80211_KCK_EXT_LEN_32
1014 },
1015 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
1016 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
1017 };
1018
1019 static const struct nla_policy
1020 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
1021 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
1022 .len = IEEE80211_MAX_SSID_LEN },
1023 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1024 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
1025 };
1026
1027 static const struct nla_policy
1028 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
1029 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
1030 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
1031 };
1032
1033 static const struct nla_policy
1034 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
1035 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
1036 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
1037 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
1038 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
1039 },
1040 };
1041
1042 /* policy for NAN function attributes */
1043 static const struct nla_policy
1044 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
1045 [NL80211_NAN_FUNC_TYPE] =
1046 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
1047 [NL80211_NAN_FUNC_SERVICE_ID] = {
1048 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
1049 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
1050 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
1051 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
1052 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
1053 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
1054 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1055 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
1056 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
1057 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
1058 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
1059 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
1060 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
1061 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
1062 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
1063 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
1064 };
1065
1066 /* policy for Service Response Filter attributes */
1067 static const struct nla_policy
1068 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
1069 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
1070 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
1071 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
1072 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
1073 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
1074 };
1075
1076 /* policy for packet pattern attributes */
1077 static const struct nla_policy
1078 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
1079 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
1080 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1081 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1082 };
1083
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)1084 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1085 struct cfg80211_registered_device **rdev,
1086 struct wireless_dev **wdev,
1087 struct nlattr **attrbuf)
1088 {
1089 int err;
1090
1091 if (!cb->args[0]) {
1092 struct nlattr **attrbuf_free = NULL;
1093
1094 if (!attrbuf) {
1095 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1096 GFP_KERNEL);
1097 if (!attrbuf)
1098 return -ENOMEM;
1099 attrbuf_free = attrbuf;
1100 }
1101
1102 err = nlmsg_parse_deprecated(cb->nlh,
1103 GENL_HDRLEN + nl80211_fam.hdrsize,
1104 attrbuf, nl80211_fam.maxattr,
1105 nl80211_policy, NULL);
1106 if (err) {
1107 kfree(attrbuf_free);
1108 return err;
1109 }
1110
1111 rtnl_lock();
1112 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1113 attrbuf);
1114 kfree(attrbuf_free);
1115 if (IS_ERR(*wdev)) {
1116 rtnl_unlock();
1117 return PTR_ERR(*wdev);
1118 }
1119 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1120 mutex_lock(&(*rdev)->wiphy.mtx);
1121 rtnl_unlock();
1122 /* 0 is the first index - add 1 to parse only once */
1123 cb->args[0] = (*rdev)->wiphy_idx + 1;
1124 cb->args[1] = (*wdev)->identifier;
1125 } else {
1126 /* subtract the 1 again here */
1127 struct wiphy *wiphy;
1128 struct wireless_dev *tmp;
1129
1130 rtnl_lock();
1131 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1132 if (!wiphy) {
1133 rtnl_unlock();
1134 return -ENODEV;
1135 }
1136 *rdev = wiphy_to_rdev(wiphy);
1137 *wdev = NULL;
1138
1139 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1140 if (tmp->identifier == cb->args[1]) {
1141 *wdev = tmp;
1142 break;
1143 }
1144 }
1145
1146 if (!*wdev) {
1147 rtnl_unlock();
1148 return -ENODEV;
1149 }
1150 mutex_lock(&(*rdev)->wiphy.mtx);
1151 rtnl_unlock();
1152 }
1153
1154 return 0;
1155 }
1156
1157 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1158 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1159 int flags, u8 cmd)
1160 {
1161 /* since there is no private header just add the generic one */
1162 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1163 }
1164
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1165 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1166 const struct ieee80211_reg_rule *rule)
1167 {
1168 int j;
1169 struct nlattr *nl_wmm_rules =
1170 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1171
1172 if (!nl_wmm_rules)
1173 goto nla_put_failure;
1174
1175 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1176 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1177
1178 if (!nl_wmm_rule)
1179 goto nla_put_failure;
1180
1181 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1182 rule->wmm_rule.client[j].cw_min) ||
1183 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1184 rule->wmm_rule.client[j].cw_max) ||
1185 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1186 rule->wmm_rule.client[j].aifsn) ||
1187 nla_put_u16(msg, NL80211_WMMR_TXOP,
1188 rule->wmm_rule.client[j].cot))
1189 goto nla_put_failure;
1190
1191 nla_nest_end(msg, nl_wmm_rule);
1192 }
1193 nla_nest_end(msg, nl_wmm_rules);
1194
1195 return 0;
1196
1197 nla_put_failure:
1198 return -ENOBUFS;
1199 }
1200
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1201 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1202 struct ieee80211_channel *chan,
1203 bool large)
1204 {
1205 /* Some channels must be completely excluded from the
1206 * list to protect old user-space tools from breaking
1207 */
1208 if (!large && chan->flags &
1209 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1210 return 0;
1211 if (!large && chan->freq_offset)
1212 return 0;
1213
1214 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1215 chan->center_freq))
1216 goto nla_put_failure;
1217
1218 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1219 goto nla_put_failure;
1220
1221 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1222 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1223 goto nla_put_failure;
1224
1225 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1226 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1227 goto nla_put_failure;
1228 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1229 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1230 goto nla_put_failure;
1231 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1232 goto nla_put_failure;
1233 }
1234 if (chan->flags & IEEE80211_CHAN_RADAR) {
1235 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1236 goto nla_put_failure;
1237 if (large) {
1238 u32 time;
1239
1240 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1241
1242 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1243 chan->dfs_state))
1244 goto nla_put_failure;
1245 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1246 time))
1247 goto nla_put_failure;
1248 if (nla_put_u32(msg,
1249 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1250 chan->dfs_cac_ms))
1251 goto nla_put_failure;
1252 }
1253 }
1254
1255 if (large) {
1256 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1257 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1258 goto nla_put_failure;
1259 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1260 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1261 goto nla_put_failure;
1262 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1263 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1264 goto nla_put_failure;
1265 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1266 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1267 goto nla_put_failure;
1268 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1269 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1270 goto nla_put_failure;
1271 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1272 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1273 goto nla_put_failure;
1274 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1275 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1276 goto nla_put_failure;
1277 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1278 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1279 goto nla_put_failure;
1280 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1281 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1282 goto nla_put_failure;
1283 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1284 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1285 goto nla_put_failure;
1286 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1287 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1288 goto nla_put_failure;
1289 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1290 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1291 goto nla_put_failure;
1292 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1293 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1294 goto nla_put_failure;
1295 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1296 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1297 goto nla_put_failure;
1298 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1299 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1300 goto nla_put_failure;
1301 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1302 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1303 goto nla_put_failure;
1304 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1305 nla_put_flag(msg,
1306 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1307 goto nla_put_failure;
1308 if ((chan->flags & IEEE80211_CHAN_NO_4MHZ) &&
1309 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_4MHZ))
1310 goto nla_put_failure;
1311 if ((chan->flags & IEEE80211_CHAN_NO_8MHZ) &&
1312 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_8MHZ))
1313 goto nla_put_failure;
1314 if ((chan->flags & IEEE80211_CHAN_NO_16MHZ) &&
1315 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_16MHZ))
1316 goto nla_put_failure;
1317 }
1318
1319 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1320 DBM_TO_MBM(chan->max_power)))
1321 goto nla_put_failure;
1322
1323 if (large) {
1324 const struct ieee80211_reg_rule *rule =
1325 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1326
1327 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1328 if (nl80211_msg_put_wmm_rules(msg, rule))
1329 goto nla_put_failure;
1330 }
1331 }
1332
1333 return 0;
1334
1335 nla_put_failure:
1336 return -ENOBUFS;
1337 }
1338
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1339 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1340 struct cfg80211_txq_stats *txqstats,
1341 int attrtype)
1342 {
1343 struct nlattr *txqattr;
1344
1345 #define PUT_TXQVAL_U32(attr, memb) do { \
1346 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1347 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1348 return false; \
1349 } while (0)
1350
1351 txqattr = nla_nest_start_noflag(msg, attrtype);
1352 if (!txqattr)
1353 return false;
1354
1355 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1356 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1357 PUT_TXQVAL_U32(FLOWS, flows);
1358 PUT_TXQVAL_U32(DROPS, drops);
1359 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1360 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1361 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1362 PUT_TXQVAL_U32(COLLISIONS, collisions);
1363 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1364 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1365 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1366 nla_nest_end(msg, txqattr);
1367
1368 #undef PUT_TXQVAL_U32
1369 return true;
1370 }
1371
1372 /* netlink command implementations */
1373
1374 /**
1375 * nl80211_link_id - return link ID
1376 * @attrs: attributes to look at
1377 *
1378 * Returns: the link ID or 0 if not given
1379 *
1380 * Note this function doesn't do any validation of the link
1381 * ID validity wrt. links that were actually added, so it must
1382 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1383 * or if additional validation is done.
1384 */
nl80211_link_id(struct nlattr ** attrs)1385 static unsigned int nl80211_link_id(struct nlattr **attrs)
1386 {
1387 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1388
1389 return nla_get_u8_default(linkid, 0);
1390 }
1391
nl80211_link_id_or_invalid(struct nlattr ** attrs)1392 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1393 {
1394 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1395
1396 if (!linkid)
1397 return -1;
1398
1399 return nla_get_u8(linkid);
1400 }
1401
1402 struct key_parse {
1403 struct key_params p;
1404 int idx;
1405 int type;
1406 bool def, defmgmt, defbeacon;
1407 bool def_uni, def_multi;
1408 };
1409
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1410 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1411 struct key_parse *k)
1412 {
1413 struct nlattr *tb[NL80211_KEY_MAX + 1];
1414 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1415 nl80211_key_policy,
1416 info->extack);
1417 if (err)
1418 return err;
1419
1420 k->def = !!tb[NL80211_KEY_DEFAULT];
1421 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1422 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1423
1424 if (k->def) {
1425 k->def_uni = true;
1426 k->def_multi = true;
1427 }
1428 if (k->defmgmt || k->defbeacon)
1429 k->def_multi = true;
1430
1431 if (tb[NL80211_KEY_IDX])
1432 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1433
1434 if (tb[NL80211_KEY_DATA]) {
1435 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1436 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1437 }
1438
1439 if (tb[NL80211_KEY_SEQ]) {
1440 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1441 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1442 }
1443
1444 if (tb[NL80211_KEY_CIPHER])
1445 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1446
1447 if (tb[NL80211_KEY_TYPE])
1448 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1449
1450 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1451 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1452
1453 err = nla_parse_nested_deprecated(kdt,
1454 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1455 tb[NL80211_KEY_DEFAULT_TYPES],
1456 nl80211_key_default_policy,
1457 info->extack);
1458 if (err)
1459 return err;
1460
1461 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1462 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1463 }
1464
1465 if (tb[NL80211_KEY_MODE])
1466 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1467
1468 return 0;
1469 }
1470
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1471 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1472 {
1473 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1474 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1475 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1476 }
1477
1478 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1479 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1480 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1481 }
1482
1483 if (info->attrs[NL80211_ATTR_KEY_IDX])
1484 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1485
1486 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1487 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1488
1489 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1490 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1491
1492 if (k->def) {
1493 k->def_uni = true;
1494 k->def_multi = true;
1495 }
1496 if (k->defmgmt)
1497 k->def_multi = true;
1498
1499 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1500 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1501
1502 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1503 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1504 int err = nla_parse_nested_deprecated(kdt,
1505 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1506 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1507 nl80211_key_default_policy,
1508 info->extack);
1509 if (err)
1510 return err;
1511
1512 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1513 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1514 }
1515
1516 return 0;
1517 }
1518
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1519 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1520 {
1521 int err;
1522
1523 memset(k, 0, sizeof(*k));
1524 k->idx = -1;
1525 k->type = -1;
1526
1527 if (info->attrs[NL80211_ATTR_KEY])
1528 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1529 else
1530 err = nl80211_parse_key_old(info, k);
1531
1532 if (err)
1533 return err;
1534
1535 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1536 (k->defbeacon ? 1 : 0) > 1) {
1537 GENL_SET_ERR_MSG(info,
1538 "key with multiple default flags is invalid");
1539 return -EINVAL;
1540 }
1541
1542 if (k->defmgmt || k->defbeacon) {
1543 if (k->def_uni || !k->def_multi) {
1544 GENL_SET_ERR_MSG(info,
1545 "defmgmt/defbeacon key must be mcast");
1546 return -EINVAL;
1547 }
1548 }
1549
1550 if (k->idx != -1) {
1551 if (k->defmgmt) {
1552 if (k->idx < 4 || k->idx > 5) {
1553 GENL_SET_ERR_MSG(info,
1554 "defmgmt key idx not 4 or 5");
1555 return -EINVAL;
1556 }
1557 } else if (k->defbeacon) {
1558 if (k->idx < 6 || k->idx > 7) {
1559 GENL_SET_ERR_MSG(info,
1560 "defbeacon key idx not 6 or 7");
1561 return -EINVAL;
1562 }
1563 } else if (k->def) {
1564 if (k->idx < 0 || k->idx > 3) {
1565 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1566 return -EINVAL;
1567 }
1568 } else {
1569 if (k->idx < 0 || k->idx > 7) {
1570 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1571 return -EINVAL;
1572 }
1573 }
1574 }
1575
1576 return 0;
1577 }
1578
1579 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1580 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1581 struct genl_info *info, bool *no_ht)
1582 {
1583 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1584 struct key_parse parse;
1585 struct nlattr *key;
1586 struct cfg80211_cached_keys *result;
1587 int rem, err, def = 0;
1588 bool have_key = false;
1589
1590 nla_for_each_nested(key, keys, rem) {
1591 have_key = true;
1592 break;
1593 }
1594
1595 if (!have_key)
1596 return NULL;
1597
1598 result = kzalloc(sizeof(*result), GFP_KERNEL);
1599 if (!result)
1600 return ERR_PTR(-ENOMEM);
1601
1602 result->def = -1;
1603
1604 nla_for_each_nested(key, keys, rem) {
1605 memset(&parse, 0, sizeof(parse));
1606 parse.idx = -1;
1607
1608 err = nl80211_parse_key_new(info, key, &parse);
1609 if (err)
1610 goto error;
1611 err = -EINVAL;
1612 if (!parse.p.key)
1613 goto error;
1614 if (parse.idx < 0 || parse.idx > 3) {
1615 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1616 goto error;
1617 }
1618 if (parse.def) {
1619 if (def) {
1620 GENL_SET_ERR_MSG(info,
1621 "only one key can be default");
1622 goto error;
1623 }
1624 def = 1;
1625 result->def = parse.idx;
1626 if (!parse.def_uni || !parse.def_multi)
1627 goto error;
1628 } else if (parse.defmgmt)
1629 goto error;
1630 err = cfg80211_validate_key_settings(rdev, &parse.p,
1631 parse.idx, false, NULL);
1632 if (err)
1633 goto error;
1634 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1635 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1636 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1637 err = -EINVAL;
1638 goto error;
1639 }
1640 result->params[parse.idx].cipher = parse.p.cipher;
1641 result->params[parse.idx].key_len = parse.p.key_len;
1642 result->params[parse.idx].key = result->data[parse.idx];
1643 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1644
1645 /* must be WEP key if we got here */
1646 if (no_ht)
1647 *no_ht = true;
1648 }
1649
1650 if (result->def < 0) {
1651 err = -EINVAL;
1652 GENL_SET_ERR_MSG(info, "need a default/TX key");
1653 goto error;
1654 }
1655
1656 return result;
1657 error:
1658 kfree_sensitive(result);
1659 return ERR_PTR(err);
1660 }
1661
nl80211_key_allowed(struct wireless_dev * wdev)1662 static int nl80211_key_allowed(struct wireless_dev *wdev)
1663 {
1664 lockdep_assert_wiphy(wdev->wiphy);
1665
1666 switch (wdev->iftype) {
1667 case NL80211_IFTYPE_AP:
1668 case NL80211_IFTYPE_AP_VLAN:
1669 case NL80211_IFTYPE_P2P_GO:
1670 case NL80211_IFTYPE_MESH_POINT:
1671 break;
1672 case NL80211_IFTYPE_ADHOC:
1673 if (wdev->u.ibss.current_bss)
1674 return 0;
1675 return -ENOLINK;
1676 case NL80211_IFTYPE_STATION:
1677 case NL80211_IFTYPE_P2P_CLIENT:
1678 if (wdev->connected)
1679 return 0;
1680 return -ENOLINK;
1681 case NL80211_IFTYPE_NAN:
1682 if (wiphy_ext_feature_isset(wdev->wiphy,
1683 NL80211_EXT_FEATURE_SECURE_NAN))
1684 return 0;
1685 return -EINVAL;
1686 case NL80211_IFTYPE_UNSPECIFIED:
1687 case NL80211_IFTYPE_OCB:
1688 case NL80211_IFTYPE_MONITOR:
1689 case NL80211_IFTYPE_P2P_DEVICE:
1690 case NL80211_IFTYPE_WDS:
1691 case NUM_NL80211_IFTYPES:
1692 return -EINVAL;
1693 }
1694
1695 return 0;
1696 }
1697
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1698 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1699 u32 freq)
1700 {
1701 struct ieee80211_channel *chan;
1702
1703 chan = ieee80211_get_channel_khz(wiphy, freq);
1704 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1705 return NULL;
1706 return chan;
1707 }
1708
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1709 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1710 {
1711 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1712 int i;
1713
1714 if (!nl_modes)
1715 goto nla_put_failure;
1716
1717 i = 0;
1718 while (ifmodes) {
1719 if ((ifmodes & 1) && nla_put_flag(msg, i))
1720 goto nla_put_failure;
1721 ifmodes >>= 1;
1722 i++;
1723 }
1724
1725 nla_nest_end(msg, nl_modes);
1726 return 0;
1727
1728 nla_put_failure:
1729 return -ENOBUFS;
1730 }
1731
nl80211_put_ifcomb_data(struct sk_buff * msg,bool large,int idx,const struct ieee80211_iface_combination * c,u16 nested)1732 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1733 const struct ieee80211_iface_combination *c,
1734 u16 nested)
1735 {
1736 struct nlattr *nl_combi, *nl_limits;
1737 int i;
1738
1739 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1740 if (!nl_combi)
1741 goto nla_put_failure;
1742
1743 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1744 nested);
1745 if (!nl_limits)
1746 goto nla_put_failure;
1747
1748 for (i = 0; i < c->n_limits; i++) {
1749 struct nlattr *nl_limit;
1750
1751 nl_limit = nla_nest_start_noflag(msg, i + 1);
1752 if (!nl_limit)
1753 goto nla_put_failure;
1754 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1755 goto nla_put_failure;
1756 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1757 c->limits[i].types))
1758 goto nla_put_failure;
1759 nla_nest_end(msg, nl_limit);
1760 }
1761
1762 nla_nest_end(msg, nl_limits);
1763
1764 if (c->beacon_int_infra_match &&
1765 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1766 goto nla_put_failure;
1767 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1768 c->num_different_channels) ||
1769 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1770 c->max_interfaces))
1771 goto nla_put_failure;
1772 if (large &&
1773 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1774 c->radar_detect_widths) ||
1775 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1776 c->radar_detect_regions)))
1777 goto nla_put_failure;
1778 if (c->beacon_int_min_gcd &&
1779 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1780 c->beacon_int_min_gcd))
1781 goto nla_put_failure;
1782
1783 nla_nest_end(msg, nl_combi);
1784
1785 return 0;
1786 nla_put_failure:
1787 return -ENOBUFS;
1788 }
1789
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,int attr,int radio,bool large,u16 nested)1790 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1791 struct sk_buff *msg,
1792 int attr, int radio,
1793 bool large, u16 nested)
1794 {
1795 const struct ieee80211_iface_combination *c;
1796 struct nlattr *nl_combis;
1797 int i, n;
1798
1799 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1800 if (!nl_combis)
1801 goto nla_put_failure;
1802
1803 if (radio >= 0) {
1804 c = wiphy->radio[0].iface_combinations;
1805 n = wiphy->radio[0].n_iface_combinations;
1806 } else {
1807 c = wiphy->iface_combinations;
1808 n = wiphy->n_iface_combinations;
1809 }
1810 for (i = 0; i < n; i++)
1811 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1812 goto nla_put_failure;
1813
1814 nla_nest_end(msg, nl_combis);
1815
1816 return 0;
1817 nla_put_failure:
1818 return -ENOBUFS;
1819 }
1820
1821 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1822 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1823 struct sk_buff *msg)
1824 {
1825 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1826 struct nlattr *nl_tcp;
1827
1828 if (!tcp)
1829 return 0;
1830
1831 nl_tcp = nla_nest_start_noflag(msg,
1832 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1833 if (!nl_tcp)
1834 return -ENOBUFS;
1835
1836 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1837 tcp->data_payload_max))
1838 return -ENOBUFS;
1839
1840 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1841 tcp->data_payload_max))
1842 return -ENOBUFS;
1843
1844 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1845 return -ENOBUFS;
1846
1847 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1848 sizeof(*tcp->tok), tcp->tok))
1849 return -ENOBUFS;
1850
1851 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1852 tcp->data_interval_max))
1853 return -ENOBUFS;
1854
1855 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1856 tcp->wake_payload_max))
1857 return -ENOBUFS;
1858
1859 nla_nest_end(msg, nl_tcp);
1860 return 0;
1861 }
1862
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1863 static int nl80211_send_wowlan(struct sk_buff *msg,
1864 struct cfg80211_registered_device *rdev,
1865 bool large)
1866 {
1867 struct nlattr *nl_wowlan;
1868
1869 if (!rdev->wiphy.wowlan)
1870 return 0;
1871
1872 nl_wowlan = nla_nest_start_noflag(msg,
1873 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1874 if (!nl_wowlan)
1875 return -ENOBUFS;
1876
1877 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1878 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1879 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1880 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1881 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1882 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1883 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1884 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1885 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1886 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1887 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1888 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1889 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1890 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1891 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1892 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1893 return -ENOBUFS;
1894
1895 if (rdev->wiphy.wowlan->n_patterns) {
1896 struct nl80211_pattern_support pat = {
1897 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1898 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1899 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1900 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1901 };
1902
1903 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1904 sizeof(pat), &pat))
1905 return -ENOBUFS;
1906 }
1907
1908 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1909 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1910 rdev->wiphy.wowlan->max_nd_match_sets))
1911 return -ENOBUFS;
1912
1913 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1914 return -ENOBUFS;
1915
1916 nla_nest_end(msg, nl_wowlan);
1917
1918 return 0;
1919 }
1920 #endif
1921
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1922 static int nl80211_send_coalesce(struct sk_buff *msg,
1923 struct cfg80211_registered_device *rdev)
1924 {
1925 struct nl80211_coalesce_rule_support rule;
1926
1927 if (!rdev->wiphy.coalesce)
1928 return 0;
1929
1930 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1931 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1932 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1933 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1934 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1935 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1936
1937 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1938 return -ENOBUFS;
1939
1940 return 0;
1941 }
1942
1943 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1944 nl80211_send_iftype_data(struct sk_buff *msg,
1945 const struct ieee80211_supported_band *sband,
1946 const struct ieee80211_sband_iftype_data *iftdata)
1947 {
1948 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1949 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1950
1951 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1952 iftdata->types_mask))
1953 return -ENOBUFS;
1954
1955 if (he_cap->has_he) {
1956 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1957 sizeof(he_cap->he_cap_elem.mac_cap_info),
1958 he_cap->he_cap_elem.mac_cap_info) ||
1959 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1960 sizeof(he_cap->he_cap_elem.phy_cap_info),
1961 he_cap->he_cap_elem.phy_cap_info) ||
1962 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1963 sizeof(he_cap->he_mcs_nss_supp),
1964 &he_cap->he_mcs_nss_supp) ||
1965 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1966 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1967 return -ENOBUFS;
1968 }
1969
1970 if (eht_cap->has_eht && he_cap->has_he) {
1971 u8 mcs_nss_size, ppe_thresh_size;
1972 u16 ppe_thres_hdr;
1973 bool is_ap;
1974
1975 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1976 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1977
1978 mcs_nss_size =
1979 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1980 &eht_cap->eht_cap_elem,
1981 is_ap);
1982
1983 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1984 ppe_thresh_size =
1985 ieee80211_eht_ppe_size(ppe_thres_hdr,
1986 eht_cap->eht_cap_elem.phy_cap_info);
1987
1988 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1989 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1990 eht_cap->eht_cap_elem.mac_cap_info) ||
1991 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1992 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1993 eht_cap->eht_cap_elem.phy_cap_info) ||
1994 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1995 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1996 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1997 ppe_thresh_size, eht_cap->eht_ppe_thres))
1998 return -ENOBUFS;
1999 }
2000
2001 if (sband->band == NL80211_BAND_6GHZ &&
2002 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
2003 sizeof(iftdata->he_6ghz_capa),
2004 &iftdata->he_6ghz_capa))
2005 return -ENOBUFS;
2006
2007 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
2008 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
2009 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
2010 return -ENOBUFS;
2011
2012 return 0;
2013 }
2014
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)2015 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
2016 struct ieee80211_supported_band *sband,
2017 bool large)
2018 {
2019 struct nlattr *nl_rates, *nl_rate;
2020 struct ieee80211_rate *rate;
2021 int i;
2022
2023 /* add HT info */
2024 if (sband->ht_cap.ht_supported &&
2025 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
2026 sizeof(sband->ht_cap.mcs),
2027 &sband->ht_cap.mcs) ||
2028 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
2029 sband->ht_cap.cap) ||
2030 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
2031 sband->ht_cap.ampdu_factor) ||
2032 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
2033 sband->ht_cap.ampdu_density)))
2034 return -ENOBUFS;
2035
2036 /* add VHT info */
2037 if (sband->vht_cap.vht_supported &&
2038 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
2039 sizeof(sband->vht_cap.vht_mcs),
2040 &sband->vht_cap.vht_mcs) ||
2041 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
2042 sband->vht_cap.cap)))
2043 return -ENOBUFS;
2044
2045 if (large && sband->n_iftype_data) {
2046 struct nlattr *nl_iftype_data =
2047 nla_nest_start_noflag(msg,
2048 NL80211_BAND_ATTR_IFTYPE_DATA);
2049 const struct ieee80211_sband_iftype_data *iftd;
2050 int err;
2051
2052 if (!nl_iftype_data)
2053 return -ENOBUFS;
2054
2055 for_each_sband_iftype_data(sband, i, iftd) {
2056 struct nlattr *iftdata;
2057
2058 iftdata = nla_nest_start_noflag(msg, i + 1);
2059 if (!iftdata)
2060 return -ENOBUFS;
2061
2062 err = nl80211_send_iftype_data(msg, sband, iftd);
2063 if (err)
2064 return err;
2065
2066 nla_nest_end(msg, iftdata);
2067 }
2068
2069 nla_nest_end(msg, nl_iftype_data);
2070 }
2071
2072 /* add EDMG info */
2073 if (large && sband->edmg_cap.channels &&
2074 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2075 sband->edmg_cap.channels) ||
2076 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2077 sband->edmg_cap.bw_config)))
2078
2079 return -ENOBUFS;
2080
2081 /* add bitrates */
2082 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2083 if (!nl_rates)
2084 return -ENOBUFS;
2085
2086 for (i = 0; i < sband->n_bitrates; i++) {
2087 nl_rate = nla_nest_start_noflag(msg, i);
2088 if (!nl_rate)
2089 return -ENOBUFS;
2090
2091 rate = &sband->bitrates[i];
2092 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2093 rate->bitrate))
2094 return -ENOBUFS;
2095 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2096 nla_put_flag(msg,
2097 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2098 return -ENOBUFS;
2099
2100 nla_nest_end(msg, nl_rate);
2101 }
2102
2103 nla_nest_end(msg, nl_rates);
2104
2105 /* S1G capabilities */
2106 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2107 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2108 sizeof(sband->s1g_cap.cap),
2109 sband->s1g_cap.cap) ||
2110 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2111 sizeof(sband->s1g_cap.nss_mcs),
2112 sband->s1g_cap.nss_mcs)))
2113 return -ENOBUFS;
2114
2115 return 0;
2116 }
2117
2118 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)2119 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2120 const struct ieee80211_txrx_stypes *mgmt_stypes)
2121 {
2122 u16 stypes;
2123 struct nlattr *nl_ftypes, *nl_ifs;
2124 enum nl80211_iftype ift;
2125 int i;
2126
2127 if (!mgmt_stypes)
2128 return 0;
2129
2130 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2131 if (!nl_ifs)
2132 return -ENOBUFS;
2133
2134 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2135 nl_ftypes = nla_nest_start_noflag(msg, ift);
2136 if (!nl_ftypes)
2137 return -ENOBUFS;
2138 i = 0;
2139 stypes = mgmt_stypes[ift].tx;
2140 while (stypes) {
2141 if ((stypes & 1) &&
2142 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2143 (i << 4) | IEEE80211_FTYPE_MGMT))
2144 return -ENOBUFS;
2145 stypes >>= 1;
2146 i++;
2147 }
2148 nla_nest_end(msg, nl_ftypes);
2149 }
2150
2151 nla_nest_end(msg, nl_ifs);
2152
2153 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2154 if (!nl_ifs)
2155 return -ENOBUFS;
2156
2157 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2158 nl_ftypes = nla_nest_start_noflag(msg, ift);
2159 if (!nl_ftypes)
2160 return -ENOBUFS;
2161 i = 0;
2162 stypes = mgmt_stypes[ift].rx;
2163 while (stypes) {
2164 if ((stypes & 1) &&
2165 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2166 (i << 4) | IEEE80211_FTYPE_MGMT))
2167 return -ENOBUFS;
2168 stypes >>= 1;
2169 i++;
2170 }
2171 nla_nest_end(msg, nl_ftypes);
2172 }
2173 nla_nest_end(msg, nl_ifs);
2174
2175 return 0;
2176 }
2177
2178 #define CMD(op, n) \
2179 do { \
2180 if (rdev->ops->op) { \
2181 i++; \
2182 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2183 goto nla_put_failure; \
2184 } \
2185 } while (0)
2186
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2187 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2188 struct sk_buff *msg)
2189 {
2190 int i = 0;
2191
2192 /*
2193 * do *NOT* add anything into this function, new things need to be
2194 * advertised only to new versions of userspace that can deal with
2195 * the split (and they can't possibly care about new features...
2196 */
2197 CMD(add_virtual_intf, NEW_INTERFACE);
2198 CMD(change_virtual_intf, SET_INTERFACE);
2199 CMD(add_key, NEW_KEY);
2200 CMD(start_ap, START_AP);
2201 CMD(add_station, NEW_STATION);
2202 CMD(add_mpath, NEW_MPATH);
2203 CMD(update_mesh_config, SET_MESH_CONFIG);
2204 CMD(change_bss, SET_BSS);
2205 CMD(auth, AUTHENTICATE);
2206 CMD(assoc, ASSOCIATE);
2207 CMD(deauth, DEAUTHENTICATE);
2208 CMD(disassoc, DISASSOCIATE);
2209 CMD(join_ibss, JOIN_IBSS);
2210 CMD(join_mesh, JOIN_MESH);
2211 CMD(set_pmksa, SET_PMKSA);
2212 CMD(del_pmksa, DEL_PMKSA);
2213 CMD(flush_pmksa, FLUSH_PMKSA);
2214 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2215 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2216 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2217 CMD(mgmt_tx, FRAME);
2218 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2219 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2220 i++;
2221 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2222 goto nla_put_failure;
2223 }
2224 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2225 rdev->ops->join_mesh) {
2226 i++;
2227 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2228 goto nla_put_failure;
2229 }
2230 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2231 CMD(tdls_mgmt, TDLS_MGMT);
2232 CMD(tdls_oper, TDLS_OPER);
2233 }
2234 if (rdev->wiphy.max_sched_scan_reqs)
2235 CMD(sched_scan_start, START_SCHED_SCAN);
2236 CMD(probe_client, PROBE_CLIENT);
2237 CMD(set_noack_map, SET_NOACK_MAP);
2238 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2239 i++;
2240 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2241 goto nla_put_failure;
2242 }
2243 CMD(start_p2p_device, START_P2P_DEVICE);
2244 CMD(set_mcast_rate, SET_MCAST_RATE);
2245 #ifdef CONFIG_NL80211_TESTMODE
2246 CMD(testmode_cmd, TESTMODE);
2247 #endif
2248
2249 if (rdev->ops->connect || rdev->ops->auth) {
2250 i++;
2251 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2252 goto nla_put_failure;
2253 }
2254
2255 if (rdev->ops->disconnect || rdev->ops->deauth) {
2256 i++;
2257 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2258 goto nla_put_failure;
2259 }
2260
2261 return i;
2262 nla_put_failure:
2263 return -ENOBUFS;
2264 }
2265
2266 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2267 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2268 struct sk_buff *msg)
2269 {
2270 struct nlattr *ftm;
2271
2272 if (!cap->ftm.supported)
2273 return 0;
2274
2275 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2276 if (!ftm)
2277 return -ENOBUFS;
2278
2279 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2280 return -ENOBUFS;
2281 if (cap->ftm.non_asap &&
2282 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2283 return -ENOBUFS;
2284 if (cap->ftm.request_lci &&
2285 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2286 return -ENOBUFS;
2287 if (cap->ftm.request_civicloc &&
2288 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2289 return -ENOBUFS;
2290 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2291 cap->ftm.preambles))
2292 return -ENOBUFS;
2293 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2294 cap->ftm.bandwidths))
2295 return -ENOBUFS;
2296 if (cap->ftm.max_bursts_exponent >= 0 &&
2297 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2298 cap->ftm.max_bursts_exponent))
2299 return -ENOBUFS;
2300 if (cap->ftm.max_ftms_per_burst &&
2301 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2302 cap->ftm.max_ftms_per_burst))
2303 return -ENOBUFS;
2304 if (cap->ftm.trigger_based &&
2305 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2306 return -ENOBUFS;
2307 if (cap->ftm.non_trigger_based &&
2308 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2309 return -ENOBUFS;
2310
2311 nla_nest_end(msg, ftm);
2312 return 0;
2313 }
2314
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2315 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2316 struct sk_buff *msg)
2317 {
2318 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2319 struct nlattr *pmsr, *caps;
2320
2321 if (!cap)
2322 return 0;
2323
2324 /*
2325 * we don't need to clean up anything here since the caller
2326 * will genlmsg_cancel() if we fail
2327 */
2328
2329 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2330 if (!pmsr)
2331 return -ENOBUFS;
2332
2333 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2334 return -ENOBUFS;
2335
2336 if (cap->report_ap_tsf &&
2337 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2338 return -ENOBUFS;
2339
2340 if (cap->randomize_mac_addr &&
2341 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2342 return -ENOBUFS;
2343
2344 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2345 if (!caps)
2346 return -ENOBUFS;
2347
2348 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2349 return -ENOBUFS;
2350
2351 nla_nest_end(msg, caps);
2352 nla_nest_end(msg, pmsr);
2353
2354 return 0;
2355 }
2356
2357 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2358 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2359 struct sk_buff *msg)
2360 {
2361 int i;
2362 struct nlattr *nested, *nested_akms;
2363 const struct wiphy_iftype_akm_suites *iftype_akms;
2364
2365 if (!rdev->wiphy.num_iftype_akm_suites ||
2366 !rdev->wiphy.iftype_akm_suites)
2367 return 0;
2368
2369 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2370 if (!nested)
2371 return -ENOBUFS;
2372
2373 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2374 nested_akms = nla_nest_start(msg, i + 1);
2375 if (!nested_akms)
2376 return -ENOBUFS;
2377
2378 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2379
2380 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2381 iftype_akms->iftypes_mask))
2382 return -ENOBUFS;
2383
2384 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2385 sizeof(u32) * iftype_akms->n_akm_suites,
2386 iftype_akms->akm_suites)) {
2387 return -ENOBUFS;
2388 }
2389 nla_nest_end(msg, nested_akms);
2390 }
2391
2392 nla_nest_end(msg, nested);
2393
2394 return 0;
2395 }
2396
2397 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2398 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2399 struct sk_buff *msg)
2400 {
2401 struct nlattr *supp;
2402
2403 if (!rdev->wiphy.tid_config_support.vif &&
2404 !rdev->wiphy.tid_config_support.peer)
2405 return 0;
2406
2407 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2408 if (!supp)
2409 return -ENOSPC;
2410
2411 if (rdev->wiphy.tid_config_support.vif &&
2412 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2413 rdev->wiphy.tid_config_support.vif,
2414 NL80211_TID_CONFIG_ATTR_PAD))
2415 goto fail;
2416
2417 if (rdev->wiphy.tid_config_support.peer &&
2418 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2419 rdev->wiphy.tid_config_support.peer,
2420 NL80211_TID_CONFIG_ATTR_PAD))
2421 goto fail;
2422
2423 /* for now we just use the same value ... makes more sense */
2424 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2425 rdev->wiphy.tid_config_support.max_retry))
2426 goto fail;
2427 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2428 rdev->wiphy.tid_config_support.max_retry))
2429 goto fail;
2430
2431 nla_nest_end(msg, supp);
2432
2433 return 0;
2434 fail:
2435 nla_nest_cancel(msg, supp);
2436 return -ENOBUFS;
2437 }
2438
2439 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2440 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2441 struct sk_buff *msg)
2442 {
2443 struct nlattr *sar_capa, *specs, *sub_freq_range;
2444 u8 num_freq_ranges;
2445 int i;
2446
2447 if (!rdev->wiphy.sar_capa)
2448 return 0;
2449
2450 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2451
2452 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2453 if (!sar_capa)
2454 return -ENOSPC;
2455
2456 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2457 goto fail;
2458
2459 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2460 if (!specs)
2461 goto fail;
2462
2463 /* report supported freq_ranges */
2464 for (i = 0; i < num_freq_ranges; i++) {
2465 sub_freq_range = nla_nest_start(msg, i + 1);
2466 if (!sub_freq_range)
2467 goto fail;
2468
2469 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2470 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2471 goto fail;
2472
2473 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2474 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2475 goto fail;
2476
2477 nla_nest_end(msg, sub_freq_range);
2478 }
2479
2480 nla_nest_end(msg, specs);
2481 nla_nest_end(msg, sar_capa);
2482
2483 return 0;
2484 fail:
2485 nla_nest_cancel(msg, sar_capa);
2486 return -ENOBUFS;
2487 }
2488
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2489 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2490 {
2491 struct nlattr *config;
2492
2493 if (!wiphy->mbssid_max_interfaces)
2494 return 0;
2495
2496 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2497 if (!config)
2498 return -ENOBUFS;
2499
2500 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2501 wiphy->mbssid_max_interfaces))
2502 goto fail;
2503
2504 if (wiphy->ema_max_profile_periodicity &&
2505 nla_put_u8(msg,
2506 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2507 wiphy->ema_max_profile_periodicity))
2508 goto fail;
2509
2510 nla_nest_end(msg, config);
2511 return 0;
2512
2513 fail:
2514 nla_nest_cancel(msg, config);
2515 return -ENOBUFS;
2516 }
2517
nl80211_put_radio(struct wiphy * wiphy,struct sk_buff * msg,int idx)2518 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2519 {
2520 const struct wiphy_radio *r = &wiphy->radio[idx];
2521 const struct wiphy_radio_cfg *rcfg = &wiphy->radio_cfg[idx];
2522 struct nlattr *radio, *freq;
2523 int i;
2524
2525 radio = nla_nest_start(msg, idx);
2526 if (!radio)
2527 return -ENOBUFS;
2528
2529 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2530 goto nla_put_failure;
2531
2532 if (rcfg->rts_threshold &&
2533 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD,
2534 rcfg->rts_threshold))
2535 goto nla_put_failure;
2536
2537 if (r->antenna_mask &&
2538 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2539 r->antenna_mask))
2540 goto nla_put_failure;
2541
2542 for (i = 0; i < r->n_freq_range; i++) {
2543 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2544
2545 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2546 if (!freq)
2547 goto nla_put_failure;
2548
2549 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2550 range->start_freq) ||
2551 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2552 range->end_freq))
2553 goto nla_put_failure;
2554
2555 nla_nest_end(msg, freq);
2556 }
2557
2558 for (i = 0; i < r->n_iface_combinations; i++)
2559 if (nl80211_put_ifcomb_data(msg, true,
2560 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2561 &r->iface_combinations[i],
2562 NLA_F_NESTED))
2563 goto nla_put_failure;
2564
2565 nla_nest_end(msg, radio);
2566
2567 return 0;
2568
2569 nla_put_failure:
2570 return -ENOBUFS;
2571 }
2572
nl80211_put_radios(struct wiphy * wiphy,struct sk_buff * msg)2573 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2574 {
2575 struct nlattr *radios;
2576 int i;
2577
2578 if (!wiphy->n_radio)
2579 return 0;
2580
2581 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2582 if (!radios)
2583 return -ENOBUFS;
2584
2585 for (i = 0; i < wiphy->n_radio; i++)
2586 if (nl80211_put_radio(wiphy, msg, i))
2587 goto fail;
2588
2589 nla_nest_end(msg, radios);
2590
2591 if (nl80211_put_iface_combinations(wiphy, msg,
2592 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2593 -1, true, NLA_F_NESTED))
2594 return -ENOBUFS;
2595
2596 return 0;
2597
2598 fail:
2599 nla_nest_cancel(msg, radios);
2600 return -ENOBUFS;
2601 }
2602
nl80211_put_nan_capa(struct wiphy * wiphy,struct sk_buff * msg)2603 static int nl80211_put_nan_capa(struct wiphy *wiphy, struct sk_buff *msg)
2604 {
2605 struct nlattr *nan_caps;
2606
2607 nan_caps = nla_nest_start(msg, NL80211_ATTR_NAN_CAPABILITIES);
2608 if (!nan_caps)
2609 return -ENOBUFS;
2610
2611 if (wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC &&
2612 nla_put_flag(msg, NL80211_NAN_CAPA_CONFIGURABLE_SYNC))
2613 goto fail;
2614
2615 if ((wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_USERSPACE_DE) &&
2616 nla_put_flag(msg, NL80211_NAN_CAPA_USERSPACE_DE))
2617 goto fail;
2618
2619 if (nla_put_u8(msg, NL80211_NAN_CAPA_OP_MODE,
2620 wiphy->nan_capa.op_mode) ||
2621 nla_put_u8(msg, NL80211_NAN_CAPA_NUM_ANTENNAS,
2622 wiphy->nan_capa.n_antennas) ||
2623 nla_put_u16(msg, NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME,
2624 wiphy->nan_capa.max_channel_switch_time) ||
2625 nla_put_u8(msg, NL80211_NAN_CAPA_CAPABILITIES,
2626 wiphy->nan_capa.dev_capabilities))
2627 goto fail;
2628
2629 nla_nest_end(msg, nan_caps);
2630
2631 return 0;
2632
2633 fail:
2634 nla_nest_cancel(msg, nan_caps);
2635 return -ENOBUFS;
2636 }
2637
2638 struct nl80211_dump_wiphy_state {
2639 s64 filter_wiphy;
2640 long start;
2641 long split_start, band_start, chan_start, capa_start;
2642 bool split;
2643 };
2644
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2645 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2646 enum nl80211_commands cmd,
2647 struct sk_buff *msg, u32 portid, u32 seq,
2648 int flags, struct nl80211_dump_wiphy_state *state)
2649 {
2650 void *hdr;
2651 struct nlattr *nl_bands, *nl_band;
2652 struct nlattr *nl_freqs, *nl_freq;
2653 struct nlattr *nl_cmds;
2654 enum nl80211_band band;
2655 struct ieee80211_channel *chan;
2656 int i;
2657 const struct ieee80211_txrx_stypes *mgmt_stypes =
2658 rdev->wiphy.mgmt_stypes;
2659 u32 features;
2660
2661 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2662 if (!hdr)
2663 return -ENOBUFS;
2664
2665 if (WARN_ON(!state))
2666 return -EINVAL;
2667
2668 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2669 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2670 wiphy_name(&rdev->wiphy)) ||
2671 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2672 cfg80211_rdev_list_generation))
2673 goto nla_put_failure;
2674
2675 if (cmd != NL80211_CMD_NEW_WIPHY)
2676 goto finish;
2677
2678 switch (state->split_start) {
2679 case 0:
2680 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2681 rdev->wiphy.retry_short) ||
2682 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2683 rdev->wiphy.retry_long) ||
2684 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2685 rdev->wiphy.frag_threshold) ||
2686 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2687 rdev->wiphy.rts_threshold) ||
2688 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2689 rdev->wiphy.coverage_class) ||
2690 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2691 rdev->wiphy.max_scan_ssids) ||
2692 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2693 rdev->wiphy.max_sched_scan_ssids) ||
2694 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2695 rdev->wiphy.max_scan_ie_len) ||
2696 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2697 rdev->wiphy.max_sched_scan_ie_len) ||
2698 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2699 rdev->wiphy.max_match_sets))
2700 goto nla_put_failure;
2701
2702 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2703 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2704 goto nla_put_failure;
2705 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2706 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2707 goto nla_put_failure;
2708 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2709 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2710 goto nla_put_failure;
2711 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2712 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2713 goto nla_put_failure;
2714 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2715 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2716 goto nla_put_failure;
2717 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2718 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2719 goto nla_put_failure;
2720 state->split_start++;
2721 if (state->split)
2722 break;
2723 fallthrough;
2724 case 1:
2725 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2726 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2727 rdev->wiphy.cipher_suites))
2728 goto nla_put_failure;
2729
2730 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2731 rdev->wiphy.max_num_pmkids))
2732 goto nla_put_failure;
2733
2734 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2735 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2736 goto nla_put_failure;
2737
2738 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2739 rdev->wiphy.available_antennas_tx) ||
2740 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2741 rdev->wiphy.available_antennas_rx))
2742 goto nla_put_failure;
2743
2744 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2745 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2746 rdev->wiphy.probe_resp_offload))
2747 goto nla_put_failure;
2748
2749 if ((rdev->wiphy.available_antennas_tx ||
2750 rdev->wiphy.available_antennas_rx) &&
2751 rdev->ops->get_antenna) {
2752 u32 tx_ant = 0, rx_ant = 0;
2753 int res;
2754
2755 res = rdev_get_antenna(rdev, -1, &tx_ant, &rx_ant);
2756 if (!res) {
2757 if (nla_put_u32(msg,
2758 NL80211_ATTR_WIPHY_ANTENNA_TX,
2759 tx_ant) ||
2760 nla_put_u32(msg,
2761 NL80211_ATTR_WIPHY_ANTENNA_RX,
2762 rx_ant))
2763 goto nla_put_failure;
2764 }
2765 }
2766
2767 state->split_start++;
2768 if (state->split)
2769 break;
2770 fallthrough;
2771 case 2:
2772 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2773 rdev->wiphy.interface_modes))
2774 goto nla_put_failure;
2775 state->split_start++;
2776 if (state->split)
2777 break;
2778 fallthrough;
2779 case 3:
2780 nl_bands = nla_nest_start_noflag(msg,
2781 NL80211_ATTR_WIPHY_BANDS);
2782 if (!nl_bands)
2783 goto nla_put_failure;
2784
2785 for (band = state->band_start;
2786 band < (state->split ?
2787 NUM_NL80211_BANDS :
2788 NL80211_BAND_60GHZ + 1);
2789 band++) {
2790 struct ieee80211_supported_band *sband;
2791
2792 /* omit higher bands for ancient software */
2793 if (band > NL80211_BAND_5GHZ && !state->split)
2794 break;
2795
2796 sband = rdev->wiphy.bands[band];
2797
2798 if (!sband)
2799 continue;
2800
2801 nl_band = nla_nest_start_noflag(msg, band);
2802 if (!nl_band)
2803 goto nla_put_failure;
2804
2805 switch (state->chan_start) {
2806 case 0:
2807 if (nl80211_send_band_rateinfo(msg, sband,
2808 state->split))
2809 goto nla_put_failure;
2810 state->chan_start++;
2811 if (state->split)
2812 break;
2813 fallthrough;
2814 default:
2815 /* add frequencies */
2816 nl_freqs = nla_nest_start_noflag(msg,
2817 NL80211_BAND_ATTR_FREQS);
2818 if (!nl_freqs)
2819 goto nla_put_failure;
2820
2821 for (i = state->chan_start - 1;
2822 i < sband->n_channels;
2823 i++) {
2824 nl_freq = nla_nest_start_noflag(msg,
2825 i);
2826 if (!nl_freq)
2827 goto nla_put_failure;
2828
2829 chan = &sband->channels[i];
2830
2831 if (nl80211_msg_put_channel(
2832 msg, &rdev->wiphy, chan,
2833 state->split))
2834 goto nla_put_failure;
2835
2836 nla_nest_end(msg, nl_freq);
2837 if (state->split)
2838 break;
2839 }
2840 if (i < sband->n_channels)
2841 state->chan_start = i + 2;
2842 else
2843 state->chan_start = 0;
2844 nla_nest_end(msg, nl_freqs);
2845 }
2846
2847 nla_nest_end(msg, nl_band);
2848
2849 if (state->split) {
2850 /* start again here */
2851 if (state->chan_start)
2852 band--;
2853 break;
2854 }
2855 }
2856 nla_nest_end(msg, nl_bands);
2857
2858 if (band < NUM_NL80211_BANDS)
2859 state->band_start = band + 1;
2860 else
2861 state->band_start = 0;
2862
2863 /* if bands & channels are done, continue outside */
2864 if (state->band_start == 0 && state->chan_start == 0)
2865 state->split_start++;
2866 if (state->split)
2867 break;
2868 fallthrough;
2869 case 4:
2870 nl_cmds = nla_nest_start_noflag(msg,
2871 NL80211_ATTR_SUPPORTED_COMMANDS);
2872 if (!nl_cmds)
2873 goto nla_put_failure;
2874
2875 i = nl80211_add_commands_unsplit(rdev, msg);
2876 if (i < 0)
2877 goto nla_put_failure;
2878 if (state->split) {
2879 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2880 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2881 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2882 CMD(channel_switch, CHANNEL_SWITCH);
2883 CMD(set_qos_map, SET_QOS_MAP);
2884 if (rdev->wiphy.features &
2885 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2886 CMD(add_tx_ts, ADD_TX_TS);
2887 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2888 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2889 CMD(update_ft_ies, UPDATE_FT_IES);
2890 if (rdev->wiphy.sar_capa)
2891 CMD(set_sar_specs, SET_SAR_SPECS);
2892 CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2893 }
2894 #undef CMD
2895
2896 nla_nest_end(msg, nl_cmds);
2897 state->split_start++;
2898 if (state->split)
2899 break;
2900 fallthrough;
2901 case 5:
2902 if (rdev->ops->remain_on_channel &&
2903 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2904 nla_put_u32(msg,
2905 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2906 rdev->wiphy.max_remain_on_channel_duration))
2907 goto nla_put_failure;
2908
2909 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2910 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2911 goto nla_put_failure;
2912
2913 state->split_start++;
2914 if (state->split)
2915 break;
2916 fallthrough;
2917 case 6:
2918 #ifdef CONFIG_PM
2919 if (nl80211_send_wowlan(msg, rdev, state->split))
2920 goto nla_put_failure;
2921 state->split_start++;
2922 if (state->split)
2923 break;
2924 #else
2925 state->split_start++;
2926 #endif
2927 fallthrough;
2928 case 7:
2929 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2930 rdev->wiphy.software_iftypes))
2931 goto nla_put_failure;
2932
2933 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2934 NL80211_ATTR_INTERFACE_COMBINATIONS,
2935 rdev->wiphy.n_radio ? 0 : -1,
2936 state->split, 0))
2937 goto nla_put_failure;
2938
2939 state->split_start++;
2940 if (state->split)
2941 break;
2942 fallthrough;
2943 case 8:
2944 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2945 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2946 rdev->wiphy.ap_sme_capa))
2947 goto nla_put_failure;
2948
2949 features = rdev->wiphy.features;
2950 /*
2951 * We can only add the per-channel limit information if the
2952 * dump is split, otherwise it makes it too big. Therefore
2953 * only advertise it in that case.
2954 */
2955 if (state->split)
2956 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2957 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2958 goto nla_put_failure;
2959
2960 if (rdev->wiphy.ht_capa_mod_mask &&
2961 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2962 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2963 rdev->wiphy.ht_capa_mod_mask))
2964 goto nla_put_failure;
2965
2966 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2967 rdev->wiphy.max_acl_mac_addrs &&
2968 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2969 rdev->wiphy.max_acl_mac_addrs))
2970 goto nla_put_failure;
2971
2972 /*
2973 * Any information below this point is only available to
2974 * applications that can deal with it being split. This
2975 * helps ensure that newly added capabilities don't break
2976 * older tools by overrunning their buffers.
2977 *
2978 * We still increment split_start so that in the split
2979 * case we'll continue with more data in the next round,
2980 * but break unconditionally so unsplit data stops here.
2981 */
2982 if (state->split)
2983 state->split_start++;
2984 else
2985 state->split_start = 0;
2986 break;
2987 case 9:
2988 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2989 goto nla_put_failure;
2990
2991 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2992 rdev->wiphy.max_sched_scan_plans) ||
2993 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2994 rdev->wiphy.max_sched_scan_plan_interval) ||
2995 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2996 rdev->wiphy.max_sched_scan_plan_iterations))
2997 goto nla_put_failure;
2998
2999 if (rdev->wiphy.extended_capabilities &&
3000 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
3001 rdev->wiphy.extended_capabilities_len,
3002 rdev->wiphy.extended_capabilities) ||
3003 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3004 rdev->wiphy.extended_capabilities_len,
3005 rdev->wiphy.extended_capabilities_mask)))
3006 goto nla_put_failure;
3007
3008 if (rdev->wiphy.vht_capa_mod_mask &&
3009 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
3010 sizeof(*rdev->wiphy.vht_capa_mod_mask),
3011 rdev->wiphy.vht_capa_mod_mask))
3012 goto nla_put_failure;
3013
3014 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3015 rdev->wiphy.perm_addr))
3016 goto nla_put_failure;
3017
3018 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
3019 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
3020 rdev->wiphy.addr_mask))
3021 goto nla_put_failure;
3022
3023 if (rdev->wiphy.n_addresses > 1) {
3024 void *attr;
3025
3026 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
3027 if (!attr)
3028 goto nla_put_failure;
3029
3030 for (i = 0; i < rdev->wiphy.n_addresses; i++)
3031 if (nla_put(msg, i + 1, ETH_ALEN,
3032 rdev->wiphy.addresses[i].addr))
3033 goto nla_put_failure;
3034
3035 nla_nest_end(msg, attr);
3036 }
3037
3038 state->split_start++;
3039 break;
3040 case 10:
3041 if (nl80211_send_coalesce(msg, rdev))
3042 goto nla_put_failure;
3043
3044 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
3045 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
3046 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
3047 goto nla_put_failure;
3048
3049 if (rdev->wiphy.max_ap_assoc_sta &&
3050 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
3051 rdev->wiphy.max_ap_assoc_sta))
3052 goto nla_put_failure;
3053
3054 state->split_start++;
3055 break;
3056 case 11:
3057 if (rdev->wiphy.n_vendor_commands) {
3058 const struct nl80211_vendor_cmd_info *info;
3059 struct nlattr *nested;
3060
3061 nested = nla_nest_start_noflag(msg,
3062 NL80211_ATTR_VENDOR_DATA);
3063 if (!nested)
3064 goto nla_put_failure;
3065
3066 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
3067 info = &rdev->wiphy.vendor_commands[i].info;
3068 if (nla_put(msg, i + 1, sizeof(*info), info))
3069 goto nla_put_failure;
3070 }
3071 nla_nest_end(msg, nested);
3072 }
3073
3074 if (rdev->wiphy.n_vendor_events) {
3075 const struct nl80211_vendor_cmd_info *info;
3076 struct nlattr *nested;
3077
3078 nested = nla_nest_start_noflag(msg,
3079 NL80211_ATTR_VENDOR_EVENTS);
3080 if (!nested)
3081 goto nla_put_failure;
3082
3083 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
3084 info = &rdev->wiphy.vendor_events[i];
3085 if (nla_put(msg, i + 1, sizeof(*info), info))
3086 goto nla_put_failure;
3087 }
3088 nla_nest_end(msg, nested);
3089 }
3090 state->split_start++;
3091 break;
3092 case 12:
3093 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
3094 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
3095 rdev->wiphy.max_num_csa_counters))
3096 goto nla_put_failure;
3097
3098 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
3099 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
3100 goto nla_put_failure;
3101
3102 if (rdev->wiphy.max_sched_scan_reqs &&
3103 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
3104 rdev->wiphy.max_sched_scan_reqs))
3105 goto nla_put_failure;
3106
3107 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
3108 sizeof(rdev->wiphy.ext_features),
3109 rdev->wiphy.ext_features))
3110 goto nla_put_failure;
3111
3112 if (rdev->wiphy.bss_param_support) {
3113 struct nlattr *nested;
3114 u32 parsup = rdev->wiphy.bss_param_support;
3115
3116 nested = nla_nest_start(msg, NL80211_ATTR_BSS_PARAM);
3117 if (!nested)
3118 goto nla_put_failure;
3119
3120 if ((parsup & WIPHY_BSS_PARAM_CTS_PROT) &&
3121 nla_put_flag(msg, NL80211_ATTR_BSS_CTS_PROT))
3122 goto nla_put_failure;
3123 if ((parsup & WIPHY_BSS_PARAM_SHORT_PREAMBLE) &&
3124 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE))
3125 goto nla_put_failure;
3126 if ((parsup & WIPHY_BSS_PARAM_SHORT_SLOT_TIME) &&
3127 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME))
3128 goto nla_put_failure;
3129 if ((parsup & WIPHY_BSS_PARAM_BASIC_RATES) &&
3130 nla_put_flag(msg, NL80211_ATTR_BSS_BASIC_RATES))
3131 goto nla_put_failure;
3132 if ((parsup & WIPHY_BSS_PARAM_AP_ISOLATE) &&
3133 nla_put_flag(msg, NL80211_ATTR_AP_ISOLATE))
3134 goto nla_put_failure;
3135 if ((parsup & WIPHY_BSS_PARAM_HT_OPMODE) &&
3136 nla_put_flag(msg, NL80211_ATTR_BSS_HT_OPMODE))
3137 goto nla_put_failure;
3138 if ((parsup & WIPHY_BSS_PARAM_P2P_CTWINDOW) &&
3139 nla_put_flag(msg, NL80211_ATTR_P2P_CTWINDOW))
3140 goto nla_put_failure;
3141 if ((parsup & WIPHY_BSS_PARAM_P2P_OPPPS) &&
3142 nla_put_flag(msg, NL80211_ATTR_P2P_OPPPS))
3143 goto nla_put_failure;
3144 nla_nest_end(msg, nested);
3145 }
3146 if (rdev->wiphy.bss_select_support) {
3147 struct nlattr *nested;
3148 u32 bss_select_support = rdev->wiphy.bss_select_support;
3149
3150 nested = nla_nest_start_noflag(msg,
3151 NL80211_ATTR_BSS_SELECT);
3152 if (!nested)
3153 goto nla_put_failure;
3154
3155 i = 0;
3156 while (bss_select_support) {
3157 if ((bss_select_support & 1) &&
3158 nla_put_flag(msg, i))
3159 goto nla_put_failure;
3160 i++;
3161 bss_select_support >>= 1;
3162 }
3163 nla_nest_end(msg, nested);
3164 }
3165
3166 state->split_start++;
3167 break;
3168 case 13:
3169 if (rdev->wiphy.num_iftype_ext_capab &&
3170 rdev->wiphy.iftype_ext_capab) {
3171 struct nlattr *nested_ext_capab, *nested;
3172
3173 nested = nla_nest_start_noflag(msg,
3174 NL80211_ATTR_IFTYPE_EXT_CAPA);
3175 if (!nested)
3176 goto nla_put_failure;
3177
3178 for (i = state->capa_start;
3179 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3180 const struct wiphy_iftype_ext_capab *capab;
3181
3182 capab = &rdev->wiphy.iftype_ext_capab[i];
3183
3184 nested_ext_capab = nla_nest_start_noflag(msg,
3185 i);
3186 if (!nested_ext_capab ||
3187 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3188 capab->iftype) ||
3189 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3190 capab->extended_capabilities_len,
3191 capab->extended_capabilities) ||
3192 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3193 capab->extended_capabilities_len,
3194 capab->extended_capabilities_mask))
3195 goto nla_put_failure;
3196
3197 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3198 (nla_put_u16(msg,
3199 NL80211_ATTR_EML_CAPABILITY,
3200 capab->eml_capabilities) ||
3201 nla_put_u16(msg,
3202 NL80211_ATTR_MLD_CAPA_AND_OPS,
3203 capab->mld_capa_and_ops)))
3204 goto nla_put_failure;
3205
3206 nla_nest_end(msg, nested_ext_capab);
3207 if (state->split)
3208 break;
3209 }
3210 nla_nest_end(msg, nested);
3211 if (i < rdev->wiphy.num_iftype_ext_capab) {
3212 state->capa_start = i + 1;
3213 break;
3214 }
3215 }
3216
3217 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3218 rdev->wiphy.nan_supported_bands))
3219 goto nla_put_failure;
3220
3221 if (wiphy_ext_feature_isset(&rdev->wiphy,
3222 NL80211_EXT_FEATURE_TXQS)) {
3223 struct cfg80211_txq_stats txqstats = {};
3224 int res;
3225
3226 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3227 if (!res &&
3228 !nl80211_put_txq_stats(msg, &txqstats,
3229 NL80211_ATTR_TXQ_STATS))
3230 goto nla_put_failure;
3231
3232 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3233 rdev->wiphy.txq_limit))
3234 goto nla_put_failure;
3235 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3236 rdev->wiphy.txq_memory_limit))
3237 goto nla_put_failure;
3238 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3239 rdev->wiphy.txq_quantum))
3240 goto nla_put_failure;
3241 }
3242
3243 state->split_start++;
3244 break;
3245 case 14:
3246 if (nl80211_send_pmsr_capa(rdev, msg))
3247 goto nla_put_failure;
3248
3249 state->split_start++;
3250 break;
3251 case 15:
3252 if (rdev->wiphy.akm_suites &&
3253 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3254 sizeof(u32) * rdev->wiphy.n_akm_suites,
3255 rdev->wiphy.akm_suites))
3256 goto nla_put_failure;
3257
3258 if (nl80211_put_iftype_akm_suites(rdev, msg))
3259 goto nla_put_failure;
3260
3261 if (nl80211_put_tid_config_support(rdev, msg))
3262 goto nla_put_failure;
3263 state->split_start++;
3264 break;
3265 case 16:
3266 if (nl80211_put_sar_specs(rdev, msg))
3267 goto nla_put_failure;
3268
3269 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3270 goto nla_put_failure;
3271
3272 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3273 rdev->wiphy.max_num_akm_suites))
3274 goto nla_put_failure;
3275
3276 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3277 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3278
3279 if (rdev->wiphy.hw_timestamp_max_peers &&
3280 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3281 rdev->wiphy.hw_timestamp_max_peers))
3282 goto nla_put_failure;
3283
3284 state->split_start++;
3285 break;
3286 case 17:
3287 if (nl80211_put_radios(&rdev->wiphy, msg))
3288 goto nla_put_failure;
3289
3290 state->split_start++;
3291 break;
3292 case 18:
3293 if (nl80211_put_nan_capa(&rdev->wiphy, msg))
3294 goto nla_put_failure;
3295
3296 /* done */
3297 state->split_start = 0;
3298 break;
3299 }
3300 finish:
3301 genlmsg_end(msg, hdr);
3302 return 0;
3303
3304 nla_put_failure:
3305 genlmsg_cancel(msg, hdr);
3306 return -EMSGSIZE;
3307 }
3308
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3309 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3310 struct netlink_callback *cb,
3311 struct nl80211_dump_wiphy_state *state)
3312 {
3313 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3314 int ret;
3315
3316 if (!tb)
3317 return -ENOMEM;
3318
3319 ret = nlmsg_parse_deprecated(cb->nlh,
3320 GENL_HDRLEN + nl80211_fam.hdrsize,
3321 tb, nl80211_fam.maxattr,
3322 nl80211_policy, NULL);
3323 /* ignore parse errors for backward compatibility */
3324 if (ret) {
3325 ret = 0;
3326 goto out;
3327 }
3328
3329 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3330 if (tb[NL80211_ATTR_WIPHY])
3331 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3332 if (tb[NL80211_ATTR_WDEV])
3333 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3334 if (tb[NL80211_ATTR_IFINDEX]) {
3335 struct net_device *netdev;
3336 struct cfg80211_registered_device *rdev;
3337 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3338
3339 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3340 if (!netdev) {
3341 ret = -ENODEV;
3342 goto out;
3343 }
3344 if (netdev->ieee80211_ptr) {
3345 rdev = wiphy_to_rdev(
3346 netdev->ieee80211_ptr->wiphy);
3347 state->filter_wiphy = rdev->wiphy_idx;
3348 }
3349 }
3350
3351 ret = 0;
3352 out:
3353 kfree(tb);
3354 return ret;
3355 }
3356
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3357 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3358 {
3359 int idx = 0, ret;
3360 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3361 struct cfg80211_registered_device *rdev;
3362
3363 rtnl_lock();
3364 if (!state) {
3365 state = kzalloc(sizeof(*state), GFP_KERNEL);
3366 if (!state) {
3367 rtnl_unlock();
3368 return -ENOMEM;
3369 }
3370 state->filter_wiphy = -1;
3371 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3372 if (ret) {
3373 kfree(state);
3374 rtnl_unlock();
3375 return ret;
3376 }
3377 cb->args[0] = (long)state;
3378 }
3379
3380 for_each_rdev(rdev) {
3381 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3382 continue;
3383 if (++idx <= state->start)
3384 continue;
3385 if (state->filter_wiphy != -1 &&
3386 state->filter_wiphy != rdev->wiphy_idx)
3387 continue;
3388 wiphy_lock(&rdev->wiphy);
3389 /* attempt to fit multiple wiphy data chunks into the skb */
3390 do {
3391 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3392 skb,
3393 NETLINK_CB(cb->skb).portid,
3394 cb->nlh->nlmsg_seq,
3395 NLM_F_MULTI, state);
3396 if (ret < 0) {
3397 /*
3398 * If sending the wiphy data didn't fit (ENOBUFS
3399 * or EMSGSIZE returned), this SKB is still
3400 * empty (so it's not too big because another
3401 * wiphy dataset is already in the skb) and
3402 * we've not tried to adjust the dump allocation
3403 * yet ... then adjust the alloc size to be
3404 * bigger, and return 1 but with the empty skb.
3405 * This results in an empty message being RX'ed
3406 * in userspace, but that is ignored.
3407 *
3408 * We can then retry with the larger buffer.
3409 */
3410 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3411 !skb->len && !state->split &&
3412 cb->min_dump_alloc < 4096) {
3413 cb->min_dump_alloc = 4096;
3414 state->split_start = 0;
3415 wiphy_unlock(&rdev->wiphy);
3416 rtnl_unlock();
3417 return 1;
3418 }
3419 idx--;
3420 break;
3421 }
3422 } while (state->split_start > 0);
3423 wiphy_unlock(&rdev->wiphy);
3424 break;
3425 }
3426 rtnl_unlock();
3427
3428 state->start = idx;
3429
3430 return skb->len;
3431 }
3432
nl80211_dump_wiphy_done(struct netlink_callback * cb)3433 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3434 {
3435 kfree((void *)cb->args[0]);
3436 return 0;
3437 }
3438
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3439 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3440 {
3441 struct sk_buff *msg;
3442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3443 struct nl80211_dump_wiphy_state state = {};
3444
3445 msg = nlmsg_new(4096, GFP_KERNEL);
3446 if (!msg)
3447 return -ENOMEM;
3448
3449 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3450 info->snd_portid, info->snd_seq, 0,
3451 &state) < 0) {
3452 nlmsg_free(msg);
3453 return -ENOBUFS;
3454 }
3455
3456 return genlmsg_reply(msg, info);
3457 }
3458
3459 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3460 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3461 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3462 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3463 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3464 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3465 };
3466
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3467 static int parse_txq_params(struct nlattr *tb[],
3468 struct ieee80211_txq_params *txq_params)
3469 {
3470 u8 ac;
3471
3472 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3473 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3474 !tb[NL80211_TXQ_ATTR_AIFS])
3475 return -EINVAL;
3476
3477 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3478 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3479 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3480 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3481 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3482
3483 if (ac >= NL80211_NUM_ACS)
3484 return -EINVAL;
3485 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3486 return 0;
3487 }
3488
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3489 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3490 {
3491 /*
3492 * You can only set the channel explicitly for some interfaces,
3493 * most have their channel managed via their respective
3494 * "establish a connection" command (connect, join, ...)
3495 *
3496 * For AP/GO and mesh mode, the channel can be set with the
3497 * channel userspace API, but is only stored and passed to the
3498 * low-level driver when the AP starts or the mesh is joined.
3499 * This is for backward compatibility, userspace can also give
3500 * the channel in the start-ap or join-mesh commands instead.
3501 *
3502 * Monitors are special as they are normally slaved to
3503 * whatever else is going on, so they have their own special
3504 * operation to set the monitor channel if possible.
3505 */
3506 return !wdev ||
3507 wdev->iftype == NL80211_IFTYPE_AP ||
3508 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3509 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3510 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3511 }
3512
_nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,bool monitor,struct cfg80211_chan_def * chandef)3513 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3514 struct genl_info *info, bool monitor,
3515 struct cfg80211_chan_def *chandef)
3516 {
3517 struct netlink_ext_ack *extack = info->extack;
3518 struct nlattr **attrs = info->attrs;
3519 u32 control_freq;
3520
3521 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3522 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3523 "Frequency is missing");
3524 return -EINVAL;
3525 }
3526
3527 control_freq = MHZ_TO_KHZ(
3528 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3529 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3530 control_freq +=
3531 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3532
3533 memset(chandef, 0, sizeof(*chandef));
3534 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3535 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3536 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3537 chandef->freq1_offset = control_freq % 1000;
3538 chandef->center_freq2 = 0;
3539 chandef->s1g_primary_2mhz = false;
3540
3541 if (!chandef->chan) {
3542 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3543 "Unknown channel");
3544 return -EINVAL;
3545 }
3546
3547 if (cfg80211_chandef_is_s1g(chandef))
3548 chandef->width = NL80211_CHAN_WIDTH_1;
3549
3550 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3551 enum nl80211_channel_type chantype;
3552
3553 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3554
3555 switch (chantype) {
3556 case NL80211_CHAN_NO_HT:
3557 case NL80211_CHAN_HT20:
3558 case NL80211_CHAN_HT40PLUS:
3559 case NL80211_CHAN_HT40MINUS:
3560 cfg80211_chandef_create(chandef, chandef->chan,
3561 chantype);
3562 /* user input for center_freq is incorrect */
3563 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3564 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3565 NL_SET_ERR_MSG_ATTR(extack,
3566 attrs[NL80211_ATTR_CENTER_FREQ1],
3567 "bad center frequency 1");
3568 return -EINVAL;
3569 }
3570 /* center_freq2 must be zero */
3571 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3572 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3573 NL_SET_ERR_MSG_ATTR(extack,
3574 attrs[NL80211_ATTR_CENTER_FREQ2],
3575 "center frequency 2 can't be used");
3576 return -EINVAL;
3577 }
3578 break;
3579 default:
3580 NL_SET_ERR_MSG_ATTR(extack,
3581 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3582 "invalid channel type");
3583 return -EINVAL;
3584 }
3585 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3586 chandef->width = nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3587 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3588 chandef->center_freq1 =
3589 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3590 chandef->freq1_offset = nla_get_u32_default(
3591 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET], 0);
3592 }
3593
3594 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3595 chandef->center_freq2 =
3596 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3597
3598 chandef->s1g_primary_2mhz = nla_get_flag(
3599 attrs[NL80211_ATTR_S1G_PRIMARY_2MHZ]);
3600 }
3601
3602 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3603 chandef->edmg.channels =
3604 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3605
3606 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3607 chandef->edmg.bw_config =
3608 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3609 } else {
3610 chandef->edmg.bw_config = 0;
3611 chandef->edmg.channels = 0;
3612 }
3613
3614 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3615 chandef->punctured =
3616 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3617
3618 if (chandef->punctured &&
3619 !wiphy_ext_feature_isset(&rdev->wiphy,
3620 NL80211_EXT_FEATURE_PUNCT)) {
3621 NL_SET_ERR_MSG(extack,
3622 "driver doesn't support puncturing");
3623 return -EINVAL;
3624 }
3625 }
3626
3627 if (!cfg80211_chandef_valid(chandef)) {
3628 NL_SET_ERR_MSG(extack, "invalid channel definition");
3629 return -EINVAL;
3630 }
3631
3632 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3633 IEEE80211_CHAN_DISABLED,
3634 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3635 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3636 return -EINVAL;
3637 }
3638
3639 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3640 chandef->width == NL80211_CHAN_WIDTH_10) &&
3641 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3642 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3643 return -EINVAL;
3644 }
3645
3646 return 0;
3647 }
3648
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3649 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3650 struct genl_info *info,
3651 struct cfg80211_chan_def *chandef)
3652 {
3653 return _nl80211_parse_chandef(rdev, info, false, chandef);
3654 }
3655
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3656 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3657 struct net_device *dev,
3658 struct genl_info *info,
3659 int _link_id)
3660 {
3661 struct cfg80211_chan_def chandef;
3662 int result;
3663 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3664 struct wireless_dev *wdev = NULL;
3665 int link_id = _link_id;
3666
3667 if (dev)
3668 wdev = dev->ieee80211_ptr;
3669 if (!nl80211_can_set_dev_channel(wdev))
3670 return -EOPNOTSUPP;
3671 if (wdev)
3672 iftype = wdev->iftype;
3673
3674 if (link_id < 0) {
3675 if (wdev && wdev->valid_links)
3676 return -EINVAL;
3677 link_id = 0;
3678 }
3679
3680 result = _nl80211_parse_chandef(rdev, info,
3681 iftype == NL80211_IFTYPE_MONITOR,
3682 &chandef);
3683 if (result)
3684 return result;
3685
3686 switch (iftype) {
3687 case NL80211_IFTYPE_AP:
3688 case NL80211_IFTYPE_P2P_GO:
3689 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3690 iftype))
3691 return -EINVAL;
3692 if (wdev->links[link_id].ap.beacon_interval) {
3693 struct ieee80211_channel *cur_chan;
3694
3695 if (!dev || !rdev->ops->set_ap_chanwidth ||
3696 !(rdev->wiphy.features &
3697 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3698 return -EBUSY;
3699
3700 /* Only allow dynamic channel width changes */
3701 cur_chan = wdev->links[link_id].ap.chandef.chan;
3702 if (chandef.chan != cur_chan)
3703 return -EBUSY;
3704
3705 /* only allow this for regular channel widths */
3706 switch (wdev->links[link_id].ap.chandef.width) {
3707 case NL80211_CHAN_WIDTH_20_NOHT:
3708 case NL80211_CHAN_WIDTH_20:
3709 case NL80211_CHAN_WIDTH_40:
3710 case NL80211_CHAN_WIDTH_80:
3711 case NL80211_CHAN_WIDTH_80P80:
3712 case NL80211_CHAN_WIDTH_160:
3713 case NL80211_CHAN_WIDTH_320:
3714 break;
3715 default:
3716 return -EINVAL;
3717 }
3718
3719 switch (chandef.width) {
3720 case NL80211_CHAN_WIDTH_20_NOHT:
3721 case NL80211_CHAN_WIDTH_20:
3722 case NL80211_CHAN_WIDTH_40:
3723 case NL80211_CHAN_WIDTH_80:
3724 case NL80211_CHAN_WIDTH_80P80:
3725 case NL80211_CHAN_WIDTH_160:
3726 case NL80211_CHAN_WIDTH_320:
3727 break;
3728 default:
3729 return -EINVAL;
3730 }
3731
3732 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3733 &chandef);
3734 if (result)
3735 return result;
3736 wdev->links[link_id].ap.chandef = chandef;
3737 } else {
3738 wdev->u.ap.preset_chandef = chandef;
3739 }
3740 return 0;
3741 case NL80211_IFTYPE_MESH_POINT:
3742 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3743 case NL80211_IFTYPE_MONITOR:
3744 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3745 default:
3746 break;
3747 }
3748
3749 return -EINVAL;
3750 }
3751
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3752 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3753 {
3754 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3755 int link_id = nl80211_link_id_or_invalid(info->attrs);
3756 struct net_device *netdev = info->user_ptr[1];
3757
3758 return __nl80211_set_channel(rdev, netdev, info, link_id);
3759 }
3760
nl80211_set_wiphy_radio(struct genl_info * info,struct cfg80211_registered_device * rdev,int radio_idx)3761 static int nl80211_set_wiphy_radio(struct genl_info *info,
3762 struct cfg80211_registered_device *rdev,
3763 int radio_idx)
3764 {
3765 u32 rts_threshold = 0, old_rts, changed = 0;
3766 int result;
3767
3768 if (!rdev->ops->set_wiphy_params)
3769 return -EOPNOTSUPP;
3770
3771 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3772 rts_threshold = nla_get_u32(
3773 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3774 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3775 }
3776
3777 old_rts = rdev->wiphy.radio_cfg[radio_idx].rts_threshold;
3778
3779 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = rts_threshold;
3780
3781 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
3782 if (result)
3783 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = old_rts;
3784
3785 return 0;
3786 }
3787
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3788 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3789 {
3790 struct cfg80211_registered_device *rdev = NULL;
3791 struct net_device *netdev = NULL;
3792 struct wireless_dev *wdev;
3793 int result = 0, rem_txq_params = 0;
3794 struct nlattr *nl_txq_params;
3795 u32 changed;
3796 u8 retry_short = 0, retry_long = 0;
3797 u32 frag_threshold = 0, rts_threshold = 0;
3798 u8 coverage_class = 0;
3799 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3800 int radio_idx = -1;
3801
3802 rtnl_lock();
3803 /*
3804 * Try to find the wiphy and netdev. Normally this
3805 * function shouldn't need the netdev, but this is
3806 * done for backward compatibility -- previously
3807 * setting the channel was done per wiphy, but now
3808 * it is per netdev. Previous userland like hostapd
3809 * also passed a netdev to set_wiphy, so that it is
3810 * possible to let that go to the right netdev!
3811 */
3812
3813 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3814 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3815
3816 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3817 if (netdev && netdev->ieee80211_ptr)
3818 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3819 else
3820 netdev = NULL;
3821 }
3822
3823 if (!netdev) {
3824 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3825 info->attrs);
3826 if (IS_ERR(rdev)) {
3827 rtnl_unlock();
3828 return PTR_ERR(rdev);
3829 }
3830 wdev = NULL;
3831 netdev = NULL;
3832 result = 0;
3833 } else
3834 wdev = netdev->ieee80211_ptr;
3835
3836 guard(wiphy)(&rdev->wiphy);
3837
3838 /*
3839 * end workaround code, by now the rdev is available
3840 * and locked, and wdev may or may not be NULL.
3841 */
3842
3843 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3844 result = cfg80211_dev_rename(
3845 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3846 rtnl_unlock();
3847
3848 if (result)
3849 return result;
3850
3851 if (info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]) {
3852 /* Radio idx is not expected for non-multi radio wiphy */
3853 if (rdev->wiphy.n_radio <= 0)
3854 return -EINVAL;
3855
3856 radio_idx = nla_get_u8(
3857 info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]);
3858 if (radio_idx >= rdev->wiphy.n_radio)
3859 return -EINVAL;
3860
3861 return nl80211_set_wiphy_radio(info, rdev, radio_idx);
3862 }
3863
3864 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3865 struct ieee80211_txq_params txq_params;
3866 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3867
3868 if (!rdev->ops->set_txq_params)
3869 return -EOPNOTSUPP;
3870
3871 if (!netdev)
3872 return -EINVAL;
3873
3874 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3875 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3876 return -EINVAL;
3877
3878 if (!netif_running(netdev))
3879 return -ENETDOWN;
3880
3881 nla_for_each_nested(nl_txq_params,
3882 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3883 rem_txq_params) {
3884 result = nla_parse_nested_deprecated(tb,
3885 NL80211_TXQ_ATTR_MAX,
3886 nl_txq_params,
3887 txq_params_policy,
3888 info->extack);
3889 if (result)
3890 return result;
3891
3892 result = parse_txq_params(tb, &txq_params);
3893 if (result)
3894 return result;
3895
3896 txq_params.link_id =
3897 nl80211_link_id_or_invalid(info->attrs);
3898
3899 if (txq_params.link_id >= 0 &&
3900 !(netdev->ieee80211_ptr->valid_links &
3901 BIT(txq_params.link_id)))
3902 result = -ENOLINK;
3903 else if (txq_params.link_id >= 0 &&
3904 !netdev->ieee80211_ptr->valid_links)
3905 result = -EINVAL;
3906 else
3907 result = rdev_set_txq_params(rdev, netdev,
3908 &txq_params);
3909 if (result)
3910 return result;
3911 }
3912 }
3913
3914 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3915 int link_id = nl80211_link_id_or_invalid(info->attrs);
3916
3917 if (wdev) {
3918 result = __nl80211_set_channel(
3919 rdev,
3920 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3921 info, link_id);
3922 } else {
3923 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3924 }
3925
3926 if (result)
3927 return result;
3928 }
3929
3930 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3931 struct wireless_dev *txp_wdev = wdev;
3932 enum nl80211_tx_power_setting type;
3933 int idx, mbm = 0;
3934
3935 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3936 txp_wdev = NULL;
3937
3938 if (!rdev->ops->set_tx_power)
3939 return -EOPNOTSUPP;
3940
3941 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3942 type = nla_get_u32(info->attrs[idx]);
3943
3944 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3945 (type != NL80211_TX_POWER_AUTOMATIC))
3946 return -EINVAL;
3947
3948 if (type != NL80211_TX_POWER_AUTOMATIC) {
3949 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3950 mbm = nla_get_u32(info->attrs[idx]);
3951 }
3952
3953 result = rdev_set_tx_power(rdev, txp_wdev, radio_idx, type,
3954 mbm);
3955 if (result)
3956 return result;
3957 }
3958
3959 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3960 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3961 u32 tx_ant, rx_ant;
3962
3963 if ((!rdev->wiphy.available_antennas_tx &&
3964 !rdev->wiphy.available_antennas_rx) ||
3965 !rdev->ops->set_antenna)
3966 return -EOPNOTSUPP;
3967
3968 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3969 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3970
3971 /* reject antenna configurations which don't match the
3972 * available antenna masks, except for the "all" mask */
3973 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3974 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3975 return -EINVAL;
3976
3977 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3978 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3979
3980 result = rdev_set_antenna(rdev, radio_idx, tx_ant, rx_ant);
3981 if (result)
3982 return result;
3983 }
3984
3985 changed = 0;
3986
3987 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3988 retry_short = nla_get_u8(
3989 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3990
3991 changed |= WIPHY_PARAM_RETRY_SHORT;
3992 }
3993
3994 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3995 retry_long = nla_get_u8(
3996 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3997
3998 changed |= WIPHY_PARAM_RETRY_LONG;
3999 }
4000
4001 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
4002 frag_threshold = nla_get_u32(
4003 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
4004 if (frag_threshold < 256)
4005 return -EINVAL;
4006
4007 if (frag_threshold != (u32) -1) {
4008 /*
4009 * Fragments (apart from the last one) are required to
4010 * have even length. Make the fragmentation code
4011 * simpler by stripping LSB should someone try to use
4012 * odd threshold value.
4013 */
4014 frag_threshold &= ~0x1;
4015 }
4016 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
4017 }
4018
4019 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
4020 rts_threshold = nla_get_u32(
4021 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
4022 changed |= WIPHY_PARAM_RTS_THRESHOLD;
4023 }
4024
4025 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
4026 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
4027 return -EINVAL;
4028
4029 coverage_class = nla_get_u8(
4030 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
4031 changed |= WIPHY_PARAM_COVERAGE_CLASS;
4032 }
4033
4034 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
4035 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
4036 return -EOPNOTSUPP;
4037
4038 changed |= WIPHY_PARAM_DYN_ACK;
4039 }
4040
4041 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
4042 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4043 NL80211_EXT_FEATURE_TXQS))
4044 return -EOPNOTSUPP;
4045
4046 txq_limit = nla_get_u32(
4047 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
4048 changed |= WIPHY_PARAM_TXQ_LIMIT;
4049 }
4050
4051 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
4052 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4053 NL80211_EXT_FEATURE_TXQS))
4054 return -EOPNOTSUPP;
4055
4056 txq_memory_limit = nla_get_u32(
4057 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
4058 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
4059 }
4060
4061 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
4062 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4063 NL80211_EXT_FEATURE_TXQS))
4064 return -EOPNOTSUPP;
4065
4066 txq_quantum = nla_get_u32(
4067 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
4068 changed |= WIPHY_PARAM_TXQ_QUANTUM;
4069 }
4070
4071 if (changed) {
4072 u8 old_retry_short, old_retry_long;
4073 u32 old_frag_threshold, old_rts_threshold;
4074 u8 old_coverage_class, i;
4075 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
4076 u32 *old_radio_rts_threshold = NULL;
4077
4078 if (!rdev->ops->set_wiphy_params)
4079 return -EOPNOTSUPP;
4080
4081 if (rdev->wiphy.n_radio) {
4082 old_radio_rts_threshold = kcalloc(rdev->wiphy.n_radio,
4083 sizeof(u32),
4084 GFP_KERNEL);
4085 if (!old_radio_rts_threshold)
4086 return -ENOMEM;
4087 }
4088
4089 old_retry_short = rdev->wiphy.retry_short;
4090 old_retry_long = rdev->wiphy.retry_long;
4091 old_frag_threshold = rdev->wiphy.frag_threshold;
4092 old_rts_threshold = rdev->wiphy.rts_threshold;
4093 if (old_radio_rts_threshold) {
4094 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4095 old_radio_rts_threshold[i] =
4096 rdev->wiphy.radio_cfg[i].rts_threshold;
4097 }
4098 old_coverage_class = rdev->wiphy.coverage_class;
4099 old_txq_limit = rdev->wiphy.txq_limit;
4100 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
4101 old_txq_quantum = rdev->wiphy.txq_quantum;
4102
4103 if (changed & WIPHY_PARAM_RETRY_SHORT)
4104 rdev->wiphy.retry_short = retry_short;
4105 if (changed & WIPHY_PARAM_RETRY_LONG)
4106 rdev->wiphy.retry_long = retry_long;
4107 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
4108 rdev->wiphy.frag_threshold = frag_threshold;
4109 if ((changed & WIPHY_PARAM_RTS_THRESHOLD) &&
4110 old_radio_rts_threshold) {
4111 rdev->wiphy.rts_threshold = rts_threshold;
4112 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4113 rdev->wiphy.radio_cfg[i].rts_threshold =
4114 rdev->wiphy.rts_threshold;
4115 }
4116 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
4117 rdev->wiphy.coverage_class = coverage_class;
4118 if (changed & WIPHY_PARAM_TXQ_LIMIT)
4119 rdev->wiphy.txq_limit = txq_limit;
4120 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
4121 rdev->wiphy.txq_memory_limit = txq_memory_limit;
4122 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
4123 rdev->wiphy.txq_quantum = txq_quantum;
4124
4125 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
4126 if (result) {
4127 rdev->wiphy.retry_short = old_retry_short;
4128 rdev->wiphy.retry_long = old_retry_long;
4129 rdev->wiphy.frag_threshold = old_frag_threshold;
4130 rdev->wiphy.rts_threshold = old_rts_threshold;
4131 if (old_radio_rts_threshold) {
4132 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4133 rdev->wiphy.radio_cfg[i].rts_threshold =
4134 old_radio_rts_threshold[i];
4135 }
4136 rdev->wiphy.coverage_class = old_coverage_class;
4137 rdev->wiphy.txq_limit = old_txq_limit;
4138 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
4139 rdev->wiphy.txq_quantum = old_txq_quantum;
4140 }
4141
4142 kfree(old_radio_rts_threshold);
4143 return result;
4144 }
4145
4146 return 0;
4147 }
4148
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)4149 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
4150 {
4151 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
4152 return -EINVAL;
4153
4154 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4155 chandef->chan->center_freq))
4156 return -ENOBUFS;
4157 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
4158 chandef->chan->freq_offset))
4159 return -ENOBUFS;
4160 switch (chandef->width) {
4161 case NL80211_CHAN_WIDTH_20_NOHT:
4162 case NL80211_CHAN_WIDTH_20:
4163 case NL80211_CHAN_WIDTH_40:
4164 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4165 cfg80211_get_chandef_type(chandef)))
4166 return -ENOBUFS;
4167 break;
4168 default:
4169 break;
4170 }
4171 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
4172 return -ENOBUFS;
4173 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
4174 return -ENOBUFS;
4175 if (chandef->center_freq2 &&
4176 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
4177 return -ENOBUFS;
4178 if (chandef->punctured &&
4179 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
4180 return -ENOBUFS;
4181 if (chandef->s1g_primary_2mhz &&
4182 nla_put_flag(msg, NL80211_ATTR_S1G_PRIMARY_2MHZ))
4183 return -ENOBUFS;
4184
4185 return 0;
4186 }
4187 EXPORT_SYMBOL(nl80211_send_chandef);
4188
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)4189 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
4190 struct cfg80211_registered_device *rdev,
4191 struct wireless_dev *wdev,
4192 enum nl80211_commands cmd)
4193 {
4194 struct net_device *dev = wdev->netdev;
4195 void *hdr;
4196
4197 lockdep_assert_wiphy(&rdev->wiphy);
4198
4199 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
4200 cmd != NL80211_CMD_DEL_INTERFACE &&
4201 cmd != NL80211_CMD_SET_INTERFACE);
4202
4203 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4204 if (!hdr)
4205 return -1;
4206
4207 if (dev &&
4208 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4209 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
4210 goto nla_put_failure;
4211
4212 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
4213 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
4214 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
4215 NL80211_ATTR_PAD) ||
4216 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
4217 nla_put_u32(msg, NL80211_ATTR_GENERATION,
4218 rdev->devlist_generation ^
4219 (cfg80211_rdev_list_generation << 2)) ||
4220 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
4221 nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
4222 goto nla_put_failure;
4223
4224 if (rdev->ops->get_channel && !wdev->valid_links) {
4225 struct cfg80211_chan_def chandef = {};
4226 int ret;
4227
4228 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4229 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4230 goto nla_put_failure;
4231 }
4232
4233 if (rdev->ops->get_tx_power && !wdev->valid_links) {
4234 int dbm, ret;
4235
4236 ret = rdev_get_tx_power(rdev, wdev, -1, 0, &dbm);
4237 if (ret == 0 &&
4238 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4239 DBM_TO_MBM(dbm)))
4240 goto nla_put_failure;
4241 }
4242
4243 switch (wdev->iftype) {
4244 case NL80211_IFTYPE_AP:
4245 case NL80211_IFTYPE_P2P_GO:
4246 if (wdev->u.ap.ssid_len &&
4247 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4248 wdev->u.ap.ssid))
4249 goto nla_put_failure;
4250 break;
4251 case NL80211_IFTYPE_STATION:
4252 case NL80211_IFTYPE_P2P_CLIENT:
4253 if (wdev->u.client.ssid_len &&
4254 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4255 wdev->u.client.ssid))
4256 goto nla_put_failure;
4257 break;
4258 case NL80211_IFTYPE_ADHOC:
4259 if (wdev->u.ibss.ssid_len &&
4260 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4261 wdev->u.ibss.ssid))
4262 goto nla_put_failure;
4263 break;
4264 default:
4265 /* nothing */
4266 break;
4267 }
4268
4269 if (rdev->ops->get_txq_stats) {
4270 struct cfg80211_txq_stats txqstats = {};
4271 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4272
4273 if (ret == 0 &&
4274 !nl80211_put_txq_stats(msg, &txqstats,
4275 NL80211_ATTR_TXQ_STATS))
4276 goto nla_put_failure;
4277 }
4278
4279 if (wdev->valid_links) {
4280 unsigned int link_id;
4281 struct nlattr *links = nla_nest_start(msg,
4282 NL80211_ATTR_MLO_LINKS);
4283
4284 if (!links)
4285 goto nla_put_failure;
4286
4287 for_each_valid_link(wdev, link_id) {
4288 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4289 struct cfg80211_chan_def chandef = {};
4290 int ret;
4291
4292 if (!link)
4293 goto nla_put_failure;
4294
4295 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4296 goto nla_put_failure;
4297 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4298 wdev->links[link_id].addr))
4299 goto nla_put_failure;
4300
4301 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4302 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4303 goto nla_put_failure;
4304
4305 if (rdev->ops->get_tx_power) {
4306 int dbm, ret;
4307
4308 ret = rdev_get_tx_power(rdev, wdev, -1, link_id, &dbm);
4309 if (ret == 0 &&
4310 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4311 DBM_TO_MBM(dbm)))
4312 goto nla_put_failure;
4313 }
4314 nla_nest_end(msg, link);
4315 }
4316
4317 nla_nest_end(msg, links);
4318 }
4319
4320 genlmsg_end(msg, hdr);
4321 return 0;
4322
4323 nla_put_failure:
4324 genlmsg_cancel(msg, hdr);
4325 return -EMSGSIZE;
4326 }
4327
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)4328 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4329 {
4330 int wp_idx = 0;
4331 int if_idx = 0;
4332 int wp_start = cb->args[0];
4333 int if_start = cb->args[1];
4334 int filter_wiphy = -1;
4335 struct cfg80211_registered_device *rdev;
4336 struct wireless_dev *wdev;
4337 int ret;
4338
4339 rtnl_lock();
4340 if (!cb->args[2]) {
4341 struct nl80211_dump_wiphy_state state = {
4342 .filter_wiphy = -1,
4343 };
4344
4345 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4346 if (ret)
4347 goto out_unlock;
4348
4349 filter_wiphy = state.filter_wiphy;
4350
4351 /*
4352 * if filtering, set cb->args[2] to +1 since 0 is the default
4353 * value needed to determine that parsing is necessary.
4354 */
4355 if (filter_wiphy >= 0)
4356 cb->args[2] = filter_wiphy + 1;
4357 else
4358 cb->args[2] = -1;
4359 } else if (cb->args[2] > 0) {
4360 filter_wiphy = cb->args[2] - 1;
4361 }
4362
4363 for_each_rdev(rdev) {
4364 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4365 continue;
4366 if (wp_idx < wp_start) {
4367 wp_idx++;
4368 continue;
4369 }
4370
4371 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4372 continue;
4373
4374 if_idx = 0;
4375
4376 guard(wiphy)(&rdev->wiphy);
4377
4378 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4379 if (if_idx < if_start) {
4380 if_idx++;
4381 continue;
4382 }
4383
4384 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4385 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4386 rdev, wdev,
4387 NL80211_CMD_NEW_INTERFACE) < 0)
4388 goto out;
4389
4390 if_idx++;
4391 }
4392
4393 if_start = 0;
4394 wp_idx++;
4395 }
4396 out:
4397 cb->args[0] = wp_idx;
4398 cb->args[1] = if_idx;
4399
4400 ret = skb->len;
4401 out_unlock:
4402 rtnl_unlock();
4403
4404 return ret;
4405 }
4406
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4407 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4408 {
4409 struct sk_buff *msg;
4410 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4411 struct wireless_dev *wdev = info->user_ptr[1];
4412
4413 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4414 if (!msg)
4415 return -ENOMEM;
4416
4417 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4418 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4419 nlmsg_free(msg);
4420 return -ENOBUFS;
4421 }
4422
4423 return genlmsg_reply(msg, info);
4424 }
4425
4426 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4427 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4428 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4429 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4430 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4431 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4432 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4433 [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4434 };
4435
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4436 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4437 {
4438 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4439 int flag;
4440
4441 *mntrflags = 0;
4442
4443 if (!nla)
4444 return -EINVAL;
4445
4446 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4447 return -EINVAL;
4448
4449 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4450 if (flags[flag])
4451 *mntrflags |= (1<<flag);
4452
4453 /* cooked monitor mode is incompatible with other modes */
4454 if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4455 *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4456 return -EOPNOTSUPP;
4457
4458 *mntrflags |= MONITOR_FLAG_CHANGED;
4459
4460 return 0;
4461 }
4462
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4463 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4464 enum nl80211_iftype type,
4465 struct genl_info *info,
4466 struct vif_params *params)
4467 {
4468 bool change = false;
4469 int err;
4470
4471 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4472 if (type != NL80211_IFTYPE_MONITOR)
4473 return -EINVAL;
4474
4475 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4476 ¶ms->flags);
4477 if (err)
4478 return err;
4479
4480 change = true;
4481 }
4482
4483 /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4484 if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4485 return -EOPNOTSUPP;
4486
4487 if (params->flags & MONITOR_FLAG_ACTIVE &&
4488 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4489 return -EOPNOTSUPP;
4490
4491 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4492 const u8 *mumimo_groups;
4493 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4494
4495 if (type != NL80211_IFTYPE_MONITOR)
4496 return -EINVAL;
4497
4498 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4499 return -EOPNOTSUPP;
4500
4501 mumimo_groups =
4502 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4503
4504 /* bits 0 and 63 are reserved and must be zero */
4505 if ((mumimo_groups[0] & BIT(0)) ||
4506 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4507 return -EINVAL;
4508
4509 params->vht_mumimo_groups = mumimo_groups;
4510 change = true;
4511 }
4512
4513 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4514 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4515
4516 if (type != NL80211_IFTYPE_MONITOR)
4517 return -EINVAL;
4518
4519 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4520 return -EOPNOTSUPP;
4521
4522 params->vht_mumimo_follow_addr =
4523 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4524 change = true;
4525 }
4526
4527 return change ? 1 : 0;
4528 }
4529
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4530 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4531 struct net_device *netdev, u8 use_4addr,
4532 enum nl80211_iftype iftype)
4533 {
4534 if (!use_4addr) {
4535 if (netdev && netif_is_bridge_port(netdev))
4536 return -EBUSY;
4537 return 0;
4538 }
4539
4540 switch (iftype) {
4541 case NL80211_IFTYPE_AP_VLAN:
4542 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4543 return 0;
4544 break;
4545 case NL80211_IFTYPE_STATION:
4546 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4547 return 0;
4548 break;
4549 default:
4550 break;
4551 }
4552
4553 return -EOPNOTSUPP;
4554 }
4555
nl80211_parse_vif_radio_mask(struct genl_info * info,u32 * radio_mask)4556 static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4557 u32 *radio_mask)
4558 {
4559 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4560 struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4561 u32 mask, allowed;
4562
4563 if (!attr) {
4564 *radio_mask = 0;
4565 return 0;
4566 }
4567
4568 allowed = BIT(rdev->wiphy.n_radio) - 1;
4569 mask = nla_get_u32(attr);
4570 if (mask & ~allowed)
4571 return -EINVAL;
4572 if (!mask)
4573 mask = allowed;
4574 *radio_mask = mask;
4575
4576 return 1;
4577 }
4578
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4579 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4580 {
4581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4582 struct vif_params params;
4583 int err;
4584 enum nl80211_iftype otype, ntype;
4585 struct net_device *dev = info->user_ptr[1];
4586 struct wireless_dev *wdev = dev->ieee80211_ptr;
4587 u32 radio_mask = 0;
4588 bool change = false;
4589
4590 memset(¶ms, 0, sizeof(params));
4591
4592 otype = ntype = dev->ieee80211_ptr->iftype;
4593
4594 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4595 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4596 if (otype != ntype)
4597 change = true;
4598 }
4599
4600 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4601 if (ntype != NL80211_IFTYPE_MESH_POINT)
4602 return -EINVAL;
4603 if (otype != NL80211_IFTYPE_MESH_POINT)
4604 return -EINVAL;
4605 if (netif_running(dev))
4606 return -EBUSY;
4607
4608 wdev->u.mesh.id_up_len =
4609 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4610 memcpy(wdev->u.mesh.id,
4611 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4612 wdev->u.mesh.id_up_len);
4613 }
4614
4615 if (info->attrs[NL80211_ATTR_4ADDR]) {
4616 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4617 change = true;
4618 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4619 if (err)
4620 return err;
4621 } else {
4622 params.use_4addr = -1;
4623 }
4624
4625 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4626 if (err < 0)
4627 return err;
4628 if (err > 0)
4629 change = true;
4630
4631 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4632 if (err < 0)
4633 return err;
4634 if (err && netif_running(dev))
4635 return -EBUSY;
4636
4637 if (change)
4638 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4639 else
4640 err = 0;
4641
4642 if (!err && params.use_4addr != -1)
4643 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4644
4645 if (radio_mask)
4646 wdev->radio_mask = radio_mask;
4647
4648 if (change && !err)
4649 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4650
4651 return err;
4652 }
4653
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4654 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4655 {
4656 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4657 struct vif_params params;
4658 struct wireless_dev *wdev;
4659 struct sk_buff *msg;
4660 u32 radio_mask;
4661 int err;
4662 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4663
4664 memset(¶ms, 0, sizeof(params));
4665
4666 if (!info->attrs[NL80211_ATTR_IFNAME])
4667 return -EINVAL;
4668
4669 if (info->attrs[NL80211_ATTR_IFTYPE])
4670 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4671
4672 if (!rdev->ops->add_virtual_intf)
4673 return -EOPNOTSUPP;
4674
4675 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4676 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4677 info->attrs[NL80211_ATTR_MAC]) {
4678 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4679 ETH_ALEN);
4680 if (!is_valid_ether_addr(params.macaddr))
4681 return -EADDRNOTAVAIL;
4682 }
4683
4684 if (info->attrs[NL80211_ATTR_4ADDR]) {
4685 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4686 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4687 if (err)
4688 return err;
4689 }
4690
4691 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4692 return -EOPNOTSUPP;
4693
4694 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4695 if (err < 0)
4696 return err;
4697
4698 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4699 if (err < 0)
4700 return err;
4701
4702 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4703 if (!msg)
4704 return -ENOMEM;
4705
4706 wdev = rdev_add_virtual_intf(rdev,
4707 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4708 NET_NAME_USER, type, ¶ms);
4709 if (WARN_ON(!wdev)) {
4710 nlmsg_free(msg);
4711 return -EPROTO;
4712 } else if (IS_ERR(wdev)) {
4713 nlmsg_free(msg);
4714 return PTR_ERR(wdev);
4715 }
4716
4717 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4718 wdev->owner_nlportid = info->snd_portid;
4719
4720 switch (type) {
4721 case NL80211_IFTYPE_MESH_POINT:
4722 if (!info->attrs[NL80211_ATTR_MESH_ID])
4723 break;
4724 wdev->u.mesh.id_up_len =
4725 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4726 memcpy(wdev->u.mesh.id,
4727 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4728 wdev->u.mesh.id_up_len);
4729 break;
4730 case NL80211_IFTYPE_NAN:
4731 case NL80211_IFTYPE_P2P_DEVICE:
4732 /*
4733 * P2P Device and NAN do not have a netdev, so don't go
4734 * through the netdev notifier and must be added here
4735 */
4736 cfg80211_init_wdev(wdev);
4737 cfg80211_register_wdev(rdev, wdev);
4738 break;
4739 default:
4740 break;
4741 }
4742
4743 if (radio_mask)
4744 wdev->radio_mask = radio_mask;
4745
4746 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4747 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4748 nlmsg_free(msg);
4749 return -ENOBUFS;
4750 }
4751
4752 return genlmsg_reply(msg, info);
4753 }
4754
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4755 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4756 {
4757 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4758
4759 /* to avoid failing a new interface creation due to pending removal */
4760 cfg80211_destroy_ifaces(rdev);
4761
4762 guard(wiphy)(&rdev->wiphy);
4763
4764 return _nl80211_new_interface(skb, info);
4765 }
4766
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4767 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4768 {
4769 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4770 struct wireless_dev *wdev = info->user_ptr[1];
4771
4772 if (!rdev->ops->del_virtual_intf)
4773 return -EOPNOTSUPP;
4774
4775 /*
4776 * We hold RTNL, so this is safe, without RTNL opencount cannot
4777 * reach 0, and thus the rdev cannot be deleted.
4778 *
4779 * We need to do it for the dev_close(), since that will call
4780 * the netdev notifiers, and we need to acquire the mutex there
4781 * but don't know if we get there from here or from some other
4782 * place (e.g. "ip link set ... down").
4783 */
4784 mutex_unlock(&rdev->wiphy.mtx);
4785
4786 /*
4787 * If we remove a wireless device without a netdev then clear
4788 * user_ptr[1] so that nl80211_post_doit won't dereference it
4789 * to check if it needs to do dev_put(). Otherwise it crashes
4790 * since the wdev has been freed, unlike with a netdev where
4791 * we need the dev_put() for the netdev to really be freed.
4792 */
4793 if (!wdev->netdev)
4794 info->user_ptr[1] = NULL;
4795 else
4796 dev_close(wdev->netdev);
4797
4798 mutex_lock(&rdev->wiphy.mtx);
4799
4800 return cfg80211_remove_virtual_intf(rdev, wdev);
4801 }
4802
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4803 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4804 {
4805 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4806 struct net_device *dev = info->user_ptr[1];
4807 u16 noack_map;
4808
4809 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4810 return -EINVAL;
4811
4812 if (!rdev->ops->set_noack_map)
4813 return -EOPNOTSUPP;
4814
4815 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4816
4817 return rdev_set_noack_map(rdev, dev, noack_map);
4818 }
4819
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4820 static int nl80211_validate_key_link_id(struct genl_info *info,
4821 struct wireless_dev *wdev,
4822 int link_id, bool pairwise)
4823 {
4824 if (pairwise) {
4825 if (link_id != -1) {
4826 GENL_SET_ERR_MSG(info,
4827 "link ID not allowed for pairwise key");
4828 return -EINVAL;
4829 }
4830
4831 return 0;
4832 }
4833
4834 if (wdev->valid_links) {
4835 if (link_id == -1) {
4836 GENL_SET_ERR_MSG(info,
4837 "link ID must for MLO group key");
4838 return -EINVAL;
4839 }
4840 if (!(wdev->valid_links & BIT(link_id))) {
4841 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4842 return -EINVAL;
4843 }
4844 } else if (link_id != -1) {
4845 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4846 return -EINVAL;
4847 }
4848
4849 return 0;
4850 }
4851
4852 struct get_key_cookie {
4853 struct sk_buff *msg;
4854 int error;
4855 int idx;
4856 };
4857
get_key_callback(void * c,struct key_params * params)4858 static void get_key_callback(void *c, struct key_params *params)
4859 {
4860 struct nlattr *key;
4861 struct get_key_cookie *cookie = c;
4862
4863 if ((params->seq &&
4864 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4865 params->seq_len, params->seq)) ||
4866 (params->cipher &&
4867 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4868 params->cipher)))
4869 goto nla_put_failure;
4870
4871 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4872 if (!key)
4873 goto nla_put_failure;
4874
4875 if ((params->seq &&
4876 nla_put(cookie->msg, NL80211_KEY_SEQ,
4877 params->seq_len, params->seq)) ||
4878 (params->cipher &&
4879 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4880 params->cipher)))
4881 goto nla_put_failure;
4882
4883 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4884 goto nla_put_failure;
4885
4886 nla_nest_end(cookie->msg, key);
4887
4888 return;
4889 nla_put_failure:
4890 cookie->error = 1;
4891 }
4892
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4893 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4894 {
4895 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4896 int err;
4897 struct net_device *dev = info->user_ptr[1];
4898 u8 key_idx = 0;
4899 const u8 *mac_addr = NULL;
4900 bool pairwise;
4901 struct get_key_cookie cookie = {
4902 .error = 0,
4903 };
4904 void *hdr;
4905 struct sk_buff *msg;
4906 bool bigtk_support = false;
4907 int link_id = nl80211_link_id_or_invalid(info->attrs);
4908 struct wireless_dev *wdev = dev->ieee80211_ptr;
4909
4910 if (wiphy_ext_feature_isset(&rdev->wiphy,
4911 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4912 bigtk_support = true;
4913
4914 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4915 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4916 wiphy_ext_feature_isset(&rdev->wiphy,
4917 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4918 bigtk_support = true;
4919
4920 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4921 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4922
4923 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4924 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4925 return -EINVAL;
4926 }
4927 }
4928
4929 if (info->attrs[NL80211_ATTR_MAC])
4930 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4931
4932 pairwise = !!mac_addr;
4933 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4934 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4935
4936 if (kt != NL80211_KEYTYPE_GROUP &&
4937 kt != NL80211_KEYTYPE_PAIRWISE)
4938 return -EINVAL;
4939 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4940 }
4941
4942 if (!rdev->ops->get_key)
4943 return -EOPNOTSUPP;
4944
4945 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4946 return -ENOENT;
4947
4948 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4949 if (!msg)
4950 return -ENOMEM;
4951
4952 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4953 NL80211_CMD_NEW_KEY);
4954 if (!hdr)
4955 goto nla_put_failure;
4956
4957 cookie.msg = msg;
4958 cookie.idx = key_idx;
4959
4960 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4961 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4962 goto nla_put_failure;
4963 if (mac_addr &&
4964 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4965 goto nla_put_failure;
4966
4967 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4968 if (err)
4969 goto free_msg;
4970
4971 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4972 &cookie, get_key_callback);
4973
4974 if (err)
4975 goto free_msg;
4976
4977 if (cookie.error)
4978 goto nla_put_failure;
4979
4980 genlmsg_end(msg, hdr);
4981 return genlmsg_reply(msg, info);
4982
4983 nla_put_failure:
4984 err = -ENOBUFS;
4985 free_msg:
4986 nlmsg_free(msg);
4987 return err;
4988 }
4989
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4990 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4991 {
4992 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4993 struct key_parse key;
4994 int err;
4995 struct net_device *dev = info->user_ptr[1];
4996 int link_id = nl80211_link_id_or_invalid(info->attrs);
4997 struct wireless_dev *wdev = dev->ieee80211_ptr;
4998
4999 err = nl80211_parse_key(info, &key);
5000 if (err)
5001 return err;
5002
5003 if (key.idx < 0)
5004 return -EINVAL;
5005
5006 /* Only support setting default key and
5007 * Extended Key ID action NL80211_KEY_SET_TX.
5008 */
5009 if (!key.def && !key.defmgmt && !key.defbeacon &&
5010 !(key.p.mode == NL80211_KEY_SET_TX))
5011 return -EINVAL;
5012
5013 if (key.def) {
5014 if (!rdev->ops->set_default_key)
5015 return -EOPNOTSUPP;
5016
5017 err = nl80211_key_allowed(wdev);
5018 if (err)
5019 return err;
5020
5021 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5022 if (err)
5023 return err;
5024
5025 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
5026 key.def_uni, key.def_multi);
5027
5028 if (err)
5029 return err;
5030
5031 #ifdef CONFIG_CFG80211_WEXT
5032 wdev->wext.default_key = key.idx;
5033 #endif
5034 return 0;
5035 } else if (key.defmgmt) {
5036 if (key.def_uni || !key.def_multi)
5037 return -EINVAL;
5038
5039 if (!rdev->ops->set_default_mgmt_key)
5040 return -EOPNOTSUPP;
5041
5042 err = nl80211_key_allowed(wdev);
5043 if (err)
5044 return err;
5045
5046 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5047 if (err)
5048 return err;
5049
5050 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
5051 if (err)
5052 return err;
5053
5054 #ifdef CONFIG_CFG80211_WEXT
5055 wdev->wext.default_mgmt_key = key.idx;
5056 #endif
5057 return 0;
5058 } else if (key.defbeacon) {
5059 if (key.def_uni || !key.def_multi)
5060 return -EINVAL;
5061
5062 if (!rdev->ops->set_default_beacon_key)
5063 return -EOPNOTSUPP;
5064
5065 err = nl80211_key_allowed(wdev);
5066 if (err)
5067 return err;
5068
5069 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5070 if (err)
5071 return err;
5072
5073 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
5074 } else if (key.p.mode == NL80211_KEY_SET_TX &&
5075 wiphy_ext_feature_isset(&rdev->wiphy,
5076 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
5077 u8 *mac_addr = NULL;
5078
5079 if (info->attrs[NL80211_ATTR_MAC])
5080 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5081
5082 if (!mac_addr || key.idx < 0 || key.idx > 1)
5083 return -EINVAL;
5084
5085 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
5086 if (err)
5087 return err;
5088
5089 return rdev_add_key(rdev, dev, link_id, key.idx,
5090 NL80211_KEYTYPE_PAIRWISE,
5091 mac_addr, &key.p);
5092 }
5093
5094 return -EINVAL;
5095 }
5096
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)5097 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
5098 {
5099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5100 int err;
5101 struct net_device *dev = info->user_ptr[1];
5102 struct key_parse key;
5103 const u8 *mac_addr = NULL;
5104 int link_id = nl80211_link_id_or_invalid(info->attrs);
5105 struct wireless_dev *wdev = dev->ieee80211_ptr;
5106
5107 err = nl80211_parse_key(info, &key);
5108 if (err)
5109 return err;
5110
5111 if (!key.p.key) {
5112 GENL_SET_ERR_MSG(info, "no key");
5113 return -EINVAL;
5114 }
5115
5116 if (info->attrs[NL80211_ATTR_MAC])
5117 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5118
5119 if (key.type == -1) {
5120 if (mac_addr)
5121 key.type = NL80211_KEYTYPE_PAIRWISE;
5122 else
5123 key.type = NL80211_KEYTYPE_GROUP;
5124 }
5125
5126 /* for now */
5127 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5128 key.type != NL80211_KEYTYPE_GROUP) {
5129 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
5130 return -EINVAL;
5131 }
5132
5133 if (key.type == NL80211_KEYTYPE_GROUP &&
5134 info->attrs[NL80211_ATTR_VLAN_ID])
5135 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5136
5137 if (!rdev->ops->add_key)
5138 return -EOPNOTSUPP;
5139
5140 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
5141 key.type == NL80211_KEYTYPE_PAIRWISE,
5142 mac_addr)) {
5143 GENL_SET_ERR_MSG(info, "key setting validation failed");
5144 return -EINVAL;
5145 }
5146
5147 err = nl80211_key_allowed(wdev);
5148 if (err)
5149 GENL_SET_ERR_MSG(info, "key not allowed");
5150
5151 if (!err)
5152 err = nl80211_validate_key_link_id(info, wdev, link_id,
5153 key.type == NL80211_KEYTYPE_PAIRWISE);
5154
5155 if (!err) {
5156 err = rdev_add_key(rdev, dev, link_id, key.idx,
5157 key.type == NL80211_KEYTYPE_PAIRWISE,
5158 mac_addr, &key.p);
5159 if (err)
5160 GENL_SET_ERR_MSG(info, "key addition failed");
5161 }
5162
5163 return err;
5164 }
5165
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)5166 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
5167 {
5168 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5169 int err;
5170 struct net_device *dev = info->user_ptr[1];
5171 u8 *mac_addr = NULL;
5172 struct key_parse key;
5173 int link_id = nl80211_link_id_or_invalid(info->attrs);
5174 struct wireless_dev *wdev = dev->ieee80211_ptr;
5175
5176 err = nl80211_parse_key(info, &key);
5177 if (err)
5178 return err;
5179
5180 if (info->attrs[NL80211_ATTR_MAC])
5181 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5182
5183 if (key.type == -1) {
5184 if (mac_addr)
5185 key.type = NL80211_KEYTYPE_PAIRWISE;
5186 else
5187 key.type = NL80211_KEYTYPE_GROUP;
5188 }
5189
5190 /* for now */
5191 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5192 key.type != NL80211_KEYTYPE_GROUP)
5193 return -EINVAL;
5194
5195 if (!cfg80211_valid_key_idx(rdev, key.idx,
5196 key.type == NL80211_KEYTYPE_PAIRWISE))
5197 return -EINVAL;
5198
5199 if (!rdev->ops->del_key)
5200 return -EOPNOTSUPP;
5201
5202 err = nl80211_key_allowed(wdev);
5203
5204 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
5205 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
5206 err = -ENOENT;
5207
5208 if (!err)
5209 err = nl80211_validate_key_link_id(info, wdev, link_id,
5210 key.type == NL80211_KEYTYPE_PAIRWISE);
5211
5212 if (!err)
5213 err = rdev_del_key(rdev, dev, link_id, key.idx,
5214 key.type == NL80211_KEYTYPE_PAIRWISE,
5215 mac_addr);
5216
5217 #ifdef CONFIG_CFG80211_WEXT
5218 if (!err) {
5219 if (key.idx == wdev->wext.default_key)
5220 wdev->wext.default_key = -1;
5221 else if (key.idx == wdev->wext.default_mgmt_key)
5222 wdev->wext.default_mgmt_key = -1;
5223 }
5224 #endif
5225
5226 return err;
5227 }
5228
5229 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)5230 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5231 {
5232 struct nlattr *attr;
5233 int n_entries = 0, tmp;
5234
5235 nla_for_each_nested(attr, nl_attr, tmp) {
5236 if (nla_len(attr) != ETH_ALEN)
5237 return -EINVAL;
5238
5239 n_entries++;
5240 }
5241
5242 return n_entries;
5243 }
5244
5245 /*
5246 * This function parses ACL information and allocates memory for ACL data.
5247 * On successful return, the calling function is responsible to free the
5248 * ACL buffer returned by this function.
5249 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)5250 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5251 struct genl_info *info)
5252 {
5253 enum nl80211_acl_policy acl_policy;
5254 struct nlattr *attr;
5255 struct cfg80211_acl_data *acl;
5256 int i = 0, n_entries, tmp;
5257
5258 if (!wiphy->max_acl_mac_addrs)
5259 return ERR_PTR(-EOPNOTSUPP);
5260
5261 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5262 return ERR_PTR(-EINVAL);
5263
5264 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5265 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5266 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5267 return ERR_PTR(-EINVAL);
5268
5269 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5270 return ERR_PTR(-EINVAL);
5271
5272 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5273 if (n_entries < 0)
5274 return ERR_PTR(n_entries);
5275
5276 if (n_entries > wiphy->max_acl_mac_addrs)
5277 return ERR_PTR(-EOPNOTSUPP);
5278
5279 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5280 if (!acl)
5281 return ERR_PTR(-ENOMEM);
5282 acl->n_acl_entries = n_entries;
5283
5284 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5285 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5286 i++;
5287 }
5288 acl->acl_policy = acl_policy;
5289
5290 return acl;
5291 }
5292
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)5293 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5294 {
5295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5296 struct net_device *dev = info->user_ptr[1];
5297 struct cfg80211_acl_data *acl;
5298 int err;
5299
5300 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5301 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5302 return -EOPNOTSUPP;
5303
5304 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5305 return -EINVAL;
5306
5307 acl = parse_acl_data(&rdev->wiphy, info);
5308 if (IS_ERR(acl))
5309 return PTR_ERR(acl);
5310
5311 err = rdev_set_mac_acl(rdev, dev, acl);
5312
5313 kfree(acl);
5314
5315 return err;
5316 }
5317
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)5318 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5319 u8 *rates, u8 rates_len)
5320 {
5321 u8 i;
5322 u32 mask = 0;
5323
5324 for (i = 0; i < rates_len; i++) {
5325 int rate = (rates[i] & 0x7f) * 5;
5326 int ridx;
5327
5328 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5329 struct ieee80211_rate *srate =
5330 &sband->bitrates[ridx];
5331 if (rate == srate->bitrate) {
5332 mask |= 1 << ridx;
5333 break;
5334 }
5335 }
5336 if (ridx == sband->n_bitrates)
5337 return 0; /* rate not found */
5338 }
5339
5340 return mask;
5341 }
5342
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])5343 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5344 u8 *rates, u8 rates_len,
5345 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5346 {
5347 u8 i;
5348
5349 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5350
5351 for (i = 0; i < rates_len; i++) {
5352 int ridx, rbit;
5353
5354 ridx = rates[i] / 8;
5355 rbit = BIT(rates[i] % 8);
5356
5357 /* check validity */
5358 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5359 return false;
5360
5361 /* check availability */
5362 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5363 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5364 mcs[ridx] |= rbit;
5365 else
5366 return false;
5367 }
5368
5369 return true;
5370 }
5371
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)5372 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5373 {
5374 u16 mcs_mask = 0;
5375
5376 switch (vht_mcs_map) {
5377 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5378 break;
5379 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5380 mcs_mask = 0x00FF;
5381 break;
5382 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5383 mcs_mask = 0x01FF;
5384 break;
5385 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5386 mcs_mask = 0x03FF;
5387 break;
5388 default:
5389 break;
5390 }
5391
5392 return mcs_mask;
5393 }
5394
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5395 static void vht_build_mcs_mask(u16 vht_mcs_map,
5396 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5397 {
5398 u8 nss;
5399
5400 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5401 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5402 vht_mcs_map >>= 2;
5403 }
5404 }
5405
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5406 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5407 struct nl80211_txrate_vht *txrate,
5408 u16 mcs[NL80211_VHT_NSS_MAX])
5409 {
5410 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5411 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5412 u8 i;
5413
5414 if (!sband->vht_cap.vht_supported)
5415 return false;
5416
5417 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5418
5419 /* Build vht_mcs_mask from VHT capabilities */
5420 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5421
5422 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5423 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5424 mcs[i] = txrate->mcs[i];
5425 else
5426 return false;
5427 }
5428
5429 return true;
5430 }
5431
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5432 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5433 {
5434 switch (he_mcs_map) {
5435 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5436 return 0;
5437 case IEEE80211_HE_MCS_SUPPORT_0_7:
5438 return 0x00FF;
5439 case IEEE80211_HE_MCS_SUPPORT_0_9:
5440 return 0x03FF;
5441 case IEEE80211_HE_MCS_SUPPORT_0_11:
5442 return 0xFFF;
5443 default:
5444 break;
5445 }
5446 return 0;
5447 }
5448
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5449 static void he_build_mcs_mask(u16 he_mcs_map,
5450 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5451 {
5452 u8 nss;
5453
5454 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5455 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5456 he_mcs_map >>= 2;
5457 }
5458 }
5459
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5460 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5461 const struct ieee80211_sta_he_cap *he_cap)
5462 {
5463 struct net_device *dev = info->user_ptr[1];
5464 struct wireless_dev *wdev = dev->ieee80211_ptr;
5465 struct cfg80211_chan_def *chandef;
5466 __le16 tx_mcs;
5467
5468 chandef = wdev_chandef(wdev, link_id);
5469 if (!chandef) {
5470 /*
5471 * This is probably broken, but we never maintained
5472 * a chandef in these cases, so it always was.
5473 */
5474 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5475 }
5476
5477 switch (chandef->width) {
5478 case NL80211_CHAN_WIDTH_80P80:
5479 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5480 break;
5481 case NL80211_CHAN_WIDTH_160:
5482 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5483 break;
5484 default:
5485 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5486 break;
5487 }
5488
5489 return le16_to_cpu(tx_mcs);
5490 }
5491
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5492 static bool he_set_mcs_mask(struct genl_info *info,
5493 struct wireless_dev *wdev,
5494 struct ieee80211_supported_band *sband,
5495 struct nl80211_txrate_he *txrate,
5496 u16 mcs[NL80211_HE_NSS_MAX],
5497 unsigned int link_id)
5498 {
5499 const struct ieee80211_sta_he_cap *he_cap;
5500 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5501 u16 tx_mcs_map = 0;
5502 u8 i;
5503
5504 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5505 if (!he_cap)
5506 return false;
5507
5508 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5509
5510 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5511
5512 /* Build he_mcs_mask from HE capabilities */
5513 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5514
5515 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5516 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5517 mcs[i] = txrate->mcs[i];
5518 else
5519 return false;
5520 }
5521
5522 return true;
5523 }
5524
eht_build_mcs_mask(struct genl_info * info,const struct ieee80211_sta_eht_cap * eht_cap,u8 mcs_nss_len,u16 * mcs_mask)5525 static void eht_build_mcs_mask(struct genl_info *info,
5526 const struct ieee80211_sta_eht_cap *eht_cap,
5527 u8 mcs_nss_len, u16 *mcs_mask)
5528 {
5529 struct net_device *dev = info->user_ptr[1];
5530 struct wireless_dev *wdev = dev->ieee80211_ptr;
5531 u8 nss, mcs_7 = 0, mcs_9 = 0, mcs_11 = 0, mcs_13 = 0;
5532 unsigned int link_id = nl80211_link_id(info->attrs);
5533
5534 if (mcs_nss_len == 4) {
5535 const struct ieee80211_eht_mcs_nss_supp_20mhz_only *mcs =
5536 &eht_cap->eht_mcs_nss_supp.only_20mhz;
5537
5538 mcs_7 = u8_get_bits(mcs->rx_tx_mcs7_max_nss,
5539 IEEE80211_EHT_MCS_NSS_TX);
5540 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5541 IEEE80211_EHT_MCS_NSS_TX);
5542 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5543 IEEE80211_EHT_MCS_NSS_TX);
5544 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5545 IEEE80211_EHT_MCS_NSS_TX);
5546
5547 } else {
5548 const struct ieee80211_eht_mcs_nss_supp_bw *mcs;
5549 enum nl80211_chan_width width;
5550
5551 switch (wdev->iftype) {
5552 case NL80211_IFTYPE_ADHOC:
5553 width = wdev->u.ibss.chandef.width;
5554 break;
5555 case NL80211_IFTYPE_MESH_POINT:
5556 width = wdev->u.mesh.chandef.width;
5557 break;
5558 case NL80211_IFTYPE_OCB:
5559 width = wdev->u.ocb.chandef.width;
5560 break;
5561 default:
5562 if (wdev->valid_links)
5563 width = wdev->links[link_id].ap.chandef.width;
5564 else
5565 width = wdev->u.ap.preset_chandef.width;
5566 break;
5567 }
5568
5569 switch (width) {
5570 case NL80211_CHAN_WIDTH_320:
5571 mcs = &eht_cap->eht_mcs_nss_supp.bw._320;
5572 break;
5573 case NL80211_CHAN_WIDTH_160:
5574 mcs = &eht_cap->eht_mcs_nss_supp.bw._160;
5575 break;
5576 default:
5577 mcs = &eht_cap->eht_mcs_nss_supp.bw._80;
5578 break;
5579 }
5580
5581 mcs_7 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5582 IEEE80211_EHT_MCS_NSS_TX);
5583 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5584 IEEE80211_EHT_MCS_NSS_TX);
5585 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5586 IEEE80211_EHT_MCS_NSS_TX);
5587 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5588 IEEE80211_EHT_MCS_NSS_TX);
5589 }
5590
5591 /* Enable MCS 14 for NSS 0 */
5592 if (eht_cap->eht_cap_elem.phy_cap_info[6] &
5593 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP)
5594 mcs_mask[0] |= 0x4000;
5595
5596 /* Enable MCS 15 for NSS 0 */
5597 mcs_mask[0] |= 0x8000;
5598
5599 for (nss = 0; nss < NL80211_EHT_NSS_MAX; nss++) {
5600 if (!mcs_7)
5601 continue;
5602 mcs_mask[nss] |= 0x00FF;
5603 mcs_7--;
5604
5605 if (!mcs_9)
5606 continue;
5607 mcs_mask[nss] |= 0x0300;
5608 mcs_9--;
5609
5610 if (!mcs_11)
5611 continue;
5612 mcs_mask[nss] |= 0x0C00;
5613 mcs_11--;
5614
5615 if (!mcs_13)
5616 continue;
5617 mcs_mask[nss] |= 0x3000;
5618 mcs_13--;
5619 }
5620 }
5621
eht_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_eht * txrate,u16 mcs[NL80211_EHT_NSS_MAX])5622 static bool eht_set_mcs_mask(struct genl_info *info, struct wireless_dev *wdev,
5623 struct ieee80211_supported_band *sband,
5624 struct nl80211_txrate_eht *txrate,
5625 u16 mcs[NL80211_EHT_NSS_MAX])
5626 {
5627 const struct ieee80211_sta_he_cap *he_cap;
5628 const struct ieee80211_sta_eht_cap *eht_cap;
5629 u16 tx_mcs_mask[NL80211_EHT_NSS_MAX] = { 0 };
5630 u8 i, mcs_nss_len;
5631
5632 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5633 if (!he_cap)
5634 return false;
5635
5636 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5637 if (!eht_cap)
5638 return false;
5639
5640 /* Checks for MCS 14 */
5641 if (txrate->mcs[0] & 0x4000) {
5642 if (sband->band != NL80211_BAND_6GHZ)
5643 return false;
5644
5645 if (!(eht_cap->eht_cap_elem.phy_cap_info[6] &
5646 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP))
5647 return false;
5648 }
5649
5650 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5651 &eht_cap->eht_cap_elem,
5652 wdev->iftype ==
5653 NL80211_IFTYPE_STATION);
5654
5655 if (mcs_nss_len == 3) {
5656 /* Supported iftypes for setting non-20 MHZ only EHT MCS */
5657 switch (wdev->iftype) {
5658 case NL80211_IFTYPE_ADHOC:
5659 case NL80211_IFTYPE_AP:
5660 case NL80211_IFTYPE_P2P_GO:
5661 case NL80211_IFTYPE_MESH_POINT:
5662 case NL80211_IFTYPE_OCB:
5663 break;
5664 default:
5665 return false;
5666 }
5667 }
5668
5669 /* Build eht_mcs_mask from EHT and HE capabilities */
5670 eht_build_mcs_mask(info, eht_cap, mcs_nss_len, tx_mcs_mask);
5671
5672 memset(mcs, 0, sizeof(u16) * NL80211_EHT_NSS_MAX);
5673 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5674 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5675 mcs[i] = txrate->mcs[i];
5676 else
5677 return false;
5678 }
5679
5680 return true;
5681 }
5682
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5683 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5684 struct nlattr *attrs[],
5685 enum nl80211_attrs attr,
5686 struct cfg80211_bitrate_mask *mask,
5687 struct net_device *dev,
5688 bool default_all_enabled,
5689 unsigned int link_id)
5690 {
5691 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5693 struct wireless_dev *wdev = dev->ieee80211_ptr;
5694 int rem, i;
5695 struct nlattr *tx_rates;
5696 struct ieee80211_supported_band *sband;
5697 u16 vht_tx_mcs_map, he_tx_mcs_map;
5698
5699 memset(mask, 0, sizeof(*mask));
5700 /* Default to all rates enabled */
5701 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5702 const struct ieee80211_sta_he_cap *he_cap;
5703 const struct ieee80211_sta_eht_cap *eht_cap;
5704 u8 mcs_nss_len;
5705
5706 if (!default_all_enabled)
5707 break;
5708
5709 sband = rdev->wiphy.bands[i];
5710
5711 if (!sband)
5712 continue;
5713
5714 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5715 memcpy(mask->control[i].ht_mcs,
5716 sband->ht_cap.mcs.rx_mask,
5717 sizeof(mask->control[i].ht_mcs));
5718
5719 if (sband->vht_cap.vht_supported) {
5720 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5721 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5722 }
5723
5724 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5725 if (!he_cap)
5726 continue;
5727
5728 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5729 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5730
5731 mask->control[i].he_gi = 0xFF;
5732 mask->control[i].he_ltf = 0xFF;
5733
5734 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5735 if (!eht_cap)
5736 continue;
5737
5738 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5739 &eht_cap->eht_cap_elem,
5740 wdev->iftype ==
5741 NL80211_IFTYPE_STATION);
5742
5743 eht_build_mcs_mask(info, eht_cap, mcs_nss_len,
5744 mask->control[i].eht_mcs);
5745
5746 mask->control[i].eht_gi = 0xFF;
5747 mask->control[i].eht_ltf = 0xFF;
5748 }
5749
5750 /* if no rates are given set it back to the defaults */
5751 if (!attrs[attr])
5752 goto out;
5753
5754 /* The nested attribute uses enum nl80211_band as the index. This maps
5755 * directly to the enum nl80211_band values used in cfg80211.
5756 */
5757 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5758 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5759 enum nl80211_band band = nla_type(tx_rates);
5760 int err;
5761
5762 if (band < 0 || band >= NUM_NL80211_BANDS)
5763 return -EINVAL;
5764 sband = rdev->wiphy.bands[band];
5765 if (sband == NULL)
5766 return -EINVAL;
5767 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5768 tx_rates,
5769 nl80211_txattr_policy,
5770 info->extack);
5771 if (err)
5772 return err;
5773 if (tb[NL80211_TXRATE_LEGACY]) {
5774 mask->control[band].legacy = rateset_to_mask(
5775 sband,
5776 nla_data(tb[NL80211_TXRATE_LEGACY]),
5777 nla_len(tb[NL80211_TXRATE_LEGACY]));
5778 if ((mask->control[band].legacy == 0) &&
5779 nla_len(tb[NL80211_TXRATE_LEGACY]))
5780 return -EINVAL;
5781 }
5782 if (tb[NL80211_TXRATE_HT]) {
5783 if (!ht_rateset_to_mask(
5784 sband,
5785 nla_data(tb[NL80211_TXRATE_HT]),
5786 nla_len(tb[NL80211_TXRATE_HT]),
5787 mask->control[band].ht_mcs))
5788 return -EINVAL;
5789 }
5790
5791 if (tb[NL80211_TXRATE_VHT]) {
5792 if (!vht_set_mcs_mask(
5793 sband,
5794 nla_data(tb[NL80211_TXRATE_VHT]),
5795 mask->control[band].vht_mcs))
5796 return -EINVAL;
5797 }
5798
5799 if (tb[NL80211_TXRATE_GI]) {
5800 mask->control[band].gi =
5801 nla_get_u8(tb[NL80211_TXRATE_GI]);
5802 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5803 return -EINVAL;
5804 }
5805 if (tb[NL80211_TXRATE_HE] &&
5806 !he_set_mcs_mask(info, wdev, sband,
5807 nla_data(tb[NL80211_TXRATE_HE]),
5808 mask->control[band].he_mcs,
5809 link_id))
5810 return -EINVAL;
5811
5812 if (tb[NL80211_TXRATE_HE_GI])
5813 mask->control[band].he_gi =
5814 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5815 if (tb[NL80211_TXRATE_HE_LTF])
5816 mask->control[band].he_ltf =
5817 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5818
5819 if (tb[NL80211_TXRATE_EHT] &&
5820 !eht_set_mcs_mask(info, wdev, sband,
5821 nla_data(tb[NL80211_TXRATE_EHT]),
5822 mask->control[band].eht_mcs))
5823 return -EINVAL;
5824
5825 if (tb[NL80211_TXRATE_EHT_GI])
5826 mask->control[band].eht_gi =
5827 nla_get_u8(tb[NL80211_TXRATE_EHT_GI]);
5828 if (tb[NL80211_TXRATE_EHT_LTF])
5829 mask->control[band].eht_ltf =
5830 nla_get_u8(tb[NL80211_TXRATE_EHT_LTF]);
5831
5832 if (mask->control[band].legacy == 0) {
5833 /* don't allow empty legacy rates if HT, VHT, HE or EHT
5834 * are not even supported.
5835 */
5836 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5837 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5838 ieee80211_get_he_iftype_cap(sband, wdev->iftype) ||
5839 ieee80211_get_eht_iftype_cap(sband, wdev->iftype)))
5840 return -EINVAL;
5841
5842 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5843 if (mask->control[band].ht_mcs[i])
5844 goto out;
5845
5846 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5847 if (mask->control[band].vht_mcs[i])
5848 goto out;
5849
5850 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5851 if (mask->control[band].he_mcs[i])
5852 goto out;
5853
5854 for (i = 0; i < NL80211_EHT_NSS_MAX; i++)
5855 if (mask->control[band].eht_mcs[i])
5856 goto out;
5857
5858 /* legacy and mcs rates may not be both empty */
5859 return -EINVAL;
5860 }
5861 }
5862
5863 out:
5864 return 0;
5865 }
5866
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5867 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5868 enum nl80211_band band,
5869 struct cfg80211_bitrate_mask *beacon_rate)
5870 {
5871 u32 count_ht, count_vht, count_he, count_eht, i;
5872 u32 rate = beacon_rate->control[band].legacy;
5873
5874 /* Allow only one rate */
5875 if (hweight32(rate) > 1)
5876 return -EINVAL;
5877
5878 count_ht = 0;
5879 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5880 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5881 return -EINVAL;
5882 } else if (beacon_rate->control[band].ht_mcs[i]) {
5883 count_ht++;
5884 if (count_ht > 1)
5885 return -EINVAL;
5886 }
5887 if (count_ht && rate)
5888 return -EINVAL;
5889 }
5890
5891 count_vht = 0;
5892 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5893 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5894 return -EINVAL;
5895 } else if (beacon_rate->control[band].vht_mcs[i]) {
5896 count_vht++;
5897 if (count_vht > 1)
5898 return -EINVAL;
5899 }
5900 if (count_vht && rate)
5901 return -EINVAL;
5902 }
5903
5904 count_he = 0;
5905 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5906 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5907 return -EINVAL;
5908 } else if (beacon_rate->control[band].he_mcs[i]) {
5909 count_he++;
5910 if (count_he > 1)
5911 return -EINVAL;
5912 }
5913 if (count_he && rate)
5914 return -EINVAL;
5915 }
5916
5917 count_eht = 0;
5918 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5919 if (hweight16(beacon_rate->control[band].eht_mcs[i]) > 1) {
5920 return -EINVAL;
5921 } else if (beacon_rate->control[band].eht_mcs[i]) {
5922 count_eht++;
5923 if (count_eht > 1)
5924 return -EINVAL;
5925 }
5926 if (count_eht && rate)
5927 return -EINVAL;
5928 }
5929
5930 if ((count_ht && count_vht && count_he && count_eht) ||
5931 (!rate && !count_ht && !count_vht && !count_he && !count_eht))
5932 return -EINVAL;
5933
5934 if (rate &&
5935 !wiphy_ext_feature_isset(&rdev->wiphy,
5936 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5937 return -EINVAL;
5938 if (count_ht &&
5939 !wiphy_ext_feature_isset(&rdev->wiphy,
5940 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5941 return -EINVAL;
5942 if (count_vht &&
5943 !wiphy_ext_feature_isset(&rdev->wiphy,
5944 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5945 return -EINVAL;
5946 if (count_he &&
5947 !wiphy_ext_feature_isset(&rdev->wiphy,
5948 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5949 return -EINVAL;
5950
5951 if (count_eht &&
5952 !wiphy_ext_feature_isset(&rdev->wiphy,
5953 NL80211_EXT_FEATURE_BEACON_RATE_EHT))
5954 return -EINVAL;
5955
5956 return 0;
5957 }
5958
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,unsigned int link_id,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5959 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5960 struct net_device *dev,
5961 unsigned int link_id,
5962 struct nlattr *attrs,
5963 struct cfg80211_mbssid_config *config,
5964 u8 num_elems)
5965 {
5966 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5967 int tx_link_id = -1;
5968
5969 if (!wiphy->mbssid_max_interfaces)
5970 return -EOPNOTSUPP;
5971
5972 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5973 NULL) ||
5974 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5975 return -EINVAL;
5976
5977 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5978 if (config->ema) {
5979 if (!wiphy->ema_max_profile_periodicity)
5980 return -EOPNOTSUPP;
5981
5982 if (num_elems > wiphy->ema_max_profile_periodicity)
5983 return -EINVAL;
5984 }
5985
5986 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5987 if (config->index >= wiphy->mbssid_max_interfaces ||
5988 (!config->index && !num_elems))
5989 return -EINVAL;
5990
5991 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
5992 tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
5993
5994 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5995 u32 tx_ifindex =
5996 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5997
5998 if ((!config->index && tx_ifindex != dev->ifindex) ||
5999 (config->index && tx_ifindex == dev->ifindex))
6000 return -EINVAL;
6001
6002 if (tx_ifindex != dev->ifindex) {
6003 struct net_device *tx_netdev =
6004 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
6005
6006 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
6007 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
6008 tx_netdev->ieee80211_ptr->iftype !=
6009 NL80211_IFTYPE_AP) {
6010 dev_put(tx_netdev);
6011 return -EINVAL;
6012 }
6013
6014 config->tx_wdev = tx_netdev->ieee80211_ptr;
6015 /* Caller should call dev_put(config->tx_wdev) from this point */
6016
6017 if (config->tx_wdev->valid_links) {
6018 if (tx_link_id == -1 ||
6019 !(config->tx_wdev->valid_links & BIT(tx_link_id)))
6020 return -ENOLINK;
6021
6022 config->tx_link_id = tx_link_id;
6023 }
6024 } else {
6025 if (tx_link_id >= 0 && tx_link_id != link_id)
6026 return -EINVAL;
6027
6028 config->tx_wdev = dev->ieee80211_ptr;
6029 }
6030 } else if (!config->index) {
6031 if (tx_link_id >= 0 && tx_link_id != link_id)
6032 return -EINVAL;
6033
6034 config->tx_wdev = dev->ieee80211_ptr;
6035 } else {
6036 return -EINVAL;
6037 }
6038
6039 return 0;
6040 }
6041
6042 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)6043 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
6044 {
6045 struct nlattr *nl_elems;
6046 struct cfg80211_mbssid_elems *elems;
6047 int rem_elems;
6048 u8 i = 0, num_elems = 0;
6049
6050 if (!wiphy->mbssid_max_interfaces)
6051 return ERR_PTR(-EINVAL);
6052
6053 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6054 if (num_elems >= 255)
6055 return ERR_PTR(-EINVAL);
6056 num_elems++;
6057 }
6058
6059 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6060 if (!elems)
6061 return ERR_PTR(-ENOMEM);
6062 elems->cnt = num_elems;
6063
6064 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6065 elems->elem[i].data = nla_data(nl_elems);
6066 elems->elem[i].len = nla_len(nl_elems);
6067 i++;
6068 }
6069 return elems;
6070 }
6071
6072 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)6073 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
6074 struct netlink_ext_ack *extack)
6075 {
6076 struct nlattr *nl_elems;
6077 struct cfg80211_rnr_elems *elems;
6078 int rem_elems;
6079 u8 i = 0, num_elems = 0;
6080
6081 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6082 int ret;
6083
6084 ret = validate_ie_attr(nl_elems, extack);
6085 if (ret)
6086 return ERR_PTR(ret);
6087
6088 num_elems++;
6089 }
6090
6091 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6092 if (!elems)
6093 return ERR_PTR(-ENOMEM);
6094 elems->cnt = num_elems;
6095
6096 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6097 elems->elem[i].data = nla_data(nl_elems);
6098 elems->elem[i].len = nla_len(nl_elems);
6099 i++;
6100 }
6101 return elems;
6102 }
6103
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)6104 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
6105 struct cfg80211_he_bss_color *he_bss_color)
6106 {
6107 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
6108 int err;
6109
6110 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
6111 he_bss_color_policy, NULL);
6112 if (err)
6113 return err;
6114
6115 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
6116 return -EINVAL;
6117
6118 he_bss_color->color =
6119 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
6120 he_bss_color->enabled =
6121 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
6122 he_bss_color->partial =
6123 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
6124
6125 return 0;
6126 }
6127
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)6128 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
6129 struct nlattr *attrs[],
6130 struct cfg80211_beacon_data *bcn,
6131 struct netlink_ext_ack *extack)
6132 {
6133 bool haveinfo = false;
6134 int err;
6135
6136 memset(bcn, 0, sizeof(*bcn));
6137
6138 bcn->link_id = nl80211_link_id(attrs);
6139
6140 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
6141 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
6142 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
6143 if (!bcn->head_len)
6144 return -EINVAL;
6145 haveinfo = true;
6146 }
6147
6148 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
6149 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
6150 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
6151 haveinfo = true;
6152 }
6153
6154 if (!haveinfo)
6155 return -EINVAL;
6156
6157 if (attrs[NL80211_ATTR_IE]) {
6158 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
6159 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
6160 }
6161
6162 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
6163 bcn->proberesp_ies =
6164 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6165 bcn->proberesp_ies_len =
6166 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6167 }
6168
6169 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
6170 bcn->assocresp_ies =
6171 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6172 bcn->assocresp_ies_len =
6173 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6174 }
6175
6176 if (attrs[NL80211_ATTR_PROBE_RESP]) {
6177 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
6178 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
6179 }
6180
6181 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
6182 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
6183
6184 err = nla_parse_nested_deprecated(tb,
6185 NL80211_FTM_RESP_ATTR_MAX,
6186 attrs[NL80211_ATTR_FTM_RESPONDER],
6187 NULL, NULL);
6188 if (err)
6189 return err;
6190
6191 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
6192 wiphy_ext_feature_isset(&rdev->wiphy,
6193 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
6194 bcn->ftm_responder = 1;
6195 else
6196 return -EOPNOTSUPP;
6197
6198 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
6199 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
6200 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
6201 }
6202
6203 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
6204 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6205 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6206 }
6207 } else {
6208 bcn->ftm_responder = -1;
6209 }
6210
6211 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
6212 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
6213 &bcn->he_bss_color);
6214 if (err)
6215 return err;
6216 bcn->he_bss_color_valid = true;
6217 }
6218
6219 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
6220 struct cfg80211_mbssid_elems *mbssid =
6221 nl80211_parse_mbssid_elems(&rdev->wiphy,
6222 attrs[NL80211_ATTR_MBSSID_ELEMS]);
6223
6224 if (IS_ERR(mbssid))
6225 return PTR_ERR(mbssid);
6226
6227 bcn->mbssid_ies = mbssid;
6228
6229 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
6230 struct cfg80211_rnr_elems *rnr =
6231 nl80211_parse_rnr_elems(&rdev->wiphy,
6232 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
6233 extack);
6234
6235 if (IS_ERR(rnr))
6236 return PTR_ERR(rnr);
6237
6238 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
6239 return -EINVAL;
6240
6241 bcn->rnr_ies = rnr;
6242 }
6243 }
6244
6245 return 0;
6246 }
6247
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)6248 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
6249 struct ieee80211_he_obss_pd *he_obss_pd)
6250 {
6251 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
6252 int err;
6253
6254 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
6255 he_obss_pd_policy, NULL);
6256 if (err)
6257 return err;
6258
6259 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
6260 return -EINVAL;
6261
6262 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
6263
6264 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
6265 he_obss_pd->min_offset =
6266 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
6267 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
6268 he_obss_pd->max_offset =
6269 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
6270 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
6271 he_obss_pd->non_srg_max_offset =
6272 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
6273
6274 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
6275 return -EINVAL;
6276
6277 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
6278 memcpy(he_obss_pd->bss_color_bitmap,
6279 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
6280 sizeof(he_obss_pd->bss_color_bitmap));
6281
6282 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
6283 memcpy(he_obss_pd->partial_bssid_bitmap,
6284 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
6285 sizeof(he_obss_pd->partial_bssid_bitmap));
6286
6287 he_obss_pd->enable = true;
6288
6289 return 0;
6290 }
6291
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_fils_discovery * fd)6292 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
6293 struct nlattr *attrs,
6294 struct cfg80211_fils_discovery *fd)
6295 {
6296 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
6297 int ret;
6298
6299 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6300 NL80211_EXT_FEATURE_FILS_DISCOVERY))
6301 return -EINVAL;
6302
6303 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
6304 NULL, NULL);
6305 if (ret)
6306 return ret;
6307
6308 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
6309 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
6310 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
6311 fd->update = true;
6312 return 0;
6313 }
6314
6315 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
6316 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
6317 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
6318 return -EINVAL;
6319
6320 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6321 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6322 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
6323 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
6324 fd->update = true;
6325 return 0;
6326 }
6327
6328 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_unsol_bcast_probe_resp * presp)6329 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
6330 struct nlattr *attrs,
6331 struct cfg80211_unsol_bcast_probe_resp *presp)
6332 {
6333 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
6334 int ret;
6335
6336 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6337 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
6338 return -EINVAL;
6339
6340 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
6341 attrs, NULL, NULL);
6342 if (ret)
6343 return ret;
6344
6345 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
6346 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
6347 presp->update = true;
6348 return 0;
6349 }
6350
6351 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
6352 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
6353 return -EINVAL;
6354
6355 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6356 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6357 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
6358 presp->update = true;
6359 return 0;
6360 }
6361
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)6362 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
6363 const struct element *rates)
6364 {
6365 int i;
6366
6367 if (!rates)
6368 return;
6369
6370 for (i = 0; i < rates->datalen; i++) {
6371 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
6372 params->ht_required = true;
6373 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
6374 params->vht_required = true;
6375 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
6376 params->he_required = true;
6377 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
6378 params->sae_h2e_required = true;
6379 }
6380 }
6381
6382 /*
6383 * Since the nl80211 API didn't include, from the beginning, attributes about
6384 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
6385 * benefit of drivers that rebuild IEs in the firmware.
6386 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)6387 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
6388 {
6389 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
6390 size_t ies_len = bcn->tail_len;
6391 const u8 *ies = bcn->tail;
6392 const struct element *rates;
6393 const struct element *cap;
6394
6395 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
6396 nl80211_check_ap_rate_selectors(params, rates);
6397
6398 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
6399 nl80211_check_ap_rate_selectors(params, rates);
6400
6401 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
6402 if (cap && cap->datalen >= sizeof(*params->ht_cap))
6403 params->ht_cap = (void *)cap->data;
6404 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
6405 if (cap && cap->datalen >= sizeof(*params->vht_cap))
6406 params->vht_cap = (void *)cap->data;
6407 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
6408 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
6409 params->he_cap = (void *)(cap->data + 1);
6410 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
6411 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
6412 params->he_oper = (void *)(cap->data + 1);
6413 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
6414 if (cap) {
6415 if (!cap->datalen)
6416 return -EINVAL;
6417 params->eht_cap = (void *)(cap->data + 1);
6418 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
6419 (const u8 *)params->eht_cap,
6420 cap->datalen - 1, true))
6421 return -EINVAL;
6422 }
6423 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
6424 if (cap) {
6425 if (!cap->datalen)
6426 return -EINVAL;
6427 params->eht_oper = (void *)(cap->data + 1);
6428 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
6429 cap->datalen - 1))
6430 return -EINVAL;
6431 }
6432 return 0;
6433 }
6434
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)6435 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
6436 struct cfg80211_ap_settings *params)
6437 {
6438 struct wireless_dev *wdev;
6439
6440 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
6441 if (wdev->iftype != NL80211_IFTYPE_AP &&
6442 wdev->iftype != NL80211_IFTYPE_P2P_GO)
6443 continue;
6444
6445 if (!wdev->u.ap.preset_chandef.chan)
6446 continue;
6447
6448 params->chandef = wdev->u.ap.preset_chandef;
6449 return true;
6450 }
6451
6452 return false;
6453 }
6454
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)6455 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6456 enum nl80211_auth_type auth_type,
6457 enum nl80211_commands cmd)
6458 {
6459 if (auth_type > NL80211_AUTHTYPE_MAX)
6460 return false;
6461
6462 switch (cmd) {
6463 case NL80211_CMD_AUTHENTICATE:
6464 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6465 auth_type == NL80211_AUTHTYPE_SAE)
6466 return false;
6467 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6468 NL80211_EXT_FEATURE_FILS_STA) &&
6469 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6470 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6471 auth_type == NL80211_AUTHTYPE_FILS_PK))
6472 return false;
6473 return true;
6474 case NL80211_CMD_CONNECT:
6475 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6476 !wiphy_ext_feature_isset(&rdev->wiphy,
6477 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6478 auth_type == NL80211_AUTHTYPE_SAE)
6479 return false;
6480
6481 /* FILS with SK PFS or PK not supported yet */
6482 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6483 auth_type == NL80211_AUTHTYPE_FILS_PK)
6484 return false;
6485 if (!wiphy_ext_feature_isset(
6486 &rdev->wiphy,
6487 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6488 auth_type == NL80211_AUTHTYPE_FILS_SK)
6489 return false;
6490 return true;
6491 case NL80211_CMD_START_AP:
6492 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6493 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6494 auth_type == NL80211_AUTHTYPE_SAE)
6495 return false;
6496 /* FILS not supported yet */
6497 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6498 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6499 auth_type == NL80211_AUTHTYPE_FILS_PK)
6500 return false;
6501 return true;
6502 default:
6503 return false;
6504 }
6505 }
6506
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)6507 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6508 unsigned int link_id)
6509 {
6510 struct wiphy *wiphy = wdev->wiphy;
6511 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6512 struct sk_buff *msg;
6513 void *hdr;
6514
6515 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6516 if (!msg)
6517 return;
6518
6519 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6520 if (!hdr)
6521 goto out;
6522
6523 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6524 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6525 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6526 NL80211_ATTR_PAD) ||
6527 (wdev->u.ap.ssid_len &&
6528 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6529 wdev->u.ap.ssid)) ||
6530 (wdev->valid_links &&
6531 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6532 goto out;
6533
6534 genlmsg_end(msg, hdr);
6535
6536 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6537 NL80211_MCGRP_MLME, GFP_KERNEL);
6538 return;
6539 out:
6540 nlmsg_free(msg);
6541 }
6542
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)6543 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6544 {
6545 struct ieee80211_channel *channel = params->chandef.chan;
6546
6547 if ((params->he_cap || params->he_oper) &&
6548 (channel->flags & IEEE80211_CHAN_NO_HE))
6549 return -EOPNOTSUPP;
6550
6551 if ((params->eht_cap || params->eht_oper) &&
6552 (channel->flags & IEEE80211_CHAN_NO_EHT))
6553 return -EOPNOTSUPP;
6554
6555 return 0;
6556 }
6557
6558 static int
nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_s1g_short_beacon * sb)6559 nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device *rdev,
6560 struct nlattr *attrs,
6561 struct cfg80211_s1g_short_beacon *sb)
6562 {
6563 struct nlattr *tb[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1];
6564 int ret;
6565
6566 if (!rdev->wiphy.bands[NL80211_BAND_S1GHZ])
6567 return -EINVAL;
6568
6569 ret = nla_parse_nested(tb, NL80211_S1G_SHORT_BEACON_ATTR_MAX, attrs,
6570 NULL, NULL);
6571 if (ret)
6572 return ret;
6573
6574 /* Short beacon tail is optional (i.e might only include the TIM) */
6575 if (!tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD])
6576 return -EINVAL;
6577
6578 sb->short_head = nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6579 sb->short_head_len = nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6580 sb->short_tail_len = 0;
6581
6582 if (tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]) {
6583 sb->short_tail =
6584 nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6585 sb->short_tail_len =
6586 nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6587 }
6588
6589 sb->update = true;
6590 return 0;
6591 }
6592
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)6593 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6594 {
6595 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6596 struct cfg80211_beaconing_check_config beacon_check = {};
6597 unsigned int link_id = nl80211_link_id(info->attrs);
6598 struct net_device *dev = info->user_ptr[1];
6599 struct wireless_dev *wdev = dev->ieee80211_ptr;
6600 struct cfg80211_ap_settings *params;
6601 int err;
6602
6603 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6604 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6605 return -EOPNOTSUPP;
6606
6607 if (!rdev->ops->start_ap)
6608 return -EOPNOTSUPP;
6609
6610 if (wdev->links[link_id].cac_started)
6611 return -EBUSY;
6612
6613 if (wdev->links[link_id].ap.beacon_interval)
6614 return -EALREADY;
6615
6616 /* these are required for START_AP */
6617 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6618 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6619 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6620 return -EINVAL;
6621
6622 if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6623 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6624 return -EOPNOTSUPP;
6625
6626 params = kzalloc(sizeof(*params), GFP_KERNEL);
6627 if (!params)
6628 return -ENOMEM;
6629
6630 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6631 info->extack);
6632 if (err)
6633 goto out;
6634
6635 params->beacon_interval =
6636 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6637 params->dtim_period =
6638 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6639
6640 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6641 params->beacon_interval);
6642 if (err)
6643 goto out;
6644
6645 /*
6646 * In theory, some of these attributes should be required here
6647 * but since they were not used when the command was originally
6648 * added, keep them optional for old user space programs to let
6649 * them continue to work with drivers that do not need the
6650 * additional information -- drivers must check!
6651 */
6652 if (info->attrs[NL80211_ATTR_SSID]) {
6653 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6654 params->ssid_len =
6655 nla_len(info->attrs[NL80211_ATTR_SSID]);
6656 if (params->ssid_len == 0) {
6657 err = -EINVAL;
6658 goto out;
6659 }
6660
6661 if (wdev->u.ap.ssid_len &&
6662 (wdev->u.ap.ssid_len != params->ssid_len ||
6663 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6664 /* require identical SSID for MLO */
6665 err = -EINVAL;
6666 goto out;
6667 }
6668 } else if (wdev->valid_links) {
6669 /* require SSID for MLO */
6670 err = -EINVAL;
6671 goto out;
6672 }
6673
6674 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6675 params->hidden_ssid = nla_get_u32(
6676 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6677
6678 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6679
6680 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6681 params->auth_type = nla_get_u32(
6682 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6683 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6684 NL80211_CMD_START_AP)) {
6685 err = -EINVAL;
6686 goto out;
6687 }
6688 } else
6689 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6690
6691 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6692 NL80211_MAX_NR_CIPHER_SUITES);
6693 if (err)
6694 goto out;
6695
6696 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6697 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6698 err = -EOPNOTSUPP;
6699 goto out;
6700 }
6701 params->inactivity_timeout = nla_get_u16(
6702 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6703 }
6704
6705 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6706 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6707 err = -EINVAL;
6708 goto out;
6709 }
6710 params->p2p_ctwindow =
6711 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6712 if (params->p2p_ctwindow != 0 &&
6713 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6714 err = -EINVAL;
6715 goto out;
6716 }
6717 }
6718
6719 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6720 u8 tmp;
6721
6722 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6723 err = -EINVAL;
6724 goto out;
6725 }
6726 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6727 params->p2p_opp_ps = tmp;
6728 if (params->p2p_opp_ps != 0 &&
6729 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6730 err = -EINVAL;
6731 goto out;
6732 }
6733 }
6734
6735 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6736 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6737 if (err)
6738 goto out;
6739 } else if (wdev->valid_links) {
6740 /* with MLD need to specify the channel configuration */
6741 err = -EINVAL;
6742 goto out;
6743 } else if (wdev->u.ap.preset_chandef.chan) {
6744 params->chandef = wdev->u.ap.preset_chandef;
6745 } else if (!nl80211_get_ap_channel(rdev, params)) {
6746 err = -EINVAL;
6747 goto out;
6748 }
6749
6750 beacon_check.iftype = wdev->iftype;
6751 beacon_check.relax = true;
6752 beacon_check.reg_power =
6753 cfg80211_get_6ghz_power_type(params->beacon.tail,
6754 params->beacon.tail_len, 0);
6755 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, ¶ms->chandef,
6756 &beacon_check)) {
6757 err = -EINVAL;
6758 goto out;
6759 }
6760
6761 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6762 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6763 NL80211_ATTR_TX_RATES,
6764 ¶ms->beacon_rate,
6765 dev, false, link_id);
6766 if (err)
6767 goto out;
6768
6769 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6770 ¶ms->beacon_rate);
6771 if (err)
6772 goto out;
6773 }
6774
6775 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6776 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6777 err = -EOPNOTSUPP;
6778 goto out;
6779 }
6780
6781 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6782 params->acl = parse_acl_data(&rdev->wiphy, info);
6783 if (IS_ERR(params->acl)) {
6784 err = PTR_ERR(params->acl);
6785 params->acl = NULL;
6786 goto out;
6787 }
6788 }
6789
6790 params->twt_responder =
6791 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6792
6793 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6794 err = nl80211_parse_he_obss_pd(
6795 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6796 ¶ms->he_obss_pd);
6797 if (err)
6798 goto out;
6799 }
6800
6801 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6802 err = nl80211_parse_fils_discovery(rdev,
6803 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6804 ¶ms->fils_discovery);
6805 if (err)
6806 goto out;
6807 }
6808
6809 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6810 err = nl80211_parse_unsol_bcast_probe_resp(
6811 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6812 ¶ms->unsol_bcast_probe_resp);
6813 if (err)
6814 goto out;
6815 }
6816
6817 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6818 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
6819 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6820 ¶ms->mbssid_config,
6821 params->beacon.mbssid_ies ?
6822 params->beacon.mbssid_ies->cnt :
6823 0);
6824 if (err)
6825 goto out;
6826 }
6827
6828 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6829 err = -EINVAL;
6830 goto out;
6831 }
6832
6833 if (info->attrs[NL80211_ATTR_S1G_SHORT_BEACON]) {
6834 if (!info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]) {
6835 err = -EINVAL;
6836 goto out;
6837 }
6838
6839 params->s1g_long_beacon_period = nla_get_u8(
6840 info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]);
6841
6842 err = nl80211_parse_s1g_short_beacon(
6843 rdev, info->attrs[NL80211_ATTR_S1G_SHORT_BEACON],
6844 ¶ms->s1g_short_beacon);
6845 if (err)
6846 goto out;
6847 }
6848
6849 err = nl80211_calculate_ap_params(params);
6850 if (err)
6851 goto out;
6852
6853 err = nl80211_validate_ap_phy_operation(params);
6854 if (err)
6855 goto out;
6856
6857 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6858 params->flags = nla_get_u32(
6859 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6860 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6861 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6862
6863 if (wdev->conn_owner_nlportid &&
6864 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6865 wdev->conn_owner_nlportid != info->snd_portid) {
6866 err = -EINVAL;
6867 goto out;
6868 }
6869
6870 /* FIXME: validate MLO/link-id against driver capabilities */
6871
6872 err = rdev_start_ap(rdev, dev, params);
6873 if (!err) {
6874 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6875 wdev->links[link_id].ap.chandef = params->chandef;
6876 wdev->u.ap.ssid_len = params->ssid_len;
6877 memcpy(wdev->u.ap.ssid, params->ssid,
6878 params->ssid_len);
6879
6880 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6881 wdev->conn_owner_nlportid = info->snd_portid;
6882
6883 nl80211_send_ap_started(wdev, link_id);
6884 }
6885 out:
6886 kfree(params->acl);
6887 kfree(params->beacon.mbssid_ies);
6888 if (params->mbssid_config.tx_wdev &&
6889 params->mbssid_config.tx_wdev->netdev &&
6890 params->mbssid_config.tx_wdev->netdev != dev)
6891 dev_put(params->mbssid_config.tx_wdev->netdev);
6892 kfree(params->beacon.rnr_ies);
6893 kfree(params);
6894
6895 return err;
6896 }
6897
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6898 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6899 {
6900 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6901 struct cfg80211_beaconing_check_config beacon_check = {};
6902 unsigned int link_id = nl80211_link_id(info->attrs);
6903 struct net_device *dev = info->user_ptr[1];
6904 struct wireless_dev *wdev = dev->ieee80211_ptr;
6905 struct cfg80211_ap_update *params;
6906 struct nlattr *attr;
6907 int err;
6908
6909 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6910 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6911 return -EOPNOTSUPP;
6912
6913 if (!rdev->ops->change_beacon)
6914 return -EOPNOTSUPP;
6915
6916 if (!wdev->links[link_id].ap.beacon_interval)
6917 return -EINVAL;
6918
6919 params = kzalloc(sizeof(*params), GFP_KERNEL);
6920 if (!params)
6921 return -ENOMEM;
6922
6923 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6924 info->extack);
6925 if (err)
6926 goto out;
6927
6928 /* recheck beaconing is permitted with possibly changed power type */
6929 beacon_check.iftype = wdev->iftype;
6930 beacon_check.relax = true;
6931 beacon_check.reg_power =
6932 cfg80211_get_6ghz_power_type(params->beacon.tail,
6933 params->beacon.tail_len, 0);
6934 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6935 &wdev->links[link_id].ap.chandef,
6936 &beacon_check)) {
6937 err = -EINVAL;
6938 goto out;
6939 }
6940
6941 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6942 if (attr) {
6943 err = nl80211_parse_fils_discovery(rdev, attr,
6944 ¶ms->fils_discovery);
6945 if (err)
6946 goto out;
6947 }
6948
6949 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6950 if (attr) {
6951 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6952 ¶ms->unsol_bcast_probe_resp);
6953 if (err)
6954 goto out;
6955 }
6956
6957 attr = info->attrs[NL80211_ATTR_S1G_SHORT_BEACON];
6958 if (attr) {
6959 err = nl80211_parse_s1g_short_beacon(rdev, attr,
6960 ¶ms->s1g_short_beacon);
6961 if (err)
6962 goto out;
6963 }
6964
6965 err = rdev_change_beacon(rdev, dev, params);
6966
6967 out:
6968 kfree(params->beacon.mbssid_ies);
6969 kfree(params->beacon.rnr_ies);
6970 kfree(params);
6971 return err;
6972 }
6973
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6974 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6975 {
6976 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6977 unsigned int link_id = nl80211_link_id(info->attrs);
6978 struct net_device *dev = info->user_ptr[1];
6979
6980 return cfg80211_stop_ap(rdev, dev, link_id, false);
6981 }
6982
6983 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6984 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6985 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6986 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6987 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6988 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6989 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6990 };
6991
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6992 static int parse_station_flags(struct genl_info *info,
6993 enum nl80211_iftype iftype,
6994 struct station_parameters *params)
6995 {
6996 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6997 struct nlattr *nla;
6998 int flag;
6999
7000 /*
7001 * Try parsing the new attribute first so userspace
7002 * can specify both for older kernels.
7003 */
7004 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
7005 if (nla) {
7006 struct nl80211_sta_flag_update *sta_flags;
7007
7008 sta_flags = nla_data(nla);
7009 params->sta_flags_mask = sta_flags->mask;
7010 params->sta_flags_set = sta_flags->set;
7011 params->sta_flags_set &= params->sta_flags_mask;
7012 if ((params->sta_flags_mask |
7013 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
7014 return -EINVAL;
7015 return 0;
7016 }
7017
7018 /* if present, parse the old attribute */
7019
7020 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
7021 if (!nla)
7022 return 0;
7023
7024 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
7025 return -EINVAL;
7026
7027 /*
7028 * Only allow certain flags for interface types so that
7029 * other attributes are silently ignored. Remember that
7030 * this is backward compatibility code with old userspace
7031 * and shouldn't be hit in other cases anyway.
7032 */
7033 switch (iftype) {
7034 case NL80211_IFTYPE_AP:
7035 case NL80211_IFTYPE_AP_VLAN:
7036 case NL80211_IFTYPE_P2P_GO:
7037 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7038 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7039 BIT(NL80211_STA_FLAG_WME) |
7040 BIT(NL80211_STA_FLAG_MFP);
7041 break;
7042 case NL80211_IFTYPE_P2P_CLIENT:
7043 case NL80211_IFTYPE_STATION:
7044 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7045 BIT(NL80211_STA_FLAG_TDLS_PEER);
7046 break;
7047 case NL80211_IFTYPE_MESH_POINT:
7048 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7049 BIT(NL80211_STA_FLAG_MFP) |
7050 BIT(NL80211_STA_FLAG_AUTHORIZED);
7051 break;
7052 default:
7053 return -EINVAL;
7054 }
7055
7056 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
7057 if (flags[flag]) {
7058 params->sta_flags_set |= (1<<flag);
7059
7060 /* no longer support new API additions in old API */
7061 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
7062 return -EINVAL;
7063 }
7064 }
7065
7066 return 0;
7067 }
7068
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)7069 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
7070 {
7071 struct nlattr *rate;
7072 u32 bitrate;
7073 u16 bitrate_compat;
7074 enum nl80211_rate_info rate_flg;
7075
7076 rate = nla_nest_start_noflag(msg, attr);
7077 if (!rate)
7078 return false;
7079
7080 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
7081 bitrate = cfg80211_calculate_bitrate(info);
7082 /* report 16-bit bitrate only if we can */
7083 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
7084 if (bitrate > 0 &&
7085 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
7086 return false;
7087 if (bitrate_compat > 0 &&
7088 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
7089 return false;
7090
7091 switch (info->bw) {
7092 case RATE_INFO_BW_1:
7093 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
7094 break;
7095 case RATE_INFO_BW_2:
7096 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
7097 break;
7098 case RATE_INFO_BW_4:
7099 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
7100 break;
7101 case RATE_INFO_BW_5:
7102 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
7103 break;
7104 case RATE_INFO_BW_8:
7105 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
7106 break;
7107 case RATE_INFO_BW_10:
7108 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
7109 break;
7110 case RATE_INFO_BW_16:
7111 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
7112 break;
7113 default:
7114 WARN_ON(1);
7115 fallthrough;
7116 case RATE_INFO_BW_20:
7117 rate_flg = 0;
7118 break;
7119 case RATE_INFO_BW_40:
7120 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
7121 break;
7122 case RATE_INFO_BW_80:
7123 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
7124 break;
7125 case RATE_INFO_BW_160:
7126 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
7127 break;
7128 case RATE_INFO_BW_HE_RU:
7129 rate_flg = 0;
7130 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
7131 break;
7132 case RATE_INFO_BW_320:
7133 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
7134 break;
7135 case RATE_INFO_BW_EHT_RU:
7136 rate_flg = 0;
7137 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
7138 break;
7139 }
7140
7141 if (rate_flg && nla_put_flag(msg, rate_flg))
7142 return false;
7143
7144 if (info->flags & RATE_INFO_FLAGS_MCS) {
7145 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
7146 return false;
7147 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7148 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7149 return false;
7150 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
7151 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
7152 return false;
7153 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
7154 return false;
7155 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7156 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7157 return false;
7158 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
7159 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
7160 return false;
7161 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
7162 return false;
7163 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
7164 return false;
7165 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
7166 return false;
7167 if (info->bw == RATE_INFO_BW_HE_RU &&
7168 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
7169 info->he_ru_alloc))
7170 return false;
7171 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
7172 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
7173 return false;
7174 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
7175 return false;
7176 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7177 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7178 return false;
7179 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
7180 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
7181 return false;
7182 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
7183 return false;
7184 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
7185 return false;
7186 if (info->bw == RATE_INFO_BW_EHT_RU &&
7187 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
7188 info->eht_ru_alloc))
7189 return false;
7190 }
7191
7192 nla_nest_end(msg, rate);
7193 return true;
7194 }
7195
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)7196 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
7197 int id)
7198 {
7199 void *attr;
7200 int i = 0;
7201
7202 if (!mask)
7203 return true;
7204
7205 attr = nla_nest_start_noflag(msg, id);
7206 if (!attr)
7207 return false;
7208
7209 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
7210 if (!(mask & BIT(i)))
7211 continue;
7212
7213 if (nla_put_u8(msg, i, signal[i]))
7214 return false;
7215 }
7216
7217 nla_nest_end(msg, attr);
7218
7219 return true;
7220 }
7221
nl80211_fill_link_station(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct link_station_info * link_sinfo)7222 static int nl80211_fill_link_station(struct sk_buff *msg,
7223 struct cfg80211_registered_device *rdev,
7224 struct link_station_info *link_sinfo)
7225 {
7226 struct nlattr *bss_param, *link_sinfoattr;
7227
7228 #define PUT_LINK_SINFO(attr, memb, type) do { \
7229 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7230 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7231 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7232 link_sinfo->memb)) \
7233 goto nla_put_failure; \
7234 } while (0)
7235 #define PUT_LINK_SINFO_U64(attr, memb) do { \
7236 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7237 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7238 link_sinfo->memb, NL80211_STA_INFO_PAD)) \
7239 goto nla_put_failure; \
7240 } while (0)
7241
7242 link_sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7243 if (!link_sinfoattr)
7244 goto nla_put_failure;
7245
7246 PUT_LINK_SINFO(INACTIVE_TIME, inactive_time, u32);
7247
7248 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7249 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7250 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7251 (u32)link_sinfo->rx_bytes))
7252 goto nla_put_failure;
7253
7254 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7255 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7256 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7257 (u32)link_sinfo->tx_bytes))
7258 goto nla_put_failure;
7259
7260 PUT_LINK_SINFO_U64(RX_BYTES64, rx_bytes);
7261 PUT_LINK_SINFO_U64(TX_BYTES64, tx_bytes);
7262 PUT_LINK_SINFO_U64(RX_DURATION, rx_duration);
7263 PUT_LINK_SINFO_U64(TX_DURATION, tx_duration);
7264
7265 if (wiphy_ext_feature_isset(&rdev->wiphy,
7266 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7267 PUT_LINK_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7268
7269 switch (rdev->wiphy.signal_type) {
7270 case CFG80211_SIGNAL_TYPE_MBM:
7271 PUT_LINK_SINFO(SIGNAL, signal, u8);
7272 PUT_LINK_SINFO(SIGNAL_AVG, signal_avg, u8);
7273 break;
7274 default:
7275 break;
7276 }
7277 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7278 if (!nl80211_put_signal(msg, link_sinfo->chains,
7279 link_sinfo->chain_signal,
7280 NL80211_STA_INFO_CHAIN_SIGNAL))
7281 goto nla_put_failure;
7282 }
7283 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7284 if (!nl80211_put_signal(msg, link_sinfo->chains,
7285 link_sinfo->chain_signal_avg,
7286 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7287 goto nla_put_failure;
7288 }
7289 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7290 if (!nl80211_put_sta_rate(msg, &link_sinfo->txrate,
7291 NL80211_STA_INFO_TX_BITRATE))
7292 goto nla_put_failure;
7293 }
7294 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7295 if (!nl80211_put_sta_rate(msg, &link_sinfo->rxrate,
7296 NL80211_STA_INFO_RX_BITRATE))
7297 goto nla_put_failure;
7298 }
7299
7300 PUT_LINK_SINFO(RX_PACKETS, rx_packets, u32);
7301 PUT_LINK_SINFO(TX_PACKETS, tx_packets, u32);
7302 PUT_LINK_SINFO(TX_RETRIES, tx_retries, u32);
7303 PUT_LINK_SINFO(TX_FAILED, tx_failed, u32);
7304 PUT_LINK_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7305 PUT_LINK_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7306
7307 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7308 bss_param = nla_nest_start_noflag(msg,
7309 NL80211_STA_INFO_BSS_PARAM);
7310 if (!bss_param)
7311 goto nla_put_failure;
7312
7313 if (((link_sinfo->bss_param.flags &
7314 BSS_PARAM_FLAGS_CTS_PROT) &&
7315 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7316 ((link_sinfo->bss_param.flags &
7317 BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7318 nla_put_flag(msg,
7319 NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7320 ((link_sinfo->bss_param.flags &
7321 BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7322 nla_put_flag(msg,
7323 NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7324 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7325 link_sinfo->bss_param.dtim_period) ||
7326 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7327 link_sinfo->bss_param.beacon_interval))
7328 goto nla_put_failure;
7329
7330 nla_nest_end(msg, bss_param);
7331 }
7332
7333 PUT_LINK_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7334 PUT_LINK_SINFO_U64(BEACON_RX, rx_beacon);
7335 PUT_LINK_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7336 PUT_LINK_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7337 PUT_LINK_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7338 if (wiphy_ext_feature_isset(&rdev->wiphy,
7339 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7340 PUT_LINK_SINFO(ACK_SIGNAL, ack_signal, u8);
7341 PUT_LINK_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7342 }
7343
7344 #undef PUT_LINK_SINFO
7345 #undef PUT_LINK_SINFO_U64
7346
7347 if (link_sinfo->pertid) {
7348 struct nlattr *tidsattr;
7349 int tid;
7350
7351 tidsattr = nla_nest_start_noflag(msg,
7352 NL80211_STA_INFO_TID_STATS);
7353 if (!tidsattr)
7354 goto nla_put_failure;
7355
7356 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7357 struct cfg80211_tid_stats *tidstats;
7358 struct nlattr *tidattr;
7359
7360 tidstats = &link_sinfo->pertid[tid];
7361
7362 if (!tidstats->filled)
7363 continue;
7364
7365 tidattr = nla_nest_start_noflag(msg, tid + 1);
7366 if (!tidattr)
7367 goto nla_put_failure;
7368
7369 #define PUT_TIDVAL_U64(attr, memb) do { \
7370 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7371 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7372 tidstats->memb, NL80211_TID_STATS_PAD)) \
7373 goto nla_put_failure; \
7374 } while (0)
7375
7376 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7377 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7378 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7379 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7380
7381 #undef PUT_TIDVAL_U64
7382 if ((tidstats->filled &
7383 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7384 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7385 NL80211_TID_STATS_TXQ_STATS))
7386 goto nla_put_failure;
7387
7388 nla_nest_end(msg, tidattr);
7389 }
7390
7391 nla_nest_end(msg, tidsattr);
7392 }
7393
7394 nla_nest_end(msg, link_sinfoattr);
7395 return 0;
7396
7397 nla_put_failure:
7398 return -EMSGSIZE;
7399 }
7400
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,bool link_stats)7401 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
7402 u32 seq, int flags,
7403 struct cfg80211_registered_device *rdev,
7404 struct net_device *dev,
7405 const u8 *mac_addr, struct station_info *sinfo,
7406 bool link_stats)
7407 {
7408 void *hdr;
7409 struct nlattr *sinfoattr, *bss_param;
7410 struct link_station_info *link_sinfo;
7411 struct nlattr *links, *link;
7412 int link_id;
7413
7414 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7415 if (!hdr) {
7416 cfg80211_sinfo_release_content(sinfo);
7417 return -1;
7418 }
7419
7420 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7421 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
7422 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
7423 goto nla_put_failure;
7424
7425 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7426 if (!sinfoattr)
7427 goto nla_put_failure;
7428
7429 #define PUT_SINFO(attr, memb, type) do { \
7430 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7431 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7432 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7433 sinfo->memb)) \
7434 goto nla_put_failure; \
7435 } while (0)
7436 #define PUT_SINFO_U64(attr, memb) do { \
7437 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7438 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7439 sinfo->memb, NL80211_STA_INFO_PAD)) \
7440 goto nla_put_failure; \
7441 } while (0)
7442
7443 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
7444 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
7445 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
7446
7447 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7448 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7449 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7450 (u32)sinfo->rx_bytes))
7451 goto nla_put_failure;
7452
7453 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7454 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7455 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7456 (u32)sinfo->tx_bytes))
7457 goto nla_put_failure;
7458
7459 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
7460 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
7461 PUT_SINFO_U64(RX_DURATION, rx_duration);
7462 PUT_SINFO_U64(TX_DURATION, tx_duration);
7463
7464 if (wiphy_ext_feature_isset(&rdev->wiphy,
7465 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7466 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7467
7468 switch (rdev->wiphy.signal_type) {
7469 case CFG80211_SIGNAL_TYPE_MBM:
7470 PUT_SINFO(SIGNAL, signal, u8);
7471 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
7472 break;
7473 default:
7474 break;
7475 }
7476 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7477 if (!nl80211_put_signal(msg, sinfo->chains,
7478 sinfo->chain_signal,
7479 NL80211_STA_INFO_CHAIN_SIGNAL))
7480 goto nla_put_failure;
7481 }
7482 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7483 if (!nl80211_put_signal(msg, sinfo->chains,
7484 sinfo->chain_signal_avg,
7485 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7486 goto nla_put_failure;
7487 }
7488 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7489 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
7490 NL80211_STA_INFO_TX_BITRATE))
7491 goto nla_put_failure;
7492 }
7493 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7494 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
7495 NL80211_STA_INFO_RX_BITRATE))
7496 goto nla_put_failure;
7497 }
7498
7499 PUT_SINFO(RX_PACKETS, rx_packets, u32);
7500 PUT_SINFO(TX_PACKETS, tx_packets, u32);
7501 PUT_SINFO(TX_RETRIES, tx_retries, u32);
7502 PUT_SINFO(TX_FAILED, tx_failed, u32);
7503 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7504 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7505
7506 PUT_SINFO(LLID, llid, u16);
7507 PUT_SINFO(PLID, plid, u16);
7508 PUT_SINFO(PLINK_STATE, plink_state, u8);
7509 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
7510 PUT_SINFO(LOCAL_PM, local_pm, u32);
7511 PUT_SINFO(PEER_PM, peer_pm, u32);
7512 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
7513 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
7514 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
7515 PUT_SINFO_U64(T_OFFSET, t_offset);
7516
7517 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7518 bss_param = nla_nest_start_noflag(msg,
7519 NL80211_STA_INFO_BSS_PARAM);
7520 if (!bss_param)
7521 goto nla_put_failure;
7522
7523 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
7524 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7525 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7526 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7527 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7528 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7529 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7530 sinfo->bss_param.dtim_period) ||
7531 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7532 sinfo->bss_param.beacon_interval))
7533 goto nla_put_failure;
7534
7535 nla_nest_end(msg, bss_param);
7536 }
7537 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
7538 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
7539 sizeof(struct nl80211_sta_flag_update),
7540 &sinfo->sta_flags))
7541 goto nla_put_failure;
7542
7543 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7544 PUT_SINFO_U64(BEACON_RX, rx_beacon);
7545 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7546 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7547 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7548 if (wiphy_ext_feature_isset(&rdev->wiphy,
7549 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7550 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
7551 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7552 }
7553
7554 #undef PUT_SINFO
7555 #undef PUT_SINFO_U64
7556
7557 if (sinfo->pertid) {
7558 struct nlattr *tidsattr;
7559 int tid;
7560
7561 tidsattr = nla_nest_start_noflag(msg,
7562 NL80211_STA_INFO_TID_STATS);
7563 if (!tidsattr)
7564 goto nla_put_failure;
7565
7566 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7567 struct cfg80211_tid_stats *tidstats;
7568 struct nlattr *tidattr;
7569
7570 tidstats = &sinfo->pertid[tid];
7571
7572 if (!tidstats->filled)
7573 continue;
7574
7575 tidattr = nla_nest_start_noflag(msg, tid + 1);
7576 if (!tidattr)
7577 goto nla_put_failure;
7578
7579 #define PUT_TIDVAL_U64(attr, memb) do { \
7580 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7581 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7582 tidstats->memb, NL80211_TID_STATS_PAD)) \
7583 goto nla_put_failure; \
7584 } while (0)
7585
7586 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7587 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7588 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7589 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7590
7591 #undef PUT_TIDVAL_U64
7592 if ((tidstats->filled &
7593 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7594 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7595 NL80211_TID_STATS_TXQ_STATS))
7596 goto nla_put_failure;
7597
7598 nla_nest_end(msg, tidattr);
7599 }
7600
7601 nla_nest_end(msg, tidsattr);
7602 }
7603
7604 nla_nest_end(msg, sinfoattr);
7605
7606 if (sinfo->assoc_req_ies_len &&
7607 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
7608 sinfo->assoc_req_ies))
7609 goto nla_put_failure;
7610
7611 if (sinfo->assoc_resp_ies_len &&
7612 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
7613 sinfo->assoc_resp_ies))
7614 goto nla_put_failure;
7615
7616 if (sinfo->mlo_params_valid) {
7617 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7618 sinfo->assoc_link_id))
7619 goto nla_put_failure;
7620
7621 if (!is_zero_ether_addr(sinfo->mld_addr) &&
7622 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
7623 sinfo->mld_addr))
7624 goto nla_put_failure;
7625 }
7626
7627 if (link_stats && sinfo->valid_links) {
7628 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
7629 if (!links)
7630 goto nla_put_failure;
7631
7632 for_each_valid_link(sinfo, link_id) {
7633 link_sinfo = sinfo->links[link_id];
7634
7635 if (WARN_ON_ONCE(!link_sinfo))
7636 continue;
7637
7638 if (!is_valid_ether_addr(link_sinfo->addr))
7639 continue;
7640
7641 link = nla_nest_start(msg, link_id + 1);
7642 if (!link)
7643 goto nla_put_failure;
7644
7645 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7646 link_id))
7647 goto nla_put_failure;
7648
7649 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
7650 link_sinfo->addr))
7651 goto nla_put_failure;
7652
7653 if (nl80211_fill_link_station(msg, rdev, link_sinfo))
7654 goto nla_put_failure;
7655
7656 nla_nest_end(msg, link);
7657 }
7658 nla_nest_end(msg, links);
7659 }
7660
7661 cfg80211_sinfo_release_content(sinfo);
7662 genlmsg_end(msg, hdr);
7663 return 0;
7664
7665 nla_put_failure:
7666 cfg80211_sinfo_release_content(sinfo);
7667 genlmsg_cancel(msg, hdr);
7668 return -EMSGSIZE;
7669 }
7670
cfg80211_sta_set_mld_sinfo(struct station_info * sinfo)7671 static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
7672 {
7673 struct link_station_info *link_sinfo;
7674 int link_id, init = 0;
7675 u32 link_inactive_time;
7676
7677 sinfo->signal = -99;
7678
7679 for_each_valid_link(sinfo, link_id) {
7680 link_sinfo = sinfo->links[link_id];
7681 if (!link_sinfo)
7682 continue;
7683
7684 if ((link_sinfo->filled &
7685 BIT_ULL(NL80211_STA_INFO_TX_PACKETS))) {
7686 sinfo->tx_packets += link_sinfo->tx_packets;
7687 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
7688 }
7689
7690 if ((link_sinfo->filled &
7691 BIT_ULL(NL80211_STA_INFO_RX_PACKETS))) {
7692 sinfo->rx_packets += link_sinfo->rx_packets;
7693 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
7694 }
7695
7696 if (link_sinfo->filled &
7697 (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7698 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7699 sinfo->tx_bytes += link_sinfo->tx_bytes;
7700 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
7701 }
7702
7703 if (link_sinfo->filled &
7704 (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7705 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7706 sinfo->rx_bytes += link_sinfo->rx_bytes;
7707 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
7708 }
7709
7710 if (link_sinfo->filled &
7711 BIT_ULL(NL80211_STA_INFO_TX_RETRIES)) {
7712 sinfo->tx_retries += link_sinfo->tx_retries;
7713 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
7714 }
7715
7716 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED)) {
7717 sinfo->tx_failed += link_sinfo->tx_failed;
7718 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
7719 }
7720
7721 if (link_sinfo->filled &
7722 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC)) {
7723 sinfo->rx_dropped_misc += link_sinfo->rx_dropped_misc;
7724 sinfo->filled |=
7725 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC);
7726 }
7727
7728 if (link_sinfo->filled &
7729 BIT_ULL(NL80211_STA_INFO_BEACON_LOSS)) {
7730 sinfo->beacon_loss_count +=
7731 link_sinfo->beacon_loss_count;
7732 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_LOSS);
7733 }
7734
7735 if (link_sinfo->filled &
7736 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) {
7737 sinfo->expected_throughput +=
7738 link_sinfo->expected_throughput;
7739 sinfo->filled |=
7740 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
7741 }
7742
7743 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_MPDUS)) {
7744 sinfo->rx_mpdu_count += link_sinfo->rx_mpdu_count;
7745 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_MPDUS);
7746 }
7747
7748 if (link_sinfo->filled &
7749 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT)) {
7750 sinfo->fcs_err_count += link_sinfo->fcs_err_count;
7751 sinfo->filled |=
7752 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT);
7753 }
7754
7755 if (link_sinfo->filled &
7756 BIT_ULL(NL80211_STA_INFO_BEACON_RX)) {
7757 sinfo->rx_beacon += link_sinfo->rx_beacon;
7758 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
7759 }
7760
7761 /* Update MLO signal, signal_avg as best among links */
7762 if ((link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL)) &&
7763 link_sinfo->signal > sinfo->signal) {
7764 sinfo->signal = link_sinfo->signal;
7765 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
7766 }
7767
7768 if ((link_sinfo->filled &
7769 BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG)) &&
7770 link_sinfo->signal_avg > sinfo->signal_avg) {
7771 sinfo->signal_avg = link_sinfo->signal_avg;
7772 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
7773 }
7774
7775 /* Update MLO inactive_time, bss_param based on least
7776 * value for corresponding field of link.
7777 */
7778 if ((link_sinfo->filled &
7779 BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME)) &&
7780 (!init ||
7781 link_inactive_time > link_sinfo->inactive_time)) {
7782 link_inactive_time = link_sinfo->inactive_time;
7783 sinfo->inactive_time = link_sinfo->inactive_time;
7784 sinfo->filled |= NL80211_STA_INFO_INACTIVE_TIME;
7785 }
7786
7787 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM) &&
7788 (!init ||
7789 sinfo->bss_param.dtim_period >
7790 link_sinfo->bss_param.dtim_period)) {
7791 sinfo->bss_param.dtim_period =
7792 link_sinfo->bss_param.dtim_period;
7793 sinfo->filled |= NL80211_STA_BSS_PARAM_DTIM_PERIOD;
7794 sinfo->bss_param.beacon_interval =
7795 link_sinfo->bss_param.beacon_interval;
7796 sinfo->filled |= NL80211_STA_BSS_PARAM_BEACON_INTERVAL;
7797 }
7798
7799 /* Update MLO rates as per last updated link rate */
7800 if ((link_sinfo->filled &
7801 BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) &&
7802 (!init ||
7803 link_inactive_time > link_sinfo->inactive_time)) {
7804 sinfo->txrate = link_sinfo->txrate;
7805 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
7806 }
7807 if ((link_sinfo->filled &
7808 BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) &&
7809 (!init ||
7810 link_inactive_time > link_sinfo->inactive_time)) {
7811 sinfo->rxrate = link_sinfo->rxrate;
7812 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
7813 }
7814
7815 if (link_sinfo->filled &
7816 BIT_ULL(NL80211_STA_INFO_TX_DURATION) &&
7817 (!init ||
7818 link_inactive_time > link_sinfo->inactive_time)) {
7819 sinfo->tx_duration += link_sinfo->tx_duration;
7820 sinfo->filled |=
7821 BIT_ULL(NL80211_STA_INFO_TX_DURATION);
7822 }
7823 if (link_sinfo->filled &
7824 BIT_ULL(NL80211_STA_INFO_RX_DURATION) &&
7825 (!init ||
7826 link_inactive_time > link_sinfo->inactive_time)) {
7827 sinfo->rx_duration += link_sinfo->rx_duration;
7828 sinfo->filled |=
7829 BIT_ULL(NL80211_STA_INFO_RX_DURATION);
7830 }
7831 init++;
7832
7833 /* pertid stats accumulate for rx/tx fields */
7834 if (sinfo->pertid) {
7835 sinfo->pertid->rx_msdu +=
7836 link_sinfo->pertid->rx_msdu;
7837 sinfo->pertid->tx_msdu +=
7838 link_sinfo->pertid->tx_msdu;
7839 sinfo->pertid->tx_msdu_retries +=
7840 link_sinfo->pertid->tx_msdu_retries;
7841 sinfo->pertid->tx_msdu_failed +=
7842 link_sinfo->pertid->tx_msdu_failed;
7843
7844 sinfo->pertid->filled |=
7845 BIT(NL80211_TID_STATS_RX_MSDU) |
7846 BIT(NL80211_TID_STATS_TX_MSDU) |
7847 BIT(NL80211_TID_STATS_TX_MSDU_RETRIES) |
7848 BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
7849 }
7850 }
7851
7852 /* Reset sinfo->filled bits to exclude fields which don't make
7853 * much sense at the MLO level.
7854 */
7855 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
7856 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
7857 }
7858
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)7859 static int nl80211_dump_station(struct sk_buff *skb,
7860 struct netlink_callback *cb)
7861 {
7862 struct station_info sinfo;
7863 struct cfg80211_registered_device *rdev;
7864 struct wireless_dev *wdev;
7865 u8 mac_addr[ETH_ALEN];
7866 int sta_idx = cb->args[2];
7867 bool sinfo_alloc = false;
7868 int err, i;
7869
7870 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7871 if (err)
7872 return err;
7873 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7874 __acquire(&rdev->wiphy.mtx);
7875
7876 if (!wdev->netdev) {
7877 err = -EINVAL;
7878 goto out_err;
7879 }
7880
7881 if (!rdev->ops->dump_station) {
7882 err = -EOPNOTSUPP;
7883 goto out_err;
7884 }
7885
7886 while (1) {
7887 memset(&sinfo, 0, sizeof(sinfo));
7888
7889 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7890 sinfo.links[i] =
7891 kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7892 if (!sinfo.links[i]) {
7893 err = -ENOMEM;
7894 goto out_err;
7895 }
7896 sinfo_alloc = true;
7897 }
7898
7899 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
7900 mac_addr, &sinfo);
7901 if (err == -ENOENT)
7902 break;
7903 if (err)
7904 goto out_err;
7905
7906 if (sinfo.valid_links)
7907 cfg80211_sta_set_mld_sinfo(&sinfo);
7908
7909 /* reset the sinfo_alloc flag as nl80211_send_station()
7910 * always releases sinfo
7911 */
7912 sinfo_alloc = false;
7913
7914 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
7915 NETLINK_CB(cb->skb).portid,
7916 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7917 rdev, wdev->netdev, mac_addr,
7918 &sinfo, false) < 0)
7919 goto out;
7920
7921 sta_idx++;
7922 }
7923
7924 out:
7925 cb->args[2] = sta_idx;
7926 err = skb->len;
7927 out_err:
7928 if (sinfo_alloc)
7929 cfg80211_sinfo_release_content(&sinfo);
7930 wiphy_unlock(&rdev->wiphy);
7931
7932 return err;
7933 }
7934
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)7935 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
7936 {
7937 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7938 struct net_device *dev = info->user_ptr[1];
7939 struct station_info sinfo;
7940 struct sk_buff *msg;
7941 u8 *mac_addr = NULL;
7942 int err, i;
7943
7944 memset(&sinfo, 0, sizeof(sinfo));
7945
7946 if (!info->attrs[NL80211_ATTR_MAC])
7947 return -EINVAL;
7948
7949 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7950
7951 if (!rdev->ops->get_station)
7952 return -EOPNOTSUPP;
7953
7954 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7955 sinfo.links[i] = kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7956 if (!sinfo.links[i]) {
7957 cfg80211_sinfo_release_content(&sinfo);
7958 return -ENOMEM;
7959 }
7960 }
7961
7962 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7963 if (err) {
7964 cfg80211_sinfo_release_content(&sinfo);
7965 return err;
7966 }
7967
7968 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7969 if (!msg) {
7970 cfg80211_sinfo_release_content(&sinfo);
7971 return -ENOMEM;
7972 }
7973
7974 if (sinfo.valid_links)
7975 cfg80211_sta_set_mld_sinfo(&sinfo);
7976
7977 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7978 info->snd_portid, info->snd_seq, 0,
7979 rdev, dev, mac_addr, &sinfo, false) < 0) {
7980 nlmsg_free(msg);
7981 return -ENOBUFS;
7982 }
7983
7984 return genlmsg_reply(msg, info);
7985 }
7986
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)7987 int cfg80211_check_station_change(struct wiphy *wiphy,
7988 struct station_parameters *params,
7989 enum cfg80211_station_type statype)
7990 {
7991 if (params->listen_interval != -1 &&
7992 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7993 return -EINVAL;
7994
7995 if (params->support_p2p_ps != -1 &&
7996 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7997 return -EINVAL;
7998
7999 if (params->aid &&
8000 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
8001 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
8002 return -EINVAL;
8003
8004 /* When you run into this, adjust the code below for the new flag */
8005 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8006
8007 switch (statype) {
8008 case CFG80211_STA_MESH_PEER_KERNEL:
8009 case CFG80211_STA_MESH_PEER_USER:
8010 /*
8011 * No ignoring the TDLS flag here -- the userspace mesh
8012 * code doesn't have the bug of including TDLS in the
8013 * mask everywhere.
8014 */
8015 if (params->sta_flags_mask &
8016 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8017 BIT(NL80211_STA_FLAG_MFP) |
8018 BIT(NL80211_STA_FLAG_AUTHORIZED)))
8019 return -EINVAL;
8020 break;
8021 case CFG80211_STA_TDLS_PEER_SETUP:
8022 case CFG80211_STA_TDLS_PEER_ACTIVE:
8023 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8024 return -EINVAL;
8025 /* ignore since it can't change */
8026 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8027 break;
8028 default:
8029 /* disallow mesh-specific things */
8030 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
8031 return -EINVAL;
8032 if (params->local_pm)
8033 return -EINVAL;
8034 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8035 return -EINVAL;
8036 }
8037
8038 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8039 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
8040 /* TDLS can't be set, ... */
8041 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
8042 return -EINVAL;
8043 /*
8044 * ... but don't bother the driver with it. This works around
8045 * a hostapd/wpa_supplicant issue -- it always includes the
8046 * TLDS_PEER flag in the mask even for AP mode.
8047 */
8048 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8049 }
8050
8051 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8052 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8053 /* reject other things that can't change */
8054 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
8055 return -EINVAL;
8056 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
8057 return -EINVAL;
8058 if (params->link_sta_params.supported_rates)
8059 return -EINVAL;
8060 if (params->ext_capab || params->link_sta_params.ht_capa ||
8061 params->link_sta_params.vht_capa ||
8062 params->link_sta_params.he_capa ||
8063 params->link_sta_params.eht_capa)
8064 return -EINVAL;
8065 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8066 return -EINVAL;
8067 }
8068
8069 if (statype != CFG80211_STA_AP_CLIENT &&
8070 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8071 if (params->vlan)
8072 return -EINVAL;
8073 }
8074
8075 /* Accept EMLSR capabilities only for AP client before association */
8076 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8077 params->eml_cap_present)
8078 return -EINVAL;
8079
8080 switch (statype) {
8081 case CFG80211_STA_AP_MLME_CLIENT:
8082 /* Use this only for authorizing/unauthorizing a station */
8083 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
8084 return -EOPNOTSUPP;
8085 break;
8086 case CFG80211_STA_AP_CLIENT:
8087 case CFG80211_STA_AP_CLIENT_UNASSOC:
8088 /* accept only the listed bits */
8089 if (params->sta_flags_mask &
8090 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8091 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8092 BIT(NL80211_STA_FLAG_ASSOCIATED) |
8093 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
8094 BIT(NL80211_STA_FLAG_WME) |
8095 BIT(NL80211_STA_FLAG_MFP) |
8096 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
8097 return -EINVAL;
8098
8099 /* but authenticated/associated only if driver handles it */
8100 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8101 params->sta_flags_mask &
8102 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8103 BIT(NL80211_STA_FLAG_ASSOCIATED)))
8104 return -EINVAL;
8105 break;
8106 case CFG80211_STA_IBSS:
8107 case CFG80211_STA_AP_STA:
8108 /* reject any changes other than AUTHORIZED */
8109 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
8110 return -EINVAL;
8111 break;
8112 case CFG80211_STA_TDLS_PEER_SETUP:
8113 /* reject any changes other than AUTHORIZED or WME */
8114 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8115 BIT(NL80211_STA_FLAG_WME)))
8116 return -EINVAL;
8117 /* force (at least) rates when authorizing */
8118 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
8119 !params->link_sta_params.supported_rates)
8120 return -EINVAL;
8121 break;
8122 case CFG80211_STA_TDLS_PEER_ACTIVE:
8123 /* reject any changes */
8124 return -EINVAL;
8125 case CFG80211_STA_MESH_PEER_KERNEL:
8126 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8127 return -EINVAL;
8128 break;
8129 case CFG80211_STA_MESH_PEER_USER:
8130 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
8131 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
8132 return -EINVAL;
8133 break;
8134 }
8135
8136 /*
8137 * Older kernel versions ignored this attribute entirely, so don't
8138 * reject attempts to update it but mark it as unused instead so the
8139 * driver won't look at the data.
8140 */
8141 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8142 statype != CFG80211_STA_TDLS_PEER_SETUP)
8143 params->link_sta_params.opmode_notif_used = false;
8144
8145 return 0;
8146 }
8147 EXPORT_SYMBOL(cfg80211_check_station_change);
8148
8149 /*
8150 * Get vlan interface making sure it is running and on the right wiphy.
8151 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)8152 static struct net_device *get_vlan(struct genl_info *info,
8153 struct cfg80211_registered_device *rdev)
8154 {
8155 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
8156 struct net_device *v;
8157 int ret;
8158
8159 if (!vlanattr)
8160 return NULL;
8161
8162 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
8163 if (!v)
8164 return ERR_PTR(-ENODEV);
8165
8166 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
8167 ret = -EINVAL;
8168 goto error;
8169 }
8170
8171 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
8172 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8173 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
8174 ret = -EINVAL;
8175 goto error;
8176 }
8177
8178 if (!netif_running(v)) {
8179 ret = -ENETDOWN;
8180 goto error;
8181 }
8182
8183 return v;
8184 error:
8185 dev_put(v);
8186 return ERR_PTR(ret);
8187 }
8188
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)8189 static int nl80211_parse_sta_wme(struct genl_info *info,
8190 struct station_parameters *params)
8191 {
8192 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
8193 struct nlattr *nla;
8194 int err;
8195
8196 /* parse WME attributes if present */
8197 if (!info->attrs[NL80211_ATTR_STA_WME])
8198 return 0;
8199
8200 nla = info->attrs[NL80211_ATTR_STA_WME];
8201 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
8202 nl80211_sta_wme_policy,
8203 info->extack);
8204 if (err)
8205 return err;
8206
8207 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
8208 params->uapsd_queues = nla_get_u8(
8209 tb[NL80211_STA_WME_UAPSD_QUEUES]);
8210 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
8211 return -EINVAL;
8212
8213 if (tb[NL80211_STA_WME_MAX_SP])
8214 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
8215
8216 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
8217 return -EINVAL;
8218
8219 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
8220
8221 return 0;
8222 }
8223
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)8224 static int nl80211_parse_sta_channel_info(struct genl_info *info,
8225 struct station_parameters *params)
8226 {
8227 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
8228 params->supported_channels =
8229 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8230 params->supported_channels_len =
8231 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8232 /*
8233 * Need to include at least one (first channel, number of
8234 * channels) tuple for each subband (checked in policy),
8235 * and must have proper tuples for the rest of the data as well.
8236 */
8237 if (params->supported_channels_len % 2)
8238 return -EINVAL;
8239 }
8240
8241 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
8242 params->supported_oper_classes =
8243 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8244 params->supported_oper_classes_len =
8245 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8246 }
8247 return 0;
8248 }
8249
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)8250 static int nl80211_set_station_tdls(struct genl_info *info,
8251 struct station_parameters *params)
8252 {
8253 int err;
8254 /* Dummy STA entry gets updated once the peer capabilities are known */
8255 if (info->attrs[NL80211_ATTR_PEER_AID])
8256 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8257 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8258 params->link_sta_params.ht_capa =
8259 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8260 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8261 params->link_sta_params.vht_capa =
8262 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8263 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8264 params->link_sta_params.he_capa =
8265 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8266 params->link_sta_params.he_capa_len =
8267 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8268
8269 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8270 params->link_sta_params.eht_capa =
8271 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8272 params->link_sta_params.eht_capa_len =
8273 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8274
8275 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
8276 (const u8 *)params->link_sta_params.eht_capa,
8277 params->link_sta_params.eht_capa_len,
8278 false))
8279 return -EINVAL;
8280 }
8281 }
8282
8283 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8284 params->link_sta_params.s1g_capa =
8285 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8286
8287 err = nl80211_parse_sta_channel_info(info, params);
8288 if (err)
8289 return err;
8290
8291 return nl80211_parse_sta_wme(info, params);
8292 }
8293
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)8294 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
8295 struct sta_txpwr *txpwr,
8296 bool *txpwr_set)
8297 {
8298 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8299 int idx;
8300
8301 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
8302 if (!rdev->ops->set_tx_power ||
8303 !wiphy_ext_feature_isset(&rdev->wiphy,
8304 NL80211_EXT_FEATURE_STA_TX_PWR))
8305 return -EOPNOTSUPP;
8306
8307 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
8308 txpwr->type = nla_get_u8(info->attrs[idx]);
8309
8310 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
8311 idx = NL80211_ATTR_STA_TX_POWER;
8312
8313 if (info->attrs[idx])
8314 txpwr->power = nla_get_s16(info->attrs[idx]);
8315 else
8316 return -EINVAL;
8317 }
8318
8319 *txpwr_set = true;
8320 } else {
8321 *txpwr_set = false;
8322 }
8323
8324 return 0;
8325 }
8326
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)8327 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
8328 {
8329 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8330 struct net_device *dev = info->user_ptr[1];
8331 struct station_parameters params;
8332 u8 *mac_addr;
8333 int err;
8334
8335 memset(¶ms, 0, sizeof(params));
8336
8337 if (!rdev->ops->change_station)
8338 return -EOPNOTSUPP;
8339
8340 /*
8341 * AID and listen_interval properties can be set only for unassociated
8342 * station. Include these parameters here and will check them in
8343 * cfg80211_check_station_change().
8344 */
8345 if (info->attrs[NL80211_ATTR_STA_AID])
8346 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8347
8348 if (info->attrs[NL80211_ATTR_VLAN_ID])
8349 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8350
8351 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8352 params.listen_interval =
8353 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8354 else
8355 params.listen_interval = -1;
8356
8357 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
8358 params.support_p2p_ps =
8359 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8360 else
8361 params.support_p2p_ps = -1;
8362
8363 if (!info->attrs[NL80211_ATTR_MAC])
8364 return -EINVAL;
8365
8366 params.link_sta_params.link_id =
8367 nl80211_link_id_or_invalid(info->attrs);
8368
8369 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8370 /* If MLD_ADDR attribute is set then this is an MLD station
8371 * and the MLD_ADDR attribute holds the MLD address and the
8372 * MAC attribute holds for the LINK address.
8373 * In that case, the link_id is also expected to be valid.
8374 */
8375 if (params.link_sta_params.link_id < 0)
8376 return -EINVAL;
8377
8378 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8379 params.link_sta_params.mld_mac = mac_addr;
8380 params.link_sta_params.link_mac =
8381 nla_data(info->attrs[NL80211_ATTR_MAC]);
8382 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8383 return -EINVAL;
8384 } else {
8385 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8386 }
8387
8388
8389 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
8390 params.link_sta_params.supported_rates =
8391 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8392 params.link_sta_params.supported_rates_len =
8393 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8394 }
8395
8396 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8397 params.capability =
8398 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8399 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8400 }
8401
8402 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8403 params.ext_capab =
8404 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8405 params.ext_capab_len =
8406 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8407 }
8408
8409 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8410 return -EINVAL;
8411
8412 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8413 params.plink_action =
8414 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8415
8416 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
8417 params.plink_state =
8418 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
8419 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
8420 params.peer_aid = nla_get_u16(
8421 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
8422 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
8423 }
8424
8425 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
8426 params.local_pm = nla_get_u32(
8427 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
8428
8429 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8430 params.link_sta_params.opmode_notif_used = true;
8431 params.link_sta_params.opmode_notif =
8432 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8433 }
8434
8435 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8436 params.link_sta_params.he_6ghz_capa =
8437 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8438
8439 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8440 params.eml_cap_present = true;
8441 params.eml_cap =
8442 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8443 }
8444
8445 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8446 params.airtime_weight =
8447 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8448
8449 if (params.airtime_weight &&
8450 !wiphy_ext_feature_isset(&rdev->wiphy,
8451 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8452 return -EOPNOTSUPP;
8453
8454 err = nl80211_parse_sta_txpower_setting(info,
8455 ¶ms.link_sta_params.txpwr,
8456 ¶ms.link_sta_params.txpwr_set);
8457 if (err)
8458 return err;
8459
8460 /* Include parameters for TDLS peer (will check later) */
8461 err = nl80211_set_station_tdls(info, ¶ms);
8462 if (err)
8463 return err;
8464
8465 params.vlan = get_vlan(info, rdev);
8466 if (IS_ERR(params.vlan))
8467 return PTR_ERR(params.vlan);
8468
8469 switch (dev->ieee80211_ptr->iftype) {
8470 case NL80211_IFTYPE_AP:
8471 case NL80211_IFTYPE_AP_VLAN:
8472 case NL80211_IFTYPE_P2P_GO:
8473 case NL80211_IFTYPE_P2P_CLIENT:
8474 case NL80211_IFTYPE_STATION:
8475 case NL80211_IFTYPE_ADHOC:
8476 case NL80211_IFTYPE_MESH_POINT:
8477 break;
8478 default:
8479 err = -EOPNOTSUPP;
8480 goto out_put_vlan;
8481 }
8482
8483 /* driver will call cfg80211_check_station_change() */
8484 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
8485
8486 out_put_vlan:
8487 dev_put(params.vlan);
8488
8489 return err;
8490 }
8491
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)8492 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
8493 {
8494 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8495 int err;
8496 struct net_device *dev = info->user_ptr[1];
8497 struct wireless_dev *wdev = dev->ieee80211_ptr;
8498 struct station_parameters params;
8499 u8 *mac_addr = NULL;
8500 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8501 BIT(NL80211_STA_FLAG_ASSOCIATED);
8502
8503 memset(¶ms, 0, sizeof(params));
8504
8505 if (!rdev->ops->add_station)
8506 return -EOPNOTSUPP;
8507
8508 if (!info->attrs[NL80211_ATTR_MAC])
8509 return -EINVAL;
8510
8511 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8512 return -EINVAL;
8513
8514 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
8515 return -EINVAL;
8516
8517 if (!info->attrs[NL80211_ATTR_STA_AID] &&
8518 !info->attrs[NL80211_ATTR_PEER_AID])
8519 return -EINVAL;
8520
8521 params.link_sta_params.link_id =
8522 nl80211_link_id_or_invalid(info->attrs);
8523
8524 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8525 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8526 params.link_sta_params.mld_mac = mac_addr;
8527 params.link_sta_params.link_mac =
8528 nla_data(info->attrs[NL80211_ATTR_MAC]);
8529 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8530 return -EINVAL;
8531 } else {
8532 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8533 }
8534
8535 params.link_sta_params.supported_rates =
8536 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8537 params.link_sta_params.supported_rates_len =
8538 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8539 params.listen_interval =
8540 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8541
8542 if (info->attrs[NL80211_ATTR_VLAN_ID])
8543 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8544
8545 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
8546 params.support_p2p_ps =
8547 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8548 } else {
8549 /*
8550 * if not specified, assume it's supported for P2P GO interface,
8551 * and is NOT supported for AP interface
8552 */
8553 params.support_p2p_ps =
8554 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
8555 }
8556
8557 if (info->attrs[NL80211_ATTR_PEER_AID])
8558 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8559 else
8560 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8561
8562 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8563 params.capability =
8564 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8565 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8566 }
8567
8568 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8569 params.ext_capab =
8570 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8571 params.ext_capab_len =
8572 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8573 }
8574
8575 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8576 params.link_sta_params.ht_capa =
8577 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8578
8579 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8580 params.link_sta_params.vht_capa =
8581 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8582
8583 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8584 params.link_sta_params.he_capa =
8585 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8586 params.link_sta_params.he_capa_len =
8587 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8588
8589 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8590 params.link_sta_params.eht_capa =
8591 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8592 params.link_sta_params.eht_capa_len =
8593 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8594
8595 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
8596 (const u8 *)params.link_sta_params.eht_capa,
8597 params.link_sta_params.eht_capa_len,
8598 false))
8599 return -EINVAL;
8600 }
8601 }
8602
8603 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8604 params.eml_cap_present = true;
8605 params.eml_cap =
8606 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8607 }
8608
8609 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8610 params.link_sta_params.he_6ghz_capa =
8611 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8612
8613 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8614 params.link_sta_params.s1g_capa =
8615 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8616
8617 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8618 params.link_sta_params.opmode_notif_used = true;
8619 params.link_sta_params.opmode_notif =
8620 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8621 }
8622
8623 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8624 params.plink_action =
8625 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8626
8627 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8628 params.airtime_weight =
8629 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8630
8631 if (params.airtime_weight &&
8632 !wiphy_ext_feature_isset(&rdev->wiphy,
8633 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8634 return -EOPNOTSUPP;
8635
8636 err = nl80211_parse_sta_txpower_setting(info,
8637 ¶ms.link_sta_params.txpwr,
8638 ¶ms.link_sta_params.txpwr_set);
8639 if (err)
8640 return err;
8641
8642 err = nl80211_parse_sta_channel_info(info, ¶ms);
8643 if (err)
8644 return err;
8645
8646 err = nl80211_parse_sta_wme(info, ¶ms);
8647 if (err)
8648 return err;
8649
8650 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8651 return -EINVAL;
8652
8653 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
8654 * as userspace might just pass through the capabilities from the IEs
8655 * directly, rather than enforcing this restriction and returning an
8656 * error in this case.
8657 */
8658 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
8659 params.link_sta_params.ht_capa = NULL;
8660 params.link_sta_params.vht_capa = NULL;
8661
8662 /* HE and EHT require WME */
8663 if (params.link_sta_params.he_capa_len ||
8664 params.link_sta_params.he_6ghz_capa ||
8665 params.link_sta_params.eht_capa_len)
8666 return -EINVAL;
8667 }
8668
8669 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
8670 if (params.link_sta_params.he_6ghz_capa &&
8671 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
8672 return -EINVAL;
8673
8674 /* When you run into this, adjust the code below for the new flag */
8675 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8676
8677 switch (dev->ieee80211_ptr->iftype) {
8678 case NL80211_IFTYPE_AP:
8679 case NL80211_IFTYPE_AP_VLAN:
8680 case NL80211_IFTYPE_P2P_GO:
8681 /* ignore WME attributes if iface/sta is not capable */
8682 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
8683 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
8684 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8685
8686 /* TDLS peers cannot be added */
8687 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8688 info->attrs[NL80211_ATTR_PEER_AID])
8689 return -EINVAL;
8690 /* but don't bother the driver with it */
8691 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8692
8693 /* allow authenticated/associated only if driver handles it */
8694 if (!(rdev->wiphy.features &
8695 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8696 params.sta_flags_mask & auth_assoc)
8697 return -EINVAL;
8698
8699 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8700 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
8701 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8702 return -EINVAL;
8703
8704 /* Older userspace, or userspace wanting to be compatible with
8705 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
8706 * and assoc flags in the mask, but assumes the station will be
8707 * added as associated anyway since this was the required driver
8708 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
8709 * introduced.
8710 * In order to not bother drivers with this quirk in the API
8711 * set the flags in both the mask and set for new stations in
8712 * this case.
8713 */
8714 if (!(params.sta_flags_mask & auth_assoc)) {
8715 params.sta_flags_mask |= auth_assoc;
8716 params.sta_flags_set |= auth_assoc;
8717 }
8718
8719 /* must be last in here for error handling */
8720 params.vlan = get_vlan(info, rdev);
8721 if (IS_ERR(params.vlan))
8722 return PTR_ERR(params.vlan);
8723 break;
8724 case NL80211_IFTYPE_MESH_POINT:
8725 /* ignore uAPSD data */
8726 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8727
8728 /* associated is disallowed */
8729 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
8730 return -EINVAL;
8731 /* TDLS peers cannot be added */
8732 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8733 info->attrs[NL80211_ATTR_PEER_AID])
8734 return -EINVAL;
8735 break;
8736 case NL80211_IFTYPE_STATION:
8737 case NL80211_IFTYPE_P2P_CLIENT:
8738 /* ignore uAPSD data */
8739 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8740
8741 /* these are disallowed */
8742 if (params.sta_flags_mask &
8743 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
8744 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
8745 return -EINVAL;
8746 /* Only TDLS peers can be added */
8747 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8748 return -EINVAL;
8749 /* Can only add if TDLS ... */
8750 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
8751 return -EOPNOTSUPP;
8752 /* ... with external setup is supported */
8753 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
8754 return -EOPNOTSUPP;
8755 /*
8756 * Older wpa_supplicant versions always mark the TDLS peer
8757 * as authorized, but it shouldn't yet be.
8758 */
8759 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
8760 break;
8761 default:
8762 return -EOPNOTSUPP;
8763 }
8764
8765 /* be aware of params.vlan when changing code here */
8766
8767 if (wdev->valid_links) {
8768 if (params.link_sta_params.link_id < 0) {
8769 err = -EINVAL;
8770 goto out;
8771 }
8772 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
8773 err = -ENOLINK;
8774 goto out;
8775 }
8776 } else {
8777 if (params.link_sta_params.link_id >= 0) {
8778 err = -EINVAL;
8779 goto out;
8780 }
8781 }
8782 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
8783 out:
8784 dev_put(params.vlan);
8785 return err;
8786 }
8787
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)8788 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
8789 {
8790 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8791 struct net_device *dev = info->user_ptr[1];
8792 struct wireless_dev *wdev = dev->ieee80211_ptr;
8793 struct station_del_parameters params;
8794 int link_id = nl80211_link_id_or_invalid(info->attrs);
8795
8796 memset(¶ms, 0, sizeof(params));
8797
8798 if (info->attrs[NL80211_ATTR_MAC])
8799 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
8800
8801 switch (wdev->iftype) {
8802 case NL80211_IFTYPE_AP:
8803 case NL80211_IFTYPE_AP_VLAN:
8804 case NL80211_IFTYPE_MESH_POINT:
8805 case NL80211_IFTYPE_P2P_GO:
8806 /* always accept these */
8807 break;
8808 case NL80211_IFTYPE_ADHOC:
8809 /* conditionally accept */
8810 if (wiphy_ext_feature_isset(&rdev->wiphy,
8811 NL80211_EXT_FEATURE_DEL_IBSS_STA))
8812 break;
8813 return -EINVAL;
8814 default:
8815 return -EINVAL;
8816 }
8817
8818 if (!rdev->ops->del_station)
8819 return -EOPNOTSUPP;
8820
8821 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
8822 params.subtype =
8823 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
8824 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
8825 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
8826 return -EINVAL;
8827 } else {
8828 /* Default to Deauthentication frame */
8829 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
8830 }
8831
8832 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
8833 params.reason_code =
8834 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8835 if (params.reason_code == 0)
8836 return -EINVAL; /* 0 is reserved */
8837 } else {
8838 /* Default to reason code 2 */
8839 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
8840 }
8841
8842 /* Link ID not expected in case of non-ML operation */
8843 if (!wdev->valid_links && link_id != -1)
8844 return -EINVAL;
8845
8846 /* If given, a valid link ID should be passed during MLO */
8847 if (wdev->valid_links && link_id >= 0 &&
8848 !(wdev->valid_links & BIT(link_id)))
8849 return -EINVAL;
8850
8851 params.link_id = link_id;
8852
8853 return rdev_del_station(rdev, dev, ¶ms);
8854 }
8855
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)8856 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
8857 int flags, struct net_device *dev,
8858 u8 *dst, u8 *next_hop,
8859 struct mpath_info *pinfo)
8860 {
8861 void *hdr;
8862 struct nlattr *pinfoattr;
8863
8864 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
8865 if (!hdr)
8866 return -1;
8867
8868 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8869 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
8870 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
8871 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
8872 goto nla_put_failure;
8873
8874 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
8875 if (!pinfoattr)
8876 goto nla_put_failure;
8877 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
8878 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
8879 pinfo->frame_qlen))
8880 goto nla_put_failure;
8881 if (((pinfo->filled & MPATH_INFO_SN) &&
8882 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
8883 ((pinfo->filled & MPATH_INFO_METRIC) &&
8884 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
8885 pinfo->metric)) ||
8886 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
8887 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
8888 pinfo->exptime)) ||
8889 ((pinfo->filled & MPATH_INFO_FLAGS) &&
8890 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
8891 pinfo->flags)) ||
8892 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
8893 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
8894 pinfo->discovery_timeout)) ||
8895 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
8896 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
8897 pinfo->discovery_retries)) ||
8898 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
8899 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
8900 pinfo->hop_count)) ||
8901 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
8902 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
8903 pinfo->path_change_count)))
8904 goto nla_put_failure;
8905
8906 nla_nest_end(msg, pinfoattr);
8907
8908 genlmsg_end(msg, hdr);
8909 return 0;
8910
8911 nla_put_failure:
8912 genlmsg_cancel(msg, hdr);
8913 return -EMSGSIZE;
8914 }
8915
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)8916 static int nl80211_dump_mpath(struct sk_buff *skb,
8917 struct netlink_callback *cb)
8918 {
8919 struct mpath_info pinfo;
8920 struct cfg80211_registered_device *rdev;
8921 struct wireless_dev *wdev;
8922 u8 dst[ETH_ALEN];
8923 u8 next_hop[ETH_ALEN];
8924 int path_idx = cb->args[2];
8925 int err;
8926
8927 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8928 if (err)
8929 return err;
8930 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8931 __acquire(&rdev->wiphy.mtx);
8932
8933 if (!rdev->ops->dump_mpath) {
8934 err = -EOPNOTSUPP;
8935 goto out_err;
8936 }
8937
8938 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8939 err = -EOPNOTSUPP;
8940 goto out_err;
8941 }
8942
8943 while (1) {
8944 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
8945 next_hop, &pinfo);
8946 if (err == -ENOENT)
8947 break;
8948 if (err)
8949 goto out_err;
8950
8951 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8952 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8953 wdev->netdev, dst, next_hop,
8954 &pinfo) < 0)
8955 goto out;
8956
8957 path_idx++;
8958 }
8959
8960 out:
8961 cb->args[2] = path_idx;
8962 err = skb->len;
8963 out_err:
8964 wiphy_unlock(&rdev->wiphy);
8965 return err;
8966 }
8967
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)8968 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
8969 {
8970 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8971 int err;
8972 struct net_device *dev = info->user_ptr[1];
8973 struct mpath_info pinfo;
8974 struct sk_buff *msg;
8975 u8 *dst = NULL;
8976 u8 next_hop[ETH_ALEN];
8977
8978 memset(&pinfo, 0, sizeof(pinfo));
8979
8980 if (!info->attrs[NL80211_ATTR_MAC])
8981 return -EINVAL;
8982
8983 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8984
8985 if (!rdev->ops->get_mpath)
8986 return -EOPNOTSUPP;
8987
8988 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8989 return -EOPNOTSUPP;
8990
8991 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8992 if (err)
8993 return err;
8994
8995 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8996 if (!msg)
8997 return -ENOMEM;
8998
8999 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
9000 dev, dst, next_hop, &pinfo) < 0) {
9001 nlmsg_free(msg);
9002 return -ENOBUFS;
9003 }
9004
9005 return genlmsg_reply(msg, info);
9006 }
9007
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)9008 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
9009 {
9010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9011 struct net_device *dev = info->user_ptr[1];
9012 u8 *dst = NULL;
9013 u8 *next_hop = NULL;
9014
9015 if (!info->attrs[NL80211_ATTR_MAC])
9016 return -EINVAL;
9017
9018 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9019 return -EINVAL;
9020
9021 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9022 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9023
9024 if (!rdev->ops->change_mpath)
9025 return -EOPNOTSUPP;
9026
9027 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9028 return -EOPNOTSUPP;
9029
9030 return rdev_change_mpath(rdev, dev, dst, next_hop);
9031 }
9032
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)9033 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
9034 {
9035 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9036 struct net_device *dev = info->user_ptr[1];
9037 u8 *dst = NULL;
9038 u8 *next_hop = NULL;
9039
9040 if (!info->attrs[NL80211_ATTR_MAC])
9041 return -EINVAL;
9042
9043 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9044 return -EINVAL;
9045
9046 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9047 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9048
9049 if (!rdev->ops->add_mpath)
9050 return -EOPNOTSUPP;
9051
9052 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9053 return -EOPNOTSUPP;
9054
9055 return rdev_add_mpath(rdev, dev, dst, next_hop);
9056 }
9057
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)9058 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
9059 {
9060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9061 struct net_device *dev = info->user_ptr[1];
9062 u8 *dst = NULL;
9063
9064 if (info->attrs[NL80211_ATTR_MAC])
9065 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9066
9067 if (!rdev->ops->del_mpath)
9068 return -EOPNOTSUPP;
9069
9070 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9071 return -EOPNOTSUPP;
9072
9073 return rdev_del_mpath(rdev, dev, dst);
9074 }
9075
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)9076 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
9077 {
9078 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9079 int err;
9080 struct net_device *dev = info->user_ptr[1];
9081 struct mpath_info pinfo;
9082 struct sk_buff *msg;
9083 u8 *dst = NULL;
9084 u8 mpp[ETH_ALEN];
9085
9086 memset(&pinfo, 0, sizeof(pinfo));
9087
9088 if (!info->attrs[NL80211_ATTR_MAC])
9089 return -EINVAL;
9090
9091 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9092
9093 if (!rdev->ops->get_mpp)
9094 return -EOPNOTSUPP;
9095
9096 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9097 return -EOPNOTSUPP;
9098
9099 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
9100 if (err)
9101 return err;
9102
9103 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9104 if (!msg)
9105 return -ENOMEM;
9106
9107 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
9108 dev, dst, mpp, &pinfo) < 0) {
9109 nlmsg_free(msg);
9110 return -ENOBUFS;
9111 }
9112
9113 return genlmsg_reply(msg, info);
9114 }
9115
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)9116 static int nl80211_dump_mpp(struct sk_buff *skb,
9117 struct netlink_callback *cb)
9118 {
9119 struct mpath_info pinfo;
9120 struct cfg80211_registered_device *rdev;
9121 struct wireless_dev *wdev;
9122 u8 dst[ETH_ALEN];
9123 u8 mpp[ETH_ALEN];
9124 int path_idx = cb->args[2];
9125 int err;
9126
9127 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
9128 if (err)
9129 return err;
9130 /* nl80211_prepare_wdev_dump acquired it in the successful case */
9131 __acquire(&rdev->wiphy.mtx);
9132
9133 if (!rdev->ops->dump_mpp) {
9134 err = -EOPNOTSUPP;
9135 goto out_err;
9136 }
9137
9138 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
9139 err = -EOPNOTSUPP;
9140 goto out_err;
9141 }
9142
9143 while (1) {
9144 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
9145 mpp, &pinfo);
9146 if (err == -ENOENT)
9147 break;
9148 if (err)
9149 goto out_err;
9150
9151 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
9152 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9153 wdev->netdev, dst, mpp,
9154 &pinfo) < 0)
9155 goto out;
9156
9157 path_idx++;
9158 }
9159
9160 out:
9161 cb->args[2] = path_idx;
9162 err = skb->len;
9163 out_err:
9164 wiphy_unlock(&rdev->wiphy);
9165 return err;
9166 }
9167
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)9168 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
9169 {
9170 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9171 struct net_device *dev = info->user_ptr[1];
9172 struct bss_parameters params;
9173 u32 bss_param_support = rdev->wiphy.bss_param_support;
9174 u32 changed = 0;
9175 bool strict;
9176
9177 memset(¶ms, 0, sizeof(params));
9178 params.link_id = nl80211_link_id_or_invalid(info->attrs);
9179 /* default to not changing parameters */
9180 params.use_cts_prot = -1;
9181 params.use_short_preamble = -1;
9182 params.use_short_slot_time = -1;
9183 params.ap_isolate = -1;
9184 params.ht_opmode = -1;
9185 params.p2p_ctwindow = -1;
9186 params.p2p_opp_ps = -1;
9187
9188 strict = nla_get_flag(info->attrs[NL80211_ATTR_BSS_PARAM]);
9189 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) {
9190 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_CTS_PROT))
9191 return -EINVAL;
9192 params.use_cts_prot =
9193 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
9194 changed |= WIPHY_BSS_PARAM_CTS_PROT;
9195 }
9196 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) {
9197 if (strict &&
9198 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_PREAMBLE))
9199 return -EINVAL;
9200 params.use_short_preamble =
9201 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
9202 changed |= WIPHY_BSS_PARAM_SHORT_PREAMBLE;
9203 }
9204 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) {
9205 if (strict &&
9206 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_SLOT_TIME))
9207 return -EINVAL;
9208 params.use_short_slot_time =
9209 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
9210 changed |= WIPHY_BSS_PARAM_SHORT_SLOT_TIME;
9211 }
9212 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9213 if (strict &&
9214 !(bss_param_support & WIPHY_BSS_PARAM_BASIC_RATES))
9215 return -EINVAL;
9216 params.basic_rates =
9217 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9218 params.basic_rates_len =
9219 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9220 changed |= WIPHY_BSS_PARAM_BASIC_RATES;
9221 }
9222 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) {
9223 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_AP_ISOLATE))
9224 return -EINVAL;
9225 params.ap_isolate =
9226 !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
9227 changed |= WIPHY_BSS_PARAM_AP_ISOLATE;
9228 }
9229 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) {
9230 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_HT_OPMODE))
9231 return -EINVAL;
9232 params.ht_opmode =
9233 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
9234 changed |= WIPHY_BSS_PARAM_HT_OPMODE;
9235 }
9236
9237 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
9238 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9239 return -EINVAL;
9240 params.p2p_ctwindow =
9241 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
9242 if (params.p2p_ctwindow != 0 &&
9243 !(bss_param_support & WIPHY_BSS_PARAM_P2P_CTWINDOW))
9244 return -EINVAL;
9245 changed |= WIPHY_BSS_PARAM_P2P_CTWINDOW;
9246 }
9247
9248 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
9249 u8 tmp;
9250
9251 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9252 return -EINVAL;
9253 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
9254 if (tmp && !(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9255 return -EINVAL;
9256 params.p2p_opp_ps = tmp;
9257 if (params.p2p_opp_ps &&
9258 !(rdev->wiphy.bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9259 return -EINVAL;
9260 }
9261
9262 if (!rdev->ops->change_bss)
9263 return -EOPNOTSUPP;
9264
9265 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
9266 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9267 return -EOPNOTSUPP;
9268
9269 changed &= rdev->wiphy.bss_param_support;
9270 if (!changed)
9271 return 0;
9272
9273 return rdev_change_bss(rdev, dev, ¶ms);
9274 }
9275
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)9276 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
9277 {
9278 char *data = NULL;
9279 bool is_indoor;
9280 enum nl80211_user_reg_hint_type user_reg_hint_type;
9281 u32 owner_nlportid;
9282
9283 /*
9284 * You should only get this when cfg80211 hasn't yet initialized
9285 * completely when built-in to the kernel right between the time
9286 * window between nl80211_init() and regulatory_init(), if that is
9287 * even possible.
9288 */
9289 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
9290 return -EINPROGRESS;
9291
9292 user_reg_hint_type =
9293 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
9294 NL80211_USER_REG_HINT_USER);
9295
9296 switch (user_reg_hint_type) {
9297 case NL80211_USER_REG_HINT_USER:
9298 case NL80211_USER_REG_HINT_CELL_BASE:
9299 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
9300 return -EINVAL;
9301
9302 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9303 return regulatory_hint_user(data, user_reg_hint_type);
9304 case NL80211_USER_REG_HINT_INDOOR:
9305 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9306 owner_nlportid = info->snd_portid;
9307 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
9308 } else {
9309 owner_nlportid = 0;
9310 is_indoor = true;
9311 }
9312
9313 regulatory_hint_indoor(is_indoor, owner_nlportid);
9314 return 0;
9315 default:
9316 return -EINVAL;
9317 }
9318 }
9319
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)9320 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
9321 {
9322 return reg_reload_regdb();
9323 }
9324
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)9325 static int nl80211_get_mesh_config(struct sk_buff *skb,
9326 struct genl_info *info)
9327 {
9328 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9329 struct net_device *dev = info->user_ptr[1];
9330 struct wireless_dev *wdev = dev->ieee80211_ptr;
9331 struct mesh_config cur_params;
9332 int err = 0;
9333 void *hdr;
9334 struct nlattr *pinfoattr;
9335 struct sk_buff *msg;
9336
9337 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9338 return -EOPNOTSUPP;
9339
9340 if (!rdev->ops->get_mesh_config)
9341 return -EOPNOTSUPP;
9342
9343 /* If not connected, get default parameters */
9344 if (!wdev->u.mesh.id_len)
9345 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
9346 else
9347 err = rdev_get_mesh_config(rdev, dev, &cur_params);
9348
9349 if (err)
9350 return err;
9351
9352 /* Draw up a netlink message to send back */
9353 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9354 if (!msg)
9355 return -ENOMEM;
9356 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9357 NL80211_CMD_GET_MESH_CONFIG);
9358 if (!hdr)
9359 goto out;
9360 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
9361 if (!pinfoattr)
9362 goto nla_put_failure;
9363 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9364 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
9365 cur_params.dot11MeshRetryTimeout) ||
9366 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
9367 cur_params.dot11MeshConfirmTimeout) ||
9368 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
9369 cur_params.dot11MeshHoldingTimeout) ||
9370 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
9371 cur_params.dot11MeshMaxPeerLinks) ||
9372 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
9373 cur_params.dot11MeshMaxRetries) ||
9374 nla_put_u8(msg, NL80211_MESHCONF_TTL,
9375 cur_params.dot11MeshTTL) ||
9376 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
9377 cur_params.element_ttl) ||
9378 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9379 cur_params.auto_open_plinks) ||
9380 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9381 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
9382 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9383 cur_params.dot11MeshHWMPmaxPREQretries) ||
9384 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
9385 cur_params.path_refresh_time) ||
9386 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9387 cur_params.min_discovery_timeout) ||
9388 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9389 cur_params.dot11MeshHWMPactivePathTimeout) ||
9390 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9391 cur_params.dot11MeshHWMPpreqMinInterval) ||
9392 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9393 cur_params.dot11MeshHWMPperrMinInterval) ||
9394 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9395 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
9396 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
9397 cur_params.dot11MeshHWMPRootMode) ||
9398 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9399 cur_params.dot11MeshHWMPRannInterval) ||
9400 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9401 cur_params.dot11MeshGateAnnouncementProtocol) ||
9402 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
9403 cur_params.dot11MeshForwarding) ||
9404 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
9405 cur_params.rssi_threshold) ||
9406 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
9407 cur_params.ht_opmode) ||
9408 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9409 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
9410 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9411 cur_params.dot11MeshHWMProotInterval) ||
9412 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9413 cur_params.dot11MeshHWMPconfirmationInterval) ||
9414 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
9415 cur_params.power_mode) ||
9416 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
9417 cur_params.dot11MeshAwakeWindowDuration) ||
9418 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
9419 cur_params.plink_timeout) ||
9420 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
9421 cur_params.dot11MeshConnectedToMeshGate) ||
9422 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
9423 cur_params.dot11MeshNolearn) ||
9424 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
9425 cur_params.dot11MeshConnectedToAuthServer))
9426 goto nla_put_failure;
9427 nla_nest_end(msg, pinfoattr);
9428 genlmsg_end(msg, hdr);
9429 return genlmsg_reply(msg, info);
9430
9431 nla_put_failure:
9432 out:
9433 nlmsg_free(msg);
9434 return -ENOBUFS;
9435 }
9436
9437 static const struct nla_policy
9438 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
9439 [NL80211_MESHCONF_RETRY_TIMEOUT] =
9440 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9441 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
9442 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9443 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
9444 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9445 [NL80211_MESHCONF_MAX_PEER_LINKS] =
9446 NLA_POLICY_RANGE(NLA_U16, 0, 255),
9447 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
9448 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9449 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9450 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
9451 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
9452 NLA_POLICY_RANGE(NLA_U32, 1, 255),
9453 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
9454 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
9455 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
9456 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
9457 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
9458 NLA_POLICY_MIN(NLA_U16, 1),
9459 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
9460 NLA_POLICY_MIN(NLA_U16, 1),
9461 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
9462 NLA_POLICY_MIN(NLA_U16, 1),
9463 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
9464 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
9465 NLA_POLICY_MIN(NLA_U16, 1),
9466 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
9467 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
9468 [NL80211_MESHCONF_RSSI_THRESHOLD] =
9469 NLA_POLICY_RANGE(NLA_S32, -255, 0),
9470 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
9471 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
9472 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
9473 NLA_POLICY_MIN(NLA_U16, 1),
9474 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
9475 NLA_POLICY_MIN(NLA_U16, 1),
9476 [NL80211_MESHCONF_POWER_MODE] =
9477 NLA_POLICY_RANGE(NLA_U32,
9478 NL80211_MESH_POWER_ACTIVE,
9479 NL80211_MESH_POWER_MAX),
9480 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
9481 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
9482 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9483 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9484 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9485 };
9486
9487 static const struct nla_policy
9488 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
9489 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
9490 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
9491 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
9492 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
9493 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
9494 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
9495 [NL80211_MESH_SETUP_IE] =
9496 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
9497 IEEE80211_MAX_DATA_LEN),
9498 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
9499 };
9500
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)9501 static int nl80211_parse_mesh_config(struct genl_info *info,
9502 struct mesh_config *cfg,
9503 u32 *mask_out)
9504 {
9505 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
9506 u32 mask = 0;
9507 u16 ht_opmode;
9508
9509 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
9510 do { \
9511 if (tb[attr]) { \
9512 cfg->param = fn(tb[attr]); \
9513 mask |= BIT((attr) - 1); \
9514 } \
9515 } while (0)
9516
9517 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
9518 return -EINVAL;
9519 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
9520 return -EINVAL;
9521
9522 /* This makes sure that there aren't more than 32 mesh config
9523 * parameters (otherwise our bitfield scheme would not work.) */
9524 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
9525
9526 /* Fill in the params struct */
9527 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
9528 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
9529 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
9530 NL80211_MESHCONF_CONFIRM_TIMEOUT,
9531 nla_get_u16);
9532 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
9533 NL80211_MESHCONF_HOLDING_TIMEOUT,
9534 nla_get_u16);
9535 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
9536 NL80211_MESHCONF_MAX_PEER_LINKS,
9537 nla_get_u16);
9538 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
9539 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
9540 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
9541 NL80211_MESHCONF_TTL, nla_get_u8);
9542 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
9543 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
9544 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
9545 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9546 nla_get_u8);
9547 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
9548 mask,
9549 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9550 nla_get_u32);
9551 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
9552 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9553 nla_get_u8);
9554 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
9555 NL80211_MESHCONF_PATH_REFRESH_TIME,
9556 nla_get_u32);
9557 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
9558 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
9559 return -EINVAL;
9560 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
9561 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9562 nla_get_u16);
9563 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
9564 mask,
9565 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9566 nla_get_u32);
9567 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
9568 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
9569 cfg->dot11MeshHWMPactivePathTimeout > 65535))
9570 return -EINVAL;
9571 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
9572 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9573 nla_get_u16);
9574 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
9575 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9576 nla_get_u16);
9577 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9578 dot11MeshHWMPnetDiameterTraversalTime, mask,
9579 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9580 nla_get_u16);
9581 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
9582 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
9583 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
9584 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9585 nla_get_u16);
9586 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
9587 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9588 nla_get_u8);
9589 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
9590 NL80211_MESHCONF_FORWARDING, nla_get_u8);
9591 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
9592 NL80211_MESHCONF_RSSI_THRESHOLD,
9593 nla_get_s32);
9594 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
9595 NL80211_MESHCONF_CONNECTED_TO_GATE,
9596 nla_get_u8);
9597 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
9598 NL80211_MESHCONF_CONNECTED_TO_AS,
9599 nla_get_u8);
9600 /*
9601 * Check HT operation mode based on
9602 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
9603 */
9604 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
9605 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
9606
9607 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
9608 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
9609 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
9610 return -EINVAL;
9611
9612 /* NON_HT_STA bit is reserved, but some programs set it */
9613 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
9614
9615 cfg->ht_opmode = ht_opmode;
9616 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
9617 }
9618 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9619 dot11MeshHWMPactivePathToRootTimeout, mask,
9620 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9621 nla_get_u32);
9622 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
9623 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
9624 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
9625 return -EINVAL;
9626 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
9627 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9628 nla_get_u16);
9629 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
9630 mask,
9631 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9632 nla_get_u16);
9633 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
9634 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
9635 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
9636 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
9637 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
9638 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
9639 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
9640 NL80211_MESHCONF_NOLEARN, nla_get_u8);
9641 if (mask_out)
9642 *mask_out = mask;
9643
9644 return 0;
9645
9646 #undef FILL_IN_MESH_PARAM_IF_SET
9647 }
9648
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)9649 static int nl80211_parse_mesh_setup(struct genl_info *info,
9650 struct mesh_setup *setup)
9651 {
9652 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9653 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
9654
9655 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
9656 return -EINVAL;
9657 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
9658 return -EINVAL;
9659
9660 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
9661 setup->sync_method =
9662 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
9663 IEEE80211_SYNC_METHOD_VENDOR :
9664 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
9665
9666 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
9667 setup->path_sel_proto =
9668 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
9669 IEEE80211_PATH_PROTOCOL_VENDOR :
9670 IEEE80211_PATH_PROTOCOL_HWMP;
9671
9672 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
9673 setup->path_metric =
9674 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
9675 IEEE80211_PATH_METRIC_VENDOR :
9676 IEEE80211_PATH_METRIC_AIRTIME;
9677
9678 if (tb[NL80211_MESH_SETUP_IE]) {
9679 struct nlattr *ieattr =
9680 tb[NL80211_MESH_SETUP_IE];
9681 setup->ie = nla_data(ieattr);
9682 setup->ie_len = nla_len(ieattr);
9683 }
9684 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
9685 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
9686 return -EINVAL;
9687 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
9688 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
9689 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
9690 if (setup->is_secure)
9691 setup->user_mpm = true;
9692
9693 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
9694 if (!setup->user_mpm)
9695 return -EINVAL;
9696 setup->auth_id =
9697 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
9698 }
9699
9700 return 0;
9701 }
9702
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)9703 static int nl80211_update_mesh_config(struct sk_buff *skb,
9704 struct genl_info *info)
9705 {
9706 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9707 struct net_device *dev = info->user_ptr[1];
9708 struct wireless_dev *wdev = dev->ieee80211_ptr;
9709 struct mesh_config cfg = {};
9710 u32 mask;
9711 int err;
9712
9713 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9714 return -EOPNOTSUPP;
9715
9716 if (!rdev->ops->update_mesh_config)
9717 return -EOPNOTSUPP;
9718
9719 err = nl80211_parse_mesh_config(info, &cfg, &mask);
9720 if (err)
9721 return err;
9722
9723 if (!wdev->u.mesh.id_len)
9724 err = -ENOLINK;
9725
9726 if (!err)
9727 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
9728
9729 return err;
9730 }
9731
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)9732 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
9733 struct sk_buff *msg)
9734 {
9735 struct nlattr *nl_reg_rules;
9736 unsigned int i;
9737
9738 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
9739 (regdom->dfs_region &&
9740 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
9741 goto nla_put_failure;
9742
9743 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
9744 if (!nl_reg_rules)
9745 goto nla_put_failure;
9746
9747 for (i = 0; i < regdom->n_reg_rules; i++) {
9748 struct nlattr *nl_reg_rule;
9749 const struct ieee80211_reg_rule *reg_rule;
9750 const struct ieee80211_freq_range *freq_range;
9751 const struct ieee80211_power_rule *power_rule;
9752 unsigned int max_bandwidth_khz;
9753
9754 reg_rule = ®dom->reg_rules[i];
9755 freq_range = ®_rule->freq_range;
9756 power_rule = ®_rule->power_rule;
9757
9758 nl_reg_rule = nla_nest_start_noflag(msg, i);
9759 if (!nl_reg_rule)
9760 goto nla_put_failure;
9761
9762 max_bandwidth_khz = freq_range->max_bandwidth_khz;
9763 if (!max_bandwidth_khz)
9764 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
9765 reg_rule);
9766
9767 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
9768 reg_rule->flags) ||
9769 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
9770 freq_range->start_freq_khz) ||
9771 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
9772 freq_range->end_freq_khz) ||
9773 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
9774 max_bandwidth_khz) ||
9775 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
9776 power_rule->max_antenna_gain) ||
9777 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
9778 power_rule->max_eirp) ||
9779 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
9780 reg_rule->dfs_cac_ms))
9781 goto nla_put_failure;
9782
9783 if ((reg_rule->flags & NL80211_RRF_PSD) &&
9784 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
9785 reg_rule->psd))
9786 goto nla_put_failure;
9787
9788 nla_nest_end(msg, nl_reg_rule);
9789 }
9790
9791 nla_nest_end(msg, nl_reg_rules);
9792 return 0;
9793
9794 nla_put_failure:
9795 return -EMSGSIZE;
9796 }
9797
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)9798 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
9799 {
9800 const struct ieee80211_regdomain *regdom = NULL;
9801 struct cfg80211_registered_device *rdev;
9802 struct wiphy *wiphy = NULL;
9803 struct sk_buff *msg;
9804 int err = -EMSGSIZE;
9805 void *hdr;
9806
9807 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9808 if (!msg)
9809 return -ENOBUFS;
9810
9811 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9812 NL80211_CMD_GET_REG);
9813 if (!hdr)
9814 goto put_failure;
9815
9816 rtnl_lock();
9817
9818 if (info->attrs[NL80211_ATTR_WIPHY]) {
9819 bool self_managed;
9820
9821 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9822 if (IS_ERR(rdev)) {
9823 err = PTR_ERR(rdev);
9824 goto nla_put_failure;
9825 }
9826
9827 wiphy = &rdev->wiphy;
9828 self_managed = wiphy->regulatory_flags &
9829 REGULATORY_WIPHY_SELF_MANAGED;
9830
9831 rcu_read_lock();
9832
9833 regdom = get_wiphy_regdom(wiphy);
9834
9835 /* a self-managed-reg device must have a private regdom */
9836 if (WARN_ON(!regdom && self_managed)) {
9837 err = -EINVAL;
9838 goto nla_put_failure_rcu;
9839 }
9840
9841 if (regdom &&
9842 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9843 goto nla_put_failure_rcu;
9844 } else {
9845 rcu_read_lock();
9846 }
9847
9848 if (!wiphy && reg_last_request_cell_base() &&
9849 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9850 NL80211_USER_REG_HINT_CELL_BASE))
9851 goto nla_put_failure_rcu;
9852
9853 if (!regdom)
9854 regdom = rcu_dereference(cfg80211_regdomain);
9855
9856 if (nl80211_put_regdom(regdom, msg))
9857 goto nla_put_failure_rcu;
9858
9859 rcu_read_unlock();
9860
9861 genlmsg_end(msg, hdr);
9862 rtnl_unlock();
9863 return genlmsg_reply(msg, info);
9864
9865 nla_put_failure_rcu:
9866 rcu_read_unlock();
9867 nla_put_failure:
9868 rtnl_unlock();
9869 put_failure:
9870 nlmsg_free(msg);
9871 return err;
9872 }
9873
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)9874 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
9875 u32 seq, int flags, struct wiphy *wiphy,
9876 const struct ieee80211_regdomain *regdom)
9877 {
9878 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9879 NL80211_CMD_GET_REG);
9880
9881 if (!hdr)
9882 return -1;
9883
9884 genl_dump_check_consistent(cb, hdr);
9885
9886 if (nl80211_put_regdom(regdom, msg))
9887 goto nla_put_failure;
9888
9889 if (!wiphy && reg_last_request_cell_base() &&
9890 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9891 NL80211_USER_REG_HINT_CELL_BASE))
9892 goto nla_put_failure;
9893
9894 if (wiphy &&
9895 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9896 goto nla_put_failure;
9897
9898 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
9899 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
9900 goto nla_put_failure;
9901
9902 genlmsg_end(msg, hdr);
9903 return 0;
9904
9905 nla_put_failure:
9906 genlmsg_cancel(msg, hdr);
9907 return -EMSGSIZE;
9908 }
9909
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)9910 static int nl80211_get_reg_dump(struct sk_buff *skb,
9911 struct netlink_callback *cb)
9912 {
9913 const struct ieee80211_regdomain *regdom = NULL;
9914 struct cfg80211_registered_device *rdev;
9915 int err, reg_idx, start = cb->args[2];
9916
9917 rcu_read_lock();
9918
9919 if (cfg80211_regdomain && start == 0) {
9920 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9921 NLM_F_MULTI, NULL,
9922 rcu_dereference(cfg80211_regdomain));
9923 if (err < 0)
9924 goto out_err;
9925 }
9926
9927 /* the global regdom is idx 0 */
9928 reg_idx = 1;
9929 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9930 regdom = get_wiphy_regdom(&rdev->wiphy);
9931 if (!regdom)
9932 continue;
9933
9934 if (++reg_idx <= start)
9935 continue;
9936
9937 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9938 NLM_F_MULTI, &rdev->wiphy, regdom);
9939 if (err < 0) {
9940 reg_idx--;
9941 break;
9942 }
9943 }
9944
9945 cb->args[2] = reg_idx;
9946 err = skb->len;
9947 out_err:
9948 rcu_read_unlock();
9949 return err;
9950 }
9951
9952 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
9953 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
9954 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
9955 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
9956 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
9957 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
9958 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
9959 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
9960 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
9961 };
9962
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)9963 static int parse_reg_rule(struct nlattr *tb[],
9964 struct ieee80211_reg_rule *reg_rule)
9965 {
9966 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
9967 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
9968
9969 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
9970 return -EINVAL;
9971 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
9972 return -EINVAL;
9973 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
9974 return -EINVAL;
9975 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
9976 return -EINVAL;
9977 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
9978 return -EINVAL;
9979
9980 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
9981
9982 freq_range->start_freq_khz =
9983 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
9984 freq_range->end_freq_khz =
9985 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
9986 freq_range->max_bandwidth_khz =
9987 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
9988
9989 power_rule->max_eirp =
9990 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
9991
9992 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
9993 power_rule->max_antenna_gain =
9994 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
9995
9996 if (tb[NL80211_ATTR_DFS_CAC_TIME])
9997 reg_rule->dfs_cac_ms =
9998 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
9999
10000 return 0;
10001 }
10002
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)10003 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
10004 {
10005 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
10006 struct nlattr *nl_reg_rule;
10007 char *alpha2;
10008 int rem_reg_rules, r;
10009 u32 num_rules = 0, rule_idx = 0;
10010 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
10011 struct ieee80211_regdomain *rd;
10012
10013 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
10014 return -EINVAL;
10015
10016 if (!info->attrs[NL80211_ATTR_REG_RULES])
10017 return -EINVAL;
10018
10019 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
10020
10021 if (info->attrs[NL80211_ATTR_DFS_REGION])
10022 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
10023
10024 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10025 rem_reg_rules) {
10026 num_rules++;
10027 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
10028 return -EINVAL;
10029 }
10030
10031 rtnl_lock();
10032 if (!reg_is_valid_request(alpha2)) {
10033 r = -EINVAL;
10034 goto out;
10035 }
10036
10037 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
10038 if (!rd) {
10039 r = -ENOMEM;
10040 goto out;
10041 }
10042
10043 rd->n_reg_rules = num_rules;
10044 rd->alpha2[0] = alpha2[0];
10045 rd->alpha2[1] = alpha2[1];
10046
10047 /*
10048 * Disable DFS master mode if the DFS region was
10049 * not supported or known on this kernel.
10050 */
10051 if (reg_supported_dfs_region(dfs_region))
10052 rd->dfs_region = dfs_region;
10053
10054 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10055 rem_reg_rules) {
10056 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
10057 nl_reg_rule, reg_rule_policy,
10058 info->extack);
10059 if (r)
10060 goto bad_reg;
10061 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
10062 if (r)
10063 goto bad_reg;
10064
10065 rule_idx++;
10066
10067 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
10068 r = -EINVAL;
10069 goto bad_reg;
10070 }
10071 }
10072
10073 r = set_regdom(rd, REGD_SOURCE_CRDA);
10074 /* set_regdom takes ownership of rd */
10075 rd = NULL;
10076 bad_reg:
10077 kfree(rd);
10078 out:
10079 rtnl_unlock();
10080 return r;
10081 }
10082 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
10083
validate_scan_freqs(struct nlattr * freqs)10084 static int validate_scan_freqs(struct nlattr *freqs)
10085 {
10086 struct nlattr *attr1, *attr2;
10087 int n_channels = 0, tmp1, tmp2;
10088
10089 nla_for_each_nested(attr1, freqs, tmp1)
10090 if (nla_len(attr1) != sizeof(u32))
10091 return 0;
10092
10093 nla_for_each_nested(attr1, freqs, tmp1) {
10094 n_channels++;
10095 /*
10096 * Some hardware has a limited channel list for
10097 * scanning, and it is pretty much nonsensical
10098 * to scan for a channel twice, so disallow that
10099 * and don't require drivers to check that the
10100 * channel list they get isn't longer than what
10101 * they can scan, as long as they can scan all
10102 * the channels they registered at once.
10103 */
10104 nla_for_each_nested(attr2, freqs, tmp2)
10105 if (attr1 != attr2 &&
10106 nla_get_u32(attr1) == nla_get_u32(attr2))
10107 return 0;
10108 }
10109
10110 return n_channels;
10111 }
10112
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)10113 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
10114 {
10115 return b < NUM_NL80211_BANDS && wiphy->bands[b];
10116 }
10117
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)10118 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
10119 struct cfg80211_bss_selection *bss_select)
10120 {
10121 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
10122 struct nlattr *nest;
10123 int err;
10124 bool found = false;
10125 int i;
10126
10127 /* only process one nested attribute */
10128 nest = nla_data(nla);
10129 if (!nla_ok(nest, nla_len(nest)))
10130 return -EINVAL;
10131
10132 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
10133 nest, nl80211_bss_select_policy,
10134 NULL);
10135 if (err)
10136 return err;
10137
10138 /* only one attribute may be given */
10139 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
10140 if (attr[i]) {
10141 if (found)
10142 return -EINVAL;
10143 found = true;
10144 }
10145 }
10146
10147 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
10148
10149 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
10150 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
10151
10152 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
10153 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
10154 bss_select->param.band_pref =
10155 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
10156 if (!is_band_valid(wiphy, bss_select->param.band_pref))
10157 return -EINVAL;
10158 }
10159
10160 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
10161 struct nl80211_bss_select_rssi_adjust *adj_param;
10162
10163 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
10164 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
10165 bss_select->param.adjust.band = adj_param->band;
10166 bss_select->param.adjust.delta = adj_param->delta;
10167 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
10168 return -EINVAL;
10169 }
10170
10171 /* user-space did not provide behaviour attribute */
10172 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
10173 return -EINVAL;
10174
10175 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
10176 return -EINVAL;
10177
10178 return 0;
10179 }
10180
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)10181 int nl80211_parse_random_mac(struct nlattr **attrs,
10182 u8 *mac_addr, u8 *mac_addr_mask)
10183 {
10184 int i;
10185
10186 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
10187 eth_zero_addr(mac_addr);
10188 eth_zero_addr(mac_addr_mask);
10189 mac_addr[0] = 0x2;
10190 mac_addr_mask[0] = 0x3;
10191
10192 return 0;
10193 }
10194
10195 /* need both or none */
10196 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
10197 return -EINVAL;
10198
10199 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
10200 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
10201
10202 /* don't allow or configure an mcast address */
10203 if (!is_multicast_ether_addr(mac_addr_mask) ||
10204 is_multicast_ether_addr(mac_addr))
10205 return -EINVAL;
10206
10207 /*
10208 * allow users to pass a MAC address that has bits set outside
10209 * of the mask, but don't bother drivers with having to deal
10210 * with such bits
10211 */
10212 for (i = 0; i < ETH_ALEN; i++)
10213 mac_addr[i] &= mac_addr_mask[i];
10214
10215 return 0;
10216 }
10217
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)10218 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
10219 struct ieee80211_channel *chan)
10220 {
10221 unsigned int link_id;
10222 bool all_ok = true;
10223 int radio_idx;
10224
10225 lockdep_assert_wiphy(wdev->wiphy);
10226
10227 if (!cfg80211_wdev_channel_allowed(wdev, chan))
10228 return false;
10229
10230 if (!cfg80211_beaconing_iface_active(wdev))
10231 return true;
10232
10233 radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy, chan);
10234
10235 /*
10236 * FIXME: check if we have a free radio/link for chan
10237 *
10238 * This, as well as the FIXME below, requires knowing the link
10239 * capabilities of the hardware.
10240 */
10241
10242 /* we cannot leave radar channels */
10243 for_each_valid_link(wdev, link_id) {
10244 struct cfg80211_chan_def *chandef;
10245 int link_radio_idx;
10246
10247 chandef = wdev_chandef(wdev, link_id);
10248 if (!chandef || !chandef->chan)
10249 continue;
10250
10251 if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
10252 continue;
10253
10254 /*
10255 * chandef->chan is a radar channel. If the radio/link onto
10256 * which this radar channel falls is the same radio/link onto
10257 * which the input 'chan' falls, off-channel operation should
10258 * not be allowed. Hence, set 'all_ok' to false.
10259 */
10260
10261 link_radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy,
10262 chandef->chan);
10263 if (link_radio_idx == radio_idx) {
10264 all_ok = false;
10265 break;
10266 }
10267 }
10268
10269 if (all_ok)
10270 return true;
10271
10272 return regulatory_pre_cac_allowed(wdev->wiphy);
10273 }
10274
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)10275 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
10276 enum nl80211_ext_feature_index feat)
10277 {
10278 if (!(flags & flag))
10279 return true;
10280 if (wiphy_ext_feature_isset(wiphy, feat))
10281 return true;
10282 return false;
10283 }
10284
10285 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask,u32 * flags,enum nl80211_feature_flags randomness_flag)10286 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
10287 struct nlattr **attrs, u8 *mac_addr, u8 *mac_addr_mask,
10288 u32 *flags, enum nl80211_feature_flags randomness_flag)
10289 {
10290 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
10291 return 0;
10292
10293 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
10294
10295 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
10296 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
10297 !nl80211_check_scan_feat(wiphy, *flags,
10298 NL80211_SCAN_FLAG_LOW_SPAN,
10299 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
10300 !nl80211_check_scan_feat(wiphy, *flags,
10301 NL80211_SCAN_FLAG_LOW_POWER,
10302 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
10303 !nl80211_check_scan_feat(wiphy, *flags,
10304 NL80211_SCAN_FLAG_HIGH_ACCURACY,
10305 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
10306 !nl80211_check_scan_feat(wiphy, *flags,
10307 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
10308 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
10309 !nl80211_check_scan_feat(wiphy, *flags,
10310 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
10311 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
10312 !nl80211_check_scan_feat(wiphy, *flags,
10313 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
10314 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
10315 !nl80211_check_scan_feat(wiphy, *flags,
10316 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
10317 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
10318 !nl80211_check_scan_feat(wiphy, *flags,
10319 NL80211_SCAN_FLAG_RANDOM_SN,
10320 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
10321 !nl80211_check_scan_feat(wiphy, *flags,
10322 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
10323 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
10324 return -EOPNOTSUPP;
10325
10326 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
10327 int err;
10328
10329 if (!(wiphy->features & randomness_flag) ||
10330 (wdev && wdev->connected))
10331 return -EOPNOTSUPP;
10332
10333 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
10334 if (err)
10335 return err;
10336 }
10337
10338 return 0;
10339 }
10340
10341 static int
nl80211_check_scan_flags_sched(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_sched_scan_request * req)10342 nl80211_check_scan_flags_sched(struct wiphy *wiphy, struct wireless_dev *wdev,
10343 struct nlattr **attrs,
10344 struct cfg80211_sched_scan_request *req)
10345 {
10346 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10347 req->mac_addr, req->mac_addr_mask,
10348 &req->flags,
10349 wdev ? NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
10350 NL80211_FEATURE_ND_RANDOM_MAC_ADDR);
10351 }
10352
10353 static int
nl80211_check_scan_flags_reg(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_scan_request_int * req)10354 nl80211_check_scan_flags_reg(struct wiphy *wiphy, struct wireless_dev *wdev,
10355 struct nlattr **attrs,
10356 struct cfg80211_scan_request_int *req)
10357 {
10358 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10359 req->req.mac_addr,
10360 req->req.mac_addr_mask,
10361 &req->req.flags,
10362 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR);
10363 }
10364
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)10365 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
10366 {
10367 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10368 struct wireless_dev *wdev = info->user_ptr[1];
10369 struct cfg80211_scan_request_int *request;
10370 struct nlattr *scan_freqs = NULL;
10371 bool scan_freqs_khz = false;
10372 struct nlattr *attr;
10373 struct wiphy *wiphy;
10374 int err, tmp, n_ssids = 0, n_channels, i;
10375 size_t ie_len, size;
10376 size_t ssids_offset, ie_offset;
10377
10378 wiphy = &rdev->wiphy;
10379
10380 if (wdev->iftype == NL80211_IFTYPE_NAN)
10381 return -EOPNOTSUPP;
10382
10383 if (!rdev->ops->scan)
10384 return -EOPNOTSUPP;
10385
10386 if (rdev->scan_req || rdev->scan_msg)
10387 return -EBUSY;
10388
10389 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
10390 if (!wiphy_ext_feature_isset(wiphy,
10391 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
10392 return -EOPNOTSUPP;
10393 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
10394 scan_freqs_khz = true;
10395 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
10396 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
10397
10398 if (scan_freqs) {
10399 n_channels = validate_scan_freqs(scan_freqs);
10400 if (!n_channels)
10401 return -EINVAL;
10402 } else {
10403 n_channels = ieee80211_get_num_supported_channels(wiphy);
10404 }
10405
10406 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
10407 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
10408 n_ssids++;
10409
10410 if (n_ssids > wiphy->max_scan_ssids)
10411 return -EINVAL;
10412
10413 if (info->attrs[NL80211_ATTR_IE])
10414 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10415 else
10416 ie_len = 0;
10417
10418 if (ie_len > wiphy->max_scan_ie_len)
10419 return -EINVAL;
10420
10421 size = struct_size(request, req.channels, n_channels);
10422 ssids_offset = size;
10423 size = size_add(size, array_size(sizeof(*request->req.ssids), n_ssids));
10424 ie_offset = size;
10425 size = size_add(size, ie_len);
10426 request = kzalloc(size, GFP_KERNEL);
10427 if (!request)
10428 return -ENOMEM;
10429
10430 if (n_ssids)
10431 request->req.ssids = (void *)request + ssids_offset;
10432 request->req.n_ssids = n_ssids;
10433 if (ie_len)
10434 request->req.ie = (void *)request + ie_offset;
10435
10436 i = 0;
10437 if (scan_freqs) {
10438 /* user specified, bail out if channel not found */
10439 nla_for_each_nested(attr, scan_freqs, tmp) {
10440 struct ieee80211_channel *chan;
10441 int freq = nla_get_u32(attr);
10442
10443 if (!scan_freqs_khz)
10444 freq = MHZ_TO_KHZ(freq);
10445
10446 chan = ieee80211_get_channel_khz(wiphy, freq);
10447 if (!chan) {
10448 err = -EINVAL;
10449 goto out_free;
10450 }
10451
10452 /* Ignore disabled / no primary channels */
10453 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10454 chan->flags & IEEE80211_CHAN_S1G_NO_PRIMARY ||
10455 !cfg80211_wdev_channel_allowed(wdev, chan))
10456 continue;
10457
10458 request->req.channels[i] = chan;
10459 i++;
10460 }
10461 } else {
10462 enum nl80211_band band;
10463
10464 /* all channels */
10465 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10466 int j;
10467
10468 if (!wiphy->bands[band])
10469 continue;
10470 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10471 struct ieee80211_channel *chan;
10472
10473 chan = &wiphy->bands[band]->channels[j];
10474
10475 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10476 chan->flags &
10477 IEEE80211_CHAN_S1G_NO_PRIMARY ||
10478 !cfg80211_wdev_channel_allowed(wdev, chan))
10479 continue;
10480
10481 request->req.channels[i] = chan;
10482 i++;
10483 }
10484 }
10485 }
10486
10487 if (!i) {
10488 err = -EINVAL;
10489 goto out_free;
10490 }
10491
10492 request->req.n_channels = i;
10493
10494 for (i = 0; i < request->req.n_channels; i++) {
10495 struct ieee80211_channel *chan = request->req.channels[i];
10496
10497 /* if we can go off-channel to the target channel we're good */
10498 if (cfg80211_off_channel_oper_allowed(wdev, chan))
10499 continue;
10500
10501 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
10502 err = -EBUSY;
10503 goto out_free;
10504 }
10505 }
10506
10507 i = 0;
10508 if (n_ssids) {
10509 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
10510 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10511 err = -EINVAL;
10512 goto out_free;
10513 }
10514 request->req.ssids[i].ssid_len = nla_len(attr);
10515 memcpy(request->req.ssids[i].ssid,
10516 nla_data(attr), nla_len(attr));
10517 i++;
10518 }
10519 }
10520
10521 if (info->attrs[NL80211_ATTR_IE]) {
10522 request->req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10523 memcpy((void *)request->req.ie,
10524 nla_data(info->attrs[NL80211_ATTR_IE]),
10525 request->req.ie_len);
10526 }
10527
10528 for (i = 0; i < NUM_NL80211_BANDS; i++)
10529 if (wiphy->bands[i])
10530 request->req.rates[i] =
10531 (1 << wiphy->bands[i]->n_bitrates) - 1;
10532
10533 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
10534 nla_for_each_nested(attr,
10535 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
10536 tmp) {
10537 enum nl80211_band band = nla_type(attr);
10538
10539 if (band < 0 || band >= NUM_NL80211_BANDS) {
10540 err = -EINVAL;
10541 goto out_free;
10542 }
10543
10544 if (!wiphy->bands[band])
10545 continue;
10546
10547 err = ieee80211_get_ratemask(wiphy->bands[band],
10548 nla_data(attr),
10549 nla_len(attr),
10550 &request->req.rates[band]);
10551 if (err)
10552 goto out_free;
10553 }
10554 }
10555
10556 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
10557 request->req.duration =
10558 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
10559 request->req.duration_mandatory =
10560 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
10561 }
10562
10563 err = nl80211_check_scan_flags_reg(wiphy, wdev, info->attrs, request);
10564 if (err)
10565 goto out_free;
10566
10567 request->req.no_cck =
10568 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10569
10570 /* Initial implementation used NL80211_ATTR_MAC to set the specific
10571 * BSSID to scan for. This was problematic because that same attribute
10572 * was already used for another purpose (local random MAC address). The
10573 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
10574 * compatibility with older userspace components, also use the
10575 * NL80211_ATTR_MAC value here if it can be determined to be used for
10576 * the specific BSSID use case instead of the random MAC address
10577 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
10578 */
10579 if (info->attrs[NL80211_ATTR_BSSID])
10580 memcpy(request->req.bssid,
10581 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
10582 else if (!(request->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
10583 info->attrs[NL80211_ATTR_MAC])
10584 memcpy(request->req.bssid,
10585 nla_data(info->attrs[NL80211_ATTR_MAC]),
10586 ETH_ALEN);
10587 else
10588 eth_broadcast_addr(request->req.bssid);
10589
10590 request->req.tsf_report_link_id =
10591 nl80211_link_id_or_invalid(info->attrs);
10592 request->req.wdev = wdev;
10593 request->req.wiphy = &rdev->wiphy;
10594 request->req.scan_start = jiffies;
10595
10596 rdev->scan_req = request;
10597 err = cfg80211_scan(rdev);
10598
10599 if (err)
10600 goto out_free;
10601
10602 nl80211_send_scan_start(rdev, wdev);
10603 dev_hold(wdev->netdev);
10604
10605 return 0;
10606
10607 out_free:
10608 rdev->scan_req = NULL;
10609 kfree(request);
10610
10611 return err;
10612 }
10613
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)10614 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
10615 {
10616 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10617 struct wireless_dev *wdev = info->user_ptr[1];
10618
10619 if (!rdev->ops->abort_scan)
10620 return -EOPNOTSUPP;
10621
10622 if (rdev->scan_msg)
10623 return 0;
10624
10625 if (!rdev->scan_req)
10626 return -ENOENT;
10627
10628 rdev_abort_scan(rdev, wdev);
10629 return 0;
10630 }
10631
10632 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)10633 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
10634 struct cfg80211_sched_scan_request *request,
10635 struct nlattr **attrs)
10636 {
10637 int tmp, err, i = 0;
10638 struct nlattr *attr;
10639
10640 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10641 u32 interval;
10642
10643 /*
10644 * If scan plans are not specified,
10645 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
10646 * case one scan plan will be set with the specified scan
10647 * interval and infinite number of iterations.
10648 */
10649 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
10650 if (!interval)
10651 return -EINVAL;
10652
10653 request->scan_plans[0].interval =
10654 DIV_ROUND_UP(interval, MSEC_PER_SEC);
10655 if (!request->scan_plans[0].interval)
10656 return -EINVAL;
10657
10658 if (request->scan_plans[0].interval >
10659 wiphy->max_sched_scan_plan_interval)
10660 request->scan_plans[0].interval =
10661 wiphy->max_sched_scan_plan_interval;
10662
10663 return 0;
10664 }
10665
10666 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
10667 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
10668
10669 if (WARN_ON(i >= n_plans))
10670 return -EINVAL;
10671
10672 err = nla_parse_nested_deprecated(plan,
10673 NL80211_SCHED_SCAN_PLAN_MAX,
10674 attr, nl80211_plan_policy,
10675 NULL);
10676 if (err)
10677 return err;
10678
10679 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
10680 return -EINVAL;
10681
10682 request->scan_plans[i].interval =
10683 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
10684 if (!request->scan_plans[i].interval ||
10685 request->scan_plans[i].interval >
10686 wiphy->max_sched_scan_plan_interval)
10687 return -EINVAL;
10688
10689 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
10690 request->scan_plans[i].iterations =
10691 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
10692 if (!request->scan_plans[i].iterations ||
10693 (request->scan_plans[i].iterations >
10694 wiphy->max_sched_scan_plan_iterations))
10695 return -EINVAL;
10696 } else if (i < n_plans - 1) {
10697 /*
10698 * All scan plans but the last one must specify
10699 * a finite number of iterations
10700 */
10701 return -EINVAL;
10702 }
10703
10704 i++;
10705 }
10706
10707 /*
10708 * The last scan plan must not specify the number of
10709 * iterations, it is supposed to run infinitely
10710 */
10711 if (request->scan_plans[n_plans - 1].iterations)
10712 return -EINVAL;
10713
10714 return 0;
10715 }
10716
10717 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)10718 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
10719 struct nlattr **attrs, int max_match_sets)
10720 {
10721 struct cfg80211_sched_scan_request *request;
10722 struct nlattr *attr;
10723 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
10724 enum nl80211_band band;
10725 size_t ie_len, size;
10726 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
10727 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
10728
10729 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10730 n_channels = validate_scan_freqs(
10731 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
10732 if (!n_channels)
10733 return ERR_PTR(-EINVAL);
10734 } else {
10735 n_channels = ieee80211_get_num_supported_channels(wiphy);
10736 }
10737
10738 if (attrs[NL80211_ATTR_SCAN_SSIDS])
10739 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10740 tmp)
10741 n_ssids++;
10742
10743 if (n_ssids > wiphy->max_sched_scan_ssids)
10744 return ERR_PTR(-EINVAL);
10745
10746 /*
10747 * First, count the number of 'real' matchsets. Due to an issue with
10748 * the old implementation, matchsets containing only the RSSI attribute
10749 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
10750 * RSSI for all matchsets, rather than their own matchset for reporting
10751 * all APs with a strong RSSI. This is needed to be compatible with
10752 * older userspace that treated a matchset with only the RSSI as the
10753 * global RSSI for all other matchsets - if there are other matchsets.
10754 */
10755 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10756 nla_for_each_nested(attr,
10757 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10758 tmp) {
10759 struct nlattr *rssi;
10760
10761 err = nla_parse_nested_deprecated(tb,
10762 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10763 attr,
10764 nl80211_match_policy,
10765 NULL);
10766 if (err)
10767 return ERR_PTR(err);
10768
10769 /* SSID and BSSID are mutually exclusive */
10770 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
10771 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
10772 return ERR_PTR(-EINVAL);
10773
10774 /* add other standalone attributes here */
10775 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
10776 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
10777 n_match_sets++;
10778 continue;
10779 }
10780 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10781 if (rssi)
10782 default_match_rssi = nla_get_s32(rssi);
10783 }
10784 }
10785
10786 /* However, if there's no other matchset, add the RSSI one */
10787 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
10788 n_match_sets = 1;
10789
10790 if (n_match_sets > max_match_sets)
10791 return ERR_PTR(-EINVAL);
10792
10793 if (attrs[NL80211_ATTR_IE])
10794 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
10795 else
10796 ie_len = 0;
10797
10798 if (ie_len > wiphy->max_sched_scan_ie_len)
10799 return ERR_PTR(-EINVAL);
10800
10801 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10802 /*
10803 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
10804 * each scan plan already specifies its own interval
10805 */
10806 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10807 return ERR_PTR(-EINVAL);
10808
10809 nla_for_each_nested(attr,
10810 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
10811 n_plans++;
10812 } else {
10813 /*
10814 * The scan interval attribute is kept for backward
10815 * compatibility. If no scan plans are specified and sched scan
10816 * interval is specified, one scan plan will be set with this
10817 * scan interval and infinite number of iterations.
10818 */
10819 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10820 return ERR_PTR(-EINVAL);
10821
10822 n_plans = 1;
10823 }
10824
10825 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
10826 return ERR_PTR(-EINVAL);
10827
10828 if (!wiphy_ext_feature_isset(
10829 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
10830 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
10831 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
10832 return ERR_PTR(-EINVAL);
10833
10834 size = struct_size(request, channels, n_channels);
10835 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
10836 size = size_add(size, array_size(sizeof(*request->match_sets),
10837 n_match_sets));
10838 size = size_add(size, array_size(sizeof(*request->scan_plans),
10839 n_plans));
10840 size = size_add(size, ie_len);
10841 request = kzalloc(size, GFP_KERNEL);
10842 if (!request)
10843 return ERR_PTR(-ENOMEM);
10844 request->n_channels = n_channels;
10845
10846 if (n_ssids)
10847 request->ssids = (void *)request +
10848 struct_size(request, channels, n_channels);
10849 request->n_ssids = n_ssids;
10850 if (ie_len) {
10851 if (n_ssids)
10852 request->ie = (void *)(request->ssids + n_ssids);
10853 else
10854 request->ie = (void *)(request->channels + n_channels);
10855 }
10856
10857 if (n_match_sets) {
10858 if (request->ie)
10859 request->match_sets = (void *)(request->ie + ie_len);
10860 else if (n_ssids)
10861 request->match_sets =
10862 (void *)(request->ssids + n_ssids);
10863 else
10864 request->match_sets =
10865 (void *)(request->channels + n_channels);
10866 }
10867 request->n_match_sets = n_match_sets;
10868
10869 if (n_match_sets)
10870 request->scan_plans = (void *)(request->match_sets +
10871 n_match_sets);
10872 else if (request->ie)
10873 request->scan_plans = (void *)(request->ie + ie_len);
10874 else if (n_ssids)
10875 request->scan_plans = (void *)(request->ssids + n_ssids);
10876 else
10877 request->scan_plans = (void *)(request->channels + n_channels);
10878
10879 request->n_scan_plans = n_plans;
10880
10881 i = 0;
10882 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10883 /* user specified, bail out if channel not found */
10884 nla_for_each_nested(attr,
10885 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
10886 tmp) {
10887 struct ieee80211_channel *chan;
10888
10889 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
10890
10891 if (!chan) {
10892 err = -EINVAL;
10893 goto out_free;
10894 }
10895
10896 /* ignore disabled channels */
10897 if (chan->flags & IEEE80211_CHAN_DISABLED)
10898 continue;
10899
10900 request->channels[i] = chan;
10901 i++;
10902 }
10903 } else {
10904 /* all channels */
10905 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10906 int j;
10907
10908 if (!wiphy->bands[band])
10909 continue;
10910 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10911 struct ieee80211_channel *chan;
10912
10913 chan = &wiphy->bands[band]->channels[j];
10914
10915 if (chan->flags & IEEE80211_CHAN_DISABLED)
10916 continue;
10917
10918 request->channels[i] = chan;
10919 i++;
10920 }
10921 }
10922 }
10923
10924 if (!i) {
10925 err = -EINVAL;
10926 goto out_free;
10927 }
10928
10929 request->n_channels = i;
10930
10931 i = 0;
10932 if (n_ssids) {
10933 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10934 tmp) {
10935 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10936 err = -EINVAL;
10937 goto out_free;
10938 }
10939 request->ssids[i].ssid_len = nla_len(attr);
10940 memcpy(request->ssids[i].ssid, nla_data(attr),
10941 nla_len(attr));
10942 i++;
10943 }
10944 }
10945
10946 i = 0;
10947 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10948 nla_for_each_nested(attr,
10949 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10950 tmp) {
10951 struct nlattr *ssid, *bssid, *rssi;
10952
10953 err = nla_parse_nested_deprecated(tb,
10954 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10955 attr,
10956 nl80211_match_policy,
10957 NULL);
10958 if (err)
10959 goto out_free;
10960 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
10961 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
10962
10963 if (!ssid && !bssid) {
10964 i++;
10965 continue;
10966 }
10967
10968 if (WARN_ON(i >= n_match_sets)) {
10969 /* this indicates a programming error,
10970 * the loop above should have verified
10971 * things properly
10972 */
10973 err = -EINVAL;
10974 goto out_free;
10975 }
10976
10977 if (ssid) {
10978 memcpy(request->match_sets[i].ssid.ssid,
10979 nla_data(ssid), nla_len(ssid));
10980 request->match_sets[i].ssid.ssid_len =
10981 nla_len(ssid);
10982 }
10983 if (bssid)
10984 memcpy(request->match_sets[i].bssid,
10985 nla_data(bssid), ETH_ALEN);
10986
10987 /* special attribute - old implementation w/a */
10988 request->match_sets[i].rssi_thold = default_match_rssi;
10989 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10990 if (rssi)
10991 request->match_sets[i].rssi_thold =
10992 nla_get_s32(rssi);
10993 i++;
10994 }
10995
10996 /* there was no other matchset, so the RSSI one is alone */
10997 if (i == 0 && n_match_sets)
10998 request->match_sets[0].rssi_thold = default_match_rssi;
10999
11000 request->min_rssi_thold = INT_MAX;
11001 for (i = 0; i < n_match_sets; i++)
11002 request->min_rssi_thold =
11003 min(request->match_sets[i].rssi_thold,
11004 request->min_rssi_thold);
11005 } else {
11006 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
11007 }
11008
11009 if (ie_len) {
11010 request->ie_len = ie_len;
11011 memcpy((void *)request->ie,
11012 nla_data(attrs[NL80211_ATTR_IE]),
11013 request->ie_len);
11014 }
11015
11016 err = nl80211_check_scan_flags_sched(wiphy, wdev, attrs, request);
11017 if (err)
11018 goto out_free;
11019
11020 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
11021 request->delay =
11022 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
11023
11024 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
11025 request->relative_rssi = nla_get_s8(
11026 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
11027 request->relative_rssi_set = true;
11028 }
11029
11030 if (request->relative_rssi_set &&
11031 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
11032 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
11033
11034 rssi_adjust = nla_data(
11035 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
11036 request->rssi_adjust.band = rssi_adjust->band;
11037 request->rssi_adjust.delta = rssi_adjust->delta;
11038 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
11039 err = -EINVAL;
11040 goto out_free;
11041 }
11042 }
11043
11044 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
11045 if (err)
11046 goto out_free;
11047
11048 request->scan_start = jiffies;
11049
11050 return request;
11051
11052 out_free:
11053 kfree(request);
11054 return ERR_PTR(err);
11055 }
11056
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)11057 static int nl80211_start_sched_scan(struct sk_buff *skb,
11058 struct genl_info *info)
11059 {
11060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11061 struct net_device *dev = info->user_ptr[1];
11062 struct wireless_dev *wdev = dev->ieee80211_ptr;
11063 struct cfg80211_sched_scan_request *sched_scan_req;
11064 bool want_multi;
11065 int err;
11066
11067 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
11068 return -EOPNOTSUPP;
11069
11070 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
11071 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
11072 if (err)
11073 return err;
11074
11075 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
11076 info->attrs,
11077 rdev->wiphy.max_match_sets);
11078
11079 err = PTR_ERR_OR_ZERO(sched_scan_req);
11080 if (err)
11081 goto out_err;
11082
11083 /* leave request id zero for legacy request
11084 * or if driver does not support multi-scheduled scan
11085 */
11086 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
11087 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
11088
11089 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
11090 if (err)
11091 goto out_free;
11092
11093 sched_scan_req->dev = dev;
11094 sched_scan_req->wiphy = &rdev->wiphy;
11095
11096 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11097 sched_scan_req->owner_nlportid = info->snd_portid;
11098
11099 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
11100
11101 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
11102 return 0;
11103
11104 out_free:
11105 kfree(sched_scan_req);
11106 out_err:
11107 return err;
11108 }
11109
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)11110 static int nl80211_stop_sched_scan(struct sk_buff *skb,
11111 struct genl_info *info)
11112 {
11113 struct cfg80211_sched_scan_request *req;
11114 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11115 u64 cookie;
11116
11117 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
11118 return -EOPNOTSUPP;
11119
11120 if (info->attrs[NL80211_ATTR_COOKIE]) {
11121 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11122 return __cfg80211_stop_sched_scan(rdev, cookie, false);
11123 }
11124
11125 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
11126 struct cfg80211_sched_scan_request,
11127 list);
11128 if (!req || req->reqid ||
11129 (req->owner_nlportid &&
11130 req->owner_nlportid != info->snd_portid))
11131 return -ENOENT;
11132
11133 return cfg80211_stop_sched_scan_req(rdev, req, false);
11134 }
11135
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)11136 static int nl80211_start_radar_detection(struct sk_buff *skb,
11137 struct genl_info *info)
11138 {
11139 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11140 struct net_device *dev = info->user_ptr[1];
11141 struct wireless_dev *wdev = dev->ieee80211_ptr;
11142 int link_id = nl80211_link_id(info->attrs);
11143 struct wiphy *wiphy = wdev->wiphy;
11144 struct cfg80211_chan_def chandef;
11145 enum nl80211_dfs_regions dfs_region;
11146 unsigned int cac_time_ms;
11147 int err;
11148
11149 flush_delayed_work(&rdev->dfs_update_channels_wk);
11150
11151 switch (wdev->iftype) {
11152 case NL80211_IFTYPE_AP:
11153 case NL80211_IFTYPE_P2P_GO:
11154 case NL80211_IFTYPE_MESH_POINT:
11155 case NL80211_IFTYPE_ADHOC:
11156 break;
11157 default:
11158 /* caution - see cfg80211_beaconing_iface_active() below */
11159 return -EINVAL;
11160 }
11161
11162 guard(wiphy)(wiphy);
11163
11164 dfs_region = reg_get_dfs_region(wiphy);
11165 if (dfs_region == NL80211_DFS_UNSET)
11166 return -EINVAL;
11167
11168 err = nl80211_parse_chandef(rdev, info, &chandef);
11169 if (err)
11170 return err;
11171
11172 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11173 if (err < 0)
11174 return err;
11175
11176 if (err == 0)
11177 return -EINVAL;
11178
11179 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
11180 return -EINVAL;
11181
11182 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
11183 return cfg80211_start_background_radar_detection(rdev, wdev,
11184 &chandef);
11185
11186 if (cfg80211_beaconing_iface_active(wdev)) {
11187 /* During MLO other link(s) can beacon, only the current link
11188 * can not already beacon
11189 */
11190 if (wdev->valid_links &&
11191 !wdev->links[link_id].ap.beacon_interval) {
11192 /* nothing */
11193 } else {
11194 return -EBUSY;
11195 }
11196 }
11197
11198 if (wdev->links[link_id].cac_started)
11199 return -EBUSY;
11200
11201 /* CAC start is offloaded to HW and can't be started manually */
11202 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
11203 return -EOPNOTSUPP;
11204
11205 if (!rdev->ops->start_radar_detection)
11206 return -EOPNOTSUPP;
11207
11208 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
11209 if (WARN_ON(!cac_time_ms))
11210 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
11211
11212 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
11213 link_id);
11214 if (err)
11215 return err;
11216
11217 switch (wdev->iftype) {
11218 case NL80211_IFTYPE_AP:
11219 case NL80211_IFTYPE_P2P_GO:
11220 wdev->links[link_id].ap.chandef = chandef;
11221 break;
11222 case NL80211_IFTYPE_ADHOC:
11223 wdev->u.ibss.chandef = chandef;
11224 break;
11225 case NL80211_IFTYPE_MESH_POINT:
11226 wdev->u.mesh.chandef = chandef;
11227 break;
11228 default:
11229 break;
11230 }
11231 wdev->links[link_id].cac_started = true;
11232 wdev->links[link_id].cac_start_time = jiffies;
11233 wdev->links[link_id].cac_time_ms = cac_time_ms;
11234
11235 return 0;
11236 }
11237
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)11238 static int nl80211_notify_radar_detection(struct sk_buff *skb,
11239 struct genl_info *info)
11240 {
11241 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11242 struct net_device *dev = info->user_ptr[1];
11243 struct wireless_dev *wdev = dev->ieee80211_ptr;
11244 struct wiphy *wiphy = wdev->wiphy;
11245 struct cfg80211_chan_def chandef;
11246 enum nl80211_dfs_regions dfs_region;
11247 int err;
11248
11249 dfs_region = reg_get_dfs_region(wiphy);
11250 if (dfs_region == NL80211_DFS_UNSET) {
11251 GENL_SET_ERR_MSG(info,
11252 "DFS Region is not set. Unexpected Radar indication");
11253 return -EINVAL;
11254 }
11255
11256 err = nl80211_parse_chandef(rdev, info, &chandef);
11257 if (err) {
11258 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
11259 return err;
11260 }
11261
11262 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11263 if (err < 0) {
11264 GENL_SET_ERR_MSG(info, "chandef is invalid");
11265 return err;
11266 }
11267
11268 if (err == 0) {
11269 GENL_SET_ERR_MSG(info,
11270 "Unexpected Radar indication for chandef/iftype");
11271 return -EINVAL;
11272 }
11273
11274 /* Do not process this notification if radar is already detected
11275 * by kernel on this channel, and return success.
11276 */
11277 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
11278 return 0;
11279
11280 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
11281
11282 cfg80211_sched_dfs_chan_update(rdev);
11283
11284 rdev->radar_chandef = chandef;
11285
11286 /* Propagate this notification to other radios as well */
11287 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
11288
11289 return 0;
11290 }
11291
nl80211_parse_counter_offsets(struct cfg80211_registered_device * rdev,const u8 * data,size_t datalen,int first_count,struct nlattr * attr,const u16 ** offsets,unsigned int * n_offsets)11292 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
11293 const u8 *data, size_t datalen,
11294 int first_count, struct nlattr *attr,
11295 const u16 **offsets, unsigned int *n_offsets)
11296 {
11297 int i;
11298
11299 *n_offsets = 0;
11300
11301 if (!attr)
11302 return 0;
11303
11304 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
11305 return -EINVAL;
11306
11307 *n_offsets = nla_len(attr) / sizeof(u16);
11308 if (rdev->wiphy.max_num_csa_counters &&
11309 (*n_offsets > rdev->wiphy.max_num_csa_counters))
11310 return -EINVAL;
11311
11312 *offsets = nla_data(attr);
11313
11314 /* sanity checks - counters should fit and be the same */
11315 for (i = 0; i < *n_offsets; i++) {
11316 u16 offset = (*offsets)[i];
11317
11318 if (offset >= datalen)
11319 return -EINVAL;
11320
11321 if (first_count != -1 && data[offset] != first_count)
11322 return -EINVAL;
11323 }
11324
11325 return 0;
11326 }
11327
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)11328 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
11329 {
11330 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11331 unsigned int link_id = nl80211_link_id(info->attrs);
11332 struct net_device *dev = info->user_ptr[1];
11333 struct wireless_dev *wdev = dev->ieee80211_ptr;
11334 struct cfg80211_csa_settings params;
11335 struct nlattr **csa_attrs = NULL;
11336 int err;
11337 bool need_new_beacon = false;
11338 bool need_handle_dfs_flag = true;
11339 u32 cs_count;
11340
11341 if (!rdev->ops->channel_switch ||
11342 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
11343 return -EOPNOTSUPP;
11344
11345 switch (dev->ieee80211_ptr->iftype) {
11346 case NL80211_IFTYPE_AP:
11347 case NL80211_IFTYPE_P2P_GO:
11348 need_new_beacon = true;
11349 /* For all modes except AP the handle_dfs flag needs to be
11350 * supplied to tell the kernel that userspace will handle radar
11351 * events when they happen. Otherwise a switch to a channel
11352 * requiring DFS will be rejected.
11353 */
11354 need_handle_dfs_flag = false;
11355
11356 /* useless if AP is not running */
11357 if (!wdev->links[link_id].ap.beacon_interval)
11358 return -ENOTCONN;
11359 break;
11360 case NL80211_IFTYPE_ADHOC:
11361 if (!wdev->u.ibss.ssid_len)
11362 return -ENOTCONN;
11363 break;
11364 case NL80211_IFTYPE_MESH_POINT:
11365 if (!wdev->u.mesh.id_len)
11366 return -ENOTCONN;
11367 break;
11368 default:
11369 return -EOPNOTSUPP;
11370 }
11371
11372 memset(¶ms, 0, sizeof(params));
11373 params.beacon_csa.ftm_responder = -1;
11374
11375 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11376 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
11377 return -EINVAL;
11378
11379 /* only important for AP, IBSS and mesh create IEs internally */
11380 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
11381 return -EINVAL;
11382
11383 /* Even though the attribute is u32, the specification says
11384 * u8, so let's make sure we don't overflow.
11385 */
11386 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
11387 if (cs_count > 255)
11388 return -EINVAL;
11389
11390 params.count = cs_count;
11391
11392 if (!need_new_beacon)
11393 goto skip_beacons;
11394
11395 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
11396 info->extack);
11397 if (err)
11398 goto free;
11399
11400 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
11401 GFP_KERNEL);
11402 if (!csa_attrs) {
11403 err = -ENOMEM;
11404 goto free;
11405 }
11406
11407 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
11408 info->attrs[NL80211_ATTR_CSA_IES],
11409 nl80211_policy, info->extack);
11410 if (err)
11411 goto free;
11412
11413 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
11414 info->extack);
11415 if (err)
11416 goto free;
11417
11418 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
11419 err = -EINVAL;
11420 goto free;
11421 }
11422
11423 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
11424 params.beacon_csa.tail_len,
11425 params.count,
11426 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
11427 ¶ms.counter_offsets_beacon,
11428 ¶ms.n_counter_offsets_beacon);
11429 if (err)
11430 goto free;
11431
11432 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
11433 params.beacon_csa.probe_resp_len,
11434 params.count,
11435 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
11436 ¶ms.counter_offsets_presp,
11437 ¶ms.n_counter_offsets_presp);
11438 if (err)
11439 goto free;
11440
11441 skip_beacons:
11442 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
11443 if (err)
11444 goto free;
11445
11446 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
11447 wdev->iftype)) {
11448 err = -EINVAL;
11449 goto free;
11450 }
11451
11452 err = cfg80211_chandef_dfs_required(wdev->wiphy,
11453 ¶ms.chandef,
11454 wdev->iftype);
11455 if (err < 0)
11456 goto free;
11457
11458 if (err > 0) {
11459 params.radar_required = true;
11460 if (need_handle_dfs_flag &&
11461 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
11462 err = -EINVAL;
11463 goto free;
11464 }
11465 }
11466
11467 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
11468 params.block_tx = true;
11469
11470 if ((wdev->iftype == NL80211_IFTYPE_AP ||
11471 wdev->iftype == NL80211_IFTYPE_P2P_GO) &&
11472 info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
11473 err = nl80211_parse_unsol_bcast_probe_resp(
11474 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
11475 ¶ms.unsol_bcast_probe_resp);
11476 if (err)
11477 goto free;
11478 }
11479
11480 params.link_id = link_id;
11481 err = rdev_channel_switch(rdev, dev, ¶ms);
11482
11483 free:
11484 kfree(params.beacon_after.mbssid_ies);
11485 kfree(params.beacon_csa.mbssid_ies);
11486 kfree(params.beacon_after.rnr_ies);
11487 kfree(params.beacon_csa.rnr_ies);
11488 kfree(csa_attrs);
11489 return err;
11490 }
11491
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)11492 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
11493 u32 seq, int flags,
11494 struct cfg80211_registered_device *rdev,
11495 struct wireless_dev *wdev,
11496 struct cfg80211_internal_bss *intbss)
11497 {
11498 struct cfg80211_bss *res = &intbss->pub;
11499 const struct cfg80211_bss_ies *ies;
11500 unsigned int link_id;
11501 void *hdr;
11502 struct nlattr *bss;
11503
11504 lockdep_assert_wiphy(wdev->wiphy);
11505
11506 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
11507 NL80211_CMD_NEW_SCAN_RESULTS);
11508 if (!hdr)
11509 return -1;
11510
11511 genl_dump_check_consistent(cb, hdr);
11512
11513 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
11514 goto nla_put_failure;
11515 if (wdev->netdev &&
11516 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
11517 goto nla_put_failure;
11518 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11519 NL80211_ATTR_PAD))
11520 goto nla_put_failure;
11521
11522 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
11523 if (!bss)
11524 goto nla_put_failure;
11525 if ((!is_zero_ether_addr(res->bssid) &&
11526 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
11527 goto nla_put_failure;
11528
11529 rcu_read_lock();
11530 /* indicate whether we have probe response data or not */
11531 if (rcu_access_pointer(res->proberesp_ies) &&
11532 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
11533 goto fail_unlock_rcu;
11534
11535 /* this pointer prefers to be pointed to probe response data
11536 * but is always valid
11537 */
11538 ies = rcu_dereference(res->ies);
11539 if (ies) {
11540 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
11541 NL80211_BSS_PAD))
11542 goto fail_unlock_rcu;
11543 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
11544 ies->len, ies->data))
11545 goto fail_unlock_rcu;
11546 }
11547
11548 /* and this pointer is always (unless driver didn't know) beacon data */
11549 ies = rcu_dereference(res->beacon_ies);
11550 if (ies && ies->from_beacon) {
11551 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
11552 NL80211_BSS_PAD))
11553 goto fail_unlock_rcu;
11554 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
11555 ies->len, ies->data))
11556 goto fail_unlock_rcu;
11557 }
11558 rcu_read_unlock();
11559
11560 if (res->beacon_interval &&
11561 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
11562 goto nla_put_failure;
11563 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
11564 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
11565 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
11566 res->channel->freq_offset) ||
11567 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
11568 jiffies_to_msecs(jiffies - intbss->ts)))
11569 goto nla_put_failure;
11570
11571 if (intbss->parent_tsf &&
11572 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
11573 intbss->parent_tsf, NL80211_BSS_PAD) ||
11574 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
11575 intbss->parent_bssid)))
11576 goto nla_put_failure;
11577
11578 if (res->ts_boottime &&
11579 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
11580 res->ts_boottime, NL80211_BSS_PAD))
11581 goto nla_put_failure;
11582
11583 if (!nl80211_put_signal(msg, intbss->pub.chains,
11584 intbss->pub.chain_signal,
11585 NL80211_BSS_CHAIN_SIGNAL))
11586 goto nla_put_failure;
11587
11588 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
11589 switch (rdev->wiphy.signal_type) {
11590 case CFG80211_SIGNAL_TYPE_MBM:
11591 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
11592 res->signal))
11593 goto nla_put_failure;
11594 break;
11595 case CFG80211_SIGNAL_TYPE_UNSPEC:
11596 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
11597 res->signal))
11598 goto nla_put_failure;
11599 break;
11600 default:
11601 break;
11602 }
11603 }
11604
11605 switch (wdev->iftype) {
11606 case NL80211_IFTYPE_P2P_CLIENT:
11607 case NL80211_IFTYPE_STATION:
11608 for_each_valid_link(wdev, link_id) {
11609 if (intbss == wdev->links[link_id].client.current_bss &&
11610 (nla_put_u32(msg, NL80211_BSS_STATUS,
11611 NL80211_BSS_STATUS_ASSOCIATED) ||
11612 (wdev->valid_links &&
11613 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
11614 link_id) ||
11615 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
11616 wdev->u.client.connected_addr)))))
11617 goto nla_put_failure;
11618 }
11619 break;
11620 case NL80211_IFTYPE_ADHOC:
11621 if (intbss == wdev->u.ibss.current_bss &&
11622 nla_put_u32(msg, NL80211_BSS_STATUS,
11623 NL80211_BSS_STATUS_IBSS_JOINED))
11624 goto nla_put_failure;
11625 break;
11626 default:
11627 break;
11628 }
11629
11630 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
11631 goto nla_put_failure;
11632
11633 if (res->cannot_use_reasons &&
11634 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
11635 res->cannot_use_reasons,
11636 NL80211_BSS_PAD))
11637 goto nla_put_failure;
11638
11639 nla_nest_end(msg, bss);
11640
11641 genlmsg_end(msg, hdr);
11642 return 0;
11643
11644 fail_unlock_rcu:
11645 rcu_read_unlock();
11646 nla_put_failure:
11647 genlmsg_cancel(msg, hdr);
11648 return -EMSGSIZE;
11649 }
11650
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)11651 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
11652 {
11653 struct cfg80211_registered_device *rdev;
11654 struct cfg80211_internal_bss *scan;
11655 struct wireless_dev *wdev;
11656 struct nlattr **attrbuf;
11657 int start = cb->args[2], idx = 0;
11658 bool dump_include_use_data;
11659 int err;
11660
11661 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11662 if (!attrbuf)
11663 return -ENOMEM;
11664
11665 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11666 if (err) {
11667 kfree(attrbuf);
11668 return err;
11669 }
11670 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11671 __acquire(&rdev->wiphy.mtx);
11672
11673 dump_include_use_data =
11674 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
11675 kfree(attrbuf);
11676
11677 spin_lock_bh(&rdev->bss_lock);
11678
11679 /*
11680 * dump_scan will be called multiple times to break up the scan results
11681 * into multiple messages. It is unlikely that any more bss-es will be
11682 * expired after the first call, so only call only call this on the
11683 * first dump_scan invocation.
11684 */
11685 if (start == 0)
11686 cfg80211_bss_expire(rdev);
11687
11688 cb->seq = rdev->bss_generation;
11689
11690 list_for_each_entry(scan, &rdev->bss_list, list) {
11691 if (++idx <= start)
11692 continue;
11693 if (!dump_include_use_data &&
11694 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
11695 continue;
11696 if (nl80211_send_bss(skb, cb,
11697 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11698 rdev, wdev, scan) < 0) {
11699 idx--;
11700 break;
11701 }
11702 }
11703
11704 spin_unlock_bh(&rdev->bss_lock);
11705
11706 cb->args[2] = idx;
11707 wiphy_unlock(&rdev->wiphy);
11708
11709 return skb->len;
11710 }
11711
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)11712 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
11713 int flags, struct net_device *dev,
11714 bool allow_radio_stats,
11715 struct survey_info *survey)
11716 {
11717 void *hdr;
11718 struct nlattr *infoattr;
11719
11720 /* skip radio stats if userspace didn't request them */
11721 if (!survey->channel && !allow_radio_stats)
11722 return 0;
11723
11724 hdr = nl80211hdr_put(msg, portid, seq, flags,
11725 NL80211_CMD_NEW_SURVEY_RESULTS);
11726 if (!hdr)
11727 return -ENOMEM;
11728
11729 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11730 goto nla_put_failure;
11731
11732 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
11733 if (!infoattr)
11734 goto nla_put_failure;
11735
11736 if (survey->channel &&
11737 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
11738 survey->channel->center_freq))
11739 goto nla_put_failure;
11740
11741 if (survey->channel && survey->channel->freq_offset &&
11742 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
11743 survey->channel->freq_offset))
11744 goto nla_put_failure;
11745
11746 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
11747 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
11748 goto nla_put_failure;
11749 if ((survey->filled & SURVEY_INFO_IN_USE) &&
11750 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
11751 goto nla_put_failure;
11752 if ((survey->filled & SURVEY_INFO_TIME) &&
11753 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
11754 survey->time, NL80211_SURVEY_INFO_PAD))
11755 goto nla_put_failure;
11756 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
11757 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
11758 survey->time_busy, NL80211_SURVEY_INFO_PAD))
11759 goto nla_put_failure;
11760 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
11761 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
11762 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
11763 goto nla_put_failure;
11764 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
11765 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
11766 survey->time_rx, NL80211_SURVEY_INFO_PAD))
11767 goto nla_put_failure;
11768 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
11769 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
11770 survey->time_tx, NL80211_SURVEY_INFO_PAD))
11771 goto nla_put_failure;
11772 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
11773 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
11774 survey->time_scan, NL80211_SURVEY_INFO_PAD))
11775 goto nla_put_failure;
11776 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
11777 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
11778 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
11779 goto nla_put_failure;
11780
11781 nla_nest_end(msg, infoattr);
11782
11783 genlmsg_end(msg, hdr);
11784 return 0;
11785
11786 nla_put_failure:
11787 genlmsg_cancel(msg, hdr);
11788 return -EMSGSIZE;
11789 }
11790
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)11791 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
11792 {
11793 struct nlattr **attrbuf;
11794 struct survey_info survey;
11795 struct cfg80211_registered_device *rdev;
11796 struct wireless_dev *wdev;
11797 int survey_idx = cb->args[2];
11798 int res;
11799 bool radio_stats;
11800
11801 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11802 if (!attrbuf)
11803 return -ENOMEM;
11804
11805 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11806 if (res) {
11807 kfree(attrbuf);
11808 return res;
11809 }
11810 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11811 __acquire(&rdev->wiphy.mtx);
11812
11813 /* prepare_wdev_dump parsed the attributes */
11814 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
11815
11816 if (!wdev->netdev) {
11817 res = -EINVAL;
11818 goto out_err;
11819 }
11820
11821 if (!rdev->ops->dump_survey) {
11822 res = -EOPNOTSUPP;
11823 goto out_err;
11824 }
11825
11826 while (1) {
11827 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
11828 if (res == -ENOENT)
11829 break;
11830 if (res)
11831 goto out_err;
11832
11833 /* don't send disabled channels, but do send non-channel data */
11834 if (survey.channel &&
11835 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
11836 survey_idx++;
11837 continue;
11838 }
11839
11840 if (nl80211_send_survey(skb,
11841 NETLINK_CB(cb->skb).portid,
11842 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11843 wdev->netdev, radio_stats, &survey) < 0)
11844 goto out;
11845 survey_idx++;
11846 }
11847
11848 out:
11849 cb->args[2] = survey_idx;
11850 res = skb->len;
11851 out_err:
11852 kfree(attrbuf);
11853 wiphy_unlock(&rdev->wiphy);
11854 return res;
11855 }
11856
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)11857 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
11858 {
11859 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11860 struct net_device *dev = info->user_ptr[1];
11861 struct ieee80211_channel *chan;
11862 const u8 *bssid, *ssid;
11863 int err, ssid_len;
11864 enum nl80211_auth_type auth_type;
11865 struct key_parse key;
11866 bool local_state_change;
11867 struct cfg80211_auth_request req = {};
11868 u32 freq;
11869
11870 if (!info->attrs[NL80211_ATTR_MAC])
11871 return -EINVAL;
11872
11873 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
11874 return -EINVAL;
11875
11876 if (!info->attrs[NL80211_ATTR_SSID])
11877 return -EINVAL;
11878
11879 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11880 return -EINVAL;
11881
11882 err = nl80211_parse_key(info, &key);
11883 if (err)
11884 return err;
11885
11886 if (key.idx >= 0) {
11887 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
11888 return -EINVAL;
11889 if (!key.p.key || !key.p.key_len)
11890 return -EINVAL;
11891 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
11892 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
11893 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
11894 key.p.key_len != WLAN_KEY_LEN_WEP104))
11895 return -EINVAL;
11896 if (key.idx > 3)
11897 return -EINVAL;
11898 } else {
11899 key.p.key_len = 0;
11900 key.p.key = NULL;
11901 }
11902
11903 if (key.idx >= 0) {
11904 int i;
11905 bool ok = false;
11906
11907 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
11908 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
11909 ok = true;
11910 break;
11911 }
11912 }
11913 if (!ok)
11914 return -EINVAL;
11915 }
11916
11917 if (!rdev->ops->auth)
11918 return -EOPNOTSUPP;
11919
11920 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11921 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11922 return -EOPNOTSUPP;
11923
11924 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11925 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11926 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11927 freq +=
11928 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11929
11930 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11931 if (!chan)
11932 return -EINVAL;
11933
11934 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11935 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11936
11937 if (info->attrs[NL80211_ATTR_IE]) {
11938 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11939 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11940 }
11941
11942 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11943 req.supported_selectors =
11944 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11945 req.supported_selectors_len =
11946 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11947 }
11948
11949 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11950 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
11951 return -EINVAL;
11952
11953 if ((auth_type == NL80211_AUTHTYPE_SAE ||
11954 auth_type == NL80211_AUTHTYPE_FILS_SK ||
11955 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
11956 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
11957 !info->attrs[NL80211_ATTR_AUTH_DATA])
11958 return -EINVAL;
11959
11960 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
11961 if (auth_type != NL80211_AUTHTYPE_SAE &&
11962 auth_type != NL80211_AUTHTYPE_FILS_SK &&
11963 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
11964 auth_type != NL80211_AUTHTYPE_FILS_PK)
11965 return -EINVAL;
11966 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
11967 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
11968 }
11969
11970 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11971
11972 /*
11973 * Since we no longer track auth state, ignore
11974 * requests to only change local state.
11975 */
11976 if (local_state_change)
11977 return 0;
11978
11979 req.auth_type = auth_type;
11980 req.key = key.p.key;
11981 req.key_len = key.p.key_len;
11982 req.key_idx = key.idx;
11983 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11984 if (req.link_id >= 0) {
11985 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11986 return -EINVAL;
11987 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
11988 return -EINVAL;
11989 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11990 if (!is_valid_ether_addr(req.ap_mld_addr))
11991 return -EINVAL;
11992 }
11993
11994 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
11995 IEEE80211_BSS_TYPE_ESS,
11996 IEEE80211_PRIVACY_ANY);
11997 if (!req.bss)
11998 return -ENOENT;
11999
12000 err = cfg80211_mlme_auth(rdev, dev, &req);
12001
12002 cfg80211_put_bss(&rdev->wiphy, req.bss);
12003
12004 return err;
12005 }
12006
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)12007 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
12008 struct genl_info *info)
12009 {
12010 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12011 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
12012 return -EINVAL;
12013 }
12014
12015 if (!rdev->ops->tx_control_port ||
12016 !wiphy_ext_feature_isset(&rdev->wiphy,
12017 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12018 return -EOPNOTSUPP;
12019
12020 return 0;
12021 }
12022
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)12023 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
12024 struct genl_info *info,
12025 struct cfg80211_crypto_settings *settings,
12026 int cipher_limit)
12027 {
12028 memset(settings, 0, sizeof(*settings));
12029
12030 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
12031
12032 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12033 u16 proto;
12034
12035 proto = nla_get_u16(
12036 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12037 settings->control_port_ethertype = cpu_to_be16(proto);
12038 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
12039 proto != ETH_P_PAE)
12040 return -EINVAL;
12041 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
12042 settings->control_port_no_encrypt = true;
12043 } else
12044 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
12045
12046 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12047 int r = validate_pae_over_nl80211(rdev, info);
12048
12049 if (r < 0)
12050 return r;
12051
12052 settings->control_port_over_nl80211 = true;
12053
12054 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
12055 settings->control_port_no_preauth = true;
12056 }
12057
12058 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
12059 void *data;
12060 int len, i;
12061
12062 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12063 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12064 settings->n_ciphers_pairwise = len / sizeof(u32);
12065
12066 if (len % sizeof(u32))
12067 return -EINVAL;
12068
12069 if (settings->n_ciphers_pairwise > cipher_limit)
12070 return -EINVAL;
12071
12072 memcpy(settings->ciphers_pairwise, data, len);
12073
12074 for (i = 0; i < settings->n_ciphers_pairwise; i++)
12075 if (!cfg80211_supported_cipher_suite(
12076 &rdev->wiphy,
12077 settings->ciphers_pairwise[i]))
12078 return -EINVAL;
12079 }
12080
12081 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
12082 settings->cipher_group =
12083 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
12084 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
12085 settings->cipher_group))
12086 return -EINVAL;
12087 }
12088
12089 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
12090 settings->wpa_versions =
12091 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
12092
12093 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
12094 void *data;
12095 int len;
12096
12097 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
12098 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
12099 settings->n_akm_suites = len / sizeof(u32);
12100
12101 if (len % sizeof(u32))
12102 return -EINVAL;
12103
12104 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
12105 return -EINVAL;
12106
12107 memcpy(settings->akm_suites, data, len);
12108 }
12109
12110 if (info->attrs[NL80211_ATTR_PMK]) {
12111 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
12112 return -EINVAL;
12113 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12114 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
12115 !wiphy_ext_feature_isset(&rdev->wiphy,
12116 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
12117 return -EINVAL;
12118 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12119 }
12120
12121 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
12122 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12123 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
12124 !wiphy_ext_feature_isset(&rdev->wiphy,
12125 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
12126 return -EINVAL;
12127 settings->sae_pwd =
12128 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12129 settings->sae_pwd_len =
12130 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12131 }
12132
12133 settings->sae_pwe =
12134 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
12135 NL80211_SAE_PWE_UNSPECIFIED);
12136
12137 return 0;
12138 }
12139
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs,int assoc_link_id,int link_id)12140 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
12141 const u8 *ssid, int ssid_len,
12142 struct nlattr **attrs,
12143 int assoc_link_id, int link_id)
12144 {
12145 struct ieee80211_channel *chan;
12146 struct cfg80211_bss *bss;
12147 const u8 *bssid;
12148 u32 freq, use_for = 0;
12149
12150 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
12151 return ERR_PTR(-EINVAL);
12152
12153 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
12154
12155 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
12156 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12157 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12158
12159 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
12160 if (!chan)
12161 return ERR_PTR(-EINVAL);
12162
12163 if (assoc_link_id >= 0)
12164 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
12165 if (assoc_link_id == link_id)
12166 use_for |= NL80211_BSS_USE_FOR_NORMAL;
12167
12168 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
12169 ssid, ssid_len,
12170 IEEE80211_BSS_TYPE_ESS,
12171 IEEE80211_PRIVACY_ANY,
12172 use_for);
12173 if (!bss)
12174 return ERR_PTR(-ENOENT);
12175
12176 return bss;
12177 }
12178
nl80211_process_links(struct cfg80211_registered_device * rdev,struct cfg80211_assoc_link * links,int assoc_link_id,const u8 * ssid,int ssid_len,struct genl_info * info)12179 static int nl80211_process_links(struct cfg80211_registered_device *rdev,
12180 struct cfg80211_assoc_link *links,
12181 int assoc_link_id,
12182 const u8 *ssid, int ssid_len,
12183 struct genl_info *info)
12184 {
12185 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
12186 struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
12187 struct nlattr *link;
12188 unsigned int link_id;
12189 int rem, err;
12190
12191 if (!attrs)
12192 return -ENOMEM;
12193
12194 nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
12195 memset(attrs, 0, attrsize);
12196
12197 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
12198
12199 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
12200 NL_SET_BAD_ATTR(info->extack, link);
12201 return -EINVAL;
12202 }
12203
12204 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
12205 /* cannot use the same link ID again */
12206 if (links[link_id].bss) {
12207 NL_SET_BAD_ATTR(info->extack, link);
12208 return -EINVAL;
12209 }
12210 links[link_id].bss =
12211 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
12212 assoc_link_id, link_id);
12213 if (IS_ERR(links[link_id].bss)) {
12214 err = PTR_ERR(links[link_id].bss);
12215 links[link_id].bss = NULL;
12216 NL_SET_ERR_MSG_ATTR(info->extack, link,
12217 "Error fetching BSS for link");
12218 return err;
12219 }
12220
12221 if (attrs[NL80211_ATTR_IE]) {
12222 links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
12223 links[link_id].elems_len =
12224 nla_len(attrs[NL80211_ATTR_IE]);
12225
12226 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
12227 links[link_id].elems,
12228 links[link_id].elems_len)) {
12229 NL_SET_ERR_MSG_ATTR(info->extack,
12230 attrs[NL80211_ATTR_IE],
12231 "cannot deal with fragmentation");
12232 return -EINVAL;
12233 }
12234
12235 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12236 links[link_id].elems,
12237 links[link_id].elems_len)) {
12238 NL_SET_ERR_MSG_ATTR(info->extack,
12239 attrs[NL80211_ATTR_IE],
12240 "cannot deal with non-inheritance");
12241 return -EINVAL;
12242 }
12243 }
12244
12245 links[link_id].disabled =
12246 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
12247 }
12248
12249 return 0;
12250 }
12251
nl80211_associate(struct sk_buff * skb,struct genl_info * info)12252 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
12253 {
12254 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12255 struct net_device *dev = info->user_ptr[1];
12256 struct cfg80211_assoc_request req = {};
12257 const u8 *ap_addr, *ssid;
12258 unsigned int link_id;
12259 int err, ssid_len;
12260
12261 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12262 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12263 return -EPERM;
12264
12265 if (!info->attrs[NL80211_ATTR_SSID])
12266 return -EINVAL;
12267
12268 if (!rdev->ops->assoc)
12269 return -EOPNOTSUPP;
12270
12271 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12272 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12273 return -EOPNOTSUPP;
12274
12275 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12276 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12277
12278 if (info->attrs[NL80211_ATTR_IE]) {
12279 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12280 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12281
12282 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12283 req.ie, req.ie_len)) {
12284 NL_SET_ERR_MSG_ATTR(info->extack,
12285 info->attrs[NL80211_ATTR_IE],
12286 "non-inheritance makes no sense");
12287 return -EINVAL;
12288 }
12289 }
12290
12291 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12292 enum nl80211_mfp mfp =
12293 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12294 if (mfp == NL80211_MFP_REQUIRED)
12295 req.use_mfp = true;
12296 else if (mfp != NL80211_MFP_NO)
12297 return -EINVAL;
12298 }
12299
12300 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12301 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12302
12303 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
12304 req.supported_selectors =
12305 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12306 req.supported_selectors_len =
12307 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12308 }
12309
12310 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12311 req.flags |= ASSOC_REQ_DISABLE_HT;
12312
12313 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12314 memcpy(&req.ht_capa_mask,
12315 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12316 sizeof(req.ht_capa_mask));
12317
12318 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12319 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12320 return -EINVAL;
12321 memcpy(&req.ht_capa,
12322 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12323 sizeof(req.ht_capa));
12324 }
12325
12326 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12327 req.flags |= ASSOC_REQ_DISABLE_VHT;
12328
12329 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12330 req.flags |= ASSOC_REQ_DISABLE_HE;
12331
12332 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12333 req.flags |= ASSOC_REQ_DISABLE_EHT;
12334
12335 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12336 memcpy(&req.vht_capa_mask,
12337 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12338 sizeof(req.vht_capa_mask));
12339
12340 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12341 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12342 return -EINVAL;
12343 memcpy(&req.vht_capa,
12344 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12345 sizeof(req.vht_capa));
12346 }
12347
12348 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12349 if (!((rdev->wiphy.features &
12350 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12351 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12352 !wiphy_ext_feature_isset(&rdev->wiphy,
12353 NL80211_EXT_FEATURE_RRM))
12354 return -EINVAL;
12355 req.flags |= ASSOC_REQ_USE_RRM;
12356 }
12357
12358 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
12359 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
12360 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
12361 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
12362 return -EINVAL;
12363 req.fils_nonces =
12364 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
12365 }
12366
12367 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
12368 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
12369 return -EINVAL;
12370 memcpy(&req.s1g_capa_mask,
12371 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
12372 sizeof(req.s1g_capa_mask));
12373 }
12374
12375 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
12376 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
12377 return -EINVAL;
12378 memcpy(&req.s1g_capa,
12379 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
12380 sizeof(req.s1g_capa));
12381 }
12382
12383 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
12384 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12385 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
12386 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
12387 return -EINVAL;
12388 }
12389 req.flags |= ASSOC_REQ_SPP_AMSDU;
12390 }
12391
12392 req.link_id = nl80211_link_id_or_invalid(info->attrs);
12393
12394 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12395 if (req.link_id < 0)
12396 return -EINVAL;
12397
12398 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
12399 return -EINVAL;
12400
12401 if (info->attrs[NL80211_ATTR_MAC] ||
12402 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12403 !info->attrs[NL80211_ATTR_MLD_ADDR])
12404 return -EINVAL;
12405
12406 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
12407 ap_addr = req.ap_mld_addr;
12408
12409 err = nl80211_process_links(rdev, req.links, req.link_id,
12410 ssid, ssid_len, info);
12411 if (err)
12412 goto free;
12413
12414 if (!req.links[req.link_id].bss) {
12415 err = -EINVAL;
12416 goto free;
12417 }
12418
12419 if (req.links[req.link_id].elems_len) {
12420 GENL_SET_ERR_MSG(info,
12421 "cannot have per-link elems on assoc link");
12422 err = -EINVAL;
12423 goto free;
12424 }
12425
12426 if (req.links[req.link_id].disabled) {
12427 GENL_SET_ERR_MSG(info,
12428 "cannot have assoc link disabled");
12429 err = -EINVAL;
12430 goto free;
12431 }
12432
12433 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12434 req.ext_mld_capa_ops =
12435 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
12436 } else {
12437 if (req.link_id >= 0)
12438 return -EINVAL;
12439
12440 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
12441 -1, -1);
12442 if (IS_ERR(req.bss))
12443 return PTR_ERR(req.bss);
12444 ap_addr = req.bss->bssid;
12445
12446 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12447 return -EINVAL;
12448 }
12449
12450 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
12451 if (!err) {
12452 struct nlattr *link;
12453 int rem = 0;
12454
12455 err = cfg80211_mlme_assoc(rdev, dev, &req,
12456 info->extack);
12457
12458 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12459 dev->ieee80211_ptr->conn_owner_nlportid =
12460 info->snd_portid;
12461 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12462 ap_addr, ETH_ALEN);
12463 }
12464
12465 /* Report error from first problematic link */
12466 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12467 nla_for_each_nested(link,
12468 info->attrs[NL80211_ATTR_MLO_LINKS],
12469 rem) {
12470 struct nlattr *link_id_attr =
12471 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
12472
12473 if (!link_id_attr)
12474 continue;
12475
12476 link_id = nla_get_u8(link_id_attr);
12477
12478 if (link_id == req.link_id)
12479 continue;
12480
12481 if (!req.links[link_id].error ||
12482 WARN_ON(req.links[link_id].error > 0))
12483 continue;
12484
12485 WARN_ON(err >= 0);
12486
12487 NL_SET_BAD_ATTR(info->extack, link);
12488 err = req.links[link_id].error;
12489 break;
12490 }
12491 }
12492 }
12493
12494 free:
12495 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
12496 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
12497 cfg80211_put_bss(&rdev->wiphy, req.bss);
12498
12499 return err;
12500 }
12501
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)12502 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
12503 {
12504 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12505 struct net_device *dev = info->user_ptr[1];
12506 const u8 *ie = NULL, *bssid;
12507 int ie_len = 0;
12508 u16 reason_code;
12509 bool local_state_change;
12510
12511 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12512 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12513 return -EPERM;
12514
12515 if (!info->attrs[NL80211_ATTR_MAC])
12516 return -EINVAL;
12517
12518 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12519 return -EINVAL;
12520
12521 if (!rdev->ops->deauth)
12522 return -EOPNOTSUPP;
12523
12524 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12525 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12526 return -EOPNOTSUPP;
12527
12528 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12529
12530 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12531 if (reason_code == 0) {
12532 /* Reason Code 0 is reserved */
12533 return -EINVAL;
12534 }
12535
12536 if (info->attrs[NL80211_ATTR_IE]) {
12537 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12538 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12539 }
12540
12541 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12542
12543 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
12544 local_state_change);
12545 }
12546
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)12547 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
12548 {
12549 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12550 struct net_device *dev = info->user_ptr[1];
12551 const u8 *ie = NULL, *bssid;
12552 int ie_len = 0;
12553 u16 reason_code;
12554 bool local_state_change;
12555
12556 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12557 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12558 return -EPERM;
12559
12560 if (!info->attrs[NL80211_ATTR_MAC])
12561 return -EINVAL;
12562
12563 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12564 return -EINVAL;
12565
12566 if (!rdev->ops->disassoc)
12567 return -EOPNOTSUPP;
12568
12569 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12570 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12571 return -EOPNOTSUPP;
12572
12573 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12574
12575 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12576 if (reason_code == 0) {
12577 /* Reason Code 0 is reserved */
12578 return -EINVAL;
12579 }
12580
12581 if (info->attrs[NL80211_ATTR_IE]) {
12582 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12583 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12584 }
12585
12586 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12587
12588 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
12589 local_state_change);
12590 }
12591
12592 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)12593 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
12594 int mcast_rate[NUM_NL80211_BANDS],
12595 int rateval)
12596 {
12597 struct wiphy *wiphy = &rdev->wiphy;
12598 bool found = false;
12599 int band, i;
12600
12601 for (band = 0; band < NUM_NL80211_BANDS; band++) {
12602 struct ieee80211_supported_band *sband;
12603
12604 sband = wiphy->bands[band];
12605 if (!sband)
12606 continue;
12607
12608 for (i = 0; i < sband->n_bitrates; i++) {
12609 if (sband->bitrates[i].bitrate == rateval) {
12610 mcast_rate[band] = i + 1;
12611 found = true;
12612 break;
12613 }
12614 }
12615 }
12616
12617 return found;
12618 }
12619
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)12620 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
12621 {
12622 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12623 struct net_device *dev = info->user_ptr[1];
12624 struct cfg80211_ibss_params ibss;
12625 struct wiphy *wiphy;
12626 struct cfg80211_cached_keys *connkeys = NULL;
12627 int err;
12628
12629 memset(&ibss, 0, sizeof(ibss));
12630
12631 if (!info->attrs[NL80211_ATTR_SSID] ||
12632 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12633 return -EINVAL;
12634
12635 ibss.beacon_interval = 100;
12636
12637 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
12638 ibss.beacon_interval =
12639 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12640
12641 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
12642 ibss.beacon_interval);
12643 if (err)
12644 return err;
12645
12646 if (!rdev->ops->join_ibss)
12647 return -EOPNOTSUPP;
12648
12649 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12650 return -EOPNOTSUPP;
12651
12652 wiphy = &rdev->wiphy;
12653
12654 if (info->attrs[NL80211_ATTR_MAC]) {
12655 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12656
12657 if (!is_valid_ether_addr(ibss.bssid))
12658 return -EINVAL;
12659 }
12660 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12661 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12662
12663 if (info->attrs[NL80211_ATTR_IE]) {
12664 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12665 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12666 }
12667
12668 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
12669 if (err)
12670 return err;
12671
12672 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
12673 NL80211_IFTYPE_ADHOC))
12674 return -EINVAL;
12675
12676 switch (ibss.chandef.width) {
12677 case NL80211_CHAN_WIDTH_5:
12678 case NL80211_CHAN_WIDTH_10:
12679 case NL80211_CHAN_WIDTH_20_NOHT:
12680 break;
12681 case NL80211_CHAN_WIDTH_20:
12682 case NL80211_CHAN_WIDTH_40:
12683 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12684 return -EINVAL;
12685 break;
12686 case NL80211_CHAN_WIDTH_80:
12687 case NL80211_CHAN_WIDTH_80P80:
12688 case NL80211_CHAN_WIDTH_160:
12689 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12690 return -EINVAL;
12691 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12692 NL80211_EXT_FEATURE_VHT_IBSS))
12693 return -EINVAL;
12694 break;
12695 case NL80211_CHAN_WIDTH_320:
12696 return -EINVAL;
12697 default:
12698 return -EINVAL;
12699 }
12700
12701 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
12702 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
12703
12704 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12705 u8 *rates =
12706 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12707 int n_rates =
12708 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12709 struct ieee80211_supported_band *sband =
12710 wiphy->bands[ibss.chandef.chan->band];
12711
12712 err = ieee80211_get_ratemask(sband, rates, n_rates,
12713 &ibss.basic_rates);
12714 if (err)
12715 return err;
12716 }
12717
12718 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12719 memcpy(&ibss.ht_capa_mask,
12720 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12721 sizeof(ibss.ht_capa_mask));
12722
12723 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12724 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12725 return -EINVAL;
12726 memcpy(&ibss.ht_capa,
12727 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12728 sizeof(ibss.ht_capa));
12729 }
12730
12731 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12732 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
12733 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12734 return -EINVAL;
12735
12736 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12737 bool no_ht = false;
12738
12739 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
12740 if (IS_ERR(connkeys))
12741 return PTR_ERR(connkeys);
12742
12743 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
12744 no_ht) {
12745 kfree_sensitive(connkeys);
12746 return -EINVAL;
12747 }
12748 }
12749
12750 ibss.control_port =
12751 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
12752
12753 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12754 int r = validate_pae_over_nl80211(rdev, info);
12755
12756 if (r < 0) {
12757 kfree_sensitive(connkeys);
12758 return r;
12759 }
12760
12761 ibss.control_port_over_nl80211 = true;
12762 }
12763
12764 ibss.userspace_handles_dfs =
12765 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12766
12767 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
12768 if (err)
12769 kfree_sensitive(connkeys);
12770 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
12771 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12772
12773 return err;
12774 }
12775
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)12776 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
12777 {
12778 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12779 struct net_device *dev = info->user_ptr[1];
12780
12781 if (!rdev->ops->leave_ibss)
12782 return -EOPNOTSUPP;
12783
12784 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12785 return -EOPNOTSUPP;
12786
12787 return cfg80211_leave_ibss(rdev, dev, false);
12788 }
12789
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)12790 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
12791 {
12792 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12793 struct net_device *dev = info->user_ptr[1];
12794 int mcast_rate[NUM_NL80211_BANDS];
12795 u32 nla_rate;
12796
12797 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
12798 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
12799 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
12800 return -EOPNOTSUPP;
12801
12802 if (!rdev->ops->set_mcast_rate)
12803 return -EOPNOTSUPP;
12804
12805 memset(mcast_rate, 0, sizeof(mcast_rate));
12806
12807 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
12808 return -EINVAL;
12809
12810 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
12811 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
12812 return -EINVAL;
12813
12814 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
12815 }
12816
12817 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)12818 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
12819 struct wireless_dev *wdev, int approxlen,
12820 u32 portid, u32 seq, enum nl80211_commands cmd,
12821 enum nl80211_attrs attr,
12822 const struct nl80211_vendor_cmd_info *info,
12823 gfp_t gfp)
12824 {
12825 struct sk_buff *skb;
12826 void *hdr;
12827 struct nlattr *data;
12828
12829 skb = nlmsg_new(approxlen + 100, gfp);
12830 if (!skb)
12831 return NULL;
12832
12833 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
12834 if (!hdr) {
12835 kfree_skb(skb);
12836 return NULL;
12837 }
12838
12839 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12840 goto nla_put_failure;
12841
12842 if (info) {
12843 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
12844 info->vendor_id))
12845 goto nla_put_failure;
12846 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
12847 info->subcmd))
12848 goto nla_put_failure;
12849 }
12850
12851 if (wdev) {
12852 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12853 wdev_id(wdev), NL80211_ATTR_PAD))
12854 goto nla_put_failure;
12855 if (wdev->netdev &&
12856 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
12857 wdev->netdev->ifindex))
12858 goto nla_put_failure;
12859 }
12860
12861 data = nla_nest_start_noflag(skb, attr);
12862 if (!data)
12863 goto nla_put_failure;
12864
12865 ((void **)skb->cb)[0] = rdev;
12866 ((void **)skb->cb)[1] = hdr;
12867 ((void **)skb->cb)[2] = data;
12868
12869 return skb;
12870
12871 nla_put_failure:
12872 kfree_skb(skb);
12873 return NULL;
12874 }
12875
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)12876 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
12877 struct wireless_dev *wdev,
12878 enum nl80211_commands cmd,
12879 enum nl80211_attrs attr,
12880 unsigned int portid,
12881 int vendor_event_idx,
12882 int approxlen, gfp_t gfp)
12883 {
12884 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12885 const struct nl80211_vendor_cmd_info *info;
12886
12887 switch (cmd) {
12888 case NL80211_CMD_TESTMODE:
12889 if (WARN_ON(vendor_event_idx != -1))
12890 return NULL;
12891 info = NULL;
12892 break;
12893 case NL80211_CMD_VENDOR:
12894 if (WARN_ON(vendor_event_idx < 0 ||
12895 vendor_event_idx >= wiphy->n_vendor_events))
12896 return NULL;
12897 info = &wiphy->vendor_events[vendor_event_idx];
12898 break;
12899 default:
12900 WARN_ON(1);
12901 return NULL;
12902 }
12903
12904 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
12905 cmd, attr, info, gfp);
12906 }
12907 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
12908
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)12909 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
12910 {
12911 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12912 void *hdr = ((void **)skb->cb)[1];
12913 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
12914 struct nlattr *data = ((void **)skb->cb)[2];
12915 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
12916
12917 /* clear CB data for netlink core to own from now on */
12918 memset(skb->cb, 0, sizeof(skb->cb));
12919
12920 nla_nest_end(skb, data);
12921 genlmsg_end(skb, hdr);
12922
12923 if (nlhdr->nlmsg_pid) {
12924 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
12925 nlhdr->nlmsg_pid);
12926 } else {
12927 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
12928 mcgrp = NL80211_MCGRP_VENDOR;
12929
12930 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12931 skb, 0, mcgrp, gfp);
12932 }
12933 }
12934 EXPORT_SYMBOL(__cfg80211_send_event_skb);
12935
12936 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)12937 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
12938 {
12939 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12940 struct wireless_dev *wdev;
12941 int err;
12942
12943 lockdep_assert_held(&rdev->wiphy.mtx);
12944
12945 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
12946 info->attrs);
12947
12948 if (!rdev->ops->testmode_cmd)
12949 return -EOPNOTSUPP;
12950
12951 if (IS_ERR(wdev)) {
12952 err = PTR_ERR(wdev);
12953 if (err != -EINVAL)
12954 return err;
12955 wdev = NULL;
12956 } else if (wdev->wiphy != &rdev->wiphy) {
12957 return -EINVAL;
12958 }
12959
12960 if (!info->attrs[NL80211_ATTR_TESTDATA])
12961 return -EINVAL;
12962
12963 rdev->cur_cmd_info = info;
12964 err = rdev_testmode_cmd(rdev, wdev,
12965 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
12966 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
12967 rdev->cur_cmd_info = NULL;
12968
12969 return err;
12970 }
12971
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)12972 static int nl80211_testmode_dump(struct sk_buff *skb,
12973 struct netlink_callback *cb)
12974 {
12975 struct cfg80211_registered_device *rdev;
12976 struct nlattr **attrbuf = NULL;
12977 int err;
12978 long phy_idx;
12979 void *data = NULL;
12980 int data_len = 0;
12981
12982 rtnl_lock();
12983
12984 if (cb->args[0]) {
12985 /*
12986 * 0 is a valid index, but not valid for args[0],
12987 * so we need to offset by 1.
12988 */
12989 phy_idx = cb->args[0] - 1;
12990
12991 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
12992 if (!rdev) {
12993 err = -ENOENT;
12994 goto out_err;
12995 }
12996 } else {
12997 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
12998 GFP_KERNEL);
12999 if (!attrbuf) {
13000 err = -ENOMEM;
13001 goto out_err;
13002 }
13003
13004 err = nlmsg_parse_deprecated(cb->nlh,
13005 GENL_HDRLEN + nl80211_fam.hdrsize,
13006 attrbuf, nl80211_fam.maxattr,
13007 nl80211_policy, NULL);
13008 if (err)
13009 goto out_err;
13010
13011 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13012 if (IS_ERR(rdev)) {
13013 err = PTR_ERR(rdev);
13014 goto out_err;
13015 }
13016 phy_idx = rdev->wiphy_idx;
13017
13018 if (attrbuf[NL80211_ATTR_TESTDATA])
13019 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
13020 }
13021
13022 if (cb->args[1]) {
13023 data = nla_data((void *)cb->args[1]);
13024 data_len = nla_len((void *)cb->args[1]);
13025 }
13026
13027 if (!rdev->ops->testmode_dump) {
13028 err = -EOPNOTSUPP;
13029 goto out_err;
13030 }
13031
13032 while (1) {
13033 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13034 cb->nlh->nlmsg_seq, NLM_F_MULTI,
13035 NL80211_CMD_TESTMODE);
13036 struct nlattr *tmdata;
13037
13038 if (!hdr)
13039 break;
13040
13041 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
13042 genlmsg_cancel(skb, hdr);
13043 break;
13044 }
13045
13046 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
13047 if (!tmdata) {
13048 genlmsg_cancel(skb, hdr);
13049 break;
13050 }
13051 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
13052 nla_nest_end(skb, tmdata);
13053
13054 if (err == -ENOBUFS || err == -ENOENT) {
13055 genlmsg_cancel(skb, hdr);
13056 break;
13057 } else if (err) {
13058 genlmsg_cancel(skb, hdr);
13059 goto out_err;
13060 }
13061
13062 genlmsg_end(skb, hdr);
13063 }
13064
13065 err = skb->len;
13066 /* see above */
13067 cb->args[0] = phy_idx + 1;
13068 out_err:
13069 kfree(attrbuf);
13070 rtnl_unlock();
13071 return err;
13072 }
13073 #endif
13074
nl80211_connect(struct sk_buff * skb,struct genl_info * info)13075 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
13076 {
13077 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13078 struct net_device *dev = info->user_ptr[1];
13079 struct cfg80211_connect_params connect;
13080 struct wiphy *wiphy;
13081 struct cfg80211_cached_keys *connkeys = NULL;
13082 u32 freq = 0;
13083 int err;
13084
13085 memset(&connect, 0, sizeof(connect));
13086
13087 if (!info->attrs[NL80211_ATTR_SSID] ||
13088 !nla_len(info->attrs[NL80211_ATTR_SSID]))
13089 return -EINVAL;
13090
13091 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13092 connect.auth_type =
13093 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13094 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
13095 NL80211_CMD_CONNECT))
13096 return -EINVAL;
13097 } else
13098 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
13099
13100 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
13101
13102 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
13103 !wiphy_ext_feature_isset(&rdev->wiphy,
13104 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13105 return -EINVAL;
13106 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
13107
13108 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
13109 NL80211_MAX_NR_CIPHER_SUITES);
13110 if (err)
13111 return err;
13112
13113 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13114 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13115 return -EOPNOTSUPP;
13116
13117 wiphy = &rdev->wiphy;
13118
13119 connect.bg_scan_period = -1;
13120 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
13121 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
13122 connect.bg_scan_period =
13123 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
13124 }
13125
13126 if (info->attrs[NL80211_ATTR_MAC])
13127 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13128 else if (info->attrs[NL80211_ATTR_MAC_HINT])
13129 connect.bssid_hint =
13130 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
13131 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13132 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13133
13134 if (info->attrs[NL80211_ATTR_IE]) {
13135 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13136 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13137 }
13138
13139 if (info->attrs[NL80211_ATTR_USE_MFP]) {
13140 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
13141 if (connect.mfp == NL80211_MFP_OPTIONAL &&
13142 !wiphy_ext_feature_isset(&rdev->wiphy,
13143 NL80211_EXT_FEATURE_MFP_OPTIONAL))
13144 return -EOPNOTSUPP;
13145 } else {
13146 connect.mfp = NL80211_MFP_NO;
13147 }
13148
13149 if (info->attrs[NL80211_ATTR_PREV_BSSID])
13150 connect.prev_bssid =
13151 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
13152
13153 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
13154 freq = MHZ_TO_KHZ(nla_get_u32(
13155 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
13156 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
13157 freq +=
13158 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
13159
13160 if (freq) {
13161 connect.channel = nl80211_get_valid_chan(wiphy, freq);
13162 if (!connect.channel)
13163 return -EINVAL;
13164 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
13165 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
13166 freq = MHZ_TO_KHZ(freq);
13167 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
13168 if (!connect.channel_hint)
13169 return -EINVAL;
13170 }
13171
13172 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
13173 connect.edmg.channels =
13174 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
13175
13176 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
13177 connect.edmg.bw_config =
13178 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
13179 }
13180
13181 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
13182 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
13183 if (IS_ERR(connkeys))
13184 return PTR_ERR(connkeys);
13185 }
13186
13187 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
13188 connect.flags |= ASSOC_REQ_DISABLE_HT;
13189
13190 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
13191 memcpy(&connect.ht_capa_mask,
13192 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
13193 sizeof(connect.ht_capa_mask));
13194
13195 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
13196 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
13197 kfree_sensitive(connkeys);
13198 return -EINVAL;
13199 }
13200 memcpy(&connect.ht_capa,
13201 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
13202 sizeof(connect.ht_capa));
13203 }
13204
13205 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
13206 connect.flags |= ASSOC_REQ_DISABLE_VHT;
13207
13208 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
13209 connect.flags |= ASSOC_REQ_DISABLE_HE;
13210
13211 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
13212 connect.flags |= ASSOC_REQ_DISABLE_EHT;
13213
13214 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
13215 memcpy(&connect.vht_capa_mask,
13216 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
13217 sizeof(connect.vht_capa_mask));
13218
13219 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
13220 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
13221 kfree_sensitive(connkeys);
13222 return -EINVAL;
13223 }
13224 memcpy(&connect.vht_capa,
13225 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
13226 sizeof(connect.vht_capa));
13227 }
13228
13229 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
13230 if (!((rdev->wiphy.features &
13231 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
13232 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
13233 !wiphy_ext_feature_isset(&rdev->wiphy,
13234 NL80211_EXT_FEATURE_RRM)) {
13235 kfree_sensitive(connkeys);
13236 return -EINVAL;
13237 }
13238 connect.flags |= ASSOC_REQ_USE_RRM;
13239 }
13240
13241 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
13242 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
13243 kfree_sensitive(connkeys);
13244 return -EOPNOTSUPP;
13245 }
13246
13247 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
13248 /* bss selection makes no sense if bssid is set */
13249 if (connect.bssid) {
13250 kfree_sensitive(connkeys);
13251 return -EINVAL;
13252 }
13253
13254 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
13255 wiphy, &connect.bss_select);
13256 if (err) {
13257 kfree_sensitive(connkeys);
13258 return err;
13259 }
13260 }
13261
13262 if (wiphy_ext_feature_isset(&rdev->wiphy,
13263 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
13264 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13265 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13266 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13267 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13268 connect.fils_erp_username =
13269 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13270 connect.fils_erp_username_len =
13271 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13272 connect.fils_erp_realm =
13273 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13274 connect.fils_erp_realm_len =
13275 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13276 connect.fils_erp_next_seq_num =
13277 nla_get_u16(
13278 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13279 connect.fils_erp_rrk =
13280 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13281 connect.fils_erp_rrk_len =
13282 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13283 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13284 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13285 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13286 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13287 kfree_sensitive(connkeys);
13288 return -EINVAL;
13289 }
13290
13291 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
13292 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13293 kfree_sensitive(connkeys);
13294 GENL_SET_ERR_MSG(info,
13295 "external auth requires connection ownership");
13296 return -EINVAL;
13297 }
13298 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
13299 }
13300
13301 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
13302 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
13303
13304 err = cfg80211_connect(rdev, dev, &connect, connkeys,
13305 connect.prev_bssid);
13306 if (err)
13307 kfree_sensitive(connkeys);
13308
13309 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13310 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13311 if (connect.bssid)
13312 memcpy(dev->ieee80211_ptr->disconnect_bssid,
13313 connect.bssid, ETH_ALEN);
13314 else
13315 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
13316 }
13317
13318 return err;
13319 }
13320
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)13321 static int nl80211_update_connect_params(struct sk_buff *skb,
13322 struct genl_info *info)
13323 {
13324 struct cfg80211_connect_params connect = {};
13325 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13326 struct net_device *dev = info->user_ptr[1];
13327 struct wireless_dev *wdev = dev->ieee80211_ptr;
13328 bool fils_sk_offload;
13329 u32 auth_type;
13330 u32 changed = 0;
13331
13332 if (!rdev->ops->update_connect_params)
13333 return -EOPNOTSUPP;
13334
13335 if (info->attrs[NL80211_ATTR_IE]) {
13336 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13337 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13338 changed |= UPDATE_ASSOC_IES;
13339 }
13340
13341 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
13342 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
13343
13344 /*
13345 * when driver supports fils-sk offload all attributes must be
13346 * provided. So the else covers "fils-sk-not-all" and
13347 * "no-fils-sk-any".
13348 */
13349 if (fils_sk_offload &&
13350 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13351 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13352 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13353 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13354 connect.fils_erp_username =
13355 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13356 connect.fils_erp_username_len =
13357 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13358 connect.fils_erp_realm =
13359 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13360 connect.fils_erp_realm_len =
13361 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13362 connect.fils_erp_next_seq_num =
13363 nla_get_u16(
13364 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13365 connect.fils_erp_rrk =
13366 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13367 connect.fils_erp_rrk_len =
13368 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13369 changed |= UPDATE_FILS_ERP_INFO;
13370 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13371 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13372 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13373 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13374 return -EINVAL;
13375 }
13376
13377 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13378 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13379 if (!nl80211_valid_auth_type(rdev, auth_type,
13380 NL80211_CMD_CONNECT))
13381 return -EINVAL;
13382
13383 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
13384 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
13385 return -EINVAL;
13386
13387 connect.auth_type = auth_type;
13388 changed |= UPDATE_AUTH_TYPE;
13389 }
13390
13391 if (!wdev->connected)
13392 return -ENOLINK;
13393
13394 return rdev_update_connect_params(rdev, dev, &connect, changed);
13395 }
13396
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)13397 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
13398 {
13399 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13400 struct net_device *dev = info->user_ptr[1];
13401 u16 reason;
13402
13403 if (dev->ieee80211_ptr->conn_owner_nlportid &&
13404 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
13405 return -EPERM;
13406
13407 reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
13408 WLAN_REASON_DEAUTH_LEAVING);
13409
13410 if (reason == 0)
13411 return -EINVAL;
13412
13413 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13414 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13415 return -EOPNOTSUPP;
13416
13417 return cfg80211_disconnect(rdev, dev, reason, true);
13418 }
13419
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)13420 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
13421 {
13422 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13423 struct net *net;
13424 int err;
13425
13426 if (info->attrs[NL80211_ATTR_PID]) {
13427 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
13428
13429 net = get_net_ns_by_pid(pid);
13430 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
13431 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
13432
13433 net = get_net_ns_by_fd(fd);
13434 } else {
13435 return -EINVAL;
13436 }
13437
13438 if (IS_ERR(net))
13439 return PTR_ERR(net);
13440
13441 err = 0;
13442
13443 /* check if anything to do */
13444 if (!net_eq(wiphy_net(&rdev->wiphy), net))
13445 err = cfg80211_switch_netns(rdev, net);
13446
13447 put_net(net);
13448 return err;
13449 }
13450
nl80211_set_pmksa(struct sk_buff * skb,struct genl_info * info)13451 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
13452 {
13453 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13454 struct net_device *dev = info->user_ptr[1];
13455 struct cfg80211_pmksa pmksa;
13456 bool ap_pmksa_caching_support = false;
13457
13458 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13459
13460 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13461 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13462
13463 if (!info->attrs[NL80211_ATTR_PMKID])
13464 return -EINVAL;
13465
13466 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13467
13468 if (info->attrs[NL80211_ATTR_MAC]) {
13469 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13470 } else if (info->attrs[NL80211_ATTR_SSID] &&
13471 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13472 info->attrs[NL80211_ATTR_PMK]) {
13473 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13474 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13475 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13476 } else {
13477 return -EINVAL;
13478 }
13479
13480 if (info->attrs[NL80211_ATTR_PMK]) {
13481 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13482 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13483 }
13484
13485 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
13486 pmksa.pmk_lifetime =
13487 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
13488
13489 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
13490 pmksa.pmk_reauth_threshold =
13491 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
13492
13493 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13494 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13495 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13496 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13497 ap_pmksa_caching_support))
13498 return -EOPNOTSUPP;
13499
13500 if (!rdev->ops->set_pmksa)
13501 return -EOPNOTSUPP;
13502
13503 return rdev_set_pmksa(rdev, dev, &pmksa);
13504 }
13505
nl80211_del_pmksa(struct sk_buff * skb,struct genl_info * info)13506 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
13507 {
13508 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13509 struct net_device *dev = info->user_ptr[1];
13510 struct cfg80211_pmksa pmksa;
13511 bool sae_offload_support = false;
13512 bool owe_offload_support = false;
13513 bool ap_pmksa_caching_support = false;
13514
13515 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13516
13517 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13518 NL80211_EXT_FEATURE_SAE_OFFLOAD);
13519 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13520 NL80211_EXT_FEATURE_OWE_OFFLOAD);
13521 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13522 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13523
13524 if (info->attrs[NL80211_ATTR_PMKID])
13525 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13526
13527 if (info->attrs[NL80211_ATTR_MAC]) {
13528 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13529 } else if (info->attrs[NL80211_ATTR_SSID]) {
13530 /* SSID based pmksa flush supported only for FILS,
13531 * OWE/SAE OFFLOAD cases
13532 */
13533 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13534 info->attrs[NL80211_ATTR_PMK]) {
13535 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13536 } else if (!sae_offload_support && !owe_offload_support) {
13537 return -EINVAL;
13538 }
13539 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13540 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13541 } else {
13542 return -EINVAL;
13543 }
13544
13545 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13546 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13547 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13548 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13549 ap_pmksa_caching_support))
13550 return -EOPNOTSUPP;
13551
13552 if (!rdev->ops->del_pmksa)
13553 return -EOPNOTSUPP;
13554
13555 return rdev_del_pmksa(rdev, dev, &pmksa);
13556 }
13557
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)13558 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
13559 {
13560 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13561 struct net_device *dev = info->user_ptr[1];
13562
13563 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13564 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13565 return -EOPNOTSUPP;
13566
13567 if (!rdev->ops->flush_pmksa)
13568 return -EOPNOTSUPP;
13569
13570 return rdev_flush_pmksa(rdev, dev);
13571 }
13572
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)13573 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
13574 {
13575 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13576 struct net_device *dev = info->user_ptr[1];
13577 u8 action_code, dialog_token;
13578 u32 peer_capability = 0;
13579 u16 status_code;
13580 u8 *peer;
13581 int link_id;
13582 bool initiator;
13583
13584 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13585 !rdev->ops->tdls_mgmt)
13586 return -EOPNOTSUPP;
13587
13588 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
13589 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
13590 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
13591 !info->attrs[NL80211_ATTR_IE] ||
13592 !info->attrs[NL80211_ATTR_MAC])
13593 return -EINVAL;
13594
13595 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13596 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
13597 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13598 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
13599 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
13600 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
13601 peer_capability =
13602 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
13603 link_id = nl80211_link_id_or_invalid(info->attrs);
13604
13605 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
13606 dialog_token, status_code, peer_capability,
13607 initiator,
13608 nla_data(info->attrs[NL80211_ATTR_IE]),
13609 nla_len(info->attrs[NL80211_ATTR_IE]));
13610 }
13611
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)13612 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
13613 {
13614 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13615 struct net_device *dev = info->user_ptr[1];
13616 enum nl80211_tdls_operation operation;
13617 u8 *peer;
13618
13619 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13620 !rdev->ops->tdls_oper)
13621 return -EOPNOTSUPP;
13622
13623 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
13624 !info->attrs[NL80211_ATTR_MAC])
13625 return -EINVAL;
13626
13627 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
13628 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13629
13630 return rdev_tdls_oper(rdev, dev, peer, operation);
13631 }
13632
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13633 static int nl80211_remain_on_channel(struct sk_buff *skb,
13634 struct genl_info *info)
13635 {
13636 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13637 unsigned int link_id = nl80211_link_id(info->attrs);
13638 struct wireless_dev *wdev = info->user_ptr[1];
13639 struct cfg80211_chan_def chandef;
13640 struct sk_buff *msg;
13641 void *hdr;
13642 u64 cookie;
13643 u32 duration;
13644 int err;
13645
13646 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
13647 !info->attrs[NL80211_ATTR_DURATION])
13648 return -EINVAL;
13649
13650 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13651
13652 if (!rdev->ops->remain_on_channel ||
13653 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
13654 return -EOPNOTSUPP;
13655
13656 /*
13657 * We should be on that channel for at least a minimum amount of
13658 * time (10ms) but no longer than the driver supports.
13659 */
13660 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13661 duration > rdev->wiphy.max_remain_on_channel_duration)
13662 return -EINVAL;
13663
13664 err = nl80211_parse_chandef(rdev, info, &chandef);
13665 if (err)
13666 return err;
13667
13668 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
13669 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
13670
13671 oper_chandef = wdev_chandef(wdev, link_id);
13672
13673 if (WARN_ON(!oper_chandef)) {
13674 /* cannot happen since we must beacon to get here */
13675 WARN_ON(1);
13676 return -EBUSY;
13677 }
13678
13679 /* note: returns first one if identical chandefs */
13680 compat_chandef = cfg80211_chandef_compatible(&chandef,
13681 oper_chandef);
13682
13683 if (compat_chandef != &chandef)
13684 return -EBUSY;
13685 }
13686
13687 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13688 if (!msg)
13689 return -ENOMEM;
13690
13691 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13692 NL80211_CMD_REMAIN_ON_CHANNEL);
13693 if (!hdr) {
13694 err = -ENOBUFS;
13695 goto free_msg;
13696 }
13697
13698 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
13699 duration, &cookie);
13700
13701 if (err)
13702 goto free_msg;
13703
13704 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13705 NL80211_ATTR_PAD))
13706 goto nla_put_failure;
13707
13708 genlmsg_end(msg, hdr);
13709
13710 return genlmsg_reply(msg, info);
13711
13712 nla_put_failure:
13713 err = -ENOBUFS;
13714 free_msg:
13715 nlmsg_free(msg);
13716 return err;
13717 }
13718
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13719 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
13720 struct genl_info *info)
13721 {
13722 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13723 struct wireless_dev *wdev = info->user_ptr[1];
13724 u64 cookie;
13725
13726 if (!info->attrs[NL80211_ATTR_COOKIE])
13727 return -EINVAL;
13728
13729 if (!rdev->ops->cancel_remain_on_channel)
13730 return -EOPNOTSUPP;
13731
13732 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13733
13734 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
13735 }
13736
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)13737 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
13738 struct genl_info *info)
13739 {
13740 struct cfg80211_bitrate_mask mask;
13741 unsigned int link_id = nl80211_link_id(info->attrs);
13742 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13743 struct net_device *dev = info->user_ptr[1];
13744 int err;
13745
13746 if (!rdev->ops->set_bitrate_mask)
13747 return -EOPNOTSUPP;
13748
13749 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13750 NL80211_ATTR_TX_RATES, &mask,
13751 dev, true, link_id);
13752 if (err)
13753 return err;
13754
13755 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
13756 }
13757
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)13758 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
13759 {
13760 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13761 struct wireless_dev *wdev = info->user_ptr[1];
13762 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
13763
13764 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
13765 return -EINVAL;
13766
13767 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
13768 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
13769
13770 switch (wdev->iftype) {
13771 case NL80211_IFTYPE_STATION:
13772 case NL80211_IFTYPE_ADHOC:
13773 case NL80211_IFTYPE_P2P_CLIENT:
13774 case NL80211_IFTYPE_AP:
13775 case NL80211_IFTYPE_AP_VLAN:
13776 case NL80211_IFTYPE_MESH_POINT:
13777 case NL80211_IFTYPE_P2P_GO:
13778 case NL80211_IFTYPE_P2P_DEVICE:
13779 break;
13780 case NL80211_IFTYPE_NAN:
13781 if (!wiphy_ext_feature_isset(wdev->wiphy,
13782 NL80211_EXT_FEATURE_SECURE_NAN) &&
13783 !(wdev->wiphy->nan_capa.flags &
13784 WIPHY_NAN_FLAGS_USERSPACE_DE))
13785 return -EOPNOTSUPP;
13786 break;
13787 default:
13788 return -EOPNOTSUPP;
13789 }
13790
13791 /* not much point in registering if we can't reply */
13792 if (!rdev->ops->mgmt_tx)
13793 return -EOPNOTSUPP;
13794
13795 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
13796 !wiphy_ext_feature_isset(&rdev->wiphy,
13797 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
13798 GENL_SET_ERR_MSG(info,
13799 "multicast RX registrations are not supported");
13800 return -EOPNOTSUPP;
13801 }
13802
13803 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
13804 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13805 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13806 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
13807 info->extack);
13808 }
13809
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)13810 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
13811 {
13812 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13813 struct wireless_dev *wdev = info->user_ptr[1];
13814 struct cfg80211_chan_def chandef;
13815 int err;
13816 void *hdr = NULL;
13817 u64 cookie;
13818 struct sk_buff *msg = NULL;
13819 struct cfg80211_mgmt_tx_params params = {
13820 .dont_wait_for_ack =
13821 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
13822 };
13823
13824 if (!info->attrs[NL80211_ATTR_FRAME])
13825 return -EINVAL;
13826
13827 if (!rdev->ops->mgmt_tx)
13828 return -EOPNOTSUPP;
13829
13830 switch (wdev->iftype) {
13831 case NL80211_IFTYPE_P2P_DEVICE:
13832 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
13833 return -EINVAL;
13834 break;
13835 case NL80211_IFTYPE_STATION:
13836 case NL80211_IFTYPE_ADHOC:
13837 case NL80211_IFTYPE_P2P_CLIENT:
13838 case NL80211_IFTYPE_AP:
13839 case NL80211_IFTYPE_AP_VLAN:
13840 case NL80211_IFTYPE_MESH_POINT:
13841 case NL80211_IFTYPE_P2P_GO:
13842 break;
13843 case NL80211_IFTYPE_NAN:
13844 if (!wiphy_ext_feature_isset(wdev->wiphy,
13845 NL80211_EXT_FEATURE_SECURE_NAN) &&
13846 !(wdev->wiphy->nan_capa.flags &
13847 WIPHY_NAN_FLAGS_USERSPACE_DE))
13848 return -EOPNOTSUPP;
13849 break;
13850 default:
13851 return -EOPNOTSUPP;
13852 }
13853
13854 if (info->attrs[NL80211_ATTR_DURATION]) {
13855 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13856 return -EINVAL;
13857 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13858
13859 /*
13860 * We should wait on the channel for at least a minimum amount
13861 * of time (10ms) but no longer than the driver supports.
13862 */
13863 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13864 params.wait > rdev->wiphy.max_remain_on_channel_duration)
13865 return -EINVAL;
13866 }
13867
13868 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
13869
13870 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13871 return -EINVAL;
13872
13873 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
13874
13875 /* get the channel if any has been specified, otherwise pass NULL to
13876 * the driver. The latter will use the current one
13877 */
13878 chandef.chan = NULL;
13879 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13880 err = nl80211_parse_chandef(rdev, info, &chandef);
13881 if (err)
13882 return err;
13883 }
13884
13885 if (!chandef.chan && params.offchan)
13886 return -EINVAL;
13887
13888 if (params.offchan &&
13889 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
13890 return -EBUSY;
13891
13892 params.link_id = nl80211_link_id_or_invalid(info->attrs);
13893 /*
13894 * This now races due to the unlock, but we cannot check
13895 * the valid links for the _station_ anyway, so that's up
13896 * to the driver.
13897 */
13898 if (params.link_id >= 0 &&
13899 !(wdev->valid_links & BIT(params.link_id)))
13900 return -EINVAL;
13901
13902 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13903 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13904
13905 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
13906 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
13907 ¶ms.csa_offsets,
13908 ¶ms.n_csa_offsets);
13909 if (err)
13910 return err;
13911
13912 if (!params.dont_wait_for_ack) {
13913 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13914 if (!msg)
13915 return -ENOMEM;
13916
13917 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13918 NL80211_CMD_FRAME);
13919 if (!hdr) {
13920 err = -ENOBUFS;
13921 goto free_msg;
13922 }
13923 }
13924
13925 params.chan = chandef.chan;
13926 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
13927 if (err)
13928 goto free_msg;
13929
13930 if (msg) {
13931 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13932 NL80211_ATTR_PAD))
13933 goto nla_put_failure;
13934
13935 genlmsg_end(msg, hdr);
13936 return genlmsg_reply(msg, info);
13937 }
13938
13939 return 0;
13940
13941 nla_put_failure:
13942 err = -ENOBUFS;
13943 free_msg:
13944 nlmsg_free(msg);
13945 return err;
13946 }
13947
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)13948 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
13949 {
13950 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13951 struct wireless_dev *wdev = info->user_ptr[1];
13952 u64 cookie;
13953
13954 if (!info->attrs[NL80211_ATTR_COOKIE])
13955 return -EINVAL;
13956
13957 if (!rdev->ops->mgmt_tx_cancel_wait)
13958 return -EOPNOTSUPP;
13959
13960 switch (wdev->iftype) {
13961 case NL80211_IFTYPE_STATION:
13962 case NL80211_IFTYPE_ADHOC:
13963 case NL80211_IFTYPE_P2P_CLIENT:
13964 case NL80211_IFTYPE_AP:
13965 case NL80211_IFTYPE_AP_VLAN:
13966 case NL80211_IFTYPE_P2P_GO:
13967 case NL80211_IFTYPE_P2P_DEVICE:
13968 break;
13969 case NL80211_IFTYPE_NAN:
13970 if (!wiphy_ext_feature_isset(wdev->wiphy,
13971 NL80211_EXT_FEATURE_SECURE_NAN))
13972 return -EOPNOTSUPP;
13973 break;
13974 default:
13975 return -EOPNOTSUPP;
13976 }
13977
13978 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13979
13980 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
13981 }
13982
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)13983 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
13984 {
13985 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13986 struct wireless_dev *wdev;
13987 struct net_device *dev = info->user_ptr[1];
13988 u8 ps_state;
13989 bool state;
13990 int err;
13991
13992 if (!info->attrs[NL80211_ATTR_PS_STATE])
13993 return -EINVAL;
13994
13995 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
13996
13997 wdev = dev->ieee80211_ptr;
13998
13999 if (!rdev->ops->set_power_mgmt)
14000 return -EOPNOTSUPP;
14001
14002 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
14003
14004 if (state == wdev->ps)
14005 return 0;
14006
14007 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
14008 if (!err)
14009 wdev->ps = state;
14010 return err;
14011 }
14012
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)14013 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
14014 {
14015 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14016 enum nl80211_ps_state ps_state;
14017 struct wireless_dev *wdev;
14018 struct net_device *dev = info->user_ptr[1];
14019 struct sk_buff *msg;
14020 void *hdr;
14021 int err;
14022
14023 wdev = dev->ieee80211_ptr;
14024
14025 if (!rdev->ops->set_power_mgmt)
14026 return -EOPNOTSUPP;
14027
14028 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14029 if (!msg)
14030 return -ENOMEM;
14031
14032 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14033 NL80211_CMD_GET_POWER_SAVE);
14034 if (!hdr) {
14035 err = -ENOBUFS;
14036 goto free_msg;
14037 }
14038
14039 if (wdev->ps)
14040 ps_state = NL80211_PS_ENABLED;
14041 else
14042 ps_state = NL80211_PS_DISABLED;
14043
14044 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
14045 goto nla_put_failure;
14046
14047 genlmsg_end(msg, hdr);
14048 return genlmsg_reply(msg, info);
14049
14050 nla_put_failure:
14051 err = -ENOBUFS;
14052 free_msg:
14053 nlmsg_free(msg);
14054 return err;
14055 }
14056
14057 static const struct nla_policy
14058 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
14059 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
14060 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
14061 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
14062 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
14063 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
14064 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
14065 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
14066 };
14067
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)14068 static int nl80211_set_cqm_txe(struct genl_info *info,
14069 u32 rate, u32 pkts, u32 intvl)
14070 {
14071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14072 struct net_device *dev = info->user_ptr[1];
14073 struct wireless_dev *wdev = dev->ieee80211_ptr;
14074
14075 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
14076 return -EINVAL;
14077
14078 if (!rdev->ops->set_cqm_txe_config)
14079 return -EOPNOTSUPP;
14080
14081 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14082 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14083 return -EOPNOTSUPP;
14084
14085 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
14086 }
14087
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)14088 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
14089 struct net_device *dev,
14090 struct cfg80211_cqm_config *cqm_config)
14091 {
14092 struct wireless_dev *wdev = dev->ieee80211_ptr;
14093 s32 last, low, high;
14094 u32 hyst;
14095 int i, n, low_index;
14096 int err;
14097
14098 /*
14099 * Obtain current RSSI value if possible, if not and no RSSI threshold
14100 * event has been received yet, we should receive an event after a
14101 * connection is established and enough beacons received to calculate
14102 * the average.
14103 */
14104 if (!cqm_config->last_rssi_event_value &&
14105 wdev->links[0].client.current_bss &&
14106 rdev->ops->get_station) {
14107 struct station_info sinfo = {};
14108 u8 *mac_addr;
14109
14110 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
14111
14112 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
14113 if (err)
14114 return err;
14115
14116 cfg80211_sinfo_release_content(&sinfo);
14117 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
14118 cqm_config->last_rssi_event_value =
14119 (s8) sinfo.rx_beacon_signal_avg;
14120 }
14121
14122 last = cqm_config->last_rssi_event_value;
14123 hyst = cqm_config->rssi_hyst;
14124 n = cqm_config->n_rssi_thresholds;
14125
14126 for (i = 0; i < n; i++) {
14127 i = array_index_nospec(i, n);
14128 if (last < cqm_config->rssi_thresholds[i])
14129 break;
14130 }
14131
14132 low_index = i - 1;
14133 if (low_index >= 0) {
14134 low_index = array_index_nospec(low_index, n);
14135 low = cqm_config->rssi_thresholds[low_index] - hyst;
14136 } else {
14137 low = S32_MIN;
14138 }
14139 if (i < n) {
14140 i = array_index_nospec(i, n);
14141 high = cqm_config->rssi_thresholds[i] + hyst - 1;
14142 } else {
14143 high = S32_MAX;
14144 }
14145
14146 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
14147 }
14148
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)14149 static int nl80211_set_cqm_rssi(struct genl_info *info,
14150 const s32 *thresholds, int n_thresholds,
14151 u32 hysteresis)
14152 {
14153 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14154 struct cfg80211_cqm_config *cqm_config = NULL, *old;
14155 struct net_device *dev = info->user_ptr[1];
14156 struct wireless_dev *wdev = dev->ieee80211_ptr;
14157 s32 prev = S32_MIN;
14158 int i, err;
14159
14160 /* Check all values negative and sorted */
14161 for (i = 0; i < n_thresholds; i++) {
14162 if (thresholds[i] > 0 || thresholds[i] <= prev)
14163 return -EINVAL;
14164
14165 prev = thresholds[i];
14166 }
14167
14168 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14169 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14170 return -EOPNOTSUPP;
14171
14172 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
14173 n_thresholds = 0;
14174
14175 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
14176
14177 /* if already disabled just succeed */
14178 if (!n_thresholds && !old)
14179 return 0;
14180
14181 if (n_thresholds > 1) {
14182 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14183 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
14184 !rdev->ops->set_cqm_rssi_range_config)
14185 return -EOPNOTSUPP;
14186 } else {
14187 if (!rdev->ops->set_cqm_rssi_config)
14188 return -EOPNOTSUPP;
14189 }
14190
14191 if (n_thresholds) {
14192 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
14193 n_thresholds),
14194 GFP_KERNEL);
14195 if (!cqm_config)
14196 return -ENOMEM;
14197
14198 cqm_config->rssi_hyst = hysteresis;
14199 cqm_config->n_rssi_thresholds = n_thresholds;
14200 memcpy(cqm_config->rssi_thresholds, thresholds,
14201 flex_array_size(cqm_config, rssi_thresholds,
14202 n_thresholds));
14203 cqm_config->use_range_api = n_thresholds > 1 ||
14204 !rdev->ops->set_cqm_rssi_config;
14205
14206 rcu_assign_pointer(wdev->cqm_config, cqm_config);
14207
14208 if (cqm_config->use_range_api)
14209 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
14210 else
14211 err = rdev_set_cqm_rssi_config(rdev, dev,
14212 thresholds[0],
14213 hysteresis);
14214 } else {
14215 RCU_INIT_POINTER(wdev->cqm_config, NULL);
14216 /* if enabled as range also disable via range */
14217 if (old->use_range_api)
14218 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
14219 else
14220 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
14221 }
14222
14223 if (err) {
14224 rcu_assign_pointer(wdev->cqm_config, old);
14225 kfree_rcu(cqm_config, rcu_head);
14226 } else {
14227 kfree_rcu(old, rcu_head);
14228 }
14229
14230 return err;
14231 }
14232
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)14233 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
14234 {
14235 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
14236 struct nlattr *cqm;
14237 int err;
14238
14239 cqm = info->attrs[NL80211_ATTR_CQM];
14240 if (!cqm)
14241 return -EINVAL;
14242
14243 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
14244 nl80211_attr_cqm_policy,
14245 info->extack);
14246 if (err)
14247 return err;
14248
14249 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
14250 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
14251 const s32 *thresholds =
14252 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14253 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14254 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
14255
14256 if (len % 4)
14257 return -EINVAL;
14258
14259 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
14260 hysteresis);
14261 }
14262
14263 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
14264 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
14265 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
14266 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
14267 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
14268 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
14269
14270 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
14271 }
14272
14273 return -EINVAL;
14274 }
14275
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)14276 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
14277 {
14278 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14279 struct net_device *dev = info->user_ptr[1];
14280 struct ocb_setup setup = {};
14281 int err;
14282
14283 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14284 if (err)
14285 return err;
14286
14287 return cfg80211_join_ocb(rdev, dev, &setup);
14288 }
14289
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)14290 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
14291 {
14292 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14293 struct net_device *dev = info->user_ptr[1];
14294
14295 return cfg80211_leave_ocb(rdev, dev);
14296 }
14297
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)14298 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
14299 {
14300 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14301 struct net_device *dev = info->user_ptr[1];
14302 struct mesh_config cfg;
14303 struct mesh_setup setup;
14304 int err;
14305
14306 /* start with default */
14307 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
14308 memcpy(&setup, &default_mesh_setup, sizeof(setup));
14309
14310 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
14311 /* and parse parameters if given */
14312 err = nl80211_parse_mesh_config(info, &cfg, NULL);
14313 if (err)
14314 return err;
14315 }
14316
14317 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
14318 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
14319 return -EINVAL;
14320
14321 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
14322 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
14323
14324 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
14325 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
14326 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
14327 return -EINVAL;
14328
14329 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
14330 setup.beacon_interval =
14331 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
14332
14333 err = cfg80211_validate_beacon_int(rdev,
14334 NL80211_IFTYPE_MESH_POINT,
14335 setup.beacon_interval);
14336 if (err)
14337 return err;
14338 }
14339
14340 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
14341 setup.dtim_period =
14342 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
14343 if (setup.dtim_period < 1 || setup.dtim_period > 100)
14344 return -EINVAL;
14345 }
14346
14347 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
14348 /* parse additional setup parameters if given */
14349 err = nl80211_parse_mesh_setup(info, &setup);
14350 if (err)
14351 return err;
14352 }
14353
14354 if (setup.user_mpm)
14355 cfg.auto_open_plinks = false;
14356
14357 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
14358 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14359 if (err)
14360 return err;
14361 } else {
14362 /* __cfg80211_join_mesh() will sort it out */
14363 setup.chandef.chan = NULL;
14364 }
14365
14366 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
14367 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14368 int n_rates =
14369 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14370 struct ieee80211_supported_band *sband;
14371
14372 if (!setup.chandef.chan)
14373 return -EINVAL;
14374
14375 sband = rdev->wiphy.bands[setup.chandef.chan->band];
14376
14377 err = ieee80211_get_ratemask(sband, rates, n_rates,
14378 &setup.basic_rates);
14379 if (err)
14380 return err;
14381 }
14382
14383 if (info->attrs[NL80211_ATTR_TX_RATES]) {
14384 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
14385 NL80211_ATTR_TX_RATES,
14386 &setup.beacon_rate,
14387 dev, false, 0);
14388 if (err)
14389 return err;
14390
14391 if (!setup.chandef.chan)
14392 return -EINVAL;
14393
14394 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
14395 &setup.beacon_rate);
14396 if (err)
14397 return err;
14398 }
14399
14400 setup.userspace_handles_dfs =
14401 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
14402
14403 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
14404 int r = validate_pae_over_nl80211(rdev, info);
14405
14406 if (r < 0)
14407 return r;
14408
14409 setup.control_port_over_nl80211 = true;
14410 }
14411
14412 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
14413 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
14414 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
14415
14416 return err;
14417 }
14418
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)14419 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
14420 {
14421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14422 struct net_device *dev = info->user_ptr[1];
14423
14424 return cfg80211_leave_mesh(rdev, dev);
14425 }
14426
14427 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)14428 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
14429 struct cfg80211_registered_device *rdev)
14430 {
14431 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
14432 struct nlattr *nl_pats, *nl_pat;
14433 int i, pat_len;
14434
14435 if (!wowlan->n_patterns)
14436 return 0;
14437
14438 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
14439 if (!nl_pats)
14440 return -ENOBUFS;
14441
14442 for (i = 0; i < wowlan->n_patterns; i++) {
14443 nl_pat = nla_nest_start_noflag(msg, i + 1);
14444 if (!nl_pat)
14445 return -ENOBUFS;
14446 pat_len = wowlan->patterns[i].pattern_len;
14447 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
14448 wowlan->patterns[i].mask) ||
14449 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14450 wowlan->patterns[i].pattern) ||
14451 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14452 wowlan->patterns[i].pkt_offset))
14453 return -ENOBUFS;
14454 nla_nest_end(msg, nl_pat);
14455 }
14456 nla_nest_end(msg, nl_pats);
14457
14458 return 0;
14459 }
14460
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)14461 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
14462 struct cfg80211_wowlan_tcp *tcp)
14463 {
14464 struct nlattr *nl_tcp;
14465
14466 if (!tcp)
14467 return 0;
14468
14469 nl_tcp = nla_nest_start_noflag(msg,
14470 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
14471 if (!nl_tcp)
14472 return -ENOBUFS;
14473
14474 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
14475 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
14476 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
14477 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
14478 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
14479 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
14480 tcp->payload_len, tcp->payload) ||
14481 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
14482 tcp->data_interval) ||
14483 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
14484 tcp->wake_len, tcp->wake_data) ||
14485 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
14486 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
14487 return -ENOBUFS;
14488
14489 if (tcp->payload_seq.len &&
14490 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
14491 sizeof(tcp->payload_seq), &tcp->payload_seq))
14492 return -ENOBUFS;
14493
14494 if (tcp->payload_tok.len &&
14495 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
14496 sizeof(tcp->payload_tok) + tcp->tokens_size,
14497 &tcp->payload_tok))
14498 return -ENOBUFS;
14499
14500 nla_nest_end(msg, nl_tcp);
14501
14502 return 0;
14503 }
14504
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)14505 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
14506 struct cfg80211_sched_scan_request *req)
14507 {
14508 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
14509 int i;
14510
14511 if (!req)
14512 return 0;
14513
14514 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
14515 if (!nd)
14516 return -ENOBUFS;
14517
14518 if (req->n_scan_plans == 1 &&
14519 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
14520 req->scan_plans[0].interval * 1000))
14521 return -ENOBUFS;
14522
14523 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
14524 return -ENOBUFS;
14525
14526 if (req->relative_rssi_set) {
14527 struct nl80211_bss_select_rssi_adjust rssi_adjust;
14528
14529 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
14530 req->relative_rssi))
14531 return -ENOBUFS;
14532
14533 rssi_adjust.band = req->rssi_adjust.band;
14534 rssi_adjust.delta = req->rssi_adjust.delta;
14535 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
14536 sizeof(rssi_adjust), &rssi_adjust))
14537 return -ENOBUFS;
14538 }
14539
14540 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14541 if (!freqs)
14542 return -ENOBUFS;
14543
14544 for (i = 0; i < req->n_channels; i++) {
14545 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14546 return -ENOBUFS;
14547 }
14548
14549 nla_nest_end(msg, freqs);
14550
14551 if (req->n_match_sets) {
14552 matches = nla_nest_start_noflag(msg,
14553 NL80211_ATTR_SCHED_SCAN_MATCH);
14554 if (!matches)
14555 return -ENOBUFS;
14556
14557 for (i = 0; i < req->n_match_sets; i++) {
14558 match = nla_nest_start_noflag(msg, i);
14559 if (!match)
14560 return -ENOBUFS;
14561
14562 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
14563 req->match_sets[i].ssid.ssid_len,
14564 req->match_sets[i].ssid.ssid))
14565 return -ENOBUFS;
14566 nla_nest_end(msg, match);
14567 }
14568 nla_nest_end(msg, matches);
14569 }
14570
14571 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
14572 if (!scan_plans)
14573 return -ENOBUFS;
14574
14575 for (i = 0; i < req->n_scan_plans; i++) {
14576 scan_plan = nla_nest_start_noflag(msg, i + 1);
14577 if (!scan_plan)
14578 return -ENOBUFS;
14579
14580 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
14581 req->scan_plans[i].interval) ||
14582 (req->scan_plans[i].iterations &&
14583 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
14584 req->scan_plans[i].iterations)))
14585 return -ENOBUFS;
14586 nla_nest_end(msg, scan_plan);
14587 }
14588 nla_nest_end(msg, scan_plans);
14589
14590 nla_nest_end(msg, nd);
14591
14592 return 0;
14593 }
14594
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)14595 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
14596 {
14597 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14598 struct sk_buff *msg;
14599 void *hdr;
14600 u32 size = NLMSG_DEFAULT_SIZE;
14601
14602 if (!rdev->wiphy.wowlan)
14603 return -EOPNOTSUPP;
14604
14605 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
14606 /* adjust size to have room for all the data */
14607 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
14608 rdev->wiphy.wowlan_config->tcp->payload_len +
14609 rdev->wiphy.wowlan_config->tcp->wake_len +
14610 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
14611 }
14612
14613 msg = nlmsg_new(size, GFP_KERNEL);
14614 if (!msg)
14615 return -ENOMEM;
14616
14617 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14618 NL80211_CMD_GET_WOWLAN);
14619 if (!hdr)
14620 goto nla_put_failure;
14621
14622 if (rdev->wiphy.wowlan_config) {
14623 struct nlattr *nl_wowlan;
14624
14625 nl_wowlan = nla_nest_start_noflag(msg,
14626 NL80211_ATTR_WOWLAN_TRIGGERS);
14627 if (!nl_wowlan)
14628 goto nla_put_failure;
14629
14630 if ((rdev->wiphy.wowlan_config->any &&
14631 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
14632 (rdev->wiphy.wowlan_config->disconnect &&
14633 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
14634 (rdev->wiphy.wowlan_config->magic_pkt &&
14635 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
14636 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
14637 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
14638 (rdev->wiphy.wowlan_config->eap_identity_req &&
14639 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
14640 (rdev->wiphy.wowlan_config->four_way_handshake &&
14641 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
14642 (rdev->wiphy.wowlan_config->rfkill_release &&
14643 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
14644 goto nla_put_failure;
14645
14646 if (nl80211_send_wowlan_patterns(msg, rdev))
14647 goto nla_put_failure;
14648
14649 if (nl80211_send_wowlan_tcp(msg,
14650 rdev->wiphy.wowlan_config->tcp))
14651 goto nla_put_failure;
14652
14653 if (nl80211_send_wowlan_nd(
14654 msg,
14655 rdev->wiphy.wowlan_config->nd_config))
14656 goto nla_put_failure;
14657
14658 nla_nest_end(msg, nl_wowlan);
14659 }
14660
14661 genlmsg_end(msg, hdr);
14662 return genlmsg_reply(msg, info);
14663
14664 nla_put_failure:
14665 nlmsg_free(msg);
14666 return -ENOBUFS;
14667 }
14668
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)14669 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
14670 struct nlattr *attr,
14671 struct cfg80211_wowlan *trig)
14672 {
14673 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
14674 struct cfg80211_wowlan_tcp *cfg;
14675 struct nl80211_wowlan_tcp_data_token *tok = NULL;
14676 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
14677 u32 size;
14678 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
14679 int err, port;
14680
14681 if (!rdev->wiphy.wowlan->tcp)
14682 return -EINVAL;
14683
14684 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
14685 nl80211_wowlan_tcp_policy, NULL);
14686 if (err)
14687 return err;
14688
14689 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
14690 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
14691 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
14692 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
14693 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
14694 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
14695 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
14696 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
14697 return -EINVAL;
14698
14699 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
14700 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
14701 return -EINVAL;
14702
14703 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
14704 rdev->wiphy.wowlan->tcp->data_interval_max ||
14705 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
14706 return -EINVAL;
14707
14708 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
14709 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
14710 return -EINVAL;
14711
14712 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
14713 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
14714 return -EINVAL;
14715
14716 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
14717 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14718
14719 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14720 tokens_size = tokln - sizeof(*tok);
14721
14722 if (!tok->len || tokens_size % tok->len)
14723 return -EINVAL;
14724 if (!rdev->wiphy.wowlan->tcp->tok)
14725 return -EINVAL;
14726 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
14727 return -EINVAL;
14728 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
14729 return -EINVAL;
14730 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
14731 return -EINVAL;
14732 if (tok->offset + tok->len > data_size)
14733 return -EINVAL;
14734 }
14735
14736 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
14737 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
14738 if (!rdev->wiphy.wowlan->tcp->seq)
14739 return -EINVAL;
14740 if (seq->len == 0 || seq->len > 4)
14741 return -EINVAL;
14742 if (seq->len + seq->offset > data_size)
14743 return -EINVAL;
14744 }
14745
14746 size = sizeof(*cfg);
14747 size += data_size;
14748 size += wake_size + wake_mask_size;
14749 size += tokens_size;
14750
14751 cfg = kzalloc(size, GFP_KERNEL);
14752 if (!cfg)
14753 return -ENOMEM;
14754 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
14755 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
14756 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
14757 ETH_ALEN);
14758 port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
14759 #ifdef CONFIG_INET
14760 /* allocate a socket and port for it and use it */
14761 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
14762 IPPROTO_TCP, &cfg->sock, 1);
14763 if (err) {
14764 kfree(cfg);
14765 return err;
14766 }
14767 if (inet_csk_get_port(cfg->sock->sk, port)) {
14768 sock_release(cfg->sock);
14769 kfree(cfg);
14770 return -EADDRINUSE;
14771 }
14772 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
14773 #else
14774 if (!port) {
14775 kfree(cfg);
14776 return -EINVAL;
14777 }
14778 cfg->src_port = port;
14779 #endif
14780
14781 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
14782 cfg->payload_len = data_size;
14783 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
14784 memcpy((void *)cfg->payload,
14785 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
14786 data_size);
14787 if (seq)
14788 cfg->payload_seq = *seq;
14789 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
14790 cfg->wake_len = wake_size;
14791 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
14792 memcpy((void *)cfg->wake_data,
14793 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
14794 wake_size);
14795 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
14796 data_size + wake_size;
14797 memcpy((void *)cfg->wake_mask,
14798 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
14799 wake_mask_size);
14800 if (tok) {
14801 cfg->tokens_size = tokens_size;
14802 cfg->payload_tok = *tok;
14803 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
14804 tokens_size);
14805 }
14806
14807 trig->tcp = cfg;
14808
14809 return 0;
14810 }
14811
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)14812 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
14813 const struct wiphy_wowlan_support *wowlan,
14814 struct nlattr *attr,
14815 struct cfg80211_wowlan *trig)
14816 {
14817 struct nlattr **tb;
14818 int err;
14819
14820 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
14821 if (!tb)
14822 return -ENOMEM;
14823
14824 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
14825 err = -EOPNOTSUPP;
14826 goto out;
14827 }
14828
14829 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
14830 nl80211_policy, NULL);
14831 if (err)
14832 goto out;
14833
14834 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
14835 wowlan->max_nd_match_sets);
14836 err = PTR_ERR_OR_ZERO(trig->nd_config);
14837 if (err)
14838 trig->nd_config = NULL;
14839
14840 out:
14841 kfree(tb);
14842 return err;
14843 }
14844
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)14845 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
14846 {
14847 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14848 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
14849 struct cfg80211_wowlan new_triggers = {};
14850 struct cfg80211_wowlan *ntrig;
14851 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
14852 int err, i;
14853 bool prev_enabled = rdev->wiphy.wowlan_config;
14854 bool regular = false;
14855
14856 if (!wowlan)
14857 return -EOPNOTSUPP;
14858
14859 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
14860 cfg80211_rdev_free_wowlan(rdev);
14861 rdev->wiphy.wowlan_config = NULL;
14862 goto set_wakeup;
14863 }
14864
14865 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
14866 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
14867 nl80211_wowlan_policy, info->extack);
14868 if (err)
14869 return err;
14870
14871 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
14872 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
14873 return -EINVAL;
14874 new_triggers.any = true;
14875 }
14876
14877 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
14878 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
14879 return -EINVAL;
14880 new_triggers.disconnect = true;
14881 regular = true;
14882 }
14883
14884 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
14885 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
14886 return -EINVAL;
14887 new_triggers.magic_pkt = true;
14888 regular = true;
14889 }
14890
14891 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
14892 return -EINVAL;
14893
14894 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
14895 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
14896 return -EINVAL;
14897 new_triggers.gtk_rekey_failure = true;
14898 regular = true;
14899 }
14900
14901 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
14902 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
14903 return -EINVAL;
14904 new_triggers.eap_identity_req = true;
14905 regular = true;
14906 }
14907
14908 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
14909 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
14910 return -EINVAL;
14911 new_triggers.four_way_handshake = true;
14912 regular = true;
14913 }
14914
14915 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
14916 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
14917 return -EINVAL;
14918 new_triggers.rfkill_release = true;
14919 regular = true;
14920 }
14921
14922 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
14923 struct nlattr *pat;
14924 int n_patterns = 0;
14925 int rem, pat_len, mask_len, pkt_offset;
14926 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14927
14928 regular = true;
14929
14930 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14931 rem)
14932 n_patterns++;
14933 if (n_patterns > wowlan->n_patterns)
14934 return -EINVAL;
14935
14936 new_triggers.patterns = kcalloc(n_patterns,
14937 sizeof(new_triggers.patterns[0]),
14938 GFP_KERNEL);
14939 if (!new_triggers.patterns)
14940 return -ENOMEM;
14941
14942 new_triggers.n_patterns = n_patterns;
14943 i = 0;
14944
14945 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14946 rem) {
14947 u8 *mask_pat;
14948
14949 err = nla_parse_nested_deprecated(pat_tb,
14950 MAX_NL80211_PKTPAT,
14951 pat,
14952 nl80211_packet_pattern_policy,
14953 info->extack);
14954 if (err)
14955 goto error;
14956
14957 err = -EINVAL;
14958 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14959 !pat_tb[NL80211_PKTPAT_PATTERN])
14960 goto error;
14961 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14962 mask_len = DIV_ROUND_UP(pat_len, 8);
14963 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14964 goto error;
14965 if (pat_len > wowlan->pattern_max_len ||
14966 pat_len < wowlan->pattern_min_len)
14967 goto error;
14968
14969 pkt_offset =
14970 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14971 0);
14972 if (pkt_offset > wowlan->max_pkt_offset)
14973 goto error;
14974 new_triggers.patterns[i].pkt_offset = pkt_offset;
14975
14976 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14977 if (!mask_pat) {
14978 err = -ENOMEM;
14979 goto error;
14980 }
14981 new_triggers.patterns[i].mask = mask_pat;
14982 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14983 mask_len);
14984 mask_pat += mask_len;
14985 new_triggers.patterns[i].pattern = mask_pat;
14986 new_triggers.patterns[i].pattern_len = pat_len;
14987 memcpy(mask_pat,
14988 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14989 pat_len);
14990 i++;
14991 }
14992 }
14993
14994 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
14995 regular = true;
14996 err = nl80211_parse_wowlan_tcp(
14997 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
14998 &new_triggers);
14999 if (err)
15000 goto error;
15001 }
15002
15003 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
15004 regular = true;
15005 err = nl80211_parse_wowlan_nd(
15006 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
15007 &new_triggers);
15008 if (err)
15009 goto error;
15010 }
15011
15012 /* The 'any' trigger means the device continues operating more or less
15013 * as in its normal operation mode and wakes up the host on most of the
15014 * normal interrupts (like packet RX, ...)
15015 * It therefore makes little sense to combine with the more constrained
15016 * wakeup trigger modes.
15017 */
15018 if (new_triggers.any && regular) {
15019 err = -EINVAL;
15020 goto error;
15021 }
15022
15023 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
15024 if (!ntrig) {
15025 err = -ENOMEM;
15026 goto error;
15027 }
15028 cfg80211_rdev_free_wowlan(rdev);
15029 rdev->wiphy.wowlan_config = ntrig;
15030
15031 set_wakeup:
15032 if (rdev->ops->set_wakeup &&
15033 prev_enabled != !!rdev->wiphy.wowlan_config)
15034 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
15035
15036 return 0;
15037 error:
15038 for (i = 0; i < new_triggers.n_patterns; i++)
15039 kfree(new_triggers.patterns[i].mask);
15040 kfree(new_triggers.patterns);
15041 if (new_triggers.tcp && new_triggers.tcp->sock)
15042 sock_release(new_triggers.tcp->sock);
15043 kfree(new_triggers.tcp);
15044 kfree(new_triggers.nd_config);
15045 return err;
15046 }
15047 #endif
15048
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)15049 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
15050 struct cfg80211_registered_device *rdev)
15051 {
15052 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
15053 int i, j, pat_len;
15054 struct cfg80211_coalesce_rules *rule;
15055
15056 if (!rdev->coalesce->n_rules)
15057 return 0;
15058
15059 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
15060 if (!nl_rules)
15061 return -ENOBUFS;
15062
15063 for (i = 0; i < rdev->coalesce->n_rules; i++) {
15064 nl_rule = nla_nest_start_noflag(msg, i + 1);
15065 if (!nl_rule)
15066 return -ENOBUFS;
15067
15068 rule = &rdev->coalesce->rules[i];
15069 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
15070 rule->delay))
15071 return -ENOBUFS;
15072
15073 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
15074 rule->condition))
15075 return -ENOBUFS;
15076
15077 nl_pats = nla_nest_start_noflag(msg,
15078 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
15079 if (!nl_pats)
15080 return -ENOBUFS;
15081
15082 for (j = 0; j < rule->n_patterns; j++) {
15083 nl_pat = nla_nest_start_noflag(msg, j + 1);
15084 if (!nl_pat)
15085 return -ENOBUFS;
15086 pat_len = rule->patterns[j].pattern_len;
15087 if (nla_put(msg, NL80211_PKTPAT_MASK,
15088 DIV_ROUND_UP(pat_len, 8),
15089 rule->patterns[j].mask) ||
15090 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
15091 rule->patterns[j].pattern) ||
15092 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
15093 rule->patterns[j].pkt_offset))
15094 return -ENOBUFS;
15095 nla_nest_end(msg, nl_pat);
15096 }
15097 nla_nest_end(msg, nl_pats);
15098 nla_nest_end(msg, nl_rule);
15099 }
15100 nla_nest_end(msg, nl_rules);
15101
15102 return 0;
15103 }
15104
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)15105 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
15106 {
15107 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15108 struct sk_buff *msg;
15109 void *hdr;
15110
15111 if (!rdev->wiphy.coalesce)
15112 return -EOPNOTSUPP;
15113
15114 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15115 if (!msg)
15116 return -ENOMEM;
15117
15118 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15119 NL80211_CMD_GET_COALESCE);
15120 if (!hdr)
15121 goto nla_put_failure;
15122
15123 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
15124 goto nla_put_failure;
15125
15126 genlmsg_end(msg, hdr);
15127 return genlmsg_reply(msg, info);
15128
15129 nla_put_failure:
15130 nlmsg_free(msg);
15131 return -ENOBUFS;
15132 }
15133
cfg80211_free_coalesce(struct cfg80211_coalesce * coalesce)15134 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
15135 {
15136 int i, j;
15137 struct cfg80211_coalesce_rules *rule;
15138
15139 if (!coalesce)
15140 return;
15141
15142 for (i = 0; i < coalesce->n_rules; i++) {
15143 rule = &coalesce->rules[i];
15144 for (j = 0; j < rule->n_patterns; j++)
15145 kfree(rule->patterns[j].mask);
15146 kfree(rule->patterns);
15147 }
15148 kfree(coalesce);
15149 }
15150
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)15151 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
15152 struct nlattr *rule,
15153 struct cfg80211_coalesce_rules *new_rule)
15154 {
15155 int err, i;
15156 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15157 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
15158 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
15159 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
15160
15161 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
15162 rule, nl80211_coalesce_policy, NULL);
15163 if (err)
15164 return err;
15165
15166 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
15167 new_rule->delay =
15168 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
15169 if (new_rule->delay > coalesce->max_delay)
15170 return -EINVAL;
15171
15172 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
15173 new_rule->condition =
15174 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
15175
15176 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
15177 return -EINVAL;
15178
15179 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15180 rem)
15181 n_patterns++;
15182 if (n_patterns > coalesce->n_patterns)
15183 return -EINVAL;
15184
15185 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
15186 GFP_KERNEL);
15187 if (!new_rule->patterns)
15188 return -ENOMEM;
15189
15190 new_rule->n_patterns = n_patterns;
15191 i = 0;
15192
15193 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15194 rem) {
15195 u8 *mask_pat;
15196
15197 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
15198 pat,
15199 nl80211_packet_pattern_policy,
15200 NULL);
15201 if (err)
15202 return err;
15203
15204 if (!pat_tb[NL80211_PKTPAT_MASK] ||
15205 !pat_tb[NL80211_PKTPAT_PATTERN])
15206 return -EINVAL;
15207 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
15208 mask_len = DIV_ROUND_UP(pat_len, 8);
15209 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
15210 return -EINVAL;
15211 if (pat_len > coalesce->pattern_max_len ||
15212 pat_len < coalesce->pattern_min_len)
15213 return -EINVAL;
15214
15215 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
15216 0);
15217 if (pkt_offset > coalesce->max_pkt_offset)
15218 return -EINVAL;
15219 new_rule->patterns[i].pkt_offset = pkt_offset;
15220
15221 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
15222 if (!mask_pat)
15223 return -ENOMEM;
15224
15225 new_rule->patterns[i].mask = mask_pat;
15226 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
15227 mask_len);
15228
15229 mask_pat += mask_len;
15230 new_rule->patterns[i].pattern = mask_pat;
15231 new_rule->patterns[i].pattern_len = pat_len;
15232 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
15233 pat_len);
15234 i++;
15235 }
15236
15237 return 0;
15238 }
15239
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)15240 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
15241 {
15242 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15243 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15244 struct cfg80211_coalesce *new_coalesce;
15245 int err, rem_rule, n_rules = 0, i;
15246 struct nlattr *rule;
15247
15248 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
15249 return -EOPNOTSUPP;
15250
15251 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
15252 cfg80211_free_coalesce(rdev->coalesce);
15253 rdev->coalesce = NULL;
15254 rdev_set_coalesce(rdev, NULL);
15255 return 0;
15256 }
15257
15258 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15259 rem_rule)
15260 n_rules++;
15261 if (n_rules > coalesce->n_rules)
15262 return -EINVAL;
15263
15264 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
15265 GFP_KERNEL);
15266 if (!new_coalesce)
15267 return -ENOMEM;
15268
15269 new_coalesce->n_rules = n_rules;
15270 i = 0;
15271
15272 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15273 rem_rule) {
15274 err = nl80211_parse_coalesce_rule(rdev, rule,
15275 &new_coalesce->rules[i]);
15276 if (err)
15277 goto error;
15278
15279 i++;
15280 }
15281
15282 err = rdev_set_coalesce(rdev, new_coalesce);
15283 if (err)
15284 goto error;
15285
15286 cfg80211_free_coalesce(rdev->coalesce);
15287 rdev->coalesce = new_coalesce;
15288
15289 return 0;
15290 error:
15291 cfg80211_free_coalesce(new_coalesce);
15292
15293 return err;
15294 }
15295
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)15296 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
15297 {
15298 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15299 struct net_device *dev = info->user_ptr[1];
15300 struct wireless_dev *wdev = dev->ieee80211_ptr;
15301 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
15302 struct cfg80211_gtk_rekey_data rekey_data = {};
15303 int err;
15304
15305 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
15306 return -EINVAL;
15307
15308 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
15309 info->attrs[NL80211_ATTR_REKEY_DATA],
15310 nl80211_rekey_policy, info->extack);
15311 if (err)
15312 return err;
15313
15314 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
15315 !tb[NL80211_REKEY_DATA_KCK])
15316 return -EINVAL;
15317 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
15318 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15319 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
15320 return -ERANGE;
15321 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
15322 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15323 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
15324 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
15325 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
15326 return -ERANGE;
15327
15328 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
15329 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
15330 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
15331 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
15332 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
15333 if (tb[NL80211_REKEY_DATA_AKM])
15334 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
15335
15336 if (!wdev->connected)
15337 return -ENOTCONN;
15338
15339 if (!rdev->ops->set_rekey_data)
15340 return -EOPNOTSUPP;
15341
15342 return rdev_set_rekey_data(rdev, dev, &rekey_data);
15343 }
15344
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)15345 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
15346 struct genl_info *info)
15347 {
15348 struct net_device *dev = info->user_ptr[1];
15349 struct wireless_dev *wdev = dev->ieee80211_ptr;
15350
15351 if (wdev->iftype != NL80211_IFTYPE_AP &&
15352 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15353 return -EINVAL;
15354
15355 if (wdev->ap_unexpected_nlportid)
15356 return -EBUSY;
15357
15358 wdev->ap_unexpected_nlportid = info->snd_portid;
15359 return 0;
15360 }
15361
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)15362 static int nl80211_probe_client(struct sk_buff *skb,
15363 struct genl_info *info)
15364 {
15365 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15366 struct net_device *dev = info->user_ptr[1];
15367 struct wireless_dev *wdev = dev->ieee80211_ptr;
15368 struct sk_buff *msg;
15369 void *hdr;
15370 const u8 *addr;
15371 u64 cookie;
15372 int err;
15373
15374 if (wdev->iftype != NL80211_IFTYPE_AP &&
15375 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15376 return -EOPNOTSUPP;
15377
15378 if (!info->attrs[NL80211_ATTR_MAC])
15379 return -EINVAL;
15380
15381 if (!rdev->ops->probe_client)
15382 return -EOPNOTSUPP;
15383
15384 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15385 if (!msg)
15386 return -ENOMEM;
15387
15388 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15389 NL80211_CMD_PROBE_CLIENT);
15390 if (!hdr) {
15391 err = -ENOBUFS;
15392 goto free_msg;
15393 }
15394
15395 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15396
15397 err = rdev_probe_client(rdev, dev, addr, &cookie);
15398 if (err)
15399 goto free_msg;
15400
15401 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15402 NL80211_ATTR_PAD))
15403 goto nla_put_failure;
15404
15405 genlmsg_end(msg, hdr);
15406
15407 return genlmsg_reply(msg, info);
15408
15409 nla_put_failure:
15410 err = -ENOBUFS;
15411 free_msg:
15412 nlmsg_free(msg);
15413 return err;
15414 }
15415
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)15416 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
15417 {
15418 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15419 struct cfg80211_beacon_registration *reg, *nreg;
15420 int rv;
15421
15422 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
15423 return -EOPNOTSUPP;
15424
15425 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
15426 if (!nreg)
15427 return -ENOMEM;
15428
15429 /* First, check if already registered. */
15430 spin_lock_bh(&rdev->beacon_registrations_lock);
15431 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15432 if (reg->nlportid == info->snd_portid) {
15433 rv = -EALREADY;
15434 goto out_err;
15435 }
15436 }
15437 /* Add it to the list */
15438 nreg->nlportid = info->snd_portid;
15439 list_add(&nreg->list, &rdev->beacon_registrations);
15440
15441 spin_unlock_bh(&rdev->beacon_registrations_lock);
15442
15443 return 0;
15444 out_err:
15445 spin_unlock_bh(&rdev->beacon_registrations_lock);
15446 kfree(nreg);
15447 return rv;
15448 }
15449
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)15450 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
15451 {
15452 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15453 struct wireless_dev *wdev = info->user_ptr[1];
15454 int err;
15455
15456 if (!rdev->ops->start_p2p_device)
15457 return -EOPNOTSUPP;
15458
15459 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15460 return -EOPNOTSUPP;
15461
15462 if (wdev_running(wdev))
15463 return 0;
15464
15465 if (rfkill_blocked(rdev->wiphy.rfkill))
15466 return -ERFKILL;
15467
15468 err = rdev_start_p2p_device(rdev, wdev);
15469 if (err)
15470 return err;
15471
15472 wdev->is_running = true;
15473 rdev->opencount++;
15474
15475 return 0;
15476 }
15477
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)15478 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
15479 {
15480 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15481 struct wireless_dev *wdev = info->user_ptr[1];
15482
15483 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15484 return -EOPNOTSUPP;
15485
15486 if (!rdev->ops->stop_p2p_device)
15487 return -EOPNOTSUPP;
15488
15489 cfg80211_stop_p2p_device(rdev, wdev);
15490
15491 return 0;
15492 }
15493
nl80211_get_nan_channel(struct wiphy * wiphy,int freq)15494 static struct ieee80211_channel *nl80211_get_nan_channel(struct wiphy *wiphy,
15495 int freq)
15496 {
15497 struct ieee80211_channel *chan;
15498 struct cfg80211_chan_def def;
15499
15500 /* Check if the frequency is valid for NAN */
15501 if (freq != 5220 && freq != 5745 && freq != 2437)
15502 return NULL;
15503
15504 chan = ieee80211_get_channel(wiphy, freq);
15505 if (!chan)
15506 return NULL;
15507
15508 cfg80211_chandef_create(&def, chan, NL80211_CHAN_NO_HT);
15509
15510 /* Check if the channel is allowed */
15511 if (cfg80211_reg_can_beacon(wiphy, &def, NL80211_IFTYPE_NAN))
15512 return chan;
15513
15514 return NULL;
15515 }
15516
nl80211_parse_nan_band_config(struct wiphy * wiphy,struct nlattr ** tb,struct cfg80211_nan_band_config * cfg,enum nl80211_band band)15517 static int nl80211_parse_nan_band_config(struct wiphy *wiphy,
15518 struct nlattr **tb,
15519 struct cfg80211_nan_band_config *cfg,
15520 enum nl80211_band band)
15521 {
15522 if (BIT(band) & ~(u32)wiphy->nan_supported_bands)
15523 return -EINVAL;
15524
15525 if (tb[NL80211_NAN_BAND_CONF_FREQ]) {
15526 u16 freq = nla_get_u16(tb[NL80211_NAN_BAND_CONF_FREQ]);
15527
15528 if (band != NL80211_BAND_5GHZ)
15529 return -EINVAL;
15530
15531 cfg->chan = nl80211_get_nan_channel(wiphy, freq);
15532 if (!cfg->chan)
15533 return -EINVAL;
15534 }
15535
15536 if (tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]) {
15537 cfg->rssi_close =
15538 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]);
15539 if (!tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE])
15540 return -EINVAL;
15541 }
15542
15543 if (tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]) {
15544 cfg->rssi_middle =
15545 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]);
15546 if (!cfg->rssi_close || cfg->rssi_middle >= cfg->rssi_close)
15547 return -EINVAL;
15548 }
15549
15550 if (tb[NL80211_NAN_BAND_CONF_WAKE_DW]) {
15551 cfg->awake_dw_interval =
15552 nla_get_u8(tb[NL80211_NAN_BAND_CONF_WAKE_DW]);
15553
15554 if (band == NL80211_BAND_2GHZ && cfg->awake_dw_interval == 0)
15555 return -EINVAL;
15556 }
15557
15558 cfg->disable_scan =
15559 nla_get_flag(tb[NL80211_NAN_BAND_CONF_DISABLE_SCAN]);
15560 return 0;
15561 }
15562
nl80211_parse_nan_conf(struct wiphy * wiphy,struct genl_info * info,struct cfg80211_nan_conf * conf,u32 * changed_flags)15563 static int nl80211_parse_nan_conf(struct wiphy *wiphy,
15564 struct genl_info *info,
15565 struct cfg80211_nan_conf *conf,
15566 u32 *changed_flags)
15567 {
15568 struct nlattr *attrs[NL80211_NAN_CONF_ATTR_MAX + 1];
15569 int err, rem;
15570 u32 changed = 0;
15571 struct nlattr *band_config;
15572
15573 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
15574 conf->master_pref =
15575 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
15576
15577 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
15578 }
15579
15580 if (info->attrs[NL80211_ATTR_BANDS]) {
15581 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
15582
15583 if (bands & ~(u32)wiphy->nan_supported_bands)
15584 return -EOPNOTSUPP;
15585
15586 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
15587 return -EINVAL;
15588
15589 conf->bands = bands;
15590 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
15591 }
15592
15593 conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval = 1;
15594 if (conf->bands & BIT(NL80211_BAND_5GHZ) || !conf->bands)
15595 conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval = 1;
15596
15597 /* On 2.4 GHz band use channel 6 */
15598 conf->band_cfgs[NL80211_BAND_2GHZ].chan =
15599 nl80211_get_nan_channel(wiphy, 2437);
15600 if (!conf->band_cfgs[NL80211_BAND_2GHZ].chan)
15601 return -EINVAL;
15602
15603 if (!info->attrs[NL80211_ATTR_NAN_CONFIG])
15604 goto out;
15605
15606 err = nla_parse_nested(attrs, NL80211_NAN_CONF_ATTR_MAX,
15607 info->attrs[NL80211_ATTR_NAN_CONFIG], NULL,
15608 info->extack);
15609 if (err)
15610 return err;
15611
15612 changed |= CFG80211_NAN_CONF_CHANGED_CONFIG;
15613 if (attrs[NL80211_NAN_CONF_CLUSTER_ID])
15614 conf->cluster_id =
15615 nla_data(attrs[NL80211_NAN_CONF_CLUSTER_ID]);
15616
15617 if (attrs[NL80211_NAN_CONF_EXTRA_ATTRS]) {
15618 conf->extra_nan_attrs =
15619 nla_data(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15620 conf->extra_nan_attrs_len =
15621 nla_len(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15622 }
15623
15624 if (attrs[NL80211_NAN_CONF_VENDOR_ELEMS]) {
15625 conf->vendor_elems =
15626 nla_data(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15627 conf->vendor_elems_len =
15628 nla_len(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15629 }
15630
15631 if (attrs[NL80211_NAN_CONF_BAND_CONFIGS]) {
15632 nla_for_each_nested(band_config,
15633 attrs[NL80211_NAN_CONF_BAND_CONFIGS],
15634 rem) {
15635 enum nl80211_band band;
15636 struct cfg80211_nan_band_config *cfg;
15637 struct nlattr *tb[NL80211_NAN_BAND_CONF_ATTR_MAX + 1];
15638
15639 err = nla_parse_nested(tb,
15640 NL80211_NAN_BAND_CONF_ATTR_MAX,
15641 band_config, NULL,
15642 info->extack);
15643 if (err)
15644 return err;
15645
15646 if (!tb[NL80211_NAN_BAND_CONF_BAND])
15647 return -EINVAL;
15648
15649 band = nla_get_u8(tb[NL80211_NAN_BAND_CONF_BAND]);
15650 if (conf->bands && !(conf->bands & BIT(band)))
15651 return -EINVAL;
15652
15653 cfg = &conf->band_cfgs[band];
15654
15655 err = nl80211_parse_nan_band_config(wiphy, tb, cfg,
15656 band);
15657 if (err)
15658 return err;
15659 }
15660 }
15661
15662 if (attrs[NL80211_NAN_CONF_SCAN_PERIOD])
15663 conf->scan_period =
15664 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_PERIOD]);
15665
15666 if (attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME])
15667 conf->scan_dwell_time =
15668 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME]);
15669
15670 if (attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL])
15671 conf->discovery_beacon_interval =
15672 nla_get_u8(attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL]);
15673
15674 if (attrs[NL80211_NAN_CONF_NOTIFY_DW])
15675 conf->enable_dw_notification =
15676 nla_get_flag(attrs[NL80211_NAN_CONF_NOTIFY_DW]);
15677
15678 out:
15679 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15680 (!conf->bands || conf->bands & BIT(NL80211_BAND_5GHZ))) {
15681 /* If no 5GHz channel is specified use default, if possible */
15682 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15683 nl80211_get_nan_channel(wiphy, 5745);
15684 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan)
15685 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15686 nl80211_get_nan_channel(wiphy, 5220);
15687
15688 /* Return error if user space asked explicitly for 5 GHz */
15689 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15690 conf->bands & BIT(NL80211_BAND_5GHZ)) {
15691 NL_SET_ERR_MSG_ATTR(info->extack,
15692 info->attrs[NL80211_ATTR_BANDS],
15693 "5 GHz band operation is not allowed");
15694 return -EINVAL;
15695 }
15696 }
15697
15698 if (changed_flags)
15699 *changed_flags = changed;
15700
15701 return 0;
15702 }
15703
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)15704 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
15705 {
15706 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15707 struct wireless_dev *wdev = info->user_ptr[1];
15708 struct cfg80211_nan_conf conf = {};
15709 int err;
15710
15711 if (wdev->iftype != NL80211_IFTYPE_NAN)
15712 return -EOPNOTSUPP;
15713
15714 if (wdev_running(wdev))
15715 return -EEXIST;
15716
15717 if (rfkill_blocked(rdev->wiphy.rfkill))
15718 return -ERFKILL;
15719
15720 /* Master preference is mandatory for START_NAN */
15721 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
15722 return -EINVAL;
15723
15724 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, NULL);
15725 if (err)
15726 return err;
15727
15728 err = rdev_start_nan(rdev, wdev, &conf);
15729 if (err)
15730 return err;
15731
15732 wdev->is_running = true;
15733 rdev->opencount++;
15734
15735 return 0;
15736 }
15737
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)15738 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
15739 {
15740 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15741 struct wireless_dev *wdev = info->user_ptr[1];
15742
15743 if (wdev->iftype != NL80211_IFTYPE_NAN)
15744 return -EOPNOTSUPP;
15745
15746 cfg80211_stop_nan(rdev, wdev);
15747
15748 return 0;
15749 }
15750
validate_nan_filter(struct nlattr * filter_attr)15751 static int validate_nan_filter(struct nlattr *filter_attr)
15752 {
15753 struct nlattr *attr;
15754 int len = 0, n_entries = 0, rem;
15755
15756 nla_for_each_nested(attr, filter_attr, rem) {
15757 len += nla_len(attr);
15758 n_entries++;
15759 }
15760
15761 if (len >= U8_MAX)
15762 return -EINVAL;
15763
15764 return n_entries;
15765 }
15766
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)15767 static int handle_nan_filter(struct nlattr *attr_filter,
15768 struct cfg80211_nan_func *func,
15769 bool tx)
15770 {
15771 struct nlattr *attr;
15772 int n_entries, rem, i;
15773 struct cfg80211_nan_func_filter *filter;
15774
15775 n_entries = validate_nan_filter(attr_filter);
15776 if (n_entries < 0)
15777 return n_entries;
15778
15779 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
15780
15781 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
15782 if (!filter)
15783 return -ENOMEM;
15784
15785 i = 0;
15786 nla_for_each_nested(attr, attr_filter, rem) {
15787 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
15788 if (!filter[i].filter)
15789 goto err;
15790
15791 filter[i].len = nla_len(attr);
15792 i++;
15793 }
15794 if (tx) {
15795 func->num_tx_filters = n_entries;
15796 func->tx_filters = filter;
15797 } else {
15798 func->num_rx_filters = n_entries;
15799 func->rx_filters = filter;
15800 }
15801
15802 return 0;
15803
15804 err:
15805 i = 0;
15806 nla_for_each_nested(attr, attr_filter, rem) {
15807 kfree(filter[i].filter);
15808 i++;
15809 }
15810 kfree(filter);
15811 return -ENOMEM;
15812 }
15813
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)15814 static int nl80211_nan_add_func(struct sk_buff *skb,
15815 struct genl_info *info)
15816 {
15817 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15818 struct wireless_dev *wdev = info->user_ptr[1];
15819 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
15820 struct cfg80211_nan_func *func;
15821 struct sk_buff *msg = NULL;
15822 void *hdr = NULL;
15823 int err = 0;
15824
15825 if (wdev->iftype != NL80211_IFTYPE_NAN)
15826 return -EOPNOTSUPP;
15827
15828 if (!wdev_running(wdev))
15829 return -ENOTCONN;
15830
15831 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
15832 return -EINVAL;
15833
15834 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
15835 info->attrs[NL80211_ATTR_NAN_FUNC],
15836 nl80211_nan_func_policy,
15837 info->extack);
15838 if (err)
15839 return err;
15840
15841 func = kzalloc(sizeof(*func), GFP_KERNEL);
15842 if (!func)
15843 return -ENOMEM;
15844
15845 func->cookie = cfg80211_assign_cookie(rdev);
15846
15847 if (!tb[NL80211_NAN_FUNC_TYPE]) {
15848 err = -EINVAL;
15849 goto out;
15850 }
15851
15852
15853 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
15854
15855 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
15856 err = -EINVAL;
15857 goto out;
15858 }
15859
15860 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
15861 sizeof(func->service_id));
15862
15863 func->close_range =
15864 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
15865
15866 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
15867 func->serv_spec_info_len =
15868 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
15869 func->serv_spec_info =
15870 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
15871 func->serv_spec_info_len,
15872 GFP_KERNEL);
15873 if (!func->serv_spec_info) {
15874 err = -ENOMEM;
15875 goto out;
15876 }
15877 }
15878
15879 if (tb[NL80211_NAN_FUNC_TTL])
15880 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
15881
15882 switch (func->type) {
15883 case NL80211_NAN_FUNC_PUBLISH:
15884 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
15885 err = -EINVAL;
15886 goto out;
15887 }
15888
15889 func->publish_type =
15890 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
15891 func->publish_bcast =
15892 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
15893
15894 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
15895 func->publish_bcast) {
15896 err = -EINVAL;
15897 goto out;
15898 }
15899 break;
15900 case NL80211_NAN_FUNC_SUBSCRIBE:
15901 func->subscribe_active =
15902 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
15903 break;
15904 case NL80211_NAN_FUNC_FOLLOW_UP:
15905 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
15906 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
15907 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
15908 err = -EINVAL;
15909 goto out;
15910 }
15911
15912 func->followup_id =
15913 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
15914 func->followup_reqid =
15915 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
15916 memcpy(func->followup_dest.addr,
15917 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
15918 sizeof(func->followup_dest.addr));
15919 if (func->ttl) {
15920 err = -EINVAL;
15921 goto out;
15922 }
15923 break;
15924 default:
15925 err = -EINVAL;
15926 goto out;
15927 }
15928
15929 if (tb[NL80211_NAN_FUNC_SRF]) {
15930 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
15931
15932 err = nla_parse_nested_deprecated(srf_tb,
15933 NL80211_NAN_SRF_ATTR_MAX,
15934 tb[NL80211_NAN_FUNC_SRF],
15935 nl80211_nan_srf_policy,
15936 info->extack);
15937 if (err)
15938 goto out;
15939
15940 func->srf_include =
15941 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
15942
15943 if (srf_tb[NL80211_NAN_SRF_BF]) {
15944 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
15945 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
15946 err = -EINVAL;
15947 goto out;
15948 }
15949
15950 func->srf_bf_len =
15951 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
15952 func->srf_bf =
15953 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
15954 func->srf_bf_len, GFP_KERNEL);
15955 if (!func->srf_bf) {
15956 err = -ENOMEM;
15957 goto out;
15958 }
15959
15960 func->srf_bf_idx =
15961 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
15962 } else {
15963 struct nlattr *attr, *mac_attr =
15964 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
15965 int n_entries, rem, i = 0;
15966
15967 if (!mac_attr) {
15968 err = -EINVAL;
15969 goto out;
15970 }
15971
15972 n_entries = validate_acl_mac_addrs(mac_attr);
15973 if (n_entries <= 0) {
15974 err = -EINVAL;
15975 goto out;
15976 }
15977
15978 func->srf_num_macs = n_entries;
15979 func->srf_macs =
15980 kcalloc(n_entries, sizeof(*func->srf_macs),
15981 GFP_KERNEL);
15982 if (!func->srf_macs) {
15983 err = -ENOMEM;
15984 goto out;
15985 }
15986
15987 nla_for_each_nested(attr, mac_attr, rem)
15988 memcpy(func->srf_macs[i++].addr, nla_data(attr),
15989 sizeof(*func->srf_macs));
15990 }
15991 }
15992
15993 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
15994 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
15995 func, true);
15996 if (err)
15997 goto out;
15998 }
15999
16000 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
16001 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
16002 func, false);
16003 if (err)
16004 goto out;
16005 }
16006
16007 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16008 if (!msg) {
16009 err = -ENOMEM;
16010 goto out;
16011 }
16012
16013 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16014 NL80211_CMD_ADD_NAN_FUNCTION);
16015 /* This can't really happen - we just allocated 4KB */
16016 if (WARN_ON(!hdr)) {
16017 err = -ENOMEM;
16018 goto out;
16019 }
16020
16021 err = rdev_add_nan_func(rdev, wdev, func);
16022 out:
16023 if (err < 0) {
16024 cfg80211_free_nan_func(func);
16025 nlmsg_free(msg);
16026 return err;
16027 }
16028
16029 /* propagate the instance id and cookie to userspace */
16030 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
16031 NL80211_ATTR_PAD))
16032 goto nla_put_failure;
16033
16034 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16035 if (!func_attr)
16036 goto nla_put_failure;
16037
16038 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
16039 func->instance_id))
16040 goto nla_put_failure;
16041
16042 nla_nest_end(msg, func_attr);
16043
16044 genlmsg_end(msg, hdr);
16045 return genlmsg_reply(msg, info);
16046
16047 nla_put_failure:
16048 nlmsg_free(msg);
16049 return -ENOBUFS;
16050 }
16051
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)16052 static int nl80211_nan_del_func(struct sk_buff *skb,
16053 struct genl_info *info)
16054 {
16055 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16056 struct wireless_dev *wdev = info->user_ptr[1];
16057 u64 cookie;
16058
16059 if (wdev->iftype != NL80211_IFTYPE_NAN)
16060 return -EOPNOTSUPP;
16061
16062 if (!wdev_running(wdev))
16063 return -ENOTCONN;
16064
16065 if (!info->attrs[NL80211_ATTR_COOKIE])
16066 return -EINVAL;
16067
16068 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
16069
16070 rdev_del_nan_func(rdev, wdev, cookie);
16071
16072 return 0;
16073 }
16074
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)16075 static int nl80211_nan_change_config(struct sk_buff *skb,
16076 struct genl_info *info)
16077 {
16078 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16079 struct wireless_dev *wdev = info->user_ptr[1];
16080 struct cfg80211_nan_conf conf = {};
16081 u32 changed = 0;
16082 int err;
16083
16084 if (wdev->iftype != NL80211_IFTYPE_NAN)
16085 return -EOPNOTSUPP;
16086
16087 if (!wdev_running(wdev))
16088 return -ENOTCONN;
16089
16090 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, &changed);
16091 if (err)
16092 return err;
16093
16094 if (!changed)
16095 return -EINVAL;
16096
16097 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
16098 }
16099
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)16100 void cfg80211_nan_match(struct wireless_dev *wdev,
16101 struct cfg80211_nan_match_params *match, gfp_t gfp)
16102 {
16103 struct wiphy *wiphy = wdev->wiphy;
16104 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16105 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
16106 struct sk_buff *msg;
16107 void *hdr;
16108
16109 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
16110 return;
16111
16112 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16113 if (!msg)
16114 return;
16115
16116 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
16117 if (!hdr) {
16118 nlmsg_free(msg);
16119 return;
16120 }
16121
16122 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16123 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16124 wdev->netdev->ifindex)) ||
16125 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16126 NL80211_ATTR_PAD))
16127 goto nla_put_failure;
16128
16129 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
16130 NL80211_ATTR_PAD) ||
16131 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
16132 goto nla_put_failure;
16133
16134 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
16135 if (!match_attr)
16136 goto nla_put_failure;
16137
16138 local_func_attr = nla_nest_start_noflag(msg,
16139 NL80211_NAN_MATCH_FUNC_LOCAL);
16140 if (!local_func_attr)
16141 goto nla_put_failure;
16142
16143 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
16144 goto nla_put_failure;
16145
16146 nla_nest_end(msg, local_func_attr);
16147
16148 peer_func_attr = nla_nest_start_noflag(msg,
16149 NL80211_NAN_MATCH_FUNC_PEER);
16150 if (!peer_func_attr)
16151 goto nla_put_failure;
16152
16153 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
16154 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
16155 goto nla_put_failure;
16156
16157 if (match->info && match->info_len &&
16158 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
16159 match->info))
16160 goto nla_put_failure;
16161
16162 nla_nest_end(msg, peer_func_attr);
16163 nla_nest_end(msg, match_attr);
16164 genlmsg_end(msg, hdr);
16165
16166 if (!wdev->owner_nlportid)
16167 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16168 msg, 0, NL80211_MCGRP_NAN, gfp);
16169 else
16170 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16171 wdev->owner_nlportid);
16172
16173 return;
16174
16175 nla_put_failure:
16176 nlmsg_free(msg);
16177 }
16178 EXPORT_SYMBOL(cfg80211_nan_match);
16179
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)16180 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
16181 u8 inst_id,
16182 enum nl80211_nan_func_term_reason reason,
16183 u64 cookie, gfp_t gfp)
16184 {
16185 struct wiphy *wiphy = wdev->wiphy;
16186 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16187 struct sk_buff *msg;
16188 struct nlattr *func_attr;
16189 void *hdr;
16190
16191 if (WARN_ON(!inst_id))
16192 return;
16193
16194 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16195 if (!msg)
16196 return;
16197
16198 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
16199 if (!hdr) {
16200 nlmsg_free(msg);
16201 return;
16202 }
16203
16204 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16205 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16206 wdev->netdev->ifindex)) ||
16207 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16208 NL80211_ATTR_PAD))
16209 goto nla_put_failure;
16210
16211 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16212 NL80211_ATTR_PAD))
16213 goto nla_put_failure;
16214
16215 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16216 if (!func_attr)
16217 goto nla_put_failure;
16218
16219 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
16220 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
16221 goto nla_put_failure;
16222
16223 nla_nest_end(msg, func_attr);
16224 genlmsg_end(msg, hdr);
16225
16226 if (!wdev->owner_nlportid)
16227 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16228 msg, 0, NL80211_MCGRP_NAN, gfp);
16229 else
16230 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16231 wdev->owner_nlportid);
16232
16233 return;
16234
16235 nla_put_failure:
16236 nlmsg_free(msg);
16237 }
16238 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
16239
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)16240 static int nl80211_get_protocol_features(struct sk_buff *skb,
16241 struct genl_info *info)
16242 {
16243 void *hdr;
16244 struct sk_buff *msg;
16245
16246 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16247 if (!msg)
16248 return -ENOMEM;
16249
16250 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16251 NL80211_CMD_GET_PROTOCOL_FEATURES);
16252 if (!hdr)
16253 goto nla_put_failure;
16254
16255 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
16256 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
16257 goto nla_put_failure;
16258
16259 genlmsg_end(msg, hdr);
16260 return genlmsg_reply(msg, info);
16261
16262 nla_put_failure:
16263 kfree_skb(msg);
16264 return -ENOBUFS;
16265 }
16266
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)16267 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
16268 {
16269 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16270 struct cfg80211_update_ft_ies_params ft_params;
16271 struct net_device *dev = info->user_ptr[1];
16272
16273 if (!rdev->ops->update_ft_ies)
16274 return -EOPNOTSUPP;
16275
16276 if (!info->attrs[NL80211_ATTR_MDID] ||
16277 !info->attrs[NL80211_ATTR_IE])
16278 return -EINVAL;
16279
16280 memset(&ft_params, 0, sizeof(ft_params));
16281 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
16282 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
16283 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
16284
16285 return rdev_update_ft_ies(rdev, dev, &ft_params);
16286 }
16287
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)16288 static int nl80211_crit_protocol_start(struct sk_buff *skb,
16289 struct genl_info *info)
16290 {
16291 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16292 struct wireless_dev *wdev = info->user_ptr[1];
16293 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
16294 u16 duration;
16295 int ret;
16296
16297 if (!rdev->ops->crit_proto_start)
16298 return -EOPNOTSUPP;
16299
16300 if (WARN_ON(!rdev->ops->crit_proto_stop))
16301 return -EINVAL;
16302
16303 if (rdev->crit_proto_nlportid)
16304 return -EBUSY;
16305
16306 /* determine protocol if provided */
16307 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
16308 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
16309
16310 if (proto >= NUM_NL80211_CRIT_PROTO)
16311 return -EINVAL;
16312
16313 /* timeout must be provided */
16314 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
16315 return -EINVAL;
16316
16317 duration =
16318 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
16319
16320 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
16321 if (!ret)
16322 rdev->crit_proto_nlportid = info->snd_portid;
16323
16324 return ret;
16325 }
16326
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)16327 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
16328 struct genl_info *info)
16329 {
16330 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16331 struct wireless_dev *wdev = info->user_ptr[1];
16332
16333 if (!rdev->ops->crit_proto_stop)
16334 return -EOPNOTSUPP;
16335
16336 if (rdev->crit_proto_nlportid) {
16337 rdev->crit_proto_nlportid = 0;
16338 rdev_crit_proto_stop(rdev, wdev);
16339 }
16340 return 0;
16341 }
16342
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)16343 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
16344 struct nlattr *attr,
16345 struct netlink_ext_ack *extack)
16346 {
16347 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
16348 if (attr->nla_type & NLA_F_NESTED) {
16349 NL_SET_ERR_MSG_ATTR(extack, attr,
16350 "unexpected nested data");
16351 return -EINVAL;
16352 }
16353
16354 return 0;
16355 }
16356
16357 if (!(attr->nla_type & NLA_F_NESTED)) {
16358 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
16359 return -EINVAL;
16360 }
16361
16362 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
16363 }
16364
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)16365 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
16366 {
16367 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16368 struct wireless_dev *wdev =
16369 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
16370 info->attrs);
16371 int i, err;
16372 u32 vid, subcmd;
16373
16374 if (!rdev->wiphy.vendor_commands)
16375 return -EOPNOTSUPP;
16376
16377 if (IS_ERR(wdev)) {
16378 err = PTR_ERR(wdev);
16379 if (err != -EINVAL)
16380 return err;
16381 wdev = NULL;
16382 } else if (wdev->wiphy != &rdev->wiphy) {
16383 return -EINVAL;
16384 }
16385
16386 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
16387 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
16388 return -EINVAL;
16389
16390 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
16391 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
16392 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
16393 const struct wiphy_vendor_command *vcmd;
16394 void *data = NULL;
16395 int len = 0;
16396
16397 vcmd = &rdev->wiphy.vendor_commands[i];
16398
16399 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16400 continue;
16401
16402 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16403 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16404 if (!wdev)
16405 return -EINVAL;
16406 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16407 !wdev->netdev)
16408 return -EINVAL;
16409
16410 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16411 if (!wdev_running(wdev))
16412 return -ENETDOWN;
16413 }
16414 } else {
16415 wdev = NULL;
16416 }
16417
16418 if (!vcmd->doit)
16419 return -EOPNOTSUPP;
16420
16421 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
16422 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16423 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16424
16425 err = nl80211_vendor_check_policy(vcmd,
16426 info->attrs[NL80211_ATTR_VENDOR_DATA],
16427 info->extack);
16428 if (err)
16429 return err;
16430 }
16431
16432 rdev->cur_cmd_info = info;
16433 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
16434 rdev->cur_cmd_info = NULL;
16435 return err;
16436 }
16437
16438 return -EOPNOTSUPP;
16439 }
16440
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)16441 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
16442 struct netlink_callback *cb,
16443 struct cfg80211_registered_device **rdev,
16444 struct wireless_dev **wdev)
16445 {
16446 struct nlattr **attrbuf;
16447 u32 vid, subcmd;
16448 unsigned int i;
16449 int vcmd_idx = -1;
16450 int err;
16451 void *data = NULL;
16452 unsigned int data_len = 0;
16453
16454 if (cb->args[0]) {
16455 /* subtract the 1 again here */
16456 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
16457 struct wireless_dev *tmp;
16458
16459 if (!wiphy)
16460 return -ENODEV;
16461 *rdev = wiphy_to_rdev(wiphy);
16462 *wdev = NULL;
16463
16464 if (cb->args[1]) {
16465 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
16466 if (tmp->identifier == cb->args[1] - 1) {
16467 *wdev = tmp;
16468 break;
16469 }
16470 }
16471 }
16472
16473 /* keep rtnl locked in successful case */
16474 return 0;
16475 }
16476
16477 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
16478 if (!attrbuf)
16479 return -ENOMEM;
16480
16481 err = nlmsg_parse_deprecated(cb->nlh,
16482 GENL_HDRLEN + nl80211_fam.hdrsize,
16483 attrbuf, nl80211_fam.maxattr,
16484 nl80211_policy, NULL);
16485 if (err)
16486 goto out;
16487
16488 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
16489 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
16490 err = -EINVAL;
16491 goto out;
16492 }
16493
16494 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
16495 if (IS_ERR(*wdev))
16496 *wdev = NULL;
16497
16498 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
16499 if (IS_ERR(*rdev)) {
16500 err = PTR_ERR(*rdev);
16501 goto out;
16502 }
16503
16504 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
16505 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
16506
16507 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
16508 const struct wiphy_vendor_command *vcmd;
16509
16510 vcmd = &(*rdev)->wiphy.vendor_commands[i];
16511
16512 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16513 continue;
16514
16515 if (!vcmd->dumpit) {
16516 err = -EOPNOTSUPP;
16517 goto out;
16518 }
16519
16520 vcmd_idx = i;
16521 break;
16522 }
16523
16524 if (vcmd_idx < 0) {
16525 err = -EOPNOTSUPP;
16526 goto out;
16527 }
16528
16529 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
16530 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16531 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16532
16533 err = nl80211_vendor_check_policy(
16534 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
16535 attrbuf[NL80211_ATTR_VENDOR_DATA],
16536 cb->extack);
16537 if (err)
16538 goto out;
16539 }
16540
16541 /* 0 is the first index - add 1 to parse only once */
16542 cb->args[0] = (*rdev)->wiphy_idx + 1;
16543 /* add 1 to know if it was NULL */
16544 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
16545 cb->args[2] = vcmd_idx;
16546 cb->args[3] = (unsigned long)data;
16547 cb->args[4] = data_len;
16548
16549 /* keep rtnl locked in successful case */
16550 err = 0;
16551 out:
16552 kfree(attrbuf);
16553 return err;
16554 }
16555
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)16556 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
16557 struct netlink_callback *cb)
16558 {
16559 struct cfg80211_registered_device *rdev;
16560 struct wireless_dev *wdev;
16561 unsigned int vcmd_idx;
16562 const struct wiphy_vendor_command *vcmd;
16563 void *data;
16564 int data_len;
16565 int err;
16566 struct nlattr *vendor_data;
16567
16568 rtnl_lock();
16569 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
16570 if (err)
16571 goto out;
16572
16573 vcmd_idx = cb->args[2];
16574 data = (void *)cb->args[3];
16575 data_len = cb->args[4];
16576 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
16577
16578 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16579 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16580 if (!wdev) {
16581 err = -EINVAL;
16582 goto out;
16583 }
16584 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16585 !wdev->netdev) {
16586 err = -EINVAL;
16587 goto out;
16588 }
16589
16590 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16591 if (!wdev_running(wdev)) {
16592 err = -ENETDOWN;
16593 goto out;
16594 }
16595 }
16596 }
16597
16598 while (1) {
16599 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
16600 cb->nlh->nlmsg_seq, NLM_F_MULTI,
16601 NL80211_CMD_VENDOR);
16602 if (!hdr)
16603 break;
16604
16605 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16606 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
16607 wdev_id(wdev),
16608 NL80211_ATTR_PAD))) {
16609 genlmsg_cancel(skb, hdr);
16610 break;
16611 }
16612
16613 vendor_data = nla_nest_start_noflag(skb,
16614 NL80211_ATTR_VENDOR_DATA);
16615 if (!vendor_data) {
16616 genlmsg_cancel(skb, hdr);
16617 break;
16618 }
16619
16620 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
16621 (unsigned long *)&cb->args[5]);
16622 nla_nest_end(skb, vendor_data);
16623
16624 if (err == -ENOBUFS || err == -ENOENT) {
16625 genlmsg_cancel(skb, hdr);
16626 break;
16627 } else if (err <= 0) {
16628 genlmsg_cancel(skb, hdr);
16629 goto out;
16630 }
16631
16632 genlmsg_end(skb, hdr);
16633 }
16634
16635 err = skb->len;
16636 out:
16637 rtnl_unlock();
16638 return err;
16639 }
16640
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)16641 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
16642 enum nl80211_commands cmd,
16643 enum nl80211_attrs attr,
16644 int approxlen)
16645 {
16646 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16647
16648 if (WARN_ON(!rdev->cur_cmd_info))
16649 return NULL;
16650
16651 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
16652 rdev->cur_cmd_info->snd_portid,
16653 rdev->cur_cmd_info->snd_seq,
16654 cmd, attr, NULL, GFP_KERNEL);
16655 }
16656 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
16657
cfg80211_vendor_cmd_reply(struct sk_buff * skb)16658 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
16659 {
16660 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
16661 void *hdr = ((void **)skb->cb)[1];
16662 struct nlattr *data = ((void **)skb->cb)[2];
16663
16664 /* clear CB data for netlink core to own from now on */
16665 memset(skb->cb, 0, sizeof(skb->cb));
16666
16667 if (WARN_ON(!rdev->cur_cmd_info)) {
16668 kfree_skb(skb);
16669 return -EINVAL;
16670 }
16671
16672 nla_nest_end(skb, data);
16673 genlmsg_end(skb, hdr);
16674 return genlmsg_reply(skb, rdev->cur_cmd_info);
16675 }
16676 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
16677
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)16678 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
16679 {
16680 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16681
16682 if (WARN_ON(!rdev->cur_cmd_info))
16683 return 0;
16684
16685 return rdev->cur_cmd_info->snd_portid;
16686 }
16687 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
16688
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)16689 static int nl80211_set_qos_map(struct sk_buff *skb,
16690 struct genl_info *info)
16691 {
16692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16693 struct cfg80211_qos_map *qos_map = NULL;
16694 struct net_device *dev = info->user_ptr[1];
16695 u8 *pos, len, num_des, des_len, des;
16696 int ret;
16697
16698 if (!rdev->ops->set_qos_map)
16699 return -EOPNOTSUPP;
16700
16701 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
16702 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
16703 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
16704
16705 if (len % 2)
16706 return -EINVAL;
16707
16708 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
16709 if (!qos_map)
16710 return -ENOMEM;
16711
16712 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
16713 if (num_des) {
16714 des_len = num_des *
16715 sizeof(struct cfg80211_dscp_exception);
16716 memcpy(qos_map->dscp_exception, pos, des_len);
16717 qos_map->num_des = num_des;
16718 for (des = 0; des < num_des; des++) {
16719 if (qos_map->dscp_exception[des].up > 7) {
16720 kfree(qos_map);
16721 return -EINVAL;
16722 }
16723 }
16724 pos += des_len;
16725 }
16726 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
16727 }
16728
16729 ret = nl80211_key_allowed(dev->ieee80211_ptr);
16730 if (!ret)
16731 ret = rdev_set_qos_map(rdev, dev, qos_map);
16732
16733 kfree(qos_map);
16734 return ret;
16735 }
16736
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)16737 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
16738 {
16739 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16740 struct net_device *dev = info->user_ptr[1];
16741 struct wireless_dev *wdev = dev->ieee80211_ptr;
16742 const u8 *peer;
16743 u8 tsid, up;
16744 u16 admitted_time = 0;
16745
16746 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
16747 return -EOPNOTSUPP;
16748
16749 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
16750 !info->attrs[NL80211_ATTR_USER_PRIO])
16751 return -EINVAL;
16752
16753 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16754 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
16755
16756 /* WMM uses TIDs 0-7 even for TSPEC */
16757 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
16758 /* TODO: handle 802.11 TSPEC/admission control
16759 * need more attributes for that (e.g. BA session requirement);
16760 * change the WMM admission test above to allow both then
16761 */
16762 return -EINVAL;
16763 }
16764
16765 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16766
16767 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
16768 admitted_time =
16769 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
16770 if (!admitted_time)
16771 return -EINVAL;
16772 }
16773
16774 switch (wdev->iftype) {
16775 case NL80211_IFTYPE_STATION:
16776 case NL80211_IFTYPE_P2P_CLIENT:
16777 if (wdev->connected)
16778 break;
16779 return -ENOTCONN;
16780 default:
16781 return -EOPNOTSUPP;
16782 }
16783
16784 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
16785 }
16786
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)16787 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
16788 {
16789 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16790 struct net_device *dev = info->user_ptr[1];
16791 const u8 *peer;
16792 u8 tsid;
16793
16794 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
16795 return -EINVAL;
16796
16797 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16798 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16799
16800 return rdev_del_tx_ts(rdev, dev, tsid, peer);
16801 }
16802
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)16803 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
16804 struct genl_info *info)
16805 {
16806 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16807 struct net_device *dev = info->user_ptr[1];
16808 struct wireless_dev *wdev = dev->ieee80211_ptr;
16809 struct cfg80211_chan_def chandef = {};
16810 const u8 *addr;
16811 u8 oper_class;
16812 int err;
16813
16814 if (!rdev->ops->tdls_channel_switch ||
16815 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16816 return -EOPNOTSUPP;
16817
16818 switch (dev->ieee80211_ptr->iftype) {
16819 case NL80211_IFTYPE_STATION:
16820 case NL80211_IFTYPE_P2P_CLIENT:
16821 break;
16822 default:
16823 return -EOPNOTSUPP;
16824 }
16825
16826 if (!info->attrs[NL80211_ATTR_MAC] ||
16827 !info->attrs[NL80211_ATTR_OPER_CLASS])
16828 return -EINVAL;
16829
16830 err = nl80211_parse_chandef(rdev, info, &chandef);
16831 if (err)
16832 return err;
16833
16834 /*
16835 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
16836 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
16837 * specification is not defined for them.
16838 */
16839 if (chandef.chan->band == NL80211_BAND_2GHZ &&
16840 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
16841 chandef.width != NL80211_CHAN_WIDTH_20)
16842 return -EINVAL;
16843
16844 /* we will be active on the TDLS link */
16845 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
16846 wdev->iftype))
16847 return -EINVAL;
16848
16849 /* don't allow switching to DFS channels */
16850 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
16851 return -EINVAL;
16852
16853 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16854 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
16855
16856 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
16857 }
16858
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)16859 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
16860 struct genl_info *info)
16861 {
16862 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16863 struct net_device *dev = info->user_ptr[1];
16864 const u8 *addr;
16865
16866 if (!rdev->ops->tdls_channel_switch ||
16867 !rdev->ops->tdls_cancel_channel_switch ||
16868 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16869 return -EOPNOTSUPP;
16870
16871 switch (dev->ieee80211_ptr->iftype) {
16872 case NL80211_IFTYPE_STATION:
16873 case NL80211_IFTYPE_P2P_CLIENT:
16874 break;
16875 default:
16876 return -EOPNOTSUPP;
16877 }
16878
16879 if (!info->attrs[NL80211_ATTR_MAC])
16880 return -EINVAL;
16881
16882 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16883
16884 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
16885
16886 return 0;
16887 }
16888
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)16889 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
16890 struct genl_info *info)
16891 {
16892 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16893 struct net_device *dev = info->user_ptr[1];
16894 struct wireless_dev *wdev = dev->ieee80211_ptr;
16895 const struct nlattr *nla;
16896 bool enabled;
16897
16898 if (!rdev->ops->set_multicast_to_unicast)
16899 return -EOPNOTSUPP;
16900
16901 if (wdev->iftype != NL80211_IFTYPE_AP &&
16902 wdev->iftype != NL80211_IFTYPE_P2P_GO)
16903 return -EOPNOTSUPP;
16904
16905 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
16906 enabled = nla_get_flag(nla);
16907
16908 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
16909 }
16910
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)16911 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
16912 {
16913 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16914 struct net_device *dev = info->user_ptr[1];
16915 struct wireless_dev *wdev = dev->ieee80211_ptr;
16916 struct cfg80211_pmk_conf pmk_conf = {};
16917
16918 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16919 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16920 return -EOPNOTSUPP;
16921
16922 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16923 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16924 return -EOPNOTSUPP;
16925
16926 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
16927 return -EINVAL;
16928
16929 if (!wdev->connected)
16930 return -ENOTCONN;
16931
16932 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16933 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
16934 return -EINVAL;
16935
16936 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
16937 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
16938 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
16939 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
16940 return -EINVAL;
16941
16942 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
16943 pmk_conf.pmk_r0_name =
16944 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
16945
16946 return rdev_set_pmk(rdev, dev, &pmk_conf);
16947 }
16948
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)16949 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
16950 {
16951 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16952 struct net_device *dev = info->user_ptr[1];
16953 struct wireless_dev *wdev = dev->ieee80211_ptr;
16954 const u8 *aa;
16955
16956 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16957 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16958 return -EOPNOTSUPP;
16959
16960 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16961 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16962 return -EOPNOTSUPP;
16963
16964 if (!info->attrs[NL80211_ATTR_MAC])
16965 return -EINVAL;
16966
16967 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16968 return rdev_del_pmk(rdev, dev, aa);
16969 }
16970
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)16971 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
16972 {
16973 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16974 struct net_device *dev = info->user_ptr[1];
16975 struct cfg80211_external_auth_params params;
16976
16977 if (!rdev->ops->external_auth)
16978 return -EOPNOTSUPP;
16979
16980 if (!info->attrs[NL80211_ATTR_SSID] &&
16981 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
16982 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
16983 return -EINVAL;
16984
16985 if (!info->attrs[NL80211_ATTR_BSSID])
16986 return -EINVAL;
16987
16988 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
16989 return -EINVAL;
16990
16991 memset(¶ms, 0, sizeof(params));
16992
16993 if (info->attrs[NL80211_ATTR_SSID]) {
16994 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
16995 if (params.ssid.ssid_len == 0)
16996 return -EINVAL;
16997 memcpy(params.ssid.ssid,
16998 nla_data(info->attrs[NL80211_ATTR_SSID]),
16999 params.ssid.ssid_len);
17000 }
17001
17002 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
17003 ETH_ALEN);
17004
17005 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17006
17007 if (info->attrs[NL80211_ATTR_PMKID])
17008 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
17009
17010 return rdev_external_auth(rdev, dev, ¶ms);
17011 }
17012
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)17013 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
17014 {
17015 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
17016 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17017 struct net_device *dev = info->user_ptr[1];
17018 struct wireless_dev *wdev = dev->ieee80211_ptr;
17019 const u8 *buf;
17020 size_t len;
17021 u8 *dest;
17022 u16 proto;
17023 bool noencrypt;
17024 u64 cookie = 0;
17025 int link_id;
17026 int err;
17027
17028 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17029 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
17030 return -EOPNOTSUPP;
17031
17032 if (!rdev->ops->tx_control_port)
17033 return -EOPNOTSUPP;
17034
17035 if (!info->attrs[NL80211_ATTR_FRAME] ||
17036 !info->attrs[NL80211_ATTR_MAC] ||
17037 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
17038 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
17039 return -EINVAL;
17040 }
17041
17042 switch (wdev->iftype) {
17043 case NL80211_IFTYPE_AP:
17044 case NL80211_IFTYPE_P2P_GO:
17045 case NL80211_IFTYPE_MESH_POINT:
17046 break;
17047 case NL80211_IFTYPE_ADHOC:
17048 if (wdev->u.ibss.current_bss)
17049 break;
17050 return -ENOTCONN;
17051 case NL80211_IFTYPE_STATION:
17052 case NL80211_IFTYPE_P2P_CLIENT:
17053 if (wdev->connected)
17054 break;
17055 return -ENOTCONN;
17056 default:
17057 return -EOPNOTSUPP;
17058 }
17059
17060 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17061 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17062 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17063 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
17064 noencrypt =
17065 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
17066
17067 link_id = nl80211_link_id_or_invalid(info->attrs);
17068
17069 err = rdev_tx_control_port(rdev, dev, buf, len,
17070 dest, cpu_to_be16(proto), noencrypt, link_id,
17071 dont_wait_for_ack ? NULL : &cookie);
17072 if (!err && !dont_wait_for_ack)
17073 nl_set_extack_cookie_u64(info->extack, cookie);
17074 return err;
17075 }
17076
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)17077 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
17078 struct genl_info *info)
17079 {
17080 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17081 struct net_device *dev = info->user_ptr[1];
17082 struct wireless_dev *wdev = dev->ieee80211_ptr;
17083 struct cfg80211_ftm_responder_stats ftm_stats = {};
17084 unsigned int link_id = nl80211_link_id(info->attrs);
17085 struct sk_buff *msg;
17086 void *hdr;
17087 struct nlattr *ftm_stats_attr;
17088 int err;
17089
17090 if (wdev->iftype != NL80211_IFTYPE_AP ||
17091 !wdev->links[link_id].ap.beacon_interval)
17092 return -EOPNOTSUPP;
17093
17094 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
17095 if (err)
17096 return err;
17097
17098 if (!ftm_stats.filled)
17099 return -ENODATA;
17100
17101 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17102 if (!msg)
17103 return -ENOMEM;
17104
17105 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
17106 NL80211_CMD_GET_FTM_RESPONDER_STATS);
17107 if (!hdr)
17108 goto nla_put_failure;
17109
17110 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17111 goto nla_put_failure;
17112
17113 ftm_stats_attr = nla_nest_start_noflag(msg,
17114 NL80211_ATTR_FTM_RESPONDER_STATS);
17115 if (!ftm_stats_attr)
17116 goto nla_put_failure;
17117
17118 #define SET_FTM(field, name, type) \
17119 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17120 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
17121 ftm_stats.field)) \
17122 goto nla_put_failure; } while (0)
17123 #define SET_FTM_U64(field, name) \
17124 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17125 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
17126 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
17127 goto nla_put_failure; } while (0)
17128
17129 SET_FTM(success_num, SUCCESS_NUM, u32);
17130 SET_FTM(partial_num, PARTIAL_NUM, u32);
17131 SET_FTM(failed_num, FAILED_NUM, u32);
17132 SET_FTM(asap_num, ASAP_NUM, u32);
17133 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
17134 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
17135 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
17136 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
17137 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
17138 #undef SET_FTM
17139
17140 nla_nest_end(msg, ftm_stats_attr);
17141
17142 genlmsg_end(msg, hdr);
17143 return genlmsg_reply(msg, info);
17144
17145 nla_put_failure:
17146 nlmsg_free(msg);
17147 return -ENOBUFS;
17148 }
17149
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)17150 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
17151 {
17152 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17153 struct cfg80211_update_owe_info owe_info;
17154 struct net_device *dev = info->user_ptr[1];
17155
17156 if (!rdev->ops->update_owe_info)
17157 return -EOPNOTSUPP;
17158
17159 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
17160 !info->attrs[NL80211_ATTR_MAC])
17161 return -EINVAL;
17162
17163 memset(&owe_info, 0, sizeof(owe_info));
17164 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17165 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
17166
17167 if (info->attrs[NL80211_ATTR_IE]) {
17168 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
17169 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
17170 }
17171
17172 return rdev_update_owe_info(rdev, dev, &owe_info);
17173 }
17174
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)17175 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
17176 {
17177 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17178 struct net_device *dev = info->user_ptr[1];
17179 struct wireless_dev *wdev = dev->ieee80211_ptr;
17180 struct station_info sinfo = {};
17181 const u8 *buf;
17182 size_t len;
17183 u8 *dest;
17184 int err;
17185
17186 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
17187 return -EOPNOTSUPP;
17188
17189 if (!info->attrs[NL80211_ATTR_MAC] ||
17190 !info->attrs[NL80211_ATTR_FRAME]) {
17191 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
17192 return -EINVAL;
17193 }
17194
17195 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
17196 return -EOPNOTSUPP;
17197
17198 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17199 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17200 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17201
17202 if (len < sizeof(struct ethhdr))
17203 return -EINVAL;
17204
17205 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
17206 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
17207 return -EINVAL;
17208
17209 err = rdev_get_station(rdev, dev, dest, &sinfo);
17210 if (err)
17211 return err;
17212
17213 cfg80211_sinfo_release_content(&sinfo);
17214
17215 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
17216 }
17217
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)17218 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
17219 struct nlattr *attrs[], struct net_device *dev,
17220 struct cfg80211_tid_cfg *tid_conf,
17221 struct genl_info *info, const u8 *peer,
17222 unsigned int link_id)
17223 {
17224 struct netlink_ext_ack *extack = info->extack;
17225 u64 mask;
17226 int err;
17227
17228 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
17229 return -EINVAL;
17230
17231 tid_conf->config_override =
17232 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
17233 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
17234
17235 if (tid_conf->config_override) {
17236 if (rdev->ops->reset_tid_config) {
17237 err = rdev_reset_tid_config(rdev, dev, peer,
17238 tid_conf->tids);
17239 if (err)
17240 return err;
17241 } else {
17242 return -EINVAL;
17243 }
17244 }
17245
17246 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
17247 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
17248 tid_conf->noack =
17249 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
17250 }
17251
17252 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
17253 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
17254 tid_conf->retry_short =
17255 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
17256
17257 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
17258 return -EINVAL;
17259 }
17260
17261 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
17262 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
17263 tid_conf->retry_long =
17264 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
17265
17266 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
17267 return -EINVAL;
17268 }
17269
17270 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
17271 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
17272 tid_conf->ampdu =
17273 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
17274 }
17275
17276 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
17277 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
17278 tid_conf->rtscts =
17279 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
17280 }
17281
17282 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
17283 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
17284 tid_conf->amsdu =
17285 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
17286 }
17287
17288 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
17289 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
17290
17291 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
17292
17293 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
17294 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
17295 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
17296 &tid_conf->txrate_mask, dev,
17297 true, link_id);
17298 if (err)
17299 return err;
17300
17301 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
17302 }
17303 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
17304 }
17305
17306 if (peer)
17307 mask = rdev->wiphy.tid_config_support.peer;
17308 else
17309 mask = rdev->wiphy.tid_config_support.vif;
17310
17311 if (tid_conf->mask & ~mask) {
17312 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
17313 return -EOPNOTSUPP;
17314 }
17315
17316 return 0;
17317 }
17318
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)17319 static int nl80211_set_tid_config(struct sk_buff *skb,
17320 struct genl_info *info)
17321 {
17322 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17323 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
17324 unsigned int link_id = nl80211_link_id(info->attrs);
17325 struct net_device *dev = info->user_ptr[1];
17326 struct cfg80211_tid_config *tid_config;
17327 struct nlattr *tid;
17328 int conf_idx = 0, rem_conf;
17329 int ret = -EINVAL;
17330 u32 num_conf = 0;
17331
17332 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
17333 return -EINVAL;
17334
17335 if (!rdev->ops->set_tid_config)
17336 return -EOPNOTSUPP;
17337
17338 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17339 rem_conf)
17340 num_conf++;
17341
17342 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
17343 GFP_KERNEL);
17344 if (!tid_config)
17345 return -ENOMEM;
17346
17347 tid_config->n_tid_conf = num_conf;
17348
17349 if (info->attrs[NL80211_ATTR_MAC])
17350 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
17351
17352 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17353 rem_conf) {
17354 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
17355 tid, NULL, NULL);
17356
17357 if (ret)
17358 goto bad_tid_conf;
17359
17360 ret = parse_tid_conf(rdev, attrs, dev,
17361 &tid_config->tid_conf[conf_idx],
17362 info, tid_config->peer, link_id);
17363 if (ret)
17364 goto bad_tid_conf;
17365
17366 conf_idx++;
17367 }
17368
17369 ret = rdev_set_tid_config(rdev, dev, tid_config);
17370
17371 bad_tid_conf:
17372 kfree(tid_config);
17373 return ret;
17374 }
17375
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)17376 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
17377 {
17378 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17379 struct cfg80211_color_change_settings params = {};
17380 struct net_device *dev = info->user_ptr[1];
17381 struct wireless_dev *wdev = dev->ieee80211_ptr;
17382 struct nlattr **tb;
17383 u16 offset;
17384 int err;
17385
17386 if (!rdev->ops->color_change)
17387 return -EOPNOTSUPP;
17388
17389 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17390 NL80211_EXT_FEATURE_BSS_COLOR))
17391 return -EOPNOTSUPP;
17392
17393 if (wdev->iftype != NL80211_IFTYPE_AP)
17394 return -EOPNOTSUPP;
17395
17396 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
17397 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
17398 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
17399 return -EINVAL;
17400
17401 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
17402 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
17403
17404 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
17405 info->extack);
17406 if (err)
17407 return err;
17408
17409 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
17410 if (!tb)
17411 return -ENOMEM;
17412
17413 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
17414 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
17415 nl80211_policy, info->extack);
17416 if (err)
17417 goto out;
17418
17419 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
17420 info->extack);
17421 if (err)
17422 goto out;
17423
17424 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
17425 err = -EINVAL;
17426 goto out;
17427 }
17428
17429 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
17430 err = -EINVAL;
17431 goto out;
17432 }
17433
17434 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
17435 if (offset >= params.beacon_color_change.tail_len) {
17436 err = -EINVAL;
17437 goto out;
17438 }
17439
17440 if (params.beacon_color_change.tail[offset] != params.count) {
17441 err = -EINVAL;
17442 goto out;
17443 }
17444
17445 params.counter_offset_beacon = offset;
17446
17447 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
17448 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
17449 sizeof(u16)) {
17450 err = -EINVAL;
17451 goto out;
17452 }
17453
17454 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
17455 if (offset >= params.beacon_color_change.probe_resp_len) {
17456 err = -EINVAL;
17457 goto out;
17458 }
17459
17460 if (params.beacon_color_change.probe_resp[offset] !=
17461 params.count) {
17462 err = -EINVAL;
17463 goto out;
17464 }
17465
17466 params.counter_offset_presp = offset;
17467 }
17468
17469 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
17470 err = nl80211_parse_unsol_bcast_probe_resp(
17471 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
17472 ¶ms.unsol_bcast_probe_resp);
17473 if (err)
17474 goto out;
17475 }
17476
17477 params.link_id = nl80211_link_id(info->attrs);
17478 err = rdev_color_change(rdev, dev, ¶ms);
17479
17480 out:
17481 kfree(params.beacon_next.mbssid_ies);
17482 kfree(params.beacon_color_change.mbssid_ies);
17483 kfree(params.beacon_next.rnr_ies);
17484 kfree(params.beacon_color_change.rnr_ies);
17485 kfree(tb);
17486 return err;
17487 }
17488
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)17489 static int nl80211_set_fils_aad(struct sk_buff *skb,
17490 struct genl_info *info)
17491 {
17492 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17493 struct net_device *dev = info->user_ptr[1];
17494 struct cfg80211_fils_aad fils_aad = {};
17495 u8 *nonces;
17496
17497 if (!info->attrs[NL80211_ATTR_MAC] ||
17498 !info->attrs[NL80211_ATTR_FILS_KEK] ||
17499 !info->attrs[NL80211_ATTR_FILS_NONCES])
17500 return -EINVAL;
17501
17502 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17503 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
17504 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
17505 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
17506 fils_aad.snonce = nonces;
17507 fils_aad.anonce = nonces + FILS_NONCE_LEN;
17508
17509 return rdev_set_fils_aad(rdev, dev, &fils_aad);
17510 }
17511
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)17512 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
17513 {
17514 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17515 unsigned int link_id = nl80211_link_id(info->attrs);
17516 struct net_device *dev = info->user_ptr[1];
17517 struct wireless_dev *wdev = dev->ieee80211_ptr;
17518 int ret;
17519
17520 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
17521 return -EINVAL;
17522
17523 switch (wdev->iftype) {
17524 case NL80211_IFTYPE_AP:
17525 break;
17526 default:
17527 return -EINVAL;
17528 }
17529
17530 if (!info->attrs[NL80211_ATTR_MAC] ||
17531 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
17532 return -EINVAL;
17533
17534 wdev->valid_links |= BIT(link_id);
17535 ether_addr_copy(wdev->links[link_id].addr,
17536 nla_data(info->attrs[NL80211_ATTR_MAC]));
17537
17538 ret = rdev_add_intf_link(rdev, wdev, link_id);
17539 if (ret) {
17540 wdev->valid_links &= ~BIT(link_id);
17541 eth_zero_addr(wdev->links[link_id].addr);
17542 }
17543
17544 return ret;
17545 }
17546
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)17547 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
17548 {
17549 unsigned int link_id = nl80211_link_id(info->attrs);
17550 struct net_device *dev = info->user_ptr[1];
17551 struct wireless_dev *wdev = dev->ieee80211_ptr;
17552
17553 /* cannot remove if there's no link */
17554 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17555 return -EINVAL;
17556
17557 switch (wdev->iftype) {
17558 case NL80211_IFTYPE_AP:
17559 break;
17560 default:
17561 return -EINVAL;
17562 }
17563
17564 cfg80211_remove_link(wdev, link_id);
17565
17566 return 0;
17567 }
17568
17569 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)17570 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
17571 bool add)
17572 {
17573 struct link_station_parameters params = {};
17574 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17575 struct net_device *dev = info->user_ptr[1];
17576 int err;
17577
17578 if ((add && !rdev->ops->add_link_station) ||
17579 (!add && !rdev->ops->mod_link_station))
17580 return -EOPNOTSUPP;
17581
17582 if (add && !info->attrs[NL80211_ATTR_MAC])
17583 return -EINVAL;
17584
17585 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
17586 return -EINVAL;
17587
17588 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
17589 return -EINVAL;
17590
17591 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17592
17593 if (info->attrs[NL80211_ATTR_MAC]) {
17594 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
17595 if (!is_valid_ether_addr(params.link_mac))
17596 return -EINVAL;
17597 }
17598
17599 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17600 return -EINVAL;
17601
17602 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17603
17604 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
17605 params.supported_rates =
17606 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17607 params.supported_rates_len =
17608 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17609 }
17610
17611 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
17612 params.ht_capa =
17613 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
17614
17615 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
17616 params.vht_capa =
17617 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
17618
17619 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
17620 params.he_capa =
17621 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17622 params.he_capa_len =
17623 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17624
17625 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
17626 params.eht_capa =
17627 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17628 params.eht_capa_len =
17629 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17630
17631 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
17632 (const u8 *)params.eht_capa,
17633 params.eht_capa_len,
17634 false))
17635 return -EINVAL;
17636 }
17637 }
17638
17639 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
17640 params.he_6ghz_capa =
17641 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
17642
17643 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
17644 params.opmode_notif_used = true;
17645 params.opmode_notif =
17646 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
17647 }
17648
17649 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
17650 ¶ms.txpwr_set);
17651 if (err)
17652 return err;
17653
17654 if (add)
17655 return rdev_add_link_station(rdev, dev, ¶ms);
17656
17657 return rdev_mod_link_station(rdev, dev, ¶ms);
17658 }
17659
17660 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)17661 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
17662 {
17663 return nl80211_add_mod_link_station(skb, info, true);
17664 }
17665
17666 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)17667 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
17668 {
17669 return nl80211_add_mod_link_station(skb, info, false);
17670 }
17671
17672 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)17673 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
17674 {
17675 struct link_station_del_parameters params = {};
17676 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17677 struct net_device *dev = info->user_ptr[1];
17678
17679 if (!rdev->ops->del_link_station)
17680 return -EOPNOTSUPP;
17681
17682 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
17683 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
17684 return -EINVAL;
17685
17686 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17687 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17688
17689 return rdev_del_link_station(rdev, dev, ¶ms);
17690 }
17691
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)17692 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
17693 struct genl_info *info)
17694 {
17695 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17696 struct net_device *dev = info->user_ptr[1];
17697 struct cfg80211_set_hw_timestamp hwts = {};
17698
17699 if (!rdev->wiphy.hw_timestamp_max_peers)
17700 return -EOPNOTSUPP;
17701
17702 if (!info->attrs[NL80211_ATTR_MAC] &&
17703 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
17704 return -EOPNOTSUPP;
17705
17706 if (info->attrs[NL80211_ATTR_MAC])
17707 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17708
17709 hwts.enable =
17710 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
17711
17712 return rdev_set_hw_timestamp(rdev, dev, &hwts);
17713 }
17714
17715 static int
nl80211_set_ttlm(struct sk_buff * skb,struct genl_info * info)17716 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
17717 {
17718 struct cfg80211_ttlm_params params = {};
17719 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17720 struct net_device *dev = info->user_ptr[1];
17721 struct wireless_dev *wdev = dev->ieee80211_ptr;
17722
17723 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17724 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17725 return -EOPNOTSUPP;
17726
17727 if (!wdev->connected)
17728 return -ENOLINK;
17729
17730 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
17731 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
17732 return -EINVAL;
17733
17734 nla_memcpy(params.dlink,
17735 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
17736 sizeof(params.dlink));
17737 nla_memcpy(params.ulink,
17738 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
17739 sizeof(params.ulink));
17740
17741 return rdev_set_ttlm(rdev, dev, ¶ms);
17742 }
17743
nl80211_assoc_ml_reconf(struct sk_buff * skb,struct genl_info * info)17744 static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
17745 {
17746 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17747 struct net_device *dev = info->user_ptr[1];
17748 struct wireless_dev *wdev = dev->ieee80211_ptr;
17749 struct cfg80211_ml_reconf_req req = {};
17750 unsigned int link_id;
17751 u16 add_links;
17752 int err;
17753
17754 if (!wdev->valid_links)
17755 return -EINVAL;
17756
17757 if (dev->ieee80211_ptr->conn_owner_nlportid &&
17758 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
17759 return -EPERM;
17760
17761 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
17762 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
17763 return -EOPNOTSUPP;
17764
17765 add_links = 0;
17766 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
17767 err = nl80211_process_links(rdev, req.add_links,
17768 /* mark as MLO, but not assoc */
17769 IEEE80211_MLD_MAX_NUM_LINKS,
17770 NULL, 0, info);
17771 if (err)
17772 return err;
17773
17774 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
17775 link_id++) {
17776 if (!req.add_links[link_id].bss)
17777 continue;
17778 add_links |= BIT(link_id);
17779 }
17780 }
17781
17782 if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
17783 req.rem_links =
17784 nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
17785
17786 /* Validate that existing links are not added, removed links are valid
17787 * and don't allow adding and removing the same links
17788 */
17789 if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
17790 (wdev->valid_links & add_links) ||
17791 ((wdev->valid_links & req.rem_links) != req.rem_links)) {
17792 err = -EINVAL;
17793 goto out;
17794 }
17795
17796 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
17797 req.ext_mld_capa_ops =
17798 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
17799
17800 err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
17801
17802 out:
17803 for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
17804 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
17805
17806 return err;
17807 }
17808
17809 static int
nl80211_epcs_cfg(struct sk_buff * skb,struct genl_info * info)17810 nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
17811 {
17812 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17813 struct net_device *dev = info->user_ptr[1];
17814 struct wireless_dev *wdev = dev->ieee80211_ptr;
17815 bool val;
17816
17817 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17818 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17819 return -EOPNOTSUPP;
17820
17821 if (!wdev->connected)
17822 return -ENOLINK;
17823
17824 val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
17825
17826 return rdev_set_epcs(rdev, dev, val);
17827 }
17828
17829 #define NL80211_FLAG_NEED_WIPHY 0x01
17830 #define NL80211_FLAG_NEED_NETDEV 0x02
17831 #define NL80211_FLAG_NEED_RTNL 0x04
17832 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
17833 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
17834 NL80211_FLAG_CHECK_NETDEV_UP)
17835 #define NL80211_FLAG_NEED_WDEV 0x10
17836 /* If a netdev is associated, it must be UP, P2P must be started */
17837 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
17838 NL80211_FLAG_CHECK_NETDEV_UP)
17839 #define NL80211_FLAG_CLEAR_SKB 0x20
17840 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
17841 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
17842 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
17843
17844 #define INTERNAL_FLAG_SELECTORS(__sel) \
17845 SELECTOR(__sel, NONE, 0) /* must be first */ \
17846 SELECTOR(__sel, WIPHY, \
17847 NL80211_FLAG_NEED_WIPHY) \
17848 SELECTOR(__sel, WDEV, \
17849 NL80211_FLAG_NEED_WDEV) \
17850 SELECTOR(__sel, NETDEV, \
17851 NL80211_FLAG_NEED_NETDEV) \
17852 SELECTOR(__sel, NETDEV_LINK, \
17853 NL80211_FLAG_NEED_NETDEV | \
17854 NL80211_FLAG_MLO_VALID_LINK_ID) \
17855 SELECTOR(__sel, NETDEV_NO_MLO, \
17856 NL80211_FLAG_NEED_NETDEV | \
17857 NL80211_FLAG_MLO_UNSUPPORTED) \
17858 SELECTOR(__sel, WIPHY_RTNL, \
17859 NL80211_FLAG_NEED_WIPHY | \
17860 NL80211_FLAG_NEED_RTNL) \
17861 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
17862 NL80211_FLAG_NEED_WIPHY | \
17863 NL80211_FLAG_NEED_RTNL | \
17864 NL80211_FLAG_NO_WIPHY_MTX) \
17865 SELECTOR(__sel, WDEV_RTNL, \
17866 NL80211_FLAG_NEED_WDEV | \
17867 NL80211_FLAG_NEED_RTNL) \
17868 SELECTOR(__sel, NETDEV_RTNL, \
17869 NL80211_FLAG_NEED_NETDEV | \
17870 NL80211_FLAG_NEED_RTNL) \
17871 SELECTOR(__sel, NETDEV_UP, \
17872 NL80211_FLAG_NEED_NETDEV_UP) \
17873 SELECTOR(__sel, NETDEV_UP_LINK, \
17874 NL80211_FLAG_NEED_NETDEV_UP | \
17875 NL80211_FLAG_MLO_VALID_LINK_ID) \
17876 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
17877 NL80211_FLAG_NEED_NETDEV_UP | \
17878 NL80211_FLAG_MLO_UNSUPPORTED) \
17879 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
17880 NL80211_FLAG_NEED_NETDEV_UP | \
17881 NL80211_FLAG_CLEAR_SKB | \
17882 NL80211_FLAG_MLO_UNSUPPORTED) \
17883 SELECTOR(__sel, NETDEV_UP_NOTMX, \
17884 NL80211_FLAG_NEED_NETDEV_UP | \
17885 NL80211_FLAG_NO_WIPHY_MTX) \
17886 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
17887 NL80211_FLAG_NEED_NETDEV_UP | \
17888 NL80211_FLAG_NO_WIPHY_MTX | \
17889 NL80211_FLAG_MLO_VALID_LINK_ID) \
17890 SELECTOR(__sel, NETDEV_UP_CLEAR, \
17891 NL80211_FLAG_NEED_NETDEV_UP | \
17892 NL80211_FLAG_CLEAR_SKB) \
17893 SELECTOR(__sel, WDEV_UP, \
17894 NL80211_FLAG_NEED_WDEV_UP) \
17895 SELECTOR(__sel, WDEV_UP_LINK, \
17896 NL80211_FLAG_NEED_WDEV_UP | \
17897 NL80211_FLAG_MLO_VALID_LINK_ID) \
17898 SELECTOR(__sel, WDEV_UP_RTNL, \
17899 NL80211_FLAG_NEED_WDEV_UP | \
17900 NL80211_FLAG_NEED_RTNL) \
17901 SELECTOR(__sel, WIPHY_CLEAR, \
17902 NL80211_FLAG_NEED_WIPHY | \
17903 NL80211_FLAG_CLEAR_SKB)
17904
17905 enum nl80211_internal_flags_selector {
17906 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
17907 INTERNAL_FLAG_SELECTORS(_)
17908 #undef SELECTOR
17909 };
17910
17911 static u32 nl80211_internal_flags[] = {
17912 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
17913 INTERNAL_FLAG_SELECTORS(_)
17914 #undef SELECTOR
17915 };
17916
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)17917 static int nl80211_pre_doit(const struct genl_split_ops *ops,
17918 struct sk_buff *skb,
17919 struct genl_info *info)
17920 {
17921 struct cfg80211_registered_device *rdev = NULL;
17922 struct wireless_dev *wdev = NULL;
17923 struct net_device *dev = NULL;
17924 u32 internal_flags;
17925 int err;
17926
17927 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
17928 return -EINVAL;
17929
17930 internal_flags = nl80211_internal_flags[ops->internal_flags];
17931
17932 rtnl_lock();
17933 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
17934 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
17935 if (IS_ERR(rdev)) {
17936 err = PTR_ERR(rdev);
17937 goto out_unlock;
17938 }
17939 info->user_ptr[0] = rdev;
17940 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
17941 internal_flags & NL80211_FLAG_NEED_WDEV) {
17942 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
17943 info->attrs);
17944 if (IS_ERR(wdev)) {
17945 err = PTR_ERR(wdev);
17946 goto out_unlock;
17947 }
17948
17949 dev = wdev->netdev;
17950 dev_hold(dev);
17951 rdev = wiphy_to_rdev(wdev->wiphy);
17952
17953 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
17954 if (!dev) {
17955 err = -EINVAL;
17956 goto out_unlock;
17957 }
17958
17959 info->user_ptr[1] = dev;
17960 } else {
17961 info->user_ptr[1] = wdev;
17962 }
17963
17964 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
17965 !wdev_running(wdev)) {
17966 err = -ENETDOWN;
17967 goto out_unlock;
17968 }
17969
17970 info->user_ptr[0] = rdev;
17971 }
17972
17973 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
17974 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
17975
17976 if (!wdev) {
17977 err = -EINVAL;
17978 goto out_unlock;
17979 }
17980
17981 /* MLO -> require valid link ID */
17982 if (wdev->valid_links &&
17983 (!link_id ||
17984 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
17985 err = -EINVAL;
17986 goto out_unlock;
17987 }
17988
17989 /* non-MLO -> no link ID attribute accepted */
17990 if (!wdev->valid_links && link_id) {
17991 err = -EINVAL;
17992 goto out_unlock;
17993 }
17994 }
17995
17996 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
17997 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
17998 (wdev && wdev->valid_links)) {
17999 err = -EINVAL;
18000 goto out_unlock;
18001 }
18002 }
18003
18004 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
18005 wiphy_lock(&rdev->wiphy);
18006 /* we keep the mutex locked until post_doit */
18007 __release(&rdev->wiphy.mtx);
18008 }
18009 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
18010 rtnl_unlock();
18011
18012 return 0;
18013 out_unlock:
18014 rtnl_unlock();
18015 dev_put(dev);
18016 return err;
18017 }
18018
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)18019 static void nl80211_post_doit(const struct genl_split_ops *ops,
18020 struct sk_buff *skb,
18021 struct genl_info *info)
18022 {
18023 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
18024
18025 if (info->user_ptr[1]) {
18026 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
18027 struct wireless_dev *wdev = info->user_ptr[1];
18028
18029 dev_put(wdev->netdev);
18030 } else {
18031 dev_put(info->user_ptr[1]);
18032 }
18033 }
18034
18035 if (info->user_ptr[0] &&
18036 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
18037 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18038
18039 /* we kept the mutex locked since pre_doit */
18040 __acquire(&rdev->wiphy.mtx);
18041 wiphy_unlock(&rdev->wiphy);
18042 }
18043
18044 if (internal_flags & NL80211_FLAG_NEED_RTNL)
18045 rtnl_unlock();
18046
18047 /* If needed, clear the netlink message payload from the SKB
18048 * as it might contain key data that shouldn't stick around on
18049 * the heap after the SKB is freed. The netlink message header
18050 * is still needed for further processing, so leave it intact.
18051 */
18052 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
18053 struct nlmsghdr *nlh = nlmsg_hdr(skb);
18054
18055 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
18056 }
18057 }
18058
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)18059 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
18060 struct cfg80211_sar_specs *sar_specs,
18061 struct nlattr *spec[], int index)
18062 {
18063 u32 range_index, i;
18064
18065 if (!sar_specs || !spec)
18066 return -EINVAL;
18067
18068 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
18069 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
18070 return -EINVAL;
18071
18072 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
18073
18074 /* check if range_index exceeds num_freq_ranges */
18075 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
18076 return -EINVAL;
18077
18078 /* check if range_index duplicates */
18079 for (i = 0; i < index; i++) {
18080 if (sar_specs->sub_specs[i].freq_range_index == range_index)
18081 return -EINVAL;
18082 }
18083
18084 sar_specs->sub_specs[index].power =
18085 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
18086
18087 sar_specs->sub_specs[index].freq_range_index = range_index;
18088
18089 return 0;
18090 }
18091
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)18092 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
18093 {
18094 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18095 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
18096 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
18097 struct cfg80211_sar_specs *sar_spec;
18098 enum nl80211_sar_type type;
18099 struct nlattr *spec_list;
18100 u32 specs;
18101 int rem, err;
18102
18103 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
18104 return -EOPNOTSUPP;
18105
18106 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
18107 return -EINVAL;
18108
18109 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
18110 info->attrs[NL80211_ATTR_SAR_SPEC],
18111 NULL, NULL);
18112
18113 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
18114 return -EINVAL;
18115
18116 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
18117 if (type != rdev->wiphy.sar_capa->type)
18118 return -EINVAL;
18119
18120 specs = 0;
18121 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
18122 specs++;
18123
18124 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
18125 return -EINVAL;
18126
18127 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
18128 if (!sar_spec)
18129 return -ENOMEM;
18130
18131 sar_spec->num_sub_specs = specs;
18132 sar_spec->type = type;
18133 specs = 0;
18134 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
18135 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
18136 spec_list, NULL, NULL);
18137
18138 switch (type) {
18139 case NL80211_SAR_TYPE_POWER:
18140 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
18141 spec, specs)) {
18142 err = -EINVAL;
18143 goto error;
18144 }
18145 break;
18146 default:
18147 err = -EINVAL;
18148 goto error;
18149 }
18150 specs++;
18151 }
18152
18153 sar_spec->num_sub_specs = specs;
18154
18155 rdev->cur_cmd_info = info;
18156 err = rdev_set_sar_specs(rdev, sar_spec);
18157 rdev->cur_cmd_info = NULL;
18158 error:
18159 kfree(sar_spec);
18160 return err;
18161 }
18162
18163 #define SELECTOR(__sel, name, value) \
18164 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
18165 int __missing_selector(void);
18166 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
18167
18168 static const struct genl_ops nl80211_ops[] = {
18169 {
18170 .cmd = NL80211_CMD_GET_WIPHY,
18171 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18172 .doit = nl80211_get_wiphy,
18173 .dumpit = nl80211_dump_wiphy,
18174 .done = nl80211_dump_wiphy_done,
18175 /* can be retrieved by unprivileged users */
18176 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18177 },
18178 };
18179
18180 static const struct genl_small_ops nl80211_small_ops[] = {
18181 {
18182 .cmd = NL80211_CMD_SET_WIPHY,
18183 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18184 .doit = nl80211_set_wiphy,
18185 .flags = GENL_UNS_ADMIN_PERM,
18186 },
18187 {
18188 .cmd = NL80211_CMD_GET_INTERFACE,
18189 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18190 .doit = nl80211_get_interface,
18191 .dumpit = nl80211_dump_interface,
18192 /* can be retrieved by unprivileged users */
18193 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18194 },
18195 {
18196 .cmd = NL80211_CMD_SET_INTERFACE,
18197 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18198 .doit = nl80211_set_interface,
18199 .flags = GENL_UNS_ADMIN_PERM,
18200 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18201 NL80211_FLAG_NEED_RTNL),
18202 },
18203 {
18204 .cmd = NL80211_CMD_NEW_INTERFACE,
18205 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18206 .doit = nl80211_new_interface,
18207 .flags = GENL_UNS_ADMIN_PERM,
18208 .internal_flags =
18209 IFLAGS(NL80211_FLAG_NEED_WIPHY |
18210 NL80211_FLAG_NEED_RTNL |
18211 /* we take the wiphy mutex later ourselves */
18212 NL80211_FLAG_NO_WIPHY_MTX),
18213 },
18214 {
18215 .cmd = NL80211_CMD_DEL_INTERFACE,
18216 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18217 .doit = nl80211_del_interface,
18218 .flags = GENL_UNS_ADMIN_PERM,
18219 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18220 NL80211_FLAG_NEED_RTNL),
18221 },
18222 {
18223 .cmd = NL80211_CMD_GET_KEY,
18224 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18225 .doit = nl80211_get_key,
18226 .flags = GENL_UNS_ADMIN_PERM,
18227 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18228 },
18229 {
18230 .cmd = NL80211_CMD_SET_KEY,
18231 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18232 .doit = nl80211_set_key,
18233 .flags = GENL_UNS_ADMIN_PERM,
18234 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
18235 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18236 NL80211_FLAG_CLEAR_SKB),
18237 },
18238 {
18239 .cmd = NL80211_CMD_NEW_KEY,
18240 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18241 .doit = nl80211_new_key,
18242 .flags = GENL_UNS_ADMIN_PERM,
18243 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18244 NL80211_FLAG_CLEAR_SKB),
18245 },
18246 {
18247 .cmd = NL80211_CMD_DEL_KEY,
18248 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18249 .doit = nl80211_del_key,
18250 .flags = GENL_UNS_ADMIN_PERM,
18251 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18252 },
18253 {
18254 .cmd = NL80211_CMD_SET_BEACON,
18255 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18256 .flags = GENL_UNS_ADMIN_PERM,
18257 .doit = nl80211_set_beacon,
18258 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18259 NL80211_FLAG_MLO_VALID_LINK_ID),
18260 },
18261 {
18262 .cmd = NL80211_CMD_START_AP,
18263 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18264 .flags = GENL_UNS_ADMIN_PERM,
18265 .doit = nl80211_start_ap,
18266 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18267 NL80211_FLAG_MLO_VALID_LINK_ID),
18268 },
18269 {
18270 .cmd = NL80211_CMD_STOP_AP,
18271 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18272 .flags = GENL_UNS_ADMIN_PERM,
18273 .doit = nl80211_stop_ap,
18274 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18275 NL80211_FLAG_MLO_VALID_LINK_ID),
18276 },
18277 {
18278 .cmd = NL80211_CMD_GET_STATION,
18279 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18280 .doit = nl80211_get_station,
18281 .dumpit = nl80211_dump_station,
18282 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18283 },
18284 {
18285 .cmd = NL80211_CMD_SET_STATION,
18286 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18287 .doit = nl80211_set_station,
18288 .flags = GENL_UNS_ADMIN_PERM,
18289 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18290 },
18291 {
18292 .cmd = NL80211_CMD_NEW_STATION,
18293 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18294 .doit = nl80211_new_station,
18295 .flags = GENL_UNS_ADMIN_PERM,
18296 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18297 },
18298 {
18299 .cmd = NL80211_CMD_DEL_STATION,
18300 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18301 .doit = nl80211_del_station,
18302 .flags = GENL_UNS_ADMIN_PERM,
18303 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
18304 * whether MAC address is passed or not. If MAC address is
18305 * passed, then even during MLO, link ID is not required.
18306 */
18307 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18308 },
18309 {
18310 .cmd = NL80211_CMD_GET_MPATH,
18311 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18312 .doit = nl80211_get_mpath,
18313 .dumpit = nl80211_dump_mpath,
18314 .flags = GENL_UNS_ADMIN_PERM,
18315 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18316 },
18317 {
18318 .cmd = NL80211_CMD_GET_MPP,
18319 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18320 .doit = nl80211_get_mpp,
18321 .dumpit = nl80211_dump_mpp,
18322 .flags = GENL_UNS_ADMIN_PERM,
18323 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18324 },
18325 {
18326 .cmd = NL80211_CMD_SET_MPATH,
18327 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18328 .doit = nl80211_set_mpath,
18329 .flags = GENL_UNS_ADMIN_PERM,
18330 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18331 },
18332 {
18333 .cmd = NL80211_CMD_NEW_MPATH,
18334 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18335 .doit = nl80211_new_mpath,
18336 .flags = GENL_UNS_ADMIN_PERM,
18337 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18338 },
18339 {
18340 .cmd = NL80211_CMD_DEL_MPATH,
18341 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18342 .doit = nl80211_del_mpath,
18343 .flags = GENL_UNS_ADMIN_PERM,
18344 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18345 },
18346 {
18347 .cmd = NL80211_CMD_SET_BSS,
18348 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18349 .doit = nl80211_set_bss,
18350 .flags = GENL_UNS_ADMIN_PERM,
18351 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18352 NL80211_FLAG_MLO_VALID_LINK_ID),
18353 },
18354 {
18355 .cmd = NL80211_CMD_GET_REG,
18356 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18357 .doit = nl80211_get_reg_do,
18358 .dumpit = nl80211_get_reg_dump,
18359 /* can be retrieved by unprivileged users */
18360 },
18361 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
18362 {
18363 .cmd = NL80211_CMD_SET_REG,
18364 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18365 .doit = nl80211_set_reg,
18366 .flags = GENL_ADMIN_PERM,
18367 },
18368 #endif
18369 {
18370 .cmd = NL80211_CMD_REQ_SET_REG,
18371 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18372 .doit = nl80211_req_set_reg,
18373 .flags = GENL_ADMIN_PERM,
18374 },
18375 {
18376 .cmd = NL80211_CMD_RELOAD_REGDB,
18377 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18378 .doit = nl80211_reload_regdb,
18379 .flags = GENL_ADMIN_PERM,
18380 },
18381 {
18382 .cmd = NL80211_CMD_GET_MESH_CONFIG,
18383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18384 .doit = nl80211_get_mesh_config,
18385 /* can be retrieved by unprivileged users */
18386 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18387 },
18388 {
18389 .cmd = NL80211_CMD_SET_MESH_CONFIG,
18390 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18391 .doit = nl80211_update_mesh_config,
18392 .flags = GENL_UNS_ADMIN_PERM,
18393 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18394 },
18395 {
18396 .cmd = NL80211_CMD_TRIGGER_SCAN,
18397 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18398 .doit = nl80211_trigger_scan,
18399 .flags = GENL_UNS_ADMIN_PERM,
18400 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18401 },
18402 {
18403 .cmd = NL80211_CMD_ABORT_SCAN,
18404 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18405 .doit = nl80211_abort_scan,
18406 .flags = GENL_UNS_ADMIN_PERM,
18407 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18408 },
18409 {
18410 .cmd = NL80211_CMD_GET_SCAN,
18411 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18412 .dumpit = nl80211_dump_scan,
18413 },
18414 {
18415 .cmd = NL80211_CMD_START_SCHED_SCAN,
18416 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18417 .doit = nl80211_start_sched_scan,
18418 .flags = GENL_UNS_ADMIN_PERM,
18419 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18420 },
18421 {
18422 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
18423 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18424 .doit = nl80211_stop_sched_scan,
18425 .flags = GENL_UNS_ADMIN_PERM,
18426 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18427 },
18428 {
18429 .cmd = NL80211_CMD_AUTHENTICATE,
18430 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18431 .doit = nl80211_authenticate,
18432 .flags = GENL_UNS_ADMIN_PERM,
18433 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18434 NL80211_FLAG_CLEAR_SKB),
18435 },
18436 {
18437 .cmd = NL80211_CMD_ASSOCIATE,
18438 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18439 .doit = nl80211_associate,
18440 .flags = GENL_UNS_ADMIN_PERM,
18441 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18442 NL80211_FLAG_CLEAR_SKB),
18443 },
18444 {
18445 .cmd = NL80211_CMD_DEAUTHENTICATE,
18446 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18447 .doit = nl80211_deauthenticate,
18448 .flags = GENL_UNS_ADMIN_PERM,
18449 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18450 },
18451 {
18452 .cmd = NL80211_CMD_DISASSOCIATE,
18453 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18454 .doit = nl80211_disassociate,
18455 .flags = GENL_UNS_ADMIN_PERM,
18456 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18457 },
18458 {
18459 .cmd = NL80211_CMD_JOIN_IBSS,
18460 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18461 .doit = nl80211_join_ibss,
18462 .flags = GENL_UNS_ADMIN_PERM,
18463 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18464 },
18465 {
18466 .cmd = NL80211_CMD_LEAVE_IBSS,
18467 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18468 .doit = nl80211_leave_ibss,
18469 .flags = GENL_UNS_ADMIN_PERM,
18470 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18471 },
18472 #ifdef CONFIG_NL80211_TESTMODE
18473 {
18474 .cmd = NL80211_CMD_TESTMODE,
18475 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18476 .doit = nl80211_testmode_do,
18477 .dumpit = nl80211_testmode_dump,
18478 .flags = GENL_UNS_ADMIN_PERM,
18479 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18480 },
18481 #endif
18482 {
18483 .cmd = NL80211_CMD_CONNECT,
18484 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18485 .doit = nl80211_connect,
18486 .flags = GENL_UNS_ADMIN_PERM,
18487 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18488 NL80211_FLAG_CLEAR_SKB),
18489 },
18490 {
18491 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
18492 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18493 .doit = nl80211_update_connect_params,
18494 .flags = GENL_ADMIN_PERM,
18495 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18496 NL80211_FLAG_CLEAR_SKB),
18497 },
18498 {
18499 .cmd = NL80211_CMD_DISCONNECT,
18500 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18501 .doit = nl80211_disconnect,
18502 .flags = GENL_UNS_ADMIN_PERM,
18503 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18504 },
18505 {
18506 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
18507 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18508 .doit = nl80211_wiphy_netns,
18509 .flags = GENL_UNS_ADMIN_PERM,
18510 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18511 NL80211_FLAG_NEED_RTNL |
18512 NL80211_FLAG_NO_WIPHY_MTX),
18513 },
18514 {
18515 .cmd = NL80211_CMD_GET_SURVEY,
18516 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18517 .dumpit = nl80211_dump_survey,
18518 },
18519 {
18520 .cmd = NL80211_CMD_SET_PMKSA,
18521 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18522 .doit = nl80211_set_pmksa,
18523 .flags = GENL_UNS_ADMIN_PERM,
18524 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18525 NL80211_FLAG_CLEAR_SKB),
18526 },
18527 {
18528 .cmd = NL80211_CMD_DEL_PMKSA,
18529 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18530 .doit = nl80211_del_pmksa,
18531 .flags = GENL_UNS_ADMIN_PERM,
18532 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18533 },
18534 {
18535 .cmd = NL80211_CMD_FLUSH_PMKSA,
18536 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18537 .doit = nl80211_flush_pmksa,
18538 .flags = GENL_UNS_ADMIN_PERM,
18539 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18540 },
18541 {
18542 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
18543 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18544 .doit = nl80211_remain_on_channel,
18545 .flags = GENL_UNS_ADMIN_PERM,
18546 /* FIXME: requiring a link ID here is probably not good */
18547 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18548 NL80211_FLAG_MLO_VALID_LINK_ID),
18549 },
18550 {
18551 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18552 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18553 .doit = nl80211_cancel_remain_on_channel,
18554 .flags = GENL_UNS_ADMIN_PERM,
18555 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18556 },
18557 {
18558 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
18559 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18560 .doit = nl80211_set_tx_bitrate_mask,
18561 .flags = GENL_UNS_ADMIN_PERM,
18562 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18563 NL80211_FLAG_MLO_VALID_LINK_ID),
18564 },
18565 {
18566 .cmd = NL80211_CMD_REGISTER_FRAME,
18567 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18568 .doit = nl80211_register_mgmt,
18569 .flags = GENL_UNS_ADMIN_PERM,
18570 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18571 },
18572 {
18573 .cmd = NL80211_CMD_FRAME,
18574 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18575 .doit = nl80211_tx_mgmt,
18576 .flags = GENL_UNS_ADMIN_PERM,
18577 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18578 },
18579 {
18580 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
18581 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18582 .doit = nl80211_tx_mgmt_cancel_wait,
18583 .flags = GENL_UNS_ADMIN_PERM,
18584 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18585 },
18586 {
18587 .cmd = NL80211_CMD_SET_POWER_SAVE,
18588 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18589 .doit = nl80211_set_power_save,
18590 .flags = GENL_UNS_ADMIN_PERM,
18591 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18592 },
18593 {
18594 .cmd = NL80211_CMD_GET_POWER_SAVE,
18595 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18596 .doit = nl80211_get_power_save,
18597 /* can be retrieved by unprivileged users */
18598 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18599 },
18600 {
18601 .cmd = NL80211_CMD_SET_CQM,
18602 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18603 .doit = nl80211_set_cqm,
18604 .flags = GENL_UNS_ADMIN_PERM,
18605 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18606 },
18607 {
18608 .cmd = NL80211_CMD_SET_CHANNEL,
18609 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18610 .doit = nl80211_set_channel,
18611 .flags = GENL_UNS_ADMIN_PERM,
18612 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18613 NL80211_FLAG_MLO_VALID_LINK_ID),
18614 },
18615 {
18616 .cmd = NL80211_CMD_JOIN_MESH,
18617 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18618 .doit = nl80211_join_mesh,
18619 .flags = GENL_UNS_ADMIN_PERM,
18620 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18621 },
18622 {
18623 .cmd = NL80211_CMD_LEAVE_MESH,
18624 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18625 .doit = nl80211_leave_mesh,
18626 .flags = GENL_UNS_ADMIN_PERM,
18627 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18628 },
18629 {
18630 .cmd = NL80211_CMD_JOIN_OCB,
18631 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18632 .doit = nl80211_join_ocb,
18633 .flags = GENL_UNS_ADMIN_PERM,
18634 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18635 },
18636 {
18637 .cmd = NL80211_CMD_LEAVE_OCB,
18638 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18639 .doit = nl80211_leave_ocb,
18640 .flags = GENL_UNS_ADMIN_PERM,
18641 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18642 },
18643 #ifdef CONFIG_PM
18644 {
18645 .cmd = NL80211_CMD_GET_WOWLAN,
18646 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18647 .doit = nl80211_get_wowlan,
18648 /* can be retrieved by unprivileged users */
18649 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18650 },
18651 {
18652 .cmd = NL80211_CMD_SET_WOWLAN,
18653 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18654 .doit = nl80211_set_wowlan,
18655 .flags = GENL_UNS_ADMIN_PERM,
18656 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18657 },
18658 #endif
18659 {
18660 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
18661 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18662 .doit = nl80211_set_rekey_data,
18663 .flags = GENL_UNS_ADMIN_PERM,
18664 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18665 NL80211_FLAG_CLEAR_SKB),
18666 },
18667 {
18668 .cmd = NL80211_CMD_TDLS_MGMT,
18669 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18670 .doit = nl80211_tdls_mgmt,
18671 .flags = GENL_UNS_ADMIN_PERM,
18672 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18673 NL80211_FLAG_MLO_VALID_LINK_ID),
18674 },
18675 {
18676 .cmd = NL80211_CMD_TDLS_OPER,
18677 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18678 .doit = nl80211_tdls_oper,
18679 .flags = GENL_UNS_ADMIN_PERM,
18680 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18681 },
18682 {
18683 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
18684 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18685 .doit = nl80211_register_unexpected_frame,
18686 .flags = GENL_UNS_ADMIN_PERM,
18687 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18688 },
18689 {
18690 .cmd = NL80211_CMD_PROBE_CLIENT,
18691 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18692 .doit = nl80211_probe_client,
18693 .flags = GENL_UNS_ADMIN_PERM,
18694 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18695 },
18696 {
18697 .cmd = NL80211_CMD_REGISTER_BEACONS,
18698 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18699 .doit = nl80211_register_beacons,
18700 .flags = GENL_UNS_ADMIN_PERM,
18701 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18702 },
18703 {
18704 .cmd = NL80211_CMD_SET_NOACK_MAP,
18705 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18706 .doit = nl80211_set_noack_map,
18707 .flags = GENL_UNS_ADMIN_PERM,
18708 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18709 },
18710 {
18711 .cmd = NL80211_CMD_START_P2P_DEVICE,
18712 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18713 .doit = nl80211_start_p2p_device,
18714 .flags = GENL_UNS_ADMIN_PERM,
18715 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18716 NL80211_FLAG_NEED_RTNL),
18717 },
18718 {
18719 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
18720 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18721 .doit = nl80211_stop_p2p_device,
18722 .flags = GENL_UNS_ADMIN_PERM,
18723 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18724 NL80211_FLAG_NEED_RTNL),
18725 },
18726 {
18727 .cmd = NL80211_CMD_START_NAN,
18728 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18729 .doit = nl80211_start_nan,
18730 .flags = GENL_ADMIN_PERM,
18731 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18732 NL80211_FLAG_NEED_RTNL),
18733 },
18734 {
18735 .cmd = NL80211_CMD_STOP_NAN,
18736 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18737 .doit = nl80211_stop_nan,
18738 .flags = GENL_ADMIN_PERM,
18739 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18740 NL80211_FLAG_NEED_RTNL),
18741 },
18742 {
18743 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
18744 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18745 .doit = nl80211_nan_add_func,
18746 .flags = GENL_ADMIN_PERM,
18747 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18748 },
18749 {
18750 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
18751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18752 .doit = nl80211_nan_del_func,
18753 .flags = GENL_ADMIN_PERM,
18754 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18755 },
18756 {
18757 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
18758 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18759 .doit = nl80211_nan_change_config,
18760 .flags = GENL_ADMIN_PERM,
18761 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18762 },
18763 {
18764 .cmd = NL80211_CMD_SET_MCAST_RATE,
18765 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18766 .doit = nl80211_set_mcast_rate,
18767 .flags = GENL_UNS_ADMIN_PERM,
18768 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18769 },
18770 {
18771 .cmd = NL80211_CMD_SET_MAC_ACL,
18772 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18773 .doit = nl80211_set_mac_acl,
18774 .flags = GENL_UNS_ADMIN_PERM,
18775 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18776 NL80211_FLAG_MLO_UNSUPPORTED),
18777 },
18778 {
18779 .cmd = NL80211_CMD_RADAR_DETECT,
18780 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18781 .doit = nl80211_start_radar_detection,
18782 .flags = GENL_UNS_ADMIN_PERM,
18783 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18784 NL80211_FLAG_NO_WIPHY_MTX |
18785 NL80211_FLAG_MLO_VALID_LINK_ID),
18786 },
18787 {
18788 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
18789 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18790 .doit = nl80211_get_protocol_features,
18791 },
18792 {
18793 .cmd = NL80211_CMD_UPDATE_FT_IES,
18794 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18795 .doit = nl80211_update_ft_ies,
18796 .flags = GENL_UNS_ADMIN_PERM,
18797 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18798 },
18799 {
18800 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
18801 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18802 .doit = nl80211_crit_protocol_start,
18803 .flags = GENL_UNS_ADMIN_PERM,
18804 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18805 },
18806 {
18807 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
18808 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18809 .doit = nl80211_crit_protocol_stop,
18810 .flags = GENL_UNS_ADMIN_PERM,
18811 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18812 },
18813 {
18814 .cmd = NL80211_CMD_GET_COALESCE,
18815 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18816 .doit = nl80211_get_coalesce,
18817 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18818 },
18819 {
18820 .cmd = NL80211_CMD_SET_COALESCE,
18821 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18822 .doit = nl80211_set_coalesce,
18823 .flags = GENL_UNS_ADMIN_PERM,
18824 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18825 },
18826 {
18827 .cmd = NL80211_CMD_CHANNEL_SWITCH,
18828 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18829 .doit = nl80211_channel_switch,
18830 .flags = GENL_UNS_ADMIN_PERM,
18831 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18832 NL80211_FLAG_MLO_VALID_LINK_ID),
18833 },
18834 {
18835 .cmd = NL80211_CMD_VENDOR,
18836 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18837 .doit = nl80211_vendor_cmd,
18838 .dumpit = nl80211_vendor_cmd_dump,
18839 .flags = GENL_UNS_ADMIN_PERM,
18840 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18841 NL80211_FLAG_CLEAR_SKB),
18842 },
18843 {
18844 .cmd = NL80211_CMD_SET_QOS_MAP,
18845 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18846 .doit = nl80211_set_qos_map,
18847 .flags = GENL_UNS_ADMIN_PERM,
18848 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18849 },
18850 {
18851 .cmd = NL80211_CMD_ADD_TX_TS,
18852 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18853 .doit = nl80211_add_tx_ts,
18854 .flags = GENL_UNS_ADMIN_PERM,
18855 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18856 NL80211_FLAG_MLO_UNSUPPORTED),
18857 },
18858 {
18859 .cmd = NL80211_CMD_DEL_TX_TS,
18860 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18861 .doit = nl80211_del_tx_ts,
18862 .flags = GENL_UNS_ADMIN_PERM,
18863 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18864 },
18865 {
18866 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
18867 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18868 .doit = nl80211_tdls_channel_switch,
18869 .flags = GENL_UNS_ADMIN_PERM,
18870 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18871 },
18872 {
18873 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
18874 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18875 .doit = nl80211_tdls_cancel_channel_switch,
18876 .flags = GENL_UNS_ADMIN_PERM,
18877 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18878 },
18879 {
18880 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
18881 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18882 .doit = nl80211_set_multicast_to_unicast,
18883 .flags = GENL_UNS_ADMIN_PERM,
18884 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18885 },
18886 {
18887 .cmd = NL80211_CMD_SET_PMK,
18888 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18889 .doit = nl80211_set_pmk,
18890 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18891 NL80211_FLAG_CLEAR_SKB),
18892 },
18893 {
18894 .cmd = NL80211_CMD_DEL_PMK,
18895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18896 .doit = nl80211_del_pmk,
18897 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18898 },
18899 {
18900 .cmd = NL80211_CMD_EXTERNAL_AUTH,
18901 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18902 .doit = nl80211_external_auth,
18903 .flags = GENL_ADMIN_PERM,
18904 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18905 },
18906 {
18907 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
18908 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18909 .doit = nl80211_tx_control_port,
18910 .flags = GENL_UNS_ADMIN_PERM,
18911 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18912 },
18913 {
18914 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
18915 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18916 .doit = nl80211_get_ftm_responder_stats,
18917 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18918 NL80211_FLAG_MLO_VALID_LINK_ID),
18919 },
18920 {
18921 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
18922 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18923 .doit = nl80211_pmsr_start,
18924 .flags = GENL_UNS_ADMIN_PERM,
18925 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18926 },
18927 {
18928 .cmd = NL80211_CMD_NOTIFY_RADAR,
18929 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18930 .doit = nl80211_notify_radar_detection,
18931 .flags = GENL_UNS_ADMIN_PERM,
18932 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18933 },
18934 {
18935 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
18936 .doit = nl80211_update_owe_info,
18937 .flags = GENL_ADMIN_PERM,
18938 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18939 },
18940 {
18941 .cmd = NL80211_CMD_PROBE_MESH_LINK,
18942 .doit = nl80211_probe_mesh_link,
18943 .flags = GENL_UNS_ADMIN_PERM,
18944 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18945 },
18946 {
18947 .cmd = NL80211_CMD_SET_TID_CONFIG,
18948 .doit = nl80211_set_tid_config,
18949 .flags = GENL_UNS_ADMIN_PERM,
18950 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18951 NL80211_FLAG_MLO_VALID_LINK_ID),
18952 },
18953 {
18954 .cmd = NL80211_CMD_SET_SAR_SPECS,
18955 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18956 .doit = nl80211_set_sar_specs,
18957 .flags = GENL_UNS_ADMIN_PERM,
18958 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18959 NL80211_FLAG_NEED_RTNL),
18960 },
18961 {
18962 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
18963 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18964 .doit = nl80211_color_change,
18965 .flags = GENL_UNS_ADMIN_PERM,
18966 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18967 NL80211_FLAG_MLO_VALID_LINK_ID),
18968 },
18969 {
18970 .cmd = NL80211_CMD_SET_FILS_AAD,
18971 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18972 .doit = nl80211_set_fils_aad,
18973 .flags = GENL_UNS_ADMIN_PERM,
18974 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18975 },
18976 {
18977 .cmd = NL80211_CMD_ADD_LINK,
18978 .doit = nl80211_add_link,
18979 .flags = GENL_UNS_ADMIN_PERM,
18980 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18981 },
18982 {
18983 .cmd = NL80211_CMD_REMOVE_LINK,
18984 .doit = nl80211_remove_link,
18985 .flags = GENL_UNS_ADMIN_PERM,
18986 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18987 NL80211_FLAG_MLO_VALID_LINK_ID),
18988 },
18989 {
18990 .cmd = NL80211_CMD_ADD_LINK_STA,
18991 .doit = nl80211_add_link_station,
18992 .flags = GENL_UNS_ADMIN_PERM,
18993 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18994 NL80211_FLAG_MLO_VALID_LINK_ID),
18995 },
18996 {
18997 .cmd = NL80211_CMD_MODIFY_LINK_STA,
18998 .doit = nl80211_modify_link_station,
18999 .flags = GENL_UNS_ADMIN_PERM,
19000 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
19001 NL80211_FLAG_MLO_VALID_LINK_ID),
19002 },
19003 {
19004 .cmd = NL80211_CMD_REMOVE_LINK_STA,
19005 .doit = nl80211_remove_link_station,
19006 .flags = GENL_UNS_ADMIN_PERM,
19007 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
19008 NL80211_FLAG_MLO_VALID_LINK_ID),
19009 },
19010 {
19011 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
19012 .doit = nl80211_set_hw_timestamp,
19013 .flags = GENL_UNS_ADMIN_PERM,
19014 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19015 },
19016 {
19017 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
19018 .doit = nl80211_set_ttlm,
19019 .flags = GENL_UNS_ADMIN_PERM,
19020 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19021 },
19022 {
19023 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19024 .doit = nl80211_assoc_ml_reconf,
19025 .flags = GENL_UNS_ADMIN_PERM,
19026 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19027 },
19028 {
19029 .cmd = NL80211_CMD_EPCS_CFG,
19030 .doit = nl80211_epcs_cfg,
19031 .flags = GENL_UNS_ADMIN_PERM,
19032 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19033 },
19034 };
19035
19036 static struct genl_family nl80211_fam __ro_after_init = {
19037 .name = NL80211_GENL_NAME, /* have users key off the name instead */
19038 .hdrsize = 0, /* no private header */
19039 .version = 1, /* no particular meaning now */
19040 .maxattr = NL80211_ATTR_MAX,
19041 .policy = nl80211_policy,
19042 .netnsok = true,
19043 .pre_doit = nl80211_pre_doit,
19044 .post_doit = nl80211_post_doit,
19045 .module = THIS_MODULE,
19046 .ops = nl80211_ops,
19047 .n_ops = ARRAY_SIZE(nl80211_ops),
19048 .small_ops = nl80211_small_ops,
19049 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
19050 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
19051 .mcgrps = nl80211_mcgrps,
19052 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
19053 .parallel_ops = true,
19054 };
19055
19056 /* notification functions */
19057
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)19058 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
19059 enum nl80211_commands cmd)
19060 {
19061 struct sk_buff *msg;
19062 struct nl80211_dump_wiphy_state state = {};
19063
19064 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
19065 cmd != NL80211_CMD_DEL_WIPHY);
19066
19067 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19068 if (!msg)
19069 return;
19070
19071 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
19072 nlmsg_free(msg);
19073 return;
19074 }
19075
19076 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19077 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19078 }
19079
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)19080 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
19081 struct wireless_dev *wdev,
19082 enum nl80211_commands cmd)
19083 {
19084 struct sk_buff *msg;
19085
19086 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19087 if (!msg)
19088 return;
19089
19090 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
19091 nlmsg_free(msg);
19092 return;
19093 }
19094
19095 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19096 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19097 }
19098
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)19099 static int nl80211_add_scan_req(struct sk_buff *msg,
19100 struct cfg80211_registered_device *rdev)
19101 {
19102 struct cfg80211_scan_request_int *req = rdev->scan_req;
19103 struct nlattr *nest;
19104 int i;
19105 struct cfg80211_scan_info *info;
19106
19107 if (WARN_ON(!req))
19108 return 0;
19109
19110 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
19111 if (!nest)
19112 goto nla_put_failure;
19113 for (i = 0; i < req->req.n_ssids; i++) {
19114 if (nla_put(msg, i, req->req.ssids[i].ssid_len,
19115 req->req.ssids[i].ssid))
19116 goto nla_put_failure;
19117 }
19118 nla_nest_end(msg, nest);
19119
19120 if (req->req.flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
19121 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
19122 if (!nest)
19123 goto nla_put_failure;
19124 for (i = 0; i < req->req.n_channels; i++) {
19125 if (nla_put_u32(msg, i,
19126 ieee80211_channel_to_khz(req->req.channels[i])))
19127 goto nla_put_failure;
19128 }
19129 nla_nest_end(msg, nest);
19130 } else {
19131 nest = nla_nest_start_noflag(msg,
19132 NL80211_ATTR_SCAN_FREQUENCIES);
19133 if (!nest)
19134 goto nla_put_failure;
19135 for (i = 0; i < req->req.n_channels; i++) {
19136 if (nla_put_u32(msg, i,
19137 req->req.channels[i]->center_freq))
19138 goto nla_put_failure;
19139 }
19140 nla_nest_end(msg, nest);
19141 }
19142
19143 if (req->req.ie &&
19144 nla_put(msg, NL80211_ATTR_IE, req->req.ie_len, req->req.ie))
19145 goto nla_put_failure;
19146
19147 if (req->req.flags &&
19148 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->req.flags))
19149 goto nla_put_failure;
19150
19151 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
19152 &rdev->scan_req->info;
19153 if (info->scan_start_tsf &&
19154 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
19155 info->scan_start_tsf, NL80211_BSS_PAD) ||
19156 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
19157 info->tsf_bssid)))
19158 goto nla_put_failure;
19159
19160 return 0;
19161 nla_put_failure:
19162 return -ENOBUFS;
19163 }
19164
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)19165 static int nl80211_prep_scan_msg(struct sk_buff *msg,
19166 struct cfg80211_registered_device *rdev,
19167 struct wireless_dev *wdev,
19168 u32 portid, u32 seq, int flags,
19169 u32 cmd)
19170 {
19171 void *hdr;
19172
19173 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
19174 if (!hdr)
19175 return -1;
19176
19177 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19178 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19179 wdev->netdev->ifindex)) ||
19180 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19181 NL80211_ATTR_PAD))
19182 goto nla_put_failure;
19183
19184 /* ignore errors and send incomplete event anyway */
19185 nl80211_add_scan_req(msg, rdev);
19186
19187 genlmsg_end(msg, hdr);
19188 return 0;
19189
19190 nla_put_failure:
19191 genlmsg_cancel(msg, hdr);
19192 return -EMSGSIZE;
19193 }
19194
19195 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)19196 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
19197 struct cfg80211_sched_scan_request *req, u32 cmd)
19198 {
19199 void *hdr;
19200
19201 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19202 if (!hdr)
19203 return -1;
19204
19205 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
19206 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
19207 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
19208 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
19209 NL80211_ATTR_PAD))
19210 goto nla_put_failure;
19211
19212 genlmsg_end(msg, hdr);
19213 return 0;
19214
19215 nla_put_failure:
19216 genlmsg_cancel(msg, hdr);
19217 return -EMSGSIZE;
19218 }
19219
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)19220 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
19221 struct wireless_dev *wdev)
19222 {
19223 struct sk_buff *msg;
19224
19225 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19226 if (!msg)
19227 return;
19228
19229 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19230 NL80211_CMD_TRIGGER_SCAN) < 0) {
19231 nlmsg_free(msg);
19232 return;
19233 }
19234
19235 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19236 NL80211_MCGRP_SCAN, GFP_KERNEL);
19237 }
19238
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)19239 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
19240 struct wireless_dev *wdev, bool aborted)
19241 {
19242 struct sk_buff *msg;
19243
19244 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19245 if (!msg)
19246 return NULL;
19247
19248 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19249 aborted ? NL80211_CMD_SCAN_ABORTED :
19250 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
19251 nlmsg_free(msg);
19252 return NULL;
19253 }
19254
19255 return msg;
19256 }
19257
19258 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)19259 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
19260 struct sk_buff *msg)
19261 {
19262 if (!msg)
19263 return;
19264
19265 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19266 NL80211_MCGRP_SCAN, GFP_KERNEL);
19267 }
19268
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)19269 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
19270 {
19271 struct sk_buff *msg;
19272
19273 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19274 if (!msg)
19275 return;
19276
19277 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
19278 nlmsg_free(msg);
19279 return;
19280 }
19281
19282 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
19283 NL80211_MCGRP_SCAN, GFP_KERNEL);
19284 }
19285
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)19286 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
19287 struct regulatory_request *request)
19288 {
19289 /* Userspace can always count this one always being set */
19290 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
19291 goto nla_put_failure;
19292
19293 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
19294 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19295 NL80211_REGDOM_TYPE_WORLD))
19296 goto nla_put_failure;
19297 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
19298 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19299 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
19300 goto nla_put_failure;
19301 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
19302 request->intersect) {
19303 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19304 NL80211_REGDOM_TYPE_INTERSECTION))
19305 goto nla_put_failure;
19306 } else {
19307 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19308 NL80211_REGDOM_TYPE_COUNTRY) ||
19309 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
19310 request->alpha2))
19311 goto nla_put_failure;
19312 }
19313
19314 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
19315 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
19316
19317 if (wiphy &&
19318 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
19319 goto nla_put_failure;
19320
19321 if (wiphy &&
19322 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
19323 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
19324 goto nla_put_failure;
19325 }
19326
19327 return true;
19328
19329 nla_put_failure:
19330 return false;
19331 }
19332
19333 /*
19334 * This can happen on global regulatory changes or device specific settings
19335 * based on custom regulatory domains.
19336 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)19337 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
19338 struct regulatory_request *request)
19339 {
19340 struct sk_buff *msg;
19341 void *hdr;
19342
19343 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19344 if (!msg)
19345 return;
19346
19347 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
19348 if (!hdr)
19349 goto nla_put_failure;
19350
19351 if (!nl80211_reg_change_event_fill(msg, request))
19352 goto nla_put_failure;
19353
19354 genlmsg_end(msg, hdr);
19355
19356 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
19357 NL80211_MCGRP_REGULATORY);
19358
19359 return;
19360
19361 nla_put_failure:
19362 nlmsg_free(msg);
19363 }
19364
19365 struct nl80211_mlme_event {
19366 enum nl80211_commands cmd;
19367 const u8 *buf;
19368 size_t buf_len;
19369 int uapsd_queues;
19370 const u8 *req_ies;
19371 size_t req_ies_len;
19372 bool reconnect;
19373 };
19374
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct nl80211_mlme_event * event,gfp_t gfp)19375 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
19376 struct net_device *netdev,
19377 const struct nl80211_mlme_event *event,
19378 gfp_t gfp)
19379 {
19380 struct sk_buff *msg;
19381 void *hdr;
19382
19383 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
19384 if (!msg)
19385 return;
19386
19387 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
19388 if (!hdr) {
19389 nlmsg_free(msg);
19390 return;
19391 }
19392
19393 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19394 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19395 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
19396 (event->req_ies &&
19397 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
19398 event->req_ies)))
19399 goto nla_put_failure;
19400
19401 if (event->reconnect &&
19402 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
19403 goto nla_put_failure;
19404
19405 if (event->uapsd_queues >= 0) {
19406 struct nlattr *nla_wmm =
19407 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
19408 if (!nla_wmm)
19409 goto nla_put_failure;
19410
19411 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
19412 event->uapsd_queues))
19413 goto nla_put_failure;
19414
19415 nla_nest_end(msg, nla_wmm);
19416 }
19417
19418 genlmsg_end(msg, hdr);
19419
19420 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19421 NL80211_MCGRP_MLME, gfp);
19422 return;
19423
19424 nla_put_failure:
19425 nlmsg_free(msg);
19426 }
19427
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)19428 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
19429 struct net_device *netdev, const u8 *buf,
19430 size_t len, gfp_t gfp)
19431 {
19432 struct nl80211_mlme_event event = {
19433 .cmd = NL80211_CMD_AUTHENTICATE,
19434 .buf = buf,
19435 .buf_len = len,
19436 .uapsd_queues = -1,
19437 };
19438
19439 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19440 }
19441
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct cfg80211_rx_assoc_resp_data * data)19442 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
19443 struct net_device *netdev,
19444 const struct cfg80211_rx_assoc_resp_data *data)
19445 {
19446 struct nl80211_mlme_event event = {
19447 .cmd = NL80211_CMD_ASSOCIATE,
19448 .buf = data->buf,
19449 .buf_len = data->len,
19450 .uapsd_queues = data->uapsd_queues,
19451 .req_ies = data->req_ies,
19452 .req_ies_len = data->req_ies_len,
19453 };
19454
19455 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
19456 }
19457
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19458 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
19459 struct net_device *netdev, const u8 *buf,
19460 size_t len, bool reconnect, gfp_t gfp)
19461 {
19462 struct nl80211_mlme_event event = {
19463 .cmd = NL80211_CMD_DEAUTHENTICATE,
19464 .buf = buf,
19465 .buf_len = len,
19466 .reconnect = reconnect,
19467 .uapsd_queues = -1,
19468 };
19469
19470 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19471 }
19472
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19473 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
19474 struct net_device *netdev, const u8 *buf,
19475 size_t len, bool reconnect, gfp_t gfp)
19476 {
19477 struct nl80211_mlme_event event = {
19478 .cmd = NL80211_CMD_DISASSOCIATE,
19479 .buf = buf,
19480 .buf_len = len,
19481 .reconnect = reconnect,
19482 .uapsd_queues = -1,
19483 };
19484
19485 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19486 }
19487
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)19488 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
19489 size_t len)
19490 {
19491 struct wireless_dev *wdev = dev->ieee80211_ptr;
19492 struct wiphy *wiphy = wdev->wiphy;
19493 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19494 const struct ieee80211_mgmt *mgmt = (void *)buf;
19495 struct nl80211_mlme_event event = {
19496 .buf = buf,
19497 .buf_len = len,
19498 .uapsd_queues = -1,
19499 };
19500
19501 if (WARN_ON(len < 2))
19502 return;
19503
19504 if (ieee80211_is_deauth(mgmt->frame_control)) {
19505 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
19506 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
19507 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
19508 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
19509 if (wdev->unprot_beacon_reported &&
19510 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
19511 return;
19512 event.cmd = NL80211_CMD_UNPROT_BEACON;
19513 wdev->unprot_beacon_reported = jiffies;
19514 } else {
19515 return;
19516 }
19517
19518 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
19519 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
19520 }
19521 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
19522
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)19523 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
19524 struct net_device *netdev, int cmd,
19525 const u8 *addr, gfp_t gfp)
19526 {
19527 struct sk_buff *msg;
19528 void *hdr;
19529
19530 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19531 if (!msg)
19532 return;
19533
19534 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19535 if (!hdr) {
19536 nlmsg_free(msg);
19537 return;
19538 }
19539
19540 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19541 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19542 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19543 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19544 goto nla_put_failure;
19545
19546 genlmsg_end(msg, hdr);
19547
19548 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19549 NL80211_MCGRP_MLME, gfp);
19550 return;
19551
19552 nla_put_failure:
19553 nlmsg_free(msg);
19554 }
19555
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19556 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
19557 struct net_device *netdev, const u8 *addr,
19558 gfp_t gfp)
19559 {
19560 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
19561 addr, gfp);
19562 }
19563
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19564 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
19565 struct net_device *netdev, const u8 *addr,
19566 gfp_t gfp)
19567 {
19568 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
19569 addr, gfp);
19570 }
19571
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)19572 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
19573 struct net_device *netdev,
19574 struct cfg80211_connect_resp_params *cr,
19575 gfp_t gfp)
19576 {
19577 struct sk_buff *msg;
19578 void *hdr;
19579 unsigned int link;
19580 size_t link_info_size = 0;
19581 const u8 *connected_addr = cr->valid_links ?
19582 cr->ap_mld_addr : cr->links[0].bssid;
19583
19584 if (cr->valid_links) {
19585 for_each_valid_link(cr, link) {
19586 /* Nested attribute header */
19587 link_info_size += NLA_HDRLEN;
19588 /* Link ID */
19589 link_info_size += nla_total_size(sizeof(u8));
19590 link_info_size += cr->links[link].addr ?
19591 nla_total_size(ETH_ALEN) : 0;
19592 link_info_size += (cr->links[link].bssid ||
19593 cr->links[link].bss) ?
19594 nla_total_size(ETH_ALEN) : 0;
19595 link_info_size += nla_total_size(sizeof(u16));
19596 }
19597 }
19598
19599 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
19600 cr->fils.kek_len + cr->fils.pmk_len +
19601 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
19602 gfp);
19603 if (!msg)
19604 return;
19605
19606 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
19607 if (!hdr) {
19608 nlmsg_free(msg);
19609 return;
19610 }
19611
19612 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19613 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19614 (connected_addr &&
19615 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
19616 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19617 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
19618 cr->status) ||
19619 (cr->status < 0 &&
19620 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19621 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
19622 cr->timeout_reason))) ||
19623 (cr->req_ie &&
19624 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
19625 (cr->resp_ie &&
19626 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
19627 cr->resp_ie)) ||
19628 (cr->fils.update_erp_next_seq_num &&
19629 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19630 cr->fils.erp_next_seq_num)) ||
19631 (cr->status == WLAN_STATUS_SUCCESS &&
19632 ((cr->fils.kek &&
19633 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
19634 cr->fils.kek)) ||
19635 (cr->fils.pmk &&
19636 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
19637 (cr->fils.pmkid &&
19638 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
19639 goto nla_put_failure;
19640
19641 if (cr->valid_links) {
19642 int i = 1;
19643 struct nlattr *nested;
19644
19645 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19646 if (!nested)
19647 goto nla_put_failure;
19648
19649 for_each_valid_link(cr, link) {
19650 struct nlattr *nested_mlo_links;
19651 const u8 *bssid = cr->links[link].bss ?
19652 cr->links[link].bss->bssid :
19653 cr->links[link].bssid;
19654
19655 nested_mlo_links = nla_nest_start(msg, i);
19656 if (!nested_mlo_links)
19657 goto nla_put_failure;
19658
19659 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19660 (bssid &&
19661 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19662 (cr->links[link].addr &&
19663 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19664 cr->links[link].addr)) ||
19665 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19666 cr->links[link].status))
19667 goto nla_put_failure;
19668
19669 nla_nest_end(msg, nested_mlo_links);
19670 i++;
19671 }
19672 nla_nest_end(msg, nested);
19673 }
19674
19675 genlmsg_end(msg, hdr);
19676
19677 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19678 NL80211_MCGRP_MLME, gfp);
19679 return;
19680
19681 nla_put_failure:
19682 nlmsg_free(msg);
19683 }
19684
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)19685 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
19686 struct net_device *netdev,
19687 struct cfg80211_roam_info *info, gfp_t gfp)
19688 {
19689 struct sk_buff *msg;
19690 void *hdr;
19691 size_t link_info_size = 0;
19692 unsigned int link;
19693 const u8 *connected_addr = info->ap_mld_addr ?
19694 info->ap_mld_addr :
19695 (info->links[0].bss ?
19696 info->links[0].bss->bssid :
19697 info->links[0].bssid);
19698
19699 if (info->valid_links) {
19700 for_each_valid_link(info, link) {
19701 /* Nested attribute header */
19702 link_info_size += NLA_HDRLEN;
19703 /* Link ID */
19704 link_info_size += nla_total_size(sizeof(u8));
19705 link_info_size += info->links[link].addr ?
19706 nla_total_size(ETH_ALEN) : 0;
19707 link_info_size += (info->links[link].bssid ||
19708 info->links[link].bss) ?
19709 nla_total_size(ETH_ALEN) : 0;
19710 }
19711 }
19712
19713 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
19714 info->fils.kek_len + info->fils.pmk_len +
19715 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
19716 link_info_size, gfp);
19717 if (!msg)
19718 return;
19719
19720 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
19721 if (!hdr) {
19722 nlmsg_free(msg);
19723 return;
19724 }
19725
19726 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19727 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19728 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
19729 (info->req_ie &&
19730 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
19731 info->req_ie)) ||
19732 (info->resp_ie &&
19733 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
19734 info->resp_ie)) ||
19735 (info->fils.update_erp_next_seq_num &&
19736 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19737 info->fils.erp_next_seq_num)) ||
19738 (info->fils.kek &&
19739 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
19740 info->fils.kek)) ||
19741 (info->fils.pmk &&
19742 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
19743 (info->fils.pmkid &&
19744 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
19745 goto nla_put_failure;
19746
19747 if (info->valid_links) {
19748 int i = 1;
19749 struct nlattr *nested;
19750
19751 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19752 if (!nested)
19753 goto nla_put_failure;
19754
19755 for_each_valid_link(info, link) {
19756 struct nlattr *nested_mlo_links;
19757 const u8 *bssid = info->links[link].bss ?
19758 info->links[link].bss->bssid :
19759 info->links[link].bssid;
19760
19761 nested_mlo_links = nla_nest_start(msg, i);
19762 if (!nested_mlo_links)
19763 goto nla_put_failure;
19764
19765 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19766 (bssid &&
19767 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19768 (info->links[link].addr &&
19769 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19770 info->links[link].addr)))
19771 goto nla_put_failure;
19772
19773 nla_nest_end(msg, nested_mlo_links);
19774 i++;
19775 }
19776 nla_nest_end(msg, nested);
19777 }
19778
19779 genlmsg_end(msg, hdr);
19780
19781 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19782 NL80211_MCGRP_MLME, gfp);
19783 return;
19784
19785 nla_put_failure:
19786 nlmsg_free(msg);
19787 }
19788
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * peer_addr,const u8 * td_bitmap,u8 td_bitmap_len)19789 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
19790 struct net_device *netdev, const u8 *peer_addr,
19791 const u8 *td_bitmap, u8 td_bitmap_len)
19792 {
19793 struct sk_buff *msg;
19794 void *hdr;
19795
19796 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19797 if (!msg)
19798 return;
19799
19800 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
19801 if (!hdr) {
19802 nlmsg_free(msg);
19803 return;
19804 }
19805
19806 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19807 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19808 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
19809 goto nla_put_failure;
19810
19811 if (td_bitmap_len > 0 && td_bitmap &&
19812 nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
19813 goto nla_put_failure;
19814
19815 genlmsg_end(msg, hdr);
19816
19817 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19818 NL80211_MCGRP_MLME, GFP_KERNEL);
19819 return;
19820
19821 nla_put_failure:
19822 nlmsg_free(msg);
19823 }
19824
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)19825 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
19826 struct net_device *netdev, u16 reason,
19827 const u8 *ie, size_t ie_len, bool from_ap)
19828 {
19829 struct sk_buff *msg;
19830 void *hdr;
19831
19832 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
19833 if (!msg)
19834 return;
19835
19836 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
19837 if (!hdr) {
19838 nlmsg_free(msg);
19839 return;
19840 }
19841
19842 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19843 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19844 (reason &&
19845 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
19846 (from_ap &&
19847 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
19848 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
19849 goto nla_put_failure;
19850
19851 genlmsg_end(msg, hdr);
19852
19853 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19854 NL80211_MCGRP_MLME, GFP_KERNEL);
19855 return;
19856
19857 nla_put_failure:
19858 nlmsg_free(msg);
19859 }
19860
cfg80211_links_removed(struct net_device * dev,u16 link_mask)19861 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
19862 {
19863 struct wireless_dev *wdev = dev->ieee80211_ptr;
19864 struct wiphy *wiphy = wdev->wiphy;
19865 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19866 struct sk_buff *msg;
19867 struct nlattr *links;
19868 void *hdr;
19869
19870 lockdep_assert_wiphy(wdev->wiphy);
19871 trace_cfg80211_links_removed(dev, link_mask);
19872
19873 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
19874 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
19875 return;
19876
19877 if (WARN_ON(!wdev->valid_links || !link_mask ||
19878 (wdev->valid_links & link_mask) != link_mask ||
19879 wdev->valid_links == link_mask))
19880 return;
19881
19882 cfg80211_wdev_release_link_bsses(wdev, link_mask);
19883 wdev->valid_links &= ~link_mask;
19884
19885 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19886 if (!msg)
19887 return;
19888
19889 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
19890 if (!hdr) {
19891 nlmsg_free(msg);
19892 return;
19893 }
19894
19895 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19896 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19897 goto nla_put_failure;
19898
19899 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19900 if (!links)
19901 goto nla_put_failure;
19902
19903 while (link_mask) {
19904 struct nlattr *link;
19905 int link_id = __ffs(link_mask);
19906
19907 link = nla_nest_start(msg, link_id + 1);
19908 if (!link)
19909 goto nla_put_failure;
19910
19911 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19912 goto nla_put_failure;
19913
19914 nla_nest_end(msg, link);
19915 link_mask &= ~(1 << link_id);
19916 }
19917
19918 nla_nest_end(msg, links);
19919
19920 genlmsg_end(msg, hdr);
19921
19922 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19923 NL80211_MCGRP_MLME, GFP_KERNEL);
19924 return;
19925
19926 nla_put_failure:
19927 nlmsg_free(msg);
19928 }
19929 EXPORT_SYMBOL(cfg80211_links_removed);
19930
nl80211_mlo_reconf_add_done(struct net_device * dev,struct cfg80211_mlo_reconf_done_data * data)19931 void nl80211_mlo_reconf_add_done(struct net_device *dev,
19932 struct cfg80211_mlo_reconf_done_data *data)
19933 {
19934 struct wireless_dev *wdev = dev->ieee80211_ptr;
19935 struct wiphy *wiphy = wdev->wiphy;
19936 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19937 struct nl80211_mlme_event event = {
19938 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19939 .buf = data->buf,
19940 .buf_len = data->len,
19941 .uapsd_queues = -1,
19942 };
19943
19944 nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
19945 }
19946 EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
19947
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)19948 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
19949 struct net_device *netdev, const u8 *bssid,
19950 gfp_t gfp)
19951 {
19952 struct sk_buff *msg;
19953 void *hdr;
19954
19955 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19956 if (!msg)
19957 return;
19958
19959 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
19960 if (!hdr) {
19961 nlmsg_free(msg);
19962 return;
19963 }
19964
19965 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19966 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19967 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19968 goto nla_put_failure;
19969
19970 genlmsg_end(msg, hdr);
19971
19972 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19973 NL80211_MCGRP_MLME, gfp);
19974 return;
19975
19976 nla_put_failure:
19977 nlmsg_free(msg);
19978 }
19979
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)19980 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
19981 const u8 *ie, u8 ie_len,
19982 int sig_dbm, gfp_t gfp)
19983 {
19984 struct wireless_dev *wdev = dev->ieee80211_ptr;
19985 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19986 struct sk_buff *msg;
19987 void *hdr;
19988
19989 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
19990 return;
19991
19992 trace_cfg80211_notify_new_peer_candidate(dev, addr);
19993
19994 msg = nlmsg_new(100 + ie_len, gfp);
19995 if (!msg)
19996 return;
19997
19998 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
19999 if (!hdr) {
20000 nlmsg_free(msg);
20001 return;
20002 }
20003
20004 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20005 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20006 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20007 (ie_len && ie &&
20008 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
20009 (sig_dbm &&
20010 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
20011 goto nla_put_failure;
20012
20013 genlmsg_end(msg, hdr);
20014
20015 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20016 NL80211_MCGRP_MLME, gfp);
20017 return;
20018
20019 nla_put_failure:
20020 nlmsg_free(msg);
20021 }
20022 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
20023
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)20024 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
20025 struct net_device *netdev, const u8 *addr,
20026 enum nl80211_key_type key_type, int key_id,
20027 const u8 *tsc, gfp_t gfp)
20028 {
20029 struct sk_buff *msg;
20030 void *hdr;
20031
20032 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20033 if (!msg)
20034 return;
20035
20036 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
20037 if (!hdr) {
20038 nlmsg_free(msg);
20039 return;
20040 }
20041
20042 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20043 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20044 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
20045 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
20046 (key_id != -1 &&
20047 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
20048 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
20049 goto nla_put_failure;
20050
20051 genlmsg_end(msg, hdr);
20052
20053 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20054 NL80211_MCGRP_MLME, gfp);
20055 return;
20056
20057 nla_put_failure:
20058 nlmsg_free(msg);
20059 }
20060
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)20061 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
20062 struct ieee80211_channel *channel_before,
20063 struct ieee80211_channel *channel_after)
20064 {
20065 struct sk_buff *msg;
20066 void *hdr;
20067 struct nlattr *nl_freq;
20068
20069 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
20070 if (!msg)
20071 return;
20072
20073 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
20074 if (!hdr) {
20075 nlmsg_free(msg);
20076 return;
20077 }
20078
20079 /*
20080 * Since we are applying the beacon hint to a wiphy we know its
20081 * wiphy_idx is valid
20082 */
20083 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
20084 goto nla_put_failure;
20085
20086 /* Before */
20087 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
20088 if (!nl_freq)
20089 goto nla_put_failure;
20090
20091 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
20092 goto nla_put_failure;
20093 nla_nest_end(msg, nl_freq);
20094
20095 /* After */
20096 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
20097 if (!nl_freq)
20098 goto nla_put_failure;
20099
20100 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
20101 goto nla_put_failure;
20102 nla_nest_end(msg, nl_freq);
20103
20104 genlmsg_end(msg, hdr);
20105
20106 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
20107 NL80211_MCGRP_REGULATORY);
20108
20109 return;
20110
20111 nla_put_failure:
20112 nlmsg_free(msg);
20113 }
20114
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20115 static void nl80211_send_remain_on_chan_event(
20116 int cmd, struct cfg80211_registered_device *rdev,
20117 struct wireless_dev *wdev, u64 cookie,
20118 struct ieee80211_channel *chan,
20119 unsigned int duration, gfp_t gfp)
20120 {
20121 struct sk_buff *msg;
20122 void *hdr;
20123
20124 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20125 if (!msg)
20126 return;
20127
20128 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20129 if (!hdr) {
20130 nlmsg_free(msg);
20131 return;
20132 }
20133
20134 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20135 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20136 wdev->netdev->ifindex)) ||
20137 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20138 NL80211_ATTR_PAD) ||
20139 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
20140 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
20141 NL80211_CHAN_NO_HT) ||
20142 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
20143 NL80211_ATTR_PAD))
20144 goto nla_put_failure;
20145
20146 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
20147 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
20148 goto nla_put_failure;
20149
20150 genlmsg_end(msg, hdr);
20151
20152 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20153 NL80211_MCGRP_MLME, gfp);
20154 return;
20155
20156 nla_put_failure:
20157 nlmsg_free(msg);
20158 }
20159
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)20160 void cfg80211_assoc_comeback(struct net_device *netdev,
20161 const u8 *ap_addr, u32 timeout)
20162 {
20163 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20164 struct wiphy *wiphy = wdev->wiphy;
20165 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20166 struct sk_buff *msg;
20167 void *hdr;
20168
20169 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
20170
20171 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20172 if (!msg)
20173 return;
20174
20175 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
20176 if (!hdr) {
20177 nlmsg_free(msg);
20178 return;
20179 }
20180
20181 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20182 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20183 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
20184 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
20185 goto nla_put_failure;
20186
20187 genlmsg_end(msg, hdr);
20188
20189 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20190 NL80211_MCGRP_MLME, GFP_KERNEL);
20191 return;
20192
20193 nla_put_failure:
20194 nlmsg_free(msg);
20195 }
20196 EXPORT_SYMBOL(cfg80211_assoc_comeback);
20197
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20198 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
20199 struct ieee80211_channel *chan,
20200 unsigned int duration, gfp_t gfp)
20201 {
20202 struct wiphy *wiphy = wdev->wiphy;
20203 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20204
20205 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
20206 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
20207 rdev, wdev, cookie, chan,
20208 duration, gfp);
20209 }
20210 EXPORT_SYMBOL(cfg80211_ready_on_channel);
20211
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20212 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
20213 struct ieee80211_channel *chan,
20214 gfp_t gfp)
20215 {
20216 struct wiphy *wiphy = wdev->wiphy;
20217 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20218
20219 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
20220 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
20221 rdev, wdev, cookie, chan, 0, gfp);
20222 }
20223 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
20224
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20225 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
20226 struct ieee80211_channel *chan,
20227 gfp_t gfp)
20228 {
20229 struct wiphy *wiphy = wdev->wiphy;
20230 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20231
20232 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
20233 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
20234 rdev, wdev, cookie, chan, 0, gfp);
20235 }
20236 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
20237
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20238 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
20239 struct station_info *sinfo, gfp_t gfp)
20240 {
20241 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20242 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20243 struct sk_buff *msg;
20244
20245 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
20246
20247 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20248 if (!msg)
20249 return;
20250
20251 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
20252 rdev, dev, mac_addr, sinfo, false) < 0) {
20253 nlmsg_free(msg);
20254 return;
20255 }
20256
20257 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20258 NL80211_MCGRP_MLME, gfp);
20259 }
20260 EXPORT_SYMBOL(cfg80211_new_sta);
20261
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20262 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
20263 struct station_info *sinfo, gfp_t gfp)
20264 {
20265 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20266 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20267 struct sk_buff *msg;
20268 struct station_info empty_sinfo = {};
20269
20270 if (!sinfo)
20271 sinfo = &empty_sinfo;
20272
20273 trace_cfg80211_del_sta(dev, mac_addr);
20274
20275 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20276 if (!msg) {
20277 cfg80211_sinfo_release_content(sinfo);
20278 return;
20279 }
20280
20281 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
20282 rdev, dev, mac_addr, sinfo, false) < 0) {
20283 nlmsg_free(msg);
20284 return;
20285 }
20286
20287 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20288 NL80211_MCGRP_MLME, gfp);
20289 }
20290 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
20291
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)20292 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
20293 enum nl80211_connect_failed_reason reason,
20294 gfp_t gfp)
20295 {
20296 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20297 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20298 struct sk_buff *msg;
20299 void *hdr;
20300
20301 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
20302 if (!msg)
20303 return;
20304
20305 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
20306 if (!hdr) {
20307 nlmsg_free(msg);
20308 return;
20309 }
20310
20311 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20312 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
20313 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
20314 goto nla_put_failure;
20315
20316 genlmsg_end(msg, hdr);
20317
20318 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20319 NL80211_MCGRP_MLME, gfp);
20320 return;
20321
20322 nla_put_failure:
20323 nlmsg_free(msg);
20324 }
20325 EXPORT_SYMBOL(cfg80211_conn_failed);
20326
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,int link_id,gfp_t gfp)20327 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
20328 const u8 *addr, int link_id, gfp_t gfp)
20329 {
20330 struct wireless_dev *wdev = dev->ieee80211_ptr;
20331 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20332 struct sk_buff *msg;
20333 void *hdr;
20334 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
20335
20336 if (!nlportid)
20337 return false;
20338
20339 msg = nlmsg_new(100, gfp);
20340 if (!msg)
20341 return true;
20342
20343 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20344 if (!hdr) {
20345 nlmsg_free(msg);
20346 return true;
20347 }
20348
20349 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20350 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20351 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20352 (link_id >= 0 &&
20353 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20354 goto nla_put_failure;
20355
20356 genlmsg_end(msg, hdr);
20357 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20358 return true;
20359
20360 nla_put_failure:
20361 nlmsg_free(msg);
20362 return true;
20363 }
20364
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20365 bool cfg80211_rx_spurious_frame(struct net_device *dev, const u8 *addr,
20366 int link_id, gfp_t gfp)
20367 {
20368 struct wireless_dev *wdev = dev->ieee80211_ptr;
20369 bool ret;
20370
20371 trace_cfg80211_rx_spurious_frame(dev, addr, link_id);
20372
20373 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20374 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
20375 trace_cfg80211_return_bool(false);
20376 return false;
20377 }
20378 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
20379 addr, link_id, gfp);
20380 trace_cfg80211_return_bool(ret);
20381 return ret;
20382 }
20383 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
20384
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20385 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, const u8 *addr,
20386 int link_id, gfp_t gfp)
20387 {
20388 struct wireless_dev *wdev = dev->ieee80211_ptr;
20389 bool ret;
20390
20391 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr, link_id);
20392
20393 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20394 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
20395 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
20396 trace_cfg80211_return_bool(false);
20397 return false;
20398 }
20399 ret = __nl80211_unexpected_frame(dev,
20400 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
20401 addr, link_id, gfp);
20402 trace_cfg80211_return_bool(ret);
20403 return ret;
20404 }
20405 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
20406
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)20407 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
20408 struct wireless_dev *wdev, u32 nlportid,
20409 struct cfg80211_rx_info *info, gfp_t gfp)
20410 {
20411 struct net_device *netdev = wdev->netdev;
20412 struct sk_buff *msg;
20413 void *hdr;
20414
20415 msg = nlmsg_new(100 + info->len, gfp);
20416 if (!msg)
20417 return -ENOMEM;
20418
20419 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20420 if (!hdr) {
20421 nlmsg_free(msg);
20422 return -ENOMEM;
20423 }
20424
20425 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20426 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20427 netdev->ifindex)) ||
20428 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20429 NL80211_ATTR_PAD) ||
20430 (info->have_link_id &&
20431 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
20432 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
20433 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
20434 (info->sig_dbm &&
20435 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
20436 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
20437 (info->flags &&
20438 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
20439 (info->rx_tstamp && nla_put_u64_64bit(msg,
20440 NL80211_ATTR_RX_HW_TIMESTAMP,
20441 info->rx_tstamp,
20442 NL80211_ATTR_PAD)) ||
20443 (info->ack_tstamp && nla_put_u64_64bit(msg,
20444 NL80211_ATTR_TX_HW_TIMESTAMP,
20445 info->ack_tstamp,
20446 NL80211_ATTR_PAD)))
20447 goto nla_put_failure;
20448
20449 genlmsg_end(msg, hdr);
20450
20451 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20452
20453 nla_put_failure:
20454 nlmsg_free(msg);
20455 return -ENOBUFS;
20456 }
20457
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)20458 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
20459 struct cfg80211_tx_status *status,
20460 gfp_t gfp, enum nl80211_commands command)
20461 {
20462 struct wiphy *wiphy = wdev->wiphy;
20463 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20464 struct net_device *netdev = wdev->netdev;
20465 struct sk_buff *msg;
20466 void *hdr;
20467
20468 if (command == NL80211_CMD_FRAME_TX_STATUS)
20469 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
20470 status->ack);
20471 else
20472 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
20473 status->ack);
20474
20475 msg = nlmsg_new(100 + status->len, gfp);
20476 if (!msg)
20477 return;
20478
20479 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
20480 if (!hdr) {
20481 nlmsg_free(msg);
20482 return;
20483 }
20484
20485 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20486 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20487 netdev->ifindex)) ||
20488 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20489 NL80211_ATTR_PAD) ||
20490 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
20491 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
20492 NL80211_ATTR_PAD) ||
20493 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
20494 (status->tx_tstamp &&
20495 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
20496 status->tx_tstamp, NL80211_ATTR_PAD)) ||
20497 (status->ack_tstamp &&
20498 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
20499 status->ack_tstamp, NL80211_ATTR_PAD)))
20500 goto nla_put_failure;
20501
20502 genlmsg_end(msg, hdr);
20503
20504 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20505 NL80211_MCGRP_MLME, gfp);
20506 return;
20507
20508 nla_put_failure:
20509 nlmsg_free(msg);
20510 }
20511
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)20512 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
20513 const u8 *buf, size_t len, bool ack,
20514 gfp_t gfp)
20515 {
20516 struct cfg80211_tx_status status = {
20517 .cookie = cookie,
20518 .buf = buf,
20519 .len = len,
20520 .ack = ack
20521 };
20522
20523 nl80211_frame_tx_status(wdev, &status, gfp,
20524 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
20525 }
20526 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
20527
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)20528 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
20529 struct cfg80211_tx_status *status, gfp_t gfp)
20530 {
20531 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
20532 }
20533 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
20534
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)20535 static int __nl80211_rx_control_port(struct net_device *dev,
20536 struct sk_buff *skb,
20537 bool unencrypted,
20538 int link_id,
20539 gfp_t gfp)
20540 {
20541 struct wireless_dev *wdev = dev->ieee80211_ptr;
20542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20543 struct ethhdr *ehdr = eth_hdr(skb);
20544 const u8 *addr = ehdr->h_source;
20545 u16 proto = be16_to_cpu(skb->protocol);
20546 struct sk_buff *msg;
20547 void *hdr;
20548 struct nlattr *frame;
20549
20550 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
20551
20552 if (!nlportid)
20553 return -ENOENT;
20554
20555 msg = nlmsg_new(100 + skb->len, gfp);
20556 if (!msg)
20557 return -ENOMEM;
20558
20559 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
20560 if (!hdr) {
20561 nlmsg_free(msg);
20562 return -ENOBUFS;
20563 }
20564
20565 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20566 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20567 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20568 NL80211_ATTR_PAD) ||
20569 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20570 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
20571 (link_id >= 0 &&
20572 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
20573 (unencrypted && nla_put_flag(msg,
20574 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
20575 goto nla_put_failure;
20576
20577 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
20578 if (!frame)
20579 goto nla_put_failure;
20580
20581 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
20582 genlmsg_end(msg, hdr);
20583
20584 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20585
20586 nla_put_failure:
20587 nlmsg_free(msg);
20588 return -ENOBUFS;
20589 }
20590
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)20591 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
20592 bool unencrypted, int link_id)
20593 {
20594 int ret;
20595
20596 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
20597 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
20598 GFP_ATOMIC);
20599 trace_cfg80211_return_bool(ret == 0);
20600 return ret == 0;
20601 }
20602 EXPORT_SYMBOL(cfg80211_rx_control_port);
20603
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)20604 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
20605 const char *mac, gfp_t gfp)
20606 {
20607 struct wireless_dev *wdev = dev->ieee80211_ptr;
20608 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20609 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20610 void **cb;
20611
20612 if (!msg)
20613 return NULL;
20614
20615 cb = (void **)msg->cb;
20616
20617 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
20618 if (!cb[0]) {
20619 nlmsg_free(msg);
20620 return NULL;
20621 }
20622
20623 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20624 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
20625 goto nla_put_failure;
20626
20627 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
20628 goto nla_put_failure;
20629
20630 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
20631 if (!cb[1])
20632 goto nla_put_failure;
20633
20634 cb[2] = rdev;
20635
20636 return msg;
20637 nla_put_failure:
20638 nlmsg_free(msg);
20639 return NULL;
20640 }
20641
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)20642 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
20643 {
20644 void **cb = (void **)msg->cb;
20645 struct cfg80211_registered_device *rdev = cb[2];
20646
20647 nla_nest_end(msg, cb[1]);
20648 genlmsg_end(msg, cb[0]);
20649
20650 memset(msg->cb, 0, sizeof(msg->cb));
20651
20652 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20653 NL80211_MCGRP_MLME, gfp);
20654 }
20655
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)20656 void cfg80211_cqm_rssi_notify(struct net_device *dev,
20657 enum nl80211_cqm_rssi_threshold_event rssi_event,
20658 s32 rssi_level, gfp_t gfp)
20659 {
20660 struct wireless_dev *wdev = dev->ieee80211_ptr;
20661 struct cfg80211_cqm_config *cqm_config;
20662
20663 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
20664
20665 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
20666 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
20667 return;
20668
20669 rcu_read_lock();
20670 cqm_config = rcu_dereference(wdev->cqm_config);
20671 if (cqm_config) {
20672 cqm_config->last_rssi_event_value = rssi_level;
20673 cqm_config->last_rssi_event_type = rssi_event;
20674 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
20675 }
20676 rcu_read_unlock();
20677 }
20678 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
20679
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)20680 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
20681 {
20682 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
20683 cqm_rssi_work);
20684 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20685 enum nl80211_cqm_rssi_threshold_event rssi_event;
20686 struct cfg80211_cqm_config *cqm_config;
20687 struct sk_buff *msg;
20688 s32 rssi_level;
20689
20690 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
20691 if (!cqm_config)
20692 return;
20693
20694 if (cqm_config->use_range_api)
20695 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
20696
20697 rssi_level = cqm_config->last_rssi_event_value;
20698 rssi_event = cqm_config->last_rssi_event_type;
20699
20700 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
20701 if (!msg)
20702 return;
20703
20704 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
20705 rssi_event))
20706 goto nla_put_failure;
20707
20708 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
20709 rssi_level))
20710 goto nla_put_failure;
20711
20712 cfg80211_send_cqm(msg, GFP_KERNEL);
20713
20714 return;
20715
20716 nla_put_failure:
20717 nlmsg_free(msg);
20718 }
20719
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)20720 void cfg80211_cqm_txe_notify(struct net_device *dev,
20721 const u8 *peer, u32 num_packets,
20722 u32 rate, u32 intvl, gfp_t gfp)
20723 {
20724 struct sk_buff *msg;
20725
20726 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20727 if (!msg)
20728 return;
20729
20730 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
20731 goto nla_put_failure;
20732
20733 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
20734 goto nla_put_failure;
20735
20736 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
20737 goto nla_put_failure;
20738
20739 cfg80211_send_cqm(msg, gfp);
20740 return;
20741
20742 nla_put_failure:
20743 nlmsg_free(msg);
20744 }
20745 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
20746
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)20747 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
20748 const u8 *peer, u32 num_packets, gfp_t gfp)
20749 {
20750 struct sk_buff *msg;
20751
20752 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
20753
20754 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20755 if (!msg)
20756 return;
20757
20758 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
20759 goto nla_put_failure;
20760
20761 cfg80211_send_cqm(msg, gfp);
20762 return;
20763
20764 nla_put_failure:
20765 nlmsg_free(msg);
20766 }
20767 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
20768
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)20769 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
20770 {
20771 struct sk_buff *msg;
20772
20773 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
20774 if (!msg)
20775 return;
20776
20777 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
20778 goto nla_put_failure;
20779
20780 cfg80211_send_cqm(msg, gfp);
20781 return;
20782
20783 nla_put_failure:
20784 nlmsg_free(msg);
20785 }
20786 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
20787
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20788 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
20789 struct net_device *netdev, const u8 *bssid,
20790 const u8 *replay_ctr, gfp_t gfp)
20791 {
20792 struct sk_buff *msg;
20793 struct nlattr *rekey_attr;
20794 void *hdr;
20795
20796 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20797 if (!msg)
20798 return;
20799
20800 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
20801 if (!hdr) {
20802 nlmsg_free(msg);
20803 return;
20804 }
20805
20806 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20807 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20808 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
20809 goto nla_put_failure;
20810
20811 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
20812 if (!rekey_attr)
20813 goto nla_put_failure;
20814
20815 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
20816 NL80211_REPLAY_CTR_LEN, replay_ctr))
20817 goto nla_put_failure;
20818
20819 nla_nest_end(msg, rekey_attr);
20820
20821 genlmsg_end(msg, hdr);
20822
20823 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20824 NL80211_MCGRP_MLME, gfp);
20825 return;
20826
20827 nla_put_failure:
20828 nlmsg_free(msg);
20829 }
20830
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20831 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
20832 const u8 *replay_ctr, gfp_t gfp)
20833 {
20834 struct wireless_dev *wdev = dev->ieee80211_ptr;
20835 struct wiphy *wiphy = wdev->wiphy;
20836 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20837
20838 trace_cfg80211_gtk_rekey_notify(dev, bssid);
20839 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
20840 }
20841 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
20842
20843 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20844 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
20845 struct net_device *netdev, int index,
20846 const u8 *bssid, bool preauth, gfp_t gfp)
20847 {
20848 struct sk_buff *msg;
20849 struct nlattr *attr;
20850 void *hdr;
20851
20852 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20853 if (!msg)
20854 return;
20855
20856 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
20857 if (!hdr) {
20858 nlmsg_free(msg);
20859 return;
20860 }
20861
20862 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20863 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20864 goto nla_put_failure;
20865
20866 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
20867 if (!attr)
20868 goto nla_put_failure;
20869
20870 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
20871 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
20872 (preauth &&
20873 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
20874 goto nla_put_failure;
20875
20876 nla_nest_end(msg, attr);
20877
20878 genlmsg_end(msg, hdr);
20879
20880 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20881 NL80211_MCGRP_MLME, gfp);
20882 return;
20883
20884 nla_put_failure:
20885 nlmsg_free(msg);
20886 }
20887
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20888 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
20889 const u8 *bssid, bool preauth, gfp_t gfp)
20890 {
20891 struct wireless_dev *wdev = dev->ieee80211_ptr;
20892 struct wiphy *wiphy = wdev->wiphy;
20893 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20894
20895 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
20896 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
20897 }
20898 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
20899
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)20900 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
20901 struct net_device *netdev,
20902 unsigned int link_id,
20903 struct cfg80211_chan_def *chandef,
20904 gfp_t gfp,
20905 enum nl80211_commands notif,
20906 u8 count, bool quiet)
20907 {
20908 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20909 struct sk_buff *msg;
20910 void *hdr;
20911
20912 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20913 if (!msg)
20914 return;
20915
20916 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
20917 if (!hdr) {
20918 nlmsg_free(msg);
20919 return;
20920 }
20921
20922 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20923 goto nla_put_failure;
20924
20925 if (wdev->valid_links &&
20926 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
20927 goto nla_put_failure;
20928
20929 if (nl80211_send_chandef(msg, chandef))
20930 goto nla_put_failure;
20931
20932 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
20933 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
20934 goto nla_put_failure;
20935 if (quiet &&
20936 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
20937 goto nla_put_failure;
20938 }
20939
20940 genlmsg_end(msg, hdr);
20941
20942 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20943 NL80211_MCGRP_MLME, gfp);
20944 return;
20945
20946 nla_put_failure:
20947 nlmsg_free(msg);
20948 }
20949
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)20950 void cfg80211_ch_switch_notify(struct net_device *dev,
20951 struct cfg80211_chan_def *chandef,
20952 unsigned int link_id)
20953 {
20954 struct wireless_dev *wdev = dev->ieee80211_ptr;
20955 struct wiphy *wiphy = wdev->wiphy;
20956 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20957
20958 lockdep_assert_wiphy(wdev->wiphy);
20959 WARN_INVALID_LINK_ID(wdev, link_id);
20960
20961 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
20962
20963 switch (wdev->iftype) {
20964 case NL80211_IFTYPE_STATION:
20965 case NL80211_IFTYPE_P2P_CLIENT:
20966 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
20967 cfg80211_update_assoc_bss_entry(wdev, link_id,
20968 chandef->chan);
20969 break;
20970 case NL80211_IFTYPE_MESH_POINT:
20971 wdev->u.mesh.chandef = *chandef;
20972 wdev->u.mesh.preset_chandef = *chandef;
20973 break;
20974 case NL80211_IFTYPE_AP:
20975 case NL80211_IFTYPE_P2P_GO:
20976 wdev->links[link_id].ap.chandef = *chandef;
20977 break;
20978 case NL80211_IFTYPE_ADHOC:
20979 wdev->u.ibss.chandef = *chandef;
20980 break;
20981 default:
20982 WARN_ON(1);
20983 break;
20984 }
20985
20986 cfg80211_schedule_channels_check(wdev);
20987 cfg80211_sched_dfs_chan_update(rdev);
20988
20989 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
20990 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
20991 }
20992 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
20993
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet)20994 void cfg80211_ch_switch_started_notify(struct net_device *dev,
20995 struct cfg80211_chan_def *chandef,
20996 unsigned int link_id, u8 count,
20997 bool quiet)
20998 {
20999 struct wireless_dev *wdev = dev->ieee80211_ptr;
21000 struct wiphy *wiphy = wdev->wiphy;
21001 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21002
21003 lockdep_assert_wiphy(wdev->wiphy);
21004 WARN_INVALID_LINK_ID(wdev, link_id);
21005
21006 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
21007
21008
21009 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
21010 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
21011 count, quiet);
21012 }
21013 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
21014
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap,u8 link_id)21015 int cfg80211_bss_color_notify(struct net_device *dev,
21016 enum nl80211_commands cmd, u8 count,
21017 u64 color_bitmap, u8 link_id)
21018 {
21019 struct wireless_dev *wdev = dev->ieee80211_ptr;
21020 struct wiphy *wiphy = wdev->wiphy;
21021 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21022 struct sk_buff *msg;
21023 void *hdr;
21024
21025 lockdep_assert_wiphy(wdev->wiphy);
21026
21027 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
21028
21029 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21030 if (!msg)
21031 return -ENOMEM;
21032
21033 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
21034 if (!hdr)
21035 goto nla_put_failure;
21036
21037 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21038 goto nla_put_failure;
21039
21040 if (wdev->valid_links &&
21041 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
21042 goto nla_put_failure;
21043
21044 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
21045 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
21046 goto nla_put_failure;
21047
21048 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
21049 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
21050 color_bitmap, NL80211_ATTR_PAD))
21051 goto nla_put_failure;
21052
21053 genlmsg_end(msg, hdr);
21054
21055 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
21056 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
21057
21058 nla_put_failure:
21059 nlmsg_free(msg);
21060 return -EINVAL;
21061 }
21062 EXPORT_SYMBOL(cfg80211_bss_color_notify);
21063
21064 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)21065 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
21066 const struct cfg80211_chan_def *chandef,
21067 enum nl80211_radar_event event,
21068 struct net_device *netdev, gfp_t gfp)
21069 {
21070 struct sk_buff *msg;
21071 void *hdr;
21072
21073 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21074 if (!msg)
21075 return;
21076
21077 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
21078 if (!hdr) {
21079 nlmsg_free(msg);
21080 return;
21081 }
21082
21083 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21084 goto nla_put_failure;
21085
21086 /* NOP and radar events don't need a netdev parameter */
21087 if (netdev) {
21088 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21089
21090 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21091 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21092 NL80211_ATTR_PAD))
21093 goto nla_put_failure;
21094 }
21095
21096 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
21097 goto nla_put_failure;
21098
21099 if (nl80211_send_chandef(msg, chandef))
21100 goto nla_put_failure;
21101
21102 genlmsg_end(msg, hdr);
21103
21104 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21105 NL80211_MCGRP_MLME, gfp);
21106 return;
21107
21108 nla_put_failure:
21109 nlmsg_free(msg);
21110 }
21111
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)21112 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
21113 struct sta_opmode_info *sta_opmode,
21114 gfp_t gfp)
21115 {
21116 struct sk_buff *msg;
21117 struct wireless_dev *wdev = dev->ieee80211_ptr;
21118 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21119 void *hdr;
21120
21121 if (WARN_ON(!mac))
21122 return;
21123
21124 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21125 if (!msg)
21126 return;
21127
21128 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
21129 if (!hdr) {
21130 nlmsg_free(msg);
21131 return;
21132 }
21133
21134 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21135 goto nla_put_failure;
21136
21137 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21138 goto nla_put_failure;
21139
21140 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
21141 goto nla_put_failure;
21142
21143 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
21144 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
21145 goto nla_put_failure;
21146
21147 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
21148 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
21149 goto nla_put_failure;
21150
21151 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
21152 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
21153 goto nla_put_failure;
21154
21155 genlmsg_end(msg, hdr);
21156
21157 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21158 NL80211_MCGRP_MLME, gfp);
21159
21160 return;
21161
21162 nla_put_failure:
21163 nlmsg_free(msg);
21164 }
21165 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
21166
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)21167 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
21168 u64 cookie, bool acked, s32 ack_signal,
21169 bool is_valid_ack_signal, gfp_t gfp)
21170 {
21171 struct wireless_dev *wdev = dev->ieee80211_ptr;
21172 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21173 struct sk_buff *msg;
21174 void *hdr;
21175
21176 trace_cfg80211_probe_status(dev, addr, cookie, acked);
21177
21178 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21179
21180 if (!msg)
21181 return;
21182
21183 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
21184 if (!hdr) {
21185 nlmsg_free(msg);
21186 return;
21187 }
21188
21189 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21190 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21191 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
21192 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
21193 NL80211_ATTR_PAD) ||
21194 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
21195 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
21196 ack_signal)))
21197 goto nla_put_failure;
21198
21199 genlmsg_end(msg, hdr);
21200
21201 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21202 NL80211_MCGRP_MLME, gfp);
21203 return;
21204
21205 nla_put_failure:
21206 nlmsg_free(msg);
21207 }
21208 EXPORT_SYMBOL(cfg80211_probe_status);
21209
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)21210 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
21211 size_t len, int freq, int sig_dbm)
21212 {
21213 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21214 struct sk_buff *msg;
21215 void *hdr;
21216 struct cfg80211_beacon_registration *reg;
21217
21218 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
21219
21220 spin_lock_bh(&rdev->beacon_registrations_lock);
21221 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
21222 msg = nlmsg_new(len + 100, GFP_ATOMIC);
21223 if (!msg) {
21224 spin_unlock_bh(&rdev->beacon_registrations_lock);
21225 return;
21226 }
21227
21228 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
21229 if (!hdr)
21230 goto nla_put_failure;
21231
21232 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21233 (freq &&
21234 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
21235 KHZ_TO_MHZ(freq)) ||
21236 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
21237 freq % 1000))) ||
21238 (sig_dbm &&
21239 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
21240 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
21241 goto nla_put_failure;
21242
21243 genlmsg_end(msg, hdr);
21244
21245 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
21246 }
21247 spin_unlock_bh(&rdev->beacon_registrations_lock);
21248 return;
21249
21250 nla_put_failure:
21251 spin_unlock_bh(&rdev->beacon_registrations_lock);
21252 nlmsg_free(msg);
21253 }
21254 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
21255
21256 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)21257 static int cfg80211_net_detect_results(struct sk_buff *msg,
21258 struct cfg80211_wowlan_wakeup *wakeup)
21259 {
21260 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
21261 struct nlattr *nl_results, *nl_match, *nl_freqs;
21262 int i, j;
21263
21264 nl_results = nla_nest_start_noflag(msg,
21265 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
21266 if (!nl_results)
21267 return -EMSGSIZE;
21268
21269 for (i = 0; i < nd->n_matches; i++) {
21270 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
21271
21272 nl_match = nla_nest_start_noflag(msg, i);
21273 if (!nl_match)
21274 break;
21275
21276 /* The SSID attribute is optional in nl80211, but for
21277 * simplicity reasons it's always present in the
21278 * cfg80211 structure. If a driver can't pass the
21279 * SSID, that needs to be changed. A zero length SSID
21280 * is still a valid SSID (wildcard), so it cannot be
21281 * used for this purpose.
21282 */
21283 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
21284 match->ssid.ssid)) {
21285 nla_nest_cancel(msg, nl_match);
21286 goto out;
21287 }
21288
21289 if (match->n_channels) {
21290 nl_freqs = nla_nest_start_noflag(msg,
21291 NL80211_ATTR_SCAN_FREQUENCIES);
21292 if (!nl_freqs) {
21293 nla_nest_cancel(msg, nl_match);
21294 goto out;
21295 }
21296
21297 for (j = 0; j < match->n_channels; j++) {
21298 if (nla_put_u32(msg, j, match->channels[j])) {
21299 nla_nest_cancel(msg, nl_freqs);
21300 nla_nest_cancel(msg, nl_match);
21301 goto out;
21302 }
21303 }
21304
21305 nla_nest_end(msg, nl_freqs);
21306 }
21307
21308 nla_nest_end(msg, nl_match);
21309 }
21310
21311 out:
21312 nla_nest_end(msg, nl_results);
21313 return 0;
21314 }
21315
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)21316 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
21317 struct cfg80211_wowlan_wakeup *wakeup,
21318 gfp_t gfp)
21319 {
21320 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21321 struct sk_buff *msg;
21322 void *hdr;
21323 int size = 200;
21324
21325 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
21326
21327 if (wakeup)
21328 size += wakeup->packet_present_len;
21329
21330 msg = nlmsg_new(size, gfp);
21331 if (!msg)
21332 return;
21333
21334 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
21335 if (!hdr)
21336 goto free_msg;
21337
21338 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21339 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21340 NL80211_ATTR_PAD))
21341 goto free_msg;
21342
21343 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
21344 wdev->netdev->ifindex))
21345 goto free_msg;
21346
21347 if (wakeup) {
21348 struct nlattr *reasons;
21349
21350 reasons = nla_nest_start_noflag(msg,
21351 NL80211_ATTR_WOWLAN_TRIGGERS);
21352 if (!reasons)
21353 goto free_msg;
21354
21355 if (wakeup->disconnect &&
21356 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
21357 goto free_msg;
21358 if (wakeup->magic_pkt &&
21359 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
21360 goto free_msg;
21361 if (wakeup->gtk_rekey_failure &&
21362 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
21363 goto free_msg;
21364 if (wakeup->eap_identity_req &&
21365 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
21366 goto free_msg;
21367 if (wakeup->four_way_handshake &&
21368 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
21369 goto free_msg;
21370 if (wakeup->rfkill_release &&
21371 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
21372 goto free_msg;
21373
21374 if (wakeup->pattern_idx >= 0 &&
21375 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
21376 wakeup->pattern_idx))
21377 goto free_msg;
21378
21379 if (wakeup->tcp_match &&
21380 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
21381 goto free_msg;
21382
21383 if (wakeup->tcp_connlost &&
21384 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
21385 goto free_msg;
21386
21387 if (wakeup->tcp_nomoretokens &&
21388 nla_put_flag(msg,
21389 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
21390 goto free_msg;
21391
21392 if (wakeup->unprot_deauth_disassoc &&
21393 nla_put_flag(msg,
21394 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
21395 goto free_msg;
21396
21397 if (wakeup->packet) {
21398 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
21399 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
21400
21401 if (!wakeup->packet_80211) {
21402 pkt_attr =
21403 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
21404 len_attr =
21405 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
21406 }
21407
21408 if (wakeup->packet_len &&
21409 nla_put_u32(msg, len_attr, wakeup->packet_len))
21410 goto free_msg;
21411
21412 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
21413 wakeup->packet))
21414 goto free_msg;
21415 }
21416
21417 if (wakeup->net_detect &&
21418 cfg80211_net_detect_results(msg, wakeup))
21419 goto free_msg;
21420
21421 nla_nest_end(msg, reasons);
21422 }
21423
21424 genlmsg_end(msg, hdr);
21425
21426 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21427 NL80211_MCGRP_MLME, gfp);
21428 return;
21429
21430 free_msg:
21431 nlmsg_free(msg);
21432 }
21433 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
21434 #endif
21435
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)21436 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
21437 enum nl80211_tdls_operation oper,
21438 u16 reason_code, gfp_t gfp)
21439 {
21440 struct wireless_dev *wdev = dev->ieee80211_ptr;
21441 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21442 struct sk_buff *msg;
21443 void *hdr;
21444
21445 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
21446 reason_code);
21447
21448 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21449 if (!msg)
21450 return;
21451
21452 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
21453 if (!hdr) {
21454 nlmsg_free(msg);
21455 return;
21456 }
21457
21458 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21459 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21460 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
21461 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
21462 (reason_code > 0 &&
21463 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
21464 goto nla_put_failure;
21465
21466 genlmsg_end(msg, hdr);
21467
21468 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21469 NL80211_MCGRP_MLME, gfp);
21470 return;
21471
21472 nla_put_failure:
21473 nlmsg_free(msg);
21474 }
21475 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
21476
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)21477 static int nl80211_netlink_notify(struct notifier_block * nb,
21478 unsigned long state,
21479 void *_notify)
21480 {
21481 struct netlink_notify *notify = _notify;
21482 struct cfg80211_registered_device *rdev;
21483 struct wireless_dev *wdev;
21484 struct cfg80211_beacon_registration *reg, *tmp;
21485
21486 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
21487 return NOTIFY_DONE;
21488
21489 rcu_read_lock();
21490
21491 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
21492 struct cfg80211_sched_scan_request *sched_scan_req;
21493
21494 list_for_each_entry_rcu(sched_scan_req,
21495 &rdev->sched_scan_req_list,
21496 list) {
21497 if (sched_scan_req->owner_nlportid == notify->portid) {
21498 sched_scan_req->nl_owner_dead = true;
21499 wiphy_work_queue(&rdev->wiphy,
21500 &rdev->sched_scan_stop_wk);
21501 }
21502 }
21503
21504 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
21505 cfg80211_mlme_unregister_socket(wdev, notify->portid);
21506
21507 if (wdev->owner_nlportid == notify->portid) {
21508 wdev->nl_owner_dead = true;
21509 schedule_work(&rdev->destroy_work);
21510 } else if (wdev->conn_owner_nlportid == notify->portid) {
21511 schedule_work(&wdev->disconnect_wk);
21512 }
21513
21514 cfg80211_release_pmsr(wdev, notify->portid);
21515 }
21516
21517 spin_lock_bh(&rdev->beacon_registrations_lock);
21518 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
21519 list) {
21520 if (reg->nlportid == notify->portid) {
21521 list_del(®->list);
21522 kfree(reg);
21523 break;
21524 }
21525 }
21526 spin_unlock_bh(&rdev->beacon_registrations_lock);
21527 }
21528
21529 rcu_read_unlock();
21530
21531 /*
21532 * It is possible that the user space process that is controlling the
21533 * indoor setting disappeared, so notify the regulatory core.
21534 */
21535 regulatory_netlink_notify(notify->portid);
21536 return NOTIFY_OK;
21537 }
21538
21539 static struct notifier_block nl80211_netlink_notifier = {
21540 .notifier_call = nl80211_netlink_notify,
21541 };
21542
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)21543 void cfg80211_ft_event(struct net_device *netdev,
21544 struct cfg80211_ft_event_params *ft_event)
21545 {
21546 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21547 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21548 struct sk_buff *msg;
21549 void *hdr;
21550
21551 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
21552
21553 if (!ft_event->target_ap)
21554 return;
21555
21556 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
21557 GFP_KERNEL);
21558 if (!msg)
21559 return;
21560
21561 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
21562 if (!hdr)
21563 goto out;
21564
21565 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21566 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21567 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
21568 goto out;
21569
21570 if (ft_event->ies &&
21571 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
21572 goto out;
21573 if (ft_event->ric_ies &&
21574 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
21575 ft_event->ric_ies))
21576 goto out;
21577
21578 genlmsg_end(msg, hdr);
21579
21580 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21581 NL80211_MCGRP_MLME, GFP_KERNEL);
21582 return;
21583 out:
21584 nlmsg_free(msg);
21585 }
21586 EXPORT_SYMBOL(cfg80211_ft_event);
21587
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)21588 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
21589 {
21590 struct cfg80211_registered_device *rdev;
21591 struct sk_buff *msg;
21592 void *hdr;
21593 u32 nlportid;
21594
21595 rdev = wiphy_to_rdev(wdev->wiphy);
21596 if (!rdev->crit_proto_nlportid)
21597 return;
21598
21599 nlportid = rdev->crit_proto_nlportid;
21600 rdev->crit_proto_nlportid = 0;
21601
21602 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21603 if (!msg)
21604 return;
21605
21606 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
21607 if (!hdr)
21608 goto nla_put_failure;
21609
21610 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21611 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21612 NL80211_ATTR_PAD))
21613 goto nla_put_failure;
21614
21615 genlmsg_end(msg, hdr);
21616
21617 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
21618 return;
21619
21620 nla_put_failure:
21621 nlmsg_free(msg);
21622 }
21623 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
21624
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)21625 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
21626 {
21627 struct wiphy *wiphy = wdev->wiphy;
21628 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21629 struct sk_buff *msg;
21630 void *hdr;
21631
21632 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21633 if (!msg)
21634 return;
21635
21636 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
21637 if (!hdr)
21638 goto out;
21639
21640 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21641 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
21642 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21643 NL80211_ATTR_PAD) ||
21644 (wdev->valid_links &&
21645 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
21646 goto out;
21647
21648 genlmsg_end(msg, hdr);
21649
21650 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
21651 NL80211_MCGRP_MLME, GFP_KERNEL);
21652 return;
21653 out:
21654 nlmsg_free(msg);
21655 }
21656
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)21657 int cfg80211_external_auth_request(struct net_device *dev,
21658 struct cfg80211_external_auth_params *params,
21659 gfp_t gfp)
21660 {
21661 struct wireless_dev *wdev = dev->ieee80211_ptr;
21662 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21663 struct sk_buff *msg;
21664 void *hdr;
21665
21666 if (!wdev->conn_owner_nlportid)
21667 return -EINVAL;
21668
21669 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21670 if (!msg)
21671 return -ENOMEM;
21672
21673 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
21674 if (!hdr)
21675 goto nla_put_failure;
21676
21677 /* Some historical mistakes in drivers <-> userspace interface (notably
21678 * between drivers and wpa_supplicant) led to a big-endian conversion
21679 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
21680 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
21681 * benefit of older wpa_supplicant versions, send this particular value
21682 * in big-endian. Note that newer wpa_supplicant will also detect this
21683 * particular value in big endian still, so it all continues to work.
21684 */
21685 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
21686 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
21687 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
21688 goto nla_put_failure;
21689 } else {
21690 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
21691 params->key_mgmt_suite))
21692 goto nla_put_failure;
21693 }
21694
21695 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21696 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21697 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
21698 params->action) ||
21699 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
21700 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
21701 params->ssid.ssid) ||
21702 (!is_zero_ether_addr(params->mld_addr) &&
21703 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
21704 goto nla_put_failure;
21705
21706 genlmsg_end(msg, hdr);
21707 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
21708 wdev->conn_owner_nlportid);
21709 return 0;
21710
21711 nla_put_failure:
21712 nlmsg_free(msg);
21713 return -ENOBUFS;
21714 }
21715 EXPORT_SYMBOL(cfg80211_external_auth_request);
21716
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)21717 void cfg80211_update_owe_info_event(struct net_device *netdev,
21718 struct cfg80211_update_owe_info *owe_info,
21719 gfp_t gfp)
21720 {
21721 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21722 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21723 struct sk_buff *msg;
21724 void *hdr;
21725
21726 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
21727
21728 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21729 if (!msg)
21730 return;
21731
21732 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
21733 if (!hdr)
21734 goto nla_put_failure;
21735
21736 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21737 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21738 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
21739 goto nla_put_failure;
21740
21741 if (!owe_info->ie_len ||
21742 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
21743 goto nla_put_failure;
21744
21745 if (owe_info->assoc_link_id != -1) {
21746 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
21747 owe_info->assoc_link_id))
21748 goto nla_put_failure;
21749
21750 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
21751 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
21752 owe_info->peer_mld_addr))
21753 goto nla_put_failure;
21754 }
21755
21756 genlmsg_end(msg, hdr);
21757
21758 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21759 NL80211_MCGRP_MLME, gfp);
21760 return;
21761
21762 nla_put_failure:
21763 genlmsg_cancel(msg, hdr);
21764 nlmsg_free(msg);
21765 }
21766 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
21767
cfg80211_schedule_channels_check(struct wireless_dev * wdev)21768 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
21769 {
21770 struct wiphy *wiphy = wdev->wiphy;
21771
21772 /* Schedule channels check if NO_IR or DFS relaxations are supported */
21773 if (wdev->iftype == NL80211_IFTYPE_STATION &&
21774 (wiphy_ext_feature_isset(wiphy,
21775 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
21776 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
21777 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
21778 reg_check_channels();
21779 }
21780 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
21781
cfg80211_epcs_changed(struct net_device * netdev,bool enabled)21782 void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
21783 {
21784 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21785 struct wiphy *wiphy = wdev->wiphy;
21786 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21787 struct sk_buff *msg;
21788 void *hdr;
21789
21790 trace_cfg80211_epcs_changed(wdev, enabled);
21791
21792 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21793 if (!msg)
21794 return;
21795
21796 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
21797 if (!hdr) {
21798 nlmsg_free(msg);
21799 return;
21800 }
21801
21802 if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
21803 goto nla_put_failure;
21804
21805 genlmsg_end(msg, hdr);
21806 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21807 NL80211_MCGRP_MLME, GFP_KERNEL);
21808 return;
21809
21810 nla_put_failure:
21811 nlmsg_free(msg);
21812 }
21813 EXPORT_SYMBOL(cfg80211_epcs_changed);
21814
cfg80211_next_nan_dw_notif(struct wireless_dev * wdev,struct ieee80211_channel * chan,gfp_t gfp)21815 void cfg80211_next_nan_dw_notif(struct wireless_dev *wdev,
21816 struct ieee80211_channel *chan, gfp_t gfp)
21817 {
21818 struct wiphy *wiphy = wdev->wiphy;
21819 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21820 struct sk_buff *msg;
21821 void *hdr;
21822
21823 trace_cfg80211_next_nan_dw_notif(wdev, chan);
21824
21825 if (!wdev->owner_nlportid)
21826 return;
21827
21828 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21829 if (!msg)
21830 return;
21831
21832 hdr = nl80211hdr_put(msg, 0, 0, 0,
21833 NL80211_CMD_NAN_NEXT_DW_NOTIFICATION);
21834 if (!hdr)
21835 goto nla_put_failure;
21836
21837 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21838 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21839 NL80211_ATTR_PAD) ||
21840 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq))
21841 goto nla_put_failure;
21842
21843 genlmsg_end(msg, hdr);
21844
21845 genlmsg_unicast(wiphy_net(wiphy), msg, wdev->owner_nlportid);
21846
21847 return;
21848
21849 nla_put_failure:
21850 nlmsg_free(msg);
21851 }
21852 EXPORT_SYMBOL(cfg80211_next_nan_dw_notif);
21853
cfg80211_nan_cluster_joined(struct wireless_dev * wdev,const u8 * cluster_id,bool new_cluster,gfp_t gfp)21854 void cfg80211_nan_cluster_joined(struct wireless_dev *wdev,
21855 const u8 *cluster_id, bool new_cluster,
21856 gfp_t gfp)
21857 {
21858 struct wiphy *wiphy = wdev->wiphy;
21859 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21860 struct sk_buff *msg;
21861 void *hdr;
21862
21863 trace_cfg80211_nan_cluster_joined(wdev, cluster_id, new_cluster);
21864
21865 memcpy(wdev->u.nan.cluster_id, cluster_id, ETH_ALEN);
21866
21867 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21868 if (!msg)
21869 return;
21870
21871 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_CLUSTER_JOINED);
21872 if (!hdr)
21873 goto nla_put_failure;
21874
21875 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21876 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21877 NL80211_ATTR_PAD) ||
21878 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cluster_id) ||
21879 (new_cluster && nla_put_flag(msg, NL80211_ATTR_NAN_NEW_CLUSTER)))
21880 goto nla_put_failure;
21881
21882 genlmsg_end(msg, hdr);
21883
21884 if (!wdev->owner_nlportid)
21885 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy),
21886 msg, 0, NL80211_MCGRP_NAN, gfp);
21887 else
21888 genlmsg_unicast(wiphy_net(wiphy), msg,
21889 wdev->owner_nlportid);
21890 return;
21891
21892 nla_put_failure:
21893 nlmsg_free(msg);
21894 }
21895 EXPORT_SYMBOL(cfg80211_nan_cluster_joined);
21896
21897 /* initialisation/exit functions */
21898
nl80211_init(void)21899 int __init nl80211_init(void)
21900 {
21901 int err;
21902
21903 err = genl_register_family(&nl80211_fam);
21904 if (err)
21905 return err;
21906
21907 err = netlink_register_notifier(&nl80211_netlink_notifier);
21908 if (err)
21909 goto err_out;
21910
21911 return 0;
21912 err_out:
21913 genl_unregister_family(&nl80211_fam);
21914 return err;
21915 }
21916
nl80211_exit(void)21917 void nl80211_exit(void)
21918 {
21919 netlink_unregister_notifier(&nl80211_netlink_notifier);
21920 genl_unregister_family(&nl80211_fam);
21921 }
21922