1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2025 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 const struct ieee80211_ext *ext;
233 unsigned int fixedlen, hdrlen;
234 bool s1g_bcn;
235
236 if (len < offsetofend(typeof(*mgmt), frame_control))
237 goto err;
238
239 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
240 if (s1g_bcn) {
241 ext = (struct ieee80211_ext *)mgmt;
242 fixedlen =
243 offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
244 ieee80211_s1g_optional_len(ext->frame_control);
245 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
246 } else {
247 fixedlen = offsetof(struct ieee80211_mgmt,
248 u.beacon.variable);
249 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
250 }
251
252 if (len < fixedlen)
253 goto err;
254
255 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
256 goto err;
257
258 data += fixedlen;
259 len -= fixedlen;
260
261 for_each_element(elem, data, len) {
262 /* nothing */
263 }
264
265 if (for_each_element_completed(elem, data, len))
266 return 0;
267
268 err:
269 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
270 return -EINVAL;
271 }
272
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)273 static int validate_ie_attr(const struct nlattr *attr,
274 struct netlink_ext_ack *extack)
275 {
276 const u8 *data = nla_data(attr);
277 unsigned int len = nla_len(attr);
278 const struct element *elem;
279
280 for_each_element(elem, data, len) {
281 /* nothing */
282 }
283
284 if (for_each_element_completed(elem, data, len))
285 return 0;
286
287 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
288 return -EINVAL;
289 }
290
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)291 static int validate_he_capa(const struct nlattr *attr,
292 struct netlink_ext_ack *extack)
293 {
294 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
295 return -EINVAL;
296
297 return 0;
298 }
299
validate_supported_selectors(const struct nlattr * attr,struct netlink_ext_ack * extack)300 static int validate_supported_selectors(const struct nlattr *attr,
301 struct netlink_ext_ack *extack)
302 {
303 const u8 *supported_selectors = nla_data(attr);
304 u8 supported_selectors_len = nla_len(attr);
305
306 /* The top bit must not be set as it is not part of the selector */
307 for (int i = 0; i < supported_selectors_len; i++) {
308 if (supported_selectors[i] & 0x80)
309 return -EINVAL;
310 }
311
312 return 0;
313 }
314
validate_nan_cluster_id(const struct nlattr * attr,struct netlink_ext_ack * extack)315 static int validate_nan_cluster_id(const struct nlattr *attr,
316 struct netlink_ext_ack *extack)
317 {
318 const u8 *data = nla_data(attr);
319 unsigned int len = nla_len(attr);
320 static const u8 cluster_id_prefix[4] = {0x50, 0x6f, 0x9a, 0x1};
321
322 if (len != ETH_ALEN) {
323 NL_SET_ERR_MSG_ATTR(extack, attr, "bad cluster id length");
324 return -EINVAL;
325 }
326
327 if (memcmp(data, cluster_id_prefix, sizeof(cluster_id_prefix))) {
328 NL_SET_ERR_MSG_ATTR(extack, attr, "invalid cluster id prefix");
329 return -EINVAL;
330 }
331
332 return 0;
333 }
334
335 /* policy for the attributes */
336 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
337
338 static const struct nla_policy
339 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
340 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
341 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
342 .len = U8_MAX },
343 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
344 .len = U8_MAX },
345 };
346
347 static const struct nla_policy
348 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
349 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
350 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
351 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
352 NLA_POLICY_MAX(NLA_U8, 15),
353 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
354 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
355 NLA_POLICY_MAX(NLA_U8, 15),
356 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
357 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
358 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
359 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
360 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
361 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
362 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
363 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
364 };
365
366 static const struct nla_policy
367 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
368 [NL80211_PMSR_TYPE_FTM] =
369 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
370 };
371
372 static const struct nla_policy
373 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
374 [NL80211_PMSR_REQ_ATTR_DATA] =
375 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
376 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
377 };
378
379 static const struct nla_policy
380 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
381 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
382 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
383 [NL80211_PMSR_PEER_ATTR_REQ] =
384 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
385 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
386 };
387
388 static const struct nla_policy
389 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
390 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
391 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
392 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
393 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
394 [NL80211_PMSR_ATTR_PEERS] =
395 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
396 };
397
398 static const struct nla_policy
399 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
400 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
401 NLA_POLICY_RANGE(NLA_U8, 1, 20),
402 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
403 NLA_POLICY_RANGE(NLA_U8, 1, 20),
404 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
405 NLA_POLICY_RANGE(NLA_U8, 1, 20),
406 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
407 NLA_POLICY_EXACT_LEN(8),
408 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
409 NLA_POLICY_EXACT_LEN(8),
410 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
411 };
412
413 static const struct nla_policy
414 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
415 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
416 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
417 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
418 };
419
420 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
421 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
422 .len = NL80211_MAX_SUPP_RATES },
423 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
424 .len = NL80211_MAX_SUPP_HT_RATES },
425 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
426 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
427 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
428 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
429 NL80211_RATE_INFO_HE_GI_0_8,
430 NL80211_RATE_INFO_HE_GI_3_2),
431 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
432 NL80211_RATE_INFO_HE_1XLTF,
433 NL80211_RATE_INFO_HE_4XLTF),
434 [NL80211_TXRATE_EHT] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_eht)),
435 [NL80211_TXRATE_EHT_GI] = NLA_POLICY_RANGE(NLA_U8,
436 NL80211_RATE_INFO_EHT_GI_0_8,
437 NL80211_RATE_INFO_EHT_GI_3_2),
438 [NL80211_TXRATE_EHT_LTF] = NLA_POLICY_RANGE(NLA_U8,
439 NL80211_RATE_INFO_EHT_1XLTF,
440 NL80211_RATE_INFO_EHT_8XLTF),
441
442 };
443
444 static const struct nla_policy
445 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
446 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
447 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
448 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
449 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
450 [NL80211_TID_CONFIG_ATTR_NOACK] =
451 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
452 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
453 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
454 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
455 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
456 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
457 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
458 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
459 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
460 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
461 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
462 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
463 NLA_POLICY_NESTED(nl80211_txattr_policy),
464 };
465
466 static const struct nla_policy
467 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
468 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
469 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
470 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
471 NLA_POLICY_RANGE(NLA_BINARY,
472 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
473 IEEE80211_MAX_DATA_LEN),
474 };
475
476 static const struct nla_policy
477 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
478 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
479 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
480 .len = IEEE80211_MAX_DATA_LEN }
481 };
482
483 static const struct nla_policy
484 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
485 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
486 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
487 };
488
489 static const struct nla_policy
490 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
491 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
492 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
493 };
494
495 static const struct nla_policy
496 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
497 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
498 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
499 NLA_POLICY_MIN(NLA_U8, 1),
500 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
501 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
502 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
503 [NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
504 NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
505 };
506
507 static const struct nla_policy
508 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
509 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
510 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
511 };
512
513 static const struct nla_policy
514 nl80211_s1g_short_beacon[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1] = {
515 [NL80211_S1G_SHORT_BEACON_ATTR_HEAD] =
516 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
517 IEEE80211_MAX_DATA_LEN),
518 [NL80211_S1G_SHORT_BEACON_ATTR_TAIL] =
519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
520 IEEE80211_MAX_DATA_LEN),
521 };
522
523 static const struct nla_policy
524 nl80211_nan_band_conf_policy[NL80211_NAN_BAND_CONF_ATTR_MAX + 1] = {
525 [NL80211_NAN_BAND_CONF_BAND] = NLA_POLICY_MAX(NLA_U8,
526 NUM_NL80211_BANDS - 1),
527 [NL80211_NAN_BAND_CONF_FREQ] = { .type = NLA_U16 },
528 [NL80211_NAN_BAND_CONF_RSSI_CLOSE] = NLA_POLICY_MIN(NLA_S8, -59),
529 [NL80211_NAN_BAND_CONF_RSSI_MIDDLE] = NLA_POLICY_MIN(NLA_S8, -74),
530 [NL80211_NAN_BAND_CONF_WAKE_DW] = NLA_POLICY_MAX(NLA_U8, 5),
531 [NL80211_NAN_BAND_CONF_DISABLE_SCAN] = { .type = NLA_FLAG },
532 };
533
534 static const struct nla_policy
535 nl80211_nan_conf_policy[NL80211_NAN_CONF_ATTR_MAX + 1] = {
536 [NL80211_NAN_CONF_CLUSTER_ID] =
537 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_nan_cluster_id,
538 ETH_ALEN),
539 [NL80211_NAN_CONF_EXTRA_ATTRS] = { .type = NLA_BINARY,
540 .len = IEEE80211_MAX_DATA_LEN},
541 [NL80211_NAN_CONF_VENDOR_ELEMS] =
542 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
543 IEEE80211_MAX_DATA_LEN),
544 [NL80211_NAN_CONF_BAND_CONFIGS] =
545 NLA_POLICY_NESTED_ARRAY(nl80211_nan_band_conf_policy),
546 [NL80211_NAN_CONF_SCAN_PERIOD] = { .type = NLA_U16 },
547 [NL80211_NAN_CONF_SCAN_DWELL_TIME] = NLA_POLICY_RANGE(NLA_U16, 50, 512),
548 [NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL] =
549 NLA_POLICY_RANGE(NLA_U8, 50, 200),
550 [NL80211_NAN_CONF_NOTIFY_DW] = { .type = NLA_FLAG },
551 };
552
553 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
554 .min = 0,
555 .max = 0xffff,
556 };
557
558 static const struct netlink_range_validation q_range = {
559 .max = INT_MAX,
560 };
561
562 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
563 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
564 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
565 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
566 .len = 20-1 },
567 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
568
569 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
570 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
571 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
572 NL80211_EDMG_CHANNELS_MIN,
573 NL80211_EDMG_CHANNELS_MAX),
574 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
575 NL80211_EDMG_BW_CONFIG_MIN,
576 NL80211_EDMG_BW_CONFIG_MAX),
577
578 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
579 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
580 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
581 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
582
583 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
584 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
585 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
586 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
587 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
588 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
589
590 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
591 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
592 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
593
594 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
595 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
596
597 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
598 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
599 .len = WLAN_MAX_KEY_LEN },
600 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
601 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
602 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
603 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
604 [NL80211_ATTR_KEY_TYPE] =
605 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
606
607 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
608 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
609 [NL80211_ATTR_BEACON_HEAD] =
610 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
611 IEEE80211_MAX_DATA_LEN),
612 [NL80211_ATTR_BEACON_TAIL] =
613 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
614 IEEE80211_MAX_DATA_LEN),
615 [NL80211_ATTR_STA_AID] =
616 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
617 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
618 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
619 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
620 .len = NL80211_MAX_SUPP_RATES },
621 [NL80211_ATTR_STA_PLINK_ACTION] =
622 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
623 [NL80211_ATTR_STA_TX_POWER_SETTING] =
624 NLA_POLICY_RANGE(NLA_U8,
625 NL80211_TX_POWER_AUTOMATIC,
626 NL80211_TX_POWER_FIXED),
627 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
628 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
629 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
630 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
631 .len = IEEE80211_MAX_MESH_ID_LEN },
632 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
633
634 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
635 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
636 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
637
638 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
639 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
640 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
641 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
642 .len = NL80211_MAX_SUPP_RATES },
643 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
644
645 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
646 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
647
648 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
649
650 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
651 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
652 validate_ie_attr,
653 IEEE80211_MAX_DATA_LEN),
654 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
655 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
656
657 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
658 .len = IEEE80211_MAX_SSID_LEN },
659 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
660 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
661 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
662 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
663 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
664 NL80211_MFP_NO,
665 NL80211_MFP_OPTIONAL),
666 [NL80211_ATTR_STA_FLAGS2] =
667 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
668 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
669 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
670 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
671 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
672 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
673 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
674 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
675 [NL80211_ATTR_WPA_VERSIONS] =
676 NLA_POLICY_RANGE(NLA_U32, 0,
677 NL80211_WPA_VERSION_1 |
678 NL80211_WPA_VERSION_2 |
679 NL80211_WPA_VERSION_3),
680 [NL80211_ATTR_PID] = { .type = NLA_U32 },
681 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
682 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
683 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
684 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
685 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
686 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
687 .len = IEEE80211_MAX_DATA_LEN },
688 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
689 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
690 NL80211_PS_DISABLED,
691 NL80211_PS_ENABLED),
692 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
693 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
694 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
695 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
696 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
697 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
698 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
699 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
700 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
701 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
702 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
703 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
704 [NL80211_ATTR_STA_PLINK_STATE] =
705 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
706 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
707 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
708 [NL80211_ATTR_MESH_PEER_AID] =
709 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
710 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
711 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
712 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
713 [NL80211_ATTR_HIDDEN_SSID] =
714 NLA_POLICY_RANGE(NLA_U32,
715 NL80211_HIDDEN_SSID_NOT_IN_USE,
716 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
717 [NL80211_ATTR_IE_PROBE_RESP] =
718 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
719 IEEE80211_MAX_DATA_LEN),
720 [NL80211_ATTR_IE_ASSOC_RESP] =
721 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
722 IEEE80211_MAX_DATA_LEN),
723 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
724 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
725 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
726 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
727 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
728 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
729 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
730 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
731 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
732 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
733 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
734 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
735 .len = IEEE80211_MAX_DATA_LEN },
736 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
737 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
738 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
739 .len = NL80211_HT_CAPABILITY_LEN
740 },
741 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
742 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
743 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
744 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
745 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
746
747 /* need to include at least Auth Transaction and Status Code */
748 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
749
750 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
751 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
752 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
753 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
754 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
755 NLA_POLICY_RANGE(NLA_U32,
756 NL80211_MESH_POWER_UNKNOWN + 1,
757 NL80211_MESH_POWER_MAX),
758 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
759 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
760 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
761 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
762 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
763 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
764 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
765 .len = NL80211_VHT_CAPABILITY_LEN,
766 },
767 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
768 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
769 .len = IEEE80211_MAX_DATA_LEN },
770 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
771 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
772 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
773 [NL80211_ATTR_PEER_AID] =
774 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
775 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
776 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
777 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
778 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
779 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
780 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
781 /*
782 * The value of the Length field of the Supported Operating
783 * Classes element is between 2 and 253.
784 */
785 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
786 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
787 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
788 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
789 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
790 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
791 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
792 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
793 IEEE80211_QOS_MAP_LEN_MIN,
794 IEEE80211_QOS_MAP_LEN_MAX),
795 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
796 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
797 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
798 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
799 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
800 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
801 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
802 [NL80211_ATTR_USER_PRIO] =
803 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
804 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
805 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
806 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
807 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
808 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
809 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
810 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
811 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
812 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
813 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
814 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
815 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
816 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
817 .len = VHT_MUMIMO_GROUPS_DATA_LEN
818 },
819 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
820 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
821 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
822 [NL80211_ATTR_NAN_CONFIG] = NLA_POLICY_NESTED(nl80211_nan_conf_policy),
823 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
824 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
825 .len = FILS_MAX_KEK_LEN },
826 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
827 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
828 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
829 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
830 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
831 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
832 },
833 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
834 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
835 .len = FILS_ERP_MAX_USERNAME_LEN },
836 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
837 .len = FILS_ERP_MAX_REALM_LEN },
838 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
839 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
840 .len = FILS_ERP_MAX_RRK_LEN },
841 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
842 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
843 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
844 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
845 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
846
847 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
848 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
849 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
850 [NL80211_ATTR_HE_CAPABILITY] =
851 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
852 NL80211_HE_MAX_CAPABILITY_LEN),
853 [NL80211_ATTR_FTM_RESPONDER] =
854 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
855 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
856 [NL80211_ATTR_PEER_MEASUREMENTS] =
857 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
858 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
859 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
860 .len = SAE_PASSWORD_MAX_LEN },
861 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
862 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
863 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
864 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
865 [NL80211_ATTR_TID_CONFIG] =
866 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
867 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
868 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
869 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
870 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
871 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
872 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
873 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
874 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
875 [NL80211_ATTR_FILS_DISCOVERY] =
876 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
877 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
878 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
879 [NL80211_ATTR_S1G_CAPABILITY] =
880 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
881 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
882 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
883 [NL80211_ATTR_SAE_PWE] =
884 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
885 NL80211_SAE_PWE_BOTH),
886 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
887 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
888 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
889 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
890 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
891 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
892 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
893 [NL80211_ATTR_MBSSID_CONFIG] =
894 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
895 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
896 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
897 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
898 [NL80211_ATTR_EHT_CAPABILITY] =
899 NLA_POLICY_RANGE(NLA_BINARY,
900 NL80211_EHT_MIN_CAPABILITY_LEN,
901 NL80211_EHT_MAX_CAPABILITY_LEN),
902 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
903 [NL80211_ATTR_MLO_LINKS] =
904 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
905 [NL80211_ATTR_MLO_LINK_ID] =
906 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
907 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
908 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
909 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
910 [NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
911 [NL80211_ATTR_PUNCT_BITMAP] =
912 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
913
914 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
915 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
916 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
917 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
918 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
919 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
920 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
921 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
922 [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
923 [NL80211_ATTR_SUPPORTED_SELECTORS] =
924 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
925 NL80211_MAX_SUPP_SELECTORS),
926 [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
927 [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
928 [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
929 [NL80211_ATTR_WIPHY_RADIO_INDEX] = { .type = NLA_U8 },
930 [NL80211_ATTR_S1G_LONG_BEACON_PERIOD] = NLA_POLICY_MIN(NLA_U8, 2),
931 [NL80211_ATTR_S1G_SHORT_BEACON] =
932 NLA_POLICY_NESTED(nl80211_s1g_short_beacon),
933 [NL80211_ATTR_BSS_PARAM] = { .type = NLA_FLAG },
934 [NL80211_ATTR_S1G_PRIMARY_2MHZ] = { .type = NLA_FLAG },
935 };
936
937 /* policy for the key attributes */
938 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
939 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
940 [NL80211_KEY_IDX] = { .type = NLA_U8 },
941 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
942 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
943 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
944 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
945 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
946 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
947 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
948 };
949
950 /* policy for the key default flags */
951 static const struct nla_policy
952 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
953 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
954 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
955 };
956
957 #ifdef CONFIG_PM
958 /* policy for WoWLAN attributes */
959 static const struct nla_policy
960 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
961 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
962 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
963 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
964 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
965 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
966 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
967 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
968 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
969 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
970 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
971 };
972
973 static const struct nla_policy
974 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
975 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
976 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
977 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
978 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
979 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
980 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
981 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
982 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
983 },
984 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
985 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
986 },
987 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
988 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
989 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
990 };
991 #endif /* CONFIG_PM */
992
993 /* policy for coalesce rule attributes */
994 static const struct nla_policy
995 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
996 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
997 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
998 NLA_POLICY_RANGE(NLA_U32,
999 NL80211_COALESCE_CONDITION_MATCH,
1000 NL80211_COALESCE_CONDITION_NO_MATCH),
1001 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
1002 };
1003
1004 /* policy for GTK rekey offload attributes */
1005 static const struct nla_policy
1006 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
1007 [NL80211_REKEY_DATA_KEK] = {
1008 .type = NLA_BINARY,
1009 .len = NL80211_KEK_EXT_LEN
1010 },
1011 [NL80211_REKEY_DATA_KCK] = {
1012 .type = NLA_BINARY,
1013 .len = NL80211_KCK_EXT_LEN_32
1014 },
1015 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
1016 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
1017 };
1018
1019 static const struct nla_policy
1020 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
1021 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
1022 .len = IEEE80211_MAX_SSID_LEN },
1023 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1024 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
1025 };
1026
1027 static const struct nla_policy
1028 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
1029 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
1030 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
1031 };
1032
1033 static const struct nla_policy
1034 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
1035 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
1036 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
1037 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
1038 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
1039 },
1040 };
1041
1042 /* policy for NAN function attributes */
1043 static const struct nla_policy
1044 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
1045 [NL80211_NAN_FUNC_TYPE] =
1046 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
1047 [NL80211_NAN_FUNC_SERVICE_ID] = {
1048 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
1049 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
1050 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
1051 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
1052 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
1053 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
1054 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1055 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
1056 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
1057 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
1058 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
1059 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
1060 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
1061 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
1062 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
1063 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
1064 };
1065
1066 /* policy for Service Response Filter attributes */
1067 static const struct nla_policy
1068 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
1069 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
1070 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
1071 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
1072 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
1073 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
1074 };
1075
1076 /* policy for packet pattern attributes */
1077 static const struct nla_policy
1078 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
1079 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
1080 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1081 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1082 };
1083
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)1084 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1085 struct cfg80211_registered_device **rdev,
1086 struct wireless_dev **wdev,
1087 struct nlattr **attrbuf)
1088 {
1089 int err;
1090
1091 if (!cb->args[0]) {
1092 struct nlattr **attrbuf_free = NULL;
1093
1094 if (!attrbuf) {
1095 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1096 GFP_KERNEL);
1097 if (!attrbuf)
1098 return -ENOMEM;
1099 attrbuf_free = attrbuf;
1100 }
1101
1102 err = nlmsg_parse_deprecated(cb->nlh,
1103 GENL_HDRLEN + nl80211_fam.hdrsize,
1104 attrbuf, nl80211_fam.maxattr,
1105 nl80211_policy, NULL);
1106 if (err) {
1107 kfree(attrbuf_free);
1108 return err;
1109 }
1110
1111 rtnl_lock();
1112 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1113 attrbuf);
1114 kfree(attrbuf_free);
1115 if (IS_ERR(*wdev)) {
1116 rtnl_unlock();
1117 return PTR_ERR(*wdev);
1118 }
1119 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1120 mutex_lock(&(*rdev)->wiphy.mtx);
1121 rtnl_unlock();
1122 /* 0 is the first index - add 1 to parse only once */
1123 cb->args[0] = (*rdev)->wiphy_idx + 1;
1124 cb->args[1] = (*wdev)->identifier;
1125 } else {
1126 /* subtract the 1 again here */
1127 struct wiphy *wiphy;
1128 struct wireless_dev *tmp;
1129
1130 rtnl_lock();
1131 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1132 if (!wiphy) {
1133 rtnl_unlock();
1134 return -ENODEV;
1135 }
1136 *rdev = wiphy_to_rdev(wiphy);
1137 *wdev = NULL;
1138
1139 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1140 if (tmp->identifier == cb->args[1]) {
1141 *wdev = tmp;
1142 break;
1143 }
1144 }
1145
1146 if (!*wdev) {
1147 rtnl_unlock();
1148 return -ENODEV;
1149 }
1150 mutex_lock(&(*rdev)->wiphy.mtx);
1151 rtnl_unlock();
1152 }
1153
1154 return 0;
1155 }
1156
1157 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1158 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1159 int flags, u8 cmd)
1160 {
1161 /* since there is no private header just add the generic one */
1162 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1163 }
1164
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1165 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1166 const struct ieee80211_reg_rule *rule)
1167 {
1168 int j;
1169 struct nlattr *nl_wmm_rules =
1170 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1171
1172 if (!nl_wmm_rules)
1173 goto nla_put_failure;
1174
1175 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1176 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1177
1178 if (!nl_wmm_rule)
1179 goto nla_put_failure;
1180
1181 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1182 rule->wmm_rule.client[j].cw_min) ||
1183 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1184 rule->wmm_rule.client[j].cw_max) ||
1185 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1186 rule->wmm_rule.client[j].aifsn) ||
1187 nla_put_u16(msg, NL80211_WMMR_TXOP,
1188 rule->wmm_rule.client[j].cot))
1189 goto nla_put_failure;
1190
1191 nla_nest_end(msg, nl_wmm_rule);
1192 }
1193 nla_nest_end(msg, nl_wmm_rules);
1194
1195 return 0;
1196
1197 nla_put_failure:
1198 return -ENOBUFS;
1199 }
1200
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1201 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1202 struct ieee80211_channel *chan,
1203 bool large)
1204 {
1205 /* Some channels must be completely excluded from the
1206 * list to protect old user-space tools from breaking
1207 */
1208 if (!large && chan->flags &
1209 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1210 return 0;
1211 if (!large && chan->freq_offset)
1212 return 0;
1213
1214 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1215 chan->center_freq))
1216 goto nla_put_failure;
1217
1218 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1219 goto nla_put_failure;
1220
1221 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1222 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1223 goto nla_put_failure;
1224
1225 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1226 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1227 goto nla_put_failure;
1228 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1229 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1230 goto nla_put_failure;
1231 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1232 goto nla_put_failure;
1233 }
1234 if (chan->flags & IEEE80211_CHAN_RADAR) {
1235 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1236 goto nla_put_failure;
1237 if (large) {
1238 u32 time;
1239
1240 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1241
1242 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1243 chan->dfs_state))
1244 goto nla_put_failure;
1245 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1246 time))
1247 goto nla_put_failure;
1248 if (nla_put_u32(msg,
1249 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1250 chan->dfs_cac_ms))
1251 goto nla_put_failure;
1252 }
1253 }
1254
1255 if (large) {
1256 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1257 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1258 goto nla_put_failure;
1259 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1260 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1261 goto nla_put_failure;
1262 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1263 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1264 goto nla_put_failure;
1265 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1266 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1267 goto nla_put_failure;
1268 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1269 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1270 goto nla_put_failure;
1271 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1272 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1273 goto nla_put_failure;
1274 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1275 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1276 goto nla_put_failure;
1277 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1278 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1279 goto nla_put_failure;
1280 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1281 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1282 goto nla_put_failure;
1283 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1284 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1285 goto nla_put_failure;
1286 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1287 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1288 goto nla_put_failure;
1289 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1290 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1291 goto nla_put_failure;
1292 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1293 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1294 goto nla_put_failure;
1295 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1296 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1297 goto nla_put_failure;
1298 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1299 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1300 goto nla_put_failure;
1301 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1302 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1303 goto nla_put_failure;
1304 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1305 nla_put_flag(msg,
1306 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1307 goto nla_put_failure;
1308 if ((chan->flags & IEEE80211_CHAN_NO_4MHZ) &&
1309 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_4MHZ))
1310 goto nla_put_failure;
1311 if ((chan->flags & IEEE80211_CHAN_NO_8MHZ) &&
1312 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_8MHZ))
1313 goto nla_put_failure;
1314 if ((chan->flags & IEEE80211_CHAN_NO_16MHZ) &&
1315 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_16MHZ))
1316 goto nla_put_failure;
1317 }
1318
1319 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1320 DBM_TO_MBM(chan->max_power)))
1321 goto nla_put_failure;
1322
1323 if (large) {
1324 const struct ieee80211_reg_rule *rule =
1325 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1326
1327 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1328 if (nl80211_msg_put_wmm_rules(msg, rule))
1329 goto nla_put_failure;
1330 }
1331 }
1332
1333 return 0;
1334
1335 nla_put_failure:
1336 return -ENOBUFS;
1337 }
1338
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1339 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1340 struct cfg80211_txq_stats *txqstats,
1341 int attrtype)
1342 {
1343 struct nlattr *txqattr;
1344
1345 #define PUT_TXQVAL_U32(attr, memb) do { \
1346 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1347 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1348 return false; \
1349 } while (0)
1350
1351 txqattr = nla_nest_start_noflag(msg, attrtype);
1352 if (!txqattr)
1353 return false;
1354
1355 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1356 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1357 PUT_TXQVAL_U32(FLOWS, flows);
1358 PUT_TXQVAL_U32(DROPS, drops);
1359 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1360 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1361 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1362 PUT_TXQVAL_U32(COLLISIONS, collisions);
1363 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1364 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1365 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1366 nla_nest_end(msg, txqattr);
1367
1368 #undef PUT_TXQVAL_U32
1369 return true;
1370 }
1371
1372 /* netlink command implementations */
1373
1374 /**
1375 * nl80211_link_id - return link ID
1376 * @attrs: attributes to look at
1377 *
1378 * Returns: the link ID or 0 if not given
1379 *
1380 * Note this function doesn't do any validation of the link
1381 * ID validity wrt. links that were actually added, so it must
1382 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1383 * or if additional validation is done.
1384 */
nl80211_link_id(struct nlattr ** attrs)1385 static unsigned int nl80211_link_id(struct nlattr **attrs)
1386 {
1387 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1388
1389 return nla_get_u8_default(linkid, 0);
1390 }
1391
nl80211_link_id_or_invalid(struct nlattr ** attrs)1392 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1393 {
1394 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1395
1396 if (!linkid)
1397 return -1;
1398
1399 return nla_get_u8(linkid);
1400 }
1401
1402 struct key_parse {
1403 struct key_params p;
1404 int idx;
1405 int type;
1406 bool def, defmgmt, defbeacon;
1407 bool def_uni, def_multi;
1408 };
1409
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1410 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1411 struct key_parse *k)
1412 {
1413 struct nlattr *tb[NL80211_KEY_MAX + 1];
1414 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1415 nl80211_key_policy,
1416 info->extack);
1417 if (err)
1418 return err;
1419
1420 k->def = !!tb[NL80211_KEY_DEFAULT];
1421 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1422 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1423
1424 if (k->def) {
1425 k->def_uni = true;
1426 k->def_multi = true;
1427 }
1428 if (k->defmgmt || k->defbeacon)
1429 k->def_multi = true;
1430
1431 if (tb[NL80211_KEY_IDX])
1432 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1433
1434 if (tb[NL80211_KEY_DATA]) {
1435 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1436 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1437 }
1438
1439 if (tb[NL80211_KEY_SEQ]) {
1440 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1441 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1442 }
1443
1444 if (tb[NL80211_KEY_CIPHER])
1445 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1446
1447 if (tb[NL80211_KEY_TYPE])
1448 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1449
1450 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1451 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1452
1453 err = nla_parse_nested_deprecated(kdt,
1454 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1455 tb[NL80211_KEY_DEFAULT_TYPES],
1456 nl80211_key_default_policy,
1457 info->extack);
1458 if (err)
1459 return err;
1460
1461 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1462 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1463 }
1464
1465 if (tb[NL80211_KEY_MODE])
1466 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1467
1468 return 0;
1469 }
1470
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1471 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1472 {
1473 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1474 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1475 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1476 }
1477
1478 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1479 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1480 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1481 }
1482
1483 if (info->attrs[NL80211_ATTR_KEY_IDX])
1484 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1485
1486 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1487 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1488
1489 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1490 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1491
1492 if (k->def) {
1493 k->def_uni = true;
1494 k->def_multi = true;
1495 }
1496 if (k->defmgmt)
1497 k->def_multi = true;
1498
1499 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1500 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1501
1502 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1503 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1504 int err = nla_parse_nested_deprecated(kdt,
1505 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1506 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1507 nl80211_key_default_policy,
1508 info->extack);
1509 if (err)
1510 return err;
1511
1512 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1513 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1514 }
1515
1516 return 0;
1517 }
1518
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1519 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1520 {
1521 int err;
1522
1523 memset(k, 0, sizeof(*k));
1524 k->idx = -1;
1525 k->type = -1;
1526
1527 if (info->attrs[NL80211_ATTR_KEY])
1528 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1529 else
1530 err = nl80211_parse_key_old(info, k);
1531
1532 if (err)
1533 return err;
1534
1535 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1536 (k->defbeacon ? 1 : 0) > 1) {
1537 GENL_SET_ERR_MSG(info,
1538 "key with multiple default flags is invalid");
1539 return -EINVAL;
1540 }
1541
1542 if (k->defmgmt || k->defbeacon) {
1543 if (k->def_uni || !k->def_multi) {
1544 GENL_SET_ERR_MSG(info,
1545 "defmgmt/defbeacon key must be mcast");
1546 return -EINVAL;
1547 }
1548 }
1549
1550 if (k->idx != -1) {
1551 if (k->defmgmt) {
1552 if (k->idx < 4 || k->idx > 5) {
1553 GENL_SET_ERR_MSG(info,
1554 "defmgmt key idx not 4 or 5");
1555 return -EINVAL;
1556 }
1557 } else if (k->defbeacon) {
1558 if (k->idx < 6 || k->idx > 7) {
1559 GENL_SET_ERR_MSG(info,
1560 "defbeacon key idx not 6 or 7");
1561 return -EINVAL;
1562 }
1563 } else if (k->def) {
1564 if (k->idx < 0 || k->idx > 3) {
1565 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1566 return -EINVAL;
1567 }
1568 } else {
1569 if (k->idx < 0 || k->idx > 7) {
1570 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1571 return -EINVAL;
1572 }
1573 }
1574 }
1575
1576 return 0;
1577 }
1578
1579 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1580 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1581 struct genl_info *info, bool *no_ht)
1582 {
1583 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1584 struct key_parse parse;
1585 struct nlattr *key;
1586 struct cfg80211_cached_keys *result;
1587 int rem, err, def = 0;
1588 bool have_key = false;
1589
1590 nla_for_each_nested(key, keys, rem) {
1591 have_key = true;
1592 break;
1593 }
1594
1595 if (!have_key)
1596 return NULL;
1597
1598 result = kzalloc(sizeof(*result), GFP_KERNEL);
1599 if (!result)
1600 return ERR_PTR(-ENOMEM);
1601
1602 result->def = -1;
1603
1604 nla_for_each_nested(key, keys, rem) {
1605 memset(&parse, 0, sizeof(parse));
1606 parse.idx = -1;
1607
1608 err = nl80211_parse_key_new(info, key, &parse);
1609 if (err)
1610 goto error;
1611 err = -EINVAL;
1612 if (!parse.p.key)
1613 goto error;
1614 if (parse.idx < 0 || parse.idx > 3) {
1615 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1616 goto error;
1617 }
1618 if (parse.def) {
1619 if (def) {
1620 GENL_SET_ERR_MSG(info,
1621 "only one key can be default");
1622 goto error;
1623 }
1624 def = 1;
1625 result->def = parse.idx;
1626 if (!parse.def_uni || !parse.def_multi)
1627 goto error;
1628 } else if (parse.defmgmt)
1629 goto error;
1630 err = cfg80211_validate_key_settings(rdev, &parse.p,
1631 parse.idx, false, NULL);
1632 if (err)
1633 goto error;
1634 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1635 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1636 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1637 err = -EINVAL;
1638 goto error;
1639 }
1640 result->params[parse.idx].cipher = parse.p.cipher;
1641 result->params[parse.idx].key_len = parse.p.key_len;
1642 result->params[parse.idx].key = result->data[parse.idx];
1643 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1644
1645 /* must be WEP key if we got here */
1646 if (no_ht)
1647 *no_ht = true;
1648 }
1649
1650 if (result->def < 0) {
1651 err = -EINVAL;
1652 GENL_SET_ERR_MSG(info, "need a default/TX key");
1653 goto error;
1654 }
1655
1656 return result;
1657 error:
1658 kfree_sensitive(result);
1659 return ERR_PTR(err);
1660 }
1661
nl80211_key_allowed(struct wireless_dev * wdev)1662 static int nl80211_key_allowed(struct wireless_dev *wdev)
1663 {
1664 lockdep_assert_wiphy(wdev->wiphy);
1665
1666 switch (wdev->iftype) {
1667 case NL80211_IFTYPE_AP:
1668 case NL80211_IFTYPE_AP_VLAN:
1669 case NL80211_IFTYPE_P2P_GO:
1670 case NL80211_IFTYPE_MESH_POINT:
1671 break;
1672 case NL80211_IFTYPE_ADHOC:
1673 if (wdev->u.ibss.current_bss)
1674 return 0;
1675 return -ENOLINK;
1676 case NL80211_IFTYPE_STATION:
1677 case NL80211_IFTYPE_P2P_CLIENT:
1678 if (wdev->connected)
1679 return 0;
1680 return -ENOLINK;
1681 case NL80211_IFTYPE_NAN:
1682 if (wiphy_ext_feature_isset(wdev->wiphy,
1683 NL80211_EXT_FEATURE_SECURE_NAN))
1684 return 0;
1685 return -EINVAL;
1686 case NL80211_IFTYPE_UNSPECIFIED:
1687 case NL80211_IFTYPE_OCB:
1688 case NL80211_IFTYPE_MONITOR:
1689 case NL80211_IFTYPE_P2P_DEVICE:
1690 case NL80211_IFTYPE_WDS:
1691 case NUM_NL80211_IFTYPES:
1692 return -EINVAL;
1693 }
1694
1695 return 0;
1696 }
1697
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1698 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1699 u32 freq)
1700 {
1701 struct ieee80211_channel *chan;
1702
1703 chan = ieee80211_get_channel_khz(wiphy, freq);
1704 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1705 return NULL;
1706 return chan;
1707 }
1708
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1709 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1710 {
1711 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1712 int i;
1713
1714 if (!nl_modes)
1715 goto nla_put_failure;
1716
1717 i = 0;
1718 while (ifmodes) {
1719 if ((ifmodes & 1) && nla_put_flag(msg, i))
1720 goto nla_put_failure;
1721 ifmodes >>= 1;
1722 i++;
1723 }
1724
1725 nla_nest_end(msg, nl_modes);
1726 return 0;
1727
1728 nla_put_failure:
1729 return -ENOBUFS;
1730 }
1731
nl80211_put_ifcomb_data(struct sk_buff * msg,bool large,int idx,const struct ieee80211_iface_combination * c,u16 nested)1732 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1733 const struct ieee80211_iface_combination *c,
1734 u16 nested)
1735 {
1736 struct nlattr *nl_combi, *nl_limits;
1737 int i;
1738
1739 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1740 if (!nl_combi)
1741 goto nla_put_failure;
1742
1743 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1744 nested);
1745 if (!nl_limits)
1746 goto nla_put_failure;
1747
1748 for (i = 0; i < c->n_limits; i++) {
1749 struct nlattr *nl_limit;
1750
1751 nl_limit = nla_nest_start_noflag(msg, i + 1);
1752 if (!nl_limit)
1753 goto nla_put_failure;
1754 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1755 goto nla_put_failure;
1756 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1757 c->limits[i].types))
1758 goto nla_put_failure;
1759 nla_nest_end(msg, nl_limit);
1760 }
1761
1762 nla_nest_end(msg, nl_limits);
1763
1764 if (c->beacon_int_infra_match &&
1765 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1766 goto nla_put_failure;
1767 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1768 c->num_different_channels) ||
1769 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1770 c->max_interfaces))
1771 goto nla_put_failure;
1772 if (large &&
1773 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1774 c->radar_detect_widths) ||
1775 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1776 c->radar_detect_regions)))
1777 goto nla_put_failure;
1778 if (c->beacon_int_min_gcd &&
1779 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1780 c->beacon_int_min_gcd))
1781 goto nla_put_failure;
1782
1783 nla_nest_end(msg, nl_combi);
1784
1785 return 0;
1786 nla_put_failure:
1787 return -ENOBUFS;
1788 }
1789
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,int attr,int radio,bool large,u16 nested)1790 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1791 struct sk_buff *msg,
1792 int attr, int radio,
1793 bool large, u16 nested)
1794 {
1795 const struct ieee80211_iface_combination *c;
1796 struct nlattr *nl_combis;
1797 int i, n;
1798
1799 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1800 if (!nl_combis)
1801 goto nla_put_failure;
1802
1803 if (radio >= 0) {
1804 c = wiphy->radio[0].iface_combinations;
1805 n = wiphy->radio[0].n_iface_combinations;
1806 } else {
1807 c = wiphy->iface_combinations;
1808 n = wiphy->n_iface_combinations;
1809 }
1810 for (i = 0; i < n; i++)
1811 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1812 goto nla_put_failure;
1813
1814 nla_nest_end(msg, nl_combis);
1815
1816 return 0;
1817 nla_put_failure:
1818 return -ENOBUFS;
1819 }
1820
1821 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1822 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1823 struct sk_buff *msg)
1824 {
1825 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1826 struct nlattr *nl_tcp;
1827
1828 if (!tcp)
1829 return 0;
1830
1831 nl_tcp = nla_nest_start_noflag(msg,
1832 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1833 if (!nl_tcp)
1834 return -ENOBUFS;
1835
1836 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1837 tcp->data_payload_max))
1838 return -ENOBUFS;
1839
1840 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1841 tcp->data_payload_max))
1842 return -ENOBUFS;
1843
1844 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1845 return -ENOBUFS;
1846
1847 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1848 sizeof(*tcp->tok), tcp->tok))
1849 return -ENOBUFS;
1850
1851 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1852 tcp->data_interval_max))
1853 return -ENOBUFS;
1854
1855 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1856 tcp->wake_payload_max))
1857 return -ENOBUFS;
1858
1859 nla_nest_end(msg, nl_tcp);
1860 return 0;
1861 }
1862
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1863 static int nl80211_send_wowlan(struct sk_buff *msg,
1864 struct cfg80211_registered_device *rdev,
1865 bool large)
1866 {
1867 struct nlattr *nl_wowlan;
1868
1869 if (!rdev->wiphy.wowlan)
1870 return 0;
1871
1872 nl_wowlan = nla_nest_start_noflag(msg,
1873 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1874 if (!nl_wowlan)
1875 return -ENOBUFS;
1876
1877 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1878 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1879 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1880 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1881 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1882 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1883 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1884 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1885 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1886 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1887 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1888 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1889 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1890 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1891 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1892 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1893 return -ENOBUFS;
1894
1895 if (rdev->wiphy.wowlan->n_patterns) {
1896 struct nl80211_pattern_support pat = {
1897 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1898 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1899 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1900 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1901 };
1902
1903 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1904 sizeof(pat), &pat))
1905 return -ENOBUFS;
1906 }
1907
1908 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1909 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1910 rdev->wiphy.wowlan->max_nd_match_sets))
1911 return -ENOBUFS;
1912
1913 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1914 return -ENOBUFS;
1915
1916 nla_nest_end(msg, nl_wowlan);
1917
1918 return 0;
1919 }
1920 #endif
1921
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1922 static int nl80211_send_coalesce(struct sk_buff *msg,
1923 struct cfg80211_registered_device *rdev)
1924 {
1925 struct nl80211_coalesce_rule_support rule;
1926
1927 if (!rdev->wiphy.coalesce)
1928 return 0;
1929
1930 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1931 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1932 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1933 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1934 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1935 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1936
1937 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1938 return -ENOBUFS;
1939
1940 return 0;
1941 }
1942
1943 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1944 nl80211_send_iftype_data(struct sk_buff *msg,
1945 const struct ieee80211_supported_band *sband,
1946 const struct ieee80211_sband_iftype_data *iftdata)
1947 {
1948 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1949 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1950
1951 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1952 iftdata->types_mask))
1953 return -ENOBUFS;
1954
1955 if (he_cap->has_he) {
1956 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1957 sizeof(he_cap->he_cap_elem.mac_cap_info),
1958 he_cap->he_cap_elem.mac_cap_info) ||
1959 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1960 sizeof(he_cap->he_cap_elem.phy_cap_info),
1961 he_cap->he_cap_elem.phy_cap_info) ||
1962 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1963 sizeof(he_cap->he_mcs_nss_supp),
1964 &he_cap->he_mcs_nss_supp) ||
1965 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1966 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1967 return -ENOBUFS;
1968 }
1969
1970 if (eht_cap->has_eht && he_cap->has_he) {
1971 u8 mcs_nss_size, ppe_thresh_size;
1972 u16 ppe_thres_hdr;
1973 bool is_ap;
1974
1975 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1976 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1977
1978 mcs_nss_size =
1979 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1980 &eht_cap->eht_cap_elem,
1981 is_ap);
1982
1983 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1984 ppe_thresh_size =
1985 ieee80211_eht_ppe_size(ppe_thres_hdr,
1986 eht_cap->eht_cap_elem.phy_cap_info);
1987
1988 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1989 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1990 eht_cap->eht_cap_elem.mac_cap_info) ||
1991 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1992 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1993 eht_cap->eht_cap_elem.phy_cap_info) ||
1994 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1995 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1996 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1997 ppe_thresh_size, eht_cap->eht_ppe_thres))
1998 return -ENOBUFS;
1999 }
2000
2001 if (sband->band == NL80211_BAND_6GHZ &&
2002 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
2003 sizeof(iftdata->he_6ghz_capa),
2004 &iftdata->he_6ghz_capa))
2005 return -ENOBUFS;
2006
2007 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
2008 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
2009 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
2010 return -ENOBUFS;
2011
2012 return 0;
2013 }
2014
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)2015 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
2016 struct ieee80211_supported_band *sband,
2017 bool large)
2018 {
2019 struct nlattr *nl_rates, *nl_rate;
2020 struct ieee80211_rate *rate;
2021 int i;
2022
2023 /* add HT info */
2024 if (sband->ht_cap.ht_supported &&
2025 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
2026 sizeof(sband->ht_cap.mcs),
2027 &sband->ht_cap.mcs) ||
2028 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
2029 sband->ht_cap.cap) ||
2030 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
2031 sband->ht_cap.ampdu_factor) ||
2032 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
2033 sband->ht_cap.ampdu_density)))
2034 return -ENOBUFS;
2035
2036 /* add VHT info */
2037 if (sband->vht_cap.vht_supported &&
2038 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
2039 sizeof(sband->vht_cap.vht_mcs),
2040 &sband->vht_cap.vht_mcs) ||
2041 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
2042 sband->vht_cap.cap)))
2043 return -ENOBUFS;
2044
2045 if (large && sband->n_iftype_data) {
2046 struct nlattr *nl_iftype_data =
2047 nla_nest_start_noflag(msg,
2048 NL80211_BAND_ATTR_IFTYPE_DATA);
2049 const struct ieee80211_sband_iftype_data *iftd;
2050 int err;
2051
2052 if (!nl_iftype_data)
2053 return -ENOBUFS;
2054
2055 for_each_sband_iftype_data(sband, i, iftd) {
2056 struct nlattr *iftdata;
2057
2058 iftdata = nla_nest_start_noflag(msg, i + 1);
2059 if (!iftdata)
2060 return -ENOBUFS;
2061
2062 err = nl80211_send_iftype_data(msg, sband, iftd);
2063 if (err)
2064 return err;
2065
2066 nla_nest_end(msg, iftdata);
2067 }
2068
2069 nla_nest_end(msg, nl_iftype_data);
2070 }
2071
2072 /* add EDMG info */
2073 if (large && sband->edmg_cap.channels &&
2074 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2075 sband->edmg_cap.channels) ||
2076 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2077 sband->edmg_cap.bw_config)))
2078
2079 return -ENOBUFS;
2080
2081 /* add bitrates */
2082 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2083 if (!nl_rates)
2084 return -ENOBUFS;
2085
2086 for (i = 0; i < sband->n_bitrates; i++) {
2087 nl_rate = nla_nest_start_noflag(msg, i);
2088 if (!nl_rate)
2089 return -ENOBUFS;
2090
2091 rate = &sband->bitrates[i];
2092 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2093 rate->bitrate))
2094 return -ENOBUFS;
2095 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2096 nla_put_flag(msg,
2097 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2098 return -ENOBUFS;
2099
2100 nla_nest_end(msg, nl_rate);
2101 }
2102
2103 nla_nest_end(msg, nl_rates);
2104
2105 /* S1G capabilities */
2106 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2107 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2108 sizeof(sband->s1g_cap.cap),
2109 sband->s1g_cap.cap) ||
2110 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2111 sizeof(sband->s1g_cap.nss_mcs),
2112 sband->s1g_cap.nss_mcs)))
2113 return -ENOBUFS;
2114
2115 return 0;
2116 }
2117
2118 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)2119 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2120 const struct ieee80211_txrx_stypes *mgmt_stypes)
2121 {
2122 u16 stypes;
2123 struct nlattr *nl_ftypes, *nl_ifs;
2124 enum nl80211_iftype ift;
2125 int i;
2126
2127 if (!mgmt_stypes)
2128 return 0;
2129
2130 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2131 if (!nl_ifs)
2132 return -ENOBUFS;
2133
2134 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2135 nl_ftypes = nla_nest_start_noflag(msg, ift);
2136 if (!nl_ftypes)
2137 return -ENOBUFS;
2138 i = 0;
2139 stypes = mgmt_stypes[ift].tx;
2140 while (stypes) {
2141 if ((stypes & 1) &&
2142 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2143 (i << 4) | IEEE80211_FTYPE_MGMT))
2144 return -ENOBUFS;
2145 stypes >>= 1;
2146 i++;
2147 }
2148 nla_nest_end(msg, nl_ftypes);
2149 }
2150
2151 nla_nest_end(msg, nl_ifs);
2152
2153 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2154 if (!nl_ifs)
2155 return -ENOBUFS;
2156
2157 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2158 nl_ftypes = nla_nest_start_noflag(msg, ift);
2159 if (!nl_ftypes)
2160 return -ENOBUFS;
2161 i = 0;
2162 stypes = mgmt_stypes[ift].rx;
2163 while (stypes) {
2164 if ((stypes & 1) &&
2165 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2166 (i << 4) | IEEE80211_FTYPE_MGMT))
2167 return -ENOBUFS;
2168 stypes >>= 1;
2169 i++;
2170 }
2171 nla_nest_end(msg, nl_ftypes);
2172 }
2173 nla_nest_end(msg, nl_ifs);
2174
2175 return 0;
2176 }
2177
2178 #define CMD(op, n) \
2179 do { \
2180 if (rdev->ops->op) { \
2181 i++; \
2182 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2183 goto nla_put_failure; \
2184 } \
2185 } while (0)
2186
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2187 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2188 struct sk_buff *msg)
2189 {
2190 int i = 0;
2191
2192 /*
2193 * do *NOT* add anything into this function, new things need to be
2194 * advertised only to new versions of userspace that can deal with
2195 * the split (and they can't possibly care about new features...
2196 */
2197 CMD(add_virtual_intf, NEW_INTERFACE);
2198 CMD(change_virtual_intf, SET_INTERFACE);
2199 CMD(add_key, NEW_KEY);
2200 CMD(start_ap, START_AP);
2201 CMD(add_station, NEW_STATION);
2202 CMD(add_mpath, NEW_MPATH);
2203 CMD(update_mesh_config, SET_MESH_CONFIG);
2204 CMD(change_bss, SET_BSS);
2205 CMD(auth, AUTHENTICATE);
2206 CMD(assoc, ASSOCIATE);
2207 CMD(deauth, DEAUTHENTICATE);
2208 CMD(disassoc, DISASSOCIATE);
2209 CMD(join_ibss, JOIN_IBSS);
2210 CMD(join_mesh, JOIN_MESH);
2211 CMD(set_pmksa, SET_PMKSA);
2212 CMD(del_pmksa, DEL_PMKSA);
2213 CMD(flush_pmksa, FLUSH_PMKSA);
2214 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2215 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2216 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2217 CMD(mgmt_tx, FRAME);
2218 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2219 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2220 i++;
2221 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2222 goto nla_put_failure;
2223 }
2224 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2225 rdev->ops->join_mesh) {
2226 i++;
2227 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2228 goto nla_put_failure;
2229 }
2230 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2231 CMD(tdls_mgmt, TDLS_MGMT);
2232 CMD(tdls_oper, TDLS_OPER);
2233 }
2234 if (rdev->wiphy.max_sched_scan_reqs)
2235 CMD(sched_scan_start, START_SCHED_SCAN);
2236 CMD(probe_client, PROBE_CLIENT);
2237 CMD(set_noack_map, SET_NOACK_MAP);
2238 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2239 i++;
2240 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2241 goto nla_put_failure;
2242 }
2243 CMD(start_p2p_device, START_P2P_DEVICE);
2244 CMD(set_mcast_rate, SET_MCAST_RATE);
2245 #ifdef CONFIG_NL80211_TESTMODE
2246 CMD(testmode_cmd, TESTMODE);
2247 #endif
2248
2249 if (rdev->ops->connect || rdev->ops->auth) {
2250 i++;
2251 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2252 goto nla_put_failure;
2253 }
2254
2255 if (rdev->ops->disconnect || rdev->ops->deauth) {
2256 i++;
2257 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2258 goto nla_put_failure;
2259 }
2260
2261 return i;
2262 nla_put_failure:
2263 return -ENOBUFS;
2264 }
2265
2266 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2267 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2268 struct sk_buff *msg)
2269 {
2270 struct nlattr *ftm;
2271
2272 if (!cap->ftm.supported)
2273 return 0;
2274
2275 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2276 if (!ftm)
2277 return -ENOBUFS;
2278
2279 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2280 return -ENOBUFS;
2281 if (cap->ftm.non_asap &&
2282 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2283 return -ENOBUFS;
2284 if (cap->ftm.request_lci &&
2285 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2286 return -ENOBUFS;
2287 if (cap->ftm.request_civicloc &&
2288 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2289 return -ENOBUFS;
2290 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2291 cap->ftm.preambles))
2292 return -ENOBUFS;
2293 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2294 cap->ftm.bandwidths))
2295 return -ENOBUFS;
2296 if (cap->ftm.max_bursts_exponent >= 0 &&
2297 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2298 cap->ftm.max_bursts_exponent))
2299 return -ENOBUFS;
2300 if (cap->ftm.max_ftms_per_burst &&
2301 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2302 cap->ftm.max_ftms_per_burst))
2303 return -ENOBUFS;
2304 if (cap->ftm.trigger_based &&
2305 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2306 return -ENOBUFS;
2307 if (cap->ftm.non_trigger_based &&
2308 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2309 return -ENOBUFS;
2310
2311 nla_nest_end(msg, ftm);
2312 return 0;
2313 }
2314
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2315 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2316 struct sk_buff *msg)
2317 {
2318 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2319 struct nlattr *pmsr, *caps;
2320
2321 if (!cap)
2322 return 0;
2323
2324 /*
2325 * we don't need to clean up anything here since the caller
2326 * will genlmsg_cancel() if we fail
2327 */
2328
2329 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2330 if (!pmsr)
2331 return -ENOBUFS;
2332
2333 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2334 return -ENOBUFS;
2335
2336 if (cap->report_ap_tsf &&
2337 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2338 return -ENOBUFS;
2339
2340 if (cap->randomize_mac_addr &&
2341 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2342 return -ENOBUFS;
2343
2344 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2345 if (!caps)
2346 return -ENOBUFS;
2347
2348 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2349 return -ENOBUFS;
2350
2351 nla_nest_end(msg, caps);
2352 nla_nest_end(msg, pmsr);
2353
2354 return 0;
2355 }
2356
2357 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2358 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2359 struct sk_buff *msg)
2360 {
2361 int i;
2362 struct nlattr *nested, *nested_akms;
2363 const struct wiphy_iftype_akm_suites *iftype_akms;
2364
2365 if (!rdev->wiphy.num_iftype_akm_suites ||
2366 !rdev->wiphy.iftype_akm_suites)
2367 return 0;
2368
2369 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2370 if (!nested)
2371 return -ENOBUFS;
2372
2373 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2374 nested_akms = nla_nest_start(msg, i + 1);
2375 if (!nested_akms)
2376 return -ENOBUFS;
2377
2378 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2379
2380 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2381 iftype_akms->iftypes_mask))
2382 return -ENOBUFS;
2383
2384 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2385 sizeof(u32) * iftype_akms->n_akm_suites,
2386 iftype_akms->akm_suites)) {
2387 return -ENOBUFS;
2388 }
2389 nla_nest_end(msg, nested_akms);
2390 }
2391
2392 nla_nest_end(msg, nested);
2393
2394 return 0;
2395 }
2396
2397 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2398 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2399 struct sk_buff *msg)
2400 {
2401 struct nlattr *supp;
2402
2403 if (!rdev->wiphy.tid_config_support.vif &&
2404 !rdev->wiphy.tid_config_support.peer)
2405 return 0;
2406
2407 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2408 if (!supp)
2409 return -ENOSPC;
2410
2411 if (rdev->wiphy.tid_config_support.vif &&
2412 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2413 rdev->wiphy.tid_config_support.vif,
2414 NL80211_TID_CONFIG_ATTR_PAD))
2415 goto fail;
2416
2417 if (rdev->wiphy.tid_config_support.peer &&
2418 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2419 rdev->wiphy.tid_config_support.peer,
2420 NL80211_TID_CONFIG_ATTR_PAD))
2421 goto fail;
2422
2423 /* for now we just use the same value ... makes more sense */
2424 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2425 rdev->wiphy.tid_config_support.max_retry))
2426 goto fail;
2427 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2428 rdev->wiphy.tid_config_support.max_retry))
2429 goto fail;
2430
2431 nla_nest_end(msg, supp);
2432
2433 return 0;
2434 fail:
2435 nla_nest_cancel(msg, supp);
2436 return -ENOBUFS;
2437 }
2438
2439 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2440 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2441 struct sk_buff *msg)
2442 {
2443 struct nlattr *sar_capa, *specs, *sub_freq_range;
2444 u8 num_freq_ranges;
2445 int i;
2446
2447 if (!rdev->wiphy.sar_capa)
2448 return 0;
2449
2450 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2451
2452 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2453 if (!sar_capa)
2454 return -ENOSPC;
2455
2456 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2457 goto fail;
2458
2459 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2460 if (!specs)
2461 goto fail;
2462
2463 /* report supported freq_ranges */
2464 for (i = 0; i < num_freq_ranges; i++) {
2465 sub_freq_range = nla_nest_start(msg, i + 1);
2466 if (!sub_freq_range)
2467 goto fail;
2468
2469 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2470 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2471 goto fail;
2472
2473 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2474 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2475 goto fail;
2476
2477 nla_nest_end(msg, sub_freq_range);
2478 }
2479
2480 nla_nest_end(msg, specs);
2481 nla_nest_end(msg, sar_capa);
2482
2483 return 0;
2484 fail:
2485 nla_nest_cancel(msg, sar_capa);
2486 return -ENOBUFS;
2487 }
2488
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2489 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2490 {
2491 struct nlattr *config;
2492
2493 if (!wiphy->mbssid_max_interfaces)
2494 return 0;
2495
2496 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2497 if (!config)
2498 return -ENOBUFS;
2499
2500 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2501 wiphy->mbssid_max_interfaces))
2502 goto fail;
2503
2504 if (wiphy->ema_max_profile_periodicity &&
2505 nla_put_u8(msg,
2506 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2507 wiphy->ema_max_profile_periodicity))
2508 goto fail;
2509
2510 nla_nest_end(msg, config);
2511 return 0;
2512
2513 fail:
2514 nla_nest_cancel(msg, config);
2515 return -ENOBUFS;
2516 }
2517
nl80211_put_radio(struct wiphy * wiphy,struct sk_buff * msg,int idx)2518 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2519 {
2520 const struct wiphy_radio *r = &wiphy->radio[idx];
2521 const struct wiphy_radio_cfg *rcfg = &wiphy->radio_cfg[idx];
2522 struct nlattr *radio, *freq;
2523 int i;
2524
2525 radio = nla_nest_start(msg, idx);
2526 if (!radio)
2527 return -ENOBUFS;
2528
2529 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2530 goto nla_put_failure;
2531
2532 if (rcfg->rts_threshold &&
2533 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD,
2534 rcfg->rts_threshold))
2535 goto nla_put_failure;
2536
2537 if (r->antenna_mask &&
2538 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2539 r->antenna_mask))
2540 goto nla_put_failure;
2541
2542 for (i = 0; i < r->n_freq_range; i++) {
2543 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2544
2545 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2546 if (!freq)
2547 goto nla_put_failure;
2548
2549 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2550 range->start_freq) ||
2551 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2552 range->end_freq))
2553 goto nla_put_failure;
2554
2555 nla_nest_end(msg, freq);
2556 }
2557
2558 for (i = 0; i < r->n_iface_combinations; i++)
2559 if (nl80211_put_ifcomb_data(msg, true,
2560 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2561 &r->iface_combinations[i],
2562 NLA_F_NESTED))
2563 goto nla_put_failure;
2564
2565 nla_nest_end(msg, radio);
2566
2567 return 0;
2568
2569 nla_put_failure:
2570 return -ENOBUFS;
2571 }
2572
nl80211_put_radios(struct wiphy * wiphy,struct sk_buff * msg)2573 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2574 {
2575 struct nlattr *radios;
2576 int i;
2577
2578 if (!wiphy->n_radio)
2579 return 0;
2580
2581 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2582 if (!radios)
2583 return -ENOBUFS;
2584
2585 for (i = 0; i < wiphy->n_radio; i++)
2586 if (nl80211_put_radio(wiphy, msg, i))
2587 goto fail;
2588
2589 nla_nest_end(msg, radios);
2590
2591 if (nl80211_put_iface_combinations(wiphy, msg,
2592 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2593 -1, true, NLA_F_NESTED))
2594 return -ENOBUFS;
2595
2596 return 0;
2597
2598 fail:
2599 nla_nest_cancel(msg, radios);
2600 return -ENOBUFS;
2601 }
2602
nl80211_put_nan_capa(struct wiphy * wiphy,struct sk_buff * msg)2603 static int nl80211_put_nan_capa(struct wiphy *wiphy, struct sk_buff *msg)
2604 {
2605 struct nlattr *nan_caps;
2606
2607 nan_caps = nla_nest_start(msg, NL80211_ATTR_NAN_CAPABILITIES);
2608 if (!nan_caps)
2609 return -ENOBUFS;
2610
2611 if (wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC &&
2612 nla_put_flag(msg, NL80211_NAN_CAPA_CONFIGURABLE_SYNC))
2613 goto fail;
2614
2615 if ((wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_USERSPACE_DE) &&
2616 nla_put_flag(msg, NL80211_NAN_CAPA_USERSPACE_DE))
2617 goto fail;
2618
2619 if (nla_put_u8(msg, NL80211_NAN_CAPA_OP_MODE,
2620 wiphy->nan_capa.op_mode) ||
2621 nla_put_u8(msg, NL80211_NAN_CAPA_NUM_ANTENNAS,
2622 wiphy->nan_capa.n_antennas) ||
2623 nla_put_u16(msg, NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME,
2624 wiphy->nan_capa.max_channel_switch_time) ||
2625 nla_put_u8(msg, NL80211_NAN_CAPA_CAPABILITIES,
2626 wiphy->nan_capa.dev_capabilities))
2627 goto fail;
2628
2629 nla_nest_end(msg, nan_caps);
2630
2631 return 0;
2632
2633 fail:
2634 nla_nest_cancel(msg, nan_caps);
2635 return -ENOBUFS;
2636 }
2637
2638 struct nl80211_dump_wiphy_state {
2639 s64 filter_wiphy;
2640 long start;
2641 long split_start, band_start, chan_start, capa_start;
2642 bool split;
2643 };
2644
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2645 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2646 enum nl80211_commands cmd,
2647 struct sk_buff *msg, u32 portid, u32 seq,
2648 int flags, struct nl80211_dump_wiphy_state *state)
2649 {
2650 void *hdr;
2651 struct nlattr *nl_bands, *nl_band;
2652 struct nlattr *nl_freqs, *nl_freq;
2653 struct nlattr *nl_cmds;
2654 enum nl80211_band band;
2655 struct ieee80211_channel *chan;
2656 int i;
2657 const struct ieee80211_txrx_stypes *mgmt_stypes =
2658 rdev->wiphy.mgmt_stypes;
2659 u32 features;
2660
2661 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2662 if (!hdr)
2663 return -ENOBUFS;
2664
2665 if (WARN_ON(!state))
2666 return -EINVAL;
2667
2668 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2669 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2670 wiphy_name(&rdev->wiphy)) ||
2671 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2672 cfg80211_rdev_list_generation))
2673 goto nla_put_failure;
2674
2675 if (cmd != NL80211_CMD_NEW_WIPHY)
2676 goto finish;
2677
2678 switch (state->split_start) {
2679 case 0:
2680 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2681 rdev->wiphy.retry_short) ||
2682 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2683 rdev->wiphy.retry_long) ||
2684 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2685 rdev->wiphy.frag_threshold) ||
2686 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2687 rdev->wiphy.rts_threshold) ||
2688 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2689 rdev->wiphy.coverage_class) ||
2690 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2691 rdev->wiphy.max_scan_ssids) ||
2692 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2693 rdev->wiphy.max_sched_scan_ssids) ||
2694 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2695 rdev->wiphy.max_scan_ie_len) ||
2696 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2697 rdev->wiphy.max_sched_scan_ie_len) ||
2698 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2699 rdev->wiphy.max_match_sets))
2700 goto nla_put_failure;
2701
2702 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2703 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2704 goto nla_put_failure;
2705 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2706 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2707 goto nla_put_failure;
2708 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2709 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2710 goto nla_put_failure;
2711 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2712 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2713 goto nla_put_failure;
2714 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2715 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2716 goto nla_put_failure;
2717 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2718 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2719 goto nla_put_failure;
2720 state->split_start++;
2721 if (state->split)
2722 break;
2723 fallthrough;
2724 case 1:
2725 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2726 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2727 rdev->wiphy.cipher_suites))
2728 goto nla_put_failure;
2729
2730 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2731 rdev->wiphy.max_num_pmkids))
2732 goto nla_put_failure;
2733
2734 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2735 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2736 goto nla_put_failure;
2737
2738 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2739 rdev->wiphy.available_antennas_tx) ||
2740 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2741 rdev->wiphy.available_antennas_rx))
2742 goto nla_put_failure;
2743
2744 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2745 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2746 rdev->wiphy.probe_resp_offload))
2747 goto nla_put_failure;
2748
2749 if ((rdev->wiphy.available_antennas_tx ||
2750 rdev->wiphy.available_antennas_rx) &&
2751 rdev->ops->get_antenna) {
2752 u32 tx_ant = 0, rx_ant = 0;
2753 int res;
2754
2755 res = rdev_get_antenna(rdev, -1, &tx_ant, &rx_ant);
2756 if (!res) {
2757 if (nla_put_u32(msg,
2758 NL80211_ATTR_WIPHY_ANTENNA_TX,
2759 tx_ant) ||
2760 nla_put_u32(msg,
2761 NL80211_ATTR_WIPHY_ANTENNA_RX,
2762 rx_ant))
2763 goto nla_put_failure;
2764 }
2765 }
2766
2767 state->split_start++;
2768 if (state->split)
2769 break;
2770 fallthrough;
2771 case 2:
2772 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2773 rdev->wiphy.interface_modes))
2774 goto nla_put_failure;
2775 state->split_start++;
2776 if (state->split)
2777 break;
2778 fallthrough;
2779 case 3:
2780 nl_bands = nla_nest_start_noflag(msg,
2781 NL80211_ATTR_WIPHY_BANDS);
2782 if (!nl_bands)
2783 goto nla_put_failure;
2784
2785 for (band = state->band_start;
2786 band < (state->split ?
2787 NUM_NL80211_BANDS :
2788 NL80211_BAND_60GHZ + 1);
2789 band++) {
2790 struct ieee80211_supported_band *sband;
2791
2792 /* omit higher bands for ancient software */
2793 if (band > NL80211_BAND_5GHZ && !state->split)
2794 break;
2795
2796 sband = rdev->wiphy.bands[band];
2797
2798 if (!sband)
2799 continue;
2800
2801 nl_band = nla_nest_start_noflag(msg, band);
2802 if (!nl_band)
2803 goto nla_put_failure;
2804
2805 switch (state->chan_start) {
2806 case 0:
2807 if (nl80211_send_band_rateinfo(msg, sband,
2808 state->split))
2809 goto nla_put_failure;
2810 state->chan_start++;
2811 if (state->split)
2812 break;
2813 fallthrough;
2814 default:
2815 /* add frequencies */
2816 nl_freqs = nla_nest_start_noflag(msg,
2817 NL80211_BAND_ATTR_FREQS);
2818 if (!nl_freqs)
2819 goto nla_put_failure;
2820
2821 for (i = state->chan_start - 1;
2822 i < sband->n_channels;
2823 i++) {
2824 nl_freq = nla_nest_start_noflag(msg,
2825 i);
2826 if (!nl_freq)
2827 goto nla_put_failure;
2828
2829 chan = &sband->channels[i];
2830
2831 if (nl80211_msg_put_channel(
2832 msg, &rdev->wiphy, chan,
2833 state->split))
2834 goto nla_put_failure;
2835
2836 nla_nest_end(msg, nl_freq);
2837 if (state->split)
2838 break;
2839 }
2840 if (i < sband->n_channels)
2841 state->chan_start = i + 2;
2842 else
2843 state->chan_start = 0;
2844 nla_nest_end(msg, nl_freqs);
2845 }
2846
2847 nla_nest_end(msg, nl_band);
2848
2849 if (state->split) {
2850 /* start again here */
2851 if (state->chan_start)
2852 band--;
2853 break;
2854 }
2855 }
2856 nla_nest_end(msg, nl_bands);
2857
2858 if (band < NUM_NL80211_BANDS)
2859 state->band_start = band + 1;
2860 else
2861 state->band_start = 0;
2862
2863 /* if bands & channels are done, continue outside */
2864 if (state->band_start == 0 && state->chan_start == 0)
2865 state->split_start++;
2866 if (state->split)
2867 break;
2868 fallthrough;
2869 case 4:
2870 nl_cmds = nla_nest_start_noflag(msg,
2871 NL80211_ATTR_SUPPORTED_COMMANDS);
2872 if (!nl_cmds)
2873 goto nla_put_failure;
2874
2875 i = nl80211_add_commands_unsplit(rdev, msg);
2876 if (i < 0)
2877 goto nla_put_failure;
2878 if (state->split) {
2879 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2880 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2881 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2882 CMD(channel_switch, CHANNEL_SWITCH);
2883 CMD(set_qos_map, SET_QOS_MAP);
2884 if (rdev->wiphy.features &
2885 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2886 CMD(add_tx_ts, ADD_TX_TS);
2887 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2888 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2889 CMD(update_ft_ies, UPDATE_FT_IES);
2890 if (rdev->wiphy.sar_capa)
2891 CMD(set_sar_specs, SET_SAR_SPECS);
2892 CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2893 }
2894 #undef CMD
2895
2896 nla_nest_end(msg, nl_cmds);
2897 state->split_start++;
2898 if (state->split)
2899 break;
2900 fallthrough;
2901 case 5:
2902 if (rdev->ops->remain_on_channel &&
2903 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2904 nla_put_u32(msg,
2905 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2906 rdev->wiphy.max_remain_on_channel_duration))
2907 goto nla_put_failure;
2908
2909 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2910 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2911 goto nla_put_failure;
2912
2913 state->split_start++;
2914 if (state->split)
2915 break;
2916 fallthrough;
2917 case 6:
2918 #ifdef CONFIG_PM
2919 if (nl80211_send_wowlan(msg, rdev, state->split))
2920 goto nla_put_failure;
2921 state->split_start++;
2922 if (state->split)
2923 break;
2924 #else
2925 state->split_start++;
2926 #endif
2927 fallthrough;
2928 case 7:
2929 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2930 rdev->wiphy.software_iftypes))
2931 goto nla_put_failure;
2932
2933 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2934 NL80211_ATTR_INTERFACE_COMBINATIONS,
2935 rdev->wiphy.n_radio ? 0 : -1,
2936 state->split, 0))
2937 goto nla_put_failure;
2938
2939 state->split_start++;
2940 if (state->split)
2941 break;
2942 fallthrough;
2943 case 8:
2944 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2945 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2946 rdev->wiphy.ap_sme_capa))
2947 goto nla_put_failure;
2948
2949 features = rdev->wiphy.features;
2950 /*
2951 * We can only add the per-channel limit information if the
2952 * dump is split, otherwise it makes it too big. Therefore
2953 * only advertise it in that case.
2954 */
2955 if (state->split)
2956 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2957 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2958 goto nla_put_failure;
2959
2960 if (rdev->wiphy.ht_capa_mod_mask &&
2961 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2962 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2963 rdev->wiphy.ht_capa_mod_mask))
2964 goto nla_put_failure;
2965
2966 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2967 rdev->wiphy.max_acl_mac_addrs &&
2968 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2969 rdev->wiphy.max_acl_mac_addrs))
2970 goto nla_put_failure;
2971
2972 /*
2973 * Any information below this point is only available to
2974 * applications that can deal with it being split. This
2975 * helps ensure that newly added capabilities don't break
2976 * older tools by overrunning their buffers.
2977 *
2978 * We still increment split_start so that in the split
2979 * case we'll continue with more data in the next round,
2980 * but break unconditionally so unsplit data stops here.
2981 */
2982 if (state->split)
2983 state->split_start++;
2984 else
2985 state->split_start = 0;
2986 break;
2987 case 9:
2988 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2989 goto nla_put_failure;
2990
2991 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2992 rdev->wiphy.max_sched_scan_plans) ||
2993 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2994 rdev->wiphy.max_sched_scan_plan_interval) ||
2995 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2996 rdev->wiphy.max_sched_scan_plan_iterations))
2997 goto nla_put_failure;
2998
2999 if (rdev->wiphy.extended_capabilities &&
3000 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
3001 rdev->wiphy.extended_capabilities_len,
3002 rdev->wiphy.extended_capabilities) ||
3003 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3004 rdev->wiphy.extended_capabilities_len,
3005 rdev->wiphy.extended_capabilities_mask)))
3006 goto nla_put_failure;
3007
3008 if (rdev->wiphy.vht_capa_mod_mask &&
3009 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
3010 sizeof(*rdev->wiphy.vht_capa_mod_mask),
3011 rdev->wiphy.vht_capa_mod_mask))
3012 goto nla_put_failure;
3013
3014 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3015 rdev->wiphy.perm_addr))
3016 goto nla_put_failure;
3017
3018 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
3019 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
3020 rdev->wiphy.addr_mask))
3021 goto nla_put_failure;
3022
3023 if (rdev->wiphy.n_addresses > 1) {
3024 void *attr;
3025
3026 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
3027 if (!attr)
3028 goto nla_put_failure;
3029
3030 for (i = 0; i < rdev->wiphy.n_addresses; i++)
3031 if (nla_put(msg, i + 1, ETH_ALEN,
3032 rdev->wiphy.addresses[i].addr))
3033 goto nla_put_failure;
3034
3035 nla_nest_end(msg, attr);
3036 }
3037
3038 state->split_start++;
3039 break;
3040 case 10:
3041 if (nl80211_send_coalesce(msg, rdev))
3042 goto nla_put_failure;
3043
3044 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
3045 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
3046 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
3047 goto nla_put_failure;
3048
3049 if (rdev->wiphy.max_ap_assoc_sta &&
3050 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
3051 rdev->wiphy.max_ap_assoc_sta))
3052 goto nla_put_failure;
3053
3054 state->split_start++;
3055 break;
3056 case 11:
3057 if (rdev->wiphy.n_vendor_commands) {
3058 const struct nl80211_vendor_cmd_info *info;
3059 struct nlattr *nested;
3060
3061 nested = nla_nest_start_noflag(msg,
3062 NL80211_ATTR_VENDOR_DATA);
3063 if (!nested)
3064 goto nla_put_failure;
3065
3066 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
3067 info = &rdev->wiphy.vendor_commands[i].info;
3068 if (nla_put(msg, i + 1, sizeof(*info), info))
3069 goto nla_put_failure;
3070 }
3071 nla_nest_end(msg, nested);
3072 }
3073
3074 if (rdev->wiphy.n_vendor_events) {
3075 const struct nl80211_vendor_cmd_info *info;
3076 struct nlattr *nested;
3077
3078 nested = nla_nest_start_noflag(msg,
3079 NL80211_ATTR_VENDOR_EVENTS);
3080 if (!nested)
3081 goto nla_put_failure;
3082
3083 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
3084 info = &rdev->wiphy.vendor_events[i];
3085 if (nla_put(msg, i + 1, sizeof(*info), info))
3086 goto nla_put_failure;
3087 }
3088 nla_nest_end(msg, nested);
3089 }
3090 state->split_start++;
3091 break;
3092 case 12:
3093 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
3094 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
3095 rdev->wiphy.max_num_csa_counters))
3096 goto nla_put_failure;
3097
3098 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
3099 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
3100 goto nla_put_failure;
3101
3102 if (rdev->wiphy.max_sched_scan_reqs &&
3103 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
3104 rdev->wiphy.max_sched_scan_reqs))
3105 goto nla_put_failure;
3106
3107 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
3108 sizeof(rdev->wiphy.ext_features),
3109 rdev->wiphy.ext_features))
3110 goto nla_put_failure;
3111
3112 if (rdev->wiphy.bss_param_support) {
3113 struct nlattr *nested;
3114 u32 parsup = rdev->wiphy.bss_param_support;
3115
3116 nested = nla_nest_start(msg, NL80211_ATTR_BSS_PARAM);
3117 if (!nested)
3118 goto nla_put_failure;
3119
3120 if ((parsup & WIPHY_BSS_PARAM_CTS_PROT) &&
3121 nla_put_flag(msg, NL80211_ATTR_BSS_CTS_PROT))
3122 goto nla_put_failure;
3123 if ((parsup & WIPHY_BSS_PARAM_SHORT_PREAMBLE) &&
3124 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE))
3125 goto nla_put_failure;
3126 if ((parsup & WIPHY_BSS_PARAM_SHORT_SLOT_TIME) &&
3127 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME))
3128 goto nla_put_failure;
3129 if ((parsup & WIPHY_BSS_PARAM_BASIC_RATES) &&
3130 nla_put_flag(msg, NL80211_ATTR_BSS_BASIC_RATES))
3131 goto nla_put_failure;
3132 if ((parsup & WIPHY_BSS_PARAM_AP_ISOLATE) &&
3133 nla_put_flag(msg, NL80211_ATTR_AP_ISOLATE))
3134 goto nla_put_failure;
3135 if ((parsup & WIPHY_BSS_PARAM_HT_OPMODE) &&
3136 nla_put_flag(msg, NL80211_ATTR_BSS_HT_OPMODE))
3137 goto nla_put_failure;
3138 if ((parsup & WIPHY_BSS_PARAM_P2P_CTWINDOW) &&
3139 nla_put_flag(msg, NL80211_ATTR_P2P_CTWINDOW))
3140 goto nla_put_failure;
3141 if ((parsup & WIPHY_BSS_PARAM_P2P_OPPPS) &&
3142 nla_put_flag(msg, NL80211_ATTR_P2P_OPPPS))
3143 goto nla_put_failure;
3144 nla_nest_end(msg, nested);
3145 }
3146 if (rdev->wiphy.bss_select_support) {
3147 struct nlattr *nested;
3148 u32 bss_select_support = rdev->wiphy.bss_select_support;
3149
3150 nested = nla_nest_start_noflag(msg,
3151 NL80211_ATTR_BSS_SELECT);
3152 if (!nested)
3153 goto nla_put_failure;
3154
3155 i = 0;
3156 while (bss_select_support) {
3157 if ((bss_select_support & 1) &&
3158 nla_put_flag(msg, i))
3159 goto nla_put_failure;
3160 i++;
3161 bss_select_support >>= 1;
3162 }
3163 nla_nest_end(msg, nested);
3164 }
3165
3166 state->split_start++;
3167 break;
3168 case 13:
3169 if (rdev->wiphy.num_iftype_ext_capab &&
3170 rdev->wiphy.iftype_ext_capab) {
3171 struct nlattr *nested_ext_capab, *nested;
3172
3173 nested = nla_nest_start_noflag(msg,
3174 NL80211_ATTR_IFTYPE_EXT_CAPA);
3175 if (!nested)
3176 goto nla_put_failure;
3177
3178 for (i = state->capa_start;
3179 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3180 const struct wiphy_iftype_ext_capab *capab;
3181
3182 capab = &rdev->wiphy.iftype_ext_capab[i];
3183
3184 nested_ext_capab = nla_nest_start_noflag(msg,
3185 i);
3186 if (!nested_ext_capab ||
3187 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3188 capab->iftype) ||
3189 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3190 capab->extended_capabilities_len,
3191 capab->extended_capabilities) ||
3192 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3193 capab->extended_capabilities_len,
3194 capab->extended_capabilities_mask))
3195 goto nla_put_failure;
3196
3197 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3198 (nla_put_u16(msg,
3199 NL80211_ATTR_EML_CAPABILITY,
3200 capab->eml_capabilities) ||
3201 nla_put_u16(msg,
3202 NL80211_ATTR_MLD_CAPA_AND_OPS,
3203 capab->mld_capa_and_ops)))
3204 goto nla_put_failure;
3205
3206 nla_nest_end(msg, nested_ext_capab);
3207 if (state->split)
3208 break;
3209 }
3210 nla_nest_end(msg, nested);
3211 if (i < rdev->wiphy.num_iftype_ext_capab) {
3212 state->capa_start = i + 1;
3213 break;
3214 }
3215 }
3216
3217 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3218 rdev->wiphy.nan_supported_bands))
3219 goto nla_put_failure;
3220
3221 if (wiphy_ext_feature_isset(&rdev->wiphy,
3222 NL80211_EXT_FEATURE_TXQS)) {
3223 struct cfg80211_txq_stats txqstats = {};
3224 int res;
3225
3226 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3227 if (!res &&
3228 !nl80211_put_txq_stats(msg, &txqstats,
3229 NL80211_ATTR_TXQ_STATS))
3230 goto nla_put_failure;
3231
3232 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3233 rdev->wiphy.txq_limit))
3234 goto nla_put_failure;
3235 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3236 rdev->wiphy.txq_memory_limit))
3237 goto nla_put_failure;
3238 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3239 rdev->wiphy.txq_quantum))
3240 goto nla_put_failure;
3241 }
3242
3243 state->split_start++;
3244 break;
3245 case 14:
3246 if (nl80211_send_pmsr_capa(rdev, msg))
3247 goto nla_put_failure;
3248
3249 state->split_start++;
3250 break;
3251 case 15:
3252 if (rdev->wiphy.akm_suites &&
3253 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3254 sizeof(u32) * rdev->wiphy.n_akm_suites,
3255 rdev->wiphy.akm_suites))
3256 goto nla_put_failure;
3257
3258 if (nl80211_put_iftype_akm_suites(rdev, msg))
3259 goto nla_put_failure;
3260
3261 if (nl80211_put_tid_config_support(rdev, msg))
3262 goto nla_put_failure;
3263 state->split_start++;
3264 break;
3265 case 16:
3266 if (nl80211_put_sar_specs(rdev, msg))
3267 goto nla_put_failure;
3268
3269 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3270 goto nla_put_failure;
3271
3272 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3273 rdev->wiphy.max_num_akm_suites))
3274 goto nla_put_failure;
3275
3276 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3277 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3278
3279 if (rdev->wiphy.hw_timestamp_max_peers &&
3280 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3281 rdev->wiphy.hw_timestamp_max_peers))
3282 goto nla_put_failure;
3283
3284 state->split_start++;
3285 break;
3286 case 17:
3287 if (nl80211_put_radios(&rdev->wiphy, msg))
3288 goto nla_put_failure;
3289
3290 state->split_start++;
3291 break;
3292 case 18:
3293 if (nl80211_put_nan_capa(&rdev->wiphy, msg))
3294 goto nla_put_failure;
3295
3296 /* done */
3297 state->split_start = 0;
3298 break;
3299 }
3300 finish:
3301 genlmsg_end(msg, hdr);
3302 return 0;
3303
3304 nla_put_failure:
3305 genlmsg_cancel(msg, hdr);
3306 return -EMSGSIZE;
3307 }
3308
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3309 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3310 struct netlink_callback *cb,
3311 struct nl80211_dump_wiphy_state *state)
3312 {
3313 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3314 int ret;
3315
3316 if (!tb)
3317 return -ENOMEM;
3318
3319 ret = nlmsg_parse_deprecated(cb->nlh,
3320 GENL_HDRLEN + nl80211_fam.hdrsize,
3321 tb, nl80211_fam.maxattr,
3322 nl80211_policy, NULL);
3323 /* ignore parse errors for backward compatibility */
3324 if (ret) {
3325 ret = 0;
3326 goto out;
3327 }
3328
3329 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3330 if (tb[NL80211_ATTR_WIPHY])
3331 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3332 if (tb[NL80211_ATTR_WDEV])
3333 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3334 if (tb[NL80211_ATTR_IFINDEX]) {
3335 struct net_device *netdev;
3336 struct cfg80211_registered_device *rdev;
3337 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3338
3339 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3340 if (!netdev) {
3341 ret = -ENODEV;
3342 goto out;
3343 }
3344 if (netdev->ieee80211_ptr) {
3345 rdev = wiphy_to_rdev(
3346 netdev->ieee80211_ptr->wiphy);
3347 state->filter_wiphy = rdev->wiphy_idx;
3348 }
3349 }
3350
3351 ret = 0;
3352 out:
3353 kfree(tb);
3354 return ret;
3355 }
3356
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3357 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3358 {
3359 int idx = 0, ret;
3360 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3361 struct cfg80211_registered_device *rdev;
3362
3363 rtnl_lock();
3364 if (!state) {
3365 state = kzalloc(sizeof(*state), GFP_KERNEL);
3366 if (!state) {
3367 rtnl_unlock();
3368 return -ENOMEM;
3369 }
3370 state->filter_wiphy = -1;
3371 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3372 if (ret) {
3373 kfree(state);
3374 rtnl_unlock();
3375 return ret;
3376 }
3377 cb->args[0] = (long)state;
3378 }
3379
3380 for_each_rdev(rdev) {
3381 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3382 continue;
3383 if (++idx <= state->start)
3384 continue;
3385 if (state->filter_wiphy != -1 &&
3386 state->filter_wiphy != rdev->wiphy_idx)
3387 continue;
3388 wiphy_lock(&rdev->wiphy);
3389 /* attempt to fit multiple wiphy data chunks into the skb */
3390 do {
3391 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3392 skb,
3393 NETLINK_CB(cb->skb).portid,
3394 cb->nlh->nlmsg_seq,
3395 NLM_F_MULTI, state);
3396 if (ret < 0) {
3397 /*
3398 * If sending the wiphy data didn't fit (ENOBUFS
3399 * or EMSGSIZE returned), this SKB is still
3400 * empty (so it's not too big because another
3401 * wiphy dataset is already in the skb) and
3402 * we've not tried to adjust the dump allocation
3403 * yet ... then adjust the alloc size to be
3404 * bigger, and return 1 but with the empty skb.
3405 * This results in an empty message being RX'ed
3406 * in userspace, but that is ignored.
3407 *
3408 * We can then retry with the larger buffer.
3409 */
3410 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3411 !skb->len && !state->split &&
3412 cb->min_dump_alloc < 4096) {
3413 cb->min_dump_alloc = 4096;
3414 state->split_start = 0;
3415 wiphy_unlock(&rdev->wiphy);
3416 rtnl_unlock();
3417 return 1;
3418 }
3419 idx--;
3420 break;
3421 }
3422 } while (state->split_start > 0);
3423 wiphy_unlock(&rdev->wiphy);
3424 break;
3425 }
3426 rtnl_unlock();
3427
3428 state->start = idx;
3429
3430 return skb->len;
3431 }
3432
nl80211_dump_wiphy_done(struct netlink_callback * cb)3433 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3434 {
3435 kfree((void *)cb->args[0]);
3436 return 0;
3437 }
3438
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3439 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3440 {
3441 struct sk_buff *msg;
3442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3443 struct nl80211_dump_wiphy_state state = {};
3444
3445 msg = nlmsg_new(4096, GFP_KERNEL);
3446 if (!msg)
3447 return -ENOMEM;
3448
3449 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3450 info->snd_portid, info->snd_seq, 0,
3451 &state) < 0) {
3452 nlmsg_free(msg);
3453 return -ENOBUFS;
3454 }
3455
3456 return genlmsg_reply(msg, info);
3457 }
3458
3459 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3460 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3461 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3462 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3463 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3464 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3465 };
3466
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3467 static int parse_txq_params(struct nlattr *tb[],
3468 struct ieee80211_txq_params *txq_params)
3469 {
3470 u8 ac;
3471
3472 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3473 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3474 !tb[NL80211_TXQ_ATTR_AIFS])
3475 return -EINVAL;
3476
3477 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3478 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3479 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3480 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3481 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3482
3483 if (ac >= NL80211_NUM_ACS)
3484 return -EINVAL;
3485 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3486 return 0;
3487 }
3488
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3489 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3490 {
3491 /*
3492 * You can only set the channel explicitly for some interfaces,
3493 * most have their channel managed via their respective
3494 * "establish a connection" command (connect, join, ...)
3495 *
3496 * For AP/GO and mesh mode, the channel can be set with the
3497 * channel userspace API, but is only stored and passed to the
3498 * low-level driver when the AP starts or the mesh is joined.
3499 * This is for backward compatibility, userspace can also give
3500 * the channel in the start-ap or join-mesh commands instead.
3501 *
3502 * Monitors are special as they are normally slaved to
3503 * whatever else is going on, so they have their own special
3504 * operation to set the monitor channel if possible.
3505 */
3506 return !wdev ||
3507 wdev->iftype == NL80211_IFTYPE_AP ||
3508 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3509 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3510 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3511 }
3512
_nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,bool monitor,struct cfg80211_chan_def * chandef)3513 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3514 struct genl_info *info, bool monitor,
3515 struct cfg80211_chan_def *chandef)
3516 {
3517 struct netlink_ext_ack *extack = info->extack;
3518 struct nlattr **attrs = info->attrs;
3519 u32 control_freq;
3520
3521 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3522 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3523 "Frequency is missing");
3524 return -EINVAL;
3525 }
3526
3527 control_freq = MHZ_TO_KHZ(
3528 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3529 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3530 control_freq +=
3531 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3532
3533 memset(chandef, 0, sizeof(*chandef));
3534 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3535 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3536 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3537 chandef->freq1_offset = control_freq % 1000;
3538 chandef->center_freq2 = 0;
3539 chandef->s1g_primary_2mhz = false;
3540
3541 if (!chandef->chan) {
3542 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3543 "Unknown channel");
3544 return -EINVAL;
3545 }
3546
3547 if (cfg80211_chandef_is_s1g(chandef))
3548 chandef->width = NL80211_CHAN_WIDTH_1;
3549
3550 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3551 enum nl80211_channel_type chantype;
3552
3553 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3554
3555 switch (chantype) {
3556 case NL80211_CHAN_NO_HT:
3557 case NL80211_CHAN_HT20:
3558 case NL80211_CHAN_HT40PLUS:
3559 case NL80211_CHAN_HT40MINUS:
3560 cfg80211_chandef_create(chandef, chandef->chan,
3561 chantype);
3562 /* user input for center_freq is incorrect */
3563 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3564 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3565 NL_SET_ERR_MSG_ATTR(extack,
3566 attrs[NL80211_ATTR_CENTER_FREQ1],
3567 "bad center frequency 1");
3568 return -EINVAL;
3569 }
3570 /* center_freq2 must be zero */
3571 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3572 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3573 NL_SET_ERR_MSG_ATTR(extack,
3574 attrs[NL80211_ATTR_CENTER_FREQ2],
3575 "center frequency 2 can't be used");
3576 return -EINVAL;
3577 }
3578 break;
3579 default:
3580 NL_SET_ERR_MSG_ATTR(extack,
3581 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3582 "invalid channel type");
3583 return -EINVAL;
3584 }
3585 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3586 chandef->width = nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3587 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3588 chandef->center_freq1 =
3589 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3590 chandef->freq1_offset = nla_get_u32_default(
3591 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET], 0);
3592 }
3593
3594 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3595 chandef->center_freq2 =
3596 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3597
3598 chandef->s1g_primary_2mhz = nla_get_flag(
3599 attrs[NL80211_ATTR_S1G_PRIMARY_2MHZ]);
3600 }
3601
3602 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3603 chandef->edmg.channels =
3604 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3605
3606 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3607 chandef->edmg.bw_config =
3608 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3609 } else {
3610 chandef->edmg.bw_config = 0;
3611 chandef->edmg.channels = 0;
3612 }
3613
3614 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3615 chandef->punctured =
3616 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3617
3618 if (chandef->punctured &&
3619 !wiphy_ext_feature_isset(&rdev->wiphy,
3620 NL80211_EXT_FEATURE_PUNCT)) {
3621 NL_SET_ERR_MSG(extack,
3622 "driver doesn't support puncturing");
3623 return -EINVAL;
3624 }
3625 }
3626
3627 if (!cfg80211_chandef_valid(chandef)) {
3628 NL_SET_ERR_MSG(extack, "invalid channel definition");
3629 return -EINVAL;
3630 }
3631
3632 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3633 IEEE80211_CHAN_DISABLED,
3634 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3635 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3636 return -EINVAL;
3637 }
3638
3639 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3640 chandef->width == NL80211_CHAN_WIDTH_10) &&
3641 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3642 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3643 return -EINVAL;
3644 }
3645
3646 return 0;
3647 }
3648
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3649 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3650 struct genl_info *info,
3651 struct cfg80211_chan_def *chandef)
3652 {
3653 return _nl80211_parse_chandef(rdev, info, false, chandef);
3654 }
3655
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3656 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3657 struct net_device *dev,
3658 struct genl_info *info,
3659 int _link_id)
3660 {
3661 struct cfg80211_chan_def chandef;
3662 int result;
3663 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3664 struct wireless_dev *wdev = NULL;
3665 int link_id = _link_id;
3666
3667 if (dev)
3668 wdev = dev->ieee80211_ptr;
3669 if (!nl80211_can_set_dev_channel(wdev))
3670 return -EOPNOTSUPP;
3671 if (wdev)
3672 iftype = wdev->iftype;
3673
3674 if (link_id < 0) {
3675 if (wdev && wdev->valid_links)
3676 return -EINVAL;
3677 link_id = 0;
3678 }
3679
3680 result = _nl80211_parse_chandef(rdev, info,
3681 iftype == NL80211_IFTYPE_MONITOR,
3682 &chandef);
3683 if (result)
3684 return result;
3685
3686 switch (iftype) {
3687 case NL80211_IFTYPE_AP:
3688 case NL80211_IFTYPE_P2P_GO:
3689 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3690 iftype))
3691 return -EINVAL;
3692 if (wdev->links[link_id].ap.beacon_interval) {
3693 struct ieee80211_channel *cur_chan;
3694
3695 if (!dev || !rdev->ops->set_ap_chanwidth ||
3696 !(rdev->wiphy.features &
3697 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3698 return -EBUSY;
3699
3700 /* Only allow dynamic channel width changes */
3701 cur_chan = wdev->links[link_id].ap.chandef.chan;
3702 if (chandef.chan != cur_chan)
3703 return -EBUSY;
3704
3705 /* only allow this for regular channel widths */
3706 switch (wdev->links[link_id].ap.chandef.width) {
3707 case NL80211_CHAN_WIDTH_20_NOHT:
3708 case NL80211_CHAN_WIDTH_20:
3709 case NL80211_CHAN_WIDTH_40:
3710 case NL80211_CHAN_WIDTH_80:
3711 case NL80211_CHAN_WIDTH_80P80:
3712 case NL80211_CHAN_WIDTH_160:
3713 case NL80211_CHAN_WIDTH_320:
3714 break;
3715 default:
3716 return -EINVAL;
3717 }
3718
3719 switch (chandef.width) {
3720 case NL80211_CHAN_WIDTH_20_NOHT:
3721 case NL80211_CHAN_WIDTH_20:
3722 case NL80211_CHAN_WIDTH_40:
3723 case NL80211_CHAN_WIDTH_80:
3724 case NL80211_CHAN_WIDTH_80P80:
3725 case NL80211_CHAN_WIDTH_160:
3726 case NL80211_CHAN_WIDTH_320:
3727 break;
3728 default:
3729 return -EINVAL;
3730 }
3731
3732 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3733 &chandef);
3734 if (result)
3735 return result;
3736 wdev->links[link_id].ap.chandef = chandef;
3737 } else {
3738 wdev->u.ap.preset_chandef = chandef;
3739 }
3740 return 0;
3741 case NL80211_IFTYPE_MESH_POINT:
3742 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3743 case NL80211_IFTYPE_MONITOR:
3744 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3745 default:
3746 break;
3747 }
3748
3749 return -EINVAL;
3750 }
3751
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3752 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3753 {
3754 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3755 int link_id = nl80211_link_id_or_invalid(info->attrs);
3756 struct net_device *netdev = info->user_ptr[1];
3757
3758 return __nl80211_set_channel(rdev, netdev, info, link_id);
3759 }
3760
nl80211_set_wiphy_radio(struct genl_info * info,struct cfg80211_registered_device * rdev,int radio_idx)3761 static int nl80211_set_wiphy_radio(struct genl_info *info,
3762 struct cfg80211_registered_device *rdev,
3763 int radio_idx)
3764 {
3765 u32 rts_threshold = 0, old_rts, changed = 0;
3766 int result;
3767
3768 if (!rdev->ops->set_wiphy_params)
3769 return -EOPNOTSUPP;
3770
3771 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3772 rts_threshold = nla_get_u32(
3773 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3774 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3775 }
3776
3777 old_rts = rdev->wiphy.radio_cfg[radio_idx].rts_threshold;
3778
3779 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = rts_threshold;
3780
3781 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
3782 if (result)
3783 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = old_rts;
3784
3785 return 0;
3786 }
3787
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3788 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3789 {
3790 struct cfg80211_registered_device *rdev = NULL;
3791 struct net_device *netdev = NULL;
3792 struct wireless_dev *wdev;
3793 int result = 0, rem_txq_params = 0;
3794 struct nlattr *nl_txq_params;
3795 u32 changed;
3796 u8 retry_short = 0, retry_long = 0;
3797 u32 frag_threshold = 0, rts_threshold = 0;
3798 u8 coverage_class = 0;
3799 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3800 int radio_idx = -1;
3801
3802 rtnl_lock();
3803 /*
3804 * Try to find the wiphy and netdev. Normally this
3805 * function shouldn't need the netdev, but this is
3806 * done for backward compatibility -- previously
3807 * setting the channel was done per wiphy, but now
3808 * it is per netdev. Previous userland like hostapd
3809 * also passed a netdev to set_wiphy, so that it is
3810 * possible to let that go to the right netdev!
3811 */
3812
3813 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3814 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3815
3816 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3817 if (netdev && netdev->ieee80211_ptr)
3818 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3819 else
3820 netdev = NULL;
3821 }
3822
3823 if (!netdev) {
3824 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3825 info->attrs);
3826 if (IS_ERR(rdev)) {
3827 rtnl_unlock();
3828 return PTR_ERR(rdev);
3829 }
3830 wdev = NULL;
3831 netdev = NULL;
3832 result = 0;
3833 } else
3834 wdev = netdev->ieee80211_ptr;
3835
3836 guard(wiphy)(&rdev->wiphy);
3837
3838 /*
3839 * end workaround code, by now the rdev is available
3840 * and locked, and wdev may or may not be NULL.
3841 */
3842
3843 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3844 result = cfg80211_dev_rename(
3845 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3846 rtnl_unlock();
3847
3848 if (result)
3849 return result;
3850
3851 if (info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]) {
3852 /* Radio idx is not expected for non-multi radio wiphy */
3853 if (rdev->wiphy.n_radio <= 0)
3854 return -EINVAL;
3855
3856 radio_idx = nla_get_u8(
3857 info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]);
3858 if (radio_idx >= rdev->wiphy.n_radio)
3859 return -EINVAL;
3860
3861 return nl80211_set_wiphy_radio(info, rdev, radio_idx);
3862 }
3863
3864 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3865 struct ieee80211_txq_params txq_params;
3866 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3867
3868 if (!rdev->ops->set_txq_params)
3869 return -EOPNOTSUPP;
3870
3871 if (!netdev)
3872 return -EINVAL;
3873
3874 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3875 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3876 return -EINVAL;
3877
3878 if (!netif_running(netdev))
3879 return -ENETDOWN;
3880
3881 nla_for_each_nested(nl_txq_params,
3882 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3883 rem_txq_params) {
3884 result = nla_parse_nested_deprecated(tb,
3885 NL80211_TXQ_ATTR_MAX,
3886 nl_txq_params,
3887 txq_params_policy,
3888 info->extack);
3889 if (result)
3890 return result;
3891
3892 result = parse_txq_params(tb, &txq_params);
3893 if (result)
3894 return result;
3895
3896 txq_params.link_id =
3897 nl80211_link_id_or_invalid(info->attrs);
3898
3899 if (txq_params.link_id >= 0 &&
3900 !(netdev->ieee80211_ptr->valid_links &
3901 BIT(txq_params.link_id)))
3902 result = -ENOLINK;
3903 else if (txq_params.link_id >= 0 &&
3904 !netdev->ieee80211_ptr->valid_links)
3905 result = -EINVAL;
3906 else
3907 result = rdev_set_txq_params(rdev, netdev,
3908 &txq_params);
3909 if (result)
3910 return result;
3911 }
3912 }
3913
3914 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3915 int link_id = nl80211_link_id_or_invalid(info->attrs);
3916
3917 if (wdev) {
3918 result = __nl80211_set_channel(
3919 rdev,
3920 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3921 info, link_id);
3922 } else {
3923 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3924 }
3925
3926 if (result)
3927 return result;
3928 }
3929
3930 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3931 struct wireless_dev *txp_wdev = wdev;
3932 enum nl80211_tx_power_setting type;
3933 int idx, mbm = 0;
3934
3935 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3936 txp_wdev = NULL;
3937
3938 if (!rdev->ops->set_tx_power)
3939 return -EOPNOTSUPP;
3940
3941 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3942 type = nla_get_u32(info->attrs[idx]);
3943
3944 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3945 (type != NL80211_TX_POWER_AUTOMATIC))
3946 return -EINVAL;
3947
3948 if (type != NL80211_TX_POWER_AUTOMATIC) {
3949 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3950 mbm = nla_get_u32(info->attrs[idx]);
3951 }
3952
3953 result = rdev_set_tx_power(rdev, txp_wdev, radio_idx, type,
3954 mbm);
3955 if (result)
3956 return result;
3957 }
3958
3959 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3960 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3961 u32 tx_ant, rx_ant;
3962
3963 if ((!rdev->wiphy.available_antennas_tx &&
3964 !rdev->wiphy.available_antennas_rx) ||
3965 !rdev->ops->set_antenna)
3966 return -EOPNOTSUPP;
3967
3968 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3969 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3970
3971 /* reject antenna configurations which don't match the
3972 * available antenna masks, except for the "all" mask */
3973 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3974 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3975 return -EINVAL;
3976
3977 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3978 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3979
3980 result = rdev_set_antenna(rdev, radio_idx, tx_ant, rx_ant);
3981 if (result)
3982 return result;
3983 }
3984
3985 changed = 0;
3986
3987 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3988 retry_short = nla_get_u8(
3989 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3990
3991 changed |= WIPHY_PARAM_RETRY_SHORT;
3992 }
3993
3994 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3995 retry_long = nla_get_u8(
3996 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3997
3998 changed |= WIPHY_PARAM_RETRY_LONG;
3999 }
4000
4001 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
4002 frag_threshold = nla_get_u32(
4003 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
4004 if (frag_threshold < 256)
4005 return -EINVAL;
4006
4007 if (frag_threshold != (u32) -1) {
4008 /*
4009 * Fragments (apart from the last one) are required to
4010 * have even length. Make the fragmentation code
4011 * simpler by stripping LSB should someone try to use
4012 * odd threshold value.
4013 */
4014 frag_threshold &= ~0x1;
4015 }
4016 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
4017 }
4018
4019 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
4020 rts_threshold = nla_get_u32(
4021 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
4022 changed |= WIPHY_PARAM_RTS_THRESHOLD;
4023 }
4024
4025 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
4026 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
4027 return -EINVAL;
4028
4029 coverage_class = nla_get_u8(
4030 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
4031 changed |= WIPHY_PARAM_COVERAGE_CLASS;
4032 }
4033
4034 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
4035 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
4036 return -EOPNOTSUPP;
4037
4038 changed |= WIPHY_PARAM_DYN_ACK;
4039 }
4040
4041 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
4042 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4043 NL80211_EXT_FEATURE_TXQS))
4044 return -EOPNOTSUPP;
4045
4046 txq_limit = nla_get_u32(
4047 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
4048 changed |= WIPHY_PARAM_TXQ_LIMIT;
4049 }
4050
4051 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
4052 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4053 NL80211_EXT_FEATURE_TXQS))
4054 return -EOPNOTSUPP;
4055
4056 txq_memory_limit = nla_get_u32(
4057 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
4058 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
4059 }
4060
4061 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
4062 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4063 NL80211_EXT_FEATURE_TXQS))
4064 return -EOPNOTSUPP;
4065
4066 txq_quantum = nla_get_u32(
4067 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
4068 changed |= WIPHY_PARAM_TXQ_QUANTUM;
4069 }
4070
4071 if (changed) {
4072 u8 old_retry_short, old_retry_long;
4073 u32 old_frag_threshold, old_rts_threshold;
4074 u8 old_coverage_class, i;
4075 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
4076 u32 *old_radio_rts_threshold = NULL;
4077
4078 if (!rdev->ops->set_wiphy_params)
4079 return -EOPNOTSUPP;
4080
4081 if (rdev->wiphy.n_radio) {
4082 old_radio_rts_threshold = kcalloc(rdev->wiphy.n_radio,
4083 sizeof(u32),
4084 GFP_KERNEL);
4085 if (!old_radio_rts_threshold)
4086 return -ENOMEM;
4087 }
4088
4089 old_retry_short = rdev->wiphy.retry_short;
4090 old_retry_long = rdev->wiphy.retry_long;
4091 old_frag_threshold = rdev->wiphy.frag_threshold;
4092 old_rts_threshold = rdev->wiphy.rts_threshold;
4093 if (old_radio_rts_threshold) {
4094 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4095 old_radio_rts_threshold[i] =
4096 rdev->wiphy.radio_cfg[i].rts_threshold;
4097 }
4098 old_coverage_class = rdev->wiphy.coverage_class;
4099 old_txq_limit = rdev->wiphy.txq_limit;
4100 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
4101 old_txq_quantum = rdev->wiphy.txq_quantum;
4102
4103 if (changed & WIPHY_PARAM_RETRY_SHORT)
4104 rdev->wiphy.retry_short = retry_short;
4105 if (changed & WIPHY_PARAM_RETRY_LONG)
4106 rdev->wiphy.retry_long = retry_long;
4107 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
4108 rdev->wiphy.frag_threshold = frag_threshold;
4109 if ((changed & WIPHY_PARAM_RTS_THRESHOLD) &&
4110 old_radio_rts_threshold) {
4111 rdev->wiphy.rts_threshold = rts_threshold;
4112 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4113 rdev->wiphy.radio_cfg[i].rts_threshold =
4114 rdev->wiphy.rts_threshold;
4115 }
4116 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
4117 rdev->wiphy.coverage_class = coverage_class;
4118 if (changed & WIPHY_PARAM_TXQ_LIMIT)
4119 rdev->wiphy.txq_limit = txq_limit;
4120 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
4121 rdev->wiphy.txq_memory_limit = txq_memory_limit;
4122 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
4123 rdev->wiphy.txq_quantum = txq_quantum;
4124
4125 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
4126 if (result) {
4127 rdev->wiphy.retry_short = old_retry_short;
4128 rdev->wiphy.retry_long = old_retry_long;
4129 rdev->wiphy.frag_threshold = old_frag_threshold;
4130 rdev->wiphy.rts_threshold = old_rts_threshold;
4131 if (old_radio_rts_threshold) {
4132 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4133 rdev->wiphy.radio_cfg[i].rts_threshold =
4134 old_radio_rts_threshold[i];
4135 }
4136 rdev->wiphy.coverage_class = old_coverage_class;
4137 rdev->wiphy.txq_limit = old_txq_limit;
4138 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
4139 rdev->wiphy.txq_quantum = old_txq_quantum;
4140 }
4141
4142 kfree(old_radio_rts_threshold);
4143 return result;
4144 }
4145
4146 return 0;
4147 }
4148
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)4149 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
4150 {
4151 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
4152 return -EINVAL;
4153
4154 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4155 chandef->chan->center_freq))
4156 return -ENOBUFS;
4157 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
4158 chandef->chan->freq_offset))
4159 return -ENOBUFS;
4160 switch (chandef->width) {
4161 case NL80211_CHAN_WIDTH_20_NOHT:
4162 case NL80211_CHAN_WIDTH_20:
4163 case NL80211_CHAN_WIDTH_40:
4164 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4165 cfg80211_get_chandef_type(chandef)))
4166 return -ENOBUFS;
4167 break;
4168 default:
4169 break;
4170 }
4171 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
4172 return -ENOBUFS;
4173 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
4174 return -ENOBUFS;
4175 if (chandef->center_freq2 &&
4176 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
4177 return -ENOBUFS;
4178 if (chandef->punctured &&
4179 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
4180 return -ENOBUFS;
4181 if (chandef->s1g_primary_2mhz &&
4182 nla_put_flag(msg, NL80211_ATTR_S1G_PRIMARY_2MHZ))
4183 return -ENOBUFS;
4184
4185 return 0;
4186 }
4187 EXPORT_SYMBOL(nl80211_send_chandef);
4188
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)4189 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
4190 struct cfg80211_registered_device *rdev,
4191 struct wireless_dev *wdev,
4192 enum nl80211_commands cmd)
4193 {
4194 struct net_device *dev = wdev->netdev;
4195 void *hdr;
4196
4197 lockdep_assert_wiphy(&rdev->wiphy);
4198
4199 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
4200 cmd != NL80211_CMD_DEL_INTERFACE &&
4201 cmd != NL80211_CMD_SET_INTERFACE);
4202
4203 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4204 if (!hdr)
4205 return -1;
4206
4207 if (dev &&
4208 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4209 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
4210 goto nla_put_failure;
4211
4212 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
4213 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
4214 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
4215 NL80211_ATTR_PAD) ||
4216 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
4217 nla_put_u32(msg, NL80211_ATTR_GENERATION,
4218 rdev->devlist_generation ^
4219 (cfg80211_rdev_list_generation << 2)) ||
4220 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
4221 nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
4222 goto nla_put_failure;
4223
4224 if (rdev->ops->get_channel && !wdev->valid_links) {
4225 struct cfg80211_chan_def chandef = {};
4226 int ret;
4227
4228 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4229 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4230 goto nla_put_failure;
4231 }
4232
4233 if (rdev->ops->get_tx_power && !wdev->valid_links) {
4234 int dbm, ret;
4235
4236 ret = rdev_get_tx_power(rdev, wdev, -1, 0, &dbm);
4237 if (ret == 0 &&
4238 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4239 DBM_TO_MBM(dbm)))
4240 goto nla_put_failure;
4241 }
4242
4243 switch (wdev->iftype) {
4244 case NL80211_IFTYPE_AP:
4245 case NL80211_IFTYPE_P2P_GO:
4246 if (wdev->u.ap.ssid_len &&
4247 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4248 wdev->u.ap.ssid))
4249 goto nla_put_failure;
4250 break;
4251 case NL80211_IFTYPE_STATION:
4252 case NL80211_IFTYPE_P2P_CLIENT:
4253 if (wdev->u.client.ssid_len &&
4254 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4255 wdev->u.client.ssid))
4256 goto nla_put_failure;
4257 break;
4258 case NL80211_IFTYPE_ADHOC:
4259 if (wdev->u.ibss.ssid_len &&
4260 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4261 wdev->u.ibss.ssid))
4262 goto nla_put_failure;
4263 break;
4264 default:
4265 /* nothing */
4266 break;
4267 }
4268
4269 if (rdev->ops->get_txq_stats) {
4270 struct cfg80211_txq_stats txqstats = {};
4271 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4272
4273 if (ret == 0 &&
4274 !nl80211_put_txq_stats(msg, &txqstats,
4275 NL80211_ATTR_TXQ_STATS))
4276 goto nla_put_failure;
4277 }
4278
4279 if (wdev->valid_links) {
4280 unsigned int link_id;
4281 struct nlattr *links = nla_nest_start(msg,
4282 NL80211_ATTR_MLO_LINKS);
4283
4284 if (!links)
4285 goto nla_put_failure;
4286
4287 for_each_valid_link(wdev, link_id) {
4288 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4289 struct cfg80211_chan_def chandef = {};
4290 int ret;
4291
4292 if (!link)
4293 goto nla_put_failure;
4294
4295 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4296 goto nla_put_failure;
4297 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4298 wdev->links[link_id].addr))
4299 goto nla_put_failure;
4300
4301 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4302 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4303 goto nla_put_failure;
4304
4305 if (rdev->ops->get_tx_power) {
4306 int dbm, ret;
4307
4308 ret = rdev_get_tx_power(rdev, wdev, -1, link_id, &dbm);
4309 if (ret == 0 &&
4310 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4311 DBM_TO_MBM(dbm)))
4312 goto nla_put_failure;
4313 }
4314 nla_nest_end(msg, link);
4315 }
4316
4317 nla_nest_end(msg, links);
4318 }
4319
4320 genlmsg_end(msg, hdr);
4321 return 0;
4322
4323 nla_put_failure:
4324 genlmsg_cancel(msg, hdr);
4325 return -EMSGSIZE;
4326 }
4327
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)4328 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4329 {
4330 int wp_idx = 0;
4331 int if_idx = 0;
4332 int wp_start = cb->args[0];
4333 int if_start = cb->args[1];
4334 int filter_wiphy = -1;
4335 struct cfg80211_registered_device *rdev;
4336 struct wireless_dev *wdev;
4337 int ret;
4338
4339 rtnl_lock();
4340 if (!cb->args[2]) {
4341 struct nl80211_dump_wiphy_state state = {
4342 .filter_wiphy = -1,
4343 };
4344
4345 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4346 if (ret)
4347 goto out_unlock;
4348
4349 filter_wiphy = state.filter_wiphy;
4350
4351 /*
4352 * if filtering, set cb->args[2] to +1 since 0 is the default
4353 * value needed to determine that parsing is necessary.
4354 */
4355 if (filter_wiphy >= 0)
4356 cb->args[2] = filter_wiphy + 1;
4357 else
4358 cb->args[2] = -1;
4359 } else if (cb->args[2] > 0) {
4360 filter_wiphy = cb->args[2] - 1;
4361 }
4362
4363 for_each_rdev(rdev) {
4364 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4365 continue;
4366 if (wp_idx < wp_start) {
4367 wp_idx++;
4368 continue;
4369 }
4370
4371 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4372 continue;
4373
4374 if_idx = 0;
4375
4376 guard(wiphy)(&rdev->wiphy);
4377
4378 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4379 if (if_idx < if_start) {
4380 if_idx++;
4381 continue;
4382 }
4383
4384 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4385 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4386 rdev, wdev,
4387 NL80211_CMD_NEW_INTERFACE) < 0)
4388 goto out;
4389
4390 if_idx++;
4391 }
4392
4393 if_start = 0;
4394 wp_idx++;
4395 }
4396 out:
4397 cb->args[0] = wp_idx;
4398 cb->args[1] = if_idx;
4399
4400 ret = skb->len;
4401 out_unlock:
4402 rtnl_unlock();
4403
4404 return ret;
4405 }
4406
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4407 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4408 {
4409 struct sk_buff *msg;
4410 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4411 struct wireless_dev *wdev = info->user_ptr[1];
4412
4413 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4414 if (!msg)
4415 return -ENOMEM;
4416
4417 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4418 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4419 nlmsg_free(msg);
4420 return -ENOBUFS;
4421 }
4422
4423 return genlmsg_reply(msg, info);
4424 }
4425
4426 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4427 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4428 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4429 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4430 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4431 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4432 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4433 [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4434 };
4435
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4436 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4437 {
4438 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4439 int flag;
4440
4441 *mntrflags = 0;
4442
4443 if (!nla)
4444 return -EINVAL;
4445
4446 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4447 return -EINVAL;
4448
4449 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4450 if (flags[flag])
4451 *mntrflags |= (1<<flag);
4452
4453 /* cooked monitor mode is incompatible with other modes */
4454 if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4455 *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4456 return -EOPNOTSUPP;
4457
4458 *mntrflags |= MONITOR_FLAG_CHANGED;
4459
4460 return 0;
4461 }
4462
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4463 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4464 enum nl80211_iftype type,
4465 struct genl_info *info,
4466 struct vif_params *params)
4467 {
4468 bool change = false;
4469 int err;
4470
4471 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4472 if (type != NL80211_IFTYPE_MONITOR)
4473 return -EINVAL;
4474
4475 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4476 ¶ms->flags);
4477 if (err)
4478 return err;
4479
4480 change = true;
4481 }
4482
4483 /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4484 if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4485 return -EOPNOTSUPP;
4486
4487 if (params->flags & MONITOR_FLAG_ACTIVE &&
4488 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4489 return -EOPNOTSUPP;
4490
4491 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4492 const u8 *mumimo_groups;
4493 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4494
4495 if (type != NL80211_IFTYPE_MONITOR)
4496 return -EINVAL;
4497
4498 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4499 return -EOPNOTSUPP;
4500
4501 mumimo_groups =
4502 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4503
4504 /* bits 0 and 63 are reserved and must be zero */
4505 if ((mumimo_groups[0] & BIT(0)) ||
4506 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4507 return -EINVAL;
4508
4509 params->vht_mumimo_groups = mumimo_groups;
4510 change = true;
4511 }
4512
4513 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4514 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4515
4516 if (type != NL80211_IFTYPE_MONITOR)
4517 return -EINVAL;
4518
4519 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4520 return -EOPNOTSUPP;
4521
4522 params->vht_mumimo_follow_addr =
4523 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4524 change = true;
4525 }
4526
4527 return change ? 1 : 0;
4528 }
4529
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4530 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4531 struct net_device *netdev, u8 use_4addr,
4532 enum nl80211_iftype iftype)
4533 {
4534 if (!use_4addr) {
4535 if (netdev && netif_is_bridge_port(netdev))
4536 return -EBUSY;
4537 return 0;
4538 }
4539
4540 switch (iftype) {
4541 case NL80211_IFTYPE_AP_VLAN:
4542 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4543 return 0;
4544 break;
4545 case NL80211_IFTYPE_STATION:
4546 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4547 return 0;
4548 break;
4549 default:
4550 break;
4551 }
4552
4553 return -EOPNOTSUPP;
4554 }
4555
nl80211_parse_vif_radio_mask(struct genl_info * info,u32 * radio_mask)4556 static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4557 u32 *radio_mask)
4558 {
4559 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4560 struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4561 u32 mask, allowed;
4562
4563 if (!attr) {
4564 *radio_mask = 0;
4565 return 0;
4566 }
4567
4568 allowed = BIT(rdev->wiphy.n_radio) - 1;
4569 mask = nla_get_u32(attr);
4570 if (mask & ~allowed)
4571 return -EINVAL;
4572 if (!mask)
4573 mask = allowed;
4574 *radio_mask = mask;
4575
4576 return 1;
4577 }
4578
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4579 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4580 {
4581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4582 struct vif_params params;
4583 int err;
4584 enum nl80211_iftype otype, ntype;
4585 struct net_device *dev = info->user_ptr[1];
4586 struct wireless_dev *wdev = dev->ieee80211_ptr;
4587 u32 radio_mask = 0;
4588 bool change = false;
4589
4590 memset(¶ms, 0, sizeof(params));
4591
4592 otype = ntype = dev->ieee80211_ptr->iftype;
4593
4594 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4595 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4596 if (otype != ntype)
4597 change = true;
4598 }
4599
4600 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4601 if (ntype != NL80211_IFTYPE_MESH_POINT)
4602 return -EINVAL;
4603 if (otype != NL80211_IFTYPE_MESH_POINT)
4604 return -EINVAL;
4605 if (netif_running(dev))
4606 return -EBUSY;
4607
4608 wdev->u.mesh.id_up_len =
4609 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4610 memcpy(wdev->u.mesh.id,
4611 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4612 wdev->u.mesh.id_up_len);
4613 }
4614
4615 if (info->attrs[NL80211_ATTR_4ADDR]) {
4616 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4617 change = true;
4618 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4619 if (err)
4620 return err;
4621 } else {
4622 params.use_4addr = -1;
4623 }
4624
4625 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4626 if (err < 0)
4627 return err;
4628 if (err > 0)
4629 change = true;
4630
4631 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4632 if (err < 0)
4633 return err;
4634 if (err && netif_running(dev))
4635 return -EBUSY;
4636
4637 if (change)
4638 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4639 else
4640 err = 0;
4641
4642 if (!err && params.use_4addr != -1)
4643 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4644
4645 if (radio_mask)
4646 wdev->radio_mask = radio_mask;
4647
4648 if (change && !err)
4649 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4650
4651 return err;
4652 }
4653
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4654 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4655 {
4656 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4657 struct vif_params params;
4658 struct wireless_dev *wdev;
4659 struct sk_buff *msg;
4660 u32 radio_mask;
4661 int err;
4662 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4663
4664 memset(¶ms, 0, sizeof(params));
4665
4666 if (!info->attrs[NL80211_ATTR_IFNAME])
4667 return -EINVAL;
4668
4669 if (info->attrs[NL80211_ATTR_IFTYPE])
4670 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4671
4672 if (!rdev->ops->add_virtual_intf)
4673 return -EOPNOTSUPP;
4674
4675 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4676 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4677 info->attrs[NL80211_ATTR_MAC]) {
4678 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4679 ETH_ALEN);
4680 if (!is_valid_ether_addr(params.macaddr))
4681 return -EADDRNOTAVAIL;
4682 }
4683
4684 if (info->attrs[NL80211_ATTR_4ADDR]) {
4685 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4686 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4687 if (err)
4688 return err;
4689 }
4690
4691 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4692 return -EOPNOTSUPP;
4693
4694 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4695 if (err < 0)
4696 return err;
4697
4698 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4699 if (err < 0)
4700 return err;
4701
4702 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4703 if (!msg)
4704 return -ENOMEM;
4705
4706 wdev = rdev_add_virtual_intf(rdev,
4707 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4708 NET_NAME_USER, type, ¶ms);
4709 if (WARN_ON(!wdev)) {
4710 nlmsg_free(msg);
4711 return -EPROTO;
4712 } else if (IS_ERR(wdev)) {
4713 nlmsg_free(msg);
4714 return PTR_ERR(wdev);
4715 }
4716
4717 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4718 wdev->owner_nlportid = info->snd_portid;
4719
4720 switch (type) {
4721 case NL80211_IFTYPE_MESH_POINT:
4722 if (!info->attrs[NL80211_ATTR_MESH_ID])
4723 break;
4724 wdev->u.mesh.id_up_len =
4725 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4726 memcpy(wdev->u.mesh.id,
4727 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4728 wdev->u.mesh.id_up_len);
4729 break;
4730 case NL80211_IFTYPE_NAN:
4731 case NL80211_IFTYPE_P2P_DEVICE:
4732 /*
4733 * P2P Device and NAN do not have a netdev, so don't go
4734 * through the netdev notifier and must be added here
4735 */
4736 cfg80211_init_wdev(wdev);
4737 cfg80211_register_wdev(rdev, wdev);
4738 break;
4739 default:
4740 break;
4741 }
4742
4743 if (radio_mask)
4744 wdev->radio_mask = radio_mask;
4745
4746 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4747 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4748 nlmsg_free(msg);
4749 return -ENOBUFS;
4750 }
4751
4752 return genlmsg_reply(msg, info);
4753 }
4754
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4755 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4756 {
4757 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4758
4759 /* to avoid failing a new interface creation due to pending removal */
4760 cfg80211_destroy_ifaces(rdev);
4761
4762 guard(wiphy)(&rdev->wiphy);
4763
4764 return _nl80211_new_interface(skb, info);
4765 }
4766
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4767 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4768 {
4769 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4770 struct wireless_dev *wdev = info->user_ptr[1];
4771
4772 if (!rdev->ops->del_virtual_intf)
4773 return -EOPNOTSUPP;
4774
4775 /*
4776 * We hold RTNL, so this is safe, without RTNL opencount cannot
4777 * reach 0, and thus the rdev cannot be deleted.
4778 *
4779 * We need to do it for the dev_close(), since that will call
4780 * the netdev notifiers, and we need to acquire the mutex there
4781 * but don't know if we get there from here or from some other
4782 * place (e.g. "ip link set ... down").
4783 */
4784 mutex_unlock(&rdev->wiphy.mtx);
4785
4786 /*
4787 * If we remove a wireless device without a netdev then clear
4788 * user_ptr[1] so that nl80211_post_doit won't dereference it
4789 * to check if it needs to do dev_put(). Otherwise it crashes
4790 * since the wdev has been freed, unlike with a netdev where
4791 * we need the dev_put() for the netdev to really be freed.
4792 */
4793 if (!wdev->netdev)
4794 info->user_ptr[1] = NULL;
4795 else
4796 dev_close(wdev->netdev);
4797
4798 mutex_lock(&rdev->wiphy.mtx);
4799
4800 return cfg80211_remove_virtual_intf(rdev, wdev);
4801 }
4802
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4803 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4804 {
4805 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4806 struct net_device *dev = info->user_ptr[1];
4807 u16 noack_map;
4808
4809 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4810 return -EINVAL;
4811
4812 if (!rdev->ops->set_noack_map)
4813 return -EOPNOTSUPP;
4814
4815 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4816
4817 return rdev_set_noack_map(rdev, dev, noack_map);
4818 }
4819
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4820 static int nl80211_validate_key_link_id(struct genl_info *info,
4821 struct wireless_dev *wdev,
4822 int link_id, bool pairwise)
4823 {
4824 if (pairwise) {
4825 if (link_id != -1) {
4826 GENL_SET_ERR_MSG(info,
4827 "link ID not allowed for pairwise key");
4828 return -EINVAL;
4829 }
4830
4831 return 0;
4832 }
4833
4834 if (wdev->valid_links) {
4835 if (link_id == -1) {
4836 GENL_SET_ERR_MSG(info,
4837 "link ID must for MLO group key");
4838 return -EINVAL;
4839 }
4840 if (!(wdev->valid_links & BIT(link_id))) {
4841 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4842 return -EINVAL;
4843 }
4844 } else if (link_id != -1) {
4845 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4846 return -EINVAL;
4847 }
4848
4849 return 0;
4850 }
4851
4852 struct get_key_cookie {
4853 struct sk_buff *msg;
4854 int error;
4855 int idx;
4856 };
4857
get_key_callback(void * c,struct key_params * params)4858 static void get_key_callback(void *c, struct key_params *params)
4859 {
4860 struct nlattr *key;
4861 struct get_key_cookie *cookie = c;
4862
4863 if ((params->seq &&
4864 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4865 params->seq_len, params->seq)) ||
4866 (params->cipher &&
4867 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4868 params->cipher)))
4869 goto nla_put_failure;
4870
4871 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4872 if (!key)
4873 goto nla_put_failure;
4874
4875 if ((params->seq &&
4876 nla_put(cookie->msg, NL80211_KEY_SEQ,
4877 params->seq_len, params->seq)) ||
4878 (params->cipher &&
4879 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4880 params->cipher)))
4881 goto nla_put_failure;
4882
4883 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4884 goto nla_put_failure;
4885
4886 nla_nest_end(cookie->msg, key);
4887
4888 return;
4889 nla_put_failure:
4890 cookie->error = 1;
4891 }
4892
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4893 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4894 {
4895 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4896 int err;
4897 struct net_device *dev = info->user_ptr[1];
4898 u8 key_idx = 0;
4899 const u8 *mac_addr = NULL;
4900 bool pairwise;
4901 struct get_key_cookie cookie = {
4902 .error = 0,
4903 };
4904 void *hdr;
4905 struct sk_buff *msg;
4906 bool bigtk_support = false;
4907 int link_id = nl80211_link_id_or_invalid(info->attrs);
4908 struct wireless_dev *wdev = dev->ieee80211_ptr;
4909
4910 if (wiphy_ext_feature_isset(&rdev->wiphy,
4911 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4912 bigtk_support = true;
4913
4914 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4915 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4916 wiphy_ext_feature_isset(&rdev->wiphy,
4917 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4918 bigtk_support = true;
4919
4920 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4921 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4922
4923 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4924 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4925 return -EINVAL;
4926 }
4927 }
4928
4929 if (info->attrs[NL80211_ATTR_MAC])
4930 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4931
4932 pairwise = !!mac_addr;
4933 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4934 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4935
4936 if (kt != NL80211_KEYTYPE_GROUP &&
4937 kt != NL80211_KEYTYPE_PAIRWISE)
4938 return -EINVAL;
4939 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4940 }
4941
4942 if (!rdev->ops->get_key)
4943 return -EOPNOTSUPP;
4944
4945 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4946 return -ENOENT;
4947
4948 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4949 if (!msg)
4950 return -ENOMEM;
4951
4952 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4953 NL80211_CMD_NEW_KEY);
4954 if (!hdr)
4955 goto nla_put_failure;
4956
4957 cookie.msg = msg;
4958 cookie.idx = key_idx;
4959
4960 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4961 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4962 goto nla_put_failure;
4963 if (mac_addr &&
4964 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4965 goto nla_put_failure;
4966
4967 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4968 if (err)
4969 goto free_msg;
4970
4971 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4972 &cookie, get_key_callback);
4973
4974 if (err)
4975 goto free_msg;
4976
4977 if (cookie.error)
4978 goto nla_put_failure;
4979
4980 genlmsg_end(msg, hdr);
4981 return genlmsg_reply(msg, info);
4982
4983 nla_put_failure:
4984 err = -ENOBUFS;
4985 free_msg:
4986 nlmsg_free(msg);
4987 return err;
4988 }
4989
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4990 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4991 {
4992 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4993 struct key_parse key;
4994 int err;
4995 struct net_device *dev = info->user_ptr[1];
4996 int link_id = nl80211_link_id_or_invalid(info->attrs);
4997 struct wireless_dev *wdev = dev->ieee80211_ptr;
4998
4999 err = nl80211_parse_key(info, &key);
5000 if (err)
5001 return err;
5002
5003 if (key.idx < 0)
5004 return -EINVAL;
5005
5006 /* Only support setting default key and
5007 * Extended Key ID action NL80211_KEY_SET_TX.
5008 */
5009 if (!key.def && !key.defmgmt && !key.defbeacon &&
5010 !(key.p.mode == NL80211_KEY_SET_TX))
5011 return -EINVAL;
5012
5013 if (key.def) {
5014 if (!rdev->ops->set_default_key)
5015 return -EOPNOTSUPP;
5016
5017 err = nl80211_key_allowed(wdev);
5018 if (err)
5019 return err;
5020
5021 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5022 if (err)
5023 return err;
5024
5025 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
5026 key.def_uni, key.def_multi);
5027
5028 if (err)
5029 return err;
5030
5031 #ifdef CONFIG_CFG80211_WEXT
5032 wdev->wext.default_key = key.idx;
5033 #endif
5034 return 0;
5035 } else if (key.defmgmt) {
5036 if (key.def_uni || !key.def_multi)
5037 return -EINVAL;
5038
5039 if (!rdev->ops->set_default_mgmt_key)
5040 return -EOPNOTSUPP;
5041
5042 err = nl80211_key_allowed(wdev);
5043 if (err)
5044 return err;
5045
5046 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5047 if (err)
5048 return err;
5049
5050 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
5051 if (err)
5052 return err;
5053
5054 #ifdef CONFIG_CFG80211_WEXT
5055 wdev->wext.default_mgmt_key = key.idx;
5056 #endif
5057 return 0;
5058 } else if (key.defbeacon) {
5059 if (key.def_uni || !key.def_multi)
5060 return -EINVAL;
5061
5062 if (!rdev->ops->set_default_beacon_key)
5063 return -EOPNOTSUPP;
5064
5065 err = nl80211_key_allowed(wdev);
5066 if (err)
5067 return err;
5068
5069 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5070 if (err)
5071 return err;
5072
5073 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
5074 } else if (key.p.mode == NL80211_KEY_SET_TX &&
5075 wiphy_ext_feature_isset(&rdev->wiphy,
5076 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
5077 u8 *mac_addr = NULL;
5078
5079 if (info->attrs[NL80211_ATTR_MAC])
5080 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5081
5082 if (!mac_addr || key.idx < 0 || key.idx > 1)
5083 return -EINVAL;
5084
5085 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
5086 if (err)
5087 return err;
5088
5089 return rdev_add_key(rdev, dev, link_id, key.idx,
5090 NL80211_KEYTYPE_PAIRWISE,
5091 mac_addr, &key.p);
5092 }
5093
5094 return -EINVAL;
5095 }
5096
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)5097 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
5098 {
5099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5100 int err;
5101 struct net_device *dev = info->user_ptr[1];
5102 struct key_parse key;
5103 const u8 *mac_addr = NULL;
5104 int link_id = nl80211_link_id_or_invalid(info->attrs);
5105 struct wireless_dev *wdev = dev->ieee80211_ptr;
5106
5107 err = nl80211_parse_key(info, &key);
5108 if (err)
5109 return err;
5110
5111 if (!key.p.key) {
5112 GENL_SET_ERR_MSG(info, "no key");
5113 return -EINVAL;
5114 }
5115
5116 if (info->attrs[NL80211_ATTR_MAC])
5117 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5118
5119 if (key.type == -1) {
5120 if (mac_addr)
5121 key.type = NL80211_KEYTYPE_PAIRWISE;
5122 else
5123 key.type = NL80211_KEYTYPE_GROUP;
5124 }
5125
5126 /* for now */
5127 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5128 key.type != NL80211_KEYTYPE_GROUP) {
5129 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
5130 return -EINVAL;
5131 }
5132
5133 if (key.type == NL80211_KEYTYPE_GROUP &&
5134 info->attrs[NL80211_ATTR_VLAN_ID])
5135 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5136
5137 if (!rdev->ops->add_key)
5138 return -EOPNOTSUPP;
5139
5140 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
5141 key.type == NL80211_KEYTYPE_PAIRWISE,
5142 mac_addr)) {
5143 GENL_SET_ERR_MSG(info, "key setting validation failed");
5144 return -EINVAL;
5145 }
5146
5147 err = nl80211_key_allowed(wdev);
5148 if (err)
5149 GENL_SET_ERR_MSG(info, "key not allowed");
5150
5151 if (!err)
5152 err = nl80211_validate_key_link_id(info, wdev, link_id,
5153 key.type == NL80211_KEYTYPE_PAIRWISE);
5154
5155 if (!err) {
5156 err = rdev_add_key(rdev, dev, link_id, key.idx,
5157 key.type == NL80211_KEYTYPE_PAIRWISE,
5158 mac_addr, &key.p);
5159 if (err)
5160 GENL_SET_ERR_MSG(info, "key addition failed");
5161 }
5162
5163 return err;
5164 }
5165
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)5166 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
5167 {
5168 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5169 int err;
5170 struct net_device *dev = info->user_ptr[1];
5171 u8 *mac_addr = NULL;
5172 struct key_parse key;
5173 int link_id = nl80211_link_id_or_invalid(info->attrs);
5174 struct wireless_dev *wdev = dev->ieee80211_ptr;
5175
5176 err = nl80211_parse_key(info, &key);
5177 if (err)
5178 return err;
5179
5180 if (info->attrs[NL80211_ATTR_MAC])
5181 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5182
5183 if (key.type == -1) {
5184 if (mac_addr)
5185 key.type = NL80211_KEYTYPE_PAIRWISE;
5186 else
5187 key.type = NL80211_KEYTYPE_GROUP;
5188 }
5189
5190 /* for now */
5191 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5192 key.type != NL80211_KEYTYPE_GROUP)
5193 return -EINVAL;
5194
5195 if (!cfg80211_valid_key_idx(rdev, key.idx,
5196 key.type == NL80211_KEYTYPE_PAIRWISE))
5197 return -EINVAL;
5198
5199 if (!rdev->ops->del_key)
5200 return -EOPNOTSUPP;
5201
5202 err = nl80211_key_allowed(wdev);
5203
5204 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
5205 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
5206 err = -ENOENT;
5207
5208 if (!err)
5209 err = nl80211_validate_key_link_id(info, wdev, link_id,
5210 key.type == NL80211_KEYTYPE_PAIRWISE);
5211
5212 if (!err)
5213 err = rdev_del_key(rdev, dev, link_id, key.idx,
5214 key.type == NL80211_KEYTYPE_PAIRWISE,
5215 mac_addr);
5216
5217 #ifdef CONFIG_CFG80211_WEXT
5218 if (!err) {
5219 if (key.idx == wdev->wext.default_key)
5220 wdev->wext.default_key = -1;
5221 else if (key.idx == wdev->wext.default_mgmt_key)
5222 wdev->wext.default_mgmt_key = -1;
5223 }
5224 #endif
5225
5226 return err;
5227 }
5228
5229 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)5230 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5231 {
5232 struct nlattr *attr;
5233 int n_entries = 0, tmp;
5234
5235 nla_for_each_nested(attr, nl_attr, tmp) {
5236 if (nla_len(attr) != ETH_ALEN)
5237 return -EINVAL;
5238
5239 n_entries++;
5240 }
5241
5242 return n_entries;
5243 }
5244
5245 /*
5246 * This function parses ACL information and allocates memory for ACL data.
5247 * On successful return, the calling function is responsible to free the
5248 * ACL buffer returned by this function.
5249 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)5250 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5251 struct genl_info *info)
5252 {
5253 enum nl80211_acl_policy acl_policy;
5254 struct nlattr *attr;
5255 struct cfg80211_acl_data *acl;
5256 int i = 0, n_entries, tmp;
5257
5258 if (!wiphy->max_acl_mac_addrs)
5259 return ERR_PTR(-EOPNOTSUPP);
5260
5261 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5262 return ERR_PTR(-EINVAL);
5263
5264 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5265 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5266 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5267 return ERR_PTR(-EINVAL);
5268
5269 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5270 return ERR_PTR(-EINVAL);
5271
5272 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5273 if (n_entries < 0)
5274 return ERR_PTR(n_entries);
5275
5276 if (n_entries > wiphy->max_acl_mac_addrs)
5277 return ERR_PTR(-EOPNOTSUPP);
5278
5279 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5280 if (!acl)
5281 return ERR_PTR(-ENOMEM);
5282 acl->n_acl_entries = n_entries;
5283
5284 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5285 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5286 i++;
5287 }
5288 acl->acl_policy = acl_policy;
5289
5290 return acl;
5291 }
5292
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)5293 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5294 {
5295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5296 struct net_device *dev = info->user_ptr[1];
5297 struct cfg80211_acl_data *acl;
5298 int err;
5299
5300 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5301 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5302 return -EOPNOTSUPP;
5303
5304 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5305 return -EINVAL;
5306
5307 acl = parse_acl_data(&rdev->wiphy, info);
5308 if (IS_ERR(acl))
5309 return PTR_ERR(acl);
5310
5311 err = rdev_set_mac_acl(rdev, dev, acl);
5312
5313 kfree(acl);
5314
5315 return err;
5316 }
5317
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)5318 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5319 u8 *rates, u8 rates_len)
5320 {
5321 u8 i;
5322 u32 mask = 0;
5323
5324 for (i = 0; i < rates_len; i++) {
5325 int rate = (rates[i] & 0x7f) * 5;
5326 int ridx;
5327
5328 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5329 struct ieee80211_rate *srate =
5330 &sband->bitrates[ridx];
5331 if (rate == srate->bitrate) {
5332 mask |= 1 << ridx;
5333 break;
5334 }
5335 }
5336 if (ridx == sband->n_bitrates)
5337 return 0; /* rate not found */
5338 }
5339
5340 return mask;
5341 }
5342
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])5343 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5344 u8 *rates, u8 rates_len,
5345 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5346 {
5347 u8 i;
5348
5349 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5350
5351 for (i = 0; i < rates_len; i++) {
5352 int ridx, rbit;
5353
5354 ridx = rates[i] / 8;
5355 rbit = BIT(rates[i] % 8);
5356
5357 /* check validity */
5358 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5359 return false;
5360
5361 /* check availability */
5362 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5363 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5364 mcs[ridx] |= rbit;
5365 else
5366 return false;
5367 }
5368
5369 return true;
5370 }
5371
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)5372 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5373 {
5374 u16 mcs_mask = 0;
5375
5376 switch (vht_mcs_map) {
5377 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5378 break;
5379 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5380 mcs_mask = 0x00FF;
5381 break;
5382 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5383 mcs_mask = 0x01FF;
5384 break;
5385 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5386 mcs_mask = 0x03FF;
5387 break;
5388 default:
5389 break;
5390 }
5391
5392 return mcs_mask;
5393 }
5394
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5395 static void vht_build_mcs_mask(u16 vht_mcs_map,
5396 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5397 {
5398 u8 nss;
5399
5400 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5401 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5402 vht_mcs_map >>= 2;
5403 }
5404 }
5405
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5406 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5407 struct nl80211_txrate_vht *txrate,
5408 u16 mcs[NL80211_VHT_NSS_MAX])
5409 {
5410 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5411 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5412 u8 i;
5413
5414 if (!sband->vht_cap.vht_supported)
5415 return false;
5416
5417 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5418
5419 /* Build vht_mcs_mask from VHT capabilities */
5420 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5421
5422 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5423 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5424 mcs[i] = txrate->mcs[i];
5425 else
5426 return false;
5427 }
5428
5429 return true;
5430 }
5431
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5432 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5433 {
5434 switch (he_mcs_map) {
5435 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5436 return 0;
5437 case IEEE80211_HE_MCS_SUPPORT_0_7:
5438 return 0x00FF;
5439 case IEEE80211_HE_MCS_SUPPORT_0_9:
5440 return 0x03FF;
5441 case IEEE80211_HE_MCS_SUPPORT_0_11:
5442 return 0xFFF;
5443 default:
5444 break;
5445 }
5446 return 0;
5447 }
5448
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5449 static void he_build_mcs_mask(u16 he_mcs_map,
5450 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5451 {
5452 u8 nss;
5453
5454 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5455 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5456 he_mcs_map >>= 2;
5457 }
5458 }
5459
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5460 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5461 const struct ieee80211_sta_he_cap *he_cap)
5462 {
5463 struct net_device *dev = info->user_ptr[1];
5464 struct wireless_dev *wdev = dev->ieee80211_ptr;
5465 struct cfg80211_chan_def *chandef;
5466 __le16 tx_mcs;
5467
5468 chandef = wdev_chandef(wdev, link_id);
5469 if (!chandef) {
5470 /*
5471 * This is probably broken, but we never maintained
5472 * a chandef in these cases, so it always was.
5473 */
5474 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5475 }
5476
5477 switch (chandef->width) {
5478 case NL80211_CHAN_WIDTH_80P80:
5479 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5480 break;
5481 case NL80211_CHAN_WIDTH_160:
5482 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5483 break;
5484 default:
5485 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5486 break;
5487 }
5488
5489 return le16_to_cpu(tx_mcs);
5490 }
5491
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5492 static bool he_set_mcs_mask(struct genl_info *info,
5493 struct wireless_dev *wdev,
5494 struct ieee80211_supported_band *sband,
5495 struct nl80211_txrate_he *txrate,
5496 u16 mcs[NL80211_HE_NSS_MAX],
5497 unsigned int link_id)
5498 {
5499 const struct ieee80211_sta_he_cap *he_cap;
5500 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5501 u16 tx_mcs_map = 0;
5502 u8 i;
5503
5504 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5505 if (!he_cap)
5506 return false;
5507
5508 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5509
5510 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5511
5512 /* Build he_mcs_mask from HE capabilities */
5513 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5514
5515 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5516 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5517 mcs[i] = txrate->mcs[i];
5518 else
5519 return false;
5520 }
5521
5522 return true;
5523 }
5524
eht_build_mcs_mask(struct genl_info * info,const struct ieee80211_sta_eht_cap * eht_cap,u8 mcs_nss_len,u16 * mcs_mask)5525 static void eht_build_mcs_mask(struct genl_info *info,
5526 const struct ieee80211_sta_eht_cap *eht_cap,
5527 u8 mcs_nss_len, u16 *mcs_mask)
5528 {
5529 struct net_device *dev = info->user_ptr[1];
5530 struct wireless_dev *wdev = dev->ieee80211_ptr;
5531 u8 nss, mcs_7 = 0, mcs_9 = 0, mcs_11 = 0, mcs_13 = 0;
5532 unsigned int link_id = nl80211_link_id(info->attrs);
5533
5534 if (mcs_nss_len == 4) {
5535 const struct ieee80211_eht_mcs_nss_supp_20mhz_only *mcs =
5536 &eht_cap->eht_mcs_nss_supp.only_20mhz;
5537
5538 mcs_7 = u8_get_bits(mcs->rx_tx_mcs7_max_nss,
5539 IEEE80211_EHT_MCS_NSS_TX);
5540 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5541 IEEE80211_EHT_MCS_NSS_TX);
5542 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5543 IEEE80211_EHT_MCS_NSS_TX);
5544 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5545 IEEE80211_EHT_MCS_NSS_TX);
5546
5547 } else {
5548 const struct ieee80211_eht_mcs_nss_supp_bw *mcs;
5549 enum nl80211_chan_width width;
5550
5551 switch (wdev->iftype) {
5552 case NL80211_IFTYPE_ADHOC:
5553 width = wdev->u.ibss.chandef.width;
5554 break;
5555 case NL80211_IFTYPE_MESH_POINT:
5556 width = wdev->u.mesh.chandef.width;
5557 break;
5558 case NL80211_IFTYPE_OCB:
5559 width = wdev->u.ocb.chandef.width;
5560 break;
5561 default:
5562 if (wdev->valid_links)
5563 width = wdev->links[link_id].ap.chandef.width;
5564 else
5565 width = wdev->u.ap.preset_chandef.width;
5566 break;
5567 }
5568
5569 switch (width) {
5570 case NL80211_CHAN_WIDTH_320:
5571 mcs = &eht_cap->eht_mcs_nss_supp.bw._320;
5572 break;
5573 case NL80211_CHAN_WIDTH_160:
5574 mcs = &eht_cap->eht_mcs_nss_supp.bw._160;
5575 break;
5576 default:
5577 mcs = &eht_cap->eht_mcs_nss_supp.bw._80;
5578 break;
5579 }
5580
5581 mcs_7 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5582 IEEE80211_EHT_MCS_NSS_TX);
5583 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5584 IEEE80211_EHT_MCS_NSS_TX);
5585 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5586 IEEE80211_EHT_MCS_NSS_TX);
5587 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5588 IEEE80211_EHT_MCS_NSS_TX);
5589 }
5590
5591 /* Enable MCS 14 for NSS 0 */
5592 if (eht_cap->eht_cap_elem.phy_cap_info[6] &
5593 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP)
5594 mcs_mask[0] |= 0x4000;
5595
5596 /* Enable MCS 15 for NSS 0 */
5597 mcs_mask[0] |= 0x8000;
5598
5599 for (nss = 0; nss < NL80211_EHT_NSS_MAX; nss++) {
5600 if (!mcs_7)
5601 continue;
5602 mcs_mask[nss] |= 0x00FF;
5603 mcs_7--;
5604
5605 if (!mcs_9)
5606 continue;
5607 mcs_mask[nss] |= 0x0300;
5608 mcs_9--;
5609
5610 if (!mcs_11)
5611 continue;
5612 mcs_mask[nss] |= 0x0C00;
5613 mcs_11--;
5614
5615 if (!mcs_13)
5616 continue;
5617 mcs_mask[nss] |= 0x3000;
5618 mcs_13--;
5619 }
5620 }
5621
eht_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_eht * txrate,u16 mcs[NL80211_EHT_NSS_MAX])5622 static bool eht_set_mcs_mask(struct genl_info *info, struct wireless_dev *wdev,
5623 struct ieee80211_supported_band *sband,
5624 struct nl80211_txrate_eht *txrate,
5625 u16 mcs[NL80211_EHT_NSS_MAX])
5626 {
5627 const struct ieee80211_sta_he_cap *he_cap;
5628 const struct ieee80211_sta_eht_cap *eht_cap;
5629 u16 tx_mcs_mask[NL80211_EHT_NSS_MAX] = { 0 };
5630 u8 i, mcs_nss_len;
5631
5632 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5633 if (!he_cap)
5634 return false;
5635
5636 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5637 if (!eht_cap)
5638 return false;
5639
5640 /* Checks for MCS 14 */
5641 if (txrate->mcs[0] & 0x4000) {
5642 if (sband->band != NL80211_BAND_6GHZ)
5643 return false;
5644
5645 if (!(eht_cap->eht_cap_elem.phy_cap_info[6] &
5646 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP))
5647 return false;
5648 }
5649
5650 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5651 &eht_cap->eht_cap_elem,
5652 wdev->iftype ==
5653 NL80211_IFTYPE_STATION);
5654
5655 if (mcs_nss_len == 3) {
5656 /* Supported iftypes for setting non-20 MHZ only EHT MCS */
5657 switch (wdev->iftype) {
5658 case NL80211_IFTYPE_ADHOC:
5659 case NL80211_IFTYPE_AP:
5660 case NL80211_IFTYPE_P2P_GO:
5661 case NL80211_IFTYPE_MESH_POINT:
5662 case NL80211_IFTYPE_OCB:
5663 break;
5664 default:
5665 return false;
5666 }
5667 }
5668
5669 /* Build eht_mcs_mask from EHT and HE capabilities */
5670 eht_build_mcs_mask(info, eht_cap, mcs_nss_len, tx_mcs_mask);
5671
5672 memset(mcs, 0, sizeof(u16) * NL80211_EHT_NSS_MAX);
5673 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5674 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5675 mcs[i] = txrate->mcs[i];
5676 else
5677 return false;
5678 }
5679
5680 return true;
5681 }
5682
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5683 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5684 struct nlattr *attrs[],
5685 enum nl80211_attrs attr,
5686 struct cfg80211_bitrate_mask *mask,
5687 struct net_device *dev,
5688 bool default_all_enabled,
5689 unsigned int link_id)
5690 {
5691 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5693 struct wireless_dev *wdev = dev->ieee80211_ptr;
5694 int rem, i;
5695 struct nlattr *tx_rates;
5696 struct ieee80211_supported_band *sband;
5697 u16 vht_tx_mcs_map, he_tx_mcs_map;
5698
5699 memset(mask, 0, sizeof(*mask));
5700 /* Default to all rates enabled */
5701 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5702 const struct ieee80211_sta_he_cap *he_cap;
5703 const struct ieee80211_sta_eht_cap *eht_cap;
5704 u8 mcs_nss_len;
5705
5706 if (!default_all_enabled)
5707 break;
5708
5709 sband = rdev->wiphy.bands[i];
5710
5711 if (!sband)
5712 continue;
5713
5714 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5715 memcpy(mask->control[i].ht_mcs,
5716 sband->ht_cap.mcs.rx_mask,
5717 sizeof(mask->control[i].ht_mcs));
5718
5719 if (sband->vht_cap.vht_supported) {
5720 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5721 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5722 }
5723
5724 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5725 if (!he_cap)
5726 continue;
5727
5728 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5729 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5730
5731 mask->control[i].he_gi = 0xFF;
5732 mask->control[i].he_ltf = 0xFF;
5733
5734 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5735 if (!eht_cap)
5736 continue;
5737
5738 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5739 &eht_cap->eht_cap_elem,
5740 wdev->iftype ==
5741 NL80211_IFTYPE_STATION);
5742
5743 eht_build_mcs_mask(info, eht_cap, mcs_nss_len,
5744 mask->control[i].eht_mcs);
5745
5746 mask->control[i].eht_gi = 0xFF;
5747 mask->control[i].eht_ltf = 0xFF;
5748 }
5749
5750 /* if no rates are given set it back to the defaults */
5751 if (!attrs[attr])
5752 goto out;
5753
5754 /* The nested attribute uses enum nl80211_band as the index. This maps
5755 * directly to the enum nl80211_band values used in cfg80211.
5756 */
5757 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5758 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5759 enum nl80211_band band = nla_type(tx_rates);
5760 int err;
5761
5762 if (band < 0 || band >= NUM_NL80211_BANDS)
5763 return -EINVAL;
5764 sband = rdev->wiphy.bands[band];
5765 if (sband == NULL)
5766 return -EINVAL;
5767 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5768 tx_rates,
5769 nl80211_txattr_policy,
5770 info->extack);
5771 if (err)
5772 return err;
5773 if (tb[NL80211_TXRATE_LEGACY]) {
5774 mask->control[band].legacy = rateset_to_mask(
5775 sband,
5776 nla_data(tb[NL80211_TXRATE_LEGACY]),
5777 nla_len(tb[NL80211_TXRATE_LEGACY]));
5778 if ((mask->control[band].legacy == 0) &&
5779 nla_len(tb[NL80211_TXRATE_LEGACY]))
5780 return -EINVAL;
5781 }
5782 if (tb[NL80211_TXRATE_HT]) {
5783 if (!ht_rateset_to_mask(
5784 sband,
5785 nla_data(tb[NL80211_TXRATE_HT]),
5786 nla_len(tb[NL80211_TXRATE_HT]),
5787 mask->control[band].ht_mcs))
5788 return -EINVAL;
5789 }
5790
5791 if (tb[NL80211_TXRATE_VHT]) {
5792 if (!vht_set_mcs_mask(
5793 sband,
5794 nla_data(tb[NL80211_TXRATE_VHT]),
5795 mask->control[band].vht_mcs))
5796 return -EINVAL;
5797 }
5798
5799 if (tb[NL80211_TXRATE_GI]) {
5800 mask->control[band].gi =
5801 nla_get_u8(tb[NL80211_TXRATE_GI]);
5802 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5803 return -EINVAL;
5804 }
5805 if (tb[NL80211_TXRATE_HE] &&
5806 !he_set_mcs_mask(info, wdev, sband,
5807 nla_data(tb[NL80211_TXRATE_HE]),
5808 mask->control[band].he_mcs,
5809 link_id))
5810 return -EINVAL;
5811
5812 if (tb[NL80211_TXRATE_HE_GI])
5813 mask->control[band].he_gi =
5814 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5815 if (tb[NL80211_TXRATE_HE_LTF])
5816 mask->control[band].he_ltf =
5817 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5818
5819 if (tb[NL80211_TXRATE_EHT] &&
5820 !eht_set_mcs_mask(info, wdev, sband,
5821 nla_data(tb[NL80211_TXRATE_EHT]),
5822 mask->control[band].eht_mcs))
5823 return -EINVAL;
5824
5825 if (tb[NL80211_TXRATE_EHT_GI])
5826 mask->control[band].eht_gi =
5827 nla_get_u8(tb[NL80211_TXRATE_EHT_GI]);
5828 if (tb[NL80211_TXRATE_EHT_LTF])
5829 mask->control[band].eht_ltf =
5830 nla_get_u8(tb[NL80211_TXRATE_EHT_LTF]);
5831
5832 if (mask->control[band].legacy == 0) {
5833 /* don't allow empty legacy rates if HT, VHT, HE or EHT
5834 * are not even supported.
5835 */
5836 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5837 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5838 ieee80211_get_he_iftype_cap(sband, wdev->iftype) ||
5839 ieee80211_get_eht_iftype_cap(sband, wdev->iftype)))
5840 return -EINVAL;
5841
5842 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5843 if (mask->control[band].ht_mcs[i])
5844 goto out;
5845
5846 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5847 if (mask->control[band].vht_mcs[i])
5848 goto out;
5849
5850 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5851 if (mask->control[band].he_mcs[i])
5852 goto out;
5853
5854 for (i = 0; i < NL80211_EHT_NSS_MAX; i++)
5855 if (mask->control[band].eht_mcs[i])
5856 goto out;
5857
5858 /* legacy and mcs rates may not be both empty */
5859 return -EINVAL;
5860 }
5861 }
5862
5863 out:
5864 return 0;
5865 }
5866
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5867 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5868 enum nl80211_band band,
5869 struct cfg80211_bitrate_mask *beacon_rate)
5870 {
5871 u32 count_ht, count_vht, count_he, count_eht, i;
5872 u32 rate = beacon_rate->control[band].legacy;
5873
5874 /* Allow only one rate */
5875 if (hweight32(rate) > 1)
5876 return -EINVAL;
5877
5878 count_ht = 0;
5879 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5880 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5881 return -EINVAL;
5882 } else if (beacon_rate->control[band].ht_mcs[i]) {
5883 count_ht++;
5884 if (count_ht > 1)
5885 return -EINVAL;
5886 }
5887 if (count_ht && rate)
5888 return -EINVAL;
5889 }
5890
5891 count_vht = 0;
5892 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5893 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5894 return -EINVAL;
5895 } else if (beacon_rate->control[band].vht_mcs[i]) {
5896 count_vht++;
5897 if (count_vht > 1)
5898 return -EINVAL;
5899 }
5900 if (count_vht && rate)
5901 return -EINVAL;
5902 }
5903
5904 count_he = 0;
5905 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5906 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5907 return -EINVAL;
5908 } else if (beacon_rate->control[band].he_mcs[i]) {
5909 count_he++;
5910 if (count_he > 1)
5911 return -EINVAL;
5912 }
5913 if (count_he && rate)
5914 return -EINVAL;
5915 }
5916
5917 count_eht = 0;
5918 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5919 if (hweight16(beacon_rate->control[band].eht_mcs[i]) > 1) {
5920 return -EINVAL;
5921 } else if (beacon_rate->control[band].eht_mcs[i]) {
5922 count_eht++;
5923 if (count_eht > 1)
5924 return -EINVAL;
5925 }
5926 if (count_eht && rate)
5927 return -EINVAL;
5928 }
5929
5930 if ((count_ht && count_vht && count_he && count_eht) ||
5931 (!rate && !count_ht && !count_vht && !count_he && !count_eht))
5932 return -EINVAL;
5933
5934 if (rate &&
5935 !wiphy_ext_feature_isset(&rdev->wiphy,
5936 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5937 return -EINVAL;
5938 if (count_ht &&
5939 !wiphy_ext_feature_isset(&rdev->wiphy,
5940 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5941 return -EINVAL;
5942 if (count_vht &&
5943 !wiphy_ext_feature_isset(&rdev->wiphy,
5944 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5945 return -EINVAL;
5946 if (count_he &&
5947 !wiphy_ext_feature_isset(&rdev->wiphy,
5948 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5949 return -EINVAL;
5950
5951 if (count_eht &&
5952 !wiphy_ext_feature_isset(&rdev->wiphy,
5953 NL80211_EXT_FEATURE_BEACON_RATE_EHT))
5954 return -EINVAL;
5955
5956 return 0;
5957 }
5958
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,unsigned int link_id,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5959 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5960 struct net_device *dev,
5961 unsigned int link_id,
5962 struct nlattr *attrs,
5963 struct cfg80211_mbssid_config *config,
5964 u8 num_elems)
5965 {
5966 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5967 int tx_link_id = -1;
5968
5969 if (!wiphy->mbssid_max_interfaces)
5970 return -EOPNOTSUPP;
5971
5972 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5973 NULL) ||
5974 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5975 return -EINVAL;
5976
5977 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5978 if (config->ema) {
5979 if (!wiphy->ema_max_profile_periodicity)
5980 return -EOPNOTSUPP;
5981
5982 if (num_elems > wiphy->ema_max_profile_periodicity)
5983 return -EINVAL;
5984 }
5985
5986 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5987 if (config->index >= wiphy->mbssid_max_interfaces ||
5988 (!config->index && !num_elems))
5989 return -EINVAL;
5990
5991 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
5992 tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
5993
5994 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5995 u32 tx_ifindex =
5996 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5997
5998 if ((!config->index && tx_ifindex != dev->ifindex) ||
5999 (config->index && tx_ifindex == dev->ifindex))
6000 return -EINVAL;
6001
6002 if (tx_ifindex != dev->ifindex) {
6003 struct net_device *tx_netdev =
6004 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
6005
6006 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
6007 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
6008 tx_netdev->ieee80211_ptr->iftype !=
6009 NL80211_IFTYPE_AP) {
6010 dev_put(tx_netdev);
6011 return -EINVAL;
6012 }
6013
6014 config->tx_wdev = tx_netdev->ieee80211_ptr;
6015 /* Caller should call dev_put(config->tx_wdev) from this point */
6016
6017 if (config->tx_wdev->valid_links) {
6018 if (tx_link_id == -1 ||
6019 !(config->tx_wdev->valid_links & BIT(tx_link_id)))
6020 return -ENOLINK;
6021
6022 config->tx_link_id = tx_link_id;
6023 }
6024 } else {
6025 if (tx_link_id >= 0 && tx_link_id != link_id)
6026 return -EINVAL;
6027
6028 config->tx_wdev = dev->ieee80211_ptr;
6029 }
6030 } else if (!config->index) {
6031 if (tx_link_id >= 0 && tx_link_id != link_id)
6032 return -EINVAL;
6033
6034 config->tx_wdev = dev->ieee80211_ptr;
6035 } else {
6036 return -EINVAL;
6037 }
6038
6039 return 0;
6040 }
6041
6042 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)6043 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
6044 {
6045 struct nlattr *nl_elems;
6046 struct cfg80211_mbssid_elems *elems;
6047 int rem_elems;
6048 u8 i = 0, num_elems = 0;
6049
6050 if (!wiphy->mbssid_max_interfaces)
6051 return ERR_PTR(-EINVAL);
6052
6053 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6054 if (num_elems >= 255)
6055 return ERR_PTR(-EINVAL);
6056 num_elems++;
6057 }
6058
6059 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6060 if (!elems)
6061 return ERR_PTR(-ENOMEM);
6062 elems->cnt = num_elems;
6063
6064 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6065 elems->elem[i].data = nla_data(nl_elems);
6066 elems->elem[i].len = nla_len(nl_elems);
6067 i++;
6068 }
6069 return elems;
6070 }
6071
6072 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)6073 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
6074 struct netlink_ext_ack *extack)
6075 {
6076 struct nlattr *nl_elems;
6077 struct cfg80211_rnr_elems *elems;
6078 int rem_elems;
6079 u8 i = 0, num_elems = 0;
6080
6081 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6082 int ret;
6083
6084 ret = validate_ie_attr(nl_elems, extack);
6085 if (ret)
6086 return ERR_PTR(ret);
6087
6088 num_elems++;
6089 }
6090
6091 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6092 if (!elems)
6093 return ERR_PTR(-ENOMEM);
6094 elems->cnt = num_elems;
6095
6096 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6097 elems->elem[i].data = nla_data(nl_elems);
6098 elems->elem[i].len = nla_len(nl_elems);
6099 i++;
6100 }
6101 return elems;
6102 }
6103
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)6104 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
6105 struct cfg80211_he_bss_color *he_bss_color)
6106 {
6107 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
6108 int err;
6109
6110 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
6111 he_bss_color_policy, NULL);
6112 if (err)
6113 return err;
6114
6115 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
6116 return -EINVAL;
6117
6118 he_bss_color->color =
6119 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
6120 he_bss_color->enabled =
6121 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
6122 he_bss_color->partial =
6123 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
6124
6125 return 0;
6126 }
6127
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)6128 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
6129 struct nlattr *attrs[],
6130 struct cfg80211_beacon_data *bcn,
6131 struct netlink_ext_ack *extack)
6132 {
6133 bool haveinfo = false;
6134 int err;
6135
6136 memset(bcn, 0, sizeof(*bcn));
6137
6138 bcn->link_id = nl80211_link_id(attrs);
6139
6140 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
6141 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
6142 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
6143 if (!bcn->head_len)
6144 return -EINVAL;
6145 haveinfo = true;
6146 }
6147
6148 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
6149 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
6150 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
6151 haveinfo = true;
6152 }
6153
6154 if (!haveinfo)
6155 return -EINVAL;
6156
6157 if (attrs[NL80211_ATTR_IE]) {
6158 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
6159 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
6160 }
6161
6162 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
6163 bcn->proberesp_ies =
6164 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6165 bcn->proberesp_ies_len =
6166 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6167 }
6168
6169 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
6170 bcn->assocresp_ies =
6171 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6172 bcn->assocresp_ies_len =
6173 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6174 }
6175
6176 if (attrs[NL80211_ATTR_PROBE_RESP]) {
6177 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
6178 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
6179 }
6180
6181 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
6182 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
6183
6184 err = nla_parse_nested_deprecated(tb,
6185 NL80211_FTM_RESP_ATTR_MAX,
6186 attrs[NL80211_ATTR_FTM_RESPONDER],
6187 NULL, NULL);
6188 if (err)
6189 return err;
6190
6191 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
6192 wiphy_ext_feature_isset(&rdev->wiphy,
6193 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
6194 bcn->ftm_responder = 1;
6195 else
6196 return -EOPNOTSUPP;
6197
6198 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
6199 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
6200 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
6201 }
6202
6203 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
6204 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6205 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6206 }
6207 } else {
6208 bcn->ftm_responder = -1;
6209 }
6210
6211 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
6212 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
6213 &bcn->he_bss_color);
6214 if (err)
6215 return err;
6216 bcn->he_bss_color_valid = true;
6217 }
6218
6219 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
6220 struct cfg80211_mbssid_elems *mbssid =
6221 nl80211_parse_mbssid_elems(&rdev->wiphy,
6222 attrs[NL80211_ATTR_MBSSID_ELEMS]);
6223
6224 if (IS_ERR(mbssid))
6225 return PTR_ERR(mbssid);
6226
6227 bcn->mbssid_ies = mbssid;
6228
6229 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
6230 struct cfg80211_rnr_elems *rnr =
6231 nl80211_parse_rnr_elems(&rdev->wiphy,
6232 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
6233 extack);
6234
6235 if (IS_ERR(rnr))
6236 return PTR_ERR(rnr);
6237
6238 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
6239 return -EINVAL;
6240
6241 bcn->rnr_ies = rnr;
6242 }
6243 }
6244
6245 return 0;
6246 }
6247
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)6248 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
6249 struct ieee80211_he_obss_pd *he_obss_pd)
6250 {
6251 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
6252 int err;
6253
6254 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
6255 he_obss_pd_policy, NULL);
6256 if (err)
6257 return err;
6258
6259 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
6260 return -EINVAL;
6261
6262 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
6263
6264 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
6265 he_obss_pd->min_offset =
6266 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
6267 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
6268 he_obss_pd->max_offset =
6269 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
6270 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
6271 he_obss_pd->non_srg_max_offset =
6272 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
6273
6274 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
6275 return -EINVAL;
6276
6277 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
6278 memcpy(he_obss_pd->bss_color_bitmap,
6279 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
6280 sizeof(he_obss_pd->bss_color_bitmap));
6281
6282 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
6283 memcpy(he_obss_pd->partial_bssid_bitmap,
6284 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
6285 sizeof(he_obss_pd->partial_bssid_bitmap));
6286
6287 he_obss_pd->enable = true;
6288
6289 return 0;
6290 }
6291
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_fils_discovery * fd)6292 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
6293 struct nlattr *attrs,
6294 struct cfg80211_fils_discovery *fd)
6295 {
6296 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
6297 int ret;
6298
6299 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6300 NL80211_EXT_FEATURE_FILS_DISCOVERY))
6301 return -EINVAL;
6302
6303 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
6304 NULL, NULL);
6305 if (ret)
6306 return ret;
6307
6308 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
6309 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
6310 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
6311 fd->update = true;
6312 return 0;
6313 }
6314
6315 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
6316 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
6317 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
6318 return -EINVAL;
6319
6320 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6321 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6322 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
6323 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
6324 fd->update = true;
6325 return 0;
6326 }
6327
6328 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_unsol_bcast_probe_resp * presp)6329 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
6330 struct nlattr *attrs,
6331 struct cfg80211_unsol_bcast_probe_resp *presp)
6332 {
6333 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
6334 int ret;
6335
6336 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6337 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
6338 return -EINVAL;
6339
6340 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
6341 attrs, NULL, NULL);
6342 if (ret)
6343 return ret;
6344
6345 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
6346 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
6347 presp->update = true;
6348 return 0;
6349 }
6350
6351 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
6352 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
6353 return -EINVAL;
6354
6355 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6356 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6357 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
6358 presp->update = true;
6359 return 0;
6360 }
6361
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)6362 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
6363 const struct element *rates)
6364 {
6365 int i;
6366
6367 if (!rates)
6368 return;
6369
6370 for (i = 0; i < rates->datalen; i++) {
6371 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
6372 params->ht_required = true;
6373 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
6374 params->vht_required = true;
6375 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
6376 params->he_required = true;
6377 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
6378 params->sae_h2e_required = true;
6379 }
6380 }
6381
6382 /*
6383 * Since the nl80211 API didn't include, from the beginning, attributes about
6384 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
6385 * benefit of drivers that rebuild IEs in the firmware.
6386 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)6387 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
6388 {
6389 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
6390 size_t ies_len = bcn->tail_len;
6391 const u8 *ies = bcn->tail;
6392 const struct element *rates;
6393 const struct element *cap;
6394
6395 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
6396 nl80211_check_ap_rate_selectors(params, rates);
6397
6398 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
6399 nl80211_check_ap_rate_selectors(params, rates);
6400
6401 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
6402 if (cap && cap->datalen >= sizeof(*params->ht_cap))
6403 params->ht_cap = (void *)cap->data;
6404 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
6405 if (cap && cap->datalen >= sizeof(*params->vht_cap))
6406 params->vht_cap = (void *)cap->data;
6407 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
6408 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
6409 params->he_cap = (void *)(cap->data + 1);
6410 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
6411 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
6412 params->he_oper = (void *)(cap->data + 1);
6413 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
6414 if (cap) {
6415 if (!cap->datalen)
6416 return -EINVAL;
6417 params->eht_cap = (void *)(cap->data + 1);
6418 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
6419 (const u8 *)params->eht_cap,
6420 cap->datalen - 1, true))
6421 return -EINVAL;
6422 }
6423 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
6424 if (cap) {
6425 if (!cap->datalen)
6426 return -EINVAL;
6427 params->eht_oper = (void *)(cap->data + 1);
6428 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
6429 cap->datalen - 1))
6430 return -EINVAL;
6431 }
6432 return 0;
6433 }
6434
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)6435 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
6436 struct cfg80211_ap_settings *params)
6437 {
6438 struct wireless_dev *wdev;
6439
6440 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
6441 if (wdev->iftype != NL80211_IFTYPE_AP &&
6442 wdev->iftype != NL80211_IFTYPE_P2P_GO)
6443 continue;
6444
6445 if (!wdev->u.ap.preset_chandef.chan)
6446 continue;
6447
6448 params->chandef = wdev->u.ap.preset_chandef;
6449 return true;
6450 }
6451
6452 return false;
6453 }
6454
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)6455 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6456 enum nl80211_auth_type auth_type,
6457 enum nl80211_commands cmd)
6458 {
6459 if (auth_type > NL80211_AUTHTYPE_MAX)
6460 return false;
6461
6462 switch (cmd) {
6463 case NL80211_CMD_AUTHENTICATE:
6464 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6465 auth_type == NL80211_AUTHTYPE_SAE)
6466 return false;
6467 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6468 NL80211_EXT_FEATURE_FILS_STA) &&
6469 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6470 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6471 auth_type == NL80211_AUTHTYPE_FILS_PK))
6472 return false;
6473 return true;
6474 case NL80211_CMD_CONNECT:
6475 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6476 !wiphy_ext_feature_isset(&rdev->wiphy,
6477 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6478 auth_type == NL80211_AUTHTYPE_SAE)
6479 return false;
6480
6481 /* FILS with SK PFS or PK not supported yet */
6482 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6483 auth_type == NL80211_AUTHTYPE_FILS_PK)
6484 return false;
6485 if (!wiphy_ext_feature_isset(
6486 &rdev->wiphy,
6487 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6488 auth_type == NL80211_AUTHTYPE_FILS_SK)
6489 return false;
6490 return true;
6491 case NL80211_CMD_START_AP:
6492 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6493 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6494 auth_type == NL80211_AUTHTYPE_SAE)
6495 return false;
6496 /* FILS not supported yet */
6497 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6498 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6499 auth_type == NL80211_AUTHTYPE_FILS_PK)
6500 return false;
6501 return true;
6502 default:
6503 return false;
6504 }
6505 }
6506
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)6507 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6508 unsigned int link_id)
6509 {
6510 struct wiphy *wiphy = wdev->wiphy;
6511 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6512 struct sk_buff *msg;
6513 void *hdr;
6514
6515 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6516 if (!msg)
6517 return;
6518
6519 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6520 if (!hdr)
6521 goto out;
6522
6523 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6524 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6525 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6526 NL80211_ATTR_PAD) ||
6527 (wdev->u.ap.ssid_len &&
6528 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6529 wdev->u.ap.ssid)) ||
6530 (wdev->valid_links &&
6531 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6532 goto out;
6533
6534 genlmsg_end(msg, hdr);
6535
6536 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6537 NL80211_MCGRP_MLME, GFP_KERNEL);
6538 return;
6539 out:
6540 nlmsg_free(msg);
6541 }
6542
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)6543 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6544 {
6545 struct ieee80211_channel *channel = params->chandef.chan;
6546
6547 if ((params->he_cap || params->he_oper) &&
6548 (channel->flags & IEEE80211_CHAN_NO_HE))
6549 return -EOPNOTSUPP;
6550
6551 if ((params->eht_cap || params->eht_oper) &&
6552 (channel->flags & IEEE80211_CHAN_NO_EHT))
6553 return -EOPNOTSUPP;
6554
6555 return 0;
6556 }
6557
6558 static int
nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_s1g_short_beacon * sb)6559 nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device *rdev,
6560 struct nlattr *attrs,
6561 struct cfg80211_s1g_short_beacon *sb)
6562 {
6563 struct nlattr *tb[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1];
6564 int ret;
6565
6566 if (!rdev->wiphy.bands[NL80211_BAND_S1GHZ])
6567 return -EINVAL;
6568
6569 ret = nla_parse_nested(tb, NL80211_S1G_SHORT_BEACON_ATTR_MAX, attrs,
6570 NULL, NULL);
6571 if (ret)
6572 return ret;
6573
6574 /* Short beacon tail is optional (i.e might only include the TIM) */
6575 if (!tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD])
6576 return -EINVAL;
6577
6578 sb->short_head = nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6579 sb->short_head_len = nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6580 sb->short_tail_len = 0;
6581
6582 if (tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]) {
6583 sb->short_tail =
6584 nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6585 sb->short_tail_len =
6586 nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6587 }
6588
6589 sb->update = true;
6590 return 0;
6591 }
6592
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)6593 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6594 {
6595 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6596 struct cfg80211_beaconing_check_config beacon_check = {};
6597 unsigned int link_id = nl80211_link_id(info->attrs);
6598 struct net_device *dev = info->user_ptr[1];
6599 struct wireless_dev *wdev = dev->ieee80211_ptr;
6600 struct cfg80211_ap_settings *params;
6601 int err;
6602
6603 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6604 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6605 return -EOPNOTSUPP;
6606
6607 if (!rdev->ops->start_ap)
6608 return -EOPNOTSUPP;
6609
6610 if (wdev->links[link_id].cac_started)
6611 return -EBUSY;
6612
6613 if (wdev->links[link_id].ap.beacon_interval)
6614 return -EALREADY;
6615
6616 /* these are required for START_AP */
6617 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6618 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6619 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6620 return -EINVAL;
6621
6622 if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6623 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6624 return -EOPNOTSUPP;
6625
6626 params = kzalloc(sizeof(*params), GFP_KERNEL);
6627 if (!params)
6628 return -ENOMEM;
6629
6630 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6631 info->extack);
6632 if (err)
6633 goto out;
6634
6635 params->beacon_interval =
6636 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6637 params->dtim_period =
6638 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6639
6640 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6641 params->beacon_interval);
6642 if (err)
6643 goto out;
6644
6645 /*
6646 * In theory, some of these attributes should be required here
6647 * but since they were not used when the command was originally
6648 * added, keep them optional for old user space programs to let
6649 * them continue to work with drivers that do not need the
6650 * additional information -- drivers must check!
6651 */
6652 if (info->attrs[NL80211_ATTR_SSID]) {
6653 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6654 params->ssid_len =
6655 nla_len(info->attrs[NL80211_ATTR_SSID]);
6656 if (params->ssid_len == 0) {
6657 err = -EINVAL;
6658 goto out;
6659 }
6660
6661 if (wdev->u.ap.ssid_len &&
6662 (wdev->u.ap.ssid_len != params->ssid_len ||
6663 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6664 /* require identical SSID for MLO */
6665 err = -EINVAL;
6666 goto out;
6667 }
6668 } else if (wdev->valid_links) {
6669 /* require SSID for MLO */
6670 err = -EINVAL;
6671 goto out;
6672 }
6673
6674 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6675 params->hidden_ssid = nla_get_u32(
6676 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6677
6678 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6679
6680 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6681 params->auth_type = nla_get_u32(
6682 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6683 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6684 NL80211_CMD_START_AP)) {
6685 err = -EINVAL;
6686 goto out;
6687 }
6688 } else
6689 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6690
6691 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6692 NL80211_MAX_NR_CIPHER_SUITES);
6693 if (err)
6694 goto out;
6695
6696 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6697 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6698 err = -EOPNOTSUPP;
6699 goto out;
6700 }
6701 params->inactivity_timeout = nla_get_u16(
6702 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6703 }
6704
6705 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6706 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6707 err = -EINVAL;
6708 goto out;
6709 }
6710 params->p2p_ctwindow =
6711 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6712 if (params->p2p_ctwindow != 0 &&
6713 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6714 err = -EINVAL;
6715 goto out;
6716 }
6717 }
6718
6719 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6720 u8 tmp;
6721
6722 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6723 err = -EINVAL;
6724 goto out;
6725 }
6726 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6727 params->p2p_opp_ps = tmp;
6728 if (params->p2p_opp_ps != 0 &&
6729 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6730 err = -EINVAL;
6731 goto out;
6732 }
6733 }
6734
6735 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6736 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6737 if (err)
6738 goto out;
6739 } else if (wdev->valid_links) {
6740 /* with MLD need to specify the channel configuration */
6741 err = -EINVAL;
6742 goto out;
6743 } else if (wdev->u.ap.preset_chandef.chan) {
6744 params->chandef = wdev->u.ap.preset_chandef;
6745 } else if (!nl80211_get_ap_channel(rdev, params)) {
6746 err = -EINVAL;
6747 goto out;
6748 }
6749
6750 beacon_check.iftype = wdev->iftype;
6751 beacon_check.relax = true;
6752 beacon_check.reg_power =
6753 cfg80211_get_6ghz_power_type(params->beacon.tail,
6754 params->beacon.tail_len, 0);
6755 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, ¶ms->chandef,
6756 &beacon_check)) {
6757 err = -EINVAL;
6758 goto out;
6759 }
6760
6761 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6762 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6763 NL80211_ATTR_TX_RATES,
6764 ¶ms->beacon_rate,
6765 dev, false, link_id);
6766 if (err)
6767 goto out;
6768
6769 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6770 ¶ms->beacon_rate);
6771 if (err)
6772 goto out;
6773 }
6774
6775 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6776 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6777 err = -EOPNOTSUPP;
6778 goto out;
6779 }
6780
6781 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6782 params->acl = parse_acl_data(&rdev->wiphy, info);
6783 if (IS_ERR(params->acl)) {
6784 err = PTR_ERR(params->acl);
6785 params->acl = NULL;
6786 goto out;
6787 }
6788 }
6789
6790 params->twt_responder =
6791 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6792
6793 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6794 err = nl80211_parse_he_obss_pd(
6795 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6796 ¶ms->he_obss_pd);
6797 if (err)
6798 goto out;
6799 }
6800
6801 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6802 err = nl80211_parse_fils_discovery(rdev,
6803 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6804 ¶ms->fils_discovery);
6805 if (err)
6806 goto out;
6807 }
6808
6809 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6810 err = nl80211_parse_unsol_bcast_probe_resp(
6811 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6812 ¶ms->unsol_bcast_probe_resp);
6813 if (err)
6814 goto out;
6815 }
6816
6817 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6818 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
6819 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6820 ¶ms->mbssid_config,
6821 params->beacon.mbssid_ies ?
6822 params->beacon.mbssid_ies->cnt :
6823 0);
6824 if (err)
6825 goto out;
6826 }
6827
6828 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6829 err = -EINVAL;
6830 goto out;
6831 }
6832
6833 if (info->attrs[NL80211_ATTR_S1G_SHORT_BEACON]) {
6834 if (!info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]) {
6835 err = -EINVAL;
6836 goto out;
6837 }
6838
6839 params->s1g_long_beacon_period = nla_get_u8(
6840 info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]);
6841
6842 err = nl80211_parse_s1g_short_beacon(
6843 rdev, info->attrs[NL80211_ATTR_S1G_SHORT_BEACON],
6844 ¶ms->s1g_short_beacon);
6845 if (err)
6846 goto out;
6847 }
6848
6849 err = nl80211_calculate_ap_params(params);
6850 if (err)
6851 goto out;
6852
6853 err = nl80211_validate_ap_phy_operation(params);
6854 if (err)
6855 goto out;
6856
6857 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6858 params->flags = nla_get_u32(
6859 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6860 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6861 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6862
6863 if (wdev->conn_owner_nlportid &&
6864 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6865 wdev->conn_owner_nlportid != info->snd_portid) {
6866 err = -EINVAL;
6867 goto out;
6868 }
6869
6870 /* FIXME: validate MLO/link-id against driver capabilities */
6871
6872 err = rdev_start_ap(rdev, dev, params);
6873 if (!err) {
6874 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6875 wdev->links[link_id].ap.chandef = params->chandef;
6876 wdev->u.ap.ssid_len = params->ssid_len;
6877 memcpy(wdev->u.ap.ssid, params->ssid,
6878 params->ssid_len);
6879
6880 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6881 wdev->conn_owner_nlportid = info->snd_portid;
6882
6883 nl80211_send_ap_started(wdev, link_id);
6884 }
6885 out:
6886 kfree(params->acl);
6887 kfree(params->beacon.mbssid_ies);
6888 if (params->mbssid_config.tx_wdev &&
6889 params->mbssid_config.tx_wdev->netdev &&
6890 params->mbssid_config.tx_wdev->netdev != dev)
6891 dev_put(params->mbssid_config.tx_wdev->netdev);
6892 kfree(params->beacon.rnr_ies);
6893 kfree(params);
6894
6895 return err;
6896 }
6897
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6898 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6899 {
6900 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6901 struct cfg80211_beaconing_check_config beacon_check = {};
6902 unsigned int link_id = nl80211_link_id(info->attrs);
6903 struct net_device *dev = info->user_ptr[1];
6904 struct wireless_dev *wdev = dev->ieee80211_ptr;
6905 struct cfg80211_ap_update *params;
6906 struct nlattr *attr;
6907 int err;
6908
6909 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6910 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6911 return -EOPNOTSUPP;
6912
6913 if (!rdev->ops->change_beacon)
6914 return -EOPNOTSUPP;
6915
6916 if (!wdev->links[link_id].ap.beacon_interval)
6917 return -EINVAL;
6918
6919 params = kzalloc(sizeof(*params), GFP_KERNEL);
6920 if (!params)
6921 return -ENOMEM;
6922
6923 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6924 info->extack);
6925 if (err)
6926 goto out;
6927
6928 /* recheck beaconing is permitted with possibly changed power type */
6929 beacon_check.iftype = wdev->iftype;
6930 beacon_check.relax = true;
6931 beacon_check.reg_power =
6932 cfg80211_get_6ghz_power_type(params->beacon.tail,
6933 params->beacon.tail_len, 0);
6934 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6935 &wdev->links[link_id].ap.chandef,
6936 &beacon_check)) {
6937 err = -EINVAL;
6938 goto out;
6939 }
6940
6941 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6942 if (attr) {
6943 err = nl80211_parse_fils_discovery(rdev, attr,
6944 ¶ms->fils_discovery);
6945 if (err)
6946 goto out;
6947 }
6948
6949 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6950 if (attr) {
6951 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6952 ¶ms->unsol_bcast_probe_resp);
6953 if (err)
6954 goto out;
6955 }
6956
6957 attr = info->attrs[NL80211_ATTR_S1G_SHORT_BEACON];
6958 if (attr) {
6959 err = nl80211_parse_s1g_short_beacon(rdev, attr,
6960 ¶ms->s1g_short_beacon);
6961 if (err)
6962 goto out;
6963 }
6964
6965 err = rdev_change_beacon(rdev, dev, params);
6966
6967 out:
6968 kfree(params->beacon.mbssid_ies);
6969 kfree(params->beacon.rnr_ies);
6970 kfree(params);
6971 return err;
6972 }
6973
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6974 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6975 {
6976 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6977 unsigned int link_id = nl80211_link_id(info->attrs);
6978 struct net_device *dev = info->user_ptr[1];
6979
6980 return cfg80211_stop_ap(rdev, dev, link_id, false);
6981 }
6982
6983 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6984 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6985 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6986 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6987 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6988 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6989 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6990 };
6991
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6992 static int parse_station_flags(struct genl_info *info,
6993 enum nl80211_iftype iftype,
6994 struct station_parameters *params)
6995 {
6996 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6997 struct nlattr *nla;
6998 int flag;
6999
7000 /*
7001 * Try parsing the new attribute first so userspace
7002 * can specify both for older kernels.
7003 */
7004 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
7005 if (nla) {
7006 struct nl80211_sta_flag_update *sta_flags;
7007
7008 sta_flags = nla_data(nla);
7009 params->sta_flags_mask = sta_flags->mask;
7010 params->sta_flags_set = sta_flags->set;
7011 params->sta_flags_set &= params->sta_flags_mask;
7012 if ((params->sta_flags_mask |
7013 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
7014 return -EINVAL;
7015 return 0;
7016 }
7017
7018 /* if present, parse the old attribute */
7019
7020 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
7021 if (!nla)
7022 return 0;
7023
7024 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
7025 return -EINVAL;
7026
7027 /*
7028 * Only allow certain flags for interface types so that
7029 * other attributes are silently ignored. Remember that
7030 * this is backward compatibility code with old userspace
7031 * and shouldn't be hit in other cases anyway.
7032 */
7033 switch (iftype) {
7034 case NL80211_IFTYPE_AP:
7035 case NL80211_IFTYPE_AP_VLAN:
7036 case NL80211_IFTYPE_P2P_GO:
7037 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7038 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7039 BIT(NL80211_STA_FLAG_WME) |
7040 BIT(NL80211_STA_FLAG_MFP);
7041 break;
7042 case NL80211_IFTYPE_P2P_CLIENT:
7043 case NL80211_IFTYPE_STATION:
7044 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7045 BIT(NL80211_STA_FLAG_TDLS_PEER);
7046 break;
7047 case NL80211_IFTYPE_MESH_POINT:
7048 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7049 BIT(NL80211_STA_FLAG_MFP) |
7050 BIT(NL80211_STA_FLAG_AUTHORIZED);
7051 break;
7052 default:
7053 return -EINVAL;
7054 }
7055
7056 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
7057 if (flags[flag]) {
7058 params->sta_flags_set |= (1<<flag);
7059
7060 /* no longer support new API additions in old API */
7061 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
7062 return -EINVAL;
7063 }
7064 }
7065
7066 return 0;
7067 }
7068
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)7069 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
7070 {
7071 struct nlattr *rate;
7072 u32 bitrate;
7073 u16 bitrate_compat;
7074 enum nl80211_rate_info rate_flg;
7075
7076 rate = nla_nest_start_noflag(msg, attr);
7077 if (!rate)
7078 return false;
7079
7080 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
7081 bitrate = cfg80211_calculate_bitrate(info);
7082 /* report 16-bit bitrate only if we can */
7083 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
7084 if (bitrate > 0 &&
7085 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
7086 return false;
7087 if (bitrate_compat > 0 &&
7088 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
7089 return false;
7090
7091 switch (info->bw) {
7092 case RATE_INFO_BW_1:
7093 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
7094 break;
7095 case RATE_INFO_BW_2:
7096 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
7097 break;
7098 case RATE_INFO_BW_4:
7099 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
7100 break;
7101 case RATE_INFO_BW_5:
7102 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
7103 break;
7104 case RATE_INFO_BW_8:
7105 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
7106 break;
7107 case RATE_INFO_BW_10:
7108 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
7109 break;
7110 case RATE_INFO_BW_16:
7111 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
7112 break;
7113 default:
7114 WARN_ON(1);
7115 fallthrough;
7116 case RATE_INFO_BW_20:
7117 rate_flg = 0;
7118 break;
7119 case RATE_INFO_BW_40:
7120 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
7121 break;
7122 case RATE_INFO_BW_80:
7123 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
7124 break;
7125 case RATE_INFO_BW_160:
7126 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
7127 break;
7128 case RATE_INFO_BW_HE_RU:
7129 rate_flg = 0;
7130 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
7131 break;
7132 case RATE_INFO_BW_320:
7133 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
7134 break;
7135 case RATE_INFO_BW_EHT_RU:
7136 rate_flg = 0;
7137 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
7138 break;
7139 }
7140
7141 if (rate_flg && nla_put_flag(msg, rate_flg))
7142 return false;
7143
7144 if (info->flags & RATE_INFO_FLAGS_MCS) {
7145 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
7146 return false;
7147 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7148 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7149 return false;
7150 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
7151 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
7152 return false;
7153 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
7154 return false;
7155 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7156 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7157 return false;
7158 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
7159 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
7160 return false;
7161 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
7162 return false;
7163 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
7164 return false;
7165 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
7166 return false;
7167 if (info->bw == RATE_INFO_BW_HE_RU &&
7168 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
7169 info->he_ru_alloc))
7170 return false;
7171 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
7172 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
7173 return false;
7174 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
7175 return false;
7176 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7177 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7178 return false;
7179 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
7180 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
7181 return false;
7182 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
7183 return false;
7184 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
7185 return false;
7186 if (info->bw == RATE_INFO_BW_EHT_RU &&
7187 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
7188 info->eht_ru_alloc))
7189 return false;
7190 }
7191
7192 nla_nest_end(msg, rate);
7193 return true;
7194 }
7195
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)7196 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
7197 int id)
7198 {
7199 void *attr;
7200 int i = 0;
7201
7202 if (!mask)
7203 return true;
7204
7205 attr = nla_nest_start_noflag(msg, id);
7206 if (!attr)
7207 return false;
7208
7209 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
7210 if (!(mask & BIT(i)))
7211 continue;
7212
7213 if (nla_put_u8(msg, i, signal[i]))
7214 return false;
7215 }
7216
7217 nla_nest_end(msg, attr);
7218
7219 return true;
7220 }
7221
nl80211_fill_link_station(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct link_station_info * link_sinfo)7222 static int nl80211_fill_link_station(struct sk_buff *msg,
7223 struct cfg80211_registered_device *rdev,
7224 struct link_station_info *link_sinfo)
7225 {
7226 struct nlattr *bss_param, *link_sinfoattr;
7227
7228 #define PUT_LINK_SINFO(attr, memb, type) do { \
7229 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7230 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7231 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7232 link_sinfo->memb)) \
7233 goto nla_put_failure; \
7234 } while (0)
7235 #define PUT_LINK_SINFO_U64(attr, memb) do { \
7236 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7237 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7238 link_sinfo->memb, NL80211_STA_INFO_PAD)) \
7239 goto nla_put_failure; \
7240 } while (0)
7241
7242 link_sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7243 if (!link_sinfoattr)
7244 goto nla_put_failure;
7245
7246 PUT_LINK_SINFO(INACTIVE_TIME, inactive_time, u32);
7247
7248 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7249 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7250 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7251 (u32)link_sinfo->rx_bytes))
7252 goto nla_put_failure;
7253
7254 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7255 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7256 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7257 (u32)link_sinfo->tx_bytes))
7258 goto nla_put_failure;
7259
7260 PUT_LINK_SINFO_U64(RX_BYTES64, rx_bytes);
7261 PUT_LINK_SINFO_U64(TX_BYTES64, tx_bytes);
7262 PUT_LINK_SINFO_U64(RX_DURATION, rx_duration);
7263 PUT_LINK_SINFO_U64(TX_DURATION, tx_duration);
7264
7265 if (wiphy_ext_feature_isset(&rdev->wiphy,
7266 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7267 PUT_LINK_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7268
7269 switch (rdev->wiphy.signal_type) {
7270 case CFG80211_SIGNAL_TYPE_MBM:
7271 PUT_LINK_SINFO(SIGNAL, signal, u8);
7272 PUT_LINK_SINFO(SIGNAL_AVG, signal_avg, u8);
7273 break;
7274 default:
7275 break;
7276 }
7277 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7278 if (!nl80211_put_signal(msg, link_sinfo->chains,
7279 link_sinfo->chain_signal,
7280 NL80211_STA_INFO_CHAIN_SIGNAL))
7281 goto nla_put_failure;
7282 }
7283 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7284 if (!nl80211_put_signal(msg, link_sinfo->chains,
7285 link_sinfo->chain_signal_avg,
7286 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7287 goto nla_put_failure;
7288 }
7289 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7290 if (!nl80211_put_sta_rate(msg, &link_sinfo->txrate,
7291 NL80211_STA_INFO_TX_BITRATE))
7292 goto nla_put_failure;
7293 }
7294 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7295 if (!nl80211_put_sta_rate(msg, &link_sinfo->rxrate,
7296 NL80211_STA_INFO_RX_BITRATE))
7297 goto nla_put_failure;
7298 }
7299
7300 PUT_LINK_SINFO(RX_PACKETS, rx_packets, u32);
7301 PUT_LINK_SINFO(TX_PACKETS, tx_packets, u32);
7302 PUT_LINK_SINFO(TX_RETRIES, tx_retries, u32);
7303 PUT_LINK_SINFO(TX_FAILED, tx_failed, u32);
7304 PUT_LINK_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7305 PUT_LINK_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7306
7307 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7308 bss_param = nla_nest_start_noflag(msg,
7309 NL80211_STA_INFO_BSS_PARAM);
7310 if (!bss_param)
7311 goto nla_put_failure;
7312
7313 if (((link_sinfo->bss_param.flags &
7314 BSS_PARAM_FLAGS_CTS_PROT) &&
7315 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7316 ((link_sinfo->bss_param.flags &
7317 BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7318 nla_put_flag(msg,
7319 NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7320 ((link_sinfo->bss_param.flags &
7321 BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7322 nla_put_flag(msg,
7323 NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7324 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7325 link_sinfo->bss_param.dtim_period) ||
7326 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7327 link_sinfo->bss_param.beacon_interval))
7328 goto nla_put_failure;
7329
7330 nla_nest_end(msg, bss_param);
7331 }
7332
7333 PUT_LINK_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7334 PUT_LINK_SINFO_U64(BEACON_RX, rx_beacon);
7335 PUT_LINK_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7336 PUT_LINK_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7337 PUT_LINK_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7338 if (wiphy_ext_feature_isset(&rdev->wiphy,
7339 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7340 PUT_LINK_SINFO(ACK_SIGNAL, ack_signal, u8);
7341 PUT_LINK_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7342 }
7343
7344 #undef PUT_LINK_SINFO
7345 #undef PUT_LINK_SINFO_U64
7346
7347 if (link_sinfo->pertid) {
7348 struct nlattr *tidsattr;
7349 int tid;
7350
7351 tidsattr = nla_nest_start_noflag(msg,
7352 NL80211_STA_INFO_TID_STATS);
7353 if (!tidsattr)
7354 goto nla_put_failure;
7355
7356 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7357 struct cfg80211_tid_stats *tidstats;
7358 struct nlattr *tidattr;
7359
7360 tidstats = &link_sinfo->pertid[tid];
7361
7362 if (!tidstats->filled)
7363 continue;
7364
7365 tidattr = nla_nest_start_noflag(msg, tid + 1);
7366 if (!tidattr)
7367 goto nla_put_failure;
7368
7369 #define PUT_TIDVAL_U64(attr, memb) do { \
7370 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7371 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7372 tidstats->memb, NL80211_TID_STATS_PAD)) \
7373 goto nla_put_failure; \
7374 } while (0)
7375
7376 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7377 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7378 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7379 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7380
7381 #undef PUT_TIDVAL_U64
7382 if ((tidstats->filled &
7383 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7384 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7385 NL80211_TID_STATS_TXQ_STATS))
7386 goto nla_put_failure;
7387
7388 nla_nest_end(msg, tidattr);
7389 }
7390
7391 nla_nest_end(msg, tidsattr);
7392 }
7393
7394 nla_nest_end(msg, link_sinfoattr);
7395 return 0;
7396
7397 nla_put_failure:
7398 return -EMSGSIZE;
7399 }
7400
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,bool link_stats)7401 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
7402 u32 seq, int flags,
7403 struct cfg80211_registered_device *rdev,
7404 struct net_device *dev,
7405 const u8 *mac_addr, struct station_info *sinfo,
7406 bool link_stats)
7407 {
7408 void *hdr;
7409 struct nlattr *sinfoattr, *bss_param;
7410 struct link_station_info *link_sinfo;
7411 struct nlattr *links, *link;
7412 int link_id;
7413
7414 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7415 if (!hdr) {
7416 cfg80211_sinfo_release_content(sinfo);
7417 return -1;
7418 }
7419
7420 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7421 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
7422 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
7423 goto nla_put_failure;
7424
7425 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7426 if (!sinfoattr)
7427 goto nla_put_failure;
7428
7429 #define PUT_SINFO(attr, memb, type) do { \
7430 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7431 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7432 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7433 sinfo->memb)) \
7434 goto nla_put_failure; \
7435 } while (0)
7436 #define PUT_SINFO_U64(attr, memb) do { \
7437 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7438 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7439 sinfo->memb, NL80211_STA_INFO_PAD)) \
7440 goto nla_put_failure; \
7441 } while (0)
7442
7443 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
7444 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
7445 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
7446
7447 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7448 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7449 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7450 (u32)sinfo->rx_bytes))
7451 goto nla_put_failure;
7452
7453 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7454 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7455 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7456 (u32)sinfo->tx_bytes))
7457 goto nla_put_failure;
7458
7459 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
7460 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
7461 PUT_SINFO_U64(RX_DURATION, rx_duration);
7462 PUT_SINFO_U64(TX_DURATION, tx_duration);
7463
7464 if (wiphy_ext_feature_isset(&rdev->wiphy,
7465 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7466 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7467
7468 switch (rdev->wiphy.signal_type) {
7469 case CFG80211_SIGNAL_TYPE_MBM:
7470 PUT_SINFO(SIGNAL, signal, u8);
7471 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
7472 break;
7473 default:
7474 break;
7475 }
7476 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7477 if (!nl80211_put_signal(msg, sinfo->chains,
7478 sinfo->chain_signal,
7479 NL80211_STA_INFO_CHAIN_SIGNAL))
7480 goto nla_put_failure;
7481 }
7482 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7483 if (!nl80211_put_signal(msg, sinfo->chains,
7484 sinfo->chain_signal_avg,
7485 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7486 goto nla_put_failure;
7487 }
7488 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7489 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
7490 NL80211_STA_INFO_TX_BITRATE))
7491 goto nla_put_failure;
7492 }
7493 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7494 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
7495 NL80211_STA_INFO_RX_BITRATE))
7496 goto nla_put_failure;
7497 }
7498
7499 PUT_SINFO(RX_PACKETS, rx_packets, u32);
7500 PUT_SINFO(TX_PACKETS, tx_packets, u32);
7501 PUT_SINFO(TX_RETRIES, tx_retries, u32);
7502 PUT_SINFO(TX_FAILED, tx_failed, u32);
7503 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7504 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7505
7506 PUT_SINFO(LLID, llid, u16);
7507 PUT_SINFO(PLID, plid, u16);
7508 PUT_SINFO(PLINK_STATE, plink_state, u8);
7509 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
7510 PUT_SINFO(LOCAL_PM, local_pm, u32);
7511 PUT_SINFO(PEER_PM, peer_pm, u32);
7512 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
7513 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
7514 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
7515 PUT_SINFO_U64(T_OFFSET, t_offset);
7516
7517 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7518 bss_param = nla_nest_start_noflag(msg,
7519 NL80211_STA_INFO_BSS_PARAM);
7520 if (!bss_param)
7521 goto nla_put_failure;
7522
7523 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
7524 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7525 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7526 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7527 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7528 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7529 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7530 sinfo->bss_param.dtim_period) ||
7531 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7532 sinfo->bss_param.beacon_interval))
7533 goto nla_put_failure;
7534
7535 nla_nest_end(msg, bss_param);
7536 }
7537 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
7538 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
7539 sizeof(struct nl80211_sta_flag_update),
7540 &sinfo->sta_flags))
7541 goto nla_put_failure;
7542
7543 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7544 PUT_SINFO_U64(BEACON_RX, rx_beacon);
7545 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7546 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7547 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7548 if (wiphy_ext_feature_isset(&rdev->wiphy,
7549 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7550 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
7551 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7552 }
7553
7554 #undef PUT_SINFO
7555 #undef PUT_SINFO_U64
7556
7557 if (sinfo->pertid) {
7558 struct nlattr *tidsattr;
7559 int tid;
7560
7561 tidsattr = nla_nest_start_noflag(msg,
7562 NL80211_STA_INFO_TID_STATS);
7563 if (!tidsattr)
7564 goto nla_put_failure;
7565
7566 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7567 struct cfg80211_tid_stats *tidstats;
7568 struct nlattr *tidattr;
7569
7570 tidstats = &sinfo->pertid[tid];
7571
7572 if (!tidstats->filled)
7573 continue;
7574
7575 tidattr = nla_nest_start_noflag(msg, tid + 1);
7576 if (!tidattr)
7577 goto nla_put_failure;
7578
7579 #define PUT_TIDVAL_U64(attr, memb) do { \
7580 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7581 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7582 tidstats->memb, NL80211_TID_STATS_PAD)) \
7583 goto nla_put_failure; \
7584 } while (0)
7585
7586 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7587 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7588 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7589 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7590
7591 #undef PUT_TIDVAL_U64
7592 if ((tidstats->filled &
7593 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7594 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7595 NL80211_TID_STATS_TXQ_STATS))
7596 goto nla_put_failure;
7597
7598 nla_nest_end(msg, tidattr);
7599 }
7600
7601 nla_nest_end(msg, tidsattr);
7602 }
7603
7604 nla_nest_end(msg, sinfoattr);
7605
7606 if (sinfo->assoc_req_ies_len &&
7607 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
7608 sinfo->assoc_req_ies))
7609 goto nla_put_failure;
7610
7611 if (sinfo->assoc_resp_ies_len &&
7612 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
7613 sinfo->assoc_resp_ies))
7614 goto nla_put_failure;
7615
7616 if (sinfo->mlo_params_valid) {
7617 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7618 sinfo->assoc_link_id))
7619 goto nla_put_failure;
7620
7621 if (!is_zero_ether_addr(sinfo->mld_addr) &&
7622 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
7623 sinfo->mld_addr))
7624 goto nla_put_failure;
7625 }
7626
7627 if (link_stats && sinfo->valid_links) {
7628 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
7629 if (!links)
7630 goto nla_put_failure;
7631
7632 for_each_valid_link(sinfo, link_id) {
7633 link_sinfo = sinfo->links[link_id];
7634
7635 if (WARN_ON_ONCE(!link_sinfo))
7636 continue;
7637
7638 if (!is_valid_ether_addr(link_sinfo->addr))
7639 continue;
7640
7641 link = nla_nest_start(msg, link_id + 1);
7642 if (!link)
7643 goto nla_put_failure;
7644
7645 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7646 link_id))
7647 goto nla_put_failure;
7648
7649 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
7650 link_sinfo->addr))
7651 goto nla_put_failure;
7652
7653 if (nl80211_fill_link_station(msg, rdev, link_sinfo))
7654 goto nla_put_failure;
7655
7656 nla_nest_end(msg, link);
7657 }
7658 nla_nest_end(msg, links);
7659 }
7660
7661 cfg80211_sinfo_release_content(sinfo);
7662 genlmsg_end(msg, hdr);
7663 return 0;
7664
7665 nla_put_failure:
7666 cfg80211_sinfo_release_content(sinfo);
7667 genlmsg_cancel(msg, hdr);
7668 return -EMSGSIZE;
7669 }
7670
cfg80211_sta_set_mld_sinfo(struct station_info * sinfo)7671 static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
7672 {
7673 struct link_station_info *link_sinfo;
7674 int link_id, init = 0;
7675 u32 link_inactive_time;
7676
7677 sinfo->signal = -99;
7678
7679 for_each_valid_link(sinfo, link_id) {
7680 link_sinfo = sinfo->links[link_id];
7681 if (!link_sinfo)
7682 continue;
7683
7684 if ((link_sinfo->filled &
7685 BIT_ULL(NL80211_STA_INFO_TX_PACKETS))) {
7686 sinfo->tx_packets += link_sinfo->tx_packets;
7687 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
7688 }
7689
7690 if ((link_sinfo->filled &
7691 BIT_ULL(NL80211_STA_INFO_RX_PACKETS))) {
7692 sinfo->rx_packets += link_sinfo->rx_packets;
7693 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
7694 }
7695
7696 if (link_sinfo->filled &
7697 (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7698 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7699 sinfo->tx_bytes += link_sinfo->tx_bytes;
7700 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
7701 }
7702
7703 if (link_sinfo->filled &
7704 (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7705 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7706 sinfo->rx_bytes += link_sinfo->rx_bytes;
7707 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
7708 }
7709
7710 if (link_sinfo->filled &
7711 BIT_ULL(NL80211_STA_INFO_TX_RETRIES)) {
7712 sinfo->tx_retries += link_sinfo->tx_retries;
7713 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
7714 }
7715
7716 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED)) {
7717 sinfo->tx_failed += link_sinfo->tx_failed;
7718 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
7719 }
7720
7721 if (link_sinfo->filled &
7722 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC)) {
7723 sinfo->rx_dropped_misc += link_sinfo->rx_dropped_misc;
7724 sinfo->filled |=
7725 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC);
7726 }
7727
7728 if (link_sinfo->filled &
7729 BIT_ULL(NL80211_STA_INFO_BEACON_LOSS)) {
7730 sinfo->beacon_loss_count +=
7731 link_sinfo->beacon_loss_count;
7732 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_LOSS);
7733 }
7734
7735 if (link_sinfo->filled &
7736 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) {
7737 sinfo->expected_throughput +=
7738 link_sinfo->expected_throughput;
7739 sinfo->filled |=
7740 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
7741 }
7742
7743 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_MPDUS)) {
7744 sinfo->rx_mpdu_count += link_sinfo->rx_mpdu_count;
7745 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_MPDUS);
7746 }
7747
7748 if (link_sinfo->filled &
7749 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT)) {
7750 sinfo->fcs_err_count += link_sinfo->fcs_err_count;
7751 sinfo->filled |=
7752 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT);
7753 }
7754
7755 if (link_sinfo->filled &
7756 BIT_ULL(NL80211_STA_INFO_BEACON_RX)) {
7757 sinfo->rx_beacon += link_sinfo->rx_beacon;
7758 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
7759 }
7760
7761 /* Update MLO signal, signal_avg as best among links */
7762 if ((link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL)) &&
7763 link_sinfo->signal > sinfo->signal) {
7764 sinfo->signal = link_sinfo->signal;
7765 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
7766 }
7767
7768 if ((link_sinfo->filled &
7769 BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG)) &&
7770 link_sinfo->signal_avg > sinfo->signal_avg) {
7771 sinfo->signal_avg = link_sinfo->signal_avg;
7772 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
7773 }
7774
7775 /* Update MLO inactive_time, bss_param based on least
7776 * value for corresponding field of link.
7777 */
7778 if ((link_sinfo->filled &
7779 BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME)) &&
7780 (!init ||
7781 link_inactive_time > link_sinfo->inactive_time)) {
7782 link_inactive_time = link_sinfo->inactive_time;
7783 sinfo->inactive_time = link_sinfo->inactive_time;
7784 sinfo->filled |= NL80211_STA_INFO_INACTIVE_TIME;
7785 }
7786
7787 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM) &&
7788 (!init ||
7789 sinfo->bss_param.dtim_period >
7790 link_sinfo->bss_param.dtim_period)) {
7791 sinfo->bss_param.dtim_period =
7792 link_sinfo->bss_param.dtim_period;
7793 sinfo->filled |= NL80211_STA_BSS_PARAM_DTIM_PERIOD;
7794 sinfo->bss_param.beacon_interval =
7795 link_sinfo->bss_param.beacon_interval;
7796 sinfo->filled |= NL80211_STA_BSS_PARAM_BEACON_INTERVAL;
7797 }
7798
7799 /* Update MLO rates as per last updated link rate */
7800 if ((link_sinfo->filled &
7801 BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) &&
7802 (!init ||
7803 link_inactive_time > link_sinfo->inactive_time)) {
7804 sinfo->txrate = link_sinfo->txrate;
7805 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
7806 }
7807 if ((link_sinfo->filled &
7808 BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) &&
7809 (!init ||
7810 link_inactive_time > link_sinfo->inactive_time)) {
7811 sinfo->rxrate = link_sinfo->rxrate;
7812 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
7813 }
7814
7815 if (link_sinfo->filled &
7816 BIT_ULL(NL80211_STA_INFO_TX_DURATION) &&
7817 (!init ||
7818 link_inactive_time > link_sinfo->inactive_time)) {
7819 sinfo->tx_duration += link_sinfo->tx_duration;
7820 sinfo->filled |=
7821 BIT_ULL(NL80211_STA_INFO_TX_DURATION);
7822 }
7823 if (link_sinfo->filled &
7824 BIT_ULL(NL80211_STA_INFO_RX_DURATION) &&
7825 (!init ||
7826 link_inactive_time > link_sinfo->inactive_time)) {
7827 sinfo->rx_duration += link_sinfo->rx_duration;
7828 sinfo->filled |=
7829 BIT_ULL(NL80211_STA_INFO_RX_DURATION);
7830 }
7831 init++;
7832
7833 /* pertid stats accumulate for rx/tx fields */
7834 if (sinfo->pertid) {
7835 sinfo->pertid->rx_msdu +=
7836 link_sinfo->pertid->rx_msdu;
7837 sinfo->pertid->tx_msdu +=
7838 link_sinfo->pertid->tx_msdu;
7839 sinfo->pertid->tx_msdu_retries +=
7840 link_sinfo->pertid->tx_msdu_retries;
7841 sinfo->pertid->tx_msdu_failed +=
7842 link_sinfo->pertid->tx_msdu_failed;
7843
7844 sinfo->pertid->filled |=
7845 BIT(NL80211_TID_STATS_RX_MSDU) |
7846 BIT(NL80211_TID_STATS_TX_MSDU) |
7847 BIT(NL80211_TID_STATS_TX_MSDU_RETRIES) |
7848 BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
7849 }
7850 }
7851
7852 /* Reset sinfo->filled bits to exclude fields which don't make
7853 * much sense at the MLO level.
7854 */
7855 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
7856 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
7857 }
7858
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)7859 static int nl80211_dump_station(struct sk_buff *skb,
7860 struct netlink_callback *cb)
7861 {
7862 struct station_info sinfo;
7863 struct cfg80211_registered_device *rdev;
7864 struct wireless_dev *wdev;
7865 u8 mac_addr[ETH_ALEN];
7866 int sta_idx = cb->args[2];
7867 bool sinfo_alloc = false;
7868 int err, i;
7869
7870 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7871 if (err)
7872 return err;
7873 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7874 __acquire(&rdev->wiphy.mtx);
7875
7876 if (!wdev->netdev) {
7877 err = -EINVAL;
7878 goto out_err;
7879 }
7880
7881 if (!rdev->ops->dump_station) {
7882 err = -EOPNOTSUPP;
7883 goto out_err;
7884 }
7885
7886 while (1) {
7887 memset(&sinfo, 0, sizeof(sinfo));
7888
7889 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7890 sinfo.links[i] =
7891 kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7892 if (!sinfo.links[i]) {
7893 err = -ENOMEM;
7894 goto out_err;
7895 }
7896 sinfo_alloc = true;
7897 }
7898
7899 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
7900 mac_addr, &sinfo);
7901 if (err == -ENOENT)
7902 break;
7903 if (err)
7904 goto out_err;
7905
7906 if (sinfo.valid_links)
7907 cfg80211_sta_set_mld_sinfo(&sinfo);
7908
7909 /* reset the sinfo_alloc flag as nl80211_send_station()
7910 * always releases sinfo
7911 */
7912 sinfo_alloc = false;
7913
7914 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
7915 NETLINK_CB(cb->skb).portid,
7916 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7917 rdev, wdev->netdev, mac_addr,
7918 &sinfo, false) < 0)
7919 goto out;
7920
7921 sta_idx++;
7922 }
7923
7924 out:
7925 cb->args[2] = sta_idx;
7926 err = skb->len;
7927 out_err:
7928 if (sinfo_alloc)
7929 cfg80211_sinfo_release_content(&sinfo);
7930 wiphy_unlock(&rdev->wiphy);
7931
7932 return err;
7933 }
7934
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)7935 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
7936 {
7937 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7938 struct net_device *dev = info->user_ptr[1];
7939 struct station_info sinfo;
7940 struct sk_buff *msg;
7941 u8 *mac_addr = NULL;
7942 int err, i;
7943
7944 memset(&sinfo, 0, sizeof(sinfo));
7945
7946 if (!info->attrs[NL80211_ATTR_MAC])
7947 return -EINVAL;
7948
7949 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7950
7951 if (!rdev->ops->get_station)
7952 return -EOPNOTSUPP;
7953
7954 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7955 sinfo.links[i] = kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7956 if (!sinfo.links[i]) {
7957 cfg80211_sinfo_release_content(&sinfo);
7958 return -ENOMEM;
7959 }
7960 }
7961
7962 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7963 if (err) {
7964 cfg80211_sinfo_release_content(&sinfo);
7965 return err;
7966 }
7967
7968 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7969 if (!msg) {
7970 cfg80211_sinfo_release_content(&sinfo);
7971 return -ENOMEM;
7972 }
7973
7974 if (sinfo.valid_links)
7975 cfg80211_sta_set_mld_sinfo(&sinfo);
7976
7977 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7978 info->snd_portid, info->snd_seq, 0,
7979 rdev, dev, mac_addr, &sinfo, false) < 0) {
7980 nlmsg_free(msg);
7981 return -ENOBUFS;
7982 }
7983
7984 return genlmsg_reply(msg, info);
7985 }
7986
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)7987 int cfg80211_check_station_change(struct wiphy *wiphy,
7988 struct station_parameters *params,
7989 enum cfg80211_station_type statype)
7990 {
7991 if (params->listen_interval != -1 &&
7992 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7993 return -EINVAL;
7994
7995 if (params->support_p2p_ps != -1 &&
7996 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7997 return -EINVAL;
7998
7999 if (params->aid &&
8000 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
8001 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
8002 return -EINVAL;
8003
8004 /* When you run into this, adjust the code below for the new flag */
8005 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8006
8007 switch (statype) {
8008 case CFG80211_STA_MESH_PEER_KERNEL:
8009 case CFG80211_STA_MESH_PEER_USER:
8010 /*
8011 * No ignoring the TDLS flag here -- the userspace mesh
8012 * code doesn't have the bug of including TDLS in the
8013 * mask everywhere.
8014 */
8015 if (params->sta_flags_mask &
8016 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8017 BIT(NL80211_STA_FLAG_MFP) |
8018 BIT(NL80211_STA_FLAG_AUTHORIZED)))
8019 return -EINVAL;
8020 break;
8021 case CFG80211_STA_TDLS_PEER_SETUP:
8022 case CFG80211_STA_TDLS_PEER_ACTIVE:
8023 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8024 return -EINVAL;
8025 /* ignore since it can't change */
8026 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8027 break;
8028 default:
8029 /* disallow mesh-specific things */
8030 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
8031 return -EINVAL;
8032 if (params->local_pm)
8033 return -EINVAL;
8034 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8035 return -EINVAL;
8036 }
8037
8038 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8039 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
8040 /* TDLS can't be set, ... */
8041 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
8042 return -EINVAL;
8043 /*
8044 * ... but don't bother the driver with it. This works around
8045 * a hostapd/wpa_supplicant issue -- it always includes the
8046 * TLDS_PEER flag in the mask even for AP mode.
8047 */
8048 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8049 }
8050
8051 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8052 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8053 /* reject other things that can't change */
8054 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
8055 return -EINVAL;
8056 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
8057 return -EINVAL;
8058 if (params->link_sta_params.supported_rates)
8059 return -EINVAL;
8060 if (params->ext_capab || params->link_sta_params.ht_capa ||
8061 params->link_sta_params.vht_capa ||
8062 params->link_sta_params.he_capa ||
8063 params->link_sta_params.eht_capa)
8064 return -EINVAL;
8065 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8066 return -EINVAL;
8067 }
8068
8069 if (statype != CFG80211_STA_AP_CLIENT &&
8070 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8071 if (params->vlan)
8072 return -EINVAL;
8073 }
8074
8075 /* Accept EMLSR capabilities only for AP client before association */
8076 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8077 params->eml_cap_present)
8078 return -EINVAL;
8079
8080 switch (statype) {
8081 case CFG80211_STA_AP_MLME_CLIENT:
8082 /* Use this only for authorizing/unauthorizing a station */
8083 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
8084 return -EOPNOTSUPP;
8085 break;
8086 case CFG80211_STA_AP_CLIENT:
8087 case CFG80211_STA_AP_CLIENT_UNASSOC:
8088 /* accept only the listed bits */
8089 if (params->sta_flags_mask &
8090 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8091 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8092 BIT(NL80211_STA_FLAG_ASSOCIATED) |
8093 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
8094 BIT(NL80211_STA_FLAG_WME) |
8095 BIT(NL80211_STA_FLAG_MFP) |
8096 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
8097 return -EINVAL;
8098
8099 /* but authenticated/associated only if driver handles it */
8100 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8101 params->sta_flags_mask &
8102 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8103 BIT(NL80211_STA_FLAG_ASSOCIATED)))
8104 return -EINVAL;
8105 break;
8106 case CFG80211_STA_IBSS:
8107 case CFG80211_STA_AP_STA:
8108 /* reject any changes other than AUTHORIZED */
8109 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
8110 return -EINVAL;
8111 break;
8112 case CFG80211_STA_TDLS_PEER_SETUP:
8113 /* reject any changes other than AUTHORIZED or WME */
8114 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8115 BIT(NL80211_STA_FLAG_WME)))
8116 return -EINVAL;
8117 /* force (at least) rates when authorizing */
8118 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
8119 !params->link_sta_params.supported_rates)
8120 return -EINVAL;
8121 break;
8122 case CFG80211_STA_TDLS_PEER_ACTIVE:
8123 /* reject any changes */
8124 return -EINVAL;
8125 case CFG80211_STA_MESH_PEER_KERNEL:
8126 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8127 return -EINVAL;
8128 break;
8129 case CFG80211_STA_MESH_PEER_USER:
8130 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
8131 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
8132 return -EINVAL;
8133 break;
8134 }
8135
8136 /*
8137 * Older kernel versions ignored this attribute entirely, so don't
8138 * reject attempts to update it but mark it as unused instead so the
8139 * driver won't look at the data.
8140 */
8141 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8142 statype != CFG80211_STA_TDLS_PEER_SETUP)
8143 params->link_sta_params.opmode_notif_used = false;
8144
8145 return 0;
8146 }
8147 EXPORT_SYMBOL(cfg80211_check_station_change);
8148
8149 /*
8150 * Get vlan interface making sure it is running and on the right wiphy.
8151 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)8152 static struct net_device *get_vlan(struct genl_info *info,
8153 struct cfg80211_registered_device *rdev)
8154 {
8155 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
8156 struct net_device *v;
8157 int ret;
8158
8159 if (!vlanattr)
8160 return NULL;
8161
8162 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
8163 if (!v)
8164 return ERR_PTR(-ENODEV);
8165
8166 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
8167 ret = -EINVAL;
8168 goto error;
8169 }
8170
8171 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
8172 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8173 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
8174 ret = -EINVAL;
8175 goto error;
8176 }
8177
8178 if (!netif_running(v)) {
8179 ret = -ENETDOWN;
8180 goto error;
8181 }
8182
8183 return v;
8184 error:
8185 dev_put(v);
8186 return ERR_PTR(ret);
8187 }
8188
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)8189 static int nl80211_parse_sta_wme(struct genl_info *info,
8190 struct station_parameters *params)
8191 {
8192 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
8193 struct nlattr *nla;
8194 int err;
8195
8196 /* parse WME attributes if present */
8197 if (!info->attrs[NL80211_ATTR_STA_WME])
8198 return 0;
8199
8200 nla = info->attrs[NL80211_ATTR_STA_WME];
8201 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
8202 nl80211_sta_wme_policy,
8203 info->extack);
8204 if (err)
8205 return err;
8206
8207 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
8208 params->uapsd_queues = nla_get_u8(
8209 tb[NL80211_STA_WME_UAPSD_QUEUES]);
8210 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
8211 return -EINVAL;
8212
8213 if (tb[NL80211_STA_WME_MAX_SP])
8214 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
8215
8216 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
8217 return -EINVAL;
8218
8219 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
8220
8221 return 0;
8222 }
8223
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)8224 static int nl80211_parse_sta_channel_info(struct genl_info *info,
8225 struct station_parameters *params)
8226 {
8227 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
8228 params->supported_channels =
8229 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8230 params->supported_channels_len =
8231 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8232 /*
8233 * Need to include at least one (first channel, number of
8234 * channels) tuple for each subband (checked in policy),
8235 * and must have proper tuples for the rest of the data as well.
8236 */
8237 if (params->supported_channels_len % 2)
8238 return -EINVAL;
8239 }
8240
8241 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
8242 params->supported_oper_classes =
8243 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8244 params->supported_oper_classes_len =
8245 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8246 }
8247 return 0;
8248 }
8249
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)8250 static int nl80211_set_station_tdls(struct genl_info *info,
8251 struct station_parameters *params)
8252 {
8253 int err;
8254 /* Dummy STA entry gets updated once the peer capabilities are known */
8255 if (info->attrs[NL80211_ATTR_PEER_AID])
8256 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8257 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8258 params->link_sta_params.ht_capa =
8259 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8260 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8261 params->link_sta_params.vht_capa =
8262 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8263 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8264 params->link_sta_params.he_capa =
8265 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8266 params->link_sta_params.he_capa_len =
8267 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8268
8269 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8270 params->link_sta_params.eht_capa =
8271 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8272 params->link_sta_params.eht_capa_len =
8273 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8274
8275 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
8276 (const u8 *)params->link_sta_params.eht_capa,
8277 params->link_sta_params.eht_capa_len,
8278 false))
8279 return -EINVAL;
8280 }
8281 }
8282
8283 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8284 params->link_sta_params.s1g_capa =
8285 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8286
8287 err = nl80211_parse_sta_channel_info(info, params);
8288 if (err)
8289 return err;
8290
8291 return nl80211_parse_sta_wme(info, params);
8292 }
8293
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)8294 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
8295 struct sta_txpwr *txpwr,
8296 bool *txpwr_set)
8297 {
8298 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8299 int idx;
8300
8301 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
8302 if (!rdev->ops->set_tx_power ||
8303 !wiphy_ext_feature_isset(&rdev->wiphy,
8304 NL80211_EXT_FEATURE_STA_TX_PWR))
8305 return -EOPNOTSUPP;
8306
8307 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
8308 txpwr->type = nla_get_u8(info->attrs[idx]);
8309
8310 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
8311 idx = NL80211_ATTR_STA_TX_POWER;
8312
8313 if (info->attrs[idx])
8314 txpwr->power = nla_get_s16(info->attrs[idx]);
8315 else
8316 return -EINVAL;
8317 }
8318
8319 *txpwr_set = true;
8320 } else {
8321 *txpwr_set = false;
8322 }
8323
8324 return 0;
8325 }
8326
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)8327 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
8328 {
8329 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8330 struct net_device *dev = info->user_ptr[1];
8331 struct station_parameters params;
8332 u8 *mac_addr;
8333 int err;
8334
8335 memset(¶ms, 0, sizeof(params));
8336
8337 if (!rdev->ops->change_station)
8338 return -EOPNOTSUPP;
8339
8340 /*
8341 * AID and listen_interval properties can be set only for unassociated
8342 * station. Include these parameters here and will check them in
8343 * cfg80211_check_station_change().
8344 */
8345 if (info->attrs[NL80211_ATTR_STA_AID])
8346 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8347
8348 if (info->attrs[NL80211_ATTR_VLAN_ID])
8349 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8350
8351 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8352 params.listen_interval =
8353 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8354 else
8355 params.listen_interval = -1;
8356
8357 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
8358 params.support_p2p_ps =
8359 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8360 else
8361 params.support_p2p_ps = -1;
8362
8363 if (!info->attrs[NL80211_ATTR_MAC])
8364 return -EINVAL;
8365
8366 params.link_sta_params.link_id =
8367 nl80211_link_id_or_invalid(info->attrs);
8368
8369 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8370 /* If MLD_ADDR attribute is set then this is an MLD station
8371 * and the MLD_ADDR attribute holds the MLD address and the
8372 * MAC attribute holds for the LINK address.
8373 * In that case, the link_id is also expected to be valid.
8374 */
8375 if (params.link_sta_params.link_id < 0)
8376 return -EINVAL;
8377
8378 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8379 params.link_sta_params.mld_mac = mac_addr;
8380 params.link_sta_params.link_mac =
8381 nla_data(info->attrs[NL80211_ATTR_MAC]);
8382 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8383 return -EINVAL;
8384 } else {
8385 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8386 }
8387
8388
8389 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
8390 params.link_sta_params.supported_rates =
8391 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8392 params.link_sta_params.supported_rates_len =
8393 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8394 }
8395
8396 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8397 params.capability =
8398 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8399 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8400 }
8401
8402 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8403 params.ext_capab =
8404 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8405 params.ext_capab_len =
8406 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8407 }
8408
8409 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8410 return -EINVAL;
8411
8412 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8413 params.plink_action =
8414 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8415
8416 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
8417 params.plink_state =
8418 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
8419 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
8420 params.peer_aid = nla_get_u16(
8421 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
8422 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
8423 }
8424
8425 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
8426 params.local_pm = nla_get_u32(
8427 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
8428
8429 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8430 params.link_sta_params.opmode_notif_used = true;
8431 params.link_sta_params.opmode_notif =
8432 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8433 }
8434
8435 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8436 params.link_sta_params.he_6ghz_capa =
8437 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8438
8439 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8440 params.eml_cap_present = true;
8441 params.eml_cap =
8442 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8443 }
8444
8445 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8446 params.airtime_weight =
8447 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8448
8449 if (params.airtime_weight &&
8450 !wiphy_ext_feature_isset(&rdev->wiphy,
8451 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8452 return -EOPNOTSUPP;
8453
8454 err = nl80211_parse_sta_txpower_setting(info,
8455 ¶ms.link_sta_params.txpwr,
8456 ¶ms.link_sta_params.txpwr_set);
8457 if (err)
8458 return err;
8459
8460 /* Include parameters for TDLS peer (will check later) */
8461 err = nl80211_set_station_tdls(info, ¶ms);
8462 if (err)
8463 return err;
8464
8465 params.vlan = get_vlan(info, rdev);
8466 if (IS_ERR(params.vlan))
8467 return PTR_ERR(params.vlan);
8468
8469 switch (dev->ieee80211_ptr->iftype) {
8470 case NL80211_IFTYPE_AP:
8471 case NL80211_IFTYPE_AP_VLAN:
8472 case NL80211_IFTYPE_P2P_GO:
8473 case NL80211_IFTYPE_P2P_CLIENT:
8474 case NL80211_IFTYPE_STATION:
8475 case NL80211_IFTYPE_ADHOC:
8476 case NL80211_IFTYPE_MESH_POINT:
8477 break;
8478 default:
8479 err = -EOPNOTSUPP;
8480 goto out_put_vlan;
8481 }
8482
8483 /* driver will call cfg80211_check_station_change() */
8484 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
8485
8486 out_put_vlan:
8487 dev_put(params.vlan);
8488
8489 return err;
8490 }
8491
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)8492 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
8493 {
8494 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8495 int err;
8496 struct net_device *dev = info->user_ptr[1];
8497 struct wireless_dev *wdev = dev->ieee80211_ptr;
8498 struct station_parameters params;
8499 u8 *mac_addr = NULL;
8500 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8501 BIT(NL80211_STA_FLAG_ASSOCIATED);
8502
8503 memset(¶ms, 0, sizeof(params));
8504
8505 if (!rdev->ops->add_station)
8506 return -EOPNOTSUPP;
8507
8508 if (!info->attrs[NL80211_ATTR_MAC])
8509 return -EINVAL;
8510
8511 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8512 return -EINVAL;
8513
8514 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
8515 return -EINVAL;
8516
8517 if (!info->attrs[NL80211_ATTR_STA_AID] &&
8518 !info->attrs[NL80211_ATTR_PEER_AID])
8519 return -EINVAL;
8520
8521 params.link_sta_params.link_id =
8522 nl80211_link_id_or_invalid(info->attrs);
8523
8524 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8525 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8526 params.link_sta_params.mld_mac = mac_addr;
8527 params.link_sta_params.link_mac =
8528 nla_data(info->attrs[NL80211_ATTR_MAC]);
8529 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8530 return -EINVAL;
8531 } else {
8532 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8533 }
8534
8535 params.link_sta_params.supported_rates =
8536 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8537 params.link_sta_params.supported_rates_len =
8538 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8539 params.listen_interval =
8540 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8541
8542 if (info->attrs[NL80211_ATTR_VLAN_ID])
8543 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8544
8545 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
8546 params.support_p2p_ps =
8547 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8548 } else {
8549 /*
8550 * if not specified, assume it's supported for P2P GO interface,
8551 * and is NOT supported for AP interface
8552 */
8553 params.support_p2p_ps =
8554 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
8555 }
8556
8557 if (info->attrs[NL80211_ATTR_PEER_AID])
8558 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8559 else
8560 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8561
8562 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8563 params.capability =
8564 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8565 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8566 }
8567
8568 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8569 params.ext_capab =
8570 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8571 params.ext_capab_len =
8572 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8573 }
8574
8575 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8576 params.link_sta_params.ht_capa =
8577 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8578
8579 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8580 params.link_sta_params.vht_capa =
8581 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8582
8583 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8584 params.link_sta_params.he_capa =
8585 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8586 params.link_sta_params.he_capa_len =
8587 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8588
8589 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8590 params.link_sta_params.eht_capa =
8591 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8592 params.link_sta_params.eht_capa_len =
8593 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8594
8595 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
8596 (const u8 *)params.link_sta_params.eht_capa,
8597 params.link_sta_params.eht_capa_len,
8598 false))
8599 return -EINVAL;
8600 }
8601 }
8602
8603 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8604 params.eml_cap_present = true;
8605 params.eml_cap =
8606 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8607 }
8608
8609 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8610 params.link_sta_params.he_6ghz_capa =
8611 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8612
8613 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8614 params.link_sta_params.s1g_capa =
8615 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8616
8617 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8618 params.link_sta_params.opmode_notif_used = true;
8619 params.link_sta_params.opmode_notif =
8620 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8621 }
8622
8623 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8624 params.plink_action =
8625 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8626
8627 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8628 params.airtime_weight =
8629 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8630
8631 if (params.airtime_weight &&
8632 !wiphy_ext_feature_isset(&rdev->wiphy,
8633 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8634 return -EOPNOTSUPP;
8635
8636 err = nl80211_parse_sta_txpower_setting(info,
8637 ¶ms.link_sta_params.txpwr,
8638 ¶ms.link_sta_params.txpwr_set);
8639 if (err)
8640 return err;
8641
8642 err = nl80211_parse_sta_channel_info(info, ¶ms);
8643 if (err)
8644 return err;
8645
8646 err = nl80211_parse_sta_wme(info, ¶ms);
8647 if (err)
8648 return err;
8649
8650 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8651 return -EINVAL;
8652
8653 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
8654 * as userspace might just pass through the capabilities from the IEs
8655 * directly, rather than enforcing this restriction and returning an
8656 * error in this case.
8657 */
8658 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
8659 params.link_sta_params.ht_capa = NULL;
8660 params.link_sta_params.vht_capa = NULL;
8661
8662 /* HE and EHT require WME */
8663 if (params.link_sta_params.he_capa_len ||
8664 params.link_sta_params.he_6ghz_capa ||
8665 params.link_sta_params.eht_capa_len)
8666 return -EINVAL;
8667 }
8668
8669 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
8670 if (params.link_sta_params.he_6ghz_capa &&
8671 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
8672 return -EINVAL;
8673
8674 /* When you run into this, adjust the code below for the new flag */
8675 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8676
8677 switch (dev->ieee80211_ptr->iftype) {
8678 case NL80211_IFTYPE_AP:
8679 case NL80211_IFTYPE_AP_VLAN:
8680 case NL80211_IFTYPE_P2P_GO:
8681 /* ignore WME attributes if iface/sta is not capable */
8682 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
8683 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
8684 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8685
8686 /* TDLS peers cannot be added */
8687 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8688 info->attrs[NL80211_ATTR_PEER_AID])
8689 return -EINVAL;
8690 /* but don't bother the driver with it */
8691 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8692
8693 /* allow authenticated/associated only if driver handles it */
8694 if (!(rdev->wiphy.features &
8695 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8696 params.sta_flags_mask & auth_assoc)
8697 return -EINVAL;
8698
8699 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8700 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
8701 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8702 return -EINVAL;
8703
8704 /* Older userspace, or userspace wanting to be compatible with
8705 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
8706 * and assoc flags in the mask, but assumes the station will be
8707 * added as associated anyway since this was the required driver
8708 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
8709 * introduced.
8710 * In order to not bother drivers with this quirk in the API
8711 * set the flags in both the mask and set for new stations in
8712 * this case.
8713 */
8714 if (!(params.sta_flags_mask & auth_assoc)) {
8715 params.sta_flags_mask |= auth_assoc;
8716 params.sta_flags_set |= auth_assoc;
8717 }
8718
8719 /* must be last in here for error handling */
8720 params.vlan = get_vlan(info, rdev);
8721 if (IS_ERR(params.vlan))
8722 return PTR_ERR(params.vlan);
8723 break;
8724 case NL80211_IFTYPE_MESH_POINT:
8725 /* ignore uAPSD data */
8726 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8727
8728 /* associated is disallowed */
8729 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
8730 return -EINVAL;
8731 /* TDLS peers cannot be added */
8732 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8733 info->attrs[NL80211_ATTR_PEER_AID])
8734 return -EINVAL;
8735 break;
8736 case NL80211_IFTYPE_STATION:
8737 case NL80211_IFTYPE_P2P_CLIENT:
8738 /* ignore uAPSD data */
8739 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8740
8741 /* these are disallowed */
8742 if (params.sta_flags_mask &
8743 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
8744 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
8745 return -EINVAL;
8746 /* Only TDLS peers can be added */
8747 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8748 return -EINVAL;
8749 /* Can only add if TDLS ... */
8750 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
8751 return -EOPNOTSUPP;
8752 /* ... with external setup is supported */
8753 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
8754 return -EOPNOTSUPP;
8755 /*
8756 * Older wpa_supplicant versions always mark the TDLS peer
8757 * as authorized, but it shouldn't yet be.
8758 */
8759 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
8760 break;
8761 default:
8762 return -EOPNOTSUPP;
8763 }
8764
8765 /* be aware of params.vlan when changing code here */
8766
8767 if (wdev->valid_links) {
8768 if (params.link_sta_params.link_id < 0) {
8769 err = -EINVAL;
8770 goto out;
8771 }
8772 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
8773 err = -ENOLINK;
8774 goto out;
8775 }
8776 } else {
8777 if (params.link_sta_params.link_id >= 0) {
8778 err = -EINVAL;
8779 goto out;
8780 }
8781 }
8782 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
8783 out:
8784 dev_put(params.vlan);
8785 return err;
8786 }
8787
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)8788 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
8789 {
8790 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8791 struct net_device *dev = info->user_ptr[1];
8792 struct wireless_dev *wdev = dev->ieee80211_ptr;
8793 struct station_del_parameters params;
8794 int link_id = nl80211_link_id_or_invalid(info->attrs);
8795
8796 memset(¶ms, 0, sizeof(params));
8797
8798 if (info->attrs[NL80211_ATTR_MAC])
8799 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
8800
8801 switch (wdev->iftype) {
8802 case NL80211_IFTYPE_AP:
8803 case NL80211_IFTYPE_AP_VLAN:
8804 case NL80211_IFTYPE_MESH_POINT:
8805 case NL80211_IFTYPE_P2P_GO:
8806 /* always accept these */
8807 break;
8808 case NL80211_IFTYPE_ADHOC:
8809 /* conditionally accept */
8810 if (wiphy_ext_feature_isset(&rdev->wiphy,
8811 NL80211_EXT_FEATURE_DEL_IBSS_STA))
8812 break;
8813 return -EINVAL;
8814 default:
8815 return -EINVAL;
8816 }
8817
8818 if (!rdev->ops->del_station)
8819 return -EOPNOTSUPP;
8820
8821 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
8822 params.subtype =
8823 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
8824 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
8825 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
8826 return -EINVAL;
8827 } else {
8828 /* Default to Deauthentication frame */
8829 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
8830 }
8831
8832 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
8833 params.reason_code =
8834 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8835 if (params.reason_code == 0)
8836 return -EINVAL; /* 0 is reserved */
8837 } else {
8838 /* Default to reason code 2 */
8839 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
8840 }
8841
8842 /* Link ID not expected in case of non-ML operation */
8843 if (!wdev->valid_links && link_id != -1)
8844 return -EINVAL;
8845
8846 /* If given, a valid link ID should be passed during MLO */
8847 if (wdev->valid_links && link_id >= 0 &&
8848 !(wdev->valid_links & BIT(link_id)))
8849 return -EINVAL;
8850
8851 params.link_id = link_id;
8852
8853 return rdev_del_station(rdev, dev, ¶ms);
8854 }
8855
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)8856 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
8857 int flags, struct net_device *dev,
8858 u8 *dst, u8 *next_hop,
8859 struct mpath_info *pinfo)
8860 {
8861 void *hdr;
8862 struct nlattr *pinfoattr;
8863
8864 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
8865 if (!hdr)
8866 return -1;
8867
8868 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8869 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
8870 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
8871 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
8872 goto nla_put_failure;
8873
8874 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
8875 if (!pinfoattr)
8876 goto nla_put_failure;
8877 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
8878 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
8879 pinfo->frame_qlen))
8880 goto nla_put_failure;
8881 if (((pinfo->filled & MPATH_INFO_SN) &&
8882 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
8883 ((pinfo->filled & MPATH_INFO_METRIC) &&
8884 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
8885 pinfo->metric)) ||
8886 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
8887 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
8888 pinfo->exptime)) ||
8889 ((pinfo->filled & MPATH_INFO_FLAGS) &&
8890 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
8891 pinfo->flags)) ||
8892 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
8893 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
8894 pinfo->discovery_timeout)) ||
8895 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
8896 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
8897 pinfo->discovery_retries)) ||
8898 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
8899 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
8900 pinfo->hop_count)) ||
8901 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
8902 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
8903 pinfo->path_change_count)))
8904 goto nla_put_failure;
8905
8906 nla_nest_end(msg, pinfoattr);
8907
8908 genlmsg_end(msg, hdr);
8909 return 0;
8910
8911 nla_put_failure:
8912 genlmsg_cancel(msg, hdr);
8913 return -EMSGSIZE;
8914 }
8915
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)8916 static int nl80211_dump_mpath(struct sk_buff *skb,
8917 struct netlink_callback *cb)
8918 {
8919 struct mpath_info pinfo;
8920 struct cfg80211_registered_device *rdev;
8921 struct wireless_dev *wdev;
8922 u8 dst[ETH_ALEN];
8923 u8 next_hop[ETH_ALEN];
8924 int path_idx = cb->args[2];
8925 int err;
8926
8927 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8928 if (err)
8929 return err;
8930 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8931 __acquire(&rdev->wiphy.mtx);
8932
8933 if (!rdev->ops->dump_mpath) {
8934 err = -EOPNOTSUPP;
8935 goto out_err;
8936 }
8937
8938 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8939 err = -EOPNOTSUPP;
8940 goto out_err;
8941 }
8942
8943 while (1) {
8944 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
8945 next_hop, &pinfo);
8946 if (err == -ENOENT)
8947 break;
8948 if (err)
8949 goto out_err;
8950
8951 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8952 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8953 wdev->netdev, dst, next_hop,
8954 &pinfo) < 0)
8955 goto out;
8956
8957 path_idx++;
8958 }
8959
8960 out:
8961 cb->args[2] = path_idx;
8962 err = skb->len;
8963 out_err:
8964 wiphy_unlock(&rdev->wiphy);
8965 return err;
8966 }
8967
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)8968 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
8969 {
8970 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8971 int err;
8972 struct net_device *dev = info->user_ptr[1];
8973 struct mpath_info pinfo;
8974 struct sk_buff *msg;
8975 u8 *dst = NULL;
8976 u8 next_hop[ETH_ALEN];
8977
8978 memset(&pinfo, 0, sizeof(pinfo));
8979
8980 if (!info->attrs[NL80211_ATTR_MAC])
8981 return -EINVAL;
8982
8983 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8984
8985 if (!rdev->ops->get_mpath)
8986 return -EOPNOTSUPP;
8987
8988 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8989 return -EOPNOTSUPP;
8990
8991 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8992 if (err)
8993 return err;
8994
8995 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8996 if (!msg)
8997 return -ENOMEM;
8998
8999 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
9000 dev, dst, next_hop, &pinfo) < 0) {
9001 nlmsg_free(msg);
9002 return -ENOBUFS;
9003 }
9004
9005 return genlmsg_reply(msg, info);
9006 }
9007
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)9008 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
9009 {
9010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9011 struct net_device *dev = info->user_ptr[1];
9012 u8 *dst = NULL;
9013 u8 *next_hop = NULL;
9014
9015 if (!info->attrs[NL80211_ATTR_MAC])
9016 return -EINVAL;
9017
9018 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9019 return -EINVAL;
9020
9021 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9022 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9023
9024 if (!rdev->ops->change_mpath)
9025 return -EOPNOTSUPP;
9026
9027 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9028 return -EOPNOTSUPP;
9029
9030 return rdev_change_mpath(rdev, dev, dst, next_hop);
9031 }
9032
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)9033 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
9034 {
9035 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9036 struct net_device *dev = info->user_ptr[1];
9037 u8 *dst = NULL;
9038 u8 *next_hop = NULL;
9039
9040 if (!info->attrs[NL80211_ATTR_MAC])
9041 return -EINVAL;
9042
9043 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9044 return -EINVAL;
9045
9046 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9047 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9048
9049 if (!rdev->ops->add_mpath)
9050 return -EOPNOTSUPP;
9051
9052 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9053 return -EOPNOTSUPP;
9054
9055 return rdev_add_mpath(rdev, dev, dst, next_hop);
9056 }
9057
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)9058 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
9059 {
9060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9061 struct net_device *dev = info->user_ptr[1];
9062 u8 *dst = NULL;
9063
9064 if (info->attrs[NL80211_ATTR_MAC])
9065 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9066
9067 if (!rdev->ops->del_mpath)
9068 return -EOPNOTSUPP;
9069
9070 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9071 return -EOPNOTSUPP;
9072
9073 return rdev_del_mpath(rdev, dev, dst);
9074 }
9075
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)9076 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
9077 {
9078 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9079 int err;
9080 struct net_device *dev = info->user_ptr[1];
9081 struct mpath_info pinfo;
9082 struct sk_buff *msg;
9083 u8 *dst = NULL;
9084 u8 mpp[ETH_ALEN];
9085
9086 memset(&pinfo, 0, sizeof(pinfo));
9087
9088 if (!info->attrs[NL80211_ATTR_MAC])
9089 return -EINVAL;
9090
9091 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9092
9093 if (!rdev->ops->get_mpp)
9094 return -EOPNOTSUPP;
9095
9096 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9097 return -EOPNOTSUPP;
9098
9099 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
9100 if (err)
9101 return err;
9102
9103 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9104 if (!msg)
9105 return -ENOMEM;
9106
9107 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
9108 dev, dst, mpp, &pinfo) < 0) {
9109 nlmsg_free(msg);
9110 return -ENOBUFS;
9111 }
9112
9113 return genlmsg_reply(msg, info);
9114 }
9115
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)9116 static int nl80211_dump_mpp(struct sk_buff *skb,
9117 struct netlink_callback *cb)
9118 {
9119 struct mpath_info pinfo;
9120 struct cfg80211_registered_device *rdev;
9121 struct wireless_dev *wdev;
9122 u8 dst[ETH_ALEN];
9123 u8 mpp[ETH_ALEN];
9124 int path_idx = cb->args[2];
9125 int err;
9126
9127 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
9128 if (err)
9129 return err;
9130 /* nl80211_prepare_wdev_dump acquired it in the successful case */
9131 __acquire(&rdev->wiphy.mtx);
9132
9133 if (!rdev->ops->dump_mpp) {
9134 err = -EOPNOTSUPP;
9135 goto out_err;
9136 }
9137
9138 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
9139 err = -EOPNOTSUPP;
9140 goto out_err;
9141 }
9142
9143 while (1) {
9144 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
9145 mpp, &pinfo);
9146 if (err == -ENOENT)
9147 break;
9148 if (err)
9149 goto out_err;
9150
9151 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
9152 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9153 wdev->netdev, dst, mpp,
9154 &pinfo) < 0)
9155 goto out;
9156
9157 path_idx++;
9158 }
9159
9160 out:
9161 cb->args[2] = path_idx;
9162 err = skb->len;
9163 out_err:
9164 wiphy_unlock(&rdev->wiphy);
9165 return err;
9166 }
9167
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)9168 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
9169 {
9170 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9171 struct net_device *dev = info->user_ptr[1];
9172 struct bss_parameters params;
9173 u32 bss_param_support = rdev->wiphy.bss_param_support;
9174 u32 changed = 0;
9175 bool strict;
9176
9177 memset(¶ms, 0, sizeof(params));
9178 params.link_id = nl80211_link_id_or_invalid(info->attrs);
9179 /* default to not changing parameters */
9180 params.use_cts_prot = -1;
9181 params.use_short_preamble = -1;
9182 params.use_short_slot_time = -1;
9183 params.ap_isolate = -1;
9184 params.ht_opmode = -1;
9185 params.p2p_ctwindow = -1;
9186 params.p2p_opp_ps = -1;
9187
9188 strict = nla_get_flag(info->attrs[NL80211_ATTR_BSS_PARAM]);
9189 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) {
9190 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_CTS_PROT))
9191 return -EINVAL;
9192 params.use_cts_prot =
9193 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
9194 changed |= WIPHY_BSS_PARAM_CTS_PROT;
9195 }
9196 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) {
9197 if (strict &&
9198 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_PREAMBLE))
9199 return -EINVAL;
9200 params.use_short_preamble =
9201 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
9202 changed |= WIPHY_BSS_PARAM_SHORT_PREAMBLE;
9203 }
9204 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) {
9205 if (strict &&
9206 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_SLOT_TIME))
9207 return -EINVAL;
9208 params.use_short_slot_time =
9209 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
9210 changed |= WIPHY_BSS_PARAM_SHORT_SLOT_TIME;
9211 }
9212 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9213 if (strict &&
9214 !(bss_param_support & WIPHY_BSS_PARAM_BASIC_RATES))
9215 return -EINVAL;
9216 params.basic_rates =
9217 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9218 params.basic_rates_len =
9219 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9220 changed |= WIPHY_BSS_PARAM_BASIC_RATES;
9221 }
9222 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) {
9223 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_AP_ISOLATE))
9224 return -EINVAL;
9225 params.ap_isolate =
9226 !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
9227 changed |= WIPHY_BSS_PARAM_AP_ISOLATE;
9228 }
9229 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) {
9230 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_HT_OPMODE))
9231 return -EINVAL;
9232 params.ht_opmode =
9233 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
9234 changed |= WIPHY_BSS_PARAM_HT_OPMODE;
9235 }
9236
9237 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
9238 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9239 return -EINVAL;
9240 params.p2p_ctwindow =
9241 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
9242 if (params.p2p_ctwindow != 0 &&
9243 !(bss_param_support & WIPHY_BSS_PARAM_P2P_CTWINDOW))
9244 return -EINVAL;
9245 changed |= WIPHY_BSS_PARAM_P2P_CTWINDOW;
9246 }
9247
9248 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
9249 u8 tmp;
9250
9251 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9252 return -EINVAL;
9253 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
9254 if (tmp && !(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9255 return -EINVAL;
9256 params.p2p_opp_ps = tmp;
9257 if (params.p2p_opp_ps &&
9258 !(rdev->wiphy.bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9259 return -EINVAL;
9260 }
9261
9262 if (!rdev->ops->change_bss)
9263 return -EOPNOTSUPP;
9264
9265 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
9266 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9267 return -EOPNOTSUPP;
9268
9269 changed &= rdev->wiphy.bss_param_support;
9270 if (!changed)
9271 return 0;
9272
9273 return rdev_change_bss(rdev, dev, ¶ms);
9274 }
9275
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)9276 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
9277 {
9278 char *data = NULL;
9279 bool is_indoor;
9280 enum nl80211_user_reg_hint_type user_reg_hint_type;
9281 u32 owner_nlportid;
9282
9283 /*
9284 * You should only get this when cfg80211 hasn't yet initialized
9285 * completely when built-in to the kernel right between the time
9286 * window between nl80211_init() and regulatory_init(), if that is
9287 * even possible.
9288 */
9289 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
9290 return -EINPROGRESS;
9291
9292 user_reg_hint_type =
9293 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
9294 NL80211_USER_REG_HINT_USER);
9295
9296 switch (user_reg_hint_type) {
9297 case NL80211_USER_REG_HINT_USER:
9298 case NL80211_USER_REG_HINT_CELL_BASE:
9299 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
9300 return -EINVAL;
9301
9302 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9303 return regulatory_hint_user(data, user_reg_hint_type);
9304 case NL80211_USER_REG_HINT_INDOOR:
9305 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9306 owner_nlportid = info->snd_portid;
9307 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
9308 } else {
9309 owner_nlportid = 0;
9310 is_indoor = true;
9311 }
9312
9313 regulatory_hint_indoor(is_indoor, owner_nlportid);
9314 return 0;
9315 default:
9316 return -EINVAL;
9317 }
9318 }
9319
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)9320 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
9321 {
9322 return reg_reload_regdb();
9323 }
9324
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)9325 static int nl80211_get_mesh_config(struct sk_buff *skb,
9326 struct genl_info *info)
9327 {
9328 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9329 struct net_device *dev = info->user_ptr[1];
9330 struct wireless_dev *wdev = dev->ieee80211_ptr;
9331 struct mesh_config cur_params;
9332 int err = 0;
9333 void *hdr;
9334 struct nlattr *pinfoattr;
9335 struct sk_buff *msg;
9336
9337 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9338 return -EOPNOTSUPP;
9339
9340 if (!rdev->ops->get_mesh_config)
9341 return -EOPNOTSUPP;
9342
9343 /* If not connected, get default parameters */
9344 if (!wdev->u.mesh.id_len)
9345 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
9346 else
9347 err = rdev_get_mesh_config(rdev, dev, &cur_params);
9348
9349 if (err)
9350 return err;
9351
9352 /* Draw up a netlink message to send back */
9353 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9354 if (!msg)
9355 return -ENOMEM;
9356 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9357 NL80211_CMD_GET_MESH_CONFIG);
9358 if (!hdr)
9359 goto out;
9360 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
9361 if (!pinfoattr)
9362 goto nla_put_failure;
9363 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9364 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
9365 cur_params.dot11MeshRetryTimeout) ||
9366 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
9367 cur_params.dot11MeshConfirmTimeout) ||
9368 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
9369 cur_params.dot11MeshHoldingTimeout) ||
9370 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
9371 cur_params.dot11MeshMaxPeerLinks) ||
9372 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
9373 cur_params.dot11MeshMaxRetries) ||
9374 nla_put_u8(msg, NL80211_MESHCONF_TTL,
9375 cur_params.dot11MeshTTL) ||
9376 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
9377 cur_params.element_ttl) ||
9378 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9379 cur_params.auto_open_plinks) ||
9380 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9381 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
9382 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9383 cur_params.dot11MeshHWMPmaxPREQretries) ||
9384 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
9385 cur_params.path_refresh_time) ||
9386 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9387 cur_params.min_discovery_timeout) ||
9388 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9389 cur_params.dot11MeshHWMPactivePathTimeout) ||
9390 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9391 cur_params.dot11MeshHWMPpreqMinInterval) ||
9392 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9393 cur_params.dot11MeshHWMPperrMinInterval) ||
9394 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9395 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
9396 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
9397 cur_params.dot11MeshHWMPRootMode) ||
9398 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9399 cur_params.dot11MeshHWMPRannInterval) ||
9400 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9401 cur_params.dot11MeshGateAnnouncementProtocol) ||
9402 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
9403 cur_params.dot11MeshForwarding) ||
9404 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
9405 cur_params.rssi_threshold) ||
9406 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
9407 cur_params.ht_opmode) ||
9408 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9409 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
9410 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9411 cur_params.dot11MeshHWMProotInterval) ||
9412 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9413 cur_params.dot11MeshHWMPconfirmationInterval) ||
9414 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
9415 cur_params.power_mode) ||
9416 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
9417 cur_params.dot11MeshAwakeWindowDuration) ||
9418 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
9419 cur_params.plink_timeout) ||
9420 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
9421 cur_params.dot11MeshConnectedToMeshGate) ||
9422 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
9423 cur_params.dot11MeshNolearn) ||
9424 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
9425 cur_params.dot11MeshConnectedToAuthServer))
9426 goto nla_put_failure;
9427 nla_nest_end(msg, pinfoattr);
9428 genlmsg_end(msg, hdr);
9429 return genlmsg_reply(msg, info);
9430
9431 nla_put_failure:
9432 out:
9433 nlmsg_free(msg);
9434 return -ENOBUFS;
9435 }
9436
9437 static const struct nla_policy
9438 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
9439 [NL80211_MESHCONF_RETRY_TIMEOUT] =
9440 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9441 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
9442 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9443 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
9444 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9445 [NL80211_MESHCONF_MAX_PEER_LINKS] =
9446 NLA_POLICY_RANGE(NLA_U16, 0, 255),
9447 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
9448 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9449 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9450 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
9451 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
9452 NLA_POLICY_RANGE(NLA_U32, 1, 255),
9453 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
9454 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
9455 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
9456 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
9457 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
9458 NLA_POLICY_MIN(NLA_U16, 1),
9459 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
9460 NLA_POLICY_MIN(NLA_U16, 1),
9461 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
9462 NLA_POLICY_MIN(NLA_U16, 1),
9463 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
9464 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
9465 NLA_POLICY_MIN(NLA_U16, 1),
9466 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
9467 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
9468 [NL80211_MESHCONF_RSSI_THRESHOLD] =
9469 NLA_POLICY_RANGE(NLA_S32, -255, 0),
9470 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
9471 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
9472 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
9473 NLA_POLICY_MIN(NLA_U16, 1),
9474 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
9475 NLA_POLICY_MIN(NLA_U16, 1),
9476 [NL80211_MESHCONF_POWER_MODE] =
9477 NLA_POLICY_RANGE(NLA_U32,
9478 NL80211_MESH_POWER_ACTIVE,
9479 NL80211_MESH_POWER_MAX),
9480 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
9481 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
9482 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9483 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9484 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9485 };
9486
9487 static const struct nla_policy
9488 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
9489 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
9490 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
9491 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
9492 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
9493 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
9494 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
9495 [NL80211_MESH_SETUP_IE] =
9496 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
9497 IEEE80211_MAX_DATA_LEN),
9498 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
9499 };
9500
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)9501 static int nl80211_parse_mesh_config(struct genl_info *info,
9502 struct mesh_config *cfg,
9503 u32 *mask_out)
9504 {
9505 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
9506 u32 mask = 0;
9507 u16 ht_opmode;
9508
9509 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
9510 do { \
9511 if (tb[attr]) { \
9512 cfg->param = fn(tb[attr]); \
9513 mask |= BIT((attr) - 1); \
9514 } \
9515 } while (0)
9516
9517 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
9518 return -EINVAL;
9519 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
9520 return -EINVAL;
9521
9522 /* This makes sure that there aren't more than 32 mesh config
9523 * parameters (otherwise our bitfield scheme would not work.) */
9524 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
9525
9526 /* Fill in the params struct */
9527 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
9528 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
9529 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
9530 NL80211_MESHCONF_CONFIRM_TIMEOUT,
9531 nla_get_u16);
9532 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
9533 NL80211_MESHCONF_HOLDING_TIMEOUT,
9534 nla_get_u16);
9535 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
9536 NL80211_MESHCONF_MAX_PEER_LINKS,
9537 nla_get_u16);
9538 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
9539 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
9540 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
9541 NL80211_MESHCONF_TTL, nla_get_u8);
9542 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
9543 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
9544 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
9545 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9546 nla_get_u8);
9547 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
9548 mask,
9549 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9550 nla_get_u32);
9551 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
9552 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9553 nla_get_u8);
9554 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
9555 NL80211_MESHCONF_PATH_REFRESH_TIME,
9556 nla_get_u32);
9557 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
9558 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
9559 return -EINVAL;
9560 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
9561 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9562 nla_get_u16);
9563 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
9564 mask,
9565 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9566 nla_get_u32);
9567 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
9568 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
9569 cfg->dot11MeshHWMPactivePathTimeout > 65535))
9570 return -EINVAL;
9571 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
9572 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9573 nla_get_u16);
9574 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
9575 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9576 nla_get_u16);
9577 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9578 dot11MeshHWMPnetDiameterTraversalTime, mask,
9579 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9580 nla_get_u16);
9581 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
9582 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
9583 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
9584 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9585 nla_get_u16);
9586 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
9587 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9588 nla_get_u8);
9589 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
9590 NL80211_MESHCONF_FORWARDING, nla_get_u8);
9591 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
9592 NL80211_MESHCONF_RSSI_THRESHOLD,
9593 nla_get_s32);
9594 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
9595 NL80211_MESHCONF_CONNECTED_TO_GATE,
9596 nla_get_u8);
9597 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
9598 NL80211_MESHCONF_CONNECTED_TO_AS,
9599 nla_get_u8);
9600 /*
9601 * Check HT operation mode based on
9602 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
9603 */
9604 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
9605 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
9606
9607 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
9608 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
9609 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
9610 return -EINVAL;
9611
9612 /* NON_HT_STA bit is reserved, but some programs set it */
9613 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
9614
9615 cfg->ht_opmode = ht_opmode;
9616 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
9617 }
9618 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9619 dot11MeshHWMPactivePathToRootTimeout, mask,
9620 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9621 nla_get_u32);
9622 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
9623 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
9624 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
9625 return -EINVAL;
9626 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
9627 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9628 nla_get_u16);
9629 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
9630 mask,
9631 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9632 nla_get_u16);
9633 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
9634 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
9635 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
9636 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
9637 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
9638 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
9639 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
9640 NL80211_MESHCONF_NOLEARN, nla_get_u8);
9641 if (mask_out)
9642 *mask_out = mask;
9643
9644 return 0;
9645
9646 #undef FILL_IN_MESH_PARAM_IF_SET
9647 }
9648
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)9649 static int nl80211_parse_mesh_setup(struct genl_info *info,
9650 struct mesh_setup *setup)
9651 {
9652 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9653 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
9654
9655 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
9656 return -EINVAL;
9657 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
9658 return -EINVAL;
9659
9660 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
9661 setup->sync_method =
9662 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
9663 IEEE80211_SYNC_METHOD_VENDOR :
9664 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
9665
9666 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
9667 setup->path_sel_proto =
9668 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
9669 IEEE80211_PATH_PROTOCOL_VENDOR :
9670 IEEE80211_PATH_PROTOCOL_HWMP;
9671
9672 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
9673 setup->path_metric =
9674 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
9675 IEEE80211_PATH_METRIC_VENDOR :
9676 IEEE80211_PATH_METRIC_AIRTIME;
9677
9678 if (tb[NL80211_MESH_SETUP_IE]) {
9679 struct nlattr *ieattr =
9680 tb[NL80211_MESH_SETUP_IE];
9681 setup->ie = nla_data(ieattr);
9682 setup->ie_len = nla_len(ieattr);
9683 }
9684 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
9685 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
9686 return -EINVAL;
9687 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
9688 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
9689 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
9690 if (setup->is_secure)
9691 setup->user_mpm = true;
9692
9693 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
9694 if (!setup->user_mpm)
9695 return -EINVAL;
9696 setup->auth_id =
9697 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
9698 }
9699
9700 return 0;
9701 }
9702
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)9703 static int nl80211_update_mesh_config(struct sk_buff *skb,
9704 struct genl_info *info)
9705 {
9706 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9707 struct net_device *dev = info->user_ptr[1];
9708 struct wireless_dev *wdev = dev->ieee80211_ptr;
9709 struct mesh_config cfg = {};
9710 u32 mask;
9711 int err;
9712
9713 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9714 return -EOPNOTSUPP;
9715
9716 if (!rdev->ops->update_mesh_config)
9717 return -EOPNOTSUPP;
9718
9719 err = nl80211_parse_mesh_config(info, &cfg, &mask);
9720 if (err)
9721 return err;
9722
9723 if (!wdev->u.mesh.id_len)
9724 err = -ENOLINK;
9725
9726 if (!err)
9727 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
9728
9729 return err;
9730 }
9731
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)9732 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
9733 struct sk_buff *msg)
9734 {
9735 struct nlattr *nl_reg_rules;
9736 unsigned int i;
9737
9738 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
9739 (regdom->dfs_region &&
9740 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
9741 goto nla_put_failure;
9742
9743 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
9744 if (!nl_reg_rules)
9745 goto nla_put_failure;
9746
9747 for (i = 0; i < regdom->n_reg_rules; i++) {
9748 struct nlattr *nl_reg_rule;
9749 const struct ieee80211_reg_rule *reg_rule;
9750 const struct ieee80211_freq_range *freq_range;
9751 const struct ieee80211_power_rule *power_rule;
9752 unsigned int max_bandwidth_khz;
9753
9754 reg_rule = ®dom->reg_rules[i];
9755 freq_range = ®_rule->freq_range;
9756 power_rule = ®_rule->power_rule;
9757
9758 nl_reg_rule = nla_nest_start_noflag(msg, i);
9759 if (!nl_reg_rule)
9760 goto nla_put_failure;
9761
9762 max_bandwidth_khz = freq_range->max_bandwidth_khz;
9763 if (!max_bandwidth_khz)
9764 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
9765 reg_rule);
9766
9767 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
9768 reg_rule->flags) ||
9769 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
9770 freq_range->start_freq_khz) ||
9771 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
9772 freq_range->end_freq_khz) ||
9773 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
9774 max_bandwidth_khz) ||
9775 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
9776 power_rule->max_antenna_gain) ||
9777 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
9778 power_rule->max_eirp) ||
9779 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
9780 reg_rule->dfs_cac_ms))
9781 goto nla_put_failure;
9782
9783 if ((reg_rule->flags & NL80211_RRF_PSD) &&
9784 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
9785 reg_rule->psd))
9786 goto nla_put_failure;
9787
9788 nla_nest_end(msg, nl_reg_rule);
9789 }
9790
9791 nla_nest_end(msg, nl_reg_rules);
9792 return 0;
9793
9794 nla_put_failure:
9795 return -EMSGSIZE;
9796 }
9797
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)9798 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
9799 {
9800 const struct ieee80211_regdomain *regdom = NULL;
9801 struct cfg80211_registered_device *rdev;
9802 struct wiphy *wiphy = NULL;
9803 struct sk_buff *msg;
9804 int err = -EMSGSIZE;
9805 void *hdr;
9806
9807 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9808 if (!msg)
9809 return -ENOBUFS;
9810
9811 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9812 NL80211_CMD_GET_REG);
9813 if (!hdr)
9814 goto put_failure;
9815
9816 rtnl_lock();
9817
9818 if (info->attrs[NL80211_ATTR_WIPHY]) {
9819 bool self_managed;
9820
9821 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9822 if (IS_ERR(rdev)) {
9823 err = PTR_ERR(rdev);
9824 goto nla_put_failure;
9825 }
9826
9827 wiphy = &rdev->wiphy;
9828 self_managed = wiphy->regulatory_flags &
9829 REGULATORY_WIPHY_SELF_MANAGED;
9830
9831 rcu_read_lock();
9832
9833 regdom = get_wiphy_regdom(wiphy);
9834
9835 /* a self-managed-reg device must have a private regdom */
9836 if (WARN_ON(!regdom && self_managed)) {
9837 err = -EINVAL;
9838 goto nla_put_failure_rcu;
9839 }
9840
9841 if (regdom &&
9842 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9843 goto nla_put_failure_rcu;
9844 } else {
9845 rcu_read_lock();
9846 }
9847
9848 if (!wiphy && reg_last_request_cell_base() &&
9849 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9850 NL80211_USER_REG_HINT_CELL_BASE))
9851 goto nla_put_failure_rcu;
9852
9853 if (!regdom)
9854 regdom = rcu_dereference(cfg80211_regdomain);
9855
9856 if (nl80211_put_regdom(regdom, msg))
9857 goto nla_put_failure_rcu;
9858
9859 rcu_read_unlock();
9860
9861 genlmsg_end(msg, hdr);
9862 rtnl_unlock();
9863 return genlmsg_reply(msg, info);
9864
9865 nla_put_failure_rcu:
9866 rcu_read_unlock();
9867 nla_put_failure:
9868 rtnl_unlock();
9869 put_failure:
9870 nlmsg_free(msg);
9871 return err;
9872 }
9873
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)9874 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
9875 u32 seq, int flags, struct wiphy *wiphy,
9876 const struct ieee80211_regdomain *regdom)
9877 {
9878 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9879 NL80211_CMD_GET_REG);
9880
9881 if (!hdr)
9882 return -1;
9883
9884 genl_dump_check_consistent(cb, hdr);
9885
9886 if (nl80211_put_regdom(regdom, msg))
9887 goto nla_put_failure;
9888
9889 if (!wiphy && reg_last_request_cell_base() &&
9890 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9891 NL80211_USER_REG_HINT_CELL_BASE))
9892 goto nla_put_failure;
9893
9894 if (wiphy &&
9895 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9896 goto nla_put_failure;
9897
9898 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
9899 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
9900 goto nla_put_failure;
9901
9902 genlmsg_end(msg, hdr);
9903 return 0;
9904
9905 nla_put_failure:
9906 genlmsg_cancel(msg, hdr);
9907 return -EMSGSIZE;
9908 }
9909
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)9910 static int nl80211_get_reg_dump(struct sk_buff *skb,
9911 struct netlink_callback *cb)
9912 {
9913 const struct ieee80211_regdomain *regdom = NULL;
9914 struct cfg80211_registered_device *rdev;
9915 int err, reg_idx, start = cb->args[2];
9916
9917 rcu_read_lock();
9918
9919 if (cfg80211_regdomain && start == 0) {
9920 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9921 NLM_F_MULTI, NULL,
9922 rcu_dereference(cfg80211_regdomain));
9923 if (err < 0)
9924 goto out_err;
9925 }
9926
9927 /* the global regdom is idx 0 */
9928 reg_idx = 1;
9929 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9930 regdom = get_wiphy_regdom(&rdev->wiphy);
9931 if (!regdom)
9932 continue;
9933
9934 if (++reg_idx <= start)
9935 continue;
9936
9937 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9938 NLM_F_MULTI, &rdev->wiphy, regdom);
9939 if (err < 0) {
9940 reg_idx--;
9941 break;
9942 }
9943 }
9944
9945 cb->args[2] = reg_idx;
9946 err = skb->len;
9947 out_err:
9948 rcu_read_unlock();
9949 return err;
9950 }
9951
9952 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
9953 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
9954 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
9955 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
9956 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
9957 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
9958 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
9959 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
9960 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
9961 };
9962
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)9963 static int parse_reg_rule(struct nlattr *tb[],
9964 struct ieee80211_reg_rule *reg_rule)
9965 {
9966 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
9967 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
9968
9969 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
9970 return -EINVAL;
9971 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
9972 return -EINVAL;
9973 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
9974 return -EINVAL;
9975 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
9976 return -EINVAL;
9977 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
9978 return -EINVAL;
9979
9980 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
9981
9982 freq_range->start_freq_khz =
9983 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
9984 freq_range->end_freq_khz =
9985 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
9986 freq_range->max_bandwidth_khz =
9987 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
9988
9989 power_rule->max_eirp =
9990 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
9991
9992 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
9993 power_rule->max_antenna_gain =
9994 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
9995
9996 if (tb[NL80211_ATTR_DFS_CAC_TIME])
9997 reg_rule->dfs_cac_ms =
9998 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
9999
10000 return 0;
10001 }
10002
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)10003 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
10004 {
10005 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
10006 struct nlattr *nl_reg_rule;
10007 char *alpha2;
10008 int rem_reg_rules, r;
10009 u32 num_rules = 0, rule_idx = 0;
10010 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
10011 struct ieee80211_regdomain *rd;
10012
10013 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
10014 return -EINVAL;
10015
10016 if (!info->attrs[NL80211_ATTR_REG_RULES])
10017 return -EINVAL;
10018
10019 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
10020
10021 if (info->attrs[NL80211_ATTR_DFS_REGION])
10022 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
10023
10024 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10025 rem_reg_rules) {
10026 num_rules++;
10027 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
10028 return -EINVAL;
10029 }
10030
10031 rtnl_lock();
10032 if (!reg_is_valid_request(alpha2)) {
10033 r = -EINVAL;
10034 goto out;
10035 }
10036
10037 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
10038 if (!rd) {
10039 r = -ENOMEM;
10040 goto out;
10041 }
10042
10043 rd->n_reg_rules = num_rules;
10044 rd->alpha2[0] = alpha2[0];
10045 rd->alpha2[1] = alpha2[1];
10046
10047 /*
10048 * Disable DFS master mode if the DFS region was
10049 * not supported or known on this kernel.
10050 */
10051 if (reg_supported_dfs_region(dfs_region))
10052 rd->dfs_region = dfs_region;
10053
10054 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10055 rem_reg_rules) {
10056 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
10057 nl_reg_rule, reg_rule_policy,
10058 info->extack);
10059 if (r)
10060 goto bad_reg;
10061 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
10062 if (r)
10063 goto bad_reg;
10064
10065 rule_idx++;
10066
10067 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
10068 r = -EINVAL;
10069 goto bad_reg;
10070 }
10071 }
10072
10073 r = set_regdom(rd, REGD_SOURCE_CRDA);
10074 /* set_regdom takes ownership of rd */
10075 rd = NULL;
10076 bad_reg:
10077 kfree(rd);
10078 out:
10079 rtnl_unlock();
10080 return r;
10081 }
10082 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
10083
validate_scan_freqs(struct nlattr * freqs)10084 static int validate_scan_freqs(struct nlattr *freqs)
10085 {
10086 struct nlattr *attr1, *attr2;
10087 int n_channels = 0, tmp1, tmp2;
10088
10089 nla_for_each_nested(attr1, freqs, tmp1)
10090 if (nla_len(attr1) != sizeof(u32))
10091 return 0;
10092
10093 nla_for_each_nested(attr1, freqs, tmp1) {
10094 n_channels++;
10095 /*
10096 * Some hardware has a limited channel list for
10097 * scanning, and it is pretty much nonsensical
10098 * to scan for a channel twice, so disallow that
10099 * and don't require drivers to check that the
10100 * channel list they get isn't longer than what
10101 * they can scan, as long as they can scan all
10102 * the channels they registered at once.
10103 */
10104 nla_for_each_nested(attr2, freqs, tmp2)
10105 if (attr1 != attr2 &&
10106 nla_get_u32(attr1) == nla_get_u32(attr2))
10107 return 0;
10108 }
10109
10110 return n_channels;
10111 }
10112
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)10113 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
10114 {
10115 return b < NUM_NL80211_BANDS && wiphy->bands[b];
10116 }
10117
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)10118 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
10119 struct cfg80211_bss_selection *bss_select)
10120 {
10121 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
10122 struct nlattr *nest;
10123 int err;
10124 bool found = false;
10125 int i;
10126
10127 /* only process one nested attribute */
10128 nest = nla_data(nla);
10129 if (!nla_ok(nest, nla_len(nest)))
10130 return -EINVAL;
10131
10132 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
10133 nest, nl80211_bss_select_policy,
10134 NULL);
10135 if (err)
10136 return err;
10137
10138 /* only one attribute may be given */
10139 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
10140 if (attr[i]) {
10141 if (found)
10142 return -EINVAL;
10143 found = true;
10144 }
10145 }
10146
10147 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
10148
10149 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
10150 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
10151
10152 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
10153 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
10154 bss_select->param.band_pref =
10155 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
10156 if (!is_band_valid(wiphy, bss_select->param.band_pref))
10157 return -EINVAL;
10158 }
10159
10160 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
10161 struct nl80211_bss_select_rssi_adjust *adj_param;
10162
10163 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
10164 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
10165 bss_select->param.adjust.band = adj_param->band;
10166 bss_select->param.adjust.delta = adj_param->delta;
10167 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
10168 return -EINVAL;
10169 }
10170
10171 /* user-space did not provide behaviour attribute */
10172 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
10173 return -EINVAL;
10174
10175 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
10176 return -EINVAL;
10177
10178 return 0;
10179 }
10180
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)10181 int nl80211_parse_random_mac(struct nlattr **attrs,
10182 u8 *mac_addr, u8 *mac_addr_mask)
10183 {
10184 int i;
10185
10186 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
10187 eth_zero_addr(mac_addr);
10188 eth_zero_addr(mac_addr_mask);
10189 mac_addr[0] = 0x2;
10190 mac_addr_mask[0] = 0x3;
10191
10192 return 0;
10193 }
10194
10195 /* need both or none */
10196 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
10197 return -EINVAL;
10198
10199 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
10200 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
10201
10202 /* don't allow or configure an mcast address */
10203 if (!is_multicast_ether_addr(mac_addr_mask) ||
10204 is_multicast_ether_addr(mac_addr))
10205 return -EINVAL;
10206
10207 /*
10208 * allow users to pass a MAC address that has bits set outside
10209 * of the mask, but don't bother drivers with having to deal
10210 * with such bits
10211 */
10212 for (i = 0; i < ETH_ALEN; i++)
10213 mac_addr[i] &= mac_addr_mask[i];
10214
10215 return 0;
10216 }
10217
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)10218 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
10219 struct ieee80211_channel *chan)
10220 {
10221 unsigned int link_id;
10222 bool all_ok = true;
10223 int radio_idx;
10224
10225 lockdep_assert_wiphy(wdev->wiphy);
10226
10227 if (!cfg80211_wdev_channel_allowed(wdev, chan))
10228 return false;
10229
10230 if (!cfg80211_beaconing_iface_active(wdev))
10231 return true;
10232
10233 radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy, chan);
10234
10235 /*
10236 * FIXME: check if we have a free radio/link for chan
10237 *
10238 * This, as well as the FIXME below, requires knowing the link
10239 * capabilities of the hardware.
10240 */
10241
10242 /* we cannot leave radar channels */
10243 for_each_valid_link(wdev, link_id) {
10244 struct cfg80211_chan_def *chandef;
10245 int link_radio_idx;
10246
10247 chandef = wdev_chandef(wdev, link_id);
10248 if (!chandef || !chandef->chan)
10249 continue;
10250
10251 if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
10252 continue;
10253
10254 /*
10255 * chandef->chan is a radar channel. If the radio/link onto
10256 * which this radar channel falls is the same radio/link onto
10257 * which the input 'chan' falls, off-channel operation should
10258 * not be allowed. Hence, set 'all_ok' to false.
10259 */
10260
10261 link_radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy,
10262 chandef->chan);
10263 if (link_radio_idx == radio_idx) {
10264 all_ok = false;
10265 break;
10266 }
10267 }
10268
10269 if (all_ok)
10270 return true;
10271
10272 return regulatory_pre_cac_allowed(wdev->wiphy);
10273 }
10274
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)10275 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
10276 enum nl80211_ext_feature_index feat)
10277 {
10278 if (!(flags & flag))
10279 return true;
10280 if (wiphy_ext_feature_isset(wiphy, feat))
10281 return true;
10282 return false;
10283 }
10284
10285 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask,u32 * flags,enum nl80211_feature_flags randomness_flag)10286 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
10287 struct nlattr **attrs, u8 *mac_addr, u8 *mac_addr_mask,
10288 u32 *flags, enum nl80211_feature_flags randomness_flag)
10289 {
10290 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
10291 return 0;
10292
10293 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
10294
10295 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
10296 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
10297 !nl80211_check_scan_feat(wiphy, *flags,
10298 NL80211_SCAN_FLAG_LOW_SPAN,
10299 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
10300 !nl80211_check_scan_feat(wiphy, *flags,
10301 NL80211_SCAN_FLAG_LOW_POWER,
10302 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
10303 !nl80211_check_scan_feat(wiphy, *flags,
10304 NL80211_SCAN_FLAG_HIGH_ACCURACY,
10305 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
10306 !nl80211_check_scan_feat(wiphy, *flags,
10307 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
10308 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
10309 !nl80211_check_scan_feat(wiphy, *flags,
10310 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
10311 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
10312 !nl80211_check_scan_feat(wiphy, *flags,
10313 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
10314 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
10315 !nl80211_check_scan_feat(wiphy, *flags,
10316 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
10317 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
10318 !nl80211_check_scan_feat(wiphy, *flags,
10319 NL80211_SCAN_FLAG_RANDOM_SN,
10320 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
10321 !nl80211_check_scan_feat(wiphy, *flags,
10322 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
10323 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
10324 return -EOPNOTSUPP;
10325
10326 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
10327 int err;
10328
10329 if (!(wiphy->features & randomness_flag) ||
10330 (wdev && wdev->connected))
10331 return -EOPNOTSUPP;
10332
10333 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
10334 if (err)
10335 return err;
10336 }
10337
10338 return 0;
10339 }
10340
10341 static int
nl80211_check_scan_flags_sched(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_sched_scan_request * req)10342 nl80211_check_scan_flags_sched(struct wiphy *wiphy, struct wireless_dev *wdev,
10343 struct nlattr **attrs,
10344 struct cfg80211_sched_scan_request *req)
10345 {
10346 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10347 req->mac_addr, req->mac_addr_mask,
10348 &req->flags,
10349 wdev ? NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
10350 NL80211_FEATURE_ND_RANDOM_MAC_ADDR);
10351 }
10352
10353 static int
nl80211_check_scan_flags_reg(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_scan_request_int * req)10354 nl80211_check_scan_flags_reg(struct wiphy *wiphy, struct wireless_dev *wdev,
10355 struct nlattr **attrs,
10356 struct cfg80211_scan_request_int *req)
10357 {
10358 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10359 req->req.mac_addr,
10360 req->req.mac_addr_mask,
10361 &req->req.flags,
10362 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR);
10363 }
10364
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)10365 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
10366 {
10367 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10368 struct wireless_dev *wdev = info->user_ptr[1];
10369 struct cfg80211_scan_request_int *request;
10370 struct nlattr *scan_freqs = NULL;
10371 bool scan_freqs_khz = false;
10372 struct nlattr *attr;
10373 struct wiphy *wiphy;
10374 int err, tmp, n_ssids = 0, n_channels, i;
10375 size_t ie_len, size;
10376 size_t ssids_offset, ie_offset;
10377
10378 wiphy = &rdev->wiphy;
10379
10380 if (wdev->iftype == NL80211_IFTYPE_NAN)
10381 return -EOPNOTSUPP;
10382
10383 if (!rdev->ops->scan)
10384 return -EOPNOTSUPP;
10385
10386 if (rdev->scan_req || rdev->scan_msg)
10387 return -EBUSY;
10388
10389 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
10390 if (!wiphy_ext_feature_isset(wiphy,
10391 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
10392 return -EOPNOTSUPP;
10393 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
10394 scan_freqs_khz = true;
10395 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
10396 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
10397
10398 if (scan_freqs) {
10399 n_channels = validate_scan_freqs(scan_freqs);
10400 if (!n_channels)
10401 return -EINVAL;
10402 } else {
10403 n_channels = ieee80211_get_num_supported_channels(wiphy);
10404 }
10405
10406 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
10407 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
10408 n_ssids++;
10409
10410 if (n_ssids > wiphy->max_scan_ssids)
10411 return -EINVAL;
10412
10413 if (info->attrs[NL80211_ATTR_IE])
10414 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10415 else
10416 ie_len = 0;
10417
10418 if (ie_len > wiphy->max_scan_ie_len)
10419 return -EINVAL;
10420
10421 size = struct_size(request, req.channels, n_channels);
10422 ssids_offset = size;
10423 size = size_add(size, array_size(sizeof(*request->req.ssids), n_ssids));
10424 ie_offset = size;
10425 size = size_add(size, ie_len);
10426 request = kzalloc(size, GFP_KERNEL);
10427 if (!request)
10428 return -ENOMEM;
10429
10430 if (n_ssids)
10431 request->req.ssids = (void *)request + ssids_offset;
10432 request->req.n_ssids = n_ssids;
10433 if (ie_len)
10434 request->req.ie = (void *)request + ie_offset;
10435
10436 i = 0;
10437 if (scan_freqs) {
10438 /* user specified, bail out if channel not found */
10439 nla_for_each_nested(attr, scan_freqs, tmp) {
10440 struct ieee80211_channel *chan;
10441 int freq = nla_get_u32(attr);
10442
10443 if (!scan_freqs_khz)
10444 freq = MHZ_TO_KHZ(freq);
10445
10446 chan = ieee80211_get_channel_khz(wiphy, freq);
10447 if (!chan) {
10448 err = -EINVAL;
10449 goto out_free;
10450 }
10451
10452 /* Ignore disabled / no primary channels */
10453 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10454 chan->flags & IEEE80211_CHAN_S1G_NO_PRIMARY ||
10455 !cfg80211_wdev_channel_allowed(wdev, chan))
10456 continue;
10457
10458 request->req.channels[i] = chan;
10459 i++;
10460 }
10461 } else {
10462 enum nl80211_band band;
10463
10464 /* all channels */
10465 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10466 int j;
10467
10468 if (!wiphy->bands[band])
10469 continue;
10470 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10471 struct ieee80211_channel *chan;
10472
10473 chan = &wiphy->bands[band]->channels[j];
10474
10475 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10476 chan->flags &
10477 IEEE80211_CHAN_S1G_NO_PRIMARY ||
10478 !cfg80211_wdev_channel_allowed(wdev, chan))
10479 continue;
10480
10481 request->req.channels[i] = chan;
10482 i++;
10483 }
10484 }
10485 }
10486
10487 if (!i) {
10488 err = -EINVAL;
10489 goto out_free;
10490 }
10491
10492 request->req.n_channels = i;
10493
10494 for (i = 0; i < request->req.n_channels; i++) {
10495 struct ieee80211_channel *chan = request->req.channels[i];
10496
10497 /* if we can go off-channel to the target channel we're good */
10498 if (cfg80211_off_channel_oper_allowed(wdev, chan))
10499 continue;
10500
10501 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
10502 err = -EBUSY;
10503 goto out_free;
10504 }
10505 }
10506
10507 i = 0;
10508 if (n_ssids) {
10509 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
10510 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10511 err = -EINVAL;
10512 goto out_free;
10513 }
10514 request->req.ssids[i].ssid_len = nla_len(attr);
10515 memcpy(request->req.ssids[i].ssid,
10516 nla_data(attr), nla_len(attr));
10517 i++;
10518 }
10519 }
10520
10521 if (info->attrs[NL80211_ATTR_IE]) {
10522 request->req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10523 memcpy((void *)request->req.ie,
10524 nla_data(info->attrs[NL80211_ATTR_IE]),
10525 request->req.ie_len);
10526 }
10527
10528 for (i = 0; i < NUM_NL80211_BANDS; i++)
10529 if (wiphy->bands[i])
10530 request->req.rates[i] =
10531 (1 << wiphy->bands[i]->n_bitrates) - 1;
10532
10533 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
10534 nla_for_each_nested(attr,
10535 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
10536 tmp) {
10537 enum nl80211_band band = nla_type(attr);
10538
10539 if (band < 0 || band >= NUM_NL80211_BANDS) {
10540 err = -EINVAL;
10541 goto out_free;
10542 }
10543
10544 if (!wiphy->bands[band])
10545 continue;
10546
10547 err = ieee80211_get_ratemask(wiphy->bands[band],
10548 nla_data(attr),
10549 nla_len(attr),
10550 &request->req.rates[band]);
10551 if (err)
10552 goto out_free;
10553 }
10554 }
10555
10556 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
10557 request->req.duration =
10558 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
10559 request->req.duration_mandatory =
10560 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
10561 }
10562
10563 err = nl80211_check_scan_flags_reg(wiphy, wdev, info->attrs, request);
10564 if (err)
10565 goto out_free;
10566
10567 request->req.no_cck =
10568 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10569
10570 /* Initial implementation used NL80211_ATTR_MAC to set the specific
10571 * BSSID to scan for. This was problematic because that same attribute
10572 * was already used for another purpose (local random MAC address). The
10573 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
10574 * compatibility with older userspace components, also use the
10575 * NL80211_ATTR_MAC value here if it can be determined to be used for
10576 * the specific BSSID use case instead of the random MAC address
10577 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
10578 */
10579 if (info->attrs[NL80211_ATTR_BSSID])
10580 memcpy(request->req.bssid,
10581 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
10582 else if (!(request->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
10583 info->attrs[NL80211_ATTR_MAC])
10584 memcpy(request->req.bssid,
10585 nla_data(info->attrs[NL80211_ATTR_MAC]),
10586 ETH_ALEN);
10587 else
10588 eth_broadcast_addr(request->req.bssid);
10589
10590 request->req.tsf_report_link_id =
10591 nl80211_link_id_or_invalid(info->attrs);
10592 request->req.wdev = wdev;
10593 request->req.wiphy = &rdev->wiphy;
10594 request->req.scan_start = jiffies;
10595
10596 rdev->scan_req = request;
10597 err = cfg80211_scan(rdev);
10598
10599 if (err)
10600 goto out_free;
10601
10602 nl80211_send_scan_start(rdev, wdev);
10603 dev_hold(wdev->netdev);
10604
10605 return 0;
10606
10607 out_free:
10608 rdev->scan_req = NULL;
10609 kfree(request);
10610
10611 return err;
10612 }
10613
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)10614 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
10615 {
10616 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10617 struct wireless_dev *wdev = info->user_ptr[1];
10618
10619 if (!rdev->ops->abort_scan)
10620 return -EOPNOTSUPP;
10621
10622 if (rdev->scan_msg)
10623 return 0;
10624
10625 if (!rdev->scan_req)
10626 return -ENOENT;
10627
10628 rdev_abort_scan(rdev, wdev);
10629 return 0;
10630 }
10631
10632 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)10633 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
10634 struct cfg80211_sched_scan_request *request,
10635 struct nlattr **attrs)
10636 {
10637 int tmp, err, i = 0;
10638 struct nlattr *attr;
10639
10640 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10641 u32 interval;
10642
10643 /*
10644 * If scan plans are not specified,
10645 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
10646 * case one scan plan will be set with the specified scan
10647 * interval and infinite number of iterations.
10648 */
10649 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
10650 if (!interval)
10651 return -EINVAL;
10652
10653 request->scan_plans[0].interval =
10654 DIV_ROUND_UP(interval, MSEC_PER_SEC);
10655 if (!request->scan_plans[0].interval)
10656 return -EINVAL;
10657
10658 if (request->scan_plans[0].interval >
10659 wiphy->max_sched_scan_plan_interval)
10660 request->scan_plans[0].interval =
10661 wiphy->max_sched_scan_plan_interval;
10662
10663 return 0;
10664 }
10665
10666 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
10667 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
10668
10669 if (WARN_ON(i >= n_plans))
10670 return -EINVAL;
10671
10672 err = nla_parse_nested_deprecated(plan,
10673 NL80211_SCHED_SCAN_PLAN_MAX,
10674 attr, nl80211_plan_policy,
10675 NULL);
10676 if (err)
10677 return err;
10678
10679 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
10680 return -EINVAL;
10681
10682 request->scan_plans[i].interval =
10683 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
10684 if (!request->scan_plans[i].interval ||
10685 request->scan_plans[i].interval >
10686 wiphy->max_sched_scan_plan_interval)
10687 return -EINVAL;
10688
10689 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
10690 request->scan_plans[i].iterations =
10691 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
10692 if (!request->scan_plans[i].iterations ||
10693 (request->scan_plans[i].iterations >
10694 wiphy->max_sched_scan_plan_iterations))
10695 return -EINVAL;
10696 } else if (i < n_plans - 1) {
10697 /*
10698 * All scan plans but the last one must specify
10699 * a finite number of iterations
10700 */
10701 return -EINVAL;
10702 }
10703
10704 i++;
10705 }
10706
10707 /*
10708 * The last scan plan must not specify the number of
10709 * iterations, it is supposed to run infinitely
10710 */
10711 if (request->scan_plans[n_plans - 1].iterations)
10712 return -EINVAL;
10713
10714 return 0;
10715 }
10716
10717 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)10718 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
10719 struct nlattr **attrs, int max_match_sets)
10720 {
10721 struct cfg80211_sched_scan_request *request;
10722 struct nlattr *attr;
10723 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
10724 enum nl80211_band band;
10725 size_t ie_len, size;
10726 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
10727 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
10728
10729 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10730 n_channels = validate_scan_freqs(
10731 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
10732 if (!n_channels)
10733 return ERR_PTR(-EINVAL);
10734 } else {
10735 n_channels = ieee80211_get_num_supported_channels(wiphy);
10736 }
10737
10738 if (attrs[NL80211_ATTR_SCAN_SSIDS])
10739 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10740 tmp)
10741 n_ssids++;
10742
10743 if (n_ssids > wiphy->max_sched_scan_ssids)
10744 return ERR_PTR(-EINVAL);
10745
10746 /*
10747 * First, count the number of 'real' matchsets. Due to an issue with
10748 * the old implementation, matchsets containing only the RSSI attribute
10749 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
10750 * RSSI for all matchsets, rather than their own matchset for reporting
10751 * all APs with a strong RSSI. This is needed to be compatible with
10752 * older userspace that treated a matchset with only the RSSI as the
10753 * global RSSI for all other matchsets - if there are other matchsets.
10754 */
10755 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10756 nla_for_each_nested(attr,
10757 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10758 tmp) {
10759 struct nlattr *rssi;
10760
10761 err = nla_parse_nested_deprecated(tb,
10762 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10763 attr,
10764 nl80211_match_policy,
10765 NULL);
10766 if (err)
10767 return ERR_PTR(err);
10768
10769 /* SSID and BSSID are mutually exclusive */
10770 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
10771 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
10772 return ERR_PTR(-EINVAL);
10773
10774 /* add other standalone attributes here */
10775 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
10776 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
10777 n_match_sets++;
10778 continue;
10779 }
10780 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10781 if (rssi)
10782 default_match_rssi = nla_get_s32(rssi);
10783 }
10784 }
10785
10786 /* However, if there's no other matchset, add the RSSI one */
10787 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
10788 n_match_sets = 1;
10789
10790 if (n_match_sets > max_match_sets)
10791 return ERR_PTR(-EINVAL);
10792
10793 if (attrs[NL80211_ATTR_IE])
10794 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
10795 else
10796 ie_len = 0;
10797
10798 if (ie_len > wiphy->max_sched_scan_ie_len)
10799 return ERR_PTR(-EINVAL);
10800
10801 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10802 /*
10803 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
10804 * each scan plan already specifies its own interval
10805 */
10806 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10807 return ERR_PTR(-EINVAL);
10808
10809 nla_for_each_nested(attr,
10810 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
10811 n_plans++;
10812 } else {
10813 /*
10814 * The scan interval attribute is kept for backward
10815 * compatibility. If no scan plans are specified and sched scan
10816 * interval is specified, one scan plan will be set with this
10817 * scan interval and infinite number of iterations.
10818 */
10819 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10820 return ERR_PTR(-EINVAL);
10821
10822 n_plans = 1;
10823 }
10824
10825 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
10826 return ERR_PTR(-EINVAL);
10827
10828 if (!wiphy_ext_feature_isset(
10829 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
10830 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
10831 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
10832 return ERR_PTR(-EINVAL);
10833
10834 size = struct_size(request, channels, n_channels);
10835 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
10836 size = size_add(size, array_size(sizeof(*request->match_sets),
10837 n_match_sets));
10838 size = size_add(size, array_size(sizeof(*request->scan_plans),
10839 n_plans));
10840 size = size_add(size, ie_len);
10841 request = kzalloc(size, GFP_KERNEL);
10842 if (!request)
10843 return ERR_PTR(-ENOMEM);
10844 request->n_channels = n_channels;
10845
10846 if (n_ssids)
10847 request->ssids = (void *)request +
10848 struct_size(request, channels, n_channels);
10849 request->n_ssids = n_ssids;
10850 if (ie_len) {
10851 if (n_ssids)
10852 request->ie = (void *)(request->ssids + n_ssids);
10853 else
10854 request->ie = (void *)(request->channels + n_channels);
10855 }
10856
10857 if (n_match_sets) {
10858 if (request->ie)
10859 request->match_sets = (void *)(request->ie + ie_len);
10860 else if (n_ssids)
10861 request->match_sets =
10862 (void *)(request->ssids + n_ssids);
10863 else
10864 request->match_sets =
10865 (void *)(request->channels + n_channels);
10866 }
10867 request->n_match_sets = n_match_sets;
10868
10869 if (n_match_sets)
10870 request->scan_plans = (void *)(request->match_sets +
10871 n_match_sets);
10872 else if (request->ie)
10873 request->scan_plans = (void *)(request->ie + ie_len);
10874 else if (n_ssids)
10875 request->scan_plans = (void *)(request->ssids + n_ssids);
10876 else
10877 request->scan_plans = (void *)(request->channels + n_channels);
10878
10879 request->n_scan_plans = n_plans;
10880
10881 i = 0;
10882 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10883 /* user specified, bail out if channel not found */
10884 nla_for_each_nested(attr,
10885 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
10886 tmp) {
10887 struct ieee80211_channel *chan;
10888
10889 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
10890
10891 if (!chan) {
10892 err = -EINVAL;
10893 goto out_free;
10894 }
10895
10896 /* ignore disabled channels */
10897 if (chan->flags & IEEE80211_CHAN_DISABLED)
10898 continue;
10899
10900 request->channels[i] = chan;
10901 i++;
10902 }
10903 } else {
10904 /* all channels */
10905 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10906 int j;
10907
10908 if (!wiphy->bands[band])
10909 continue;
10910 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10911 struct ieee80211_channel *chan;
10912
10913 chan = &wiphy->bands[band]->channels[j];
10914
10915 if (chan->flags & IEEE80211_CHAN_DISABLED)
10916 continue;
10917
10918 request->channels[i] = chan;
10919 i++;
10920 }
10921 }
10922 }
10923
10924 if (!i) {
10925 err = -EINVAL;
10926 goto out_free;
10927 }
10928
10929 request->n_channels = i;
10930
10931 i = 0;
10932 if (n_ssids) {
10933 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10934 tmp) {
10935 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10936 err = -EINVAL;
10937 goto out_free;
10938 }
10939 request->ssids[i].ssid_len = nla_len(attr);
10940 memcpy(request->ssids[i].ssid, nla_data(attr),
10941 nla_len(attr));
10942 i++;
10943 }
10944 }
10945
10946 i = 0;
10947 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10948 nla_for_each_nested(attr,
10949 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10950 tmp) {
10951 struct nlattr *ssid, *bssid, *rssi;
10952
10953 err = nla_parse_nested_deprecated(tb,
10954 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10955 attr,
10956 nl80211_match_policy,
10957 NULL);
10958 if (err)
10959 goto out_free;
10960 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
10961 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
10962
10963 if (!ssid && !bssid) {
10964 i++;
10965 continue;
10966 }
10967
10968 if (WARN_ON(i >= n_match_sets)) {
10969 /* this indicates a programming error,
10970 * the loop above should have verified
10971 * things properly
10972 */
10973 err = -EINVAL;
10974 goto out_free;
10975 }
10976
10977 if (ssid) {
10978 memcpy(request->match_sets[i].ssid.ssid,
10979 nla_data(ssid), nla_len(ssid));
10980 request->match_sets[i].ssid.ssid_len =
10981 nla_len(ssid);
10982 }
10983 if (bssid)
10984 memcpy(request->match_sets[i].bssid,
10985 nla_data(bssid), ETH_ALEN);
10986
10987 /* special attribute - old implementation w/a */
10988 request->match_sets[i].rssi_thold = default_match_rssi;
10989 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10990 if (rssi)
10991 request->match_sets[i].rssi_thold =
10992 nla_get_s32(rssi);
10993 i++;
10994 }
10995
10996 /* there was no other matchset, so the RSSI one is alone */
10997 if (i == 0 && n_match_sets)
10998 request->match_sets[0].rssi_thold = default_match_rssi;
10999
11000 request->min_rssi_thold = INT_MAX;
11001 for (i = 0; i < n_match_sets; i++)
11002 request->min_rssi_thold =
11003 min(request->match_sets[i].rssi_thold,
11004 request->min_rssi_thold);
11005 } else {
11006 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
11007 }
11008
11009 if (ie_len) {
11010 request->ie_len = ie_len;
11011 memcpy((void *)request->ie,
11012 nla_data(attrs[NL80211_ATTR_IE]),
11013 request->ie_len);
11014 }
11015
11016 err = nl80211_check_scan_flags_sched(wiphy, wdev, attrs, request);
11017 if (err)
11018 goto out_free;
11019
11020 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
11021 request->delay =
11022 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
11023
11024 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
11025 request->relative_rssi = nla_get_s8(
11026 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
11027 request->relative_rssi_set = true;
11028 }
11029
11030 if (request->relative_rssi_set &&
11031 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
11032 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
11033
11034 rssi_adjust = nla_data(
11035 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
11036 request->rssi_adjust.band = rssi_adjust->band;
11037 request->rssi_adjust.delta = rssi_adjust->delta;
11038 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
11039 err = -EINVAL;
11040 goto out_free;
11041 }
11042 }
11043
11044 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
11045 if (err)
11046 goto out_free;
11047
11048 request->scan_start = jiffies;
11049
11050 return request;
11051
11052 out_free:
11053 kfree(request);
11054 return ERR_PTR(err);
11055 }
11056
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)11057 static int nl80211_start_sched_scan(struct sk_buff *skb,
11058 struct genl_info *info)
11059 {
11060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11061 struct net_device *dev = info->user_ptr[1];
11062 struct wireless_dev *wdev = dev->ieee80211_ptr;
11063 struct cfg80211_sched_scan_request *sched_scan_req;
11064 bool want_multi;
11065 int err;
11066
11067 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
11068 return -EOPNOTSUPP;
11069
11070 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
11071 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
11072 if (err)
11073 return err;
11074
11075 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
11076 info->attrs,
11077 rdev->wiphy.max_match_sets);
11078
11079 err = PTR_ERR_OR_ZERO(sched_scan_req);
11080 if (err)
11081 goto out_err;
11082
11083 /* leave request id zero for legacy request
11084 * or if driver does not support multi-scheduled scan
11085 */
11086 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
11087 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
11088
11089 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
11090 if (err)
11091 goto out_free;
11092
11093 sched_scan_req->dev = dev;
11094 sched_scan_req->wiphy = &rdev->wiphy;
11095
11096 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11097 sched_scan_req->owner_nlportid = info->snd_portid;
11098
11099 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
11100
11101 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
11102 return 0;
11103
11104 out_free:
11105 kfree(sched_scan_req);
11106 out_err:
11107 return err;
11108 }
11109
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)11110 static int nl80211_stop_sched_scan(struct sk_buff *skb,
11111 struct genl_info *info)
11112 {
11113 struct cfg80211_sched_scan_request *req;
11114 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11115 u64 cookie;
11116
11117 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
11118 return -EOPNOTSUPP;
11119
11120 if (info->attrs[NL80211_ATTR_COOKIE]) {
11121 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11122 return __cfg80211_stop_sched_scan(rdev, cookie, false);
11123 }
11124
11125 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
11126 struct cfg80211_sched_scan_request,
11127 list);
11128 if (!req || req->reqid ||
11129 (req->owner_nlportid &&
11130 req->owner_nlportid != info->snd_portid))
11131 return -ENOENT;
11132
11133 return cfg80211_stop_sched_scan_req(rdev, req, false);
11134 }
11135
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)11136 static int nl80211_start_radar_detection(struct sk_buff *skb,
11137 struct genl_info *info)
11138 {
11139 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11140 struct net_device *dev = info->user_ptr[1];
11141 struct wireless_dev *wdev = dev->ieee80211_ptr;
11142 int link_id = nl80211_link_id(info->attrs);
11143 struct wiphy *wiphy = wdev->wiphy;
11144 struct cfg80211_chan_def chandef;
11145 enum nl80211_dfs_regions dfs_region;
11146 unsigned int cac_time_ms;
11147 int err;
11148
11149 flush_delayed_work(&rdev->dfs_update_channels_wk);
11150
11151 switch (wdev->iftype) {
11152 case NL80211_IFTYPE_AP:
11153 case NL80211_IFTYPE_P2P_GO:
11154 case NL80211_IFTYPE_MESH_POINT:
11155 case NL80211_IFTYPE_ADHOC:
11156 break;
11157 default:
11158 /* caution - see cfg80211_beaconing_iface_active() below */
11159 return -EINVAL;
11160 }
11161
11162 guard(wiphy)(wiphy);
11163
11164 dfs_region = reg_get_dfs_region(wiphy);
11165 if (dfs_region == NL80211_DFS_UNSET)
11166 return -EINVAL;
11167
11168 err = nl80211_parse_chandef(rdev, info, &chandef);
11169 if (err)
11170 return err;
11171
11172 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11173 if (err < 0)
11174 return err;
11175
11176 if (err == 0)
11177 return -EINVAL;
11178
11179 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
11180 return -EINVAL;
11181
11182 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
11183 return cfg80211_start_background_radar_detection(rdev, wdev,
11184 &chandef);
11185
11186 if (cfg80211_beaconing_iface_active(wdev)) {
11187 /* During MLO other link(s) can beacon, only the current link
11188 * can not already beacon
11189 */
11190 if (wdev->valid_links &&
11191 !wdev->links[link_id].ap.beacon_interval) {
11192 /* nothing */
11193 } else {
11194 return -EBUSY;
11195 }
11196 }
11197
11198 if (wdev->links[link_id].cac_started)
11199 return -EBUSY;
11200
11201 /* CAC start is offloaded to HW and can't be started manually */
11202 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
11203 return -EOPNOTSUPP;
11204
11205 if (!rdev->ops->start_radar_detection)
11206 return -EOPNOTSUPP;
11207
11208 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
11209 if (WARN_ON(!cac_time_ms))
11210 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
11211
11212 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
11213 link_id);
11214 if (err)
11215 return err;
11216
11217 switch (wdev->iftype) {
11218 case NL80211_IFTYPE_AP:
11219 case NL80211_IFTYPE_P2P_GO:
11220 wdev->links[link_id].ap.chandef = chandef;
11221 break;
11222 case NL80211_IFTYPE_ADHOC:
11223 wdev->u.ibss.chandef = chandef;
11224 break;
11225 case NL80211_IFTYPE_MESH_POINT:
11226 wdev->u.mesh.chandef = chandef;
11227 break;
11228 default:
11229 break;
11230 }
11231 wdev->links[link_id].cac_started = true;
11232 wdev->links[link_id].cac_start_time = jiffies;
11233 wdev->links[link_id].cac_time_ms = cac_time_ms;
11234
11235 return 0;
11236 }
11237
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)11238 static int nl80211_notify_radar_detection(struct sk_buff *skb,
11239 struct genl_info *info)
11240 {
11241 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11242 struct net_device *dev = info->user_ptr[1];
11243 struct wireless_dev *wdev = dev->ieee80211_ptr;
11244 struct wiphy *wiphy = wdev->wiphy;
11245 struct cfg80211_chan_def chandef;
11246 enum nl80211_dfs_regions dfs_region;
11247 int err;
11248
11249 dfs_region = reg_get_dfs_region(wiphy);
11250 if (dfs_region == NL80211_DFS_UNSET) {
11251 GENL_SET_ERR_MSG(info,
11252 "DFS Region is not set. Unexpected Radar indication");
11253 return -EINVAL;
11254 }
11255
11256 err = nl80211_parse_chandef(rdev, info, &chandef);
11257 if (err) {
11258 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
11259 return err;
11260 }
11261
11262 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11263 if (err < 0) {
11264 GENL_SET_ERR_MSG(info, "chandef is invalid");
11265 return err;
11266 }
11267
11268 if (err == 0) {
11269 GENL_SET_ERR_MSG(info,
11270 "Unexpected Radar indication for chandef/iftype");
11271 return -EINVAL;
11272 }
11273
11274 /* Do not process this notification if radar is already detected
11275 * by kernel on this channel, and return success.
11276 */
11277 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
11278 return 0;
11279
11280 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
11281
11282 cfg80211_sched_dfs_chan_update(rdev);
11283
11284 rdev->radar_chandef = chandef;
11285
11286 /* Propagate this notification to other radios as well */
11287 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
11288
11289 return 0;
11290 }
11291
nl80211_parse_counter_offsets(struct cfg80211_registered_device * rdev,const u8 * data,size_t datalen,int first_count,struct nlattr * attr,const u16 ** offsets,unsigned int * n_offsets)11292 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
11293 const u8 *data, size_t datalen,
11294 int first_count, struct nlattr *attr,
11295 const u16 **offsets, unsigned int *n_offsets)
11296 {
11297 int i;
11298
11299 *n_offsets = 0;
11300
11301 if (!attr)
11302 return 0;
11303
11304 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
11305 return -EINVAL;
11306
11307 *n_offsets = nla_len(attr) / sizeof(u16);
11308 if (rdev->wiphy.max_num_csa_counters &&
11309 (*n_offsets > rdev->wiphy.max_num_csa_counters))
11310 return -EINVAL;
11311
11312 *offsets = nla_data(attr);
11313
11314 /* sanity checks - counters should fit and be the same */
11315 for (i = 0; i < *n_offsets; i++) {
11316 u16 offset = (*offsets)[i];
11317
11318 if (offset >= datalen)
11319 return -EINVAL;
11320
11321 if (first_count != -1 && data[offset] != first_count)
11322 return -EINVAL;
11323 }
11324
11325 return 0;
11326 }
11327
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)11328 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
11329 {
11330 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11331 unsigned int link_id = nl80211_link_id(info->attrs);
11332 struct net_device *dev = info->user_ptr[1];
11333 struct wireless_dev *wdev = dev->ieee80211_ptr;
11334 struct cfg80211_csa_settings params;
11335 struct nlattr **csa_attrs = NULL;
11336 int err;
11337 bool need_new_beacon = false;
11338 bool need_handle_dfs_flag = true;
11339 u32 cs_count;
11340
11341 if (!rdev->ops->channel_switch ||
11342 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
11343 return -EOPNOTSUPP;
11344
11345 switch (dev->ieee80211_ptr->iftype) {
11346 case NL80211_IFTYPE_AP:
11347 case NL80211_IFTYPE_P2P_GO:
11348 need_new_beacon = true;
11349 /* For all modes except AP the handle_dfs flag needs to be
11350 * supplied to tell the kernel that userspace will handle radar
11351 * events when they happen. Otherwise a switch to a channel
11352 * requiring DFS will be rejected.
11353 */
11354 need_handle_dfs_flag = false;
11355
11356 /* useless if AP is not running */
11357 if (!wdev->links[link_id].ap.beacon_interval)
11358 return -ENOTCONN;
11359 break;
11360 case NL80211_IFTYPE_ADHOC:
11361 if (!wdev->u.ibss.ssid_len)
11362 return -ENOTCONN;
11363 break;
11364 case NL80211_IFTYPE_MESH_POINT:
11365 if (!wdev->u.mesh.id_len)
11366 return -ENOTCONN;
11367 break;
11368 default:
11369 return -EOPNOTSUPP;
11370 }
11371
11372 memset(¶ms, 0, sizeof(params));
11373 params.beacon_csa.ftm_responder = -1;
11374
11375 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11376 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
11377 return -EINVAL;
11378
11379 /* only important for AP, IBSS and mesh create IEs internally */
11380 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
11381 return -EINVAL;
11382
11383 /* Even though the attribute is u32, the specification says
11384 * u8, so let's make sure we don't overflow.
11385 */
11386 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
11387 if (cs_count > 255)
11388 return -EINVAL;
11389
11390 params.count = cs_count;
11391
11392 if (!need_new_beacon)
11393 goto skip_beacons;
11394
11395 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
11396 info->extack);
11397 if (err)
11398 goto free;
11399
11400 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
11401 GFP_KERNEL);
11402 if (!csa_attrs) {
11403 err = -ENOMEM;
11404 goto free;
11405 }
11406
11407 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
11408 info->attrs[NL80211_ATTR_CSA_IES],
11409 nl80211_policy, info->extack);
11410 if (err)
11411 goto free;
11412
11413 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
11414 info->extack);
11415 if (err)
11416 goto free;
11417
11418 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
11419 err = -EINVAL;
11420 goto free;
11421 }
11422
11423 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
11424 params.beacon_csa.tail_len,
11425 params.count,
11426 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
11427 ¶ms.counter_offsets_beacon,
11428 ¶ms.n_counter_offsets_beacon);
11429 if (err)
11430 goto free;
11431
11432 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
11433 params.beacon_csa.probe_resp_len,
11434 params.count,
11435 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
11436 ¶ms.counter_offsets_presp,
11437 ¶ms.n_counter_offsets_presp);
11438 if (err)
11439 goto free;
11440
11441 skip_beacons:
11442 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
11443 if (err)
11444 goto free;
11445
11446 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
11447 wdev->iftype)) {
11448 err = -EINVAL;
11449 goto free;
11450 }
11451
11452 err = cfg80211_chandef_dfs_required(wdev->wiphy,
11453 ¶ms.chandef,
11454 wdev->iftype);
11455 if (err < 0)
11456 goto free;
11457
11458 if (err > 0) {
11459 params.radar_required = true;
11460 if (need_handle_dfs_flag &&
11461 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
11462 err = -EINVAL;
11463 goto free;
11464 }
11465 }
11466
11467 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
11468 params.block_tx = true;
11469
11470 if ((wdev->iftype == NL80211_IFTYPE_AP ||
11471 wdev->iftype == NL80211_IFTYPE_P2P_GO) &&
11472 info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
11473 err = nl80211_parse_unsol_bcast_probe_resp(
11474 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
11475 ¶ms.unsol_bcast_probe_resp);
11476 if (err)
11477 goto free;
11478 }
11479
11480 params.link_id = link_id;
11481 err = rdev_channel_switch(rdev, dev, ¶ms);
11482
11483 free:
11484 kfree(params.beacon_after.mbssid_ies);
11485 kfree(params.beacon_csa.mbssid_ies);
11486 kfree(params.beacon_after.rnr_ies);
11487 kfree(params.beacon_csa.rnr_ies);
11488 kfree(csa_attrs);
11489 return err;
11490 }
11491
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)11492 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
11493 u32 seq, int flags,
11494 struct cfg80211_registered_device *rdev,
11495 struct wireless_dev *wdev,
11496 struct cfg80211_internal_bss *intbss)
11497 {
11498 struct cfg80211_bss *res = &intbss->pub;
11499 const struct cfg80211_bss_ies *ies;
11500 unsigned int link_id;
11501 void *hdr;
11502 struct nlattr *bss;
11503
11504 lockdep_assert_wiphy(wdev->wiphy);
11505
11506 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
11507 NL80211_CMD_NEW_SCAN_RESULTS);
11508 if (!hdr)
11509 return -1;
11510
11511 genl_dump_check_consistent(cb, hdr);
11512
11513 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
11514 goto nla_put_failure;
11515 if (wdev->netdev &&
11516 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
11517 goto nla_put_failure;
11518 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11519 NL80211_ATTR_PAD))
11520 goto nla_put_failure;
11521
11522 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
11523 if (!bss)
11524 goto nla_put_failure;
11525 if ((!is_zero_ether_addr(res->bssid) &&
11526 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
11527 goto nla_put_failure;
11528
11529 rcu_read_lock();
11530 /* indicate whether we have probe response data or not */
11531 if (rcu_access_pointer(res->proberesp_ies) &&
11532 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
11533 goto fail_unlock_rcu;
11534
11535 /* this pointer prefers to be pointed to probe response data
11536 * but is always valid
11537 */
11538 ies = rcu_dereference(res->ies);
11539 if (ies) {
11540 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
11541 NL80211_BSS_PAD))
11542 goto fail_unlock_rcu;
11543 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
11544 ies->len, ies->data))
11545 goto fail_unlock_rcu;
11546 }
11547
11548 /* and this pointer is always (unless driver didn't know) beacon data */
11549 ies = rcu_dereference(res->beacon_ies);
11550 if (ies && ies->from_beacon) {
11551 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
11552 NL80211_BSS_PAD))
11553 goto fail_unlock_rcu;
11554 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
11555 ies->len, ies->data))
11556 goto fail_unlock_rcu;
11557 }
11558 rcu_read_unlock();
11559
11560 if (res->beacon_interval &&
11561 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
11562 goto nla_put_failure;
11563 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
11564 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
11565 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
11566 res->channel->freq_offset) ||
11567 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
11568 jiffies_to_msecs(jiffies - intbss->ts)))
11569 goto nla_put_failure;
11570
11571 if (intbss->parent_tsf &&
11572 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
11573 intbss->parent_tsf, NL80211_BSS_PAD) ||
11574 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
11575 intbss->parent_bssid)))
11576 goto nla_put_failure;
11577
11578 if (res->ts_boottime &&
11579 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
11580 res->ts_boottime, NL80211_BSS_PAD))
11581 goto nla_put_failure;
11582
11583 if (!nl80211_put_signal(msg, intbss->pub.chains,
11584 intbss->pub.chain_signal,
11585 NL80211_BSS_CHAIN_SIGNAL))
11586 goto nla_put_failure;
11587
11588 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
11589 switch (rdev->wiphy.signal_type) {
11590 case CFG80211_SIGNAL_TYPE_MBM:
11591 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
11592 res->signal))
11593 goto nla_put_failure;
11594 break;
11595 case CFG80211_SIGNAL_TYPE_UNSPEC:
11596 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
11597 res->signal))
11598 goto nla_put_failure;
11599 break;
11600 default:
11601 break;
11602 }
11603 }
11604
11605 switch (wdev->iftype) {
11606 case NL80211_IFTYPE_P2P_CLIENT:
11607 case NL80211_IFTYPE_STATION:
11608 for_each_valid_link(wdev, link_id) {
11609 if (intbss == wdev->links[link_id].client.current_bss &&
11610 (nla_put_u32(msg, NL80211_BSS_STATUS,
11611 NL80211_BSS_STATUS_ASSOCIATED) ||
11612 (wdev->valid_links &&
11613 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
11614 link_id) ||
11615 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
11616 wdev->u.client.connected_addr)))))
11617 goto nla_put_failure;
11618 }
11619 break;
11620 case NL80211_IFTYPE_ADHOC:
11621 if (intbss == wdev->u.ibss.current_bss &&
11622 nla_put_u32(msg, NL80211_BSS_STATUS,
11623 NL80211_BSS_STATUS_IBSS_JOINED))
11624 goto nla_put_failure;
11625 break;
11626 default:
11627 break;
11628 }
11629
11630 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
11631 goto nla_put_failure;
11632
11633 if (res->cannot_use_reasons &&
11634 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
11635 res->cannot_use_reasons,
11636 NL80211_BSS_PAD))
11637 goto nla_put_failure;
11638
11639 nla_nest_end(msg, bss);
11640
11641 genlmsg_end(msg, hdr);
11642 return 0;
11643
11644 fail_unlock_rcu:
11645 rcu_read_unlock();
11646 nla_put_failure:
11647 genlmsg_cancel(msg, hdr);
11648 return -EMSGSIZE;
11649 }
11650
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)11651 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
11652 {
11653 struct cfg80211_registered_device *rdev;
11654 struct cfg80211_internal_bss *scan;
11655 struct wireless_dev *wdev;
11656 struct nlattr **attrbuf;
11657 int start = cb->args[2], idx = 0;
11658 bool dump_include_use_data;
11659 int err;
11660
11661 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11662 if (!attrbuf)
11663 return -ENOMEM;
11664
11665 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11666 if (err) {
11667 kfree(attrbuf);
11668 return err;
11669 }
11670 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11671 __acquire(&rdev->wiphy.mtx);
11672
11673 dump_include_use_data =
11674 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
11675 kfree(attrbuf);
11676
11677 spin_lock_bh(&rdev->bss_lock);
11678
11679 /*
11680 * dump_scan will be called multiple times to break up the scan results
11681 * into multiple messages. It is unlikely that any more bss-es will be
11682 * expired after the first call, so only call only call this on the
11683 * first dump_scan invocation.
11684 */
11685 if (start == 0)
11686 cfg80211_bss_expire(rdev);
11687
11688 cb->seq = rdev->bss_generation;
11689
11690 list_for_each_entry(scan, &rdev->bss_list, list) {
11691 if (++idx <= start)
11692 continue;
11693 if (!dump_include_use_data &&
11694 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
11695 continue;
11696 if (nl80211_send_bss(skb, cb,
11697 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11698 rdev, wdev, scan) < 0) {
11699 idx--;
11700 break;
11701 }
11702 }
11703
11704 spin_unlock_bh(&rdev->bss_lock);
11705
11706 cb->args[2] = idx;
11707 wiphy_unlock(&rdev->wiphy);
11708
11709 return skb->len;
11710 }
11711
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)11712 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
11713 int flags, struct net_device *dev,
11714 bool allow_radio_stats,
11715 struct survey_info *survey)
11716 {
11717 void *hdr;
11718 struct nlattr *infoattr;
11719
11720 /* skip radio stats if userspace didn't request them */
11721 if (!survey->channel && !allow_radio_stats)
11722 return 0;
11723
11724 hdr = nl80211hdr_put(msg, portid, seq, flags,
11725 NL80211_CMD_NEW_SURVEY_RESULTS);
11726 if (!hdr)
11727 return -ENOMEM;
11728
11729 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11730 goto nla_put_failure;
11731
11732 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
11733 if (!infoattr)
11734 goto nla_put_failure;
11735
11736 if (survey->channel &&
11737 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
11738 survey->channel->center_freq))
11739 goto nla_put_failure;
11740
11741 if (survey->channel && survey->channel->freq_offset &&
11742 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
11743 survey->channel->freq_offset))
11744 goto nla_put_failure;
11745
11746 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
11747 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
11748 goto nla_put_failure;
11749 if ((survey->filled & SURVEY_INFO_IN_USE) &&
11750 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
11751 goto nla_put_failure;
11752 if ((survey->filled & SURVEY_INFO_TIME) &&
11753 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
11754 survey->time, NL80211_SURVEY_INFO_PAD))
11755 goto nla_put_failure;
11756 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
11757 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
11758 survey->time_busy, NL80211_SURVEY_INFO_PAD))
11759 goto nla_put_failure;
11760 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
11761 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
11762 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
11763 goto nla_put_failure;
11764 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
11765 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
11766 survey->time_rx, NL80211_SURVEY_INFO_PAD))
11767 goto nla_put_failure;
11768 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
11769 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
11770 survey->time_tx, NL80211_SURVEY_INFO_PAD))
11771 goto nla_put_failure;
11772 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
11773 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
11774 survey->time_scan, NL80211_SURVEY_INFO_PAD))
11775 goto nla_put_failure;
11776 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
11777 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
11778 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
11779 goto nla_put_failure;
11780
11781 nla_nest_end(msg, infoattr);
11782
11783 genlmsg_end(msg, hdr);
11784 return 0;
11785
11786 nla_put_failure:
11787 genlmsg_cancel(msg, hdr);
11788 return -EMSGSIZE;
11789 }
11790
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)11791 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
11792 {
11793 struct nlattr **attrbuf;
11794 struct survey_info survey;
11795 struct cfg80211_registered_device *rdev;
11796 struct wireless_dev *wdev;
11797 int survey_idx = cb->args[2];
11798 int res;
11799 bool radio_stats;
11800
11801 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11802 if (!attrbuf)
11803 return -ENOMEM;
11804
11805 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11806 if (res) {
11807 kfree(attrbuf);
11808 return res;
11809 }
11810 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11811 __acquire(&rdev->wiphy.mtx);
11812
11813 /* prepare_wdev_dump parsed the attributes */
11814 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
11815
11816 if (!wdev->netdev) {
11817 res = -EINVAL;
11818 goto out_err;
11819 }
11820
11821 if (!rdev->ops->dump_survey) {
11822 res = -EOPNOTSUPP;
11823 goto out_err;
11824 }
11825
11826 while (1) {
11827 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
11828 if (res == -ENOENT)
11829 break;
11830 if (res)
11831 goto out_err;
11832
11833 /* don't send disabled channels, but do send non-channel data */
11834 if (survey.channel &&
11835 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
11836 survey_idx++;
11837 continue;
11838 }
11839
11840 if (nl80211_send_survey(skb,
11841 NETLINK_CB(cb->skb).portid,
11842 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11843 wdev->netdev, radio_stats, &survey) < 0)
11844 goto out;
11845 survey_idx++;
11846 }
11847
11848 out:
11849 cb->args[2] = survey_idx;
11850 res = skb->len;
11851 out_err:
11852 kfree(attrbuf);
11853 wiphy_unlock(&rdev->wiphy);
11854 return res;
11855 }
11856
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)11857 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
11858 {
11859 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11860 struct net_device *dev = info->user_ptr[1];
11861 struct ieee80211_channel *chan;
11862 const u8 *bssid, *ssid;
11863 int err, ssid_len;
11864 enum nl80211_auth_type auth_type;
11865 struct key_parse key;
11866 bool local_state_change;
11867 struct cfg80211_auth_request req = {};
11868 u32 freq;
11869
11870 if (!info->attrs[NL80211_ATTR_MAC])
11871 return -EINVAL;
11872
11873 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
11874 return -EINVAL;
11875
11876 if (!info->attrs[NL80211_ATTR_SSID])
11877 return -EINVAL;
11878
11879 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11880 return -EINVAL;
11881
11882 err = nl80211_parse_key(info, &key);
11883 if (err)
11884 return err;
11885
11886 if (key.idx >= 0) {
11887 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
11888 return -EINVAL;
11889 if (!key.p.key || !key.p.key_len)
11890 return -EINVAL;
11891 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
11892 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
11893 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
11894 key.p.key_len != WLAN_KEY_LEN_WEP104))
11895 return -EINVAL;
11896 if (key.idx > 3)
11897 return -EINVAL;
11898 } else {
11899 key.p.key_len = 0;
11900 key.p.key = NULL;
11901 }
11902
11903 if (key.idx >= 0) {
11904 int i;
11905 bool ok = false;
11906
11907 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
11908 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
11909 ok = true;
11910 break;
11911 }
11912 }
11913 if (!ok)
11914 return -EINVAL;
11915 }
11916
11917 if (!rdev->ops->auth)
11918 return -EOPNOTSUPP;
11919
11920 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11921 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11922 return -EOPNOTSUPP;
11923
11924 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11925 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11926 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11927 freq +=
11928 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11929
11930 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11931 if (!chan)
11932 return -EINVAL;
11933
11934 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11935 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11936
11937 if (info->attrs[NL80211_ATTR_IE]) {
11938 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11939 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11940 }
11941
11942 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11943 req.supported_selectors =
11944 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11945 req.supported_selectors_len =
11946 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11947 }
11948
11949 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11950 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
11951 return -EINVAL;
11952
11953 if ((auth_type == NL80211_AUTHTYPE_SAE ||
11954 auth_type == NL80211_AUTHTYPE_FILS_SK ||
11955 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
11956 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
11957 !info->attrs[NL80211_ATTR_AUTH_DATA])
11958 return -EINVAL;
11959
11960 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
11961 if (auth_type != NL80211_AUTHTYPE_SAE &&
11962 auth_type != NL80211_AUTHTYPE_FILS_SK &&
11963 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
11964 auth_type != NL80211_AUTHTYPE_FILS_PK)
11965 return -EINVAL;
11966 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
11967 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
11968 }
11969
11970 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11971
11972 /*
11973 * Since we no longer track auth state, ignore
11974 * requests to only change local state.
11975 */
11976 if (local_state_change)
11977 return 0;
11978
11979 req.auth_type = auth_type;
11980 req.key = key.p.key;
11981 req.key_len = key.p.key_len;
11982 req.key_idx = key.idx;
11983 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11984 if (req.link_id >= 0) {
11985 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11986 return -EINVAL;
11987 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
11988 return -EINVAL;
11989 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11990 if (!is_valid_ether_addr(req.ap_mld_addr))
11991 return -EINVAL;
11992 }
11993
11994 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
11995 IEEE80211_BSS_TYPE_ESS,
11996 IEEE80211_PRIVACY_ANY);
11997 if (!req.bss)
11998 return -ENOENT;
11999
12000 err = cfg80211_mlme_auth(rdev, dev, &req);
12001
12002 cfg80211_put_bss(&rdev->wiphy, req.bss);
12003
12004 return err;
12005 }
12006
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)12007 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
12008 struct genl_info *info)
12009 {
12010 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12011 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
12012 return -EINVAL;
12013 }
12014
12015 if (!rdev->ops->tx_control_port ||
12016 !wiphy_ext_feature_isset(&rdev->wiphy,
12017 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12018 return -EOPNOTSUPP;
12019
12020 return 0;
12021 }
12022
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)12023 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
12024 struct genl_info *info,
12025 struct cfg80211_crypto_settings *settings,
12026 int cipher_limit)
12027 {
12028 memset(settings, 0, sizeof(*settings));
12029
12030 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
12031
12032 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12033 u16 proto;
12034
12035 proto = nla_get_u16(
12036 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12037 settings->control_port_ethertype = cpu_to_be16(proto);
12038 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
12039 proto != ETH_P_PAE)
12040 return -EINVAL;
12041 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
12042 settings->control_port_no_encrypt = true;
12043 } else
12044 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
12045
12046 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12047 int r = validate_pae_over_nl80211(rdev, info);
12048
12049 if (r < 0)
12050 return r;
12051
12052 settings->control_port_over_nl80211 = true;
12053
12054 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
12055 settings->control_port_no_preauth = true;
12056 }
12057
12058 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
12059 void *data;
12060 int len, i;
12061
12062 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12063 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12064 settings->n_ciphers_pairwise = len / sizeof(u32);
12065
12066 if (len % sizeof(u32))
12067 return -EINVAL;
12068
12069 if (settings->n_ciphers_pairwise > cipher_limit)
12070 return -EINVAL;
12071
12072 memcpy(settings->ciphers_pairwise, data, len);
12073
12074 for (i = 0; i < settings->n_ciphers_pairwise; i++)
12075 if (!cfg80211_supported_cipher_suite(
12076 &rdev->wiphy,
12077 settings->ciphers_pairwise[i]))
12078 return -EINVAL;
12079 }
12080
12081 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
12082 settings->cipher_group =
12083 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
12084 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
12085 settings->cipher_group))
12086 return -EINVAL;
12087 }
12088
12089 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
12090 settings->wpa_versions =
12091 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
12092
12093 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
12094 void *data;
12095 int len;
12096
12097 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
12098 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
12099 settings->n_akm_suites = len / sizeof(u32);
12100
12101 if (len % sizeof(u32))
12102 return -EINVAL;
12103
12104 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
12105 return -EINVAL;
12106
12107 memcpy(settings->akm_suites, data, len);
12108 }
12109
12110 if (info->attrs[NL80211_ATTR_PMK]) {
12111 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
12112 return -EINVAL;
12113 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12114 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
12115 !wiphy_ext_feature_isset(&rdev->wiphy,
12116 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
12117 return -EINVAL;
12118 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12119 }
12120
12121 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
12122 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12123 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
12124 !wiphy_ext_feature_isset(&rdev->wiphy,
12125 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
12126 return -EINVAL;
12127 settings->sae_pwd =
12128 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12129 settings->sae_pwd_len =
12130 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12131 }
12132
12133 settings->sae_pwe =
12134 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
12135 NL80211_SAE_PWE_UNSPECIFIED);
12136
12137 return 0;
12138 }
12139
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs,int assoc_link_id,int link_id)12140 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
12141 const u8 *ssid, int ssid_len,
12142 struct nlattr **attrs,
12143 int assoc_link_id, int link_id)
12144 {
12145 struct ieee80211_channel *chan;
12146 struct cfg80211_bss *bss;
12147 const u8 *bssid;
12148 u32 freq, use_for = 0;
12149
12150 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
12151 return ERR_PTR(-EINVAL);
12152
12153 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
12154
12155 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
12156 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12157 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12158
12159 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
12160 if (!chan)
12161 return ERR_PTR(-EINVAL);
12162
12163 if (assoc_link_id >= 0)
12164 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
12165 if (assoc_link_id == link_id)
12166 use_for |= NL80211_BSS_USE_FOR_NORMAL;
12167
12168 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
12169 ssid, ssid_len,
12170 IEEE80211_BSS_TYPE_ESS,
12171 IEEE80211_PRIVACY_ANY,
12172 use_for);
12173 if (!bss)
12174 return ERR_PTR(-ENOENT);
12175
12176 return bss;
12177 }
12178
nl80211_process_links(struct cfg80211_registered_device * rdev,struct cfg80211_assoc_link * links,int assoc_link_id,const u8 * ssid,int ssid_len,struct genl_info * info)12179 static int nl80211_process_links(struct cfg80211_registered_device *rdev,
12180 struct cfg80211_assoc_link *links,
12181 int assoc_link_id,
12182 const u8 *ssid, int ssid_len,
12183 struct genl_info *info)
12184 {
12185 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
12186 struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
12187 struct nlattr *link;
12188 unsigned int link_id;
12189 int rem, err;
12190
12191 if (!attrs)
12192 return -ENOMEM;
12193
12194 nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
12195 memset(attrs, 0, attrsize);
12196
12197 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
12198
12199 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
12200 NL_SET_BAD_ATTR(info->extack, link);
12201 return -EINVAL;
12202 }
12203
12204 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
12205 /* cannot use the same link ID again */
12206 if (links[link_id].bss) {
12207 NL_SET_BAD_ATTR(info->extack, link);
12208 return -EINVAL;
12209 }
12210 links[link_id].bss =
12211 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
12212 assoc_link_id, link_id);
12213 if (IS_ERR(links[link_id].bss)) {
12214 err = PTR_ERR(links[link_id].bss);
12215 links[link_id].bss = NULL;
12216 NL_SET_ERR_MSG_ATTR(info->extack, link,
12217 "Error fetching BSS for link");
12218 return err;
12219 }
12220
12221 if (attrs[NL80211_ATTR_IE]) {
12222 links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
12223 links[link_id].elems_len =
12224 nla_len(attrs[NL80211_ATTR_IE]);
12225
12226 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
12227 links[link_id].elems,
12228 links[link_id].elems_len)) {
12229 NL_SET_ERR_MSG_ATTR(info->extack,
12230 attrs[NL80211_ATTR_IE],
12231 "cannot deal with fragmentation");
12232 return -EINVAL;
12233 }
12234
12235 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12236 links[link_id].elems,
12237 links[link_id].elems_len)) {
12238 NL_SET_ERR_MSG_ATTR(info->extack,
12239 attrs[NL80211_ATTR_IE],
12240 "cannot deal with non-inheritance");
12241 return -EINVAL;
12242 }
12243 }
12244 }
12245
12246 return 0;
12247 }
12248
nl80211_associate(struct sk_buff * skb,struct genl_info * info)12249 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
12250 {
12251 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12252 struct net_device *dev = info->user_ptr[1];
12253 struct cfg80211_assoc_request req = {};
12254 const u8 *ap_addr, *ssid;
12255 unsigned int link_id;
12256 int err, ssid_len;
12257
12258 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12259 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12260 return -EPERM;
12261
12262 if (!info->attrs[NL80211_ATTR_SSID])
12263 return -EINVAL;
12264
12265 if (!rdev->ops->assoc)
12266 return -EOPNOTSUPP;
12267
12268 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12269 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12270 return -EOPNOTSUPP;
12271
12272 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12273 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12274
12275 if (info->attrs[NL80211_ATTR_IE]) {
12276 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12277 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12278
12279 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12280 req.ie, req.ie_len)) {
12281 NL_SET_ERR_MSG_ATTR(info->extack,
12282 info->attrs[NL80211_ATTR_IE],
12283 "non-inheritance makes no sense");
12284 return -EINVAL;
12285 }
12286 }
12287
12288 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12289 enum nl80211_mfp mfp =
12290 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12291 if (mfp == NL80211_MFP_REQUIRED)
12292 req.use_mfp = true;
12293 else if (mfp != NL80211_MFP_NO)
12294 return -EINVAL;
12295 }
12296
12297 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12298 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12299
12300 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
12301 req.supported_selectors =
12302 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12303 req.supported_selectors_len =
12304 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12305 }
12306
12307 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12308 req.flags |= ASSOC_REQ_DISABLE_HT;
12309
12310 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12311 memcpy(&req.ht_capa_mask,
12312 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12313 sizeof(req.ht_capa_mask));
12314
12315 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12316 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12317 return -EINVAL;
12318 memcpy(&req.ht_capa,
12319 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12320 sizeof(req.ht_capa));
12321 }
12322
12323 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12324 req.flags |= ASSOC_REQ_DISABLE_VHT;
12325
12326 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12327 req.flags |= ASSOC_REQ_DISABLE_HE;
12328
12329 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12330 req.flags |= ASSOC_REQ_DISABLE_EHT;
12331
12332 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12333 memcpy(&req.vht_capa_mask,
12334 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12335 sizeof(req.vht_capa_mask));
12336
12337 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12338 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12339 return -EINVAL;
12340 memcpy(&req.vht_capa,
12341 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12342 sizeof(req.vht_capa));
12343 }
12344
12345 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12346 if (!((rdev->wiphy.features &
12347 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12348 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12349 !wiphy_ext_feature_isset(&rdev->wiphy,
12350 NL80211_EXT_FEATURE_RRM))
12351 return -EINVAL;
12352 req.flags |= ASSOC_REQ_USE_RRM;
12353 }
12354
12355 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
12356 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
12357 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
12358 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
12359 return -EINVAL;
12360 req.fils_nonces =
12361 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
12362 }
12363
12364 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
12365 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
12366 return -EINVAL;
12367 memcpy(&req.s1g_capa_mask,
12368 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
12369 sizeof(req.s1g_capa_mask));
12370 }
12371
12372 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
12373 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
12374 return -EINVAL;
12375 memcpy(&req.s1g_capa,
12376 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
12377 sizeof(req.s1g_capa));
12378 }
12379
12380 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
12381 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12382 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
12383 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
12384 return -EINVAL;
12385 }
12386 req.flags |= ASSOC_REQ_SPP_AMSDU;
12387 }
12388
12389 req.link_id = nl80211_link_id_or_invalid(info->attrs);
12390
12391 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12392 if (req.link_id < 0)
12393 return -EINVAL;
12394
12395 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
12396 return -EINVAL;
12397
12398 if (info->attrs[NL80211_ATTR_MAC] ||
12399 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12400 !info->attrs[NL80211_ATTR_MLD_ADDR])
12401 return -EINVAL;
12402
12403 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
12404 ap_addr = req.ap_mld_addr;
12405
12406 err = nl80211_process_links(rdev, req.links, req.link_id,
12407 ssid, ssid_len, info);
12408 if (err)
12409 goto free;
12410
12411 if (!req.links[req.link_id].bss) {
12412 err = -EINVAL;
12413 goto free;
12414 }
12415
12416 if (req.links[req.link_id].elems_len) {
12417 GENL_SET_ERR_MSG(info,
12418 "cannot have per-link elems on assoc link");
12419 err = -EINVAL;
12420 goto free;
12421 }
12422
12423 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12424 req.ext_mld_capa_ops =
12425 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
12426 } else {
12427 if (req.link_id >= 0)
12428 return -EINVAL;
12429
12430 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
12431 -1, -1);
12432 if (IS_ERR(req.bss))
12433 return PTR_ERR(req.bss);
12434 ap_addr = req.bss->bssid;
12435
12436 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12437 return -EINVAL;
12438 }
12439
12440 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
12441 if (!err) {
12442 struct nlattr *link;
12443 int rem = 0;
12444
12445 err = cfg80211_mlme_assoc(rdev, dev, &req,
12446 info->extack);
12447
12448 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12449 dev->ieee80211_ptr->conn_owner_nlportid =
12450 info->snd_portid;
12451 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12452 ap_addr, ETH_ALEN);
12453 }
12454
12455 /* Report error from first problematic link */
12456 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12457 nla_for_each_nested(link,
12458 info->attrs[NL80211_ATTR_MLO_LINKS],
12459 rem) {
12460 struct nlattr *link_id_attr =
12461 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
12462
12463 if (!link_id_attr)
12464 continue;
12465
12466 link_id = nla_get_u8(link_id_attr);
12467
12468 if (link_id == req.link_id)
12469 continue;
12470
12471 if (!req.links[link_id].error ||
12472 WARN_ON(req.links[link_id].error > 0))
12473 continue;
12474
12475 WARN_ON(err >= 0);
12476
12477 NL_SET_BAD_ATTR(info->extack, link);
12478 err = req.links[link_id].error;
12479 break;
12480 }
12481 }
12482 }
12483
12484 free:
12485 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
12486 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
12487 cfg80211_put_bss(&rdev->wiphy, req.bss);
12488
12489 return err;
12490 }
12491
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)12492 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
12493 {
12494 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12495 struct net_device *dev = info->user_ptr[1];
12496 const u8 *ie = NULL, *bssid;
12497 int ie_len = 0;
12498 u16 reason_code;
12499 bool local_state_change;
12500
12501 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12502 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12503 return -EPERM;
12504
12505 if (!info->attrs[NL80211_ATTR_MAC])
12506 return -EINVAL;
12507
12508 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12509 return -EINVAL;
12510
12511 if (!rdev->ops->deauth)
12512 return -EOPNOTSUPP;
12513
12514 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12515 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12516 return -EOPNOTSUPP;
12517
12518 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12519
12520 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12521 if (reason_code == 0) {
12522 /* Reason Code 0 is reserved */
12523 return -EINVAL;
12524 }
12525
12526 if (info->attrs[NL80211_ATTR_IE]) {
12527 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12528 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12529 }
12530
12531 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12532
12533 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
12534 local_state_change);
12535 }
12536
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)12537 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
12538 {
12539 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12540 struct net_device *dev = info->user_ptr[1];
12541 const u8 *ie = NULL, *bssid;
12542 int ie_len = 0;
12543 u16 reason_code;
12544 bool local_state_change;
12545
12546 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12547 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12548 return -EPERM;
12549
12550 if (!info->attrs[NL80211_ATTR_MAC])
12551 return -EINVAL;
12552
12553 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12554 return -EINVAL;
12555
12556 if (!rdev->ops->disassoc)
12557 return -EOPNOTSUPP;
12558
12559 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12560 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12561 return -EOPNOTSUPP;
12562
12563 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12564
12565 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12566 if (reason_code == 0) {
12567 /* Reason Code 0 is reserved */
12568 return -EINVAL;
12569 }
12570
12571 if (info->attrs[NL80211_ATTR_IE]) {
12572 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12573 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12574 }
12575
12576 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12577
12578 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
12579 local_state_change);
12580 }
12581
12582 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)12583 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
12584 int mcast_rate[NUM_NL80211_BANDS],
12585 int rateval)
12586 {
12587 struct wiphy *wiphy = &rdev->wiphy;
12588 bool found = false;
12589 int band, i;
12590
12591 for (band = 0; band < NUM_NL80211_BANDS; band++) {
12592 struct ieee80211_supported_band *sband;
12593
12594 sband = wiphy->bands[band];
12595 if (!sband)
12596 continue;
12597
12598 for (i = 0; i < sband->n_bitrates; i++) {
12599 if (sband->bitrates[i].bitrate == rateval) {
12600 mcast_rate[band] = i + 1;
12601 found = true;
12602 break;
12603 }
12604 }
12605 }
12606
12607 return found;
12608 }
12609
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)12610 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
12611 {
12612 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12613 struct net_device *dev = info->user_ptr[1];
12614 struct cfg80211_ibss_params ibss;
12615 struct wiphy *wiphy;
12616 struct cfg80211_cached_keys *connkeys = NULL;
12617 int err;
12618
12619 memset(&ibss, 0, sizeof(ibss));
12620
12621 if (!info->attrs[NL80211_ATTR_SSID] ||
12622 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12623 return -EINVAL;
12624
12625 ibss.beacon_interval = 100;
12626
12627 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
12628 ibss.beacon_interval =
12629 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12630
12631 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
12632 ibss.beacon_interval);
12633 if (err)
12634 return err;
12635
12636 if (!rdev->ops->join_ibss)
12637 return -EOPNOTSUPP;
12638
12639 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12640 return -EOPNOTSUPP;
12641
12642 wiphy = &rdev->wiphy;
12643
12644 if (info->attrs[NL80211_ATTR_MAC]) {
12645 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12646
12647 if (!is_valid_ether_addr(ibss.bssid))
12648 return -EINVAL;
12649 }
12650 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12651 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12652
12653 if (info->attrs[NL80211_ATTR_IE]) {
12654 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12655 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12656 }
12657
12658 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
12659 if (err)
12660 return err;
12661
12662 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
12663 NL80211_IFTYPE_ADHOC))
12664 return -EINVAL;
12665
12666 switch (ibss.chandef.width) {
12667 case NL80211_CHAN_WIDTH_5:
12668 case NL80211_CHAN_WIDTH_10:
12669 case NL80211_CHAN_WIDTH_20_NOHT:
12670 break;
12671 case NL80211_CHAN_WIDTH_20:
12672 case NL80211_CHAN_WIDTH_40:
12673 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12674 return -EINVAL;
12675 break;
12676 case NL80211_CHAN_WIDTH_80:
12677 case NL80211_CHAN_WIDTH_80P80:
12678 case NL80211_CHAN_WIDTH_160:
12679 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12680 return -EINVAL;
12681 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12682 NL80211_EXT_FEATURE_VHT_IBSS))
12683 return -EINVAL;
12684 break;
12685 case NL80211_CHAN_WIDTH_320:
12686 return -EINVAL;
12687 default:
12688 return -EINVAL;
12689 }
12690
12691 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
12692 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
12693
12694 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12695 u8 *rates =
12696 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12697 int n_rates =
12698 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12699 struct ieee80211_supported_band *sband =
12700 wiphy->bands[ibss.chandef.chan->band];
12701
12702 err = ieee80211_get_ratemask(sband, rates, n_rates,
12703 &ibss.basic_rates);
12704 if (err)
12705 return err;
12706 }
12707
12708 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12709 memcpy(&ibss.ht_capa_mask,
12710 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12711 sizeof(ibss.ht_capa_mask));
12712
12713 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12714 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12715 return -EINVAL;
12716 memcpy(&ibss.ht_capa,
12717 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12718 sizeof(ibss.ht_capa));
12719 }
12720
12721 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12722 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
12723 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12724 return -EINVAL;
12725
12726 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12727 bool no_ht = false;
12728
12729 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
12730 if (IS_ERR(connkeys))
12731 return PTR_ERR(connkeys);
12732
12733 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
12734 no_ht) {
12735 kfree_sensitive(connkeys);
12736 return -EINVAL;
12737 }
12738 }
12739
12740 ibss.control_port =
12741 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
12742
12743 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12744 int r = validate_pae_over_nl80211(rdev, info);
12745
12746 if (r < 0) {
12747 kfree_sensitive(connkeys);
12748 return r;
12749 }
12750
12751 ibss.control_port_over_nl80211 = true;
12752 }
12753
12754 ibss.userspace_handles_dfs =
12755 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12756
12757 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
12758 if (err)
12759 kfree_sensitive(connkeys);
12760 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
12761 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12762
12763 return err;
12764 }
12765
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)12766 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
12767 {
12768 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12769 struct net_device *dev = info->user_ptr[1];
12770
12771 if (!rdev->ops->leave_ibss)
12772 return -EOPNOTSUPP;
12773
12774 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12775 return -EOPNOTSUPP;
12776
12777 return cfg80211_leave_ibss(rdev, dev, false);
12778 }
12779
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)12780 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
12781 {
12782 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12783 struct net_device *dev = info->user_ptr[1];
12784 int mcast_rate[NUM_NL80211_BANDS];
12785 u32 nla_rate;
12786
12787 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
12788 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
12789 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
12790 return -EOPNOTSUPP;
12791
12792 if (!rdev->ops->set_mcast_rate)
12793 return -EOPNOTSUPP;
12794
12795 memset(mcast_rate, 0, sizeof(mcast_rate));
12796
12797 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
12798 return -EINVAL;
12799
12800 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
12801 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
12802 return -EINVAL;
12803
12804 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
12805 }
12806
12807 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)12808 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
12809 struct wireless_dev *wdev, int approxlen,
12810 u32 portid, u32 seq, enum nl80211_commands cmd,
12811 enum nl80211_attrs attr,
12812 const struct nl80211_vendor_cmd_info *info,
12813 gfp_t gfp)
12814 {
12815 struct sk_buff *skb;
12816 void *hdr;
12817 struct nlattr *data;
12818
12819 skb = nlmsg_new(approxlen + 100, gfp);
12820 if (!skb)
12821 return NULL;
12822
12823 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
12824 if (!hdr) {
12825 kfree_skb(skb);
12826 return NULL;
12827 }
12828
12829 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12830 goto nla_put_failure;
12831
12832 if (info) {
12833 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
12834 info->vendor_id))
12835 goto nla_put_failure;
12836 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
12837 info->subcmd))
12838 goto nla_put_failure;
12839 }
12840
12841 if (wdev) {
12842 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12843 wdev_id(wdev), NL80211_ATTR_PAD))
12844 goto nla_put_failure;
12845 if (wdev->netdev &&
12846 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
12847 wdev->netdev->ifindex))
12848 goto nla_put_failure;
12849 }
12850
12851 data = nla_nest_start_noflag(skb, attr);
12852 if (!data)
12853 goto nla_put_failure;
12854
12855 ((void **)skb->cb)[0] = rdev;
12856 ((void **)skb->cb)[1] = hdr;
12857 ((void **)skb->cb)[2] = data;
12858
12859 return skb;
12860
12861 nla_put_failure:
12862 kfree_skb(skb);
12863 return NULL;
12864 }
12865
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)12866 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
12867 struct wireless_dev *wdev,
12868 enum nl80211_commands cmd,
12869 enum nl80211_attrs attr,
12870 unsigned int portid,
12871 int vendor_event_idx,
12872 int approxlen, gfp_t gfp)
12873 {
12874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12875 const struct nl80211_vendor_cmd_info *info;
12876
12877 switch (cmd) {
12878 case NL80211_CMD_TESTMODE:
12879 if (WARN_ON(vendor_event_idx != -1))
12880 return NULL;
12881 info = NULL;
12882 break;
12883 case NL80211_CMD_VENDOR:
12884 if (WARN_ON(vendor_event_idx < 0 ||
12885 vendor_event_idx >= wiphy->n_vendor_events))
12886 return NULL;
12887 info = &wiphy->vendor_events[vendor_event_idx];
12888 break;
12889 default:
12890 WARN_ON(1);
12891 return NULL;
12892 }
12893
12894 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
12895 cmd, attr, info, gfp);
12896 }
12897 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
12898
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)12899 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
12900 {
12901 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12902 void *hdr = ((void **)skb->cb)[1];
12903 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
12904 struct nlattr *data = ((void **)skb->cb)[2];
12905 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
12906
12907 /* clear CB data for netlink core to own from now on */
12908 memset(skb->cb, 0, sizeof(skb->cb));
12909
12910 nla_nest_end(skb, data);
12911 genlmsg_end(skb, hdr);
12912
12913 if (nlhdr->nlmsg_pid) {
12914 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
12915 nlhdr->nlmsg_pid);
12916 } else {
12917 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
12918 mcgrp = NL80211_MCGRP_VENDOR;
12919
12920 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12921 skb, 0, mcgrp, gfp);
12922 }
12923 }
12924 EXPORT_SYMBOL(__cfg80211_send_event_skb);
12925
12926 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)12927 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
12928 {
12929 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12930 struct wireless_dev *wdev;
12931 int err;
12932
12933 lockdep_assert_held(&rdev->wiphy.mtx);
12934
12935 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
12936 info->attrs);
12937
12938 if (!rdev->ops->testmode_cmd)
12939 return -EOPNOTSUPP;
12940
12941 if (IS_ERR(wdev)) {
12942 err = PTR_ERR(wdev);
12943 if (err != -EINVAL)
12944 return err;
12945 wdev = NULL;
12946 } else if (wdev->wiphy != &rdev->wiphy) {
12947 return -EINVAL;
12948 }
12949
12950 if (!info->attrs[NL80211_ATTR_TESTDATA])
12951 return -EINVAL;
12952
12953 rdev->cur_cmd_info = info;
12954 err = rdev_testmode_cmd(rdev, wdev,
12955 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
12956 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
12957 rdev->cur_cmd_info = NULL;
12958
12959 return err;
12960 }
12961
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)12962 static int nl80211_testmode_dump(struct sk_buff *skb,
12963 struct netlink_callback *cb)
12964 {
12965 struct cfg80211_registered_device *rdev;
12966 struct nlattr **attrbuf = NULL;
12967 int err;
12968 long phy_idx;
12969 void *data = NULL;
12970 int data_len = 0;
12971
12972 rtnl_lock();
12973
12974 if (cb->args[0]) {
12975 /*
12976 * 0 is a valid index, but not valid for args[0],
12977 * so we need to offset by 1.
12978 */
12979 phy_idx = cb->args[0] - 1;
12980
12981 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
12982 if (!rdev) {
12983 err = -ENOENT;
12984 goto out_err;
12985 }
12986 } else {
12987 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
12988 GFP_KERNEL);
12989 if (!attrbuf) {
12990 err = -ENOMEM;
12991 goto out_err;
12992 }
12993
12994 err = nlmsg_parse_deprecated(cb->nlh,
12995 GENL_HDRLEN + nl80211_fam.hdrsize,
12996 attrbuf, nl80211_fam.maxattr,
12997 nl80211_policy, NULL);
12998 if (err)
12999 goto out_err;
13000
13001 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13002 if (IS_ERR(rdev)) {
13003 err = PTR_ERR(rdev);
13004 goto out_err;
13005 }
13006 phy_idx = rdev->wiphy_idx;
13007
13008 if (attrbuf[NL80211_ATTR_TESTDATA])
13009 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
13010 }
13011
13012 if (cb->args[1]) {
13013 data = nla_data((void *)cb->args[1]);
13014 data_len = nla_len((void *)cb->args[1]);
13015 }
13016
13017 if (!rdev->ops->testmode_dump) {
13018 err = -EOPNOTSUPP;
13019 goto out_err;
13020 }
13021
13022 while (1) {
13023 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13024 cb->nlh->nlmsg_seq, NLM_F_MULTI,
13025 NL80211_CMD_TESTMODE);
13026 struct nlattr *tmdata;
13027
13028 if (!hdr)
13029 break;
13030
13031 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
13032 genlmsg_cancel(skb, hdr);
13033 break;
13034 }
13035
13036 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
13037 if (!tmdata) {
13038 genlmsg_cancel(skb, hdr);
13039 break;
13040 }
13041 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
13042 nla_nest_end(skb, tmdata);
13043
13044 if (err == -ENOBUFS || err == -ENOENT) {
13045 genlmsg_cancel(skb, hdr);
13046 break;
13047 } else if (err) {
13048 genlmsg_cancel(skb, hdr);
13049 goto out_err;
13050 }
13051
13052 genlmsg_end(skb, hdr);
13053 }
13054
13055 err = skb->len;
13056 /* see above */
13057 cb->args[0] = phy_idx + 1;
13058 out_err:
13059 kfree(attrbuf);
13060 rtnl_unlock();
13061 return err;
13062 }
13063 #endif
13064
nl80211_connect(struct sk_buff * skb,struct genl_info * info)13065 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
13066 {
13067 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13068 struct net_device *dev = info->user_ptr[1];
13069 struct cfg80211_connect_params connect;
13070 struct wiphy *wiphy;
13071 struct cfg80211_cached_keys *connkeys = NULL;
13072 u32 freq = 0;
13073 int err;
13074
13075 memset(&connect, 0, sizeof(connect));
13076
13077 if (!info->attrs[NL80211_ATTR_SSID] ||
13078 !nla_len(info->attrs[NL80211_ATTR_SSID]))
13079 return -EINVAL;
13080
13081 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13082 connect.auth_type =
13083 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13084 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
13085 NL80211_CMD_CONNECT))
13086 return -EINVAL;
13087 } else
13088 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
13089
13090 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
13091
13092 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
13093 !wiphy_ext_feature_isset(&rdev->wiphy,
13094 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13095 return -EINVAL;
13096 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
13097
13098 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
13099 NL80211_MAX_NR_CIPHER_SUITES);
13100 if (err)
13101 return err;
13102
13103 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13104 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13105 return -EOPNOTSUPP;
13106
13107 wiphy = &rdev->wiphy;
13108
13109 connect.bg_scan_period = -1;
13110 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
13111 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
13112 connect.bg_scan_period =
13113 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
13114 }
13115
13116 if (info->attrs[NL80211_ATTR_MAC])
13117 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13118 else if (info->attrs[NL80211_ATTR_MAC_HINT])
13119 connect.bssid_hint =
13120 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
13121 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13122 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13123
13124 if (info->attrs[NL80211_ATTR_IE]) {
13125 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13126 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13127 }
13128
13129 if (info->attrs[NL80211_ATTR_USE_MFP]) {
13130 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
13131 if (connect.mfp == NL80211_MFP_OPTIONAL &&
13132 !wiphy_ext_feature_isset(&rdev->wiphy,
13133 NL80211_EXT_FEATURE_MFP_OPTIONAL))
13134 return -EOPNOTSUPP;
13135 } else {
13136 connect.mfp = NL80211_MFP_NO;
13137 }
13138
13139 if (info->attrs[NL80211_ATTR_PREV_BSSID])
13140 connect.prev_bssid =
13141 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
13142
13143 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
13144 freq = MHZ_TO_KHZ(nla_get_u32(
13145 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
13146 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
13147 freq +=
13148 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
13149
13150 if (freq) {
13151 connect.channel = nl80211_get_valid_chan(wiphy, freq);
13152 if (!connect.channel)
13153 return -EINVAL;
13154 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
13155 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
13156 freq = MHZ_TO_KHZ(freq);
13157 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
13158 if (!connect.channel_hint)
13159 return -EINVAL;
13160 }
13161
13162 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
13163 connect.edmg.channels =
13164 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
13165
13166 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
13167 connect.edmg.bw_config =
13168 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
13169 }
13170
13171 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
13172 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
13173 if (IS_ERR(connkeys))
13174 return PTR_ERR(connkeys);
13175 }
13176
13177 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
13178 connect.flags |= ASSOC_REQ_DISABLE_HT;
13179
13180 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
13181 memcpy(&connect.ht_capa_mask,
13182 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
13183 sizeof(connect.ht_capa_mask));
13184
13185 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
13186 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
13187 kfree_sensitive(connkeys);
13188 return -EINVAL;
13189 }
13190 memcpy(&connect.ht_capa,
13191 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
13192 sizeof(connect.ht_capa));
13193 }
13194
13195 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
13196 connect.flags |= ASSOC_REQ_DISABLE_VHT;
13197
13198 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
13199 connect.flags |= ASSOC_REQ_DISABLE_HE;
13200
13201 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
13202 connect.flags |= ASSOC_REQ_DISABLE_EHT;
13203
13204 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
13205 memcpy(&connect.vht_capa_mask,
13206 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
13207 sizeof(connect.vht_capa_mask));
13208
13209 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
13210 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
13211 kfree_sensitive(connkeys);
13212 return -EINVAL;
13213 }
13214 memcpy(&connect.vht_capa,
13215 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
13216 sizeof(connect.vht_capa));
13217 }
13218
13219 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
13220 if (!((rdev->wiphy.features &
13221 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
13222 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
13223 !wiphy_ext_feature_isset(&rdev->wiphy,
13224 NL80211_EXT_FEATURE_RRM)) {
13225 kfree_sensitive(connkeys);
13226 return -EINVAL;
13227 }
13228 connect.flags |= ASSOC_REQ_USE_RRM;
13229 }
13230
13231 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
13232 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
13233 kfree_sensitive(connkeys);
13234 return -EOPNOTSUPP;
13235 }
13236
13237 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
13238 /* bss selection makes no sense if bssid is set */
13239 if (connect.bssid) {
13240 kfree_sensitive(connkeys);
13241 return -EINVAL;
13242 }
13243
13244 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
13245 wiphy, &connect.bss_select);
13246 if (err) {
13247 kfree_sensitive(connkeys);
13248 return err;
13249 }
13250 }
13251
13252 if (wiphy_ext_feature_isset(&rdev->wiphy,
13253 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
13254 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13255 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13256 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13257 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13258 connect.fils_erp_username =
13259 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13260 connect.fils_erp_username_len =
13261 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13262 connect.fils_erp_realm =
13263 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13264 connect.fils_erp_realm_len =
13265 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13266 connect.fils_erp_next_seq_num =
13267 nla_get_u16(
13268 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13269 connect.fils_erp_rrk =
13270 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13271 connect.fils_erp_rrk_len =
13272 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13273 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13274 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13275 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13276 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13277 kfree_sensitive(connkeys);
13278 return -EINVAL;
13279 }
13280
13281 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
13282 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13283 kfree_sensitive(connkeys);
13284 GENL_SET_ERR_MSG(info,
13285 "external auth requires connection ownership");
13286 return -EINVAL;
13287 }
13288 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
13289 }
13290
13291 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
13292 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
13293
13294 err = cfg80211_connect(rdev, dev, &connect, connkeys,
13295 connect.prev_bssid);
13296 if (err)
13297 kfree_sensitive(connkeys);
13298
13299 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13300 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13301 if (connect.bssid)
13302 memcpy(dev->ieee80211_ptr->disconnect_bssid,
13303 connect.bssid, ETH_ALEN);
13304 else
13305 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
13306 }
13307
13308 return err;
13309 }
13310
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)13311 static int nl80211_update_connect_params(struct sk_buff *skb,
13312 struct genl_info *info)
13313 {
13314 struct cfg80211_connect_params connect = {};
13315 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13316 struct net_device *dev = info->user_ptr[1];
13317 struct wireless_dev *wdev = dev->ieee80211_ptr;
13318 bool fils_sk_offload;
13319 u32 auth_type;
13320 u32 changed = 0;
13321
13322 if (!rdev->ops->update_connect_params)
13323 return -EOPNOTSUPP;
13324
13325 if (info->attrs[NL80211_ATTR_IE]) {
13326 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13327 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13328 changed |= UPDATE_ASSOC_IES;
13329 }
13330
13331 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
13332 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
13333
13334 /*
13335 * when driver supports fils-sk offload all attributes must be
13336 * provided. So the else covers "fils-sk-not-all" and
13337 * "no-fils-sk-any".
13338 */
13339 if (fils_sk_offload &&
13340 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13341 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13342 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13343 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13344 connect.fils_erp_username =
13345 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13346 connect.fils_erp_username_len =
13347 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13348 connect.fils_erp_realm =
13349 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13350 connect.fils_erp_realm_len =
13351 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13352 connect.fils_erp_next_seq_num =
13353 nla_get_u16(
13354 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13355 connect.fils_erp_rrk =
13356 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13357 connect.fils_erp_rrk_len =
13358 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13359 changed |= UPDATE_FILS_ERP_INFO;
13360 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13361 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13362 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13363 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13364 return -EINVAL;
13365 }
13366
13367 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13368 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13369 if (!nl80211_valid_auth_type(rdev, auth_type,
13370 NL80211_CMD_CONNECT))
13371 return -EINVAL;
13372
13373 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
13374 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
13375 return -EINVAL;
13376
13377 connect.auth_type = auth_type;
13378 changed |= UPDATE_AUTH_TYPE;
13379 }
13380
13381 if (!wdev->connected)
13382 return -ENOLINK;
13383
13384 return rdev_update_connect_params(rdev, dev, &connect, changed);
13385 }
13386
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)13387 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
13388 {
13389 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13390 struct net_device *dev = info->user_ptr[1];
13391 u16 reason;
13392
13393 if (dev->ieee80211_ptr->conn_owner_nlportid &&
13394 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
13395 return -EPERM;
13396
13397 reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
13398 WLAN_REASON_DEAUTH_LEAVING);
13399
13400 if (reason == 0)
13401 return -EINVAL;
13402
13403 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13404 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13405 return -EOPNOTSUPP;
13406
13407 return cfg80211_disconnect(rdev, dev, reason, true);
13408 }
13409
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)13410 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
13411 {
13412 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13413 struct net *net;
13414 int err;
13415
13416 if (info->attrs[NL80211_ATTR_PID]) {
13417 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
13418
13419 net = get_net_ns_by_pid(pid);
13420 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
13421 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
13422
13423 net = get_net_ns_by_fd(fd);
13424 } else {
13425 return -EINVAL;
13426 }
13427
13428 if (IS_ERR(net))
13429 return PTR_ERR(net);
13430
13431 err = 0;
13432
13433 /* check if anything to do */
13434 if (!net_eq(wiphy_net(&rdev->wiphy), net))
13435 err = cfg80211_switch_netns(rdev, net);
13436
13437 put_net(net);
13438 return err;
13439 }
13440
nl80211_set_pmksa(struct sk_buff * skb,struct genl_info * info)13441 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
13442 {
13443 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13444 struct net_device *dev = info->user_ptr[1];
13445 struct cfg80211_pmksa pmksa;
13446 bool ap_pmksa_caching_support = false;
13447
13448 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13449
13450 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13451 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13452
13453 if (!info->attrs[NL80211_ATTR_PMKID])
13454 return -EINVAL;
13455
13456 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13457
13458 if (info->attrs[NL80211_ATTR_MAC]) {
13459 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13460 } else if (info->attrs[NL80211_ATTR_SSID] &&
13461 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13462 info->attrs[NL80211_ATTR_PMK]) {
13463 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13464 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13465 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13466 } else {
13467 return -EINVAL;
13468 }
13469
13470 if (info->attrs[NL80211_ATTR_PMK]) {
13471 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13472 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13473 }
13474
13475 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
13476 pmksa.pmk_lifetime =
13477 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
13478
13479 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
13480 pmksa.pmk_reauth_threshold =
13481 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
13482
13483 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13484 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13485 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13486 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13487 ap_pmksa_caching_support))
13488 return -EOPNOTSUPP;
13489
13490 if (!rdev->ops->set_pmksa)
13491 return -EOPNOTSUPP;
13492
13493 return rdev_set_pmksa(rdev, dev, &pmksa);
13494 }
13495
nl80211_del_pmksa(struct sk_buff * skb,struct genl_info * info)13496 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
13497 {
13498 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13499 struct net_device *dev = info->user_ptr[1];
13500 struct cfg80211_pmksa pmksa;
13501 bool sae_offload_support = false;
13502 bool owe_offload_support = false;
13503 bool ap_pmksa_caching_support = false;
13504
13505 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13506
13507 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13508 NL80211_EXT_FEATURE_SAE_OFFLOAD);
13509 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13510 NL80211_EXT_FEATURE_OWE_OFFLOAD);
13511 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13512 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13513
13514 if (info->attrs[NL80211_ATTR_PMKID])
13515 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13516
13517 if (info->attrs[NL80211_ATTR_MAC]) {
13518 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13519 } else if (info->attrs[NL80211_ATTR_SSID]) {
13520 /* SSID based pmksa flush supported only for FILS,
13521 * OWE/SAE OFFLOAD cases
13522 */
13523 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13524 info->attrs[NL80211_ATTR_PMK]) {
13525 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13526 } else if (!sae_offload_support && !owe_offload_support) {
13527 return -EINVAL;
13528 }
13529 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13530 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13531 } else {
13532 return -EINVAL;
13533 }
13534
13535 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13536 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13537 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13538 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13539 ap_pmksa_caching_support))
13540 return -EOPNOTSUPP;
13541
13542 if (!rdev->ops->del_pmksa)
13543 return -EOPNOTSUPP;
13544
13545 return rdev_del_pmksa(rdev, dev, &pmksa);
13546 }
13547
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)13548 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
13549 {
13550 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13551 struct net_device *dev = info->user_ptr[1];
13552
13553 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13554 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13555 return -EOPNOTSUPP;
13556
13557 if (!rdev->ops->flush_pmksa)
13558 return -EOPNOTSUPP;
13559
13560 return rdev_flush_pmksa(rdev, dev);
13561 }
13562
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)13563 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
13564 {
13565 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13566 struct net_device *dev = info->user_ptr[1];
13567 u8 action_code, dialog_token;
13568 u32 peer_capability = 0;
13569 u16 status_code;
13570 u8 *peer;
13571 int link_id;
13572 bool initiator;
13573
13574 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13575 !rdev->ops->tdls_mgmt)
13576 return -EOPNOTSUPP;
13577
13578 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
13579 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
13580 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
13581 !info->attrs[NL80211_ATTR_IE] ||
13582 !info->attrs[NL80211_ATTR_MAC])
13583 return -EINVAL;
13584
13585 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13586 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
13587 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13588 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
13589 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
13590 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
13591 peer_capability =
13592 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
13593 link_id = nl80211_link_id_or_invalid(info->attrs);
13594
13595 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
13596 dialog_token, status_code, peer_capability,
13597 initiator,
13598 nla_data(info->attrs[NL80211_ATTR_IE]),
13599 nla_len(info->attrs[NL80211_ATTR_IE]));
13600 }
13601
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)13602 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
13603 {
13604 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13605 struct net_device *dev = info->user_ptr[1];
13606 enum nl80211_tdls_operation operation;
13607 u8 *peer;
13608
13609 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13610 !rdev->ops->tdls_oper)
13611 return -EOPNOTSUPP;
13612
13613 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
13614 !info->attrs[NL80211_ATTR_MAC])
13615 return -EINVAL;
13616
13617 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
13618 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13619
13620 return rdev_tdls_oper(rdev, dev, peer, operation);
13621 }
13622
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13623 static int nl80211_remain_on_channel(struct sk_buff *skb,
13624 struct genl_info *info)
13625 {
13626 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13627 unsigned int link_id = nl80211_link_id(info->attrs);
13628 struct wireless_dev *wdev = info->user_ptr[1];
13629 struct cfg80211_chan_def chandef;
13630 struct sk_buff *msg;
13631 void *hdr;
13632 u64 cookie;
13633 u32 duration;
13634 int err;
13635
13636 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
13637 !info->attrs[NL80211_ATTR_DURATION])
13638 return -EINVAL;
13639
13640 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13641
13642 if (!rdev->ops->remain_on_channel ||
13643 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
13644 return -EOPNOTSUPP;
13645
13646 /*
13647 * We should be on that channel for at least a minimum amount of
13648 * time (10ms) but no longer than the driver supports.
13649 */
13650 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13651 duration > rdev->wiphy.max_remain_on_channel_duration)
13652 return -EINVAL;
13653
13654 err = nl80211_parse_chandef(rdev, info, &chandef);
13655 if (err)
13656 return err;
13657
13658 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
13659 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
13660
13661 oper_chandef = wdev_chandef(wdev, link_id);
13662
13663 if (WARN_ON(!oper_chandef)) {
13664 /* cannot happen since we must beacon to get here */
13665 WARN_ON(1);
13666 return -EBUSY;
13667 }
13668
13669 /* note: returns first one if identical chandefs */
13670 compat_chandef = cfg80211_chandef_compatible(&chandef,
13671 oper_chandef);
13672
13673 if (compat_chandef != &chandef)
13674 return -EBUSY;
13675 }
13676
13677 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13678 if (!msg)
13679 return -ENOMEM;
13680
13681 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13682 NL80211_CMD_REMAIN_ON_CHANNEL);
13683 if (!hdr) {
13684 err = -ENOBUFS;
13685 goto free_msg;
13686 }
13687
13688 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
13689 duration, &cookie);
13690
13691 if (err)
13692 goto free_msg;
13693
13694 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13695 NL80211_ATTR_PAD))
13696 goto nla_put_failure;
13697
13698 genlmsg_end(msg, hdr);
13699
13700 return genlmsg_reply(msg, info);
13701
13702 nla_put_failure:
13703 err = -ENOBUFS;
13704 free_msg:
13705 nlmsg_free(msg);
13706 return err;
13707 }
13708
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13709 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
13710 struct genl_info *info)
13711 {
13712 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13713 struct wireless_dev *wdev = info->user_ptr[1];
13714 u64 cookie;
13715
13716 if (!info->attrs[NL80211_ATTR_COOKIE])
13717 return -EINVAL;
13718
13719 if (!rdev->ops->cancel_remain_on_channel)
13720 return -EOPNOTSUPP;
13721
13722 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13723
13724 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
13725 }
13726
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)13727 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
13728 struct genl_info *info)
13729 {
13730 struct cfg80211_bitrate_mask mask;
13731 unsigned int link_id = nl80211_link_id(info->attrs);
13732 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13733 struct net_device *dev = info->user_ptr[1];
13734 int err;
13735
13736 if (!rdev->ops->set_bitrate_mask)
13737 return -EOPNOTSUPP;
13738
13739 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13740 NL80211_ATTR_TX_RATES, &mask,
13741 dev, true, link_id);
13742 if (err)
13743 return err;
13744
13745 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
13746 }
13747
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)13748 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
13749 {
13750 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13751 struct wireless_dev *wdev = info->user_ptr[1];
13752 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
13753
13754 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
13755 return -EINVAL;
13756
13757 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
13758 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
13759
13760 switch (wdev->iftype) {
13761 case NL80211_IFTYPE_STATION:
13762 case NL80211_IFTYPE_ADHOC:
13763 case NL80211_IFTYPE_P2P_CLIENT:
13764 case NL80211_IFTYPE_AP:
13765 case NL80211_IFTYPE_AP_VLAN:
13766 case NL80211_IFTYPE_MESH_POINT:
13767 case NL80211_IFTYPE_P2P_GO:
13768 case NL80211_IFTYPE_P2P_DEVICE:
13769 break;
13770 case NL80211_IFTYPE_NAN:
13771 if (!wiphy_ext_feature_isset(wdev->wiphy,
13772 NL80211_EXT_FEATURE_SECURE_NAN) &&
13773 !(wdev->wiphy->nan_capa.flags &
13774 WIPHY_NAN_FLAGS_USERSPACE_DE))
13775 return -EOPNOTSUPP;
13776 break;
13777 default:
13778 return -EOPNOTSUPP;
13779 }
13780
13781 /* not much point in registering if we can't reply */
13782 if (!rdev->ops->mgmt_tx)
13783 return -EOPNOTSUPP;
13784
13785 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
13786 !wiphy_ext_feature_isset(&rdev->wiphy,
13787 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
13788 GENL_SET_ERR_MSG(info,
13789 "multicast RX registrations are not supported");
13790 return -EOPNOTSUPP;
13791 }
13792
13793 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
13794 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13795 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13796 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
13797 info->extack);
13798 }
13799
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)13800 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
13801 {
13802 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13803 struct wireless_dev *wdev = info->user_ptr[1];
13804 struct cfg80211_chan_def chandef;
13805 int err;
13806 void *hdr = NULL;
13807 u64 cookie;
13808 struct sk_buff *msg = NULL;
13809 struct cfg80211_mgmt_tx_params params = {
13810 .dont_wait_for_ack =
13811 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
13812 };
13813
13814 if (!info->attrs[NL80211_ATTR_FRAME])
13815 return -EINVAL;
13816
13817 if (!rdev->ops->mgmt_tx)
13818 return -EOPNOTSUPP;
13819
13820 switch (wdev->iftype) {
13821 case NL80211_IFTYPE_P2P_DEVICE:
13822 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
13823 return -EINVAL;
13824 break;
13825 case NL80211_IFTYPE_STATION:
13826 case NL80211_IFTYPE_ADHOC:
13827 case NL80211_IFTYPE_P2P_CLIENT:
13828 case NL80211_IFTYPE_AP:
13829 case NL80211_IFTYPE_AP_VLAN:
13830 case NL80211_IFTYPE_MESH_POINT:
13831 case NL80211_IFTYPE_P2P_GO:
13832 break;
13833 case NL80211_IFTYPE_NAN:
13834 if (!wiphy_ext_feature_isset(wdev->wiphy,
13835 NL80211_EXT_FEATURE_SECURE_NAN) &&
13836 !(wdev->wiphy->nan_capa.flags &
13837 WIPHY_NAN_FLAGS_USERSPACE_DE))
13838 return -EOPNOTSUPP;
13839 break;
13840 default:
13841 return -EOPNOTSUPP;
13842 }
13843
13844 if (info->attrs[NL80211_ATTR_DURATION]) {
13845 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13846 return -EINVAL;
13847 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13848
13849 /*
13850 * We should wait on the channel for at least a minimum amount
13851 * of time (10ms) but no longer than the driver supports.
13852 */
13853 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13854 params.wait > rdev->wiphy.max_remain_on_channel_duration)
13855 return -EINVAL;
13856 }
13857
13858 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
13859
13860 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13861 return -EINVAL;
13862
13863 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
13864
13865 /* get the channel if any has been specified, otherwise pass NULL to
13866 * the driver. The latter will use the current one
13867 */
13868 chandef.chan = NULL;
13869 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13870 err = nl80211_parse_chandef(rdev, info, &chandef);
13871 if (err)
13872 return err;
13873 }
13874
13875 if (!chandef.chan && params.offchan)
13876 return -EINVAL;
13877
13878 if (params.offchan &&
13879 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
13880 return -EBUSY;
13881
13882 params.link_id = nl80211_link_id_or_invalid(info->attrs);
13883 /*
13884 * This now races due to the unlock, but we cannot check
13885 * the valid links for the _station_ anyway, so that's up
13886 * to the driver.
13887 */
13888 if (params.link_id >= 0 &&
13889 !(wdev->valid_links & BIT(params.link_id)))
13890 return -EINVAL;
13891
13892 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13893 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13894
13895 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
13896 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
13897 ¶ms.csa_offsets,
13898 ¶ms.n_csa_offsets);
13899 if (err)
13900 return err;
13901
13902 if (!params.dont_wait_for_ack) {
13903 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13904 if (!msg)
13905 return -ENOMEM;
13906
13907 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13908 NL80211_CMD_FRAME);
13909 if (!hdr) {
13910 err = -ENOBUFS;
13911 goto free_msg;
13912 }
13913 }
13914
13915 params.chan = chandef.chan;
13916 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
13917 if (err)
13918 goto free_msg;
13919
13920 if (msg) {
13921 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13922 NL80211_ATTR_PAD))
13923 goto nla_put_failure;
13924
13925 genlmsg_end(msg, hdr);
13926 return genlmsg_reply(msg, info);
13927 }
13928
13929 return 0;
13930
13931 nla_put_failure:
13932 err = -ENOBUFS;
13933 free_msg:
13934 nlmsg_free(msg);
13935 return err;
13936 }
13937
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)13938 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
13939 {
13940 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13941 struct wireless_dev *wdev = info->user_ptr[1];
13942 u64 cookie;
13943
13944 if (!info->attrs[NL80211_ATTR_COOKIE])
13945 return -EINVAL;
13946
13947 if (!rdev->ops->mgmt_tx_cancel_wait)
13948 return -EOPNOTSUPP;
13949
13950 switch (wdev->iftype) {
13951 case NL80211_IFTYPE_STATION:
13952 case NL80211_IFTYPE_ADHOC:
13953 case NL80211_IFTYPE_P2P_CLIENT:
13954 case NL80211_IFTYPE_AP:
13955 case NL80211_IFTYPE_AP_VLAN:
13956 case NL80211_IFTYPE_P2P_GO:
13957 case NL80211_IFTYPE_P2P_DEVICE:
13958 break;
13959 case NL80211_IFTYPE_NAN:
13960 if (!wiphy_ext_feature_isset(wdev->wiphy,
13961 NL80211_EXT_FEATURE_SECURE_NAN))
13962 return -EOPNOTSUPP;
13963 break;
13964 default:
13965 return -EOPNOTSUPP;
13966 }
13967
13968 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13969
13970 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
13971 }
13972
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)13973 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
13974 {
13975 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13976 struct wireless_dev *wdev;
13977 struct net_device *dev = info->user_ptr[1];
13978 u8 ps_state;
13979 bool state;
13980 int err;
13981
13982 if (!info->attrs[NL80211_ATTR_PS_STATE])
13983 return -EINVAL;
13984
13985 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
13986
13987 wdev = dev->ieee80211_ptr;
13988
13989 if (!rdev->ops->set_power_mgmt)
13990 return -EOPNOTSUPP;
13991
13992 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
13993
13994 if (state == wdev->ps)
13995 return 0;
13996
13997 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
13998 if (!err)
13999 wdev->ps = state;
14000 return err;
14001 }
14002
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)14003 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
14004 {
14005 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14006 enum nl80211_ps_state ps_state;
14007 struct wireless_dev *wdev;
14008 struct net_device *dev = info->user_ptr[1];
14009 struct sk_buff *msg;
14010 void *hdr;
14011 int err;
14012
14013 wdev = dev->ieee80211_ptr;
14014
14015 if (!rdev->ops->set_power_mgmt)
14016 return -EOPNOTSUPP;
14017
14018 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14019 if (!msg)
14020 return -ENOMEM;
14021
14022 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14023 NL80211_CMD_GET_POWER_SAVE);
14024 if (!hdr) {
14025 err = -ENOBUFS;
14026 goto free_msg;
14027 }
14028
14029 if (wdev->ps)
14030 ps_state = NL80211_PS_ENABLED;
14031 else
14032 ps_state = NL80211_PS_DISABLED;
14033
14034 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
14035 goto nla_put_failure;
14036
14037 genlmsg_end(msg, hdr);
14038 return genlmsg_reply(msg, info);
14039
14040 nla_put_failure:
14041 err = -ENOBUFS;
14042 free_msg:
14043 nlmsg_free(msg);
14044 return err;
14045 }
14046
14047 static const struct nla_policy
14048 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
14049 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
14050 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
14051 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
14052 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
14053 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
14054 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
14055 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
14056 };
14057
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)14058 static int nl80211_set_cqm_txe(struct genl_info *info,
14059 u32 rate, u32 pkts, u32 intvl)
14060 {
14061 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14062 struct net_device *dev = info->user_ptr[1];
14063 struct wireless_dev *wdev = dev->ieee80211_ptr;
14064
14065 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
14066 return -EINVAL;
14067
14068 if (!rdev->ops->set_cqm_txe_config)
14069 return -EOPNOTSUPP;
14070
14071 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14072 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14073 return -EOPNOTSUPP;
14074
14075 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
14076 }
14077
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)14078 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
14079 struct net_device *dev,
14080 struct cfg80211_cqm_config *cqm_config)
14081 {
14082 struct wireless_dev *wdev = dev->ieee80211_ptr;
14083 s32 last, low, high;
14084 u32 hyst;
14085 int i, n, low_index;
14086 int err;
14087
14088 /*
14089 * Obtain current RSSI value if possible, if not and no RSSI threshold
14090 * event has been received yet, we should receive an event after a
14091 * connection is established and enough beacons received to calculate
14092 * the average.
14093 */
14094 if (!cqm_config->last_rssi_event_value &&
14095 wdev->links[0].client.current_bss &&
14096 rdev->ops->get_station) {
14097 struct station_info sinfo = {};
14098 u8 *mac_addr;
14099
14100 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
14101
14102 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
14103 if (err)
14104 return err;
14105
14106 cfg80211_sinfo_release_content(&sinfo);
14107 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
14108 cqm_config->last_rssi_event_value =
14109 (s8) sinfo.rx_beacon_signal_avg;
14110 }
14111
14112 last = cqm_config->last_rssi_event_value;
14113 hyst = cqm_config->rssi_hyst;
14114 n = cqm_config->n_rssi_thresholds;
14115
14116 for (i = 0; i < n; i++) {
14117 i = array_index_nospec(i, n);
14118 if (last < cqm_config->rssi_thresholds[i])
14119 break;
14120 }
14121
14122 low_index = i - 1;
14123 if (low_index >= 0) {
14124 low_index = array_index_nospec(low_index, n);
14125 low = cqm_config->rssi_thresholds[low_index] - hyst;
14126 } else {
14127 low = S32_MIN;
14128 }
14129 if (i < n) {
14130 i = array_index_nospec(i, n);
14131 high = cqm_config->rssi_thresholds[i] + hyst - 1;
14132 } else {
14133 high = S32_MAX;
14134 }
14135
14136 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
14137 }
14138
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)14139 static int nl80211_set_cqm_rssi(struct genl_info *info,
14140 const s32 *thresholds, int n_thresholds,
14141 u32 hysteresis)
14142 {
14143 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14144 struct cfg80211_cqm_config *cqm_config = NULL, *old;
14145 struct net_device *dev = info->user_ptr[1];
14146 struct wireless_dev *wdev = dev->ieee80211_ptr;
14147 s32 prev = S32_MIN;
14148 int i, err;
14149
14150 /* Check all values negative and sorted */
14151 for (i = 0; i < n_thresholds; i++) {
14152 if (thresholds[i] > 0 || thresholds[i] <= prev)
14153 return -EINVAL;
14154
14155 prev = thresholds[i];
14156 }
14157
14158 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14159 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14160 return -EOPNOTSUPP;
14161
14162 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
14163 n_thresholds = 0;
14164
14165 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
14166
14167 /* if already disabled just succeed */
14168 if (!n_thresholds && !old)
14169 return 0;
14170
14171 if (n_thresholds > 1) {
14172 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14173 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
14174 !rdev->ops->set_cqm_rssi_range_config)
14175 return -EOPNOTSUPP;
14176 } else {
14177 if (!rdev->ops->set_cqm_rssi_config)
14178 return -EOPNOTSUPP;
14179 }
14180
14181 if (n_thresholds) {
14182 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
14183 n_thresholds),
14184 GFP_KERNEL);
14185 if (!cqm_config)
14186 return -ENOMEM;
14187
14188 cqm_config->rssi_hyst = hysteresis;
14189 cqm_config->n_rssi_thresholds = n_thresholds;
14190 memcpy(cqm_config->rssi_thresholds, thresholds,
14191 flex_array_size(cqm_config, rssi_thresholds,
14192 n_thresholds));
14193 cqm_config->use_range_api = n_thresholds > 1 ||
14194 !rdev->ops->set_cqm_rssi_config;
14195
14196 rcu_assign_pointer(wdev->cqm_config, cqm_config);
14197
14198 if (cqm_config->use_range_api)
14199 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
14200 else
14201 err = rdev_set_cqm_rssi_config(rdev, dev,
14202 thresholds[0],
14203 hysteresis);
14204 } else {
14205 RCU_INIT_POINTER(wdev->cqm_config, NULL);
14206 /* if enabled as range also disable via range */
14207 if (old->use_range_api)
14208 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
14209 else
14210 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
14211 }
14212
14213 if (err) {
14214 rcu_assign_pointer(wdev->cqm_config, old);
14215 kfree_rcu(cqm_config, rcu_head);
14216 } else {
14217 kfree_rcu(old, rcu_head);
14218 }
14219
14220 return err;
14221 }
14222
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)14223 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
14224 {
14225 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
14226 struct nlattr *cqm;
14227 int err;
14228
14229 cqm = info->attrs[NL80211_ATTR_CQM];
14230 if (!cqm)
14231 return -EINVAL;
14232
14233 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
14234 nl80211_attr_cqm_policy,
14235 info->extack);
14236 if (err)
14237 return err;
14238
14239 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
14240 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
14241 const s32 *thresholds =
14242 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14243 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14244 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
14245
14246 if (len % 4)
14247 return -EINVAL;
14248
14249 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
14250 hysteresis);
14251 }
14252
14253 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
14254 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
14255 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
14256 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
14257 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
14258 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
14259
14260 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
14261 }
14262
14263 return -EINVAL;
14264 }
14265
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)14266 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
14267 {
14268 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14269 struct net_device *dev = info->user_ptr[1];
14270 struct ocb_setup setup = {};
14271 int err;
14272
14273 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14274 if (err)
14275 return err;
14276
14277 return cfg80211_join_ocb(rdev, dev, &setup);
14278 }
14279
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)14280 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
14281 {
14282 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14283 struct net_device *dev = info->user_ptr[1];
14284
14285 return cfg80211_leave_ocb(rdev, dev);
14286 }
14287
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)14288 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
14289 {
14290 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14291 struct net_device *dev = info->user_ptr[1];
14292 struct mesh_config cfg;
14293 struct mesh_setup setup;
14294 int err;
14295
14296 /* start with default */
14297 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
14298 memcpy(&setup, &default_mesh_setup, sizeof(setup));
14299
14300 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
14301 /* and parse parameters if given */
14302 err = nl80211_parse_mesh_config(info, &cfg, NULL);
14303 if (err)
14304 return err;
14305 }
14306
14307 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
14308 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
14309 return -EINVAL;
14310
14311 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
14312 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
14313
14314 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
14315 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
14316 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
14317 return -EINVAL;
14318
14319 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
14320 setup.beacon_interval =
14321 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
14322
14323 err = cfg80211_validate_beacon_int(rdev,
14324 NL80211_IFTYPE_MESH_POINT,
14325 setup.beacon_interval);
14326 if (err)
14327 return err;
14328 }
14329
14330 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
14331 setup.dtim_period =
14332 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
14333 if (setup.dtim_period < 1 || setup.dtim_period > 100)
14334 return -EINVAL;
14335 }
14336
14337 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
14338 /* parse additional setup parameters if given */
14339 err = nl80211_parse_mesh_setup(info, &setup);
14340 if (err)
14341 return err;
14342 }
14343
14344 if (setup.user_mpm)
14345 cfg.auto_open_plinks = false;
14346
14347 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
14348 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14349 if (err)
14350 return err;
14351 } else {
14352 /* __cfg80211_join_mesh() will sort it out */
14353 setup.chandef.chan = NULL;
14354 }
14355
14356 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
14357 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14358 int n_rates =
14359 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14360 struct ieee80211_supported_band *sband;
14361
14362 if (!setup.chandef.chan)
14363 return -EINVAL;
14364
14365 sband = rdev->wiphy.bands[setup.chandef.chan->band];
14366
14367 err = ieee80211_get_ratemask(sband, rates, n_rates,
14368 &setup.basic_rates);
14369 if (err)
14370 return err;
14371 }
14372
14373 if (info->attrs[NL80211_ATTR_TX_RATES]) {
14374 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
14375 NL80211_ATTR_TX_RATES,
14376 &setup.beacon_rate,
14377 dev, false, 0);
14378 if (err)
14379 return err;
14380
14381 if (!setup.chandef.chan)
14382 return -EINVAL;
14383
14384 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
14385 &setup.beacon_rate);
14386 if (err)
14387 return err;
14388 }
14389
14390 setup.userspace_handles_dfs =
14391 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
14392
14393 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
14394 int r = validate_pae_over_nl80211(rdev, info);
14395
14396 if (r < 0)
14397 return r;
14398
14399 setup.control_port_over_nl80211 = true;
14400 }
14401
14402 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
14403 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
14404 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
14405
14406 return err;
14407 }
14408
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)14409 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
14410 {
14411 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14412 struct net_device *dev = info->user_ptr[1];
14413
14414 return cfg80211_leave_mesh(rdev, dev);
14415 }
14416
14417 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)14418 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
14419 struct cfg80211_registered_device *rdev)
14420 {
14421 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
14422 struct nlattr *nl_pats, *nl_pat;
14423 int i, pat_len;
14424
14425 if (!wowlan->n_patterns)
14426 return 0;
14427
14428 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
14429 if (!nl_pats)
14430 return -ENOBUFS;
14431
14432 for (i = 0; i < wowlan->n_patterns; i++) {
14433 nl_pat = nla_nest_start_noflag(msg, i + 1);
14434 if (!nl_pat)
14435 return -ENOBUFS;
14436 pat_len = wowlan->patterns[i].pattern_len;
14437 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
14438 wowlan->patterns[i].mask) ||
14439 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14440 wowlan->patterns[i].pattern) ||
14441 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14442 wowlan->patterns[i].pkt_offset))
14443 return -ENOBUFS;
14444 nla_nest_end(msg, nl_pat);
14445 }
14446 nla_nest_end(msg, nl_pats);
14447
14448 return 0;
14449 }
14450
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)14451 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
14452 struct cfg80211_wowlan_tcp *tcp)
14453 {
14454 struct nlattr *nl_tcp;
14455
14456 if (!tcp)
14457 return 0;
14458
14459 nl_tcp = nla_nest_start_noflag(msg,
14460 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
14461 if (!nl_tcp)
14462 return -ENOBUFS;
14463
14464 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
14465 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
14466 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
14467 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
14468 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
14469 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
14470 tcp->payload_len, tcp->payload) ||
14471 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
14472 tcp->data_interval) ||
14473 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
14474 tcp->wake_len, tcp->wake_data) ||
14475 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
14476 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
14477 return -ENOBUFS;
14478
14479 if (tcp->payload_seq.len &&
14480 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
14481 sizeof(tcp->payload_seq), &tcp->payload_seq))
14482 return -ENOBUFS;
14483
14484 if (tcp->payload_tok.len &&
14485 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
14486 sizeof(tcp->payload_tok) + tcp->tokens_size,
14487 &tcp->payload_tok))
14488 return -ENOBUFS;
14489
14490 nla_nest_end(msg, nl_tcp);
14491
14492 return 0;
14493 }
14494
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)14495 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
14496 struct cfg80211_sched_scan_request *req)
14497 {
14498 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
14499 int i;
14500
14501 if (!req)
14502 return 0;
14503
14504 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
14505 if (!nd)
14506 return -ENOBUFS;
14507
14508 if (req->n_scan_plans == 1 &&
14509 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
14510 req->scan_plans[0].interval * 1000))
14511 return -ENOBUFS;
14512
14513 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
14514 return -ENOBUFS;
14515
14516 if (req->relative_rssi_set) {
14517 struct nl80211_bss_select_rssi_adjust rssi_adjust;
14518
14519 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
14520 req->relative_rssi))
14521 return -ENOBUFS;
14522
14523 rssi_adjust.band = req->rssi_adjust.band;
14524 rssi_adjust.delta = req->rssi_adjust.delta;
14525 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
14526 sizeof(rssi_adjust), &rssi_adjust))
14527 return -ENOBUFS;
14528 }
14529
14530 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14531 if (!freqs)
14532 return -ENOBUFS;
14533
14534 for (i = 0; i < req->n_channels; i++) {
14535 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14536 return -ENOBUFS;
14537 }
14538
14539 nla_nest_end(msg, freqs);
14540
14541 if (req->n_match_sets) {
14542 matches = nla_nest_start_noflag(msg,
14543 NL80211_ATTR_SCHED_SCAN_MATCH);
14544 if (!matches)
14545 return -ENOBUFS;
14546
14547 for (i = 0; i < req->n_match_sets; i++) {
14548 match = nla_nest_start_noflag(msg, i);
14549 if (!match)
14550 return -ENOBUFS;
14551
14552 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
14553 req->match_sets[i].ssid.ssid_len,
14554 req->match_sets[i].ssid.ssid))
14555 return -ENOBUFS;
14556 nla_nest_end(msg, match);
14557 }
14558 nla_nest_end(msg, matches);
14559 }
14560
14561 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
14562 if (!scan_plans)
14563 return -ENOBUFS;
14564
14565 for (i = 0; i < req->n_scan_plans; i++) {
14566 scan_plan = nla_nest_start_noflag(msg, i + 1);
14567 if (!scan_plan)
14568 return -ENOBUFS;
14569
14570 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
14571 req->scan_plans[i].interval) ||
14572 (req->scan_plans[i].iterations &&
14573 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
14574 req->scan_plans[i].iterations)))
14575 return -ENOBUFS;
14576 nla_nest_end(msg, scan_plan);
14577 }
14578 nla_nest_end(msg, scan_plans);
14579
14580 nla_nest_end(msg, nd);
14581
14582 return 0;
14583 }
14584
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)14585 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
14586 {
14587 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14588 struct sk_buff *msg;
14589 void *hdr;
14590 u32 size = NLMSG_DEFAULT_SIZE;
14591
14592 if (!rdev->wiphy.wowlan)
14593 return -EOPNOTSUPP;
14594
14595 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
14596 /* adjust size to have room for all the data */
14597 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
14598 rdev->wiphy.wowlan_config->tcp->payload_len +
14599 rdev->wiphy.wowlan_config->tcp->wake_len +
14600 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
14601 }
14602
14603 msg = nlmsg_new(size, GFP_KERNEL);
14604 if (!msg)
14605 return -ENOMEM;
14606
14607 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14608 NL80211_CMD_GET_WOWLAN);
14609 if (!hdr)
14610 goto nla_put_failure;
14611
14612 if (rdev->wiphy.wowlan_config) {
14613 struct nlattr *nl_wowlan;
14614
14615 nl_wowlan = nla_nest_start_noflag(msg,
14616 NL80211_ATTR_WOWLAN_TRIGGERS);
14617 if (!nl_wowlan)
14618 goto nla_put_failure;
14619
14620 if ((rdev->wiphy.wowlan_config->any &&
14621 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
14622 (rdev->wiphy.wowlan_config->disconnect &&
14623 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
14624 (rdev->wiphy.wowlan_config->magic_pkt &&
14625 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
14626 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
14627 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
14628 (rdev->wiphy.wowlan_config->eap_identity_req &&
14629 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
14630 (rdev->wiphy.wowlan_config->four_way_handshake &&
14631 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
14632 (rdev->wiphy.wowlan_config->rfkill_release &&
14633 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
14634 goto nla_put_failure;
14635
14636 if (nl80211_send_wowlan_patterns(msg, rdev))
14637 goto nla_put_failure;
14638
14639 if (nl80211_send_wowlan_tcp(msg,
14640 rdev->wiphy.wowlan_config->tcp))
14641 goto nla_put_failure;
14642
14643 if (nl80211_send_wowlan_nd(
14644 msg,
14645 rdev->wiphy.wowlan_config->nd_config))
14646 goto nla_put_failure;
14647
14648 nla_nest_end(msg, nl_wowlan);
14649 }
14650
14651 genlmsg_end(msg, hdr);
14652 return genlmsg_reply(msg, info);
14653
14654 nla_put_failure:
14655 nlmsg_free(msg);
14656 return -ENOBUFS;
14657 }
14658
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)14659 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
14660 struct nlattr *attr,
14661 struct cfg80211_wowlan *trig)
14662 {
14663 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
14664 struct cfg80211_wowlan_tcp *cfg;
14665 struct nl80211_wowlan_tcp_data_token *tok = NULL;
14666 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
14667 u32 size;
14668 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
14669 int err, port;
14670
14671 if (!rdev->wiphy.wowlan->tcp)
14672 return -EINVAL;
14673
14674 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
14675 nl80211_wowlan_tcp_policy, NULL);
14676 if (err)
14677 return err;
14678
14679 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
14680 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
14681 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
14682 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
14683 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
14684 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
14685 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
14686 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
14687 return -EINVAL;
14688
14689 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
14690 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
14691 return -EINVAL;
14692
14693 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
14694 rdev->wiphy.wowlan->tcp->data_interval_max ||
14695 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
14696 return -EINVAL;
14697
14698 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
14699 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
14700 return -EINVAL;
14701
14702 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
14703 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
14704 return -EINVAL;
14705
14706 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
14707 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14708
14709 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14710 tokens_size = tokln - sizeof(*tok);
14711
14712 if (!tok->len || tokens_size % tok->len)
14713 return -EINVAL;
14714 if (!rdev->wiphy.wowlan->tcp->tok)
14715 return -EINVAL;
14716 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
14717 return -EINVAL;
14718 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
14719 return -EINVAL;
14720 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
14721 return -EINVAL;
14722 if (tok->offset + tok->len > data_size)
14723 return -EINVAL;
14724 }
14725
14726 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
14727 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
14728 if (!rdev->wiphy.wowlan->tcp->seq)
14729 return -EINVAL;
14730 if (seq->len == 0 || seq->len > 4)
14731 return -EINVAL;
14732 if (seq->len + seq->offset > data_size)
14733 return -EINVAL;
14734 }
14735
14736 size = sizeof(*cfg);
14737 size += data_size;
14738 size += wake_size + wake_mask_size;
14739 size += tokens_size;
14740
14741 cfg = kzalloc(size, GFP_KERNEL);
14742 if (!cfg)
14743 return -ENOMEM;
14744 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
14745 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
14746 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
14747 ETH_ALEN);
14748 port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
14749 #ifdef CONFIG_INET
14750 /* allocate a socket and port for it and use it */
14751 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
14752 IPPROTO_TCP, &cfg->sock, 1);
14753 if (err) {
14754 kfree(cfg);
14755 return err;
14756 }
14757 if (inet_csk_get_port(cfg->sock->sk, port)) {
14758 sock_release(cfg->sock);
14759 kfree(cfg);
14760 return -EADDRINUSE;
14761 }
14762 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
14763 #else
14764 if (!port) {
14765 kfree(cfg);
14766 return -EINVAL;
14767 }
14768 cfg->src_port = port;
14769 #endif
14770
14771 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
14772 cfg->payload_len = data_size;
14773 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
14774 memcpy((void *)cfg->payload,
14775 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
14776 data_size);
14777 if (seq)
14778 cfg->payload_seq = *seq;
14779 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
14780 cfg->wake_len = wake_size;
14781 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
14782 memcpy((void *)cfg->wake_data,
14783 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
14784 wake_size);
14785 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
14786 data_size + wake_size;
14787 memcpy((void *)cfg->wake_mask,
14788 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
14789 wake_mask_size);
14790 if (tok) {
14791 cfg->tokens_size = tokens_size;
14792 cfg->payload_tok = *tok;
14793 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
14794 tokens_size);
14795 }
14796
14797 trig->tcp = cfg;
14798
14799 return 0;
14800 }
14801
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)14802 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
14803 const struct wiphy_wowlan_support *wowlan,
14804 struct nlattr *attr,
14805 struct cfg80211_wowlan *trig)
14806 {
14807 struct nlattr **tb;
14808 int err;
14809
14810 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
14811 if (!tb)
14812 return -ENOMEM;
14813
14814 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
14815 err = -EOPNOTSUPP;
14816 goto out;
14817 }
14818
14819 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
14820 nl80211_policy, NULL);
14821 if (err)
14822 goto out;
14823
14824 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
14825 wowlan->max_nd_match_sets);
14826 err = PTR_ERR_OR_ZERO(trig->nd_config);
14827 if (err)
14828 trig->nd_config = NULL;
14829
14830 out:
14831 kfree(tb);
14832 return err;
14833 }
14834
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)14835 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
14836 {
14837 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14838 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
14839 struct cfg80211_wowlan new_triggers = {};
14840 struct cfg80211_wowlan *ntrig;
14841 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
14842 int err, i;
14843 bool prev_enabled = rdev->wiphy.wowlan_config;
14844 bool regular = false;
14845
14846 if (!wowlan)
14847 return -EOPNOTSUPP;
14848
14849 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
14850 cfg80211_rdev_free_wowlan(rdev);
14851 rdev->wiphy.wowlan_config = NULL;
14852 goto set_wakeup;
14853 }
14854
14855 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
14856 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
14857 nl80211_wowlan_policy, info->extack);
14858 if (err)
14859 return err;
14860
14861 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
14862 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
14863 return -EINVAL;
14864 new_triggers.any = true;
14865 }
14866
14867 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
14868 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
14869 return -EINVAL;
14870 new_triggers.disconnect = true;
14871 regular = true;
14872 }
14873
14874 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
14875 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
14876 return -EINVAL;
14877 new_triggers.magic_pkt = true;
14878 regular = true;
14879 }
14880
14881 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
14882 return -EINVAL;
14883
14884 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
14885 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
14886 return -EINVAL;
14887 new_triggers.gtk_rekey_failure = true;
14888 regular = true;
14889 }
14890
14891 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
14892 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
14893 return -EINVAL;
14894 new_triggers.eap_identity_req = true;
14895 regular = true;
14896 }
14897
14898 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
14899 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
14900 return -EINVAL;
14901 new_triggers.four_way_handshake = true;
14902 regular = true;
14903 }
14904
14905 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
14906 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
14907 return -EINVAL;
14908 new_triggers.rfkill_release = true;
14909 regular = true;
14910 }
14911
14912 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
14913 struct nlattr *pat;
14914 int n_patterns = 0;
14915 int rem, pat_len, mask_len, pkt_offset;
14916 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14917
14918 regular = true;
14919
14920 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14921 rem)
14922 n_patterns++;
14923 if (n_patterns > wowlan->n_patterns)
14924 return -EINVAL;
14925
14926 new_triggers.patterns = kcalloc(n_patterns,
14927 sizeof(new_triggers.patterns[0]),
14928 GFP_KERNEL);
14929 if (!new_triggers.patterns)
14930 return -ENOMEM;
14931
14932 new_triggers.n_patterns = n_patterns;
14933 i = 0;
14934
14935 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14936 rem) {
14937 u8 *mask_pat;
14938
14939 err = nla_parse_nested_deprecated(pat_tb,
14940 MAX_NL80211_PKTPAT,
14941 pat,
14942 nl80211_packet_pattern_policy,
14943 info->extack);
14944 if (err)
14945 goto error;
14946
14947 err = -EINVAL;
14948 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14949 !pat_tb[NL80211_PKTPAT_PATTERN])
14950 goto error;
14951 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14952 mask_len = DIV_ROUND_UP(pat_len, 8);
14953 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14954 goto error;
14955 if (pat_len > wowlan->pattern_max_len ||
14956 pat_len < wowlan->pattern_min_len)
14957 goto error;
14958
14959 pkt_offset =
14960 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14961 0);
14962 if (pkt_offset > wowlan->max_pkt_offset)
14963 goto error;
14964 new_triggers.patterns[i].pkt_offset = pkt_offset;
14965
14966 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14967 if (!mask_pat) {
14968 err = -ENOMEM;
14969 goto error;
14970 }
14971 new_triggers.patterns[i].mask = mask_pat;
14972 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14973 mask_len);
14974 mask_pat += mask_len;
14975 new_triggers.patterns[i].pattern = mask_pat;
14976 new_triggers.patterns[i].pattern_len = pat_len;
14977 memcpy(mask_pat,
14978 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14979 pat_len);
14980 i++;
14981 }
14982 }
14983
14984 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
14985 regular = true;
14986 err = nl80211_parse_wowlan_tcp(
14987 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
14988 &new_triggers);
14989 if (err)
14990 goto error;
14991 }
14992
14993 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
14994 regular = true;
14995 err = nl80211_parse_wowlan_nd(
14996 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
14997 &new_triggers);
14998 if (err)
14999 goto error;
15000 }
15001
15002 /* The 'any' trigger means the device continues operating more or less
15003 * as in its normal operation mode and wakes up the host on most of the
15004 * normal interrupts (like packet RX, ...)
15005 * It therefore makes little sense to combine with the more constrained
15006 * wakeup trigger modes.
15007 */
15008 if (new_triggers.any && regular) {
15009 err = -EINVAL;
15010 goto error;
15011 }
15012
15013 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
15014 if (!ntrig) {
15015 err = -ENOMEM;
15016 goto error;
15017 }
15018 cfg80211_rdev_free_wowlan(rdev);
15019 rdev->wiphy.wowlan_config = ntrig;
15020
15021 set_wakeup:
15022 if (rdev->ops->set_wakeup &&
15023 prev_enabled != !!rdev->wiphy.wowlan_config)
15024 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
15025
15026 return 0;
15027 error:
15028 for (i = 0; i < new_triggers.n_patterns; i++)
15029 kfree(new_triggers.patterns[i].mask);
15030 kfree(new_triggers.patterns);
15031 if (new_triggers.tcp && new_triggers.tcp->sock)
15032 sock_release(new_triggers.tcp->sock);
15033 kfree(new_triggers.tcp);
15034 kfree(new_triggers.nd_config);
15035 return err;
15036 }
15037 #endif
15038
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)15039 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
15040 struct cfg80211_registered_device *rdev)
15041 {
15042 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
15043 int i, j, pat_len;
15044 struct cfg80211_coalesce_rules *rule;
15045
15046 if (!rdev->coalesce->n_rules)
15047 return 0;
15048
15049 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
15050 if (!nl_rules)
15051 return -ENOBUFS;
15052
15053 for (i = 0; i < rdev->coalesce->n_rules; i++) {
15054 nl_rule = nla_nest_start_noflag(msg, i + 1);
15055 if (!nl_rule)
15056 return -ENOBUFS;
15057
15058 rule = &rdev->coalesce->rules[i];
15059 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
15060 rule->delay))
15061 return -ENOBUFS;
15062
15063 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
15064 rule->condition))
15065 return -ENOBUFS;
15066
15067 nl_pats = nla_nest_start_noflag(msg,
15068 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
15069 if (!nl_pats)
15070 return -ENOBUFS;
15071
15072 for (j = 0; j < rule->n_patterns; j++) {
15073 nl_pat = nla_nest_start_noflag(msg, j + 1);
15074 if (!nl_pat)
15075 return -ENOBUFS;
15076 pat_len = rule->patterns[j].pattern_len;
15077 if (nla_put(msg, NL80211_PKTPAT_MASK,
15078 DIV_ROUND_UP(pat_len, 8),
15079 rule->patterns[j].mask) ||
15080 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
15081 rule->patterns[j].pattern) ||
15082 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
15083 rule->patterns[j].pkt_offset))
15084 return -ENOBUFS;
15085 nla_nest_end(msg, nl_pat);
15086 }
15087 nla_nest_end(msg, nl_pats);
15088 nla_nest_end(msg, nl_rule);
15089 }
15090 nla_nest_end(msg, nl_rules);
15091
15092 return 0;
15093 }
15094
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)15095 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
15096 {
15097 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15098 struct sk_buff *msg;
15099 void *hdr;
15100
15101 if (!rdev->wiphy.coalesce)
15102 return -EOPNOTSUPP;
15103
15104 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15105 if (!msg)
15106 return -ENOMEM;
15107
15108 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15109 NL80211_CMD_GET_COALESCE);
15110 if (!hdr)
15111 goto nla_put_failure;
15112
15113 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
15114 goto nla_put_failure;
15115
15116 genlmsg_end(msg, hdr);
15117 return genlmsg_reply(msg, info);
15118
15119 nla_put_failure:
15120 nlmsg_free(msg);
15121 return -ENOBUFS;
15122 }
15123
cfg80211_free_coalesce(struct cfg80211_coalesce * coalesce)15124 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
15125 {
15126 int i, j;
15127 struct cfg80211_coalesce_rules *rule;
15128
15129 if (!coalesce)
15130 return;
15131
15132 for (i = 0; i < coalesce->n_rules; i++) {
15133 rule = &coalesce->rules[i];
15134 for (j = 0; j < rule->n_patterns; j++)
15135 kfree(rule->patterns[j].mask);
15136 kfree(rule->patterns);
15137 }
15138 kfree(coalesce);
15139 }
15140
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)15141 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
15142 struct nlattr *rule,
15143 struct cfg80211_coalesce_rules *new_rule)
15144 {
15145 int err, i;
15146 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15147 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
15148 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
15149 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
15150
15151 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
15152 rule, nl80211_coalesce_policy, NULL);
15153 if (err)
15154 return err;
15155
15156 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
15157 new_rule->delay =
15158 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
15159 if (new_rule->delay > coalesce->max_delay)
15160 return -EINVAL;
15161
15162 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
15163 new_rule->condition =
15164 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
15165
15166 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
15167 return -EINVAL;
15168
15169 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15170 rem)
15171 n_patterns++;
15172 if (n_patterns > coalesce->n_patterns)
15173 return -EINVAL;
15174
15175 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
15176 GFP_KERNEL);
15177 if (!new_rule->patterns)
15178 return -ENOMEM;
15179
15180 new_rule->n_patterns = n_patterns;
15181 i = 0;
15182
15183 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15184 rem) {
15185 u8 *mask_pat;
15186
15187 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
15188 pat,
15189 nl80211_packet_pattern_policy,
15190 NULL);
15191 if (err)
15192 return err;
15193
15194 if (!pat_tb[NL80211_PKTPAT_MASK] ||
15195 !pat_tb[NL80211_PKTPAT_PATTERN])
15196 return -EINVAL;
15197 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
15198 mask_len = DIV_ROUND_UP(pat_len, 8);
15199 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
15200 return -EINVAL;
15201 if (pat_len > coalesce->pattern_max_len ||
15202 pat_len < coalesce->pattern_min_len)
15203 return -EINVAL;
15204
15205 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
15206 0);
15207 if (pkt_offset > coalesce->max_pkt_offset)
15208 return -EINVAL;
15209 new_rule->patterns[i].pkt_offset = pkt_offset;
15210
15211 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
15212 if (!mask_pat)
15213 return -ENOMEM;
15214
15215 new_rule->patterns[i].mask = mask_pat;
15216 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
15217 mask_len);
15218
15219 mask_pat += mask_len;
15220 new_rule->patterns[i].pattern = mask_pat;
15221 new_rule->patterns[i].pattern_len = pat_len;
15222 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
15223 pat_len);
15224 i++;
15225 }
15226
15227 return 0;
15228 }
15229
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)15230 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
15231 {
15232 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15233 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15234 struct cfg80211_coalesce *new_coalesce;
15235 int err, rem_rule, n_rules = 0, i;
15236 struct nlattr *rule;
15237
15238 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
15239 return -EOPNOTSUPP;
15240
15241 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
15242 cfg80211_free_coalesce(rdev->coalesce);
15243 rdev->coalesce = NULL;
15244 rdev_set_coalesce(rdev, NULL);
15245 return 0;
15246 }
15247
15248 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15249 rem_rule)
15250 n_rules++;
15251 if (n_rules > coalesce->n_rules)
15252 return -EINVAL;
15253
15254 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
15255 GFP_KERNEL);
15256 if (!new_coalesce)
15257 return -ENOMEM;
15258
15259 new_coalesce->n_rules = n_rules;
15260 i = 0;
15261
15262 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15263 rem_rule) {
15264 err = nl80211_parse_coalesce_rule(rdev, rule,
15265 &new_coalesce->rules[i]);
15266 if (err)
15267 goto error;
15268
15269 i++;
15270 }
15271
15272 err = rdev_set_coalesce(rdev, new_coalesce);
15273 if (err)
15274 goto error;
15275
15276 cfg80211_free_coalesce(rdev->coalesce);
15277 rdev->coalesce = new_coalesce;
15278
15279 return 0;
15280 error:
15281 cfg80211_free_coalesce(new_coalesce);
15282
15283 return err;
15284 }
15285
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)15286 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
15287 {
15288 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15289 struct net_device *dev = info->user_ptr[1];
15290 struct wireless_dev *wdev = dev->ieee80211_ptr;
15291 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
15292 struct cfg80211_gtk_rekey_data rekey_data = {};
15293 int err;
15294
15295 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
15296 return -EINVAL;
15297
15298 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
15299 info->attrs[NL80211_ATTR_REKEY_DATA],
15300 nl80211_rekey_policy, info->extack);
15301 if (err)
15302 return err;
15303
15304 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
15305 !tb[NL80211_REKEY_DATA_KCK])
15306 return -EINVAL;
15307 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
15308 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15309 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
15310 return -ERANGE;
15311 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
15312 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15313 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
15314 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
15315 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
15316 return -ERANGE;
15317
15318 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
15319 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
15320 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
15321 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
15322 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
15323 if (tb[NL80211_REKEY_DATA_AKM])
15324 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
15325
15326 if (!wdev->connected)
15327 return -ENOTCONN;
15328
15329 if (!rdev->ops->set_rekey_data)
15330 return -EOPNOTSUPP;
15331
15332 return rdev_set_rekey_data(rdev, dev, &rekey_data);
15333 }
15334
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)15335 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
15336 struct genl_info *info)
15337 {
15338 struct net_device *dev = info->user_ptr[1];
15339 struct wireless_dev *wdev = dev->ieee80211_ptr;
15340
15341 if (wdev->iftype != NL80211_IFTYPE_AP &&
15342 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15343 return -EINVAL;
15344
15345 if (wdev->ap_unexpected_nlportid)
15346 return -EBUSY;
15347
15348 wdev->ap_unexpected_nlportid = info->snd_portid;
15349 return 0;
15350 }
15351
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)15352 static int nl80211_probe_client(struct sk_buff *skb,
15353 struct genl_info *info)
15354 {
15355 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15356 struct net_device *dev = info->user_ptr[1];
15357 struct wireless_dev *wdev = dev->ieee80211_ptr;
15358 struct sk_buff *msg;
15359 void *hdr;
15360 const u8 *addr;
15361 u64 cookie;
15362 int err;
15363
15364 if (wdev->iftype != NL80211_IFTYPE_AP &&
15365 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15366 return -EOPNOTSUPP;
15367
15368 if (!info->attrs[NL80211_ATTR_MAC])
15369 return -EINVAL;
15370
15371 if (!rdev->ops->probe_client)
15372 return -EOPNOTSUPP;
15373
15374 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15375 if (!msg)
15376 return -ENOMEM;
15377
15378 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15379 NL80211_CMD_PROBE_CLIENT);
15380 if (!hdr) {
15381 err = -ENOBUFS;
15382 goto free_msg;
15383 }
15384
15385 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15386
15387 err = rdev_probe_client(rdev, dev, addr, &cookie);
15388 if (err)
15389 goto free_msg;
15390
15391 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15392 NL80211_ATTR_PAD))
15393 goto nla_put_failure;
15394
15395 genlmsg_end(msg, hdr);
15396
15397 return genlmsg_reply(msg, info);
15398
15399 nla_put_failure:
15400 err = -ENOBUFS;
15401 free_msg:
15402 nlmsg_free(msg);
15403 return err;
15404 }
15405
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)15406 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
15407 {
15408 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15409 struct cfg80211_beacon_registration *reg, *nreg;
15410 int rv;
15411
15412 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
15413 return -EOPNOTSUPP;
15414
15415 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
15416 if (!nreg)
15417 return -ENOMEM;
15418
15419 /* First, check if already registered. */
15420 spin_lock_bh(&rdev->beacon_registrations_lock);
15421 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15422 if (reg->nlportid == info->snd_portid) {
15423 rv = -EALREADY;
15424 goto out_err;
15425 }
15426 }
15427 /* Add it to the list */
15428 nreg->nlportid = info->snd_portid;
15429 list_add(&nreg->list, &rdev->beacon_registrations);
15430
15431 spin_unlock_bh(&rdev->beacon_registrations_lock);
15432
15433 return 0;
15434 out_err:
15435 spin_unlock_bh(&rdev->beacon_registrations_lock);
15436 kfree(nreg);
15437 return rv;
15438 }
15439
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)15440 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
15441 {
15442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15443 struct wireless_dev *wdev = info->user_ptr[1];
15444 int err;
15445
15446 if (!rdev->ops->start_p2p_device)
15447 return -EOPNOTSUPP;
15448
15449 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15450 return -EOPNOTSUPP;
15451
15452 if (wdev_running(wdev))
15453 return 0;
15454
15455 if (rfkill_blocked(rdev->wiphy.rfkill))
15456 return -ERFKILL;
15457
15458 err = rdev_start_p2p_device(rdev, wdev);
15459 if (err)
15460 return err;
15461
15462 wdev->is_running = true;
15463 rdev->opencount++;
15464
15465 return 0;
15466 }
15467
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)15468 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
15469 {
15470 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15471 struct wireless_dev *wdev = info->user_ptr[1];
15472
15473 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15474 return -EOPNOTSUPP;
15475
15476 if (!rdev->ops->stop_p2p_device)
15477 return -EOPNOTSUPP;
15478
15479 cfg80211_stop_p2p_device(rdev, wdev);
15480
15481 return 0;
15482 }
15483
nl80211_get_nan_channel(struct wiphy * wiphy,int freq)15484 static struct ieee80211_channel *nl80211_get_nan_channel(struct wiphy *wiphy,
15485 int freq)
15486 {
15487 struct ieee80211_channel *chan;
15488 struct cfg80211_chan_def def;
15489
15490 /* Check if the frequency is valid for NAN */
15491 if (freq != 5220 && freq != 5745 && freq != 2437)
15492 return NULL;
15493
15494 chan = ieee80211_get_channel(wiphy, freq);
15495 if (!chan)
15496 return NULL;
15497
15498 cfg80211_chandef_create(&def, chan, NL80211_CHAN_NO_HT);
15499
15500 /* Check if the channel is allowed */
15501 if (cfg80211_reg_can_beacon(wiphy, &def, NL80211_IFTYPE_NAN))
15502 return chan;
15503
15504 return NULL;
15505 }
15506
nl80211_parse_nan_band_config(struct wiphy * wiphy,struct nlattr ** tb,struct cfg80211_nan_band_config * cfg,enum nl80211_band band)15507 static int nl80211_parse_nan_band_config(struct wiphy *wiphy,
15508 struct nlattr **tb,
15509 struct cfg80211_nan_band_config *cfg,
15510 enum nl80211_band band)
15511 {
15512 if (BIT(band) & ~(u32)wiphy->nan_supported_bands)
15513 return -EINVAL;
15514
15515 if (tb[NL80211_NAN_BAND_CONF_FREQ]) {
15516 u16 freq = nla_get_u16(tb[NL80211_NAN_BAND_CONF_FREQ]);
15517
15518 if (band != NL80211_BAND_5GHZ)
15519 return -EINVAL;
15520
15521 cfg->chan = nl80211_get_nan_channel(wiphy, freq);
15522 if (!cfg->chan)
15523 return -EINVAL;
15524 }
15525
15526 if (tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]) {
15527 cfg->rssi_close =
15528 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]);
15529 if (!tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE])
15530 return -EINVAL;
15531 }
15532
15533 if (tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]) {
15534 cfg->rssi_middle =
15535 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]);
15536 if (!cfg->rssi_close || cfg->rssi_middle >= cfg->rssi_close)
15537 return -EINVAL;
15538 }
15539
15540 if (tb[NL80211_NAN_BAND_CONF_WAKE_DW]) {
15541 cfg->awake_dw_interval =
15542 nla_get_u8(tb[NL80211_NAN_BAND_CONF_WAKE_DW]);
15543
15544 if (band == NL80211_BAND_2GHZ && cfg->awake_dw_interval == 0)
15545 return -EINVAL;
15546 }
15547
15548 cfg->disable_scan =
15549 nla_get_flag(tb[NL80211_NAN_BAND_CONF_DISABLE_SCAN]);
15550 return 0;
15551 }
15552
nl80211_parse_nan_conf(struct wiphy * wiphy,struct genl_info * info,struct cfg80211_nan_conf * conf,u32 * changed_flags)15553 static int nl80211_parse_nan_conf(struct wiphy *wiphy,
15554 struct genl_info *info,
15555 struct cfg80211_nan_conf *conf,
15556 u32 *changed_flags)
15557 {
15558 struct nlattr *attrs[NL80211_NAN_CONF_ATTR_MAX + 1];
15559 int err, rem;
15560 u32 changed = 0;
15561 struct nlattr *band_config;
15562
15563 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
15564 conf->master_pref =
15565 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
15566
15567 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
15568 }
15569
15570 if (info->attrs[NL80211_ATTR_BANDS]) {
15571 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
15572
15573 if (bands & ~(u32)wiphy->nan_supported_bands)
15574 return -EOPNOTSUPP;
15575
15576 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
15577 return -EINVAL;
15578
15579 conf->bands = bands;
15580 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
15581 }
15582
15583 conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval = 1;
15584 if (conf->bands & BIT(NL80211_BAND_5GHZ) || !conf->bands)
15585 conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval = 1;
15586
15587 /* On 2.4 GHz band use channel 6 */
15588 conf->band_cfgs[NL80211_BAND_2GHZ].chan =
15589 nl80211_get_nan_channel(wiphy, 2437);
15590 if (!conf->band_cfgs[NL80211_BAND_2GHZ].chan)
15591 return -EINVAL;
15592
15593 if (!info->attrs[NL80211_ATTR_NAN_CONFIG])
15594 goto out;
15595
15596 err = nla_parse_nested(attrs, NL80211_NAN_CONF_ATTR_MAX,
15597 info->attrs[NL80211_ATTR_NAN_CONFIG], NULL,
15598 info->extack);
15599 if (err)
15600 return err;
15601
15602 changed |= CFG80211_NAN_CONF_CHANGED_CONFIG;
15603 if (attrs[NL80211_NAN_CONF_CLUSTER_ID])
15604 conf->cluster_id =
15605 nla_data(attrs[NL80211_NAN_CONF_CLUSTER_ID]);
15606
15607 if (attrs[NL80211_NAN_CONF_EXTRA_ATTRS]) {
15608 conf->extra_nan_attrs =
15609 nla_data(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15610 conf->extra_nan_attrs_len =
15611 nla_len(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15612 }
15613
15614 if (attrs[NL80211_NAN_CONF_VENDOR_ELEMS]) {
15615 conf->vendor_elems =
15616 nla_data(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15617 conf->vendor_elems_len =
15618 nla_len(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15619 }
15620
15621 if (attrs[NL80211_NAN_CONF_BAND_CONFIGS]) {
15622 nla_for_each_nested(band_config,
15623 attrs[NL80211_NAN_CONF_BAND_CONFIGS],
15624 rem) {
15625 enum nl80211_band band;
15626 struct cfg80211_nan_band_config *cfg;
15627 struct nlattr *tb[NL80211_NAN_BAND_CONF_ATTR_MAX + 1];
15628
15629 err = nla_parse_nested(tb,
15630 NL80211_NAN_BAND_CONF_ATTR_MAX,
15631 band_config, NULL,
15632 info->extack);
15633 if (err)
15634 return err;
15635
15636 if (!tb[NL80211_NAN_BAND_CONF_BAND])
15637 return -EINVAL;
15638
15639 band = nla_get_u8(tb[NL80211_NAN_BAND_CONF_BAND]);
15640 if (conf->bands && !(conf->bands & BIT(band)))
15641 return -EINVAL;
15642
15643 cfg = &conf->band_cfgs[band];
15644
15645 err = nl80211_parse_nan_band_config(wiphy, tb, cfg,
15646 band);
15647 if (err)
15648 return err;
15649 }
15650 }
15651
15652 if (attrs[NL80211_NAN_CONF_SCAN_PERIOD])
15653 conf->scan_period =
15654 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_PERIOD]);
15655
15656 if (attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME])
15657 conf->scan_dwell_time =
15658 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME]);
15659
15660 if (attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL])
15661 conf->discovery_beacon_interval =
15662 nla_get_u8(attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL]);
15663
15664 if (attrs[NL80211_NAN_CONF_NOTIFY_DW])
15665 conf->enable_dw_notification =
15666 nla_get_flag(attrs[NL80211_NAN_CONF_NOTIFY_DW]);
15667
15668 out:
15669 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15670 (!conf->bands || conf->bands & BIT(NL80211_BAND_5GHZ))) {
15671 /* If no 5GHz channel is specified use default, if possible */
15672 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15673 nl80211_get_nan_channel(wiphy, 5745);
15674 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan)
15675 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15676 nl80211_get_nan_channel(wiphy, 5220);
15677
15678 /* Return error if user space asked explicitly for 5 GHz */
15679 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15680 conf->bands & BIT(NL80211_BAND_5GHZ)) {
15681 NL_SET_ERR_MSG_ATTR(info->extack,
15682 info->attrs[NL80211_ATTR_BANDS],
15683 "5 GHz band operation is not allowed");
15684 return -EINVAL;
15685 }
15686 }
15687
15688 if (changed_flags)
15689 *changed_flags = changed;
15690
15691 return 0;
15692 }
15693
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)15694 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
15695 {
15696 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15697 struct wireless_dev *wdev = info->user_ptr[1];
15698 struct cfg80211_nan_conf conf = {};
15699 int err;
15700
15701 if (wdev->iftype != NL80211_IFTYPE_NAN)
15702 return -EOPNOTSUPP;
15703
15704 if (wdev_running(wdev))
15705 return -EEXIST;
15706
15707 if (rfkill_blocked(rdev->wiphy.rfkill))
15708 return -ERFKILL;
15709
15710 /* Master preference is mandatory for START_NAN */
15711 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
15712 return -EINVAL;
15713
15714 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, NULL);
15715 if (err)
15716 return err;
15717
15718 err = rdev_start_nan(rdev, wdev, &conf);
15719 if (err)
15720 return err;
15721
15722 wdev->is_running = true;
15723 rdev->opencount++;
15724
15725 return 0;
15726 }
15727
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)15728 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
15729 {
15730 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15731 struct wireless_dev *wdev = info->user_ptr[1];
15732
15733 if (wdev->iftype != NL80211_IFTYPE_NAN)
15734 return -EOPNOTSUPP;
15735
15736 cfg80211_stop_nan(rdev, wdev);
15737
15738 return 0;
15739 }
15740
validate_nan_filter(struct nlattr * filter_attr)15741 static int validate_nan_filter(struct nlattr *filter_attr)
15742 {
15743 struct nlattr *attr;
15744 int len = 0, n_entries = 0, rem;
15745
15746 nla_for_each_nested(attr, filter_attr, rem) {
15747 len += nla_len(attr);
15748 n_entries++;
15749 }
15750
15751 if (len >= U8_MAX)
15752 return -EINVAL;
15753
15754 return n_entries;
15755 }
15756
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)15757 static int handle_nan_filter(struct nlattr *attr_filter,
15758 struct cfg80211_nan_func *func,
15759 bool tx)
15760 {
15761 struct nlattr *attr;
15762 int n_entries, rem, i;
15763 struct cfg80211_nan_func_filter *filter;
15764
15765 n_entries = validate_nan_filter(attr_filter);
15766 if (n_entries < 0)
15767 return n_entries;
15768
15769 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
15770
15771 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
15772 if (!filter)
15773 return -ENOMEM;
15774
15775 i = 0;
15776 nla_for_each_nested(attr, attr_filter, rem) {
15777 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
15778 if (!filter[i].filter)
15779 goto err;
15780
15781 filter[i].len = nla_len(attr);
15782 i++;
15783 }
15784 if (tx) {
15785 func->num_tx_filters = n_entries;
15786 func->tx_filters = filter;
15787 } else {
15788 func->num_rx_filters = n_entries;
15789 func->rx_filters = filter;
15790 }
15791
15792 return 0;
15793
15794 err:
15795 i = 0;
15796 nla_for_each_nested(attr, attr_filter, rem) {
15797 kfree(filter[i].filter);
15798 i++;
15799 }
15800 kfree(filter);
15801 return -ENOMEM;
15802 }
15803
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)15804 static int nl80211_nan_add_func(struct sk_buff *skb,
15805 struct genl_info *info)
15806 {
15807 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15808 struct wireless_dev *wdev = info->user_ptr[1];
15809 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
15810 struct cfg80211_nan_func *func;
15811 struct sk_buff *msg = NULL;
15812 void *hdr = NULL;
15813 int err = 0;
15814
15815 if (wdev->iftype != NL80211_IFTYPE_NAN)
15816 return -EOPNOTSUPP;
15817
15818 if (!wdev_running(wdev))
15819 return -ENOTCONN;
15820
15821 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
15822 return -EINVAL;
15823
15824 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
15825 info->attrs[NL80211_ATTR_NAN_FUNC],
15826 nl80211_nan_func_policy,
15827 info->extack);
15828 if (err)
15829 return err;
15830
15831 func = kzalloc(sizeof(*func), GFP_KERNEL);
15832 if (!func)
15833 return -ENOMEM;
15834
15835 func->cookie = cfg80211_assign_cookie(rdev);
15836
15837 if (!tb[NL80211_NAN_FUNC_TYPE]) {
15838 err = -EINVAL;
15839 goto out;
15840 }
15841
15842
15843 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
15844
15845 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
15846 err = -EINVAL;
15847 goto out;
15848 }
15849
15850 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
15851 sizeof(func->service_id));
15852
15853 func->close_range =
15854 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
15855
15856 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
15857 func->serv_spec_info_len =
15858 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
15859 func->serv_spec_info =
15860 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
15861 func->serv_spec_info_len,
15862 GFP_KERNEL);
15863 if (!func->serv_spec_info) {
15864 err = -ENOMEM;
15865 goto out;
15866 }
15867 }
15868
15869 if (tb[NL80211_NAN_FUNC_TTL])
15870 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
15871
15872 switch (func->type) {
15873 case NL80211_NAN_FUNC_PUBLISH:
15874 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
15875 err = -EINVAL;
15876 goto out;
15877 }
15878
15879 func->publish_type =
15880 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
15881 func->publish_bcast =
15882 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
15883
15884 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
15885 func->publish_bcast) {
15886 err = -EINVAL;
15887 goto out;
15888 }
15889 break;
15890 case NL80211_NAN_FUNC_SUBSCRIBE:
15891 func->subscribe_active =
15892 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
15893 break;
15894 case NL80211_NAN_FUNC_FOLLOW_UP:
15895 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
15896 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
15897 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
15898 err = -EINVAL;
15899 goto out;
15900 }
15901
15902 func->followup_id =
15903 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
15904 func->followup_reqid =
15905 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
15906 memcpy(func->followup_dest.addr,
15907 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
15908 sizeof(func->followup_dest.addr));
15909 if (func->ttl) {
15910 err = -EINVAL;
15911 goto out;
15912 }
15913 break;
15914 default:
15915 err = -EINVAL;
15916 goto out;
15917 }
15918
15919 if (tb[NL80211_NAN_FUNC_SRF]) {
15920 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
15921
15922 err = nla_parse_nested_deprecated(srf_tb,
15923 NL80211_NAN_SRF_ATTR_MAX,
15924 tb[NL80211_NAN_FUNC_SRF],
15925 nl80211_nan_srf_policy,
15926 info->extack);
15927 if (err)
15928 goto out;
15929
15930 func->srf_include =
15931 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
15932
15933 if (srf_tb[NL80211_NAN_SRF_BF]) {
15934 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
15935 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
15936 err = -EINVAL;
15937 goto out;
15938 }
15939
15940 func->srf_bf_len =
15941 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
15942 func->srf_bf =
15943 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
15944 func->srf_bf_len, GFP_KERNEL);
15945 if (!func->srf_bf) {
15946 err = -ENOMEM;
15947 goto out;
15948 }
15949
15950 func->srf_bf_idx =
15951 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
15952 } else {
15953 struct nlattr *attr, *mac_attr =
15954 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
15955 int n_entries, rem, i = 0;
15956
15957 if (!mac_attr) {
15958 err = -EINVAL;
15959 goto out;
15960 }
15961
15962 n_entries = validate_acl_mac_addrs(mac_attr);
15963 if (n_entries <= 0) {
15964 err = -EINVAL;
15965 goto out;
15966 }
15967
15968 func->srf_num_macs = n_entries;
15969 func->srf_macs =
15970 kcalloc(n_entries, sizeof(*func->srf_macs),
15971 GFP_KERNEL);
15972 if (!func->srf_macs) {
15973 err = -ENOMEM;
15974 goto out;
15975 }
15976
15977 nla_for_each_nested(attr, mac_attr, rem)
15978 memcpy(func->srf_macs[i++].addr, nla_data(attr),
15979 sizeof(*func->srf_macs));
15980 }
15981 }
15982
15983 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
15984 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
15985 func, true);
15986 if (err)
15987 goto out;
15988 }
15989
15990 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
15991 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
15992 func, false);
15993 if (err)
15994 goto out;
15995 }
15996
15997 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15998 if (!msg) {
15999 err = -ENOMEM;
16000 goto out;
16001 }
16002
16003 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16004 NL80211_CMD_ADD_NAN_FUNCTION);
16005 /* This can't really happen - we just allocated 4KB */
16006 if (WARN_ON(!hdr)) {
16007 err = -ENOMEM;
16008 goto out;
16009 }
16010
16011 err = rdev_add_nan_func(rdev, wdev, func);
16012 out:
16013 if (err < 0) {
16014 cfg80211_free_nan_func(func);
16015 nlmsg_free(msg);
16016 return err;
16017 }
16018
16019 /* propagate the instance id and cookie to userspace */
16020 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
16021 NL80211_ATTR_PAD))
16022 goto nla_put_failure;
16023
16024 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16025 if (!func_attr)
16026 goto nla_put_failure;
16027
16028 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
16029 func->instance_id))
16030 goto nla_put_failure;
16031
16032 nla_nest_end(msg, func_attr);
16033
16034 genlmsg_end(msg, hdr);
16035 return genlmsg_reply(msg, info);
16036
16037 nla_put_failure:
16038 nlmsg_free(msg);
16039 return -ENOBUFS;
16040 }
16041
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)16042 static int nl80211_nan_del_func(struct sk_buff *skb,
16043 struct genl_info *info)
16044 {
16045 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16046 struct wireless_dev *wdev = info->user_ptr[1];
16047 u64 cookie;
16048
16049 if (wdev->iftype != NL80211_IFTYPE_NAN)
16050 return -EOPNOTSUPP;
16051
16052 if (!wdev_running(wdev))
16053 return -ENOTCONN;
16054
16055 if (!info->attrs[NL80211_ATTR_COOKIE])
16056 return -EINVAL;
16057
16058 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
16059
16060 rdev_del_nan_func(rdev, wdev, cookie);
16061
16062 return 0;
16063 }
16064
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)16065 static int nl80211_nan_change_config(struct sk_buff *skb,
16066 struct genl_info *info)
16067 {
16068 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16069 struct wireless_dev *wdev = info->user_ptr[1];
16070 struct cfg80211_nan_conf conf = {};
16071 u32 changed = 0;
16072 int err;
16073
16074 if (wdev->iftype != NL80211_IFTYPE_NAN)
16075 return -EOPNOTSUPP;
16076
16077 if (!wdev_running(wdev))
16078 return -ENOTCONN;
16079
16080 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, &changed);
16081 if (err)
16082 return err;
16083
16084 if (!changed)
16085 return -EINVAL;
16086
16087 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
16088 }
16089
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)16090 void cfg80211_nan_match(struct wireless_dev *wdev,
16091 struct cfg80211_nan_match_params *match, gfp_t gfp)
16092 {
16093 struct wiphy *wiphy = wdev->wiphy;
16094 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16095 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
16096 struct sk_buff *msg;
16097 void *hdr;
16098
16099 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
16100 return;
16101
16102 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16103 if (!msg)
16104 return;
16105
16106 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
16107 if (!hdr) {
16108 nlmsg_free(msg);
16109 return;
16110 }
16111
16112 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16113 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16114 wdev->netdev->ifindex)) ||
16115 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16116 NL80211_ATTR_PAD))
16117 goto nla_put_failure;
16118
16119 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
16120 NL80211_ATTR_PAD) ||
16121 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
16122 goto nla_put_failure;
16123
16124 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
16125 if (!match_attr)
16126 goto nla_put_failure;
16127
16128 local_func_attr = nla_nest_start_noflag(msg,
16129 NL80211_NAN_MATCH_FUNC_LOCAL);
16130 if (!local_func_attr)
16131 goto nla_put_failure;
16132
16133 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
16134 goto nla_put_failure;
16135
16136 nla_nest_end(msg, local_func_attr);
16137
16138 peer_func_attr = nla_nest_start_noflag(msg,
16139 NL80211_NAN_MATCH_FUNC_PEER);
16140 if (!peer_func_attr)
16141 goto nla_put_failure;
16142
16143 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
16144 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
16145 goto nla_put_failure;
16146
16147 if (match->info && match->info_len &&
16148 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
16149 match->info))
16150 goto nla_put_failure;
16151
16152 nla_nest_end(msg, peer_func_attr);
16153 nla_nest_end(msg, match_attr);
16154 genlmsg_end(msg, hdr);
16155
16156 if (!wdev->owner_nlportid)
16157 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16158 msg, 0, NL80211_MCGRP_NAN, gfp);
16159 else
16160 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16161 wdev->owner_nlportid);
16162
16163 return;
16164
16165 nla_put_failure:
16166 nlmsg_free(msg);
16167 }
16168 EXPORT_SYMBOL(cfg80211_nan_match);
16169
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)16170 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
16171 u8 inst_id,
16172 enum nl80211_nan_func_term_reason reason,
16173 u64 cookie, gfp_t gfp)
16174 {
16175 struct wiphy *wiphy = wdev->wiphy;
16176 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16177 struct sk_buff *msg;
16178 struct nlattr *func_attr;
16179 void *hdr;
16180
16181 if (WARN_ON(!inst_id))
16182 return;
16183
16184 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16185 if (!msg)
16186 return;
16187
16188 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
16189 if (!hdr) {
16190 nlmsg_free(msg);
16191 return;
16192 }
16193
16194 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16195 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16196 wdev->netdev->ifindex)) ||
16197 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16198 NL80211_ATTR_PAD))
16199 goto nla_put_failure;
16200
16201 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16202 NL80211_ATTR_PAD))
16203 goto nla_put_failure;
16204
16205 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16206 if (!func_attr)
16207 goto nla_put_failure;
16208
16209 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
16210 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
16211 goto nla_put_failure;
16212
16213 nla_nest_end(msg, func_attr);
16214 genlmsg_end(msg, hdr);
16215
16216 if (!wdev->owner_nlportid)
16217 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16218 msg, 0, NL80211_MCGRP_NAN, gfp);
16219 else
16220 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16221 wdev->owner_nlportid);
16222
16223 return;
16224
16225 nla_put_failure:
16226 nlmsg_free(msg);
16227 }
16228 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
16229
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)16230 static int nl80211_get_protocol_features(struct sk_buff *skb,
16231 struct genl_info *info)
16232 {
16233 void *hdr;
16234 struct sk_buff *msg;
16235
16236 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16237 if (!msg)
16238 return -ENOMEM;
16239
16240 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16241 NL80211_CMD_GET_PROTOCOL_FEATURES);
16242 if (!hdr)
16243 goto nla_put_failure;
16244
16245 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
16246 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
16247 goto nla_put_failure;
16248
16249 genlmsg_end(msg, hdr);
16250 return genlmsg_reply(msg, info);
16251
16252 nla_put_failure:
16253 kfree_skb(msg);
16254 return -ENOBUFS;
16255 }
16256
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)16257 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
16258 {
16259 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16260 struct cfg80211_update_ft_ies_params ft_params;
16261 struct net_device *dev = info->user_ptr[1];
16262
16263 if (!rdev->ops->update_ft_ies)
16264 return -EOPNOTSUPP;
16265
16266 if (!info->attrs[NL80211_ATTR_MDID] ||
16267 !info->attrs[NL80211_ATTR_IE])
16268 return -EINVAL;
16269
16270 memset(&ft_params, 0, sizeof(ft_params));
16271 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
16272 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
16273 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
16274
16275 return rdev_update_ft_ies(rdev, dev, &ft_params);
16276 }
16277
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)16278 static int nl80211_crit_protocol_start(struct sk_buff *skb,
16279 struct genl_info *info)
16280 {
16281 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16282 struct wireless_dev *wdev = info->user_ptr[1];
16283 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
16284 u16 duration;
16285 int ret;
16286
16287 if (!rdev->ops->crit_proto_start)
16288 return -EOPNOTSUPP;
16289
16290 if (WARN_ON(!rdev->ops->crit_proto_stop))
16291 return -EINVAL;
16292
16293 if (rdev->crit_proto_nlportid)
16294 return -EBUSY;
16295
16296 /* determine protocol if provided */
16297 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
16298 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
16299
16300 if (proto >= NUM_NL80211_CRIT_PROTO)
16301 return -EINVAL;
16302
16303 /* timeout must be provided */
16304 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
16305 return -EINVAL;
16306
16307 duration =
16308 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
16309
16310 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
16311 if (!ret)
16312 rdev->crit_proto_nlportid = info->snd_portid;
16313
16314 return ret;
16315 }
16316
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)16317 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
16318 struct genl_info *info)
16319 {
16320 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16321 struct wireless_dev *wdev = info->user_ptr[1];
16322
16323 if (!rdev->ops->crit_proto_stop)
16324 return -EOPNOTSUPP;
16325
16326 if (rdev->crit_proto_nlportid) {
16327 rdev->crit_proto_nlportid = 0;
16328 rdev_crit_proto_stop(rdev, wdev);
16329 }
16330 return 0;
16331 }
16332
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)16333 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
16334 struct nlattr *attr,
16335 struct netlink_ext_ack *extack)
16336 {
16337 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
16338 if (attr->nla_type & NLA_F_NESTED) {
16339 NL_SET_ERR_MSG_ATTR(extack, attr,
16340 "unexpected nested data");
16341 return -EINVAL;
16342 }
16343
16344 return 0;
16345 }
16346
16347 if (!(attr->nla_type & NLA_F_NESTED)) {
16348 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
16349 return -EINVAL;
16350 }
16351
16352 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
16353 }
16354
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)16355 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
16356 {
16357 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16358 struct wireless_dev *wdev =
16359 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
16360 info->attrs);
16361 int i, err;
16362 u32 vid, subcmd;
16363
16364 if (!rdev->wiphy.vendor_commands)
16365 return -EOPNOTSUPP;
16366
16367 if (IS_ERR(wdev)) {
16368 err = PTR_ERR(wdev);
16369 if (err != -EINVAL)
16370 return err;
16371 wdev = NULL;
16372 } else if (wdev->wiphy != &rdev->wiphy) {
16373 return -EINVAL;
16374 }
16375
16376 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
16377 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
16378 return -EINVAL;
16379
16380 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
16381 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
16382 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
16383 const struct wiphy_vendor_command *vcmd;
16384 void *data = NULL;
16385 int len = 0;
16386
16387 vcmd = &rdev->wiphy.vendor_commands[i];
16388
16389 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16390 continue;
16391
16392 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16393 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16394 if (!wdev)
16395 return -EINVAL;
16396 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16397 !wdev->netdev)
16398 return -EINVAL;
16399
16400 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16401 if (!wdev_running(wdev))
16402 return -ENETDOWN;
16403 }
16404 } else {
16405 wdev = NULL;
16406 }
16407
16408 if (!vcmd->doit)
16409 return -EOPNOTSUPP;
16410
16411 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
16412 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16413 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16414
16415 err = nl80211_vendor_check_policy(vcmd,
16416 info->attrs[NL80211_ATTR_VENDOR_DATA],
16417 info->extack);
16418 if (err)
16419 return err;
16420 }
16421
16422 rdev->cur_cmd_info = info;
16423 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
16424 rdev->cur_cmd_info = NULL;
16425 return err;
16426 }
16427
16428 return -EOPNOTSUPP;
16429 }
16430
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)16431 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
16432 struct netlink_callback *cb,
16433 struct cfg80211_registered_device **rdev,
16434 struct wireless_dev **wdev)
16435 {
16436 struct nlattr **attrbuf;
16437 u32 vid, subcmd;
16438 unsigned int i;
16439 int vcmd_idx = -1;
16440 int err;
16441 void *data = NULL;
16442 unsigned int data_len = 0;
16443
16444 if (cb->args[0]) {
16445 /* subtract the 1 again here */
16446 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
16447 struct wireless_dev *tmp;
16448
16449 if (!wiphy)
16450 return -ENODEV;
16451 *rdev = wiphy_to_rdev(wiphy);
16452 *wdev = NULL;
16453
16454 if (cb->args[1]) {
16455 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
16456 if (tmp->identifier == cb->args[1] - 1) {
16457 *wdev = tmp;
16458 break;
16459 }
16460 }
16461 }
16462
16463 /* keep rtnl locked in successful case */
16464 return 0;
16465 }
16466
16467 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
16468 if (!attrbuf)
16469 return -ENOMEM;
16470
16471 err = nlmsg_parse_deprecated(cb->nlh,
16472 GENL_HDRLEN + nl80211_fam.hdrsize,
16473 attrbuf, nl80211_fam.maxattr,
16474 nl80211_policy, NULL);
16475 if (err)
16476 goto out;
16477
16478 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
16479 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
16480 err = -EINVAL;
16481 goto out;
16482 }
16483
16484 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
16485 if (IS_ERR(*wdev))
16486 *wdev = NULL;
16487
16488 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
16489 if (IS_ERR(*rdev)) {
16490 err = PTR_ERR(*rdev);
16491 goto out;
16492 }
16493
16494 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
16495 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
16496
16497 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
16498 const struct wiphy_vendor_command *vcmd;
16499
16500 vcmd = &(*rdev)->wiphy.vendor_commands[i];
16501
16502 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16503 continue;
16504
16505 if (!vcmd->dumpit) {
16506 err = -EOPNOTSUPP;
16507 goto out;
16508 }
16509
16510 vcmd_idx = i;
16511 break;
16512 }
16513
16514 if (vcmd_idx < 0) {
16515 err = -EOPNOTSUPP;
16516 goto out;
16517 }
16518
16519 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
16520 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16521 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16522
16523 err = nl80211_vendor_check_policy(
16524 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
16525 attrbuf[NL80211_ATTR_VENDOR_DATA],
16526 cb->extack);
16527 if (err)
16528 goto out;
16529 }
16530
16531 /* 0 is the first index - add 1 to parse only once */
16532 cb->args[0] = (*rdev)->wiphy_idx + 1;
16533 /* add 1 to know if it was NULL */
16534 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
16535 cb->args[2] = vcmd_idx;
16536 cb->args[3] = (unsigned long)data;
16537 cb->args[4] = data_len;
16538
16539 /* keep rtnl locked in successful case */
16540 err = 0;
16541 out:
16542 kfree(attrbuf);
16543 return err;
16544 }
16545
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)16546 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
16547 struct netlink_callback *cb)
16548 {
16549 struct cfg80211_registered_device *rdev;
16550 struct wireless_dev *wdev;
16551 unsigned int vcmd_idx;
16552 const struct wiphy_vendor_command *vcmd;
16553 void *data;
16554 int data_len;
16555 int err;
16556 struct nlattr *vendor_data;
16557
16558 rtnl_lock();
16559 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
16560 if (err)
16561 goto out;
16562
16563 vcmd_idx = cb->args[2];
16564 data = (void *)cb->args[3];
16565 data_len = cb->args[4];
16566 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
16567
16568 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16569 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16570 if (!wdev) {
16571 err = -EINVAL;
16572 goto out;
16573 }
16574 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16575 !wdev->netdev) {
16576 err = -EINVAL;
16577 goto out;
16578 }
16579
16580 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16581 if (!wdev_running(wdev)) {
16582 err = -ENETDOWN;
16583 goto out;
16584 }
16585 }
16586 }
16587
16588 while (1) {
16589 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
16590 cb->nlh->nlmsg_seq, NLM_F_MULTI,
16591 NL80211_CMD_VENDOR);
16592 if (!hdr)
16593 break;
16594
16595 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16596 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
16597 wdev_id(wdev),
16598 NL80211_ATTR_PAD))) {
16599 genlmsg_cancel(skb, hdr);
16600 break;
16601 }
16602
16603 vendor_data = nla_nest_start_noflag(skb,
16604 NL80211_ATTR_VENDOR_DATA);
16605 if (!vendor_data) {
16606 genlmsg_cancel(skb, hdr);
16607 break;
16608 }
16609
16610 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
16611 (unsigned long *)&cb->args[5]);
16612 nla_nest_end(skb, vendor_data);
16613
16614 if (err == -ENOBUFS || err == -ENOENT) {
16615 genlmsg_cancel(skb, hdr);
16616 break;
16617 } else if (err <= 0) {
16618 genlmsg_cancel(skb, hdr);
16619 goto out;
16620 }
16621
16622 genlmsg_end(skb, hdr);
16623 }
16624
16625 err = skb->len;
16626 out:
16627 rtnl_unlock();
16628 return err;
16629 }
16630
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)16631 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
16632 enum nl80211_commands cmd,
16633 enum nl80211_attrs attr,
16634 int approxlen)
16635 {
16636 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16637
16638 if (WARN_ON(!rdev->cur_cmd_info))
16639 return NULL;
16640
16641 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
16642 rdev->cur_cmd_info->snd_portid,
16643 rdev->cur_cmd_info->snd_seq,
16644 cmd, attr, NULL, GFP_KERNEL);
16645 }
16646 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
16647
cfg80211_vendor_cmd_reply(struct sk_buff * skb)16648 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
16649 {
16650 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
16651 void *hdr = ((void **)skb->cb)[1];
16652 struct nlattr *data = ((void **)skb->cb)[2];
16653
16654 /* clear CB data for netlink core to own from now on */
16655 memset(skb->cb, 0, sizeof(skb->cb));
16656
16657 if (WARN_ON(!rdev->cur_cmd_info)) {
16658 kfree_skb(skb);
16659 return -EINVAL;
16660 }
16661
16662 nla_nest_end(skb, data);
16663 genlmsg_end(skb, hdr);
16664 return genlmsg_reply(skb, rdev->cur_cmd_info);
16665 }
16666 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
16667
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)16668 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
16669 {
16670 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16671
16672 if (WARN_ON(!rdev->cur_cmd_info))
16673 return 0;
16674
16675 return rdev->cur_cmd_info->snd_portid;
16676 }
16677 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
16678
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)16679 static int nl80211_set_qos_map(struct sk_buff *skb,
16680 struct genl_info *info)
16681 {
16682 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16683 struct cfg80211_qos_map *qos_map = NULL;
16684 struct net_device *dev = info->user_ptr[1];
16685 u8 *pos, len, num_des, des_len, des;
16686 int ret;
16687
16688 if (!rdev->ops->set_qos_map)
16689 return -EOPNOTSUPP;
16690
16691 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
16692 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
16693 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
16694
16695 if (len % 2)
16696 return -EINVAL;
16697
16698 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
16699 if (!qos_map)
16700 return -ENOMEM;
16701
16702 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
16703 if (num_des) {
16704 des_len = num_des *
16705 sizeof(struct cfg80211_dscp_exception);
16706 memcpy(qos_map->dscp_exception, pos, des_len);
16707 qos_map->num_des = num_des;
16708 for (des = 0; des < num_des; des++) {
16709 if (qos_map->dscp_exception[des].up > 7) {
16710 kfree(qos_map);
16711 return -EINVAL;
16712 }
16713 }
16714 pos += des_len;
16715 }
16716 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
16717 }
16718
16719 ret = nl80211_key_allowed(dev->ieee80211_ptr);
16720 if (!ret)
16721 ret = rdev_set_qos_map(rdev, dev, qos_map);
16722
16723 kfree(qos_map);
16724 return ret;
16725 }
16726
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)16727 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
16728 {
16729 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16730 struct net_device *dev = info->user_ptr[1];
16731 struct wireless_dev *wdev = dev->ieee80211_ptr;
16732 const u8 *peer;
16733 u8 tsid, up;
16734 u16 admitted_time = 0;
16735
16736 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
16737 return -EOPNOTSUPP;
16738
16739 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
16740 !info->attrs[NL80211_ATTR_USER_PRIO])
16741 return -EINVAL;
16742
16743 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16744 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
16745
16746 /* WMM uses TIDs 0-7 even for TSPEC */
16747 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
16748 /* TODO: handle 802.11 TSPEC/admission control
16749 * need more attributes for that (e.g. BA session requirement);
16750 * change the WMM admission test above to allow both then
16751 */
16752 return -EINVAL;
16753 }
16754
16755 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16756
16757 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
16758 admitted_time =
16759 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
16760 if (!admitted_time)
16761 return -EINVAL;
16762 }
16763
16764 switch (wdev->iftype) {
16765 case NL80211_IFTYPE_STATION:
16766 case NL80211_IFTYPE_P2P_CLIENT:
16767 if (wdev->connected)
16768 break;
16769 return -ENOTCONN;
16770 default:
16771 return -EOPNOTSUPP;
16772 }
16773
16774 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
16775 }
16776
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)16777 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
16778 {
16779 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16780 struct net_device *dev = info->user_ptr[1];
16781 const u8 *peer;
16782 u8 tsid;
16783
16784 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
16785 return -EINVAL;
16786
16787 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16788 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16789
16790 return rdev_del_tx_ts(rdev, dev, tsid, peer);
16791 }
16792
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)16793 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
16794 struct genl_info *info)
16795 {
16796 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16797 struct net_device *dev = info->user_ptr[1];
16798 struct wireless_dev *wdev = dev->ieee80211_ptr;
16799 struct cfg80211_chan_def chandef = {};
16800 const u8 *addr;
16801 u8 oper_class;
16802 int err;
16803
16804 if (!rdev->ops->tdls_channel_switch ||
16805 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16806 return -EOPNOTSUPP;
16807
16808 switch (dev->ieee80211_ptr->iftype) {
16809 case NL80211_IFTYPE_STATION:
16810 case NL80211_IFTYPE_P2P_CLIENT:
16811 break;
16812 default:
16813 return -EOPNOTSUPP;
16814 }
16815
16816 if (!info->attrs[NL80211_ATTR_MAC] ||
16817 !info->attrs[NL80211_ATTR_OPER_CLASS])
16818 return -EINVAL;
16819
16820 err = nl80211_parse_chandef(rdev, info, &chandef);
16821 if (err)
16822 return err;
16823
16824 /*
16825 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
16826 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
16827 * specification is not defined for them.
16828 */
16829 if (chandef.chan->band == NL80211_BAND_2GHZ &&
16830 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
16831 chandef.width != NL80211_CHAN_WIDTH_20)
16832 return -EINVAL;
16833
16834 /* we will be active on the TDLS link */
16835 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
16836 wdev->iftype))
16837 return -EINVAL;
16838
16839 /* don't allow switching to DFS channels */
16840 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
16841 return -EINVAL;
16842
16843 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16844 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
16845
16846 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
16847 }
16848
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)16849 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
16850 struct genl_info *info)
16851 {
16852 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16853 struct net_device *dev = info->user_ptr[1];
16854 const u8 *addr;
16855
16856 if (!rdev->ops->tdls_channel_switch ||
16857 !rdev->ops->tdls_cancel_channel_switch ||
16858 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16859 return -EOPNOTSUPP;
16860
16861 switch (dev->ieee80211_ptr->iftype) {
16862 case NL80211_IFTYPE_STATION:
16863 case NL80211_IFTYPE_P2P_CLIENT:
16864 break;
16865 default:
16866 return -EOPNOTSUPP;
16867 }
16868
16869 if (!info->attrs[NL80211_ATTR_MAC])
16870 return -EINVAL;
16871
16872 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16873
16874 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
16875
16876 return 0;
16877 }
16878
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)16879 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
16880 struct genl_info *info)
16881 {
16882 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16883 struct net_device *dev = info->user_ptr[1];
16884 struct wireless_dev *wdev = dev->ieee80211_ptr;
16885 const struct nlattr *nla;
16886 bool enabled;
16887
16888 if (!rdev->ops->set_multicast_to_unicast)
16889 return -EOPNOTSUPP;
16890
16891 if (wdev->iftype != NL80211_IFTYPE_AP &&
16892 wdev->iftype != NL80211_IFTYPE_P2P_GO)
16893 return -EOPNOTSUPP;
16894
16895 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
16896 enabled = nla_get_flag(nla);
16897
16898 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
16899 }
16900
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)16901 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
16902 {
16903 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16904 struct net_device *dev = info->user_ptr[1];
16905 struct wireless_dev *wdev = dev->ieee80211_ptr;
16906 struct cfg80211_pmk_conf pmk_conf = {};
16907
16908 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16909 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16910 return -EOPNOTSUPP;
16911
16912 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16913 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16914 return -EOPNOTSUPP;
16915
16916 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
16917 return -EINVAL;
16918
16919 if (!wdev->connected)
16920 return -ENOTCONN;
16921
16922 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16923 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
16924 return -EINVAL;
16925
16926 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
16927 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
16928 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
16929 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
16930 return -EINVAL;
16931
16932 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
16933 pmk_conf.pmk_r0_name =
16934 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
16935
16936 return rdev_set_pmk(rdev, dev, &pmk_conf);
16937 }
16938
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)16939 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
16940 {
16941 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16942 struct net_device *dev = info->user_ptr[1];
16943 struct wireless_dev *wdev = dev->ieee80211_ptr;
16944 const u8 *aa;
16945
16946 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16947 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16948 return -EOPNOTSUPP;
16949
16950 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16951 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16952 return -EOPNOTSUPP;
16953
16954 if (!info->attrs[NL80211_ATTR_MAC])
16955 return -EINVAL;
16956
16957 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16958 return rdev_del_pmk(rdev, dev, aa);
16959 }
16960
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)16961 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
16962 {
16963 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16964 struct net_device *dev = info->user_ptr[1];
16965 struct cfg80211_external_auth_params params;
16966
16967 if (!rdev->ops->external_auth)
16968 return -EOPNOTSUPP;
16969
16970 if (!info->attrs[NL80211_ATTR_SSID] &&
16971 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
16972 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
16973 return -EINVAL;
16974
16975 if (!info->attrs[NL80211_ATTR_BSSID])
16976 return -EINVAL;
16977
16978 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
16979 return -EINVAL;
16980
16981 memset(¶ms, 0, sizeof(params));
16982
16983 if (info->attrs[NL80211_ATTR_SSID]) {
16984 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
16985 if (params.ssid.ssid_len == 0)
16986 return -EINVAL;
16987 memcpy(params.ssid.ssid,
16988 nla_data(info->attrs[NL80211_ATTR_SSID]),
16989 params.ssid.ssid_len);
16990 }
16991
16992 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
16993 ETH_ALEN);
16994
16995 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
16996
16997 if (info->attrs[NL80211_ATTR_PMKID])
16998 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
16999
17000 return rdev_external_auth(rdev, dev, ¶ms);
17001 }
17002
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)17003 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
17004 {
17005 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
17006 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17007 struct net_device *dev = info->user_ptr[1];
17008 struct wireless_dev *wdev = dev->ieee80211_ptr;
17009 const u8 *buf;
17010 size_t len;
17011 u8 *dest;
17012 u16 proto;
17013 bool noencrypt;
17014 u64 cookie = 0;
17015 int link_id;
17016 int err;
17017
17018 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17019 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
17020 return -EOPNOTSUPP;
17021
17022 if (!rdev->ops->tx_control_port)
17023 return -EOPNOTSUPP;
17024
17025 if (!info->attrs[NL80211_ATTR_FRAME] ||
17026 !info->attrs[NL80211_ATTR_MAC] ||
17027 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
17028 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
17029 return -EINVAL;
17030 }
17031
17032 switch (wdev->iftype) {
17033 case NL80211_IFTYPE_AP:
17034 case NL80211_IFTYPE_P2P_GO:
17035 case NL80211_IFTYPE_MESH_POINT:
17036 break;
17037 case NL80211_IFTYPE_ADHOC:
17038 if (wdev->u.ibss.current_bss)
17039 break;
17040 return -ENOTCONN;
17041 case NL80211_IFTYPE_STATION:
17042 case NL80211_IFTYPE_P2P_CLIENT:
17043 if (wdev->connected)
17044 break;
17045 return -ENOTCONN;
17046 default:
17047 return -EOPNOTSUPP;
17048 }
17049
17050 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17051 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17052 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17053 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
17054 noencrypt =
17055 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
17056
17057 link_id = nl80211_link_id_or_invalid(info->attrs);
17058
17059 err = rdev_tx_control_port(rdev, dev, buf, len,
17060 dest, cpu_to_be16(proto), noencrypt, link_id,
17061 dont_wait_for_ack ? NULL : &cookie);
17062 if (!err && !dont_wait_for_ack)
17063 nl_set_extack_cookie_u64(info->extack, cookie);
17064 return err;
17065 }
17066
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)17067 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
17068 struct genl_info *info)
17069 {
17070 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17071 struct net_device *dev = info->user_ptr[1];
17072 struct wireless_dev *wdev = dev->ieee80211_ptr;
17073 struct cfg80211_ftm_responder_stats ftm_stats = {};
17074 unsigned int link_id = nl80211_link_id(info->attrs);
17075 struct sk_buff *msg;
17076 void *hdr;
17077 struct nlattr *ftm_stats_attr;
17078 int err;
17079
17080 if (wdev->iftype != NL80211_IFTYPE_AP ||
17081 !wdev->links[link_id].ap.beacon_interval)
17082 return -EOPNOTSUPP;
17083
17084 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
17085 if (err)
17086 return err;
17087
17088 if (!ftm_stats.filled)
17089 return -ENODATA;
17090
17091 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17092 if (!msg)
17093 return -ENOMEM;
17094
17095 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
17096 NL80211_CMD_GET_FTM_RESPONDER_STATS);
17097 if (!hdr)
17098 goto nla_put_failure;
17099
17100 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17101 goto nla_put_failure;
17102
17103 ftm_stats_attr = nla_nest_start_noflag(msg,
17104 NL80211_ATTR_FTM_RESPONDER_STATS);
17105 if (!ftm_stats_attr)
17106 goto nla_put_failure;
17107
17108 #define SET_FTM(field, name, type) \
17109 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17110 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
17111 ftm_stats.field)) \
17112 goto nla_put_failure; } while (0)
17113 #define SET_FTM_U64(field, name) \
17114 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17115 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
17116 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
17117 goto nla_put_failure; } while (0)
17118
17119 SET_FTM(success_num, SUCCESS_NUM, u32);
17120 SET_FTM(partial_num, PARTIAL_NUM, u32);
17121 SET_FTM(failed_num, FAILED_NUM, u32);
17122 SET_FTM(asap_num, ASAP_NUM, u32);
17123 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
17124 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
17125 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
17126 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
17127 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
17128 #undef SET_FTM
17129
17130 nla_nest_end(msg, ftm_stats_attr);
17131
17132 genlmsg_end(msg, hdr);
17133 return genlmsg_reply(msg, info);
17134
17135 nla_put_failure:
17136 nlmsg_free(msg);
17137 return -ENOBUFS;
17138 }
17139
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)17140 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
17141 {
17142 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17143 struct cfg80211_update_owe_info owe_info;
17144 struct net_device *dev = info->user_ptr[1];
17145
17146 if (!rdev->ops->update_owe_info)
17147 return -EOPNOTSUPP;
17148
17149 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
17150 !info->attrs[NL80211_ATTR_MAC])
17151 return -EINVAL;
17152
17153 memset(&owe_info, 0, sizeof(owe_info));
17154 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17155 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
17156
17157 if (info->attrs[NL80211_ATTR_IE]) {
17158 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
17159 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
17160 }
17161
17162 return rdev_update_owe_info(rdev, dev, &owe_info);
17163 }
17164
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)17165 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
17166 {
17167 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17168 struct net_device *dev = info->user_ptr[1];
17169 struct wireless_dev *wdev = dev->ieee80211_ptr;
17170 struct station_info sinfo = {};
17171 const u8 *buf;
17172 size_t len;
17173 u8 *dest;
17174 int err;
17175
17176 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
17177 return -EOPNOTSUPP;
17178
17179 if (!info->attrs[NL80211_ATTR_MAC] ||
17180 !info->attrs[NL80211_ATTR_FRAME]) {
17181 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
17182 return -EINVAL;
17183 }
17184
17185 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
17186 return -EOPNOTSUPP;
17187
17188 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17189 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17190 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17191
17192 if (len < sizeof(struct ethhdr))
17193 return -EINVAL;
17194
17195 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
17196 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
17197 return -EINVAL;
17198
17199 err = rdev_get_station(rdev, dev, dest, &sinfo);
17200 if (err)
17201 return err;
17202
17203 cfg80211_sinfo_release_content(&sinfo);
17204
17205 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
17206 }
17207
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)17208 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
17209 struct nlattr *attrs[], struct net_device *dev,
17210 struct cfg80211_tid_cfg *tid_conf,
17211 struct genl_info *info, const u8 *peer,
17212 unsigned int link_id)
17213 {
17214 struct netlink_ext_ack *extack = info->extack;
17215 u64 mask;
17216 int err;
17217
17218 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
17219 return -EINVAL;
17220
17221 tid_conf->config_override =
17222 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
17223 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
17224
17225 if (tid_conf->config_override) {
17226 if (rdev->ops->reset_tid_config) {
17227 err = rdev_reset_tid_config(rdev, dev, peer,
17228 tid_conf->tids);
17229 if (err)
17230 return err;
17231 } else {
17232 return -EINVAL;
17233 }
17234 }
17235
17236 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
17237 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
17238 tid_conf->noack =
17239 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
17240 }
17241
17242 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
17243 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
17244 tid_conf->retry_short =
17245 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
17246
17247 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
17248 return -EINVAL;
17249 }
17250
17251 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
17252 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
17253 tid_conf->retry_long =
17254 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
17255
17256 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
17257 return -EINVAL;
17258 }
17259
17260 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
17261 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
17262 tid_conf->ampdu =
17263 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
17264 }
17265
17266 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
17267 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
17268 tid_conf->rtscts =
17269 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
17270 }
17271
17272 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
17273 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
17274 tid_conf->amsdu =
17275 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
17276 }
17277
17278 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
17279 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
17280
17281 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
17282
17283 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
17284 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
17285 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
17286 &tid_conf->txrate_mask, dev,
17287 true, link_id);
17288 if (err)
17289 return err;
17290
17291 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
17292 }
17293 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
17294 }
17295
17296 if (peer)
17297 mask = rdev->wiphy.tid_config_support.peer;
17298 else
17299 mask = rdev->wiphy.tid_config_support.vif;
17300
17301 if (tid_conf->mask & ~mask) {
17302 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
17303 return -EOPNOTSUPP;
17304 }
17305
17306 return 0;
17307 }
17308
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)17309 static int nl80211_set_tid_config(struct sk_buff *skb,
17310 struct genl_info *info)
17311 {
17312 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17313 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
17314 unsigned int link_id = nl80211_link_id(info->attrs);
17315 struct net_device *dev = info->user_ptr[1];
17316 struct cfg80211_tid_config *tid_config;
17317 struct nlattr *tid;
17318 int conf_idx = 0, rem_conf;
17319 int ret = -EINVAL;
17320 u32 num_conf = 0;
17321
17322 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
17323 return -EINVAL;
17324
17325 if (!rdev->ops->set_tid_config)
17326 return -EOPNOTSUPP;
17327
17328 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17329 rem_conf)
17330 num_conf++;
17331
17332 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
17333 GFP_KERNEL);
17334 if (!tid_config)
17335 return -ENOMEM;
17336
17337 tid_config->n_tid_conf = num_conf;
17338
17339 if (info->attrs[NL80211_ATTR_MAC])
17340 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
17341
17342 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17343 rem_conf) {
17344 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
17345 tid, NULL, NULL);
17346
17347 if (ret)
17348 goto bad_tid_conf;
17349
17350 ret = parse_tid_conf(rdev, attrs, dev,
17351 &tid_config->tid_conf[conf_idx],
17352 info, tid_config->peer, link_id);
17353 if (ret)
17354 goto bad_tid_conf;
17355
17356 conf_idx++;
17357 }
17358
17359 ret = rdev_set_tid_config(rdev, dev, tid_config);
17360
17361 bad_tid_conf:
17362 kfree(tid_config);
17363 return ret;
17364 }
17365
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)17366 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
17367 {
17368 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17369 struct cfg80211_color_change_settings params = {};
17370 struct net_device *dev = info->user_ptr[1];
17371 struct wireless_dev *wdev = dev->ieee80211_ptr;
17372 struct nlattr **tb;
17373 u16 offset;
17374 int err;
17375
17376 if (!rdev->ops->color_change)
17377 return -EOPNOTSUPP;
17378
17379 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17380 NL80211_EXT_FEATURE_BSS_COLOR))
17381 return -EOPNOTSUPP;
17382
17383 if (wdev->iftype != NL80211_IFTYPE_AP)
17384 return -EOPNOTSUPP;
17385
17386 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
17387 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
17388 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
17389 return -EINVAL;
17390
17391 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
17392 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
17393
17394 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
17395 info->extack);
17396 if (err)
17397 return err;
17398
17399 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
17400 if (!tb)
17401 return -ENOMEM;
17402
17403 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
17404 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
17405 nl80211_policy, info->extack);
17406 if (err)
17407 goto out;
17408
17409 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
17410 info->extack);
17411 if (err)
17412 goto out;
17413
17414 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
17415 err = -EINVAL;
17416 goto out;
17417 }
17418
17419 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
17420 err = -EINVAL;
17421 goto out;
17422 }
17423
17424 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
17425 if (offset >= params.beacon_color_change.tail_len) {
17426 err = -EINVAL;
17427 goto out;
17428 }
17429
17430 if (params.beacon_color_change.tail[offset] != params.count) {
17431 err = -EINVAL;
17432 goto out;
17433 }
17434
17435 params.counter_offset_beacon = offset;
17436
17437 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
17438 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
17439 sizeof(u16)) {
17440 err = -EINVAL;
17441 goto out;
17442 }
17443
17444 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
17445 if (offset >= params.beacon_color_change.probe_resp_len) {
17446 err = -EINVAL;
17447 goto out;
17448 }
17449
17450 if (params.beacon_color_change.probe_resp[offset] !=
17451 params.count) {
17452 err = -EINVAL;
17453 goto out;
17454 }
17455
17456 params.counter_offset_presp = offset;
17457 }
17458
17459 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
17460 err = nl80211_parse_unsol_bcast_probe_resp(
17461 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
17462 ¶ms.unsol_bcast_probe_resp);
17463 if (err)
17464 goto out;
17465 }
17466
17467 params.link_id = nl80211_link_id(info->attrs);
17468 err = rdev_color_change(rdev, dev, ¶ms);
17469
17470 out:
17471 kfree(params.beacon_next.mbssid_ies);
17472 kfree(params.beacon_color_change.mbssid_ies);
17473 kfree(params.beacon_next.rnr_ies);
17474 kfree(params.beacon_color_change.rnr_ies);
17475 kfree(tb);
17476 return err;
17477 }
17478
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)17479 static int nl80211_set_fils_aad(struct sk_buff *skb,
17480 struct genl_info *info)
17481 {
17482 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17483 struct net_device *dev = info->user_ptr[1];
17484 struct cfg80211_fils_aad fils_aad = {};
17485 u8 *nonces;
17486
17487 if (!info->attrs[NL80211_ATTR_MAC] ||
17488 !info->attrs[NL80211_ATTR_FILS_KEK] ||
17489 !info->attrs[NL80211_ATTR_FILS_NONCES])
17490 return -EINVAL;
17491
17492 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17493 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
17494 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
17495 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
17496 fils_aad.snonce = nonces;
17497 fils_aad.anonce = nonces + FILS_NONCE_LEN;
17498
17499 return rdev_set_fils_aad(rdev, dev, &fils_aad);
17500 }
17501
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)17502 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
17503 {
17504 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17505 unsigned int link_id = nl80211_link_id(info->attrs);
17506 struct net_device *dev = info->user_ptr[1];
17507 struct wireless_dev *wdev = dev->ieee80211_ptr;
17508 int ret;
17509
17510 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
17511 return -EINVAL;
17512
17513 switch (wdev->iftype) {
17514 case NL80211_IFTYPE_AP:
17515 break;
17516 default:
17517 return -EINVAL;
17518 }
17519
17520 if (!info->attrs[NL80211_ATTR_MAC] ||
17521 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
17522 return -EINVAL;
17523
17524 wdev->valid_links |= BIT(link_id);
17525 ether_addr_copy(wdev->links[link_id].addr,
17526 nla_data(info->attrs[NL80211_ATTR_MAC]));
17527
17528 ret = rdev_add_intf_link(rdev, wdev, link_id);
17529 if (ret) {
17530 wdev->valid_links &= ~BIT(link_id);
17531 eth_zero_addr(wdev->links[link_id].addr);
17532 }
17533
17534 return ret;
17535 }
17536
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)17537 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
17538 {
17539 unsigned int link_id = nl80211_link_id(info->attrs);
17540 struct net_device *dev = info->user_ptr[1];
17541 struct wireless_dev *wdev = dev->ieee80211_ptr;
17542
17543 /* cannot remove if there's no link */
17544 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17545 return -EINVAL;
17546
17547 switch (wdev->iftype) {
17548 case NL80211_IFTYPE_AP:
17549 break;
17550 default:
17551 return -EINVAL;
17552 }
17553
17554 cfg80211_remove_link(wdev, link_id);
17555
17556 return 0;
17557 }
17558
17559 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)17560 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
17561 bool add)
17562 {
17563 struct link_station_parameters params = {};
17564 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17565 struct net_device *dev = info->user_ptr[1];
17566 int err;
17567
17568 if ((add && !rdev->ops->add_link_station) ||
17569 (!add && !rdev->ops->mod_link_station))
17570 return -EOPNOTSUPP;
17571
17572 if (add && !info->attrs[NL80211_ATTR_MAC])
17573 return -EINVAL;
17574
17575 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
17576 return -EINVAL;
17577
17578 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
17579 return -EINVAL;
17580
17581 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17582
17583 if (info->attrs[NL80211_ATTR_MAC]) {
17584 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
17585 if (!is_valid_ether_addr(params.link_mac))
17586 return -EINVAL;
17587 }
17588
17589 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17590 return -EINVAL;
17591
17592 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17593
17594 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
17595 params.supported_rates =
17596 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17597 params.supported_rates_len =
17598 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17599 }
17600
17601 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
17602 params.ht_capa =
17603 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
17604
17605 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
17606 params.vht_capa =
17607 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
17608
17609 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
17610 params.he_capa =
17611 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17612 params.he_capa_len =
17613 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17614
17615 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
17616 params.eht_capa =
17617 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17618 params.eht_capa_len =
17619 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17620
17621 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
17622 (const u8 *)params.eht_capa,
17623 params.eht_capa_len,
17624 false))
17625 return -EINVAL;
17626 }
17627 }
17628
17629 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
17630 params.he_6ghz_capa =
17631 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
17632
17633 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
17634 params.opmode_notif_used = true;
17635 params.opmode_notif =
17636 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
17637 }
17638
17639 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
17640 ¶ms.txpwr_set);
17641 if (err)
17642 return err;
17643
17644 if (add)
17645 return rdev_add_link_station(rdev, dev, ¶ms);
17646
17647 return rdev_mod_link_station(rdev, dev, ¶ms);
17648 }
17649
17650 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)17651 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
17652 {
17653 return nl80211_add_mod_link_station(skb, info, true);
17654 }
17655
17656 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)17657 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
17658 {
17659 return nl80211_add_mod_link_station(skb, info, false);
17660 }
17661
17662 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)17663 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
17664 {
17665 struct link_station_del_parameters params = {};
17666 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17667 struct net_device *dev = info->user_ptr[1];
17668
17669 if (!rdev->ops->del_link_station)
17670 return -EOPNOTSUPP;
17671
17672 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
17673 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
17674 return -EINVAL;
17675
17676 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17677 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17678
17679 return rdev_del_link_station(rdev, dev, ¶ms);
17680 }
17681
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)17682 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
17683 struct genl_info *info)
17684 {
17685 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17686 struct net_device *dev = info->user_ptr[1];
17687 struct cfg80211_set_hw_timestamp hwts = {};
17688
17689 if (!rdev->wiphy.hw_timestamp_max_peers)
17690 return -EOPNOTSUPP;
17691
17692 if (!info->attrs[NL80211_ATTR_MAC] &&
17693 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
17694 return -EOPNOTSUPP;
17695
17696 if (info->attrs[NL80211_ATTR_MAC])
17697 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17698
17699 hwts.enable =
17700 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
17701
17702 return rdev_set_hw_timestamp(rdev, dev, &hwts);
17703 }
17704
17705 static int
nl80211_set_ttlm(struct sk_buff * skb,struct genl_info * info)17706 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
17707 {
17708 struct cfg80211_ttlm_params params = {};
17709 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17710 struct net_device *dev = info->user_ptr[1];
17711 struct wireless_dev *wdev = dev->ieee80211_ptr;
17712
17713 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17714 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17715 return -EOPNOTSUPP;
17716
17717 if (!wdev->connected)
17718 return -ENOLINK;
17719
17720 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
17721 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
17722 return -EINVAL;
17723
17724 nla_memcpy(params.dlink,
17725 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
17726 sizeof(params.dlink));
17727 nla_memcpy(params.ulink,
17728 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
17729 sizeof(params.ulink));
17730
17731 return rdev_set_ttlm(rdev, dev, ¶ms);
17732 }
17733
nl80211_assoc_ml_reconf(struct sk_buff * skb,struct genl_info * info)17734 static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
17735 {
17736 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17737 struct net_device *dev = info->user_ptr[1];
17738 struct wireless_dev *wdev = dev->ieee80211_ptr;
17739 struct cfg80211_ml_reconf_req req = {};
17740 unsigned int link_id;
17741 u16 add_links;
17742 int err;
17743
17744 if (!wdev->valid_links)
17745 return -EINVAL;
17746
17747 if (dev->ieee80211_ptr->conn_owner_nlportid &&
17748 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
17749 return -EPERM;
17750
17751 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
17752 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
17753 return -EOPNOTSUPP;
17754
17755 add_links = 0;
17756 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
17757 err = nl80211_process_links(rdev, req.add_links,
17758 /* mark as MLO, but not assoc */
17759 IEEE80211_MLD_MAX_NUM_LINKS,
17760 NULL, 0, info);
17761 if (err)
17762 return err;
17763
17764 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
17765 link_id++) {
17766 if (!req.add_links[link_id].bss)
17767 continue;
17768 add_links |= BIT(link_id);
17769 }
17770 }
17771
17772 if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
17773 req.rem_links =
17774 nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
17775
17776 /* Validate that existing links are not added, removed links are valid
17777 * and don't allow adding and removing the same links
17778 */
17779 if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
17780 (wdev->valid_links & add_links) ||
17781 ((wdev->valid_links & req.rem_links) != req.rem_links)) {
17782 err = -EINVAL;
17783 goto out;
17784 }
17785
17786 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
17787 req.ext_mld_capa_ops =
17788 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
17789
17790 err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
17791
17792 out:
17793 for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
17794 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
17795
17796 return err;
17797 }
17798
17799 static int
nl80211_epcs_cfg(struct sk_buff * skb,struct genl_info * info)17800 nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
17801 {
17802 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17803 struct net_device *dev = info->user_ptr[1];
17804 struct wireless_dev *wdev = dev->ieee80211_ptr;
17805 bool val;
17806
17807 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17808 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17809 return -EOPNOTSUPP;
17810
17811 if (!wdev->connected)
17812 return -ENOLINK;
17813
17814 val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
17815
17816 return rdev_set_epcs(rdev, dev, val);
17817 }
17818
17819 #define NL80211_FLAG_NEED_WIPHY 0x01
17820 #define NL80211_FLAG_NEED_NETDEV 0x02
17821 #define NL80211_FLAG_NEED_RTNL 0x04
17822 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
17823 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
17824 NL80211_FLAG_CHECK_NETDEV_UP)
17825 #define NL80211_FLAG_NEED_WDEV 0x10
17826 /* If a netdev is associated, it must be UP, P2P must be started */
17827 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
17828 NL80211_FLAG_CHECK_NETDEV_UP)
17829 #define NL80211_FLAG_CLEAR_SKB 0x20
17830 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
17831 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
17832 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
17833
17834 #define INTERNAL_FLAG_SELECTORS(__sel) \
17835 SELECTOR(__sel, NONE, 0) /* must be first */ \
17836 SELECTOR(__sel, WIPHY, \
17837 NL80211_FLAG_NEED_WIPHY) \
17838 SELECTOR(__sel, WDEV, \
17839 NL80211_FLAG_NEED_WDEV) \
17840 SELECTOR(__sel, NETDEV, \
17841 NL80211_FLAG_NEED_NETDEV) \
17842 SELECTOR(__sel, NETDEV_LINK, \
17843 NL80211_FLAG_NEED_NETDEV | \
17844 NL80211_FLAG_MLO_VALID_LINK_ID) \
17845 SELECTOR(__sel, NETDEV_NO_MLO, \
17846 NL80211_FLAG_NEED_NETDEV | \
17847 NL80211_FLAG_MLO_UNSUPPORTED) \
17848 SELECTOR(__sel, WIPHY_RTNL, \
17849 NL80211_FLAG_NEED_WIPHY | \
17850 NL80211_FLAG_NEED_RTNL) \
17851 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
17852 NL80211_FLAG_NEED_WIPHY | \
17853 NL80211_FLAG_NEED_RTNL | \
17854 NL80211_FLAG_NO_WIPHY_MTX) \
17855 SELECTOR(__sel, WDEV_RTNL, \
17856 NL80211_FLAG_NEED_WDEV | \
17857 NL80211_FLAG_NEED_RTNL) \
17858 SELECTOR(__sel, NETDEV_RTNL, \
17859 NL80211_FLAG_NEED_NETDEV | \
17860 NL80211_FLAG_NEED_RTNL) \
17861 SELECTOR(__sel, NETDEV_UP, \
17862 NL80211_FLAG_NEED_NETDEV_UP) \
17863 SELECTOR(__sel, NETDEV_UP_LINK, \
17864 NL80211_FLAG_NEED_NETDEV_UP | \
17865 NL80211_FLAG_MLO_VALID_LINK_ID) \
17866 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
17867 NL80211_FLAG_NEED_NETDEV_UP | \
17868 NL80211_FLAG_MLO_UNSUPPORTED) \
17869 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
17870 NL80211_FLAG_NEED_NETDEV_UP | \
17871 NL80211_FLAG_CLEAR_SKB | \
17872 NL80211_FLAG_MLO_UNSUPPORTED) \
17873 SELECTOR(__sel, NETDEV_UP_NOTMX, \
17874 NL80211_FLAG_NEED_NETDEV_UP | \
17875 NL80211_FLAG_NO_WIPHY_MTX) \
17876 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
17877 NL80211_FLAG_NEED_NETDEV_UP | \
17878 NL80211_FLAG_NO_WIPHY_MTX | \
17879 NL80211_FLAG_MLO_VALID_LINK_ID) \
17880 SELECTOR(__sel, NETDEV_UP_CLEAR, \
17881 NL80211_FLAG_NEED_NETDEV_UP | \
17882 NL80211_FLAG_CLEAR_SKB) \
17883 SELECTOR(__sel, WDEV_UP, \
17884 NL80211_FLAG_NEED_WDEV_UP) \
17885 SELECTOR(__sel, WDEV_UP_LINK, \
17886 NL80211_FLAG_NEED_WDEV_UP | \
17887 NL80211_FLAG_MLO_VALID_LINK_ID) \
17888 SELECTOR(__sel, WDEV_UP_RTNL, \
17889 NL80211_FLAG_NEED_WDEV_UP | \
17890 NL80211_FLAG_NEED_RTNL) \
17891 SELECTOR(__sel, WIPHY_CLEAR, \
17892 NL80211_FLAG_NEED_WIPHY | \
17893 NL80211_FLAG_CLEAR_SKB)
17894
17895 enum nl80211_internal_flags_selector {
17896 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
17897 INTERNAL_FLAG_SELECTORS(_)
17898 #undef SELECTOR
17899 };
17900
17901 static u32 nl80211_internal_flags[] = {
17902 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
17903 INTERNAL_FLAG_SELECTORS(_)
17904 #undef SELECTOR
17905 };
17906
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)17907 static int nl80211_pre_doit(const struct genl_split_ops *ops,
17908 struct sk_buff *skb,
17909 struct genl_info *info)
17910 {
17911 struct cfg80211_registered_device *rdev = NULL;
17912 struct wireless_dev *wdev = NULL;
17913 struct net_device *dev = NULL;
17914 u32 internal_flags;
17915 int err;
17916
17917 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
17918 return -EINVAL;
17919
17920 internal_flags = nl80211_internal_flags[ops->internal_flags];
17921
17922 rtnl_lock();
17923 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
17924 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
17925 if (IS_ERR(rdev)) {
17926 err = PTR_ERR(rdev);
17927 goto out_unlock;
17928 }
17929 info->user_ptr[0] = rdev;
17930 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
17931 internal_flags & NL80211_FLAG_NEED_WDEV) {
17932 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
17933 info->attrs);
17934 if (IS_ERR(wdev)) {
17935 err = PTR_ERR(wdev);
17936 goto out_unlock;
17937 }
17938
17939 dev = wdev->netdev;
17940 dev_hold(dev);
17941 rdev = wiphy_to_rdev(wdev->wiphy);
17942
17943 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
17944 if (!dev) {
17945 err = -EINVAL;
17946 goto out_unlock;
17947 }
17948
17949 info->user_ptr[1] = dev;
17950 } else {
17951 info->user_ptr[1] = wdev;
17952 }
17953
17954 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
17955 !wdev_running(wdev)) {
17956 err = -ENETDOWN;
17957 goto out_unlock;
17958 }
17959
17960 info->user_ptr[0] = rdev;
17961 }
17962
17963 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
17964 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
17965
17966 if (!wdev) {
17967 err = -EINVAL;
17968 goto out_unlock;
17969 }
17970
17971 /* MLO -> require valid link ID */
17972 if (wdev->valid_links &&
17973 (!link_id ||
17974 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
17975 err = -EINVAL;
17976 goto out_unlock;
17977 }
17978
17979 /* non-MLO -> no link ID attribute accepted */
17980 if (!wdev->valid_links && link_id) {
17981 err = -EINVAL;
17982 goto out_unlock;
17983 }
17984 }
17985
17986 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
17987 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
17988 (wdev && wdev->valid_links)) {
17989 err = -EINVAL;
17990 goto out_unlock;
17991 }
17992 }
17993
17994 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
17995 wiphy_lock(&rdev->wiphy);
17996 /* we keep the mutex locked until post_doit */
17997 __release(&rdev->wiphy.mtx);
17998 }
17999 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
18000 rtnl_unlock();
18001
18002 return 0;
18003 out_unlock:
18004 rtnl_unlock();
18005 dev_put(dev);
18006 return err;
18007 }
18008
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)18009 static void nl80211_post_doit(const struct genl_split_ops *ops,
18010 struct sk_buff *skb,
18011 struct genl_info *info)
18012 {
18013 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
18014
18015 if (info->user_ptr[1]) {
18016 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
18017 struct wireless_dev *wdev = info->user_ptr[1];
18018
18019 dev_put(wdev->netdev);
18020 } else {
18021 dev_put(info->user_ptr[1]);
18022 }
18023 }
18024
18025 if (info->user_ptr[0] &&
18026 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
18027 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18028
18029 /* we kept the mutex locked since pre_doit */
18030 __acquire(&rdev->wiphy.mtx);
18031 wiphy_unlock(&rdev->wiphy);
18032 }
18033
18034 if (internal_flags & NL80211_FLAG_NEED_RTNL)
18035 rtnl_unlock();
18036
18037 /* If needed, clear the netlink message payload from the SKB
18038 * as it might contain key data that shouldn't stick around on
18039 * the heap after the SKB is freed. The netlink message header
18040 * is still needed for further processing, so leave it intact.
18041 */
18042 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
18043 struct nlmsghdr *nlh = nlmsg_hdr(skb);
18044
18045 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
18046 }
18047 }
18048
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)18049 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
18050 struct cfg80211_sar_specs *sar_specs,
18051 struct nlattr *spec[], int index)
18052 {
18053 u32 range_index, i;
18054
18055 if (!sar_specs || !spec)
18056 return -EINVAL;
18057
18058 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
18059 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
18060 return -EINVAL;
18061
18062 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
18063
18064 /* check if range_index exceeds num_freq_ranges */
18065 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
18066 return -EINVAL;
18067
18068 /* check if range_index duplicates */
18069 for (i = 0; i < index; i++) {
18070 if (sar_specs->sub_specs[i].freq_range_index == range_index)
18071 return -EINVAL;
18072 }
18073
18074 sar_specs->sub_specs[index].power =
18075 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
18076
18077 sar_specs->sub_specs[index].freq_range_index = range_index;
18078
18079 return 0;
18080 }
18081
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)18082 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
18083 {
18084 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18085 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
18086 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
18087 struct cfg80211_sar_specs *sar_spec;
18088 enum nl80211_sar_type type;
18089 struct nlattr *spec_list;
18090 u32 specs;
18091 int rem, err;
18092
18093 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
18094 return -EOPNOTSUPP;
18095
18096 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
18097 return -EINVAL;
18098
18099 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
18100 info->attrs[NL80211_ATTR_SAR_SPEC],
18101 NULL, NULL);
18102
18103 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
18104 return -EINVAL;
18105
18106 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
18107 if (type != rdev->wiphy.sar_capa->type)
18108 return -EINVAL;
18109
18110 specs = 0;
18111 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
18112 specs++;
18113
18114 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
18115 return -EINVAL;
18116
18117 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
18118 if (!sar_spec)
18119 return -ENOMEM;
18120
18121 sar_spec->num_sub_specs = specs;
18122 sar_spec->type = type;
18123 specs = 0;
18124 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
18125 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
18126 spec_list, NULL, NULL);
18127
18128 switch (type) {
18129 case NL80211_SAR_TYPE_POWER:
18130 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
18131 spec, specs)) {
18132 err = -EINVAL;
18133 goto error;
18134 }
18135 break;
18136 default:
18137 err = -EINVAL;
18138 goto error;
18139 }
18140 specs++;
18141 }
18142
18143 sar_spec->num_sub_specs = specs;
18144
18145 rdev->cur_cmd_info = info;
18146 err = rdev_set_sar_specs(rdev, sar_spec);
18147 rdev->cur_cmd_info = NULL;
18148 error:
18149 kfree(sar_spec);
18150 return err;
18151 }
18152
18153 #define SELECTOR(__sel, name, value) \
18154 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
18155 int __missing_selector(void);
18156 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
18157
18158 static const struct genl_ops nl80211_ops[] = {
18159 {
18160 .cmd = NL80211_CMD_GET_WIPHY,
18161 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18162 .doit = nl80211_get_wiphy,
18163 .dumpit = nl80211_dump_wiphy,
18164 .done = nl80211_dump_wiphy_done,
18165 /* can be retrieved by unprivileged users */
18166 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18167 },
18168 };
18169
18170 static const struct genl_small_ops nl80211_small_ops[] = {
18171 {
18172 .cmd = NL80211_CMD_SET_WIPHY,
18173 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18174 .doit = nl80211_set_wiphy,
18175 .flags = GENL_UNS_ADMIN_PERM,
18176 },
18177 {
18178 .cmd = NL80211_CMD_GET_INTERFACE,
18179 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18180 .doit = nl80211_get_interface,
18181 .dumpit = nl80211_dump_interface,
18182 /* can be retrieved by unprivileged users */
18183 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18184 },
18185 {
18186 .cmd = NL80211_CMD_SET_INTERFACE,
18187 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18188 .doit = nl80211_set_interface,
18189 .flags = GENL_UNS_ADMIN_PERM,
18190 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18191 NL80211_FLAG_NEED_RTNL),
18192 },
18193 {
18194 .cmd = NL80211_CMD_NEW_INTERFACE,
18195 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18196 .doit = nl80211_new_interface,
18197 .flags = GENL_UNS_ADMIN_PERM,
18198 .internal_flags =
18199 IFLAGS(NL80211_FLAG_NEED_WIPHY |
18200 NL80211_FLAG_NEED_RTNL |
18201 /* we take the wiphy mutex later ourselves */
18202 NL80211_FLAG_NO_WIPHY_MTX),
18203 },
18204 {
18205 .cmd = NL80211_CMD_DEL_INTERFACE,
18206 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18207 .doit = nl80211_del_interface,
18208 .flags = GENL_UNS_ADMIN_PERM,
18209 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18210 NL80211_FLAG_NEED_RTNL),
18211 },
18212 {
18213 .cmd = NL80211_CMD_GET_KEY,
18214 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18215 .doit = nl80211_get_key,
18216 .flags = GENL_UNS_ADMIN_PERM,
18217 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18218 },
18219 {
18220 .cmd = NL80211_CMD_SET_KEY,
18221 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18222 .doit = nl80211_set_key,
18223 .flags = GENL_UNS_ADMIN_PERM,
18224 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
18225 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18226 NL80211_FLAG_CLEAR_SKB),
18227 },
18228 {
18229 .cmd = NL80211_CMD_NEW_KEY,
18230 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18231 .doit = nl80211_new_key,
18232 .flags = GENL_UNS_ADMIN_PERM,
18233 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18234 NL80211_FLAG_CLEAR_SKB),
18235 },
18236 {
18237 .cmd = NL80211_CMD_DEL_KEY,
18238 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18239 .doit = nl80211_del_key,
18240 .flags = GENL_UNS_ADMIN_PERM,
18241 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18242 },
18243 {
18244 .cmd = NL80211_CMD_SET_BEACON,
18245 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18246 .flags = GENL_UNS_ADMIN_PERM,
18247 .doit = nl80211_set_beacon,
18248 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18249 NL80211_FLAG_MLO_VALID_LINK_ID),
18250 },
18251 {
18252 .cmd = NL80211_CMD_START_AP,
18253 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18254 .flags = GENL_UNS_ADMIN_PERM,
18255 .doit = nl80211_start_ap,
18256 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18257 NL80211_FLAG_MLO_VALID_LINK_ID),
18258 },
18259 {
18260 .cmd = NL80211_CMD_STOP_AP,
18261 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18262 .flags = GENL_UNS_ADMIN_PERM,
18263 .doit = nl80211_stop_ap,
18264 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18265 NL80211_FLAG_MLO_VALID_LINK_ID),
18266 },
18267 {
18268 .cmd = NL80211_CMD_GET_STATION,
18269 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18270 .doit = nl80211_get_station,
18271 .dumpit = nl80211_dump_station,
18272 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18273 },
18274 {
18275 .cmd = NL80211_CMD_SET_STATION,
18276 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18277 .doit = nl80211_set_station,
18278 .flags = GENL_UNS_ADMIN_PERM,
18279 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18280 },
18281 {
18282 .cmd = NL80211_CMD_NEW_STATION,
18283 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18284 .doit = nl80211_new_station,
18285 .flags = GENL_UNS_ADMIN_PERM,
18286 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18287 },
18288 {
18289 .cmd = NL80211_CMD_DEL_STATION,
18290 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18291 .doit = nl80211_del_station,
18292 .flags = GENL_UNS_ADMIN_PERM,
18293 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
18294 * whether MAC address is passed or not. If MAC address is
18295 * passed, then even during MLO, link ID is not required.
18296 */
18297 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18298 },
18299 {
18300 .cmd = NL80211_CMD_GET_MPATH,
18301 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18302 .doit = nl80211_get_mpath,
18303 .dumpit = nl80211_dump_mpath,
18304 .flags = GENL_UNS_ADMIN_PERM,
18305 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18306 },
18307 {
18308 .cmd = NL80211_CMD_GET_MPP,
18309 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18310 .doit = nl80211_get_mpp,
18311 .dumpit = nl80211_dump_mpp,
18312 .flags = GENL_UNS_ADMIN_PERM,
18313 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18314 },
18315 {
18316 .cmd = NL80211_CMD_SET_MPATH,
18317 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18318 .doit = nl80211_set_mpath,
18319 .flags = GENL_UNS_ADMIN_PERM,
18320 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18321 },
18322 {
18323 .cmd = NL80211_CMD_NEW_MPATH,
18324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18325 .doit = nl80211_new_mpath,
18326 .flags = GENL_UNS_ADMIN_PERM,
18327 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18328 },
18329 {
18330 .cmd = NL80211_CMD_DEL_MPATH,
18331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18332 .doit = nl80211_del_mpath,
18333 .flags = GENL_UNS_ADMIN_PERM,
18334 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18335 },
18336 {
18337 .cmd = NL80211_CMD_SET_BSS,
18338 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18339 .doit = nl80211_set_bss,
18340 .flags = GENL_UNS_ADMIN_PERM,
18341 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18342 NL80211_FLAG_MLO_VALID_LINK_ID),
18343 },
18344 {
18345 .cmd = NL80211_CMD_GET_REG,
18346 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18347 .doit = nl80211_get_reg_do,
18348 .dumpit = nl80211_get_reg_dump,
18349 /* can be retrieved by unprivileged users */
18350 },
18351 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
18352 {
18353 .cmd = NL80211_CMD_SET_REG,
18354 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18355 .doit = nl80211_set_reg,
18356 .flags = GENL_ADMIN_PERM,
18357 },
18358 #endif
18359 {
18360 .cmd = NL80211_CMD_REQ_SET_REG,
18361 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18362 .doit = nl80211_req_set_reg,
18363 .flags = GENL_ADMIN_PERM,
18364 },
18365 {
18366 .cmd = NL80211_CMD_RELOAD_REGDB,
18367 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18368 .doit = nl80211_reload_regdb,
18369 .flags = GENL_ADMIN_PERM,
18370 },
18371 {
18372 .cmd = NL80211_CMD_GET_MESH_CONFIG,
18373 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18374 .doit = nl80211_get_mesh_config,
18375 /* can be retrieved by unprivileged users */
18376 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18377 },
18378 {
18379 .cmd = NL80211_CMD_SET_MESH_CONFIG,
18380 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18381 .doit = nl80211_update_mesh_config,
18382 .flags = GENL_UNS_ADMIN_PERM,
18383 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18384 },
18385 {
18386 .cmd = NL80211_CMD_TRIGGER_SCAN,
18387 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18388 .doit = nl80211_trigger_scan,
18389 .flags = GENL_UNS_ADMIN_PERM,
18390 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18391 },
18392 {
18393 .cmd = NL80211_CMD_ABORT_SCAN,
18394 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18395 .doit = nl80211_abort_scan,
18396 .flags = GENL_UNS_ADMIN_PERM,
18397 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18398 },
18399 {
18400 .cmd = NL80211_CMD_GET_SCAN,
18401 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18402 .dumpit = nl80211_dump_scan,
18403 },
18404 {
18405 .cmd = NL80211_CMD_START_SCHED_SCAN,
18406 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18407 .doit = nl80211_start_sched_scan,
18408 .flags = GENL_UNS_ADMIN_PERM,
18409 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18410 },
18411 {
18412 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
18413 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18414 .doit = nl80211_stop_sched_scan,
18415 .flags = GENL_UNS_ADMIN_PERM,
18416 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18417 },
18418 {
18419 .cmd = NL80211_CMD_AUTHENTICATE,
18420 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18421 .doit = nl80211_authenticate,
18422 .flags = GENL_UNS_ADMIN_PERM,
18423 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18424 NL80211_FLAG_CLEAR_SKB),
18425 },
18426 {
18427 .cmd = NL80211_CMD_ASSOCIATE,
18428 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18429 .doit = nl80211_associate,
18430 .flags = GENL_UNS_ADMIN_PERM,
18431 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18432 NL80211_FLAG_CLEAR_SKB),
18433 },
18434 {
18435 .cmd = NL80211_CMD_DEAUTHENTICATE,
18436 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18437 .doit = nl80211_deauthenticate,
18438 .flags = GENL_UNS_ADMIN_PERM,
18439 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18440 },
18441 {
18442 .cmd = NL80211_CMD_DISASSOCIATE,
18443 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18444 .doit = nl80211_disassociate,
18445 .flags = GENL_UNS_ADMIN_PERM,
18446 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18447 },
18448 {
18449 .cmd = NL80211_CMD_JOIN_IBSS,
18450 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18451 .doit = nl80211_join_ibss,
18452 .flags = GENL_UNS_ADMIN_PERM,
18453 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18454 },
18455 {
18456 .cmd = NL80211_CMD_LEAVE_IBSS,
18457 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18458 .doit = nl80211_leave_ibss,
18459 .flags = GENL_UNS_ADMIN_PERM,
18460 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18461 },
18462 #ifdef CONFIG_NL80211_TESTMODE
18463 {
18464 .cmd = NL80211_CMD_TESTMODE,
18465 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18466 .doit = nl80211_testmode_do,
18467 .dumpit = nl80211_testmode_dump,
18468 .flags = GENL_UNS_ADMIN_PERM,
18469 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18470 },
18471 #endif
18472 {
18473 .cmd = NL80211_CMD_CONNECT,
18474 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18475 .doit = nl80211_connect,
18476 .flags = GENL_UNS_ADMIN_PERM,
18477 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18478 NL80211_FLAG_CLEAR_SKB),
18479 },
18480 {
18481 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
18482 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18483 .doit = nl80211_update_connect_params,
18484 .flags = GENL_ADMIN_PERM,
18485 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18486 NL80211_FLAG_CLEAR_SKB),
18487 },
18488 {
18489 .cmd = NL80211_CMD_DISCONNECT,
18490 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18491 .doit = nl80211_disconnect,
18492 .flags = GENL_UNS_ADMIN_PERM,
18493 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18494 },
18495 {
18496 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
18497 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18498 .doit = nl80211_wiphy_netns,
18499 .flags = GENL_UNS_ADMIN_PERM,
18500 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18501 NL80211_FLAG_NEED_RTNL |
18502 NL80211_FLAG_NO_WIPHY_MTX),
18503 },
18504 {
18505 .cmd = NL80211_CMD_GET_SURVEY,
18506 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18507 .dumpit = nl80211_dump_survey,
18508 },
18509 {
18510 .cmd = NL80211_CMD_SET_PMKSA,
18511 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18512 .doit = nl80211_set_pmksa,
18513 .flags = GENL_UNS_ADMIN_PERM,
18514 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18515 NL80211_FLAG_CLEAR_SKB),
18516 },
18517 {
18518 .cmd = NL80211_CMD_DEL_PMKSA,
18519 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18520 .doit = nl80211_del_pmksa,
18521 .flags = GENL_UNS_ADMIN_PERM,
18522 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18523 },
18524 {
18525 .cmd = NL80211_CMD_FLUSH_PMKSA,
18526 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18527 .doit = nl80211_flush_pmksa,
18528 .flags = GENL_UNS_ADMIN_PERM,
18529 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18530 },
18531 {
18532 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
18533 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18534 .doit = nl80211_remain_on_channel,
18535 .flags = GENL_UNS_ADMIN_PERM,
18536 /* FIXME: requiring a link ID here is probably not good */
18537 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18538 NL80211_FLAG_MLO_VALID_LINK_ID),
18539 },
18540 {
18541 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18542 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18543 .doit = nl80211_cancel_remain_on_channel,
18544 .flags = GENL_UNS_ADMIN_PERM,
18545 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18546 },
18547 {
18548 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
18549 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18550 .doit = nl80211_set_tx_bitrate_mask,
18551 .flags = GENL_UNS_ADMIN_PERM,
18552 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18553 NL80211_FLAG_MLO_VALID_LINK_ID),
18554 },
18555 {
18556 .cmd = NL80211_CMD_REGISTER_FRAME,
18557 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18558 .doit = nl80211_register_mgmt,
18559 .flags = GENL_UNS_ADMIN_PERM,
18560 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18561 },
18562 {
18563 .cmd = NL80211_CMD_FRAME,
18564 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18565 .doit = nl80211_tx_mgmt,
18566 .flags = GENL_UNS_ADMIN_PERM,
18567 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18568 },
18569 {
18570 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
18571 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18572 .doit = nl80211_tx_mgmt_cancel_wait,
18573 .flags = GENL_UNS_ADMIN_PERM,
18574 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18575 },
18576 {
18577 .cmd = NL80211_CMD_SET_POWER_SAVE,
18578 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18579 .doit = nl80211_set_power_save,
18580 .flags = GENL_UNS_ADMIN_PERM,
18581 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18582 },
18583 {
18584 .cmd = NL80211_CMD_GET_POWER_SAVE,
18585 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18586 .doit = nl80211_get_power_save,
18587 /* can be retrieved by unprivileged users */
18588 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18589 },
18590 {
18591 .cmd = NL80211_CMD_SET_CQM,
18592 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18593 .doit = nl80211_set_cqm,
18594 .flags = GENL_UNS_ADMIN_PERM,
18595 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18596 },
18597 {
18598 .cmd = NL80211_CMD_SET_CHANNEL,
18599 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18600 .doit = nl80211_set_channel,
18601 .flags = GENL_UNS_ADMIN_PERM,
18602 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18603 NL80211_FLAG_MLO_VALID_LINK_ID),
18604 },
18605 {
18606 .cmd = NL80211_CMD_JOIN_MESH,
18607 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18608 .doit = nl80211_join_mesh,
18609 .flags = GENL_UNS_ADMIN_PERM,
18610 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18611 },
18612 {
18613 .cmd = NL80211_CMD_LEAVE_MESH,
18614 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18615 .doit = nl80211_leave_mesh,
18616 .flags = GENL_UNS_ADMIN_PERM,
18617 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18618 },
18619 {
18620 .cmd = NL80211_CMD_JOIN_OCB,
18621 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18622 .doit = nl80211_join_ocb,
18623 .flags = GENL_UNS_ADMIN_PERM,
18624 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18625 },
18626 {
18627 .cmd = NL80211_CMD_LEAVE_OCB,
18628 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18629 .doit = nl80211_leave_ocb,
18630 .flags = GENL_UNS_ADMIN_PERM,
18631 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18632 },
18633 #ifdef CONFIG_PM
18634 {
18635 .cmd = NL80211_CMD_GET_WOWLAN,
18636 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18637 .doit = nl80211_get_wowlan,
18638 /* can be retrieved by unprivileged users */
18639 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18640 },
18641 {
18642 .cmd = NL80211_CMD_SET_WOWLAN,
18643 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18644 .doit = nl80211_set_wowlan,
18645 .flags = GENL_UNS_ADMIN_PERM,
18646 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18647 },
18648 #endif
18649 {
18650 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
18651 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18652 .doit = nl80211_set_rekey_data,
18653 .flags = GENL_UNS_ADMIN_PERM,
18654 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18655 NL80211_FLAG_CLEAR_SKB),
18656 },
18657 {
18658 .cmd = NL80211_CMD_TDLS_MGMT,
18659 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18660 .doit = nl80211_tdls_mgmt,
18661 .flags = GENL_UNS_ADMIN_PERM,
18662 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18663 NL80211_FLAG_MLO_VALID_LINK_ID),
18664 },
18665 {
18666 .cmd = NL80211_CMD_TDLS_OPER,
18667 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18668 .doit = nl80211_tdls_oper,
18669 .flags = GENL_UNS_ADMIN_PERM,
18670 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18671 },
18672 {
18673 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
18674 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18675 .doit = nl80211_register_unexpected_frame,
18676 .flags = GENL_UNS_ADMIN_PERM,
18677 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18678 },
18679 {
18680 .cmd = NL80211_CMD_PROBE_CLIENT,
18681 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18682 .doit = nl80211_probe_client,
18683 .flags = GENL_UNS_ADMIN_PERM,
18684 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18685 },
18686 {
18687 .cmd = NL80211_CMD_REGISTER_BEACONS,
18688 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18689 .doit = nl80211_register_beacons,
18690 .flags = GENL_UNS_ADMIN_PERM,
18691 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18692 },
18693 {
18694 .cmd = NL80211_CMD_SET_NOACK_MAP,
18695 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18696 .doit = nl80211_set_noack_map,
18697 .flags = GENL_UNS_ADMIN_PERM,
18698 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18699 },
18700 {
18701 .cmd = NL80211_CMD_START_P2P_DEVICE,
18702 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18703 .doit = nl80211_start_p2p_device,
18704 .flags = GENL_UNS_ADMIN_PERM,
18705 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18706 NL80211_FLAG_NEED_RTNL),
18707 },
18708 {
18709 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
18710 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18711 .doit = nl80211_stop_p2p_device,
18712 .flags = GENL_UNS_ADMIN_PERM,
18713 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18714 NL80211_FLAG_NEED_RTNL),
18715 },
18716 {
18717 .cmd = NL80211_CMD_START_NAN,
18718 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18719 .doit = nl80211_start_nan,
18720 .flags = GENL_ADMIN_PERM,
18721 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18722 NL80211_FLAG_NEED_RTNL),
18723 },
18724 {
18725 .cmd = NL80211_CMD_STOP_NAN,
18726 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18727 .doit = nl80211_stop_nan,
18728 .flags = GENL_ADMIN_PERM,
18729 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18730 NL80211_FLAG_NEED_RTNL),
18731 },
18732 {
18733 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
18734 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18735 .doit = nl80211_nan_add_func,
18736 .flags = GENL_ADMIN_PERM,
18737 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18738 },
18739 {
18740 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
18741 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18742 .doit = nl80211_nan_del_func,
18743 .flags = GENL_ADMIN_PERM,
18744 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18745 },
18746 {
18747 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
18748 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18749 .doit = nl80211_nan_change_config,
18750 .flags = GENL_ADMIN_PERM,
18751 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18752 },
18753 {
18754 .cmd = NL80211_CMD_SET_MCAST_RATE,
18755 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18756 .doit = nl80211_set_mcast_rate,
18757 .flags = GENL_UNS_ADMIN_PERM,
18758 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18759 },
18760 {
18761 .cmd = NL80211_CMD_SET_MAC_ACL,
18762 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18763 .doit = nl80211_set_mac_acl,
18764 .flags = GENL_UNS_ADMIN_PERM,
18765 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18766 NL80211_FLAG_MLO_UNSUPPORTED),
18767 },
18768 {
18769 .cmd = NL80211_CMD_RADAR_DETECT,
18770 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18771 .doit = nl80211_start_radar_detection,
18772 .flags = GENL_UNS_ADMIN_PERM,
18773 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18774 NL80211_FLAG_NO_WIPHY_MTX |
18775 NL80211_FLAG_MLO_VALID_LINK_ID),
18776 },
18777 {
18778 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
18779 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18780 .doit = nl80211_get_protocol_features,
18781 },
18782 {
18783 .cmd = NL80211_CMD_UPDATE_FT_IES,
18784 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18785 .doit = nl80211_update_ft_ies,
18786 .flags = GENL_UNS_ADMIN_PERM,
18787 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18788 },
18789 {
18790 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
18791 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18792 .doit = nl80211_crit_protocol_start,
18793 .flags = GENL_UNS_ADMIN_PERM,
18794 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18795 },
18796 {
18797 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
18798 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18799 .doit = nl80211_crit_protocol_stop,
18800 .flags = GENL_UNS_ADMIN_PERM,
18801 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18802 },
18803 {
18804 .cmd = NL80211_CMD_GET_COALESCE,
18805 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18806 .doit = nl80211_get_coalesce,
18807 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18808 },
18809 {
18810 .cmd = NL80211_CMD_SET_COALESCE,
18811 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18812 .doit = nl80211_set_coalesce,
18813 .flags = GENL_UNS_ADMIN_PERM,
18814 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18815 },
18816 {
18817 .cmd = NL80211_CMD_CHANNEL_SWITCH,
18818 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18819 .doit = nl80211_channel_switch,
18820 .flags = GENL_UNS_ADMIN_PERM,
18821 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18822 NL80211_FLAG_MLO_VALID_LINK_ID),
18823 },
18824 {
18825 .cmd = NL80211_CMD_VENDOR,
18826 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18827 .doit = nl80211_vendor_cmd,
18828 .dumpit = nl80211_vendor_cmd_dump,
18829 .flags = GENL_UNS_ADMIN_PERM,
18830 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18831 NL80211_FLAG_CLEAR_SKB),
18832 },
18833 {
18834 .cmd = NL80211_CMD_SET_QOS_MAP,
18835 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18836 .doit = nl80211_set_qos_map,
18837 .flags = GENL_UNS_ADMIN_PERM,
18838 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18839 },
18840 {
18841 .cmd = NL80211_CMD_ADD_TX_TS,
18842 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18843 .doit = nl80211_add_tx_ts,
18844 .flags = GENL_UNS_ADMIN_PERM,
18845 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18846 NL80211_FLAG_MLO_UNSUPPORTED),
18847 },
18848 {
18849 .cmd = NL80211_CMD_DEL_TX_TS,
18850 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18851 .doit = nl80211_del_tx_ts,
18852 .flags = GENL_UNS_ADMIN_PERM,
18853 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18854 },
18855 {
18856 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
18857 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18858 .doit = nl80211_tdls_channel_switch,
18859 .flags = GENL_UNS_ADMIN_PERM,
18860 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18861 },
18862 {
18863 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
18864 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18865 .doit = nl80211_tdls_cancel_channel_switch,
18866 .flags = GENL_UNS_ADMIN_PERM,
18867 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18868 },
18869 {
18870 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
18871 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18872 .doit = nl80211_set_multicast_to_unicast,
18873 .flags = GENL_UNS_ADMIN_PERM,
18874 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18875 },
18876 {
18877 .cmd = NL80211_CMD_SET_PMK,
18878 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18879 .doit = nl80211_set_pmk,
18880 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18881 NL80211_FLAG_CLEAR_SKB),
18882 },
18883 {
18884 .cmd = NL80211_CMD_DEL_PMK,
18885 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18886 .doit = nl80211_del_pmk,
18887 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18888 },
18889 {
18890 .cmd = NL80211_CMD_EXTERNAL_AUTH,
18891 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18892 .doit = nl80211_external_auth,
18893 .flags = GENL_ADMIN_PERM,
18894 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18895 },
18896 {
18897 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
18898 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18899 .doit = nl80211_tx_control_port,
18900 .flags = GENL_UNS_ADMIN_PERM,
18901 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18902 },
18903 {
18904 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
18905 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18906 .doit = nl80211_get_ftm_responder_stats,
18907 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18908 NL80211_FLAG_MLO_VALID_LINK_ID),
18909 },
18910 {
18911 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
18912 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18913 .doit = nl80211_pmsr_start,
18914 .flags = GENL_UNS_ADMIN_PERM,
18915 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18916 },
18917 {
18918 .cmd = NL80211_CMD_NOTIFY_RADAR,
18919 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18920 .doit = nl80211_notify_radar_detection,
18921 .flags = GENL_UNS_ADMIN_PERM,
18922 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18923 },
18924 {
18925 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
18926 .doit = nl80211_update_owe_info,
18927 .flags = GENL_ADMIN_PERM,
18928 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18929 },
18930 {
18931 .cmd = NL80211_CMD_PROBE_MESH_LINK,
18932 .doit = nl80211_probe_mesh_link,
18933 .flags = GENL_UNS_ADMIN_PERM,
18934 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18935 },
18936 {
18937 .cmd = NL80211_CMD_SET_TID_CONFIG,
18938 .doit = nl80211_set_tid_config,
18939 .flags = GENL_UNS_ADMIN_PERM,
18940 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18941 NL80211_FLAG_MLO_VALID_LINK_ID),
18942 },
18943 {
18944 .cmd = NL80211_CMD_SET_SAR_SPECS,
18945 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18946 .doit = nl80211_set_sar_specs,
18947 .flags = GENL_UNS_ADMIN_PERM,
18948 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18949 NL80211_FLAG_NEED_RTNL),
18950 },
18951 {
18952 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
18953 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18954 .doit = nl80211_color_change,
18955 .flags = GENL_UNS_ADMIN_PERM,
18956 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18957 NL80211_FLAG_MLO_VALID_LINK_ID),
18958 },
18959 {
18960 .cmd = NL80211_CMD_SET_FILS_AAD,
18961 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18962 .doit = nl80211_set_fils_aad,
18963 .flags = GENL_UNS_ADMIN_PERM,
18964 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18965 },
18966 {
18967 .cmd = NL80211_CMD_ADD_LINK,
18968 .doit = nl80211_add_link,
18969 .flags = GENL_UNS_ADMIN_PERM,
18970 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18971 },
18972 {
18973 .cmd = NL80211_CMD_REMOVE_LINK,
18974 .doit = nl80211_remove_link,
18975 .flags = GENL_UNS_ADMIN_PERM,
18976 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18977 NL80211_FLAG_MLO_VALID_LINK_ID),
18978 },
18979 {
18980 .cmd = NL80211_CMD_ADD_LINK_STA,
18981 .doit = nl80211_add_link_station,
18982 .flags = GENL_UNS_ADMIN_PERM,
18983 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18984 NL80211_FLAG_MLO_VALID_LINK_ID),
18985 },
18986 {
18987 .cmd = NL80211_CMD_MODIFY_LINK_STA,
18988 .doit = nl80211_modify_link_station,
18989 .flags = GENL_UNS_ADMIN_PERM,
18990 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18991 NL80211_FLAG_MLO_VALID_LINK_ID),
18992 },
18993 {
18994 .cmd = NL80211_CMD_REMOVE_LINK_STA,
18995 .doit = nl80211_remove_link_station,
18996 .flags = GENL_UNS_ADMIN_PERM,
18997 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18998 NL80211_FLAG_MLO_VALID_LINK_ID),
18999 },
19000 {
19001 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
19002 .doit = nl80211_set_hw_timestamp,
19003 .flags = GENL_UNS_ADMIN_PERM,
19004 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19005 },
19006 {
19007 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
19008 .doit = nl80211_set_ttlm,
19009 .flags = GENL_UNS_ADMIN_PERM,
19010 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19011 },
19012 {
19013 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19014 .doit = nl80211_assoc_ml_reconf,
19015 .flags = GENL_UNS_ADMIN_PERM,
19016 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19017 },
19018 {
19019 .cmd = NL80211_CMD_EPCS_CFG,
19020 .doit = nl80211_epcs_cfg,
19021 .flags = GENL_UNS_ADMIN_PERM,
19022 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19023 },
19024 };
19025
19026 static struct genl_family nl80211_fam __ro_after_init = {
19027 .name = NL80211_GENL_NAME, /* have users key off the name instead */
19028 .hdrsize = 0, /* no private header */
19029 .version = 1, /* no particular meaning now */
19030 .maxattr = NL80211_ATTR_MAX,
19031 .policy = nl80211_policy,
19032 .netnsok = true,
19033 .pre_doit = nl80211_pre_doit,
19034 .post_doit = nl80211_post_doit,
19035 .module = THIS_MODULE,
19036 .ops = nl80211_ops,
19037 .n_ops = ARRAY_SIZE(nl80211_ops),
19038 .small_ops = nl80211_small_ops,
19039 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
19040 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
19041 .mcgrps = nl80211_mcgrps,
19042 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
19043 .parallel_ops = true,
19044 };
19045
19046 /* notification functions */
19047
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)19048 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
19049 enum nl80211_commands cmd)
19050 {
19051 struct sk_buff *msg;
19052 struct nl80211_dump_wiphy_state state = {};
19053
19054 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
19055 cmd != NL80211_CMD_DEL_WIPHY);
19056
19057 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19058 if (!msg)
19059 return;
19060
19061 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
19062 nlmsg_free(msg);
19063 return;
19064 }
19065
19066 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19067 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19068 }
19069
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)19070 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
19071 struct wireless_dev *wdev,
19072 enum nl80211_commands cmd)
19073 {
19074 struct sk_buff *msg;
19075
19076 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19077 if (!msg)
19078 return;
19079
19080 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
19081 nlmsg_free(msg);
19082 return;
19083 }
19084
19085 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19086 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19087 }
19088
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)19089 static int nl80211_add_scan_req(struct sk_buff *msg,
19090 struct cfg80211_registered_device *rdev)
19091 {
19092 struct cfg80211_scan_request_int *req = rdev->scan_req;
19093 struct nlattr *nest;
19094 int i;
19095 struct cfg80211_scan_info *info;
19096
19097 if (WARN_ON(!req))
19098 return 0;
19099
19100 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
19101 if (!nest)
19102 goto nla_put_failure;
19103 for (i = 0; i < req->req.n_ssids; i++) {
19104 if (nla_put(msg, i, req->req.ssids[i].ssid_len,
19105 req->req.ssids[i].ssid))
19106 goto nla_put_failure;
19107 }
19108 nla_nest_end(msg, nest);
19109
19110 if (req->req.flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
19111 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
19112 if (!nest)
19113 goto nla_put_failure;
19114 for (i = 0; i < req->req.n_channels; i++) {
19115 if (nla_put_u32(msg, i,
19116 ieee80211_channel_to_khz(req->req.channels[i])))
19117 goto nla_put_failure;
19118 }
19119 nla_nest_end(msg, nest);
19120 } else {
19121 nest = nla_nest_start_noflag(msg,
19122 NL80211_ATTR_SCAN_FREQUENCIES);
19123 if (!nest)
19124 goto nla_put_failure;
19125 for (i = 0; i < req->req.n_channels; i++) {
19126 if (nla_put_u32(msg, i,
19127 req->req.channels[i]->center_freq))
19128 goto nla_put_failure;
19129 }
19130 nla_nest_end(msg, nest);
19131 }
19132
19133 if (req->req.ie &&
19134 nla_put(msg, NL80211_ATTR_IE, req->req.ie_len, req->req.ie))
19135 goto nla_put_failure;
19136
19137 if (req->req.flags &&
19138 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->req.flags))
19139 goto nla_put_failure;
19140
19141 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
19142 &rdev->scan_req->info;
19143 if (info->scan_start_tsf &&
19144 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
19145 info->scan_start_tsf, NL80211_BSS_PAD) ||
19146 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
19147 info->tsf_bssid)))
19148 goto nla_put_failure;
19149
19150 return 0;
19151 nla_put_failure:
19152 return -ENOBUFS;
19153 }
19154
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)19155 static int nl80211_prep_scan_msg(struct sk_buff *msg,
19156 struct cfg80211_registered_device *rdev,
19157 struct wireless_dev *wdev,
19158 u32 portid, u32 seq, int flags,
19159 u32 cmd)
19160 {
19161 void *hdr;
19162
19163 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
19164 if (!hdr)
19165 return -1;
19166
19167 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19168 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19169 wdev->netdev->ifindex)) ||
19170 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19171 NL80211_ATTR_PAD))
19172 goto nla_put_failure;
19173
19174 /* ignore errors and send incomplete event anyway */
19175 nl80211_add_scan_req(msg, rdev);
19176
19177 genlmsg_end(msg, hdr);
19178 return 0;
19179
19180 nla_put_failure:
19181 genlmsg_cancel(msg, hdr);
19182 return -EMSGSIZE;
19183 }
19184
19185 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)19186 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
19187 struct cfg80211_sched_scan_request *req, u32 cmd)
19188 {
19189 void *hdr;
19190
19191 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19192 if (!hdr)
19193 return -1;
19194
19195 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
19196 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
19197 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
19198 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
19199 NL80211_ATTR_PAD))
19200 goto nla_put_failure;
19201
19202 genlmsg_end(msg, hdr);
19203 return 0;
19204
19205 nla_put_failure:
19206 genlmsg_cancel(msg, hdr);
19207 return -EMSGSIZE;
19208 }
19209
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)19210 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
19211 struct wireless_dev *wdev)
19212 {
19213 struct sk_buff *msg;
19214
19215 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19216 if (!msg)
19217 return;
19218
19219 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19220 NL80211_CMD_TRIGGER_SCAN) < 0) {
19221 nlmsg_free(msg);
19222 return;
19223 }
19224
19225 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19226 NL80211_MCGRP_SCAN, GFP_KERNEL);
19227 }
19228
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)19229 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
19230 struct wireless_dev *wdev, bool aborted)
19231 {
19232 struct sk_buff *msg;
19233
19234 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19235 if (!msg)
19236 return NULL;
19237
19238 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19239 aborted ? NL80211_CMD_SCAN_ABORTED :
19240 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
19241 nlmsg_free(msg);
19242 return NULL;
19243 }
19244
19245 return msg;
19246 }
19247
19248 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)19249 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
19250 struct sk_buff *msg)
19251 {
19252 if (!msg)
19253 return;
19254
19255 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19256 NL80211_MCGRP_SCAN, GFP_KERNEL);
19257 }
19258
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)19259 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
19260 {
19261 struct sk_buff *msg;
19262
19263 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19264 if (!msg)
19265 return;
19266
19267 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
19268 nlmsg_free(msg);
19269 return;
19270 }
19271
19272 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
19273 NL80211_MCGRP_SCAN, GFP_KERNEL);
19274 }
19275
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)19276 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
19277 struct regulatory_request *request)
19278 {
19279 /* Userspace can always count this one always being set */
19280 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
19281 goto nla_put_failure;
19282
19283 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
19284 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19285 NL80211_REGDOM_TYPE_WORLD))
19286 goto nla_put_failure;
19287 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
19288 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19289 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
19290 goto nla_put_failure;
19291 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
19292 request->intersect) {
19293 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19294 NL80211_REGDOM_TYPE_INTERSECTION))
19295 goto nla_put_failure;
19296 } else {
19297 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19298 NL80211_REGDOM_TYPE_COUNTRY) ||
19299 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
19300 request->alpha2))
19301 goto nla_put_failure;
19302 }
19303
19304 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
19305 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
19306
19307 if (wiphy &&
19308 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
19309 goto nla_put_failure;
19310
19311 if (wiphy &&
19312 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
19313 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
19314 goto nla_put_failure;
19315 }
19316
19317 return true;
19318
19319 nla_put_failure:
19320 return false;
19321 }
19322
19323 /*
19324 * This can happen on global regulatory changes or device specific settings
19325 * based on custom regulatory domains.
19326 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)19327 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
19328 struct regulatory_request *request)
19329 {
19330 struct sk_buff *msg;
19331 void *hdr;
19332
19333 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19334 if (!msg)
19335 return;
19336
19337 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
19338 if (!hdr)
19339 goto nla_put_failure;
19340
19341 if (!nl80211_reg_change_event_fill(msg, request))
19342 goto nla_put_failure;
19343
19344 genlmsg_end(msg, hdr);
19345
19346 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
19347 NL80211_MCGRP_REGULATORY);
19348
19349 return;
19350
19351 nla_put_failure:
19352 nlmsg_free(msg);
19353 }
19354
19355 struct nl80211_mlme_event {
19356 enum nl80211_commands cmd;
19357 const u8 *buf;
19358 size_t buf_len;
19359 int uapsd_queues;
19360 const u8 *req_ies;
19361 size_t req_ies_len;
19362 bool reconnect;
19363 };
19364
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct nl80211_mlme_event * event,gfp_t gfp)19365 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
19366 struct net_device *netdev,
19367 const struct nl80211_mlme_event *event,
19368 gfp_t gfp)
19369 {
19370 struct sk_buff *msg;
19371 void *hdr;
19372
19373 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
19374 if (!msg)
19375 return;
19376
19377 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
19378 if (!hdr) {
19379 nlmsg_free(msg);
19380 return;
19381 }
19382
19383 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19384 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19385 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
19386 (event->req_ies &&
19387 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
19388 event->req_ies)))
19389 goto nla_put_failure;
19390
19391 if (event->reconnect &&
19392 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
19393 goto nla_put_failure;
19394
19395 if (event->uapsd_queues >= 0) {
19396 struct nlattr *nla_wmm =
19397 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
19398 if (!nla_wmm)
19399 goto nla_put_failure;
19400
19401 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
19402 event->uapsd_queues))
19403 goto nla_put_failure;
19404
19405 nla_nest_end(msg, nla_wmm);
19406 }
19407
19408 genlmsg_end(msg, hdr);
19409
19410 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19411 NL80211_MCGRP_MLME, gfp);
19412 return;
19413
19414 nla_put_failure:
19415 nlmsg_free(msg);
19416 }
19417
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)19418 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
19419 struct net_device *netdev, const u8 *buf,
19420 size_t len, gfp_t gfp)
19421 {
19422 struct nl80211_mlme_event event = {
19423 .cmd = NL80211_CMD_AUTHENTICATE,
19424 .buf = buf,
19425 .buf_len = len,
19426 .uapsd_queues = -1,
19427 };
19428
19429 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19430 }
19431
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct cfg80211_rx_assoc_resp_data * data)19432 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
19433 struct net_device *netdev,
19434 const struct cfg80211_rx_assoc_resp_data *data)
19435 {
19436 struct nl80211_mlme_event event = {
19437 .cmd = NL80211_CMD_ASSOCIATE,
19438 .buf = data->buf,
19439 .buf_len = data->len,
19440 .uapsd_queues = data->uapsd_queues,
19441 .req_ies = data->req_ies,
19442 .req_ies_len = data->req_ies_len,
19443 };
19444
19445 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
19446 }
19447
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19448 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
19449 struct net_device *netdev, const u8 *buf,
19450 size_t len, bool reconnect, gfp_t gfp)
19451 {
19452 struct nl80211_mlme_event event = {
19453 .cmd = NL80211_CMD_DEAUTHENTICATE,
19454 .buf = buf,
19455 .buf_len = len,
19456 .reconnect = reconnect,
19457 .uapsd_queues = -1,
19458 };
19459
19460 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19461 }
19462
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19463 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
19464 struct net_device *netdev, const u8 *buf,
19465 size_t len, bool reconnect, gfp_t gfp)
19466 {
19467 struct nl80211_mlme_event event = {
19468 .cmd = NL80211_CMD_DISASSOCIATE,
19469 .buf = buf,
19470 .buf_len = len,
19471 .reconnect = reconnect,
19472 .uapsd_queues = -1,
19473 };
19474
19475 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19476 }
19477
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)19478 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
19479 size_t len)
19480 {
19481 struct wireless_dev *wdev = dev->ieee80211_ptr;
19482 struct wiphy *wiphy = wdev->wiphy;
19483 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19484 const struct ieee80211_mgmt *mgmt = (void *)buf;
19485 struct nl80211_mlme_event event = {
19486 .buf = buf,
19487 .buf_len = len,
19488 .uapsd_queues = -1,
19489 };
19490
19491 if (WARN_ON(len < 2))
19492 return;
19493
19494 if (ieee80211_is_deauth(mgmt->frame_control)) {
19495 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
19496 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
19497 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
19498 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
19499 if (wdev->unprot_beacon_reported &&
19500 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
19501 return;
19502 event.cmd = NL80211_CMD_UNPROT_BEACON;
19503 wdev->unprot_beacon_reported = jiffies;
19504 } else {
19505 return;
19506 }
19507
19508 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
19509 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
19510 }
19511 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
19512
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)19513 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
19514 struct net_device *netdev, int cmd,
19515 const u8 *addr, gfp_t gfp)
19516 {
19517 struct sk_buff *msg;
19518 void *hdr;
19519
19520 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19521 if (!msg)
19522 return;
19523
19524 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19525 if (!hdr) {
19526 nlmsg_free(msg);
19527 return;
19528 }
19529
19530 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19531 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19532 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19533 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19534 goto nla_put_failure;
19535
19536 genlmsg_end(msg, hdr);
19537
19538 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19539 NL80211_MCGRP_MLME, gfp);
19540 return;
19541
19542 nla_put_failure:
19543 nlmsg_free(msg);
19544 }
19545
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19546 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
19547 struct net_device *netdev, const u8 *addr,
19548 gfp_t gfp)
19549 {
19550 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
19551 addr, gfp);
19552 }
19553
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19554 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
19555 struct net_device *netdev, const u8 *addr,
19556 gfp_t gfp)
19557 {
19558 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
19559 addr, gfp);
19560 }
19561
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)19562 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
19563 struct net_device *netdev,
19564 struct cfg80211_connect_resp_params *cr,
19565 gfp_t gfp)
19566 {
19567 struct sk_buff *msg;
19568 void *hdr;
19569 unsigned int link;
19570 size_t link_info_size = 0;
19571 const u8 *connected_addr = cr->valid_links ?
19572 cr->ap_mld_addr : cr->links[0].bssid;
19573
19574 if (cr->valid_links) {
19575 for_each_valid_link(cr, link) {
19576 /* Nested attribute header */
19577 link_info_size += NLA_HDRLEN;
19578 /* Link ID */
19579 link_info_size += nla_total_size(sizeof(u8));
19580 link_info_size += cr->links[link].addr ?
19581 nla_total_size(ETH_ALEN) : 0;
19582 link_info_size += (cr->links[link].bssid ||
19583 cr->links[link].bss) ?
19584 nla_total_size(ETH_ALEN) : 0;
19585 link_info_size += nla_total_size(sizeof(u16));
19586 }
19587 }
19588
19589 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
19590 cr->fils.kek_len + cr->fils.pmk_len +
19591 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
19592 gfp);
19593 if (!msg)
19594 return;
19595
19596 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
19597 if (!hdr) {
19598 nlmsg_free(msg);
19599 return;
19600 }
19601
19602 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19603 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19604 (connected_addr &&
19605 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
19606 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19607 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
19608 cr->status) ||
19609 (cr->status < 0 &&
19610 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19611 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
19612 cr->timeout_reason))) ||
19613 (cr->req_ie &&
19614 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
19615 (cr->resp_ie &&
19616 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
19617 cr->resp_ie)) ||
19618 (cr->fils.update_erp_next_seq_num &&
19619 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19620 cr->fils.erp_next_seq_num)) ||
19621 (cr->status == WLAN_STATUS_SUCCESS &&
19622 ((cr->fils.kek &&
19623 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
19624 cr->fils.kek)) ||
19625 (cr->fils.pmk &&
19626 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
19627 (cr->fils.pmkid &&
19628 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
19629 goto nla_put_failure;
19630
19631 if (cr->valid_links) {
19632 int i = 1;
19633 struct nlattr *nested;
19634
19635 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19636 if (!nested)
19637 goto nla_put_failure;
19638
19639 for_each_valid_link(cr, link) {
19640 struct nlattr *nested_mlo_links;
19641 const u8 *bssid = cr->links[link].bss ?
19642 cr->links[link].bss->bssid :
19643 cr->links[link].bssid;
19644
19645 nested_mlo_links = nla_nest_start(msg, i);
19646 if (!nested_mlo_links)
19647 goto nla_put_failure;
19648
19649 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19650 (bssid &&
19651 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19652 (cr->links[link].addr &&
19653 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19654 cr->links[link].addr)) ||
19655 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19656 cr->links[link].status))
19657 goto nla_put_failure;
19658
19659 nla_nest_end(msg, nested_mlo_links);
19660 i++;
19661 }
19662 nla_nest_end(msg, nested);
19663 }
19664
19665 genlmsg_end(msg, hdr);
19666
19667 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19668 NL80211_MCGRP_MLME, gfp);
19669 return;
19670
19671 nla_put_failure:
19672 nlmsg_free(msg);
19673 }
19674
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)19675 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
19676 struct net_device *netdev,
19677 struct cfg80211_roam_info *info, gfp_t gfp)
19678 {
19679 struct sk_buff *msg;
19680 void *hdr;
19681 size_t link_info_size = 0;
19682 unsigned int link;
19683 const u8 *connected_addr = info->ap_mld_addr ?
19684 info->ap_mld_addr :
19685 (info->links[0].bss ?
19686 info->links[0].bss->bssid :
19687 info->links[0].bssid);
19688
19689 if (info->valid_links) {
19690 for_each_valid_link(info, link) {
19691 /* Nested attribute header */
19692 link_info_size += NLA_HDRLEN;
19693 /* Link ID */
19694 link_info_size += nla_total_size(sizeof(u8));
19695 link_info_size += info->links[link].addr ?
19696 nla_total_size(ETH_ALEN) : 0;
19697 link_info_size += (info->links[link].bssid ||
19698 info->links[link].bss) ?
19699 nla_total_size(ETH_ALEN) : 0;
19700 }
19701 }
19702
19703 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
19704 info->fils.kek_len + info->fils.pmk_len +
19705 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
19706 link_info_size, gfp);
19707 if (!msg)
19708 return;
19709
19710 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
19711 if (!hdr) {
19712 nlmsg_free(msg);
19713 return;
19714 }
19715
19716 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19717 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19718 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
19719 (info->req_ie &&
19720 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
19721 info->req_ie)) ||
19722 (info->resp_ie &&
19723 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
19724 info->resp_ie)) ||
19725 (info->fils.update_erp_next_seq_num &&
19726 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19727 info->fils.erp_next_seq_num)) ||
19728 (info->fils.kek &&
19729 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
19730 info->fils.kek)) ||
19731 (info->fils.pmk &&
19732 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
19733 (info->fils.pmkid &&
19734 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
19735 goto nla_put_failure;
19736
19737 if (info->valid_links) {
19738 int i = 1;
19739 struct nlattr *nested;
19740
19741 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19742 if (!nested)
19743 goto nla_put_failure;
19744
19745 for_each_valid_link(info, link) {
19746 struct nlattr *nested_mlo_links;
19747 const u8 *bssid = info->links[link].bss ?
19748 info->links[link].bss->bssid :
19749 info->links[link].bssid;
19750
19751 nested_mlo_links = nla_nest_start(msg, i);
19752 if (!nested_mlo_links)
19753 goto nla_put_failure;
19754
19755 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19756 (bssid &&
19757 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19758 (info->links[link].addr &&
19759 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19760 info->links[link].addr)))
19761 goto nla_put_failure;
19762
19763 nla_nest_end(msg, nested_mlo_links);
19764 i++;
19765 }
19766 nla_nest_end(msg, nested);
19767 }
19768
19769 genlmsg_end(msg, hdr);
19770
19771 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19772 NL80211_MCGRP_MLME, gfp);
19773 return;
19774
19775 nla_put_failure:
19776 nlmsg_free(msg);
19777 }
19778
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * peer_addr,const u8 * td_bitmap,u8 td_bitmap_len)19779 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
19780 struct net_device *netdev, const u8 *peer_addr,
19781 const u8 *td_bitmap, u8 td_bitmap_len)
19782 {
19783 struct sk_buff *msg;
19784 void *hdr;
19785
19786 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19787 if (!msg)
19788 return;
19789
19790 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
19791 if (!hdr) {
19792 nlmsg_free(msg);
19793 return;
19794 }
19795
19796 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19797 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19798 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
19799 goto nla_put_failure;
19800
19801 if (td_bitmap_len > 0 && td_bitmap &&
19802 nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
19803 goto nla_put_failure;
19804
19805 genlmsg_end(msg, hdr);
19806
19807 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19808 NL80211_MCGRP_MLME, GFP_KERNEL);
19809 return;
19810
19811 nla_put_failure:
19812 nlmsg_free(msg);
19813 }
19814
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)19815 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
19816 struct net_device *netdev, u16 reason,
19817 const u8 *ie, size_t ie_len, bool from_ap)
19818 {
19819 struct sk_buff *msg;
19820 void *hdr;
19821
19822 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
19823 if (!msg)
19824 return;
19825
19826 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
19827 if (!hdr) {
19828 nlmsg_free(msg);
19829 return;
19830 }
19831
19832 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19833 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19834 (reason &&
19835 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
19836 (from_ap &&
19837 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
19838 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
19839 goto nla_put_failure;
19840
19841 genlmsg_end(msg, hdr);
19842
19843 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19844 NL80211_MCGRP_MLME, GFP_KERNEL);
19845 return;
19846
19847 nla_put_failure:
19848 nlmsg_free(msg);
19849 }
19850
cfg80211_links_removed(struct net_device * dev,u16 link_mask)19851 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
19852 {
19853 struct wireless_dev *wdev = dev->ieee80211_ptr;
19854 struct wiphy *wiphy = wdev->wiphy;
19855 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19856 struct sk_buff *msg;
19857 struct nlattr *links;
19858 void *hdr;
19859
19860 lockdep_assert_wiphy(wdev->wiphy);
19861 trace_cfg80211_links_removed(dev, link_mask);
19862
19863 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
19864 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
19865 return;
19866
19867 if (WARN_ON(!wdev->valid_links || !link_mask ||
19868 (wdev->valid_links & link_mask) != link_mask ||
19869 wdev->valid_links == link_mask))
19870 return;
19871
19872 cfg80211_wdev_release_link_bsses(wdev, link_mask);
19873 wdev->valid_links &= ~link_mask;
19874
19875 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19876 if (!msg)
19877 return;
19878
19879 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
19880 if (!hdr) {
19881 nlmsg_free(msg);
19882 return;
19883 }
19884
19885 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19886 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19887 goto nla_put_failure;
19888
19889 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19890 if (!links)
19891 goto nla_put_failure;
19892
19893 while (link_mask) {
19894 struct nlattr *link;
19895 int link_id = __ffs(link_mask);
19896
19897 link = nla_nest_start(msg, link_id + 1);
19898 if (!link)
19899 goto nla_put_failure;
19900
19901 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19902 goto nla_put_failure;
19903
19904 nla_nest_end(msg, link);
19905 link_mask &= ~(1 << link_id);
19906 }
19907
19908 nla_nest_end(msg, links);
19909
19910 genlmsg_end(msg, hdr);
19911
19912 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19913 NL80211_MCGRP_MLME, GFP_KERNEL);
19914 return;
19915
19916 nla_put_failure:
19917 nlmsg_free(msg);
19918 }
19919 EXPORT_SYMBOL(cfg80211_links_removed);
19920
nl80211_mlo_reconf_add_done(struct net_device * dev,struct cfg80211_mlo_reconf_done_data * data)19921 void nl80211_mlo_reconf_add_done(struct net_device *dev,
19922 struct cfg80211_mlo_reconf_done_data *data)
19923 {
19924 struct wireless_dev *wdev = dev->ieee80211_ptr;
19925 struct wiphy *wiphy = wdev->wiphy;
19926 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19927 struct nl80211_mlme_event event = {
19928 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19929 .buf = data->buf,
19930 .buf_len = data->len,
19931 .uapsd_queues = -1,
19932 };
19933
19934 nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
19935 }
19936 EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
19937
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)19938 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
19939 struct net_device *netdev, const u8 *bssid,
19940 gfp_t gfp)
19941 {
19942 struct sk_buff *msg;
19943 void *hdr;
19944
19945 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19946 if (!msg)
19947 return;
19948
19949 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
19950 if (!hdr) {
19951 nlmsg_free(msg);
19952 return;
19953 }
19954
19955 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19956 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19957 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19958 goto nla_put_failure;
19959
19960 genlmsg_end(msg, hdr);
19961
19962 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19963 NL80211_MCGRP_MLME, gfp);
19964 return;
19965
19966 nla_put_failure:
19967 nlmsg_free(msg);
19968 }
19969
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)19970 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
19971 const u8 *ie, u8 ie_len,
19972 int sig_dbm, gfp_t gfp)
19973 {
19974 struct wireless_dev *wdev = dev->ieee80211_ptr;
19975 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19976 struct sk_buff *msg;
19977 void *hdr;
19978
19979 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
19980 return;
19981
19982 trace_cfg80211_notify_new_peer_candidate(dev, addr);
19983
19984 msg = nlmsg_new(100 + ie_len, gfp);
19985 if (!msg)
19986 return;
19987
19988 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
19989 if (!hdr) {
19990 nlmsg_free(msg);
19991 return;
19992 }
19993
19994 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19995 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19996 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19997 (ie_len && ie &&
19998 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
19999 (sig_dbm &&
20000 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
20001 goto nla_put_failure;
20002
20003 genlmsg_end(msg, hdr);
20004
20005 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20006 NL80211_MCGRP_MLME, gfp);
20007 return;
20008
20009 nla_put_failure:
20010 nlmsg_free(msg);
20011 }
20012 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
20013
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)20014 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
20015 struct net_device *netdev, const u8 *addr,
20016 enum nl80211_key_type key_type, int key_id,
20017 const u8 *tsc, gfp_t gfp)
20018 {
20019 struct sk_buff *msg;
20020 void *hdr;
20021
20022 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20023 if (!msg)
20024 return;
20025
20026 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
20027 if (!hdr) {
20028 nlmsg_free(msg);
20029 return;
20030 }
20031
20032 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20033 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20034 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
20035 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
20036 (key_id != -1 &&
20037 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
20038 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
20039 goto nla_put_failure;
20040
20041 genlmsg_end(msg, hdr);
20042
20043 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20044 NL80211_MCGRP_MLME, gfp);
20045 return;
20046
20047 nla_put_failure:
20048 nlmsg_free(msg);
20049 }
20050
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)20051 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
20052 struct ieee80211_channel *channel_before,
20053 struct ieee80211_channel *channel_after)
20054 {
20055 struct sk_buff *msg;
20056 void *hdr;
20057 struct nlattr *nl_freq;
20058
20059 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
20060 if (!msg)
20061 return;
20062
20063 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
20064 if (!hdr) {
20065 nlmsg_free(msg);
20066 return;
20067 }
20068
20069 /*
20070 * Since we are applying the beacon hint to a wiphy we know its
20071 * wiphy_idx is valid
20072 */
20073 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
20074 goto nla_put_failure;
20075
20076 /* Before */
20077 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
20078 if (!nl_freq)
20079 goto nla_put_failure;
20080
20081 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
20082 goto nla_put_failure;
20083 nla_nest_end(msg, nl_freq);
20084
20085 /* After */
20086 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
20087 if (!nl_freq)
20088 goto nla_put_failure;
20089
20090 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
20091 goto nla_put_failure;
20092 nla_nest_end(msg, nl_freq);
20093
20094 genlmsg_end(msg, hdr);
20095
20096 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
20097 NL80211_MCGRP_REGULATORY);
20098
20099 return;
20100
20101 nla_put_failure:
20102 nlmsg_free(msg);
20103 }
20104
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20105 static void nl80211_send_remain_on_chan_event(
20106 int cmd, struct cfg80211_registered_device *rdev,
20107 struct wireless_dev *wdev, u64 cookie,
20108 struct ieee80211_channel *chan,
20109 unsigned int duration, gfp_t gfp)
20110 {
20111 struct sk_buff *msg;
20112 void *hdr;
20113
20114 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20115 if (!msg)
20116 return;
20117
20118 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20119 if (!hdr) {
20120 nlmsg_free(msg);
20121 return;
20122 }
20123
20124 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20125 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20126 wdev->netdev->ifindex)) ||
20127 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20128 NL80211_ATTR_PAD) ||
20129 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
20130 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
20131 NL80211_CHAN_NO_HT) ||
20132 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
20133 NL80211_ATTR_PAD))
20134 goto nla_put_failure;
20135
20136 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
20137 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
20138 goto nla_put_failure;
20139
20140 genlmsg_end(msg, hdr);
20141
20142 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20143 NL80211_MCGRP_MLME, gfp);
20144 return;
20145
20146 nla_put_failure:
20147 nlmsg_free(msg);
20148 }
20149
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)20150 void cfg80211_assoc_comeback(struct net_device *netdev,
20151 const u8 *ap_addr, u32 timeout)
20152 {
20153 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20154 struct wiphy *wiphy = wdev->wiphy;
20155 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20156 struct sk_buff *msg;
20157 void *hdr;
20158
20159 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
20160
20161 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20162 if (!msg)
20163 return;
20164
20165 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
20166 if (!hdr) {
20167 nlmsg_free(msg);
20168 return;
20169 }
20170
20171 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20172 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20173 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
20174 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
20175 goto nla_put_failure;
20176
20177 genlmsg_end(msg, hdr);
20178
20179 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20180 NL80211_MCGRP_MLME, GFP_KERNEL);
20181 return;
20182
20183 nla_put_failure:
20184 nlmsg_free(msg);
20185 }
20186 EXPORT_SYMBOL(cfg80211_assoc_comeback);
20187
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20188 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
20189 struct ieee80211_channel *chan,
20190 unsigned int duration, gfp_t gfp)
20191 {
20192 struct wiphy *wiphy = wdev->wiphy;
20193 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20194
20195 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
20196 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
20197 rdev, wdev, cookie, chan,
20198 duration, gfp);
20199 }
20200 EXPORT_SYMBOL(cfg80211_ready_on_channel);
20201
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20202 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
20203 struct ieee80211_channel *chan,
20204 gfp_t gfp)
20205 {
20206 struct wiphy *wiphy = wdev->wiphy;
20207 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20208
20209 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
20210 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
20211 rdev, wdev, cookie, chan, 0, gfp);
20212 }
20213 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
20214
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20215 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
20216 struct ieee80211_channel *chan,
20217 gfp_t gfp)
20218 {
20219 struct wiphy *wiphy = wdev->wiphy;
20220 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20221
20222 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
20223 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
20224 rdev, wdev, cookie, chan, 0, gfp);
20225 }
20226 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
20227
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20228 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
20229 struct station_info *sinfo, gfp_t gfp)
20230 {
20231 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20232 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20233 struct sk_buff *msg;
20234
20235 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
20236
20237 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20238 if (!msg)
20239 return;
20240
20241 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
20242 rdev, dev, mac_addr, sinfo, false) < 0) {
20243 nlmsg_free(msg);
20244 return;
20245 }
20246
20247 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20248 NL80211_MCGRP_MLME, gfp);
20249 }
20250 EXPORT_SYMBOL(cfg80211_new_sta);
20251
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20252 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
20253 struct station_info *sinfo, gfp_t gfp)
20254 {
20255 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20256 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20257 struct sk_buff *msg;
20258 struct station_info empty_sinfo = {};
20259
20260 if (!sinfo)
20261 sinfo = &empty_sinfo;
20262
20263 trace_cfg80211_del_sta(dev, mac_addr);
20264
20265 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20266 if (!msg) {
20267 cfg80211_sinfo_release_content(sinfo);
20268 return;
20269 }
20270
20271 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
20272 rdev, dev, mac_addr, sinfo, false) < 0) {
20273 nlmsg_free(msg);
20274 return;
20275 }
20276
20277 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20278 NL80211_MCGRP_MLME, gfp);
20279 }
20280 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
20281
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)20282 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
20283 enum nl80211_connect_failed_reason reason,
20284 gfp_t gfp)
20285 {
20286 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20287 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20288 struct sk_buff *msg;
20289 void *hdr;
20290
20291 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
20292 if (!msg)
20293 return;
20294
20295 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
20296 if (!hdr) {
20297 nlmsg_free(msg);
20298 return;
20299 }
20300
20301 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20302 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
20303 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
20304 goto nla_put_failure;
20305
20306 genlmsg_end(msg, hdr);
20307
20308 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20309 NL80211_MCGRP_MLME, gfp);
20310 return;
20311
20312 nla_put_failure:
20313 nlmsg_free(msg);
20314 }
20315 EXPORT_SYMBOL(cfg80211_conn_failed);
20316
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,int link_id,gfp_t gfp)20317 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
20318 const u8 *addr, int link_id, gfp_t gfp)
20319 {
20320 struct wireless_dev *wdev = dev->ieee80211_ptr;
20321 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20322 struct sk_buff *msg;
20323 void *hdr;
20324 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
20325
20326 if (!nlportid)
20327 return false;
20328
20329 msg = nlmsg_new(100, gfp);
20330 if (!msg)
20331 return true;
20332
20333 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20334 if (!hdr) {
20335 nlmsg_free(msg);
20336 return true;
20337 }
20338
20339 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20340 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20341 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20342 (link_id >= 0 &&
20343 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20344 goto nla_put_failure;
20345
20346 genlmsg_end(msg, hdr);
20347 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20348 return true;
20349
20350 nla_put_failure:
20351 nlmsg_free(msg);
20352 return true;
20353 }
20354
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20355 bool cfg80211_rx_spurious_frame(struct net_device *dev, const u8 *addr,
20356 int link_id, gfp_t gfp)
20357 {
20358 struct wireless_dev *wdev = dev->ieee80211_ptr;
20359 bool ret;
20360
20361 trace_cfg80211_rx_spurious_frame(dev, addr, link_id);
20362
20363 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20364 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
20365 trace_cfg80211_return_bool(false);
20366 return false;
20367 }
20368 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
20369 addr, link_id, gfp);
20370 trace_cfg80211_return_bool(ret);
20371 return ret;
20372 }
20373 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
20374
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20375 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, const u8 *addr,
20376 int link_id, gfp_t gfp)
20377 {
20378 struct wireless_dev *wdev = dev->ieee80211_ptr;
20379 bool ret;
20380
20381 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr, link_id);
20382
20383 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20384 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
20385 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
20386 trace_cfg80211_return_bool(false);
20387 return false;
20388 }
20389 ret = __nl80211_unexpected_frame(dev,
20390 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
20391 addr, link_id, gfp);
20392 trace_cfg80211_return_bool(ret);
20393 return ret;
20394 }
20395 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
20396
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)20397 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
20398 struct wireless_dev *wdev, u32 nlportid,
20399 struct cfg80211_rx_info *info, gfp_t gfp)
20400 {
20401 struct net_device *netdev = wdev->netdev;
20402 struct sk_buff *msg;
20403 void *hdr;
20404
20405 msg = nlmsg_new(100 + info->len, gfp);
20406 if (!msg)
20407 return -ENOMEM;
20408
20409 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20410 if (!hdr) {
20411 nlmsg_free(msg);
20412 return -ENOMEM;
20413 }
20414
20415 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20416 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20417 netdev->ifindex)) ||
20418 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20419 NL80211_ATTR_PAD) ||
20420 (info->have_link_id &&
20421 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
20422 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
20423 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
20424 (info->sig_dbm &&
20425 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
20426 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
20427 (info->flags &&
20428 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
20429 (info->rx_tstamp && nla_put_u64_64bit(msg,
20430 NL80211_ATTR_RX_HW_TIMESTAMP,
20431 info->rx_tstamp,
20432 NL80211_ATTR_PAD)) ||
20433 (info->ack_tstamp && nla_put_u64_64bit(msg,
20434 NL80211_ATTR_TX_HW_TIMESTAMP,
20435 info->ack_tstamp,
20436 NL80211_ATTR_PAD)))
20437 goto nla_put_failure;
20438
20439 genlmsg_end(msg, hdr);
20440
20441 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20442
20443 nla_put_failure:
20444 nlmsg_free(msg);
20445 return -ENOBUFS;
20446 }
20447
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)20448 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
20449 struct cfg80211_tx_status *status,
20450 gfp_t gfp, enum nl80211_commands command)
20451 {
20452 struct wiphy *wiphy = wdev->wiphy;
20453 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20454 struct net_device *netdev = wdev->netdev;
20455 struct sk_buff *msg;
20456 void *hdr;
20457
20458 if (command == NL80211_CMD_FRAME_TX_STATUS)
20459 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
20460 status->ack);
20461 else
20462 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
20463 status->ack);
20464
20465 msg = nlmsg_new(100 + status->len, gfp);
20466 if (!msg)
20467 return;
20468
20469 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
20470 if (!hdr) {
20471 nlmsg_free(msg);
20472 return;
20473 }
20474
20475 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20476 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20477 netdev->ifindex)) ||
20478 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20479 NL80211_ATTR_PAD) ||
20480 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
20481 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
20482 NL80211_ATTR_PAD) ||
20483 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
20484 (status->tx_tstamp &&
20485 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
20486 status->tx_tstamp, NL80211_ATTR_PAD)) ||
20487 (status->ack_tstamp &&
20488 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
20489 status->ack_tstamp, NL80211_ATTR_PAD)))
20490 goto nla_put_failure;
20491
20492 genlmsg_end(msg, hdr);
20493
20494 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20495 NL80211_MCGRP_MLME, gfp);
20496 return;
20497
20498 nla_put_failure:
20499 nlmsg_free(msg);
20500 }
20501
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)20502 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
20503 const u8 *buf, size_t len, bool ack,
20504 gfp_t gfp)
20505 {
20506 struct cfg80211_tx_status status = {
20507 .cookie = cookie,
20508 .buf = buf,
20509 .len = len,
20510 .ack = ack
20511 };
20512
20513 nl80211_frame_tx_status(wdev, &status, gfp,
20514 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
20515 }
20516 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
20517
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)20518 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
20519 struct cfg80211_tx_status *status, gfp_t gfp)
20520 {
20521 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
20522 }
20523 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
20524
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)20525 static int __nl80211_rx_control_port(struct net_device *dev,
20526 struct sk_buff *skb,
20527 bool unencrypted,
20528 int link_id,
20529 gfp_t gfp)
20530 {
20531 struct wireless_dev *wdev = dev->ieee80211_ptr;
20532 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20533 struct ethhdr *ehdr = eth_hdr(skb);
20534 const u8 *addr = ehdr->h_source;
20535 u16 proto = be16_to_cpu(skb->protocol);
20536 struct sk_buff *msg;
20537 void *hdr;
20538 struct nlattr *frame;
20539
20540 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
20541
20542 if (!nlportid)
20543 return -ENOENT;
20544
20545 msg = nlmsg_new(100 + skb->len, gfp);
20546 if (!msg)
20547 return -ENOMEM;
20548
20549 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
20550 if (!hdr) {
20551 nlmsg_free(msg);
20552 return -ENOBUFS;
20553 }
20554
20555 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20556 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20557 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20558 NL80211_ATTR_PAD) ||
20559 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20560 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
20561 (link_id >= 0 &&
20562 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
20563 (unencrypted && nla_put_flag(msg,
20564 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
20565 goto nla_put_failure;
20566
20567 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
20568 if (!frame)
20569 goto nla_put_failure;
20570
20571 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
20572 genlmsg_end(msg, hdr);
20573
20574 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20575
20576 nla_put_failure:
20577 nlmsg_free(msg);
20578 return -ENOBUFS;
20579 }
20580
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)20581 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
20582 bool unencrypted, int link_id)
20583 {
20584 int ret;
20585
20586 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
20587 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
20588 GFP_ATOMIC);
20589 trace_cfg80211_return_bool(ret == 0);
20590 return ret == 0;
20591 }
20592 EXPORT_SYMBOL(cfg80211_rx_control_port);
20593
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)20594 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
20595 const char *mac, gfp_t gfp)
20596 {
20597 struct wireless_dev *wdev = dev->ieee80211_ptr;
20598 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20599 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20600 void **cb;
20601
20602 if (!msg)
20603 return NULL;
20604
20605 cb = (void **)msg->cb;
20606
20607 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
20608 if (!cb[0]) {
20609 nlmsg_free(msg);
20610 return NULL;
20611 }
20612
20613 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20614 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
20615 goto nla_put_failure;
20616
20617 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
20618 goto nla_put_failure;
20619
20620 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
20621 if (!cb[1])
20622 goto nla_put_failure;
20623
20624 cb[2] = rdev;
20625
20626 return msg;
20627 nla_put_failure:
20628 nlmsg_free(msg);
20629 return NULL;
20630 }
20631
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)20632 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
20633 {
20634 void **cb = (void **)msg->cb;
20635 struct cfg80211_registered_device *rdev = cb[2];
20636
20637 nla_nest_end(msg, cb[1]);
20638 genlmsg_end(msg, cb[0]);
20639
20640 memset(msg->cb, 0, sizeof(msg->cb));
20641
20642 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20643 NL80211_MCGRP_MLME, gfp);
20644 }
20645
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)20646 void cfg80211_cqm_rssi_notify(struct net_device *dev,
20647 enum nl80211_cqm_rssi_threshold_event rssi_event,
20648 s32 rssi_level, gfp_t gfp)
20649 {
20650 struct wireless_dev *wdev = dev->ieee80211_ptr;
20651 struct cfg80211_cqm_config *cqm_config;
20652
20653 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
20654
20655 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
20656 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
20657 return;
20658
20659 rcu_read_lock();
20660 cqm_config = rcu_dereference(wdev->cqm_config);
20661 if (cqm_config) {
20662 cqm_config->last_rssi_event_value = rssi_level;
20663 cqm_config->last_rssi_event_type = rssi_event;
20664 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
20665 }
20666 rcu_read_unlock();
20667 }
20668 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
20669
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)20670 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
20671 {
20672 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
20673 cqm_rssi_work);
20674 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20675 enum nl80211_cqm_rssi_threshold_event rssi_event;
20676 struct cfg80211_cqm_config *cqm_config;
20677 struct sk_buff *msg;
20678 s32 rssi_level;
20679
20680 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
20681 if (!cqm_config)
20682 return;
20683
20684 if (cqm_config->use_range_api)
20685 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
20686
20687 rssi_level = cqm_config->last_rssi_event_value;
20688 rssi_event = cqm_config->last_rssi_event_type;
20689
20690 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
20691 if (!msg)
20692 return;
20693
20694 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
20695 rssi_event))
20696 goto nla_put_failure;
20697
20698 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
20699 rssi_level))
20700 goto nla_put_failure;
20701
20702 cfg80211_send_cqm(msg, GFP_KERNEL);
20703
20704 return;
20705
20706 nla_put_failure:
20707 nlmsg_free(msg);
20708 }
20709
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)20710 void cfg80211_cqm_txe_notify(struct net_device *dev,
20711 const u8 *peer, u32 num_packets,
20712 u32 rate, u32 intvl, gfp_t gfp)
20713 {
20714 struct sk_buff *msg;
20715
20716 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20717 if (!msg)
20718 return;
20719
20720 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
20721 goto nla_put_failure;
20722
20723 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
20724 goto nla_put_failure;
20725
20726 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
20727 goto nla_put_failure;
20728
20729 cfg80211_send_cqm(msg, gfp);
20730 return;
20731
20732 nla_put_failure:
20733 nlmsg_free(msg);
20734 }
20735 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
20736
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)20737 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
20738 const u8 *peer, u32 num_packets, gfp_t gfp)
20739 {
20740 struct sk_buff *msg;
20741
20742 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
20743
20744 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20745 if (!msg)
20746 return;
20747
20748 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
20749 goto nla_put_failure;
20750
20751 cfg80211_send_cqm(msg, gfp);
20752 return;
20753
20754 nla_put_failure:
20755 nlmsg_free(msg);
20756 }
20757 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
20758
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)20759 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
20760 {
20761 struct sk_buff *msg;
20762
20763 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
20764 if (!msg)
20765 return;
20766
20767 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
20768 goto nla_put_failure;
20769
20770 cfg80211_send_cqm(msg, gfp);
20771 return;
20772
20773 nla_put_failure:
20774 nlmsg_free(msg);
20775 }
20776 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
20777
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20778 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
20779 struct net_device *netdev, const u8 *bssid,
20780 const u8 *replay_ctr, gfp_t gfp)
20781 {
20782 struct sk_buff *msg;
20783 struct nlattr *rekey_attr;
20784 void *hdr;
20785
20786 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20787 if (!msg)
20788 return;
20789
20790 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
20791 if (!hdr) {
20792 nlmsg_free(msg);
20793 return;
20794 }
20795
20796 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20797 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20798 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
20799 goto nla_put_failure;
20800
20801 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
20802 if (!rekey_attr)
20803 goto nla_put_failure;
20804
20805 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
20806 NL80211_REPLAY_CTR_LEN, replay_ctr))
20807 goto nla_put_failure;
20808
20809 nla_nest_end(msg, rekey_attr);
20810
20811 genlmsg_end(msg, hdr);
20812
20813 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20814 NL80211_MCGRP_MLME, gfp);
20815 return;
20816
20817 nla_put_failure:
20818 nlmsg_free(msg);
20819 }
20820
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20821 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
20822 const u8 *replay_ctr, gfp_t gfp)
20823 {
20824 struct wireless_dev *wdev = dev->ieee80211_ptr;
20825 struct wiphy *wiphy = wdev->wiphy;
20826 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20827
20828 trace_cfg80211_gtk_rekey_notify(dev, bssid);
20829 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
20830 }
20831 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
20832
20833 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20834 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
20835 struct net_device *netdev, int index,
20836 const u8 *bssid, bool preauth, gfp_t gfp)
20837 {
20838 struct sk_buff *msg;
20839 struct nlattr *attr;
20840 void *hdr;
20841
20842 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20843 if (!msg)
20844 return;
20845
20846 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
20847 if (!hdr) {
20848 nlmsg_free(msg);
20849 return;
20850 }
20851
20852 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20853 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20854 goto nla_put_failure;
20855
20856 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
20857 if (!attr)
20858 goto nla_put_failure;
20859
20860 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
20861 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
20862 (preauth &&
20863 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
20864 goto nla_put_failure;
20865
20866 nla_nest_end(msg, attr);
20867
20868 genlmsg_end(msg, hdr);
20869
20870 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20871 NL80211_MCGRP_MLME, gfp);
20872 return;
20873
20874 nla_put_failure:
20875 nlmsg_free(msg);
20876 }
20877
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20878 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
20879 const u8 *bssid, bool preauth, gfp_t gfp)
20880 {
20881 struct wireless_dev *wdev = dev->ieee80211_ptr;
20882 struct wiphy *wiphy = wdev->wiphy;
20883 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20884
20885 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
20886 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
20887 }
20888 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
20889
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)20890 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
20891 struct net_device *netdev,
20892 unsigned int link_id,
20893 struct cfg80211_chan_def *chandef,
20894 gfp_t gfp,
20895 enum nl80211_commands notif,
20896 u8 count, bool quiet)
20897 {
20898 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20899 struct sk_buff *msg;
20900 void *hdr;
20901
20902 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20903 if (!msg)
20904 return;
20905
20906 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
20907 if (!hdr) {
20908 nlmsg_free(msg);
20909 return;
20910 }
20911
20912 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20913 goto nla_put_failure;
20914
20915 if (wdev->valid_links &&
20916 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
20917 goto nla_put_failure;
20918
20919 if (nl80211_send_chandef(msg, chandef))
20920 goto nla_put_failure;
20921
20922 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
20923 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
20924 goto nla_put_failure;
20925 if (quiet &&
20926 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
20927 goto nla_put_failure;
20928 }
20929
20930 genlmsg_end(msg, hdr);
20931
20932 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20933 NL80211_MCGRP_MLME, gfp);
20934 return;
20935
20936 nla_put_failure:
20937 nlmsg_free(msg);
20938 }
20939
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)20940 void cfg80211_ch_switch_notify(struct net_device *dev,
20941 struct cfg80211_chan_def *chandef,
20942 unsigned int link_id)
20943 {
20944 struct wireless_dev *wdev = dev->ieee80211_ptr;
20945 struct wiphy *wiphy = wdev->wiphy;
20946 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20947
20948 lockdep_assert_wiphy(wdev->wiphy);
20949 WARN_INVALID_LINK_ID(wdev, link_id);
20950
20951 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
20952
20953 switch (wdev->iftype) {
20954 case NL80211_IFTYPE_STATION:
20955 case NL80211_IFTYPE_P2P_CLIENT:
20956 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
20957 cfg80211_update_assoc_bss_entry(wdev, link_id,
20958 chandef->chan);
20959 break;
20960 case NL80211_IFTYPE_MESH_POINT:
20961 wdev->u.mesh.chandef = *chandef;
20962 wdev->u.mesh.preset_chandef = *chandef;
20963 break;
20964 case NL80211_IFTYPE_AP:
20965 case NL80211_IFTYPE_P2P_GO:
20966 wdev->links[link_id].ap.chandef = *chandef;
20967 break;
20968 case NL80211_IFTYPE_ADHOC:
20969 wdev->u.ibss.chandef = *chandef;
20970 break;
20971 default:
20972 WARN_ON(1);
20973 break;
20974 }
20975
20976 cfg80211_schedule_channels_check(wdev);
20977 cfg80211_sched_dfs_chan_update(rdev);
20978
20979 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
20980 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
20981 }
20982 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
20983
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet)20984 void cfg80211_ch_switch_started_notify(struct net_device *dev,
20985 struct cfg80211_chan_def *chandef,
20986 unsigned int link_id, u8 count,
20987 bool quiet)
20988 {
20989 struct wireless_dev *wdev = dev->ieee80211_ptr;
20990 struct wiphy *wiphy = wdev->wiphy;
20991 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20992
20993 lockdep_assert_wiphy(wdev->wiphy);
20994 WARN_INVALID_LINK_ID(wdev, link_id);
20995
20996 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
20997
20998
20999 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
21000 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
21001 count, quiet);
21002 }
21003 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
21004
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap,u8 link_id)21005 int cfg80211_bss_color_notify(struct net_device *dev,
21006 enum nl80211_commands cmd, u8 count,
21007 u64 color_bitmap, u8 link_id)
21008 {
21009 struct wireless_dev *wdev = dev->ieee80211_ptr;
21010 struct wiphy *wiphy = wdev->wiphy;
21011 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21012 struct sk_buff *msg;
21013 void *hdr;
21014
21015 lockdep_assert_wiphy(wdev->wiphy);
21016
21017 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
21018
21019 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21020 if (!msg)
21021 return -ENOMEM;
21022
21023 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
21024 if (!hdr)
21025 goto nla_put_failure;
21026
21027 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21028 goto nla_put_failure;
21029
21030 if (wdev->valid_links &&
21031 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
21032 goto nla_put_failure;
21033
21034 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
21035 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
21036 goto nla_put_failure;
21037
21038 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
21039 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
21040 color_bitmap, NL80211_ATTR_PAD))
21041 goto nla_put_failure;
21042
21043 genlmsg_end(msg, hdr);
21044
21045 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
21046 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
21047
21048 nla_put_failure:
21049 nlmsg_free(msg);
21050 return -EINVAL;
21051 }
21052 EXPORT_SYMBOL(cfg80211_bss_color_notify);
21053
21054 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)21055 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
21056 const struct cfg80211_chan_def *chandef,
21057 enum nl80211_radar_event event,
21058 struct net_device *netdev, gfp_t gfp)
21059 {
21060 struct sk_buff *msg;
21061 void *hdr;
21062
21063 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21064 if (!msg)
21065 return;
21066
21067 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
21068 if (!hdr) {
21069 nlmsg_free(msg);
21070 return;
21071 }
21072
21073 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21074 goto nla_put_failure;
21075
21076 /* NOP and radar events don't need a netdev parameter */
21077 if (netdev) {
21078 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21079
21080 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21081 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21082 NL80211_ATTR_PAD))
21083 goto nla_put_failure;
21084 }
21085
21086 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
21087 goto nla_put_failure;
21088
21089 if (nl80211_send_chandef(msg, chandef))
21090 goto nla_put_failure;
21091
21092 genlmsg_end(msg, hdr);
21093
21094 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21095 NL80211_MCGRP_MLME, gfp);
21096 return;
21097
21098 nla_put_failure:
21099 nlmsg_free(msg);
21100 }
21101
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)21102 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
21103 struct sta_opmode_info *sta_opmode,
21104 gfp_t gfp)
21105 {
21106 struct sk_buff *msg;
21107 struct wireless_dev *wdev = dev->ieee80211_ptr;
21108 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21109 void *hdr;
21110
21111 if (WARN_ON(!mac))
21112 return;
21113
21114 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21115 if (!msg)
21116 return;
21117
21118 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
21119 if (!hdr) {
21120 nlmsg_free(msg);
21121 return;
21122 }
21123
21124 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21125 goto nla_put_failure;
21126
21127 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21128 goto nla_put_failure;
21129
21130 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
21131 goto nla_put_failure;
21132
21133 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
21134 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
21135 goto nla_put_failure;
21136
21137 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
21138 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
21139 goto nla_put_failure;
21140
21141 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
21142 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
21143 goto nla_put_failure;
21144
21145 genlmsg_end(msg, hdr);
21146
21147 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21148 NL80211_MCGRP_MLME, gfp);
21149
21150 return;
21151
21152 nla_put_failure:
21153 nlmsg_free(msg);
21154 }
21155 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
21156
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)21157 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
21158 u64 cookie, bool acked, s32 ack_signal,
21159 bool is_valid_ack_signal, gfp_t gfp)
21160 {
21161 struct wireless_dev *wdev = dev->ieee80211_ptr;
21162 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21163 struct sk_buff *msg;
21164 void *hdr;
21165
21166 trace_cfg80211_probe_status(dev, addr, cookie, acked);
21167
21168 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21169
21170 if (!msg)
21171 return;
21172
21173 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
21174 if (!hdr) {
21175 nlmsg_free(msg);
21176 return;
21177 }
21178
21179 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21180 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21181 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
21182 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
21183 NL80211_ATTR_PAD) ||
21184 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
21185 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
21186 ack_signal)))
21187 goto nla_put_failure;
21188
21189 genlmsg_end(msg, hdr);
21190
21191 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21192 NL80211_MCGRP_MLME, gfp);
21193 return;
21194
21195 nla_put_failure:
21196 nlmsg_free(msg);
21197 }
21198 EXPORT_SYMBOL(cfg80211_probe_status);
21199
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)21200 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
21201 size_t len, int freq, int sig_dbm)
21202 {
21203 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21204 struct sk_buff *msg;
21205 void *hdr;
21206 struct cfg80211_beacon_registration *reg;
21207
21208 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
21209
21210 spin_lock_bh(&rdev->beacon_registrations_lock);
21211 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
21212 msg = nlmsg_new(len + 100, GFP_ATOMIC);
21213 if (!msg) {
21214 spin_unlock_bh(&rdev->beacon_registrations_lock);
21215 return;
21216 }
21217
21218 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
21219 if (!hdr)
21220 goto nla_put_failure;
21221
21222 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21223 (freq &&
21224 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
21225 KHZ_TO_MHZ(freq)) ||
21226 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
21227 freq % 1000))) ||
21228 (sig_dbm &&
21229 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
21230 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
21231 goto nla_put_failure;
21232
21233 genlmsg_end(msg, hdr);
21234
21235 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
21236 }
21237 spin_unlock_bh(&rdev->beacon_registrations_lock);
21238 return;
21239
21240 nla_put_failure:
21241 spin_unlock_bh(&rdev->beacon_registrations_lock);
21242 nlmsg_free(msg);
21243 }
21244 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
21245
21246 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)21247 static int cfg80211_net_detect_results(struct sk_buff *msg,
21248 struct cfg80211_wowlan_wakeup *wakeup)
21249 {
21250 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
21251 struct nlattr *nl_results, *nl_match, *nl_freqs;
21252 int i, j;
21253
21254 nl_results = nla_nest_start_noflag(msg,
21255 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
21256 if (!nl_results)
21257 return -EMSGSIZE;
21258
21259 for (i = 0; i < nd->n_matches; i++) {
21260 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
21261
21262 nl_match = nla_nest_start_noflag(msg, i);
21263 if (!nl_match)
21264 break;
21265
21266 /* The SSID attribute is optional in nl80211, but for
21267 * simplicity reasons it's always present in the
21268 * cfg80211 structure. If a driver can't pass the
21269 * SSID, that needs to be changed. A zero length SSID
21270 * is still a valid SSID (wildcard), so it cannot be
21271 * used for this purpose.
21272 */
21273 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
21274 match->ssid.ssid)) {
21275 nla_nest_cancel(msg, nl_match);
21276 goto out;
21277 }
21278
21279 if (match->n_channels) {
21280 nl_freqs = nla_nest_start_noflag(msg,
21281 NL80211_ATTR_SCAN_FREQUENCIES);
21282 if (!nl_freqs) {
21283 nla_nest_cancel(msg, nl_match);
21284 goto out;
21285 }
21286
21287 for (j = 0; j < match->n_channels; j++) {
21288 if (nla_put_u32(msg, j, match->channels[j])) {
21289 nla_nest_cancel(msg, nl_freqs);
21290 nla_nest_cancel(msg, nl_match);
21291 goto out;
21292 }
21293 }
21294
21295 nla_nest_end(msg, nl_freqs);
21296 }
21297
21298 nla_nest_end(msg, nl_match);
21299 }
21300
21301 out:
21302 nla_nest_end(msg, nl_results);
21303 return 0;
21304 }
21305
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)21306 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
21307 struct cfg80211_wowlan_wakeup *wakeup,
21308 gfp_t gfp)
21309 {
21310 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21311 struct sk_buff *msg;
21312 void *hdr;
21313 int size = 200;
21314
21315 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
21316
21317 if (wakeup)
21318 size += wakeup->packet_present_len;
21319
21320 msg = nlmsg_new(size, gfp);
21321 if (!msg)
21322 return;
21323
21324 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
21325 if (!hdr)
21326 goto free_msg;
21327
21328 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21329 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21330 NL80211_ATTR_PAD))
21331 goto free_msg;
21332
21333 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
21334 wdev->netdev->ifindex))
21335 goto free_msg;
21336
21337 if (wakeup) {
21338 struct nlattr *reasons;
21339
21340 reasons = nla_nest_start_noflag(msg,
21341 NL80211_ATTR_WOWLAN_TRIGGERS);
21342 if (!reasons)
21343 goto free_msg;
21344
21345 if (wakeup->disconnect &&
21346 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
21347 goto free_msg;
21348 if (wakeup->magic_pkt &&
21349 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
21350 goto free_msg;
21351 if (wakeup->gtk_rekey_failure &&
21352 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
21353 goto free_msg;
21354 if (wakeup->eap_identity_req &&
21355 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
21356 goto free_msg;
21357 if (wakeup->four_way_handshake &&
21358 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
21359 goto free_msg;
21360 if (wakeup->rfkill_release &&
21361 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
21362 goto free_msg;
21363
21364 if (wakeup->pattern_idx >= 0 &&
21365 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
21366 wakeup->pattern_idx))
21367 goto free_msg;
21368
21369 if (wakeup->tcp_match &&
21370 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
21371 goto free_msg;
21372
21373 if (wakeup->tcp_connlost &&
21374 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
21375 goto free_msg;
21376
21377 if (wakeup->tcp_nomoretokens &&
21378 nla_put_flag(msg,
21379 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
21380 goto free_msg;
21381
21382 if (wakeup->unprot_deauth_disassoc &&
21383 nla_put_flag(msg,
21384 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
21385 goto free_msg;
21386
21387 if (wakeup->packet) {
21388 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
21389 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
21390
21391 if (!wakeup->packet_80211) {
21392 pkt_attr =
21393 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
21394 len_attr =
21395 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
21396 }
21397
21398 if (wakeup->packet_len &&
21399 nla_put_u32(msg, len_attr, wakeup->packet_len))
21400 goto free_msg;
21401
21402 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
21403 wakeup->packet))
21404 goto free_msg;
21405 }
21406
21407 if (wakeup->net_detect &&
21408 cfg80211_net_detect_results(msg, wakeup))
21409 goto free_msg;
21410
21411 nla_nest_end(msg, reasons);
21412 }
21413
21414 genlmsg_end(msg, hdr);
21415
21416 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21417 NL80211_MCGRP_MLME, gfp);
21418 return;
21419
21420 free_msg:
21421 nlmsg_free(msg);
21422 }
21423 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
21424 #endif
21425
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)21426 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
21427 enum nl80211_tdls_operation oper,
21428 u16 reason_code, gfp_t gfp)
21429 {
21430 struct wireless_dev *wdev = dev->ieee80211_ptr;
21431 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21432 struct sk_buff *msg;
21433 void *hdr;
21434
21435 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
21436 reason_code);
21437
21438 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21439 if (!msg)
21440 return;
21441
21442 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
21443 if (!hdr) {
21444 nlmsg_free(msg);
21445 return;
21446 }
21447
21448 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21449 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21450 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
21451 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
21452 (reason_code > 0 &&
21453 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
21454 goto nla_put_failure;
21455
21456 genlmsg_end(msg, hdr);
21457
21458 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21459 NL80211_MCGRP_MLME, gfp);
21460 return;
21461
21462 nla_put_failure:
21463 nlmsg_free(msg);
21464 }
21465 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
21466
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)21467 static int nl80211_netlink_notify(struct notifier_block * nb,
21468 unsigned long state,
21469 void *_notify)
21470 {
21471 struct netlink_notify *notify = _notify;
21472 struct cfg80211_registered_device *rdev;
21473 struct wireless_dev *wdev;
21474 struct cfg80211_beacon_registration *reg, *tmp;
21475
21476 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
21477 return NOTIFY_DONE;
21478
21479 rcu_read_lock();
21480
21481 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
21482 struct cfg80211_sched_scan_request *sched_scan_req;
21483
21484 list_for_each_entry_rcu(sched_scan_req,
21485 &rdev->sched_scan_req_list,
21486 list) {
21487 if (sched_scan_req->owner_nlportid == notify->portid) {
21488 sched_scan_req->nl_owner_dead = true;
21489 wiphy_work_queue(&rdev->wiphy,
21490 &rdev->sched_scan_stop_wk);
21491 }
21492 }
21493
21494 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
21495 cfg80211_mlme_unregister_socket(wdev, notify->portid);
21496
21497 if (wdev->owner_nlportid == notify->portid) {
21498 wdev->nl_owner_dead = true;
21499 schedule_work(&rdev->destroy_work);
21500 } else if (wdev->conn_owner_nlportid == notify->portid) {
21501 schedule_work(&wdev->disconnect_wk);
21502 }
21503
21504 cfg80211_release_pmsr(wdev, notify->portid);
21505 }
21506
21507 spin_lock_bh(&rdev->beacon_registrations_lock);
21508 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
21509 list) {
21510 if (reg->nlportid == notify->portid) {
21511 list_del(®->list);
21512 kfree(reg);
21513 break;
21514 }
21515 }
21516 spin_unlock_bh(&rdev->beacon_registrations_lock);
21517 }
21518
21519 rcu_read_unlock();
21520
21521 /*
21522 * It is possible that the user space process that is controlling the
21523 * indoor setting disappeared, so notify the regulatory core.
21524 */
21525 regulatory_netlink_notify(notify->portid);
21526 return NOTIFY_OK;
21527 }
21528
21529 static struct notifier_block nl80211_netlink_notifier = {
21530 .notifier_call = nl80211_netlink_notify,
21531 };
21532
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)21533 void cfg80211_ft_event(struct net_device *netdev,
21534 struct cfg80211_ft_event_params *ft_event)
21535 {
21536 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21537 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21538 struct sk_buff *msg;
21539 void *hdr;
21540
21541 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
21542
21543 if (!ft_event->target_ap)
21544 return;
21545
21546 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
21547 GFP_KERNEL);
21548 if (!msg)
21549 return;
21550
21551 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
21552 if (!hdr)
21553 goto out;
21554
21555 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21556 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21557 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
21558 goto out;
21559
21560 if (ft_event->ies &&
21561 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
21562 goto out;
21563 if (ft_event->ric_ies &&
21564 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
21565 ft_event->ric_ies))
21566 goto out;
21567
21568 genlmsg_end(msg, hdr);
21569
21570 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21571 NL80211_MCGRP_MLME, GFP_KERNEL);
21572 return;
21573 out:
21574 nlmsg_free(msg);
21575 }
21576 EXPORT_SYMBOL(cfg80211_ft_event);
21577
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)21578 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
21579 {
21580 struct cfg80211_registered_device *rdev;
21581 struct sk_buff *msg;
21582 void *hdr;
21583 u32 nlportid;
21584
21585 rdev = wiphy_to_rdev(wdev->wiphy);
21586 if (!rdev->crit_proto_nlportid)
21587 return;
21588
21589 nlportid = rdev->crit_proto_nlportid;
21590 rdev->crit_proto_nlportid = 0;
21591
21592 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21593 if (!msg)
21594 return;
21595
21596 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
21597 if (!hdr)
21598 goto nla_put_failure;
21599
21600 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21601 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21602 NL80211_ATTR_PAD))
21603 goto nla_put_failure;
21604
21605 genlmsg_end(msg, hdr);
21606
21607 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
21608 return;
21609
21610 nla_put_failure:
21611 nlmsg_free(msg);
21612 }
21613 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
21614
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)21615 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
21616 {
21617 struct wiphy *wiphy = wdev->wiphy;
21618 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21619 struct sk_buff *msg;
21620 void *hdr;
21621
21622 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21623 if (!msg)
21624 return;
21625
21626 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
21627 if (!hdr)
21628 goto out;
21629
21630 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21631 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
21632 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21633 NL80211_ATTR_PAD) ||
21634 (wdev->valid_links &&
21635 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
21636 goto out;
21637
21638 genlmsg_end(msg, hdr);
21639
21640 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
21641 NL80211_MCGRP_MLME, GFP_KERNEL);
21642 return;
21643 out:
21644 nlmsg_free(msg);
21645 }
21646
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)21647 int cfg80211_external_auth_request(struct net_device *dev,
21648 struct cfg80211_external_auth_params *params,
21649 gfp_t gfp)
21650 {
21651 struct wireless_dev *wdev = dev->ieee80211_ptr;
21652 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21653 struct sk_buff *msg;
21654 void *hdr;
21655
21656 if (!wdev->conn_owner_nlportid)
21657 return -EINVAL;
21658
21659 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21660 if (!msg)
21661 return -ENOMEM;
21662
21663 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
21664 if (!hdr)
21665 goto nla_put_failure;
21666
21667 /* Some historical mistakes in drivers <-> userspace interface (notably
21668 * between drivers and wpa_supplicant) led to a big-endian conversion
21669 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
21670 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
21671 * benefit of older wpa_supplicant versions, send this particular value
21672 * in big-endian. Note that newer wpa_supplicant will also detect this
21673 * particular value in big endian still, so it all continues to work.
21674 */
21675 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
21676 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
21677 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
21678 goto nla_put_failure;
21679 } else {
21680 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
21681 params->key_mgmt_suite))
21682 goto nla_put_failure;
21683 }
21684
21685 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21686 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21687 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
21688 params->action) ||
21689 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
21690 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
21691 params->ssid.ssid) ||
21692 (!is_zero_ether_addr(params->mld_addr) &&
21693 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
21694 goto nla_put_failure;
21695
21696 genlmsg_end(msg, hdr);
21697 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
21698 wdev->conn_owner_nlportid);
21699 return 0;
21700
21701 nla_put_failure:
21702 nlmsg_free(msg);
21703 return -ENOBUFS;
21704 }
21705 EXPORT_SYMBOL(cfg80211_external_auth_request);
21706
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)21707 void cfg80211_update_owe_info_event(struct net_device *netdev,
21708 struct cfg80211_update_owe_info *owe_info,
21709 gfp_t gfp)
21710 {
21711 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21712 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21713 struct sk_buff *msg;
21714 void *hdr;
21715
21716 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
21717
21718 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21719 if (!msg)
21720 return;
21721
21722 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
21723 if (!hdr)
21724 goto nla_put_failure;
21725
21726 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21727 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21728 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
21729 goto nla_put_failure;
21730
21731 if (!owe_info->ie_len ||
21732 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
21733 goto nla_put_failure;
21734
21735 if (owe_info->assoc_link_id != -1) {
21736 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
21737 owe_info->assoc_link_id))
21738 goto nla_put_failure;
21739
21740 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
21741 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
21742 owe_info->peer_mld_addr))
21743 goto nla_put_failure;
21744 }
21745
21746 genlmsg_end(msg, hdr);
21747
21748 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21749 NL80211_MCGRP_MLME, gfp);
21750 return;
21751
21752 nla_put_failure:
21753 genlmsg_cancel(msg, hdr);
21754 nlmsg_free(msg);
21755 }
21756 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
21757
cfg80211_schedule_channels_check(struct wireless_dev * wdev)21758 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
21759 {
21760 struct wiphy *wiphy = wdev->wiphy;
21761
21762 /* Schedule channels check if NO_IR or DFS relaxations are supported */
21763 if (wdev->iftype == NL80211_IFTYPE_STATION &&
21764 (wiphy_ext_feature_isset(wiphy,
21765 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
21766 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
21767 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
21768 reg_check_channels();
21769 }
21770 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
21771
cfg80211_epcs_changed(struct net_device * netdev,bool enabled)21772 void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
21773 {
21774 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21775 struct wiphy *wiphy = wdev->wiphy;
21776 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21777 struct sk_buff *msg;
21778 void *hdr;
21779
21780 trace_cfg80211_epcs_changed(wdev, enabled);
21781
21782 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21783 if (!msg)
21784 return;
21785
21786 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
21787 if (!hdr) {
21788 nlmsg_free(msg);
21789 return;
21790 }
21791
21792 if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
21793 goto nla_put_failure;
21794
21795 genlmsg_end(msg, hdr);
21796 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21797 NL80211_MCGRP_MLME, GFP_KERNEL);
21798 return;
21799
21800 nla_put_failure:
21801 nlmsg_free(msg);
21802 }
21803 EXPORT_SYMBOL(cfg80211_epcs_changed);
21804
cfg80211_next_nan_dw_notif(struct wireless_dev * wdev,struct ieee80211_channel * chan,gfp_t gfp)21805 void cfg80211_next_nan_dw_notif(struct wireless_dev *wdev,
21806 struct ieee80211_channel *chan, gfp_t gfp)
21807 {
21808 struct wiphy *wiphy = wdev->wiphy;
21809 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21810 struct sk_buff *msg;
21811 void *hdr;
21812
21813 trace_cfg80211_next_nan_dw_notif(wdev, chan);
21814
21815 if (!wdev->owner_nlportid)
21816 return;
21817
21818 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21819 if (!msg)
21820 return;
21821
21822 hdr = nl80211hdr_put(msg, 0, 0, 0,
21823 NL80211_CMD_NAN_NEXT_DW_NOTIFICATION);
21824 if (!hdr)
21825 goto nla_put_failure;
21826
21827 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21828 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21829 NL80211_ATTR_PAD) ||
21830 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq))
21831 goto nla_put_failure;
21832
21833 genlmsg_end(msg, hdr);
21834
21835 genlmsg_unicast(wiphy_net(wiphy), msg, wdev->owner_nlportid);
21836
21837 return;
21838
21839 nla_put_failure:
21840 nlmsg_free(msg);
21841 }
21842 EXPORT_SYMBOL(cfg80211_next_nan_dw_notif);
21843
cfg80211_nan_cluster_joined(struct wireless_dev * wdev,const u8 * cluster_id,bool new_cluster,gfp_t gfp)21844 void cfg80211_nan_cluster_joined(struct wireless_dev *wdev,
21845 const u8 *cluster_id, bool new_cluster,
21846 gfp_t gfp)
21847 {
21848 struct wiphy *wiphy = wdev->wiphy;
21849 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21850 struct sk_buff *msg;
21851 void *hdr;
21852
21853 trace_cfg80211_nan_cluster_joined(wdev, cluster_id, new_cluster);
21854
21855 memcpy(wdev->u.nan.cluster_id, cluster_id, ETH_ALEN);
21856
21857 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21858 if (!msg)
21859 return;
21860
21861 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_CLUSTER_JOINED);
21862 if (!hdr)
21863 goto nla_put_failure;
21864
21865 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21866 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21867 NL80211_ATTR_PAD) ||
21868 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cluster_id) ||
21869 (new_cluster && nla_put_flag(msg, NL80211_ATTR_NAN_NEW_CLUSTER)))
21870 goto nla_put_failure;
21871
21872 genlmsg_end(msg, hdr);
21873
21874 if (!wdev->owner_nlportid)
21875 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy),
21876 msg, 0, NL80211_MCGRP_NAN, gfp);
21877 else
21878 genlmsg_unicast(wiphy_net(wiphy), msg,
21879 wdev->owner_nlportid);
21880 return;
21881
21882 nla_put_failure:
21883 nlmsg_free(msg);
21884 }
21885 EXPORT_SYMBOL(cfg80211_nan_cluster_joined);
21886
21887 /* initialisation/exit functions */
21888
nl80211_init(void)21889 int __init nl80211_init(void)
21890 {
21891 int err;
21892
21893 err = genl_register_family(&nl80211_fam);
21894 if (err)
21895 return err;
21896
21897 err = netlink_register_notifier(&nl80211_netlink_notifier);
21898 if (err)
21899 goto err_out;
21900
21901 return 0;
21902 err_out:
21903 genl_unregister_family(&nl80211_fam);
21904 return err;
21905 }
21906
nl80211_exit(void)21907 void nl80211_exit(void)
21908 {
21909 netlink_unregister_notifier(&nl80211_netlink_notifier);
21910 genl_unregister_family(&nl80211_fam);
21911 }
21912