1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2025 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 const struct ieee80211_ext *ext;
233 unsigned int fixedlen, hdrlen;
234 bool s1g_bcn;
235
236 if (len < offsetofend(typeof(*mgmt), frame_control))
237 goto err;
238
239 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
240 if (s1g_bcn) {
241 ext = (struct ieee80211_ext *)mgmt;
242 fixedlen =
243 offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
244 ieee80211_s1g_optional_len(ext->frame_control);
245 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
246 } else {
247 fixedlen = offsetof(struct ieee80211_mgmt,
248 u.beacon.variable);
249 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
250 }
251
252 if (len < fixedlen)
253 goto err;
254
255 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
256 goto err;
257
258 data += fixedlen;
259 len -= fixedlen;
260
261 for_each_element(elem, data, len) {
262 /* nothing */
263 }
264
265 if (for_each_element_completed(elem, data, len))
266 return 0;
267
268 err:
269 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
270 return -EINVAL;
271 }
272
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)273 static int validate_ie_attr(const struct nlattr *attr,
274 struct netlink_ext_ack *extack)
275 {
276 const u8 *data = nla_data(attr);
277 unsigned int len = nla_len(attr);
278 const struct element *elem;
279
280 for_each_element(elem, data, len) {
281 /* nothing */
282 }
283
284 if (for_each_element_completed(elem, data, len))
285 return 0;
286
287 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
288 return -EINVAL;
289 }
290
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)291 static int validate_he_capa(const struct nlattr *attr,
292 struct netlink_ext_ack *extack)
293 {
294 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
295 return -EINVAL;
296
297 return 0;
298 }
299
validate_supported_selectors(const struct nlattr * attr,struct netlink_ext_ack * extack)300 static int validate_supported_selectors(const struct nlattr *attr,
301 struct netlink_ext_ack *extack)
302 {
303 const u8 *supported_selectors = nla_data(attr);
304 u8 supported_selectors_len = nla_len(attr);
305
306 /* The top bit must not be set as it is not part of the selector */
307 for (int i = 0; i < supported_selectors_len; i++) {
308 if (supported_selectors[i] & 0x80)
309 return -EINVAL;
310 }
311
312 return 0;
313 }
314
validate_nan_cluster_id(const struct nlattr * attr,struct netlink_ext_ack * extack)315 static int validate_nan_cluster_id(const struct nlattr *attr,
316 struct netlink_ext_ack *extack)
317 {
318 const u8 *data = nla_data(attr);
319 unsigned int len = nla_len(attr);
320 static const u8 cluster_id_prefix[4] = {0x50, 0x6f, 0x9a, 0x1};
321
322 if (len != ETH_ALEN) {
323 NL_SET_ERR_MSG_ATTR(extack, attr, "bad cluster id length");
324 return -EINVAL;
325 }
326
327 if (memcmp(data, cluster_id_prefix, sizeof(cluster_id_prefix))) {
328 NL_SET_ERR_MSG_ATTR(extack, attr, "invalid cluster id prefix");
329 return -EINVAL;
330 }
331
332 return 0;
333 }
334
335 /* policy for the attributes */
336 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
337
338 static const struct nla_policy
339 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
340 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
341 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
342 .len = U8_MAX },
343 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
344 .len = U8_MAX },
345 };
346
347 static const struct nla_policy
348 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
349 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
350 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
351 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
352 NLA_POLICY_MAX(NLA_U8, 15),
353 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
354 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
355 NLA_POLICY_MAX(NLA_U8, 15),
356 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
357 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
358 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
359 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
360 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
361 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
362 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
363 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
364 };
365
366 static const struct nla_policy
367 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
368 [NL80211_PMSR_TYPE_FTM] =
369 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
370 };
371
372 static const struct nla_policy
373 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
374 [NL80211_PMSR_REQ_ATTR_DATA] =
375 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
376 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
377 };
378
379 static const struct nla_policy
380 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
381 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
382 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
383 [NL80211_PMSR_PEER_ATTR_REQ] =
384 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
385 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
386 };
387
388 static const struct nla_policy
389 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
390 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
391 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
392 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
393 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
394 [NL80211_PMSR_ATTR_PEERS] =
395 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
396 };
397
398 static const struct nla_policy
399 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
400 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
401 NLA_POLICY_RANGE(NLA_U8, 1, 20),
402 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
403 NLA_POLICY_RANGE(NLA_U8, 1, 20),
404 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
405 NLA_POLICY_RANGE(NLA_U8, 1, 20),
406 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
407 NLA_POLICY_EXACT_LEN(8),
408 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
409 NLA_POLICY_EXACT_LEN(8),
410 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
411 };
412
413 static const struct nla_policy
414 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
415 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
416 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
417 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
418 };
419
420 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
421 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
422 .len = NL80211_MAX_SUPP_RATES },
423 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
424 .len = NL80211_MAX_SUPP_HT_RATES },
425 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
426 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
427 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
428 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
429 NL80211_RATE_INFO_HE_GI_0_8,
430 NL80211_RATE_INFO_HE_GI_3_2),
431 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
432 NL80211_RATE_INFO_HE_1XLTF,
433 NL80211_RATE_INFO_HE_4XLTF),
434 [NL80211_TXRATE_EHT] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_eht)),
435 [NL80211_TXRATE_EHT_GI] = NLA_POLICY_RANGE(NLA_U8,
436 NL80211_RATE_INFO_EHT_GI_0_8,
437 NL80211_RATE_INFO_EHT_GI_3_2),
438 [NL80211_TXRATE_EHT_LTF] = NLA_POLICY_RANGE(NLA_U8,
439 NL80211_RATE_INFO_EHT_1XLTF,
440 NL80211_RATE_INFO_EHT_8XLTF),
441
442 };
443
444 static const struct nla_policy
445 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
446 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
447 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
448 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
449 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
450 [NL80211_TID_CONFIG_ATTR_NOACK] =
451 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
452 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
453 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
454 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
455 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
456 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
457 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
458 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
459 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
460 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
461 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
462 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
463 NLA_POLICY_NESTED(nl80211_txattr_policy),
464 };
465
466 static const struct nla_policy
467 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
468 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
469 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
470 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
471 NLA_POLICY_RANGE(NLA_BINARY,
472 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
473 IEEE80211_MAX_DATA_LEN),
474 };
475
476 static const struct nla_policy
477 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
478 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
479 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
480 .len = IEEE80211_MAX_DATA_LEN }
481 };
482
483 static const struct nla_policy
484 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
485 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
486 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
487 };
488
489 static const struct nla_policy
490 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
491 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
492 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
493 };
494
495 static const struct nla_policy
496 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
497 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
498 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
499 NLA_POLICY_MIN(NLA_U8, 1),
500 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
501 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
502 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
503 [NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
504 NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
505 };
506
507 static const struct nla_policy
508 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
509 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
510 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
511 };
512
513 static const struct nla_policy
514 nl80211_s1g_short_beacon[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1] = {
515 [NL80211_S1G_SHORT_BEACON_ATTR_HEAD] =
516 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
517 IEEE80211_MAX_DATA_LEN),
518 [NL80211_S1G_SHORT_BEACON_ATTR_TAIL] =
519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
520 IEEE80211_MAX_DATA_LEN),
521 };
522
523 static const struct nla_policy
524 nl80211_nan_band_conf_policy[NL80211_NAN_BAND_CONF_ATTR_MAX + 1] = {
525 [NL80211_NAN_BAND_CONF_BAND] = NLA_POLICY_MAX(NLA_U8,
526 NUM_NL80211_BANDS - 1),
527 [NL80211_NAN_BAND_CONF_FREQ] = { .type = NLA_U16 },
528 [NL80211_NAN_BAND_CONF_RSSI_CLOSE] = NLA_POLICY_MIN(NLA_S8, -59),
529 [NL80211_NAN_BAND_CONF_RSSI_MIDDLE] = NLA_POLICY_MIN(NLA_S8, -74),
530 [NL80211_NAN_BAND_CONF_WAKE_DW] = NLA_POLICY_MAX(NLA_U8, 5),
531 [NL80211_NAN_BAND_CONF_DISABLE_SCAN] = { .type = NLA_FLAG },
532 };
533
534 static const struct nla_policy
535 nl80211_nan_conf_policy[NL80211_NAN_CONF_ATTR_MAX + 1] = {
536 [NL80211_NAN_CONF_CLUSTER_ID] =
537 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_nan_cluster_id,
538 ETH_ALEN),
539 [NL80211_NAN_CONF_EXTRA_ATTRS] = { .type = NLA_BINARY,
540 .len = IEEE80211_MAX_DATA_LEN},
541 [NL80211_NAN_CONF_VENDOR_ELEMS] =
542 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
543 IEEE80211_MAX_DATA_LEN),
544 [NL80211_NAN_CONF_BAND_CONFIGS] =
545 NLA_POLICY_NESTED_ARRAY(nl80211_nan_band_conf_policy),
546 [NL80211_NAN_CONF_SCAN_PERIOD] = { .type = NLA_U16 },
547 [NL80211_NAN_CONF_SCAN_DWELL_TIME] = NLA_POLICY_RANGE(NLA_U16, 50, 512),
548 [NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL] =
549 NLA_POLICY_RANGE(NLA_U8, 50, 200),
550 [NL80211_NAN_CONF_NOTIFY_DW] = { .type = NLA_FLAG },
551 };
552
553 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
554 .min = 0,
555 .max = 0xffff,
556 };
557
558 static const struct netlink_range_validation q_range = {
559 .max = INT_MAX,
560 };
561
562 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
563 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
564 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
565 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
566 .len = 20-1 },
567 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
568
569 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
570 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
571 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
572 NL80211_EDMG_CHANNELS_MIN,
573 NL80211_EDMG_CHANNELS_MAX),
574 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
575 NL80211_EDMG_BW_CONFIG_MIN,
576 NL80211_EDMG_BW_CONFIG_MAX),
577
578 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
579 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
580 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
581 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
582
583 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
584 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
585 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
586 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
587 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
588 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
589
590 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
591 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
592 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
593
594 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
595 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
596
597 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
598 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
599 .len = WLAN_MAX_KEY_LEN },
600 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
601 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
602 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
603 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
604 [NL80211_ATTR_KEY_TYPE] =
605 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
606
607 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
608 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
609 [NL80211_ATTR_BEACON_HEAD] =
610 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
611 IEEE80211_MAX_DATA_LEN),
612 [NL80211_ATTR_BEACON_TAIL] =
613 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
614 IEEE80211_MAX_DATA_LEN),
615 [NL80211_ATTR_STA_AID] =
616 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
617 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
618 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
619 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
620 .len = NL80211_MAX_SUPP_RATES },
621 [NL80211_ATTR_STA_PLINK_ACTION] =
622 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
623 [NL80211_ATTR_STA_TX_POWER_SETTING] =
624 NLA_POLICY_RANGE(NLA_U8,
625 NL80211_TX_POWER_AUTOMATIC,
626 NL80211_TX_POWER_FIXED),
627 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
628 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
629 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
630 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
631 .len = IEEE80211_MAX_MESH_ID_LEN },
632 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
633
634 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
635 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
636 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
637
638 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
639 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
640 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
641 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
642 .len = NL80211_MAX_SUPP_RATES },
643 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
644
645 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
646 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
647
648 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
649
650 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
651 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
652 validate_ie_attr,
653 IEEE80211_MAX_DATA_LEN),
654 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
655 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
656
657 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
658 .len = IEEE80211_MAX_SSID_LEN },
659 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
660 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
661 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
662 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
663 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
664 NL80211_MFP_NO,
665 NL80211_MFP_OPTIONAL),
666 [NL80211_ATTR_STA_FLAGS2] =
667 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
668 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
669 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
670 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
671 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
672 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
673 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
674 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
675 [NL80211_ATTR_WPA_VERSIONS] =
676 NLA_POLICY_RANGE(NLA_U32, 0,
677 NL80211_WPA_VERSION_1 |
678 NL80211_WPA_VERSION_2 |
679 NL80211_WPA_VERSION_3),
680 [NL80211_ATTR_PID] = { .type = NLA_U32 },
681 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
682 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
683 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
684 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
685 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
686 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
687 .len = IEEE80211_MAX_DATA_LEN },
688 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
689 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
690 NL80211_PS_DISABLED,
691 NL80211_PS_ENABLED),
692 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
693 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
694 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
695 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
696 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
697 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
698 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
699 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
700 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
701 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
702 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
703 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
704 [NL80211_ATTR_STA_PLINK_STATE] =
705 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
706 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
707 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
708 [NL80211_ATTR_MESH_PEER_AID] =
709 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
710 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
711 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
712 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
713 [NL80211_ATTR_HIDDEN_SSID] =
714 NLA_POLICY_RANGE(NLA_U32,
715 NL80211_HIDDEN_SSID_NOT_IN_USE,
716 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
717 [NL80211_ATTR_IE_PROBE_RESP] =
718 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
719 IEEE80211_MAX_DATA_LEN),
720 [NL80211_ATTR_IE_ASSOC_RESP] =
721 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
722 IEEE80211_MAX_DATA_LEN),
723 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
724 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
725 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
726 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
727 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
728 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
729 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
730 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
731 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
732 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
733 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
734 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
735 .len = IEEE80211_MAX_DATA_LEN },
736 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
737 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
738 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
739 .len = NL80211_HT_CAPABILITY_LEN
740 },
741 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
742 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
743 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
744 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
745 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
746
747 /* need to include at least Auth Transaction and Status Code */
748 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
749
750 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
751 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
752 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
753 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
754 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
755 NLA_POLICY_RANGE(NLA_U32,
756 NL80211_MESH_POWER_UNKNOWN + 1,
757 NL80211_MESH_POWER_MAX),
758 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
759 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
760 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
761 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
762 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
763 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
764 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
765 .len = NL80211_VHT_CAPABILITY_LEN,
766 },
767 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
768 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
769 .len = IEEE80211_MAX_DATA_LEN },
770 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
771 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
772 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
773 [NL80211_ATTR_PEER_AID] =
774 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
775 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
776 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
777 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
778 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
779 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
780 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
781 /*
782 * The value of the Length field of the Supported Operating
783 * Classes element is between 2 and 253.
784 */
785 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
786 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
787 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
788 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
789 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
790 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
791 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
792 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
793 IEEE80211_QOS_MAP_LEN_MIN,
794 IEEE80211_QOS_MAP_LEN_MAX),
795 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
796 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
797 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
798 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
799 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
800 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
801 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
802 [NL80211_ATTR_USER_PRIO] =
803 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
804 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
805 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
806 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
807 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
808 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
809 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
810 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
811 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
812 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
813 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
814 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
815 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
816 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
817 .len = VHT_MUMIMO_GROUPS_DATA_LEN
818 },
819 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
820 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
821 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
822 [NL80211_ATTR_NAN_CONFIG] = NLA_POLICY_NESTED(nl80211_nan_conf_policy),
823 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
824 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
825 .len = FILS_MAX_KEK_LEN },
826 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
827 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
828 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
829 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
830 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
831 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
832 },
833 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
834 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
835 .len = FILS_ERP_MAX_USERNAME_LEN },
836 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
837 .len = FILS_ERP_MAX_REALM_LEN },
838 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
839 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
840 .len = FILS_ERP_MAX_RRK_LEN },
841 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
842 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
843 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
844 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
845 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
846
847 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
848 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
849 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
850 [NL80211_ATTR_HE_CAPABILITY] =
851 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
852 NL80211_HE_MAX_CAPABILITY_LEN),
853 [NL80211_ATTR_FTM_RESPONDER] =
854 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
855 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
856 [NL80211_ATTR_PEER_MEASUREMENTS] =
857 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
858 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
859 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
860 .len = SAE_PASSWORD_MAX_LEN },
861 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
862 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
863 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
864 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
865 [NL80211_ATTR_TID_CONFIG] =
866 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
867 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
868 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
869 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
870 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
871 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
872 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
873 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
874 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
875 [NL80211_ATTR_FILS_DISCOVERY] =
876 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
877 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
878 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
879 [NL80211_ATTR_S1G_CAPABILITY] =
880 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
881 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
882 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
883 [NL80211_ATTR_SAE_PWE] =
884 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
885 NL80211_SAE_PWE_BOTH),
886 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
887 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
888 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
889 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
890 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
891 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
892 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
893 [NL80211_ATTR_MBSSID_CONFIG] =
894 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
895 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
896 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
897 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
898 [NL80211_ATTR_EHT_CAPABILITY] =
899 NLA_POLICY_RANGE(NLA_BINARY,
900 NL80211_EHT_MIN_CAPABILITY_LEN,
901 NL80211_EHT_MAX_CAPABILITY_LEN),
902 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
903 [NL80211_ATTR_MLO_LINKS] =
904 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
905 [NL80211_ATTR_MLO_LINK_ID] =
906 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
907 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
908 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
909 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
910 [NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
911 [NL80211_ATTR_PUNCT_BITMAP] =
912 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
913
914 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
915 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
916 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
917 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
918 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
919 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
920 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
921 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
922 [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
923 [NL80211_ATTR_SUPPORTED_SELECTORS] =
924 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
925 NL80211_MAX_SUPP_SELECTORS),
926 [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
927 [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
928 [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
929 [NL80211_ATTR_WIPHY_RADIO_INDEX] = { .type = NLA_U8 },
930 [NL80211_ATTR_S1G_LONG_BEACON_PERIOD] = NLA_POLICY_MIN(NLA_U8, 2),
931 [NL80211_ATTR_S1G_SHORT_BEACON] =
932 NLA_POLICY_NESTED(nl80211_s1g_short_beacon),
933 [NL80211_ATTR_BSS_PARAM] = { .type = NLA_FLAG },
934 [NL80211_ATTR_S1G_PRIMARY_2MHZ] = { .type = NLA_FLAG },
935 };
936
937 /* policy for the key attributes */
938 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
939 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
940 [NL80211_KEY_IDX] = { .type = NLA_U8 },
941 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
942 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
943 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
944 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
945 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
946 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
947 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
948 };
949
950 /* policy for the key default flags */
951 static const struct nla_policy
952 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
953 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
954 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
955 };
956
957 #ifdef CONFIG_PM
958 /* policy for WoWLAN attributes */
959 static const struct nla_policy
960 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
961 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
962 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
963 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
964 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
965 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
966 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
967 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
968 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
969 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
970 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
971 };
972
973 static const struct nla_policy
974 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
975 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
976 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
977 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
978 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
979 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
980 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
981 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
982 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
983 },
984 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
985 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
986 },
987 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
988 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
989 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
990 };
991 #endif /* CONFIG_PM */
992
993 /* policy for coalesce rule attributes */
994 static const struct nla_policy
995 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
996 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
997 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
998 NLA_POLICY_RANGE(NLA_U32,
999 NL80211_COALESCE_CONDITION_MATCH,
1000 NL80211_COALESCE_CONDITION_NO_MATCH),
1001 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
1002 };
1003
1004 /* policy for GTK rekey offload attributes */
1005 static const struct nla_policy
1006 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
1007 [NL80211_REKEY_DATA_KEK] = {
1008 .type = NLA_BINARY,
1009 .len = NL80211_KEK_EXT_LEN
1010 },
1011 [NL80211_REKEY_DATA_KCK] = {
1012 .type = NLA_BINARY,
1013 .len = NL80211_KCK_EXT_LEN_32
1014 },
1015 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
1016 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
1017 };
1018
1019 static const struct nla_policy
1020 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
1021 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
1022 .len = IEEE80211_MAX_SSID_LEN },
1023 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1024 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
1025 };
1026
1027 static const struct nla_policy
1028 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
1029 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
1030 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
1031 };
1032
1033 static const struct nla_policy
1034 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
1035 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
1036 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
1037 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
1038 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
1039 },
1040 };
1041
1042 /* policy for NAN function attributes */
1043 static const struct nla_policy
1044 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
1045 [NL80211_NAN_FUNC_TYPE] =
1046 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
1047 [NL80211_NAN_FUNC_SERVICE_ID] = {
1048 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
1049 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
1050 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
1051 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
1052 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
1053 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
1054 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
1055 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
1056 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
1057 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
1058 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
1059 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
1060 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
1061 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
1062 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
1063 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
1064 };
1065
1066 /* policy for Service Response Filter attributes */
1067 static const struct nla_policy
1068 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
1069 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
1070 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
1071 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
1072 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
1073 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
1074 };
1075
1076 /* policy for packet pattern attributes */
1077 static const struct nla_policy
1078 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
1079 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
1080 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1081 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1082 };
1083
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)1084 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1085 struct cfg80211_registered_device **rdev,
1086 struct wireless_dev **wdev,
1087 struct nlattr **attrbuf)
1088 {
1089 int err;
1090
1091 if (!cb->args[0]) {
1092 struct nlattr **attrbuf_free = NULL;
1093
1094 if (!attrbuf) {
1095 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1096 GFP_KERNEL);
1097 if (!attrbuf)
1098 return -ENOMEM;
1099 attrbuf_free = attrbuf;
1100 }
1101
1102 err = nlmsg_parse_deprecated(cb->nlh,
1103 GENL_HDRLEN + nl80211_fam.hdrsize,
1104 attrbuf, nl80211_fam.maxattr,
1105 nl80211_policy, NULL);
1106 if (err) {
1107 kfree(attrbuf_free);
1108 return err;
1109 }
1110
1111 rtnl_lock();
1112 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1113 attrbuf);
1114 kfree(attrbuf_free);
1115 if (IS_ERR(*wdev)) {
1116 rtnl_unlock();
1117 return PTR_ERR(*wdev);
1118 }
1119 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1120 mutex_lock(&(*rdev)->wiphy.mtx);
1121 rtnl_unlock();
1122 /* 0 is the first index - add 1 to parse only once */
1123 cb->args[0] = (*rdev)->wiphy_idx + 1;
1124 cb->args[1] = (*wdev)->identifier;
1125 } else {
1126 /* subtract the 1 again here */
1127 struct wiphy *wiphy;
1128 struct wireless_dev *tmp;
1129
1130 rtnl_lock();
1131 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1132 if (!wiphy) {
1133 rtnl_unlock();
1134 return -ENODEV;
1135 }
1136 *rdev = wiphy_to_rdev(wiphy);
1137 *wdev = NULL;
1138
1139 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1140 if (tmp->identifier == cb->args[1]) {
1141 *wdev = tmp;
1142 break;
1143 }
1144 }
1145
1146 if (!*wdev) {
1147 rtnl_unlock();
1148 return -ENODEV;
1149 }
1150 mutex_lock(&(*rdev)->wiphy.mtx);
1151 rtnl_unlock();
1152 }
1153
1154 return 0;
1155 }
1156
1157 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1158 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1159 int flags, u8 cmd)
1160 {
1161 /* since there is no private header just add the generic one */
1162 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1163 }
1164
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1165 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1166 const struct ieee80211_reg_rule *rule)
1167 {
1168 int j;
1169 struct nlattr *nl_wmm_rules =
1170 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1171
1172 if (!nl_wmm_rules)
1173 goto nla_put_failure;
1174
1175 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1176 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1177
1178 if (!nl_wmm_rule)
1179 goto nla_put_failure;
1180
1181 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1182 rule->wmm_rule.client[j].cw_min) ||
1183 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1184 rule->wmm_rule.client[j].cw_max) ||
1185 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1186 rule->wmm_rule.client[j].aifsn) ||
1187 nla_put_u16(msg, NL80211_WMMR_TXOP,
1188 rule->wmm_rule.client[j].cot))
1189 goto nla_put_failure;
1190
1191 nla_nest_end(msg, nl_wmm_rule);
1192 }
1193 nla_nest_end(msg, nl_wmm_rules);
1194
1195 return 0;
1196
1197 nla_put_failure:
1198 return -ENOBUFS;
1199 }
1200
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1201 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1202 struct ieee80211_channel *chan,
1203 bool large)
1204 {
1205 /* Some channels must be completely excluded from the
1206 * list to protect old user-space tools from breaking
1207 */
1208 if (!large && chan->flags &
1209 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1210 return 0;
1211 if (!large && chan->freq_offset)
1212 return 0;
1213
1214 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1215 chan->center_freq))
1216 goto nla_put_failure;
1217
1218 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1219 goto nla_put_failure;
1220
1221 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1222 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1223 goto nla_put_failure;
1224
1225 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1226 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1227 goto nla_put_failure;
1228 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1229 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1230 goto nla_put_failure;
1231 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1232 goto nla_put_failure;
1233 }
1234 if (chan->flags & IEEE80211_CHAN_RADAR) {
1235 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1236 goto nla_put_failure;
1237 if (large) {
1238 u32 time;
1239
1240 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1241
1242 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1243 chan->dfs_state))
1244 goto nla_put_failure;
1245 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1246 time))
1247 goto nla_put_failure;
1248 if (nla_put_u32(msg,
1249 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1250 chan->dfs_cac_ms))
1251 goto nla_put_failure;
1252 }
1253 }
1254
1255 if (large) {
1256 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1257 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1258 goto nla_put_failure;
1259 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1260 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1261 goto nla_put_failure;
1262 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1263 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1264 goto nla_put_failure;
1265 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1266 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1267 goto nla_put_failure;
1268 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1269 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1270 goto nla_put_failure;
1271 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1272 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1273 goto nla_put_failure;
1274 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1275 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1276 goto nla_put_failure;
1277 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1278 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1279 goto nla_put_failure;
1280 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1281 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1282 goto nla_put_failure;
1283 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1284 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1285 goto nla_put_failure;
1286 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1287 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1288 goto nla_put_failure;
1289 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1290 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1291 goto nla_put_failure;
1292 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1293 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1294 goto nla_put_failure;
1295 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1296 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1297 goto nla_put_failure;
1298 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1299 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1300 goto nla_put_failure;
1301 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1302 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1303 goto nla_put_failure;
1304 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1305 nla_put_flag(msg,
1306 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1307 goto nla_put_failure;
1308 if ((chan->flags & IEEE80211_CHAN_NO_4MHZ) &&
1309 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_4MHZ))
1310 goto nla_put_failure;
1311 if ((chan->flags & IEEE80211_CHAN_NO_8MHZ) &&
1312 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_8MHZ))
1313 goto nla_put_failure;
1314 if ((chan->flags & IEEE80211_CHAN_NO_16MHZ) &&
1315 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_16MHZ))
1316 goto nla_put_failure;
1317 }
1318
1319 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1320 DBM_TO_MBM(chan->max_power)))
1321 goto nla_put_failure;
1322
1323 if (large) {
1324 const struct ieee80211_reg_rule *rule =
1325 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1326
1327 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1328 if (nl80211_msg_put_wmm_rules(msg, rule))
1329 goto nla_put_failure;
1330 }
1331 }
1332
1333 return 0;
1334
1335 nla_put_failure:
1336 return -ENOBUFS;
1337 }
1338
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1339 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1340 struct cfg80211_txq_stats *txqstats,
1341 int attrtype)
1342 {
1343 struct nlattr *txqattr;
1344
1345 #define PUT_TXQVAL_U32(attr, memb) do { \
1346 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1347 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1348 return false; \
1349 } while (0)
1350
1351 txqattr = nla_nest_start_noflag(msg, attrtype);
1352 if (!txqattr)
1353 return false;
1354
1355 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1356 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1357 PUT_TXQVAL_U32(FLOWS, flows);
1358 PUT_TXQVAL_U32(DROPS, drops);
1359 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1360 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1361 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1362 PUT_TXQVAL_U32(COLLISIONS, collisions);
1363 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1364 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1365 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1366 nla_nest_end(msg, txqattr);
1367
1368 #undef PUT_TXQVAL_U32
1369 return true;
1370 }
1371
1372 /* netlink command implementations */
1373
1374 /**
1375 * nl80211_link_id - return link ID
1376 * @attrs: attributes to look at
1377 *
1378 * Returns: the link ID or 0 if not given
1379 *
1380 * Note this function doesn't do any validation of the link
1381 * ID validity wrt. links that were actually added, so it must
1382 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1383 * or if additional validation is done.
1384 */
nl80211_link_id(struct nlattr ** attrs)1385 static unsigned int nl80211_link_id(struct nlattr **attrs)
1386 {
1387 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1388
1389 return nla_get_u8_default(linkid, 0);
1390 }
1391
nl80211_link_id_or_invalid(struct nlattr ** attrs)1392 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1393 {
1394 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1395
1396 if (!linkid)
1397 return -1;
1398
1399 return nla_get_u8(linkid);
1400 }
1401
1402 struct key_parse {
1403 struct key_params p;
1404 int idx;
1405 int type;
1406 bool def, defmgmt, defbeacon;
1407 bool def_uni, def_multi;
1408 };
1409
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1410 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1411 struct key_parse *k)
1412 {
1413 struct nlattr *tb[NL80211_KEY_MAX + 1];
1414 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1415 nl80211_key_policy,
1416 info->extack);
1417 if (err)
1418 return err;
1419
1420 k->def = !!tb[NL80211_KEY_DEFAULT];
1421 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1422 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1423
1424 if (k->def) {
1425 k->def_uni = true;
1426 k->def_multi = true;
1427 }
1428 if (k->defmgmt || k->defbeacon)
1429 k->def_multi = true;
1430
1431 if (tb[NL80211_KEY_IDX])
1432 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1433
1434 if (tb[NL80211_KEY_DATA]) {
1435 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1436 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1437 }
1438
1439 if (tb[NL80211_KEY_SEQ]) {
1440 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1441 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1442 }
1443
1444 if (tb[NL80211_KEY_CIPHER])
1445 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1446
1447 if (tb[NL80211_KEY_TYPE])
1448 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1449
1450 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1451 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1452
1453 err = nla_parse_nested_deprecated(kdt,
1454 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1455 tb[NL80211_KEY_DEFAULT_TYPES],
1456 nl80211_key_default_policy,
1457 info->extack);
1458 if (err)
1459 return err;
1460
1461 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1462 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1463 }
1464
1465 if (tb[NL80211_KEY_MODE])
1466 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1467
1468 return 0;
1469 }
1470
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1471 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1472 {
1473 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1474 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1475 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1476 }
1477
1478 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1479 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1480 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1481 }
1482
1483 if (info->attrs[NL80211_ATTR_KEY_IDX])
1484 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1485
1486 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1487 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1488
1489 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1490 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1491
1492 if (k->def) {
1493 k->def_uni = true;
1494 k->def_multi = true;
1495 }
1496 if (k->defmgmt)
1497 k->def_multi = true;
1498
1499 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1500 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1501
1502 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1503 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1504 int err = nla_parse_nested_deprecated(kdt,
1505 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1506 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1507 nl80211_key_default_policy,
1508 info->extack);
1509 if (err)
1510 return err;
1511
1512 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1513 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1514 }
1515
1516 return 0;
1517 }
1518
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1519 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1520 {
1521 int err;
1522
1523 memset(k, 0, sizeof(*k));
1524 k->idx = -1;
1525 k->type = -1;
1526
1527 if (info->attrs[NL80211_ATTR_KEY])
1528 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1529 else
1530 err = nl80211_parse_key_old(info, k);
1531
1532 if (err)
1533 return err;
1534
1535 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1536 (k->defbeacon ? 1 : 0) > 1) {
1537 GENL_SET_ERR_MSG(info,
1538 "key with multiple default flags is invalid");
1539 return -EINVAL;
1540 }
1541
1542 if (k->defmgmt || k->defbeacon) {
1543 if (k->def_uni || !k->def_multi) {
1544 GENL_SET_ERR_MSG(info,
1545 "defmgmt/defbeacon key must be mcast");
1546 return -EINVAL;
1547 }
1548 }
1549
1550 if (k->idx != -1) {
1551 if (k->defmgmt) {
1552 if (k->idx < 4 || k->idx > 5) {
1553 GENL_SET_ERR_MSG(info,
1554 "defmgmt key idx not 4 or 5");
1555 return -EINVAL;
1556 }
1557 } else if (k->defbeacon) {
1558 if (k->idx < 6 || k->idx > 7) {
1559 GENL_SET_ERR_MSG(info,
1560 "defbeacon key idx not 6 or 7");
1561 return -EINVAL;
1562 }
1563 } else if (k->def) {
1564 if (k->idx < 0 || k->idx > 3) {
1565 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1566 return -EINVAL;
1567 }
1568 } else {
1569 if (k->idx < 0 || k->idx > 7) {
1570 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1571 return -EINVAL;
1572 }
1573 }
1574 }
1575
1576 return 0;
1577 }
1578
1579 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1580 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1581 struct genl_info *info, bool *no_ht)
1582 {
1583 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1584 struct key_parse parse;
1585 struct nlattr *key;
1586 struct cfg80211_cached_keys *result;
1587 int rem, err, def = 0;
1588 bool have_key = false;
1589
1590 nla_for_each_nested(key, keys, rem) {
1591 have_key = true;
1592 break;
1593 }
1594
1595 if (!have_key)
1596 return NULL;
1597
1598 result = kzalloc(sizeof(*result), GFP_KERNEL);
1599 if (!result)
1600 return ERR_PTR(-ENOMEM);
1601
1602 result->def = -1;
1603
1604 nla_for_each_nested(key, keys, rem) {
1605 memset(&parse, 0, sizeof(parse));
1606 parse.idx = -1;
1607
1608 err = nl80211_parse_key_new(info, key, &parse);
1609 if (err)
1610 goto error;
1611 err = -EINVAL;
1612 if (!parse.p.key)
1613 goto error;
1614 if (parse.idx < 0 || parse.idx > 3) {
1615 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1616 goto error;
1617 }
1618 if (parse.def) {
1619 if (def) {
1620 GENL_SET_ERR_MSG(info,
1621 "only one key can be default");
1622 goto error;
1623 }
1624 def = 1;
1625 result->def = parse.idx;
1626 if (!parse.def_uni || !parse.def_multi)
1627 goto error;
1628 } else if (parse.defmgmt)
1629 goto error;
1630 err = cfg80211_validate_key_settings(rdev, &parse.p,
1631 parse.idx, false, NULL);
1632 if (err)
1633 goto error;
1634 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1635 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1636 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1637 err = -EINVAL;
1638 goto error;
1639 }
1640 result->params[parse.idx].cipher = parse.p.cipher;
1641 result->params[parse.idx].key_len = parse.p.key_len;
1642 result->params[parse.idx].key = result->data[parse.idx];
1643 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1644
1645 /* must be WEP key if we got here */
1646 if (no_ht)
1647 *no_ht = true;
1648 }
1649
1650 if (result->def < 0) {
1651 err = -EINVAL;
1652 GENL_SET_ERR_MSG(info, "need a default/TX key");
1653 goto error;
1654 }
1655
1656 return result;
1657 error:
1658 kfree_sensitive(result);
1659 return ERR_PTR(err);
1660 }
1661
nl80211_key_allowed(struct wireless_dev * wdev)1662 static int nl80211_key_allowed(struct wireless_dev *wdev)
1663 {
1664 lockdep_assert_wiphy(wdev->wiphy);
1665
1666 switch (wdev->iftype) {
1667 case NL80211_IFTYPE_AP:
1668 case NL80211_IFTYPE_AP_VLAN:
1669 case NL80211_IFTYPE_P2P_GO:
1670 case NL80211_IFTYPE_MESH_POINT:
1671 break;
1672 case NL80211_IFTYPE_ADHOC:
1673 if (wdev->u.ibss.current_bss)
1674 return 0;
1675 return -ENOLINK;
1676 case NL80211_IFTYPE_STATION:
1677 case NL80211_IFTYPE_P2P_CLIENT:
1678 if (wdev->connected)
1679 return 0;
1680 return -ENOLINK;
1681 case NL80211_IFTYPE_NAN:
1682 if (wiphy_ext_feature_isset(wdev->wiphy,
1683 NL80211_EXT_FEATURE_SECURE_NAN))
1684 return 0;
1685 return -EINVAL;
1686 case NL80211_IFTYPE_UNSPECIFIED:
1687 case NL80211_IFTYPE_OCB:
1688 case NL80211_IFTYPE_MONITOR:
1689 case NL80211_IFTYPE_P2P_DEVICE:
1690 case NL80211_IFTYPE_WDS:
1691 case NUM_NL80211_IFTYPES:
1692 return -EINVAL;
1693 }
1694
1695 return 0;
1696 }
1697
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1698 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1699 u32 freq)
1700 {
1701 struct ieee80211_channel *chan;
1702
1703 chan = ieee80211_get_channel_khz(wiphy, freq);
1704 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1705 return NULL;
1706 return chan;
1707 }
1708
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1709 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1710 {
1711 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1712 int i;
1713
1714 if (!nl_modes)
1715 goto nla_put_failure;
1716
1717 i = 0;
1718 while (ifmodes) {
1719 if ((ifmodes & 1) && nla_put_flag(msg, i))
1720 goto nla_put_failure;
1721 ifmodes >>= 1;
1722 i++;
1723 }
1724
1725 nla_nest_end(msg, nl_modes);
1726 return 0;
1727
1728 nla_put_failure:
1729 return -ENOBUFS;
1730 }
1731
nl80211_put_ifcomb_data(struct sk_buff * msg,bool large,int idx,const struct ieee80211_iface_combination * c,u16 nested)1732 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1733 const struct ieee80211_iface_combination *c,
1734 u16 nested)
1735 {
1736 struct nlattr *nl_combi, *nl_limits;
1737 int i;
1738
1739 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1740 if (!nl_combi)
1741 goto nla_put_failure;
1742
1743 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1744 nested);
1745 if (!nl_limits)
1746 goto nla_put_failure;
1747
1748 for (i = 0; i < c->n_limits; i++) {
1749 struct nlattr *nl_limit;
1750
1751 nl_limit = nla_nest_start_noflag(msg, i + 1);
1752 if (!nl_limit)
1753 goto nla_put_failure;
1754 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1755 goto nla_put_failure;
1756 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1757 c->limits[i].types))
1758 goto nla_put_failure;
1759 nla_nest_end(msg, nl_limit);
1760 }
1761
1762 nla_nest_end(msg, nl_limits);
1763
1764 if (c->beacon_int_infra_match &&
1765 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1766 goto nla_put_failure;
1767 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1768 c->num_different_channels) ||
1769 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1770 c->max_interfaces))
1771 goto nla_put_failure;
1772 if (large &&
1773 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1774 c->radar_detect_widths) ||
1775 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1776 c->radar_detect_regions)))
1777 goto nla_put_failure;
1778 if (c->beacon_int_min_gcd &&
1779 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1780 c->beacon_int_min_gcd))
1781 goto nla_put_failure;
1782
1783 nla_nest_end(msg, nl_combi);
1784
1785 return 0;
1786 nla_put_failure:
1787 return -ENOBUFS;
1788 }
1789
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,int attr,int radio,bool large,u16 nested)1790 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1791 struct sk_buff *msg,
1792 int attr, int radio,
1793 bool large, u16 nested)
1794 {
1795 const struct ieee80211_iface_combination *c;
1796 struct nlattr *nl_combis;
1797 int i, n;
1798
1799 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1800 if (!nl_combis)
1801 goto nla_put_failure;
1802
1803 if (radio >= 0) {
1804 c = wiphy->radio[0].iface_combinations;
1805 n = wiphy->radio[0].n_iface_combinations;
1806 } else {
1807 c = wiphy->iface_combinations;
1808 n = wiphy->n_iface_combinations;
1809 }
1810 for (i = 0; i < n; i++)
1811 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1812 goto nla_put_failure;
1813
1814 nla_nest_end(msg, nl_combis);
1815
1816 return 0;
1817 nla_put_failure:
1818 return -ENOBUFS;
1819 }
1820
1821 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1822 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1823 struct sk_buff *msg)
1824 {
1825 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1826 struct nlattr *nl_tcp;
1827
1828 if (!tcp)
1829 return 0;
1830
1831 nl_tcp = nla_nest_start_noflag(msg,
1832 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1833 if (!nl_tcp)
1834 return -ENOBUFS;
1835
1836 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1837 tcp->data_payload_max))
1838 return -ENOBUFS;
1839
1840 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1841 tcp->data_payload_max))
1842 return -ENOBUFS;
1843
1844 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1845 return -ENOBUFS;
1846
1847 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1848 sizeof(*tcp->tok), tcp->tok))
1849 return -ENOBUFS;
1850
1851 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1852 tcp->data_interval_max))
1853 return -ENOBUFS;
1854
1855 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1856 tcp->wake_payload_max))
1857 return -ENOBUFS;
1858
1859 nla_nest_end(msg, nl_tcp);
1860 return 0;
1861 }
1862
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1863 static int nl80211_send_wowlan(struct sk_buff *msg,
1864 struct cfg80211_registered_device *rdev,
1865 bool large)
1866 {
1867 struct nlattr *nl_wowlan;
1868
1869 if (!rdev->wiphy.wowlan)
1870 return 0;
1871
1872 nl_wowlan = nla_nest_start_noflag(msg,
1873 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1874 if (!nl_wowlan)
1875 return -ENOBUFS;
1876
1877 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1878 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1879 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1880 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1881 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1882 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1883 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1884 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1885 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1886 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1887 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1888 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1889 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1890 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1891 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1892 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1893 return -ENOBUFS;
1894
1895 if (rdev->wiphy.wowlan->n_patterns) {
1896 struct nl80211_pattern_support pat = {
1897 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1898 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1899 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1900 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1901 };
1902
1903 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1904 sizeof(pat), &pat))
1905 return -ENOBUFS;
1906 }
1907
1908 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1909 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1910 rdev->wiphy.wowlan->max_nd_match_sets))
1911 return -ENOBUFS;
1912
1913 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1914 return -ENOBUFS;
1915
1916 nla_nest_end(msg, nl_wowlan);
1917
1918 return 0;
1919 }
1920 #endif
1921
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1922 static int nl80211_send_coalesce(struct sk_buff *msg,
1923 struct cfg80211_registered_device *rdev)
1924 {
1925 struct nl80211_coalesce_rule_support rule;
1926
1927 if (!rdev->wiphy.coalesce)
1928 return 0;
1929
1930 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1931 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1932 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1933 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1934 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1935 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1936
1937 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1938 return -ENOBUFS;
1939
1940 return 0;
1941 }
1942
1943 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1944 nl80211_send_iftype_data(struct sk_buff *msg,
1945 const struct ieee80211_supported_band *sband,
1946 const struct ieee80211_sband_iftype_data *iftdata)
1947 {
1948 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1949 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1950
1951 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1952 iftdata->types_mask))
1953 return -ENOBUFS;
1954
1955 if (he_cap->has_he) {
1956 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1957 sizeof(he_cap->he_cap_elem.mac_cap_info),
1958 he_cap->he_cap_elem.mac_cap_info) ||
1959 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1960 sizeof(he_cap->he_cap_elem.phy_cap_info),
1961 he_cap->he_cap_elem.phy_cap_info) ||
1962 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1963 sizeof(he_cap->he_mcs_nss_supp),
1964 &he_cap->he_mcs_nss_supp) ||
1965 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1966 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1967 return -ENOBUFS;
1968 }
1969
1970 if (eht_cap->has_eht && he_cap->has_he) {
1971 u8 mcs_nss_size, ppe_thresh_size;
1972 u16 ppe_thres_hdr;
1973 bool is_ap;
1974
1975 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1976 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1977
1978 mcs_nss_size =
1979 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1980 &eht_cap->eht_cap_elem,
1981 is_ap);
1982
1983 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1984 ppe_thresh_size =
1985 ieee80211_eht_ppe_size(ppe_thres_hdr,
1986 eht_cap->eht_cap_elem.phy_cap_info);
1987
1988 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1989 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1990 eht_cap->eht_cap_elem.mac_cap_info) ||
1991 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1992 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1993 eht_cap->eht_cap_elem.phy_cap_info) ||
1994 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1995 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1996 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1997 ppe_thresh_size, eht_cap->eht_ppe_thres))
1998 return -ENOBUFS;
1999 }
2000
2001 if (sband->band == NL80211_BAND_6GHZ &&
2002 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
2003 sizeof(iftdata->he_6ghz_capa),
2004 &iftdata->he_6ghz_capa))
2005 return -ENOBUFS;
2006
2007 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
2008 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
2009 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
2010 return -ENOBUFS;
2011
2012 return 0;
2013 }
2014
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)2015 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
2016 struct ieee80211_supported_band *sband,
2017 bool large)
2018 {
2019 struct nlattr *nl_rates, *nl_rate;
2020 struct ieee80211_rate *rate;
2021 int i;
2022
2023 /* add HT info */
2024 if (sband->ht_cap.ht_supported &&
2025 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
2026 sizeof(sband->ht_cap.mcs),
2027 &sband->ht_cap.mcs) ||
2028 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
2029 sband->ht_cap.cap) ||
2030 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
2031 sband->ht_cap.ampdu_factor) ||
2032 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
2033 sband->ht_cap.ampdu_density)))
2034 return -ENOBUFS;
2035
2036 /* add VHT info */
2037 if (sband->vht_cap.vht_supported &&
2038 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
2039 sizeof(sband->vht_cap.vht_mcs),
2040 &sband->vht_cap.vht_mcs) ||
2041 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
2042 sband->vht_cap.cap)))
2043 return -ENOBUFS;
2044
2045 if (large && sband->n_iftype_data) {
2046 struct nlattr *nl_iftype_data =
2047 nla_nest_start_noflag(msg,
2048 NL80211_BAND_ATTR_IFTYPE_DATA);
2049 const struct ieee80211_sband_iftype_data *iftd;
2050 int err;
2051
2052 if (!nl_iftype_data)
2053 return -ENOBUFS;
2054
2055 for_each_sband_iftype_data(sband, i, iftd) {
2056 struct nlattr *iftdata;
2057
2058 iftdata = nla_nest_start_noflag(msg, i + 1);
2059 if (!iftdata)
2060 return -ENOBUFS;
2061
2062 err = nl80211_send_iftype_data(msg, sband, iftd);
2063 if (err)
2064 return err;
2065
2066 nla_nest_end(msg, iftdata);
2067 }
2068
2069 nla_nest_end(msg, nl_iftype_data);
2070 }
2071
2072 /* add EDMG info */
2073 if (large && sband->edmg_cap.channels &&
2074 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2075 sband->edmg_cap.channels) ||
2076 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2077 sband->edmg_cap.bw_config)))
2078
2079 return -ENOBUFS;
2080
2081 /* add bitrates */
2082 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2083 if (!nl_rates)
2084 return -ENOBUFS;
2085
2086 for (i = 0; i < sband->n_bitrates; i++) {
2087 nl_rate = nla_nest_start_noflag(msg, i);
2088 if (!nl_rate)
2089 return -ENOBUFS;
2090
2091 rate = &sband->bitrates[i];
2092 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2093 rate->bitrate))
2094 return -ENOBUFS;
2095 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2096 nla_put_flag(msg,
2097 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2098 return -ENOBUFS;
2099
2100 nla_nest_end(msg, nl_rate);
2101 }
2102
2103 nla_nest_end(msg, nl_rates);
2104
2105 /* S1G capabilities */
2106 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2107 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2108 sizeof(sband->s1g_cap.cap),
2109 sband->s1g_cap.cap) ||
2110 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2111 sizeof(sband->s1g_cap.nss_mcs),
2112 sband->s1g_cap.nss_mcs)))
2113 return -ENOBUFS;
2114
2115 return 0;
2116 }
2117
2118 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)2119 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2120 const struct ieee80211_txrx_stypes *mgmt_stypes)
2121 {
2122 u16 stypes;
2123 struct nlattr *nl_ftypes, *nl_ifs;
2124 enum nl80211_iftype ift;
2125 int i;
2126
2127 if (!mgmt_stypes)
2128 return 0;
2129
2130 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2131 if (!nl_ifs)
2132 return -ENOBUFS;
2133
2134 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2135 nl_ftypes = nla_nest_start_noflag(msg, ift);
2136 if (!nl_ftypes)
2137 return -ENOBUFS;
2138 i = 0;
2139 stypes = mgmt_stypes[ift].tx;
2140 while (stypes) {
2141 if ((stypes & 1) &&
2142 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2143 (i << 4) | IEEE80211_FTYPE_MGMT))
2144 return -ENOBUFS;
2145 stypes >>= 1;
2146 i++;
2147 }
2148 nla_nest_end(msg, nl_ftypes);
2149 }
2150
2151 nla_nest_end(msg, nl_ifs);
2152
2153 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2154 if (!nl_ifs)
2155 return -ENOBUFS;
2156
2157 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2158 nl_ftypes = nla_nest_start_noflag(msg, ift);
2159 if (!nl_ftypes)
2160 return -ENOBUFS;
2161 i = 0;
2162 stypes = mgmt_stypes[ift].rx;
2163 while (stypes) {
2164 if ((stypes & 1) &&
2165 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2166 (i << 4) | IEEE80211_FTYPE_MGMT))
2167 return -ENOBUFS;
2168 stypes >>= 1;
2169 i++;
2170 }
2171 nla_nest_end(msg, nl_ftypes);
2172 }
2173 nla_nest_end(msg, nl_ifs);
2174
2175 return 0;
2176 }
2177
2178 #define CMD(op, n) \
2179 do { \
2180 if (rdev->ops->op) { \
2181 i++; \
2182 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2183 goto nla_put_failure; \
2184 } \
2185 } while (0)
2186
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2187 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2188 struct sk_buff *msg)
2189 {
2190 int i = 0;
2191
2192 /*
2193 * do *NOT* add anything into this function, new things need to be
2194 * advertised only to new versions of userspace that can deal with
2195 * the split (and they can't possibly care about new features...
2196 */
2197 CMD(add_virtual_intf, NEW_INTERFACE);
2198 CMD(change_virtual_intf, SET_INTERFACE);
2199 CMD(add_key, NEW_KEY);
2200 CMD(start_ap, START_AP);
2201 CMD(add_station, NEW_STATION);
2202 CMD(add_mpath, NEW_MPATH);
2203 CMD(update_mesh_config, SET_MESH_CONFIG);
2204 CMD(change_bss, SET_BSS);
2205 CMD(auth, AUTHENTICATE);
2206 CMD(assoc, ASSOCIATE);
2207 CMD(deauth, DEAUTHENTICATE);
2208 CMD(disassoc, DISASSOCIATE);
2209 CMD(join_ibss, JOIN_IBSS);
2210 CMD(join_mesh, JOIN_MESH);
2211 CMD(set_pmksa, SET_PMKSA);
2212 CMD(del_pmksa, DEL_PMKSA);
2213 CMD(flush_pmksa, FLUSH_PMKSA);
2214 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2215 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2216 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2217 CMD(mgmt_tx, FRAME);
2218 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2219 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2220 i++;
2221 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2222 goto nla_put_failure;
2223 }
2224 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2225 rdev->ops->join_mesh) {
2226 i++;
2227 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2228 goto nla_put_failure;
2229 }
2230 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2231 CMD(tdls_mgmt, TDLS_MGMT);
2232 CMD(tdls_oper, TDLS_OPER);
2233 }
2234 if (rdev->wiphy.max_sched_scan_reqs)
2235 CMD(sched_scan_start, START_SCHED_SCAN);
2236 CMD(probe_client, PROBE_CLIENT);
2237 CMD(set_noack_map, SET_NOACK_MAP);
2238 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2239 i++;
2240 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2241 goto nla_put_failure;
2242 }
2243 CMD(start_p2p_device, START_P2P_DEVICE);
2244 CMD(set_mcast_rate, SET_MCAST_RATE);
2245 #ifdef CONFIG_NL80211_TESTMODE
2246 CMD(testmode_cmd, TESTMODE);
2247 #endif
2248
2249 if (rdev->ops->connect || rdev->ops->auth) {
2250 i++;
2251 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2252 goto nla_put_failure;
2253 }
2254
2255 if (rdev->ops->disconnect || rdev->ops->deauth) {
2256 i++;
2257 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2258 goto nla_put_failure;
2259 }
2260
2261 return i;
2262 nla_put_failure:
2263 return -ENOBUFS;
2264 }
2265
2266 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2267 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2268 struct sk_buff *msg)
2269 {
2270 struct nlattr *ftm;
2271
2272 if (!cap->ftm.supported)
2273 return 0;
2274
2275 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2276 if (!ftm)
2277 return -ENOBUFS;
2278
2279 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2280 return -ENOBUFS;
2281 if (cap->ftm.non_asap &&
2282 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2283 return -ENOBUFS;
2284 if (cap->ftm.request_lci &&
2285 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2286 return -ENOBUFS;
2287 if (cap->ftm.request_civicloc &&
2288 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2289 return -ENOBUFS;
2290 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2291 cap->ftm.preambles))
2292 return -ENOBUFS;
2293 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2294 cap->ftm.bandwidths))
2295 return -ENOBUFS;
2296 if (cap->ftm.max_bursts_exponent >= 0 &&
2297 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2298 cap->ftm.max_bursts_exponent))
2299 return -ENOBUFS;
2300 if (cap->ftm.max_ftms_per_burst &&
2301 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2302 cap->ftm.max_ftms_per_burst))
2303 return -ENOBUFS;
2304 if (cap->ftm.trigger_based &&
2305 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2306 return -ENOBUFS;
2307 if (cap->ftm.non_trigger_based &&
2308 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2309 return -ENOBUFS;
2310
2311 nla_nest_end(msg, ftm);
2312 return 0;
2313 }
2314
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2315 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2316 struct sk_buff *msg)
2317 {
2318 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2319 struct nlattr *pmsr, *caps;
2320
2321 if (!cap)
2322 return 0;
2323
2324 /*
2325 * we don't need to clean up anything here since the caller
2326 * will genlmsg_cancel() if we fail
2327 */
2328
2329 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2330 if (!pmsr)
2331 return -ENOBUFS;
2332
2333 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2334 return -ENOBUFS;
2335
2336 if (cap->report_ap_tsf &&
2337 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2338 return -ENOBUFS;
2339
2340 if (cap->randomize_mac_addr &&
2341 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2342 return -ENOBUFS;
2343
2344 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2345 if (!caps)
2346 return -ENOBUFS;
2347
2348 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2349 return -ENOBUFS;
2350
2351 nla_nest_end(msg, caps);
2352 nla_nest_end(msg, pmsr);
2353
2354 return 0;
2355 }
2356
2357 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2358 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2359 struct sk_buff *msg)
2360 {
2361 int i;
2362 struct nlattr *nested, *nested_akms;
2363 const struct wiphy_iftype_akm_suites *iftype_akms;
2364
2365 if (!rdev->wiphy.num_iftype_akm_suites ||
2366 !rdev->wiphy.iftype_akm_suites)
2367 return 0;
2368
2369 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2370 if (!nested)
2371 return -ENOBUFS;
2372
2373 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2374 nested_akms = nla_nest_start(msg, i + 1);
2375 if (!nested_akms)
2376 return -ENOBUFS;
2377
2378 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2379
2380 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2381 iftype_akms->iftypes_mask))
2382 return -ENOBUFS;
2383
2384 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2385 sizeof(u32) * iftype_akms->n_akm_suites,
2386 iftype_akms->akm_suites)) {
2387 return -ENOBUFS;
2388 }
2389 nla_nest_end(msg, nested_akms);
2390 }
2391
2392 nla_nest_end(msg, nested);
2393
2394 return 0;
2395 }
2396
2397 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2398 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2399 struct sk_buff *msg)
2400 {
2401 struct nlattr *supp;
2402
2403 if (!rdev->wiphy.tid_config_support.vif &&
2404 !rdev->wiphy.tid_config_support.peer)
2405 return 0;
2406
2407 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2408 if (!supp)
2409 return -ENOSPC;
2410
2411 if (rdev->wiphy.tid_config_support.vif &&
2412 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2413 rdev->wiphy.tid_config_support.vif,
2414 NL80211_TID_CONFIG_ATTR_PAD))
2415 goto fail;
2416
2417 if (rdev->wiphy.tid_config_support.peer &&
2418 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2419 rdev->wiphy.tid_config_support.peer,
2420 NL80211_TID_CONFIG_ATTR_PAD))
2421 goto fail;
2422
2423 /* for now we just use the same value ... makes more sense */
2424 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2425 rdev->wiphy.tid_config_support.max_retry))
2426 goto fail;
2427 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2428 rdev->wiphy.tid_config_support.max_retry))
2429 goto fail;
2430
2431 nla_nest_end(msg, supp);
2432
2433 return 0;
2434 fail:
2435 nla_nest_cancel(msg, supp);
2436 return -ENOBUFS;
2437 }
2438
2439 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2440 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2441 struct sk_buff *msg)
2442 {
2443 struct nlattr *sar_capa, *specs, *sub_freq_range;
2444 u8 num_freq_ranges;
2445 int i;
2446
2447 if (!rdev->wiphy.sar_capa)
2448 return 0;
2449
2450 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2451
2452 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2453 if (!sar_capa)
2454 return -ENOSPC;
2455
2456 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2457 goto fail;
2458
2459 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2460 if (!specs)
2461 goto fail;
2462
2463 /* report supported freq_ranges */
2464 for (i = 0; i < num_freq_ranges; i++) {
2465 sub_freq_range = nla_nest_start(msg, i + 1);
2466 if (!sub_freq_range)
2467 goto fail;
2468
2469 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2470 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2471 goto fail;
2472
2473 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2474 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2475 goto fail;
2476
2477 nla_nest_end(msg, sub_freq_range);
2478 }
2479
2480 nla_nest_end(msg, specs);
2481 nla_nest_end(msg, sar_capa);
2482
2483 return 0;
2484 fail:
2485 nla_nest_cancel(msg, sar_capa);
2486 return -ENOBUFS;
2487 }
2488
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2489 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2490 {
2491 struct nlattr *config;
2492
2493 if (!wiphy->mbssid_max_interfaces)
2494 return 0;
2495
2496 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2497 if (!config)
2498 return -ENOBUFS;
2499
2500 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2501 wiphy->mbssid_max_interfaces))
2502 goto fail;
2503
2504 if (wiphy->ema_max_profile_periodicity &&
2505 nla_put_u8(msg,
2506 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2507 wiphy->ema_max_profile_periodicity))
2508 goto fail;
2509
2510 nla_nest_end(msg, config);
2511 return 0;
2512
2513 fail:
2514 nla_nest_cancel(msg, config);
2515 return -ENOBUFS;
2516 }
2517
nl80211_put_radio(struct wiphy * wiphy,struct sk_buff * msg,int idx)2518 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2519 {
2520 const struct wiphy_radio *r = &wiphy->radio[idx];
2521 const struct wiphy_radio_cfg *rcfg = &wiphy->radio_cfg[idx];
2522 struct nlattr *radio, *freq;
2523 int i;
2524
2525 radio = nla_nest_start(msg, idx);
2526 if (!radio)
2527 return -ENOBUFS;
2528
2529 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2530 goto nla_put_failure;
2531
2532 if (rcfg->rts_threshold &&
2533 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD,
2534 rcfg->rts_threshold))
2535 goto nla_put_failure;
2536
2537 if (r->antenna_mask &&
2538 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2539 r->antenna_mask))
2540 goto nla_put_failure;
2541
2542 for (i = 0; i < r->n_freq_range; i++) {
2543 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2544
2545 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2546 if (!freq)
2547 goto nla_put_failure;
2548
2549 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2550 range->start_freq) ||
2551 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2552 range->end_freq))
2553 goto nla_put_failure;
2554
2555 nla_nest_end(msg, freq);
2556 }
2557
2558 for (i = 0; i < r->n_iface_combinations; i++)
2559 if (nl80211_put_ifcomb_data(msg, true,
2560 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2561 &r->iface_combinations[i],
2562 NLA_F_NESTED))
2563 goto nla_put_failure;
2564
2565 nla_nest_end(msg, radio);
2566
2567 return 0;
2568
2569 nla_put_failure:
2570 return -ENOBUFS;
2571 }
2572
nl80211_put_radios(struct wiphy * wiphy,struct sk_buff * msg)2573 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2574 {
2575 struct nlattr *radios;
2576 int i;
2577
2578 if (!wiphy->n_radio)
2579 return 0;
2580
2581 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2582 if (!radios)
2583 return -ENOBUFS;
2584
2585 for (i = 0; i < wiphy->n_radio; i++)
2586 if (nl80211_put_radio(wiphy, msg, i))
2587 goto fail;
2588
2589 nla_nest_end(msg, radios);
2590
2591 if (nl80211_put_iface_combinations(wiphy, msg,
2592 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2593 -1, true, NLA_F_NESTED))
2594 return -ENOBUFS;
2595
2596 return 0;
2597
2598 fail:
2599 nla_nest_cancel(msg, radios);
2600 return -ENOBUFS;
2601 }
2602
nl80211_put_nan_capa(struct wiphy * wiphy,struct sk_buff * msg)2603 static int nl80211_put_nan_capa(struct wiphy *wiphy, struct sk_buff *msg)
2604 {
2605 struct nlattr *nan_caps;
2606
2607 nan_caps = nla_nest_start(msg, NL80211_ATTR_NAN_CAPABILITIES);
2608 if (!nan_caps)
2609 return -ENOBUFS;
2610
2611 if (wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC &&
2612 nla_put_flag(msg, NL80211_NAN_CAPA_CONFIGURABLE_SYNC))
2613 goto fail;
2614
2615 if ((wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_USERSPACE_DE) &&
2616 nla_put_flag(msg, NL80211_NAN_CAPA_USERSPACE_DE))
2617 goto fail;
2618
2619 if (nla_put_u8(msg, NL80211_NAN_CAPA_OP_MODE,
2620 wiphy->nan_capa.op_mode) ||
2621 nla_put_u8(msg, NL80211_NAN_CAPA_NUM_ANTENNAS,
2622 wiphy->nan_capa.n_antennas) ||
2623 nla_put_u16(msg, NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME,
2624 wiphy->nan_capa.max_channel_switch_time) ||
2625 nla_put_u8(msg, NL80211_NAN_CAPA_CAPABILITIES,
2626 wiphy->nan_capa.dev_capabilities))
2627 goto fail;
2628
2629 nla_nest_end(msg, nan_caps);
2630
2631 return 0;
2632
2633 fail:
2634 nla_nest_cancel(msg, nan_caps);
2635 return -ENOBUFS;
2636 }
2637
2638 struct nl80211_dump_wiphy_state {
2639 s64 filter_wiphy;
2640 long start;
2641 long split_start, band_start, chan_start, capa_start;
2642 bool split;
2643 };
2644
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2645 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2646 enum nl80211_commands cmd,
2647 struct sk_buff *msg, u32 portid, u32 seq,
2648 int flags, struct nl80211_dump_wiphy_state *state)
2649 {
2650 void *hdr;
2651 struct nlattr *nl_bands, *nl_band;
2652 struct nlattr *nl_freqs, *nl_freq;
2653 struct nlattr *nl_cmds;
2654 enum nl80211_band band;
2655 struct ieee80211_channel *chan;
2656 int i;
2657 const struct ieee80211_txrx_stypes *mgmt_stypes =
2658 rdev->wiphy.mgmt_stypes;
2659 u32 features;
2660
2661 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2662 if (!hdr)
2663 return -ENOBUFS;
2664
2665 if (WARN_ON(!state))
2666 return -EINVAL;
2667
2668 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2669 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2670 wiphy_name(&rdev->wiphy)) ||
2671 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2672 cfg80211_rdev_list_generation))
2673 goto nla_put_failure;
2674
2675 if (cmd != NL80211_CMD_NEW_WIPHY)
2676 goto finish;
2677
2678 switch (state->split_start) {
2679 case 0:
2680 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2681 rdev->wiphy.retry_short) ||
2682 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2683 rdev->wiphy.retry_long) ||
2684 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2685 rdev->wiphy.frag_threshold) ||
2686 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2687 rdev->wiphy.rts_threshold) ||
2688 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2689 rdev->wiphy.coverage_class) ||
2690 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2691 rdev->wiphy.max_scan_ssids) ||
2692 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2693 rdev->wiphy.max_sched_scan_ssids) ||
2694 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2695 rdev->wiphy.max_scan_ie_len) ||
2696 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2697 rdev->wiphy.max_sched_scan_ie_len) ||
2698 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2699 rdev->wiphy.max_match_sets))
2700 goto nla_put_failure;
2701
2702 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2703 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2704 goto nla_put_failure;
2705 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2706 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2707 goto nla_put_failure;
2708 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2709 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2710 goto nla_put_failure;
2711 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2712 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2713 goto nla_put_failure;
2714 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2715 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2716 goto nla_put_failure;
2717 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2718 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2719 goto nla_put_failure;
2720 state->split_start++;
2721 if (state->split)
2722 break;
2723 fallthrough;
2724 case 1:
2725 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2726 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2727 rdev->wiphy.cipher_suites))
2728 goto nla_put_failure;
2729
2730 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2731 rdev->wiphy.max_num_pmkids))
2732 goto nla_put_failure;
2733
2734 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2735 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2736 goto nla_put_failure;
2737
2738 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2739 rdev->wiphy.available_antennas_tx) ||
2740 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2741 rdev->wiphy.available_antennas_rx))
2742 goto nla_put_failure;
2743
2744 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2745 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2746 rdev->wiphy.probe_resp_offload))
2747 goto nla_put_failure;
2748
2749 if ((rdev->wiphy.available_antennas_tx ||
2750 rdev->wiphy.available_antennas_rx) &&
2751 rdev->ops->get_antenna) {
2752 u32 tx_ant = 0, rx_ant = 0;
2753 int res;
2754
2755 res = rdev_get_antenna(rdev, -1, &tx_ant, &rx_ant);
2756 if (!res) {
2757 if (nla_put_u32(msg,
2758 NL80211_ATTR_WIPHY_ANTENNA_TX,
2759 tx_ant) ||
2760 nla_put_u32(msg,
2761 NL80211_ATTR_WIPHY_ANTENNA_RX,
2762 rx_ant))
2763 goto nla_put_failure;
2764 }
2765 }
2766
2767 state->split_start++;
2768 if (state->split)
2769 break;
2770 fallthrough;
2771 case 2:
2772 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2773 rdev->wiphy.interface_modes))
2774 goto nla_put_failure;
2775 state->split_start++;
2776 if (state->split)
2777 break;
2778 fallthrough;
2779 case 3:
2780 nl_bands = nla_nest_start_noflag(msg,
2781 NL80211_ATTR_WIPHY_BANDS);
2782 if (!nl_bands)
2783 goto nla_put_failure;
2784
2785 for (band = state->band_start;
2786 band < (state->split ?
2787 NUM_NL80211_BANDS :
2788 NL80211_BAND_60GHZ + 1);
2789 band++) {
2790 struct ieee80211_supported_band *sband;
2791
2792 /* omit higher bands for ancient software */
2793 if (band > NL80211_BAND_5GHZ && !state->split)
2794 break;
2795
2796 sband = rdev->wiphy.bands[band];
2797
2798 if (!sband)
2799 continue;
2800
2801 nl_band = nla_nest_start_noflag(msg, band);
2802 if (!nl_band)
2803 goto nla_put_failure;
2804
2805 switch (state->chan_start) {
2806 case 0:
2807 if (nl80211_send_band_rateinfo(msg, sband,
2808 state->split))
2809 goto nla_put_failure;
2810 state->chan_start++;
2811 if (state->split)
2812 break;
2813 fallthrough;
2814 default:
2815 /* add frequencies */
2816 nl_freqs = nla_nest_start_noflag(msg,
2817 NL80211_BAND_ATTR_FREQS);
2818 if (!nl_freqs)
2819 goto nla_put_failure;
2820
2821 for (i = state->chan_start - 1;
2822 i < sband->n_channels;
2823 i++) {
2824 nl_freq = nla_nest_start_noflag(msg,
2825 i);
2826 if (!nl_freq)
2827 goto nla_put_failure;
2828
2829 chan = &sband->channels[i];
2830
2831 if (nl80211_msg_put_channel(
2832 msg, &rdev->wiphy, chan,
2833 state->split))
2834 goto nla_put_failure;
2835
2836 nla_nest_end(msg, nl_freq);
2837 if (state->split)
2838 break;
2839 }
2840 if (i < sband->n_channels)
2841 state->chan_start = i + 2;
2842 else
2843 state->chan_start = 0;
2844 nla_nest_end(msg, nl_freqs);
2845 }
2846
2847 nla_nest_end(msg, nl_band);
2848
2849 if (state->split) {
2850 /* start again here */
2851 if (state->chan_start)
2852 band--;
2853 break;
2854 }
2855 }
2856 nla_nest_end(msg, nl_bands);
2857
2858 if (band < NUM_NL80211_BANDS)
2859 state->band_start = band + 1;
2860 else
2861 state->band_start = 0;
2862
2863 /* if bands & channels are done, continue outside */
2864 if (state->band_start == 0 && state->chan_start == 0)
2865 state->split_start++;
2866 if (state->split)
2867 break;
2868 fallthrough;
2869 case 4:
2870 nl_cmds = nla_nest_start_noflag(msg,
2871 NL80211_ATTR_SUPPORTED_COMMANDS);
2872 if (!nl_cmds)
2873 goto nla_put_failure;
2874
2875 i = nl80211_add_commands_unsplit(rdev, msg);
2876 if (i < 0)
2877 goto nla_put_failure;
2878 if (state->split) {
2879 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2880 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2881 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2882 CMD(channel_switch, CHANNEL_SWITCH);
2883 CMD(set_qos_map, SET_QOS_MAP);
2884 if (rdev->wiphy.features &
2885 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2886 CMD(add_tx_ts, ADD_TX_TS);
2887 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2888 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2889 CMD(update_ft_ies, UPDATE_FT_IES);
2890 if (rdev->wiphy.sar_capa)
2891 CMD(set_sar_specs, SET_SAR_SPECS);
2892 CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2893 }
2894 #undef CMD
2895
2896 nla_nest_end(msg, nl_cmds);
2897 state->split_start++;
2898 if (state->split)
2899 break;
2900 fallthrough;
2901 case 5:
2902 if (rdev->ops->remain_on_channel &&
2903 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2904 nla_put_u32(msg,
2905 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2906 rdev->wiphy.max_remain_on_channel_duration))
2907 goto nla_put_failure;
2908
2909 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2910 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2911 goto nla_put_failure;
2912
2913 state->split_start++;
2914 if (state->split)
2915 break;
2916 fallthrough;
2917 case 6:
2918 #ifdef CONFIG_PM
2919 if (nl80211_send_wowlan(msg, rdev, state->split))
2920 goto nla_put_failure;
2921 state->split_start++;
2922 if (state->split)
2923 break;
2924 #else
2925 state->split_start++;
2926 #endif
2927 fallthrough;
2928 case 7:
2929 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2930 rdev->wiphy.software_iftypes))
2931 goto nla_put_failure;
2932
2933 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2934 NL80211_ATTR_INTERFACE_COMBINATIONS,
2935 rdev->wiphy.n_radio ? 0 : -1,
2936 state->split, 0))
2937 goto nla_put_failure;
2938
2939 state->split_start++;
2940 if (state->split)
2941 break;
2942 fallthrough;
2943 case 8:
2944 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2945 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2946 rdev->wiphy.ap_sme_capa))
2947 goto nla_put_failure;
2948
2949 features = rdev->wiphy.features;
2950 /*
2951 * We can only add the per-channel limit information if the
2952 * dump is split, otherwise it makes it too big. Therefore
2953 * only advertise it in that case.
2954 */
2955 if (state->split)
2956 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2957 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2958 goto nla_put_failure;
2959
2960 if (rdev->wiphy.ht_capa_mod_mask &&
2961 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2962 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2963 rdev->wiphy.ht_capa_mod_mask))
2964 goto nla_put_failure;
2965
2966 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2967 rdev->wiphy.max_acl_mac_addrs &&
2968 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2969 rdev->wiphy.max_acl_mac_addrs))
2970 goto nla_put_failure;
2971
2972 /*
2973 * Any information below this point is only available to
2974 * applications that can deal with it being split. This
2975 * helps ensure that newly added capabilities don't break
2976 * older tools by overrunning their buffers.
2977 *
2978 * We still increment split_start so that in the split
2979 * case we'll continue with more data in the next round,
2980 * but break unconditionally so unsplit data stops here.
2981 */
2982 if (state->split)
2983 state->split_start++;
2984 else
2985 state->split_start = 0;
2986 break;
2987 case 9:
2988 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2989 goto nla_put_failure;
2990
2991 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2992 rdev->wiphy.max_sched_scan_plans) ||
2993 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2994 rdev->wiphy.max_sched_scan_plan_interval) ||
2995 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2996 rdev->wiphy.max_sched_scan_plan_iterations))
2997 goto nla_put_failure;
2998
2999 if (rdev->wiphy.extended_capabilities &&
3000 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
3001 rdev->wiphy.extended_capabilities_len,
3002 rdev->wiphy.extended_capabilities) ||
3003 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3004 rdev->wiphy.extended_capabilities_len,
3005 rdev->wiphy.extended_capabilities_mask)))
3006 goto nla_put_failure;
3007
3008 if (rdev->wiphy.vht_capa_mod_mask &&
3009 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
3010 sizeof(*rdev->wiphy.vht_capa_mod_mask),
3011 rdev->wiphy.vht_capa_mod_mask))
3012 goto nla_put_failure;
3013
3014 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3015 rdev->wiphy.perm_addr))
3016 goto nla_put_failure;
3017
3018 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
3019 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
3020 rdev->wiphy.addr_mask))
3021 goto nla_put_failure;
3022
3023 if (rdev->wiphy.n_addresses > 1) {
3024 void *attr;
3025
3026 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
3027 if (!attr)
3028 goto nla_put_failure;
3029
3030 for (i = 0; i < rdev->wiphy.n_addresses; i++)
3031 if (nla_put(msg, i + 1, ETH_ALEN,
3032 rdev->wiphy.addresses[i].addr))
3033 goto nla_put_failure;
3034
3035 nla_nest_end(msg, attr);
3036 }
3037
3038 state->split_start++;
3039 break;
3040 case 10:
3041 if (nl80211_send_coalesce(msg, rdev))
3042 goto nla_put_failure;
3043
3044 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
3045 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
3046 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
3047 goto nla_put_failure;
3048
3049 if (rdev->wiphy.max_ap_assoc_sta &&
3050 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
3051 rdev->wiphy.max_ap_assoc_sta))
3052 goto nla_put_failure;
3053
3054 state->split_start++;
3055 break;
3056 case 11:
3057 if (rdev->wiphy.n_vendor_commands) {
3058 const struct nl80211_vendor_cmd_info *info;
3059 struct nlattr *nested;
3060
3061 nested = nla_nest_start_noflag(msg,
3062 NL80211_ATTR_VENDOR_DATA);
3063 if (!nested)
3064 goto nla_put_failure;
3065
3066 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
3067 info = &rdev->wiphy.vendor_commands[i].info;
3068 if (nla_put(msg, i + 1, sizeof(*info), info))
3069 goto nla_put_failure;
3070 }
3071 nla_nest_end(msg, nested);
3072 }
3073
3074 if (rdev->wiphy.n_vendor_events) {
3075 const struct nl80211_vendor_cmd_info *info;
3076 struct nlattr *nested;
3077
3078 nested = nla_nest_start_noflag(msg,
3079 NL80211_ATTR_VENDOR_EVENTS);
3080 if (!nested)
3081 goto nla_put_failure;
3082
3083 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
3084 info = &rdev->wiphy.vendor_events[i];
3085 if (nla_put(msg, i + 1, sizeof(*info), info))
3086 goto nla_put_failure;
3087 }
3088 nla_nest_end(msg, nested);
3089 }
3090 state->split_start++;
3091 break;
3092 case 12:
3093 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
3094 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
3095 rdev->wiphy.max_num_csa_counters))
3096 goto nla_put_failure;
3097
3098 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
3099 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
3100 goto nla_put_failure;
3101
3102 if (rdev->wiphy.max_sched_scan_reqs &&
3103 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
3104 rdev->wiphy.max_sched_scan_reqs))
3105 goto nla_put_failure;
3106
3107 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
3108 sizeof(rdev->wiphy.ext_features),
3109 rdev->wiphy.ext_features))
3110 goto nla_put_failure;
3111
3112 if (rdev->wiphy.bss_param_support) {
3113 struct nlattr *nested;
3114 u32 parsup = rdev->wiphy.bss_param_support;
3115
3116 nested = nla_nest_start(msg, NL80211_ATTR_BSS_PARAM);
3117 if (!nested)
3118 goto nla_put_failure;
3119
3120 if ((parsup & WIPHY_BSS_PARAM_CTS_PROT) &&
3121 nla_put_flag(msg, NL80211_ATTR_BSS_CTS_PROT))
3122 goto nla_put_failure;
3123 if ((parsup & WIPHY_BSS_PARAM_SHORT_PREAMBLE) &&
3124 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE))
3125 goto nla_put_failure;
3126 if ((parsup & WIPHY_BSS_PARAM_SHORT_SLOT_TIME) &&
3127 nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME))
3128 goto nla_put_failure;
3129 if ((parsup & WIPHY_BSS_PARAM_BASIC_RATES) &&
3130 nla_put_flag(msg, NL80211_ATTR_BSS_BASIC_RATES))
3131 goto nla_put_failure;
3132 if ((parsup & WIPHY_BSS_PARAM_AP_ISOLATE) &&
3133 nla_put_flag(msg, NL80211_ATTR_AP_ISOLATE))
3134 goto nla_put_failure;
3135 if ((parsup & WIPHY_BSS_PARAM_HT_OPMODE) &&
3136 nla_put_flag(msg, NL80211_ATTR_BSS_HT_OPMODE))
3137 goto nla_put_failure;
3138 if ((parsup & WIPHY_BSS_PARAM_P2P_CTWINDOW) &&
3139 nla_put_flag(msg, NL80211_ATTR_P2P_CTWINDOW))
3140 goto nla_put_failure;
3141 if ((parsup & WIPHY_BSS_PARAM_P2P_OPPPS) &&
3142 nla_put_flag(msg, NL80211_ATTR_P2P_OPPPS))
3143 goto nla_put_failure;
3144 nla_nest_end(msg, nested);
3145 }
3146 if (rdev->wiphy.bss_select_support) {
3147 struct nlattr *nested;
3148 u32 bss_select_support = rdev->wiphy.bss_select_support;
3149
3150 nested = nla_nest_start_noflag(msg,
3151 NL80211_ATTR_BSS_SELECT);
3152 if (!nested)
3153 goto nla_put_failure;
3154
3155 i = 0;
3156 while (bss_select_support) {
3157 if ((bss_select_support & 1) &&
3158 nla_put_flag(msg, i))
3159 goto nla_put_failure;
3160 i++;
3161 bss_select_support >>= 1;
3162 }
3163 nla_nest_end(msg, nested);
3164 }
3165
3166 state->split_start++;
3167 break;
3168 case 13:
3169 if (rdev->wiphy.num_iftype_ext_capab &&
3170 rdev->wiphy.iftype_ext_capab) {
3171 struct nlattr *nested_ext_capab, *nested;
3172
3173 nested = nla_nest_start_noflag(msg,
3174 NL80211_ATTR_IFTYPE_EXT_CAPA);
3175 if (!nested)
3176 goto nla_put_failure;
3177
3178 for (i = state->capa_start;
3179 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3180 const struct wiphy_iftype_ext_capab *capab;
3181
3182 capab = &rdev->wiphy.iftype_ext_capab[i];
3183
3184 nested_ext_capab = nla_nest_start_noflag(msg,
3185 i);
3186 if (!nested_ext_capab ||
3187 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3188 capab->iftype) ||
3189 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3190 capab->extended_capabilities_len,
3191 capab->extended_capabilities) ||
3192 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3193 capab->extended_capabilities_len,
3194 capab->extended_capabilities_mask))
3195 goto nla_put_failure;
3196
3197 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3198 (nla_put_u16(msg,
3199 NL80211_ATTR_EML_CAPABILITY,
3200 capab->eml_capabilities) ||
3201 nla_put_u16(msg,
3202 NL80211_ATTR_MLD_CAPA_AND_OPS,
3203 capab->mld_capa_and_ops)))
3204 goto nla_put_failure;
3205
3206 nla_nest_end(msg, nested_ext_capab);
3207 if (state->split)
3208 break;
3209 }
3210 nla_nest_end(msg, nested);
3211 if (i < rdev->wiphy.num_iftype_ext_capab) {
3212 state->capa_start = i + 1;
3213 break;
3214 }
3215 }
3216
3217 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3218 rdev->wiphy.nan_supported_bands))
3219 goto nla_put_failure;
3220
3221 if (wiphy_ext_feature_isset(&rdev->wiphy,
3222 NL80211_EXT_FEATURE_TXQS)) {
3223 struct cfg80211_txq_stats txqstats = {};
3224 int res;
3225
3226 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3227 if (!res &&
3228 !nl80211_put_txq_stats(msg, &txqstats,
3229 NL80211_ATTR_TXQ_STATS))
3230 goto nla_put_failure;
3231
3232 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3233 rdev->wiphy.txq_limit))
3234 goto nla_put_failure;
3235 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3236 rdev->wiphy.txq_memory_limit))
3237 goto nla_put_failure;
3238 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3239 rdev->wiphy.txq_quantum))
3240 goto nla_put_failure;
3241 }
3242
3243 state->split_start++;
3244 break;
3245 case 14:
3246 if (nl80211_send_pmsr_capa(rdev, msg))
3247 goto nla_put_failure;
3248
3249 state->split_start++;
3250 break;
3251 case 15:
3252 if (rdev->wiphy.akm_suites &&
3253 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3254 sizeof(u32) * rdev->wiphy.n_akm_suites,
3255 rdev->wiphy.akm_suites))
3256 goto nla_put_failure;
3257
3258 if (nl80211_put_iftype_akm_suites(rdev, msg))
3259 goto nla_put_failure;
3260
3261 if (nl80211_put_tid_config_support(rdev, msg))
3262 goto nla_put_failure;
3263 state->split_start++;
3264 break;
3265 case 16:
3266 if (nl80211_put_sar_specs(rdev, msg))
3267 goto nla_put_failure;
3268
3269 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3270 goto nla_put_failure;
3271
3272 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3273 rdev->wiphy.max_num_akm_suites))
3274 goto nla_put_failure;
3275
3276 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3277 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3278
3279 if (rdev->wiphy.hw_timestamp_max_peers &&
3280 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3281 rdev->wiphy.hw_timestamp_max_peers))
3282 goto nla_put_failure;
3283
3284 state->split_start++;
3285 break;
3286 case 17:
3287 if (nl80211_put_radios(&rdev->wiphy, msg))
3288 goto nla_put_failure;
3289
3290 state->split_start++;
3291 break;
3292 case 18:
3293 if (nl80211_put_nan_capa(&rdev->wiphy, msg))
3294 goto nla_put_failure;
3295
3296 /* done */
3297 state->split_start = 0;
3298 break;
3299 }
3300 finish:
3301 genlmsg_end(msg, hdr);
3302 return 0;
3303
3304 nla_put_failure:
3305 genlmsg_cancel(msg, hdr);
3306 return -EMSGSIZE;
3307 }
3308
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3309 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3310 struct netlink_callback *cb,
3311 struct nl80211_dump_wiphy_state *state)
3312 {
3313 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3314 int ret;
3315
3316 if (!tb)
3317 return -ENOMEM;
3318
3319 ret = nlmsg_parse_deprecated(cb->nlh,
3320 GENL_HDRLEN + nl80211_fam.hdrsize,
3321 tb, nl80211_fam.maxattr,
3322 nl80211_policy, NULL);
3323 /* ignore parse errors for backward compatibility */
3324 if (ret) {
3325 ret = 0;
3326 goto out;
3327 }
3328
3329 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3330 if (tb[NL80211_ATTR_WIPHY])
3331 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3332 if (tb[NL80211_ATTR_WDEV])
3333 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3334 if (tb[NL80211_ATTR_IFINDEX]) {
3335 struct net_device *netdev;
3336 struct cfg80211_registered_device *rdev;
3337 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3338
3339 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3340 if (!netdev) {
3341 ret = -ENODEV;
3342 goto out;
3343 }
3344 if (netdev->ieee80211_ptr) {
3345 rdev = wiphy_to_rdev(
3346 netdev->ieee80211_ptr->wiphy);
3347 state->filter_wiphy = rdev->wiphy_idx;
3348 }
3349 }
3350
3351 ret = 0;
3352 out:
3353 kfree(tb);
3354 return ret;
3355 }
3356
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3357 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3358 {
3359 int idx = 0, ret;
3360 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3361 struct cfg80211_registered_device *rdev;
3362
3363 rtnl_lock();
3364 if (!state) {
3365 state = kzalloc(sizeof(*state), GFP_KERNEL);
3366 if (!state) {
3367 rtnl_unlock();
3368 return -ENOMEM;
3369 }
3370 state->filter_wiphy = -1;
3371 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3372 if (ret) {
3373 kfree(state);
3374 rtnl_unlock();
3375 return ret;
3376 }
3377 cb->args[0] = (long)state;
3378 }
3379
3380 for_each_rdev(rdev) {
3381 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3382 continue;
3383 if (++idx <= state->start)
3384 continue;
3385 if (state->filter_wiphy != -1 &&
3386 state->filter_wiphy != rdev->wiphy_idx)
3387 continue;
3388 wiphy_lock(&rdev->wiphy);
3389 /* attempt to fit multiple wiphy data chunks into the skb */
3390 do {
3391 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3392 skb,
3393 NETLINK_CB(cb->skb).portid,
3394 cb->nlh->nlmsg_seq,
3395 NLM_F_MULTI, state);
3396 if (ret < 0) {
3397 /*
3398 * If sending the wiphy data didn't fit (ENOBUFS
3399 * or EMSGSIZE returned), this SKB is still
3400 * empty (so it's not too big because another
3401 * wiphy dataset is already in the skb) and
3402 * we've not tried to adjust the dump allocation
3403 * yet ... then adjust the alloc size to be
3404 * bigger, and return 1 but with the empty skb.
3405 * This results in an empty message being RX'ed
3406 * in userspace, but that is ignored.
3407 *
3408 * We can then retry with the larger buffer.
3409 */
3410 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3411 !skb->len && !state->split &&
3412 cb->min_dump_alloc < 4096) {
3413 cb->min_dump_alloc = 4096;
3414 state->split_start = 0;
3415 wiphy_unlock(&rdev->wiphy);
3416 rtnl_unlock();
3417 return 1;
3418 }
3419 idx--;
3420 break;
3421 }
3422 } while (state->split_start > 0);
3423 wiphy_unlock(&rdev->wiphy);
3424 break;
3425 }
3426 rtnl_unlock();
3427
3428 state->start = idx;
3429
3430 return skb->len;
3431 }
3432
nl80211_dump_wiphy_done(struct netlink_callback * cb)3433 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3434 {
3435 kfree((void *)cb->args[0]);
3436 return 0;
3437 }
3438
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3439 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3440 {
3441 struct sk_buff *msg;
3442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3443 struct nl80211_dump_wiphy_state state = {};
3444
3445 msg = nlmsg_new(4096, GFP_KERNEL);
3446 if (!msg)
3447 return -ENOMEM;
3448
3449 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3450 info->snd_portid, info->snd_seq, 0,
3451 &state) < 0) {
3452 nlmsg_free(msg);
3453 return -ENOBUFS;
3454 }
3455
3456 return genlmsg_reply(msg, info);
3457 }
3458
3459 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3460 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3461 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3462 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3463 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3464 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3465 };
3466
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3467 static int parse_txq_params(struct nlattr *tb[],
3468 struct ieee80211_txq_params *txq_params)
3469 {
3470 u8 ac;
3471
3472 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3473 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3474 !tb[NL80211_TXQ_ATTR_AIFS])
3475 return -EINVAL;
3476
3477 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3478 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3479 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3480 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3481 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3482
3483 if (ac >= NL80211_NUM_ACS)
3484 return -EINVAL;
3485 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3486 return 0;
3487 }
3488
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3489 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3490 {
3491 /*
3492 * You can only set the channel explicitly for some interfaces,
3493 * most have their channel managed via their respective
3494 * "establish a connection" command (connect, join, ...)
3495 *
3496 * For AP/GO and mesh mode, the channel can be set with the
3497 * channel userspace API, but is only stored and passed to the
3498 * low-level driver when the AP starts or the mesh is joined.
3499 * This is for backward compatibility, userspace can also give
3500 * the channel in the start-ap or join-mesh commands instead.
3501 *
3502 * Monitors are special as they are normally slaved to
3503 * whatever else is going on, so they have their own special
3504 * operation to set the monitor channel if possible.
3505 */
3506 return !wdev ||
3507 wdev->iftype == NL80211_IFTYPE_AP ||
3508 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3509 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3510 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3511 }
3512
_nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,bool monitor,struct cfg80211_chan_def * chandef)3513 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3514 struct genl_info *info, bool monitor,
3515 struct cfg80211_chan_def *chandef)
3516 {
3517 struct netlink_ext_ack *extack = info->extack;
3518 struct nlattr **attrs = info->attrs;
3519 u32 control_freq;
3520
3521 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3522 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3523 "Frequency is missing");
3524 return -EINVAL;
3525 }
3526
3527 control_freq = MHZ_TO_KHZ(
3528 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3529 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3530 control_freq +=
3531 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3532
3533 memset(chandef, 0, sizeof(*chandef));
3534 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3535 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3536 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3537 chandef->freq1_offset = control_freq % 1000;
3538 chandef->center_freq2 = 0;
3539 chandef->s1g_primary_2mhz = false;
3540
3541 if (!chandef->chan) {
3542 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3543 "Unknown channel");
3544 return -EINVAL;
3545 }
3546
3547 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3548 enum nl80211_channel_type chantype;
3549
3550 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3551
3552 switch (chantype) {
3553 case NL80211_CHAN_NO_HT:
3554 case NL80211_CHAN_HT20:
3555 case NL80211_CHAN_HT40PLUS:
3556 case NL80211_CHAN_HT40MINUS:
3557 cfg80211_chandef_create(chandef, chandef->chan,
3558 chantype);
3559 /* user input for center_freq is incorrect */
3560 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3561 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3562 NL_SET_ERR_MSG_ATTR(extack,
3563 attrs[NL80211_ATTR_CENTER_FREQ1],
3564 "bad center frequency 1");
3565 return -EINVAL;
3566 }
3567 /* center_freq2 must be zero */
3568 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3569 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3570 NL_SET_ERR_MSG_ATTR(extack,
3571 attrs[NL80211_ATTR_CENTER_FREQ2],
3572 "center frequency 2 can't be used");
3573 return -EINVAL;
3574 }
3575 break;
3576 default:
3577 NL_SET_ERR_MSG_ATTR(extack,
3578 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3579 "invalid channel type");
3580 return -EINVAL;
3581 }
3582 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3583 chandef->width = nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3584 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3585 chandef->center_freq1 =
3586 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3587 chandef->freq1_offset = nla_get_u32_default(
3588 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET], 0);
3589 }
3590
3591 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3592 chandef->center_freq2 =
3593 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3594
3595 chandef->s1g_primary_2mhz = nla_get_flag(
3596 attrs[NL80211_ATTR_S1G_PRIMARY_2MHZ]);
3597 }
3598
3599 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3600 chandef->edmg.channels =
3601 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3602
3603 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3604 chandef->edmg.bw_config =
3605 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3606 } else {
3607 chandef->edmg.bw_config = 0;
3608 chandef->edmg.channels = 0;
3609 }
3610
3611 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3612 chandef->punctured =
3613 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3614
3615 if (chandef->punctured &&
3616 !wiphy_ext_feature_isset(&rdev->wiphy,
3617 NL80211_EXT_FEATURE_PUNCT)) {
3618 NL_SET_ERR_MSG(extack,
3619 "driver doesn't support puncturing");
3620 return -EINVAL;
3621 }
3622 }
3623
3624 if (!cfg80211_chandef_valid(chandef)) {
3625 NL_SET_ERR_MSG(extack, "invalid channel definition");
3626 return -EINVAL;
3627 }
3628
3629 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3630 IEEE80211_CHAN_DISABLED,
3631 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3632 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3633 return -EINVAL;
3634 }
3635
3636 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3637 chandef->width == NL80211_CHAN_WIDTH_10) &&
3638 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3639 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3640 return -EINVAL;
3641 }
3642
3643 return 0;
3644 }
3645
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3646 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3647 struct genl_info *info,
3648 struct cfg80211_chan_def *chandef)
3649 {
3650 return _nl80211_parse_chandef(rdev, info, false, chandef);
3651 }
3652
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3653 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3654 struct net_device *dev,
3655 struct genl_info *info,
3656 int _link_id)
3657 {
3658 struct cfg80211_chan_def chandef;
3659 int result;
3660 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3661 struct wireless_dev *wdev = NULL;
3662 int link_id = _link_id;
3663
3664 if (dev)
3665 wdev = dev->ieee80211_ptr;
3666 if (!nl80211_can_set_dev_channel(wdev))
3667 return -EOPNOTSUPP;
3668 if (wdev)
3669 iftype = wdev->iftype;
3670
3671 if (link_id < 0) {
3672 if (wdev && wdev->valid_links)
3673 return -EINVAL;
3674 link_id = 0;
3675 }
3676
3677 result = _nl80211_parse_chandef(rdev, info,
3678 iftype == NL80211_IFTYPE_MONITOR,
3679 &chandef);
3680 if (result)
3681 return result;
3682
3683 switch (iftype) {
3684 case NL80211_IFTYPE_AP:
3685 case NL80211_IFTYPE_P2P_GO:
3686 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3687 iftype))
3688 return -EINVAL;
3689 if (wdev->links[link_id].ap.beacon_interval) {
3690 struct ieee80211_channel *cur_chan;
3691
3692 if (!dev || !rdev->ops->set_ap_chanwidth ||
3693 !(rdev->wiphy.features &
3694 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3695 return -EBUSY;
3696
3697 /* Only allow dynamic channel width changes */
3698 cur_chan = wdev->links[link_id].ap.chandef.chan;
3699 if (chandef.chan != cur_chan)
3700 return -EBUSY;
3701
3702 /* only allow this for regular channel widths */
3703 switch (wdev->links[link_id].ap.chandef.width) {
3704 case NL80211_CHAN_WIDTH_20_NOHT:
3705 case NL80211_CHAN_WIDTH_20:
3706 case NL80211_CHAN_WIDTH_40:
3707 case NL80211_CHAN_WIDTH_80:
3708 case NL80211_CHAN_WIDTH_80P80:
3709 case NL80211_CHAN_WIDTH_160:
3710 case NL80211_CHAN_WIDTH_320:
3711 break;
3712 default:
3713 return -EINVAL;
3714 }
3715
3716 switch (chandef.width) {
3717 case NL80211_CHAN_WIDTH_20_NOHT:
3718 case NL80211_CHAN_WIDTH_20:
3719 case NL80211_CHAN_WIDTH_40:
3720 case NL80211_CHAN_WIDTH_80:
3721 case NL80211_CHAN_WIDTH_80P80:
3722 case NL80211_CHAN_WIDTH_160:
3723 case NL80211_CHAN_WIDTH_320:
3724 break;
3725 default:
3726 return -EINVAL;
3727 }
3728
3729 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3730 &chandef);
3731 if (result)
3732 return result;
3733 wdev->links[link_id].ap.chandef = chandef;
3734 } else {
3735 wdev->u.ap.preset_chandef = chandef;
3736 }
3737 return 0;
3738 case NL80211_IFTYPE_MESH_POINT:
3739 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3740 case NL80211_IFTYPE_MONITOR:
3741 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3742 default:
3743 break;
3744 }
3745
3746 return -EINVAL;
3747 }
3748
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3749 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3750 {
3751 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3752 int link_id = nl80211_link_id_or_invalid(info->attrs);
3753 struct net_device *netdev = info->user_ptr[1];
3754
3755 return __nl80211_set_channel(rdev, netdev, info, link_id);
3756 }
3757
nl80211_set_wiphy_radio(struct genl_info * info,struct cfg80211_registered_device * rdev,int radio_idx)3758 static int nl80211_set_wiphy_radio(struct genl_info *info,
3759 struct cfg80211_registered_device *rdev,
3760 int radio_idx)
3761 {
3762 u32 rts_threshold = 0, old_rts, changed = 0;
3763 int result;
3764
3765 if (!rdev->ops->set_wiphy_params)
3766 return -EOPNOTSUPP;
3767
3768 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3769 rts_threshold = nla_get_u32(
3770 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3771 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3772 }
3773
3774 old_rts = rdev->wiphy.radio_cfg[radio_idx].rts_threshold;
3775
3776 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = rts_threshold;
3777
3778 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
3779 if (result)
3780 rdev->wiphy.radio_cfg[radio_idx].rts_threshold = old_rts;
3781
3782 return 0;
3783 }
3784
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3785 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3786 {
3787 struct cfg80211_registered_device *rdev = NULL;
3788 struct net_device *netdev = NULL;
3789 struct wireless_dev *wdev;
3790 int result = 0, rem_txq_params = 0;
3791 struct nlattr *nl_txq_params;
3792 u32 changed;
3793 u8 retry_short = 0, retry_long = 0;
3794 u32 frag_threshold = 0, rts_threshold = 0;
3795 u8 coverage_class = 0;
3796 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3797 int radio_idx = -1;
3798
3799 rtnl_lock();
3800 /*
3801 * Try to find the wiphy and netdev. Normally this
3802 * function shouldn't need the netdev, but this is
3803 * done for backward compatibility -- previously
3804 * setting the channel was done per wiphy, but now
3805 * it is per netdev. Previous userland like hostapd
3806 * also passed a netdev to set_wiphy, so that it is
3807 * possible to let that go to the right netdev!
3808 */
3809
3810 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3811 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3812
3813 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3814 if (netdev && netdev->ieee80211_ptr)
3815 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3816 else
3817 netdev = NULL;
3818 }
3819
3820 if (!netdev) {
3821 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3822 info->attrs);
3823 if (IS_ERR(rdev)) {
3824 rtnl_unlock();
3825 return PTR_ERR(rdev);
3826 }
3827 wdev = NULL;
3828 netdev = NULL;
3829 result = 0;
3830 } else
3831 wdev = netdev->ieee80211_ptr;
3832
3833 guard(wiphy)(&rdev->wiphy);
3834
3835 /*
3836 * end workaround code, by now the rdev is available
3837 * and locked, and wdev may or may not be NULL.
3838 */
3839
3840 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3841 result = cfg80211_dev_rename(
3842 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3843 rtnl_unlock();
3844
3845 if (result)
3846 return result;
3847
3848 if (info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]) {
3849 /* Radio idx is not expected for non-multi radio wiphy */
3850 if (rdev->wiphy.n_radio <= 0)
3851 return -EINVAL;
3852
3853 radio_idx = nla_get_u8(
3854 info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]);
3855 if (radio_idx >= rdev->wiphy.n_radio)
3856 return -EINVAL;
3857
3858 return nl80211_set_wiphy_radio(info, rdev, radio_idx);
3859 }
3860
3861 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3862 struct ieee80211_txq_params txq_params;
3863 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3864
3865 if (!rdev->ops->set_txq_params)
3866 return -EOPNOTSUPP;
3867
3868 if (!netdev)
3869 return -EINVAL;
3870
3871 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3872 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3873 return -EINVAL;
3874
3875 if (!netif_running(netdev))
3876 return -ENETDOWN;
3877
3878 nla_for_each_nested(nl_txq_params,
3879 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3880 rem_txq_params) {
3881 result = nla_parse_nested_deprecated(tb,
3882 NL80211_TXQ_ATTR_MAX,
3883 nl_txq_params,
3884 txq_params_policy,
3885 info->extack);
3886 if (result)
3887 return result;
3888
3889 result = parse_txq_params(tb, &txq_params);
3890 if (result)
3891 return result;
3892
3893 txq_params.link_id =
3894 nl80211_link_id_or_invalid(info->attrs);
3895
3896 if (txq_params.link_id >= 0 &&
3897 !(netdev->ieee80211_ptr->valid_links &
3898 BIT(txq_params.link_id)))
3899 result = -ENOLINK;
3900 else if (txq_params.link_id >= 0 &&
3901 !netdev->ieee80211_ptr->valid_links)
3902 result = -EINVAL;
3903 else
3904 result = rdev_set_txq_params(rdev, netdev,
3905 &txq_params);
3906 if (result)
3907 return result;
3908 }
3909 }
3910
3911 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3912 int link_id = nl80211_link_id_or_invalid(info->attrs);
3913
3914 if (wdev) {
3915 result = __nl80211_set_channel(
3916 rdev,
3917 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3918 info, link_id);
3919 } else {
3920 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3921 }
3922
3923 if (result)
3924 return result;
3925 }
3926
3927 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3928 struct wireless_dev *txp_wdev = wdev;
3929 enum nl80211_tx_power_setting type;
3930 int idx, mbm = 0;
3931
3932 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3933 txp_wdev = NULL;
3934
3935 if (!rdev->ops->set_tx_power)
3936 return -EOPNOTSUPP;
3937
3938 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3939 type = nla_get_u32(info->attrs[idx]);
3940
3941 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3942 (type != NL80211_TX_POWER_AUTOMATIC))
3943 return -EINVAL;
3944
3945 if (type != NL80211_TX_POWER_AUTOMATIC) {
3946 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3947 mbm = nla_get_u32(info->attrs[idx]);
3948 }
3949
3950 result = rdev_set_tx_power(rdev, txp_wdev, radio_idx, type,
3951 mbm);
3952 if (result)
3953 return result;
3954 }
3955
3956 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3957 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3958 u32 tx_ant, rx_ant;
3959
3960 if ((!rdev->wiphy.available_antennas_tx &&
3961 !rdev->wiphy.available_antennas_rx) ||
3962 !rdev->ops->set_antenna)
3963 return -EOPNOTSUPP;
3964
3965 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3966 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3967
3968 /* reject antenna configurations which don't match the
3969 * available antenna masks, except for the "all" mask */
3970 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3971 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3972 return -EINVAL;
3973
3974 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3975 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3976
3977 result = rdev_set_antenna(rdev, radio_idx, tx_ant, rx_ant);
3978 if (result)
3979 return result;
3980 }
3981
3982 changed = 0;
3983
3984 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3985 retry_short = nla_get_u8(
3986 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3987
3988 changed |= WIPHY_PARAM_RETRY_SHORT;
3989 }
3990
3991 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3992 retry_long = nla_get_u8(
3993 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3994
3995 changed |= WIPHY_PARAM_RETRY_LONG;
3996 }
3997
3998 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3999 frag_threshold = nla_get_u32(
4000 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
4001 if (frag_threshold < 256)
4002 return -EINVAL;
4003
4004 if (frag_threshold != (u32) -1) {
4005 /*
4006 * Fragments (apart from the last one) are required to
4007 * have even length. Make the fragmentation code
4008 * simpler by stripping LSB should someone try to use
4009 * odd threshold value.
4010 */
4011 frag_threshold &= ~0x1;
4012 }
4013 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
4014 }
4015
4016 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
4017 rts_threshold = nla_get_u32(
4018 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
4019 changed |= WIPHY_PARAM_RTS_THRESHOLD;
4020 }
4021
4022 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
4023 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
4024 return -EINVAL;
4025
4026 coverage_class = nla_get_u8(
4027 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
4028 changed |= WIPHY_PARAM_COVERAGE_CLASS;
4029 }
4030
4031 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
4032 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
4033 return -EOPNOTSUPP;
4034
4035 changed |= WIPHY_PARAM_DYN_ACK;
4036 }
4037
4038 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
4039 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4040 NL80211_EXT_FEATURE_TXQS))
4041 return -EOPNOTSUPP;
4042
4043 txq_limit = nla_get_u32(
4044 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
4045 changed |= WIPHY_PARAM_TXQ_LIMIT;
4046 }
4047
4048 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
4049 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4050 NL80211_EXT_FEATURE_TXQS))
4051 return -EOPNOTSUPP;
4052
4053 txq_memory_limit = nla_get_u32(
4054 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
4055 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
4056 }
4057
4058 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
4059 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4060 NL80211_EXT_FEATURE_TXQS))
4061 return -EOPNOTSUPP;
4062
4063 txq_quantum = nla_get_u32(
4064 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
4065 changed |= WIPHY_PARAM_TXQ_QUANTUM;
4066 }
4067
4068 if (changed) {
4069 u8 old_retry_short, old_retry_long;
4070 u32 old_frag_threshold, old_rts_threshold;
4071 u8 old_coverage_class, i;
4072 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
4073 u32 *old_radio_rts_threshold = NULL;
4074
4075 if (!rdev->ops->set_wiphy_params)
4076 return -EOPNOTSUPP;
4077
4078 if (rdev->wiphy.n_radio) {
4079 old_radio_rts_threshold = kcalloc(rdev->wiphy.n_radio,
4080 sizeof(u32),
4081 GFP_KERNEL);
4082 if (!old_radio_rts_threshold)
4083 return -ENOMEM;
4084 }
4085
4086 old_retry_short = rdev->wiphy.retry_short;
4087 old_retry_long = rdev->wiphy.retry_long;
4088 old_frag_threshold = rdev->wiphy.frag_threshold;
4089 old_rts_threshold = rdev->wiphy.rts_threshold;
4090 if (old_radio_rts_threshold) {
4091 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4092 old_radio_rts_threshold[i] =
4093 rdev->wiphy.radio_cfg[i].rts_threshold;
4094 }
4095 old_coverage_class = rdev->wiphy.coverage_class;
4096 old_txq_limit = rdev->wiphy.txq_limit;
4097 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
4098 old_txq_quantum = rdev->wiphy.txq_quantum;
4099
4100 if (changed & WIPHY_PARAM_RETRY_SHORT)
4101 rdev->wiphy.retry_short = retry_short;
4102 if (changed & WIPHY_PARAM_RETRY_LONG)
4103 rdev->wiphy.retry_long = retry_long;
4104 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
4105 rdev->wiphy.frag_threshold = frag_threshold;
4106 if ((changed & WIPHY_PARAM_RTS_THRESHOLD) &&
4107 old_radio_rts_threshold) {
4108 rdev->wiphy.rts_threshold = rts_threshold;
4109 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4110 rdev->wiphy.radio_cfg[i].rts_threshold =
4111 rdev->wiphy.rts_threshold;
4112 }
4113 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
4114 rdev->wiphy.coverage_class = coverage_class;
4115 if (changed & WIPHY_PARAM_TXQ_LIMIT)
4116 rdev->wiphy.txq_limit = txq_limit;
4117 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
4118 rdev->wiphy.txq_memory_limit = txq_memory_limit;
4119 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
4120 rdev->wiphy.txq_quantum = txq_quantum;
4121
4122 result = rdev_set_wiphy_params(rdev, radio_idx, changed);
4123 if (result) {
4124 rdev->wiphy.retry_short = old_retry_short;
4125 rdev->wiphy.retry_long = old_retry_long;
4126 rdev->wiphy.frag_threshold = old_frag_threshold;
4127 rdev->wiphy.rts_threshold = old_rts_threshold;
4128 if (old_radio_rts_threshold) {
4129 for (i = 0 ; i < rdev->wiphy.n_radio; i++)
4130 rdev->wiphy.radio_cfg[i].rts_threshold =
4131 old_radio_rts_threshold[i];
4132 }
4133 rdev->wiphy.coverage_class = old_coverage_class;
4134 rdev->wiphy.txq_limit = old_txq_limit;
4135 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
4136 rdev->wiphy.txq_quantum = old_txq_quantum;
4137 }
4138
4139 kfree(old_radio_rts_threshold);
4140 return result;
4141 }
4142
4143 return 0;
4144 }
4145
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)4146 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
4147 {
4148 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
4149 return -EINVAL;
4150
4151 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4152 chandef->chan->center_freq))
4153 return -ENOBUFS;
4154 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
4155 chandef->chan->freq_offset))
4156 return -ENOBUFS;
4157 switch (chandef->width) {
4158 case NL80211_CHAN_WIDTH_20_NOHT:
4159 case NL80211_CHAN_WIDTH_20:
4160 case NL80211_CHAN_WIDTH_40:
4161 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
4162 cfg80211_get_chandef_type(chandef)))
4163 return -ENOBUFS;
4164 break;
4165 default:
4166 break;
4167 }
4168 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
4169 return -ENOBUFS;
4170 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
4171 return -ENOBUFS;
4172 if (chandef->center_freq2 &&
4173 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
4174 return -ENOBUFS;
4175 if (chandef->punctured &&
4176 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
4177 return -ENOBUFS;
4178
4179 return 0;
4180 }
4181 EXPORT_SYMBOL(nl80211_send_chandef);
4182
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)4183 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
4184 struct cfg80211_registered_device *rdev,
4185 struct wireless_dev *wdev,
4186 enum nl80211_commands cmd)
4187 {
4188 struct net_device *dev = wdev->netdev;
4189 void *hdr;
4190
4191 lockdep_assert_wiphy(&rdev->wiphy);
4192
4193 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
4194 cmd != NL80211_CMD_DEL_INTERFACE &&
4195 cmd != NL80211_CMD_SET_INTERFACE);
4196
4197 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4198 if (!hdr)
4199 return -1;
4200
4201 if (dev &&
4202 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4203 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
4204 goto nla_put_failure;
4205
4206 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
4207 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
4208 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
4209 NL80211_ATTR_PAD) ||
4210 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
4211 nla_put_u32(msg, NL80211_ATTR_GENERATION,
4212 rdev->devlist_generation ^
4213 (cfg80211_rdev_list_generation << 2)) ||
4214 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
4215 nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
4216 goto nla_put_failure;
4217
4218 if (rdev->ops->get_channel && !wdev->valid_links) {
4219 struct cfg80211_chan_def chandef = {};
4220 int ret;
4221
4222 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4223 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4224 goto nla_put_failure;
4225 }
4226
4227 if (rdev->ops->get_tx_power && !wdev->valid_links) {
4228 int dbm, ret;
4229
4230 ret = rdev_get_tx_power(rdev, wdev, -1, 0, &dbm);
4231 if (ret == 0 &&
4232 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4233 DBM_TO_MBM(dbm)))
4234 goto nla_put_failure;
4235 }
4236
4237 switch (wdev->iftype) {
4238 case NL80211_IFTYPE_AP:
4239 case NL80211_IFTYPE_P2P_GO:
4240 if (wdev->u.ap.ssid_len &&
4241 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4242 wdev->u.ap.ssid))
4243 goto nla_put_failure;
4244 break;
4245 case NL80211_IFTYPE_STATION:
4246 case NL80211_IFTYPE_P2P_CLIENT:
4247 if (wdev->u.client.ssid_len &&
4248 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4249 wdev->u.client.ssid))
4250 goto nla_put_failure;
4251 break;
4252 case NL80211_IFTYPE_ADHOC:
4253 if (wdev->u.ibss.ssid_len &&
4254 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4255 wdev->u.ibss.ssid))
4256 goto nla_put_failure;
4257 break;
4258 default:
4259 /* nothing */
4260 break;
4261 }
4262
4263 if (rdev->ops->get_txq_stats) {
4264 struct cfg80211_txq_stats txqstats = {};
4265 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4266
4267 if (ret == 0 &&
4268 !nl80211_put_txq_stats(msg, &txqstats,
4269 NL80211_ATTR_TXQ_STATS))
4270 goto nla_put_failure;
4271 }
4272
4273 if (wdev->valid_links) {
4274 unsigned int link_id;
4275 struct nlattr *links = nla_nest_start(msg,
4276 NL80211_ATTR_MLO_LINKS);
4277
4278 if (!links)
4279 goto nla_put_failure;
4280
4281 for_each_valid_link(wdev, link_id) {
4282 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4283 struct cfg80211_chan_def chandef = {};
4284 int ret;
4285
4286 if (!link)
4287 goto nla_put_failure;
4288
4289 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4290 goto nla_put_failure;
4291 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4292 wdev->links[link_id].addr))
4293 goto nla_put_failure;
4294
4295 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4296 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4297 goto nla_put_failure;
4298
4299 if (rdev->ops->get_tx_power) {
4300 int dbm, ret;
4301
4302 ret = rdev_get_tx_power(rdev, wdev, -1, link_id, &dbm);
4303 if (ret == 0 &&
4304 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4305 DBM_TO_MBM(dbm)))
4306 goto nla_put_failure;
4307 }
4308 nla_nest_end(msg, link);
4309 }
4310
4311 nla_nest_end(msg, links);
4312 }
4313
4314 genlmsg_end(msg, hdr);
4315 return 0;
4316
4317 nla_put_failure:
4318 genlmsg_cancel(msg, hdr);
4319 return -EMSGSIZE;
4320 }
4321
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)4322 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4323 {
4324 int wp_idx = 0;
4325 int if_idx = 0;
4326 int wp_start = cb->args[0];
4327 int if_start = cb->args[1];
4328 int filter_wiphy = -1;
4329 struct cfg80211_registered_device *rdev;
4330 struct wireless_dev *wdev;
4331 int ret;
4332
4333 rtnl_lock();
4334 if (!cb->args[2]) {
4335 struct nl80211_dump_wiphy_state state = {
4336 .filter_wiphy = -1,
4337 };
4338
4339 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4340 if (ret)
4341 goto out_unlock;
4342
4343 filter_wiphy = state.filter_wiphy;
4344
4345 /*
4346 * if filtering, set cb->args[2] to +1 since 0 is the default
4347 * value needed to determine that parsing is necessary.
4348 */
4349 if (filter_wiphy >= 0)
4350 cb->args[2] = filter_wiphy + 1;
4351 else
4352 cb->args[2] = -1;
4353 } else if (cb->args[2] > 0) {
4354 filter_wiphy = cb->args[2] - 1;
4355 }
4356
4357 for_each_rdev(rdev) {
4358 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4359 continue;
4360 if (wp_idx < wp_start) {
4361 wp_idx++;
4362 continue;
4363 }
4364
4365 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4366 continue;
4367
4368 if_idx = 0;
4369
4370 guard(wiphy)(&rdev->wiphy);
4371
4372 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4373 if (if_idx < if_start) {
4374 if_idx++;
4375 continue;
4376 }
4377
4378 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4379 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4380 rdev, wdev,
4381 NL80211_CMD_NEW_INTERFACE) < 0)
4382 goto out;
4383
4384 if_idx++;
4385 }
4386
4387 if_start = 0;
4388 wp_idx++;
4389 }
4390 out:
4391 cb->args[0] = wp_idx;
4392 cb->args[1] = if_idx;
4393
4394 ret = skb->len;
4395 out_unlock:
4396 rtnl_unlock();
4397
4398 return ret;
4399 }
4400
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4401 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4402 {
4403 struct sk_buff *msg;
4404 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4405 struct wireless_dev *wdev = info->user_ptr[1];
4406
4407 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4408 if (!msg)
4409 return -ENOMEM;
4410
4411 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4412 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4413 nlmsg_free(msg);
4414 return -ENOBUFS;
4415 }
4416
4417 return genlmsg_reply(msg, info);
4418 }
4419
4420 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4421 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4422 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4423 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4424 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4425 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4426 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4427 [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4428 };
4429
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4430 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4431 {
4432 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4433 int flag;
4434
4435 *mntrflags = 0;
4436
4437 if (!nla)
4438 return -EINVAL;
4439
4440 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4441 return -EINVAL;
4442
4443 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4444 if (flags[flag])
4445 *mntrflags |= (1<<flag);
4446
4447 /* cooked monitor mode is incompatible with other modes */
4448 if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4449 *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4450 return -EOPNOTSUPP;
4451
4452 *mntrflags |= MONITOR_FLAG_CHANGED;
4453
4454 return 0;
4455 }
4456
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4457 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4458 enum nl80211_iftype type,
4459 struct genl_info *info,
4460 struct vif_params *params)
4461 {
4462 bool change = false;
4463 int err;
4464
4465 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4466 if (type != NL80211_IFTYPE_MONITOR)
4467 return -EINVAL;
4468
4469 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4470 ¶ms->flags);
4471 if (err)
4472 return err;
4473
4474 change = true;
4475 }
4476
4477 /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4478 if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4479 return -EOPNOTSUPP;
4480
4481 if (params->flags & MONITOR_FLAG_ACTIVE &&
4482 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4483 return -EOPNOTSUPP;
4484
4485 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4486 const u8 *mumimo_groups;
4487 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4488
4489 if (type != NL80211_IFTYPE_MONITOR)
4490 return -EINVAL;
4491
4492 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4493 return -EOPNOTSUPP;
4494
4495 mumimo_groups =
4496 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4497
4498 /* bits 0 and 63 are reserved and must be zero */
4499 if ((mumimo_groups[0] & BIT(0)) ||
4500 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4501 return -EINVAL;
4502
4503 params->vht_mumimo_groups = mumimo_groups;
4504 change = true;
4505 }
4506
4507 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4508 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4509
4510 if (type != NL80211_IFTYPE_MONITOR)
4511 return -EINVAL;
4512
4513 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4514 return -EOPNOTSUPP;
4515
4516 params->vht_mumimo_follow_addr =
4517 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4518 change = true;
4519 }
4520
4521 return change ? 1 : 0;
4522 }
4523
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4524 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4525 struct net_device *netdev, u8 use_4addr,
4526 enum nl80211_iftype iftype)
4527 {
4528 if (!use_4addr) {
4529 if (netdev && netif_is_bridge_port(netdev))
4530 return -EBUSY;
4531 return 0;
4532 }
4533
4534 switch (iftype) {
4535 case NL80211_IFTYPE_AP_VLAN:
4536 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4537 return 0;
4538 break;
4539 case NL80211_IFTYPE_STATION:
4540 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4541 return 0;
4542 break;
4543 default:
4544 break;
4545 }
4546
4547 return -EOPNOTSUPP;
4548 }
4549
nl80211_parse_vif_radio_mask(struct genl_info * info,u32 * radio_mask)4550 static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4551 u32 *radio_mask)
4552 {
4553 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4554 struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4555 u32 mask, allowed;
4556
4557 if (!attr) {
4558 *radio_mask = 0;
4559 return 0;
4560 }
4561
4562 allowed = BIT(rdev->wiphy.n_radio) - 1;
4563 mask = nla_get_u32(attr);
4564 if (mask & ~allowed)
4565 return -EINVAL;
4566 if (!mask)
4567 mask = allowed;
4568 *radio_mask = mask;
4569
4570 return 1;
4571 }
4572
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4573 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4574 {
4575 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4576 struct vif_params params;
4577 int err;
4578 enum nl80211_iftype otype, ntype;
4579 struct net_device *dev = info->user_ptr[1];
4580 struct wireless_dev *wdev = dev->ieee80211_ptr;
4581 u32 radio_mask = 0;
4582 bool change = false;
4583
4584 memset(¶ms, 0, sizeof(params));
4585
4586 otype = ntype = dev->ieee80211_ptr->iftype;
4587
4588 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4589 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4590 if (otype != ntype)
4591 change = true;
4592 }
4593
4594 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4595 if (ntype != NL80211_IFTYPE_MESH_POINT)
4596 return -EINVAL;
4597 if (otype != NL80211_IFTYPE_MESH_POINT)
4598 return -EINVAL;
4599 if (netif_running(dev))
4600 return -EBUSY;
4601
4602 wdev->u.mesh.id_up_len =
4603 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4604 memcpy(wdev->u.mesh.id,
4605 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4606 wdev->u.mesh.id_up_len);
4607 }
4608
4609 if (info->attrs[NL80211_ATTR_4ADDR]) {
4610 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4611 change = true;
4612 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4613 if (err)
4614 return err;
4615 } else {
4616 params.use_4addr = -1;
4617 }
4618
4619 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4620 if (err < 0)
4621 return err;
4622 if (err > 0)
4623 change = true;
4624
4625 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4626 if (err < 0)
4627 return err;
4628 if (err && netif_running(dev))
4629 return -EBUSY;
4630
4631 if (change)
4632 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4633 else
4634 err = 0;
4635
4636 if (!err && params.use_4addr != -1)
4637 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4638
4639 if (radio_mask)
4640 wdev->radio_mask = radio_mask;
4641
4642 if (change && !err)
4643 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4644
4645 return err;
4646 }
4647
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4648 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4649 {
4650 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4651 struct vif_params params;
4652 struct wireless_dev *wdev;
4653 struct sk_buff *msg;
4654 u32 radio_mask;
4655 int err;
4656 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4657
4658 memset(¶ms, 0, sizeof(params));
4659
4660 if (!info->attrs[NL80211_ATTR_IFNAME])
4661 return -EINVAL;
4662
4663 if (info->attrs[NL80211_ATTR_IFTYPE])
4664 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4665
4666 if (!rdev->ops->add_virtual_intf)
4667 return -EOPNOTSUPP;
4668
4669 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4670 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4671 info->attrs[NL80211_ATTR_MAC]) {
4672 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4673 ETH_ALEN);
4674 if (!is_valid_ether_addr(params.macaddr))
4675 return -EADDRNOTAVAIL;
4676 }
4677
4678 if (info->attrs[NL80211_ATTR_4ADDR]) {
4679 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4680 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4681 if (err)
4682 return err;
4683 }
4684
4685 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4686 return -EOPNOTSUPP;
4687
4688 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4689 if (err < 0)
4690 return err;
4691
4692 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4693 if (err < 0)
4694 return err;
4695
4696 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4697 if (!msg)
4698 return -ENOMEM;
4699
4700 wdev = rdev_add_virtual_intf(rdev,
4701 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4702 NET_NAME_USER, type, ¶ms);
4703 if (WARN_ON(!wdev)) {
4704 nlmsg_free(msg);
4705 return -EPROTO;
4706 } else if (IS_ERR(wdev)) {
4707 nlmsg_free(msg);
4708 return PTR_ERR(wdev);
4709 }
4710
4711 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4712 wdev->owner_nlportid = info->snd_portid;
4713
4714 switch (type) {
4715 case NL80211_IFTYPE_MESH_POINT:
4716 if (!info->attrs[NL80211_ATTR_MESH_ID])
4717 break;
4718 wdev->u.mesh.id_up_len =
4719 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4720 memcpy(wdev->u.mesh.id,
4721 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4722 wdev->u.mesh.id_up_len);
4723 break;
4724 case NL80211_IFTYPE_NAN:
4725 case NL80211_IFTYPE_P2P_DEVICE:
4726 /*
4727 * P2P Device and NAN do not have a netdev, so don't go
4728 * through the netdev notifier and must be added here
4729 */
4730 cfg80211_init_wdev(wdev);
4731 cfg80211_register_wdev(rdev, wdev);
4732 break;
4733 default:
4734 break;
4735 }
4736
4737 if (radio_mask)
4738 wdev->radio_mask = radio_mask;
4739
4740 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4741 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4742 nlmsg_free(msg);
4743 return -ENOBUFS;
4744 }
4745
4746 return genlmsg_reply(msg, info);
4747 }
4748
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4749 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4750 {
4751 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4752
4753 /* to avoid failing a new interface creation due to pending removal */
4754 cfg80211_destroy_ifaces(rdev);
4755
4756 guard(wiphy)(&rdev->wiphy);
4757
4758 return _nl80211_new_interface(skb, info);
4759 }
4760
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4761 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4762 {
4763 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4764 struct wireless_dev *wdev = info->user_ptr[1];
4765
4766 if (!rdev->ops->del_virtual_intf)
4767 return -EOPNOTSUPP;
4768
4769 /*
4770 * We hold RTNL, so this is safe, without RTNL opencount cannot
4771 * reach 0, and thus the rdev cannot be deleted.
4772 *
4773 * We need to do it for the dev_close(), since that will call
4774 * the netdev notifiers, and we need to acquire the mutex there
4775 * but don't know if we get there from here or from some other
4776 * place (e.g. "ip link set ... down").
4777 */
4778 mutex_unlock(&rdev->wiphy.mtx);
4779
4780 /*
4781 * If we remove a wireless device without a netdev then clear
4782 * user_ptr[1] so that nl80211_post_doit won't dereference it
4783 * to check if it needs to do dev_put(). Otherwise it crashes
4784 * since the wdev has been freed, unlike with a netdev where
4785 * we need the dev_put() for the netdev to really be freed.
4786 */
4787 if (!wdev->netdev)
4788 info->user_ptr[1] = NULL;
4789 else
4790 dev_close(wdev->netdev);
4791
4792 mutex_lock(&rdev->wiphy.mtx);
4793
4794 return cfg80211_remove_virtual_intf(rdev, wdev);
4795 }
4796
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4797 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4798 {
4799 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4800 struct net_device *dev = info->user_ptr[1];
4801 u16 noack_map;
4802
4803 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4804 return -EINVAL;
4805
4806 if (!rdev->ops->set_noack_map)
4807 return -EOPNOTSUPP;
4808
4809 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4810
4811 return rdev_set_noack_map(rdev, dev, noack_map);
4812 }
4813
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4814 static int nl80211_validate_key_link_id(struct genl_info *info,
4815 struct wireless_dev *wdev,
4816 int link_id, bool pairwise)
4817 {
4818 if (pairwise) {
4819 if (link_id != -1) {
4820 GENL_SET_ERR_MSG(info,
4821 "link ID not allowed for pairwise key");
4822 return -EINVAL;
4823 }
4824
4825 return 0;
4826 }
4827
4828 if (wdev->valid_links) {
4829 if (link_id == -1) {
4830 GENL_SET_ERR_MSG(info,
4831 "link ID must for MLO group key");
4832 return -EINVAL;
4833 }
4834 if (!(wdev->valid_links & BIT(link_id))) {
4835 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4836 return -EINVAL;
4837 }
4838 } else if (link_id != -1) {
4839 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4840 return -EINVAL;
4841 }
4842
4843 return 0;
4844 }
4845
4846 struct get_key_cookie {
4847 struct sk_buff *msg;
4848 int error;
4849 int idx;
4850 };
4851
get_key_callback(void * c,struct key_params * params)4852 static void get_key_callback(void *c, struct key_params *params)
4853 {
4854 struct nlattr *key;
4855 struct get_key_cookie *cookie = c;
4856
4857 if ((params->seq &&
4858 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4859 params->seq_len, params->seq)) ||
4860 (params->cipher &&
4861 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4862 params->cipher)))
4863 goto nla_put_failure;
4864
4865 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4866 if (!key)
4867 goto nla_put_failure;
4868
4869 if ((params->seq &&
4870 nla_put(cookie->msg, NL80211_KEY_SEQ,
4871 params->seq_len, params->seq)) ||
4872 (params->cipher &&
4873 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4874 params->cipher)))
4875 goto nla_put_failure;
4876
4877 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4878 goto nla_put_failure;
4879
4880 nla_nest_end(cookie->msg, key);
4881
4882 return;
4883 nla_put_failure:
4884 cookie->error = 1;
4885 }
4886
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4887 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4888 {
4889 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4890 int err;
4891 struct net_device *dev = info->user_ptr[1];
4892 u8 key_idx = 0;
4893 const u8 *mac_addr = NULL;
4894 bool pairwise;
4895 struct get_key_cookie cookie = {
4896 .error = 0,
4897 };
4898 void *hdr;
4899 struct sk_buff *msg;
4900 bool bigtk_support = false;
4901 int link_id = nl80211_link_id_or_invalid(info->attrs);
4902 struct wireless_dev *wdev = dev->ieee80211_ptr;
4903
4904 if (wiphy_ext_feature_isset(&rdev->wiphy,
4905 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4906 bigtk_support = true;
4907
4908 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4909 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4910 wiphy_ext_feature_isset(&rdev->wiphy,
4911 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4912 bigtk_support = true;
4913
4914 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4915 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4916
4917 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4918 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4919 return -EINVAL;
4920 }
4921 }
4922
4923 if (info->attrs[NL80211_ATTR_MAC])
4924 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4925
4926 pairwise = !!mac_addr;
4927 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4928 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4929
4930 if (kt != NL80211_KEYTYPE_GROUP &&
4931 kt != NL80211_KEYTYPE_PAIRWISE)
4932 return -EINVAL;
4933 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4934 }
4935
4936 if (!rdev->ops->get_key)
4937 return -EOPNOTSUPP;
4938
4939 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4940 return -ENOENT;
4941
4942 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4943 if (!msg)
4944 return -ENOMEM;
4945
4946 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4947 NL80211_CMD_NEW_KEY);
4948 if (!hdr)
4949 goto nla_put_failure;
4950
4951 cookie.msg = msg;
4952 cookie.idx = key_idx;
4953
4954 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4955 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4956 goto nla_put_failure;
4957 if (mac_addr &&
4958 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4959 goto nla_put_failure;
4960
4961 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4962 if (err)
4963 goto free_msg;
4964
4965 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4966 &cookie, get_key_callback);
4967
4968 if (err)
4969 goto free_msg;
4970
4971 if (cookie.error)
4972 goto nla_put_failure;
4973
4974 genlmsg_end(msg, hdr);
4975 return genlmsg_reply(msg, info);
4976
4977 nla_put_failure:
4978 err = -ENOBUFS;
4979 free_msg:
4980 nlmsg_free(msg);
4981 return err;
4982 }
4983
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4984 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4985 {
4986 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4987 struct key_parse key;
4988 int err;
4989 struct net_device *dev = info->user_ptr[1];
4990 int link_id = nl80211_link_id_or_invalid(info->attrs);
4991 struct wireless_dev *wdev = dev->ieee80211_ptr;
4992
4993 err = nl80211_parse_key(info, &key);
4994 if (err)
4995 return err;
4996
4997 if (key.idx < 0)
4998 return -EINVAL;
4999
5000 /* Only support setting default key and
5001 * Extended Key ID action NL80211_KEY_SET_TX.
5002 */
5003 if (!key.def && !key.defmgmt && !key.defbeacon &&
5004 !(key.p.mode == NL80211_KEY_SET_TX))
5005 return -EINVAL;
5006
5007 if (key.def) {
5008 if (!rdev->ops->set_default_key)
5009 return -EOPNOTSUPP;
5010
5011 err = nl80211_key_allowed(wdev);
5012 if (err)
5013 return err;
5014
5015 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5016 if (err)
5017 return err;
5018
5019 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
5020 key.def_uni, key.def_multi);
5021
5022 if (err)
5023 return err;
5024
5025 #ifdef CONFIG_CFG80211_WEXT
5026 wdev->wext.default_key = key.idx;
5027 #endif
5028 return 0;
5029 } else if (key.defmgmt) {
5030 if (key.def_uni || !key.def_multi)
5031 return -EINVAL;
5032
5033 if (!rdev->ops->set_default_mgmt_key)
5034 return -EOPNOTSUPP;
5035
5036 err = nl80211_key_allowed(wdev);
5037 if (err)
5038 return err;
5039
5040 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5041 if (err)
5042 return err;
5043
5044 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
5045 if (err)
5046 return err;
5047
5048 #ifdef CONFIG_CFG80211_WEXT
5049 wdev->wext.default_mgmt_key = key.idx;
5050 #endif
5051 return 0;
5052 } else if (key.defbeacon) {
5053 if (key.def_uni || !key.def_multi)
5054 return -EINVAL;
5055
5056 if (!rdev->ops->set_default_beacon_key)
5057 return -EOPNOTSUPP;
5058
5059 err = nl80211_key_allowed(wdev);
5060 if (err)
5061 return err;
5062
5063 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
5064 if (err)
5065 return err;
5066
5067 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
5068 } else if (key.p.mode == NL80211_KEY_SET_TX &&
5069 wiphy_ext_feature_isset(&rdev->wiphy,
5070 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
5071 u8 *mac_addr = NULL;
5072
5073 if (info->attrs[NL80211_ATTR_MAC])
5074 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5075
5076 if (!mac_addr || key.idx < 0 || key.idx > 1)
5077 return -EINVAL;
5078
5079 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
5080 if (err)
5081 return err;
5082
5083 return rdev_add_key(rdev, dev, link_id, key.idx,
5084 NL80211_KEYTYPE_PAIRWISE,
5085 mac_addr, &key.p);
5086 }
5087
5088 return -EINVAL;
5089 }
5090
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)5091 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
5092 {
5093 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5094 int err;
5095 struct net_device *dev = info->user_ptr[1];
5096 struct key_parse key;
5097 const u8 *mac_addr = NULL;
5098 int link_id = nl80211_link_id_or_invalid(info->attrs);
5099 struct wireless_dev *wdev = dev->ieee80211_ptr;
5100
5101 err = nl80211_parse_key(info, &key);
5102 if (err)
5103 return err;
5104
5105 if (!key.p.key) {
5106 GENL_SET_ERR_MSG(info, "no key");
5107 return -EINVAL;
5108 }
5109
5110 if (info->attrs[NL80211_ATTR_MAC])
5111 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5112
5113 if (key.type == -1) {
5114 if (mac_addr)
5115 key.type = NL80211_KEYTYPE_PAIRWISE;
5116 else
5117 key.type = NL80211_KEYTYPE_GROUP;
5118 }
5119
5120 /* for now */
5121 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5122 key.type != NL80211_KEYTYPE_GROUP) {
5123 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
5124 return -EINVAL;
5125 }
5126
5127 if (key.type == NL80211_KEYTYPE_GROUP &&
5128 info->attrs[NL80211_ATTR_VLAN_ID])
5129 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5130
5131 if (!rdev->ops->add_key)
5132 return -EOPNOTSUPP;
5133
5134 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
5135 key.type == NL80211_KEYTYPE_PAIRWISE,
5136 mac_addr)) {
5137 GENL_SET_ERR_MSG(info, "key setting validation failed");
5138 return -EINVAL;
5139 }
5140
5141 err = nl80211_key_allowed(wdev);
5142 if (err)
5143 GENL_SET_ERR_MSG(info, "key not allowed");
5144
5145 if (!err)
5146 err = nl80211_validate_key_link_id(info, wdev, link_id,
5147 key.type == NL80211_KEYTYPE_PAIRWISE);
5148
5149 if (!err) {
5150 err = rdev_add_key(rdev, dev, link_id, key.idx,
5151 key.type == NL80211_KEYTYPE_PAIRWISE,
5152 mac_addr, &key.p);
5153 if (err)
5154 GENL_SET_ERR_MSG(info, "key addition failed");
5155 }
5156
5157 return err;
5158 }
5159
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)5160 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
5161 {
5162 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5163 int err;
5164 struct net_device *dev = info->user_ptr[1];
5165 u8 *mac_addr = NULL;
5166 struct key_parse key;
5167 int link_id = nl80211_link_id_or_invalid(info->attrs);
5168 struct wireless_dev *wdev = dev->ieee80211_ptr;
5169
5170 err = nl80211_parse_key(info, &key);
5171 if (err)
5172 return err;
5173
5174 if (info->attrs[NL80211_ATTR_MAC])
5175 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5176
5177 if (key.type == -1) {
5178 if (mac_addr)
5179 key.type = NL80211_KEYTYPE_PAIRWISE;
5180 else
5181 key.type = NL80211_KEYTYPE_GROUP;
5182 }
5183
5184 /* for now */
5185 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
5186 key.type != NL80211_KEYTYPE_GROUP)
5187 return -EINVAL;
5188
5189 if (!cfg80211_valid_key_idx(rdev, key.idx,
5190 key.type == NL80211_KEYTYPE_PAIRWISE))
5191 return -EINVAL;
5192
5193 if (!rdev->ops->del_key)
5194 return -EOPNOTSUPP;
5195
5196 err = nl80211_key_allowed(wdev);
5197
5198 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
5199 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
5200 err = -ENOENT;
5201
5202 if (!err)
5203 err = nl80211_validate_key_link_id(info, wdev, link_id,
5204 key.type == NL80211_KEYTYPE_PAIRWISE);
5205
5206 if (!err)
5207 err = rdev_del_key(rdev, dev, link_id, key.idx,
5208 key.type == NL80211_KEYTYPE_PAIRWISE,
5209 mac_addr);
5210
5211 #ifdef CONFIG_CFG80211_WEXT
5212 if (!err) {
5213 if (key.idx == wdev->wext.default_key)
5214 wdev->wext.default_key = -1;
5215 else if (key.idx == wdev->wext.default_mgmt_key)
5216 wdev->wext.default_mgmt_key = -1;
5217 }
5218 #endif
5219
5220 return err;
5221 }
5222
5223 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)5224 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5225 {
5226 struct nlattr *attr;
5227 int n_entries = 0, tmp;
5228
5229 nla_for_each_nested(attr, nl_attr, tmp) {
5230 if (nla_len(attr) != ETH_ALEN)
5231 return -EINVAL;
5232
5233 n_entries++;
5234 }
5235
5236 return n_entries;
5237 }
5238
5239 /*
5240 * This function parses ACL information and allocates memory for ACL data.
5241 * On successful return, the calling function is responsible to free the
5242 * ACL buffer returned by this function.
5243 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)5244 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5245 struct genl_info *info)
5246 {
5247 enum nl80211_acl_policy acl_policy;
5248 struct nlattr *attr;
5249 struct cfg80211_acl_data *acl;
5250 int i = 0, n_entries, tmp;
5251
5252 if (!wiphy->max_acl_mac_addrs)
5253 return ERR_PTR(-EOPNOTSUPP);
5254
5255 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5256 return ERR_PTR(-EINVAL);
5257
5258 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5259 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5260 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5261 return ERR_PTR(-EINVAL);
5262
5263 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5264 return ERR_PTR(-EINVAL);
5265
5266 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5267 if (n_entries < 0)
5268 return ERR_PTR(n_entries);
5269
5270 if (n_entries > wiphy->max_acl_mac_addrs)
5271 return ERR_PTR(-EOPNOTSUPP);
5272
5273 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5274 if (!acl)
5275 return ERR_PTR(-ENOMEM);
5276 acl->n_acl_entries = n_entries;
5277
5278 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5279 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5280 i++;
5281 }
5282 acl->acl_policy = acl_policy;
5283
5284 return acl;
5285 }
5286
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)5287 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5288 {
5289 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5290 struct net_device *dev = info->user_ptr[1];
5291 struct cfg80211_acl_data *acl;
5292 int err;
5293
5294 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5295 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5296 return -EOPNOTSUPP;
5297
5298 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5299 return -EINVAL;
5300
5301 acl = parse_acl_data(&rdev->wiphy, info);
5302 if (IS_ERR(acl))
5303 return PTR_ERR(acl);
5304
5305 err = rdev_set_mac_acl(rdev, dev, acl);
5306
5307 kfree(acl);
5308
5309 return err;
5310 }
5311
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)5312 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5313 u8 *rates, u8 rates_len)
5314 {
5315 u8 i;
5316 u32 mask = 0;
5317
5318 for (i = 0; i < rates_len; i++) {
5319 int rate = (rates[i] & 0x7f) * 5;
5320 int ridx;
5321
5322 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5323 struct ieee80211_rate *srate =
5324 &sband->bitrates[ridx];
5325 if (rate == srate->bitrate) {
5326 mask |= 1 << ridx;
5327 break;
5328 }
5329 }
5330 if (ridx == sband->n_bitrates)
5331 return 0; /* rate not found */
5332 }
5333
5334 return mask;
5335 }
5336
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])5337 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5338 u8 *rates, u8 rates_len,
5339 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5340 {
5341 u8 i;
5342
5343 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5344
5345 for (i = 0; i < rates_len; i++) {
5346 int ridx, rbit;
5347
5348 ridx = rates[i] / 8;
5349 rbit = BIT(rates[i] % 8);
5350
5351 /* check validity */
5352 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5353 return false;
5354
5355 /* check availability */
5356 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5357 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5358 mcs[ridx] |= rbit;
5359 else
5360 return false;
5361 }
5362
5363 return true;
5364 }
5365
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)5366 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5367 {
5368 u16 mcs_mask = 0;
5369
5370 switch (vht_mcs_map) {
5371 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5372 break;
5373 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5374 mcs_mask = 0x00FF;
5375 break;
5376 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5377 mcs_mask = 0x01FF;
5378 break;
5379 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5380 mcs_mask = 0x03FF;
5381 break;
5382 default:
5383 break;
5384 }
5385
5386 return mcs_mask;
5387 }
5388
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5389 static void vht_build_mcs_mask(u16 vht_mcs_map,
5390 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5391 {
5392 u8 nss;
5393
5394 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5395 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5396 vht_mcs_map >>= 2;
5397 }
5398 }
5399
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5400 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5401 struct nl80211_txrate_vht *txrate,
5402 u16 mcs[NL80211_VHT_NSS_MAX])
5403 {
5404 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5405 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5406 u8 i;
5407
5408 if (!sband->vht_cap.vht_supported)
5409 return false;
5410
5411 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5412
5413 /* Build vht_mcs_mask from VHT capabilities */
5414 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5415
5416 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5417 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5418 mcs[i] = txrate->mcs[i];
5419 else
5420 return false;
5421 }
5422
5423 return true;
5424 }
5425
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5426 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5427 {
5428 switch (he_mcs_map) {
5429 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5430 return 0;
5431 case IEEE80211_HE_MCS_SUPPORT_0_7:
5432 return 0x00FF;
5433 case IEEE80211_HE_MCS_SUPPORT_0_9:
5434 return 0x03FF;
5435 case IEEE80211_HE_MCS_SUPPORT_0_11:
5436 return 0xFFF;
5437 default:
5438 break;
5439 }
5440 return 0;
5441 }
5442
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5443 static void he_build_mcs_mask(u16 he_mcs_map,
5444 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5445 {
5446 u8 nss;
5447
5448 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5449 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5450 he_mcs_map >>= 2;
5451 }
5452 }
5453
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5454 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5455 const struct ieee80211_sta_he_cap *he_cap)
5456 {
5457 struct net_device *dev = info->user_ptr[1];
5458 struct wireless_dev *wdev = dev->ieee80211_ptr;
5459 struct cfg80211_chan_def *chandef;
5460 __le16 tx_mcs;
5461
5462 chandef = wdev_chandef(wdev, link_id);
5463 if (!chandef) {
5464 /*
5465 * This is probably broken, but we never maintained
5466 * a chandef in these cases, so it always was.
5467 */
5468 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5469 }
5470
5471 switch (chandef->width) {
5472 case NL80211_CHAN_WIDTH_80P80:
5473 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5474 break;
5475 case NL80211_CHAN_WIDTH_160:
5476 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5477 break;
5478 default:
5479 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5480 break;
5481 }
5482
5483 return le16_to_cpu(tx_mcs);
5484 }
5485
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5486 static bool he_set_mcs_mask(struct genl_info *info,
5487 struct wireless_dev *wdev,
5488 struct ieee80211_supported_band *sband,
5489 struct nl80211_txrate_he *txrate,
5490 u16 mcs[NL80211_HE_NSS_MAX],
5491 unsigned int link_id)
5492 {
5493 const struct ieee80211_sta_he_cap *he_cap;
5494 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5495 u16 tx_mcs_map = 0;
5496 u8 i;
5497
5498 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5499 if (!he_cap)
5500 return false;
5501
5502 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5503
5504 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5505
5506 /* Build he_mcs_mask from HE capabilities */
5507 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5508
5509 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5510 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5511 mcs[i] = txrate->mcs[i];
5512 else
5513 return false;
5514 }
5515
5516 return true;
5517 }
5518
eht_build_mcs_mask(struct genl_info * info,const struct ieee80211_sta_eht_cap * eht_cap,u8 mcs_nss_len,u16 * mcs_mask)5519 static void eht_build_mcs_mask(struct genl_info *info,
5520 const struct ieee80211_sta_eht_cap *eht_cap,
5521 u8 mcs_nss_len, u16 *mcs_mask)
5522 {
5523 struct net_device *dev = info->user_ptr[1];
5524 struct wireless_dev *wdev = dev->ieee80211_ptr;
5525 u8 nss, mcs_7 = 0, mcs_9 = 0, mcs_11 = 0, mcs_13 = 0;
5526 unsigned int link_id = nl80211_link_id(info->attrs);
5527
5528 if (mcs_nss_len == 4) {
5529 const struct ieee80211_eht_mcs_nss_supp_20mhz_only *mcs =
5530 &eht_cap->eht_mcs_nss_supp.only_20mhz;
5531
5532 mcs_7 = u8_get_bits(mcs->rx_tx_mcs7_max_nss,
5533 IEEE80211_EHT_MCS_NSS_TX);
5534 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5535 IEEE80211_EHT_MCS_NSS_TX);
5536 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5537 IEEE80211_EHT_MCS_NSS_TX);
5538 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5539 IEEE80211_EHT_MCS_NSS_TX);
5540
5541 } else {
5542 const struct ieee80211_eht_mcs_nss_supp_bw *mcs;
5543 enum nl80211_chan_width width;
5544
5545 switch (wdev->iftype) {
5546 case NL80211_IFTYPE_ADHOC:
5547 width = wdev->u.ibss.chandef.width;
5548 break;
5549 case NL80211_IFTYPE_MESH_POINT:
5550 width = wdev->u.mesh.chandef.width;
5551 break;
5552 case NL80211_IFTYPE_OCB:
5553 width = wdev->u.ocb.chandef.width;
5554 break;
5555 default:
5556 if (wdev->valid_links)
5557 width = wdev->links[link_id].ap.chandef.width;
5558 else
5559 width = wdev->u.ap.preset_chandef.width;
5560 break;
5561 }
5562
5563 switch (width) {
5564 case NL80211_CHAN_WIDTH_320:
5565 mcs = &eht_cap->eht_mcs_nss_supp.bw._320;
5566 break;
5567 case NL80211_CHAN_WIDTH_160:
5568 mcs = &eht_cap->eht_mcs_nss_supp.bw._160;
5569 break;
5570 default:
5571 mcs = &eht_cap->eht_mcs_nss_supp.bw._80;
5572 break;
5573 }
5574
5575 mcs_7 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5576 IEEE80211_EHT_MCS_NSS_TX);
5577 mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
5578 IEEE80211_EHT_MCS_NSS_TX);
5579 mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
5580 IEEE80211_EHT_MCS_NSS_TX);
5581 mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
5582 IEEE80211_EHT_MCS_NSS_TX);
5583 }
5584
5585 /* Enable MCS 14 for NSS 0 */
5586 if (eht_cap->eht_cap_elem.phy_cap_info[6] &
5587 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP)
5588 mcs_mask[0] |= 0x4000;
5589
5590 /* Enable MCS 15 for NSS 0 */
5591 mcs_mask[0] |= 0x8000;
5592
5593 for (nss = 0; nss < NL80211_EHT_NSS_MAX; nss++) {
5594 if (!mcs_7)
5595 continue;
5596 mcs_mask[nss] |= 0x00FF;
5597 mcs_7--;
5598
5599 if (!mcs_9)
5600 continue;
5601 mcs_mask[nss] |= 0x0300;
5602 mcs_9--;
5603
5604 if (!mcs_11)
5605 continue;
5606 mcs_mask[nss] |= 0x0C00;
5607 mcs_11--;
5608
5609 if (!mcs_13)
5610 continue;
5611 mcs_mask[nss] |= 0x3000;
5612 mcs_13--;
5613 }
5614 }
5615
eht_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_eht * txrate,u16 mcs[NL80211_EHT_NSS_MAX])5616 static bool eht_set_mcs_mask(struct genl_info *info, struct wireless_dev *wdev,
5617 struct ieee80211_supported_band *sband,
5618 struct nl80211_txrate_eht *txrate,
5619 u16 mcs[NL80211_EHT_NSS_MAX])
5620 {
5621 const struct ieee80211_sta_he_cap *he_cap;
5622 const struct ieee80211_sta_eht_cap *eht_cap;
5623 u16 tx_mcs_mask[NL80211_EHT_NSS_MAX] = { 0 };
5624 u8 i, mcs_nss_len;
5625
5626 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5627 if (!he_cap)
5628 return false;
5629
5630 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5631 if (!eht_cap)
5632 return false;
5633
5634 /* Checks for MCS 14 */
5635 if (txrate->mcs[0] & 0x4000) {
5636 if (sband->band != NL80211_BAND_6GHZ)
5637 return false;
5638
5639 if (!(eht_cap->eht_cap_elem.phy_cap_info[6] &
5640 IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP))
5641 return false;
5642 }
5643
5644 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5645 &eht_cap->eht_cap_elem,
5646 wdev->iftype ==
5647 NL80211_IFTYPE_STATION);
5648
5649 if (mcs_nss_len == 3) {
5650 /* Supported iftypes for setting non-20 MHZ only EHT MCS */
5651 switch (wdev->iftype) {
5652 case NL80211_IFTYPE_ADHOC:
5653 case NL80211_IFTYPE_AP:
5654 case NL80211_IFTYPE_P2P_GO:
5655 case NL80211_IFTYPE_MESH_POINT:
5656 case NL80211_IFTYPE_OCB:
5657 break;
5658 default:
5659 return false;
5660 }
5661 }
5662
5663 /* Build eht_mcs_mask from EHT and HE capabilities */
5664 eht_build_mcs_mask(info, eht_cap, mcs_nss_len, tx_mcs_mask);
5665
5666 memset(mcs, 0, sizeof(u16) * NL80211_EHT_NSS_MAX);
5667 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5668 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5669 mcs[i] = txrate->mcs[i];
5670 else
5671 return false;
5672 }
5673
5674 return true;
5675 }
5676
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5677 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5678 struct nlattr *attrs[],
5679 enum nl80211_attrs attr,
5680 struct cfg80211_bitrate_mask *mask,
5681 struct net_device *dev,
5682 bool default_all_enabled,
5683 unsigned int link_id)
5684 {
5685 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5686 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5687 struct wireless_dev *wdev = dev->ieee80211_ptr;
5688 int rem, i;
5689 struct nlattr *tx_rates;
5690 struct ieee80211_supported_band *sband;
5691 u16 vht_tx_mcs_map, he_tx_mcs_map;
5692
5693 memset(mask, 0, sizeof(*mask));
5694 /* Default to all rates enabled */
5695 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5696 const struct ieee80211_sta_he_cap *he_cap;
5697 const struct ieee80211_sta_eht_cap *eht_cap;
5698 u8 mcs_nss_len;
5699
5700 if (!default_all_enabled)
5701 break;
5702
5703 sband = rdev->wiphy.bands[i];
5704
5705 if (!sband)
5706 continue;
5707
5708 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5709 memcpy(mask->control[i].ht_mcs,
5710 sband->ht_cap.mcs.rx_mask,
5711 sizeof(mask->control[i].ht_mcs));
5712
5713 if (sband->vht_cap.vht_supported) {
5714 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5715 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5716 }
5717
5718 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5719 if (!he_cap)
5720 continue;
5721
5722 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5723 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5724
5725 mask->control[i].he_gi = 0xFF;
5726 mask->control[i].he_ltf = 0xFF;
5727
5728 eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
5729 if (!eht_cap)
5730 continue;
5731
5732 mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5733 &eht_cap->eht_cap_elem,
5734 wdev->iftype ==
5735 NL80211_IFTYPE_STATION);
5736
5737 eht_build_mcs_mask(info, eht_cap, mcs_nss_len,
5738 mask->control[i].eht_mcs);
5739
5740 mask->control[i].eht_gi = 0xFF;
5741 mask->control[i].eht_ltf = 0xFF;
5742 }
5743
5744 /* if no rates are given set it back to the defaults */
5745 if (!attrs[attr])
5746 goto out;
5747
5748 /* The nested attribute uses enum nl80211_band as the index. This maps
5749 * directly to the enum nl80211_band values used in cfg80211.
5750 */
5751 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5752 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5753 enum nl80211_band band = nla_type(tx_rates);
5754 int err;
5755
5756 if (band < 0 || band >= NUM_NL80211_BANDS)
5757 return -EINVAL;
5758 sband = rdev->wiphy.bands[band];
5759 if (sband == NULL)
5760 return -EINVAL;
5761 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5762 tx_rates,
5763 nl80211_txattr_policy,
5764 info->extack);
5765 if (err)
5766 return err;
5767 if (tb[NL80211_TXRATE_LEGACY]) {
5768 mask->control[band].legacy = rateset_to_mask(
5769 sband,
5770 nla_data(tb[NL80211_TXRATE_LEGACY]),
5771 nla_len(tb[NL80211_TXRATE_LEGACY]));
5772 if ((mask->control[band].legacy == 0) &&
5773 nla_len(tb[NL80211_TXRATE_LEGACY]))
5774 return -EINVAL;
5775 }
5776 if (tb[NL80211_TXRATE_HT]) {
5777 if (!ht_rateset_to_mask(
5778 sband,
5779 nla_data(tb[NL80211_TXRATE_HT]),
5780 nla_len(tb[NL80211_TXRATE_HT]),
5781 mask->control[band].ht_mcs))
5782 return -EINVAL;
5783 }
5784
5785 if (tb[NL80211_TXRATE_VHT]) {
5786 if (!vht_set_mcs_mask(
5787 sband,
5788 nla_data(tb[NL80211_TXRATE_VHT]),
5789 mask->control[band].vht_mcs))
5790 return -EINVAL;
5791 }
5792
5793 if (tb[NL80211_TXRATE_GI]) {
5794 mask->control[band].gi =
5795 nla_get_u8(tb[NL80211_TXRATE_GI]);
5796 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5797 return -EINVAL;
5798 }
5799 if (tb[NL80211_TXRATE_HE] &&
5800 !he_set_mcs_mask(info, wdev, sband,
5801 nla_data(tb[NL80211_TXRATE_HE]),
5802 mask->control[band].he_mcs,
5803 link_id))
5804 return -EINVAL;
5805
5806 if (tb[NL80211_TXRATE_HE_GI])
5807 mask->control[band].he_gi =
5808 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5809 if (tb[NL80211_TXRATE_HE_LTF])
5810 mask->control[band].he_ltf =
5811 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5812
5813 if (tb[NL80211_TXRATE_EHT] &&
5814 !eht_set_mcs_mask(info, wdev, sband,
5815 nla_data(tb[NL80211_TXRATE_EHT]),
5816 mask->control[band].eht_mcs))
5817 return -EINVAL;
5818
5819 if (tb[NL80211_TXRATE_EHT_GI])
5820 mask->control[band].eht_gi =
5821 nla_get_u8(tb[NL80211_TXRATE_EHT_GI]);
5822 if (tb[NL80211_TXRATE_EHT_LTF])
5823 mask->control[band].eht_ltf =
5824 nla_get_u8(tb[NL80211_TXRATE_EHT_LTF]);
5825
5826 if (mask->control[band].legacy == 0) {
5827 /* don't allow empty legacy rates if HT, VHT, HE or EHT
5828 * are not even supported.
5829 */
5830 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5831 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5832 ieee80211_get_he_iftype_cap(sband, wdev->iftype) ||
5833 ieee80211_get_eht_iftype_cap(sband, wdev->iftype)))
5834 return -EINVAL;
5835
5836 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5837 if (mask->control[band].ht_mcs[i])
5838 goto out;
5839
5840 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5841 if (mask->control[band].vht_mcs[i])
5842 goto out;
5843
5844 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5845 if (mask->control[band].he_mcs[i])
5846 goto out;
5847
5848 for (i = 0; i < NL80211_EHT_NSS_MAX; i++)
5849 if (mask->control[band].eht_mcs[i])
5850 goto out;
5851
5852 /* legacy and mcs rates may not be both empty */
5853 return -EINVAL;
5854 }
5855 }
5856
5857 out:
5858 return 0;
5859 }
5860
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5861 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5862 enum nl80211_band band,
5863 struct cfg80211_bitrate_mask *beacon_rate)
5864 {
5865 u32 count_ht, count_vht, count_he, count_eht, i;
5866 u32 rate = beacon_rate->control[band].legacy;
5867
5868 /* Allow only one rate */
5869 if (hweight32(rate) > 1)
5870 return -EINVAL;
5871
5872 count_ht = 0;
5873 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5874 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5875 return -EINVAL;
5876 } else if (beacon_rate->control[band].ht_mcs[i]) {
5877 count_ht++;
5878 if (count_ht > 1)
5879 return -EINVAL;
5880 }
5881 if (count_ht && rate)
5882 return -EINVAL;
5883 }
5884
5885 count_vht = 0;
5886 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5887 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5888 return -EINVAL;
5889 } else if (beacon_rate->control[band].vht_mcs[i]) {
5890 count_vht++;
5891 if (count_vht > 1)
5892 return -EINVAL;
5893 }
5894 if (count_vht && rate)
5895 return -EINVAL;
5896 }
5897
5898 count_he = 0;
5899 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5900 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5901 return -EINVAL;
5902 } else if (beacon_rate->control[band].he_mcs[i]) {
5903 count_he++;
5904 if (count_he > 1)
5905 return -EINVAL;
5906 }
5907 if (count_he && rate)
5908 return -EINVAL;
5909 }
5910
5911 count_eht = 0;
5912 for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
5913 if (hweight16(beacon_rate->control[band].eht_mcs[i]) > 1) {
5914 return -EINVAL;
5915 } else if (beacon_rate->control[band].eht_mcs[i]) {
5916 count_eht++;
5917 if (count_eht > 1)
5918 return -EINVAL;
5919 }
5920 if (count_eht && rate)
5921 return -EINVAL;
5922 }
5923
5924 if ((count_ht && count_vht && count_he && count_eht) ||
5925 (!rate && !count_ht && !count_vht && !count_he && !count_eht))
5926 return -EINVAL;
5927
5928 if (rate &&
5929 !wiphy_ext_feature_isset(&rdev->wiphy,
5930 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5931 return -EINVAL;
5932 if (count_ht &&
5933 !wiphy_ext_feature_isset(&rdev->wiphy,
5934 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5935 return -EINVAL;
5936 if (count_vht &&
5937 !wiphy_ext_feature_isset(&rdev->wiphy,
5938 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5939 return -EINVAL;
5940 if (count_he &&
5941 !wiphy_ext_feature_isset(&rdev->wiphy,
5942 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5943 return -EINVAL;
5944
5945 if (count_eht &&
5946 !wiphy_ext_feature_isset(&rdev->wiphy,
5947 NL80211_EXT_FEATURE_BEACON_RATE_EHT))
5948 return -EINVAL;
5949
5950 return 0;
5951 }
5952
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,unsigned int link_id,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5953 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5954 struct net_device *dev,
5955 unsigned int link_id,
5956 struct nlattr *attrs,
5957 struct cfg80211_mbssid_config *config,
5958 u8 num_elems)
5959 {
5960 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5961 int tx_link_id = -1;
5962
5963 if (!wiphy->mbssid_max_interfaces)
5964 return -EOPNOTSUPP;
5965
5966 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5967 NULL) ||
5968 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5969 return -EINVAL;
5970
5971 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5972 if (config->ema) {
5973 if (!wiphy->ema_max_profile_periodicity)
5974 return -EOPNOTSUPP;
5975
5976 if (num_elems > wiphy->ema_max_profile_periodicity)
5977 return -EINVAL;
5978 }
5979
5980 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5981 if (config->index >= wiphy->mbssid_max_interfaces ||
5982 (!config->index && !num_elems))
5983 return -EINVAL;
5984
5985 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
5986 tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
5987
5988 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5989 u32 tx_ifindex =
5990 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5991
5992 if ((!config->index && tx_ifindex != dev->ifindex) ||
5993 (config->index && tx_ifindex == dev->ifindex))
5994 return -EINVAL;
5995
5996 if (tx_ifindex != dev->ifindex) {
5997 struct net_device *tx_netdev =
5998 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5999
6000 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
6001 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
6002 tx_netdev->ieee80211_ptr->iftype !=
6003 NL80211_IFTYPE_AP) {
6004 dev_put(tx_netdev);
6005 return -EINVAL;
6006 }
6007
6008 config->tx_wdev = tx_netdev->ieee80211_ptr;
6009 /* Caller should call dev_put(config->tx_wdev) from this point */
6010
6011 if (config->tx_wdev->valid_links) {
6012 if (tx_link_id == -1 ||
6013 !(config->tx_wdev->valid_links & BIT(tx_link_id)))
6014 return -ENOLINK;
6015
6016 config->tx_link_id = tx_link_id;
6017 }
6018 } else {
6019 if (tx_link_id >= 0 && tx_link_id != link_id)
6020 return -EINVAL;
6021
6022 config->tx_wdev = dev->ieee80211_ptr;
6023 }
6024 } else if (!config->index) {
6025 if (tx_link_id >= 0 && tx_link_id != link_id)
6026 return -EINVAL;
6027
6028 config->tx_wdev = dev->ieee80211_ptr;
6029 } else {
6030 return -EINVAL;
6031 }
6032
6033 return 0;
6034 }
6035
6036 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)6037 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
6038 {
6039 struct nlattr *nl_elems;
6040 struct cfg80211_mbssid_elems *elems;
6041 int rem_elems;
6042 u8 i = 0, num_elems = 0;
6043
6044 if (!wiphy->mbssid_max_interfaces)
6045 return ERR_PTR(-EINVAL);
6046
6047 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6048 if (num_elems >= 255)
6049 return ERR_PTR(-EINVAL);
6050 num_elems++;
6051 }
6052
6053 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6054 if (!elems)
6055 return ERR_PTR(-ENOMEM);
6056 elems->cnt = num_elems;
6057
6058 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6059 elems->elem[i].data = nla_data(nl_elems);
6060 elems->elem[i].len = nla_len(nl_elems);
6061 i++;
6062 }
6063 return elems;
6064 }
6065
6066 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)6067 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
6068 struct netlink_ext_ack *extack)
6069 {
6070 struct nlattr *nl_elems;
6071 struct cfg80211_rnr_elems *elems;
6072 int rem_elems;
6073 u8 i = 0, num_elems = 0;
6074
6075 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6076 int ret;
6077
6078 ret = validate_ie_attr(nl_elems, extack);
6079 if (ret)
6080 return ERR_PTR(ret);
6081
6082 num_elems++;
6083 }
6084
6085 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
6086 if (!elems)
6087 return ERR_PTR(-ENOMEM);
6088 elems->cnt = num_elems;
6089
6090 nla_for_each_nested(nl_elems, attrs, rem_elems) {
6091 elems->elem[i].data = nla_data(nl_elems);
6092 elems->elem[i].len = nla_len(nl_elems);
6093 i++;
6094 }
6095 return elems;
6096 }
6097
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)6098 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
6099 struct cfg80211_he_bss_color *he_bss_color)
6100 {
6101 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
6102 int err;
6103
6104 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
6105 he_bss_color_policy, NULL);
6106 if (err)
6107 return err;
6108
6109 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
6110 return -EINVAL;
6111
6112 he_bss_color->color =
6113 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
6114 he_bss_color->enabled =
6115 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
6116 he_bss_color->partial =
6117 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
6118
6119 return 0;
6120 }
6121
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)6122 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
6123 struct nlattr *attrs[],
6124 struct cfg80211_beacon_data *bcn,
6125 struct netlink_ext_ack *extack)
6126 {
6127 bool haveinfo = false;
6128 int err;
6129
6130 memset(bcn, 0, sizeof(*bcn));
6131
6132 bcn->link_id = nl80211_link_id(attrs);
6133
6134 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
6135 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
6136 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
6137 if (!bcn->head_len)
6138 return -EINVAL;
6139 haveinfo = true;
6140 }
6141
6142 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
6143 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
6144 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
6145 haveinfo = true;
6146 }
6147
6148 if (!haveinfo)
6149 return -EINVAL;
6150
6151 if (attrs[NL80211_ATTR_IE]) {
6152 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
6153 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
6154 }
6155
6156 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
6157 bcn->proberesp_ies =
6158 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6159 bcn->proberesp_ies_len =
6160 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
6161 }
6162
6163 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
6164 bcn->assocresp_ies =
6165 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6166 bcn->assocresp_ies_len =
6167 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
6168 }
6169
6170 if (attrs[NL80211_ATTR_PROBE_RESP]) {
6171 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
6172 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
6173 }
6174
6175 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
6176 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
6177
6178 err = nla_parse_nested_deprecated(tb,
6179 NL80211_FTM_RESP_ATTR_MAX,
6180 attrs[NL80211_ATTR_FTM_RESPONDER],
6181 NULL, NULL);
6182 if (err)
6183 return err;
6184
6185 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
6186 wiphy_ext_feature_isset(&rdev->wiphy,
6187 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
6188 bcn->ftm_responder = 1;
6189 else
6190 return -EOPNOTSUPP;
6191
6192 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
6193 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
6194 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
6195 }
6196
6197 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
6198 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6199 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
6200 }
6201 } else {
6202 bcn->ftm_responder = -1;
6203 }
6204
6205 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
6206 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
6207 &bcn->he_bss_color);
6208 if (err)
6209 return err;
6210 bcn->he_bss_color_valid = true;
6211 }
6212
6213 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
6214 struct cfg80211_mbssid_elems *mbssid =
6215 nl80211_parse_mbssid_elems(&rdev->wiphy,
6216 attrs[NL80211_ATTR_MBSSID_ELEMS]);
6217
6218 if (IS_ERR(mbssid))
6219 return PTR_ERR(mbssid);
6220
6221 bcn->mbssid_ies = mbssid;
6222
6223 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
6224 struct cfg80211_rnr_elems *rnr =
6225 nl80211_parse_rnr_elems(&rdev->wiphy,
6226 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
6227 extack);
6228
6229 if (IS_ERR(rnr))
6230 return PTR_ERR(rnr);
6231
6232 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
6233 return -EINVAL;
6234
6235 bcn->rnr_ies = rnr;
6236 }
6237 }
6238
6239 return 0;
6240 }
6241
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)6242 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
6243 struct ieee80211_he_obss_pd *he_obss_pd)
6244 {
6245 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
6246 int err;
6247
6248 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
6249 he_obss_pd_policy, NULL);
6250 if (err)
6251 return err;
6252
6253 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
6254 return -EINVAL;
6255
6256 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
6257
6258 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
6259 he_obss_pd->min_offset =
6260 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
6261 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
6262 he_obss_pd->max_offset =
6263 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
6264 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
6265 he_obss_pd->non_srg_max_offset =
6266 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
6267
6268 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
6269 return -EINVAL;
6270
6271 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
6272 memcpy(he_obss_pd->bss_color_bitmap,
6273 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
6274 sizeof(he_obss_pd->bss_color_bitmap));
6275
6276 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
6277 memcpy(he_obss_pd->partial_bssid_bitmap,
6278 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
6279 sizeof(he_obss_pd->partial_bssid_bitmap));
6280
6281 he_obss_pd->enable = true;
6282
6283 return 0;
6284 }
6285
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_fils_discovery * fd)6286 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
6287 struct nlattr *attrs,
6288 struct cfg80211_fils_discovery *fd)
6289 {
6290 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
6291 int ret;
6292
6293 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6294 NL80211_EXT_FEATURE_FILS_DISCOVERY))
6295 return -EINVAL;
6296
6297 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
6298 NULL, NULL);
6299 if (ret)
6300 return ret;
6301
6302 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
6303 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
6304 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
6305 fd->update = true;
6306 return 0;
6307 }
6308
6309 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
6310 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
6311 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
6312 return -EINVAL;
6313
6314 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6315 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
6316 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
6317 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
6318 fd->update = true;
6319 return 0;
6320 }
6321
6322 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_unsol_bcast_probe_resp * presp)6323 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
6324 struct nlattr *attrs,
6325 struct cfg80211_unsol_bcast_probe_resp *presp)
6326 {
6327 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
6328 int ret;
6329
6330 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6331 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
6332 return -EINVAL;
6333
6334 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
6335 attrs, NULL, NULL);
6336 if (ret)
6337 return ret;
6338
6339 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
6340 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
6341 presp->update = true;
6342 return 0;
6343 }
6344
6345 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
6346 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
6347 return -EINVAL;
6348
6349 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6350 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
6351 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
6352 presp->update = true;
6353 return 0;
6354 }
6355
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)6356 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
6357 const struct element *rates)
6358 {
6359 int i;
6360
6361 if (!rates)
6362 return;
6363
6364 for (i = 0; i < rates->datalen; i++) {
6365 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
6366 params->ht_required = true;
6367 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
6368 params->vht_required = true;
6369 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
6370 params->he_required = true;
6371 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
6372 params->sae_h2e_required = true;
6373 }
6374 }
6375
6376 /*
6377 * Since the nl80211 API didn't include, from the beginning, attributes about
6378 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
6379 * benefit of drivers that rebuild IEs in the firmware.
6380 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)6381 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
6382 {
6383 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
6384 size_t ies_len = bcn->tail_len;
6385 const u8 *ies = bcn->tail;
6386 const struct element *rates;
6387 const struct element *cap;
6388
6389 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
6390 nl80211_check_ap_rate_selectors(params, rates);
6391
6392 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
6393 nl80211_check_ap_rate_selectors(params, rates);
6394
6395 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
6396 if (cap && cap->datalen >= sizeof(*params->ht_cap))
6397 params->ht_cap = (void *)cap->data;
6398 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
6399 if (cap && cap->datalen >= sizeof(*params->vht_cap))
6400 params->vht_cap = (void *)cap->data;
6401 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
6402 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
6403 params->he_cap = (void *)(cap->data + 1);
6404 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
6405 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
6406 params->he_oper = (void *)(cap->data + 1);
6407 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
6408 if (cap) {
6409 if (!cap->datalen)
6410 return -EINVAL;
6411 params->eht_cap = (void *)(cap->data + 1);
6412 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
6413 (const u8 *)params->eht_cap,
6414 cap->datalen - 1, true))
6415 return -EINVAL;
6416 }
6417 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
6418 if (cap) {
6419 if (!cap->datalen)
6420 return -EINVAL;
6421 params->eht_oper = (void *)(cap->data + 1);
6422 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
6423 cap->datalen - 1))
6424 return -EINVAL;
6425 }
6426 return 0;
6427 }
6428
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)6429 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
6430 struct cfg80211_ap_settings *params)
6431 {
6432 struct wireless_dev *wdev;
6433
6434 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
6435 if (wdev->iftype != NL80211_IFTYPE_AP &&
6436 wdev->iftype != NL80211_IFTYPE_P2P_GO)
6437 continue;
6438
6439 if (!wdev->u.ap.preset_chandef.chan)
6440 continue;
6441
6442 params->chandef = wdev->u.ap.preset_chandef;
6443 return true;
6444 }
6445
6446 return false;
6447 }
6448
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)6449 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6450 enum nl80211_auth_type auth_type,
6451 enum nl80211_commands cmd)
6452 {
6453 if (auth_type > NL80211_AUTHTYPE_MAX)
6454 return false;
6455
6456 switch (cmd) {
6457 case NL80211_CMD_AUTHENTICATE:
6458 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6459 auth_type == NL80211_AUTHTYPE_SAE)
6460 return false;
6461 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6462 NL80211_EXT_FEATURE_FILS_STA) &&
6463 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6464 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6465 auth_type == NL80211_AUTHTYPE_FILS_PK))
6466 return false;
6467 return true;
6468 case NL80211_CMD_CONNECT:
6469 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6470 !wiphy_ext_feature_isset(&rdev->wiphy,
6471 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6472 auth_type == NL80211_AUTHTYPE_SAE)
6473 return false;
6474
6475 /* FILS with SK PFS or PK not supported yet */
6476 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6477 auth_type == NL80211_AUTHTYPE_FILS_PK)
6478 return false;
6479 if (!wiphy_ext_feature_isset(
6480 &rdev->wiphy,
6481 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6482 auth_type == NL80211_AUTHTYPE_FILS_SK)
6483 return false;
6484 return true;
6485 case NL80211_CMD_START_AP:
6486 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6487 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6488 auth_type == NL80211_AUTHTYPE_SAE)
6489 return false;
6490 /* FILS not supported yet */
6491 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6492 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6493 auth_type == NL80211_AUTHTYPE_FILS_PK)
6494 return false;
6495 return true;
6496 default:
6497 return false;
6498 }
6499 }
6500
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)6501 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6502 unsigned int link_id)
6503 {
6504 struct wiphy *wiphy = wdev->wiphy;
6505 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6506 struct sk_buff *msg;
6507 void *hdr;
6508
6509 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6510 if (!msg)
6511 return;
6512
6513 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6514 if (!hdr)
6515 goto out;
6516
6517 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6518 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6519 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6520 NL80211_ATTR_PAD) ||
6521 (wdev->u.ap.ssid_len &&
6522 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6523 wdev->u.ap.ssid)) ||
6524 (wdev->valid_links &&
6525 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6526 goto out;
6527
6528 genlmsg_end(msg, hdr);
6529
6530 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6531 NL80211_MCGRP_MLME, GFP_KERNEL);
6532 return;
6533 out:
6534 nlmsg_free(msg);
6535 }
6536
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)6537 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6538 {
6539 struct ieee80211_channel *channel = params->chandef.chan;
6540
6541 if ((params->he_cap || params->he_oper) &&
6542 (channel->flags & IEEE80211_CHAN_NO_HE))
6543 return -EOPNOTSUPP;
6544
6545 if ((params->eht_cap || params->eht_oper) &&
6546 (channel->flags & IEEE80211_CHAN_NO_EHT))
6547 return -EOPNOTSUPP;
6548
6549 return 0;
6550 }
6551
6552 static int
nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_s1g_short_beacon * sb)6553 nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device *rdev,
6554 struct nlattr *attrs,
6555 struct cfg80211_s1g_short_beacon *sb)
6556 {
6557 struct nlattr *tb[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1];
6558 int ret;
6559
6560 if (!rdev->wiphy.bands[NL80211_BAND_S1GHZ])
6561 return -EINVAL;
6562
6563 ret = nla_parse_nested(tb, NL80211_S1G_SHORT_BEACON_ATTR_MAX, attrs,
6564 NULL, NULL);
6565 if (ret)
6566 return ret;
6567
6568 /* Short beacon tail is optional (i.e might only include the TIM) */
6569 if (!tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD])
6570 return -EINVAL;
6571
6572 sb->short_head = nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6573 sb->short_head_len = nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
6574 sb->short_tail_len = 0;
6575
6576 if (tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]) {
6577 sb->short_tail =
6578 nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6579 sb->short_tail_len =
6580 nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
6581 }
6582
6583 sb->update = true;
6584 return 0;
6585 }
6586
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)6587 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6588 {
6589 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6590 struct cfg80211_beaconing_check_config beacon_check = {};
6591 unsigned int link_id = nl80211_link_id(info->attrs);
6592 struct net_device *dev = info->user_ptr[1];
6593 struct wireless_dev *wdev = dev->ieee80211_ptr;
6594 struct cfg80211_ap_settings *params;
6595 int err;
6596
6597 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6598 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6599 return -EOPNOTSUPP;
6600
6601 if (!rdev->ops->start_ap)
6602 return -EOPNOTSUPP;
6603
6604 if (wdev->links[link_id].cac_started)
6605 return -EBUSY;
6606
6607 if (wdev->links[link_id].ap.beacon_interval)
6608 return -EALREADY;
6609
6610 /* these are required for START_AP */
6611 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6612 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6613 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6614 return -EINVAL;
6615
6616 if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6617 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6618 return -EOPNOTSUPP;
6619
6620 params = kzalloc(sizeof(*params), GFP_KERNEL);
6621 if (!params)
6622 return -ENOMEM;
6623
6624 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6625 info->extack);
6626 if (err)
6627 goto out;
6628
6629 params->beacon_interval =
6630 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6631 params->dtim_period =
6632 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6633
6634 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6635 params->beacon_interval);
6636 if (err)
6637 goto out;
6638
6639 /*
6640 * In theory, some of these attributes should be required here
6641 * but since they were not used when the command was originally
6642 * added, keep them optional for old user space programs to let
6643 * them continue to work with drivers that do not need the
6644 * additional information -- drivers must check!
6645 */
6646 if (info->attrs[NL80211_ATTR_SSID]) {
6647 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6648 params->ssid_len =
6649 nla_len(info->attrs[NL80211_ATTR_SSID]);
6650 if (params->ssid_len == 0) {
6651 err = -EINVAL;
6652 goto out;
6653 }
6654
6655 if (wdev->u.ap.ssid_len &&
6656 (wdev->u.ap.ssid_len != params->ssid_len ||
6657 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6658 /* require identical SSID for MLO */
6659 err = -EINVAL;
6660 goto out;
6661 }
6662 } else if (wdev->valid_links) {
6663 /* require SSID for MLO */
6664 err = -EINVAL;
6665 goto out;
6666 }
6667
6668 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6669 params->hidden_ssid = nla_get_u32(
6670 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6671
6672 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6673
6674 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6675 params->auth_type = nla_get_u32(
6676 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6677 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6678 NL80211_CMD_START_AP)) {
6679 err = -EINVAL;
6680 goto out;
6681 }
6682 } else
6683 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6684
6685 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6686 NL80211_MAX_NR_CIPHER_SUITES);
6687 if (err)
6688 goto out;
6689
6690 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6691 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6692 err = -EOPNOTSUPP;
6693 goto out;
6694 }
6695 params->inactivity_timeout = nla_get_u16(
6696 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6697 }
6698
6699 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6700 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6701 err = -EINVAL;
6702 goto out;
6703 }
6704 params->p2p_ctwindow =
6705 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6706 if (params->p2p_ctwindow != 0 &&
6707 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6708 err = -EINVAL;
6709 goto out;
6710 }
6711 }
6712
6713 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6714 u8 tmp;
6715
6716 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6717 err = -EINVAL;
6718 goto out;
6719 }
6720 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6721 params->p2p_opp_ps = tmp;
6722 if (params->p2p_opp_ps != 0 &&
6723 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6724 err = -EINVAL;
6725 goto out;
6726 }
6727 }
6728
6729 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6730 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6731 if (err)
6732 goto out;
6733 } else if (wdev->valid_links) {
6734 /* with MLD need to specify the channel configuration */
6735 err = -EINVAL;
6736 goto out;
6737 } else if (wdev->u.ap.preset_chandef.chan) {
6738 params->chandef = wdev->u.ap.preset_chandef;
6739 } else if (!nl80211_get_ap_channel(rdev, params)) {
6740 err = -EINVAL;
6741 goto out;
6742 }
6743
6744 beacon_check.iftype = wdev->iftype;
6745 beacon_check.relax = true;
6746 beacon_check.reg_power =
6747 cfg80211_get_6ghz_power_type(params->beacon.tail,
6748 params->beacon.tail_len);
6749 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, ¶ms->chandef,
6750 &beacon_check)) {
6751 err = -EINVAL;
6752 goto out;
6753 }
6754
6755 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6756 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6757 NL80211_ATTR_TX_RATES,
6758 ¶ms->beacon_rate,
6759 dev, false, link_id);
6760 if (err)
6761 goto out;
6762
6763 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6764 ¶ms->beacon_rate);
6765 if (err)
6766 goto out;
6767 }
6768
6769 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6770 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6771 err = -EOPNOTSUPP;
6772 goto out;
6773 }
6774
6775 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6776 params->acl = parse_acl_data(&rdev->wiphy, info);
6777 if (IS_ERR(params->acl)) {
6778 err = PTR_ERR(params->acl);
6779 params->acl = NULL;
6780 goto out;
6781 }
6782 }
6783
6784 params->twt_responder =
6785 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6786
6787 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6788 err = nl80211_parse_he_obss_pd(
6789 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6790 ¶ms->he_obss_pd);
6791 if (err)
6792 goto out;
6793 }
6794
6795 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6796 err = nl80211_parse_fils_discovery(rdev,
6797 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6798 ¶ms->fils_discovery);
6799 if (err)
6800 goto out;
6801 }
6802
6803 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6804 err = nl80211_parse_unsol_bcast_probe_resp(
6805 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6806 ¶ms->unsol_bcast_probe_resp);
6807 if (err)
6808 goto out;
6809 }
6810
6811 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6812 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
6813 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6814 ¶ms->mbssid_config,
6815 params->beacon.mbssid_ies ?
6816 params->beacon.mbssid_ies->cnt :
6817 0);
6818 if (err)
6819 goto out;
6820 }
6821
6822 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6823 err = -EINVAL;
6824 goto out;
6825 }
6826
6827 if (info->attrs[NL80211_ATTR_S1G_SHORT_BEACON]) {
6828 if (!info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]) {
6829 err = -EINVAL;
6830 goto out;
6831 }
6832
6833 params->s1g_long_beacon_period = nla_get_u8(
6834 info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]);
6835
6836 err = nl80211_parse_s1g_short_beacon(
6837 rdev, info->attrs[NL80211_ATTR_S1G_SHORT_BEACON],
6838 ¶ms->s1g_short_beacon);
6839 if (err)
6840 goto out;
6841 }
6842
6843 err = nl80211_calculate_ap_params(params);
6844 if (err)
6845 goto out;
6846
6847 err = nl80211_validate_ap_phy_operation(params);
6848 if (err)
6849 goto out;
6850
6851 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6852 params->flags = nla_get_u32(
6853 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6854 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6855 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6856
6857 if (wdev->conn_owner_nlportid &&
6858 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6859 wdev->conn_owner_nlportid != info->snd_portid) {
6860 err = -EINVAL;
6861 goto out;
6862 }
6863
6864 /* FIXME: validate MLO/link-id against driver capabilities */
6865
6866 err = rdev_start_ap(rdev, dev, params);
6867 if (!err) {
6868 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6869 wdev->links[link_id].ap.chandef = params->chandef;
6870 wdev->u.ap.ssid_len = params->ssid_len;
6871 memcpy(wdev->u.ap.ssid, params->ssid,
6872 params->ssid_len);
6873
6874 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6875 wdev->conn_owner_nlportid = info->snd_portid;
6876
6877 nl80211_send_ap_started(wdev, link_id);
6878 }
6879 out:
6880 kfree(params->acl);
6881 kfree(params->beacon.mbssid_ies);
6882 if (params->mbssid_config.tx_wdev &&
6883 params->mbssid_config.tx_wdev->netdev &&
6884 params->mbssid_config.tx_wdev->netdev != dev)
6885 dev_put(params->mbssid_config.tx_wdev->netdev);
6886 kfree(params->beacon.rnr_ies);
6887 kfree(params);
6888
6889 return err;
6890 }
6891
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6892 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6893 {
6894 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6895 struct cfg80211_beaconing_check_config beacon_check = {};
6896 unsigned int link_id = nl80211_link_id(info->attrs);
6897 struct net_device *dev = info->user_ptr[1];
6898 struct wireless_dev *wdev = dev->ieee80211_ptr;
6899 struct cfg80211_ap_update *params;
6900 struct nlattr *attr;
6901 int err;
6902
6903 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6904 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6905 return -EOPNOTSUPP;
6906
6907 if (!rdev->ops->change_beacon)
6908 return -EOPNOTSUPP;
6909
6910 if (!wdev->links[link_id].ap.beacon_interval)
6911 return -EINVAL;
6912
6913 params = kzalloc(sizeof(*params), GFP_KERNEL);
6914 if (!params)
6915 return -ENOMEM;
6916
6917 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6918 info->extack);
6919 if (err)
6920 goto out;
6921
6922 /* recheck beaconing is permitted with possibly changed power type */
6923 beacon_check.iftype = wdev->iftype;
6924 beacon_check.relax = true;
6925 beacon_check.reg_power =
6926 cfg80211_get_6ghz_power_type(params->beacon.tail,
6927 params->beacon.tail_len);
6928 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6929 &wdev->links[link_id].ap.chandef,
6930 &beacon_check)) {
6931 err = -EINVAL;
6932 goto out;
6933 }
6934
6935 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6936 if (attr) {
6937 err = nl80211_parse_fils_discovery(rdev, attr,
6938 ¶ms->fils_discovery);
6939 if (err)
6940 goto out;
6941 }
6942
6943 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6944 if (attr) {
6945 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6946 ¶ms->unsol_bcast_probe_resp);
6947 if (err)
6948 goto out;
6949 }
6950
6951 attr = info->attrs[NL80211_ATTR_S1G_SHORT_BEACON];
6952 if (attr) {
6953 err = nl80211_parse_s1g_short_beacon(rdev, attr,
6954 ¶ms->s1g_short_beacon);
6955 if (err)
6956 goto out;
6957 }
6958
6959 err = rdev_change_beacon(rdev, dev, params);
6960
6961 out:
6962 kfree(params->beacon.mbssid_ies);
6963 kfree(params->beacon.rnr_ies);
6964 kfree(params);
6965 return err;
6966 }
6967
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6968 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6969 {
6970 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6971 unsigned int link_id = nl80211_link_id(info->attrs);
6972 struct net_device *dev = info->user_ptr[1];
6973
6974 return cfg80211_stop_ap(rdev, dev, link_id, false);
6975 }
6976
6977 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6978 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6979 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6980 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6981 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6982 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6983 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6984 };
6985
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6986 static int parse_station_flags(struct genl_info *info,
6987 enum nl80211_iftype iftype,
6988 struct station_parameters *params)
6989 {
6990 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6991 struct nlattr *nla;
6992 int flag;
6993
6994 /*
6995 * Try parsing the new attribute first so userspace
6996 * can specify both for older kernels.
6997 */
6998 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6999 if (nla) {
7000 struct nl80211_sta_flag_update *sta_flags;
7001
7002 sta_flags = nla_data(nla);
7003 params->sta_flags_mask = sta_flags->mask;
7004 params->sta_flags_set = sta_flags->set;
7005 params->sta_flags_set &= params->sta_flags_mask;
7006 if ((params->sta_flags_mask |
7007 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
7008 return -EINVAL;
7009 return 0;
7010 }
7011
7012 /* if present, parse the old attribute */
7013
7014 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
7015 if (!nla)
7016 return 0;
7017
7018 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
7019 return -EINVAL;
7020
7021 /*
7022 * Only allow certain flags for interface types so that
7023 * other attributes are silently ignored. Remember that
7024 * this is backward compatibility code with old userspace
7025 * and shouldn't be hit in other cases anyway.
7026 */
7027 switch (iftype) {
7028 case NL80211_IFTYPE_AP:
7029 case NL80211_IFTYPE_AP_VLAN:
7030 case NL80211_IFTYPE_P2P_GO:
7031 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7032 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7033 BIT(NL80211_STA_FLAG_WME) |
7034 BIT(NL80211_STA_FLAG_MFP);
7035 break;
7036 case NL80211_IFTYPE_P2P_CLIENT:
7037 case NL80211_IFTYPE_STATION:
7038 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
7039 BIT(NL80211_STA_FLAG_TDLS_PEER);
7040 break;
7041 case NL80211_IFTYPE_MESH_POINT:
7042 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7043 BIT(NL80211_STA_FLAG_MFP) |
7044 BIT(NL80211_STA_FLAG_AUTHORIZED);
7045 break;
7046 default:
7047 return -EINVAL;
7048 }
7049
7050 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
7051 if (flags[flag]) {
7052 params->sta_flags_set |= (1<<flag);
7053
7054 /* no longer support new API additions in old API */
7055 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
7056 return -EINVAL;
7057 }
7058 }
7059
7060 return 0;
7061 }
7062
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)7063 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
7064 {
7065 struct nlattr *rate;
7066 u32 bitrate;
7067 u16 bitrate_compat;
7068 enum nl80211_rate_info rate_flg;
7069
7070 rate = nla_nest_start_noflag(msg, attr);
7071 if (!rate)
7072 return false;
7073
7074 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
7075 bitrate = cfg80211_calculate_bitrate(info);
7076 /* report 16-bit bitrate only if we can */
7077 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
7078 if (bitrate > 0 &&
7079 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
7080 return false;
7081 if (bitrate_compat > 0 &&
7082 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
7083 return false;
7084
7085 switch (info->bw) {
7086 case RATE_INFO_BW_1:
7087 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
7088 break;
7089 case RATE_INFO_BW_2:
7090 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
7091 break;
7092 case RATE_INFO_BW_4:
7093 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
7094 break;
7095 case RATE_INFO_BW_5:
7096 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
7097 break;
7098 case RATE_INFO_BW_8:
7099 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
7100 break;
7101 case RATE_INFO_BW_10:
7102 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
7103 break;
7104 case RATE_INFO_BW_16:
7105 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
7106 break;
7107 default:
7108 WARN_ON(1);
7109 fallthrough;
7110 case RATE_INFO_BW_20:
7111 rate_flg = 0;
7112 break;
7113 case RATE_INFO_BW_40:
7114 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
7115 break;
7116 case RATE_INFO_BW_80:
7117 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
7118 break;
7119 case RATE_INFO_BW_160:
7120 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
7121 break;
7122 case RATE_INFO_BW_HE_RU:
7123 rate_flg = 0;
7124 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
7125 break;
7126 case RATE_INFO_BW_320:
7127 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
7128 break;
7129 case RATE_INFO_BW_EHT_RU:
7130 rate_flg = 0;
7131 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
7132 break;
7133 }
7134
7135 if (rate_flg && nla_put_flag(msg, rate_flg))
7136 return false;
7137
7138 if (info->flags & RATE_INFO_FLAGS_MCS) {
7139 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
7140 return false;
7141 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7142 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7143 return false;
7144 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
7145 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
7146 return false;
7147 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
7148 return false;
7149 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7150 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7151 return false;
7152 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
7153 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
7154 return false;
7155 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
7156 return false;
7157 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
7158 return false;
7159 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
7160 return false;
7161 if (info->bw == RATE_INFO_BW_HE_RU &&
7162 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
7163 info->he_ru_alloc))
7164 return false;
7165 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
7166 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
7167 return false;
7168 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
7169 return false;
7170 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
7171 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
7172 return false;
7173 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
7174 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
7175 return false;
7176 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
7177 return false;
7178 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
7179 return false;
7180 if (info->bw == RATE_INFO_BW_EHT_RU &&
7181 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
7182 info->eht_ru_alloc))
7183 return false;
7184 }
7185
7186 nla_nest_end(msg, rate);
7187 return true;
7188 }
7189
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)7190 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
7191 int id)
7192 {
7193 void *attr;
7194 int i = 0;
7195
7196 if (!mask)
7197 return true;
7198
7199 attr = nla_nest_start_noflag(msg, id);
7200 if (!attr)
7201 return false;
7202
7203 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
7204 if (!(mask & BIT(i)))
7205 continue;
7206
7207 if (nla_put_u8(msg, i, signal[i]))
7208 return false;
7209 }
7210
7211 nla_nest_end(msg, attr);
7212
7213 return true;
7214 }
7215
nl80211_fill_link_station(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct link_station_info * link_sinfo)7216 static int nl80211_fill_link_station(struct sk_buff *msg,
7217 struct cfg80211_registered_device *rdev,
7218 struct link_station_info *link_sinfo)
7219 {
7220 struct nlattr *bss_param, *link_sinfoattr;
7221
7222 #define PUT_LINK_SINFO(attr, memb, type) do { \
7223 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7224 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7225 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7226 link_sinfo->memb)) \
7227 goto nla_put_failure; \
7228 } while (0)
7229 #define PUT_LINK_SINFO_U64(attr, memb) do { \
7230 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7231 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7232 link_sinfo->memb, NL80211_STA_INFO_PAD)) \
7233 goto nla_put_failure; \
7234 } while (0)
7235
7236 link_sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7237 if (!link_sinfoattr)
7238 goto nla_put_failure;
7239
7240 PUT_LINK_SINFO(INACTIVE_TIME, inactive_time, u32);
7241
7242 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7243 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7244 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7245 (u32)link_sinfo->rx_bytes))
7246 goto nla_put_failure;
7247
7248 if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7249 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7250 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7251 (u32)link_sinfo->tx_bytes))
7252 goto nla_put_failure;
7253
7254 PUT_LINK_SINFO_U64(RX_BYTES64, rx_bytes);
7255 PUT_LINK_SINFO_U64(TX_BYTES64, tx_bytes);
7256 PUT_LINK_SINFO_U64(RX_DURATION, rx_duration);
7257 PUT_LINK_SINFO_U64(TX_DURATION, tx_duration);
7258
7259 if (wiphy_ext_feature_isset(&rdev->wiphy,
7260 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7261 PUT_LINK_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7262
7263 switch (rdev->wiphy.signal_type) {
7264 case CFG80211_SIGNAL_TYPE_MBM:
7265 PUT_LINK_SINFO(SIGNAL, signal, u8);
7266 PUT_LINK_SINFO(SIGNAL_AVG, signal_avg, u8);
7267 break;
7268 default:
7269 break;
7270 }
7271 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7272 if (!nl80211_put_signal(msg, link_sinfo->chains,
7273 link_sinfo->chain_signal,
7274 NL80211_STA_INFO_CHAIN_SIGNAL))
7275 goto nla_put_failure;
7276 }
7277 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7278 if (!nl80211_put_signal(msg, link_sinfo->chains,
7279 link_sinfo->chain_signal_avg,
7280 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7281 goto nla_put_failure;
7282 }
7283 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7284 if (!nl80211_put_sta_rate(msg, &link_sinfo->txrate,
7285 NL80211_STA_INFO_TX_BITRATE))
7286 goto nla_put_failure;
7287 }
7288 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7289 if (!nl80211_put_sta_rate(msg, &link_sinfo->rxrate,
7290 NL80211_STA_INFO_RX_BITRATE))
7291 goto nla_put_failure;
7292 }
7293
7294 PUT_LINK_SINFO(RX_PACKETS, rx_packets, u32);
7295 PUT_LINK_SINFO(TX_PACKETS, tx_packets, u32);
7296 PUT_LINK_SINFO(TX_RETRIES, tx_retries, u32);
7297 PUT_LINK_SINFO(TX_FAILED, tx_failed, u32);
7298 PUT_LINK_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7299 PUT_LINK_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7300
7301 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7302 bss_param = nla_nest_start_noflag(msg,
7303 NL80211_STA_INFO_BSS_PARAM);
7304 if (!bss_param)
7305 goto nla_put_failure;
7306
7307 if (((link_sinfo->bss_param.flags &
7308 BSS_PARAM_FLAGS_CTS_PROT) &&
7309 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7310 ((link_sinfo->bss_param.flags &
7311 BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7312 nla_put_flag(msg,
7313 NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7314 ((link_sinfo->bss_param.flags &
7315 BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7316 nla_put_flag(msg,
7317 NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7318 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7319 link_sinfo->bss_param.dtim_period) ||
7320 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7321 link_sinfo->bss_param.beacon_interval))
7322 goto nla_put_failure;
7323
7324 nla_nest_end(msg, bss_param);
7325 }
7326
7327 PUT_LINK_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7328 PUT_LINK_SINFO_U64(BEACON_RX, rx_beacon);
7329 PUT_LINK_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7330 PUT_LINK_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7331 PUT_LINK_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7332 if (wiphy_ext_feature_isset(&rdev->wiphy,
7333 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7334 PUT_LINK_SINFO(ACK_SIGNAL, ack_signal, u8);
7335 PUT_LINK_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7336 }
7337
7338 #undef PUT_LINK_SINFO
7339 #undef PUT_LINK_SINFO_U64
7340
7341 if (link_sinfo->pertid) {
7342 struct nlattr *tidsattr;
7343 int tid;
7344
7345 tidsattr = nla_nest_start_noflag(msg,
7346 NL80211_STA_INFO_TID_STATS);
7347 if (!tidsattr)
7348 goto nla_put_failure;
7349
7350 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7351 struct cfg80211_tid_stats *tidstats;
7352 struct nlattr *tidattr;
7353
7354 tidstats = &link_sinfo->pertid[tid];
7355
7356 if (!tidstats->filled)
7357 continue;
7358
7359 tidattr = nla_nest_start_noflag(msg, tid + 1);
7360 if (!tidattr)
7361 goto nla_put_failure;
7362
7363 #define PUT_TIDVAL_U64(attr, memb) do { \
7364 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7365 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7366 tidstats->memb, NL80211_TID_STATS_PAD)) \
7367 goto nla_put_failure; \
7368 } while (0)
7369
7370 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7371 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7372 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7373 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7374
7375 #undef PUT_TIDVAL_U64
7376 if ((tidstats->filled &
7377 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7378 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7379 NL80211_TID_STATS_TXQ_STATS))
7380 goto nla_put_failure;
7381
7382 nla_nest_end(msg, tidattr);
7383 }
7384
7385 nla_nest_end(msg, tidsattr);
7386 }
7387
7388 nla_nest_end(msg, link_sinfoattr);
7389 return 0;
7390
7391 nla_put_failure:
7392 return -EMSGSIZE;
7393 }
7394
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,bool link_stats)7395 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
7396 u32 seq, int flags,
7397 struct cfg80211_registered_device *rdev,
7398 struct net_device *dev,
7399 const u8 *mac_addr, struct station_info *sinfo,
7400 bool link_stats)
7401 {
7402 void *hdr;
7403 struct nlattr *sinfoattr, *bss_param;
7404 struct link_station_info *link_sinfo;
7405 struct nlattr *links, *link;
7406 int link_id;
7407
7408 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7409 if (!hdr) {
7410 cfg80211_sinfo_release_content(sinfo);
7411 return -1;
7412 }
7413
7414 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7415 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
7416 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
7417 goto nla_put_failure;
7418
7419 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
7420 if (!sinfoattr)
7421 goto nla_put_failure;
7422
7423 #define PUT_SINFO(attr, memb, type) do { \
7424 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
7425 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7426 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
7427 sinfo->memb)) \
7428 goto nla_put_failure; \
7429 } while (0)
7430 #define PUT_SINFO_U64(attr, memb) do { \
7431 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
7432 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
7433 sinfo->memb, NL80211_STA_INFO_PAD)) \
7434 goto nla_put_failure; \
7435 } while (0)
7436
7437 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
7438 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
7439 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
7440
7441 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7442 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
7443 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
7444 (u32)sinfo->rx_bytes))
7445 goto nla_put_failure;
7446
7447 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7448 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
7449 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
7450 (u32)sinfo->tx_bytes))
7451 goto nla_put_failure;
7452
7453 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
7454 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
7455 PUT_SINFO_U64(RX_DURATION, rx_duration);
7456 PUT_SINFO_U64(TX_DURATION, tx_duration);
7457
7458 if (wiphy_ext_feature_isset(&rdev->wiphy,
7459 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7460 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
7461
7462 switch (rdev->wiphy.signal_type) {
7463 case CFG80211_SIGNAL_TYPE_MBM:
7464 PUT_SINFO(SIGNAL, signal, u8);
7465 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
7466 break;
7467 default:
7468 break;
7469 }
7470 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
7471 if (!nl80211_put_signal(msg, sinfo->chains,
7472 sinfo->chain_signal,
7473 NL80211_STA_INFO_CHAIN_SIGNAL))
7474 goto nla_put_failure;
7475 }
7476 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
7477 if (!nl80211_put_signal(msg, sinfo->chains,
7478 sinfo->chain_signal_avg,
7479 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
7480 goto nla_put_failure;
7481 }
7482 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
7483 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
7484 NL80211_STA_INFO_TX_BITRATE))
7485 goto nla_put_failure;
7486 }
7487 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
7488 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
7489 NL80211_STA_INFO_RX_BITRATE))
7490 goto nla_put_failure;
7491 }
7492
7493 PUT_SINFO(RX_PACKETS, rx_packets, u32);
7494 PUT_SINFO(TX_PACKETS, tx_packets, u32);
7495 PUT_SINFO(TX_RETRIES, tx_retries, u32);
7496 PUT_SINFO(TX_FAILED, tx_failed, u32);
7497 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
7498 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
7499
7500 PUT_SINFO(LLID, llid, u16);
7501 PUT_SINFO(PLID, plid, u16);
7502 PUT_SINFO(PLINK_STATE, plink_state, u8);
7503 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
7504 PUT_SINFO(LOCAL_PM, local_pm, u32);
7505 PUT_SINFO(PEER_PM, peer_pm, u32);
7506 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
7507 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
7508 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
7509 PUT_SINFO_U64(T_OFFSET, t_offset);
7510
7511 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
7512 bss_param = nla_nest_start_noflag(msg,
7513 NL80211_STA_INFO_BSS_PARAM);
7514 if (!bss_param)
7515 goto nla_put_failure;
7516
7517 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
7518 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
7519 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
7520 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
7521 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
7522 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
7523 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
7524 sinfo->bss_param.dtim_period) ||
7525 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
7526 sinfo->bss_param.beacon_interval))
7527 goto nla_put_failure;
7528
7529 nla_nest_end(msg, bss_param);
7530 }
7531 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
7532 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
7533 sizeof(struct nl80211_sta_flag_update),
7534 &sinfo->sta_flags))
7535 goto nla_put_failure;
7536
7537 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
7538 PUT_SINFO_U64(BEACON_RX, rx_beacon);
7539 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
7540 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
7541 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
7542 if (wiphy_ext_feature_isset(&rdev->wiphy,
7543 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
7544 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
7545 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
7546 }
7547
7548 #undef PUT_SINFO
7549 #undef PUT_SINFO_U64
7550
7551 if (sinfo->pertid) {
7552 struct nlattr *tidsattr;
7553 int tid;
7554
7555 tidsattr = nla_nest_start_noflag(msg,
7556 NL80211_STA_INFO_TID_STATS);
7557 if (!tidsattr)
7558 goto nla_put_failure;
7559
7560 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
7561 struct cfg80211_tid_stats *tidstats;
7562 struct nlattr *tidattr;
7563
7564 tidstats = &sinfo->pertid[tid];
7565
7566 if (!tidstats->filled)
7567 continue;
7568
7569 tidattr = nla_nest_start_noflag(msg, tid + 1);
7570 if (!tidattr)
7571 goto nla_put_failure;
7572
7573 #define PUT_TIDVAL_U64(attr, memb) do { \
7574 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
7575 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
7576 tidstats->memb, NL80211_TID_STATS_PAD)) \
7577 goto nla_put_failure; \
7578 } while (0)
7579
7580 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
7581 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
7582 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
7583 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
7584
7585 #undef PUT_TIDVAL_U64
7586 if ((tidstats->filled &
7587 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
7588 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
7589 NL80211_TID_STATS_TXQ_STATS))
7590 goto nla_put_failure;
7591
7592 nla_nest_end(msg, tidattr);
7593 }
7594
7595 nla_nest_end(msg, tidsattr);
7596 }
7597
7598 nla_nest_end(msg, sinfoattr);
7599
7600 if (sinfo->assoc_req_ies_len &&
7601 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
7602 sinfo->assoc_req_ies))
7603 goto nla_put_failure;
7604
7605 if (sinfo->assoc_resp_ies_len &&
7606 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
7607 sinfo->assoc_resp_ies))
7608 goto nla_put_failure;
7609
7610 if (sinfo->mlo_params_valid) {
7611 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7612 sinfo->assoc_link_id))
7613 goto nla_put_failure;
7614
7615 if (!is_zero_ether_addr(sinfo->mld_addr) &&
7616 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
7617 sinfo->mld_addr))
7618 goto nla_put_failure;
7619 }
7620
7621 if (link_stats && sinfo->valid_links) {
7622 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
7623 if (!links)
7624 goto nla_put_failure;
7625
7626 for_each_valid_link(sinfo, link_id) {
7627 link_sinfo = sinfo->links[link_id];
7628
7629 if (WARN_ON_ONCE(!link_sinfo))
7630 continue;
7631
7632 if (!is_valid_ether_addr(link_sinfo->addr))
7633 continue;
7634
7635 link = nla_nest_start(msg, link_id + 1);
7636 if (!link)
7637 goto nla_put_failure;
7638
7639 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
7640 link_id))
7641 goto nla_put_failure;
7642
7643 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
7644 link_sinfo->addr))
7645 goto nla_put_failure;
7646
7647 if (nl80211_fill_link_station(msg, rdev, link_sinfo))
7648 goto nla_put_failure;
7649
7650 nla_nest_end(msg, link);
7651 }
7652 nla_nest_end(msg, links);
7653 }
7654
7655 cfg80211_sinfo_release_content(sinfo);
7656 genlmsg_end(msg, hdr);
7657 return 0;
7658
7659 nla_put_failure:
7660 cfg80211_sinfo_release_content(sinfo);
7661 genlmsg_cancel(msg, hdr);
7662 return -EMSGSIZE;
7663 }
7664
cfg80211_sta_set_mld_sinfo(struct station_info * sinfo)7665 static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
7666 {
7667 struct link_station_info *link_sinfo;
7668 int link_id, init = 0;
7669 u32 link_inactive_time;
7670
7671 sinfo->signal = -99;
7672
7673 for_each_valid_link(sinfo, link_id) {
7674 link_sinfo = sinfo->links[link_id];
7675 if (!link_sinfo)
7676 continue;
7677
7678 if ((link_sinfo->filled &
7679 BIT_ULL(NL80211_STA_INFO_TX_PACKETS))) {
7680 sinfo->tx_packets += link_sinfo->tx_packets;
7681 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
7682 }
7683
7684 if ((link_sinfo->filled &
7685 BIT_ULL(NL80211_STA_INFO_RX_PACKETS))) {
7686 sinfo->rx_packets += link_sinfo->rx_packets;
7687 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
7688 }
7689
7690 if (link_sinfo->filled &
7691 (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
7692 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7693 sinfo->tx_bytes += link_sinfo->tx_bytes;
7694 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
7695 }
7696
7697 if (link_sinfo->filled &
7698 (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
7699 BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
7700 sinfo->rx_bytes += link_sinfo->rx_bytes;
7701 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
7702 }
7703
7704 if (link_sinfo->filled &
7705 BIT_ULL(NL80211_STA_INFO_TX_RETRIES)) {
7706 sinfo->tx_retries += link_sinfo->tx_retries;
7707 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
7708 }
7709
7710 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED)) {
7711 sinfo->tx_failed += link_sinfo->tx_failed;
7712 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
7713 }
7714
7715 if (link_sinfo->filled &
7716 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC)) {
7717 sinfo->rx_dropped_misc += link_sinfo->rx_dropped_misc;
7718 sinfo->filled |=
7719 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC);
7720 }
7721
7722 if (link_sinfo->filled &
7723 BIT_ULL(NL80211_STA_INFO_BEACON_LOSS)) {
7724 sinfo->beacon_loss_count +=
7725 link_sinfo->beacon_loss_count;
7726 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_LOSS);
7727 }
7728
7729 if (link_sinfo->filled &
7730 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) {
7731 sinfo->expected_throughput +=
7732 link_sinfo->expected_throughput;
7733 sinfo->filled |=
7734 BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
7735 }
7736
7737 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_MPDUS)) {
7738 sinfo->rx_mpdu_count += link_sinfo->rx_mpdu_count;
7739 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_MPDUS);
7740 }
7741
7742 if (link_sinfo->filled &
7743 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT)) {
7744 sinfo->fcs_err_count += link_sinfo->fcs_err_count;
7745 sinfo->filled |=
7746 BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT);
7747 }
7748
7749 if (link_sinfo->filled &
7750 BIT_ULL(NL80211_STA_INFO_BEACON_RX)) {
7751 sinfo->rx_beacon += link_sinfo->rx_beacon;
7752 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
7753 }
7754
7755 /* Update MLO signal, signal_avg as best among links */
7756 if ((link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL)) &&
7757 link_sinfo->signal > sinfo->signal) {
7758 sinfo->signal = link_sinfo->signal;
7759 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
7760 }
7761
7762 if ((link_sinfo->filled &
7763 BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG)) &&
7764 link_sinfo->signal_avg > sinfo->signal_avg) {
7765 sinfo->signal_avg = link_sinfo->signal_avg;
7766 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
7767 }
7768
7769 /* Update MLO inactive_time, bss_param based on least
7770 * value for corresponding field of link.
7771 */
7772 if ((link_sinfo->filled &
7773 BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME)) &&
7774 (!init ||
7775 link_inactive_time > link_sinfo->inactive_time)) {
7776 link_inactive_time = link_sinfo->inactive_time;
7777 sinfo->inactive_time = link_sinfo->inactive_time;
7778 sinfo->filled |= NL80211_STA_INFO_INACTIVE_TIME;
7779 }
7780
7781 if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM) &&
7782 (!init ||
7783 sinfo->bss_param.dtim_period >
7784 link_sinfo->bss_param.dtim_period)) {
7785 sinfo->bss_param.dtim_period =
7786 link_sinfo->bss_param.dtim_period;
7787 sinfo->filled |= NL80211_STA_BSS_PARAM_DTIM_PERIOD;
7788 sinfo->bss_param.beacon_interval =
7789 link_sinfo->bss_param.beacon_interval;
7790 sinfo->filled |= NL80211_STA_BSS_PARAM_BEACON_INTERVAL;
7791 }
7792
7793 /* Update MLO rates as per last updated link rate */
7794 if ((link_sinfo->filled &
7795 BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) &&
7796 (!init ||
7797 link_inactive_time > link_sinfo->inactive_time)) {
7798 sinfo->txrate = link_sinfo->txrate;
7799 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
7800 }
7801 if ((link_sinfo->filled &
7802 BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) &&
7803 (!init ||
7804 link_inactive_time > link_sinfo->inactive_time)) {
7805 sinfo->rxrate = link_sinfo->rxrate;
7806 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
7807 }
7808
7809 if (link_sinfo->filled &
7810 BIT_ULL(NL80211_STA_INFO_TX_DURATION) &&
7811 (!init ||
7812 link_inactive_time > link_sinfo->inactive_time)) {
7813 sinfo->tx_duration += link_sinfo->tx_duration;
7814 sinfo->filled |=
7815 BIT_ULL(NL80211_STA_INFO_TX_DURATION);
7816 }
7817 if (link_sinfo->filled &
7818 BIT_ULL(NL80211_STA_INFO_RX_DURATION) &&
7819 (!init ||
7820 link_inactive_time > link_sinfo->inactive_time)) {
7821 sinfo->rx_duration += link_sinfo->rx_duration;
7822 sinfo->filled |=
7823 BIT_ULL(NL80211_STA_INFO_RX_DURATION);
7824 }
7825 init++;
7826
7827 /* pertid stats accumulate for rx/tx fields */
7828 if (sinfo->pertid) {
7829 sinfo->pertid->rx_msdu +=
7830 link_sinfo->pertid->rx_msdu;
7831 sinfo->pertid->tx_msdu +=
7832 link_sinfo->pertid->tx_msdu;
7833 sinfo->pertid->tx_msdu_retries +=
7834 link_sinfo->pertid->tx_msdu_retries;
7835 sinfo->pertid->tx_msdu_failed +=
7836 link_sinfo->pertid->tx_msdu_failed;
7837
7838 sinfo->pertid->filled |=
7839 BIT(NL80211_TID_STATS_RX_MSDU) |
7840 BIT(NL80211_TID_STATS_TX_MSDU) |
7841 BIT(NL80211_TID_STATS_TX_MSDU_RETRIES) |
7842 BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
7843 }
7844 }
7845
7846 /* Reset sinfo->filled bits to exclude fields which don't make
7847 * much sense at the MLO level.
7848 */
7849 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
7850 sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
7851 }
7852
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)7853 static int nl80211_dump_station(struct sk_buff *skb,
7854 struct netlink_callback *cb)
7855 {
7856 struct station_info sinfo;
7857 struct cfg80211_registered_device *rdev;
7858 struct wireless_dev *wdev;
7859 u8 mac_addr[ETH_ALEN];
7860 int sta_idx = cb->args[2];
7861 bool sinfo_alloc = false;
7862 int err, i;
7863
7864 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7865 if (err)
7866 return err;
7867 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7868 __acquire(&rdev->wiphy.mtx);
7869
7870 if (!wdev->netdev) {
7871 err = -EINVAL;
7872 goto out_err;
7873 }
7874
7875 if (!rdev->ops->dump_station) {
7876 err = -EOPNOTSUPP;
7877 goto out_err;
7878 }
7879
7880 while (1) {
7881 memset(&sinfo, 0, sizeof(sinfo));
7882
7883 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7884 sinfo.links[i] =
7885 kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7886 if (!sinfo.links[i]) {
7887 err = -ENOMEM;
7888 goto out_err;
7889 }
7890 sinfo_alloc = true;
7891 }
7892
7893 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
7894 mac_addr, &sinfo);
7895 if (err == -ENOENT)
7896 break;
7897 if (err)
7898 goto out_err;
7899
7900 if (sinfo.valid_links)
7901 cfg80211_sta_set_mld_sinfo(&sinfo);
7902
7903 /* reset the sinfo_alloc flag as nl80211_send_station()
7904 * always releases sinfo
7905 */
7906 sinfo_alloc = false;
7907
7908 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
7909 NETLINK_CB(cb->skb).portid,
7910 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7911 rdev, wdev->netdev, mac_addr,
7912 &sinfo, false) < 0)
7913 goto out;
7914
7915 sta_idx++;
7916 }
7917
7918 out:
7919 cb->args[2] = sta_idx;
7920 err = skb->len;
7921 out_err:
7922 if (sinfo_alloc)
7923 cfg80211_sinfo_release_content(&sinfo);
7924 wiphy_unlock(&rdev->wiphy);
7925
7926 return err;
7927 }
7928
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)7929 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
7930 {
7931 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7932 struct net_device *dev = info->user_ptr[1];
7933 struct station_info sinfo;
7934 struct sk_buff *msg;
7935 u8 *mac_addr = NULL;
7936 int err, i;
7937
7938 memset(&sinfo, 0, sizeof(sinfo));
7939
7940 if (!info->attrs[NL80211_ATTR_MAC])
7941 return -EINVAL;
7942
7943 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7944
7945 if (!rdev->ops->get_station)
7946 return -EOPNOTSUPP;
7947
7948 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7949 sinfo.links[i] = kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
7950 if (!sinfo.links[i]) {
7951 cfg80211_sinfo_release_content(&sinfo);
7952 return -ENOMEM;
7953 }
7954 }
7955
7956 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7957 if (err) {
7958 cfg80211_sinfo_release_content(&sinfo);
7959 return err;
7960 }
7961
7962 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7963 if (!msg) {
7964 cfg80211_sinfo_release_content(&sinfo);
7965 return -ENOMEM;
7966 }
7967
7968 if (sinfo.valid_links)
7969 cfg80211_sta_set_mld_sinfo(&sinfo);
7970
7971 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7972 info->snd_portid, info->snd_seq, 0,
7973 rdev, dev, mac_addr, &sinfo, false) < 0) {
7974 nlmsg_free(msg);
7975 return -ENOBUFS;
7976 }
7977
7978 return genlmsg_reply(msg, info);
7979 }
7980
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)7981 int cfg80211_check_station_change(struct wiphy *wiphy,
7982 struct station_parameters *params,
7983 enum cfg80211_station_type statype)
7984 {
7985 if (params->listen_interval != -1 &&
7986 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7987 return -EINVAL;
7988
7989 if (params->support_p2p_ps != -1 &&
7990 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7991 return -EINVAL;
7992
7993 if (params->aid &&
7994 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
7995 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7996 return -EINVAL;
7997
7998 /* When you run into this, adjust the code below for the new flag */
7999 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8000
8001 switch (statype) {
8002 case CFG80211_STA_MESH_PEER_KERNEL:
8003 case CFG80211_STA_MESH_PEER_USER:
8004 /*
8005 * No ignoring the TDLS flag here -- the userspace mesh
8006 * code doesn't have the bug of including TDLS in the
8007 * mask everywhere.
8008 */
8009 if (params->sta_flags_mask &
8010 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8011 BIT(NL80211_STA_FLAG_MFP) |
8012 BIT(NL80211_STA_FLAG_AUTHORIZED)))
8013 return -EINVAL;
8014 break;
8015 case CFG80211_STA_TDLS_PEER_SETUP:
8016 case CFG80211_STA_TDLS_PEER_ACTIVE:
8017 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8018 return -EINVAL;
8019 /* ignore since it can't change */
8020 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8021 break;
8022 default:
8023 /* disallow mesh-specific things */
8024 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
8025 return -EINVAL;
8026 if (params->local_pm)
8027 return -EINVAL;
8028 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8029 return -EINVAL;
8030 }
8031
8032 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8033 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
8034 /* TDLS can't be set, ... */
8035 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
8036 return -EINVAL;
8037 /*
8038 * ... but don't bother the driver with it. This works around
8039 * a hostapd/wpa_supplicant issue -- it always includes the
8040 * TLDS_PEER flag in the mask even for AP mode.
8041 */
8042 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8043 }
8044
8045 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
8046 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8047 /* reject other things that can't change */
8048 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
8049 return -EINVAL;
8050 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
8051 return -EINVAL;
8052 if (params->link_sta_params.supported_rates)
8053 return -EINVAL;
8054 if (params->ext_capab || params->link_sta_params.ht_capa ||
8055 params->link_sta_params.vht_capa ||
8056 params->link_sta_params.he_capa ||
8057 params->link_sta_params.eht_capa)
8058 return -EINVAL;
8059 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8060 return -EINVAL;
8061 }
8062
8063 if (statype != CFG80211_STA_AP_CLIENT &&
8064 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
8065 if (params->vlan)
8066 return -EINVAL;
8067 }
8068
8069 /* Accept EMLSR capabilities only for AP client before association */
8070 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8071 params->eml_cap_present)
8072 return -EINVAL;
8073
8074 switch (statype) {
8075 case CFG80211_STA_AP_MLME_CLIENT:
8076 /* Use this only for authorizing/unauthorizing a station */
8077 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
8078 return -EOPNOTSUPP;
8079 break;
8080 case CFG80211_STA_AP_CLIENT:
8081 case CFG80211_STA_AP_CLIENT_UNASSOC:
8082 /* accept only the listed bits */
8083 if (params->sta_flags_mask &
8084 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8085 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8086 BIT(NL80211_STA_FLAG_ASSOCIATED) |
8087 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
8088 BIT(NL80211_STA_FLAG_WME) |
8089 BIT(NL80211_STA_FLAG_MFP) |
8090 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
8091 return -EINVAL;
8092
8093 /* but authenticated/associated only if driver handles it */
8094 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8095 params->sta_flags_mask &
8096 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8097 BIT(NL80211_STA_FLAG_ASSOCIATED)))
8098 return -EINVAL;
8099 break;
8100 case CFG80211_STA_IBSS:
8101 case CFG80211_STA_AP_STA:
8102 /* reject any changes other than AUTHORIZED */
8103 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
8104 return -EINVAL;
8105 break;
8106 case CFG80211_STA_TDLS_PEER_SETUP:
8107 /* reject any changes other than AUTHORIZED or WME */
8108 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
8109 BIT(NL80211_STA_FLAG_WME)))
8110 return -EINVAL;
8111 /* force (at least) rates when authorizing */
8112 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
8113 !params->link_sta_params.supported_rates)
8114 return -EINVAL;
8115 break;
8116 case CFG80211_STA_TDLS_PEER_ACTIVE:
8117 /* reject any changes */
8118 return -EINVAL;
8119 case CFG80211_STA_MESH_PEER_KERNEL:
8120 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
8121 return -EINVAL;
8122 break;
8123 case CFG80211_STA_MESH_PEER_USER:
8124 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
8125 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
8126 return -EINVAL;
8127 break;
8128 }
8129
8130 /*
8131 * Older kernel versions ignored this attribute entirely, so don't
8132 * reject attempts to update it but mark it as unused instead so the
8133 * driver won't look at the data.
8134 */
8135 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
8136 statype != CFG80211_STA_TDLS_PEER_SETUP)
8137 params->link_sta_params.opmode_notif_used = false;
8138
8139 return 0;
8140 }
8141 EXPORT_SYMBOL(cfg80211_check_station_change);
8142
8143 /*
8144 * Get vlan interface making sure it is running and on the right wiphy.
8145 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)8146 static struct net_device *get_vlan(struct genl_info *info,
8147 struct cfg80211_registered_device *rdev)
8148 {
8149 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
8150 struct net_device *v;
8151 int ret;
8152
8153 if (!vlanattr)
8154 return NULL;
8155
8156 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
8157 if (!v)
8158 return ERR_PTR(-ENODEV);
8159
8160 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
8161 ret = -EINVAL;
8162 goto error;
8163 }
8164
8165 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
8166 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8167 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
8168 ret = -EINVAL;
8169 goto error;
8170 }
8171
8172 if (!netif_running(v)) {
8173 ret = -ENETDOWN;
8174 goto error;
8175 }
8176
8177 return v;
8178 error:
8179 dev_put(v);
8180 return ERR_PTR(ret);
8181 }
8182
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)8183 static int nl80211_parse_sta_wme(struct genl_info *info,
8184 struct station_parameters *params)
8185 {
8186 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
8187 struct nlattr *nla;
8188 int err;
8189
8190 /* parse WME attributes if present */
8191 if (!info->attrs[NL80211_ATTR_STA_WME])
8192 return 0;
8193
8194 nla = info->attrs[NL80211_ATTR_STA_WME];
8195 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
8196 nl80211_sta_wme_policy,
8197 info->extack);
8198 if (err)
8199 return err;
8200
8201 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
8202 params->uapsd_queues = nla_get_u8(
8203 tb[NL80211_STA_WME_UAPSD_QUEUES]);
8204 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
8205 return -EINVAL;
8206
8207 if (tb[NL80211_STA_WME_MAX_SP])
8208 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
8209
8210 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
8211 return -EINVAL;
8212
8213 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
8214
8215 return 0;
8216 }
8217
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)8218 static int nl80211_parse_sta_channel_info(struct genl_info *info,
8219 struct station_parameters *params)
8220 {
8221 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
8222 params->supported_channels =
8223 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8224 params->supported_channels_len =
8225 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
8226 /*
8227 * Need to include at least one (first channel, number of
8228 * channels) tuple for each subband (checked in policy),
8229 * and must have proper tuples for the rest of the data as well.
8230 */
8231 if (params->supported_channels_len % 2)
8232 return -EINVAL;
8233 }
8234
8235 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
8236 params->supported_oper_classes =
8237 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8238 params->supported_oper_classes_len =
8239 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
8240 }
8241 return 0;
8242 }
8243
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)8244 static int nl80211_set_station_tdls(struct genl_info *info,
8245 struct station_parameters *params)
8246 {
8247 int err;
8248 /* Dummy STA entry gets updated once the peer capabilities are known */
8249 if (info->attrs[NL80211_ATTR_PEER_AID])
8250 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8251 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8252 params->link_sta_params.ht_capa =
8253 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8254 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8255 params->link_sta_params.vht_capa =
8256 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8257 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8258 params->link_sta_params.he_capa =
8259 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8260 params->link_sta_params.he_capa_len =
8261 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8262
8263 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8264 params->link_sta_params.eht_capa =
8265 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8266 params->link_sta_params.eht_capa_len =
8267 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8268
8269 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
8270 (const u8 *)params->link_sta_params.eht_capa,
8271 params->link_sta_params.eht_capa_len,
8272 false))
8273 return -EINVAL;
8274 }
8275 }
8276
8277 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8278 params->link_sta_params.s1g_capa =
8279 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8280
8281 err = nl80211_parse_sta_channel_info(info, params);
8282 if (err)
8283 return err;
8284
8285 return nl80211_parse_sta_wme(info, params);
8286 }
8287
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)8288 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
8289 struct sta_txpwr *txpwr,
8290 bool *txpwr_set)
8291 {
8292 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8293 int idx;
8294
8295 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
8296 if (!rdev->ops->set_tx_power ||
8297 !wiphy_ext_feature_isset(&rdev->wiphy,
8298 NL80211_EXT_FEATURE_STA_TX_PWR))
8299 return -EOPNOTSUPP;
8300
8301 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
8302 txpwr->type = nla_get_u8(info->attrs[idx]);
8303
8304 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
8305 idx = NL80211_ATTR_STA_TX_POWER;
8306
8307 if (info->attrs[idx])
8308 txpwr->power = nla_get_s16(info->attrs[idx]);
8309 else
8310 return -EINVAL;
8311 }
8312
8313 *txpwr_set = true;
8314 } else {
8315 *txpwr_set = false;
8316 }
8317
8318 return 0;
8319 }
8320
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)8321 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
8322 {
8323 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8324 struct net_device *dev = info->user_ptr[1];
8325 struct station_parameters params;
8326 u8 *mac_addr;
8327 int err;
8328
8329 memset(¶ms, 0, sizeof(params));
8330
8331 if (!rdev->ops->change_station)
8332 return -EOPNOTSUPP;
8333
8334 /*
8335 * AID and listen_interval properties can be set only for unassociated
8336 * station. Include these parameters here and will check them in
8337 * cfg80211_check_station_change().
8338 */
8339 if (info->attrs[NL80211_ATTR_STA_AID])
8340 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8341
8342 if (info->attrs[NL80211_ATTR_VLAN_ID])
8343 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8344
8345 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8346 params.listen_interval =
8347 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8348 else
8349 params.listen_interval = -1;
8350
8351 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
8352 params.support_p2p_ps =
8353 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8354 else
8355 params.support_p2p_ps = -1;
8356
8357 if (!info->attrs[NL80211_ATTR_MAC])
8358 return -EINVAL;
8359
8360 params.link_sta_params.link_id =
8361 nl80211_link_id_or_invalid(info->attrs);
8362
8363 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8364 /* If MLD_ADDR attribute is set then this is an MLD station
8365 * and the MLD_ADDR attribute holds the MLD address and the
8366 * MAC attribute holds for the LINK address.
8367 * In that case, the link_id is also expected to be valid.
8368 */
8369 if (params.link_sta_params.link_id < 0)
8370 return -EINVAL;
8371
8372 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8373 params.link_sta_params.mld_mac = mac_addr;
8374 params.link_sta_params.link_mac =
8375 nla_data(info->attrs[NL80211_ATTR_MAC]);
8376 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8377 return -EINVAL;
8378 } else {
8379 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8380 }
8381
8382
8383 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
8384 params.link_sta_params.supported_rates =
8385 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8386 params.link_sta_params.supported_rates_len =
8387 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8388 }
8389
8390 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8391 params.capability =
8392 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8393 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8394 }
8395
8396 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8397 params.ext_capab =
8398 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8399 params.ext_capab_len =
8400 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8401 }
8402
8403 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8404 return -EINVAL;
8405
8406 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8407 params.plink_action =
8408 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8409
8410 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
8411 params.plink_state =
8412 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
8413 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
8414 params.peer_aid = nla_get_u16(
8415 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
8416 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
8417 }
8418
8419 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
8420 params.local_pm = nla_get_u32(
8421 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
8422
8423 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8424 params.link_sta_params.opmode_notif_used = true;
8425 params.link_sta_params.opmode_notif =
8426 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8427 }
8428
8429 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8430 params.link_sta_params.he_6ghz_capa =
8431 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8432
8433 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8434 params.eml_cap_present = true;
8435 params.eml_cap =
8436 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8437 }
8438
8439 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8440 params.airtime_weight =
8441 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8442
8443 if (params.airtime_weight &&
8444 !wiphy_ext_feature_isset(&rdev->wiphy,
8445 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8446 return -EOPNOTSUPP;
8447
8448 err = nl80211_parse_sta_txpower_setting(info,
8449 ¶ms.link_sta_params.txpwr,
8450 ¶ms.link_sta_params.txpwr_set);
8451 if (err)
8452 return err;
8453
8454 /* Include parameters for TDLS peer (will check later) */
8455 err = nl80211_set_station_tdls(info, ¶ms);
8456 if (err)
8457 return err;
8458
8459 params.vlan = get_vlan(info, rdev);
8460 if (IS_ERR(params.vlan))
8461 return PTR_ERR(params.vlan);
8462
8463 switch (dev->ieee80211_ptr->iftype) {
8464 case NL80211_IFTYPE_AP:
8465 case NL80211_IFTYPE_AP_VLAN:
8466 case NL80211_IFTYPE_P2P_GO:
8467 case NL80211_IFTYPE_P2P_CLIENT:
8468 case NL80211_IFTYPE_STATION:
8469 case NL80211_IFTYPE_ADHOC:
8470 case NL80211_IFTYPE_MESH_POINT:
8471 break;
8472 default:
8473 err = -EOPNOTSUPP;
8474 goto out_put_vlan;
8475 }
8476
8477 /* driver will call cfg80211_check_station_change() */
8478 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
8479
8480 out_put_vlan:
8481 dev_put(params.vlan);
8482
8483 return err;
8484 }
8485
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)8486 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
8487 {
8488 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8489 int err;
8490 struct net_device *dev = info->user_ptr[1];
8491 struct wireless_dev *wdev = dev->ieee80211_ptr;
8492 struct station_parameters params;
8493 u8 *mac_addr = NULL;
8494 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
8495 BIT(NL80211_STA_FLAG_ASSOCIATED);
8496
8497 memset(¶ms, 0, sizeof(params));
8498
8499 if (!rdev->ops->add_station)
8500 return -EOPNOTSUPP;
8501
8502 if (!info->attrs[NL80211_ATTR_MAC])
8503 return -EINVAL;
8504
8505 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
8506 return -EINVAL;
8507
8508 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
8509 return -EINVAL;
8510
8511 if (!info->attrs[NL80211_ATTR_STA_AID] &&
8512 !info->attrs[NL80211_ATTR_PEER_AID])
8513 return -EINVAL;
8514
8515 params.link_sta_params.link_id =
8516 nl80211_link_id_or_invalid(info->attrs);
8517
8518 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
8519 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
8520 params.link_sta_params.mld_mac = mac_addr;
8521 params.link_sta_params.link_mac =
8522 nla_data(info->attrs[NL80211_ATTR_MAC]);
8523 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
8524 return -EINVAL;
8525 } else {
8526 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8527 }
8528
8529 params.link_sta_params.supported_rates =
8530 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8531 params.link_sta_params.supported_rates_len =
8532 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
8533 params.listen_interval =
8534 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
8535
8536 if (info->attrs[NL80211_ATTR_VLAN_ID])
8537 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
8538
8539 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
8540 params.support_p2p_ps =
8541 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
8542 } else {
8543 /*
8544 * if not specified, assume it's supported for P2P GO interface,
8545 * and is NOT supported for AP interface
8546 */
8547 params.support_p2p_ps =
8548 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
8549 }
8550
8551 if (info->attrs[NL80211_ATTR_PEER_AID])
8552 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
8553 else
8554 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
8555
8556 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
8557 params.capability =
8558 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
8559 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
8560 }
8561
8562 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
8563 params.ext_capab =
8564 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8565 params.ext_capab_len =
8566 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
8567 }
8568
8569 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
8570 params.link_sta_params.ht_capa =
8571 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
8572
8573 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
8574 params.link_sta_params.vht_capa =
8575 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
8576
8577 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
8578 params.link_sta_params.he_capa =
8579 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8580 params.link_sta_params.he_capa_len =
8581 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
8582
8583 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
8584 params.link_sta_params.eht_capa =
8585 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8586 params.link_sta_params.eht_capa_len =
8587 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
8588
8589 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
8590 (const u8 *)params.link_sta_params.eht_capa,
8591 params.link_sta_params.eht_capa_len,
8592 false))
8593 return -EINVAL;
8594 }
8595 }
8596
8597 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
8598 params.eml_cap_present = true;
8599 params.eml_cap =
8600 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
8601 }
8602
8603 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
8604 params.link_sta_params.he_6ghz_capa =
8605 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
8606
8607 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
8608 params.link_sta_params.s1g_capa =
8609 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
8610
8611 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
8612 params.link_sta_params.opmode_notif_used = true;
8613 params.link_sta_params.opmode_notif =
8614 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
8615 }
8616
8617 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
8618 params.plink_action =
8619 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
8620
8621 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
8622 params.airtime_weight =
8623 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
8624
8625 if (params.airtime_weight &&
8626 !wiphy_ext_feature_isset(&rdev->wiphy,
8627 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
8628 return -EOPNOTSUPP;
8629
8630 err = nl80211_parse_sta_txpower_setting(info,
8631 ¶ms.link_sta_params.txpwr,
8632 ¶ms.link_sta_params.txpwr_set);
8633 if (err)
8634 return err;
8635
8636 err = nl80211_parse_sta_channel_info(info, ¶ms);
8637 if (err)
8638 return err;
8639
8640 err = nl80211_parse_sta_wme(info, ¶ms);
8641 if (err)
8642 return err;
8643
8644 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
8645 return -EINVAL;
8646
8647 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
8648 * as userspace might just pass through the capabilities from the IEs
8649 * directly, rather than enforcing this restriction and returning an
8650 * error in this case.
8651 */
8652 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
8653 params.link_sta_params.ht_capa = NULL;
8654 params.link_sta_params.vht_capa = NULL;
8655
8656 /* HE and EHT require WME */
8657 if (params.link_sta_params.he_capa_len ||
8658 params.link_sta_params.he_6ghz_capa ||
8659 params.link_sta_params.eht_capa_len)
8660 return -EINVAL;
8661 }
8662
8663 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
8664 if (params.link_sta_params.he_6ghz_capa &&
8665 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
8666 return -EINVAL;
8667
8668 /* When you run into this, adjust the code below for the new flag */
8669 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
8670
8671 switch (dev->ieee80211_ptr->iftype) {
8672 case NL80211_IFTYPE_AP:
8673 case NL80211_IFTYPE_AP_VLAN:
8674 case NL80211_IFTYPE_P2P_GO:
8675 /* ignore WME attributes if iface/sta is not capable */
8676 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
8677 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
8678 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8679
8680 /* TDLS peers cannot be added */
8681 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8682 info->attrs[NL80211_ATTR_PEER_AID])
8683 return -EINVAL;
8684 /* but don't bother the driver with it */
8685 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
8686
8687 /* allow authenticated/associated only if driver handles it */
8688 if (!(rdev->wiphy.features &
8689 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
8690 params.sta_flags_mask & auth_assoc)
8691 return -EINVAL;
8692
8693 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8694 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
8695 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
8696 return -EINVAL;
8697
8698 /* Older userspace, or userspace wanting to be compatible with
8699 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
8700 * and assoc flags in the mask, but assumes the station will be
8701 * added as associated anyway since this was the required driver
8702 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
8703 * introduced.
8704 * In order to not bother drivers with this quirk in the API
8705 * set the flags in both the mask and set for new stations in
8706 * this case.
8707 */
8708 if (!(params.sta_flags_mask & auth_assoc)) {
8709 params.sta_flags_mask |= auth_assoc;
8710 params.sta_flags_set |= auth_assoc;
8711 }
8712
8713 /* must be last in here for error handling */
8714 params.vlan = get_vlan(info, rdev);
8715 if (IS_ERR(params.vlan))
8716 return PTR_ERR(params.vlan);
8717 break;
8718 case NL80211_IFTYPE_MESH_POINT:
8719 /* ignore uAPSD data */
8720 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8721
8722 /* associated is disallowed */
8723 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
8724 return -EINVAL;
8725 /* TDLS peers cannot be added */
8726 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
8727 info->attrs[NL80211_ATTR_PEER_AID])
8728 return -EINVAL;
8729 break;
8730 case NL80211_IFTYPE_STATION:
8731 case NL80211_IFTYPE_P2P_CLIENT:
8732 /* ignore uAPSD data */
8733 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
8734
8735 /* these are disallowed */
8736 if (params.sta_flags_mask &
8737 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
8738 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
8739 return -EINVAL;
8740 /* Only TDLS peers can be added */
8741 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
8742 return -EINVAL;
8743 /* Can only add if TDLS ... */
8744 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
8745 return -EOPNOTSUPP;
8746 /* ... with external setup is supported */
8747 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
8748 return -EOPNOTSUPP;
8749 /*
8750 * Older wpa_supplicant versions always mark the TDLS peer
8751 * as authorized, but it shouldn't yet be.
8752 */
8753 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
8754 break;
8755 default:
8756 return -EOPNOTSUPP;
8757 }
8758
8759 /* be aware of params.vlan when changing code here */
8760
8761 if (wdev->valid_links) {
8762 if (params.link_sta_params.link_id < 0) {
8763 err = -EINVAL;
8764 goto out;
8765 }
8766 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
8767 err = -ENOLINK;
8768 goto out;
8769 }
8770 } else {
8771 if (params.link_sta_params.link_id >= 0) {
8772 err = -EINVAL;
8773 goto out;
8774 }
8775 }
8776 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
8777 out:
8778 dev_put(params.vlan);
8779 return err;
8780 }
8781
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)8782 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
8783 {
8784 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8785 struct net_device *dev = info->user_ptr[1];
8786 struct wireless_dev *wdev = dev->ieee80211_ptr;
8787 struct station_del_parameters params;
8788 int link_id = nl80211_link_id_or_invalid(info->attrs);
8789
8790 memset(¶ms, 0, sizeof(params));
8791
8792 if (info->attrs[NL80211_ATTR_MAC])
8793 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
8794
8795 switch (wdev->iftype) {
8796 case NL80211_IFTYPE_AP:
8797 case NL80211_IFTYPE_AP_VLAN:
8798 case NL80211_IFTYPE_MESH_POINT:
8799 case NL80211_IFTYPE_P2P_GO:
8800 /* always accept these */
8801 break;
8802 case NL80211_IFTYPE_ADHOC:
8803 /* conditionally accept */
8804 if (wiphy_ext_feature_isset(&rdev->wiphy,
8805 NL80211_EXT_FEATURE_DEL_IBSS_STA))
8806 break;
8807 return -EINVAL;
8808 default:
8809 return -EINVAL;
8810 }
8811
8812 if (!rdev->ops->del_station)
8813 return -EOPNOTSUPP;
8814
8815 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
8816 params.subtype =
8817 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
8818 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
8819 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
8820 return -EINVAL;
8821 } else {
8822 /* Default to Deauthentication frame */
8823 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
8824 }
8825
8826 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
8827 params.reason_code =
8828 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8829 if (params.reason_code == 0)
8830 return -EINVAL; /* 0 is reserved */
8831 } else {
8832 /* Default to reason code 2 */
8833 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
8834 }
8835
8836 /* Link ID not expected in case of non-ML operation */
8837 if (!wdev->valid_links && link_id != -1)
8838 return -EINVAL;
8839
8840 /* If given, a valid link ID should be passed during MLO */
8841 if (wdev->valid_links && link_id >= 0 &&
8842 !(wdev->valid_links & BIT(link_id)))
8843 return -EINVAL;
8844
8845 params.link_id = link_id;
8846
8847 return rdev_del_station(rdev, dev, ¶ms);
8848 }
8849
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)8850 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
8851 int flags, struct net_device *dev,
8852 u8 *dst, u8 *next_hop,
8853 struct mpath_info *pinfo)
8854 {
8855 void *hdr;
8856 struct nlattr *pinfoattr;
8857
8858 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
8859 if (!hdr)
8860 return -1;
8861
8862 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8863 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
8864 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
8865 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
8866 goto nla_put_failure;
8867
8868 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
8869 if (!pinfoattr)
8870 goto nla_put_failure;
8871 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
8872 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
8873 pinfo->frame_qlen))
8874 goto nla_put_failure;
8875 if (((pinfo->filled & MPATH_INFO_SN) &&
8876 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
8877 ((pinfo->filled & MPATH_INFO_METRIC) &&
8878 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
8879 pinfo->metric)) ||
8880 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
8881 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
8882 pinfo->exptime)) ||
8883 ((pinfo->filled & MPATH_INFO_FLAGS) &&
8884 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
8885 pinfo->flags)) ||
8886 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
8887 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
8888 pinfo->discovery_timeout)) ||
8889 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
8890 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
8891 pinfo->discovery_retries)) ||
8892 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
8893 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
8894 pinfo->hop_count)) ||
8895 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
8896 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
8897 pinfo->path_change_count)))
8898 goto nla_put_failure;
8899
8900 nla_nest_end(msg, pinfoattr);
8901
8902 genlmsg_end(msg, hdr);
8903 return 0;
8904
8905 nla_put_failure:
8906 genlmsg_cancel(msg, hdr);
8907 return -EMSGSIZE;
8908 }
8909
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)8910 static int nl80211_dump_mpath(struct sk_buff *skb,
8911 struct netlink_callback *cb)
8912 {
8913 struct mpath_info pinfo;
8914 struct cfg80211_registered_device *rdev;
8915 struct wireless_dev *wdev;
8916 u8 dst[ETH_ALEN];
8917 u8 next_hop[ETH_ALEN];
8918 int path_idx = cb->args[2];
8919 int err;
8920
8921 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8922 if (err)
8923 return err;
8924 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8925 __acquire(&rdev->wiphy.mtx);
8926
8927 if (!rdev->ops->dump_mpath) {
8928 err = -EOPNOTSUPP;
8929 goto out_err;
8930 }
8931
8932 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8933 err = -EOPNOTSUPP;
8934 goto out_err;
8935 }
8936
8937 while (1) {
8938 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
8939 next_hop, &pinfo);
8940 if (err == -ENOENT)
8941 break;
8942 if (err)
8943 goto out_err;
8944
8945 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8946 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8947 wdev->netdev, dst, next_hop,
8948 &pinfo) < 0)
8949 goto out;
8950
8951 path_idx++;
8952 }
8953
8954 out:
8955 cb->args[2] = path_idx;
8956 err = skb->len;
8957 out_err:
8958 wiphy_unlock(&rdev->wiphy);
8959 return err;
8960 }
8961
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)8962 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
8963 {
8964 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8965 int err;
8966 struct net_device *dev = info->user_ptr[1];
8967 struct mpath_info pinfo;
8968 struct sk_buff *msg;
8969 u8 *dst = NULL;
8970 u8 next_hop[ETH_ALEN];
8971
8972 memset(&pinfo, 0, sizeof(pinfo));
8973
8974 if (!info->attrs[NL80211_ATTR_MAC])
8975 return -EINVAL;
8976
8977 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8978
8979 if (!rdev->ops->get_mpath)
8980 return -EOPNOTSUPP;
8981
8982 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8983 return -EOPNOTSUPP;
8984
8985 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8986 if (err)
8987 return err;
8988
8989 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8990 if (!msg)
8991 return -ENOMEM;
8992
8993 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8994 dev, dst, next_hop, &pinfo) < 0) {
8995 nlmsg_free(msg);
8996 return -ENOBUFS;
8997 }
8998
8999 return genlmsg_reply(msg, info);
9000 }
9001
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)9002 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
9003 {
9004 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9005 struct net_device *dev = info->user_ptr[1];
9006 u8 *dst = NULL;
9007 u8 *next_hop = NULL;
9008
9009 if (!info->attrs[NL80211_ATTR_MAC])
9010 return -EINVAL;
9011
9012 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9013 return -EINVAL;
9014
9015 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9016 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9017
9018 if (!rdev->ops->change_mpath)
9019 return -EOPNOTSUPP;
9020
9021 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9022 return -EOPNOTSUPP;
9023
9024 return rdev_change_mpath(rdev, dev, dst, next_hop);
9025 }
9026
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)9027 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
9028 {
9029 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9030 struct net_device *dev = info->user_ptr[1];
9031 u8 *dst = NULL;
9032 u8 *next_hop = NULL;
9033
9034 if (!info->attrs[NL80211_ATTR_MAC])
9035 return -EINVAL;
9036
9037 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
9038 return -EINVAL;
9039
9040 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9041 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
9042
9043 if (!rdev->ops->add_mpath)
9044 return -EOPNOTSUPP;
9045
9046 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9047 return -EOPNOTSUPP;
9048
9049 return rdev_add_mpath(rdev, dev, dst, next_hop);
9050 }
9051
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)9052 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
9053 {
9054 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9055 struct net_device *dev = info->user_ptr[1];
9056 u8 *dst = NULL;
9057
9058 if (info->attrs[NL80211_ATTR_MAC])
9059 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9060
9061 if (!rdev->ops->del_mpath)
9062 return -EOPNOTSUPP;
9063
9064 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9065 return -EOPNOTSUPP;
9066
9067 return rdev_del_mpath(rdev, dev, dst);
9068 }
9069
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)9070 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
9071 {
9072 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9073 int err;
9074 struct net_device *dev = info->user_ptr[1];
9075 struct mpath_info pinfo;
9076 struct sk_buff *msg;
9077 u8 *dst = NULL;
9078 u8 mpp[ETH_ALEN];
9079
9080 memset(&pinfo, 0, sizeof(pinfo));
9081
9082 if (!info->attrs[NL80211_ATTR_MAC])
9083 return -EINVAL;
9084
9085 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
9086
9087 if (!rdev->ops->get_mpp)
9088 return -EOPNOTSUPP;
9089
9090 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
9091 return -EOPNOTSUPP;
9092
9093 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
9094 if (err)
9095 return err;
9096
9097 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9098 if (!msg)
9099 return -ENOMEM;
9100
9101 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
9102 dev, dst, mpp, &pinfo) < 0) {
9103 nlmsg_free(msg);
9104 return -ENOBUFS;
9105 }
9106
9107 return genlmsg_reply(msg, info);
9108 }
9109
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)9110 static int nl80211_dump_mpp(struct sk_buff *skb,
9111 struct netlink_callback *cb)
9112 {
9113 struct mpath_info pinfo;
9114 struct cfg80211_registered_device *rdev;
9115 struct wireless_dev *wdev;
9116 u8 dst[ETH_ALEN];
9117 u8 mpp[ETH_ALEN];
9118 int path_idx = cb->args[2];
9119 int err;
9120
9121 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
9122 if (err)
9123 return err;
9124 /* nl80211_prepare_wdev_dump acquired it in the successful case */
9125 __acquire(&rdev->wiphy.mtx);
9126
9127 if (!rdev->ops->dump_mpp) {
9128 err = -EOPNOTSUPP;
9129 goto out_err;
9130 }
9131
9132 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
9133 err = -EOPNOTSUPP;
9134 goto out_err;
9135 }
9136
9137 while (1) {
9138 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
9139 mpp, &pinfo);
9140 if (err == -ENOENT)
9141 break;
9142 if (err)
9143 goto out_err;
9144
9145 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
9146 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9147 wdev->netdev, dst, mpp,
9148 &pinfo) < 0)
9149 goto out;
9150
9151 path_idx++;
9152 }
9153
9154 out:
9155 cb->args[2] = path_idx;
9156 err = skb->len;
9157 out_err:
9158 wiphy_unlock(&rdev->wiphy);
9159 return err;
9160 }
9161
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)9162 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
9163 {
9164 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9165 struct net_device *dev = info->user_ptr[1];
9166 struct bss_parameters params;
9167 u32 bss_param_support = rdev->wiphy.bss_param_support;
9168 u32 changed = 0;
9169 bool strict;
9170
9171 memset(¶ms, 0, sizeof(params));
9172 params.link_id = nl80211_link_id_or_invalid(info->attrs);
9173 /* default to not changing parameters */
9174 params.use_cts_prot = -1;
9175 params.use_short_preamble = -1;
9176 params.use_short_slot_time = -1;
9177 params.ap_isolate = -1;
9178 params.ht_opmode = -1;
9179 params.p2p_ctwindow = -1;
9180 params.p2p_opp_ps = -1;
9181
9182 strict = nla_get_flag(info->attrs[NL80211_ATTR_BSS_PARAM]);
9183 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) {
9184 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_CTS_PROT))
9185 return -EINVAL;
9186 params.use_cts_prot =
9187 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
9188 changed |= WIPHY_BSS_PARAM_CTS_PROT;
9189 }
9190 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) {
9191 if (strict &&
9192 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_PREAMBLE))
9193 return -EINVAL;
9194 params.use_short_preamble =
9195 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
9196 changed |= WIPHY_BSS_PARAM_SHORT_PREAMBLE;
9197 }
9198 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) {
9199 if (strict &&
9200 !(bss_param_support & WIPHY_BSS_PARAM_SHORT_SLOT_TIME))
9201 return -EINVAL;
9202 params.use_short_slot_time =
9203 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
9204 changed |= WIPHY_BSS_PARAM_SHORT_SLOT_TIME;
9205 }
9206 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9207 if (strict &&
9208 !(bss_param_support & WIPHY_BSS_PARAM_BASIC_RATES))
9209 return -EINVAL;
9210 params.basic_rates =
9211 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9212 params.basic_rates_len =
9213 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9214 changed |= WIPHY_BSS_PARAM_BASIC_RATES;
9215 }
9216 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) {
9217 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_AP_ISOLATE))
9218 return -EINVAL;
9219 params.ap_isolate =
9220 !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
9221 changed |= WIPHY_BSS_PARAM_AP_ISOLATE;
9222 }
9223 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) {
9224 if (strict && !(bss_param_support & WIPHY_BSS_PARAM_HT_OPMODE))
9225 return -EINVAL;
9226 params.ht_opmode =
9227 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
9228 changed |= WIPHY_BSS_PARAM_HT_OPMODE;
9229 }
9230
9231 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
9232 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9233 return -EINVAL;
9234 params.p2p_ctwindow =
9235 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
9236 if (params.p2p_ctwindow != 0 &&
9237 !(bss_param_support & WIPHY_BSS_PARAM_P2P_CTWINDOW))
9238 return -EINVAL;
9239 changed |= WIPHY_BSS_PARAM_P2P_CTWINDOW;
9240 }
9241
9242 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
9243 u8 tmp;
9244
9245 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9246 return -EINVAL;
9247 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
9248 if (tmp && !(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9249 return -EINVAL;
9250 params.p2p_opp_ps = tmp;
9251 if (params.p2p_opp_ps &&
9252 !(rdev->wiphy.bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
9253 return -EINVAL;
9254 }
9255
9256 if (!rdev->ops->change_bss)
9257 return -EOPNOTSUPP;
9258
9259 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
9260 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
9261 return -EOPNOTSUPP;
9262
9263 changed &= rdev->wiphy.bss_param_support;
9264 if (!changed)
9265 return 0;
9266
9267 return rdev_change_bss(rdev, dev, ¶ms);
9268 }
9269
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)9270 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
9271 {
9272 char *data = NULL;
9273 bool is_indoor;
9274 enum nl80211_user_reg_hint_type user_reg_hint_type;
9275 u32 owner_nlportid;
9276
9277 /*
9278 * You should only get this when cfg80211 hasn't yet initialized
9279 * completely when built-in to the kernel right between the time
9280 * window between nl80211_init() and regulatory_init(), if that is
9281 * even possible.
9282 */
9283 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
9284 return -EINPROGRESS;
9285
9286 user_reg_hint_type =
9287 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
9288 NL80211_USER_REG_HINT_USER);
9289
9290 switch (user_reg_hint_type) {
9291 case NL80211_USER_REG_HINT_USER:
9292 case NL80211_USER_REG_HINT_CELL_BASE:
9293 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
9294 return -EINVAL;
9295
9296 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9297 return regulatory_hint_user(data, user_reg_hint_type);
9298 case NL80211_USER_REG_HINT_INDOOR:
9299 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9300 owner_nlportid = info->snd_portid;
9301 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
9302 } else {
9303 owner_nlportid = 0;
9304 is_indoor = true;
9305 }
9306
9307 regulatory_hint_indoor(is_indoor, owner_nlportid);
9308 return 0;
9309 default:
9310 return -EINVAL;
9311 }
9312 }
9313
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)9314 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
9315 {
9316 return reg_reload_regdb();
9317 }
9318
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)9319 static int nl80211_get_mesh_config(struct sk_buff *skb,
9320 struct genl_info *info)
9321 {
9322 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9323 struct net_device *dev = info->user_ptr[1];
9324 struct wireless_dev *wdev = dev->ieee80211_ptr;
9325 struct mesh_config cur_params;
9326 int err = 0;
9327 void *hdr;
9328 struct nlattr *pinfoattr;
9329 struct sk_buff *msg;
9330
9331 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9332 return -EOPNOTSUPP;
9333
9334 if (!rdev->ops->get_mesh_config)
9335 return -EOPNOTSUPP;
9336
9337 /* If not connected, get default parameters */
9338 if (!wdev->u.mesh.id_len)
9339 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
9340 else
9341 err = rdev_get_mesh_config(rdev, dev, &cur_params);
9342
9343 if (err)
9344 return err;
9345
9346 /* Draw up a netlink message to send back */
9347 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9348 if (!msg)
9349 return -ENOMEM;
9350 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9351 NL80211_CMD_GET_MESH_CONFIG);
9352 if (!hdr)
9353 goto out;
9354 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
9355 if (!pinfoattr)
9356 goto nla_put_failure;
9357 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9358 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
9359 cur_params.dot11MeshRetryTimeout) ||
9360 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
9361 cur_params.dot11MeshConfirmTimeout) ||
9362 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
9363 cur_params.dot11MeshHoldingTimeout) ||
9364 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
9365 cur_params.dot11MeshMaxPeerLinks) ||
9366 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
9367 cur_params.dot11MeshMaxRetries) ||
9368 nla_put_u8(msg, NL80211_MESHCONF_TTL,
9369 cur_params.dot11MeshTTL) ||
9370 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
9371 cur_params.element_ttl) ||
9372 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9373 cur_params.auto_open_plinks) ||
9374 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9375 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
9376 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9377 cur_params.dot11MeshHWMPmaxPREQretries) ||
9378 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
9379 cur_params.path_refresh_time) ||
9380 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9381 cur_params.min_discovery_timeout) ||
9382 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9383 cur_params.dot11MeshHWMPactivePathTimeout) ||
9384 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9385 cur_params.dot11MeshHWMPpreqMinInterval) ||
9386 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9387 cur_params.dot11MeshHWMPperrMinInterval) ||
9388 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9389 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
9390 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
9391 cur_params.dot11MeshHWMPRootMode) ||
9392 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9393 cur_params.dot11MeshHWMPRannInterval) ||
9394 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9395 cur_params.dot11MeshGateAnnouncementProtocol) ||
9396 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
9397 cur_params.dot11MeshForwarding) ||
9398 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
9399 cur_params.rssi_threshold) ||
9400 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
9401 cur_params.ht_opmode) ||
9402 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9403 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
9404 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9405 cur_params.dot11MeshHWMProotInterval) ||
9406 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9407 cur_params.dot11MeshHWMPconfirmationInterval) ||
9408 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
9409 cur_params.power_mode) ||
9410 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
9411 cur_params.dot11MeshAwakeWindowDuration) ||
9412 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
9413 cur_params.plink_timeout) ||
9414 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
9415 cur_params.dot11MeshConnectedToMeshGate) ||
9416 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
9417 cur_params.dot11MeshNolearn) ||
9418 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
9419 cur_params.dot11MeshConnectedToAuthServer))
9420 goto nla_put_failure;
9421 nla_nest_end(msg, pinfoattr);
9422 genlmsg_end(msg, hdr);
9423 return genlmsg_reply(msg, info);
9424
9425 nla_put_failure:
9426 out:
9427 nlmsg_free(msg);
9428 return -ENOBUFS;
9429 }
9430
9431 static const struct nla_policy
9432 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
9433 [NL80211_MESHCONF_RETRY_TIMEOUT] =
9434 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9435 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
9436 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9437 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
9438 NLA_POLICY_RANGE(NLA_U16, 1, 255),
9439 [NL80211_MESHCONF_MAX_PEER_LINKS] =
9440 NLA_POLICY_RANGE(NLA_U16, 0, 255),
9441 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
9442 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9443 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
9444 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
9445 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
9446 NLA_POLICY_RANGE(NLA_U32, 1, 255),
9447 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
9448 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
9449 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
9450 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
9451 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
9452 NLA_POLICY_MIN(NLA_U16, 1),
9453 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
9454 NLA_POLICY_MIN(NLA_U16, 1),
9455 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
9456 NLA_POLICY_MIN(NLA_U16, 1),
9457 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
9458 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
9459 NLA_POLICY_MIN(NLA_U16, 1),
9460 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
9461 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
9462 [NL80211_MESHCONF_RSSI_THRESHOLD] =
9463 NLA_POLICY_RANGE(NLA_S32, -255, 0),
9464 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
9465 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
9466 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
9467 NLA_POLICY_MIN(NLA_U16, 1),
9468 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
9469 NLA_POLICY_MIN(NLA_U16, 1),
9470 [NL80211_MESHCONF_POWER_MODE] =
9471 NLA_POLICY_RANGE(NLA_U32,
9472 NL80211_MESH_POWER_ACTIVE,
9473 NL80211_MESH_POWER_MAX),
9474 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
9475 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
9476 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9477 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9478 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
9479 };
9480
9481 static const struct nla_policy
9482 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
9483 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
9484 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
9485 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
9486 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
9487 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
9488 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
9489 [NL80211_MESH_SETUP_IE] =
9490 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
9491 IEEE80211_MAX_DATA_LEN),
9492 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
9493 };
9494
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)9495 static int nl80211_parse_mesh_config(struct genl_info *info,
9496 struct mesh_config *cfg,
9497 u32 *mask_out)
9498 {
9499 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
9500 u32 mask = 0;
9501 u16 ht_opmode;
9502
9503 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
9504 do { \
9505 if (tb[attr]) { \
9506 cfg->param = fn(tb[attr]); \
9507 mask |= BIT((attr) - 1); \
9508 } \
9509 } while (0)
9510
9511 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
9512 return -EINVAL;
9513 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
9514 return -EINVAL;
9515
9516 /* This makes sure that there aren't more than 32 mesh config
9517 * parameters (otherwise our bitfield scheme would not work.) */
9518 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
9519
9520 /* Fill in the params struct */
9521 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
9522 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
9523 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
9524 NL80211_MESHCONF_CONFIRM_TIMEOUT,
9525 nla_get_u16);
9526 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
9527 NL80211_MESHCONF_HOLDING_TIMEOUT,
9528 nla_get_u16);
9529 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
9530 NL80211_MESHCONF_MAX_PEER_LINKS,
9531 nla_get_u16);
9532 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
9533 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
9534 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
9535 NL80211_MESHCONF_TTL, nla_get_u8);
9536 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
9537 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
9538 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
9539 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
9540 nla_get_u8);
9541 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
9542 mask,
9543 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
9544 nla_get_u32);
9545 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
9546 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
9547 nla_get_u8);
9548 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
9549 NL80211_MESHCONF_PATH_REFRESH_TIME,
9550 nla_get_u32);
9551 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
9552 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
9553 return -EINVAL;
9554 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
9555 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
9556 nla_get_u16);
9557 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
9558 mask,
9559 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
9560 nla_get_u32);
9561 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
9562 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
9563 cfg->dot11MeshHWMPactivePathTimeout > 65535))
9564 return -EINVAL;
9565 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
9566 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
9567 nla_get_u16);
9568 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
9569 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
9570 nla_get_u16);
9571 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9572 dot11MeshHWMPnetDiameterTraversalTime, mask,
9573 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
9574 nla_get_u16);
9575 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
9576 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
9577 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
9578 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
9579 nla_get_u16);
9580 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
9581 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
9582 nla_get_u8);
9583 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
9584 NL80211_MESHCONF_FORWARDING, nla_get_u8);
9585 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
9586 NL80211_MESHCONF_RSSI_THRESHOLD,
9587 nla_get_s32);
9588 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
9589 NL80211_MESHCONF_CONNECTED_TO_GATE,
9590 nla_get_u8);
9591 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
9592 NL80211_MESHCONF_CONNECTED_TO_AS,
9593 nla_get_u8);
9594 /*
9595 * Check HT operation mode based on
9596 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
9597 */
9598 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
9599 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
9600
9601 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
9602 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
9603 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
9604 return -EINVAL;
9605
9606 /* NON_HT_STA bit is reserved, but some programs set it */
9607 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
9608
9609 cfg->ht_opmode = ht_opmode;
9610 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
9611 }
9612 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
9613 dot11MeshHWMPactivePathToRootTimeout, mask,
9614 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
9615 nla_get_u32);
9616 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
9617 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
9618 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
9619 return -EINVAL;
9620 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
9621 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
9622 nla_get_u16);
9623 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
9624 mask,
9625 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
9626 nla_get_u16);
9627 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
9628 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
9629 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
9630 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
9631 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
9632 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
9633 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
9634 NL80211_MESHCONF_NOLEARN, nla_get_u8);
9635 if (mask_out)
9636 *mask_out = mask;
9637
9638 return 0;
9639
9640 #undef FILL_IN_MESH_PARAM_IF_SET
9641 }
9642
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)9643 static int nl80211_parse_mesh_setup(struct genl_info *info,
9644 struct mesh_setup *setup)
9645 {
9646 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9647 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
9648
9649 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
9650 return -EINVAL;
9651 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
9652 return -EINVAL;
9653
9654 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
9655 setup->sync_method =
9656 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
9657 IEEE80211_SYNC_METHOD_VENDOR :
9658 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
9659
9660 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
9661 setup->path_sel_proto =
9662 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
9663 IEEE80211_PATH_PROTOCOL_VENDOR :
9664 IEEE80211_PATH_PROTOCOL_HWMP;
9665
9666 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
9667 setup->path_metric =
9668 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
9669 IEEE80211_PATH_METRIC_VENDOR :
9670 IEEE80211_PATH_METRIC_AIRTIME;
9671
9672 if (tb[NL80211_MESH_SETUP_IE]) {
9673 struct nlattr *ieattr =
9674 tb[NL80211_MESH_SETUP_IE];
9675 setup->ie = nla_data(ieattr);
9676 setup->ie_len = nla_len(ieattr);
9677 }
9678 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
9679 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
9680 return -EINVAL;
9681 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
9682 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
9683 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
9684 if (setup->is_secure)
9685 setup->user_mpm = true;
9686
9687 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
9688 if (!setup->user_mpm)
9689 return -EINVAL;
9690 setup->auth_id =
9691 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
9692 }
9693
9694 return 0;
9695 }
9696
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)9697 static int nl80211_update_mesh_config(struct sk_buff *skb,
9698 struct genl_info *info)
9699 {
9700 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9701 struct net_device *dev = info->user_ptr[1];
9702 struct wireless_dev *wdev = dev->ieee80211_ptr;
9703 struct mesh_config cfg = {};
9704 u32 mask;
9705 int err;
9706
9707 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
9708 return -EOPNOTSUPP;
9709
9710 if (!rdev->ops->update_mesh_config)
9711 return -EOPNOTSUPP;
9712
9713 err = nl80211_parse_mesh_config(info, &cfg, &mask);
9714 if (err)
9715 return err;
9716
9717 if (!wdev->u.mesh.id_len)
9718 err = -ENOLINK;
9719
9720 if (!err)
9721 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
9722
9723 return err;
9724 }
9725
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)9726 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
9727 struct sk_buff *msg)
9728 {
9729 struct nlattr *nl_reg_rules;
9730 unsigned int i;
9731
9732 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
9733 (regdom->dfs_region &&
9734 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
9735 goto nla_put_failure;
9736
9737 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
9738 if (!nl_reg_rules)
9739 goto nla_put_failure;
9740
9741 for (i = 0; i < regdom->n_reg_rules; i++) {
9742 struct nlattr *nl_reg_rule;
9743 const struct ieee80211_reg_rule *reg_rule;
9744 const struct ieee80211_freq_range *freq_range;
9745 const struct ieee80211_power_rule *power_rule;
9746 unsigned int max_bandwidth_khz;
9747
9748 reg_rule = ®dom->reg_rules[i];
9749 freq_range = ®_rule->freq_range;
9750 power_rule = ®_rule->power_rule;
9751
9752 nl_reg_rule = nla_nest_start_noflag(msg, i);
9753 if (!nl_reg_rule)
9754 goto nla_put_failure;
9755
9756 max_bandwidth_khz = freq_range->max_bandwidth_khz;
9757 if (!max_bandwidth_khz)
9758 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
9759 reg_rule);
9760
9761 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
9762 reg_rule->flags) ||
9763 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
9764 freq_range->start_freq_khz) ||
9765 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
9766 freq_range->end_freq_khz) ||
9767 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
9768 max_bandwidth_khz) ||
9769 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
9770 power_rule->max_antenna_gain) ||
9771 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
9772 power_rule->max_eirp) ||
9773 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
9774 reg_rule->dfs_cac_ms))
9775 goto nla_put_failure;
9776
9777 if ((reg_rule->flags & NL80211_RRF_PSD) &&
9778 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
9779 reg_rule->psd))
9780 goto nla_put_failure;
9781
9782 nla_nest_end(msg, nl_reg_rule);
9783 }
9784
9785 nla_nest_end(msg, nl_reg_rules);
9786 return 0;
9787
9788 nla_put_failure:
9789 return -EMSGSIZE;
9790 }
9791
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)9792 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
9793 {
9794 const struct ieee80211_regdomain *regdom = NULL;
9795 struct cfg80211_registered_device *rdev;
9796 struct wiphy *wiphy = NULL;
9797 struct sk_buff *msg;
9798 int err = -EMSGSIZE;
9799 void *hdr;
9800
9801 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9802 if (!msg)
9803 return -ENOBUFS;
9804
9805 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9806 NL80211_CMD_GET_REG);
9807 if (!hdr)
9808 goto put_failure;
9809
9810 rtnl_lock();
9811
9812 if (info->attrs[NL80211_ATTR_WIPHY]) {
9813 bool self_managed;
9814
9815 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9816 if (IS_ERR(rdev)) {
9817 err = PTR_ERR(rdev);
9818 goto nla_put_failure;
9819 }
9820
9821 wiphy = &rdev->wiphy;
9822 self_managed = wiphy->regulatory_flags &
9823 REGULATORY_WIPHY_SELF_MANAGED;
9824
9825 rcu_read_lock();
9826
9827 regdom = get_wiphy_regdom(wiphy);
9828
9829 /* a self-managed-reg device must have a private regdom */
9830 if (WARN_ON(!regdom && self_managed)) {
9831 err = -EINVAL;
9832 goto nla_put_failure_rcu;
9833 }
9834
9835 if (regdom &&
9836 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9837 goto nla_put_failure_rcu;
9838 } else {
9839 rcu_read_lock();
9840 }
9841
9842 if (!wiphy && reg_last_request_cell_base() &&
9843 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9844 NL80211_USER_REG_HINT_CELL_BASE))
9845 goto nla_put_failure_rcu;
9846
9847 if (!regdom)
9848 regdom = rcu_dereference(cfg80211_regdomain);
9849
9850 if (nl80211_put_regdom(regdom, msg))
9851 goto nla_put_failure_rcu;
9852
9853 rcu_read_unlock();
9854
9855 genlmsg_end(msg, hdr);
9856 rtnl_unlock();
9857 return genlmsg_reply(msg, info);
9858
9859 nla_put_failure_rcu:
9860 rcu_read_unlock();
9861 nla_put_failure:
9862 rtnl_unlock();
9863 put_failure:
9864 nlmsg_free(msg);
9865 return err;
9866 }
9867
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)9868 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
9869 u32 seq, int flags, struct wiphy *wiphy,
9870 const struct ieee80211_regdomain *regdom)
9871 {
9872 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9873 NL80211_CMD_GET_REG);
9874
9875 if (!hdr)
9876 return -1;
9877
9878 genl_dump_check_consistent(cb, hdr);
9879
9880 if (nl80211_put_regdom(regdom, msg))
9881 goto nla_put_failure;
9882
9883 if (!wiphy && reg_last_request_cell_base() &&
9884 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
9885 NL80211_USER_REG_HINT_CELL_BASE))
9886 goto nla_put_failure;
9887
9888 if (wiphy &&
9889 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9890 goto nla_put_failure;
9891
9892 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
9893 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
9894 goto nla_put_failure;
9895
9896 genlmsg_end(msg, hdr);
9897 return 0;
9898
9899 nla_put_failure:
9900 genlmsg_cancel(msg, hdr);
9901 return -EMSGSIZE;
9902 }
9903
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)9904 static int nl80211_get_reg_dump(struct sk_buff *skb,
9905 struct netlink_callback *cb)
9906 {
9907 const struct ieee80211_regdomain *regdom = NULL;
9908 struct cfg80211_registered_device *rdev;
9909 int err, reg_idx, start = cb->args[2];
9910
9911 rcu_read_lock();
9912
9913 if (cfg80211_regdomain && start == 0) {
9914 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9915 NLM_F_MULTI, NULL,
9916 rcu_dereference(cfg80211_regdomain));
9917 if (err < 0)
9918 goto out_err;
9919 }
9920
9921 /* the global regdom is idx 0 */
9922 reg_idx = 1;
9923 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9924 regdom = get_wiphy_regdom(&rdev->wiphy);
9925 if (!regdom)
9926 continue;
9927
9928 if (++reg_idx <= start)
9929 continue;
9930
9931 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
9932 NLM_F_MULTI, &rdev->wiphy, regdom);
9933 if (err < 0) {
9934 reg_idx--;
9935 break;
9936 }
9937 }
9938
9939 cb->args[2] = reg_idx;
9940 err = skb->len;
9941 out_err:
9942 rcu_read_unlock();
9943 return err;
9944 }
9945
9946 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
9947 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
9948 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
9949 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
9950 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
9951 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
9952 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
9953 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
9954 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
9955 };
9956
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)9957 static int parse_reg_rule(struct nlattr *tb[],
9958 struct ieee80211_reg_rule *reg_rule)
9959 {
9960 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
9961 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
9962
9963 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
9964 return -EINVAL;
9965 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
9966 return -EINVAL;
9967 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
9968 return -EINVAL;
9969 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
9970 return -EINVAL;
9971 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
9972 return -EINVAL;
9973
9974 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
9975
9976 freq_range->start_freq_khz =
9977 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
9978 freq_range->end_freq_khz =
9979 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
9980 freq_range->max_bandwidth_khz =
9981 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
9982
9983 power_rule->max_eirp =
9984 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
9985
9986 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
9987 power_rule->max_antenna_gain =
9988 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
9989
9990 if (tb[NL80211_ATTR_DFS_CAC_TIME])
9991 reg_rule->dfs_cac_ms =
9992 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
9993
9994 return 0;
9995 }
9996
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)9997 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
9998 {
9999 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
10000 struct nlattr *nl_reg_rule;
10001 char *alpha2;
10002 int rem_reg_rules, r;
10003 u32 num_rules = 0, rule_idx = 0;
10004 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
10005 struct ieee80211_regdomain *rd;
10006
10007 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
10008 return -EINVAL;
10009
10010 if (!info->attrs[NL80211_ATTR_REG_RULES])
10011 return -EINVAL;
10012
10013 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
10014
10015 if (info->attrs[NL80211_ATTR_DFS_REGION])
10016 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
10017
10018 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10019 rem_reg_rules) {
10020 num_rules++;
10021 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
10022 return -EINVAL;
10023 }
10024
10025 rtnl_lock();
10026 if (!reg_is_valid_request(alpha2)) {
10027 r = -EINVAL;
10028 goto out;
10029 }
10030
10031 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
10032 if (!rd) {
10033 r = -ENOMEM;
10034 goto out;
10035 }
10036
10037 rd->n_reg_rules = num_rules;
10038 rd->alpha2[0] = alpha2[0];
10039 rd->alpha2[1] = alpha2[1];
10040
10041 /*
10042 * Disable DFS master mode if the DFS region was
10043 * not supported or known on this kernel.
10044 */
10045 if (reg_supported_dfs_region(dfs_region))
10046 rd->dfs_region = dfs_region;
10047
10048 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10049 rem_reg_rules) {
10050 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
10051 nl_reg_rule, reg_rule_policy,
10052 info->extack);
10053 if (r)
10054 goto bad_reg;
10055 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
10056 if (r)
10057 goto bad_reg;
10058
10059 rule_idx++;
10060
10061 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
10062 r = -EINVAL;
10063 goto bad_reg;
10064 }
10065 }
10066
10067 r = set_regdom(rd, REGD_SOURCE_CRDA);
10068 /* set_regdom takes ownership of rd */
10069 rd = NULL;
10070 bad_reg:
10071 kfree(rd);
10072 out:
10073 rtnl_unlock();
10074 return r;
10075 }
10076 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
10077
validate_scan_freqs(struct nlattr * freqs)10078 static int validate_scan_freqs(struct nlattr *freqs)
10079 {
10080 struct nlattr *attr1, *attr2;
10081 int n_channels = 0, tmp1, tmp2;
10082
10083 nla_for_each_nested(attr1, freqs, tmp1)
10084 if (nla_len(attr1) != sizeof(u32))
10085 return 0;
10086
10087 nla_for_each_nested(attr1, freqs, tmp1) {
10088 n_channels++;
10089 /*
10090 * Some hardware has a limited channel list for
10091 * scanning, and it is pretty much nonsensical
10092 * to scan for a channel twice, so disallow that
10093 * and don't require drivers to check that the
10094 * channel list they get isn't longer than what
10095 * they can scan, as long as they can scan all
10096 * the channels they registered at once.
10097 */
10098 nla_for_each_nested(attr2, freqs, tmp2)
10099 if (attr1 != attr2 &&
10100 nla_get_u32(attr1) == nla_get_u32(attr2))
10101 return 0;
10102 }
10103
10104 return n_channels;
10105 }
10106
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)10107 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
10108 {
10109 return b < NUM_NL80211_BANDS && wiphy->bands[b];
10110 }
10111
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)10112 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
10113 struct cfg80211_bss_selection *bss_select)
10114 {
10115 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
10116 struct nlattr *nest;
10117 int err;
10118 bool found = false;
10119 int i;
10120
10121 /* only process one nested attribute */
10122 nest = nla_data(nla);
10123 if (!nla_ok(nest, nla_len(nest)))
10124 return -EINVAL;
10125
10126 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
10127 nest, nl80211_bss_select_policy,
10128 NULL);
10129 if (err)
10130 return err;
10131
10132 /* only one attribute may be given */
10133 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
10134 if (attr[i]) {
10135 if (found)
10136 return -EINVAL;
10137 found = true;
10138 }
10139 }
10140
10141 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
10142
10143 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
10144 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
10145
10146 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
10147 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
10148 bss_select->param.band_pref =
10149 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
10150 if (!is_band_valid(wiphy, bss_select->param.band_pref))
10151 return -EINVAL;
10152 }
10153
10154 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
10155 struct nl80211_bss_select_rssi_adjust *adj_param;
10156
10157 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
10158 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
10159 bss_select->param.adjust.band = adj_param->band;
10160 bss_select->param.adjust.delta = adj_param->delta;
10161 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
10162 return -EINVAL;
10163 }
10164
10165 /* user-space did not provide behaviour attribute */
10166 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
10167 return -EINVAL;
10168
10169 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
10170 return -EINVAL;
10171
10172 return 0;
10173 }
10174
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)10175 int nl80211_parse_random_mac(struct nlattr **attrs,
10176 u8 *mac_addr, u8 *mac_addr_mask)
10177 {
10178 int i;
10179
10180 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
10181 eth_zero_addr(mac_addr);
10182 eth_zero_addr(mac_addr_mask);
10183 mac_addr[0] = 0x2;
10184 mac_addr_mask[0] = 0x3;
10185
10186 return 0;
10187 }
10188
10189 /* need both or none */
10190 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
10191 return -EINVAL;
10192
10193 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
10194 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
10195
10196 /* don't allow or configure an mcast address */
10197 if (!is_multicast_ether_addr(mac_addr_mask) ||
10198 is_multicast_ether_addr(mac_addr))
10199 return -EINVAL;
10200
10201 /*
10202 * allow users to pass a MAC address that has bits set outside
10203 * of the mask, but don't bother drivers with having to deal
10204 * with such bits
10205 */
10206 for (i = 0; i < ETH_ALEN; i++)
10207 mac_addr[i] &= mac_addr_mask[i];
10208
10209 return 0;
10210 }
10211
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)10212 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
10213 struct ieee80211_channel *chan)
10214 {
10215 unsigned int link_id;
10216 bool all_ok = true;
10217 int radio_idx;
10218
10219 lockdep_assert_wiphy(wdev->wiphy);
10220
10221 if (!cfg80211_wdev_channel_allowed(wdev, chan))
10222 return false;
10223
10224 if (!cfg80211_beaconing_iface_active(wdev))
10225 return true;
10226
10227 radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy, chan);
10228
10229 /*
10230 * FIXME: check if we have a free radio/link for chan
10231 *
10232 * This, as well as the FIXME below, requires knowing the link
10233 * capabilities of the hardware.
10234 */
10235
10236 /* we cannot leave radar channels */
10237 for_each_valid_link(wdev, link_id) {
10238 struct cfg80211_chan_def *chandef;
10239 int link_radio_idx;
10240
10241 chandef = wdev_chandef(wdev, link_id);
10242 if (!chandef || !chandef->chan)
10243 continue;
10244
10245 if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
10246 continue;
10247
10248 /*
10249 * chandef->chan is a radar channel. If the radio/link onto
10250 * which this radar channel falls is the same radio/link onto
10251 * which the input 'chan' falls, off-channel operation should
10252 * not be allowed. Hence, set 'all_ok' to false.
10253 */
10254
10255 link_radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy,
10256 chandef->chan);
10257 if (link_radio_idx == radio_idx) {
10258 all_ok = false;
10259 break;
10260 }
10261 }
10262
10263 if (all_ok)
10264 return true;
10265
10266 return regulatory_pre_cac_allowed(wdev->wiphy);
10267 }
10268
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)10269 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
10270 enum nl80211_ext_feature_index feat)
10271 {
10272 if (!(flags & flag))
10273 return true;
10274 if (wiphy_ext_feature_isset(wiphy, feat))
10275 return true;
10276 return false;
10277 }
10278
10279 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask,u32 * flags,enum nl80211_feature_flags randomness_flag)10280 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
10281 struct nlattr **attrs, u8 *mac_addr, u8 *mac_addr_mask,
10282 u32 *flags, enum nl80211_feature_flags randomness_flag)
10283 {
10284 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
10285 return 0;
10286
10287 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
10288
10289 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
10290 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
10291 !nl80211_check_scan_feat(wiphy, *flags,
10292 NL80211_SCAN_FLAG_LOW_SPAN,
10293 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
10294 !nl80211_check_scan_feat(wiphy, *flags,
10295 NL80211_SCAN_FLAG_LOW_POWER,
10296 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
10297 !nl80211_check_scan_feat(wiphy, *flags,
10298 NL80211_SCAN_FLAG_HIGH_ACCURACY,
10299 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
10300 !nl80211_check_scan_feat(wiphy, *flags,
10301 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
10302 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
10303 !nl80211_check_scan_feat(wiphy, *flags,
10304 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
10305 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
10306 !nl80211_check_scan_feat(wiphy, *flags,
10307 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
10308 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
10309 !nl80211_check_scan_feat(wiphy, *flags,
10310 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
10311 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
10312 !nl80211_check_scan_feat(wiphy, *flags,
10313 NL80211_SCAN_FLAG_RANDOM_SN,
10314 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
10315 !nl80211_check_scan_feat(wiphy, *flags,
10316 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
10317 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
10318 return -EOPNOTSUPP;
10319
10320 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
10321 int err;
10322
10323 if (!(wiphy->features & randomness_flag) ||
10324 (wdev && wdev->connected))
10325 return -EOPNOTSUPP;
10326
10327 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
10328 if (err)
10329 return err;
10330 }
10331
10332 return 0;
10333 }
10334
10335 static int
nl80211_check_scan_flags_sched(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_sched_scan_request * req)10336 nl80211_check_scan_flags_sched(struct wiphy *wiphy, struct wireless_dev *wdev,
10337 struct nlattr **attrs,
10338 struct cfg80211_sched_scan_request *req)
10339 {
10340 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10341 req->mac_addr, req->mac_addr_mask,
10342 &req->flags,
10343 wdev ? NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
10344 NL80211_FEATURE_ND_RANDOM_MAC_ADDR);
10345 }
10346
10347 static int
nl80211_check_scan_flags_reg(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,struct cfg80211_scan_request_int * req)10348 nl80211_check_scan_flags_reg(struct wiphy *wiphy, struct wireless_dev *wdev,
10349 struct nlattr **attrs,
10350 struct cfg80211_scan_request_int *req)
10351 {
10352 return nl80211_check_scan_flags(wiphy, wdev, attrs,
10353 req->req.mac_addr,
10354 req->req.mac_addr_mask,
10355 &req->req.flags,
10356 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR);
10357 }
10358
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)10359 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
10360 {
10361 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10362 struct wireless_dev *wdev = info->user_ptr[1];
10363 struct cfg80211_scan_request_int *request;
10364 struct nlattr *scan_freqs = NULL;
10365 bool scan_freqs_khz = false;
10366 struct nlattr *attr;
10367 struct wiphy *wiphy;
10368 int err, tmp, n_ssids = 0, n_channels, i;
10369 size_t ie_len, size;
10370 size_t ssids_offset, ie_offset;
10371
10372 wiphy = &rdev->wiphy;
10373
10374 if (wdev->iftype == NL80211_IFTYPE_NAN)
10375 return -EOPNOTSUPP;
10376
10377 if (!rdev->ops->scan)
10378 return -EOPNOTSUPP;
10379
10380 if (rdev->scan_req || rdev->scan_msg)
10381 return -EBUSY;
10382
10383 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
10384 if (!wiphy_ext_feature_isset(wiphy,
10385 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
10386 return -EOPNOTSUPP;
10387 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
10388 scan_freqs_khz = true;
10389 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
10390 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
10391
10392 if (scan_freqs) {
10393 n_channels = validate_scan_freqs(scan_freqs);
10394 if (!n_channels)
10395 return -EINVAL;
10396 } else {
10397 n_channels = ieee80211_get_num_supported_channels(wiphy);
10398 }
10399
10400 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
10401 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
10402 n_ssids++;
10403
10404 if (n_ssids > wiphy->max_scan_ssids)
10405 return -EINVAL;
10406
10407 if (info->attrs[NL80211_ATTR_IE])
10408 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10409 else
10410 ie_len = 0;
10411
10412 if (ie_len > wiphy->max_scan_ie_len)
10413 return -EINVAL;
10414
10415 size = struct_size(request, req.channels, n_channels);
10416 ssids_offset = size;
10417 size = size_add(size, array_size(sizeof(*request->req.ssids), n_ssids));
10418 ie_offset = size;
10419 size = size_add(size, ie_len);
10420 request = kzalloc(size, GFP_KERNEL);
10421 if (!request)
10422 return -ENOMEM;
10423
10424 if (n_ssids)
10425 request->req.ssids = (void *)request + ssids_offset;
10426 request->req.n_ssids = n_ssids;
10427 if (ie_len)
10428 request->req.ie = (void *)request + ie_offset;
10429
10430 i = 0;
10431 if (scan_freqs) {
10432 /* user specified, bail out if channel not found */
10433 nla_for_each_nested(attr, scan_freqs, tmp) {
10434 struct ieee80211_channel *chan;
10435 int freq = nla_get_u32(attr);
10436
10437 if (!scan_freqs_khz)
10438 freq = MHZ_TO_KHZ(freq);
10439
10440 chan = ieee80211_get_channel_khz(wiphy, freq);
10441 if (!chan) {
10442 err = -EINVAL;
10443 goto out_free;
10444 }
10445
10446 /* Ignore disabled / no primary channels */
10447 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10448 chan->flags & IEEE80211_CHAN_S1G_NO_PRIMARY ||
10449 !cfg80211_wdev_channel_allowed(wdev, chan))
10450 continue;
10451
10452 request->req.channels[i] = chan;
10453 i++;
10454 }
10455 } else {
10456 enum nl80211_band band;
10457
10458 /* all channels */
10459 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10460 int j;
10461
10462 if (!wiphy->bands[band])
10463 continue;
10464 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10465 struct ieee80211_channel *chan;
10466
10467 chan = &wiphy->bands[band]->channels[j];
10468
10469 if (chan->flags & IEEE80211_CHAN_DISABLED ||
10470 chan->flags &
10471 IEEE80211_CHAN_S1G_NO_PRIMARY ||
10472 !cfg80211_wdev_channel_allowed(wdev, chan))
10473 continue;
10474
10475 request->req.channels[i] = chan;
10476 i++;
10477 }
10478 }
10479 }
10480
10481 if (!i) {
10482 err = -EINVAL;
10483 goto out_free;
10484 }
10485
10486 request->req.n_channels = i;
10487
10488 for (i = 0; i < request->req.n_channels; i++) {
10489 struct ieee80211_channel *chan = request->req.channels[i];
10490
10491 /* if we can go off-channel to the target channel we're good */
10492 if (cfg80211_off_channel_oper_allowed(wdev, chan))
10493 continue;
10494
10495 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
10496 err = -EBUSY;
10497 goto out_free;
10498 }
10499 }
10500
10501 i = 0;
10502 if (n_ssids) {
10503 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
10504 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10505 err = -EINVAL;
10506 goto out_free;
10507 }
10508 request->req.ssids[i].ssid_len = nla_len(attr);
10509 memcpy(request->req.ssids[i].ssid,
10510 nla_data(attr), nla_len(attr));
10511 i++;
10512 }
10513 }
10514
10515 if (info->attrs[NL80211_ATTR_IE]) {
10516 request->req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10517 memcpy((void *)request->req.ie,
10518 nla_data(info->attrs[NL80211_ATTR_IE]),
10519 request->req.ie_len);
10520 }
10521
10522 for (i = 0; i < NUM_NL80211_BANDS; i++)
10523 if (wiphy->bands[i])
10524 request->req.rates[i] =
10525 (1 << wiphy->bands[i]->n_bitrates) - 1;
10526
10527 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
10528 nla_for_each_nested(attr,
10529 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
10530 tmp) {
10531 enum nl80211_band band = nla_type(attr);
10532
10533 if (band < 0 || band >= NUM_NL80211_BANDS) {
10534 err = -EINVAL;
10535 goto out_free;
10536 }
10537
10538 if (!wiphy->bands[band])
10539 continue;
10540
10541 err = ieee80211_get_ratemask(wiphy->bands[band],
10542 nla_data(attr),
10543 nla_len(attr),
10544 &request->req.rates[band]);
10545 if (err)
10546 goto out_free;
10547 }
10548 }
10549
10550 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
10551 request->req.duration =
10552 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
10553 request->req.duration_mandatory =
10554 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
10555 }
10556
10557 err = nl80211_check_scan_flags_reg(wiphy, wdev, info->attrs, request);
10558 if (err)
10559 goto out_free;
10560
10561 request->req.no_cck =
10562 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10563
10564 /* Initial implementation used NL80211_ATTR_MAC to set the specific
10565 * BSSID to scan for. This was problematic because that same attribute
10566 * was already used for another purpose (local random MAC address). The
10567 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
10568 * compatibility with older userspace components, also use the
10569 * NL80211_ATTR_MAC value here if it can be determined to be used for
10570 * the specific BSSID use case instead of the random MAC address
10571 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
10572 */
10573 if (info->attrs[NL80211_ATTR_BSSID])
10574 memcpy(request->req.bssid,
10575 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
10576 else if (!(request->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
10577 info->attrs[NL80211_ATTR_MAC])
10578 memcpy(request->req.bssid,
10579 nla_data(info->attrs[NL80211_ATTR_MAC]),
10580 ETH_ALEN);
10581 else
10582 eth_broadcast_addr(request->req.bssid);
10583
10584 request->req.tsf_report_link_id =
10585 nl80211_link_id_or_invalid(info->attrs);
10586 request->req.wdev = wdev;
10587 request->req.wiphy = &rdev->wiphy;
10588 request->req.scan_start = jiffies;
10589
10590 rdev->scan_req = request;
10591 err = cfg80211_scan(rdev);
10592
10593 if (err)
10594 goto out_free;
10595
10596 nl80211_send_scan_start(rdev, wdev);
10597 dev_hold(wdev->netdev);
10598
10599 return 0;
10600
10601 out_free:
10602 rdev->scan_req = NULL;
10603 kfree(request);
10604
10605 return err;
10606 }
10607
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)10608 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
10609 {
10610 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10611 struct wireless_dev *wdev = info->user_ptr[1];
10612
10613 if (!rdev->ops->abort_scan)
10614 return -EOPNOTSUPP;
10615
10616 if (rdev->scan_msg)
10617 return 0;
10618
10619 if (!rdev->scan_req)
10620 return -ENOENT;
10621
10622 rdev_abort_scan(rdev, wdev);
10623 return 0;
10624 }
10625
10626 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)10627 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
10628 struct cfg80211_sched_scan_request *request,
10629 struct nlattr **attrs)
10630 {
10631 int tmp, err, i = 0;
10632 struct nlattr *attr;
10633
10634 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10635 u32 interval;
10636
10637 /*
10638 * If scan plans are not specified,
10639 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
10640 * case one scan plan will be set with the specified scan
10641 * interval and infinite number of iterations.
10642 */
10643 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
10644 if (!interval)
10645 return -EINVAL;
10646
10647 request->scan_plans[0].interval =
10648 DIV_ROUND_UP(interval, MSEC_PER_SEC);
10649 if (!request->scan_plans[0].interval)
10650 return -EINVAL;
10651
10652 if (request->scan_plans[0].interval >
10653 wiphy->max_sched_scan_plan_interval)
10654 request->scan_plans[0].interval =
10655 wiphy->max_sched_scan_plan_interval;
10656
10657 return 0;
10658 }
10659
10660 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
10661 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
10662
10663 if (WARN_ON(i >= n_plans))
10664 return -EINVAL;
10665
10666 err = nla_parse_nested_deprecated(plan,
10667 NL80211_SCHED_SCAN_PLAN_MAX,
10668 attr, nl80211_plan_policy,
10669 NULL);
10670 if (err)
10671 return err;
10672
10673 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
10674 return -EINVAL;
10675
10676 request->scan_plans[i].interval =
10677 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
10678 if (!request->scan_plans[i].interval ||
10679 request->scan_plans[i].interval >
10680 wiphy->max_sched_scan_plan_interval)
10681 return -EINVAL;
10682
10683 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
10684 request->scan_plans[i].iterations =
10685 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
10686 if (!request->scan_plans[i].iterations ||
10687 (request->scan_plans[i].iterations >
10688 wiphy->max_sched_scan_plan_iterations))
10689 return -EINVAL;
10690 } else if (i < n_plans - 1) {
10691 /*
10692 * All scan plans but the last one must specify
10693 * a finite number of iterations
10694 */
10695 return -EINVAL;
10696 }
10697
10698 i++;
10699 }
10700
10701 /*
10702 * The last scan plan must not specify the number of
10703 * iterations, it is supposed to run infinitely
10704 */
10705 if (request->scan_plans[n_plans - 1].iterations)
10706 return -EINVAL;
10707
10708 return 0;
10709 }
10710
10711 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)10712 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
10713 struct nlattr **attrs, int max_match_sets)
10714 {
10715 struct cfg80211_sched_scan_request *request;
10716 struct nlattr *attr;
10717 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
10718 enum nl80211_band band;
10719 size_t ie_len, size;
10720 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
10721 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
10722
10723 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10724 n_channels = validate_scan_freqs(
10725 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
10726 if (!n_channels)
10727 return ERR_PTR(-EINVAL);
10728 } else {
10729 n_channels = ieee80211_get_num_supported_channels(wiphy);
10730 }
10731
10732 if (attrs[NL80211_ATTR_SCAN_SSIDS])
10733 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10734 tmp)
10735 n_ssids++;
10736
10737 if (n_ssids > wiphy->max_sched_scan_ssids)
10738 return ERR_PTR(-EINVAL);
10739
10740 /*
10741 * First, count the number of 'real' matchsets. Due to an issue with
10742 * the old implementation, matchsets containing only the RSSI attribute
10743 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
10744 * RSSI for all matchsets, rather than their own matchset for reporting
10745 * all APs with a strong RSSI. This is needed to be compatible with
10746 * older userspace that treated a matchset with only the RSSI as the
10747 * global RSSI for all other matchsets - if there are other matchsets.
10748 */
10749 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10750 nla_for_each_nested(attr,
10751 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10752 tmp) {
10753 struct nlattr *rssi;
10754
10755 err = nla_parse_nested_deprecated(tb,
10756 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10757 attr,
10758 nl80211_match_policy,
10759 NULL);
10760 if (err)
10761 return ERR_PTR(err);
10762
10763 /* SSID and BSSID are mutually exclusive */
10764 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
10765 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
10766 return ERR_PTR(-EINVAL);
10767
10768 /* add other standalone attributes here */
10769 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
10770 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
10771 n_match_sets++;
10772 continue;
10773 }
10774 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10775 if (rssi)
10776 default_match_rssi = nla_get_s32(rssi);
10777 }
10778 }
10779
10780 /* However, if there's no other matchset, add the RSSI one */
10781 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
10782 n_match_sets = 1;
10783
10784 if (n_match_sets > max_match_sets)
10785 return ERR_PTR(-EINVAL);
10786
10787 if (attrs[NL80211_ATTR_IE])
10788 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
10789 else
10790 ie_len = 0;
10791
10792 if (ie_len > wiphy->max_sched_scan_ie_len)
10793 return ERR_PTR(-EINVAL);
10794
10795 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10796 /*
10797 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
10798 * each scan plan already specifies its own interval
10799 */
10800 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10801 return ERR_PTR(-EINVAL);
10802
10803 nla_for_each_nested(attr,
10804 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
10805 n_plans++;
10806 } else {
10807 /*
10808 * The scan interval attribute is kept for backward
10809 * compatibility. If no scan plans are specified and sched scan
10810 * interval is specified, one scan plan will be set with this
10811 * scan interval and infinite number of iterations.
10812 */
10813 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10814 return ERR_PTR(-EINVAL);
10815
10816 n_plans = 1;
10817 }
10818
10819 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
10820 return ERR_PTR(-EINVAL);
10821
10822 if (!wiphy_ext_feature_isset(
10823 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
10824 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
10825 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
10826 return ERR_PTR(-EINVAL);
10827
10828 size = struct_size(request, channels, n_channels);
10829 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
10830 size = size_add(size, array_size(sizeof(*request->match_sets),
10831 n_match_sets));
10832 size = size_add(size, array_size(sizeof(*request->scan_plans),
10833 n_plans));
10834 size = size_add(size, ie_len);
10835 request = kzalloc(size, GFP_KERNEL);
10836 if (!request)
10837 return ERR_PTR(-ENOMEM);
10838 request->n_channels = n_channels;
10839
10840 if (n_ssids)
10841 request->ssids = (void *)request +
10842 struct_size(request, channels, n_channels);
10843 request->n_ssids = n_ssids;
10844 if (ie_len) {
10845 if (n_ssids)
10846 request->ie = (void *)(request->ssids + n_ssids);
10847 else
10848 request->ie = (void *)(request->channels + n_channels);
10849 }
10850
10851 if (n_match_sets) {
10852 if (request->ie)
10853 request->match_sets = (void *)(request->ie + ie_len);
10854 else if (n_ssids)
10855 request->match_sets =
10856 (void *)(request->ssids + n_ssids);
10857 else
10858 request->match_sets =
10859 (void *)(request->channels + n_channels);
10860 }
10861 request->n_match_sets = n_match_sets;
10862
10863 if (n_match_sets)
10864 request->scan_plans = (void *)(request->match_sets +
10865 n_match_sets);
10866 else if (request->ie)
10867 request->scan_plans = (void *)(request->ie + ie_len);
10868 else if (n_ssids)
10869 request->scan_plans = (void *)(request->ssids + n_ssids);
10870 else
10871 request->scan_plans = (void *)(request->channels + n_channels);
10872
10873 request->n_scan_plans = n_plans;
10874
10875 i = 0;
10876 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10877 /* user specified, bail out if channel not found */
10878 nla_for_each_nested(attr,
10879 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
10880 tmp) {
10881 struct ieee80211_channel *chan;
10882
10883 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
10884
10885 if (!chan) {
10886 err = -EINVAL;
10887 goto out_free;
10888 }
10889
10890 /* ignore disabled channels */
10891 if (chan->flags & IEEE80211_CHAN_DISABLED)
10892 continue;
10893
10894 request->channels[i] = chan;
10895 i++;
10896 }
10897 } else {
10898 /* all channels */
10899 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10900 int j;
10901
10902 if (!wiphy->bands[band])
10903 continue;
10904 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10905 struct ieee80211_channel *chan;
10906
10907 chan = &wiphy->bands[band]->channels[j];
10908
10909 if (chan->flags & IEEE80211_CHAN_DISABLED)
10910 continue;
10911
10912 request->channels[i] = chan;
10913 i++;
10914 }
10915 }
10916 }
10917
10918 if (!i) {
10919 err = -EINVAL;
10920 goto out_free;
10921 }
10922
10923 request->n_channels = i;
10924
10925 i = 0;
10926 if (n_ssids) {
10927 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10928 tmp) {
10929 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10930 err = -EINVAL;
10931 goto out_free;
10932 }
10933 request->ssids[i].ssid_len = nla_len(attr);
10934 memcpy(request->ssids[i].ssid, nla_data(attr),
10935 nla_len(attr));
10936 i++;
10937 }
10938 }
10939
10940 i = 0;
10941 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10942 nla_for_each_nested(attr,
10943 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10944 tmp) {
10945 struct nlattr *ssid, *bssid, *rssi;
10946
10947 err = nla_parse_nested_deprecated(tb,
10948 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10949 attr,
10950 nl80211_match_policy,
10951 NULL);
10952 if (err)
10953 goto out_free;
10954 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
10955 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
10956
10957 if (!ssid && !bssid) {
10958 i++;
10959 continue;
10960 }
10961
10962 if (WARN_ON(i >= n_match_sets)) {
10963 /* this indicates a programming error,
10964 * the loop above should have verified
10965 * things properly
10966 */
10967 err = -EINVAL;
10968 goto out_free;
10969 }
10970
10971 if (ssid) {
10972 memcpy(request->match_sets[i].ssid.ssid,
10973 nla_data(ssid), nla_len(ssid));
10974 request->match_sets[i].ssid.ssid_len =
10975 nla_len(ssid);
10976 }
10977 if (bssid)
10978 memcpy(request->match_sets[i].bssid,
10979 nla_data(bssid), ETH_ALEN);
10980
10981 /* special attribute - old implementation w/a */
10982 request->match_sets[i].rssi_thold = default_match_rssi;
10983 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10984 if (rssi)
10985 request->match_sets[i].rssi_thold =
10986 nla_get_s32(rssi);
10987 i++;
10988 }
10989
10990 /* there was no other matchset, so the RSSI one is alone */
10991 if (i == 0 && n_match_sets)
10992 request->match_sets[0].rssi_thold = default_match_rssi;
10993
10994 request->min_rssi_thold = INT_MAX;
10995 for (i = 0; i < n_match_sets; i++)
10996 request->min_rssi_thold =
10997 min(request->match_sets[i].rssi_thold,
10998 request->min_rssi_thold);
10999 } else {
11000 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
11001 }
11002
11003 if (ie_len) {
11004 request->ie_len = ie_len;
11005 memcpy((void *)request->ie,
11006 nla_data(attrs[NL80211_ATTR_IE]),
11007 request->ie_len);
11008 }
11009
11010 err = nl80211_check_scan_flags_sched(wiphy, wdev, attrs, request);
11011 if (err)
11012 goto out_free;
11013
11014 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
11015 request->delay =
11016 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
11017
11018 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
11019 request->relative_rssi = nla_get_s8(
11020 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
11021 request->relative_rssi_set = true;
11022 }
11023
11024 if (request->relative_rssi_set &&
11025 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
11026 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
11027
11028 rssi_adjust = nla_data(
11029 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
11030 request->rssi_adjust.band = rssi_adjust->band;
11031 request->rssi_adjust.delta = rssi_adjust->delta;
11032 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
11033 err = -EINVAL;
11034 goto out_free;
11035 }
11036 }
11037
11038 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
11039 if (err)
11040 goto out_free;
11041
11042 request->scan_start = jiffies;
11043
11044 return request;
11045
11046 out_free:
11047 kfree(request);
11048 return ERR_PTR(err);
11049 }
11050
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)11051 static int nl80211_start_sched_scan(struct sk_buff *skb,
11052 struct genl_info *info)
11053 {
11054 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11055 struct net_device *dev = info->user_ptr[1];
11056 struct wireless_dev *wdev = dev->ieee80211_ptr;
11057 struct cfg80211_sched_scan_request *sched_scan_req;
11058 bool want_multi;
11059 int err;
11060
11061 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
11062 return -EOPNOTSUPP;
11063
11064 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
11065 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
11066 if (err)
11067 return err;
11068
11069 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
11070 info->attrs,
11071 rdev->wiphy.max_match_sets);
11072
11073 err = PTR_ERR_OR_ZERO(sched_scan_req);
11074 if (err)
11075 goto out_err;
11076
11077 /* leave request id zero for legacy request
11078 * or if driver does not support multi-scheduled scan
11079 */
11080 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
11081 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
11082
11083 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
11084 if (err)
11085 goto out_free;
11086
11087 sched_scan_req->dev = dev;
11088 sched_scan_req->wiphy = &rdev->wiphy;
11089
11090 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11091 sched_scan_req->owner_nlportid = info->snd_portid;
11092
11093 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
11094
11095 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
11096 return 0;
11097
11098 out_free:
11099 kfree(sched_scan_req);
11100 out_err:
11101 return err;
11102 }
11103
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)11104 static int nl80211_stop_sched_scan(struct sk_buff *skb,
11105 struct genl_info *info)
11106 {
11107 struct cfg80211_sched_scan_request *req;
11108 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11109 u64 cookie;
11110
11111 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
11112 return -EOPNOTSUPP;
11113
11114 if (info->attrs[NL80211_ATTR_COOKIE]) {
11115 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11116 return __cfg80211_stop_sched_scan(rdev, cookie, false);
11117 }
11118
11119 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
11120 struct cfg80211_sched_scan_request,
11121 list);
11122 if (!req || req->reqid ||
11123 (req->owner_nlportid &&
11124 req->owner_nlportid != info->snd_portid))
11125 return -ENOENT;
11126
11127 return cfg80211_stop_sched_scan_req(rdev, req, false);
11128 }
11129
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)11130 static int nl80211_start_radar_detection(struct sk_buff *skb,
11131 struct genl_info *info)
11132 {
11133 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11134 struct net_device *dev = info->user_ptr[1];
11135 struct wireless_dev *wdev = dev->ieee80211_ptr;
11136 int link_id = nl80211_link_id(info->attrs);
11137 struct wiphy *wiphy = wdev->wiphy;
11138 struct cfg80211_chan_def chandef;
11139 enum nl80211_dfs_regions dfs_region;
11140 unsigned int cac_time_ms;
11141 int err;
11142
11143 flush_delayed_work(&rdev->dfs_update_channels_wk);
11144
11145 switch (wdev->iftype) {
11146 case NL80211_IFTYPE_AP:
11147 case NL80211_IFTYPE_P2P_GO:
11148 case NL80211_IFTYPE_MESH_POINT:
11149 case NL80211_IFTYPE_ADHOC:
11150 break;
11151 default:
11152 /* caution - see cfg80211_beaconing_iface_active() below */
11153 return -EINVAL;
11154 }
11155
11156 guard(wiphy)(wiphy);
11157
11158 dfs_region = reg_get_dfs_region(wiphy);
11159 if (dfs_region == NL80211_DFS_UNSET)
11160 return -EINVAL;
11161
11162 err = nl80211_parse_chandef(rdev, info, &chandef);
11163 if (err)
11164 return err;
11165
11166 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11167 if (err < 0)
11168 return err;
11169
11170 if (err == 0)
11171 return -EINVAL;
11172
11173 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
11174 return -EINVAL;
11175
11176 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
11177 return cfg80211_start_background_radar_detection(rdev, wdev,
11178 &chandef);
11179
11180 if (cfg80211_beaconing_iface_active(wdev)) {
11181 /* During MLO other link(s) can beacon, only the current link
11182 * can not already beacon
11183 */
11184 if (wdev->valid_links &&
11185 !wdev->links[link_id].ap.beacon_interval) {
11186 /* nothing */
11187 } else {
11188 return -EBUSY;
11189 }
11190 }
11191
11192 if (wdev->links[link_id].cac_started)
11193 return -EBUSY;
11194
11195 /* CAC start is offloaded to HW and can't be started manually */
11196 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
11197 return -EOPNOTSUPP;
11198
11199 if (!rdev->ops->start_radar_detection)
11200 return -EOPNOTSUPP;
11201
11202 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
11203 if (WARN_ON(!cac_time_ms))
11204 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
11205
11206 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
11207 link_id);
11208 if (err)
11209 return err;
11210
11211 switch (wdev->iftype) {
11212 case NL80211_IFTYPE_AP:
11213 case NL80211_IFTYPE_P2P_GO:
11214 wdev->links[link_id].ap.chandef = chandef;
11215 break;
11216 case NL80211_IFTYPE_ADHOC:
11217 wdev->u.ibss.chandef = chandef;
11218 break;
11219 case NL80211_IFTYPE_MESH_POINT:
11220 wdev->u.mesh.chandef = chandef;
11221 break;
11222 default:
11223 break;
11224 }
11225 wdev->links[link_id].cac_started = true;
11226 wdev->links[link_id].cac_start_time = jiffies;
11227 wdev->links[link_id].cac_time_ms = cac_time_ms;
11228
11229 return 0;
11230 }
11231
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)11232 static int nl80211_notify_radar_detection(struct sk_buff *skb,
11233 struct genl_info *info)
11234 {
11235 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11236 struct net_device *dev = info->user_ptr[1];
11237 struct wireless_dev *wdev = dev->ieee80211_ptr;
11238 struct wiphy *wiphy = wdev->wiphy;
11239 struct cfg80211_chan_def chandef;
11240 enum nl80211_dfs_regions dfs_region;
11241 int err;
11242
11243 dfs_region = reg_get_dfs_region(wiphy);
11244 if (dfs_region == NL80211_DFS_UNSET) {
11245 GENL_SET_ERR_MSG(info,
11246 "DFS Region is not set. Unexpected Radar indication");
11247 return -EINVAL;
11248 }
11249
11250 err = nl80211_parse_chandef(rdev, info, &chandef);
11251 if (err) {
11252 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
11253 return err;
11254 }
11255
11256 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11257 if (err < 0) {
11258 GENL_SET_ERR_MSG(info, "chandef is invalid");
11259 return err;
11260 }
11261
11262 if (err == 0) {
11263 GENL_SET_ERR_MSG(info,
11264 "Unexpected Radar indication for chandef/iftype");
11265 return -EINVAL;
11266 }
11267
11268 /* Do not process this notification if radar is already detected
11269 * by kernel on this channel, and return success.
11270 */
11271 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
11272 return 0;
11273
11274 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
11275
11276 cfg80211_sched_dfs_chan_update(rdev);
11277
11278 rdev->radar_chandef = chandef;
11279
11280 /* Propagate this notification to other radios as well */
11281 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
11282
11283 return 0;
11284 }
11285
nl80211_parse_counter_offsets(struct cfg80211_registered_device * rdev,const u8 * data,size_t datalen,int first_count,struct nlattr * attr,const u16 ** offsets,unsigned int * n_offsets)11286 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
11287 const u8 *data, size_t datalen,
11288 int first_count, struct nlattr *attr,
11289 const u16 **offsets, unsigned int *n_offsets)
11290 {
11291 int i;
11292
11293 *n_offsets = 0;
11294
11295 if (!attr)
11296 return 0;
11297
11298 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
11299 return -EINVAL;
11300
11301 *n_offsets = nla_len(attr) / sizeof(u16);
11302 if (rdev->wiphy.max_num_csa_counters &&
11303 (*n_offsets > rdev->wiphy.max_num_csa_counters))
11304 return -EINVAL;
11305
11306 *offsets = nla_data(attr);
11307
11308 /* sanity checks - counters should fit and be the same */
11309 for (i = 0; i < *n_offsets; i++) {
11310 u16 offset = (*offsets)[i];
11311
11312 if (offset >= datalen)
11313 return -EINVAL;
11314
11315 if (first_count != -1 && data[offset] != first_count)
11316 return -EINVAL;
11317 }
11318
11319 return 0;
11320 }
11321
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)11322 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
11323 {
11324 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11325 unsigned int link_id = nl80211_link_id(info->attrs);
11326 struct net_device *dev = info->user_ptr[1];
11327 struct wireless_dev *wdev = dev->ieee80211_ptr;
11328 struct cfg80211_csa_settings params;
11329 struct nlattr **csa_attrs = NULL;
11330 int err;
11331 bool need_new_beacon = false;
11332 bool need_handle_dfs_flag = true;
11333 u32 cs_count;
11334
11335 if (!rdev->ops->channel_switch ||
11336 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
11337 return -EOPNOTSUPP;
11338
11339 switch (dev->ieee80211_ptr->iftype) {
11340 case NL80211_IFTYPE_AP:
11341 case NL80211_IFTYPE_P2P_GO:
11342 need_new_beacon = true;
11343 /* For all modes except AP the handle_dfs flag needs to be
11344 * supplied to tell the kernel that userspace will handle radar
11345 * events when they happen. Otherwise a switch to a channel
11346 * requiring DFS will be rejected.
11347 */
11348 need_handle_dfs_flag = false;
11349
11350 /* useless if AP is not running */
11351 if (!wdev->links[link_id].ap.beacon_interval)
11352 return -ENOTCONN;
11353 break;
11354 case NL80211_IFTYPE_ADHOC:
11355 if (!wdev->u.ibss.ssid_len)
11356 return -ENOTCONN;
11357 break;
11358 case NL80211_IFTYPE_MESH_POINT:
11359 if (!wdev->u.mesh.id_len)
11360 return -ENOTCONN;
11361 break;
11362 default:
11363 return -EOPNOTSUPP;
11364 }
11365
11366 memset(¶ms, 0, sizeof(params));
11367 params.beacon_csa.ftm_responder = -1;
11368
11369 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11370 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
11371 return -EINVAL;
11372
11373 /* only important for AP, IBSS and mesh create IEs internally */
11374 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
11375 return -EINVAL;
11376
11377 /* Even though the attribute is u32, the specification says
11378 * u8, so let's make sure we don't overflow.
11379 */
11380 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
11381 if (cs_count > 255)
11382 return -EINVAL;
11383
11384 params.count = cs_count;
11385
11386 if (!need_new_beacon)
11387 goto skip_beacons;
11388
11389 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
11390 info->extack);
11391 if (err)
11392 goto free;
11393
11394 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
11395 GFP_KERNEL);
11396 if (!csa_attrs) {
11397 err = -ENOMEM;
11398 goto free;
11399 }
11400
11401 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
11402 info->attrs[NL80211_ATTR_CSA_IES],
11403 nl80211_policy, info->extack);
11404 if (err)
11405 goto free;
11406
11407 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
11408 info->extack);
11409 if (err)
11410 goto free;
11411
11412 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
11413 err = -EINVAL;
11414 goto free;
11415 }
11416
11417 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
11418 params.beacon_csa.tail_len,
11419 params.count,
11420 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
11421 ¶ms.counter_offsets_beacon,
11422 ¶ms.n_counter_offsets_beacon);
11423 if (err)
11424 goto free;
11425
11426 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
11427 params.beacon_csa.probe_resp_len,
11428 params.count,
11429 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
11430 ¶ms.counter_offsets_presp,
11431 ¶ms.n_counter_offsets_presp);
11432 if (err)
11433 goto free;
11434
11435 skip_beacons:
11436 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
11437 if (err)
11438 goto free;
11439
11440 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
11441 wdev->iftype)) {
11442 err = -EINVAL;
11443 goto free;
11444 }
11445
11446 err = cfg80211_chandef_dfs_required(wdev->wiphy,
11447 ¶ms.chandef,
11448 wdev->iftype);
11449 if (err < 0)
11450 goto free;
11451
11452 if (err > 0) {
11453 params.radar_required = true;
11454 if (need_handle_dfs_flag &&
11455 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
11456 err = -EINVAL;
11457 goto free;
11458 }
11459 }
11460
11461 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
11462 params.block_tx = true;
11463
11464 if ((wdev->iftype == NL80211_IFTYPE_AP ||
11465 wdev->iftype == NL80211_IFTYPE_P2P_GO) &&
11466 info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
11467 err = nl80211_parse_unsol_bcast_probe_resp(
11468 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
11469 ¶ms.unsol_bcast_probe_resp);
11470 if (err)
11471 goto free;
11472 }
11473
11474 params.link_id = link_id;
11475 err = rdev_channel_switch(rdev, dev, ¶ms);
11476
11477 free:
11478 kfree(params.beacon_after.mbssid_ies);
11479 kfree(params.beacon_csa.mbssid_ies);
11480 kfree(params.beacon_after.rnr_ies);
11481 kfree(params.beacon_csa.rnr_ies);
11482 kfree(csa_attrs);
11483 return err;
11484 }
11485
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)11486 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
11487 u32 seq, int flags,
11488 struct cfg80211_registered_device *rdev,
11489 struct wireless_dev *wdev,
11490 struct cfg80211_internal_bss *intbss)
11491 {
11492 struct cfg80211_bss *res = &intbss->pub;
11493 const struct cfg80211_bss_ies *ies;
11494 unsigned int link_id;
11495 void *hdr;
11496 struct nlattr *bss;
11497
11498 lockdep_assert_wiphy(wdev->wiphy);
11499
11500 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
11501 NL80211_CMD_NEW_SCAN_RESULTS);
11502 if (!hdr)
11503 return -1;
11504
11505 genl_dump_check_consistent(cb, hdr);
11506
11507 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
11508 goto nla_put_failure;
11509 if (wdev->netdev &&
11510 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
11511 goto nla_put_failure;
11512 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11513 NL80211_ATTR_PAD))
11514 goto nla_put_failure;
11515
11516 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
11517 if (!bss)
11518 goto nla_put_failure;
11519 if ((!is_zero_ether_addr(res->bssid) &&
11520 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
11521 goto nla_put_failure;
11522
11523 rcu_read_lock();
11524 /* indicate whether we have probe response data or not */
11525 if (rcu_access_pointer(res->proberesp_ies) &&
11526 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
11527 goto fail_unlock_rcu;
11528
11529 /* this pointer prefers to be pointed to probe response data
11530 * but is always valid
11531 */
11532 ies = rcu_dereference(res->ies);
11533 if (ies) {
11534 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
11535 NL80211_BSS_PAD))
11536 goto fail_unlock_rcu;
11537 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
11538 ies->len, ies->data))
11539 goto fail_unlock_rcu;
11540 }
11541
11542 /* and this pointer is always (unless driver didn't know) beacon data */
11543 ies = rcu_dereference(res->beacon_ies);
11544 if (ies && ies->from_beacon) {
11545 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
11546 NL80211_BSS_PAD))
11547 goto fail_unlock_rcu;
11548 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
11549 ies->len, ies->data))
11550 goto fail_unlock_rcu;
11551 }
11552 rcu_read_unlock();
11553
11554 if (res->beacon_interval &&
11555 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
11556 goto nla_put_failure;
11557 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
11558 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
11559 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
11560 res->channel->freq_offset) ||
11561 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
11562 jiffies_to_msecs(jiffies - intbss->ts)))
11563 goto nla_put_failure;
11564
11565 if (intbss->parent_tsf &&
11566 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
11567 intbss->parent_tsf, NL80211_BSS_PAD) ||
11568 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
11569 intbss->parent_bssid)))
11570 goto nla_put_failure;
11571
11572 if (res->ts_boottime &&
11573 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
11574 res->ts_boottime, NL80211_BSS_PAD))
11575 goto nla_put_failure;
11576
11577 if (!nl80211_put_signal(msg, intbss->pub.chains,
11578 intbss->pub.chain_signal,
11579 NL80211_BSS_CHAIN_SIGNAL))
11580 goto nla_put_failure;
11581
11582 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
11583 switch (rdev->wiphy.signal_type) {
11584 case CFG80211_SIGNAL_TYPE_MBM:
11585 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
11586 res->signal))
11587 goto nla_put_failure;
11588 break;
11589 case CFG80211_SIGNAL_TYPE_UNSPEC:
11590 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
11591 res->signal))
11592 goto nla_put_failure;
11593 break;
11594 default:
11595 break;
11596 }
11597 }
11598
11599 switch (wdev->iftype) {
11600 case NL80211_IFTYPE_P2P_CLIENT:
11601 case NL80211_IFTYPE_STATION:
11602 for_each_valid_link(wdev, link_id) {
11603 if (intbss == wdev->links[link_id].client.current_bss &&
11604 (nla_put_u32(msg, NL80211_BSS_STATUS,
11605 NL80211_BSS_STATUS_ASSOCIATED) ||
11606 (wdev->valid_links &&
11607 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
11608 link_id) ||
11609 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
11610 wdev->u.client.connected_addr)))))
11611 goto nla_put_failure;
11612 }
11613 break;
11614 case NL80211_IFTYPE_ADHOC:
11615 if (intbss == wdev->u.ibss.current_bss &&
11616 nla_put_u32(msg, NL80211_BSS_STATUS,
11617 NL80211_BSS_STATUS_IBSS_JOINED))
11618 goto nla_put_failure;
11619 break;
11620 default:
11621 break;
11622 }
11623
11624 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
11625 goto nla_put_failure;
11626
11627 if (res->cannot_use_reasons &&
11628 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
11629 res->cannot_use_reasons,
11630 NL80211_BSS_PAD))
11631 goto nla_put_failure;
11632
11633 nla_nest_end(msg, bss);
11634
11635 genlmsg_end(msg, hdr);
11636 return 0;
11637
11638 fail_unlock_rcu:
11639 rcu_read_unlock();
11640 nla_put_failure:
11641 genlmsg_cancel(msg, hdr);
11642 return -EMSGSIZE;
11643 }
11644
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)11645 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
11646 {
11647 struct cfg80211_registered_device *rdev;
11648 struct cfg80211_internal_bss *scan;
11649 struct wireless_dev *wdev;
11650 struct nlattr **attrbuf;
11651 int start = cb->args[2], idx = 0;
11652 bool dump_include_use_data;
11653 int err;
11654
11655 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11656 if (!attrbuf)
11657 return -ENOMEM;
11658
11659 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11660 if (err) {
11661 kfree(attrbuf);
11662 return err;
11663 }
11664 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11665 __acquire(&rdev->wiphy.mtx);
11666
11667 dump_include_use_data =
11668 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
11669 kfree(attrbuf);
11670
11671 spin_lock_bh(&rdev->bss_lock);
11672
11673 /*
11674 * dump_scan will be called multiple times to break up the scan results
11675 * into multiple messages. It is unlikely that any more bss-es will be
11676 * expired after the first call, so only call only call this on the
11677 * first dump_scan invocation.
11678 */
11679 if (start == 0)
11680 cfg80211_bss_expire(rdev);
11681
11682 cb->seq = rdev->bss_generation;
11683
11684 list_for_each_entry(scan, &rdev->bss_list, list) {
11685 if (++idx <= start)
11686 continue;
11687 if (!dump_include_use_data &&
11688 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
11689 continue;
11690 if (nl80211_send_bss(skb, cb,
11691 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11692 rdev, wdev, scan) < 0) {
11693 idx--;
11694 break;
11695 }
11696 }
11697
11698 spin_unlock_bh(&rdev->bss_lock);
11699
11700 cb->args[2] = idx;
11701 wiphy_unlock(&rdev->wiphy);
11702
11703 return skb->len;
11704 }
11705
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)11706 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
11707 int flags, struct net_device *dev,
11708 bool allow_radio_stats,
11709 struct survey_info *survey)
11710 {
11711 void *hdr;
11712 struct nlattr *infoattr;
11713
11714 /* skip radio stats if userspace didn't request them */
11715 if (!survey->channel && !allow_radio_stats)
11716 return 0;
11717
11718 hdr = nl80211hdr_put(msg, portid, seq, flags,
11719 NL80211_CMD_NEW_SURVEY_RESULTS);
11720 if (!hdr)
11721 return -ENOMEM;
11722
11723 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11724 goto nla_put_failure;
11725
11726 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
11727 if (!infoattr)
11728 goto nla_put_failure;
11729
11730 if (survey->channel &&
11731 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
11732 survey->channel->center_freq))
11733 goto nla_put_failure;
11734
11735 if (survey->channel && survey->channel->freq_offset &&
11736 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
11737 survey->channel->freq_offset))
11738 goto nla_put_failure;
11739
11740 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
11741 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
11742 goto nla_put_failure;
11743 if ((survey->filled & SURVEY_INFO_IN_USE) &&
11744 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
11745 goto nla_put_failure;
11746 if ((survey->filled & SURVEY_INFO_TIME) &&
11747 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
11748 survey->time, NL80211_SURVEY_INFO_PAD))
11749 goto nla_put_failure;
11750 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
11751 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
11752 survey->time_busy, NL80211_SURVEY_INFO_PAD))
11753 goto nla_put_failure;
11754 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
11755 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
11756 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
11757 goto nla_put_failure;
11758 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
11759 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
11760 survey->time_rx, NL80211_SURVEY_INFO_PAD))
11761 goto nla_put_failure;
11762 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
11763 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
11764 survey->time_tx, NL80211_SURVEY_INFO_PAD))
11765 goto nla_put_failure;
11766 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
11767 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
11768 survey->time_scan, NL80211_SURVEY_INFO_PAD))
11769 goto nla_put_failure;
11770 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
11771 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
11772 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
11773 goto nla_put_failure;
11774
11775 nla_nest_end(msg, infoattr);
11776
11777 genlmsg_end(msg, hdr);
11778 return 0;
11779
11780 nla_put_failure:
11781 genlmsg_cancel(msg, hdr);
11782 return -EMSGSIZE;
11783 }
11784
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)11785 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
11786 {
11787 struct nlattr **attrbuf;
11788 struct survey_info survey;
11789 struct cfg80211_registered_device *rdev;
11790 struct wireless_dev *wdev;
11791 int survey_idx = cb->args[2];
11792 int res;
11793 bool radio_stats;
11794
11795 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11796 if (!attrbuf)
11797 return -ENOMEM;
11798
11799 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11800 if (res) {
11801 kfree(attrbuf);
11802 return res;
11803 }
11804 /* nl80211_prepare_wdev_dump acquired it in the successful case */
11805 __acquire(&rdev->wiphy.mtx);
11806
11807 /* prepare_wdev_dump parsed the attributes */
11808 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
11809
11810 if (!wdev->netdev) {
11811 res = -EINVAL;
11812 goto out_err;
11813 }
11814
11815 if (!rdev->ops->dump_survey) {
11816 res = -EOPNOTSUPP;
11817 goto out_err;
11818 }
11819
11820 while (1) {
11821 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
11822 if (res == -ENOENT)
11823 break;
11824 if (res)
11825 goto out_err;
11826
11827 /* don't send disabled channels, but do send non-channel data */
11828 if (survey.channel &&
11829 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
11830 survey_idx++;
11831 continue;
11832 }
11833
11834 if (nl80211_send_survey(skb,
11835 NETLINK_CB(cb->skb).portid,
11836 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11837 wdev->netdev, radio_stats, &survey) < 0)
11838 goto out;
11839 survey_idx++;
11840 }
11841
11842 out:
11843 cb->args[2] = survey_idx;
11844 res = skb->len;
11845 out_err:
11846 kfree(attrbuf);
11847 wiphy_unlock(&rdev->wiphy);
11848 return res;
11849 }
11850
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)11851 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
11852 {
11853 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11854 struct net_device *dev = info->user_ptr[1];
11855 struct ieee80211_channel *chan;
11856 const u8 *bssid, *ssid;
11857 int err, ssid_len;
11858 enum nl80211_auth_type auth_type;
11859 struct key_parse key;
11860 bool local_state_change;
11861 struct cfg80211_auth_request req = {};
11862 u32 freq;
11863
11864 if (!info->attrs[NL80211_ATTR_MAC])
11865 return -EINVAL;
11866
11867 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
11868 return -EINVAL;
11869
11870 if (!info->attrs[NL80211_ATTR_SSID])
11871 return -EINVAL;
11872
11873 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11874 return -EINVAL;
11875
11876 err = nl80211_parse_key(info, &key);
11877 if (err)
11878 return err;
11879
11880 if (key.idx >= 0) {
11881 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
11882 return -EINVAL;
11883 if (!key.p.key || !key.p.key_len)
11884 return -EINVAL;
11885 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
11886 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
11887 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
11888 key.p.key_len != WLAN_KEY_LEN_WEP104))
11889 return -EINVAL;
11890 if (key.idx > 3)
11891 return -EINVAL;
11892 } else {
11893 key.p.key_len = 0;
11894 key.p.key = NULL;
11895 }
11896
11897 if (key.idx >= 0) {
11898 int i;
11899 bool ok = false;
11900
11901 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
11902 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
11903 ok = true;
11904 break;
11905 }
11906 }
11907 if (!ok)
11908 return -EINVAL;
11909 }
11910
11911 if (!rdev->ops->auth)
11912 return -EOPNOTSUPP;
11913
11914 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11915 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11916 return -EOPNOTSUPP;
11917
11918 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11919 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11920 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11921 freq +=
11922 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11923
11924 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11925 if (!chan)
11926 return -EINVAL;
11927
11928 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11929 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11930
11931 if (info->attrs[NL80211_ATTR_IE]) {
11932 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11933 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11934 }
11935
11936 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11937 req.supported_selectors =
11938 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11939 req.supported_selectors_len =
11940 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11941 }
11942
11943 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11944 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
11945 return -EINVAL;
11946
11947 if ((auth_type == NL80211_AUTHTYPE_SAE ||
11948 auth_type == NL80211_AUTHTYPE_FILS_SK ||
11949 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
11950 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
11951 !info->attrs[NL80211_ATTR_AUTH_DATA])
11952 return -EINVAL;
11953
11954 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
11955 if (auth_type != NL80211_AUTHTYPE_SAE &&
11956 auth_type != NL80211_AUTHTYPE_FILS_SK &&
11957 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
11958 auth_type != NL80211_AUTHTYPE_FILS_PK)
11959 return -EINVAL;
11960 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
11961 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
11962 }
11963
11964 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11965
11966 /*
11967 * Since we no longer track auth state, ignore
11968 * requests to only change local state.
11969 */
11970 if (local_state_change)
11971 return 0;
11972
11973 req.auth_type = auth_type;
11974 req.key = key.p.key;
11975 req.key_len = key.p.key_len;
11976 req.key_idx = key.idx;
11977 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11978 if (req.link_id >= 0) {
11979 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11980 return -EINVAL;
11981 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
11982 return -EINVAL;
11983 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11984 if (!is_valid_ether_addr(req.ap_mld_addr))
11985 return -EINVAL;
11986 }
11987
11988 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
11989 IEEE80211_BSS_TYPE_ESS,
11990 IEEE80211_PRIVACY_ANY);
11991 if (!req.bss)
11992 return -ENOENT;
11993
11994 err = cfg80211_mlme_auth(rdev, dev, &req);
11995
11996 cfg80211_put_bss(&rdev->wiphy, req.bss);
11997
11998 return err;
11999 }
12000
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)12001 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
12002 struct genl_info *info)
12003 {
12004 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12005 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
12006 return -EINVAL;
12007 }
12008
12009 if (!rdev->ops->tx_control_port ||
12010 !wiphy_ext_feature_isset(&rdev->wiphy,
12011 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12012 return -EOPNOTSUPP;
12013
12014 return 0;
12015 }
12016
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)12017 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
12018 struct genl_info *info,
12019 struct cfg80211_crypto_settings *settings,
12020 int cipher_limit)
12021 {
12022 memset(settings, 0, sizeof(*settings));
12023
12024 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
12025
12026 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12027 u16 proto;
12028
12029 proto = nla_get_u16(
12030 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12031 settings->control_port_ethertype = cpu_to_be16(proto);
12032 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
12033 proto != ETH_P_PAE)
12034 return -EINVAL;
12035 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
12036 settings->control_port_no_encrypt = true;
12037 } else
12038 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
12039
12040 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12041 int r = validate_pae_over_nl80211(rdev, info);
12042
12043 if (r < 0)
12044 return r;
12045
12046 settings->control_port_over_nl80211 = true;
12047
12048 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
12049 settings->control_port_no_preauth = true;
12050 }
12051
12052 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
12053 void *data;
12054 int len, i;
12055
12056 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12057 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12058 settings->n_ciphers_pairwise = len / sizeof(u32);
12059
12060 if (len % sizeof(u32))
12061 return -EINVAL;
12062
12063 if (settings->n_ciphers_pairwise > cipher_limit)
12064 return -EINVAL;
12065
12066 memcpy(settings->ciphers_pairwise, data, len);
12067
12068 for (i = 0; i < settings->n_ciphers_pairwise; i++)
12069 if (!cfg80211_supported_cipher_suite(
12070 &rdev->wiphy,
12071 settings->ciphers_pairwise[i]))
12072 return -EINVAL;
12073 }
12074
12075 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
12076 settings->cipher_group =
12077 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
12078 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
12079 settings->cipher_group))
12080 return -EINVAL;
12081 }
12082
12083 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
12084 settings->wpa_versions =
12085 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
12086
12087 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
12088 void *data;
12089 int len;
12090
12091 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
12092 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
12093 settings->n_akm_suites = len / sizeof(u32);
12094
12095 if (len % sizeof(u32))
12096 return -EINVAL;
12097
12098 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
12099 return -EINVAL;
12100
12101 memcpy(settings->akm_suites, data, len);
12102 }
12103
12104 if (info->attrs[NL80211_ATTR_PMK]) {
12105 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
12106 return -EINVAL;
12107 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12108 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
12109 !wiphy_ext_feature_isset(&rdev->wiphy,
12110 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
12111 return -EINVAL;
12112 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12113 }
12114
12115 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
12116 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12117 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
12118 !wiphy_ext_feature_isset(&rdev->wiphy,
12119 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
12120 return -EINVAL;
12121 settings->sae_pwd =
12122 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12123 settings->sae_pwd_len =
12124 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12125 }
12126
12127 settings->sae_pwe =
12128 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
12129 NL80211_SAE_PWE_UNSPECIFIED);
12130
12131 return 0;
12132 }
12133
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs,int assoc_link_id,int link_id)12134 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
12135 const u8 *ssid, int ssid_len,
12136 struct nlattr **attrs,
12137 int assoc_link_id, int link_id)
12138 {
12139 struct ieee80211_channel *chan;
12140 struct cfg80211_bss *bss;
12141 const u8 *bssid;
12142 u32 freq, use_for = 0;
12143
12144 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
12145 return ERR_PTR(-EINVAL);
12146
12147 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
12148
12149 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
12150 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12151 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12152
12153 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
12154 if (!chan)
12155 return ERR_PTR(-EINVAL);
12156
12157 if (assoc_link_id >= 0)
12158 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
12159 if (assoc_link_id == link_id)
12160 use_for |= NL80211_BSS_USE_FOR_NORMAL;
12161
12162 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
12163 ssid, ssid_len,
12164 IEEE80211_BSS_TYPE_ESS,
12165 IEEE80211_PRIVACY_ANY,
12166 use_for);
12167 if (!bss)
12168 return ERR_PTR(-ENOENT);
12169
12170 return bss;
12171 }
12172
nl80211_process_links(struct cfg80211_registered_device * rdev,struct cfg80211_assoc_link * links,int assoc_link_id,const u8 * ssid,int ssid_len,struct genl_info * info)12173 static int nl80211_process_links(struct cfg80211_registered_device *rdev,
12174 struct cfg80211_assoc_link *links,
12175 int assoc_link_id,
12176 const u8 *ssid, int ssid_len,
12177 struct genl_info *info)
12178 {
12179 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
12180 struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
12181 struct nlattr *link;
12182 unsigned int link_id;
12183 int rem, err;
12184
12185 if (!attrs)
12186 return -ENOMEM;
12187
12188 nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
12189 memset(attrs, 0, attrsize);
12190
12191 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
12192
12193 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
12194 NL_SET_BAD_ATTR(info->extack, link);
12195 return -EINVAL;
12196 }
12197
12198 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
12199 /* cannot use the same link ID again */
12200 if (links[link_id].bss) {
12201 NL_SET_BAD_ATTR(info->extack, link);
12202 return -EINVAL;
12203 }
12204 links[link_id].bss =
12205 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
12206 assoc_link_id, link_id);
12207 if (IS_ERR(links[link_id].bss)) {
12208 err = PTR_ERR(links[link_id].bss);
12209 links[link_id].bss = NULL;
12210 NL_SET_ERR_MSG_ATTR(info->extack, link,
12211 "Error fetching BSS for link");
12212 return err;
12213 }
12214
12215 if (attrs[NL80211_ATTR_IE]) {
12216 links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
12217 links[link_id].elems_len =
12218 nla_len(attrs[NL80211_ATTR_IE]);
12219
12220 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
12221 links[link_id].elems,
12222 links[link_id].elems_len)) {
12223 NL_SET_ERR_MSG_ATTR(info->extack,
12224 attrs[NL80211_ATTR_IE],
12225 "cannot deal with fragmentation");
12226 return -EINVAL;
12227 }
12228
12229 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12230 links[link_id].elems,
12231 links[link_id].elems_len)) {
12232 NL_SET_ERR_MSG_ATTR(info->extack,
12233 attrs[NL80211_ATTR_IE],
12234 "cannot deal with non-inheritance");
12235 return -EINVAL;
12236 }
12237 }
12238
12239 links[link_id].disabled =
12240 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
12241 }
12242
12243 return 0;
12244 }
12245
nl80211_associate(struct sk_buff * skb,struct genl_info * info)12246 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
12247 {
12248 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12249 struct net_device *dev = info->user_ptr[1];
12250 struct cfg80211_assoc_request req = {};
12251 const u8 *ap_addr, *ssid;
12252 unsigned int link_id;
12253 int err, ssid_len;
12254
12255 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12256 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12257 return -EPERM;
12258
12259 if (!info->attrs[NL80211_ATTR_SSID])
12260 return -EINVAL;
12261
12262 if (!rdev->ops->assoc)
12263 return -EOPNOTSUPP;
12264
12265 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12266 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12267 return -EOPNOTSUPP;
12268
12269 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12270 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12271
12272 if (info->attrs[NL80211_ATTR_IE]) {
12273 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12274 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12275
12276 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12277 req.ie, req.ie_len)) {
12278 NL_SET_ERR_MSG_ATTR(info->extack,
12279 info->attrs[NL80211_ATTR_IE],
12280 "non-inheritance makes no sense");
12281 return -EINVAL;
12282 }
12283 }
12284
12285 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12286 enum nl80211_mfp mfp =
12287 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12288 if (mfp == NL80211_MFP_REQUIRED)
12289 req.use_mfp = true;
12290 else if (mfp != NL80211_MFP_NO)
12291 return -EINVAL;
12292 }
12293
12294 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12295 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12296
12297 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
12298 req.supported_selectors =
12299 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12300 req.supported_selectors_len =
12301 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12302 }
12303
12304 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12305 req.flags |= ASSOC_REQ_DISABLE_HT;
12306
12307 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12308 memcpy(&req.ht_capa_mask,
12309 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12310 sizeof(req.ht_capa_mask));
12311
12312 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12313 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12314 return -EINVAL;
12315 memcpy(&req.ht_capa,
12316 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12317 sizeof(req.ht_capa));
12318 }
12319
12320 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12321 req.flags |= ASSOC_REQ_DISABLE_VHT;
12322
12323 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12324 req.flags |= ASSOC_REQ_DISABLE_HE;
12325
12326 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12327 req.flags |= ASSOC_REQ_DISABLE_EHT;
12328
12329 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12330 memcpy(&req.vht_capa_mask,
12331 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12332 sizeof(req.vht_capa_mask));
12333
12334 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12335 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12336 return -EINVAL;
12337 memcpy(&req.vht_capa,
12338 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12339 sizeof(req.vht_capa));
12340 }
12341
12342 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12343 if (!((rdev->wiphy.features &
12344 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12345 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12346 !wiphy_ext_feature_isset(&rdev->wiphy,
12347 NL80211_EXT_FEATURE_RRM))
12348 return -EINVAL;
12349 req.flags |= ASSOC_REQ_USE_RRM;
12350 }
12351
12352 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
12353 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
12354 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
12355 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
12356 return -EINVAL;
12357 req.fils_nonces =
12358 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
12359 }
12360
12361 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
12362 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
12363 return -EINVAL;
12364 memcpy(&req.s1g_capa_mask,
12365 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
12366 sizeof(req.s1g_capa_mask));
12367 }
12368
12369 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
12370 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
12371 return -EINVAL;
12372 memcpy(&req.s1g_capa,
12373 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
12374 sizeof(req.s1g_capa));
12375 }
12376
12377 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
12378 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12379 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
12380 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
12381 return -EINVAL;
12382 }
12383 req.flags |= ASSOC_REQ_SPP_AMSDU;
12384 }
12385
12386 req.link_id = nl80211_link_id_or_invalid(info->attrs);
12387
12388 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12389 if (req.link_id < 0)
12390 return -EINVAL;
12391
12392 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
12393 return -EINVAL;
12394
12395 if (info->attrs[NL80211_ATTR_MAC] ||
12396 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12397 !info->attrs[NL80211_ATTR_MLD_ADDR])
12398 return -EINVAL;
12399
12400 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
12401 ap_addr = req.ap_mld_addr;
12402
12403 err = nl80211_process_links(rdev, req.links, req.link_id,
12404 ssid, ssid_len, info);
12405 if (err)
12406 goto free;
12407
12408 if (!req.links[req.link_id].bss) {
12409 err = -EINVAL;
12410 goto free;
12411 }
12412
12413 if (req.links[req.link_id].elems_len) {
12414 GENL_SET_ERR_MSG(info,
12415 "cannot have per-link elems on assoc link");
12416 err = -EINVAL;
12417 goto free;
12418 }
12419
12420 if (req.links[req.link_id].disabled) {
12421 GENL_SET_ERR_MSG(info,
12422 "cannot have assoc link disabled");
12423 err = -EINVAL;
12424 goto free;
12425 }
12426
12427 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12428 req.ext_mld_capa_ops =
12429 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
12430 } else {
12431 if (req.link_id >= 0)
12432 return -EINVAL;
12433
12434 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
12435 -1, -1);
12436 if (IS_ERR(req.bss))
12437 return PTR_ERR(req.bss);
12438 ap_addr = req.bss->bssid;
12439
12440 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12441 return -EINVAL;
12442 }
12443
12444 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
12445 if (!err) {
12446 struct nlattr *link;
12447 int rem = 0;
12448
12449 err = cfg80211_mlme_assoc(rdev, dev, &req,
12450 info->extack);
12451
12452 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12453 dev->ieee80211_ptr->conn_owner_nlportid =
12454 info->snd_portid;
12455 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12456 ap_addr, ETH_ALEN);
12457 }
12458
12459 /* Report error from first problematic link */
12460 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12461 nla_for_each_nested(link,
12462 info->attrs[NL80211_ATTR_MLO_LINKS],
12463 rem) {
12464 struct nlattr *link_id_attr =
12465 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
12466
12467 if (!link_id_attr)
12468 continue;
12469
12470 link_id = nla_get_u8(link_id_attr);
12471
12472 if (link_id == req.link_id)
12473 continue;
12474
12475 if (!req.links[link_id].error ||
12476 WARN_ON(req.links[link_id].error > 0))
12477 continue;
12478
12479 WARN_ON(err >= 0);
12480
12481 NL_SET_BAD_ATTR(info->extack, link);
12482 err = req.links[link_id].error;
12483 break;
12484 }
12485 }
12486 }
12487
12488 free:
12489 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
12490 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
12491 cfg80211_put_bss(&rdev->wiphy, req.bss);
12492
12493 return err;
12494 }
12495
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)12496 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
12497 {
12498 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12499 struct net_device *dev = info->user_ptr[1];
12500 const u8 *ie = NULL, *bssid;
12501 int ie_len = 0;
12502 u16 reason_code;
12503 bool local_state_change;
12504
12505 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12506 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12507 return -EPERM;
12508
12509 if (!info->attrs[NL80211_ATTR_MAC])
12510 return -EINVAL;
12511
12512 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12513 return -EINVAL;
12514
12515 if (!rdev->ops->deauth)
12516 return -EOPNOTSUPP;
12517
12518 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12519 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12520 return -EOPNOTSUPP;
12521
12522 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12523
12524 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12525 if (reason_code == 0) {
12526 /* Reason Code 0 is reserved */
12527 return -EINVAL;
12528 }
12529
12530 if (info->attrs[NL80211_ATTR_IE]) {
12531 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12532 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12533 }
12534
12535 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12536
12537 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
12538 local_state_change);
12539 }
12540
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)12541 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
12542 {
12543 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12544 struct net_device *dev = info->user_ptr[1];
12545 const u8 *ie = NULL, *bssid;
12546 int ie_len = 0;
12547 u16 reason_code;
12548 bool local_state_change;
12549
12550 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12551 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12552 return -EPERM;
12553
12554 if (!info->attrs[NL80211_ATTR_MAC])
12555 return -EINVAL;
12556
12557 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12558 return -EINVAL;
12559
12560 if (!rdev->ops->disassoc)
12561 return -EOPNOTSUPP;
12562
12563 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12564 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12565 return -EOPNOTSUPP;
12566
12567 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12568
12569 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12570 if (reason_code == 0) {
12571 /* Reason Code 0 is reserved */
12572 return -EINVAL;
12573 }
12574
12575 if (info->attrs[NL80211_ATTR_IE]) {
12576 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12577 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12578 }
12579
12580 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12581
12582 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
12583 local_state_change);
12584 }
12585
12586 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)12587 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
12588 int mcast_rate[NUM_NL80211_BANDS],
12589 int rateval)
12590 {
12591 struct wiphy *wiphy = &rdev->wiphy;
12592 bool found = false;
12593 int band, i;
12594
12595 for (band = 0; band < NUM_NL80211_BANDS; band++) {
12596 struct ieee80211_supported_band *sband;
12597
12598 sband = wiphy->bands[band];
12599 if (!sband)
12600 continue;
12601
12602 for (i = 0; i < sband->n_bitrates; i++) {
12603 if (sband->bitrates[i].bitrate == rateval) {
12604 mcast_rate[band] = i + 1;
12605 found = true;
12606 break;
12607 }
12608 }
12609 }
12610
12611 return found;
12612 }
12613
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)12614 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
12615 {
12616 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12617 struct net_device *dev = info->user_ptr[1];
12618 struct cfg80211_ibss_params ibss;
12619 struct wiphy *wiphy;
12620 struct cfg80211_cached_keys *connkeys = NULL;
12621 int err;
12622
12623 memset(&ibss, 0, sizeof(ibss));
12624
12625 if (!info->attrs[NL80211_ATTR_SSID] ||
12626 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12627 return -EINVAL;
12628
12629 ibss.beacon_interval = 100;
12630
12631 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
12632 ibss.beacon_interval =
12633 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12634
12635 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
12636 ibss.beacon_interval);
12637 if (err)
12638 return err;
12639
12640 if (!rdev->ops->join_ibss)
12641 return -EOPNOTSUPP;
12642
12643 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12644 return -EOPNOTSUPP;
12645
12646 wiphy = &rdev->wiphy;
12647
12648 if (info->attrs[NL80211_ATTR_MAC]) {
12649 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12650
12651 if (!is_valid_ether_addr(ibss.bssid))
12652 return -EINVAL;
12653 }
12654 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12655 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12656
12657 if (info->attrs[NL80211_ATTR_IE]) {
12658 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12659 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12660 }
12661
12662 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
12663 if (err)
12664 return err;
12665
12666 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
12667 NL80211_IFTYPE_ADHOC))
12668 return -EINVAL;
12669
12670 switch (ibss.chandef.width) {
12671 case NL80211_CHAN_WIDTH_5:
12672 case NL80211_CHAN_WIDTH_10:
12673 case NL80211_CHAN_WIDTH_20_NOHT:
12674 break;
12675 case NL80211_CHAN_WIDTH_20:
12676 case NL80211_CHAN_WIDTH_40:
12677 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12678 return -EINVAL;
12679 break;
12680 case NL80211_CHAN_WIDTH_80:
12681 case NL80211_CHAN_WIDTH_80P80:
12682 case NL80211_CHAN_WIDTH_160:
12683 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12684 return -EINVAL;
12685 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12686 NL80211_EXT_FEATURE_VHT_IBSS))
12687 return -EINVAL;
12688 break;
12689 case NL80211_CHAN_WIDTH_320:
12690 return -EINVAL;
12691 default:
12692 return -EINVAL;
12693 }
12694
12695 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
12696 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
12697
12698 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12699 u8 *rates =
12700 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12701 int n_rates =
12702 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12703 struct ieee80211_supported_band *sband =
12704 wiphy->bands[ibss.chandef.chan->band];
12705
12706 err = ieee80211_get_ratemask(sband, rates, n_rates,
12707 &ibss.basic_rates);
12708 if (err)
12709 return err;
12710 }
12711
12712 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12713 memcpy(&ibss.ht_capa_mask,
12714 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12715 sizeof(ibss.ht_capa_mask));
12716
12717 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12718 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12719 return -EINVAL;
12720 memcpy(&ibss.ht_capa,
12721 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12722 sizeof(ibss.ht_capa));
12723 }
12724
12725 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12726 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
12727 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12728 return -EINVAL;
12729
12730 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12731 bool no_ht = false;
12732
12733 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
12734 if (IS_ERR(connkeys))
12735 return PTR_ERR(connkeys);
12736
12737 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
12738 no_ht) {
12739 kfree_sensitive(connkeys);
12740 return -EINVAL;
12741 }
12742 }
12743
12744 ibss.control_port =
12745 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
12746
12747 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12748 int r = validate_pae_over_nl80211(rdev, info);
12749
12750 if (r < 0) {
12751 kfree_sensitive(connkeys);
12752 return r;
12753 }
12754
12755 ibss.control_port_over_nl80211 = true;
12756 }
12757
12758 ibss.userspace_handles_dfs =
12759 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12760
12761 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
12762 if (err)
12763 kfree_sensitive(connkeys);
12764 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
12765 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12766
12767 return err;
12768 }
12769
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)12770 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
12771 {
12772 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12773 struct net_device *dev = info->user_ptr[1];
12774
12775 if (!rdev->ops->leave_ibss)
12776 return -EOPNOTSUPP;
12777
12778 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12779 return -EOPNOTSUPP;
12780
12781 return cfg80211_leave_ibss(rdev, dev, false);
12782 }
12783
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)12784 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
12785 {
12786 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12787 struct net_device *dev = info->user_ptr[1];
12788 int mcast_rate[NUM_NL80211_BANDS];
12789 u32 nla_rate;
12790
12791 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
12792 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
12793 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
12794 return -EOPNOTSUPP;
12795
12796 if (!rdev->ops->set_mcast_rate)
12797 return -EOPNOTSUPP;
12798
12799 memset(mcast_rate, 0, sizeof(mcast_rate));
12800
12801 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
12802 return -EINVAL;
12803
12804 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
12805 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
12806 return -EINVAL;
12807
12808 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
12809 }
12810
12811 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)12812 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
12813 struct wireless_dev *wdev, int approxlen,
12814 u32 portid, u32 seq, enum nl80211_commands cmd,
12815 enum nl80211_attrs attr,
12816 const struct nl80211_vendor_cmd_info *info,
12817 gfp_t gfp)
12818 {
12819 struct sk_buff *skb;
12820 void *hdr;
12821 struct nlattr *data;
12822
12823 skb = nlmsg_new(approxlen + 100, gfp);
12824 if (!skb)
12825 return NULL;
12826
12827 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
12828 if (!hdr) {
12829 kfree_skb(skb);
12830 return NULL;
12831 }
12832
12833 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12834 goto nla_put_failure;
12835
12836 if (info) {
12837 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
12838 info->vendor_id))
12839 goto nla_put_failure;
12840 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
12841 info->subcmd))
12842 goto nla_put_failure;
12843 }
12844
12845 if (wdev) {
12846 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12847 wdev_id(wdev), NL80211_ATTR_PAD))
12848 goto nla_put_failure;
12849 if (wdev->netdev &&
12850 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
12851 wdev->netdev->ifindex))
12852 goto nla_put_failure;
12853 }
12854
12855 data = nla_nest_start_noflag(skb, attr);
12856 if (!data)
12857 goto nla_put_failure;
12858
12859 ((void **)skb->cb)[0] = rdev;
12860 ((void **)skb->cb)[1] = hdr;
12861 ((void **)skb->cb)[2] = data;
12862
12863 return skb;
12864
12865 nla_put_failure:
12866 kfree_skb(skb);
12867 return NULL;
12868 }
12869
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)12870 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
12871 struct wireless_dev *wdev,
12872 enum nl80211_commands cmd,
12873 enum nl80211_attrs attr,
12874 unsigned int portid,
12875 int vendor_event_idx,
12876 int approxlen, gfp_t gfp)
12877 {
12878 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12879 const struct nl80211_vendor_cmd_info *info;
12880
12881 switch (cmd) {
12882 case NL80211_CMD_TESTMODE:
12883 if (WARN_ON(vendor_event_idx != -1))
12884 return NULL;
12885 info = NULL;
12886 break;
12887 case NL80211_CMD_VENDOR:
12888 if (WARN_ON(vendor_event_idx < 0 ||
12889 vendor_event_idx >= wiphy->n_vendor_events))
12890 return NULL;
12891 info = &wiphy->vendor_events[vendor_event_idx];
12892 break;
12893 default:
12894 WARN_ON(1);
12895 return NULL;
12896 }
12897
12898 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
12899 cmd, attr, info, gfp);
12900 }
12901 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
12902
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)12903 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
12904 {
12905 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12906 void *hdr = ((void **)skb->cb)[1];
12907 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
12908 struct nlattr *data = ((void **)skb->cb)[2];
12909 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
12910
12911 /* clear CB data for netlink core to own from now on */
12912 memset(skb->cb, 0, sizeof(skb->cb));
12913
12914 nla_nest_end(skb, data);
12915 genlmsg_end(skb, hdr);
12916
12917 if (nlhdr->nlmsg_pid) {
12918 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
12919 nlhdr->nlmsg_pid);
12920 } else {
12921 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
12922 mcgrp = NL80211_MCGRP_VENDOR;
12923
12924 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12925 skb, 0, mcgrp, gfp);
12926 }
12927 }
12928 EXPORT_SYMBOL(__cfg80211_send_event_skb);
12929
12930 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)12931 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
12932 {
12933 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12934 struct wireless_dev *wdev;
12935 int err;
12936
12937 lockdep_assert_held(&rdev->wiphy.mtx);
12938
12939 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
12940 info->attrs);
12941
12942 if (!rdev->ops->testmode_cmd)
12943 return -EOPNOTSUPP;
12944
12945 if (IS_ERR(wdev)) {
12946 err = PTR_ERR(wdev);
12947 if (err != -EINVAL)
12948 return err;
12949 wdev = NULL;
12950 } else if (wdev->wiphy != &rdev->wiphy) {
12951 return -EINVAL;
12952 }
12953
12954 if (!info->attrs[NL80211_ATTR_TESTDATA])
12955 return -EINVAL;
12956
12957 rdev->cur_cmd_info = info;
12958 err = rdev_testmode_cmd(rdev, wdev,
12959 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
12960 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
12961 rdev->cur_cmd_info = NULL;
12962
12963 return err;
12964 }
12965
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)12966 static int nl80211_testmode_dump(struct sk_buff *skb,
12967 struct netlink_callback *cb)
12968 {
12969 struct cfg80211_registered_device *rdev;
12970 struct nlattr **attrbuf = NULL;
12971 int err;
12972 long phy_idx;
12973 void *data = NULL;
12974 int data_len = 0;
12975
12976 rtnl_lock();
12977
12978 if (cb->args[0]) {
12979 /*
12980 * 0 is a valid index, but not valid for args[0],
12981 * so we need to offset by 1.
12982 */
12983 phy_idx = cb->args[0] - 1;
12984
12985 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
12986 if (!rdev) {
12987 err = -ENOENT;
12988 goto out_err;
12989 }
12990 } else {
12991 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
12992 GFP_KERNEL);
12993 if (!attrbuf) {
12994 err = -ENOMEM;
12995 goto out_err;
12996 }
12997
12998 err = nlmsg_parse_deprecated(cb->nlh,
12999 GENL_HDRLEN + nl80211_fam.hdrsize,
13000 attrbuf, nl80211_fam.maxattr,
13001 nl80211_policy, NULL);
13002 if (err)
13003 goto out_err;
13004
13005 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13006 if (IS_ERR(rdev)) {
13007 err = PTR_ERR(rdev);
13008 goto out_err;
13009 }
13010 phy_idx = rdev->wiphy_idx;
13011
13012 if (attrbuf[NL80211_ATTR_TESTDATA])
13013 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
13014 }
13015
13016 if (cb->args[1]) {
13017 data = nla_data((void *)cb->args[1]);
13018 data_len = nla_len((void *)cb->args[1]);
13019 }
13020
13021 if (!rdev->ops->testmode_dump) {
13022 err = -EOPNOTSUPP;
13023 goto out_err;
13024 }
13025
13026 while (1) {
13027 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13028 cb->nlh->nlmsg_seq, NLM_F_MULTI,
13029 NL80211_CMD_TESTMODE);
13030 struct nlattr *tmdata;
13031
13032 if (!hdr)
13033 break;
13034
13035 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
13036 genlmsg_cancel(skb, hdr);
13037 break;
13038 }
13039
13040 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
13041 if (!tmdata) {
13042 genlmsg_cancel(skb, hdr);
13043 break;
13044 }
13045 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
13046 nla_nest_end(skb, tmdata);
13047
13048 if (err == -ENOBUFS || err == -ENOENT) {
13049 genlmsg_cancel(skb, hdr);
13050 break;
13051 } else if (err) {
13052 genlmsg_cancel(skb, hdr);
13053 goto out_err;
13054 }
13055
13056 genlmsg_end(skb, hdr);
13057 }
13058
13059 err = skb->len;
13060 /* see above */
13061 cb->args[0] = phy_idx + 1;
13062 out_err:
13063 kfree(attrbuf);
13064 rtnl_unlock();
13065 return err;
13066 }
13067 #endif
13068
nl80211_connect(struct sk_buff * skb,struct genl_info * info)13069 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
13070 {
13071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13072 struct net_device *dev = info->user_ptr[1];
13073 struct cfg80211_connect_params connect;
13074 struct wiphy *wiphy;
13075 struct cfg80211_cached_keys *connkeys = NULL;
13076 u32 freq = 0;
13077 int err;
13078
13079 memset(&connect, 0, sizeof(connect));
13080
13081 if (!info->attrs[NL80211_ATTR_SSID] ||
13082 !nla_len(info->attrs[NL80211_ATTR_SSID]))
13083 return -EINVAL;
13084
13085 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13086 connect.auth_type =
13087 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13088 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
13089 NL80211_CMD_CONNECT))
13090 return -EINVAL;
13091 } else
13092 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
13093
13094 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
13095
13096 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
13097 !wiphy_ext_feature_isset(&rdev->wiphy,
13098 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13099 return -EINVAL;
13100 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
13101
13102 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
13103 NL80211_MAX_NR_CIPHER_SUITES);
13104 if (err)
13105 return err;
13106
13107 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13108 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13109 return -EOPNOTSUPP;
13110
13111 wiphy = &rdev->wiphy;
13112
13113 connect.bg_scan_period = -1;
13114 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
13115 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
13116 connect.bg_scan_period =
13117 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
13118 }
13119
13120 if (info->attrs[NL80211_ATTR_MAC])
13121 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13122 else if (info->attrs[NL80211_ATTR_MAC_HINT])
13123 connect.bssid_hint =
13124 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
13125 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13126 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13127
13128 if (info->attrs[NL80211_ATTR_IE]) {
13129 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13130 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13131 }
13132
13133 if (info->attrs[NL80211_ATTR_USE_MFP]) {
13134 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
13135 if (connect.mfp == NL80211_MFP_OPTIONAL &&
13136 !wiphy_ext_feature_isset(&rdev->wiphy,
13137 NL80211_EXT_FEATURE_MFP_OPTIONAL))
13138 return -EOPNOTSUPP;
13139 } else {
13140 connect.mfp = NL80211_MFP_NO;
13141 }
13142
13143 if (info->attrs[NL80211_ATTR_PREV_BSSID])
13144 connect.prev_bssid =
13145 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
13146
13147 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
13148 freq = MHZ_TO_KHZ(nla_get_u32(
13149 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
13150 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
13151 freq +=
13152 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
13153
13154 if (freq) {
13155 connect.channel = nl80211_get_valid_chan(wiphy, freq);
13156 if (!connect.channel)
13157 return -EINVAL;
13158 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
13159 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
13160 freq = MHZ_TO_KHZ(freq);
13161 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
13162 if (!connect.channel_hint)
13163 return -EINVAL;
13164 }
13165
13166 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
13167 connect.edmg.channels =
13168 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
13169
13170 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
13171 connect.edmg.bw_config =
13172 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
13173 }
13174
13175 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
13176 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
13177 if (IS_ERR(connkeys))
13178 return PTR_ERR(connkeys);
13179 }
13180
13181 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
13182 connect.flags |= ASSOC_REQ_DISABLE_HT;
13183
13184 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
13185 memcpy(&connect.ht_capa_mask,
13186 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
13187 sizeof(connect.ht_capa_mask));
13188
13189 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
13190 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
13191 kfree_sensitive(connkeys);
13192 return -EINVAL;
13193 }
13194 memcpy(&connect.ht_capa,
13195 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
13196 sizeof(connect.ht_capa));
13197 }
13198
13199 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
13200 connect.flags |= ASSOC_REQ_DISABLE_VHT;
13201
13202 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
13203 connect.flags |= ASSOC_REQ_DISABLE_HE;
13204
13205 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
13206 connect.flags |= ASSOC_REQ_DISABLE_EHT;
13207
13208 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
13209 memcpy(&connect.vht_capa_mask,
13210 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
13211 sizeof(connect.vht_capa_mask));
13212
13213 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
13214 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
13215 kfree_sensitive(connkeys);
13216 return -EINVAL;
13217 }
13218 memcpy(&connect.vht_capa,
13219 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
13220 sizeof(connect.vht_capa));
13221 }
13222
13223 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
13224 if (!((rdev->wiphy.features &
13225 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
13226 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
13227 !wiphy_ext_feature_isset(&rdev->wiphy,
13228 NL80211_EXT_FEATURE_RRM)) {
13229 kfree_sensitive(connkeys);
13230 return -EINVAL;
13231 }
13232 connect.flags |= ASSOC_REQ_USE_RRM;
13233 }
13234
13235 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
13236 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
13237 kfree_sensitive(connkeys);
13238 return -EOPNOTSUPP;
13239 }
13240
13241 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
13242 /* bss selection makes no sense if bssid is set */
13243 if (connect.bssid) {
13244 kfree_sensitive(connkeys);
13245 return -EINVAL;
13246 }
13247
13248 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
13249 wiphy, &connect.bss_select);
13250 if (err) {
13251 kfree_sensitive(connkeys);
13252 return err;
13253 }
13254 }
13255
13256 if (wiphy_ext_feature_isset(&rdev->wiphy,
13257 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
13258 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13259 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13260 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13261 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13262 connect.fils_erp_username =
13263 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13264 connect.fils_erp_username_len =
13265 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13266 connect.fils_erp_realm =
13267 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13268 connect.fils_erp_realm_len =
13269 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13270 connect.fils_erp_next_seq_num =
13271 nla_get_u16(
13272 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13273 connect.fils_erp_rrk =
13274 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13275 connect.fils_erp_rrk_len =
13276 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13277 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13278 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13279 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13280 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13281 kfree_sensitive(connkeys);
13282 return -EINVAL;
13283 }
13284
13285 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
13286 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13287 kfree_sensitive(connkeys);
13288 GENL_SET_ERR_MSG(info,
13289 "external auth requires connection ownership");
13290 return -EINVAL;
13291 }
13292 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
13293 }
13294
13295 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
13296 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
13297
13298 err = cfg80211_connect(rdev, dev, &connect, connkeys,
13299 connect.prev_bssid);
13300 if (err)
13301 kfree_sensitive(connkeys);
13302
13303 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13304 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13305 if (connect.bssid)
13306 memcpy(dev->ieee80211_ptr->disconnect_bssid,
13307 connect.bssid, ETH_ALEN);
13308 else
13309 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
13310 }
13311
13312 return err;
13313 }
13314
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)13315 static int nl80211_update_connect_params(struct sk_buff *skb,
13316 struct genl_info *info)
13317 {
13318 struct cfg80211_connect_params connect = {};
13319 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13320 struct net_device *dev = info->user_ptr[1];
13321 struct wireless_dev *wdev = dev->ieee80211_ptr;
13322 bool fils_sk_offload;
13323 u32 auth_type;
13324 u32 changed = 0;
13325
13326 if (!rdev->ops->update_connect_params)
13327 return -EOPNOTSUPP;
13328
13329 if (info->attrs[NL80211_ATTR_IE]) {
13330 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13331 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13332 changed |= UPDATE_ASSOC_IES;
13333 }
13334
13335 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
13336 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
13337
13338 /*
13339 * when driver supports fils-sk offload all attributes must be
13340 * provided. So the else covers "fils-sk-not-all" and
13341 * "no-fils-sk-any".
13342 */
13343 if (fils_sk_offload &&
13344 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13345 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13346 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13347 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13348 connect.fils_erp_username =
13349 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13350 connect.fils_erp_username_len =
13351 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13352 connect.fils_erp_realm =
13353 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13354 connect.fils_erp_realm_len =
13355 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13356 connect.fils_erp_next_seq_num =
13357 nla_get_u16(
13358 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13359 connect.fils_erp_rrk =
13360 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13361 connect.fils_erp_rrk_len =
13362 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13363 changed |= UPDATE_FILS_ERP_INFO;
13364 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13365 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13366 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13367 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13368 return -EINVAL;
13369 }
13370
13371 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13372 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13373 if (!nl80211_valid_auth_type(rdev, auth_type,
13374 NL80211_CMD_CONNECT))
13375 return -EINVAL;
13376
13377 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
13378 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
13379 return -EINVAL;
13380
13381 connect.auth_type = auth_type;
13382 changed |= UPDATE_AUTH_TYPE;
13383 }
13384
13385 if (!wdev->connected)
13386 return -ENOLINK;
13387
13388 return rdev_update_connect_params(rdev, dev, &connect, changed);
13389 }
13390
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)13391 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
13392 {
13393 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13394 struct net_device *dev = info->user_ptr[1];
13395 u16 reason;
13396
13397 if (dev->ieee80211_ptr->conn_owner_nlportid &&
13398 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
13399 return -EPERM;
13400
13401 reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
13402 WLAN_REASON_DEAUTH_LEAVING);
13403
13404 if (reason == 0)
13405 return -EINVAL;
13406
13407 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13408 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13409 return -EOPNOTSUPP;
13410
13411 return cfg80211_disconnect(rdev, dev, reason, true);
13412 }
13413
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)13414 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
13415 {
13416 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13417 struct net *net;
13418 int err;
13419
13420 if (info->attrs[NL80211_ATTR_PID]) {
13421 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
13422
13423 net = get_net_ns_by_pid(pid);
13424 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
13425 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
13426
13427 net = get_net_ns_by_fd(fd);
13428 } else {
13429 return -EINVAL;
13430 }
13431
13432 if (IS_ERR(net))
13433 return PTR_ERR(net);
13434
13435 err = 0;
13436
13437 /* check if anything to do */
13438 if (!net_eq(wiphy_net(&rdev->wiphy), net))
13439 err = cfg80211_switch_netns(rdev, net);
13440
13441 put_net(net);
13442 return err;
13443 }
13444
nl80211_set_pmksa(struct sk_buff * skb,struct genl_info * info)13445 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
13446 {
13447 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13448 struct net_device *dev = info->user_ptr[1];
13449 struct cfg80211_pmksa pmksa;
13450 bool ap_pmksa_caching_support = false;
13451
13452 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13453
13454 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13455 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13456
13457 if (!info->attrs[NL80211_ATTR_PMKID])
13458 return -EINVAL;
13459
13460 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13461
13462 if (info->attrs[NL80211_ATTR_MAC]) {
13463 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13464 } else if (info->attrs[NL80211_ATTR_SSID] &&
13465 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13466 info->attrs[NL80211_ATTR_PMK]) {
13467 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13468 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13469 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13470 } else {
13471 return -EINVAL;
13472 }
13473
13474 if (info->attrs[NL80211_ATTR_PMK]) {
13475 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13476 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13477 }
13478
13479 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
13480 pmksa.pmk_lifetime =
13481 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
13482
13483 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
13484 pmksa.pmk_reauth_threshold =
13485 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
13486
13487 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13488 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13489 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13490 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13491 ap_pmksa_caching_support))
13492 return -EOPNOTSUPP;
13493
13494 if (!rdev->ops->set_pmksa)
13495 return -EOPNOTSUPP;
13496
13497 return rdev_set_pmksa(rdev, dev, &pmksa);
13498 }
13499
nl80211_del_pmksa(struct sk_buff * skb,struct genl_info * info)13500 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
13501 {
13502 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13503 struct net_device *dev = info->user_ptr[1];
13504 struct cfg80211_pmksa pmksa;
13505 bool sae_offload_support = false;
13506 bool owe_offload_support = false;
13507 bool ap_pmksa_caching_support = false;
13508
13509 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13510
13511 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13512 NL80211_EXT_FEATURE_SAE_OFFLOAD);
13513 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13514 NL80211_EXT_FEATURE_OWE_OFFLOAD);
13515 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13516 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13517
13518 if (info->attrs[NL80211_ATTR_PMKID])
13519 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13520
13521 if (info->attrs[NL80211_ATTR_MAC]) {
13522 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13523 } else if (info->attrs[NL80211_ATTR_SSID]) {
13524 /* SSID based pmksa flush supported only for FILS,
13525 * OWE/SAE OFFLOAD cases
13526 */
13527 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13528 info->attrs[NL80211_ATTR_PMK]) {
13529 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13530 } else if (!sae_offload_support && !owe_offload_support) {
13531 return -EINVAL;
13532 }
13533 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13534 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13535 } else {
13536 return -EINVAL;
13537 }
13538
13539 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13540 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13541 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13542 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13543 ap_pmksa_caching_support))
13544 return -EOPNOTSUPP;
13545
13546 if (!rdev->ops->del_pmksa)
13547 return -EOPNOTSUPP;
13548
13549 return rdev_del_pmksa(rdev, dev, &pmksa);
13550 }
13551
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)13552 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
13553 {
13554 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13555 struct net_device *dev = info->user_ptr[1];
13556
13557 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13558 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13559 return -EOPNOTSUPP;
13560
13561 if (!rdev->ops->flush_pmksa)
13562 return -EOPNOTSUPP;
13563
13564 return rdev_flush_pmksa(rdev, dev);
13565 }
13566
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)13567 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
13568 {
13569 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13570 struct net_device *dev = info->user_ptr[1];
13571 u8 action_code, dialog_token;
13572 u32 peer_capability = 0;
13573 u16 status_code;
13574 u8 *peer;
13575 int link_id;
13576 bool initiator;
13577
13578 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13579 !rdev->ops->tdls_mgmt)
13580 return -EOPNOTSUPP;
13581
13582 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
13583 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
13584 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
13585 !info->attrs[NL80211_ATTR_IE] ||
13586 !info->attrs[NL80211_ATTR_MAC])
13587 return -EINVAL;
13588
13589 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13590 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
13591 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13592 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
13593 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
13594 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
13595 peer_capability =
13596 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
13597 link_id = nl80211_link_id_or_invalid(info->attrs);
13598
13599 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
13600 dialog_token, status_code, peer_capability,
13601 initiator,
13602 nla_data(info->attrs[NL80211_ATTR_IE]),
13603 nla_len(info->attrs[NL80211_ATTR_IE]));
13604 }
13605
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)13606 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
13607 {
13608 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13609 struct net_device *dev = info->user_ptr[1];
13610 enum nl80211_tdls_operation operation;
13611 u8 *peer;
13612
13613 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13614 !rdev->ops->tdls_oper)
13615 return -EOPNOTSUPP;
13616
13617 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
13618 !info->attrs[NL80211_ATTR_MAC])
13619 return -EINVAL;
13620
13621 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
13622 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13623
13624 return rdev_tdls_oper(rdev, dev, peer, operation);
13625 }
13626
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13627 static int nl80211_remain_on_channel(struct sk_buff *skb,
13628 struct genl_info *info)
13629 {
13630 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13631 unsigned int link_id = nl80211_link_id(info->attrs);
13632 struct wireless_dev *wdev = info->user_ptr[1];
13633 struct cfg80211_chan_def chandef;
13634 struct sk_buff *msg;
13635 void *hdr;
13636 u64 cookie;
13637 u32 duration;
13638 int err;
13639
13640 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
13641 !info->attrs[NL80211_ATTR_DURATION])
13642 return -EINVAL;
13643
13644 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13645
13646 if (!rdev->ops->remain_on_channel ||
13647 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
13648 return -EOPNOTSUPP;
13649
13650 /*
13651 * We should be on that channel for at least a minimum amount of
13652 * time (10ms) but no longer than the driver supports.
13653 */
13654 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13655 duration > rdev->wiphy.max_remain_on_channel_duration)
13656 return -EINVAL;
13657
13658 err = nl80211_parse_chandef(rdev, info, &chandef);
13659 if (err)
13660 return err;
13661
13662 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
13663 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
13664
13665 oper_chandef = wdev_chandef(wdev, link_id);
13666
13667 if (WARN_ON(!oper_chandef)) {
13668 /* cannot happen since we must beacon to get here */
13669 WARN_ON(1);
13670 return -EBUSY;
13671 }
13672
13673 /* note: returns first one if identical chandefs */
13674 compat_chandef = cfg80211_chandef_compatible(&chandef,
13675 oper_chandef);
13676
13677 if (compat_chandef != &chandef)
13678 return -EBUSY;
13679 }
13680
13681 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13682 if (!msg)
13683 return -ENOMEM;
13684
13685 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13686 NL80211_CMD_REMAIN_ON_CHANNEL);
13687 if (!hdr) {
13688 err = -ENOBUFS;
13689 goto free_msg;
13690 }
13691
13692 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
13693 duration, &cookie);
13694
13695 if (err)
13696 goto free_msg;
13697
13698 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13699 NL80211_ATTR_PAD))
13700 goto nla_put_failure;
13701
13702 genlmsg_end(msg, hdr);
13703
13704 return genlmsg_reply(msg, info);
13705
13706 nla_put_failure:
13707 err = -ENOBUFS;
13708 free_msg:
13709 nlmsg_free(msg);
13710 return err;
13711 }
13712
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)13713 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
13714 struct genl_info *info)
13715 {
13716 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13717 struct wireless_dev *wdev = info->user_ptr[1];
13718 u64 cookie;
13719
13720 if (!info->attrs[NL80211_ATTR_COOKIE])
13721 return -EINVAL;
13722
13723 if (!rdev->ops->cancel_remain_on_channel)
13724 return -EOPNOTSUPP;
13725
13726 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13727
13728 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
13729 }
13730
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)13731 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
13732 struct genl_info *info)
13733 {
13734 struct cfg80211_bitrate_mask mask;
13735 unsigned int link_id = nl80211_link_id(info->attrs);
13736 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13737 struct net_device *dev = info->user_ptr[1];
13738 int err;
13739
13740 if (!rdev->ops->set_bitrate_mask)
13741 return -EOPNOTSUPP;
13742
13743 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13744 NL80211_ATTR_TX_RATES, &mask,
13745 dev, true, link_id);
13746 if (err)
13747 return err;
13748
13749 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
13750 }
13751
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)13752 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
13753 {
13754 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13755 struct wireless_dev *wdev = info->user_ptr[1];
13756 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
13757
13758 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
13759 return -EINVAL;
13760
13761 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
13762 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
13763
13764 switch (wdev->iftype) {
13765 case NL80211_IFTYPE_STATION:
13766 case NL80211_IFTYPE_ADHOC:
13767 case NL80211_IFTYPE_P2P_CLIENT:
13768 case NL80211_IFTYPE_AP:
13769 case NL80211_IFTYPE_AP_VLAN:
13770 case NL80211_IFTYPE_MESH_POINT:
13771 case NL80211_IFTYPE_P2P_GO:
13772 case NL80211_IFTYPE_P2P_DEVICE:
13773 break;
13774 case NL80211_IFTYPE_NAN:
13775 if (!wiphy_ext_feature_isset(wdev->wiphy,
13776 NL80211_EXT_FEATURE_SECURE_NAN) &&
13777 !(wdev->wiphy->nan_capa.flags &
13778 WIPHY_NAN_FLAGS_USERSPACE_DE))
13779 return -EOPNOTSUPP;
13780 break;
13781 default:
13782 return -EOPNOTSUPP;
13783 }
13784
13785 /* not much point in registering if we can't reply */
13786 if (!rdev->ops->mgmt_tx)
13787 return -EOPNOTSUPP;
13788
13789 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
13790 !wiphy_ext_feature_isset(&rdev->wiphy,
13791 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
13792 GENL_SET_ERR_MSG(info,
13793 "multicast RX registrations are not supported");
13794 return -EOPNOTSUPP;
13795 }
13796
13797 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
13798 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13799 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13800 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
13801 info->extack);
13802 }
13803
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)13804 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
13805 {
13806 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13807 struct wireless_dev *wdev = info->user_ptr[1];
13808 struct cfg80211_chan_def chandef;
13809 int err;
13810 void *hdr = NULL;
13811 u64 cookie;
13812 struct sk_buff *msg = NULL;
13813 struct cfg80211_mgmt_tx_params params = {
13814 .dont_wait_for_ack =
13815 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
13816 };
13817
13818 if (!info->attrs[NL80211_ATTR_FRAME])
13819 return -EINVAL;
13820
13821 if (!rdev->ops->mgmt_tx)
13822 return -EOPNOTSUPP;
13823
13824 switch (wdev->iftype) {
13825 case NL80211_IFTYPE_P2P_DEVICE:
13826 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
13827 return -EINVAL;
13828 break;
13829 case NL80211_IFTYPE_STATION:
13830 case NL80211_IFTYPE_ADHOC:
13831 case NL80211_IFTYPE_P2P_CLIENT:
13832 case NL80211_IFTYPE_AP:
13833 case NL80211_IFTYPE_AP_VLAN:
13834 case NL80211_IFTYPE_MESH_POINT:
13835 case NL80211_IFTYPE_P2P_GO:
13836 break;
13837 case NL80211_IFTYPE_NAN:
13838 if (!wiphy_ext_feature_isset(wdev->wiphy,
13839 NL80211_EXT_FEATURE_SECURE_NAN) &&
13840 !(wdev->wiphy->nan_capa.flags &
13841 WIPHY_NAN_FLAGS_USERSPACE_DE))
13842 return -EOPNOTSUPP;
13843 break;
13844 default:
13845 return -EOPNOTSUPP;
13846 }
13847
13848 if (info->attrs[NL80211_ATTR_DURATION]) {
13849 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13850 return -EINVAL;
13851 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13852
13853 /*
13854 * We should wait on the channel for at least a minimum amount
13855 * of time (10ms) but no longer than the driver supports.
13856 */
13857 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13858 params.wait > rdev->wiphy.max_remain_on_channel_duration)
13859 return -EINVAL;
13860 }
13861
13862 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
13863
13864 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13865 return -EINVAL;
13866
13867 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
13868
13869 /* get the channel if any has been specified, otherwise pass NULL to
13870 * the driver. The latter will use the current one
13871 */
13872 chandef.chan = NULL;
13873 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13874 err = nl80211_parse_chandef(rdev, info, &chandef);
13875 if (err)
13876 return err;
13877 }
13878
13879 if (!chandef.chan && params.offchan)
13880 return -EINVAL;
13881
13882 if (params.offchan &&
13883 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
13884 return -EBUSY;
13885
13886 params.link_id = nl80211_link_id_or_invalid(info->attrs);
13887 /*
13888 * This now races due to the unlock, but we cannot check
13889 * the valid links for the _station_ anyway, so that's up
13890 * to the driver.
13891 */
13892 if (params.link_id >= 0 &&
13893 !(wdev->valid_links & BIT(params.link_id)))
13894 return -EINVAL;
13895
13896 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13897 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13898
13899 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
13900 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
13901 ¶ms.csa_offsets,
13902 ¶ms.n_csa_offsets);
13903 if (err)
13904 return err;
13905
13906 if (!params.dont_wait_for_ack) {
13907 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13908 if (!msg)
13909 return -ENOMEM;
13910
13911 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13912 NL80211_CMD_FRAME);
13913 if (!hdr) {
13914 err = -ENOBUFS;
13915 goto free_msg;
13916 }
13917 }
13918
13919 params.chan = chandef.chan;
13920 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
13921 if (err)
13922 goto free_msg;
13923
13924 if (msg) {
13925 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13926 NL80211_ATTR_PAD))
13927 goto nla_put_failure;
13928
13929 genlmsg_end(msg, hdr);
13930 return genlmsg_reply(msg, info);
13931 }
13932
13933 return 0;
13934
13935 nla_put_failure:
13936 err = -ENOBUFS;
13937 free_msg:
13938 nlmsg_free(msg);
13939 return err;
13940 }
13941
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)13942 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
13943 {
13944 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13945 struct wireless_dev *wdev = info->user_ptr[1];
13946 u64 cookie;
13947
13948 if (!info->attrs[NL80211_ATTR_COOKIE])
13949 return -EINVAL;
13950
13951 if (!rdev->ops->mgmt_tx_cancel_wait)
13952 return -EOPNOTSUPP;
13953
13954 switch (wdev->iftype) {
13955 case NL80211_IFTYPE_STATION:
13956 case NL80211_IFTYPE_ADHOC:
13957 case NL80211_IFTYPE_P2P_CLIENT:
13958 case NL80211_IFTYPE_AP:
13959 case NL80211_IFTYPE_AP_VLAN:
13960 case NL80211_IFTYPE_P2P_GO:
13961 case NL80211_IFTYPE_P2P_DEVICE:
13962 break;
13963 case NL80211_IFTYPE_NAN:
13964 if (!wiphy_ext_feature_isset(wdev->wiphy,
13965 NL80211_EXT_FEATURE_SECURE_NAN))
13966 return -EOPNOTSUPP;
13967 break;
13968 default:
13969 return -EOPNOTSUPP;
13970 }
13971
13972 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13973
13974 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
13975 }
13976
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)13977 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
13978 {
13979 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13980 struct wireless_dev *wdev;
13981 struct net_device *dev = info->user_ptr[1];
13982 u8 ps_state;
13983 bool state;
13984 int err;
13985
13986 if (!info->attrs[NL80211_ATTR_PS_STATE])
13987 return -EINVAL;
13988
13989 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
13990
13991 wdev = dev->ieee80211_ptr;
13992
13993 if (!rdev->ops->set_power_mgmt)
13994 return -EOPNOTSUPP;
13995
13996 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
13997
13998 if (state == wdev->ps)
13999 return 0;
14000
14001 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
14002 if (!err)
14003 wdev->ps = state;
14004 return err;
14005 }
14006
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)14007 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
14008 {
14009 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14010 enum nl80211_ps_state ps_state;
14011 struct wireless_dev *wdev;
14012 struct net_device *dev = info->user_ptr[1];
14013 struct sk_buff *msg;
14014 void *hdr;
14015 int err;
14016
14017 wdev = dev->ieee80211_ptr;
14018
14019 if (!rdev->ops->set_power_mgmt)
14020 return -EOPNOTSUPP;
14021
14022 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14023 if (!msg)
14024 return -ENOMEM;
14025
14026 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14027 NL80211_CMD_GET_POWER_SAVE);
14028 if (!hdr) {
14029 err = -ENOBUFS;
14030 goto free_msg;
14031 }
14032
14033 if (wdev->ps)
14034 ps_state = NL80211_PS_ENABLED;
14035 else
14036 ps_state = NL80211_PS_DISABLED;
14037
14038 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
14039 goto nla_put_failure;
14040
14041 genlmsg_end(msg, hdr);
14042 return genlmsg_reply(msg, info);
14043
14044 nla_put_failure:
14045 err = -ENOBUFS;
14046 free_msg:
14047 nlmsg_free(msg);
14048 return err;
14049 }
14050
14051 static const struct nla_policy
14052 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
14053 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
14054 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
14055 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
14056 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
14057 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
14058 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
14059 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
14060 };
14061
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)14062 static int nl80211_set_cqm_txe(struct genl_info *info,
14063 u32 rate, u32 pkts, u32 intvl)
14064 {
14065 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14066 struct net_device *dev = info->user_ptr[1];
14067 struct wireless_dev *wdev = dev->ieee80211_ptr;
14068
14069 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
14070 return -EINVAL;
14071
14072 if (!rdev->ops->set_cqm_txe_config)
14073 return -EOPNOTSUPP;
14074
14075 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14076 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14077 return -EOPNOTSUPP;
14078
14079 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
14080 }
14081
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)14082 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
14083 struct net_device *dev,
14084 struct cfg80211_cqm_config *cqm_config)
14085 {
14086 struct wireless_dev *wdev = dev->ieee80211_ptr;
14087 s32 last, low, high;
14088 u32 hyst;
14089 int i, n, low_index;
14090 int err;
14091
14092 /*
14093 * Obtain current RSSI value if possible, if not and no RSSI threshold
14094 * event has been received yet, we should receive an event after a
14095 * connection is established and enough beacons received to calculate
14096 * the average.
14097 */
14098 if (!cqm_config->last_rssi_event_value &&
14099 wdev->links[0].client.current_bss &&
14100 rdev->ops->get_station) {
14101 struct station_info sinfo = {};
14102 u8 *mac_addr;
14103
14104 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
14105
14106 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
14107 if (err)
14108 return err;
14109
14110 cfg80211_sinfo_release_content(&sinfo);
14111 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
14112 cqm_config->last_rssi_event_value =
14113 (s8) sinfo.rx_beacon_signal_avg;
14114 }
14115
14116 last = cqm_config->last_rssi_event_value;
14117 hyst = cqm_config->rssi_hyst;
14118 n = cqm_config->n_rssi_thresholds;
14119
14120 for (i = 0; i < n; i++) {
14121 i = array_index_nospec(i, n);
14122 if (last < cqm_config->rssi_thresholds[i])
14123 break;
14124 }
14125
14126 low_index = i - 1;
14127 if (low_index >= 0) {
14128 low_index = array_index_nospec(low_index, n);
14129 low = cqm_config->rssi_thresholds[low_index] - hyst;
14130 } else {
14131 low = S32_MIN;
14132 }
14133 if (i < n) {
14134 i = array_index_nospec(i, n);
14135 high = cqm_config->rssi_thresholds[i] + hyst - 1;
14136 } else {
14137 high = S32_MAX;
14138 }
14139
14140 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
14141 }
14142
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)14143 static int nl80211_set_cqm_rssi(struct genl_info *info,
14144 const s32 *thresholds, int n_thresholds,
14145 u32 hysteresis)
14146 {
14147 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14148 struct cfg80211_cqm_config *cqm_config = NULL, *old;
14149 struct net_device *dev = info->user_ptr[1];
14150 struct wireless_dev *wdev = dev->ieee80211_ptr;
14151 s32 prev = S32_MIN;
14152 int i, err;
14153
14154 /* Check all values negative and sorted */
14155 for (i = 0; i < n_thresholds; i++) {
14156 if (thresholds[i] > 0 || thresholds[i] <= prev)
14157 return -EINVAL;
14158
14159 prev = thresholds[i];
14160 }
14161
14162 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14163 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14164 return -EOPNOTSUPP;
14165
14166 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
14167 n_thresholds = 0;
14168
14169 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
14170
14171 /* if already disabled just succeed */
14172 if (!n_thresholds && !old)
14173 return 0;
14174
14175 if (n_thresholds > 1) {
14176 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14177 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
14178 !rdev->ops->set_cqm_rssi_range_config)
14179 return -EOPNOTSUPP;
14180 } else {
14181 if (!rdev->ops->set_cqm_rssi_config)
14182 return -EOPNOTSUPP;
14183 }
14184
14185 if (n_thresholds) {
14186 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
14187 n_thresholds),
14188 GFP_KERNEL);
14189 if (!cqm_config)
14190 return -ENOMEM;
14191
14192 cqm_config->rssi_hyst = hysteresis;
14193 cqm_config->n_rssi_thresholds = n_thresholds;
14194 memcpy(cqm_config->rssi_thresholds, thresholds,
14195 flex_array_size(cqm_config, rssi_thresholds,
14196 n_thresholds));
14197 cqm_config->use_range_api = n_thresholds > 1 ||
14198 !rdev->ops->set_cqm_rssi_config;
14199
14200 rcu_assign_pointer(wdev->cqm_config, cqm_config);
14201
14202 if (cqm_config->use_range_api)
14203 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
14204 else
14205 err = rdev_set_cqm_rssi_config(rdev, dev,
14206 thresholds[0],
14207 hysteresis);
14208 } else {
14209 RCU_INIT_POINTER(wdev->cqm_config, NULL);
14210 /* if enabled as range also disable via range */
14211 if (old->use_range_api)
14212 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
14213 else
14214 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
14215 }
14216
14217 if (err) {
14218 rcu_assign_pointer(wdev->cqm_config, old);
14219 kfree_rcu(cqm_config, rcu_head);
14220 } else {
14221 kfree_rcu(old, rcu_head);
14222 }
14223
14224 return err;
14225 }
14226
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)14227 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
14228 {
14229 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
14230 struct nlattr *cqm;
14231 int err;
14232
14233 cqm = info->attrs[NL80211_ATTR_CQM];
14234 if (!cqm)
14235 return -EINVAL;
14236
14237 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
14238 nl80211_attr_cqm_policy,
14239 info->extack);
14240 if (err)
14241 return err;
14242
14243 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
14244 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
14245 const s32 *thresholds =
14246 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14247 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14248 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
14249
14250 if (len % 4)
14251 return -EINVAL;
14252
14253 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
14254 hysteresis);
14255 }
14256
14257 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
14258 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
14259 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
14260 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
14261 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
14262 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
14263
14264 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
14265 }
14266
14267 return -EINVAL;
14268 }
14269
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)14270 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
14271 {
14272 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14273 struct net_device *dev = info->user_ptr[1];
14274 struct ocb_setup setup = {};
14275 int err;
14276
14277 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14278 if (err)
14279 return err;
14280
14281 return cfg80211_join_ocb(rdev, dev, &setup);
14282 }
14283
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)14284 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
14285 {
14286 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14287 struct net_device *dev = info->user_ptr[1];
14288
14289 return cfg80211_leave_ocb(rdev, dev);
14290 }
14291
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)14292 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
14293 {
14294 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14295 struct net_device *dev = info->user_ptr[1];
14296 struct mesh_config cfg;
14297 struct mesh_setup setup;
14298 int err;
14299
14300 /* start with default */
14301 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
14302 memcpy(&setup, &default_mesh_setup, sizeof(setup));
14303
14304 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
14305 /* and parse parameters if given */
14306 err = nl80211_parse_mesh_config(info, &cfg, NULL);
14307 if (err)
14308 return err;
14309 }
14310
14311 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
14312 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
14313 return -EINVAL;
14314
14315 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
14316 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
14317
14318 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
14319 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
14320 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
14321 return -EINVAL;
14322
14323 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
14324 setup.beacon_interval =
14325 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
14326
14327 err = cfg80211_validate_beacon_int(rdev,
14328 NL80211_IFTYPE_MESH_POINT,
14329 setup.beacon_interval);
14330 if (err)
14331 return err;
14332 }
14333
14334 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
14335 setup.dtim_period =
14336 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
14337 if (setup.dtim_period < 1 || setup.dtim_period > 100)
14338 return -EINVAL;
14339 }
14340
14341 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
14342 /* parse additional setup parameters if given */
14343 err = nl80211_parse_mesh_setup(info, &setup);
14344 if (err)
14345 return err;
14346 }
14347
14348 if (setup.user_mpm)
14349 cfg.auto_open_plinks = false;
14350
14351 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
14352 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14353 if (err)
14354 return err;
14355 } else {
14356 /* __cfg80211_join_mesh() will sort it out */
14357 setup.chandef.chan = NULL;
14358 }
14359
14360 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
14361 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14362 int n_rates =
14363 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14364 struct ieee80211_supported_band *sband;
14365
14366 if (!setup.chandef.chan)
14367 return -EINVAL;
14368
14369 sband = rdev->wiphy.bands[setup.chandef.chan->band];
14370
14371 err = ieee80211_get_ratemask(sband, rates, n_rates,
14372 &setup.basic_rates);
14373 if (err)
14374 return err;
14375 }
14376
14377 if (info->attrs[NL80211_ATTR_TX_RATES]) {
14378 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
14379 NL80211_ATTR_TX_RATES,
14380 &setup.beacon_rate,
14381 dev, false, 0);
14382 if (err)
14383 return err;
14384
14385 if (!setup.chandef.chan)
14386 return -EINVAL;
14387
14388 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
14389 &setup.beacon_rate);
14390 if (err)
14391 return err;
14392 }
14393
14394 setup.userspace_handles_dfs =
14395 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
14396
14397 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
14398 int r = validate_pae_over_nl80211(rdev, info);
14399
14400 if (r < 0)
14401 return r;
14402
14403 setup.control_port_over_nl80211 = true;
14404 }
14405
14406 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
14407 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
14408 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
14409
14410 return err;
14411 }
14412
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)14413 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
14414 {
14415 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14416 struct net_device *dev = info->user_ptr[1];
14417
14418 return cfg80211_leave_mesh(rdev, dev);
14419 }
14420
14421 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)14422 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
14423 struct cfg80211_registered_device *rdev)
14424 {
14425 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
14426 struct nlattr *nl_pats, *nl_pat;
14427 int i, pat_len;
14428
14429 if (!wowlan->n_patterns)
14430 return 0;
14431
14432 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
14433 if (!nl_pats)
14434 return -ENOBUFS;
14435
14436 for (i = 0; i < wowlan->n_patterns; i++) {
14437 nl_pat = nla_nest_start_noflag(msg, i + 1);
14438 if (!nl_pat)
14439 return -ENOBUFS;
14440 pat_len = wowlan->patterns[i].pattern_len;
14441 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
14442 wowlan->patterns[i].mask) ||
14443 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14444 wowlan->patterns[i].pattern) ||
14445 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14446 wowlan->patterns[i].pkt_offset))
14447 return -ENOBUFS;
14448 nla_nest_end(msg, nl_pat);
14449 }
14450 nla_nest_end(msg, nl_pats);
14451
14452 return 0;
14453 }
14454
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)14455 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
14456 struct cfg80211_wowlan_tcp *tcp)
14457 {
14458 struct nlattr *nl_tcp;
14459
14460 if (!tcp)
14461 return 0;
14462
14463 nl_tcp = nla_nest_start_noflag(msg,
14464 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
14465 if (!nl_tcp)
14466 return -ENOBUFS;
14467
14468 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
14469 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
14470 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
14471 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
14472 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
14473 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
14474 tcp->payload_len, tcp->payload) ||
14475 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
14476 tcp->data_interval) ||
14477 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
14478 tcp->wake_len, tcp->wake_data) ||
14479 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
14480 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
14481 return -ENOBUFS;
14482
14483 if (tcp->payload_seq.len &&
14484 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
14485 sizeof(tcp->payload_seq), &tcp->payload_seq))
14486 return -ENOBUFS;
14487
14488 if (tcp->payload_tok.len &&
14489 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
14490 sizeof(tcp->payload_tok) + tcp->tokens_size,
14491 &tcp->payload_tok))
14492 return -ENOBUFS;
14493
14494 nla_nest_end(msg, nl_tcp);
14495
14496 return 0;
14497 }
14498
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)14499 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
14500 struct cfg80211_sched_scan_request *req)
14501 {
14502 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
14503 int i;
14504
14505 if (!req)
14506 return 0;
14507
14508 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
14509 if (!nd)
14510 return -ENOBUFS;
14511
14512 if (req->n_scan_plans == 1 &&
14513 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
14514 req->scan_plans[0].interval * 1000))
14515 return -ENOBUFS;
14516
14517 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
14518 return -ENOBUFS;
14519
14520 if (req->relative_rssi_set) {
14521 struct nl80211_bss_select_rssi_adjust rssi_adjust;
14522
14523 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
14524 req->relative_rssi))
14525 return -ENOBUFS;
14526
14527 rssi_adjust.band = req->rssi_adjust.band;
14528 rssi_adjust.delta = req->rssi_adjust.delta;
14529 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
14530 sizeof(rssi_adjust), &rssi_adjust))
14531 return -ENOBUFS;
14532 }
14533
14534 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14535 if (!freqs)
14536 return -ENOBUFS;
14537
14538 for (i = 0; i < req->n_channels; i++) {
14539 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14540 return -ENOBUFS;
14541 }
14542
14543 nla_nest_end(msg, freqs);
14544
14545 if (req->n_match_sets) {
14546 matches = nla_nest_start_noflag(msg,
14547 NL80211_ATTR_SCHED_SCAN_MATCH);
14548 if (!matches)
14549 return -ENOBUFS;
14550
14551 for (i = 0; i < req->n_match_sets; i++) {
14552 match = nla_nest_start_noflag(msg, i);
14553 if (!match)
14554 return -ENOBUFS;
14555
14556 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
14557 req->match_sets[i].ssid.ssid_len,
14558 req->match_sets[i].ssid.ssid))
14559 return -ENOBUFS;
14560 nla_nest_end(msg, match);
14561 }
14562 nla_nest_end(msg, matches);
14563 }
14564
14565 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
14566 if (!scan_plans)
14567 return -ENOBUFS;
14568
14569 for (i = 0; i < req->n_scan_plans; i++) {
14570 scan_plan = nla_nest_start_noflag(msg, i + 1);
14571 if (!scan_plan)
14572 return -ENOBUFS;
14573
14574 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
14575 req->scan_plans[i].interval) ||
14576 (req->scan_plans[i].iterations &&
14577 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
14578 req->scan_plans[i].iterations)))
14579 return -ENOBUFS;
14580 nla_nest_end(msg, scan_plan);
14581 }
14582 nla_nest_end(msg, scan_plans);
14583
14584 nla_nest_end(msg, nd);
14585
14586 return 0;
14587 }
14588
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)14589 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
14590 {
14591 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14592 struct sk_buff *msg;
14593 void *hdr;
14594 u32 size = NLMSG_DEFAULT_SIZE;
14595
14596 if (!rdev->wiphy.wowlan)
14597 return -EOPNOTSUPP;
14598
14599 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
14600 /* adjust size to have room for all the data */
14601 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
14602 rdev->wiphy.wowlan_config->tcp->payload_len +
14603 rdev->wiphy.wowlan_config->tcp->wake_len +
14604 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
14605 }
14606
14607 msg = nlmsg_new(size, GFP_KERNEL);
14608 if (!msg)
14609 return -ENOMEM;
14610
14611 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14612 NL80211_CMD_GET_WOWLAN);
14613 if (!hdr)
14614 goto nla_put_failure;
14615
14616 if (rdev->wiphy.wowlan_config) {
14617 struct nlattr *nl_wowlan;
14618
14619 nl_wowlan = nla_nest_start_noflag(msg,
14620 NL80211_ATTR_WOWLAN_TRIGGERS);
14621 if (!nl_wowlan)
14622 goto nla_put_failure;
14623
14624 if ((rdev->wiphy.wowlan_config->any &&
14625 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
14626 (rdev->wiphy.wowlan_config->disconnect &&
14627 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
14628 (rdev->wiphy.wowlan_config->magic_pkt &&
14629 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
14630 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
14631 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
14632 (rdev->wiphy.wowlan_config->eap_identity_req &&
14633 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
14634 (rdev->wiphy.wowlan_config->four_way_handshake &&
14635 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
14636 (rdev->wiphy.wowlan_config->rfkill_release &&
14637 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
14638 goto nla_put_failure;
14639
14640 if (nl80211_send_wowlan_patterns(msg, rdev))
14641 goto nla_put_failure;
14642
14643 if (nl80211_send_wowlan_tcp(msg,
14644 rdev->wiphy.wowlan_config->tcp))
14645 goto nla_put_failure;
14646
14647 if (nl80211_send_wowlan_nd(
14648 msg,
14649 rdev->wiphy.wowlan_config->nd_config))
14650 goto nla_put_failure;
14651
14652 nla_nest_end(msg, nl_wowlan);
14653 }
14654
14655 genlmsg_end(msg, hdr);
14656 return genlmsg_reply(msg, info);
14657
14658 nla_put_failure:
14659 nlmsg_free(msg);
14660 return -ENOBUFS;
14661 }
14662
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)14663 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
14664 struct nlattr *attr,
14665 struct cfg80211_wowlan *trig)
14666 {
14667 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
14668 struct cfg80211_wowlan_tcp *cfg;
14669 struct nl80211_wowlan_tcp_data_token *tok = NULL;
14670 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
14671 u32 size;
14672 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
14673 int err, port;
14674
14675 if (!rdev->wiphy.wowlan->tcp)
14676 return -EINVAL;
14677
14678 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
14679 nl80211_wowlan_tcp_policy, NULL);
14680 if (err)
14681 return err;
14682
14683 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
14684 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
14685 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
14686 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
14687 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
14688 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
14689 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
14690 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
14691 return -EINVAL;
14692
14693 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
14694 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
14695 return -EINVAL;
14696
14697 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
14698 rdev->wiphy.wowlan->tcp->data_interval_max ||
14699 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
14700 return -EINVAL;
14701
14702 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
14703 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
14704 return -EINVAL;
14705
14706 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
14707 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
14708 return -EINVAL;
14709
14710 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
14711 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14712
14713 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14714 tokens_size = tokln - sizeof(*tok);
14715
14716 if (!tok->len || tokens_size % tok->len)
14717 return -EINVAL;
14718 if (!rdev->wiphy.wowlan->tcp->tok)
14719 return -EINVAL;
14720 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
14721 return -EINVAL;
14722 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
14723 return -EINVAL;
14724 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
14725 return -EINVAL;
14726 if (tok->offset + tok->len > data_size)
14727 return -EINVAL;
14728 }
14729
14730 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
14731 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
14732 if (!rdev->wiphy.wowlan->tcp->seq)
14733 return -EINVAL;
14734 if (seq->len == 0 || seq->len > 4)
14735 return -EINVAL;
14736 if (seq->len + seq->offset > data_size)
14737 return -EINVAL;
14738 }
14739
14740 size = sizeof(*cfg);
14741 size += data_size;
14742 size += wake_size + wake_mask_size;
14743 size += tokens_size;
14744
14745 cfg = kzalloc(size, GFP_KERNEL);
14746 if (!cfg)
14747 return -ENOMEM;
14748 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
14749 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
14750 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
14751 ETH_ALEN);
14752 port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
14753 #ifdef CONFIG_INET
14754 /* allocate a socket and port for it and use it */
14755 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
14756 IPPROTO_TCP, &cfg->sock, 1);
14757 if (err) {
14758 kfree(cfg);
14759 return err;
14760 }
14761 if (inet_csk_get_port(cfg->sock->sk, port)) {
14762 sock_release(cfg->sock);
14763 kfree(cfg);
14764 return -EADDRINUSE;
14765 }
14766 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
14767 #else
14768 if (!port) {
14769 kfree(cfg);
14770 return -EINVAL;
14771 }
14772 cfg->src_port = port;
14773 #endif
14774
14775 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
14776 cfg->payload_len = data_size;
14777 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
14778 memcpy((void *)cfg->payload,
14779 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
14780 data_size);
14781 if (seq)
14782 cfg->payload_seq = *seq;
14783 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
14784 cfg->wake_len = wake_size;
14785 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
14786 memcpy((void *)cfg->wake_data,
14787 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
14788 wake_size);
14789 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
14790 data_size + wake_size;
14791 memcpy((void *)cfg->wake_mask,
14792 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
14793 wake_mask_size);
14794 if (tok) {
14795 cfg->tokens_size = tokens_size;
14796 cfg->payload_tok = *tok;
14797 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
14798 tokens_size);
14799 }
14800
14801 trig->tcp = cfg;
14802
14803 return 0;
14804 }
14805
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)14806 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
14807 const struct wiphy_wowlan_support *wowlan,
14808 struct nlattr *attr,
14809 struct cfg80211_wowlan *trig)
14810 {
14811 struct nlattr **tb;
14812 int err;
14813
14814 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
14815 if (!tb)
14816 return -ENOMEM;
14817
14818 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
14819 err = -EOPNOTSUPP;
14820 goto out;
14821 }
14822
14823 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
14824 nl80211_policy, NULL);
14825 if (err)
14826 goto out;
14827
14828 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
14829 wowlan->max_nd_match_sets);
14830 err = PTR_ERR_OR_ZERO(trig->nd_config);
14831 if (err)
14832 trig->nd_config = NULL;
14833
14834 out:
14835 kfree(tb);
14836 return err;
14837 }
14838
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)14839 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
14840 {
14841 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14842 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
14843 struct cfg80211_wowlan new_triggers = {};
14844 struct cfg80211_wowlan *ntrig;
14845 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
14846 int err, i;
14847 bool prev_enabled = rdev->wiphy.wowlan_config;
14848 bool regular = false;
14849
14850 if (!wowlan)
14851 return -EOPNOTSUPP;
14852
14853 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
14854 cfg80211_rdev_free_wowlan(rdev);
14855 rdev->wiphy.wowlan_config = NULL;
14856 goto set_wakeup;
14857 }
14858
14859 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
14860 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
14861 nl80211_wowlan_policy, info->extack);
14862 if (err)
14863 return err;
14864
14865 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
14866 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
14867 return -EINVAL;
14868 new_triggers.any = true;
14869 }
14870
14871 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
14872 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
14873 return -EINVAL;
14874 new_triggers.disconnect = true;
14875 regular = true;
14876 }
14877
14878 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
14879 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
14880 return -EINVAL;
14881 new_triggers.magic_pkt = true;
14882 regular = true;
14883 }
14884
14885 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
14886 return -EINVAL;
14887
14888 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
14889 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
14890 return -EINVAL;
14891 new_triggers.gtk_rekey_failure = true;
14892 regular = true;
14893 }
14894
14895 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
14896 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
14897 return -EINVAL;
14898 new_triggers.eap_identity_req = true;
14899 regular = true;
14900 }
14901
14902 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
14903 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
14904 return -EINVAL;
14905 new_triggers.four_way_handshake = true;
14906 regular = true;
14907 }
14908
14909 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
14910 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
14911 return -EINVAL;
14912 new_triggers.rfkill_release = true;
14913 regular = true;
14914 }
14915
14916 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
14917 struct nlattr *pat;
14918 int n_patterns = 0;
14919 int rem, pat_len, mask_len, pkt_offset;
14920 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14921
14922 regular = true;
14923
14924 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14925 rem)
14926 n_patterns++;
14927 if (n_patterns > wowlan->n_patterns)
14928 return -EINVAL;
14929
14930 new_triggers.patterns = kcalloc(n_patterns,
14931 sizeof(new_triggers.patterns[0]),
14932 GFP_KERNEL);
14933 if (!new_triggers.patterns)
14934 return -ENOMEM;
14935
14936 new_triggers.n_patterns = n_patterns;
14937 i = 0;
14938
14939 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14940 rem) {
14941 u8 *mask_pat;
14942
14943 err = nla_parse_nested_deprecated(pat_tb,
14944 MAX_NL80211_PKTPAT,
14945 pat,
14946 nl80211_packet_pattern_policy,
14947 info->extack);
14948 if (err)
14949 goto error;
14950
14951 err = -EINVAL;
14952 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14953 !pat_tb[NL80211_PKTPAT_PATTERN])
14954 goto error;
14955 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14956 mask_len = DIV_ROUND_UP(pat_len, 8);
14957 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14958 goto error;
14959 if (pat_len > wowlan->pattern_max_len ||
14960 pat_len < wowlan->pattern_min_len)
14961 goto error;
14962
14963 pkt_offset =
14964 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14965 0);
14966 if (pkt_offset > wowlan->max_pkt_offset)
14967 goto error;
14968 new_triggers.patterns[i].pkt_offset = pkt_offset;
14969
14970 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14971 if (!mask_pat) {
14972 err = -ENOMEM;
14973 goto error;
14974 }
14975 new_triggers.patterns[i].mask = mask_pat;
14976 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14977 mask_len);
14978 mask_pat += mask_len;
14979 new_triggers.patterns[i].pattern = mask_pat;
14980 new_triggers.patterns[i].pattern_len = pat_len;
14981 memcpy(mask_pat,
14982 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14983 pat_len);
14984 i++;
14985 }
14986 }
14987
14988 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
14989 regular = true;
14990 err = nl80211_parse_wowlan_tcp(
14991 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
14992 &new_triggers);
14993 if (err)
14994 goto error;
14995 }
14996
14997 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
14998 regular = true;
14999 err = nl80211_parse_wowlan_nd(
15000 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
15001 &new_triggers);
15002 if (err)
15003 goto error;
15004 }
15005
15006 /* The 'any' trigger means the device continues operating more or less
15007 * as in its normal operation mode and wakes up the host on most of the
15008 * normal interrupts (like packet RX, ...)
15009 * It therefore makes little sense to combine with the more constrained
15010 * wakeup trigger modes.
15011 */
15012 if (new_triggers.any && regular) {
15013 err = -EINVAL;
15014 goto error;
15015 }
15016
15017 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
15018 if (!ntrig) {
15019 err = -ENOMEM;
15020 goto error;
15021 }
15022 cfg80211_rdev_free_wowlan(rdev);
15023 rdev->wiphy.wowlan_config = ntrig;
15024
15025 set_wakeup:
15026 if (rdev->ops->set_wakeup &&
15027 prev_enabled != !!rdev->wiphy.wowlan_config)
15028 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
15029
15030 return 0;
15031 error:
15032 for (i = 0; i < new_triggers.n_patterns; i++)
15033 kfree(new_triggers.patterns[i].mask);
15034 kfree(new_triggers.patterns);
15035 if (new_triggers.tcp && new_triggers.tcp->sock)
15036 sock_release(new_triggers.tcp->sock);
15037 kfree(new_triggers.tcp);
15038 kfree(new_triggers.nd_config);
15039 return err;
15040 }
15041 #endif
15042
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)15043 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
15044 struct cfg80211_registered_device *rdev)
15045 {
15046 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
15047 int i, j, pat_len;
15048 struct cfg80211_coalesce_rules *rule;
15049
15050 if (!rdev->coalesce->n_rules)
15051 return 0;
15052
15053 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
15054 if (!nl_rules)
15055 return -ENOBUFS;
15056
15057 for (i = 0; i < rdev->coalesce->n_rules; i++) {
15058 nl_rule = nla_nest_start_noflag(msg, i + 1);
15059 if (!nl_rule)
15060 return -ENOBUFS;
15061
15062 rule = &rdev->coalesce->rules[i];
15063 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
15064 rule->delay))
15065 return -ENOBUFS;
15066
15067 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
15068 rule->condition))
15069 return -ENOBUFS;
15070
15071 nl_pats = nla_nest_start_noflag(msg,
15072 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
15073 if (!nl_pats)
15074 return -ENOBUFS;
15075
15076 for (j = 0; j < rule->n_patterns; j++) {
15077 nl_pat = nla_nest_start_noflag(msg, j + 1);
15078 if (!nl_pat)
15079 return -ENOBUFS;
15080 pat_len = rule->patterns[j].pattern_len;
15081 if (nla_put(msg, NL80211_PKTPAT_MASK,
15082 DIV_ROUND_UP(pat_len, 8),
15083 rule->patterns[j].mask) ||
15084 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
15085 rule->patterns[j].pattern) ||
15086 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
15087 rule->patterns[j].pkt_offset))
15088 return -ENOBUFS;
15089 nla_nest_end(msg, nl_pat);
15090 }
15091 nla_nest_end(msg, nl_pats);
15092 nla_nest_end(msg, nl_rule);
15093 }
15094 nla_nest_end(msg, nl_rules);
15095
15096 return 0;
15097 }
15098
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)15099 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
15100 {
15101 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15102 struct sk_buff *msg;
15103 void *hdr;
15104
15105 if (!rdev->wiphy.coalesce)
15106 return -EOPNOTSUPP;
15107
15108 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15109 if (!msg)
15110 return -ENOMEM;
15111
15112 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15113 NL80211_CMD_GET_COALESCE);
15114 if (!hdr)
15115 goto nla_put_failure;
15116
15117 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
15118 goto nla_put_failure;
15119
15120 genlmsg_end(msg, hdr);
15121 return genlmsg_reply(msg, info);
15122
15123 nla_put_failure:
15124 nlmsg_free(msg);
15125 return -ENOBUFS;
15126 }
15127
cfg80211_free_coalesce(struct cfg80211_coalesce * coalesce)15128 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
15129 {
15130 int i, j;
15131 struct cfg80211_coalesce_rules *rule;
15132
15133 if (!coalesce)
15134 return;
15135
15136 for (i = 0; i < coalesce->n_rules; i++) {
15137 rule = &coalesce->rules[i];
15138 for (j = 0; j < rule->n_patterns; j++)
15139 kfree(rule->patterns[j].mask);
15140 kfree(rule->patterns);
15141 }
15142 kfree(coalesce);
15143 }
15144
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)15145 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
15146 struct nlattr *rule,
15147 struct cfg80211_coalesce_rules *new_rule)
15148 {
15149 int err, i;
15150 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15151 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
15152 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
15153 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
15154
15155 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
15156 rule, nl80211_coalesce_policy, NULL);
15157 if (err)
15158 return err;
15159
15160 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
15161 new_rule->delay =
15162 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
15163 if (new_rule->delay > coalesce->max_delay)
15164 return -EINVAL;
15165
15166 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
15167 new_rule->condition =
15168 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
15169
15170 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
15171 return -EINVAL;
15172
15173 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15174 rem)
15175 n_patterns++;
15176 if (n_patterns > coalesce->n_patterns)
15177 return -EINVAL;
15178
15179 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
15180 GFP_KERNEL);
15181 if (!new_rule->patterns)
15182 return -ENOMEM;
15183
15184 new_rule->n_patterns = n_patterns;
15185 i = 0;
15186
15187 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15188 rem) {
15189 u8 *mask_pat;
15190
15191 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
15192 pat,
15193 nl80211_packet_pattern_policy,
15194 NULL);
15195 if (err)
15196 return err;
15197
15198 if (!pat_tb[NL80211_PKTPAT_MASK] ||
15199 !pat_tb[NL80211_PKTPAT_PATTERN])
15200 return -EINVAL;
15201 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
15202 mask_len = DIV_ROUND_UP(pat_len, 8);
15203 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
15204 return -EINVAL;
15205 if (pat_len > coalesce->pattern_max_len ||
15206 pat_len < coalesce->pattern_min_len)
15207 return -EINVAL;
15208
15209 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
15210 0);
15211 if (pkt_offset > coalesce->max_pkt_offset)
15212 return -EINVAL;
15213 new_rule->patterns[i].pkt_offset = pkt_offset;
15214
15215 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
15216 if (!mask_pat)
15217 return -ENOMEM;
15218
15219 new_rule->patterns[i].mask = mask_pat;
15220 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
15221 mask_len);
15222
15223 mask_pat += mask_len;
15224 new_rule->patterns[i].pattern = mask_pat;
15225 new_rule->patterns[i].pattern_len = pat_len;
15226 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
15227 pat_len);
15228 i++;
15229 }
15230
15231 return 0;
15232 }
15233
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)15234 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
15235 {
15236 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15237 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15238 struct cfg80211_coalesce *new_coalesce;
15239 int err, rem_rule, n_rules = 0, i;
15240 struct nlattr *rule;
15241
15242 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
15243 return -EOPNOTSUPP;
15244
15245 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
15246 cfg80211_free_coalesce(rdev->coalesce);
15247 rdev->coalesce = NULL;
15248 rdev_set_coalesce(rdev, NULL);
15249 return 0;
15250 }
15251
15252 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15253 rem_rule)
15254 n_rules++;
15255 if (n_rules > coalesce->n_rules)
15256 return -EINVAL;
15257
15258 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
15259 GFP_KERNEL);
15260 if (!new_coalesce)
15261 return -ENOMEM;
15262
15263 new_coalesce->n_rules = n_rules;
15264 i = 0;
15265
15266 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15267 rem_rule) {
15268 err = nl80211_parse_coalesce_rule(rdev, rule,
15269 &new_coalesce->rules[i]);
15270 if (err)
15271 goto error;
15272
15273 i++;
15274 }
15275
15276 err = rdev_set_coalesce(rdev, new_coalesce);
15277 if (err)
15278 goto error;
15279
15280 cfg80211_free_coalesce(rdev->coalesce);
15281 rdev->coalesce = new_coalesce;
15282
15283 return 0;
15284 error:
15285 cfg80211_free_coalesce(new_coalesce);
15286
15287 return err;
15288 }
15289
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)15290 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
15291 {
15292 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15293 struct net_device *dev = info->user_ptr[1];
15294 struct wireless_dev *wdev = dev->ieee80211_ptr;
15295 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
15296 struct cfg80211_gtk_rekey_data rekey_data = {};
15297 int err;
15298
15299 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
15300 return -EINVAL;
15301
15302 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
15303 info->attrs[NL80211_ATTR_REKEY_DATA],
15304 nl80211_rekey_policy, info->extack);
15305 if (err)
15306 return err;
15307
15308 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
15309 !tb[NL80211_REKEY_DATA_KCK])
15310 return -EINVAL;
15311 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
15312 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15313 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
15314 return -ERANGE;
15315 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
15316 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15317 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
15318 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
15319 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
15320 return -ERANGE;
15321
15322 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
15323 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
15324 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
15325 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
15326 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
15327 if (tb[NL80211_REKEY_DATA_AKM])
15328 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
15329
15330 if (!wdev->connected)
15331 return -ENOTCONN;
15332
15333 if (!rdev->ops->set_rekey_data)
15334 return -EOPNOTSUPP;
15335
15336 return rdev_set_rekey_data(rdev, dev, &rekey_data);
15337 }
15338
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)15339 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
15340 struct genl_info *info)
15341 {
15342 struct net_device *dev = info->user_ptr[1];
15343 struct wireless_dev *wdev = dev->ieee80211_ptr;
15344
15345 if (wdev->iftype != NL80211_IFTYPE_AP &&
15346 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15347 return -EINVAL;
15348
15349 if (wdev->ap_unexpected_nlportid)
15350 return -EBUSY;
15351
15352 wdev->ap_unexpected_nlportid = info->snd_portid;
15353 return 0;
15354 }
15355
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)15356 static int nl80211_probe_client(struct sk_buff *skb,
15357 struct genl_info *info)
15358 {
15359 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15360 struct net_device *dev = info->user_ptr[1];
15361 struct wireless_dev *wdev = dev->ieee80211_ptr;
15362 struct sk_buff *msg;
15363 void *hdr;
15364 const u8 *addr;
15365 u64 cookie;
15366 int err;
15367
15368 if (wdev->iftype != NL80211_IFTYPE_AP &&
15369 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15370 return -EOPNOTSUPP;
15371
15372 if (!info->attrs[NL80211_ATTR_MAC])
15373 return -EINVAL;
15374
15375 if (!rdev->ops->probe_client)
15376 return -EOPNOTSUPP;
15377
15378 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15379 if (!msg)
15380 return -ENOMEM;
15381
15382 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15383 NL80211_CMD_PROBE_CLIENT);
15384 if (!hdr) {
15385 err = -ENOBUFS;
15386 goto free_msg;
15387 }
15388
15389 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15390
15391 err = rdev_probe_client(rdev, dev, addr, &cookie);
15392 if (err)
15393 goto free_msg;
15394
15395 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15396 NL80211_ATTR_PAD))
15397 goto nla_put_failure;
15398
15399 genlmsg_end(msg, hdr);
15400
15401 return genlmsg_reply(msg, info);
15402
15403 nla_put_failure:
15404 err = -ENOBUFS;
15405 free_msg:
15406 nlmsg_free(msg);
15407 return err;
15408 }
15409
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)15410 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
15411 {
15412 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15413 struct cfg80211_beacon_registration *reg, *nreg;
15414 int rv;
15415
15416 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
15417 return -EOPNOTSUPP;
15418
15419 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
15420 if (!nreg)
15421 return -ENOMEM;
15422
15423 /* First, check if already registered. */
15424 spin_lock_bh(&rdev->beacon_registrations_lock);
15425 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15426 if (reg->nlportid == info->snd_portid) {
15427 rv = -EALREADY;
15428 goto out_err;
15429 }
15430 }
15431 /* Add it to the list */
15432 nreg->nlportid = info->snd_portid;
15433 list_add(&nreg->list, &rdev->beacon_registrations);
15434
15435 spin_unlock_bh(&rdev->beacon_registrations_lock);
15436
15437 return 0;
15438 out_err:
15439 spin_unlock_bh(&rdev->beacon_registrations_lock);
15440 kfree(nreg);
15441 return rv;
15442 }
15443
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)15444 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
15445 {
15446 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15447 struct wireless_dev *wdev = info->user_ptr[1];
15448 int err;
15449
15450 if (!rdev->ops->start_p2p_device)
15451 return -EOPNOTSUPP;
15452
15453 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15454 return -EOPNOTSUPP;
15455
15456 if (wdev_running(wdev))
15457 return 0;
15458
15459 if (rfkill_blocked(rdev->wiphy.rfkill))
15460 return -ERFKILL;
15461
15462 err = rdev_start_p2p_device(rdev, wdev);
15463 if (err)
15464 return err;
15465
15466 wdev->is_running = true;
15467 rdev->opencount++;
15468
15469 return 0;
15470 }
15471
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)15472 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
15473 {
15474 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15475 struct wireless_dev *wdev = info->user_ptr[1];
15476
15477 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15478 return -EOPNOTSUPP;
15479
15480 if (!rdev->ops->stop_p2p_device)
15481 return -EOPNOTSUPP;
15482
15483 cfg80211_stop_p2p_device(rdev, wdev);
15484
15485 return 0;
15486 }
15487
nl80211_get_nan_channel(struct wiphy * wiphy,int freq)15488 static struct ieee80211_channel *nl80211_get_nan_channel(struct wiphy *wiphy,
15489 int freq)
15490 {
15491 struct ieee80211_channel *chan;
15492 struct cfg80211_chan_def def;
15493
15494 /* Check if the frequency is valid for NAN */
15495 if (freq != 5220 && freq != 5745 && freq != 2437)
15496 return NULL;
15497
15498 chan = ieee80211_get_channel(wiphy, freq);
15499 if (!chan)
15500 return NULL;
15501
15502 cfg80211_chandef_create(&def, chan, NL80211_CHAN_NO_HT);
15503
15504 /* Check if the channel is allowed */
15505 if (cfg80211_reg_can_beacon(wiphy, &def, NL80211_IFTYPE_NAN))
15506 return chan;
15507
15508 return NULL;
15509 }
15510
nl80211_parse_nan_band_config(struct wiphy * wiphy,struct nlattr ** tb,struct cfg80211_nan_band_config * cfg,enum nl80211_band band)15511 static int nl80211_parse_nan_band_config(struct wiphy *wiphy,
15512 struct nlattr **tb,
15513 struct cfg80211_nan_band_config *cfg,
15514 enum nl80211_band band)
15515 {
15516 if (BIT(band) & ~(u32)wiphy->nan_supported_bands)
15517 return -EINVAL;
15518
15519 if (tb[NL80211_NAN_BAND_CONF_FREQ]) {
15520 u16 freq = nla_get_u16(tb[NL80211_NAN_BAND_CONF_FREQ]);
15521
15522 if (band != NL80211_BAND_5GHZ)
15523 return -EINVAL;
15524
15525 cfg->chan = nl80211_get_nan_channel(wiphy, freq);
15526 if (!cfg->chan)
15527 return -EINVAL;
15528 }
15529
15530 if (tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]) {
15531 cfg->rssi_close =
15532 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]);
15533 if (!tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE])
15534 return -EINVAL;
15535 }
15536
15537 if (tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]) {
15538 cfg->rssi_middle =
15539 nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]);
15540 if (!cfg->rssi_close || cfg->rssi_middle >= cfg->rssi_close)
15541 return -EINVAL;
15542 }
15543
15544 if (tb[NL80211_NAN_BAND_CONF_WAKE_DW]) {
15545 cfg->awake_dw_interval =
15546 nla_get_u8(tb[NL80211_NAN_BAND_CONF_WAKE_DW]);
15547
15548 if (band == NL80211_BAND_2GHZ && cfg->awake_dw_interval == 0)
15549 return -EINVAL;
15550 }
15551
15552 cfg->disable_scan =
15553 nla_get_flag(tb[NL80211_NAN_BAND_CONF_DISABLE_SCAN]);
15554 return 0;
15555 }
15556
nl80211_parse_nan_conf(struct wiphy * wiphy,struct genl_info * info,struct cfg80211_nan_conf * conf,u32 * changed_flags)15557 static int nl80211_parse_nan_conf(struct wiphy *wiphy,
15558 struct genl_info *info,
15559 struct cfg80211_nan_conf *conf,
15560 u32 *changed_flags)
15561 {
15562 struct nlattr *attrs[NL80211_NAN_CONF_ATTR_MAX + 1];
15563 int err, rem;
15564 u32 changed = 0;
15565 struct nlattr *band_config;
15566
15567 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
15568 conf->master_pref =
15569 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
15570
15571 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
15572 }
15573
15574 if (info->attrs[NL80211_ATTR_BANDS]) {
15575 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
15576
15577 if (bands & ~(u32)wiphy->nan_supported_bands)
15578 return -EOPNOTSUPP;
15579
15580 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
15581 return -EINVAL;
15582
15583 conf->bands = bands;
15584 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
15585 }
15586
15587 conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval = 1;
15588 if (conf->bands & BIT(NL80211_BAND_5GHZ) || !conf->bands)
15589 conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval = 1;
15590
15591 /* On 2.4 GHz band use channel 6 */
15592 conf->band_cfgs[NL80211_BAND_2GHZ].chan =
15593 nl80211_get_nan_channel(wiphy, 2437);
15594 if (!conf->band_cfgs[NL80211_BAND_2GHZ].chan)
15595 return -EINVAL;
15596
15597 if (!info->attrs[NL80211_ATTR_NAN_CONFIG])
15598 goto out;
15599
15600 err = nla_parse_nested(attrs, NL80211_NAN_CONF_ATTR_MAX,
15601 info->attrs[NL80211_ATTR_NAN_CONFIG], NULL,
15602 info->extack);
15603 if (err)
15604 return err;
15605
15606 changed |= CFG80211_NAN_CONF_CHANGED_CONFIG;
15607 if (attrs[NL80211_NAN_CONF_CLUSTER_ID])
15608 conf->cluster_id =
15609 nla_data(attrs[NL80211_NAN_CONF_CLUSTER_ID]);
15610
15611 if (attrs[NL80211_NAN_CONF_EXTRA_ATTRS]) {
15612 conf->extra_nan_attrs =
15613 nla_data(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15614 conf->extra_nan_attrs_len =
15615 nla_len(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15616 }
15617
15618 if (attrs[NL80211_NAN_CONF_VENDOR_ELEMS]) {
15619 conf->vendor_elems =
15620 nla_data(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15621 conf->vendor_elems_len =
15622 nla_len(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15623 }
15624
15625 if (attrs[NL80211_NAN_CONF_BAND_CONFIGS]) {
15626 nla_for_each_nested(band_config,
15627 attrs[NL80211_NAN_CONF_BAND_CONFIGS],
15628 rem) {
15629 enum nl80211_band band;
15630 struct cfg80211_nan_band_config *cfg;
15631 struct nlattr *tb[NL80211_NAN_BAND_CONF_ATTR_MAX + 1];
15632
15633 err = nla_parse_nested(tb,
15634 NL80211_NAN_BAND_CONF_ATTR_MAX,
15635 band_config, NULL,
15636 info->extack);
15637 if (err)
15638 return err;
15639
15640 if (!tb[NL80211_NAN_BAND_CONF_BAND])
15641 return -EINVAL;
15642
15643 band = nla_get_u8(tb[NL80211_NAN_BAND_CONF_BAND]);
15644 if (conf->bands && !(conf->bands & BIT(band)))
15645 return -EINVAL;
15646
15647 cfg = &conf->band_cfgs[band];
15648
15649 err = nl80211_parse_nan_band_config(wiphy, tb, cfg,
15650 band);
15651 if (err)
15652 return err;
15653 }
15654 }
15655
15656 if (attrs[NL80211_NAN_CONF_SCAN_PERIOD])
15657 conf->scan_period =
15658 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_PERIOD]);
15659
15660 if (attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME])
15661 conf->scan_dwell_time =
15662 nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME]);
15663
15664 if (attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL])
15665 conf->discovery_beacon_interval =
15666 nla_get_u8(attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL]);
15667
15668 if (attrs[NL80211_NAN_CONF_NOTIFY_DW])
15669 conf->enable_dw_notification =
15670 nla_get_flag(attrs[NL80211_NAN_CONF_NOTIFY_DW]);
15671
15672 out:
15673 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15674 (!conf->bands || conf->bands & BIT(NL80211_BAND_5GHZ))) {
15675 /* If no 5GHz channel is specified use default, if possible */
15676 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15677 nl80211_get_nan_channel(wiphy, 5745);
15678 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan)
15679 conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15680 nl80211_get_nan_channel(wiphy, 5220);
15681
15682 /* Return error if user space asked explicitly for 5 GHz */
15683 if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15684 conf->bands & BIT(NL80211_BAND_5GHZ)) {
15685 NL_SET_ERR_MSG_ATTR(info->extack,
15686 info->attrs[NL80211_ATTR_BANDS],
15687 "5 GHz band operation is not allowed");
15688 return -EINVAL;
15689 }
15690 }
15691
15692 if (changed_flags)
15693 *changed_flags = changed;
15694
15695 return 0;
15696 }
15697
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)15698 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
15699 {
15700 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15701 struct wireless_dev *wdev = info->user_ptr[1];
15702 struct cfg80211_nan_conf conf = {};
15703 int err;
15704
15705 if (wdev->iftype != NL80211_IFTYPE_NAN)
15706 return -EOPNOTSUPP;
15707
15708 if (wdev_running(wdev))
15709 return -EEXIST;
15710
15711 if (rfkill_blocked(rdev->wiphy.rfkill))
15712 return -ERFKILL;
15713
15714 /* Master preference is mandatory for START_NAN */
15715 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
15716 return -EINVAL;
15717
15718 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, NULL);
15719 if (err)
15720 return err;
15721
15722 err = rdev_start_nan(rdev, wdev, &conf);
15723 if (err)
15724 return err;
15725
15726 wdev->is_running = true;
15727 rdev->opencount++;
15728
15729 return 0;
15730 }
15731
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)15732 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
15733 {
15734 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15735 struct wireless_dev *wdev = info->user_ptr[1];
15736
15737 if (wdev->iftype != NL80211_IFTYPE_NAN)
15738 return -EOPNOTSUPP;
15739
15740 cfg80211_stop_nan(rdev, wdev);
15741
15742 return 0;
15743 }
15744
validate_nan_filter(struct nlattr * filter_attr)15745 static int validate_nan_filter(struct nlattr *filter_attr)
15746 {
15747 struct nlattr *attr;
15748 int len = 0, n_entries = 0, rem;
15749
15750 nla_for_each_nested(attr, filter_attr, rem) {
15751 len += nla_len(attr);
15752 n_entries++;
15753 }
15754
15755 if (len >= U8_MAX)
15756 return -EINVAL;
15757
15758 return n_entries;
15759 }
15760
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)15761 static int handle_nan_filter(struct nlattr *attr_filter,
15762 struct cfg80211_nan_func *func,
15763 bool tx)
15764 {
15765 struct nlattr *attr;
15766 int n_entries, rem, i;
15767 struct cfg80211_nan_func_filter *filter;
15768
15769 n_entries = validate_nan_filter(attr_filter);
15770 if (n_entries < 0)
15771 return n_entries;
15772
15773 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
15774
15775 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
15776 if (!filter)
15777 return -ENOMEM;
15778
15779 i = 0;
15780 nla_for_each_nested(attr, attr_filter, rem) {
15781 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
15782 if (!filter[i].filter)
15783 goto err;
15784
15785 filter[i].len = nla_len(attr);
15786 i++;
15787 }
15788 if (tx) {
15789 func->num_tx_filters = n_entries;
15790 func->tx_filters = filter;
15791 } else {
15792 func->num_rx_filters = n_entries;
15793 func->rx_filters = filter;
15794 }
15795
15796 return 0;
15797
15798 err:
15799 i = 0;
15800 nla_for_each_nested(attr, attr_filter, rem) {
15801 kfree(filter[i].filter);
15802 i++;
15803 }
15804 kfree(filter);
15805 return -ENOMEM;
15806 }
15807
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)15808 static int nl80211_nan_add_func(struct sk_buff *skb,
15809 struct genl_info *info)
15810 {
15811 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15812 struct wireless_dev *wdev = info->user_ptr[1];
15813 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
15814 struct cfg80211_nan_func *func;
15815 struct sk_buff *msg = NULL;
15816 void *hdr = NULL;
15817 int err = 0;
15818
15819 if (wdev->iftype != NL80211_IFTYPE_NAN)
15820 return -EOPNOTSUPP;
15821
15822 if (!wdev_running(wdev))
15823 return -ENOTCONN;
15824
15825 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
15826 return -EINVAL;
15827
15828 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
15829 info->attrs[NL80211_ATTR_NAN_FUNC],
15830 nl80211_nan_func_policy,
15831 info->extack);
15832 if (err)
15833 return err;
15834
15835 func = kzalloc(sizeof(*func), GFP_KERNEL);
15836 if (!func)
15837 return -ENOMEM;
15838
15839 func->cookie = cfg80211_assign_cookie(rdev);
15840
15841 if (!tb[NL80211_NAN_FUNC_TYPE]) {
15842 err = -EINVAL;
15843 goto out;
15844 }
15845
15846
15847 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
15848
15849 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
15850 err = -EINVAL;
15851 goto out;
15852 }
15853
15854 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
15855 sizeof(func->service_id));
15856
15857 func->close_range =
15858 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
15859
15860 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
15861 func->serv_spec_info_len =
15862 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
15863 func->serv_spec_info =
15864 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
15865 func->serv_spec_info_len,
15866 GFP_KERNEL);
15867 if (!func->serv_spec_info) {
15868 err = -ENOMEM;
15869 goto out;
15870 }
15871 }
15872
15873 if (tb[NL80211_NAN_FUNC_TTL])
15874 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
15875
15876 switch (func->type) {
15877 case NL80211_NAN_FUNC_PUBLISH:
15878 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
15879 err = -EINVAL;
15880 goto out;
15881 }
15882
15883 func->publish_type =
15884 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
15885 func->publish_bcast =
15886 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
15887
15888 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
15889 func->publish_bcast) {
15890 err = -EINVAL;
15891 goto out;
15892 }
15893 break;
15894 case NL80211_NAN_FUNC_SUBSCRIBE:
15895 func->subscribe_active =
15896 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
15897 break;
15898 case NL80211_NAN_FUNC_FOLLOW_UP:
15899 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
15900 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
15901 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
15902 err = -EINVAL;
15903 goto out;
15904 }
15905
15906 func->followup_id =
15907 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
15908 func->followup_reqid =
15909 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
15910 memcpy(func->followup_dest.addr,
15911 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
15912 sizeof(func->followup_dest.addr));
15913 if (func->ttl) {
15914 err = -EINVAL;
15915 goto out;
15916 }
15917 break;
15918 default:
15919 err = -EINVAL;
15920 goto out;
15921 }
15922
15923 if (tb[NL80211_NAN_FUNC_SRF]) {
15924 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
15925
15926 err = nla_parse_nested_deprecated(srf_tb,
15927 NL80211_NAN_SRF_ATTR_MAX,
15928 tb[NL80211_NAN_FUNC_SRF],
15929 nl80211_nan_srf_policy,
15930 info->extack);
15931 if (err)
15932 goto out;
15933
15934 func->srf_include =
15935 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
15936
15937 if (srf_tb[NL80211_NAN_SRF_BF]) {
15938 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
15939 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
15940 err = -EINVAL;
15941 goto out;
15942 }
15943
15944 func->srf_bf_len =
15945 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
15946 func->srf_bf =
15947 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
15948 func->srf_bf_len, GFP_KERNEL);
15949 if (!func->srf_bf) {
15950 err = -ENOMEM;
15951 goto out;
15952 }
15953
15954 func->srf_bf_idx =
15955 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
15956 } else {
15957 struct nlattr *attr, *mac_attr =
15958 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
15959 int n_entries, rem, i = 0;
15960
15961 if (!mac_attr) {
15962 err = -EINVAL;
15963 goto out;
15964 }
15965
15966 n_entries = validate_acl_mac_addrs(mac_attr);
15967 if (n_entries <= 0) {
15968 err = -EINVAL;
15969 goto out;
15970 }
15971
15972 func->srf_num_macs = n_entries;
15973 func->srf_macs =
15974 kcalloc(n_entries, sizeof(*func->srf_macs),
15975 GFP_KERNEL);
15976 if (!func->srf_macs) {
15977 err = -ENOMEM;
15978 goto out;
15979 }
15980
15981 nla_for_each_nested(attr, mac_attr, rem)
15982 memcpy(func->srf_macs[i++].addr, nla_data(attr),
15983 sizeof(*func->srf_macs));
15984 }
15985 }
15986
15987 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
15988 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
15989 func, true);
15990 if (err)
15991 goto out;
15992 }
15993
15994 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
15995 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
15996 func, false);
15997 if (err)
15998 goto out;
15999 }
16000
16001 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16002 if (!msg) {
16003 err = -ENOMEM;
16004 goto out;
16005 }
16006
16007 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16008 NL80211_CMD_ADD_NAN_FUNCTION);
16009 /* This can't really happen - we just allocated 4KB */
16010 if (WARN_ON(!hdr)) {
16011 err = -ENOMEM;
16012 goto out;
16013 }
16014
16015 err = rdev_add_nan_func(rdev, wdev, func);
16016 out:
16017 if (err < 0) {
16018 cfg80211_free_nan_func(func);
16019 nlmsg_free(msg);
16020 return err;
16021 }
16022
16023 /* propagate the instance id and cookie to userspace */
16024 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
16025 NL80211_ATTR_PAD))
16026 goto nla_put_failure;
16027
16028 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16029 if (!func_attr)
16030 goto nla_put_failure;
16031
16032 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
16033 func->instance_id))
16034 goto nla_put_failure;
16035
16036 nla_nest_end(msg, func_attr);
16037
16038 genlmsg_end(msg, hdr);
16039 return genlmsg_reply(msg, info);
16040
16041 nla_put_failure:
16042 nlmsg_free(msg);
16043 return -ENOBUFS;
16044 }
16045
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)16046 static int nl80211_nan_del_func(struct sk_buff *skb,
16047 struct genl_info *info)
16048 {
16049 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16050 struct wireless_dev *wdev = info->user_ptr[1];
16051 u64 cookie;
16052
16053 if (wdev->iftype != NL80211_IFTYPE_NAN)
16054 return -EOPNOTSUPP;
16055
16056 if (!wdev_running(wdev))
16057 return -ENOTCONN;
16058
16059 if (!info->attrs[NL80211_ATTR_COOKIE])
16060 return -EINVAL;
16061
16062 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
16063
16064 rdev_del_nan_func(rdev, wdev, cookie);
16065
16066 return 0;
16067 }
16068
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)16069 static int nl80211_nan_change_config(struct sk_buff *skb,
16070 struct genl_info *info)
16071 {
16072 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16073 struct wireless_dev *wdev = info->user_ptr[1];
16074 struct cfg80211_nan_conf conf = {};
16075 u32 changed = 0;
16076 int err;
16077
16078 if (wdev->iftype != NL80211_IFTYPE_NAN)
16079 return -EOPNOTSUPP;
16080
16081 if (!wdev_running(wdev))
16082 return -ENOTCONN;
16083
16084 err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, &changed);
16085 if (err)
16086 return err;
16087
16088 if (!changed)
16089 return -EINVAL;
16090
16091 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
16092 }
16093
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)16094 void cfg80211_nan_match(struct wireless_dev *wdev,
16095 struct cfg80211_nan_match_params *match, gfp_t gfp)
16096 {
16097 struct wiphy *wiphy = wdev->wiphy;
16098 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16099 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
16100 struct sk_buff *msg;
16101 void *hdr;
16102
16103 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
16104 return;
16105
16106 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16107 if (!msg)
16108 return;
16109
16110 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
16111 if (!hdr) {
16112 nlmsg_free(msg);
16113 return;
16114 }
16115
16116 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16117 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16118 wdev->netdev->ifindex)) ||
16119 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16120 NL80211_ATTR_PAD))
16121 goto nla_put_failure;
16122
16123 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
16124 NL80211_ATTR_PAD) ||
16125 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
16126 goto nla_put_failure;
16127
16128 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
16129 if (!match_attr)
16130 goto nla_put_failure;
16131
16132 local_func_attr = nla_nest_start_noflag(msg,
16133 NL80211_NAN_MATCH_FUNC_LOCAL);
16134 if (!local_func_attr)
16135 goto nla_put_failure;
16136
16137 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
16138 goto nla_put_failure;
16139
16140 nla_nest_end(msg, local_func_attr);
16141
16142 peer_func_attr = nla_nest_start_noflag(msg,
16143 NL80211_NAN_MATCH_FUNC_PEER);
16144 if (!peer_func_attr)
16145 goto nla_put_failure;
16146
16147 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
16148 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
16149 goto nla_put_failure;
16150
16151 if (match->info && match->info_len &&
16152 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
16153 match->info))
16154 goto nla_put_failure;
16155
16156 nla_nest_end(msg, peer_func_attr);
16157 nla_nest_end(msg, match_attr);
16158 genlmsg_end(msg, hdr);
16159
16160 if (!wdev->owner_nlportid)
16161 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16162 msg, 0, NL80211_MCGRP_NAN, gfp);
16163 else
16164 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16165 wdev->owner_nlportid);
16166
16167 return;
16168
16169 nla_put_failure:
16170 nlmsg_free(msg);
16171 }
16172 EXPORT_SYMBOL(cfg80211_nan_match);
16173
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)16174 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
16175 u8 inst_id,
16176 enum nl80211_nan_func_term_reason reason,
16177 u64 cookie, gfp_t gfp)
16178 {
16179 struct wiphy *wiphy = wdev->wiphy;
16180 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16181 struct sk_buff *msg;
16182 struct nlattr *func_attr;
16183 void *hdr;
16184
16185 if (WARN_ON(!inst_id))
16186 return;
16187
16188 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16189 if (!msg)
16190 return;
16191
16192 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
16193 if (!hdr) {
16194 nlmsg_free(msg);
16195 return;
16196 }
16197
16198 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16199 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16200 wdev->netdev->ifindex)) ||
16201 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16202 NL80211_ATTR_PAD))
16203 goto nla_put_failure;
16204
16205 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16206 NL80211_ATTR_PAD))
16207 goto nla_put_failure;
16208
16209 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16210 if (!func_attr)
16211 goto nla_put_failure;
16212
16213 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
16214 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
16215 goto nla_put_failure;
16216
16217 nla_nest_end(msg, func_attr);
16218 genlmsg_end(msg, hdr);
16219
16220 if (!wdev->owner_nlportid)
16221 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16222 msg, 0, NL80211_MCGRP_NAN, gfp);
16223 else
16224 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16225 wdev->owner_nlportid);
16226
16227 return;
16228
16229 nla_put_failure:
16230 nlmsg_free(msg);
16231 }
16232 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
16233
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)16234 static int nl80211_get_protocol_features(struct sk_buff *skb,
16235 struct genl_info *info)
16236 {
16237 void *hdr;
16238 struct sk_buff *msg;
16239
16240 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16241 if (!msg)
16242 return -ENOMEM;
16243
16244 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16245 NL80211_CMD_GET_PROTOCOL_FEATURES);
16246 if (!hdr)
16247 goto nla_put_failure;
16248
16249 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
16250 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
16251 goto nla_put_failure;
16252
16253 genlmsg_end(msg, hdr);
16254 return genlmsg_reply(msg, info);
16255
16256 nla_put_failure:
16257 kfree_skb(msg);
16258 return -ENOBUFS;
16259 }
16260
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)16261 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
16262 {
16263 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16264 struct cfg80211_update_ft_ies_params ft_params;
16265 struct net_device *dev = info->user_ptr[1];
16266
16267 if (!rdev->ops->update_ft_ies)
16268 return -EOPNOTSUPP;
16269
16270 if (!info->attrs[NL80211_ATTR_MDID] ||
16271 !info->attrs[NL80211_ATTR_IE])
16272 return -EINVAL;
16273
16274 memset(&ft_params, 0, sizeof(ft_params));
16275 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
16276 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
16277 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
16278
16279 return rdev_update_ft_ies(rdev, dev, &ft_params);
16280 }
16281
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)16282 static int nl80211_crit_protocol_start(struct sk_buff *skb,
16283 struct genl_info *info)
16284 {
16285 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16286 struct wireless_dev *wdev = info->user_ptr[1];
16287 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
16288 u16 duration;
16289 int ret;
16290
16291 if (!rdev->ops->crit_proto_start)
16292 return -EOPNOTSUPP;
16293
16294 if (WARN_ON(!rdev->ops->crit_proto_stop))
16295 return -EINVAL;
16296
16297 if (rdev->crit_proto_nlportid)
16298 return -EBUSY;
16299
16300 /* determine protocol if provided */
16301 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
16302 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
16303
16304 if (proto >= NUM_NL80211_CRIT_PROTO)
16305 return -EINVAL;
16306
16307 /* timeout must be provided */
16308 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
16309 return -EINVAL;
16310
16311 duration =
16312 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
16313
16314 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
16315 if (!ret)
16316 rdev->crit_proto_nlportid = info->snd_portid;
16317
16318 return ret;
16319 }
16320
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)16321 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
16322 struct genl_info *info)
16323 {
16324 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16325 struct wireless_dev *wdev = info->user_ptr[1];
16326
16327 if (!rdev->ops->crit_proto_stop)
16328 return -EOPNOTSUPP;
16329
16330 if (rdev->crit_proto_nlportid) {
16331 rdev->crit_proto_nlportid = 0;
16332 rdev_crit_proto_stop(rdev, wdev);
16333 }
16334 return 0;
16335 }
16336
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)16337 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
16338 struct nlattr *attr,
16339 struct netlink_ext_ack *extack)
16340 {
16341 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
16342 if (attr->nla_type & NLA_F_NESTED) {
16343 NL_SET_ERR_MSG_ATTR(extack, attr,
16344 "unexpected nested data");
16345 return -EINVAL;
16346 }
16347
16348 return 0;
16349 }
16350
16351 if (!(attr->nla_type & NLA_F_NESTED)) {
16352 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
16353 return -EINVAL;
16354 }
16355
16356 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
16357 }
16358
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)16359 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
16360 {
16361 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16362 struct wireless_dev *wdev =
16363 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
16364 info->attrs);
16365 int i, err;
16366 u32 vid, subcmd;
16367
16368 if (!rdev->wiphy.vendor_commands)
16369 return -EOPNOTSUPP;
16370
16371 if (IS_ERR(wdev)) {
16372 err = PTR_ERR(wdev);
16373 if (err != -EINVAL)
16374 return err;
16375 wdev = NULL;
16376 } else if (wdev->wiphy != &rdev->wiphy) {
16377 return -EINVAL;
16378 }
16379
16380 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
16381 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
16382 return -EINVAL;
16383
16384 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
16385 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
16386 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
16387 const struct wiphy_vendor_command *vcmd;
16388 void *data = NULL;
16389 int len = 0;
16390
16391 vcmd = &rdev->wiphy.vendor_commands[i];
16392
16393 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16394 continue;
16395
16396 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16397 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16398 if (!wdev)
16399 return -EINVAL;
16400 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16401 !wdev->netdev)
16402 return -EINVAL;
16403
16404 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16405 if (!wdev_running(wdev))
16406 return -ENETDOWN;
16407 }
16408 } else {
16409 wdev = NULL;
16410 }
16411
16412 if (!vcmd->doit)
16413 return -EOPNOTSUPP;
16414
16415 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
16416 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16417 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16418
16419 err = nl80211_vendor_check_policy(vcmd,
16420 info->attrs[NL80211_ATTR_VENDOR_DATA],
16421 info->extack);
16422 if (err)
16423 return err;
16424 }
16425
16426 rdev->cur_cmd_info = info;
16427 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
16428 rdev->cur_cmd_info = NULL;
16429 return err;
16430 }
16431
16432 return -EOPNOTSUPP;
16433 }
16434
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)16435 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
16436 struct netlink_callback *cb,
16437 struct cfg80211_registered_device **rdev,
16438 struct wireless_dev **wdev)
16439 {
16440 struct nlattr **attrbuf;
16441 u32 vid, subcmd;
16442 unsigned int i;
16443 int vcmd_idx = -1;
16444 int err;
16445 void *data = NULL;
16446 unsigned int data_len = 0;
16447
16448 if (cb->args[0]) {
16449 /* subtract the 1 again here */
16450 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
16451 struct wireless_dev *tmp;
16452
16453 if (!wiphy)
16454 return -ENODEV;
16455 *rdev = wiphy_to_rdev(wiphy);
16456 *wdev = NULL;
16457
16458 if (cb->args[1]) {
16459 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
16460 if (tmp->identifier == cb->args[1] - 1) {
16461 *wdev = tmp;
16462 break;
16463 }
16464 }
16465 }
16466
16467 /* keep rtnl locked in successful case */
16468 return 0;
16469 }
16470
16471 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
16472 if (!attrbuf)
16473 return -ENOMEM;
16474
16475 err = nlmsg_parse_deprecated(cb->nlh,
16476 GENL_HDRLEN + nl80211_fam.hdrsize,
16477 attrbuf, nl80211_fam.maxattr,
16478 nl80211_policy, NULL);
16479 if (err)
16480 goto out;
16481
16482 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
16483 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
16484 err = -EINVAL;
16485 goto out;
16486 }
16487
16488 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
16489 if (IS_ERR(*wdev))
16490 *wdev = NULL;
16491
16492 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
16493 if (IS_ERR(*rdev)) {
16494 err = PTR_ERR(*rdev);
16495 goto out;
16496 }
16497
16498 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
16499 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
16500
16501 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
16502 const struct wiphy_vendor_command *vcmd;
16503
16504 vcmd = &(*rdev)->wiphy.vendor_commands[i];
16505
16506 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16507 continue;
16508
16509 if (!vcmd->dumpit) {
16510 err = -EOPNOTSUPP;
16511 goto out;
16512 }
16513
16514 vcmd_idx = i;
16515 break;
16516 }
16517
16518 if (vcmd_idx < 0) {
16519 err = -EOPNOTSUPP;
16520 goto out;
16521 }
16522
16523 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
16524 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16525 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16526
16527 err = nl80211_vendor_check_policy(
16528 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
16529 attrbuf[NL80211_ATTR_VENDOR_DATA],
16530 cb->extack);
16531 if (err)
16532 goto out;
16533 }
16534
16535 /* 0 is the first index - add 1 to parse only once */
16536 cb->args[0] = (*rdev)->wiphy_idx + 1;
16537 /* add 1 to know if it was NULL */
16538 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
16539 cb->args[2] = vcmd_idx;
16540 cb->args[3] = (unsigned long)data;
16541 cb->args[4] = data_len;
16542
16543 /* keep rtnl locked in successful case */
16544 err = 0;
16545 out:
16546 kfree(attrbuf);
16547 return err;
16548 }
16549
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)16550 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
16551 struct netlink_callback *cb)
16552 {
16553 struct cfg80211_registered_device *rdev;
16554 struct wireless_dev *wdev;
16555 unsigned int vcmd_idx;
16556 const struct wiphy_vendor_command *vcmd;
16557 void *data;
16558 int data_len;
16559 int err;
16560 struct nlattr *vendor_data;
16561
16562 rtnl_lock();
16563 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
16564 if (err)
16565 goto out;
16566
16567 vcmd_idx = cb->args[2];
16568 data = (void *)cb->args[3];
16569 data_len = cb->args[4];
16570 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
16571
16572 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16573 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16574 if (!wdev) {
16575 err = -EINVAL;
16576 goto out;
16577 }
16578 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16579 !wdev->netdev) {
16580 err = -EINVAL;
16581 goto out;
16582 }
16583
16584 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16585 if (!wdev_running(wdev)) {
16586 err = -ENETDOWN;
16587 goto out;
16588 }
16589 }
16590 }
16591
16592 while (1) {
16593 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
16594 cb->nlh->nlmsg_seq, NLM_F_MULTI,
16595 NL80211_CMD_VENDOR);
16596 if (!hdr)
16597 break;
16598
16599 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16600 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
16601 wdev_id(wdev),
16602 NL80211_ATTR_PAD))) {
16603 genlmsg_cancel(skb, hdr);
16604 break;
16605 }
16606
16607 vendor_data = nla_nest_start_noflag(skb,
16608 NL80211_ATTR_VENDOR_DATA);
16609 if (!vendor_data) {
16610 genlmsg_cancel(skb, hdr);
16611 break;
16612 }
16613
16614 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
16615 (unsigned long *)&cb->args[5]);
16616 nla_nest_end(skb, vendor_data);
16617
16618 if (err == -ENOBUFS || err == -ENOENT) {
16619 genlmsg_cancel(skb, hdr);
16620 break;
16621 } else if (err <= 0) {
16622 genlmsg_cancel(skb, hdr);
16623 goto out;
16624 }
16625
16626 genlmsg_end(skb, hdr);
16627 }
16628
16629 err = skb->len;
16630 out:
16631 rtnl_unlock();
16632 return err;
16633 }
16634
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)16635 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
16636 enum nl80211_commands cmd,
16637 enum nl80211_attrs attr,
16638 int approxlen)
16639 {
16640 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16641
16642 if (WARN_ON(!rdev->cur_cmd_info))
16643 return NULL;
16644
16645 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
16646 rdev->cur_cmd_info->snd_portid,
16647 rdev->cur_cmd_info->snd_seq,
16648 cmd, attr, NULL, GFP_KERNEL);
16649 }
16650 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
16651
cfg80211_vendor_cmd_reply(struct sk_buff * skb)16652 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
16653 {
16654 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
16655 void *hdr = ((void **)skb->cb)[1];
16656 struct nlattr *data = ((void **)skb->cb)[2];
16657
16658 /* clear CB data for netlink core to own from now on */
16659 memset(skb->cb, 0, sizeof(skb->cb));
16660
16661 if (WARN_ON(!rdev->cur_cmd_info)) {
16662 kfree_skb(skb);
16663 return -EINVAL;
16664 }
16665
16666 nla_nest_end(skb, data);
16667 genlmsg_end(skb, hdr);
16668 return genlmsg_reply(skb, rdev->cur_cmd_info);
16669 }
16670 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
16671
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)16672 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
16673 {
16674 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16675
16676 if (WARN_ON(!rdev->cur_cmd_info))
16677 return 0;
16678
16679 return rdev->cur_cmd_info->snd_portid;
16680 }
16681 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
16682
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)16683 static int nl80211_set_qos_map(struct sk_buff *skb,
16684 struct genl_info *info)
16685 {
16686 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16687 struct cfg80211_qos_map *qos_map = NULL;
16688 struct net_device *dev = info->user_ptr[1];
16689 u8 *pos, len, num_des, des_len, des;
16690 int ret;
16691
16692 if (!rdev->ops->set_qos_map)
16693 return -EOPNOTSUPP;
16694
16695 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
16696 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
16697 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
16698
16699 if (len % 2)
16700 return -EINVAL;
16701
16702 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
16703 if (!qos_map)
16704 return -ENOMEM;
16705
16706 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
16707 if (num_des) {
16708 des_len = num_des *
16709 sizeof(struct cfg80211_dscp_exception);
16710 memcpy(qos_map->dscp_exception, pos, des_len);
16711 qos_map->num_des = num_des;
16712 for (des = 0; des < num_des; des++) {
16713 if (qos_map->dscp_exception[des].up > 7) {
16714 kfree(qos_map);
16715 return -EINVAL;
16716 }
16717 }
16718 pos += des_len;
16719 }
16720 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
16721 }
16722
16723 ret = nl80211_key_allowed(dev->ieee80211_ptr);
16724 if (!ret)
16725 ret = rdev_set_qos_map(rdev, dev, qos_map);
16726
16727 kfree(qos_map);
16728 return ret;
16729 }
16730
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)16731 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
16732 {
16733 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16734 struct net_device *dev = info->user_ptr[1];
16735 struct wireless_dev *wdev = dev->ieee80211_ptr;
16736 const u8 *peer;
16737 u8 tsid, up;
16738 u16 admitted_time = 0;
16739
16740 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
16741 return -EOPNOTSUPP;
16742
16743 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
16744 !info->attrs[NL80211_ATTR_USER_PRIO])
16745 return -EINVAL;
16746
16747 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16748 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
16749
16750 /* WMM uses TIDs 0-7 even for TSPEC */
16751 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
16752 /* TODO: handle 802.11 TSPEC/admission control
16753 * need more attributes for that (e.g. BA session requirement);
16754 * change the WMM admission test above to allow both then
16755 */
16756 return -EINVAL;
16757 }
16758
16759 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16760
16761 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
16762 admitted_time =
16763 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
16764 if (!admitted_time)
16765 return -EINVAL;
16766 }
16767
16768 switch (wdev->iftype) {
16769 case NL80211_IFTYPE_STATION:
16770 case NL80211_IFTYPE_P2P_CLIENT:
16771 if (wdev->connected)
16772 break;
16773 return -ENOTCONN;
16774 default:
16775 return -EOPNOTSUPP;
16776 }
16777
16778 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
16779 }
16780
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)16781 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
16782 {
16783 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16784 struct net_device *dev = info->user_ptr[1];
16785 const u8 *peer;
16786 u8 tsid;
16787
16788 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
16789 return -EINVAL;
16790
16791 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16792 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16793
16794 return rdev_del_tx_ts(rdev, dev, tsid, peer);
16795 }
16796
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)16797 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
16798 struct genl_info *info)
16799 {
16800 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16801 struct net_device *dev = info->user_ptr[1];
16802 struct wireless_dev *wdev = dev->ieee80211_ptr;
16803 struct cfg80211_chan_def chandef = {};
16804 const u8 *addr;
16805 u8 oper_class;
16806 int err;
16807
16808 if (!rdev->ops->tdls_channel_switch ||
16809 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16810 return -EOPNOTSUPP;
16811
16812 switch (dev->ieee80211_ptr->iftype) {
16813 case NL80211_IFTYPE_STATION:
16814 case NL80211_IFTYPE_P2P_CLIENT:
16815 break;
16816 default:
16817 return -EOPNOTSUPP;
16818 }
16819
16820 if (!info->attrs[NL80211_ATTR_MAC] ||
16821 !info->attrs[NL80211_ATTR_OPER_CLASS])
16822 return -EINVAL;
16823
16824 err = nl80211_parse_chandef(rdev, info, &chandef);
16825 if (err)
16826 return err;
16827
16828 /*
16829 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
16830 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
16831 * specification is not defined for them.
16832 */
16833 if (chandef.chan->band == NL80211_BAND_2GHZ &&
16834 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
16835 chandef.width != NL80211_CHAN_WIDTH_20)
16836 return -EINVAL;
16837
16838 /* we will be active on the TDLS link */
16839 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
16840 wdev->iftype))
16841 return -EINVAL;
16842
16843 /* don't allow switching to DFS channels */
16844 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
16845 return -EINVAL;
16846
16847 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16848 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
16849
16850 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
16851 }
16852
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)16853 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
16854 struct genl_info *info)
16855 {
16856 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16857 struct net_device *dev = info->user_ptr[1];
16858 const u8 *addr;
16859
16860 if (!rdev->ops->tdls_channel_switch ||
16861 !rdev->ops->tdls_cancel_channel_switch ||
16862 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16863 return -EOPNOTSUPP;
16864
16865 switch (dev->ieee80211_ptr->iftype) {
16866 case NL80211_IFTYPE_STATION:
16867 case NL80211_IFTYPE_P2P_CLIENT:
16868 break;
16869 default:
16870 return -EOPNOTSUPP;
16871 }
16872
16873 if (!info->attrs[NL80211_ATTR_MAC])
16874 return -EINVAL;
16875
16876 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16877
16878 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
16879
16880 return 0;
16881 }
16882
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)16883 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
16884 struct genl_info *info)
16885 {
16886 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16887 struct net_device *dev = info->user_ptr[1];
16888 struct wireless_dev *wdev = dev->ieee80211_ptr;
16889 const struct nlattr *nla;
16890 bool enabled;
16891
16892 if (!rdev->ops->set_multicast_to_unicast)
16893 return -EOPNOTSUPP;
16894
16895 if (wdev->iftype != NL80211_IFTYPE_AP &&
16896 wdev->iftype != NL80211_IFTYPE_P2P_GO)
16897 return -EOPNOTSUPP;
16898
16899 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
16900 enabled = nla_get_flag(nla);
16901
16902 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
16903 }
16904
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)16905 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
16906 {
16907 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16908 struct net_device *dev = info->user_ptr[1];
16909 struct wireless_dev *wdev = dev->ieee80211_ptr;
16910 struct cfg80211_pmk_conf pmk_conf = {};
16911
16912 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16913 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16914 return -EOPNOTSUPP;
16915
16916 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16917 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16918 return -EOPNOTSUPP;
16919
16920 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
16921 return -EINVAL;
16922
16923 if (!wdev->connected)
16924 return -ENOTCONN;
16925
16926 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16927 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
16928 return -EINVAL;
16929
16930 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
16931 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
16932 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
16933 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
16934 return -EINVAL;
16935
16936 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
16937 pmk_conf.pmk_r0_name =
16938 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
16939
16940 return rdev_set_pmk(rdev, dev, &pmk_conf);
16941 }
16942
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)16943 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
16944 {
16945 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16946 struct net_device *dev = info->user_ptr[1];
16947 struct wireless_dev *wdev = dev->ieee80211_ptr;
16948 const u8 *aa;
16949
16950 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16951 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16952 return -EOPNOTSUPP;
16953
16954 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16955 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16956 return -EOPNOTSUPP;
16957
16958 if (!info->attrs[NL80211_ATTR_MAC])
16959 return -EINVAL;
16960
16961 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16962 return rdev_del_pmk(rdev, dev, aa);
16963 }
16964
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)16965 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
16966 {
16967 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16968 struct net_device *dev = info->user_ptr[1];
16969 struct cfg80211_external_auth_params params;
16970
16971 if (!rdev->ops->external_auth)
16972 return -EOPNOTSUPP;
16973
16974 if (!info->attrs[NL80211_ATTR_SSID] &&
16975 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
16976 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
16977 return -EINVAL;
16978
16979 if (!info->attrs[NL80211_ATTR_BSSID])
16980 return -EINVAL;
16981
16982 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
16983 return -EINVAL;
16984
16985 memset(¶ms, 0, sizeof(params));
16986
16987 if (info->attrs[NL80211_ATTR_SSID]) {
16988 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
16989 if (params.ssid.ssid_len == 0)
16990 return -EINVAL;
16991 memcpy(params.ssid.ssid,
16992 nla_data(info->attrs[NL80211_ATTR_SSID]),
16993 params.ssid.ssid_len);
16994 }
16995
16996 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
16997 ETH_ALEN);
16998
16999 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17000
17001 if (info->attrs[NL80211_ATTR_PMKID])
17002 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
17003
17004 return rdev_external_auth(rdev, dev, ¶ms);
17005 }
17006
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)17007 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
17008 {
17009 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
17010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17011 struct net_device *dev = info->user_ptr[1];
17012 struct wireless_dev *wdev = dev->ieee80211_ptr;
17013 const u8 *buf;
17014 size_t len;
17015 u8 *dest;
17016 u16 proto;
17017 bool noencrypt;
17018 u64 cookie = 0;
17019 int link_id;
17020 int err;
17021
17022 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17023 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
17024 return -EOPNOTSUPP;
17025
17026 if (!rdev->ops->tx_control_port)
17027 return -EOPNOTSUPP;
17028
17029 if (!info->attrs[NL80211_ATTR_FRAME] ||
17030 !info->attrs[NL80211_ATTR_MAC] ||
17031 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
17032 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
17033 return -EINVAL;
17034 }
17035
17036 switch (wdev->iftype) {
17037 case NL80211_IFTYPE_AP:
17038 case NL80211_IFTYPE_P2P_GO:
17039 case NL80211_IFTYPE_MESH_POINT:
17040 break;
17041 case NL80211_IFTYPE_ADHOC:
17042 if (wdev->u.ibss.current_bss)
17043 break;
17044 return -ENOTCONN;
17045 case NL80211_IFTYPE_STATION:
17046 case NL80211_IFTYPE_P2P_CLIENT:
17047 if (wdev->connected)
17048 break;
17049 return -ENOTCONN;
17050 default:
17051 return -EOPNOTSUPP;
17052 }
17053
17054 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17055 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17056 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17057 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
17058 noencrypt =
17059 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
17060
17061 link_id = nl80211_link_id_or_invalid(info->attrs);
17062
17063 err = rdev_tx_control_port(rdev, dev, buf, len,
17064 dest, cpu_to_be16(proto), noencrypt, link_id,
17065 dont_wait_for_ack ? NULL : &cookie);
17066 if (!err && !dont_wait_for_ack)
17067 nl_set_extack_cookie_u64(info->extack, cookie);
17068 return err;
17069 }
17070
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)17071 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
17072 struct genl_info *info)
17073 {
17074 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17075 struct net_device *dev = info->user_ptr[1];
17076 struct wireless_dev *wdev = dev->ieee80211_ptr;
17077 struct cfg80211_ftm_responder_stats ftm_stats = {};
17078 unsigned int link_id = nl80211_link_id(info->attrs);
17079 struct sk_buff *msg;
17080 void *hdr;
17081 struct nlattr *ftm_stats_attr;
17082 int err;
17083
17084 if (wdev->iftype != NL80211_IFTYPE_AP ||
17085 !wdev->links[link_id].ap.beacon_interval)
17086 return -EOPNOTSUPP;
17087
17088 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
17089 if (err)
17090 return err;
17091
17092 if (!ftm_stats.filled)
17093 return -ENODATA;
17094
17095 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17096 if (!msg)
17097 return -ENOMEM;
17098
17099 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
17100 NL80211_CMD_GET_FTM_RESPONDER_STATS);
17101 if (!hdr)
17102 goto nla_put_failure;
17103
17104 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17105 goto nla_put_failure;
17106
17107 ftm_stats_attr = nla_nest_start_noflag(msg,
17108 NL80211_ATTR_FTM_RESPONDER_STATS);
17109 if (!ftm_stats_attr)
17110 goto nla_put_failure;
17111
17112 #define SET_FTM(field, name, type) \
17113 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17114 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
17115 ftm_stats.field)) \
17116 goto nla_put_failure; } while (0)
17117 #define SET_FTM_U64(field, name) \
17118 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17119 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
17120 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
17121 goto nla_put_failure; } while (0)
17122
17123 SET_FTM(success_num, SUCCESS_NUM, u32);
17124 SET_FTM(partial_num, PARTIAL_NUM, u32);
17125 SET_FTM(failed_num, FAILED_NUM, u32);
17126 SET_FTM(asap_num, ASAP_NUM, u32);
17127 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
17128 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
17129 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
17130 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
17131 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
17132 #undef SET_FTM
17133
17134 nla_nest_end(msg, ftm_stats_attr);
17135
17136 genlmsg_end(msg, hdr);
17137 return genlmsg_reply(msg, info);
17138
17139 nla_put_failure:
17140 nlmsg_free(msg);
17141 return -ENOBUFS;
17142 }
17143
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)17144 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
17145 {
17146 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17147 struct cfg80211_update_owe_info owe_info;
17148 struct net_device *dev = info->user_ptr[1];
17149
17150 if (!rdev->ops->update_owe_info)
17151 return -EOPNOTSUPP;
17152
17153 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
17154 !info->attrs[NL80211_ATTR_MAC])
17155 return -EINVAL;
17156
17157 memset(&owe_info, 0, sizeof(owe_info));
17158 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17159 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
17160
17161 if (info->attrs[NL80211_ATTR_IE]) {
17162 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
17163 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
17164 }
17165
17166 return rdev_update_owe_info(rdev, dev, &owe_info);
17167 }
17168
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)17169 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
17170 {
17171 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17172 struct net_device *dev = info->user_ptr[1];
17173 struct wireless_dev *wdev = dev->ieee80211_ptr;
17174 struct station_info sinfo = {};
17175 const u8 *buf;
17176 size_t len;
17177 u8 *dest;
17178 int err;
17179
17180 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
17181 return -EOPNOTSUPP;
17182
17183 if (!info->attrs[NL80211_ATTR_MAC] ||
17184 !info->attrs[NL80211_ATTR_FRAME]) {
17185 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
17186 return -EINVAL;
17187 }
17188
17189 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
17190 return -EOPNOTSUPP;
17191
17192 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17193 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17194 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17195
17196 if (len < sizeof(struct ethhdr))
17197 return -EINVAL;
17198
17199 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
17200 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
17201 return -EINVAL;
17202
17203 err = rdev_get_station(rdev, dev, dest, &sinfo);
17204 if (err)
17205 return err;
17206
17207 cfg80211_sinfo_release_content(&sinfo);
17208
17209 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
17210 }
17211
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)17212 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
17213 struct nlattr *attrs[], struct net_device *dev,
17214 struct cfg80211_tid_cfg *tid_conf,
17215 struct genl_info *info, const u8 *peer,
17216 unsigned int link_id)
17217 {
17218 struct netlink_ext_ack *extack = info->extack;
17219 u64 mask;
17220 int err;
17221
17222 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
17223 return -EINVAL;
17224
17225 tid_conf->config_override =
17226 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
17227 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
17228
17229 if (tid_conf->config_override) {
17230 if (rdev->ops->reset_tid_config) {
17231 err = rdev_reset_tid_config(rdev, dev, peer,
17232 tid_conf->tids);
17233 if (err)
17234 return err;
17235 } else {
17236 return -EINVAL;
17237 }
17238 }
17239
17240 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
17241 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
17242 tid_conf->noack =
17243 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
17244 }
17245
17246 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
17247 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
17248 tid_conf->retry_short =
17249 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
17250
17251 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
17252 return -EINVAL;
17253 }
17254
17255 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
17256 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
17257 tid_conf->retry_long =
17258 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
17259
17260 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
17261 return -EINVAL;
17262 }
17263
17264 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
17265 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
17266 tid_conf->ampdu =
17267 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
17268 }
17269
17270 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
17271 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
17272 tid_conf->rtscts =
17273 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
17274 }
17275
17276 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
17277 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
17278 tid_conf->amsdu =
17279 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
17280 }
17281
17282 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
17283 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
17284
17285 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
17286
17287 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
17288 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
17289 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
17290 &tid_conf->txrate_mask, dev,
17291 true, link_id);
17292 if (err)
17293 return err;
17294
17295 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
17296 }
17297 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
17298 }
17299
17300 if (peer)
17301 mask = rdev->wiphy.tid_config_support.peer;
17302 else
17303 mask = rdev->wiphy.tid_config_support.vif;
17304
17305 if (tid_conf->mask & ~mask) {
17306 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
17307 return -EOPNOTSUPP;
17308 }
17309
17310 return 0;
17311 }
17312
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)17313 static int nl80211_set_tid_config(struct sk_buff *skb,
17314 struct genl_info *info)
17315 {
17316 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17317 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
17318 unsigned int link_id = nl80211_link_id(info->attrs);
17319 struct net_device *dev = info->user_ptr[1];
17320 struct cfg80211_tid_config *tid_config;
17321 struct nlattr *tid;
17322 int conf_idx = 0, rem_conf;
17323 int ret = -EINVAL;
17324 u32 num_conf = 0;
17325
17326 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
17327 return -EINVAL;
17328
17329 if (!rdev->ops->set_tid_config)
17330 return -EOPNOTSUPP;
17331
17332 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17333 rem_conf)
17334 num_conf++;
17335
17336 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
17337 GFP_KERNEL);
17338 if (!tid_config)
17339 return -ENOMEM;
17340
17341 tid_config->n_tid_conf = num_conf;
17342
17343 if (info->attrs[NL80211_ATTR_MAC])
17344 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
17345
17346 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17347 rem_conf) {
17348 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
17349 tid, NULL, NULL);
17350
17351 if (ret)
17352 goto bad_tid_conf;
17353
17354 ret = parse_tid_conf(rdev, attrs, dev,
17355 &tid_config->tid_conf[conf_idx],
17356 info, tid_config->peer, link_id);
17357 if (ret)
17358 goto bad_tid_conf;
17359
17360 conf_idx++;
17361 }
17362
17363 ret = rdev_set_tid_config(rdev, dev, tid_config);
17364
17365 bad_tid_conf:
17366 kfree(tid_config);
17367 return ret;
17368 }
17369
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)17370 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
17371 {
17372 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17373 struct cfg80211_color_change_settings params = {};
17374 struct net_device *dev = info->user_ptr[1];
17375 struct wireless_dev *wdev = dev->ieee80211_ptr;
17376 struct nlattr **tb;
17377 u16 offset;
17378 int err;
17379
17380 if (!rdev->ops->color_change)
17381 return -EOPNOTSUPP;
17382
17383 if (!wiphy_ext_feature_isset(&rdev->wiphy,
17384 NL80211_EXT_FEATURE_BSS_COLOR))
17385 return -EOPNOTSUPP;
17386
17387 if (wdev->iftype != NL80211_IFTYPE_AP)
17388 return -EOPNOTSUPP;
17389
17390 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
17391 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
17392 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
17393 return -EINVAL;
17394
17395 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
17396 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
17397
17398 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
17399 info->extack);
17400 if (err)
17401 return err;
17402
17403 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
17404 if (!tb)
17405 return -ENOMEM;
17406
17407 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
17408 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
17409 nl80211_policy, info->extack);
17410 if (err)
17411 goto out;
17412
17413 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
17414 info->extack);
17415 if (err)
17416 goto out;
17417
17418 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
17419 err = -EINVAL;
17420 goto out;
17421 }
17422
17423 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
17424 err = -EINVAL;
17425 goto out;
17426 }
17427
17428 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
17429 if (offset >= params.beacon_color_change.tail_len) {
17430 err = -EINVAL;
17431 goto out;
17432 }
17433
17434 if (params.beacon_color_change.tail[offset] != params.count) {
17435 err = -EINVAL;
17436 goto out;
17437 }
17438
17439 params.counter_offset_beacon = offset;
17440
17441 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
17442 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
17443 sizeof(u16)) {
17444 err = -EINVAL;
17445 goto out;
17446 }
17447
17448 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
17449 if (offset >= params.beacon_color_change.probe_resp_len) {
17450 err = -EINVAL;
17451 goto out;
17452 }
17453
17454 if (params.beacon_color_change.probe_resp[offset] !=
17455 params.count) {
17456 err = -EINVAL;
17457 goto out;
17458 }
17459
17460 params.counter_offset_presp = offset;
17461 }
17462
17463 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
17464 err = nl80211_parse_unsol_bcast_probe_resp(
17465 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
17466 ¶ms.unsol_bcast_probe_resp);
17467 if (err)
17468 goto out;
17469 }
17470
17471 params.link_id = nl80211_link_id(info->attrs);
17472 err = rdev_color_change(rdev, dev, ¶ms);
17473
17474 out:
17475 kfree(params.beacon_next.mbssid_ies);
17476 kfree(params.beacon_color_change.mbssid_ies);
17477 kfree(params.beacon_next.rnr_ies);
17478 kfree(params.beacon_color_change.rnr_ies);
17479 kfree(tb);
17480 return err;
17481 }
17482
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)17483 static int nl80211_set_fils_aad(struct sk_buff *skb,
17484 struct genl_info *info)
17485 {
17486 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17487 struct net_device *dev = info->user_ptr[1];
17488 struct cfg80211_fils_aad fils_aad = {};
17489 u8 *nonces;
17490
17491 if (!info->attrs[NL80211_ATTR_MAC] ||
17492 !info->attrs[NL80211_ATTR_FILS_KEK] ||
17493 !info->attrs[NL80211_ATTR_FILS_NONCES])
17494 return -EINVAL;
17495
17496 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17497 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
17498 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
17499 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
17500 fils_aad.snonce = nonces;
17501 fils_aad.anonce = nonces + FILS_NONCE_LEN;
17502
17503 return rdev_set_fils_aad(rdev, dev, &fils_aad);
17504 }
17505
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)17506 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
17507 {
17508 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17509 unsigned int link_id = nl80211_link_id(info->attrs);
17510 struct net_device *dev = info->user_ptr[1];
17511 struct wireless_dev *wdev = dev->ieee80211_ptr;
17512 int ret;
17513
17514 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
17515 return -EINVAL;
17516
17517 switch (wdev->iftype) {
17518 case NL80211_IFTYPE_AP:
17519 break;
17520 default:
17521 return -EINVAL;
17522 }
17523
17524 if (!info->attrs[NL80211_ATTR_MAC] ||
17525 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
17526 return -EINVAL;
17527
17528 wdev->valid_links |= BIT(link_id);
17529 ether_addr_copy(wdev->links[link_id].addr,
17530 nla_data(info->attrs[NL80211_ATTR_MAC]));
17531
17532 ret = rdev_add_intf_link(rdev, wdev, link_id);
17533 if (ret) {
17534 wdev->valid_links &= ~BIT(link_id);
17535 eth_zero_addr(wdev->links[link_id].addr);
17536 }
17537
17538 return ret;
17539 }
17540
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)17541 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
17542 {
17543 unsigned int link_id = nl80211_link_id(info->attrs);
17544 struct net_device *dev = info->user_ptr[1];
17545 struct wireless_dev *wdev = dev->ieee80211_ptr;
17546
17547 /* cannot remove if there's no link */
17548 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17549 return -EINVAL;
17550
17551 switch (wdev->iftype) {
17552 case NL80211_IFTYPE_AP:
17553 break;
17554 default:
17555 return -EINVAL;
17556 }
17557
17558 cfg80211_remove_link(wdev, link_id);
17559
17560 return 0;
17561 }
17562
17563 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)17564 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
17565 bool add)
17566 {
17567 struct link_station_parameters params = {};
17568 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17569 struct net_device *dev = info->user_ptr[1];
17570 int err;
17571
17572 if ((add && !rdev->ops->add_link_station) ||
17573 (!add && !rdev->ops->mod_link_station))
17574 return -EOPNOTSUPP;
17575
17576 if (add && !info->attrs[NL80211_ATTR_MAC])
17577 return -EINVAL;
17578
17579 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
17580 return -EINVAL;
17581
17582 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
17583 return -EINVAL;
17584
17585 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17586
17587 if (info->attrs[NL80211_ATTR_MAC]) {
17588 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
17589 if (!is_valid_ether_addr(params.link_mac))
17590 return -EINVAL;
17591 }
17592
17593 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17594 return -EINVAL;
17595
17596 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17597
17598 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
17599 params.supported_rates =
17600 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17601 params.supported_rates_len =
17602 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17603 }
17604
17605 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
17606 params.ht_capa =
17607 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
17608
17609 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
17610 params.vht_capa =
17611 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
17612
17613 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
17614 params.he_capa =
17615 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17616 params.he_capa_len =
17617 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17618
17619 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
17620 params.eht_capa =
17621 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17622 params.eht_capa_len =
17623 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17624
17625 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
17626 (const u8 *)params.eht_capa,
17627 params.eht_capa_len,
17628 false))
17629 return -EINVAL;
17630 }
17631 }
17632
17633 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
17634 params.he_6ghz_capa =
17635 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
17636
17637 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
17638 params.opmode_notif_used = true;
17639 params.opmode_notif =
17640 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
17641 }
17642
17643 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
17644 ¶ms.txpwr_set);
17645 if (err)
17646 return err;
17647
17648 if (add)
17649 return rdev_add_link_station(rdev, dev, ¶ms);
17650
17651 return rdev_mod_link_station(rdev, dev, ¶ms);
17652 }
17653
17654 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)17655 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
17656 {
17657 return nl80211_add_mod_link_station(skb, info, true);
17658 }
17659
17660 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)17661 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
17662 {
17663 return nl80211_add_mod_link_station(skb, info, false);
17664 }
17665
17666 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)17667 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
17668 {
17669 struct link_station_del_parameters params = {};
17670 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17671 struct net_device *dev = info->user_ptr[1];
17672
17673 if (!rdev->ops->del_link_station)
17674 return -EOPNOTSUPP;
17675
17676 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
17677 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
17678 return -EINVAL;
17679
17680 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17681 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17682
17683 return rdev_del_link_station(rdev, dev, ¶ms);
17684 }
17685
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)17686 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
17687 struct genl_info *info)
17688 {
17689 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17690 struct net_device *dev = info->user_ptr[1];
17691 struct cfg80211_set_hw_timestamp hwts = {};
17692
17693 if (!rdev->wiphy.hw_timestamp_max_peers)
17694 return -EOPNOTSUPP;
17695
17696 if (!info->attrs[NL80211_ATTR_MAC] &&
17697 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
17698 return -EOPNOTSUPP;
17699
17700 if (info->attrs[NL80211_ATTR_MAC])
17701 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17702
17703 hwts.enable =
17704 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
17705
17706 return rdev_set_hw_timestamp(rdev, dev, &hwts);
17707 }
17708
17709 static int
nl80211_set_ttlm(struct sk_buff * skb,struct genl_info * info)17710 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
17711 {
17712 struct cfg80211_ttlm_params params = {};
17713 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17714 struct net_device *dev = info->user_ptr[1];
17715 struct wireless_dev *wdev = dev->ieee80211_ptr;
17716
17717 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17718 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17719 return -EOPNOTSUPP;
17720
17721 if (!wdev->connected)
17722 return -ENOLINK;
17723
17724 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
17725 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
17726 return -EINVAL;
17727
17728 nla_memcpy(params.dlink,
17729 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
17730 sizeof(params.dlink));
17731 nla_memcpy(params.ulink,
17732 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
17733 sizeof(params.ulink));
17734
17735 return rdev_set_ttlm(rdev, dev, ¶ms);
17736 }
17737
nl80211_assoc_ml_reconf(struct sk_buff * skb,struct genl_info * info)17738 static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
17739 {
17740 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17741 struct net_device *dev = info->user_ptr[1];
17742 struct wireless_dev *wdev = dev->ieee80211_ptr;
17743 struct cfg80211_ml_reconf_req req = {};
17744 unsigned int link_id;
17745 u16 add_links;
17746 int err;
17747
17748 if (!wdev->valid_links)
17749 return -EINVAL;
17750
17751 if (dev->ieee80211_ptr->conn_owner_nlportid &&
17752 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
17753 return -EPERM;
17754
17755 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
17756 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
17757 return -EOPNOTSUPP;
17758
17759 add_links = 0;
17760 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
17761 err = nl80211_process_links(rdev, req.add_links,
17762 /* mark as MLO, but not assoc */
17763 IEEE80211_MLD_MAX_NUM_LINKS,
17764 NULL, 0, info);
17765 if (err)
17766 return err;
17767
17768 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
17769 link_id++) {
17770 if (!req.add_links[link_id].bss)
17771 continue;
17772 add_links |= BIT(link_id);
17773 }
17774 }
17775
17776 if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
17777 req.rem_links =
17778 nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
17779
17780 /* Validate that existing links are not added, removed links are valid
17781 * and don't allow adding and removing the same links
17782 */
17783 if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
17784 (wdev->valid_links & add_links) ||
17785 ((wdev->valid_links & req.rem_links) != req.rem_links)) {
17786 err = -EINVAL;
17787 goto out;
17788 }
17789
17790 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
17791 req.ext_mld_capa_ops =
17792 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
17793
17794 err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
17795
17796 out:
17797 for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
17798 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
17799
17800 return err;
17801 }
17802
17803 static int
nl80211_epcs_cfg(struct sk_buff * skb,struct genl_info * info)17804 nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
17805 {
17806 struct cfg80211_registered_device *rdev = info->user_ptr[0];
17807 struct net_device *dev = info->user_ptr[1];
17808 struct wireless_dev *wdev = dev->ieee80211_ptr;
17809 bool val;
17810
17811 if (wdev->iftype != NL80211_IFTYPE_STATION &&
17812 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17813 return -EOPNOTSUPP;
17814
17815 if (!wdev->connected)
17816 return -ENOLINK;
17817
17818 val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
17819
17820 return rdev_set_epcs(rdev, dev, val);
17821 }
17822
17823 #define NL80211_FLAG_NEED_WIPHY 0x01
17824 #define NL80211_FLAG_NEED_NETDEV 0x02
17825 #define NL80211_FLAG_NEED_RTNL 0x04
17826 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
17827 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
17828 NL80211_FLAG_CHECK_NETDEV_UP)
17829 #define NL80211_FLAG_NEED_WDEV 0x10
17830 /* If a netdev is associated, it must be UP, P2P must be started */
17831 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
17832 NL80211_FLAG_CHECK_NETDEV_UP)
17833 #define NL80211_FLAG_CLEAR_SKB 0x20
17834 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
17835 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
17836 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
17837
17838 #define INTERNAL_FLAG_SELECTORS(__sel) \
17839 SELECTOR(__sel, NONE, 0) /* must be first */ \
17840 SELECTOR(__sel, WIPHY, \
17841 NL80211_FLAG_NEED_WIPHY) \
17842 SELECTOR(__sel, WDEV, \
17843 NL80211_FLAG_NEED_WDEV) \
17844 SELECTOR(__sel, NETDEV, \
17845 NL80211_FLAG_NEED_NETDEV) \
17846 SELECTOR(__sel, NETDEV_LINK, \
17847 NL80211_FLAG_NEED_NETDEV | \
17848 NL80211_FLAG_MLO_VALID_LINK_ID) \
17849 SELECTOR(__sel, NETDEV_NO_MLO, \
17850 NL80211_FLAG_NEED_NETDEV | \
17851 NL80211_FLAG_MLO_UNSUPPORTED) \
17852 SELECTOR(__sel, WIPHY_RTNL, \
17853 NL80211_FLAG_NEED_WIPHY | \
17854 NL80211_FLAG_NEED_RTNL) \
17855 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
17856 NL80211_FLAG_NEED_WIPHY | \
17857 NL80211_FLAG_NEED_RTNL | \
17858 NL80211_FLAG_NO_WIPHY_MTX) \
17859 SELECTOR(__sel, WDEV_RTNL, \
17860 NL80211_FLAG_NEED_WDEV | \
17861 NL80211_FLAG_NEED_RTNL) \
17862 SELECTOR(__sel, NETDEV_RTNL, \
17863 NL80211_FLAG_NEED_NETDEV | \
17864 NL80211_FLAG_NEED_RTNL) \
17865 SELECTOR(__sel, NETDEV_UP, \
17866 NL80211_FLAG_NEED_NETDEV_UP) \
17867 SELECTOR(__sel, NETDEV_UP_LINK, \
17868 NL80211_FLAG_NEED_NETDEV_UP | \
17869 NL80211_FLAG_MLO_VALID_LINK_ID) \
17870 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
17871 NL80211_FLAG_NEED_NETDEV_UP | \
17872 NL80211_FLAG_MLO_UNSUPPORTED) \
17873 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
17874 NL80211_FLAG_NEED_NETDEV_UP | \
17875 NL80211_FLAG_CLEAR_SKB | \
17876 NL80211_FLAG_MLO_UNSUPPORTED) \
17877 SELECTOR(__sel, NETDEV_UP_NOTMX, \
17878 NL80211_FLAG_NEED_NETDEV_UP | \
17879 NL80211_FLAG_NO_WIPHY_MTX) \
17880 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
17881 NL80211_FLAG_NEED_NETDEV_UP | \
17882 NL80211_FLAG_NO_WIPHY_MTX | \
17883 NL80211_FLAG_MLO_VALID_LINK_ID) \
17884 SELECTOR(__sel, NETDEV_UP_CLEAR, \
17885 NL80211_FLAG_NEED_NETDEV_UP | \
17886 NL80211_FLAG_CLEAR_SKB) \
17887 SELECTOR(__sel, WDEV_UP, \
17888 NL80211_FLAG_NEED_WDEV_UP) \
17889 SELECTOR(__sel, WDEV_UP_LINK, \
17890 NL80211_FLAG_NEED_WDEV_UP | \
17891 NL80211_FLAG_MLO_VALID_LINK_ID) \
17892 SELECTOR(__sel, WDEV_UP_RTNL, \
17893 NL80211_FLAG_NEED_WDEV_UP | \
17894 NL80211_FLAG_NEED_RTNL) \
17895 SELECTOR(__sel, WIPHY_CLEAR, \
17896 NL80211_FLAG_NEED_WIPHY | \
17897 NL80211_FLAG_CLEAR_SKB)
17898
17899 enum nl80211_internal_flags_selector {
17900 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
17901 INTERNAL_FLAG_SELECTORS(_)
17902 #undef SELECTOR
17903 };
17904
17905 static u32 nl80211_internal_flags[] = {
17906 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
17907 INTERNAL_FLAG_SELECTORS(_)
17908 #undef SELECTOR
17909 };
17910
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)17911 static int nl80211_pre_doit(const struct genl_split_ops *ops,
17912 struct sk_buff *skb,
17913 struct genl_info *info)
17914 {
17915 struct cfg80211_registered_device *rdev = NULL;
17916 struct wireless_dev *wdev = NULL;
17917 struct net_device *dev = NULL;
17918 u32 internal_flags;
17919 int err;
17920
17921 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
17922 return -EINVAL;
17923
17924 internal_flags = nl80211_internal_flags[ops->internal_flags];
17925
17926 rtnl_lock();
17927 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
17928 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
17929 if (IS_ERR(rdev)) {
17930 err = PTR_ERR(rdev);
17931 goto out_unlock;
17932 }
17933 info->user_ptr[0] = rdev;
17934 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
17935 internal_flags & NL80211_FLAG_NEED_WDEV) {
17936 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
17937 info->attrs);
17938 if (IS_ERR(wdev)) {
17939 err = PTR_ERR(wdev);
17940 goto out_unlock;
17941 }
17942
17943 dev = wdev->netdev;
17944 dev_hold(dev);
17945 rdev = wiphy_to_rdev(wdev->wiphy);
17946
17947 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
17948 if (!dev) {
17949 err = -EINVAL;
17950 goto out_unlock;
17951 }
17952
17953 info->user_ptr[1] = dev;
17954 } else {
17955 info->user_ptr[1] = wdev;
17956 }
17957
17958 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
17959 !wdev_running(wdev)) {
17960 err = -ENETDOWN;
17961 goto out_unlock;
17962 }
17963
17964 info->user_ptr[0] = rdev;
17965 }
17966
17967 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
17968 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
17969
17970 if (!wdev) {
17971 err = -EINVAL;
17972 goto out_unlock;
17973 }
17974
17975 /* MLO -> require valid link ID */
17976 if (wdev->valid_links &&
17977 (!link_id ||
17978 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
17979 err = -EINVAL;
17980 goto out_unlock;
17981 }
17982
17983 /* non-MLO -> no link ID attribute accepted */
17984 if (!wdev->valid_links && link_id) {
17985 err = -EINVAL;
17986 goto out_unlock;
17987 }
17988 }
17989
17990 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
17991 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
17992 (wdev && wdev->valid_links)) {
17993 err = -EINVAL;
17994 goto out_unlock;
17995 }
17996 }
17997
17998 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
17999 wiphy_lock(&rdev->wiphy);
18000 /* we keep the mutex locked until post_doit */
18001 __release(&rdev->wiphy.mtx);
18002 }
18003 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
18004 rtnl_unlock();
18005
18006 return 0;
18007 out_unlock:
18008 rtnl_unlock();
18009 dev_put(dev);
18010 return err;
18011 }
18012
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)18013 static void nl80211_post_doit(const struct genl_split_ops *ops,
18014 struct sk_buff *skb,
18015 struct genl_info *info)
18016 {
18017 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
18018
18019 if (info->user_ptr[1]) {
18020 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
18021 struct wireless_dev *wdev = info->user_ptr[1];
18022
18023 dev_put(wdev->netdev);
18024 } else {
18025 dev_put(info->user_ptr[1]);
18026 }
18027 }
18028
18029 if (info->user_ptr[0] &&
18030 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
18031 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18032
18033 /* we kept the mutex locked since pre_doit */
18034 __acquire(&rdev->wiphy.mtx);
18035 wiphy_unlock(&rdev->wiphy);
18036 }
18037
18038 if (internal_flags & NL80211_FLAG_NEED_RTNL)
18039 rtnl_unlock();
18040
18041 /* If needed, clear the netlink message payload from the SKB
18042 * as it might contain key data that shouldn't stick around on
18043 * the heap after the SKB is freed. The netlink message header
18044 * is still needed for further processing, so leave it intact.
18045 */
18046 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
18047 struct nlmsghdr *nlh = nlmsg_hdr(skb);
18048
18049 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
18050 }
18051 }
18052
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)18053 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
18054 struct cfg80211_sar_specs *sar_specs,
18055 struct nlattr *spec[], int index)
18056 {
18057 u32 range_index, i;
18058
18059 if (!sar_specs || !spec)
18060 return -EINVAL;
18061
18062 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
18063 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
18064 return -EINVAL;
18065
18066 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
18067
18068 /* check if range_index exceeds num_freq_ranges */
18069 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
18070 return -EINVAL;
18071
18072 /* check if range_index duplicates */
18073 for (i = 0; i < index; i++) {
18074 if (sar_specs->sub_specs[i].freq_range_index == range_index)
18075 return -EINVAL;
18076 }
18077
18078 sar_specs->sub_specs[index].power =
18079 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
18080
18081 sar_specs->sub_specs[index].freq_range_index = range_index;
18082
18083 return 0;
18084 }
18085
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)18086 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
18087 {
18088 struct cfg80211_registered_device *rdev = info->user_ptr[0];
18089 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
18090 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
18091 struct cfg80211_sar_specs *sar_spec;
18092 enum nl80211_sar_type type;
18093 struct nlattr *spec_list;
18094 u32 specs;
18095 int rem, err;
18096
18097 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
18098 return -EOPNOTSUPP;
18099
18100 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
18101 return -EINVAL;
18102
18103 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
18104 info->attrs[NL80211_ATTR_SAR_SPEC],
18105 NULL, NULL);
18106
18107 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
18108 return -EINVAL;
18109
18110 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
18111 if (type != rdev->wiphy.sar_capa->type)
18112 return -EINVAL;
18113
18114 specs = 0;
18115 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
18116 specs++;
18117
18118 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
18119 return -EINVAL;
18120
18121 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
18122 if (!sar_spec)
18123 return -ENOMEM;
18124
18125 sar_spec->num_sub_specs = specs;
18126 sar_spec->type = type;
18127 specs = 0;
18128 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
18129 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
18130 spec_list, NULL, NULL);
18131
18132 switch (type) {
18133 case NL80211_SAR_TYPE_POWER:
18134 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
18135 spec, specs)) {
18136 err = -EINVAL;
18137 goto error;
18138 }
18139 break;
18140 default:
18141 err = -EINVAL;
18142 goto error;
18143 }
18144 specs++;
18145 }
18146
18147 sar_spec->num_sub_specs = specs;
18148
18149 rdev->cur_cmd_info = info;
18150 err = rdev_set_sar_specs(rdev, sar_spec);
18151 rdev->cur_cmd_info = NULL;
18152 error:
18153 kfree(sar_spec);
18154 return err;
18155 }
18156
18157 #define SELECTOR(__sel, name, value) \
18158 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
18159 int __missing_selector(void);
18160 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
18161
18162 static const struct genl_ops nl80211_ops[] = {
18163 {
18164 .cmd = NL80211_CMD_GET_WIPHY,
18165 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18166 .doit = nl80211_get_wiphy,
18167 .dumpit = nl80211_dump_wiphy,
18168 .done = nl80211_dump_wiphy_done,
18169 /* can be retrieved by unprivileged users */
18170 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18171 },
18172 };
18173
18174 static const struct genl_small_ops nl80211_small_ops[] = {
18175 {
18176 .cmd = NL80211_CMD_SET_WIPHY,
18177 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18178 .doit = nl80211_set_wiphy,
18179 .flags = GENL_UNS_ADMIN_PERM,
18180 },
18181 {
18182 .cmd = NL80211_CMD_GET_INTERFACE,
18183 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18184 .doit = nl80211_get_interface,
18185 .dumpit = nl80211_dump_interface,
18186 /* can be retrieved by unprivileged users */
18187 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18188 },
18189 {
18190 .cmd = NL80211_CMD_SET_INTERFACE,
18191 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18192 .doit = nl80211_set_interface,
18193 .flags = GENL_UNS_ADMIN_PERM,
18194 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18195 NL80211_FLAG_NEED_RTNL),
18196 },
18197 {
18198 .cmd = NL80211_CMD_NEW_INTERFACE,
18199 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18200 .doit = nl80211_new_interface,
18201 .flags = GENL_UNS_ADMIN_PERM,
18202 .internal_flags =
18203 IFLAGS(NL80211_FLAG_NEED_WIPHY |
18204 NL80211_FLAG_NEED_RTNL |
18205 /* we take the wiphy mutex later ourselves */
18206 NL80211_FLAG_NO_WIPHY_MTX),
18207 },
18208 {
18209 .cmd = NL80211_CMD_DEL_INTERFACE,
18210 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18211 .doit = nl80211_del_interface,
18212 .flags = GENL_UNS_ADMIN_PERM,
18213 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18214 NL80211_FLAG_NEED_RTNL),
18215 },
18216 {
18217 .cmd = NL80211_CMD_GET_KEY,
18218 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18219 .doit = nl80211_get_key,
18220 .flags = GENL_UNS_ADMIN_PERM,
18221 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18222 },
18223 {
18224 .cmd = NL80211_CMD_SET_KEY,
18225 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18226 .doit = nl80211_set_key,
18227 .flags = GENL_UNS_ADMIN_PERM,
18228 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
18229 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18230 NL80211_FLAG_CLEAR_SKB),
18231 },
18232 {
18233 .cmd = NL80211_CMD_NEW_KEY,
18234 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18235 .doit = nl80211_new_key,
18236 .flags = GENL_UNS_ADMIN_PERM,
18237 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18238 NL80211_FLAG_CLEAR_SKB),
18239 },
18240 {
18241 .cmd = NL80211_CMD_DEL_KEY,
18242 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18243 .doit = nl80211_del_key,
18244 .flags = GENL_UNS_ADMIN_PERM,
18245 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18246 },
18247 {
18248 .cmd = NL80211_CMD_SET_BEACON,
18249 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18250 .flags = GENL_UNS_ADMIN_PERM,
18251 .doit = nl80211_set_beacon,
18252 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18253 NL80211_FLAG_MLO_VALID_LINK_ID),
18254 },
18255 {
18256 .cmd = NL80211_CMD_START_AP,
18257 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18258 .flags = GENL_UNS_ADMIN_PERM,
18259 .doit = nl80211_start_ap,
18260 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18261 NL80211_FLAG_MLO_VALID_LINK_ID),
18262 },
18263 {
18264 .cmd = NL80211_CMD_STOP_AP,
18265 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18266 .flags = GENL_UNS_ADMIN_PERM,
18267 .doit = nl80211_stop_ap,
18268 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18269 NL80211_FLAG_MLO_VALID_LINK_ID),
18270 },
18271 {
18272 .cmd = NL80211_CMD_GET_STATION,
18273 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18274 .doit = nl80211_get_station,
18275 .dumpit = nl80211_dump_station,
18276 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18277 },
18278 {
18279 .cmd = NL80211_CMD_SET_STATION,
18280 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18281 .doit = nl80211_set_station,
18282 .flags = GENL_UNS_ADMIN_PERM,
18283 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18284 },
18285 {
18286 .cmd = NL80211_CMD_NEW_STATION,
18287 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18288 .doit = nl80211_new_station,
18289 .flags = GENL_UNS_ADMIN_PERM,
18290 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18291 },
18292 {
18293 .cmd = NL80211_CMD_DEL_STATION,
18294 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18295 .doit = nl80211_del_station,
18296 .flags = GENL_UNS_ADMIN_PERM,
18297 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
18298 * whether MAC address is passed or not. If MAC address is
18299 * passed, then even during MLO, link ID is not required.
18300 */
18301 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18302 },
18303 {
18304 .cmd = NL80211_CMD_GET_MPATH,
18305 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18306 .doit = nl80211_get_mpath,
18307 .dumpit = nl80211_dump_mpath,
18308 .flags = GENL_UNS_ADMIN_PERM,
18309 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18310 },
18311 {
18312 .cmd = NL80211_CMD_GET_MPP,
18313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18314 .doit = nl80211_get_mpp,
18315 .dumpit = nl80211_dump_mpp,
18316 .flags = GENL_UNS_ADMIN_PERM,
18317 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18318 },
18319 {
18320 .cmd = NL80211_CMD_SET_MPATH,
18321 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18322 .doit = nl80211_set_mpath,
18323 .flags = GENL_UNS_ADMIN_PERM,
18324 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18325 },
18326 {
18327 .cmd = NL80211_CMD_NEW_MPATH,
18328 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18329 .doit = nl80211_new_mpath,
18330 .flags = GENL_UNS_ADMIN_PERM,
18331 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18332 },
18333 {
18334 .cmd = NL80211_CMD_DEL_MPATH,
18335 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18336 .doit = nl80211_del_mpath,
18337 .flags = GENL_UNS_ADMIN_PERM,
18338 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18339 },
18340 {
18341 .cmd = NL80211_CMD_SET_BSS,
18342 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18343 .doit = nl80211_set_bss,
18344 .flags = GENL_UNS_ADMIN_PERM,
18345 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18346 NL80211_FLAG_MLO_VALID_LINK_ID),
18347 },
18348 {
18349 .cmd = NL80211_CMD_GET_REG,
18350 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18351 .doit = nl80211_get_reg_do,
18352 .dumpit = nl80211_get_reg_dump,
18353 /* can be retrieved by unprivileged users */
18354 },
18355 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
18356 {
18357 .cmd = NL80211_CMD_SET_REG,
18358 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18359 .doit = nl80211_set_reg,
18360 .flags = GENL_ADMIN_PERM,
18361 },
18362 #endif
18363 {
18364 .cmd = NL80211_CMD_REQ_SET_REG,
18365 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18366 .doit = nl80211_req_set_reg,
18367 .flags = GENL_ADMIN_PERM,
18368 },
18369 {
18370 .cmd = NL80211_CMD_RELOAD_REGDB,
18371 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18372 .doit = nl80211_reload_regdb,
18373 .flags = GENL_ADMIN_PERM,
18374 },
18375 {
18376 .cmd = NL80211_CMD_GET_MESH_CONFIG,
18377 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18378 .doit = nl80211_get_mesh_config,
18379 /* can be retrieved by unprivileged users */
18380 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18381 },
18382 {
18383 .cmd = NL80211_CMD_SET_MESH_CONFIG,
18384 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18385 .doit = nl80211_update_mesh_config,
18386 .flags = GENL_UNS_ADMIN_PERM,
18387 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18388 },
18389 {
18390 .cmd = NL80211_CMD_TRIGGER_SCAN,
18391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18392 .doit = nl80211_trigger_scan,
18393 .flags = GENL_UNS_ADMIN_PERM,
18394 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18395 },
18396 {
18397 .cmd = NL80211_CMD_ABORT_SCAN,
18398 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18399 .doit = nl80211_abort_scan,
18400 .flags = GENL_UNS_ADMIN_PERM,
18401 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18402 },
18403 {
18404 .cmd = NL80211_CMD_GET_SCAN,
18405 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18406 .dumpit = nl80211_dump_scan,
18407 },
18408 {
18409 .cmd = NL80211_CMD_START_SCHED_SCAN,
18410 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18411 .doit = nl80211_start_sched_scan,
18412 .flags = GENL_UNS_ADMIN_PERM,
18413 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18414 },
18415 {
18416 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
18417 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18418 .doit = nl80211_stop_sched_scan,
18419 .flags = GENL_UNS_ADMIN_PERM,
18420 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18421 },
18422 {
18423 .cmd = NL80211_CMD_AUTHENTICATE,
18424 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18425 .doit = nl80211_authenticate,
18426 .flags = GENL_UNS_ADMIN_PERM,
18427 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18428 NL80211_FLAG_CLEAR_SKB),
18429 },
18430 {
18431 .cmd = NL80211_CMD_ASSOCIATE,
18432 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18433 .doit = nl80211_associate,
18434 .flags = GENL_UNS_ADMIN_PERM,
18435 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18436 NL80211_FLAG_CLEAR_SKB),
18437 },
18438 {
18439 .cmd = NL80211_CMD_DEAUTHENTICATE,
18440 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18441 .doit = nl80211_deauthenticate,
18442 .flags = GENL_UNS_ADMIN_PERM,
18443 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18444 },
18445 {
18446 .cmd = NL80211_CMD_DISASSOCIATE,
18447 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18448 .doit = nl80211_disassociate,
18449 .flags = GENL_UNS_ADMIN_PERM,
18450 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18451 },
18452 {
18453 .cmd = NL80211_CMD_JOIN_IBSS,
18454 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18455 .doit = nl80211_join_ibss,
18456 .flags = GENL_UNS_ADMIN_PERM,
18457 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18458 },
18459 {
18460 .cmd = NL80211_CMD_LEAVE_IBSS,
18461 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18462 .doit = nl80211_leave_ibss,
18463 .flags = GENL_UNS_ADMIN_PERM,
18464 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18465 },
18466 #ifdef CONFIG_NL80211_TESTMODE
18467 {
18468 .cmd = NL80211_CMD_TESTMODE,
18469 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18470 .doit = nl80211_testmode_do,
18471 .dumpit = nl80211_testmode_dump,
18472 .flags = GENL_UNS_ADMIN_PERM,
18473 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18474 },
18475 #endif
18476 {
18477 .cmd = NL80211_CMD_CONNECT,
18478 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18479 .doit = nl80211_connect,
18480 .flags = GENL_UNS_ADMIN_PERM,
18481 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18482 NL80211_FLAG_CLEAR_SKB),
18483 },
18484 {
18485 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
18486 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18487 .doit = nl80211_update_connect_params,
18488 .flags = GENL_ADMIN_PERM,
18489 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18490 NL80211_FLAG_CLEAR_SKB),
18491 },
18492 {
18493 .cmd = NL80211_CMD_DISCONNECT,
18494 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18495 .doit = nl80211_disconnect,
18496 .flags = GENL_UNS_ADMIN_PERM,
18497 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18498 },
18499 {
18500 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
18501 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18502 .doit = nl80211_wiphy_netns,
18503 .flags = GENL_UNS_ADMIN_PERM,
18504 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18505 NL80211_FLAG_NEED_RTNL |
18506 NL80211_FLAG_NO_WIPHY_MTX),
18507 },
18508 {
18509 .cmd = NL80211_CMD_GET_SURVEY,
18510 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18511 .dumpit = nl80211_dump_survey,
18512 },
18513 {
18514 .cmd = NL80211_CMD_SET_PMKSA,
18515 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18516 .doit = nl80211_set_pmksa,
18517 .flags = GENL_UNS_ADMIN_PERM,
18518 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18519 NL80211_FLAG_CLEAR_SKB),
18520 },
18521 {
18522 .cmd = NL80211_CMD_DEL_PMKSA,
18523 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18524 .doit = nl80211_del_pmksa,
18525 .flags = GENL_UNS_ADMIN_PERM,
18526 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18527 },
18528 {
18529 .cmd = NL80211_CMD_FLUSH_PMKSA,
18530 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18531 .doit = nl80211_flush_pmksa,
18532 .flags = GENL_UNS_ADMIN_PERM,
18533 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18534 },
18535 {
18536 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
18537 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18538 .doit = nl80211_remain_on_channel,
18539 .flags = GENL_UNS_ADMIN_PERM,
18540 /* FIXME: requiring a link ID here is probably not good */
18541 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18542 NL80211_FLAG_MLO_VALID_LINK_ID),
18543 },
18544 {
18545 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18546 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18547 .doit = nl80211_cancel_remain_on_channel,
18548 .flags = GENL_UNS_ADMIN_PERM,
18549 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18550 },
18551 {
18552 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
18553 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18554 .doit = nl80211_set_tx_bitrate_mask,
18555 .flags = GENL_UNS_ADMIN_PERM,
18556 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18557 NL80211_FLAG_MLO_VALID_LINK_ID),
18558 },
18559 {
18560 .cmd = NL80211_CMD_REGISTER_FRAME,
18561 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18562 .doit = nl80211_register_mgmt,
18563 .flags = GENL_UNS_ADMIN_PERM,
18564 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18565 },
18566 {
18567 .cmd = NL80211_CMD_FRAME,
18568 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18569 .doit = nl80211_tx_mgmt,
18570 .flags = GENL_UNS_ADMIN_PERM,
18571 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18572 },
18573 {
18574 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
18575 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18576 .doit = nl80211_tx_mgmt_cancel_wait,
18577 .flags = GENL_UNS_ADMIN_PERM,
18578 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18579 },
18580 {
18581 .cmd = NL80211_CMD_SET_POWER_SAVE,
18582 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18583 .doit = nl80211_set_power_save,
18584 .flags = GENL_UNS_ADMIN_PERM,
18585 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18586 },
18587 {
18588 .cmd = NL80211_CMD_GET_POWER_SAVE,
18589 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18590 .doit = nl80211_get_power_save,
18591 /* can be retrieved by unprivileged users */
18592 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18593 },
18594 {
18595 .cmd = NL80211_CMD_SET_CQM,
18596 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18597 .doit = nl80211_set_cqm,
18598 .flags = GENL_UNS_ADMIN_PERM,
18599 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18600 },
18601 {
18602 .cmd = NL80211_CMD_SET_CHANNEL,
18603 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18604 .doit = nl80211_set_channel,
18605 .flags = GENL_UNS_ADMIN_PERM,
18606 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18607 NL80211_FLAG_MLO_VALID_LINK_ID),
18608 },
18609 {
18610 .cmd = NL80211_CMD_JOIN_MESH,
18611 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18612 .doit = nl80211_join_mesh,
18613 .flags = GENL_UNS_ADMIN_PERM,
18614 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18615 },
18616 {
18617 .cmd = NL80211_CMD_LEAVE_MESH,
18618 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18619 .doit = nl80211_leave_mesh,
18620 .flags = GENL_UNS_ADMIN_PERM,
18621 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18622 },
18623 {
18624 .cmd = NL80211_CMD_JOIN_OCB,
18625 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18626 .doit = nl80211_join_ocb,
18627 .flags = GENL_UNS_ADMIN_PERM,
18628 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18629 },
18630 {
18631 .cmd = NL80211_CMD_LEAVE_OCB,
18632 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18633 .doit = nl80211_leave_ocb,
18634 .flags = GENL_UNS_ADMIN_PERM,
18635 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18636 },
18637 #ifdef CONFIG_PM
18638 {
18639 .cmd = NL80211_CMD_GET_WOWLAN,
18640 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18641 .doit = nl80211_get_wowlan,
18642 /* can be retrieved by unprivileged users */
18643 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18644 },
18645 {
18646 .cmd = NL80211_CMD_SET_WOWLAN,
18647 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18648 .doit = nl80211_set_wowlan,
18649 .flags = GENL_UNS_ADMIN_PERM,
18650 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18651 },
18652 #endif
18653 {
18654 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
18655 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18656 .doit = nl80211_set_rekey_data,
18657 .flags = GENL_UNS_ADMIN_PERM,
18658 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18659 NL80211_FLAG_CLEAR_SKB),
18660 },
18661 {
18662 .cmd = NL80211_CMD_TDLS_MGMT,
18663 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18664 .doit = nl80211_tdls_mgmt,
18665 .flags = GENL_UNS_ADMIN_PERM,
18666 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18667 NL80211_FLAG_MLO_VALID_LINK_ID),
18668 },
18669 {
18670 .cmd = NL80211_CMD_TDLS_OPER,
18671 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18672 .doit = nl80211_tdls_oper,
18673 .flags = GENL_UNS_ADMIN_PERM,
18674 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18675 },
18676 {
18677 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
18678 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18679 .doit = nl80211_register_unexpected_frame,
18680 .flags = GENL_UNS_ADMIN_PERM,
18681 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18682 },
18683 {
18684 .cmd = NL80211_CMD_PROBE_CLIENT,
18685 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18686 .doit = nl80211_probe_client,
18687 .flags = GENL_UNS_ADMIN_PERM,
18688 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18689 },
18690 {
18691 .cmd = NL80211_CMD_REGISTER_BEACONS,
18692 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18693 .doit = nl80211_register_beacons,
18694 .flags = GENL_UNS_ADMIN_PERM,
18695 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18696 },
18697 {
18698 .cmd = NL80211_CMD_SET_NOACK_MAP,
18699 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18700 .doit = nl80211_set_noack_map,
18701 .flags = GENL_UNS_ADMIN_PERM,
18702 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18703 },
18704 {
18705 .cmd = NL80211_CMD_START_P2P_DEVICE,
18706 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18707 .doit = nl80211_start_p2p_device,
18708 .flags = GENL_UNS_ADMIN_PERM,
18709 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18710 NL80211_FLAG_NEED_RTNL),
18711 },
18712 {
18713 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
18714 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18715 .doit = nl80211_stop_p2p_device,
18716 .flags = GENL_UNS_ADMIN_PERM,
18717 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18718 NL80211_FLAG_NEED_RTNL),
18719 },
18720 {
18721 .cmd = NL80211_CMD_START_NAN,
18722 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18723 .doit = nl80211_start_nan,
18724 .flags = GENL_ADMIN_PERM,
18725 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18726 NL80211_FLAG_NEED_RTNL),
18727 },
18728 {
18729 .cmd = NL80211_CMD_STOP_NAN,
18730 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18731 .doit = nl80211_stop_nan,
18732 .flags = GENL_ADMIN_PERM,
18733 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18734 NL80211_FLAG_NEED_RTNL),
18735 },
18736 {
18737 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
18738 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18739 .doit = nl80211_nan_add_func,
18740 .flags = GENL_ADMIN_PERM,
18741 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18742 },
18743 {
18744 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
18745 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18746 .doit = nl80211_nan_del_func,
18747 .flags = GENL_ADMIN_PERM,
18748 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18749 },
18750 {
18751 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
18752 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18753 .doit = nl80211_nan_change_config,
18754 .flags = GENL_ADMIN_PERM,
18755 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18756 },
18757 {
18758 .cmd = NL80211_CMD_SET_MCAST_RATE,
18759 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18760 .doit = nl80211_set_mcast_rate,
18761 .flags = GENL_UNS_ADMIN_PERM,
18762 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18763 },
18764 {
18765 .cmd = NL80211_CMD_SET_MAC_ACL,
18766 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18767 .doit = nl80211_set_mac_acl,
18768 .flags = GENL_UNS_ADMIN_PERM,
18769 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18770 NL80211_FLAG_MLO_UNSUPPORTED),
18771 },
18772 {
18773 .cmd = NL80211_CMD_RADAR_DETECT,
18774 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18775 .doit = nl80211_start_radar_detection,
18776 .flags = GENL_UNS_ADMIN_PERM,
18777 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18778 NL80211_FLAG_NO_WIPHY_MTX |
18779 NL80211_FLAG_MLO_VALID_LINK_ID),
18780 },
18781 {
18782 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
18783 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18784 .doit = nl80211_get_protocol_features,
18785 },
18786 {
18787 .cmd = NL80211_CMD_UPDATE_FT_IES,
18788 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18789 .doit = nl80211_update_ft_ies,
18790 .flags = GENL_UNS_ADMIN_PERM,
18791 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18792 },
18793 {
18794 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
18795 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18796 .doit = nl80211_crit_protocol_start,
18797 .flags = GENL_UNS_ADMIN_PERM,
18798 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18799 },
18800 {
18801 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
18802 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18803 .doit = nl80211_crit_protocol_stop,
18804 .flags = GENL_UNS_ADMIN_PERM,
18805 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18806 },
18807 {
18808 .cmd = NL80211_CMD_GET_COALESCE,
18809 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18810 .doit = nl80211_get_coalesce,
18811 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18812 },
18813 {
18814 .cmd = NL80211_CMD_SET_COALESCE,
18815 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18816 .doit = nl80211_set_coalesce,
18817 .flags = GENL_UNS_ADMIN_PERM,
18818 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18819 },
18820 {
18821 .cmd = NL80211_CMD_CHANNEL_SWITCH,
18822 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18823 .doit = nl80211_channel_switch,
18824 .flags = GENL_UNS_ADMIN_PERM,
18825 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18826 NL80211_FLAG_MLO_VALID_LINK_ID),
18827 },
18828 {
18829 .cmd = NL80211_CMD_VENDOR,
18830 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18831 .doit = nl80211_vendor_cmd,
18832 .dumpit = nl80211_vendor_cmd_dump,
18833 .flags = GENL_UNS_ADMIN_PERM,
18834 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18835 NL80211_FLAG_CLEAR_SKB),
18836 },
18837 {
18838 .cmd = NL80211_CMD_SET_QOS_MAP,
18839 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18840 .doit = nl80211_set_qos_map,
18841 .flags = GENL_UNS_ADMIN_PERM,
18842 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18843 },
18844 {
18845 .cmd = NL80211_CMD_ADD_TX_TS,
18846 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18847 .doit = nl80211_add_tx_ts,
18848 .flags = GENL_UNS_ADMIN_PERM,
18849 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18850 NL80211_FLAG_MLO_UNSUPPORTED),
18851 },
18852 {
18853 .cmd = NL80211_CMD_DEL_TX_TS,
18854 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18855 .doit = nl80211_del_tx_ts,
18856 .flags = GENL_UNS_ADMIN_PERM,
18857 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18858 },
18859 {
18860 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
18861 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18862 .doit = nl80211_tdls_channel_switch,
18863 .flags = GENL_UNS_ADMIN_PERM,
18864 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18865 },
18866 {
18867 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
18868 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18869 .doit = nl80211_tdls_cancel_channel_switch,
18870 .flags = GENL_UNS_ADMIN_PERM,
18871 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18872 },
18873 {
18874 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
18875 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18876 .doit = nl80211_set_multicast_to_unicast,
18877 .flags = GENL_UNS_ADMIN_PERM,
18878 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18879 },
18880 {
18881 .cmd = NL80211_CMD_SET_PMK,
18882 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18883 .doit = nl80211_set_pmk,
18884 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18885 NL80211_FLAG_CLEAR_SKB),
18886 },
18887 {
18888 .cmd = NL80211_CMD_DEL_PMK,
18889 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18890 .doit = nl80211_del_pmk,
18891 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18892 },
18893 {
18894 .cmd = NL80211_CMD_EXTERNAL_AUTH,
18895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18896 .doit = nl80211_external_auth,
18897 .flags = GENL_ADMIN_PERM,
18898 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18899 },
18900 {
18901 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
18902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18903 .doit = nl80211_tx_control_port,
18904 .flags = GENL_UNS_ADMIN_PERM,
18905 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18906 },
18907 {
18908 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
18909 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18910 .doit = nl80211_get_ftm_responder_stats,
18911 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18912 NL80211_FLAG_MLO_VALID_LINK_ID),
18913 },
18914 {
18915 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
18916 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18917 .doit = nl80211_pmsr_start,
18918 .flags = GENL_UNS_ADMIN_PERM,
18919 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18920 },
18921 {
18922 .cmd = NL80211_CMD_NOTIFY_RADAR,
18923 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18924 .doit = nl80211_notify_radar_detection,
18925 .flags = GENL_UNS_ADMIN_PERM,
18926 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18927 },
18928 {
18929 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
18930 .doit = nl80211_update_owe_info,
18931 .flags = GENL_ADMIN_PERM,
18932 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18933 },
18934 {
18935 .cmd = NL80211_CMD_PROBE_MESH_LINK,
18936 .doit = nl80211_probe_mesh_link,
18937 .flags = GENL_UNS_ADMIN_PERM,
18938 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18939 },
18940 {
18941 .cmd = NL80211_CMD_SET_TID_CONFIG,
18942 .doit = nl80211_set_tid_config,
18943 .flags = GENL_UNS_ADMIN_PERM,
18944 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18945 NL80211_FLAG_MLO_VALID_LINK_ID),
18946 },
18947 {
18948 .cmd = NL80211_CMD_SET_SAR_SPECS,
18949 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18950 .doit = nl80211_set_sar_specs,
18951 .flags = GENL_UNS_ADMIN_PERM,
18952 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18953 NL80211_FLAG_NEED_RTNL),
18954 },
18955 {
18956 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
18957 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18958 .doit = nl80211_color_change,
18959 .flags = GENL_UNS_ADMIN_PERM,
18960 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18961 NL80211_FLAG_MLO_VALID_LINK_ID),
18962 },
18963 {
18964 .cmd = NL80211_CMD_SET_FILS_AAD,
18965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18966 .doit = nl80211_set_fils_aad,
18967 .flags = GENL_UNS_ADMIN_PERM,
18968 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18969 },
18970 {
18971 .cmd = NL80211_CMD_ADD_LINK,
18972 .doit = nl80211_add_link,
18973 .flags = GENL_UNS_ADMIN_PERM,
18974 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18975 },
18976 {
18977 .cmd = NL80211_CMD_REMOVE_LINK,
18978 .doit = nl80211_remove_link,
18979 .flags = GENL_UNS_ADMIN_PERM,
18980 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18981 NL80211_FLAG_MLO_VALID_LINK_ID),
18982 },
18983 {
18984 .cmd = NL80211_CMD_ADD_LINK_STA,
18985 .doit = nl80211_add_link_station,
18986 .flags = GENL_UNS_ADMIN_PERM,
18987 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18988 NL80211_FLAG_MLO_VALID_LINK_ID),
18989 },
18990 {
18991 .cmd = NL80211_CMD_MODIFY_LINK_STA,
18992 .doit = nl80211_modify_link_station,
18993 .flags = GENL_UNS_ADMIN_PERM,
18994 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18995 NL80211_FLAG_MLO_VALID_LINK_ID),
18996 },
18997 {
18998 .cmd = NL80211_CMD_REMOVE_LINK_STA,
18999 .doit = nl80211_remove_link_station,
19000 .flags = GENL_UNS_ADMIN_PERM,
19001 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
19002 NL80211_FLAG_MLO_VALID_LINK_ID),
19003 },
19004 {
19005 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
19006 .doit = nl80211_set_hw_timestamp,
19007 .flags = GENL_UNS_ADMIN_PERM,
19008 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19009 },
19010 {
19011 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
19012 .doit = nl80211_set_ttlm,
19013 .flags = GENL_UNS_ADMIN_PERM,
19014 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19015 },
19016 {
19017 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19018 .doit = nl80211_assoc_ml_reconf,
19019 .flags = GENL_UNS_ADMIN_PERM,
19020 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19021 },
19022 {
19023 .cmd = NL80211_CMD_EPCS_CFG,
19024 .doit = nl80211_epcs_cfg,
19025 .flags = GENL_UNS_ADMIN_PERM,
19026 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19027 },
19028 };
19029
19030 static struct genl_family nl80211_fam __ro_after_init = {
19031 .name = NL80211_GENL_NAME, /* have users key off the name instead */
19032 .hdrsize = 0, /* no private header */
19033 .version = 1, /* no particular meaning now */
19034 .maxattr = NL80211_ATTR_MAX,
19035 .policy = nl80211_policy,
19036 .netnsok = true,
19037 .pre_doit = nl80211_pre_doit,
19038 .post_doit = nl80211_post_doit,
19039 .module = THIS_MODULE,
19040 .ops = nl80211_ops,
19041 .n_ops = ARRAY_SIZE(nl80211_ops),
19042 .small_ops = nl80211_small_ops,
19043 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
19044 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
19045 .mcgrps = nl80211_mcgrps,
19046 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
19047 .parallel_ops = true,
19048 };
19049
19050 /* notification functions */
19051
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)19052 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
19053 enum nl80211_commands cmd)
19054 {
19055 struct sk_buff *msg;
19056 struct nl80211_dump_wiphy_state state = {};
19057
19058 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
19059 cmd != NL80211_CMD_DEL_WIPHY);
19060
19061 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19062 if (!msg)
19063 return;
19064
19065 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
19066 nlmsg_free(msg);
19067 return;
19068 }
19069
19070 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19071 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19072 }
19073
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)19074 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
19075 struct wireless_dev *wdev,
19076 enum nl80211_commands cmd)
19077 {
19078 struct sk_buff *msg;
19079
19080 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19081 if (!msg)
19082 return;
19083
19084 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
19085 nlmsg_free(msg);
19086 return;
19087 }
19088
19089 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19090 NL80211_MCGRP_CONFIG, GFP_KERNEL);
19091 }
19092
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)19093 static int nl80211_add_scan_req(struct sk_buff *msg,
19094 struct cfg80211_registered_device *rdev)
19095 {
19096 struct cfg80211_scan_request_int *req = rdev->scan_req;
19097 struct nlattr *nest;
19098 int i;
19099 struct cfg80211_scan_info *info;
19100
19101 if (WARN_ON(!req))
19102 return 0;
19103
19104 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
19105 if (!nest)
19106 goto nla_put_failure;
19107 for (i = 0; i < req->req.n_ssids; i++) {
19108 if (nla_put(msg, i, req->req.ssids[i].ssid_len,
19109 req->req.ssids[i].ssid))
19110 goto nla_put_failure;
19111 }
19112 nla_nest_end(msg, nest);
19113
19114 if (req->req.flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
19115 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
19116 if (!nest)
19117 goto nla_put_failure;
19118 for (i = 0; i < req->req.n_channels; i++) {
19119 if (nla_put_u32(msg, i,
19120 ieee80211_channel_to_khz(req->req.channels[i])))
19121 goto nla_put_failure;
19122 }
19123 nla_nest_end(msg, nest);
19124 } else {
19125 nest = nla_nest_start_noflag(msg,
19126 NL80211_ATTR_SCAN_FREQUENCIES);
19127 if (!nest)
19128 goto nla_put_failure;
19129 for (i = 0; i < req->req.n_channels; i++) {
19130 if (nla_put_u32(msg, i,
19131 req->req.channels[i]->center_freq))
19132 goto nla_put_failure;
19133 }
19134 nla_nest_end(msg, nest);
19135 }
19136
19137 if (req->req.ie &&
19138 nla_put(msg, NL80211_ATTR_IE, req->req.ie_len, req->req.ie))
19139 goto nla_put_failure;
19140
19141 if (req->req.flags &&
19142 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->req.flags))
19143 goto nla_put_failure;
19144
19145 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
19146 &rdev->scan_req->info;
19147 if (info->scan_start_tsf &&
19148 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
19149 info->scan_start_tsf, NL80211_BSS_PAD) ||
19150 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
19151 info->tsf_bssid)))
19152 goto nla_put_failure;
19153
19154 return 0;
19155 nla_put_failure:
19156 return -ENOBUFS;
19157 }
19158
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)19159 static int nl80211_prep_scan_msg(struct sk_buff *msg,
19160 struct cfg80211_registered_device *rdev,
19161 struct wireless_dev *wdev,
19162 u32 portid, u32 seq, int flags,
19163 u32 cmd)
19164 {
19165 void *hdr;
19166
19167 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
19168 if (!hdr)
19169 return -1;
19170
19171 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19172 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19173 wdev->netdev->ifindex)) ||
19174 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19175 NL80211_ATTR_PAD))
19176 goto nla_put_failure;
19177
19178 /* ignore errors and send incomplete event anyway */
19179 nl80211_add_scan_req(msg, rdev);
19180
19181 genlmsg_end(msg, hdr);
19182 return 0;
19183
19184 nla_put_failure:
19185 genlmsg_cancel(msg, hdr);
19186 return -EMSGSIZE;
19187 }
19188
19189 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)19190 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
19191 struct cfg80211_sched_scan_request *req, u32 cmd)
19192 {
19193 void *hdr;
19194
19195 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19196 if (!hdr)
19197 return -1;
19198
19199 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
19200 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
19201 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
19202 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
19203 NL80211_ATTR_PAD))
19204 goto nla_put_failure;
19205
19206 genlmsg_end(msg, hdr);
19207 return 0;
19208
19209 nla_put_failure:
19210 genlmsg_cancel(msg, hdr);
19211 return -EMSGSIZE;
19212 }
19213
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)19214 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
19215 struct wireless_dev *wdev)
19216 {
19217 struct sk_buff *msg;
19218
19219 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19220 if (!msg)
19221 return;
19222
19223 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19224 NL80211_CMD_TRIGGER_SCAN) < 0) {
19225 nlmsg_free(msg);
19226 return;
19227 }
19228
19229 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19230 NL80211_MCGRP_SCAN, GFP_KERNEL);
19231 }
19232
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)19233 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
19234 struct wireless_dev *wdev, bool aborted)
19235 {
19236 struct sk_buff *msg;
19237
19238 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19239 if (!msg)
19240 return NULL;
19241
19242 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19243 aborted ? NL80211_CMD_SCAN_ABORTED :
19244 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
19245 nlmsg_free(msg);
19246 return NULL;
19247 }
19248
19249 return msg;
19250 }
19251
19252 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)19253 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
19254 struct sk_buff *msg)
19255 {
19256 if (!msg)
19257 return;
19258
19259 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19260 NL80211_MCGRP_SCAN, GFP_KERNEL);
19261 }
19262
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)19263 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
19264 {
19265 struct sk_buff *msg;
19266
19267 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19268 if (!msg)
19269 return;
19270
19271 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
19272 nlmsg_free(msg);
19273 return;
19274 }
19275
19276 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
19277 NL80211_MCGRP_SCAN, GFP_KERNEL);
19278 }
19279
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)19280 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
19281 struct regulatory_request *request)
19282 {
19283 /* Userspace can always count this one always being set */
19284 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
19285 goto nla_put_failure;
19286
19287 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
19288 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19289 NL80211_REGDOM_TYPE_WORLD))
19290 goto nla_put_failure;
19291 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
19292 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19293 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
19294 goto nla_put_failure;
19295 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
19296 request->intersect) {
19297 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19298 NL80211_REGDOM_TYPE_INTERSECTION))
19299 goto nla_put_failure;
19300 } else {
19301 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19302 NL80211_REGDOM_TYPE_COUNTRY) ||
19303 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
19304 request->alpha2))
19305 goto nla_put_failure;
19306 }
19307
19308 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
19309 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
19310
19311 if (wiphy &&
19312 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
19313 goto nla_put_failure;
19314
19315 if (wiphy &&
19316 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
19317 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
19318 goto nla_put_failure;
19319 }
19320
19321 return true;
19322
19323 nla_put_failure:
19324 return false;
19325 }
19326
19327 /*
19328 * This can happen on global regulatory changes or device specific settings
19329 * based on custom regulatory domains.
19330 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)19331 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
19332 struct regulatory_request *request)
19333 {
19334 struct sk_buff *msg;
19335 void *hdr;
19336
19337 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19338 if (!msg)
19339 return;
19340
19341 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
19342 if (!hdr)
19343 goto nla_put_failure;
19344
19345 if (!nl80211_reg_change_event_fill(msg, request))
19346 goto nla_put_failure;
19347
19348 genlmsg_end(msg, hdr);
19349
19350 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
19351 NL80211_MCGRP_REGULATORY);
19352
19353 return;
19354
19355 nla_put_failure:
19356 nlmsg_free(msg);
19357 }
19358
19359 struct nl80211_mlme_event {
19360 enum nl80211_commands cmd;
19361 const u8 *buf;
19362 size_t buf_len;
19363 int uapsd_queues;
19364 const u8 *req_ies;
19365 size_t req_ies_len;
19366 bool reconnect;
19367 };
19368
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct nl80211_mlme_event * event,gfp_t gfp)19369 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
19370 struct net_device *netdev,
19371 const struct nl80211_mlme_event *event,
19372 gfp_t gfp)
19373 {
19374 struct sk_buff *msg;
19375 void *hdr;
19376
19377 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
19378 if (!msg)
19379 return;
19380
19381 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
19382 if (!hdr) {
19383 nlmsg_free(msg);
19384 return;
19385 }
19386
19387 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19388 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19389 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
19390 (event->req_ies &&
19391 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
19392 event->req_ies)))
19393 goto nla_put_failure;
19394
19395 if (event->reconnect &&
19396 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
19397 goto nla_put_failure;
19398
19399 if (event->uapsd_queues >= 0) {
19400 struct nlattr *nla_wmm =
19401 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
19402 if (!nla_wmm)
19403 goto nla_put_failure;
19404
19405 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
19406 event->uapsd_queues))
19407 goto nla_put_failure;
19408
19409 nla_nest_end(msg, nla_wmm);
19410 }
19411
19412 genlmsg_end(msg, hdr);
19413
19414 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19415 NL80211_MCGRP_MLME, gfp);
19416 return;
19417
19418 nla_put_failure:
19419 nlmsg_free(msg);
19420 }
19421
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)19422 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
19423 struct net_device *netdev, const u8 *buf,
19424 size_t len, gfp_t gfp)
19425 {
19426 struct nl80211_mlme_event event = {
19427 .cmd = NL80211_CMD_AUTHENTICATE,
19428 .buf = buf,
19429 .buf_len = len,
19430 .uapsd_queues = -1,
19431 };
19432
19433 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19434 }
19435
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct cfg80211_rx_assoc_resp_data * data)19436 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
19437 struct net_device *netdev,
19438 const struct cfg80211_rx_assoc_resp_data *data)
19439 {
19440 struct nl80211_mlme_event event = {
19441 .cmd = NL80211_CMD_ASSOCIATE,
19442 .buf = data->buf,
19443 .buf_len = data->len,
19444 .uapsd_queues = data->uapsd_queues,
19445 .req_ies = data->req_ies,
19446 .req_ies_len = data->req_ies_len,
19447 };
19448
19449 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
19450 }
19451
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19452 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
19453 struct net_device *netdev, const u8 *buf,
19454 size_t len, bool reconnect, gfp_t gfp)
19455 {
19456 struct nl80211_mlme_event event = {
19457 .cmd = NL80211_CMD_DEAUTHENTICATE,
19458 .buf = buf,
19459 .buf_len = len,
19460 .reconnect = reconnect,
19461 .uapsd_queues = -1,
19462 };
19463
19464 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19465 }
19466
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)19467 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
19468 struct net_device *netdev, const u8 *buf,
19469 size_t len, bool reconnect, gfp_t gfp)
19470 {
19471 struct nl80211_mlme_event event = {
19472 .cmd = NL80211_CMD_DISASSOCIATE,
19473 .buf = buf,
19474 .buf_len = len,
19475 .reconnect = reconnect,
19476 .uapsd_queues = -1,
19477 };
19478
19479 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19480 }
19481
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)19482 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
19483 size_t len)
19484 {
19485 struct wireless_dev *wdev = dev->ieee80211_ptr;
19486 struct wiphy *wiphy = wdev->wiphy;
19487 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19488 const struct ieee80211_mgmt *mgmt = (void *)buf;
19489 struct nl80211_mlme_event event = {
19490 .buf = buf,
19491 .buf_len = len,
19492 .uapsd_queues = -1,
19493 };
19494
19495 if (WARN_ON(len < 2))
19496 return;
19497
19498 if (ieee80211_is_deauth(mgmt->frame_control)) {
19499 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
19500 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
19501 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
19502 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
19503 if (wdev->unprot_beacon_reported &&
19504 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
19505 return;
19506 event.cmd = NL80211_CMD_UNPROT_BEACON;
19507 wdev->unprot_beacon_reported = jiffies;
19508 } else {
19509 return;
19510 }
19511
19512 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
19513 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
19514 }
19515 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
19516
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)19517 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
19518 struct net_device *netdev, int cmd,
19519 const u8 *addr, gfp_t gfp)
19520 {
19521 struct sk_buff *msg;
19522 void *hdr;
19523
19524 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19525 if (!msg)
19526 return;
19527
19528 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19529 if (!hdr) {
19530 nlmsg_free(msg);
19531 return;
19532 }
19533
19534 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19535 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19536 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19537 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19538 goto nla_put_failure;
19539
19540 genlmsg_end(msg, hdr);
19541
19542 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19543 NL80211_MCGRP_MLME, gfp);
19544 return;
19545
19546 nla_put_failure:
19547 nlmsg_free(msg);
19548 }
19549
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19550 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
19551 struct net_device *netdev, const u8 *addr,
19552 gfp_t gfp)
19553 {
19554 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
19555 addr, gfp);
19556 }
19557
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)19558 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
19559 struct net_device *netdev, const u8 *addr,
19560 gfp_t gfp)
19561 {
19562 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
19563 addr, gfp);
19564 }
19565
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)19566 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
19567 struct net_device *netdev,
19568 struct cfg80211_connect_resp_params *cr,
19569 gfp_t gfp)
19570 {
19571 struct sk_buff *msg;
19572 void *hdr;
19573 unsigned int link;
19574 size_t link_info_size = 0;
19575 const u8 *connected_addr = cr->valid_links ?
19576 cr->ap_mld_addr : cr->links[0].bssid;
19577
19578 if (cr->valid_links) {
19579 for_each_valid_link(cr, link) {
19580 /* Nested attribute header */
19581 link_info_size += NLA_HDRLEN;
19582 /* Link ID */
19583 link_info_size += nla_total_size(sizeof(u8));
19584 link_info_size += cr->links[link].addr ?
19585 nla_total_size(ETH_ALEN) : 0;
19586 link_info_size += (cr->links[link].bssid ||
19587 cr->links[link].bss) ?
19588 nla_total_size(ETH_ALEN) : 0;
19589 link_info_size += nla_total_size(sizeof(u16));
19590 }
19591 }
19592
19593 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
19594 cr->fils.kek_len + cr->fils.pmk_len +
19595 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
19596 gfp);
19597 if (!msg)
19598 return;
19599
19600 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
19601 if (!hdr) {
19602 nlmsg_free(msg);
19603 return;
19604 }
19605
19606 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19607 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19608 (connected_addr &&
19609 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
19610 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19611 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
19612 cr->status) ||
19613 (cr->status < 0 &&
19614 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19615 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
19616 cr->timeout_reason))) ||
19617 (cr->req_ie &&
19618 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
19619 (cr->resp_ie &&
19620 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
19621 cr->resp_ie)) ||
19622 (cr->fils.update_erp_next_seq_num &&
19623 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19624 cr->fils.erp_next_seq_num)) ||
19625 (cr->status == WLAN_STATUS_SUCCESS &&
19626 ((cr->fils.kek &&
19627 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
19628 cr->fils.kek)) ||
19629 (cr->fils.pmk &&
19630 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
19631 (cr->fils.pmkid &&
19632 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
19633 goto nla_put_failure;
19634
19635 if (cr->valid_links) {
19636 int i = 1;
19637 struct nlattr *nested;
19638
19639 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19640 if (!nested)
19641 goto nla_put_failure;
19642
19643 for_each_valid_link(cr, link) {
19644 struct nlattr *nested_mlo_links;
19645 const u8 *bssid = cr->links[link].bss ?
19646 cr->links[link].bss->bssid :
19647 cr->links[link].bssid;
19648
19649 nested_mlo_links = nla_nest_start(msg, i);
19650 if (!nested_mlo_links)
19651 goto nla_put_failure;
19652
19653 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19654 (bssid &&
19655 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19656 (cr->links[link].addr &&
19657 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19658 cr->links[link].addr)) ||
19659 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19660 cr->links[link].status))
19661 goto nla_put_failure;
19662
19663 nla_nest_end(msg, nested_mlo_links);
19664 i++;
19665 }
19666 nla_nest_end(msg, nested);
19667 }
19668
19669 genlmsg_end(msg, hdr);
19670
19671 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19672 NL80211_MCGRP_MLME, gfp);
19673 return;
19674
19675 nla_put_failure:
19676 nlmsg_free(msg);
19677 }
19678
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)19679 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
19680 struct net_device *netdev,
19681 struct cfg80211_roam_info *info, gfp_t gfp)
19682 {
19683 struct sk_buff *msg;
19684 void *hdr;
19685 size_t link_info_size = 0;
19686 unsigned int link;
19687 const u8 *connected_addr = info->ap_mld_addr ?
19688 info->ap_mld_addr :
19689 (info->links[0].bss ?
19690 info->links[0].bss->bssid :
19691 info->links[0].bssid);
19692
19693 if (info->valid_links) {
19694 for_each_valid_link(info, link) {
19695 /* Nested attribute header */
19696 link_info_size += NLA_HDRLEN;
19697 /* Link ID */
19698 link_info_size += nla_total_size(sizeof(u8));
19699 link_info_size += info->links[link].addr ?
19700 nla_total_size(ETH_ALEN) : 0;
19701 link_info_size += (info->links[link].bssid ||
19702 info->links[link].bss) ?
19703 nla_total_size(ETH_ALEN) : 0;
19704 }
19705 }
19706
19707 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
19708 info->fils.kek_len + info->fils.pmk_len +
19709 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
19710 link_info_size, gfp);
19711 if (!msg)
19712 return;
19713
19714 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
19715 if (!hdr) {
19716 nlmsg_free(msg);
19717 return;
19718 }
19719
19720 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19721 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19722 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
19723 (info->req_ie &&
19724 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
19725 info->req_ie)) ||
19726 (info->resp_ie &&
19727 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
19728 info->resp_ie)) ||
19729 (info->fils.update_erp_next_seq_num &&
19730 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19731 info->fils.erp_next_seq_num)) ||
19732 (info->fils.kek &&
19733 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
19734 info->fils.kek)) ||
19735 (info->fils.pmk &&
19736 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
19737 (info->fils.pmkid &&
19738 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
19739 goto nla_put_failure;
19740
19741 if (info->valid_links) {
19742 int i = 1;
19743 struct nlattr *nested;
19744
19745 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19746 if (!nested)
19747 goto nla_put_failure;
19748
19749 for_each_valid_link(info, link) {
19750 struct nlattr *nested_mlo_links;
19751 const u8 *bssid = info->links[link].bss ?
19752 info->links[link].bss->bssid :
19753 info->links[link].bssid;
19754
19755 nested_mlo_links = nla_nest_start(msg, i);
19756 if (!nested_mlo_links)
19757 goto nla_put_failure;
19758
19759 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19760 (bssid &&
19761 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19762 (info->links[link].addr &&
19763 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19764 info->links[link].addr)))
19765 goto nla_put_failure;
19766
19767 nla_nest_end(msg, nested_mlo_links);
19768 i++;
19769 }
19770 nla_nest_end(msg, nested);
19771 }
19772
19773 genlmsg_end(msg, hdr);
19774
19775 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19776 NL80211_MCGRP_MLME, gfp);
19777 return;
19778
19779 nla_put_failure:
19780 nlmsg_free(msg);
19781 }
19782
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * peer_addr,const u8 * td_bitmap,u8 td_bitmap_len)19783 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
19784 struct net_device *netdev, const u8 *peer_addr,
19785 const u8 *td_bitmap, u8 td_bitmap_len)
19786 {
19787 struct sk_buff *msg;
19788 void *hdr;
19789
19790 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19791 if (!msg)
19792 return;
19793
19794 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
19795 if (!hdr) {
19796 nlmsg_free(msg);
19797 return;
19798 }
19799
19800 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19801 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19802 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
19803 goto nla_put_failure;
19804
19805 if (td_bitmap_len > 0 && td_bitmap &&
19806 nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
19807 goto nla_put_failure;
19808
19809 genlmsg_end(msg, hdr);
19810
19811 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19812 NL80211_MCGRP_MLME, GFP_KERNEL);
19813 return;
19814
19815 nla_put_failure:
19816 nlmsg_free(msg);
19817 }
19818
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)19819 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
19820 struct net_device *netdev, u16 reason,
19821 const u8 *ie, size_t ie_len, bool from_ap)
19822 {
19823 struct sk_buff *msg;
19824 void *hdr;
19825
19826 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
19827 if (!msg)
19828 return;
19829
19830 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
19831 if (!hdr) {
19832 nlmsg_free(msg);
19833 return;
19834 }
19835
19836 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19837 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19838 (reason &&
19839 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
19840 (from_ap &&
19841 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
19842 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
19843 goto nla_put_failure;
19844
19845 genlmsg_end(msg, hdr);
19846
19847 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19848 NL80211_MCGRP_MLME, GFP_KERNEL);
19849 return;
19850
19851 nla_put_failure:
19852 nlmsg_free(msg);
19853 }
19854
cfg80211_links_removed(struct net_device * dev,u16 link_mask)19855 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
19856 {
19857 struct wireless_dev *wdev = dev->ieee80211_ptr;
19858 struct wiphy *wiphy = wdev->wiphy;
19859 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19860 struct sk_buff *msg;
19861 struct nlattr *links;
19862 void *hdr;
19863
19864 lockdep_assert_wiphy(wdev->wiphy);
19865 trace_cfg80211_links_removed(dev, link_mask);
19866
19867 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
19868 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
19869 return;
19870
19871 if (WARN_ON(!wdev->valid_links || !link_mask ||
19872 (wdev->valid_links & link_mask) != link_mask ||
19873 wdev->valid_links == link_mask))
19874 return;
19875
19876 cfg80211_wdev_release_link_bsses(wdev, link_mask);
19877 wdev->valid_links &= ~link_mask;
19878
19879 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19880 if (!msg)
19881 return;
19882
19883 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
19884 if (!hdr) {
19885 nlmsg_free(msg);
19886 return;
19887 }
19888
19889 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19890 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19891 goto nla_put_failure;
19892
19893 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19894 if (!links)
19895 goto nla_put_failure;
19896
19897 while (link_mask) {
19898 struct nlattr *link;
19899 int link_id = __ffs(link_mask);
19900
19901 link = nla_nest_start(msg, link_id + 1);
19902 if (!link)
19903 goto nla_put_failure;
19904
19905 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19906 goto nla_put_failure;
19907
19908 nla_nest_end(msg, link);
19909 link_mask &= ~(1 << link_id);
19910 }
19911
19912 nla_nest_end(msg, links);
19913
19914 genlmsg_end(msg, hdr);
19915
19916 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19917 NL80211_MCGRP_MLME, GFP_KERNEL);
19918 return;
19919
19920 nla_put_failure:
19921 nlmsg_free(msg);
19922 }
19923 EXPORT_SYMBOL(cfg80211_links_removed);
19924
nl80211_mlo_reconf_add_done(struct net_device * dev,struct cfg80211_mlo_reconf_done_data * data)19925 void nl80211_mlo_reconf_add_done(struct net_device *dev,
19926 struct cfg80211_mlo_reconf_done_data *data)
19927 {
19928 struct wireless_dev *wdev = dev->ieee80211_ptr;
19929 struct wiphy *wiphy = wdev->wiphy;
19930 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19931 struct nl80211_mlme_event event = {
19932 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19933 .buf = data->buf,
19934 .buf_len = data->len,
19935 .uapsd_queues = -1,
19936 };
19937
19938 nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
19939 }
19940 EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
19941
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)19942 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
19943 struct net_device *netdev, const u8 *bssid,
19944 gfp_t gfp)
19945 {
19946 struct sk_buff *msg;
19947 void *hdr;
19948
19949 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19950 if (!msg)
19951 return;
19952
19953 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
19954 if (!hdr) {
19955 nlmsg_free(msg);
19956 return;
19957 }
19958
19959 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19960 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19961 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19962 goto nla_put_failure;
19963
19964 genlmsg_end(msg, hdr);
19965
19966 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19967 NL80211_MCGRP_MLME, gfp);
19968 return;
19969
19970 nla_put_failure:
19971 nlmsg_free(msg);
19972 }
19973
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)19974 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
19975 const u8 *ie, u8 ie_len,
19976 int sig_dbm, gfp_t gfp)
19977 {
19978 struct wireless_dev *wdev = dev->ieee80211_ptr;
19979 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19980 struct sk_buff *msg;
19981 void *hdr;
19982
19983 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
19984 return;
19985
19986 trace_cfg80211_notify_new_peer_candidate(dev, addr);
19987
19988 msg = nlmsg_new(100 + ie_len, gfp);
19989 if (!msg)
19990 return;
19991
19992 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
19993 if (!hdr) {
19994 nlmsg_free(msg);
19995 return;
19996 }
19997
19998 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19999 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20000 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20001 (ie_len && ie &&
20002 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
20003 (sig_dbm &&
20004 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
20005 goto nla_put_failure;
20006
20007 genlmsg_end(msg, hdr);
20008
20009 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20010 NL80211_MCGRP_MLME, gfp);
20011 return;
20012
20013 nla_put_failure:
20014 nlmsg_free(msg);
20015 }
20016 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
20017
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)20018 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
20019 struct net_device *netdev, const u8 *addr,
20020 enum nl80211_key_type key_type, int key_id,
20021 const u8 *tsc, gfp_t gfp)
20022 {
20023 struct sk_buff *msg;
20024 void *hdr;
20025
20026 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20027 if (!msg)
20028 return;
20029
20030 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
20031 if (!hdr) {
20032 nlmsg_free(msg);
20033 return;
20034 }
20035
20036 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20037 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20038 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
20039 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
20040 (key_id != -1 &&
20041 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
20042 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
20043 goto nla_put_failure;
20044
20045 genlmsg_end(msg, hdr);
20046
20047 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20048 NL80211_MCGRP_MLME, gfp);
20049 return;
20050
20051 nla_put_failure:
20052 nlmsg_free(msg);
20053 }
20054
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)20055 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
20056 struct ieee80211_channel *channel_before,
20057 struct ieee80211_channel *channel_after)
20058 {
20059 struct sk_buff *msg;
20060 void *hdr;
20061 struct nlattr *nl_freq;
20062
20063 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
20064 if (!msg)
20065 return;
20066
20067 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
20068 if (!hdr) {
20069 nlmsg_free(msg);
20070 return;
20071 }
20072
20073 /*
20074 * Since we are applying the beacon hint to a wiphy we know its
20075 * wiphy_idx is valid
20076 */
20077 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
20078 goto nla_put_failure;
20079
20080 /* Before */
20081 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
20082 if (!nl_freq)
20083 goto nla_put_failure;
20084
20085 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
20086 goto nla_put_failure;
20087 nla_nest_end(msg, nl_freq);
20088
20089 /* After */
20090 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
20091 if (!nl_freq)
20092 goto nla_put_failure;
20093
20094 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
20095 goto nla_put_failure;
20096 nla_nest_end(msg, nl_freq);
20097
20098 genlmsg_end(msg, hdr);
20099
20100 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
20101 NL80211_MCGRP_REGULATORY);
20102
20103 return;
20104
20105 nla_put_failure:
20106 nlmsg_free(msg);
20107 }
20108
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20109 static void nl80211_send_remain_on_chan_event(
20110 int cmd, struct cfg80211_registered_device *rdev,
20111 struct wireless_dev *wdev, u64 cookie,
20112 struct ieee80211_channel *chan,
20113 unsigned int duration, gfp_t gfp)
20114 {
20115 struct sk_buff *msg;
20116 void *hdr;
20117
20118 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20119 if (!msg)
20120 return;
20121
20122 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20123 if (!hdr) {
20124 nlmsg_free(msg);
20125 return;
20126 }
20127
20128 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20129 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20130 wdev->netdev->ifindex)) ||
20131 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20132 NL80211_ATTR_PAD) ||
20133 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
20134 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
20135 NL80211_CHAN_NO_HT) ||
20136 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
20137 NL80211_ATTR_PAD))
20138 goto nla_put_failure;
20139
20140 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
20141 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
20142 goto nla_put_failure;
20143
20144 genlmsg_end(msg, hdr);
20145
20146 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20147 NL80211_MCGRP_MLME, gfp);
20148 return;
20149
20150 nla_put_failure:
20151 nlmsg_free(msg);
20152 }
20153
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)20154 void cfg80211_assoc_comeback(struct net_device *netdev,
20155 const u8 *ap_addr, u32 timeout)
20156 {
20157 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20158 struct wiphy *wiphy = wdev->wiphy;
20159 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20160 struct sk_buff *msg;
20161 void *hdr;
20162
20163 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
20164
20165 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20166 if (!msg)
20167 return;
20168
20169 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
20170 if (!hdr) {
20171 nlmsg_free(msg);
20172 return;
20173 }
20174
20175 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20176 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20177 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
20178 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
20179 goto nla_put_failure;
20180
20181 genlmsg_end(msg, hdr);
20182
20183 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20184 NL80211_MCGRP_MLME, GFP_KERNEL);
20185 return;
20186
20187 nla_put_failure:
20188 nlmsg_free(msg);
20189 }
20190 EXPORT_SYMBOL(cfg80211_assoc_comeback);
20191
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)20192 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
20193 struct ieee80211_channel *chan,
20194 unsigned int duration, gfp_t gfp)
20195 {
20196 struct wiphy *wiphy = wdev->wiphy;
20197 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20198
20199 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
20200 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
20201 rdev, wdev, cookie, chan,
20202 duration, gfp);
20203 }
20204 EXPORT_SYMBOL(cfg80211_ready_on_channel);
20205
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20206 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
20207 struct ieee80211_channel *chan,
20208 gfp_t gfp)
20209 {
20210 struct wiphy *wiphy = wdev->wiphy;
20211 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20212
20213 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
20214 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
20215 rdev, wdev, cookie, chan, 0, gfp);
20216 }
20217 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
20218
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)20219 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
20220 struct ieee80211_channel *chan,
20221 gfp_t gfp)
20222 {
20223 struct wiphy *wiphy = wdev->wiphy;
20224 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20225
20226 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
20227 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
20228 rdev, wdev, cookie, chan, 0, gfp);
20229 }
20230 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
20231
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20232 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
20233 struct station_info *sinfo, gfp_t gfp)
20234 {
20235 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20236 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20237 struct sk_buff *msg;
20238
20239 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
20240
20241 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20242 if (!msg)
20243 return;
20244
20245 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
20246 rdev, dev, mac_addr, sinfo, false) < 0) {
20247 nlmsg_free(msg);
20248 return;
20249 }
20250
20251 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20252 NL80211_MCGRP_MLME, gfp);
20253 }
20254 EXPORT_SYMBOL(cfg80211_new_sta);
20255
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)20256 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
20257 struct station_info *sinfo, gfp_t gfp)
20258 {
20259 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20260 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20261 struct sk_buff *msg;
20262 struct station_info empty_sinfo = {};
20263
20264 if (!sinfo)
20265 sinfo = &empty_sinfo;
20266
20267 trace_cfg80211_del_sta(dev, mac_addr);
20268
20269 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20270 if (!msg) {
20271 cfg80211_sinfo_release_content(sinfo);
20272 return;
20273 }
20274
20275 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
20276 rdev, dev, mac_addr, sinfo, false) < 0) {
20277 nlmsg_free(msg);
20278 return;
20279 }
20280
20281 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20282 NL80211_MCGRP_MLME, gfp);
20283 }
20284 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
20285
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)20286 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
20287 enum nl80211_connect_failed_reason reason,
20288 gfp_t gfp)
20289 {
20290 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20291 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20292 struct sk_buff *msg;
20293 void *hdr;
20294
20295 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
20296 if (!msg)
20297 return;
20298
20299 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
20300 if (!hdr) {
20301 nlmsg_free(msg);
20302 return;
20303 }
20304
20305 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20306 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
20307 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
20308 goto nla_put_failure;
20309
20310 genlmsg_end(msg, hdr);
20311
20312 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20313 NL80211_MCGRP_MLME, gfp);
20314 return;
20315
20316 nla_put_failure:
20317 nlmsg_free(msg);
20318 }
20319 EXPORT_SYMBOL(cfg80211_conn_failed);
20320
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,int link_id,gfp_t gfp)20321 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
20322 const u8 *addr, int link_id, gfp_t gfp)
20323 {
20324 struct wireless_dev *wdev = dev->ieee80211_ptr;
20325 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20326 struct sk_buff *msg;
20327 void *hdr;
20328 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
20329
20330 if (!nlportid)
20331 return false;
20332
20333 msg = nlmsg_new(100, gfp);
20334 if (!msg)
20335 return true;
20336
20337 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20338 if (!hdr) {
20339 nlmsg_free(msg);
20340 return true;
20341 }
20342
20343 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20344 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20345 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20346 (link_id >= 0 &&
20347 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20348 goto nla_put_failure;
20349
20350 genlmsg_end(msg, hdr);
20351 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20352 return true;
20353
20354 nla_put_failure:
20355 nlmsg_free(msg);
20356 return true;
20357 }
20358
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20359 bool cfg80211_rx_spurious_frame(struct net_device *dev, const u8 *addr,
20360 int link_id, gfp_t gfp)
20361 {
20362 struct wireless_dev *wdev = dev->ieee80211_ptr;
20363 bool ret;
20364
20365 trace_cfg80211_rx_spurious_frame(dev, addr, link_id);
20366
20367 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20368 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
20369 trace_cfg80211_return_bool(false);
20370 return false;
20371 }
20372 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
20373 addr, link_id, gfp);
20374 trace_cfg80211_return_bool(ret);
20375 return ret;
20376 }
20377 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
20378
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,int link_id,gfp_t gfp)20379 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, const u8 *addr,
20380 int link_id, gfp_t gfp)
20381 {
20382 struct wireless_dev *wdev = dev->ieee80211_ptr;
20383 bool ret;
20384
20385 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr, link_id);
20386
20387 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20388 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
20389 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
20390 trace_cfg80211_return_bool(false);
20391 return false;
20392 }
20393 ret = __nl80211_unexpected_frame(dev,
20394 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
20395 addr, link_id, gfp);
20396 trace_cfg80211_return_bool(ret);
20397 return ret;
20398 }
20399 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
20400
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)20401 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
20402 struct wireless_dev *wdev, u32 nlportid,
20403 struct cfg80211_rx_info *info, gfp_t gfp)
20404 {
20405 struct net_device *netdev = wdev->netdev;
20406 struct sk_buff *msg;
20407 void *hdr;
20408
20409 msg = nlmsg_new(100 + info->len, gfp);
20410 if (!msg)
20411 return -ENOMEM;
20412
20413 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20414 if (!hdr) {
20415 nlmsg_free(msg);
20416 return -ENOMEM;
20417 }
20418
20419 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20420 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20421 netdev->ifindex)) ||
20422 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20423 NL80211_ATTR_PAD) ||
20424 (info->have_link_id &&
20425 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
20426 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
20427 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
20428 (info->sig_dbm &&
20429 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
20430 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
20431 (info->flags &&
20432 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
20433 (info->rx_tstamp && nla_put_u64_64bit(msg,
20434 NL80211_ATTR_RX_HW_TIMESTAMP,
20435 info->rx_tstamp,
20436 NL80211_ATTR_PAD)) ||
20437 (info->ack_tstamp && nla_put_u64_64bit(msg,
20438 NL80211_ATTR_TX_HW_TIMESTAMP,
20439 info->ack_tstamp,
20440 NL80211_ATTR_PAD)))
20441 goto nla_put_failure;
20442
20443 genlmsg_end(msg, hdr);
20444
20445 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20446
20447 nla_put_failure:
20448 nlmsg_free(msg);
20449 return -ENOBUFS;
20450 }
20451
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)20452 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
20453 struct cfg80211_tx_status *status,
20454 gfp_t gfp, enum nl80211_commands command)
20455 {
20456 struct wiphy *wiphy = wdev->wiphy;
20457 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20458 struct net_device *netdev = wdev->netdev;
20459 struct sk_buff *msg;
20460 void *hdr;
20461
20462 if (command == NL80211_CMD_FRAME_TX_STATUS)
20463 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
20464 status->ack);
20465 else
20466 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
20467 status->ack);
20468
20469 msg = nlmsg_new(100 + status->len, gfp);
20470 if (!msg)
20471 return;
20472
20473 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
20474 if (!hdr) {
20475 nlmsg_free(msg);
20476 return;
20477 }
20478
20479 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20480 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20481 netdev->ifindex)) ||
20482 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20483 NL80211_ATTR_PAD) ||
20484 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
20485 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
20486 NL80211_ATTR_PAD) ||
20487 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
20488 (status->tx_tstamp &&
20489 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
20490 status->tx_tstamp, NL80211_ATTR_PAD)) ||
20491 (status->ack_tstamp &&
20492 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
20493 status->ack_tstamp, NL80211_ATTR_PAD)))
20494 goto nla_put_failure;
20495
20496 genlmsg_end(msg, hdr);
20497
20498 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20499 NL80211_MCGRP_MLME, gfp);
20500 return;
20501
20502 nla_put_failure:
20503 nlmsg_free(msg);
20504 }
20505
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)20506 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
20507 const u8 *buf, size_t len, bool ack,
20508 gfp_t gfp)
20509 {
20510 struct cfg80211_tx_status status = {
20511 .cookie = cookie,
20512 .buf = buf,
20513 .len = len,
20514 .ack = ack
20515 };
20516
20517 nl80211_frame_tx_status(wdev, &status, gfp,
20518 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
20519 }
20520 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
20521
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)20522 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
20523 struct cfg80211_tx_status *status, gfp_t gfp)
20524 {
20525 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
20526 }
20527 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
20528
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)20529 static int __nl80211_rx_control_port(struct net_device *dev,
20530 struct sk_buff *skb,
20531 bool unencrypted,
20532 int link_id,
20533 gfp_t gfp)
20534 {
20535 struct wireless_dev *wdev = dev->ieee80211_ptr;
20536 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20537 struct ethhdr *ehdr = eth_hdr(skb);
20538 const u8 *addr = ehdr->h_source;
20539 u16 proto = be16_to_cpu(skb->protocol);
20540 struct sk_buff *msg;
20541 void *hdr;
20542 struct nlattr *frame;
20543
20544 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
20545
20546 if (!nlportid)
20547 return -ENOENT;
20548
20549 msg = nlmsg_new(100 + skb->len, gfp);
20550 if (!msg)
20551 return -ENOMEM;
20552
20553 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
20554 if (!hdr) {
20555 nlmsg_free(msg);
20556 return -ENOBUFS;
20557 }
20558
20559 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20560 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20561 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20562 NL80211_ATTR_PAD) ||
20563 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20564 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
20565 (link_id >= 0 &&
20566 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
20567 (unencrypted && nla_put_flag(msg,
20568 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
20569 goto nla_put_failure;
20570
20571 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
20572 if (!frame)
20573 goto nla_put_failure;
20574
20575 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
20576 genlmsg_end(msg, hdr);
20577
20578 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20579
20580 nla_put_failure:
20581 nlmsg_free(msg);
20582 return -ENOBUFS;
20583 }
20584
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)20585 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
20586 bool unencrypted, int link_id)
20587 {
20588 int ret;
20589
20590 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
20591 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
20592 GFP_ATOMIC);
20593 trace_cfg80211_return_bool(ret == 0);
20594 return ret == 0;
20595 }
20596 EXPORT_SYMBOL(cfg80211_rx_control_port);
20597
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)20598 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
20599 const char *mac, gfp_t gfp)
20600 {
20601 struct wireless_dev *wdev = dev->ieee80211_ptr;
20602 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20603 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20604 void **cb;
20605
20606 if (!msg)
20607 return NULL;
20608
20609 cb = (void **)msg->cb;
20610
20611 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
20612 if (!cb[0]) {
20613 nlmsg_free(msg);
20614 return NULL;
20615 }
20616
20617 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20618 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
20619 goto nla_put_failure;
20620
20621 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
20622 goto nla_put_failure;
20623
20624 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
20625 if (!cb[1])
20626 goto nla_put_failure;
20627
20628 cb[2] = rdev;
20629
20630 return msg;
20631 nla_put_failure:
20632 nlmsg_free(msg);
20633 return NULL;
20634 }
20635
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)20636 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
20637 {
20638 void **cb = (void **)msg->cb;
20639 struct cfg80211_registered_device *rdev = cb[2];
20640
20641 nla_nest_end(msg, cb[1]);
20642 genlmsg_end(msg, cb[0]);
20643
20644 memset(msg->cb, 0, sizeof(msg->cb));
20645
20646 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20647 NL80211_MCGRP_MLME, gfp);
20648 }
20649
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)20650 void cfg80211_cqm_rssi_notify(struct net_device *dev,
20651 enum nl80211_cqm_rssi_threshold_event rssi_event,
20652 s32 rssi_level, gfp_t gfp)
20653 {
20654 struct wireless_dev *wdev = dev->ieee80211_ptr;
20655 struct cfg80211_cqm_config *cqm_config;
20656
20657 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
20658
20659 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
20660 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
20661 return;
20662
20663 rcu_read_lock();
20664 cqm_config = rcu_dereference(wdev->cqm_config);
20665 if (cqm_config) {
20666 cqm_config->last_rssi_event_value = rssi_level;
20667 cqm_config->last_rssi_event_type = rssi_event;
20668 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
20669 }
20670 rcu_read_unlock();
20671 }
20672 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
20673
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)20674 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
20675 {
20676 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
20677 cqm_rssi_work);
20678 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20679 enum nl80211_cqm_rssi_threshold_event rssi_event;
20680 struct cfg80211_cqm_config *cqm_config;
20681 struct sk_buff *msg;
20682 s32 rssi_level;
20683
20684 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
20685 if (!cqm_config)
20686 return;
20687
20688 if (cqm_config->use_range_api)
20689 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
20690
20691 rssi_level = cqm_config->last_rssi_event_value;
20692 rssi_event = cqm_config->last_rssi_event_type;
20693
20694 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
20695 if (!msg)
20696 return;
20697
20698 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
20699 rssi_event))
20700 goto nla_put_failure;
20701
20702 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
20703 rssi_level))
20704 goto nla_put_failure;
20705
20706 cfg80211_send_cqm(msg, GFP_KERNEL);
20707
20708 return;
20709
20710 nla_put_failure:
20711 nlmsg_free(msg);
20712 }
20713
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)20714 void cfg80211_cqm_txe_notify(struct net_device *dev,
20715 const u8 *peer, u32 num_packets,
20716 u32 rate, u32 intvl, gfp_t gfp)
20717 {
20718 struct sk_buff *msg;
20719
20720 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20721 if (!msg)
20722 return;
20723
20724 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
20725 goto nla_put_failure;
20726
20727 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
20728 goto nla_put_failure;
20729
20730 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
20731 goto nla_put_failure;
20732
20733 cfg80211_send_cqm(msg, gfp);
20734 return;
20735
20736 nla_put_failure:
20737 nlmsg_free(msg);
20738 }
20739 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
20740
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)20741 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
20742 const u8 *peer, u32 num_packets, gfp_t gfp)
20743 {
20744 struct sk_buff *msg;
20745
20746 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
20747
20748 msg = cfg80211_prepare_cqm(dev, peer, gfp);
20749 if (!msg)
20750 return;
20751
20752 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
20753 goto nla_put_failure;
20754
20755 cfg80211_send_cqm(msg, gfp);
20756 return;
20757
20758 nla_put_failure:
20759 nlmsg_free(msg);
20760 }
20761 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
20762
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)20763 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
20764 {
20765 struct sk_buff *msg;
20766
20767 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
20768 if (!msg)
20769 return;
20770
20771 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
20772 goto nla_put_failure;
20773
20774 cfg80211_send_cqm(msg, gfp);
20775 return;
20776
20777 nla_put_failure:
20778 nlmsg_free(msg);
20779 }
20780 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
20781
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20782 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
20783 struct net_device *netdev, const u8 *bssid,
20784 const u8 *replay_ctr, gfp_t gfp)
20785 {
20786 struct sk_buff *msg;
20787 struct nlattr *rekey_attr;
20788 void *hdr;
20789
20790 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20791 if (!msg)
20792 return;
20793
20794 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
20795 if (!hdr) {
20796 nlmsg_free(msg);
20797 return;
20798 }
20799
20800 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20801 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20802 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
20803 goto nla_put_failure;
20804
20805 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
20806 if (!rekey_attr)
20807 goto nla_put_failure;
20808
20809 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
20810 NL80211_REPLAY_CTR_LEN, replay_ctr))
20811 goto nla_put_failure;
20812
20813 nla_nest_end(msg, rekey_attr);
20814
20815 genlmsg_end(msg, hdr);
20816
20817 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20818 NL80211_MCGRP_MLME, gfp);
20819 return;
20820
20821 nla_put_failure:
20822 nlmsg_free(msg);
20823 }
20824
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)20825 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
20826 const u8 *replay_ctr, gfp_t gfp)
20827 {
20828 struct wireless_dev *wdev = dev->ieee80211_ptr;
20829 struct wiphy *wiphy = wdev->wiphy;
20830 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20831
20832 trace_cfg80211_gtk_rekey_notify(dev, bssid);
20833 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
20834 }
20835 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
20836
20837 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20838 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
20839 struct net_device *netdev, int index,
20840 const u8 *bssid, bool preauth, gfp_t gfp)
20841 {
20842 struct sk_buff *msg;
20843 struct nlattr *attr;
20844 void *hdr;
20845
20846 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20847 if (!msg)
20848 return;
20849
20850 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
20851 if (!hdr) {
20852 nlmsg_free(msg);
20853 return;
20854 }
20855
20856 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20857 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20858 goto nla_put_failure;
20859
20860 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
20861 if (!attr)
20862 goto nla_put_failure;
20863
20864 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
20865 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
20866 (preauth &&
20867 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
20868 goto nla_put_failure;
20869
20870 nla_nest_end(msg, attr);
20871
20872 genlmsg_end(msg, hdr);
20873
20874 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20875 NL80211_MCGRP_MLME, gfp);
20876 return;
20877
20878 nla_put_failure:
20879 nlmsg_free(msg);
20880 }
20881
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)20882 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
20883 const u8 *bssid, bool preauth, gfp_t gfp)
20884 {
20885 struct wireless_dev *wdev = dev->ieee80211_ptr;
20886 struct wiphy *wiphy = wdev->wiphy;
20887 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20888
20889 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
20890 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
20891 }
20892 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
20893
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)20894 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
20895 struct net_device *netdev,
20896 unsigned int link_id,
20897 struct cfg80211_chan_def *chandef,
20898 gfp_t gfp,
20899 enum nl80211_commands notif,
20900 u8 count, bool quiet)
20901 {
20902 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20903 struct sk_buff *msg;
20904 void *hdr;
20905
20906 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20907 if (!msg)
20908 return;
20909
20910 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
20911 if (!hdr) {
20912 nlmsg_free(msg);
20913 return;
20914 }
20915
20916 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20917 goto nla_put_failure;
20918
20919 if (wdev->valid_links &&
20920 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
20921 goto nla_put_failure;
20922
20923 if (nl80211_send_chandef(msg, chandef))
20924 goto nla_put_failure;
20925
20926 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
20927 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
20928 goto nla_put_failure;
20929 if (quiet &&
20930 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
20931 goto nla_put_failure;
20932 }
20933
20934 genlmsg_end(msg, hdr);
20935
20936 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20937 NL80211_MCGRP_MLME, gfp);
20938 return;
20939
20940 nla_put_failure:
20941 nlmsg_free(msg);
20942 }
20943
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)20944 void cfg80211_ch_switch_notify(struct net_device *dev,
20945 struct cfg80211_chan_def *chandef,
20946 unsigned int link_id)
20947 {
20948 struct wireless_dev *wdev = dev->ieee80211_ptr;
20949 struct wiphy *wiphy = wdev->wiphy;
20950 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20951
20952 lockdep_assert_wiphy(wdev->wiphy);
20953 WARN_INVALID_LINK_ID(wdev, link_id);
20954
20955 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
20956
20957 switch (wdev->iftype) {
20958 case NL80211_IFTYPE_STATION:
20959 case NL80211_IFTYPE_P2P_CLIENT:
20960 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
20961 cfg80211_update_assoc_bss_entry(wdev, link_id,
20962 chandef->chan);
20963 break;
20964 case NL80211_IFTYPE_MESH_POINT:
20965 wdev->u.mesh.chandef = *chandef;
20966 wdev->u.mesh.preset_chandef = *chandef;
20967 break;
20968 case NL80211_IFTYPE_AP:
20969 case NL80211_IFTYPE_P2P_GO:
20970 wdev->links[link_id].ap.chandef = *chandef;
20971 break;
20972 case NL80211_IFTYPE_ADHOC:
20973 wdev->u.ibss.chandef = *chandef;
20974 break;
20975 default:
20976 WARN_ON(1);
20977 break;
20978 }
20979
20980 cfg80211_schedule_channels_check(wdev);
20981 cfg80211_sched_dfs_chan_update(rdev);
20982
20983 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
20984 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
20985 }
20986 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
20987
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet)20988 void cfg80211_ch_switch_started_notify(struct net_device *dev,
20989 struct cfg80211_chan_def *chandef,
20990 unsigned int link_id, u8 count,
20991 bool quiet)
20992 {
20993 struct wireless_dev *wdev = dev->ieee80211_ptr;
20994 struct wiphy *wiphy = wdev->wiphy;
20995 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20996
20997 lockdep_assert_wiphy(wdev->wiphy);
20998 WARN_INVALID_LINK_ID(wdev, link_id);
20999
21000 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
21001
21002
21003 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
21004 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
21005 count, quiet);
21006 }
21007 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
21008
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap,u8 link_id)21009 int cfg80211_bss_color_notify(struct net_device *dev,
21010 enum nl80211_commands cmd, u8 count,
21011 u64 color_bitmap, u8 link_id)
21012 {
21013 struct wireless_dev *wdev = dev->ieee80211_ptr;
21014 struct wiphy *wiphy = wdev->wiphy;
21015 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21016 struct sk_buff *msg;
21017 void *hdr;
21018
21019 lockdep_assert_wiphy(wdev->wiphy);
21020
21021 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
21022
21023 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21024 if (!msg)
21025 return -ENOMEM;
21026
21027 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
21028 if (!hdr)
21029 goto nla_put_failure;
21030
21031 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21032 goto nla_put_failure;
21033
21034 if (wdev->valid_links &&
21035 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
21036 goto nla_put_failure;
21037
21038 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
21039 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
21040 goto nla_put_failure;
21041
21042 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
21043 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
21044 color_bitmap, NL80211_ATTR_PAD))
21045 goto nla_put_failure;
21046
21047 genlmsg_end(msg, hdr);
21048
21049 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
21050 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
21051
21052 nla_put_failure:
21053 nlmsg_free(msg);
21054 return -EINVAL;
21055 }
21056 EXPORT_SYMBOL(cfg80211_bss_color_notify);
21057
21058 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)21059 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
21060 const struct cfg80211_chan_def *chandef,
21061 enum nl80211_radar_event event,
21062 struct net_device *netdev, gfp_t gfp)
21063 {
21064 struct sk_buff *msg;
21065 void *hdr;
21066
21067 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21068 if (!msg)
21069 return;
21070
21071 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
21072 if (!hdr) {
21073 nlmsg_free(msg);
21074 return;
21075 }
21076
21077 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21078 goto nla_put_failure;
21079
21080 /* NOP and radar events don't need a netdev parameter */
21081 if (netdev) {
21082 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21083
21084 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21085 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21086 NL80211_ATTR_PAD))
21087 goto nla_put_failure;
21088 }
21089
21090 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
21091 goto nla_put_failure;
21092
21093 if (nl80211_send_chandef(msg, chandef))
21094 goto nla_put_failure;
21095
21096 genlmsg_end(msg, hdr);
21097
21098 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21099 NL80211_MCGRP_MLME, gfp);
21100 return;
21101
21102 nla_put_failure:
21103 nlmsg_free(msg);
21104 }
21105
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)21106 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
21107 struct sta_opmode_info *sta_opmode,
21108 gfp_t gfp)
21109 {
21110 struct sk_buff *msg;
21111 struct wireless_dev *wdev = dev->ieee80211_ptr;
21112 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21113 void *hdr;
21114
21115 if (WARN_ON(!mac))
21116 return;
21117
21118 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21119 if (!msg)
21120 return;
21121
21122 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
21123 if (!hdr) {
21124 nlmsg_free(msg);
21125 return;
21126 }
21127
21128 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21129 goto nla_put_failure;
21130
21131 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21132 goto nla_put_failure;
21133
21134 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
21135 goto nla_put_failure;
21136
21137 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
21138 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
21139 goto nla_put_failure;
21140
21141 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
21142 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
21143 goto nla_put_failure;
21144
21145 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
21146 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
21147 goto nla_put_failure;
21148
21149 genlmsg_end(msg, hdr);
21150
21151 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21152 NL80211_MCGRP_MLME, gfp);
21153
21154 return;
21155
21156 nla_put_failure:
21157 nlmsg_free(msg);
21158 }
21159 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
21160
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)21161 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
21162 u64 cookie, bool acked, s32 ack_signal,
21163 bool is_valid_ack_signal, gfp_t gfp)
21164 {
21165 struct wireless_dev *wdev = dev->ieee80211_ptr;
21166 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21167 struct sk_buff *msg;
21168 void *hdr;
21169
21170 trace_cfg80211_probe_status(dev, addr, cookie, acked);
21171
21172 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21173
21174 if (!msg)
21175 return;
21176
21177 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
21178 if (!hdr) {
21179 nlmsg_free(msg);
21180 return;
21181 }
21182
21183 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21184 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21185 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
21186 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
21187 NL80211_ATTR_PAD) ||
21188 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
21189 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
21190 ack_signal)))
21191 goto nla_put_failure;
21192
21193 genlmsg_end(msg, hdr);
21194
21195 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21196 NL80211_MCGRP_MLME, gfp);
21197 return;
21198
21199 nla_put_failure:
21200 nlmsg_free(msg);
21201 }
21202 EXPORT_SYMBOL(cfg80211_probe_status);
21203
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)21204 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
21205 size_t len, int freq, int sig_dbm)
21206 {
21207 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21208 struct sk_buff *msg;
21209 void *hdr;
21210 struct cfg80211_beacon_registration *reg;
21211
21212 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
21213
21214 spin_lock_bh(&rdev->beacon_registrations_lock);
21215 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
21216 msg = nlmsg_new(len + 100, GFP_ATOMIC);
21217 if (!msg) {
21218 spin_unlock_bh(&rdev->beacon_registrations_lock);
21219 return;
21220 }
21221
21222 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
21223 if (!hdr)
21224 goto nla_put_failure;
21225
21226 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21227 (freq &&
21228 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
21229 KHZ_TO_MHZ(freq)) ||
21230 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
21231 freq % 1000))) ||
21232 (sig_dbm &&
21233 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
21234 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
21235 goto nla_put_failure;
21236
21237 genlmsg_end(msg, hdr);
21238
21239 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
21240 }
21241 spin_unlock_bh(&rdev->beacon_registrations_lock);
21242 return;
21243
21244 nla_put_failure:
21245 spin_unlock_bh(&rdev->beacon_registrations_lock);
21246 nlmsg_free(msg);
21247 }
21248 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
21249
21250 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)21251 static int cfg80211_net_detect_results(struct sk_buff *msg,
21252 struct cfg80211_wowlan_wakeup *wakeup)
21253 {
21254 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
21255 struct nlattr *nl_results, *nl_match, *nl_freqs;
21256 int i, j;
21257
21258 nl_results = nla_nest_start_noflag(msg,
21259 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
21260 if (!nl_results)
21261 return -EMSGSIZE;
21262
21263 for (i = 0; i < nd->n_matches; i++) {
21264 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
21265
21266 nl_match = nla_nest_start_noflag(msg, i);
21267 if (!nl_match)
21268 break;
21269
21270 /* The SSID attribute is optional in nl80211, but for
21271 * simplicity reasons it's always present in the
21272 * cfg80211 structure. If a driver can't pass the
21273 * SSID, that needs to be changed. A zero length SSID
21274 * is still a valid SSID (wildcard), so it cannot be
21275 * used for this purpose.
21276 */
21277 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
21278 match->ssid.ssid)) {
21279 nla_nest_cancel(msg, nl_match);
21280 goto out;
21281 }
21282
21283 if (match->n_channels) {
21284 nl_freqs = nla_nest_start_noflag(msg,
21285 NL80211_ATTR_SCAN_FREQUENCIES);
21286 if (!nl_freqs) {
21287 nla_nest_cancel(msg, nl_match);
21288 goto out;
21289 }
21290
21291 for (j = 0; j < match->n_channels; j++) {
21292 if (nla_put_u32(msg, j, match->channels[j])) {
21293 nla_nest_cancel(msg, nl_freqs);
21294 nla_nest_cancel(msg, nl_match);
21295 goto out;
21296 }
21297 }
21298
21299 nla_nest_end(msg, nl_freqs);
21300 }
21301
21302 nla_nest_end(msg, nl_match);
21303 }
21304
21305 out:
21306 nla_nest_end(msg, nl_results);
21307 return 0;
21308 }
21309
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)21310 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
21311 struct cfg80211_wowlan_wakeup *wakeup,
21312 gfp_t gfp)
21313 {
21314 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21315 struct sk_buff *msg;
21316 void *hdr;
21317 int size = 200;
21318
21319 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
21320
21321 if (wakeup)
21322 size += wakeup->packet_present_len;
21323
21324 msg = nlmsg_new(size, gfp);
21325 if (!msg)
21326 return;
21327
21328 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
21329 if (!hdr)
21330 goto free_msg;
21331
21332 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21333 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21334 NL80211_ATTR_PAD))
21335 goto free_msg;
21336
21337 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
21338 wdev->netdev->ifindex))
21339 goto free_msg;
21340
21341 if (wakeup) {
21342 struct nlattr *reasons;
21343
21344 reasons = nla_nest_start_noflag(msg,
21345 NL80211_ATTR_WOWLAN_TRIGGERS);
21346 if (!reasons)
21347 goto free_msg;
21348
21349 if (wakeup->disconnect &&
21350 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
21351 goto free_msg;
21352 if (wakeup->magic_pkt &&
21353 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
21354 goto free_msg;
21355 if (wakeup->gtk_rekey_failure &&
21356 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
21357 goto free_msg;
21358 if (wakeup->eap_identity_req &&
21359 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
21360 goto free_msg;
21361 if (wakeup->four_way_handshake &&
21362 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
21363 goto free_msg;
21364 if (wakeup->rfkill_release &&
21365 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
21366 goto free_msg;
21367
21368 if (wakeup->pattern_idx >= 0 &&
21369 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
21370 wakeup->pattern_idx))
21371 goto free_msg;
21372
21373 if (wakeup->tcp_match &&
21374 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
21375 goto free_msg;
21376
21377 if (wakeup->tcp_connlost &&
21378 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
21379 goto free_msg;
21380
21381 if (wakeup->tcp_nomoretokens &&
21382 nla_put_flag(msg,
21383 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
21384 goto free_msg;
21385
21386 if (wakeup->unprot_deauth_disassoc &&
21387 nla_put_flag(msg,
21388 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
21389 goto free_msg;
21390
21391 if (wakeup->packet) {
21392 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
21393 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
21394
21395 if (!wakeup->packet_80211) {
21396 pkt_attr =
21397 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
21398 len_attr =
21399 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
21400 }
21401
21402 if (wakeup->packet_len &&
21403 nla_put_u32(msg, len_attr, wakeup->packet_len))
21404 goto free_msg;
21405
21406 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
21407 wakeup->packet))
21408 goto free_msg;
21409 }
21410
21411 if (wakeup->net_detect &&
21412 cfg80211_net_detect_results(msg, wakeup))
21413 goto free_msg;
21414
21415 nla_nest_end(msg, reasons);
21416 }
21417
21418 genlmsg_end(msg, hdr);
21419
21420 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21421 NL80211_MCGRP_MLME, gfp);
21422 return;
21423
21424 free_msg:
21425 nlmsg_free(msg);
21426 }
21427 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
21428 #endif
21429
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)21430 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
21431 enum nl80211_tdls_operation oper,
21432 u16 reason_code, gfp_t gfp)
21433 {
21434 struct wireless_dev *wdev = dev->ieee80211_ptr;
21435 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21436 struct sk_buff *msg;
21437 void *hdr;
21438
21439 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
21440 reason_code);
21441
21442 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21443 if (!msg)
21444 return;
21445
21446 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
21447 if (!hdr) {
21448 nlmsg_free(msg);
21449 return;
21450 }
21451
21452 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21453 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21454 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
21455 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
21456 (reason_code > 0 &&
21457 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
21458 goto nla_put_failure;
21459
21460 genlmsg_end(msg, hdr);
21461
21462 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21463 NL80211_MCGRP_MLME, gfp);
21464 return;
21465
21466 nla_put_failure:
21467 nlmsg_free(msg);
21468 }
21469 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
21470
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)21471 static int nl80211_netlink_notify(struct notifier_block * nb,
21472 unsigned long state,
21473 void *_notify)
21474 {
21475 struct netlink_notify *notify = _notify;
21476 struct cfg80211_registered_device *rdev;
21477 struct wireless_dev *wdev;
21478 struct cfg80211_beacon_registration *reg, *tmp;
21479
21480 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
21481 return NOTIFY_DONE;
21482
21483 rcu_read_lock();
21484
21485 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
21486 struct cfg80211_sched_scan_request *sched_scan_req;
21487
21488 list_for_each_entry_rcu(sched_scan_req,
21489 &rdev->sched_scan_req_list,
21490 list) {
21491 if (sched_scan_req->owner_nlportid == notify->portid) {
21492 sched_scan_req->nl_owner_dead = true;
21493 wiphy_work_queue(&rdev->wiphy,
21494 &rdev->sched_scan_stop_wk);
21495 }
21496 }
21497
21498 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
21499 cfg80211_mlme_unregister_socket(wdev, notify->portid);
21500
21501 if (wdev->owner_nlportid == notify->portid) {
21502 wdev->nl_owner_dead = true;
21503 schedule_work(&rdev->destroy_work);
21504 } else if (wdev->conn_owner_nlportid == notify->portid) {
21505 schedule_work(&wdev->disconnect_wk);
21506 }
21507
21508 cfg80211_release_pmsr(wdev, notify->portid);
21509 }
21510
21511 spin_lock_bh(&rdev->beacon_registrations_lock);
21512 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
21513 list) {
21514 if (reg->nlportid == notify->portid) {
21515 list_del(®->list);
21516 kfree(reg);
21517 break;
21518 }
21519 }
21520 spin_unlock_bh(&rdev->beacon_registrations_lock);
21521 }
21522
21523 rcu_read_unlock();
21524
21525 /*
21526 * It is possible that the user space process that is controlling the
21527 * indoor setting disappeared, so notify the regulatory core.
21528 */
21529 regulatory_netlink_notify(notify->portid);
21530 return NOTIFY_OK;
21531 }
21532
21533 static struct notifier_block nl80211_netlink_notifier = {
21534 .notifier_call = nl80211_netlink_notify,
21535 };
21536
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)21537 void cfg80211_ft_event(struct net_device *netdev,
21538 struct cfg80211_ft_event_params *ft_event)
21539 {
21540 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21541 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21542 struct sk_buff *msg;
21543 void *hdr;
21544
21545 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
21546
21547 if (!ft_event->target_ap)
21548 return;
21549
21550 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
21551 GFP_KERNEL);
21552 if (!msg)
21553 return;
21554
21555 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
21556 if (!hdr)
21557 goto out;
21558
21559 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21560 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21561 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
21562 goto out;
21563
21564 if (ft_event->ies &&
21565 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
21566 goto out;
21567 if (ft_event->ric_ies &&
21568 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
21569 ft_event->ric_ies))
21570 goto out;
21571
21572 genlmsg_end(msg, hdr);
21573
21574 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21575 NL80211_MCGRP_MLME, GFP_KERNEL);
21576 return;
21577 out:
21578 nlmsg_free(msg);
21579 }
21580 EXPORT_SYMBOL(cfg80211_ft_event);
21581
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)21582 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
21583 {
21584 struct cfg80211_registered_device *rdev;
21585 struct sk_buff *msg;
21586 void *hdr;
21587 u32 nlportid;
21588
21589 rdev = wiphy_to_rdev(wdev->wiphy);
21590 if (!rdev->crit_proto_nlportid)
21591 return;
21592
21593 nlportid = rdev->crit_proto_nlportid;
21594 rdev->crit_proto_nlportid = 0;
21595
21596 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21597 if (!msg)
21598 return;
21599
21600 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
21601 if (!hdr)
21602 goto nla_put_failure;
21603
21604 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21605 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21606 NL80211_ATTR_PAD))
21607 goto nla_put_failure;
21608
21609 genlmsg_end(msg, hdr);
21610
21611 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
21612 return;
21613
21614 nla_put_failure:
21615 nlmsg_free(msg);
21616 }
21617 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
21618
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)21619 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
21620 {
21621 struct wiphy *wiphy = wdev->wiphy;
21622 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21623 struct sk_buff *msg;
21624 void *hdr;
21625
21626 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21627 if (!msg)
21628 return;
21629
21630 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
21631 if (!hdr)
21632 goto out;
21633
21634 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21635 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
21636 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21637 NL80211_ATTR_PAD) ||
21638 (wdev->valid_links &&
21639 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
21640 goto out;
21641
21642 genlmsg_end(msg, hdr);
21643
21644 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
21645 NL80211_MCGRP_MLME, GFP_KERNEL);
21646 return;
21647 out:
21648 nlmsg_free(msg);
21649 }
21650
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)21651 int cfg80211_external_auth_request(struct net_device *dev,
21652 struct cfg80211_external_auth_params *params,
21653 gfp_t gfp)
21654 {
21655 struct wireless_dev *wdev = dev->ieee80211_ptr;
21656 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21657 struct sk_buff *msg;
21658 void *hdr;
21659
21660 if (!wdev->conn_owner_nlportid)
21661 return -EINVAL;
21662
21663 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21664 if (!msg)
21665 return -ENOMEM;
21666
21667 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
21668 if (!hdr)
21669 goto nla_put_failure;
21670
21671 /* Some historical mistakes in drivers <-> userspace interface (notably
21672 * between drivers and wpa_supplicant) led to a big-endian conversion
21673 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
21674 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
21675 * benefit of older wpa_supplicant versions, send this particular value
21676 * in big-endian. Note that newer wpa_supplicant will also detect this
21677 * particular value in big endian still, so it all continues to work.
21678 */
21679 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
21680 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
21681 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
21682 goto nla_put_failure;
21683 } else {
21684 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
21685 params->key_mgmt_suite))
21686 goto nla_put_failure;
21687 }
21688
21689 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21690 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21691 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
21692 params->action) ||
21693 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
21694 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
21695 params->ssid.ssid) ||
21696 (!is_zero_ether_addr(params->mld_addr) &&
21697 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
21698 goto nla_put_failure;
21699
21700 genlmsg_end(msg, hdr);
21701 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
21702 wdev->conn_owner_nlportid);
21703 return 0;
21704
21705 nla_put_failure:
21706 nlmsg_free(msg);
21707 return -ENOBUFS;
21708 }
21709 EXPORT_SYMBOL(cfg80211_external_auth_request);
21710
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)21711 void cfg80211_update_owe_info_event(struct net_device *netdev,
21712 struct cfg80211_update_owe_info *owe_info,
21713 gfp_t gfp)
21714 {
21715 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21716 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21717 struct sk_buff *msg;
21718 void *hdr;
21719
21720 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
21721
21722 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21723 if (!msg)
21724 return;
21725
21726 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
21727 if (!hdr)
21728 goto nla_put_failure;
21729
21730 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21731 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21732 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
21733 goto nla_put_failure;
21734
21735 if (!owe_info->ie_len ||
21736 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
21737 goto nla_put_failure;
21738
21739 if (owe_info->assoc_link_id != -1) {
21740 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
21741 owe_info->assoc_link_id))
21742 goto nla_put_failure;
21743
21744 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
21745 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
21746 owe_info->peer_mld_addr))
21747 goto nla_put_failure;
21748 }
21749
21750 genlmsg_end(msg, hdr);
21751
21752 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21753 NL80211_MCGRP_MLME, gfp);
21754 return;
21755
21756 nla_put_failure:
21757 genlmsg_cancel(msg, hdr);
21758 nlmsg_free(msg);
21759 }
21760 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
21761
cfg80211_schedule_channels_check(struct wireless_dev * wdev)21762 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
21763 {
21764 struct wiphy *wiphy = wdev->wiphy;
21765
21766 /* Schedule channels check if NO_IR or DFS relaxations are supported */
21767 if (wdev->iftype == NL80211_IFTYPE_STATION &&
21768 (wiphy_ext_feature_isset(wiphy,
21769 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
21770 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
21771 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
21772 reg_check_channels();
21773 }
21774 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
21775
cfg80211_epcs_changed(struct net_device * netdev,bool enabled)21776 void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
21777 {
21778 struct wireless_dev *wdev = netdev->ieee80211_ptr;
21779 struct wiphy *wiphy = wdev->wiphy;
21780 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21781 struct sk_buff *msg;
21782 void *hdr;
21783
21784 trace_cfg80211_epcs_changed(wdev, enabled);
21785
21786 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21787 if (!msg)
21788 return;
21789
21790 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
21791 if (!hdr) {
21792 nlmsg_free(msg);
21793 return;
21794 }
21795
21796 if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
21797 goto nla_put_failure;
21798
21799 genlmsg_end(msg, hdr);
21800 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21801 NL80211_MCGRP_MLME, GFP_KERNEL);
21802 return;
21803
21804 nla_put_failure:
21805 nlmsg_free(msg);
21806 }
21807 EXPORT_SYMBOL(cfg80211_epcs_changed);
21808
cfg80211_next_nan_dw_notif(struct wireless_dev * wdev,struct ieee80211_channel * chan,gfp_t gfp)21809 void cfg80211_next_nan_dw_notif(struct wireless_dev *wdev,
21810 struct ieee80211_channel *chan, gfp_t gfp)
21811 {
21812 struct wiphy *wiphy = wdev->wiphy;
21813 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21814 struct sk_buff *msg;
21815 void *hdr;
21816
21817 trace_cfg80211_next_nan_dw_notif(wdev, chan);
21818
21819 if (!wdev->owner_nlportid)
21820 return;
21821
21822 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21823 if (!msg)
21824 return;
21825
21826 hdr = nl80211hdr_put(msg, 0, 0, 0,
21827 NL80211_CMD_NAN_NEXT_DW_NOTIFICATION);
21828 if (!hdr)
21829 goto nla_put_failure;
21830
21831 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21832 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21833 NL80211_ATTR_PAD) ||
21834 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq))
21835 goto nla_put_failure;
21836
21837 genlmsg_end(msg, hdr);
21838
21839 genlmsg_unicast(wiphy_net(wiphy), msg, wdev->owner_nlportid);
21840
21841 return;
21842
21843 nla_put_failure:
21844 nlmsg_free(msg);
21845 }
21846 EXPORT_SYMBOL(cfg80211_next_nan_dw_notif);
21847
cfg80211_nan_cluster_joined(struct wireless_dev * wdev,const u8 * cluster_id,bool new_cluster,gfp_t gfp)21848 void cfg80211_nan_cluster_joined(struct wireless_dev *wdev,
21849 const u8 *cluster_id, bool new_cluster,
21850 gfp_t gfp)
21851 {
21852 struct wiphy *wiphy = wdev->wiphy;
21853 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21854 struct sk_buff *msg;
21855 void *hdr;
21856
21857 trace_cfg80211_nan_cluster_joined(wdev, cluster_id, new_cluster);
21858
21859 memcpy(wdev->u.nan.cluster_id, cluster_id, ETH_ALEN);
21860
21861 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21862 if (!msg)
21863 return;
21864
21865 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_CLUSTER_JOINED);
21866 if (!hdr)
21867 goto nla_put_failure;
21868
21869 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21870 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21871 NL80211_ATTR_PAD) ||
21872 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cluster_id) ||
21873 (new_cluster && nla_put_flag(msg, NL80211_ATTR_NAN_NEW_CLUSTER)))
21874 goto nla_put_failure;
21875
21876 genlmsg_end(msg, hdr);
21877
21878 if (!wdev->owner_nlportid)
21879 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy),
21880 msg, 0, NL80211_MCGRP_NAN, gfp);
21881 else
21882 genlmsg_unicast(wiphy_net(wiphy), msg,
21883 wdev->owner_nlportid);
21884 return;
21885
21886 nla_put_failure:
21887 nlmsg_free(msg);
21888 }
21889 EXPORT_SYMBOL(cfg80211_nan_cluster_joined);
21890
21891 /* initialisation/exit functions */
21892
nl80211_init(void)21893 int __init nl80211_init(void)
21894 {
21895 int err;
21896
21897 err = genl_register_family(&nl80211_fam);
21898 if (err)
21899 return err;
21900
21901 err = netlink_register_notifier(&nl80211_netlink_notifier);
21902 if (err)
21903 goto err_out;
21904
21905 return 0;
21906 err_out:
21907 genl_unregister_family(&nl80211_fam);
21908 return err;
21909 }
21910
nl80211_exit(void)21911 void nl80211_exit(void)
21912 {
21913 netlink_unregister_notifier(&nl80211_netlink_notifier);
21914 genl_unregister_family(&nl80211_fam);
21915 }
21916