1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2024 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 unsigned int fixedlen, hdrlen;
233 bool s1g_bcn;
234
235 if (len < offsetofend(typeof(*mgmt), frame_control))
236 goto err;
237
238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
239 if (s1g_bcn) {
240 fixedlen = offsetof(struct ieee80211_ext,
241 u.s1g_beacon.variable);
242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
243 } else {
244 fixedlen = offsetof(struct ieee80211_mgmt,
245 u.beacon.variable);
246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
247 }
248
249 if (len < fixedlen)
250 goto err;
251
252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
253 goto err;
254
255 data += fixedlen;
256 len -= fixedlen;
257
258 for_each_element(elem, data, len) {
259 /* nothing */
260 }
261
262 if (for_each_element_completed(elem, data, len))
263 return 0;
264
265 err:
266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
267 return -EINVAL;
268 }
269
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)270 static int validate_ie_attr(const struct nlattr *attr,
271 struct netlink_ext_ack *extack)
272 {
273 const u8 *data = nla_data(attr);
274 unsigned int len = nla_len(attr);
275 const struct element *elem;
276
277 for_each_element(elem, data, len) {
278 /* nothing */
279 }
280
281 if (for_each_element_completed(elem, data, len))
282 return 0;
283
284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
285 return -EINVAL;
286 }
287
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)288 static int validate_he_capa(const struct nlattr *attr,
289 struct netlink_ext_ack *extack)
290 {
291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
292 return -EINVAL;
293
294 return 0;
295 }
296
297 /* policy for the attributes */
298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
299
300 static const struct nla_policy
301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
304 .len = U8_MAX },
305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
306 .len = U8_MAX },
307 };
308
309 static const struct nla_policy
310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
314 NLA_POLICY_MAX(NLA_U8, 15),
315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
317 NLA_POLICY_MAX(NLA_U8, 15),
318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
319 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
320 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
322 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
323 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
324 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
325 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
326 };
327
328 static const struct nla_policy
329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
330 [NL80211_PMSR_TYPE_FTM] =
331 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
332 };
333
334 static const struct nla_policy
335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
336 [NL80211_PMSR_REQ_ATTR_DATA] =
337 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
338 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
339 };
340
341 static const struct nla_policy
342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
343 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
344 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
345 [NL80211_PMSR_PEER_ATTR_REQ] =
346 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
347 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
348 };
349
350 static const struct nla_policy
351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
352 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
353 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
354 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
355 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
356 [NL80211_PMSR_ATTR_PEERS] =
357 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
358 };
359
360 static const struct nla_policy
361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
362 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
363 NLA_POLICY_RANGE(NLA_U8, 1, 20),
364 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
365 NLA_POLICY_RANGE(NLA_U8, 1, 20),
366 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
367 NLA_POLICY_RANGE(NLA_U8, 1, 20),
368 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
369 NLA_POLICY_EXACT_LEN(8),
370 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
371 NLA_POLICY_EXACT_LEN(8),
372 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
373 };
374
375 static const struct nla_policy
376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
377 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
378 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
379 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
380 };
381
382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
383 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
384 .len = NL80211_MAX_SUPP_RATES },
385 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
386 .len = NL80211_MAX_SUPP_HT_RATES },
387 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
388 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
389 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
390 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
391 NL80211_RATE_INFO_HE_GI_0_8,
392 NL80211_RATE_INFO_HE_GI_3_2),
393 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
394 NL80211_RATE_INFO_HE_1XLTF,
395 NL80211_RATE_INFO_HE_4XLTF),
396 };
397
398 static const struct nla_policy
399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
400 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
401 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
402 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
403 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
404 [NL80211_TID_CONFIG_ATTR_NOACK] =
405 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
406 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
407 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
408 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
409 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
410 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
411 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
412 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
413 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
414 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
415 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
416 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
417 NLA_POLICY_NESTED(nl80211_txattr_policy),
418 };
419
420 static const struct nla_policy
421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
422 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
423 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
424 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
425 NLA_POLICY_RANGE(NLA_BINARY,
426 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
427 IEEE80211_MAX_DATA_LEN),
428 };
429
430 static const struct nla_policy
431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
432 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
434 .len = IEEE80211_MAX_DATA_LEN }
435 };
436
437 static const struct nla_policy
438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
439 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
440 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
441 };
442
443 static const struct nla_policy
444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
445 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
446 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
447 };
448
449 static const struct nla_policy
450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
451 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
452 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
453 NLA_POLICY_MIN(NLA_U8, 1),
454 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
455 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
456 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
457 };
458
459 static const struct nla_policy
460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
461 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
462 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
463 };
464
465 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
466 .min = 0,
467 .max = 0xffff,
468 };
469
470 static const struct netlink_range_validation q_range = {
471 .max = INT_MAX,
472 };
473
474 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
475 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
476 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
477 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
478 .len = 20-1 },
479 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
480
481 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
482 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
483 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
484 NL80211_EDMG_CHANNELS_MIN,
485 NL80211_EDMG_CHANNELS_MAX),
486 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
487 NL80211_EDMG_BW_CONFIG_MIN,
488 NL80211_EDMG_BW_CONFIG_MAX),
489
490 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
491 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
492 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
493 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
494
495 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
496 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
497 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
498 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
499 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
500 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
501
502 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
503 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
504 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
505
506 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
507 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
508
509 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
510 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
511 .len = WLAN_MAX_KEY_LEN },
512 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
513 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
514 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
515 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
516 [NL80211_ATTR_KEY_TYPE] =
517 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
518
519 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
520 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
521 [NL80211_ATTR_BEACON_HEAD] =
522 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
523 IEEE80211_MAX_DATA_LEN),
524 [NL80211_ATTR_BEACON_TAIL] =
525 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
526 IEEE80211_MAX_DATA_LEN),
527 [NL80211_ATTR_STA_AID] =
528 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
529 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
530 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
531 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
532 .len = NL80211_MAX_SUPP_RATES },
533 [NL80211_ATTR_STA_PLINK_ACTION] =
534 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
535 [NL80211_ATTR_STA_TX_POWER_SETTING] =
536 NLA_POLICY_RANGE(NLA_U8,
537 NL80211_TX_POWER_AUTOMATIC,
538 NL80211_TX_POWER_FIXED),
539 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
540 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
541 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
542 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
543 .len = IEEE80211_MAX_MESH_ID_LEN },
544 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
545
546 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
547 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
548 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
549
550 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
551 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
552 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
553 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
554 .len = NL80211_MAX_SUPP_RATES },
555 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
556
557 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
558 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
559
560 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
561
562 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
563 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
564 validate_ie_attr,
565 IEEE80211_MAX_DATA_LEN),
566 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
567 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
568
569 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
570 .len = IEEE80211_MAX_SSID_LEN },
571 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
572 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
573 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
574 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
575 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
576 NL80211_MFP_NO,
577 NL80211_MFP_OPTIONAL),
578 [NL80211_ATTR_STA_FLAGS2] =
579 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
580 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
581 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
582 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
583 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
584 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
585 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
586 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
587 [NL80211_ATTR_WPA_VERSIONS] =
588 NLA_POLICY_RANGE(NLA_U32, 0,
589 NL80211_WPA_VERSION_1 |
590 NL80211_WPA_VERSION_2 |
591 NL80211_WPA_VERSION_3),
592 [NL80211_ATTR_PID] = { .type = NLA_U32 },
593 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
594 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
595 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
596 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
597 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
598 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
599 .len = IEEE80211_MAX_DATA_LEN },
600 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
601 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
602 NL80211_PS_DISABLED,
603 NL80211_PS_ENABLED),
604 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
605 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
606 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
607 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
608 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
609 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
610 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
611 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
612 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
613 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
614 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
615 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
616 [NL80211_ATTR_STA_PLINK_STATE] =
617 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
618 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
619 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
620 [NL80211_ATTR_MESH_PEER_AID] =
621 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
622 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
623 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
624 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
625 [NL80211_ATTR_HIDDEN_SSID] =
626 NLA_POLICY_RANGE(NLA_U32,
627 NL80211_HIDDEN_SSID_NOT_IN_USE,
628 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
629 [NL80211_ATTR_IE_PROBE_RESP] =
630 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
631 IEEE80211_MAX_DATA_LEN),
632 [NL80211_ATTR_IE_ASSOC_RESP] =
633 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
634 IEEE80211_MAX_DATA_LEN),
635 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
636 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
637 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
638 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
639 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
640 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
641 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
642 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
643 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
644 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
645 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
646 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
647 .len = IEEE80211_MAX_DATA_LEN },
648 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
649 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
650 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
651 .len = NL80211_HT_CAPABILITY_LEN
652 },
653 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
654 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
655 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
656 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
657 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
658
659 /* need to include at least Auth Transaction and Status Code */
660 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
661
662 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
663 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
664 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
665 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
666 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
667 NLA_POLICY_RANGE(NLA_U32,
668 NL80211_MESH_POWER_UNKNOWN + 1,
669 NL80211_MESH_POWER_MAX),
670 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
671 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
672 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
673 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
674 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
675 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
676 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
677 .len = NL80211_VHT_CAPABILITY_LEN,
678 },
679 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
680 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
681 .len = IEEE80211_MAX_DATA_LEN },
682 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
683 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
684 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
685 [NL80211_ATTR_PEER_AID] =
686 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
687 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
688 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
689 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
690 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
691 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
692 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
693 /*
694 * The value of the Length field of the Supported Operating
695 * Classes element is between 2 and 253.
696 */
697 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
698 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
699 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
700 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
701 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
702 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
703 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
704 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
705 IEEE80211_QOS_MAP_LEN_MIN,
706 IEEE80211_QOS_MAP_LEN_MAX),
707 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
708 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
709 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
710 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
711 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
712 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
713 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
714 [NL80211_ATTR_USER_PRIO] =
715 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
716 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
717 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
718 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
719 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
720 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
721 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
722 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
723 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
724 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
725 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
726 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
727 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
728 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
729 .len = VHT_MUMIMO_GROUPS_DATA_LEN
730 },
731 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
732 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
733 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
734 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
735 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
736 .len = FILS_MAX_KEK_LEN },
737 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
738 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
739 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
740 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
741 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
742 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
743 },
744 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
745 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
746 .len = FILS_ERP_MAX_USERNAME_LEN },
747 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
748 .len = FILS_ERP_MAX_REALM_LEN },
749 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
750 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
751 .len = FILS_ERP_MAX_RRK_LEN },
752 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
753 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
754 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
755 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
756 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
757
758 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
759 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
760 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
761 [NL80211_ATTR_HE_CAPABILITY] =
762 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
763 NL80211_HE_MAX_CAPABILITY_LEN),
764 [NL80211_ATTR_FTM_RESPONDER] =
765 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
766 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
767 [NL80211_ATTR_PEER_MEASUREMENTS] =
768 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
769 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
770 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
771 .len = SAE_PASSWORD_MAX_LEN },
772 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
773 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
774 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
775 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
776 [NL80211_ATTR_TID_CONFIG] =
777 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
778 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
779 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
780 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
781 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
782 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
783 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
784 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
785 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
786 [NL80211_ATTR_FILS_DISCOVERY] =
787 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
788 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
789 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
790 [NL80211_ATTR_S1G_CAPABILITY] =
791 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
792 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
793 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
794 [NL80211_ATTR_SAE_PWE] =
795 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
796 NL80211_SAE_PWE_BOTH),
797 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
798 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
799 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
800 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
801 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
802 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
803 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
804 [NL80211_ATTR_MBSSID_CONFIG] =
805 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
806 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
807 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
808 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
809 [NL80211_ATTR_EHT_CAPABILITY] =
810 NLA_POLICY_RANGE(NLA_BINARY,
811 NL80211_EHT_MIN_CAPABILITY_LEN,
812 NL80211_EHT_MAX_CAPABILITY_LEN),
813 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
814 [NL80211_ATTR_MLO_LINKS] =
815 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
816 [NL80211_ATTR_MLO_LINK_ID] =
817 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
818 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
819 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
820 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
821 [NL80211_ATTR_PUNCT_BITMAP] =
822 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
823
824 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
825 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
826 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
827 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
828 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
829 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
830 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
831 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
832 };
833
834 /* policy for the key attributes */
835 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
836 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
837 [NL80211_KEY_IDX] = { .type = NLA_U8 },
838 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
839 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
840 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
841 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
842 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
843 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
844 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
845 };
846
847 /* policy for the key default flags */
848 static const struct nla_policy
849 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
850 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
851 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
852 };
853
854 #ifdef CONFIG_PM
855 /* policy for WoWLAN attributes */
856 static const struct nla_policy
857 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
858 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
859 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
860 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
861 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
862 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
863 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
864 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
865 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
866 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
867 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
868 };
869
870 static const struct nla_policy
871 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
872 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
873 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
874 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
875 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
876 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
877 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
878 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
879 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
880 },
881 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
882 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
883 },
884 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
885 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
886 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
887 };
888 #endif /* CONFIG_PM */
889
890 /* policy for coalesce rule attributes */
891 static const struct nla_policy
892 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
893 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
894 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
895 NLA_POLICY_RANGE(NLA_U32,
896 NL80211_COALESCE_CONDITION_MATCH,
897 NL80211_COALESCE_CONDITION_NO_MATCH),
898 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
899 };
900
901 /* policy for GTK rekey offload attributes */
902 static const struct nla_policy
903 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
904 [NL80211_REKEY_DATA_KEK] = {
905 .type = NLA_BINARY,
906 .len = NL80211_KEK_EXT_LEN
907 },
908 [NL80211_REKEY_DATA_KCK] = {
909 .type = NLA_BINARY,
910 .len = NL80211_KCK_EXT_LEN_32
911 },
912 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
913 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
914 };
915
916 static const struct nla_policy
917 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
918 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
919 .len = IEEE80211_MAX_SSID_LEN },
920 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
921 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
922 };
923
924 static const struct nla_policy
925 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
926 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
927 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
928 };
929
930 static const struct nla_policy
931 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
932 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
933 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
934 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
935 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
936 },
937 };
938
939 /* policy for NAN function attributes */
940 static const struct nla_policy
941 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
942 [NL80211_NAN_FUNC_TYPE] =
943 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
944 [NL80211_NAN_FUNC_SERVICE_ID] = {
945 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
946 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
947 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
948 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
949 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
950 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
951 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
952 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
953 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
954 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
955 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
956 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
957 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
958 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
959 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
960 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
961 };
962
963 /* policy for Service Response Filter attributes */
964 static const struct nla_policy
965 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
966 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
967 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
968 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
969 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
970 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
971 };
972
973 /* policy for packet pattern attributes */
974 static const struct nla_policy
975 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
976 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
977 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
978 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
979 };
980
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)981 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
982 struct cfg80211_registered_device **rdev,
983 struct wireless_dev **wdev,
984 struct nlattr **attrbuf)
985 {
986 int err;
987
988 if (!cb->args[0]) {
989 struct nlattr **attrbuf_free = NULL;
990
991 if (!attrbuf) {
992 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
993 GFP_KERNEL);
994 if (!attrbuf)
995 return -ENOMEM;
996 attrbuf_free = attrbuf;
997 }
998
999 err = nlmsg_parse_deprecated(cb->nlh,
1000 GENL_HDRLEN + nl80211_fam.hdrsize,
1001 attrbuf, nl80211_fam.maxattr,
1002 nl80211_policy, NULL);
1003 if (err) {
1004 kfree(attrbuf_free);
1005 return err;
1006 }
1007
1008 rtnl_lock();
1009 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1010 attrbuf);
1011 kfree(attrbuf_free);
1012 if (IS_ERR(*wdev)) {
1013 rtnl_unlock();
1014 return PTR_ERR(*wdev);
1015 }
1016 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1017 mutex_lock(&(*rdev)->wiphy.mtx);
1018 rtnl_unlock();
1019 /* 0 is the first index - add 1 to parse only once */
1020 cb->args[0] = (*rdev)->wiphy_idx + 1;
1021 cb->args[1] = (*wdev)->identifier;
1022 } else {
1023 /* subtract the 1 again here */
1024 struct wiphy *wiphy;
1025 struct wireless_dev *tmp;
1026
1027 rtnl_lock();
1028 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1029 if (!wiphy) {
1030 rtnl_unlock();
1031 return -ENODEV;
1032 }
1033 *rdev = wiphy_to_rdev(wiphy);
1034 *wdev = NULL;
1035
1036 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1037 if (tmp->identifier == cb->args[1]) {
1038 *wdev = tmp;
1039 break;
1040 }
1041 }
1042
1043 if (!*wdev) {
1044 rtnl_unlock();
1045 return -ENODEV;
1046 }
1047 mutex_lock(&(*rdev)->wiphy.mtx);
1048 rtnl_unlock();
1049 }
1050
1051 return 0;
1052 }
1053
1054 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1055 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1056 int flags, u8 cmd)
1057 {
1058 /* since there is no private header just add the generic one */
1059 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1060 }
1061
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1062 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1063 const struct ieee80211_reg_rule *rule)
1064 {
1065 int j;
1066 struct nlattr *nl_wmm_rules =
1067 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1068
1069 if (!nl_wmm_rules)
1070 goto nla_put_failure;
1071
1072 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1073 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1074
1075 if (!nl_wmm_rule)
1076 goto nla_put_failure;
1077
1078 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1079 rule->wmm_rule.client[j].cw_min) ||
1080 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1081 rule->wmm_rule.client[j].cw_max) ||
1082 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1083 rule->wmm_rule.client[j].aifsn) ||
1084 nla_put_u16(msg, NL80211_WMMR_TXOP,
1085 rule->wmm_rule.client[j].cot))
1086 goto nla_put_failure;
1087
1088 nla_nest_end(msg, nl_wmm_rule);
1089 }
1090 nla_nest_end(msg, nl_wmm_rules);
1091
1092 return 0;
1093
1094 nla_put_failure:
1095 return -ENOBUFS;
1096 }
1097
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1098 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1099 struct ieee80211_channel *chan,
1100 bool large)
1101 {
1102 /* Some channels must be completely excluded from the
1103 * list to protect old user-space tools from breaking
1104 */
1105 if (!large && chan->flags &
1106 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1107 return 0;
1108 if (!large && chan->freq_offset)
1109 return 0;
1110
1111 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1112 chan->center_freq))
1113 goto nla_put_failure;
1114
1115 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1116 goto nla_put_failure;
1117
1118 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1119 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1120 goto nla_put_failure;
1121
1122 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1123 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1124 goto nla_put_failure;
1125 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1126 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1127 goto nla_put_failure;
1128 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1129 goto nla_put_failure;
1130 }
1131 if (chan->flags & IEEE80211_CHAN_RADAR) {
1132 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1133 goto nla_put_failure;
1134 if (large) {
1135 u32 time;
1136
1137 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1138
1139 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1140 chan->dfs_state))
1141 goto nla_put_failure;
1142 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1143 time))
1144 goto nla_put_failure;
1145 if (nla_put_u32(msg,
1146 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1147 chan->dfs_cac_ms))
1148 goto nla_put_failure;
1149 }
1150 }
1151
1152 if (large) {
1153 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1154 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1155 goto nla_put_failure;
1156 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1157 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1158 goto nla_put_failure;
1159 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1160 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1161 goto nla_put_failure;
1162 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1163 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1164 goto nla_put_failure;
1165 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1166 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1167 goto nla_put_failure;
1168 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1169 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1170 goto nla_put_failure;
1171 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1172 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1173 goto nla_put_failure;
1174 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1175 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1176 goto nla_put_failure;
1177 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1178 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1179 goto nla_put_failure;
1180 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1181 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1182 goto nla_put_failure;
1183 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1184 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1185 goto nla_put_failure;
1186 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1187 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1188 goto nla_put_failure;
1189 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1190 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1191 goto nla_put_failure;
1192 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1193 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1194 goto nla_put_failure;
1195 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1196 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1197 goto nla_put_failure;
1198 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1199 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1200 goto nla_put_failure;
1201 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1202 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1203 goto nla_put_failure;
1204 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1205 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1206 goto nla_put_failure;
1207 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1208 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1209 goto nla_put_failure;
1210 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1211 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1212 goto nla_put_failure;
1213 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1214 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1215 goto nla_put_failure;
1216 }
1217
1218 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1219 DBM_TO_MBM(chan->max_power)))
1220 goto nla_put_failure;
1221
1222 if (large) {
1223 const struct ieee80211_reg_rule *rule =
1224 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1225
1226 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1227 if (nl80211_msg_put_wmm_rules(msg, rule))
1228 goto nla_put_failure;
1229 }
1230 }
1231
1232 return 0;
1233
1234 nla_put_failure:
1235 return -ENOBUFS;
1236 }
1237
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1238 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1239 struct cfg80211_txq_stats *txqstats,
1240 int attrtype)
1241 {
1242 struct nlattr *txqattr;
1243
1244 #define PUT_TXQVAL_U32(attr, memb) do { \
1245 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1246 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1247 return false; \
1248 } while (0)
1249
1250 txqattr = nla_nest_start_noflag(msg, attrtype);
1251 if (!txqattr)
1252 return false;
1253
1254 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1255 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1256 PUT_TXQVAL_U32(FLOWS, flows);
1257 PUT_TXQVAL_U32(DROPS, drops);
1258 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1259 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1260 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1261 PUT_TXQVAL_U32(COLLISIONS, collisions);
1262 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1263 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1264 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1265 nla_nest_end(msg, txqattr);
1266
1267 #undef PUT_TXQVAL_U32
1268 return true;
1269 }
1270
1271 /* netlink command implementations */
1272
1273 /**
1274 * nl80211_link_id - return link ID
1275 * @attrs: attributes to look at
1276 *
1277 * Returns: the link ID or 0 if not given
1278 *
1279 * Note this function doesn't do any validation of the link
1280 * ID validity wrt. links that were actually added, so it must
1281 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1282 * or if additional validation is done.
1283 */
nl80211_link_id(struct nlattr ** attrs)1284 static unsigned int nl80211_link_id(struct nlattr **attrs)
1285 {
1286 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1287
1288 if (!linkid)
1289 return 0;
1290
1291 return nla_get_u8(linkid);
1292 }
1293
nl80211_link_id_or_invalid(struct nlattr ** attrs)1294 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1295 {
1296 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1297
1298 if (!linkid)
1299 return -1;
1300
1301 return nla_get_u8(linkid);
1302 }
1303
1304 struct key_parse {
1305 struct key_params p;
1306 int idx;
1307 int type;
1308 bool def, defmgmt, defbeacon;
1309 bool def_uni, def_multi;
1310 };
1311
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1312 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1313 struct key_parse *k)
1314 {
1315 struct nlattr *tb[NL80211_KEY_MAX + 1];
1316 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1317 nl80211_key_policy,
1318 info->extack);
1319 if (err)
1320 return err;
1321
1322 k->def = !!tb[NL80211_KEY_DEFAULT];
1323 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1324 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1325
1326 if (k->def) {
1327 k->def_uni = true;
1328 k->def_multi = true;
1329 }
1330 if (k->defmgmt || k->defbeacon)
1331 k->def_multi = true;
1332
1333 if (tb[NL80211_KEY_IDX])
1334 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1335
1336 if (tb[NL80211_KEY_DATA]) {
1337 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1338 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1339 }
1340
1341 if (tb[NL80211_KEY_SEQ]) {
1342 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1343 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1344 }
1345
1346 if (tb[NL80211_KEY_CIPHER])
1347 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1348
1349 if (tb[NL80211_KEY_TYPE])
1350 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1351
1352 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1353 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1354
1355 err = nla_parse_nested_deprecated(kdt,
1356 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1357 tb[NL80211_KEY_DEFAULT_TYPES],
1358 nl80211_key_default_policy,
1359 info->extack);
1360 if (err)
1361 return err;
1362
1363 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1364 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1365 }
1366
1367 if (tb[NL80211_KEY_MODE])
1368 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1369
1370 return 0;
1371 }
1372
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1373 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1374 {
1375 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1376 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1377 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1378 }
1379
1380 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1381 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1382 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1383 }
1384
1385 if (info->attrs[NL80211_ATTR_KEY_IDX])
1386 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1387
1388 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1389 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1390
1391 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1392 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1393
1394 if (k->def) {
1395 k->def_uni = true;
1396 k->def_multi = true;
1397 }
1398 if (k->defmgmt)
1399 k->def_multi = true;
1400
1401 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1402 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1403
1404 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1405 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1406 int err = nla_parse_nested_deprecated(kdt,
1407 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1408 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1409 nl80211_key_default_policy,
1410 info->extack);
1411 if (err)
1412 return err;
1413
1414 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1415 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1416 }
1417
1418 return 0;
1419 }
1420
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1421 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1422 {
1423 int err;
1424
1425 memset(k, 0, sizeof(*k));
1426 k->idx = -1;
1427 k->type = -1;
1428
1429 if (info->attrs[NL80211_ATTR_KEY])
1430 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1431 else
1432 err = nl80211_parse_key_old(info, k);
1433
1434 if (err)
1435 return err;
1436
1437 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1438 (k->defbeacon ? 1 : 0) > 1) {
1439 GENL_SET_ERR_MSG(info,
1440 "key with multiple default flags is invalid");
1441 return -EINVAL;
1442 }
1443
1444 if (k->defmgmt || k->defbeacon) {
1445 if (k->def_uni || !k->def_multi) {
1446 GENL_SET_ERR_MSG(info,
1447 "defmgmt/defbeacon key must be mcast");
1448 return -EINVAL;
1449 }
1450 }
1451
1452 if (k->idx != -1) {
1453 if (k->defmgmt) {
1454 if (k->idx < 4 || k->idx > 5) {
1455 GENL_SET_ERR_MSG(info,
1456 "defmgmt key idx not 4 or 5");
1457 return -EINVAL;
1458 }
1459 } else if (k->defbeacon) {
1460 if (k->idx < 6 || k->idx > 7) {
1461 GENL_SET_ERR_MSG(info,
1462 "defbeacon key idx not 6 or 7");
1463 return -EINVAL;
1464 }
1465 } else if (k->def) {
1466 if (k->idx < 0 || k->idx > 3) {
1467 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1468 return -EINVAL;
1469 }
1470 } else {
1471 if (k->idx < 0 || k->idx > 7) {
1472 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1473 return -EINVAL;
1474 }
1475 }
1476 }
1477
1478 return 0;
1479 }
1480
1481 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1482 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1483 struct genl_info *info, bool *no_ht)
1484 {
1485 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1486 struct key_parse parse;
1487 struct nlattr *key;
1488 struct cfg80211_cached_keys *result;
1489 int rem, err, def = 0;
1490 bool have_key = false;
1491
1492 nla_for_each_nested(key, keys, rem) {
1493 have_key = true;
1494 break;
1495 }
1496
1497 if (!have_key)
1498 return NULL;
1499
1500 result = kzalloc(sizeof(*result), GFP_KERNEL);
1501 if (!result)
1502 return ERR_PTR(-ENOMEM);
1503
1504 result->def = -1;
1505
1506 nla_for_each_nested(key, keys, rem) {
1507 memset(&parse, 0, sizeof(parse));
1508 parse.idx = -1;
1509
1510 err = nl80211_parse_key_new(info, key, &parse);
1511 if (err)
1512 goto error;
1513 err = -EINVAL;
1514 if (!parse.p.key)
1515 goto error;
1516 if (parse.idx < 0 || parse.idx > 3) {
1517 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1518 goto error;
1519 }
1520 if (parse.def) {
1521 if (def) {
1522 GENL_SET_ERR_MSG(info,
1523 "only one key can be default");
1524 goto error;
1525 }
1526 def = 1;
1527 result->def = parse.idx;
1528 if (!parse.def_uni || !parse.def_multi)
1529 goto error;
1530 } else if (parse.defmgmt)
1531 goto error;
1532 err = cfg80211_validate_key_settings(rdev, &parse.p,
1533 parse.idx, false, NULL);
1534 if (err)
1535 goto error;
1536 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1537 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1538 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1539 err = -EINVAL;
1540 goto error;
1541 }
1542 result->params[parse.idx].cipher = parse.p.cipher;
1543 result->params[parse.idx].key_len = parse.p.key_len;
1544 result->params[parse.idx].key = result->data[parse.idx];
1545 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1546
1547 /* must be WEP key if we got here */
1548 if (no_ht)
1549 *no_ht = true;
1550 }
1551
1552 if (result->def < 0) {
1553 err = -EINVAL;
1554 GENL_SET_ERR_MSG(info, "need a default/TX key");
1555 goto error;
1556 }
1557
1558 return result;
1559 error:
1560 kfree(result);
1561 return ERR_PTR(err);
1562 }
1563
nl80211_key_allowed(struct wireless_dev * wdev)1564 static int nl80211_key_allowed(struct wireless_dev *wdev)
1565 {
1566 lockdep_assert_wiphy(wdev->wiphy);
1567
1568 switch (wdev->iftype) {
1569 case NL80211_IFTYPE_AP:
1570 case NL80211_IFTYPE_AP_VLAN:
1571 case NL80211_IFTYPE_P2P_GO:
1572 case NL80211_IFTYPE_MESH_POINT:
1573 break;
1574 case NL80211_IFTYPE_ADHOC:
1575 if (wdev->u.ibss.current_bss)
1576 return 0;
1577 return -ENOLINK;
1578 case NL80211_IFTYPE_STATION:
1579 case NL80211_IFTYPE_P2P_CLIENT:
1580 if (wdev->connected)
1581 return 0;
1582 return -ENOLINK;
1583 case NL80211_IFTYPE_NAN:
1584 if (wiphy_ext_feature_isset(wdev->wiphy,
1585 NL80211_EXT_FEATURE_SECURE_NAN))
1586 return 0;
1587 return -EINVAL;
1588 case NL80211_IFTYPE_UNSPECIFIED:
1589 case NL80211_IFTYPE_OCB:
1590 case NL80211_IFTYPE_MONITOR:
1591 case NL80211_IFTYPE_P2P_DEVICE:
1592 case NL80211_IFTYPE_WDS:
1593 case NUM_NL80211_IFTYPES:
1594 return -EINVAL;
1595 }
1596
1597 return 0;
1598 }
1599
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1600 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1601 u32 freq)
1602 {
1603 struct ieee80211_channel *chan;
1604
1605 chan = ieee80211_get_channel_khz(wiphy, freq);
1606 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1607 return NULL;
1608 return chan;
1609 }
1610
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1611 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1612 {
1613 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1614 int i;
1615
1616 if (!nl_modes)
1617 goto nla_put_failure;
1618
1619 i = 0;
1620 while (ifmodes) {
1621 if ((ifmodes & 1) && nla_put_flag(msg, i))
1622 goto nla_put_failure;
1623 ifmodes >>= 1;
1624 i++;
1625 }
1626
1627 nla_nest_end(msg, nl_modes);
1628 return 0;
1629
1630 nla_put_failure:
1631 return -ENOBUFS;
1632 }
1633
nl80211_put_ifcomb_data(struct sk_buff * msg,bool large,int idx,const struct ieee80211_iface_combination * c,u16 nested)1634 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1635 const struct ieee80211_iface_combination *c,
1636 u16 nested)
1637 {
1638 struct nlattr *nl_combi, *nl_limits;
1639 int i;
1640
1641 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1642 if (!nl_combi)
1643 goto nla_put_failure;
1644
1645 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1646 nested);
1647 if (!nl_limits)
1648 goto nla_put_failure;
1649
1650 for (i = 0; i < c->n_limits; i++) {
1651 struct nlattr *nl_limit;
1652
1653 nl_limit = nla_nest_start_noflag(msg, i + 1);
1654 if (!nl_limit)
1655 goto nla_put_failure;
1656 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1657 goto nla_put_failure;
1658 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1659 c->limits[i].types))
1660 goto nla_put_failure;
1661 nla_nest_end(msg, nl_limit);
1662 }
1663
1664 nla_nest_end(msg, nl_limits);
1665
1666 if (c->beacon_int_infra_match &&
1667 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1668 goto nla_put_failure;
1669 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1670 c->num_different_channels) ||
1671 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1672 c->max_interfaces))
1673 goto nla_put_failure;
1674 if (large &&
1675 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1676 c->radar_detect_widths) ||
1677 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1678 c->radar_detect_regions)))
1679 goto nla_put_failure;
1680 if (c->beacon_int_min_gcd &&
1681 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1682 c->beacon_int_min_gcd))
1683 goto nla_put_failure;
1684
1685 nla_nest_end(msg, nl_combi);
1686
1687 return 0;
1688 nla_put_failure:
1689 return -ENOBUFS;
1690 }
1691
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,int attr,int radio,bool large,u16 nested)1692 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1693 struct sk_buff *msg,
1694 int attr, int radio,
1695 bool large, u16 nested)
1696 {
1697 const struct ieee80211_iface_combination *c;
1698 struct nlattr *nl_combis;
1699 int i, n;
1700
1701 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1702 if (!nl_combis)
1703 goto nla_put_failure;
1704
1705 if (radio >= 0) {
1706 c = wiphy->radio[0].iface_combinations;
1707 n = wiphy->radio[0].n_iface_combinations;
1708 } else {
1709 c = wiphy->iface_combinations;
1710 n = wiphy->n_iface_combinations;
1711 }
1712 for (i = 0; i < n; i++)
1713 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1714 goto nla_put_failure;
1715
1716 nla_nest_end(msg, nl_combis);
1717
1718 return 0;
1719 nla_put_failure:
1720 return -ENOBUFS;
1721 }
1722
1723 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1724 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1725 struct sk_buff *msg)
1726 {
1727 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1728 struct nlattr *nl_tcp;
1729
1730 if (!tcp)
1731 return 0;
1732
1733 nl_tcp = nla_nest_start_noflag(msg,
1734 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1735 if (!nl_tcp)
1736 return -ENOBUFS;
1737
1738 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1739 tcp->data_payload_max))
1740 return -ENOBUFS;
1741
1742 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1743 tcp->data_payload_max))
1744 return -ENOBUFS;
1745
1746 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1747 return -ENOBUFS;
1748
1749 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1750 sizeof(*tcp->tok), tcp->tok))
1751 return -ENOBUFS;
1752
1753 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1754 tcp->data_interval_max))
1755 return -ENOBUFS;
1756
1757 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1758 tcp->wake_payload_max))
1759 return -ENOBUFS;
1760
1761 nla_nest_end(msg, nl_tcp);
1762 return 0;
1763 }
1764
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1765 static int nl80211_send_wowlan(struct sk_buff *msg,
1766 struct cfg80211_registered_device *rdev,
1767 bool large)
1768 {
1769 struct nlattr *nl_wowlan;
1770
1771 if (!rdev->wiphy.wowlan)
1772 return 0;
1773
1774 nl_wowlan = nla_nest_start_noflag(msg,
1775 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1776 if (!nl_wowlan)
1777 return -ENOBUFS;
1778
1779 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1780 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1781 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1782 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1783 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1784 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1785 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1786 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1787 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1788 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1789 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1790 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1791 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1792 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1793 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1794 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1795 return -ENOBUFS;
1796
1797 if (rdev->wiphy.wowlan->n_patterns) {
1798 struct nl80211_pattern_support pat = {
1799 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1800 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1801 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1802 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1803 };
1804
1805 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1806 sizeof(pat), &pat))
1807 return -ENOBUFS;
1808 }
1809
1810 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1811 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1812 rdev->wiphy.wowlan->max_nd_match_sets))
1813 return -ENOBUFS;
1814
1815 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1816 return -ENOBUFS;
1817
1818 nla_nest_end(msg, nl_wowlan);
1819
1820 return 0;
1821 }
1822 #endif
1823
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1824 static int nl80211_send_coalesce(struct sk_buff *msg,
1825 struct cfg80211_registered_device *rdev)
1826 {
1827 struct nl80211_coalesce_rule_support rule;
1828
1829 if (!rdev->wiphy.coalesce)
1830 return 0;
1831
1832 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1833 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1834 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1835 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1836 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1837 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1838
1839 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1840 return -ENOBUFS;
1841
1842 return 0;
1843 }
1844
1845 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1846 nl80211_send_iftype_data(struct sk_buff *msg,
1847 const struct ieee80211_supported_band *sband,
1848 const struct ieee80211_sband_iftype_data *iftdata)
1849 {
1850 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1851 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1852
1853 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1854 iftdata->types_mask))
1855 return -ENOBUFS;
1856
1857 if (he_cap->has_he) {
1858 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1859 sizeof(he_cap->he_cap_elem.mac_cap_info),
1860 he_cap->he_cap_elem.mac_cap_info) ||
1861 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1862 sizeof(he_cap->he_cap_elem.phy_cap_info),
1863 he_cap->he_cap_elem.phy_cap_info) ||
1864 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1865 sizeof(he_cap->he_mcs_nss_supp),
1866 &he_cap->he_mcs_nss_supp) ||
1867 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1868 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1869 return -ENOBUFS;
1870 }
1871
1872 if (eht_cap->has_eht && he_cap->has_he) {
1873 u8 mcs_nss_size, ppe_thresh_size;
1874 u16 ppe_thres_hdr;
1875 bool is_ap;
1876
1877 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1878 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1879
1880 mcs_nss_size =
1881 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1882 &eht_cap->eht_cap_elem,
1883 is_ap);
1884
1885 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1886 ppe_thresh_size =
1887 ieee80211_eht_ppe_size(ppe_thres_hdr,
1888 eht_cap->eht_cap_elem.phy_cap_info);
1889
1890 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1891 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1892 eht_cap->eht_cap_elem.mac_cap_info) ||
1893 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1894 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1895 eht_cap->eht_cap_elem.phy_cap_info) ||
1896 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1897 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1898 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1899 ppe_thresh_size, eht_cap->eht_ppe_thres))
1900 return -ENOBUFS;
1901 }
1902
1903 if (sband->band == NL80211_BAND_6GHZ &&
1904 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1905 sizeof(iftdata->he_6ghz_capa),
1906 &iftdata->he_6ghz_capa))
1907 return -ENOBUFS;
1908
1909 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1910 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1911 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1912 return -ENOBUFS;
1913
1914 return 0;
1915 }
1916
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)1917 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1918 struct ieee80211_supported_band *sband,
1919 bool large)
1920 {
1921 struct nlattr *nl_rates, *nl_rate;
1922 struct ieee80211_rate *rate;
1923 int i;
1924
1925 /* add HT info */
1926 if (sband->ht_cap.ht_supported &&
1927 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1928 sizeof(sband->ht_cap.mcs),
1929 &sband->ht_cap.mcs) ||
1930 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1931 sband->ht_cap.cap) ||
1932 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1933 sband->ht_cap.ampdu_factor) ||
1934 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1935 sband->ht_cap.ampdu_density)))
1936 return -ENOBUFS;
1937
1938 /* add VHT info */
1939 if (sband->vht_cap.vht_supported &&
1940 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1941 sizeof(sband->vht_cap.vht_mcs),
1942 &sband->vht_cap.vht_mcs) ||
1943 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1944 sband->vht_cap.cap)))
1945 return -ENOBUFS;
1946
1947 if (large && sband->n_iftype_data) {
1948 struct nlattr *nl_iftype_data =
1949 nla_nest_start_noflag(msg,
1950 NL80211_BAND_ATTR_IFTYPE_DATA);
1951 const struct ieee80211_sband_iftype_data *iftd;
1952 int err;
1953
1954 if (!nl_iftype_data)
1955 return -ENOBUFS;
1956
1957 for_each_sband_iftype_data(sband, i, iftd) {
1958 struct nlattr *iftdata;
1959
1960 iftdata = nla_nest_start_noflag(msg, i + 1);
1961 if (!iftdata)
1962 return -ENOBUFS;
1963
1964 err = nl80211_send_iftype_data(msg, sband, iftd);
1965 if (err)
1966 return err;
1967
1968 nla_nest_end(msg, iftdata);
1969 }
1970
1971 nla_nest_end(msg, nl_iftype_data);
1972 }
1973
1974 /* add EDMG info */
1975 if (large && sband->edmg_cap.channels &&
1976 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1977 sband->edmg_cap.channels) ||
1978 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1979 sband->edmg_cap.bw_config)))
1980
1981 return -ENOBUFS;
1982
1983 /* add bitrates */
1984 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1985 if (!nl_rates)
1986 return -ENOBUFS;
1987
1988 for (i = 0; i < sband->n_bitrates; i++) {
1989 nl_rate = nla_nest_start_noflag(msg, i);
1990 if (!nl_rate)
1991 return -ENOBUFS;
1992
1993 rate = &sband->bitrates[i];
1994 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1995 rate->bitrate))
1996 return -ENOBUFS;
1997 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1998 nla_put_flag(msg,
1999 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2000 return -ENOBUFS;
2001
2002 nla_nest_end(msg, nl_rate);
2003 }
2004
2005 nla_nest_end(msg, nl_rates);
2006
2007 /* S1G capabilities */
2008 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2009 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2010 sizeof(sband->s1g_cap.cap),
2011 sband->s1g_cap.cap) ||
2012 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2013 sizeof(sband->s1g_cap.nss_mcs),
2014 sband->s1g_cap.nss_mcs)))
2015 return -ENOBUFS;
2016
2017 return 0;
2018 }
2019
2020 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)2021 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2022 const struct ieee80211_txrx_stypes *mgmt_stypes)
2023 {
2024 u16 stypes;
2025 struct nlattr *nl_ftypes, *nl_ifs;
2026 enum nl80211_iftype ift;
2027 int i;
2028
2029 if (!mgmt_stypes)
2030 return 0;
2031
2032 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2033 if (!nl_ifs)
2034 return -ENOBUFS;
2035
2036 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2037 nl_ftypes = nla_nest_start_noflag(msg, ift);
2038 if (!nl_ftypes)
2039 return -ENOBUFS;
2040 i = 0;
2041 stypes = mgmt_stypes[ift].tx;
2042 while (stypes) {
2043 if ((stypes & 1) &&
2044 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2045 (i << 4) | IEEE80211_FTYPE_MGMT))
2046 return -ENOBUFS;
2047 stypes >>= 1;
2048 i++;
2049 }
2050 nla_nest_end(msg, nl_ftypes);
2051 }
2052
2053 nla_nest_end(msg, nl_ifs);
2054
2055 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2056 if (!nl_ifs)
2057 return -ENOBUFS;
2058
2059 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2060 nl_ftypes = nla_nest_start_noflag(msg, ift);
2061 if (!nl_ftypes)
2062 return -ENOBUFS;
2063 i = 0;
2064 stypes = mgmt_stypes[ift].rx;
2065 while (stypes) {
2066 if ((stypes & 1) &&
2067 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2068 (i << 4) | IEEE80211_FTYPE_MGMT))
2069 return -ENOBUFS;
2070 stypes >>= 1;
2071 i++;
2072 }
2073 nla_nest_end(msg, nl_ftypes);
2074 }
2075 nla_nest_end(msg, nl_ifs);
2076
2077 return 0;
2078 }
2079
2080 #define CMD(op, n) \
2081 do { \
2082 if (rdev->ops->op) { \
2083 i++; \
2084 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2085 goto nla_put_failure; \
2086 } \
2087 } while (0)
2088
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2089 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2090 struct sk_buff *msg)
2091 {
2092 int i = 0;
2093
2094 /*
2095 * do *NOT* add anything into this function, new things need to be
2096 * advertised only to new versions of userspace that can deal with
2097 * the split (and they can't possibly care about new features...
2098 */
2099 CMD(add_virtual_intf, NEW_INTERFACE);
2100 CMD(change_virtual_intf, SET_INTERFACE);
2101 CMD(add_key, NEW_KEY);
2102 CMD(start_ap, START_AP);
2103 CMD(add_station, NEW_STATION);
2104 CMD(add_mpath, NEW_MPATH);
2105 CMD(update_mesh_config, SET_MESH_CONFIG);
2106 CMD(change_bss, SET_BSS);
2107 CMD(auth, AUTHENTICATE);
2108 CMD(assoc, ASSOCIATE);
2109 CMD(deauth, DEAUTHENTICATE);
2110 CMD(disassoc, DISASSOCIATE);
2111 CMD(join_ibss, JOIN_IBSS);
2112 CMD(join_mesh, JOIN_MESH);
2113 CMD(set_pmksa, SET_PMKSA);
2114 CMD(del_pmksa, DEL_PMKSA);
2115 CMD(flush_pmksa, FLUSH_PMKSA);
2116 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2117 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2118 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2119 CMD(mgmt_tx, FRAME);
2120 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2121 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2122 i++;
2123 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2124 goto nla_put_failure;
2125 }
2126 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2127 rdev->ops->join_mesh) {
2128 i++;
2129 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2130 goto nla_put_failure;
2131 }
2132 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2133 CMD(tdls_mgmt, TDLS_MGMT);
2134 CMD(tdls_oper, TDLS_OPER);
2135 }
2136 if (rdev->wiphy.max_sched_scan_reqs)
2137 CMD(sched_scan_start, START_SCHED_SCAN);
2138 CMD(probe_client, PROBE_CLIENT);
2139 CMD(set_noack_map, SET_NOACK_MAP);
2140 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2141 i++;
2142 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2143 goto nla_put_failure;
2144 }
2145 CMD(start_p2p_device, START_P2P_DEVICE);
2146 CMD(set_mcast_rate, SET_MCAST_RATE);
2147 #ifdef CONFIG_NL80211_TESTMODE
2148 CMD(testmode_cmd, TESTMODE);
2149 #endif
2150
2151 if (rdev->ops->connect || rdev->ops->auth) {
2152 i++;
2153 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2154 goto nla_put_failure;
2155 }
2156
2157 if (rdev->ops->disconnect || rdev->ops->deauth) {
2158 i++;
2159 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2160 goto nla_put_failure;
2161 }
2162
2163 return i;
2164 nla_put_failure:
2165 return -ENOBUFS;
2166 }
2167
2168 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2169 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2170 struct sk_buff *msg)
2171 {
2172 struct nlattr *ftm;
2173
2174 if (!cap->ftm.supported)
2175 return 0;
2176
2177 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2178 if (!ftm)
2179 return -ENOBUFS;
2180
2181 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2182 return -ENOBUFS;
2183 if (cap->ftm.non_asap &&
2184 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2185 return -ENOBUFS;
2186 if (cap->ftm.request_lci &&
2187 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2188 return -ENOBUFS;
2189 if (cap->ftm.request_civicloc &&
2190 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2191 return -ENOBUFS;
2192 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2193 cap->ftm.preambles))
2194 return -ENOBUFS;
2195 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2196 cap->ftm.bandwidths))
2197 return -ENOBUFS;
2198 if (cap->ftm.max_bursts_exponent >= 0 &&
2199 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2200 cap->ftm.max_bursts_exponent))
2201 return -ENOBUFS;
2202 if (cap->ftm.max_ftms_per_burst &&
2203 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2204 cap->ftm.max_ftms_per_burst))
2205 return -ENOBUFS;
2206 if (cap->ftm.trigger_based &&
2207 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2208 return -ENOBUFS;
2209 if (cap->ftm.non_trigger_based &&
2210 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2211 return -ENOBUFS;
2212
2213 nla_nest_end(msg, ftm);
2214 return 0;
2215 }
2216
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2217 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2218 struct sk_buff *msg)
2219 {
2220 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2221 struct nlattr *pmsr, *caps;
2222
2223 if (!cap)
2224 return 0;
2225
2226 /*
2227 * we don't need to clean up anything here since the caller
2228 * will genlmsg_cancel() if we fail
2229 */
2230
2231 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2232 if (!pmsr)
2233 return -ENOBUFS;
2234
2235 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2236 return -ENOBUFS;
2237
2238 if (cap->report_ap_tsf &&
2239 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2240 return -ENOBUFS;
2241
2242 if (cap->randomize_mac_addr &&
2243 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2244 return -ENOBUFS;
2245
2246 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2247 if (!caps)
2248 return -ENOBUFS;
2249
2250 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2251 return -ENOBUFS;
2252
2253 nla_nest_end(msg, caps);
2254 nla_nest_end(msg, pmsr);
2255
2256 return 0;
2257 }
2258
2259 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2260 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2261 struct sk_buff *msg)
2262 {
2263 int i;
2264 struct nlattr *nested, *nested_akms;
2265 const struct wiphy_iftype_akm_suites *iftype_akms;
2266
2267 if (!rdev->wiphy.num_iftype_akm_suites ||
2268 !rdev->wiphy.iftype_akm_suites)
2269 return 0;
2270
2271 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2272 if (!nested)
2273 return -ENOBUFS;
2274
2275 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2276 nested_akms = nla_nest_start(msg, i + 1);
2277 if (!nested_akms)
2278 return -ENOBUFS;
2279
2280 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2281
2282 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2283 iftype_akms->iftypes_mask))
2284 return -ENOBUFS;
2285
2286 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2287 sizeof(u32) * iftype_akms->n_akm_suites,
2288 iftype_akms->akm_suites)) {
2289 return -ENOBUFS;
2290 }
2291 nla_nest_end(msg, nested_akms);
2292 }
2293
2294 nla_nest_end(msg, nested);
2295
2296 return 0;
2297 }
2298
2299 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2300 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2301 struct sk_buff *msg)
2302 {
2303 struct nlattr *supp;
2304
2305 if (!rdev->wiphy.tid_config_support.vif &&
2306 !rdev->wiphy.tid_config_support.peer)
2307 return 0;
2308
2309 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2310 if (!supp)
2311 return -ENOSPC;
2312
2313 if (rdev->wiphy.tid_config_support.vif &&
2314 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2315 rdev->wiphy.tid_config_support.vif,
2316 NL80211_TID_CONFIG_ATTR_PAD))
2317 goto fail;
2318
2319 if (rdev->wiphy.tid_config_support.peer &&
2320 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2321 rdev->wiphy.tid_config_support.peer,
2322 NL80211_TID_CONFIG_ATTR_PAD))
2323 goto fail;
2324
2325 /* for now we just use the same value ... makes more sense */
2326 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2327 rdev->wiphy.tid_config_support.max_retry))
2328 goto fail;
2329 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2330 rdev->wiphy.tid_config_support.max_retry))
2331 goto fail;
2332
2333 nla_nest_end(msg, supp);
2334
2335 return 0;
2336 fail:
2337 nla_nest_cancel(msg, supp);
2338 return -ENOBUFS;
2339 }
2340
2341 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2342 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2343 struct sk_buff *msg)
2344 {
2345 struct nlattr *sar_capa, *specs, *sub_freq_range;
2346 u8 num_freq_ranges;
2347 int i;
2348
2349 if (!rdev->wiphy.sar_capa)
2350 return 0;
2351
2352 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2353
2354 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2355 if (!sar_capa)
2356 return -ENOSPC;
2357
2358 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2359 goto fail;
2360
2361 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2362 if (!specs)
2363 goto fail;
2364
2365 /* report supported freq_ranges */
2366 for (i = 0; i < num_freq_ranges; i++) {
2367 sub_freq_range = nla_nest_start(msg, i + 1);
2368 if (!sub_freq_range)
2369 goto fail;
2370
2371 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2372 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2373 goto fail;
2374
2375 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2376 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2377 goto fail;
2378
2379 nla_nest_end(msg, sub_freq_range);
2380 }
2381
2382 nla_nest_end(msg, specs);
2383 nla_nest_end(msg, sar_capa);
2384
2385 return 0;
2386 fail:
2387 nla_nest_cancel(msg, sar_capa);
2388 return -ENOBUFS;
2389 }
2390
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2391 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2392 {
2393 struct nlattr *config;
2394
2395 if (!wiphy->mbssid_max_interfaces)
2396 return 0;
2397
2398 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2399 if (!config)
2400 return -ENOBUFS;
2401
2402 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2403 wiphy->mbssid_max_interfaces))
2404 goto fail;
2405
2406 if (wiphy->ema_max_profile_periodicity &&
2407 nla_put_u8(msg,
2408 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2409 wiphy->ema_max_profile_periodicity))
2410 goto fail;
2411
2412 nla_nest_end(msg, config);
2413 return 0;
2414
2415 fail:
2416 nla_nest_cancel(msg, config);
2417 return -ENOBUFS;
2418 }
2419
nl80211_put_radio(struct wiphy * wiphy,struct sk_buff * msg,int idx)2420 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2421 {
2422 const struct wiphy_radio *r = &wiphy->radio[idx];
2423 struct nlattr *radio, *freq;
2424 int i;
2425
2426 radio = nla_nest_start(msg, idx);
2427 if (!radio)
2428 return -ENOBUFS;
2429
2430 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2431 goto nla_put_failure;
2432
2433 for (i = 0; i < r->n_freq_range; i++) {
2434 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2435
2436 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2437 if (!freq)
2438 goto nla_put_failure;
2439
2440 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2441 range->start_freq) ||
2442 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2443 range->end_freq))
2444 goto nla_put_failure;
2445
2446 nla_nest_end(msg, freq);
2447 }
2448
2449 for (i = 0; i < r->n_iface_combinations; i++)
2450 if (nl80211_put_ifcomb_data(msg, true,
2451 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2452 &r->iface_combinations[i],
2453 NLA_F_NESTED))
2454 goto nla_put_failure;
2455
2456 nla_nest_end(msg, radio);
2457
2458 return 0;
2459
2460 nla_put_failure:
2461 return -ENOBUFS;
2462 }
2463
nl80211_put_radios(struct wiphy * wiphy,struct sk_buff * msg)2464 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2465 {
2466 struct nlattr *radios;
2467 int i;
2468
2469 if (!wiphy->n_radio)
2470 return 0;
2471
2472 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2473 if (!radios)
2474 return -ENOBUFS;
2475
2476 for (i = 0; i < wiphy->n_radio; i++)
2477 if (nl80211_put_radio(wiphy, msg, i))
2478 goto fail;
2479
2480 nla_nest_end(msg, radios);
2481
2482 if (nl80211_put_iface_combinations(wiphy, msg,
2483 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2484 -1, true, NLA_F_NESTED))
2485 return -ENOBUFS;
2486
2487 return 0;
2488
2489 fail:
2490 nla_nest_cancel(msg, radios);
2491 return -ENOBUFS;
2492 }
2493
2494 struct nl80211_dump_wiphy_state {
2495 s64 filter_wiphy;
2496 long start;
2497 long split_start, band_start, chan_start, capa_start;
2498 bool split;
2499 };
2500
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2501 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2502 enum nl80211_commands cmd,
2503 struct sk_buff *msg, u32 portid, u32 seq,
2504 int flags, struct nl80211_dump_wiphy_state *state)
2505 {
2506 void *hdr;
2507 struct nlattr *nl_bands, *nl_band;
2508 struct nlattr *nl_freqs, *nl_freq;
2509 struct nlattr *nl_cmds;
2510 enum nl80211_band band;
2511 struct ieee80211_channel *chan;
2512 int i;
2513 const struct ieee80211_txrx_stypes *mgmt_stypes =
2514 rdev->wiphy.mgmt_stypes;
2515 u32 features;
2516
2517 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2518 if (!hdr)
2519 return -ENOBUFS;
2520
2521 if (WARN_ON(!state))
2522 return -EINVAL;
2523
2524 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2525 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2526 wiphy_name(&rdev->wiphy)) ||
2527 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2528 cfg80211_rdev_list_generation))
2529 goto nla_put_failure;
2530
2531 if (cmd != NL80211_CMD_NEW_WIPHY)
2532 goto finish;
2533
2534 switch (state->split_start) {
2535 case 0:
2536 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2537 rdev->wiphy.retry_short) ||
2538 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2539 rdev->wiphy.retry_long) ||
2540 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2541 rdev->wiphy.frag_threshold) ||
2542 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2543 rdev->wiphy.rts_threshold) ||
2544 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2545 rdev->wiphy.coverage_class) ||
2546 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2547 rdev->wiphy.max_scan_ssids) ||
2548 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2549 rdev->wiphy.max_sched_scan_ssids) ||
2550 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2551 rdev->wiphy.max_scan_ie_len) ||
2552 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2553 rdev->wiphy.max_sched_scan_ie_len) ||
2554 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2555 rdev->wiphy.max_match_sets))
2556 goto nla_put_failure;
2557
2558 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2559 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2560 goto nla_put_failure;
2561 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2562 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2563 goto nla_put_failure;
2564 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2565 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2566 goto nla_put_failure;
2567 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2568 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2569 goto nla_put_failure;
2570 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2571 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2572 goto nla_put_failure;
2573 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2574 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2575 goto nla_put_failure;
2576 state->split_start++;
2577 if (state->split)
2578 break;
2579 fallthrough;
2580 case 1:
2581 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2582 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2583 rdev->wiphy.cipher_suites))
2584 goto nla_put_failure;
2585
2586 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2587 rdev->wiphy.max_num_pmkids))
2588 goto nla_put_failure;
2589
2590 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2591 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2592 goto nla_put_failure;
2593
2594 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2595 rdev->wiphy.available_antennas_tx) ||
2596 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2597 rdev->wiphy.available_antennas_rx))
2598 goto nla_put_failure;
2599
2600 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2601 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2602 rdev->wiphy.probe_resp_offload))
2603 goto nla_put_failure;
2604
2605 if ((rdev->wiphy.available_antennas_tx ||
2606 rdev->wiphy.available_antennas_rx) &&
2607 rdev->ops->get_antenna) {
2608 u32 tx_ant = 0, rx_ant = 0;
2609 int res;
2610
2611 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2612 if (!res) {
2613 if (nla_put_u32(msg,
2614 NL80211_ATTR_WIPHY_ANTENNA_TX,
2615 tx_ant) ||
2616 nla_put_u32(msg,
2617 NL80211_ATTR_WIPHY_ANTENNA_RX,
2618 rx_ant))
2619 goto nla_put_failure;
2620 }
2621 }
2622
2623 state->split_start++;
2624 if (state->split)
2625 break;
2626 fallthrough;
2627 case 2:
2628 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2629 rdev->wiphy.interface_modes))
2630 goto nla_put_failure;
2631 state->split_start++;
2632 if (state->split)
2633 break;
2634 fallthrough;
2635 case 3:
2636 nl_bands = nla_nest_start_noflag(msg,
2637 NL80211_ATTR_WIPHY_BANDS);
2638 if (!nl_bands)
2639 goto nla_put_failure;
2640
2641 for (band = state->band_start;
2642 band < (state->split ?
2643 NUM_NL80211_BANDS :
2644 NL80211_BAND_60GHZ + 1);
2645 band++) {
2646 struct ieee80211_supported_band *sband;
2647
2648 /* omit higher bands for ancient software */
2649 if (band > NL80211_BAND_5GHZ && !state->split)
2650 break;
2651
2652 sband = rdev->wiphy.bands[band];
2653
2654 if (!sband)
2655 continue;
2656
2657 nl_band = nla_nest_start_noflag(msg, band);
2658 if (!nl_band)
2659 goto nla_put_failure;
2660
2661 switch (state->chan_start) {
2662 case 0:
2663 if (nl80211_send_band_rateinfo(msg, sband,
2664 state->split))
2665 goto nla_put_failure;
2666 state->chan_start++;
2667 if (state->split)
2668 break;
2669 fallthrough;
2670 default:
2671 /* add frequencies */
2672 nl_freqs = nla_nest_start_noflag(msg,
2673 NL80211_BAND_ATTR_FREQS);
2674 if (!nl_freqs)
2675 goto nla_put_failure;
2676
2677 for (i = state->chan_start - 1;
2678 i < sband->n_channels;
2679 i++) {
2680 nl_freq = nla_nest_start_noflag(msg,
2681 i);
2682 if (!nl_freq)
2683 goto nla_put_failure;
2684
2685 chan = &sband->channels[i];
2686
2687 if (nl80211_msg_put_channel(
2688 msg, &rdev->wiphy, chan,
2689 state->split))
2690 goto nla_put_failure;
2691
2692 nla_nest_end(msg, nl_freq);
2693 if (state->split)
2694 break;
2695 }
2696 if (i < sband->n_channels)
2697 state->chan_start = i + 2;
2698 else
2699 state->chan_start = 0;
2700 nla_nest_end(msg, nl_freqs);
2701 }
2702
2703 nla_nest_end(msg, nl_band);
2704
2705 if (state->split) {
2706 /* start again here */
2707 if (state->chan_start)
2708 band--;
2709 break;
2710 }
2711 }
2712 nla_nest_end(msg, nl_bands);
2713
2714 if (band < NUM_NL80211_BANDS)
2715 state->band_start = band + 1;
2716 else
2717 state->band_start = 0;
2718
2719 /* if bands & channels are done, continue outside */
2720 if (state->band_start == 0 && state->chan_start == 0)
2721 state->split_start++;
2722 if (state->split)
2723 break;
2724 fallthrough;
2725 case 4:
2726 nl_cmds = nla_nest_start_noflag(msg,
2727 NL80211_ATTR_SUPPORTED_COMMANDS);
2728 if (!nl_cmds)
2729 goto nla_put_failure;
2730
2731 i = nl80211_add_commands_unsplit(rdev, msg);
2732 if (i < 0)
2733 goto nla_put_failure;
2734 if (state->split) {
2735 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2736 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2737 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2738 CMD(channel_switch, CHANNEL_SWITCH);
2739 CMD(set_qos_map, SET_QOS_MAP);
2740 if (rdev->wiphy.features &
2741 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2742 CMD(add_tx_ts, ADD_TX_TS);
2743 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2744 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2745 CMD(update_ft_ies, UPDATE_FT_IES);
2746 if (rdev->wiphy.sar_capa)
2747 CMD(set_sar_specs, SET_SAR_SPECS);
2748 }
2749 #undef CMD
2750
2751 nla_nest_end(msg, nl_cmds);
2752 state->split_start++;
2753 if (state->split)
2754 break;
2755 fallthrough;
2756 case 5:
2757 if (rdev->ops->remain_on_channel &&
2758 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2759 nla_put_u32(msg,
2760 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2761 rdev->wiphy.max_remain_on_channel_duration))
2762 goto nla_put_failure;
2763
2764 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2765 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2766 goto nla_put_failure;
2767
2768 state->split_start++;
2769 if (state->split)
2770 break;
2771 fallthrough;
2772 case 6:
2773 #ifdef CONFIG_PM
2774 if (nl80211_send_wowlan(msg, rdev, state->split))
2775 goto nla_put_failure;
2776 state->split_start++;
2777 if (state->split)
2778 break;
2779 #else
2780 state->split_start++;
2781 #endif
2782 fallthrough;
2783 case 7:
2784 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2785 rdev->wiphy.software_iftypes))
2786 goto nla_put_failure;
2787
2788 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2789 NL80211_ATTR_INTERFACE_COMBINATIONS,
2790 rdev->wiphy.n_radio ? 0 : -1,
2791 state->split, 0))
2792 goto nla_put_failure;
2793
2794 state->split_start++;
2795 if (state->split)
2796 break;
2797 fallthrough;
2798 case 8:
2799 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2800 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2801 rdev->wiphy.ap_sme_capa))
2802 goto nla_put_failure;
2803
2804 features = rdev->wiphy.features;
2805 /*
2806 * We can only add the per-channel limit information if the
2807 * dump is split, otherwise it makes it too big. Therefore
2808 * only advertise it in that case.
2809 */
2810 if (state->split)
2811 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2812 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2813 goto nla_put_failure;
2814
2815 if (rdev->wiphy.ht_capa_mod_mask &&
2816 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2817 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2818 rdev->wiphy.ht_capa_mod_mask))
2819 goto nla_put_failure;
2820
2821 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2822 rdev->wiphy.max_acl_mac_addrs &&
2823 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2824 rdev->wiphy.max_acl_mac_addrs))
2825 goto nla_put_failure;
2826
2827 /*
2828 * Any information below this point is only available to
2829 * applications that can deal with it being split. This
2830 * helps ensure that newly added capabilities don't break
2831 * older tools by overrunning their buffers.
2832 *
2833 * We still increment split_start so that in the split
2834 * case we'll continue with more data in the next round,
2835 * but break unconditionally so unsplit data stops here.
2836 */
2837 if (state->split)
2838 state->split_start++;
2839 else
2840 state->split_start = 0;
2841 break;
2842 case 9:
2843 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2844 goto nla_put_failure;
2845
2846 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2847 rdev->wiphy.max_sched_scan_plans) ||
2848 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2849 rdev->wiphy.max_sched_scan_plan_interval) ||
2850 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2851 rdev->wiphy.max_sched_scan_plan_iterations))
2852 goto nla_put_failure;
2853
2854 if (rdev->wiphy.extended_capabilities &&
2855 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2856 rdev->wiphy.extended_capabilities_len,
2857 rdev->wiphy.extended_capabilities) ||
2858 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2859 rdev->wiphy.extended_capabilities_len,
2860 rdev->wiphy.extended_capabilities_mask)))
2861 goto nla_put_failure;
2862
2863 if (rdev->wiphy.vht_capa_mod_mask &&
2864 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2865 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2866 rdev->wiphy.vht_capa_mod_mask))
2867 goto nla_put_failure;
2868
2869 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2870 rdev->wiphy.perm_addr))
2871 goto nla_put_failure;
2872
2873 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2874 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2875 rdev->wiphy.addr_mask))
2876 goto nla_put_failure;
2877
2878 if (rdev->wiphy.n_addresses > 1) {
2879 void *attr;
2880
2881 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2882 if (!attr)
2883 goto nla_put_failure;
2884
2885 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2886 if (nla_put(msg, i + 1, ETH_ALEN,
2887 rdev->wiphy.addresses[i].addr))
2888 goto nla_put_failure;
2889
2890 nla_nest_end(msg, attr);
2891 }
2892
2893 state->split_start++;
2894 break;
2895 case 10:
2896 if (nl80211_send_coalesce(msg, rdev))
2897 goto nla_put_failure;
2898
2899 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2900 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2901 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2902 goto nla_put_failure;
2903
2904 if (rdev->wiphy.max_ap_assoc_sta &&
2905 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2906 rdev->wiphy.max_ap_assoc_sta))
2907 goto nla_put_failure;
2908
2909 state->split_start++;
2910 break;
2911 case 11:
2912 if (rdev->wiphy.n_vendor_commands) {
2913 const struct nl80211_vendor_cmd_info *info;
2914 struct nlattr *nested;
2915
2916 nested = nla_nest_start_noflag(msg,
2917 NL80211_ATTR_VENDOR_DATA);
2918 if (!nested)
2919 goto nla_put_failure;
2920
2921 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2922 info = &rdev->wiphy.vendor_commands[i].info;
2923 if (nla_put(msg, i + 1, sizeof(*info), info))
2924 goto nla_put_failure;
2925 }
2926 nla_nest_end(msg, nested);
2927 }
2928
2929 if (rdev->wiphy.n_vendor_events) {
2930 const struct nl80211_vendor_cmd_info *info;
2931 struct nlattr *nested;
2932
2933 nested = nla_nest_start_noflag(msg,
2934 NL80211_ATTR_VENDOR_EVENTS);
2935 if (!nested)
2936 goto nla_put_failure;
2937
2938 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2939 info = &rdev->wiphy.vendor_events[i];
2940 if (nla_put(msg, i + 1, sizeof(*info), info))
2941 goto nla_put_failure;
2942 }
2943 nla_nest_end(msg, nested);
2944 }
2945 state->split_start++;
2946 break;
2947 case 12:
2948 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2949 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2950 rdev->wiphy.max_num_csa_counters))
2951 goto nla_put_failure;
2952
2953 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2954 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2955 goto nla_put_failure;
2956
2957 if (rdev->wiphy.max_sched_scan_reqs &&
2958 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2959 rdev->wiphy.max_sched_scan_reqs))
2960 goto nla_put_failure;
2961
2962 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2963 sizeof(rdev->wiphy.ext_features),
2964 rdev->wiphy.ext_features))
2965 goto nla_put_failure;
2966
2967 if (rdev->wiphy.bss_select_support) {
2968 struct nlattr *nested;
2969 u32 bss_select_support = rdev->wiphy.bss_select_support;
2970
2971 nested = nla_nest_start_noflag(msg,
2972 NL80211_ATTR_BSS_SELECT);
2973 if (!nested)
2974 goto nla_put_failure;
2975
2976 i = 0;
2977 while (bss_select_support) {
2978 if ((bss_select_support & 1) &&
2979 nla_put_flag(msg, i))
2980 goto nla_put_failure;
2981 i++;
2982 bss_select_support >>= 1;
2983 }
2984 nla_nest_end(msg, nested);
2985 }
2986
2987 state->split_start++;
2988 break;
2989 case 13:
2990 if (rdev->wiphy.num_iftype_ext_capab &&
2991 rdev->wiphy.iftype_ext_capab) {
2992 struct nlattr *nested_ext_capab, *nested;
2993
2994 nested = nla_nest_start_noflag(msg,
2995 NL80211_ATTR_IFTYPE_EXT_CAPA);
2996 if (!nested)
2997 goto nla_put_failure;
2998
2999 for (i = state->capa_start;
3000 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3001 const struct wiphy_iftype_ext_capab *capab;
3002
3003 capab = &rdev->wiphy.iftype_ext_capab[i];
3004
3005 nested_ext_capab = nla_nest_start_noflag(msg,
3006 i);
3007 if (!nested_ext_capab ||
3008 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3009 capab->iftype) ||
3010 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3011 capab->extended_capabilities_len,
3012 capab->extended_capabilities) ||
3013 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3014 capab->extended_capabilities_len,
3015 capab->extended_capabilities_mask))
3016 goto nla_put_failure;
3017
3018 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3019 (nla_put_u16(msg,
3020 NL80211_ATTR_EML_CAPABILITY,
3021 capab->eml_capabilities) ||
3022 nla_put_u16(msg,
3023 NL80211_ATTR_MLD_CAPA_AND_OPS,
3024 capab->mld_capa_and_ops)))
3025 goto nla_put_failure;
3026
3027 nla_nest_end(msg, nested_ext_capab);
3028 if (state->split)
3029 break;
3030 }
3031 nla_nest_end(msg, nested);
3032 if (i < rdev->wiphy.num_iftype_ext_capab) {
3033 state->capa_start = i + 1;
3034 break;
3035 }
3036 }
3037
3038 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3039 rdev->wiphy.nan_supported_bands))
3040 goto nla_put_failure;
3041
3042 if (wiphy_ext_feature_isset(&rdev->wiphy,
3043 NL80211_EXT_FEATURE_TXQS)) {
3044 struct cfg80211_txq_stats txqstats = {};
3045 int res;
3046
3047 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3048 if (!res &&
3049 !nl80211_put_txq_stats(msg, &txqstats,
3050 NL80211_ATTR_TXQ_STATS))
3051 goto nla_put_failure;
3052
3053 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3054 rdev->wiphy.txq_limit))
3055 goto nla_put_failure;
3056 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3057 rdev->wiphy.txq_memory_limit))
3058 goto nla_put_failure;
3059 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3060 rdev->wiphy.txq_quantum))
3061 goto nla_put_failure;
3062 }
3063
3064 state->split_start++;
3065 break;
3066 case 14:
3067 if (nl80211_send_pmsr_capa(rdev, msg))
3068 goto nla_put_failure;
3069
3070 state->split_start++;
3071 break;
3072 case 15:
3073 if (rdev->wiphy.akm_suites &&
3074 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3075 sizeof(u32) * rdev->wiphy.n_akm_suites,
3076 rdev->wiphy.akm_suites))
3077 goto nla_put_failure;
3078
3079 if (nl80211_put_iftype_akm_suites(rdev, msg))
3080 goto nla_put_failure;
3081
3082 if (nl80211_put_tid_config_support(rdev, msg))
3083 goto nla_put_failure;
3084 state->split_start++;
3085 break;
3086 case 16:
3087 if (nl80211_put_sar_specs(rdev, msg))
3088 goto nla_put_failure;
3089
3090 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3091 goto nla_put_failure;
3092
3093 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3094 rdev->wiphy.max_num_akm_suites))
3095 goto nla_put_failure;
3096
3097 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3098 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3099
3100 if (rdev->wiphy.hw_timestamp_max_peers &&
3101 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3102 rdev->wiphy.hw_timestamp_max_peers))
3103 goto nla_put_failure;
3104
3105 state->split_start++;
3106 break;
3107 case 17:
3108 if (nl80211_put_radios(&rdev->wiphy, msg))
3109 goto nla_put_failure;
3110
3111 /* done */
3112 state->split_start = 0;
3113 break;
3114 }
3115 finish:
3116 genlmsg_end(msg, hdr);
3117 return 0;
3118
3119 nla_put_failure:
3120 genlmsg_cancel(msg, hdr);
3121 return -EMSGSIZE;
3122 }
3123
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3124 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3125 struct netlink_callback *cb,
3126 struct nl80211_dump_wiphy_state *state)
3127 {
3128 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3129 int ret;
3130
3131 if (!tb)
3132 return -ENOMEM;
3133
3134 ret = nlmsg_parse_deprecated(cb->nlh,
3135 GENL_HDRLEN + nl80211_fam.hdrsize,
3136 tb, nl80211_fam.maxattr,
3137 nl80211_policy, NULL);
3138 /* ignore parse errors for backward compatibility */
3139 if (ret) {
3140 ret = 0;
3141 goto out;
3142 }
3143
3144 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3145 if (tb[NL80211_ATTR_WIPHY])
3146 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3147 if (tb[NL80211_ATTR_WDEV])
3148 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3149 if (tb[NL80211_ATTR_IFINDEX]) {
3150 struct net_device *netdev;
3151 struct cfg80211_registered_device *rdev;
3152 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3153
3154 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3155 if (!netdev) {
3156 ret = -ENODEV;
3157 goto out;
3158 }
3159 if (netdev->ieee80211_ptr) {
3160 rdev = wiphy_to_rdev(
3161 netdev->ieee80211_ptr->wiphy);
3162 state->filter_wiphy = rdev->wiphy_idx;
3163 }
3164 }
3165
3166 ret = 0;
3167 out:
3168 kfree(tb);
3169 return ret;
3170 }
3171
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3172 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3173 {
3174 int idx = 0, ret;
3175 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3176 struct cfg80211_registered_device *rdev;
3177
3178 rtnl_lock();
3179 if (!state) {
3180 state = kzalloc(sizeof(*state), GFP_KERNEL);
3181 if (!state) {
3182 rtnl_unlock();
3183 return -ENOMEM;
3184 }
3185 state->filter_wiphy = -1;
3186 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3187 if (ret) {
3188 kfree(state);
3189 rtnl_unlock();
3190 return ret;
3191 }
3192 cb->args[0] = (long)state;
3193 }
3194
3195 for_each_rdev(rdev) {
3196 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3197 continue;
3198 if (++idx <= state->start)
3199 continue;
3200 if (state->filter_wiphy != -1 &&
3201 state->filter_wiphy != rdev->wiphy_idx)
3202 continue;
3203 wiphy_lock(&rdev->wiphy);
3204 /* attempt to fit multiple wiphy data chunks into the skb */
3205 do {
3206 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3207 skb,
3208 NETLINK_CB(cb->skb).portid,
3209 cb->nlh->nlmsg_seq,
3210 NLM_F_MULTI, state);
3211 if (ret < 0) {
3212 /*
3213 * If sending the wiphy data didn't fit (ENOBUFS
3214 * or EMSGSIZE returned), this SKB is still
3215 * empty (so it's not too big because another
3216 * wiphy dataset is already in the skb) and
3217 * we've not tried to adjust the dump allocation
3218 * yet ... then adjust the alloc size to be
3219 * bigger, and return 1 but with the empty skb.
3220 * This results in an empty message being RX'ed
3221 * in userspace, but that is ignored.
3222 *
3223 * We can then retry with the larger buffer.
3224 */
3225 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3226 !skb->len && !state->split &&
3227 cb->min_dump_alloc < 4096) {
3228 cb->min_dump_alloc = 4096;
3229 state->split_start = 0;
3230 wiphy_unlock(&rdev->wiphy);
3231 rtnl_unlock();
3232 return 1;
3233 }
3234 idx--;
3235 break;
3236 }
3237 } while (state->split_start > 0);
3238 wiphy_unlock(&rdev->wiphy);
3239 break;
3240 }
3241 rtnl_unlock();
3242
3243 state->start = idx;
3244
3245 return skb->len;
3246 }
3247
nl80211_dump_wiphy_done(struct netlink_callback * cb)3248 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3249 {
3250 kfree((void *)cb->args[0]);
3251 return 0;
3252 }
3253
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3254 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3255 {
3256 struct sk_buff *msg;
3257 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3258 struct nl80211_dump_wiphy_state state = {};
3259
3260 msg = nlmsg_new(4096, GFP_KERNEL);
3261 if (!msg)
3262 return -ENOMEM;
3263
3264 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3265 info->snd_portid, info->snd_seq, 0,
3266 &state) < 0) {
3267 nlmsg_free(msg);
3268 return -ENOBUFS;
3269 }
3270
3271 return genlmsg_reply(msg, info);
3272 }
3273
3274 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3275 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3276 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3277 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3278 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3279 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3280 };
3281
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3282 static int parse_txq_params(struct nlattr *tb[],
3283 struct ieee80211_txq_params *txq_params)
3284 {
3285 u8 ac;
3286
3287 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3288 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3289 !tb[NL80211_TXQ_ATTR_AIFS])
3290 return -EINVAL;
3291
3292 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3293 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3294 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3295 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3296 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3297
3298 if (ac >= NL80211_NUM_ACS)
3299 return -EINVAL;
3300 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3301 return 0;
3302 }
3303
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3304 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3305 {
3306 /*
3307 * You can only set the channel explicitly for some interfaces,
3308 * most have their channel managed via their respective
3309 * "establish a connection" command (connect, join, ...)
3310 *
3311 * For AP/GO and mesh mode, the channel can be set with the
3312 * channel userspace API, but is only stored and passed to the
3313 * low-level driver when the AP starts or the mesh is joined.
3314 * This is for backward compatibility, userspace can also give
3315 * the channel in the start-ap or join-mesh commands instead.
3316 *
3317 * Monitors are special as they are normally slaved to
3318 * whatever else is going on, so they have their own special
3319 * operation to set the monitor channel if possible.
3320 */
3321 return !wdev ||
3322 wdev->iftype == NL80211_IFTYPE_AP ||
3323 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3324 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3325 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3326 }
3327
_nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,bool monitor,struct cfg80211_chan_def * chandef)3328 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3329 struct genl_info *info, bool monitor,
3330 struct cfg80211_chan_def *chandef)
3331 {
3332 struct netlink_ext_ack *extack = info->extack;
3333 struct nlattr **attrs = info->attrs;
3334 u32 control_freq;
3335
3336 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3337 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3338 "Frequency is missing");
3339 return -EINVAL;
3340 }
3341
3342 control_freq = MHZ_TO_KHZ(
3343 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3344 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3345 control_freq +=
3346 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3347
3348 memset(chandef, 0, sizeof(*chandef));
3349 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3350 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3351 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3352 chandef->freq1_offset = control_freq % 1000;
3353 chandef->center_freq2 = 0;
3354
3355 if (!chandef->chan) {
3356 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3357 "Unknown channel");
3358 return -EINVAL;
3359 }
3360
3361 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3362 enum nl80211_channel_type chantype;
3363
3364 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3365
3366 switch (chantype) {
3367 case NL80211_CHAN_NO_HT:
3368 case NL80211_CHAN_HT20:
3369 case NL80211_CHAN_HT40PLUS:
3370 case NL80211_CHAN_HT40MINUS:
3371 cfg80211_chandef_create(chandef, chandef->chan,
3372 chantype);
3373 /* user input for center_freq is incorrect */
3374 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3375 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3376 NL_SET_ERR_MSG_ATTR(extack,
3377 attrs[NL80211_ATTR_CENTER_FREQ1],
3378 "bad center frequency 1");
3379 return -EINVAL;
3380 }
3381 /* center_freq2 must be zero */
3382 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3383 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3384 NL_SET_ERR_MSG_ATTR(extack,
3385 attrs[NL80211_ATTR_CENTER_FREQ2],
3386 "center frequency 2 can't be used");
3387 return -EINVAL;
3388 }
3389 break;
3390 default:
3391 NL_SET_ERR_MSG_ATTR(extack,
3392 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3393 "invalid channel type");
3394 return -EINVAL;
3395 }
3396 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3397 chandef->width =
3398 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3399 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3400 /* User input error for channel width doesn't match channel */
3401 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3402 NL_SET_ERR_MSG_ATTR(extack,
3403 attrs[NL80211_ATTR_CHANNEL_WIDTH],
3404 "bad channel width");
3405 return -EINVAL;
3406 }
3407 }
3408 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3409 chandef->center_freq1 =
3410 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3411 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3412 chandef->freq1_offset = nla_get_u32(
3413 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3414 else
3415 chandef->freq1_offset = 0;
3416 }
3417 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3418 chandef->center_freq2 =
3419 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3420 }
3421
3422 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3423 chandef->edmg.channels =
3424 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3425
3426 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3427 chandef->edmg.bw_config =
3428 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3429 } else {
3430 chandef->edmg.bw_config = 0;
3431 chandef->edmg.channels = 0;
3432 }
3433
3434 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3435 chandef->punctured =
3436 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3437
3438 if (chandef->punctured &&
3439 !wiphy_ext_feature_isset(&rdev->wiphy,
3440 NL80211_EXT_FEATURE_PUNCT)) {
3441 NL_SET_ERR_MSG(extack,
3442 "driver doesn't support puncturing");
3443 return -EINVAL;
3444 }
3445 }
3446
3447 if (!cfg80211_chandef_valid(chandef)) {
3448 NL_SET_ERR_MSG(extack, "invalid channel definition");
3449 return -EINVAL;
3450 }
3451
3452 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3453 IEEE80211_CHAN_DISABLED,
3454 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3455 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3456 return -EINVAL;
3457 }
3458
3459 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3460 chandef->width == NL80211_CHAN_WIDTH_10) &&
3461 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3462 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3463 return -EINVAL;
3464 }
3465
3466 return 0;
3467 }
3468
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3469 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3470 struct genl_info *info,
3471 struct cfg80211_chan_def *chandef)
3472 {
3473 return _nl80211_parse_chandef(rdev, info, false, chandef);
3474 }
3475
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3476 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3477 struct net_device *dev,
3478 struct genl_info *info,
3479 int _link_id)
3480 {
3481 struct cfg80211_chan_def chandef;
3482 int result;
3483 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3484 struct wireless_dev *wdev = NULL;
3485 int link_id = _link_id;
3486
3487 if (dev)
3488 wdev = dev->ieee80211_ptr;
3489 if (!nl80211_can_set_dev_channel(wdev))
3490 return -EOPNOTSUPP;
3491 if (wdev)
3492 iftype = wdev->iftype;
3493
3494 if (link_id < 0) {
3495 if (wdev && wdev->valid_links)
3496 return -EINVAL;
3497 link_id = 0;
3498 }
3499
3500 result = _nl80211_parse_chandef(rdev, info,
3501 iftype == NL80211_IFTYPE_MONITOR,
3502 &chandef);
3503 if (result)
3504 return result;
3505
3506 switch (iftype) {
3507 case NL80211_IFTYPE_AP:
3508 case NL80211_IFTYPE_P2P_GO:
3509 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3510 iftype))
3511 return -EINVAL;
3512 if (wdev->links[link_id].ap.beacon_interval) {
3513 struct ieee80211_channel *cur_chan;
3514
3515 if (!dev || !rdev->ops->set_ap_chanwidth ||
3516 !(rdev->wiphy.features &
3517 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3518 return -EBUSY;
3519
3520 /* Only allow dynamic channel width changes */
3521 cur_chan = wdev->links[link_id].ap.chandef.chan;
3522 if (chandef.chan != cur_chan)
3523 return -EBUSY;
3524
3525 /* only allow this for regular channel widths */
3526 switch (wdev->links[link_id].ap.chandef.width) {
3527 case NL80211_CHAN_WIDTH_20_NOHT:
3528 case NL80211_CHAN_WIDTH_20:
3529 case NL80211_CHAN_WIDTH_40:
3530 case NL80211_CHAN_WIDTH_80:
3531 case NL80211_CHAN_WIDTH_80P80:
3532 case NL80211_CHAN_WIDTH_160:
3533 case NL80211_CHAN_WIDTH_320:
3534 break;
3535 default:
3536 return -EINVAL;
3537 }
3538
3539 switch (chandef.width) {
3540 case NL80211_CHAN_WIDTH_20_NOHT:
3541 case NL80211_CHAN_WIDTH_20:
3542 case NL80211_CHAN_WIDTH_40:
3543 case NL80211_CHAN_WIDTH_80:
3544 case NL80211_CHAN_WIDTH_80P80:
3545 case NL80211_CHAN_WIDTH_160:
3546 case NL80211_CHAN_WIDTH_320:
3547 break;
3548 default:
3549 return -EINVAL;
3550 }
3551
3552 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3553 &chandef);
3554 if (result)
3555 return result;
3556 wdev->links[link_id].ap.chandef = chandef;
3557 } else {
3558 wdev->u.ap.preset_chandef = chandef;
3559 }
3560 return 0;
3561 case NL80211_IFTYPE_MESH_POINT:
3562 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3563 case NL80211_IFTYPE_MONITOR:
3564 return cfg80211_set_monitor_channel(rdev, &chandef);
3565 default:
3566 break;
3567 }
3568
3569 return -EINVAL;
3570 }
3571
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3572 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3573 {
3574 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3575 int link_id = nl80211_link_id_or_invalid(info->attrs);
3576 struct net_device *netdev = info->user_ptr[1];
3577
3578 return __nl80211_set_channel(rdev, netdev, info, link_id);
3579 }
3580
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3581 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3582 {
3583 struct cfg80211_registered_device *rdev = NULL;
3584 struct net_device *netdev = NULL;
3585 struct wireless_dev *wdev;
3586 int result = 0, rem_txq_params = 0;
3587 struct nlattr *nl_txq_params;
3588 u32 changed;
3589 u8 retry_short = 0, retry_long = 0;
3590 u32 frag_threshold = 0, rts_threshold = 0;
3591 u8 coverage_class = 0;
3592 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3593
3594 rtnl_lock();
3595 /*
3596 * Try to find the wiphy and netdev. Normally this
3597 * function shouldn't need the netdev, but this is
3598 * done for backward compatibility -- previously
3599 * setting the channel was done per wiphy, but now
3600 * it is per netdev. Previous userland like hostapd
3601 * also passed a netdev to set_wiphy, so that it is
3602 * possible to let that go to the right netdev!
3603 */
3604
3605 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3606 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3607
3608 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3609 if (netdev && netdev->ieee80211_ptr)
3610 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3611 else
3612 netdev = NULL;
3613 }
3614
3615 if (!netdev) {
3616 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3617 info->attrs);
3618 if (IS_ERR(rdev)) {
3619 rtnl_unlock();
3620 return PTR_ERR(rdev);
3621 }
3622 wdev = NULL;
3623 netdev = NULL;
3624 result = 0;
3625 } else
3626 wdev = netdev->ieee80211_ptr;
3627
3628 wiphy_lock(&rdev->wiphy);
3629
3630 /*
3631 * end workaround code, by now the rdev is available
3632 * and locked, and wdev may or may not be NULL.
3633 */
3634
3635 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3636 result = cfg80211_dev_rename(
3637 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3638 rtnl_unlock();
3639
3640 if (result)
3641 goto out;
3642
3643 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3644 struct ieee80211_txq_params txq_params;
3645 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3646
3647 if (!rdev->ops->set_txq_params) {
3648 result = -EOPNOTSUPP;
3649 goto out;
3650 }
3651
3652 if (!netdev) {
3653 result = -EINVAL;
3654 goto out;
3655 }
3656
3657 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3658 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3659 result = -EINVAL;
3660 goto out;
3661 }
3662
3663 if (!netif_running(netdev)) {
3664 result = -ENETDOWN;
3665 goto out;
3666 }
3667
3668 nla_for_each_nested(nl_txq_params,
3669 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3670 rem_txq_params) {
3671 result = nla_parse_nested_deprecated(tb,
3672 NL80211_TXQ_ATTR_MAX,
3673 nl_txq_params,
3674 txq_params_policy,
3675 info->extack);
3676 if (result)
3677 goto out;
3678 result = parse_txq_params(tb, &txq_params);
3679 if (result)
3680 goto out;
3681
3682 txq_params.link_id =
3683 nl80211_link_id_or_invalid(info->attrs);
3684
3685 if (txq_params.link_id >= 0 &&
3686 !(netdev->ieee80211_ptr->valid_links &
3687 BIT(txq_params.link_id)))
3688 result = -ENOLINK;
3689 else if (txq_params.link_id >= 0 &&
3690 !netdev->ieee80211_ptr->valid_links)
3691 result = -EINVAL;
3692 else
3693 result = rdev_set_txq_params(rdev, netdev,
3694 &txq_params);
3695 if (result)
3696 goto out;
3697 }
3698 }
3699
3700 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3701 int link_id = nl80211_link_id_or_invalid(info->attrs);
3702
3703 if (wdev) {
3704 result = __nl80211_set_channel(
3705 rdev,
3706 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3707 info, link_id);
3708 } else {
3709 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3710 }
3711
3712 if (result)
3713 goto out;
3714 }
3715
3716 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3717 struct wireless_dev *txp_wdev = wdev;
3718 enum nl80211_tx_power_setting type;
3719 int idx, mbm = 0;
3720
3721 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3722 txp_wdev = NULL;
3723
3724 if (!rdev->ops->set_tx_power) {
3725 result = -EOPNOTSUPP;
3726 goto out;
3727 }
3728
3729 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3730 type = nla_get_u32(info->attrs[idx]);
3731
3732 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3733 (type != NL80211_TX_POWER_AUTOMATIC)) {
3734 result = -EINVAL;
3735 goto out;
3736 }
3737
3738 if (type != NL80211_TX_POWER_AUTOMATIC) {
3739 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3740 mbm = nla_get_u32(info->attrs[idx]);
3741 }
3742
3743 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3744 if (result)
3745 goto out;
3746 }
3747
3748 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3749 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3750 u32 tx_ant, rx_ant;
3751
3752 if ((!rdev->wiphy.available_antennas_tx &&
3753 !rdev->wiphy.available_antennas_rx) ||
3754 !rdev->ops->set_antenna) {
3755 result = -EOPNOTSUPP;
3756 goto out;
3757 }
3758
3759 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3760 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3761
3762 /* reject antenna configurations which don't match the
3763 * available antenna masks, except for the "all" mask */
3764 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3765 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3766 result = -EINVAL;
3767 goto out;
3768 }
3769
3770 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3771 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3772
3773 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3774 if (result)
3775 goto out;
3776 }
3777
3778 changed = 0;
3779
3780 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3781 retry_short = nla_get_u8(
3782 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3783
3784 changed |= WIPHY_PARAM_RETRY_SHORT;
3785 }
3786
3787 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3788 retry_long = nla_get_u8(
3789 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3790
3791 changed |= WIPHY_PARAM_RETRY_LONG;
3792 }
3793
3794 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3795 frag_threshold = nla_get_u32(
3796 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3797 if (frag_threshold < 256) {
3798 result = -EINVAL;
3799 goto out;
3800 }
3801
3802 if (frag_threshold != (u32) -1) {
3803 /*
3804 * Fragments (apart from the last one) are required to
3805 * have even length. Make the fragmentation code
3806 * simpler by stripping LSB should someone try to use
3807 * odd threshold value.
3808 */
3809 frag_threshold &= ~0x1;
3810 }
3811 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3812 }
3813
3814 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3815 rts_threshold = nla_get_u32(
3816 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3817 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3818 }
3819
3820 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3821 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3822 result = -EINVAL;
3823 goto out;
3824 }
3825
3826 coverage_class = nla_get_u8(
3827 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3828 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3829 }
3830
3831 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3832 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3833 result = -EOPNOTSUPP;
3834 goto out;
3835 }
3836
3837 changed |= WIPHY_PARAM_DYN_ACK;
3838 }
3839
3840 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3841 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3842 NL80211_EXT_FEATURE_TXQS)) {
3843 result = -EOPNOTSUPP;
3844 goto out;
3845 }
3846 txq_limit = nla_get_u32(
3847 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3848 changed |= WIPHY_PARAM_TXQ_LIMIT;
3849 }
3850
3851 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3852 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3853 NL80211_EXT_FEATURE_TXQS)) {
3854 result = -EOPNOTSUPP;
3855 goto out;
3856 }
3857 txq_memory_limit = nla_get_u32(
3858 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3859 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3860 }
3861
3862 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3863 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3864 NL80211_EXT_FEATURE_TXQS)) {
3865 result = -EOPNOTSUPP;
3866 goto out;
3867 }
3868 txq_quantum = nla_get_u32(
3869 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3870 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3871 }
3872
3873 if (changed) {
3874 u8 old_retry_short, old_retry_long;
3875 u32 old_frag_threshold, old_rts_threshold;
3876 u8 old_coverage_class;
3877 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3878
3879 if (!rdev->ops->set_wiphy_params) {
3880 result = -EOPNOTSUPP;
3881 goto out;
3882 }
3883
3884 old_retry_short = rdev->wiphy.retry_short;
3885 old_retry_long = rdev->wiphy.retry_long;
3886 old_frag_threshold = rdev->wiphy.frag_threshold;
3887 old_rts_threshold = rdev->wiphy.rts_threshold;
3888 old_coverage_class = rdev->wiphy.coverage_class;
3889 old_txq_limit = rdev->wiphy.txq_limit;
3890 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3891 old_txq_quantum = rdev->wiphy.txq_quantum;
3892
3893 if (changed & WIPHY_PARAM_RETRY_SHORT)
3894 rdev->wiphy.retry_short = retry_short;
3895 if (changed & WIPHY_PARAM_RETRY_LONG)
3896 rdev->wiphy.retry_long = retry_long;
3897 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3898 rdev->wiphy.frag_threshold = frag_threshold;
3899 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3900 rdev->wiphy.rts_threshold = rts_threshold;
3901 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3902 rdev->wiphy.coverage_class = coverage_class;
3903 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3904 rdev->wiphy.txq_limit = txq_limit;
3905 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3906 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3907 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3908 rdev->wiphy.txq_quantum = txq_quantum;
3909
3910 result = rdev_set_wiphy_params(rdev, changed);
3911 if (result) {
3912 rdev->wiphy.retry_short = old_retry_short;
3913 rdev->wiphy.retry_long = old_retry_long;
3914 rdev->wiphy.frag_threshold = old_frag_threshold;
3915 rdev->wiphy.rts_threshold = old_rts_threshold;
3916 rdev->wiphy.coverage_class = old_coverage_class;
3917 rdev->wiphy.txq_limit = old_txq_limit;
3918 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3919 rdev->wiphy.txq_quantum = old_txq_quantum;
3920 goto out;
3921 }
3922 }
3923
3924 result = 0;
3925
3926 out:
3927 wiphy_unlock(&rdev->wiphy);
3928 return result;
3929 }
3930
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)3931 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3932 {
3933 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3934 return -EINVAL;
3935
3936 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3937 chandef->chan->center_freq))
3938 return -ENOBUFS;
3939 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3940 chandef->chan->freq_offset))
3941 return -ENOBUFS;
3942 switch (chandef->width) {
3943 case NL80211_CHAN_WIDTH_20_NOHT:
3944 case NL80211_CHAN_WIDTH_20:
3945 case NL80211_CHAN_WIDTH_40:
3946 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3947 cfg80211_get_chandef_type(chandef)))
3948 return -ENOBUFS;
3949 break;
3950 default:
3951 break;
3952 }
3953 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3954 return -ENOBUFS;
3955 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3956 return -ENOBUFS;
3957 if (chandef->center_freq2 &&
3958 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3959 return -ENOBUFS;
3960 if (chandef->punctured &&
3961 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
3962 return -ENOBUFS;
3963
3964 return 0;
3965 }
3966 EXPORT_SYMBOL(nl80211_send_chandef);
3967
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)3968 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3969 struct cfg80211_registered_device *rdev,
3970 struct wireless_dev *wdev,
3971 enum nl80211_commands cmd)
3972 {
3973 struct net_device *dev = wdev->netdev;
3974 void *hdr;
3975
3976 lockdep_assert_wiphy(&rdev->wiphy);
3977
3978 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3979 cmd != NL80211_CMD_DEL_INTERFACE &&
3980 cmd != NL80211_CMD_SET_INTERFACE);
3981
3982 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3983 if (!hdr)
3984 return -1;
3985
3986 if (dev &&
3987 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3988 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3989 goto nla_put_failure;
3990
3991 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3992 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3993 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3994 NL80211_ATTR_PAD) ||
3995 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3996 nla_put_u32(msg, NL80211_ATTR_GENERATION,
3997 rdev->devlist_generation ^
3998 (cfg80211_rdev_list_generation << 2)) ||
3999 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
4000 goto nla_put_failure;
4001
4002 if (rdev->ops->get_channel && !wdev->valid_links) {
4003 struct cfg80211_chan_def chandef = {};
4004 int ret;
4005
4006 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4007 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4008 goto nla_put_failure;
4009 }
4010
4011 if (rdev->ops->get_tx_power) {
4012 int dbm, ret;
4013
4014 ret = rdev_get_tx_power(rdev, wdev, &dbm);
4015 if (ret == 0 &&
4016 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4017 DBM_TO_MBM(dbm)))
4018 goto nla_put_failure;
4019 }
4020
4021 switch (wdev->iftype) {
4022 case NL80211_IFTYPE_AP:
4023 case NL80211_IFTYPE_P2P_GO:
4024 if (wdev->u.ap.ssid_len &&
4025 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4026 wdev->u.ap.ssid))
4027 goto nla_put_failure;
4028 break;
4029 case NL80211_IFTYPE_STATION:
4030 case NL80211_IFTYPE_P2P_CLIENT:
4031 if (wdev->u.client.ssid_len &&
4032 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4033 wdev->u.client.ssid))
4034 goto nla_put_failure;
4035 break;
4036 case NL80211_IFTYPE_ADHOC:
4037 if (wdev->u.ibss.ssid_len &&
4038 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4039 wdev->u.ibss.ssid))
4040 goto nla_put_failure;
4041 break;
4042 default:
4043 /* nothing */
4044 break;
4045 }
4046
4047 if (rdev->ops->get_txq_stats) {
4048 struct cfg80211_txq_stats txqstats = {};
4049 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4050
4051 if (ret == 0 &&
4052 !nl80211_put_txq_stats(msg, &txqstats,
4053 NL80211_ATTR_TXQ_STATS))
4054 goto nla_put_failure;
4055 }
4056
4057 if (wdev->valid_links) {
4058 unsigned int link_id;
4059 struct nlattr *links = nla_nest_start(msg,
4060 NL80211_ATTR_MLO_LINKS);
4061
4062 if (!links)
4063 goto nla_put_failure;
4064
4065 for_each_valid_link(wdev, link_id) {
4066 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4067 struct cfg80211_chan_def chandef = {};
4068 int ret;
4069
4070 if (!link)
4071 goto nla_put_failure;
4072
4073 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4074 goto nla_put_failure;
4075 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4076 wdev->links[link_id].addr))
4077 goto nla_put_failure;
4078
4079 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4080 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4081 goto nla_put_failure;
4082
4083 nla_nest_end(msg, link);
4084 }
4085
4086 nla_nest_end(msg, links);
4087 }
4088
4089 genlmsg_end(msg, hdr);
4090 return 0;
4091
4092 nla_put_failure:
4093 genlmsg_cancel(msg, hdr);
4094 return -EMSGSIZE;
4095 }
4096
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)4097 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4098 {
4099 int wp_idx = 0;
4100 int if_idx = 0;
4101 int wp_start = cb->args[0];
4102 int if_start = cb->args[1];
4103 int filter_wiphy = -1;
4104 struct cfg80211_registered_device *rdev;
4105 struct wireless_dev *wdev;
4106 int ret;
4107
4108 rtnl_lock();
4109 if (!cb->args[2]) {
4110 struct nl80211_dump_wiphy_state state = {
4111 .filter_wiphy = -1,
4112 };
4113
4114 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4115 if (ret)
4116 goto out_unlock;
4117
4118 filter_wiphy = state.filter_wiphy;
4119
4120 /*
4121 * if filtering, set cb->args[2] to +1 since 0 is the default
4122 * value needed to determine that parsing is necessary.
4123 */
4124 if (filter_wiphy >= 0)
4125 cb->args[2] = filter_wiphy + 1;
4126 else
4127 cb->args[2] = -1;
4128 } else if (cb->args[2] > 0) {
4129 filter_wiphy = cb->args[2] - 1;
4130 }
4131
4132 for_each_rdev(rdev) {
4133 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4134 continue;
4135 if (wp_idx < wp_start) {
4136 wp_idx++;
4137 continue;
4138 }
4139
4140 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4141 continue;
4142
4143 if_idx = 0;
4144
4145 wiphy_lock(&rdev->wiphy);
4146 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4147 if (if_idx < if_start) {
4148 if_idx++;
4149 continue;
4150 }
4151 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4152 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4153 rdev, wdev,
4154 NL80211_CMD_NEW_INTERFACE) < 0) {
4155 wiphy_unlock(&rdev->wiphy);
4156 goto out;
4157 }
4158 if_idx++;
4159 }
4160 wiphy_unlock(&rdev->wiphy);
4161
4162 if_start = 0;
4163 wp_idx++;
4164 }
4165 out:
4166 cb->args[0] = wp_idx;
4167 cb->args[1] = if_idx;
4168
4169 ret = skb->len;
4170 out_unlock:
4171 rtnl_unlock();
4172
4173 return ret;
4174 }
4175
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4176 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4177 {
4178 struct sk_buff *msg;
4179 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4180 struct wireless_dev *wdev = info->user_ptr[1];
4181
4182 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4183 if (!msg)
4184 return -ENOMEM;
4185
4186 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4187 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4188 nlmsg_free(msg);
4189 return -ENOBUFS;
4190 }
4191
4192 return genlmsg_reply(msg, info);
4193 }
4194
4195 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4196 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4197 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4198 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4199 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4200 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4201 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4202 };
4203
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4204 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4205 {
4206 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4207 int flag;
4208
4209 *mntrflags = 0;
4210
4211 if (!nla)
4212 return -EINVAL;
4213
4214 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4215 return -EINVAL;
4216
4217 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4218 if (flags[flag])
4219 *mntrflags |= (1<<flag);
4220
4221 *mntrflags |= MONITOR_FLAG_CHANGED;
4222
4223 return 0;
4224 }
4225
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4226 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4227 enum nl80211_iftype type,
4228 struct genl_info *info,
4229 struct vif_params *params)
4230 {
4231 bool change = false;
4232 int err;
4233
4234 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4235 if (type != NL80211_IFTYPE_MONITOR)
4236 return -EINVAL;
4237
4238 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4239 ¶ms->flags);
4240 if (err)
4241 return err;
4242
4243 change = true;
4244 }
4245
4246 if (params->flags & MONITOR_FLAG_ACTIVE &&
4247 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4248 return -EOPNOTSUPP;
4249
4250 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4251 const u8 *mumimo_groups;
4252 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4253
4254 if (type != NL80211_IFTYPE_MONITOR)
4255 return -EINVAL;
4256
4257 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4258 return -EOPNOTSUPP;
4259
4260 mumimo_groups =
4261 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4262
4263 /* bits 0 and 63 are reserved and must be zero */
4264 if ((mumimo_groups[0] & BIT(0)) ||
4265 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4266 return -EINVAL;
4267
4268 params->vht_mumimo_groups = mumimo_groups;
4269 change = true;
4270 }
4271
4272 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4273 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4274
4275 if (type != NL80211_IFTYPE_MONITOR)
4276 return -EINVAL;
4277
4278 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4279 return -EOPNOTSUPP;
4280
4281 params->vht_mumimo_follow_addr =
4282 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4283 change = true;
4284 }
4285
4286 return change ? 1 : 0;
4287 }
4288
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4289 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4290 struct net_device *netdev, u8 use_4addr,
4291 enum nl80211_iftype iftype)
4292 {
4293 if (!use_4addr) {
4294 if (netdev && netif_is_bridge_port(netdev))
4295 return -EBUSY;
4296 return 0;
4297 }
4298
4299 switch (iftype) {
4300 case NL80211_IFTYPE_AP_VLAN:
4301 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4302 return 0;
4303 break;
4304 case NL80211_IFTYPE_STATION:
4305 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4306 return 0;
4307 break;
4308 default:
4309 break;
4310 }
4311
4312 return -EOPNOTSUPP;
4313 }
4314
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4315 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4316 {
4317 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4318 struct vif_params params;
4319 int err;
4320 enum nl80211_iftype otype, ntype;
4321 struct net_device *dev = info->user_ptr[1];
4322 bool change = false;
4323
4324 memset(¶ms, 0, sizeof(params));
4325
4326 otype = ntype = dev->ieee80211_ptr->iftype;
4327
4328 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4329 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4330 if (otype != ntype)
4331 change = true;
4332 }
4333
4334 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4335 struct wireless_dev *wdev = dev->ieee80211_ptr;
4336
4337 if (ntype != NL80211_IFTYPE_MESH_POINT)
4338 return -EINVAL;
4339 if (otype != NL80211_IFTYPE_MESH_POINT)
4340 return -EINVAL;
4341 if (netif_running(dev))
4342 return -EBUSY;
4343
4344 wdev->u.mesh.id_up_len =
4345 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4346 memcpy(wdev->u.mesh.id,
4347 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4348 wdev->u.mesh.id_up_len);
4349 }
4350
4351 if (info->attrs[NL80211_ATTR_4ADDR]) {
4352 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4353 change = true;
4354 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4355 if (err)
4356 return err;
4357 } else {
4358 params.use_4addr = -1;
4359 }
4360
4361 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4362 if (err < 0)
4363 return err;
4364 if (err > 0)
4365 change = true;
4366
4367 if (change)
4368 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4369 else
4370 err = 0;
4371
4372 if (!err && params.use_4addr != -1)
4373 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4374
4375 if (change && !err) {
4376 struct wireless_dev *wdev = dev->ieee80211_ptr;
4377
4378 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4379 }
4380
4381 return err;
4382 }
4383
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4384 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4385 {
4386 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4387 struct vif_params params;
4388 struct wireless_dev *wdev;
4389 struct sk_buff *msg;
4390 int err;
4391 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4392
4393 memset(¶ms, 0, sizeof(params));
4394
4395 if (!info->attrs[NL80211_ATTR_IFNAME])
4396 return -EINVAL;
4397
4398 if (info->attrs[NL80211_ATTR_IFTYPE])
4399 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4400
4401 if (!rdev->ops->add_virtual_intf)
4402 return -EOPNOTSUPP;
4403
4404 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4405 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4406 info->attrs[NL80211_ATTR_MAC]) {
4407 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4408 ETH_ALEN);
4409 if (!is_valid_ether_addr(params.macaddr))
4410 return -EADDRNOTAVAIL;
4411 }
4412
4413 if (info->attrs[NL80211_ATTR_4ADDR]) {
4414 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4415 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4416 if (err)
4417 return err;
4418 }
4419
4420 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4421 return -EOPNOTSUPP;
4422
4423 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4424 if (err < 0)
4425 return err;
4426
4427 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4428 if (!msg)
4429 return -ENOMEM;
4430
4431 wdev = rdev_add_virtual_intf(rdev,
4432 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4433 NET_NAME_USER, type, ¶ms);
4434 if (WARN_ON(!wdev)) {
4435 nlmsg_free(msg);
4436 return -EPROTO;
4437 } else if (IS_ERR(wdev)) {
4438 nlmsg_free(msg);
4439 return PTR_ERR(wdev);
4440 }
4441
4442 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4443 wdev->owner_nlportid = info->snd_portid;
4444
4445 switch (type) {
4446 case NL80211_IFTYPE_MESH_POINT:
4447 if (!info->attrs[NL80211_ATTR_MESH_ID])
4448 break;
4449 wdev->u.mesh.id_up_len =
4450 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4451 memcpy(wdev->u.mesh.id,
4452 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4453 wdev->u.mesh.id_up_len);
4454 break;
4455 case NL80211_IFTYPE_NAN:
4456 case NL80211_IFTYPE_P2P_DEVICE:
4457 /*
4458 * P2P Device and NAN do not have a netdev, so don't go
4459 * through the netdev notifier and must be added here
4460 */
4461 cfg80211_init_wdev(wdev);
4462 cfg80211_register_wdev(rdev, wdev);
4463 break;
4464 default:
4465 break;
4466 }
4467
4468 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4469 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4470 nlmsg_free(msg);
4471 return -ENOBUFS;
4472 }
4473
4474 return genlmsg_reply(msg, info);
4475 }
4476
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4477 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4478 {
4479 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4480 int ret;
4481
4482 /* to avoid failing a new interface creation due to pending removal */
4483 cfg80211_destroy_ifaces(rdev);
4484
4485 wiphy_lock(&rdev->wiphy);
4486 ret = _nl80211_new_interface(skb, info);
4487 wiphy_unlock(&rdev->wiphy);
4488
4489 return ret;
4490 }
4491
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4492 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4493 {
4494 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4495 struct wireless_dev *wdev = info->user_ptr[1];
4496
4497 if (!rdev->ops->del_virtual_intf)
4498 return -EOPNOTSUPP;
4499
4500 /*
4501 * We hold RTNL, so this is safe, without RTNL opencount cannot
4502 * reach 0, and thus the rdev cannot be deleted.
4503 *
4504 * We need to do it for the dev_close(), since that will call
4505 * the netdev notifiers, and we need to acquire the mutex there
4506 * but don't know if we get there from here or from some other
4507 * place (e.g. "ip link set ... down").
4508 */
4509 mutex_unlock(&rdev->wiphy.mtx);
4510
4511 /*
4512 * If we remove a wireless device without a netdev then clear
4513 * user_ptr[1] so that nl80211_post_doit won't dereference it
4514 * to check if it needs to do dev_put(). Otherwise it crashes
4515 * since the wdev has been freed, unlike with a netdev where
4516 * we need the dev_put() for the netdev to really be freed.
4517 */
4518 if (!wdev->netdev)
4519 info->user_ptr[1] = NULL;
4520 else
4521 dev_close(wdev->netdev);
4522
4523 mutex_lock(&rdev->wiphy.mtx);
4524
4525 return cfg80211_remove_virtual_intf(rdev, wdev);
4526 }
4527
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4528 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4529 {
4530 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4531 struct net_device *dev = info->user_ptr[1];
4532 u16 noack_map;
4533
4534 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4535 return -EINVAL;
4536
4537 if (!rdev->ops->set_noack_map)
4538 return -EOPNOTSUPP;
4539
4540 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4541
4542 return rdev_set_noack_map(rdev, dev, noack_map);
4543 }
4544
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4545 static int nl80211_validate_key_link_id(struct genl_info *info,
4546 struct wireless_dev *wdev,
4547 int link_id, bool pairwise)
4548 {
4549 if (pairwise) {
4550 if (link_id != -1) {
4551 GENL_SET_ERR_MSG(info,
4552 "link ID not allowed for pairwise key");
4553 return -EINVAL;
4554 }
4555
4556 return 0;
4557 }
4558
4559 if (wdev->valid_links) {
4560 if (link_id == -1) {
4561 GENL_SET_ERR_MSG(info,
4562 "link ID must for MLO group key");
4563 return -EINVAL;
4564 }
4565 if (!(wdev->valid_links & BIT(link_id))) {
4566 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4567 return -EINVAL;
4568 }
4569 } else if (link_id != -1) {
4570 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4571 return -EINVAL;
4572 }
4573
4574 return 0;
4575 }
4576
4577 struct get_key_cookie {
4578 struct sk_buff *msg;
4579 int error;
4580 int idx;
4581 };
4582
get_key_callback(void * c,struct key_params * params)4583 static void get_key_callback(void *c, struct key_params *params)
4584 {
4585 struct nlattr *key;
4586 struct get_key_cookie *cookie = c;
4587
4588 if ((params->seq &&
4589 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4590 params->seq_len, params->seq)) ||
4591 (params->cipher &&
4592 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4593 params->cipher)))
4594 goto nla_put_failure;
4595
4596 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4597 if (!key)
4598 goto nla_put_failure;
4599
4600 if ((params->seq &&
4601 nla_put(cookie->msg, NL80211_KEY_SEQ,
4602 params->seq_len, params->seq)) ||
4603 (params->cipher &&
4604 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4605 params->cipher)))
4606 goto nla_put_failure;
4607
4608 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4609 goto nla_put_failure;
4610
4611 nla_nest_end(cookie->msg, key);
4612
4613 return;
4614 nla_put_failure:
4615 cookie->error = 1;
4616 }
4617
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4618 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4619 {
4620 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4621 int err;
4622 struct net_device *dev = info->user_ptr[1];
4623 u8 key_idx = 0;
4624 const u8 *mac_addr = NULL;
4625 bool pairwise;
4626 struct get_key_cookie cookie = {
4627 .error = 0,
4628 };
4629 void *hdr;
4630 struct sk_buff *msg;
4631 bool bigtk_support = false;
4632 int link_id = nl80211_link_id_or_invalid(info->attrs);
4633 struct wireless_dev *wdev = dev->ieee80211_ptr;
4634
4635 if (wiphy_ext_feature_isset(&rdev->wiphy,
4636 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4637 bigtk_support = true;
4638
4639 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4640 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4641 wiphy_ext_feature_isset(&rdev->wiphy,
4642 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4643 bigtk_support = true;
4644
4645 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4646 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4647
4648 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4649 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4650 return -EINVAL;
4651 }
4652 }
4653
4654 if (info->attrs[NL80211_ATTR_MAC])
4655 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4656
4657 pairwise = !!mac_addr;
4658 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4659 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4660
4661 if (kt != NL80211_KEYTYPE_GROUP &&
4662 kt != NL80211_KEYTYPE_PAIRWISE)
4663 return -EINVAL;
4664 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4665 }
4666
4667 if (!rdev->ops->get_key)
4668 return -EOPNOTSUPP;
4669
4670 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4671 return -ENOENT;
4672
4673 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4674 if (!msg)
4675 return -ENOMEM;
4676
4677 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4678 NL80211_CMD_NEW_KEY);
4679 if (!hdr)
4680 goto nla_put_failure;
4681
4682 cookie.msg = msg;
4683 cookie.idx = key_idx;
4684
4685 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4686 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4687 goto nla_put_failure;
4688 if (mac_addr &&
4689 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4690 goto nla_put_failure;
4691
4692 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4693 if (err)
4694 goto free_msg;
4695
4696 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4697 &cookie, get_key_callback);
4698
4699 if (err)
4700 goto free_msg;
4701
4702 if (cookie.error)
4703 goto nla_put_failure;
4704
4705 genlmsg_end(msg, hdr);
4706 return genlmsg_reply(msg, info);
4707
4708 nla_put_failure:
4709 err = -ENOBUFS;
4710 free_msg:
4711 nlmsg_free(msg);
4712 return err;
4713 }
4714
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4715 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4716 {
4717 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4718 struct key_parse key;
4719 int err;
4720 struct net_device *dev = info->user_ptr[1];
4721 int link_id = nl80211_link_id_or_invalid(info->attrs);
4722 struct wireless_dev *wdev = dev->ieee80211_ptr;
4723
4724 err = nl80211_parse_key(info, &key);
4725 if (err)
4726 return err;
4727
4728 if (key.idx < 0)
4729 return -EINVAL;
4730
4731 /* Only support setting default key and
4732 * Extended Key ID action NL80211_KEY_SET_TX.
4733 */
4734 if (!key.def && !key.defmgmt && !key.defbeacon &&
4735 !(key.p.mode == NL80211_KEY_SET_TX))
4736 return -EINVAL;
4737
4738 if (key.def) {
4739 if (!rdev->ops->set_default_key)
4740 return -EOPNOTSUPP;
4741
4742 err = nl80211_key_allowed(wdev);
4743 if (err)
4744 return err;
4745
4746 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4747 if (err)
4748 return err;
4749
4750 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4751 key.def_uni, key.def_multi);
4752
4753 if (err)
4754 return err;
4755
4756 #ifdef CONFIG_CFG80211_WEXT
4757 wdev->wext.default_key = key.idx;
4758 #endif
4759 return 0;
4760 } else if (key.defmgmt) {
4761 if (key.def_uni || !key.def_multi)
4762 return -EINVAL;
4763
4764 if (!rdev->ops->set_default_mgmt_key)
4765 return -EOPNOTSUPP;
4766
4767 err = nl80211_key_allowed(wdev);
4768 if (err)
4769 return err;
4770
4771 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4772 if (err)
4773 return err;
4774
4775 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4776 if (err)
4777 return err;
4778
4779 #ifdef CONFIG_CFG80211_WEXT
4780 wdev->wext.default_mgmt_key = key.idx;
4781 #endif
4782 return 0;
4783 } else if (key.defbeacon) {
4784 if (key.def_uni || !key.def_multi)
4785 return -EINVAL;
4786
4787 if (!rdev->ops->set_default_beacon_key)
4788 return -EOPNOTSUPP;
4789
4790 err = nl80211_key_allowed(wdev);
4791 if (err)
4792 return err;
4793
4794 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4795 if (err)
4796 return err;
4797
4798 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4799 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4800 wiphy_ext_feature_isset(&rdev->wiphy,
4801 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4802 u8 *mac_addr = NULL;
4803
4804 if (info->attrs[NL80211_ATTR_MAC])
4805 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4806
4807 if (!mac_addr || key.idx < 0 || key.idx > 1)
4808 return -EINVAL;
4809
4810 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4811 if (err)
4812 return err;
4813
4814 return rdev_add_key(rdev, dev, link_id, key.idx,
4815 NL80211_KEYTYPE_PAIRWISE,
4816 mac_addr, &key.p);
4817 }
4818
4819 return -EINVAL;
4820 }
4821
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)4822 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4823 {
4824 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4825 int err;
4826 struct net_device *dev = info->user_ptr[1];
4827 struct key_parse key;
4828 const u8 *mac_addr = NULL;
4829 int link_id = nl80211_link_id_or_invalid(info->attrs);
4830 struct wireless_dev *wdev = dev->ieee80211_ptr;
4831
4832 err = nl80211_parse_key(info, &key);
4833 if (err)
4834 return err;
4835
4836 if (!key.p.key) {
4837 GENL_SET_ERR_MSG(info, "no key");
4838 return -EINVAL;
4839 }
4840
4841 if (info->attrs[NL80211_ATTR_MAC])
4842 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4843
4844 if (key.type == -1) {
4845 if (mac_addr)
4846 key.type = NL80211_KEYTYPE_PAIRWISE;
4847 else
4848 key.type = NL80211_KEYTYPE_GROUP;
4849 }
4850
4851 /* for now */
4852 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4853 key.type != NL80211_KEYTYPE_GROUP) {
4854 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4855 return -EINVAL;
4856 }
4857
4858 if (key.type == NL80211_KEYTYPE_GROUP &&
4859 info->attrs[NL80211_ATTR_VLAN_ID])
4860 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4861
4862 if (!rdev->ops->add_key)
4863 return -EOPNOTSUPP;
4864
4865 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4866 key.type == NL80211_KEYTYPE_PAIRWISE,
4867 mac_addr)) {
4868 GENL_SET_ERR_MSG(info, "key setting validation failed");
4869 return -EINVAL;
4870 }
4871
4872 err = nl80211_key_allowed(wdev);
4873 if (err)
4874 GENL_SET_ERR_MSG(info, "key not allowed");
4875
4876 if (!err)
4877 err = nl80211_validate_key_link_id(info, wdev, link_id,
4878 key.type == NL80211_KEYTYPE_PAIRWISE);
4879
4880 if (!err) {
4881 err = rdev_add_key(rdev, dev, link_id, key.idx,
4882 key.type == NL80211_KEYTYPE_PAIRWISE,
4883 mac_addr, &key.p);
4884 if (err)
4885 GENL_SET_ERR_MSG(info, "key addition failed");
4886 }
4887
4888 return err;
4889 }
4890
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)4891 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4892 {
4893 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4894 int err;
4895 struct net_device *dev = info->user_ptr[1];
4896 u8 *mac_addr = NULL;
4897 struct key_parse key;
4898 int link_id = nl80211_link_id_or_invalid(info->attrs);
4899 struct wireless_dev *wdev = dev->ieee80211_ptr;
4900
4901 err = nl80211_parse_key(info, &key);
4902 if (err)
4903 return err;
4904
4905 if (info->attrs[NL80211_ATTR_MAC])
4906 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4907
4908 if (key.type == -1) {
4909 if (mac_addr)
4910 key.type = NL80211_KEYTYPE_PAIRWISE;
4911 else
4912 key.type = NL80211_KEYTYPE_GROUP;
4913 }
4914
4915 /* for now */
4916 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4917 key.type != NL80211_KEYTYPE_GROUP)
4918 return -EINVAL;
4919
4920 if (!cfg80211_valid_key_idx(rdev, key.idx,
4921 key.type == NL80211_KEYTYPE_PAIRWISE))
4922 return -EINVAL;
4923
4924 if (!rdev->ops->del_key)
4925 return -EOPNOTSUPP;
4926
4927 err = nl80211_key_allowed(wdev);
4928
4929 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4930 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4931 err = -ENOENT;
4932
4933 if (!err)
4934 err = nl80211_validate_key_link_id(info, wdev, link_id,
4935 key.type == NL80211_KEYTYPE_PAIRWISE);
4936
4937 if (!err)
4938 err = rdev_del_key(rdev, dev, link_id, key.idx,
4939 key.type == NL80211_KEYTYPE_PAIRWISE,
4940 mac_addr);
4941
4942 #ifdef CONFIG_CFG80211_WEXT
4943 if (!err) {
4944 if (key.idx == wdev->wext.default_key)
4945 wdev->wext.default_key = -1;
4946 else if (key.idx == wdev->wext.default_mgmt_key)
4947 wdev->wext.default_mgmt_key = -1;
4948 }
4949 #endif
4950
4951 return err;
4952 }
4953
4954 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)4955 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4956 {
4957 struct nlattr *attr;
4958 int n_entries = 0, tmp;
4959
4960 nla_for_each_nested(attr, nl_attr, tmp) {
4961 if (nla_len(attr) != ETH_ALEN)
4962 return -EINVAL;
4963
4964 n_entries++;
4965 }
4966
4967 return n_entries;
4968 }
4969
4970 /*
4971 * This function parses ACL information and allocates memory for ACL data.
4972 * On successful return, the calling function is responsible to free the
4973 * ACL buffer returned by this function.
4974 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)4975 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4976 struct genl_info *info)
4977 {
4978 enum nl80211_acl_policy acl_policy;
4979 struct nlattr *attr;
4980 struct cfg80211_acl_data *acl;
4981 int i = 0, n_entries, tmp;
4982
4983 if (!wiphy->max_acl_mac_addrs)
4984 return ERR_PTR(-EOPNOTSUPP);
4985
4986 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4987 return ERR_PTR(-EINVAL);
4988
4989 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4990 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4991 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4992 return ERR_PTR(-EINVAL);
4993
4994 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4995 return ERR_PTR(-EINVAL);
4996
4997 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4998 if (n_entries < 0)
4999 return ERR_PTR(n_entries);
5000
5001 if (n_entries > wiphy->max_acl_mac_addrs)
5002 return ERR_PTR(-EOPNOTSUPP);
5003
5004 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5005 if (!acl)
5006 return ERR_PTR(-ENOMEM);
5007 acl->n_acl_entries = n_entries;
5008
5009 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5010 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5011 i++;
5012 }
5013 acl->acl_policy = acl_policy;
5014
5015 return acl;
5016 }
5017
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)5018 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5019 {
5020 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5021 struct net_device *dev = info->user_ptr[1];
5022 struct cfg80211_acl_data *acl;
5023 int err;
5024
5025 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5026 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5027 return -EOPNOTSUPP;
5028
5029 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5030 return -EINVAL;
5031
5032 acl = parse_acl_data(&rdev->wiphy, info);
5033 if (IS_ERR(acl))
5034 return PTR_ERR(acl);
5035
5036 err = rdev_set_mac_acl(rdev, dev, acl);
5037
5038 kfree(acl);
5039
5040 return err;
5041 }
5042
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)5043 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5044 u8 *rates, u8 rates_len)
5045 {
5046 u8 i;
5047 u32 mask = 0;
5048
5049 for (i = 0; i < rates_len; i++) {
5050 int rate = (rates[i] & 0x7f) * 5;
5051 int ridx;
5052
5053 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5054 struct ieee80211_rate *srate =
5055 &sband->bitrates[ridx];
5056 if (rate == srate->bitrate) {
5057 mask |= 1 << ridx;
5058 break;
5059 }
5060 }
5061 if (ridx == sband->n_bitrates)
5062 return 0; /* rate not found */
5063 }
5064
5065 return mask;
5066 }
5067
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])5068 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5069 u8 *rates, u8 rates_len,
5070 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5071 {
5072 u8 i;
5073
5074 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5075
5076 for (i = 0; i < rates_len; i++) {
5077 int ridx, rbit;
5078
5079 ridx = rates[i] / 8;
5080 rbit = BIT(rates[i] % 8);
5081
5082 /* check validity */
5083 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5084 return false;
5085
5086 /* check availability */
5087 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5088 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5089 mcs[ridx] |= rbit;
5090 else
5091 return false;
5092 }
5093
5094 return true;
5095 }
5096
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)5097 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5098 {
5099 u16 mcs_mask = 0;
5100
5101 switch (vht_mcs_map) {
5102 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5103 break;
5104 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5105 mcs_mask = 0x00FF;
5106 break;
5107 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5108 mcs_mask = 0x01FF;
5109 break;
5110 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5111 mcs_mask = 0x03FF;
5112 break;
5113 default:
5114 break;
5115 }
5116
5117 return mcs_mask;
5118 }
5119
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5120 static void vht_build_mcs_mask(u16 vht_mcs_map,
5121 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5122 {
5123 u8 nss;
5124
5125 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5126 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5127 vht_mcs_map >>= 2;
5128 }
5129 }
5130
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5131 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5132 struct nl80211_txrate_vht *txrate,
5133 u16 mcs[NL80211_VHT_NSS_MAX])
5134 {
5135 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5136 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5137 u8 i;
5138
5139 if (!sband->vht_cap.vht_supported)
5140 return false;
5141
5142 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5143
5144 /* Build vht_mcs_mask from VHT capabilities */
5145 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5146
5147 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5148 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5149 mcs[i] = txrate->mcs[i];
5150 else
5151 return false;
5152 }
5153
5154 return true;
5155 }
5156
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5157 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5158 {
5159 switch (he_mcs_map) {
5160 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5161 return 0;
5162 case IEEE80211_HE_MCS_SUPPORT_0_7:
5163 return 0x00FF;
5164 case IEEE80211_HE_MCS_SUPPORT_0_9:
5165 return 0x03FF;
5166 case IEEE80211_HE_MCS_SUPPORT_0_11:
5167 return 0xFFF;
5168 default:
5169 break;
5170 }
5171 return 0;
5172 }
5173
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5174 static void he_build_mcs_mask(u16 he_mcs_map,
5175 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5176 {
5177 u8 nss;
5178
5179 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5180 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5181 he_mcs_map >>= 2;
5182 }
5183 }
5184
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5185 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5186 const struct ieee80211_sta_he_cap *he_cap)
5187 {
5188 struct net_device *dev = info->user_ptr[1];
5189 struct wireless_dev *wdev = dev->ieee80211_ptr;
5190 struct cfg80211_chan_def *chandef;
5191 __le16 tx_mcs;
5192
5193 chandef = wdev_chandef(wdev, link_id);
5194 if (!chandef) {
5195 /*
5196 * This is probably broken, but we never maintained
5197 * a chandef in these cases, so it always was.
5198 */
5199 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5200 }
5201
5202 switch (chandef->width) {
5203 case NL80211_CHAN_WIDTH_80P80:
5204 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5205 break;
5206 case NL80211_CHAN_WIDTH_160:
5207 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5208 break;
5209 default:
5210 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5211 break;
5212 }
5213
5214 return le16_to_cpu(tx_mcs);
5215 }
5216
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5217 static bool he_set_mcs_mask(struct genl_info *info,
5218 struct wireless_dev *wdev,
5219 struct ieee80211_supported_band *sband,
5220 struct nl80211_txrate_he *txrate,
5221 u16 mcs[NL80211_HE_NSS_MAX],
5222 unsigned int link_id)
5223 {
5224 const struct ieee80211_sta_he_cap *he_cap;
5225 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5226 u16 tx_mcs_map = 0;
5227 u8 i;
5228
5229 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5230 if (!he_cap)
5231 return false;
5232
5233 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5234
5235 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5236
5237 /* Build he_mcs_mask from HE capabilities */
5238 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5239
5240 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5241 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5242 mcs[i] = txrate->mcs[i];
5243 else
5244 return false;
5245 }
5246
5247 return true;
5248 }
5249
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5250 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5251 struct nlattr *attrs[],
5252 enum nl80211_attrs attr,
5253 struct cfg80211_bitrate_mask *mask,
5254 struct net_device *dev,
5255 bool default_all_enabled,
5256 unsigned int link_id)
5257 {
5258 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5259 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5260 struct wireless_dev *wdev = dev->ieee80211_ptr;
5261 int rem, i;
5262 struct nlattr *tx_rates;
5263 struct ieee80211_supported_band *sband;
5264 u16 vht_tx_mcs_map, he_tx_mcs_map;
5265
5266 memset(mask, 0, sizeof(*mask));
5267 /* Default to all rates enabled */
5268 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5269 const struct ieee80211_sta_he_cap *he_cap;
5270
5271 if (!default_all_enabled)
5272 break;
5273
5274 sband = rdev->wiphy.bands[i];
5275
5276 if (!sband)
5277 continue;
5278
5279 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5280 memcpy(mask->control[i].ht_mcs,
5281 sband->ht_cap.mcs.rx_mask,
5282 sizeof(mask->control[i].ht_mcs));
5283
5284 if (sband->vht_cap.vht_supported) {
5285 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5286 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5287 }
5288
5289 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5290 if (!he_cap)
5291 continue;
5292
5293 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5294 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5295
5296 mask->control[i].he_gi = 0xFF;
5297 mask->control[i].he_ltf = 0xFF;
5298 }
5299
5300 /* if no rates are given set it back to the defaults */
5301 if (!attrs[attr])
5302 goto out;
5303
5304 /* The nested attribute uses enum nl80211_band as the index. This maps
5305 * directly to the enum nl80211_band values used in cfg80211.
5306 */
5307 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5308 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5309 enum nl80211_band band = nla_type(tx_rates);
5310 int err;
5311
5312 if (band < 0 || band >= NUM_NL80211_BANDS)
5313 return -EINVAL;
5314 sband = rdev->wiphy.bands[band];
5315 if (sband == NULL)
5316 return -EINVAL;
5317 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5318 tx_rates,
5319 nl80211_txattr_policy,
5320 info->extack);
5321 if (err)
5322 return err;
5323 if (tb[NL80211_TXRATE_LEGACY]) {
5324 mask->control[band].legacy = rateset_to_mask(
5325 sband,
5326 nla_data(tb[NL80211_TXRATE_LEGACY]),
5327 nla_len(tb[NL80211_TXRATE_LEGACY]));
5328 if ((mask->control[band].legacy == 0) &&
5329 nla_len(tb[NL80211_TXRATE_LEGACY]))
5330 return -EINVAL;
5331 }
5332 if (tb[NL80211_TXRATE_HT]) {
5333 if (!ht_rateset_to_mask(
5334 sband,
5335 nla_data(tb[NL80211_TXRATE_HT]),
5336 nla_len(tb[NL80211_TXRATE_HT]),
5337 mask->control[band].ht_mcs))
5338 return -EINVAL;
5339 }
5340
5341 if (tb[NL80211_TXRATE_VHT]) {
5342 if (!vht_set_mcs_mask(
5343 sband,
5344 nla_data(tb[NL80211_TXRATE_VHT]),
5345 mask->control[band].vht_mcs))
5346 return -EINVAL;
5347 }
5348
5349 if (tb[NL80211_TXRATE_GI]) {
5350 mask->control[band].gi =
5351 nla_get_u8(tb[NL80211_TXRATE_GI]);
5352 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5353 return -EINVAL;
5354 }
5355 if (tb[NL80211_TXRATE_HE] &&
5356 !he_set_mcs_mask(info, wdev, sband,
5357 nla_data(tb[NL80211_TXRATE_HE]),
5358 mask->control[band].he_mcs,
5359 link_id))
5360 return -EINVAL;
5361
5362 if (tb[NL80211_TXRATE_HE_GI])
5363 mask->control[band].he_gi =
5364 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5365 if (tb[NL80211_TXRATE_HE_LTF])
5366 mask->control[band].he_ltf =
5367 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5368
5369 if (mask->control[band].legacy == 0) {
5370 /* don't allow empty legacy rates if HT, VHT or HE
5371 * are not even supported.
5372 */
5373 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5374 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5375 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5376 return -EINVAL;
5377
5378 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5379 if (mask->control[band].ht_mcs[i])
5380 goto out;
5381
5382 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5383 if (mask->control[band].vht_mcs[i])
5384 goto out;
5385
5386 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5387 if (mask->control[band].he_mcs[i])
5388 goto out;
5389
5390 /* legacy and mcs rates may not be both empty */
5391 return -EINVAL;
5392 }
5393 }
5394
5395 out:
5396 return 0;
5397 }
5398
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5399 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5400 enum nl80211_band band,
5401 struct cfg80211_bitrate_mask *beacon_rate)
5402 {
5403 u32 count_ht, count_vht, count_he, i;
5404 u32 rate = beacon_rate->control[band].legacy;
5405
5406 /* Allow only one rate */
5407 if (hweight32(rate) > 1)
5408 return -EINVAL;
5409
5410 count_ht = 0;
5411 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5412 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5413 return -EINVAL;
5414 } else if (beacon_rate->control[band].ht_mcs[i]) {
5415 count_ht++;
5416 if (count_ht > 1)
5417 return -EINVAL;
5418 }
5419 if (count_ht && rate)
5420 return -EINVAL;
5421 }
5422
5423 count_vht = 0;
5424 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5425 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5426 return -EINVAL;
5427 } else if (beacon_rate->control[band].vht_mcs[i]) {
5428 count_vht++;
5429 if (count_vht > 1)
5430 return -EINVAL;
5431 }
5432 if (count_vht && rate)
5433 return -EINVAL;
5434 }
5435
5436 count_he = 0;
5437 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5438 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5439 return -EINVAL;
5440 } else if (beacon_rate->control[band].he_mcs[i]) {
5441 count_he++;
5442 if (count_he > 1)
5443 return -EINVAL;
5444 }
5445 if (count_he && rate)
5446 return -EINVAL;
5447 }
5448
5449 if ((count_ht && count_vht && count_he) ||
5450 (!rate && !count_ht && !count_vht && !count_he))
5451 return -EINVAL;
5452
5453 if (rate &&
5454 !wiphy_ext_feature_isset(&rdev->wiphy,
5455 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5456 return -EINVAL;
5457 if (count_ht &&
5458 !wiphy_ext_feature_isset(&rdev->wiphy,
5459 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5460 return -EINVAL;
5461 if (count_vht &&
5462 !wiphy_ext_feature_isset(&rdev->wiphy,
5463 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5464 return -EINVAL;
5465 if (count_he &&
5466 !wiphy_ext_feature_isset(&rdev->wiphy,
5467 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5468 return -EINVAL;
5469
5470 return 0;
5471 }
5472
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5473 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5474 struct net_device *dev,
5475 struct nlattr *attrs,
5476 struct cfg80211_mbssid_config *config,
5477 u8 num_elems)
5478 {
5479 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5480
5481 if (!wiphy->mbssid_max_interfaces)
5482 return -EOPNOTSUPP;
5483
5484 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5485 NULL) ||
5486 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5487 return -EINVAL;
5488
5489 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5490 if (config->ema) {
5491 if (!wiphy->ema_max_profile_periodicity)
5492 return -EOPNOTSUPP;
5493
5494 if (num_elems > wiphy->ema_max_profile_periodicity)
5495 return -EINVAL;
5496 }
5497
5498 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5499 if (config->index >= wiphy->mbssid_max_interfaces ||
5500 (!config->index && !num_elems))
5501 return -EINVAL;
5502
5503 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5504 u32 tx_ifindex =
5505 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5506
5507 if ((!config->index && tx_ifindex != dev->ifindex) ||
5508 (config->index && tx_ifindex == dev->ifindex))
5509 return -EINVAL;
5510
5511 if (tx_ifindex != dev->ifindex) {
5512 struct net_device *tx_netdev =
5513 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5514
5515 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5516 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5517 tx_netdev->ieee80211_ptr->iftype !=
5518 NL80211_IFTYPE_AP) {
5519 dev_put(tx_netdev);
5520 return -EINVAL;
5521 }
5522
5523 config->tx_wdev = tx_netdev->ieee80211_ptr;
5524 } else {
5525 config->tx_wdev = dev->ieee80211_ptr;
5526 }
5527 } else if (!config->index) {
5528 config->tx_wdev = dev->ieee80211_ptr;
5529 } else {
5530 return -EINVAL;
5531 }
5532
5533 return 0;
5534 }
5535
5536 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)5537 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5538 {
5539 struct nlattr *nl_elems;
5540 struct cfg80211_mbssid_elems *elems;
5541 int rem_elems;
5542 u8 i = 0, num_elems = 0;
5543
5544 if (!wiphy->mbssid_max_interfaces)
5545 return ERR_PTR(-EINVAL);
5546
5547 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5548 if (num_elems >= 255)
5549 return ERR_PTR(-EINVAL);
5550 num_elems++;
5551 }
5552
5553 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5554 if (!elems)
5555 return ERR_PTR(-ENOMEM);
5556 elems->cnt = num_elems;
5557
5558 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5559 elems->elem[i].data = nla_data(nl_elems);
5560 elems->elem[i].len = nla_len(nl_elems);
5561 i++;
5562 }
5563 return elems;
5564 }
5565
5566 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)5567 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5568 struct netlink_ext_ack *extack)
5569 {
5570 struct nlattr *nl_elems;
5571 struct cfg80211_rnr_elems *elems;
5572 int rem_elems;
5573 u8 i = 0, num_elems = 0;
5574
5575 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5576 int ret;
5577
5578 ret = validate_ie_attr(nl_elems, extack);
5579 if (ret)
5580 return ERR_PTR(ret);
5581
5582 num_elems++;
5583 }
5584
5585 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5586 if (!elems)
5587 return ERR_PTR(-ENOMEM);
5588 elems->cnt = num_elems;
5589
5590 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5591 elems->elem[i].data = nla_data(nl_elems);
5592 elems->elem[i].len = nla_len(nl_elems);
5593 i++;
5594 }
5595 return elems;
5596 }
5597
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)5598 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5599 struct cfg80211_he_bss_color *he_bss_color)
5600 {
5601 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5602 int err;
5603
5604 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5605 he_bss_color_policy, NULL);
5606 if (err)
5607 return err;
5608
5609 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5610 return -EINVAL;
5611
5612 he_bss_color->color =
5613 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5614 he_bss_color->enabled =
5615 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5616 he_bss_color->partial =
5617 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5618
5619 return 0;
5620 }
5621
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)5622 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5623 struct nlattr *attrs[],
5624 struct cfg80211_beacon_data *bcn,
5625 struct netlink_ext_ack *extack)
5626 {
5627 bool haveinfo = false;
5628 int err;
5629
5630 memset(bcn, 0, sizeof(*bcn));
5631
5632 bcn->link_id = nl80211_link_id(attrs);
5633
5634 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5635 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5636 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5637 if (!bcn->head_len)
5638 return -EINVAL;
5639 haveinfo = true;
5640 }
5641
5642 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5643 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5644 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5645 haveinfo = true;
5646 }
5647
5648 if (!haveinfo)
5649 return -EINVAL;
5650
5651 if (attrs[NL80211_ATTR_IE]) {
5652 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5653 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5654 }
5655
5656 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5657 bcn->proberesp_ies =
5658 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5659 bcn->proberesp_ies_len =
5660 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5661 }
5662
5663 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5664 bcn->assocresp_ies =
5665 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5666 bcn->assocresp_ies_len =
5667 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5668 }
5669
5670 if (attrs[NL80211_ATTR_PROBE_RESP]) {
5671 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5672 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5673 }
5674
5675 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5676 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5677
5678 err = nla_parse_nested_deprecated(tb,
5679 NL80211_FTM_RESP_ATTR_MAX,
5680 attrs[NL80211_ATTR_FTM_RESPONDER],
5681 NULL, NULL);
5682 if (err)
5683 return err;
5684
5685 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5686 wiphy_ext_feature_isset(&rdev->wiphy,
5687 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5688 bcn->ftm_responder = 1;
5689 else
5690 return -EOPNOTSUPP;
5691
5692 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5693 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5694 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5695 }
5696
5697 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5698 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5699 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5700 }
5701 } else {
5702 bcn->ftm_responder = -1;
5703 }
5704
5705 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5706 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5707 &bcn->he_bss_color);
5708 if (err)
5709 return err;
5710 bcn->he_bss_color_valid = true;
5711 }
5712
5713 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5714 struct cfg80211_mbssid_elems *mbssid =
5715 nl80211_parse_mbssid_elems(&rdev->wiphy,
5716 attrs[NL80211_ATTR_MBSSID_ELEMS]);
5717
5718 if (IS_ERR(mbssid))
5719 return PTR_ERR(mbssid);
5720
5721 bcn->mbssid_ies = mbssid;
5722
5723 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5724 struct cfg80211_rnr_elems *rnr =
5725 nl80211_parse_rnr_elems(&rdev->wiphy,
5726 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5727 extack);
5728
5729 if (IS_ERR(rnr))
5730 return PTR_ERR(rnr);
5731
5732 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5733 return -EINVAL;
5734
5735 bcn->rnr_ies = rnr;
5736 }
5737 }
5738
5739 return 0;
5740 }
5741
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)5742 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5743 struct ieee80211_he_obss_pd *he_obss_pd)
5744 {
5745 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5746 int err;
5747
5748 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5749 he_obss_pd_policy, NULL);
5750 if (err)
5751 return err;
5752
5753 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5754 return -EINVAL;
5755
5756 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5757
5758 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5759 he_obss_pd->min_offset =
5760 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5761 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5762 he_obss_pd->max_offset =
5763 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5764 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5765 he_obss_pd->non_srg_max_offset =
5766 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5767
5768 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5769 return -EINVAL;
5770
5771 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5772 memcpy(he_obss_pd->bss_color_bitmap,
5773 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5774 sizeof(he_obss_pd->bss_color_bitmap));
5775
5776 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5777 memcpy(he_obss_pd->partial_bssid_bitmap,
5778 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5779 sizeof(he_obss_pd->partial_bssid_bitmap));
5780
5781 he_obss_pd->enable = true;
5782
5783 return 0;
5784 }
5785
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_fils_discovery * fd)5786 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5787 struct nlattr *attrs,
5788 struct cfg80211_fils_discovery *fd)
5789 {
5790 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5791 int ret;
5792
5793 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5794 NL80211_EXT_FEATURE_FILS_DISCOVERY))
5795 return -EINVAL;
5796
5797 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5798 NULL, NULL);
5799 if (ret)
5800 return ret;
5801
5802 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
5803 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
5804 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
5805 fd->update = true;
5806 return 0;
5807 }
5808
5809 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5810 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5811 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5812 return -EINVAL;
5813
5814 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5815 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5816 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5817 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5818 fd->update = true;
5819 return 0;
5820 }
5821
5822 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_unsol_bcast_probe_resp * presp)5823 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5824 struct nlattr *attrs,
5825 struct cfg80211_unsol_bcast_probe_resp *presp)
5826 {
5827 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5828 int ret;
5829
5830 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5831 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5832 return -EINVAL;
5833
5834 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5835 attrs, NULL, NULL);
5836 if (ret)
5837 return ret;
5838
5839 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
5840 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
5841 presp->update = true;
5842 return 0;
5843 }
5844
5845 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5846 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5847 return -EINVAL;
5848
5849 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5850 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5851 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5852 presp->update = true;
5853 return 0;
5854 }
5855
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)5856 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5857 const struct element *rates)
5858 {
5859 int i;
5860
5861 if (!rates)
5862 return;
5863
5864 for (i = 0; i < rates->datalen; i++) {
5865 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5866 params->ht_required = true;
5867 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5868 params->vht_required = true;
5869 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5870 params->he_required = true;
5871 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5872 params->sae_h2e_required = true;
5873 }
5874 }
5875
5876 /*
5877 * Since the nl80211 API didn't include, from the beginning, attributes about
5878 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5879 * benefit of drivers that rebuild IEs in the firmware.
5880 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)5881 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5882 {
5883 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
5884 size_t ies_len = bcn->tail_len;
5885 const u8 *ies = bcn->tail;
5886 const struct element *rates;
5887 const struct element *cap;
5888
5889 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5890 nl80211_check_ap_rate_selectors(params, rates);
5891
5892 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5893 nl80211_check_ap_rate_selectors(params, rates);
5894
5895 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5896 if (cap && cap->datalen >= sizeof(*params->ht_cap))
5897 params->ht_cap = (void *)cap->data;
5898 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5899 if (cap && cap->datalen >= sizeof(*params->vht_cap))
5900 params->vht_cap = (void *)cap->data;
5901 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5902 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5903 params->he_cap = (void *)(cap->data + 1);
5904 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5905 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5906 params->he_oper = (void *)(cap->data + 1);
5907 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5908 if (cap) {
5909 if (!cap->datalen)
5910 return -EINVAL;
5911 params->eht_cap = (void *)(cap->data + 1);
5912 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5913 (const u8 *)params->eht_cap,
5914 cap->datalen - 1, true))
5915 return -EINVAL;
5916 }
5917 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5918 if (cap) {
5919 if (!cap->datalen)
5920 return -EINVAL;
5921 params->eht_oper = (void *)(cap->data + 1);
5922 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5923 cap->datalen - 1))
5924 return -EINVAL;
5925 }
5926 return 0;
5927 }
5928
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)5929 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5930 struct cfg80211_ap_settings *params)
5931 {
5932 struct wireless_dev *wdev;
5933
5934 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5935 if (wdev->iftype != NL80211_IFTYPE_AP &&
5936 wdev->iftype != NL80211_IFTYPE_P2P_GO)
5937 continue;
5938
5939 if (!wdev->u.ap.preset_chandef.chan)
5940 continue;
5941
5942 params->chandef = wdev->u.ap.preset_chandef;
5943 return true;
5944 }
5945
5946 return false;
5947 }
5948
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)5949 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5950 enum nl80211_auth_type auth_type,
5951 enum nl80211_commands cmd)
5952 {
5953 if (auth_type > NL80211_AUTHTYPE_MAX)
5954 return false;
5955
5956 switch (cmd) {
5957 case NL80211_CMD_AUTHENTICATE:
5958 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5959 auth_type == NL80211_AUTHTYPE_SAE)
5960 return false;
5961 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5962 NL80211_EXT_FEATURE_FILS_STA) &&
5963 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5964 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5965 auth_type == NL80211_AUTHTYPE_FILS_PK))
5966 return false;
5967 return true;
5968 case NL80211_CMD_CONNECT:
5969 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5970 !wiphy_ext_feature_isset(&rdev->wiphy,
5971 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5972 auth_type == NL80211_AUTHTYPE_SAE)
5973 return false;
5974
5975 /* FILS with SK PFS or PK not supported yet */
5976 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5977 auth_type == NL80211_AUTHTYPE_FILS_PK)
5978 return false;
5979 if (!wiphy_ext_feature_isset(
5980 &rdev->wiphy,
5981 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5982 auth_type == NL80211_AUTHTYPE_FILS_SK)
5983 return false;
5984 return true;
5985 case NL80211_CMD_START_AP:
5986 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5987 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5988 auth_type == NL80211_AUTHTYPE_SAE)
5989 return false;
5990 /* FILS not supported yet */
5991 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5992 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5993 auth_type == NL80211_AUTHTYPE_FILS_PK)
5994 return false;
5995 return true;
5996 default:
5997 return false;
5998 }
5999 }
6000
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)6001 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6002 unsigned int link_id)
6003 {
6004 struct wiphy *wiphy = wdev->wiphy;
6005 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6006 struct sk_buff *msg;
6007 void *hdr;
6008
6009 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6010 if (!msg)
6011 return;
6012
6013 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6014 if (!hdr)
6015 goto out;
6016
6017 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6018 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6019 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6020 NL80211_ATTR_PAD) ||
6021 (wdev->u.ap.ssid_len &&
6022 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6023 wdev->u.ap.ssid)) ||
6024 (wdev->valid_links &&
6025 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6026 goto out;
6027
6028 genlmsg_end(msg, hdr);
6029
6030 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6031 NL80211_MCGRP_MLME, GFP_KERNEL);
6032 return;
6033 out:
6034 nlmsg_free(msg);
6035 }
6036
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)6037 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6038 {
6039 struct ieee80211_channel *channel = params->chandef.chan;
6040
6041 if ((params->he_cap || params->he_oper) &&
6042 (channel->flags & IEEE80211_CHAN_NO_HE))
6043 return -EOPNOTSUPP;
6044
6045 if ((params->eht_cap || params->eht_oper) &&
6046 (channel->flags & IEEE80211_CHAN_NO_EHT))
6047 return -EOPNOTSUPP;
6048
6049 return 0;
6050 }
6051
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)6052 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6053 {
6054 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6055 struct cfg80211_beaconing_check_config beacon_check = {};
6056 unsigned int link_id = nl80211_link_id(info->attrs);
6057 struct net_device *dev = info->user_ptr[1];
6058 struct wireless_dev *wdev = dev->ieee80211_ptr;
6059 struct cfg80211_ap_settings *params;
6060 int err;
6061
6062 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6063 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6064 return -EOPNOTSUPP;
6065
6066 if (!rdev->ops->start_ap)
6067 return -EOPNOTSUPP;
6068
6069 if (wdev->links[link_id].cac_started)
6070 return -EBUSY;
6071
6072 if (wdev->links[link_id].ap.beacon_interval)
6073 return -EALREADY;
6074
6075 /* these are required for START_AP */
6076 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6077 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6078 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6079 return -EINVAL;
6080
6081 params = kzalloc(sizeof(*params), GFP_KERNEL);
6082 if (!params)
6083 return -ENOMEM;
6084
6085 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6086 info->extack);
6087 if (err)
6088 goto out;
6089
6090 params->beacon_interval =
6091 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6092 params->dtim_period =
6093 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6094
6095 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6096 params->beacon_interval);
6097 if (err)
6098 goto out;
6099
6100 /*
6101 * In theory, some of these attributes should be required here
6102 * but since they were not used when the command was originally
6103 * added, keep them optional for old user space programs to let
6104 * them continue to work with drivers that do not need the
6105 * additional information -- drivers must check!
6106 */
6107 if (info->attrs[NL80211_ATTR_SSID]) {
6108 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6109 params->ssid_len =
6110 nla_len(info->attrs[NL80211_ATTR_SSID]);
6111 if (params->ssid_len == 0) {
6112 err = -EINVAL;
6113 goto out;
6114 }
6115
6116 if (wdev->u.ap.ssid_len &&
6117 (wdev->u.ap.ssid_len != params->ssid_len ||
6118 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6119 /* require identical SSID for MLO */
6120 err = -EINVAL;
6121 goto out;
6122 }
6123 } else if (wdev->valid_links) {
6124 /* require SSID for MLO */
6125 err = -EINVAL;
6126 goto out;
6127 }
6128
6129 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6130 params->hidden_ssid = nla_get_u32(
6131 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6132
6133 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6134
6135 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6136 params->auth_type = nla_get_u32(
6137 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6138 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6139 NL80211_CMD_START_AP)) {
6140 err = -EINVAL;
6141 goto out;
6142 }
6143 } else
6144 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6145
6146 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6147 NL80211_MAX_NR_CIPHER_SUITES);
6148 if (err)
6149 goto out;
6150
6151 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6152 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6153 err = -EOPNOTSUPP;
6154 goto out;
6155 }
6156 params->inactivity_timeout = nla_get_u16(
6157 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6158 }
6159
6160 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6161 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6162 err = -EINVAL;
6163 goto out;
6164 }
6165 params->p2p_ctwindow =
6166 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6167 if (params->p2p_ctwindow != 0 &&
6168 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6169 err = -EINVAL;
6170 goto out;
6171 }
6172 }
6173
6174 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6175 u8 tmp;
6176
6177 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6178 err = -EINVAL;
6179 goto out;
6180 }
6181 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6182 params->p2p_opp_ps = tmp;
6183 if (params->p2p_opp_ps != 0 &&
6184 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6185 err = -EINVAL;
6186 goto out;
6187 }
6188 }
6189
6190 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6191 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6192 if (err)
6193 goto out;
6194 } else if (wdev->valid_links) {
6195 /* with MLD need to specify the channel configuration */
6196 err = -EINVAL;
6197 goto out;
6198 } else if (wdev->u.ap.preset_chandef.chan) {
6199 params->chandef = wdev->u.ap.preset_chandef;
6200 } else if (!nl80211_get_ap_channel(rdev, params)) {
6201 err = -EINVAL;
6202 goto out;
6203 }
6204
6205 beacon_check.iftype = wdev->iftype;
6206 beacon_check.relax = true;
6207 beacon_check.reg_power =
6208 cfg80211_get_6ghz_power_type(params->beacon.tail,
6209 params->beacon.tail_len);
6210 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, ¶ms->chandef,
6211 &beacon_check)) {
6212 err = -EINVAL;
6213 goto out;
6214 }
6215
6216 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6217 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6218 NL80211_ATTR_TX_RATES,
6219 ¶ms->beacon_rate,
6220 dev, false, link_id);
6221 if (err)
6222 goto out;
6223
6224 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6225 ¶ms->beacon_rate);
6226 if (err)
6227 goto out;
6228 }
6229
6230 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6231 params->smps_mode =
6232 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6233 switch (params->smps_mode) {
6234 case NL80211_SMPS_OFF:
6235 break;
6236 case NL80211_SMPS_STATIC:
6237 if (!(rdev->wiphy.features &
6238 NL80211_FEATURE_STATIC_SMPS)) {
6239 err = -EINVAL;
6240 goto out;
6241 }
6242 break;
6243 case NL80211_SMPS_DYNAMIC:
6244 if (!(rdev->wiphy.features &
6245 NL80211_FEATURE_DYNAMIC_SMPS)) {
6246 err = -EINVAL;
6247 goto out;
6248 }
6249 break;
6250 default:
6251 err = -EINVAL;
6252 goto out;
6253 }
6254 } else {
6255 params->smps_mode = NL80211_SMPS_OFF;
6256 }
6257
6258 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6259 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6260 err = -EOPNOTSUPP;
6261 goto out;
6262 }
6263
6264 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6265 params->acl = parse_acl_data(&rdev->wiphy, info);
6266 if (IS_ERR(params->acl)) {
6267 err = PTR_ERR(params->acl);
6268 params->acl = NULL;
6269 goto out;
6270 }
6271 }
6272
6273 params->twt_responder =
6274 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6275
6276 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6277 err = nl80211_parse_he_obss_pd(
6278 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6279 ¶ms->he_obss_pd);
6280 if (err)
6281 goto out;
6282 }
6283
6284 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6285 err = nl80211_parse_fils_discovery(rdev,
6286 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6287 ¶ms->fils_discovery);
6288 if (err)
6289 goto out;
6290 }
6291
6292 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6293 err = nl80211_parse_unsol_bcast_probe_resp(
6294 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6295 ¶ms->unsol_bcast_probe_resp);
6296 if (err)
6297 goto out;
6298 }
6299
6300 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6301 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6302 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6303 ¶ms->mbssid_config,
6304 params->beacon.mbssid_ies ?
6305 params->beacon.mbssid_ies->cnt :
6306 0);
6307 if (err)
6308 goto out;
6309 }
6310
6311 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6312 err = -EINVAL;
6313 goto out;
6314 }
6315
6316 err = nl80211_calculate_ap_params(params);
6317 if (err)
6318 goto out;
6319
6320 err = nl80211_validate_ap_phy_operation(params);
6321 if (err)
6322 goto out;
6323
6324 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6325 params->flags = nla_get_u32(
6326 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6327 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6328 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6329
6330 if (wdev->conn_owner_nlportid &&
6331 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6332 wdev->conn_owner_nlportid != info->snd_portid) {
6333 err = -EINVAL;
6334 goto out;
6335 }
6336
6337 /* FIXME: validate MLO/link-id against driver capabilities */
6338
6339 err = rdev_start_ap(rdev, dev, params);
6340 if (!err) {
6341 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6342 wdev->links[link_id].ap.chandef = params->chandef;
6343 wdev->u.ap.ssid_len = params->ssid_len;
6344 memcpy(wdev->u.ap.ssid, params->ssid,
6345 params->ssid_len);
6346
6347 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6348 wdev->conn_owner_nlportid = info->snd_portid;
6349
6350 nl80211_send_ap_started(wdev, link_id);
6351 }
6352 out:
6353 kfree(params->acl);
6354 kfree(params->beacon.mbssid_ies);
6355 if (params->mbssid_config.tx_wdev &&
6356 params->mbssid_config.tx_wdev->netdev &&
6357 params->mbssid_config.tx_wdev->netdev != dev)
6358 dev_put(params->mbssid_config.tx_wdev->netdev);
6359 kfree(params->beacon.rnr_ies);
6360 kfree(params);
6361
6362 return err;
6363 }
6364
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6365 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6366 {
6367 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6368 struct cfg80211_beaconing_check_config beacon_check = {};
6369 unsigned int link_id = nl80211_link_id(info->attrs);
6370 struct net_device *dev = info->user_ptr[1];
6371 struct wireless_dev *wdev = dev->ieee80211_ptr;
6372 struct cfg80211_ap_update *params;
6373 struct nlattr *attr;
6374 int err;
6375
6376 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6377 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6378 return -EOPNOTSUPP;
6379
6380 if (!rdev->ops->change_beacon)
6381 return -EOPNOTSUPP;
6382
6383 if (!wdev->links[link_id].ap.beacon_interval)
6384 return -EINVAL;
6385
6386 params = kzalloc(sizeof(*params), GFP_KERNEL);
6387 if (!params)
6388 return -ENOMEM;
6389
6390 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6391 info->extack);
6392 if (err)
6393 goto out;
6394
6395 /* recheck beaconing is permitted with possibly changed power type */
6396 beacon_check.iftype = wdev->iftype;
6397 beacon_check.relax = true;
6398 beacon_check.reg_power =
6399 cfg80211_get_6ghz_power_type(params->beacon.tail,
6400 params->beacon.tail_len);
6401 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6402 &wdev->links[link_id].ap.chandef,
6403 &beacon_check)) {
6404 err = -EINVAL;
6405 goto out;
6406 }
6407
6408 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6409 if (attr) {
6410 err = nl80211_parse_fils_discovery(rdev, attr,
6411 ¶ms->fils_discovery);
6412 if (err)
6413 goto out;
6414 }
6415
6416 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6417 if (attr) {
6418 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6419 ¶ms->unsol_bcast_probe_resp);
6420 if (err)
6421 goto out;
6422 }
6423
6424 err = rdev_change_beacon(rdev, dev, params);
6425
6426 out:
6427 kfree(params->beacon.mbssid_ies);
6428 kfree(params->beacon.rnr_ies);
6429 kfree(params);
6430 return err;
6431 }
6432
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6433 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6434 {
6435 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6436 unsigned int link_id = nl80211_link_id(info->attrs);
6437 struct net_device *dev = info->user_ptr[1];
6438
6439 return cfg80211_stop_ap(rdev, dev, link_id, false);
6440 }
6441
6442 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6443 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6444 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6445 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6446 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6447 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6448 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6449 };
6450
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6451 static int parse_station_flags(struct genl_info *info,
6452 enum nl80211_iftype iftype,
6453 struct station_parameters *params)
6454 {
6455 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6456 struct nlattr *nla;
6457 int flag;
6458
6459 /*
6460 * Try parsing the new attribute first so userspace
6461 * can specify both for older kernels.
6462 */
6463 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6464 if (nla) {
6465 struct nl80211_sta_flag_update *sta_flags;
6466
6467 sta_flags = nla_data(nla);
6468 params->sta_flags_mask = sta_flags->mask;
6469 params->sta_flags_set = sta_flags->set;
6470 params->sta_flags_set &= params->sta_flags_mask;
6471 if ((params->sta_flags_mask |
6472 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6473 return -EINVAL;
6474 return 0;
6475 }
6476
6477 /* if present, parse the old attribute */
6478
6479 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6480 if (!nla)
6481 return 0;
6482
6483 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6484 return -EINVAL;
6485
6486 /*
6487 * Only allow certain flags for interface types so that
6488 * other attributes are silently ignored. Remember that
6489 * this is backward compatibility code with old userspace
6490 * and shouldn't be hit in other cases anyway.
6491 */
6492 switch (iftype) {
6493 case NL80211_IFTYPE_AP:
6494 case NL80211_IFTYPE_AP_VLAN:
6495 case NL80211_IFTYPE_P2P_GO:
6496 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6497 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6498 BIT(NL80211_STA_FLAG_WME) |
6499 BIT(NL80211_STA_FLAG_MFP);
6500 break;
6501 case NL80211_IFTYPE_P2P_CLIENT:
6502 case NL80211_IFTYPE_STATION:
6503 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6504 BIT(NL80211_STA_FLAG_TDLS_PEER);
6505 break;
6506 case NL80211_IFTYPE_MESH_POINT:
6507 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6508 BIT(NL80211_STA_FLAG_MFP) |
6509 BIT(NL80211_STA_FLAG_AUTHORIZED);
6510 break;
6511 default:
6512 return -EINVAL;
6513 }
6514
6515 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6516 if (flags[flag]) {
6517 params->sta_flags_set |= (1<<flag);
6518
6519 /* no longer support new API additions in old API */
6520 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6521 return -EINVAL;
6522 }
6523 }
6524
6525 return 0;
6526 }
6527
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)6528 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6529 {
6530 struct nlattr *rate;
6531 u32 bitrate;
6532 u16 bitrate_compat;
6533 enum nl80211_rate_info rate_flg;
6534
6535 rate = nla_nest_start_noflag(msg, attr);
6536 if (!rate)
6537 return false;
6538
6539 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6540 bitrate = cfg80211_calculate_bitrate(info);
6541 /* report 16-bit bitrate only if we can */
6542 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6543 if (bitrate > 0 &&
6544 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6545 return false;
6546 if (bitrate_compat > 0 &&
6547 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6548 return false;
6549
6550 switch (info->bw) {
6551 case RATE_INFO_BW_1:
6552 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6553 break;
6554 case RATE_INFO_BW_2:
6555 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6556 break;
6557 case RATE_INFO_BW_4:
6558 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6559 break;
6560 case RATE_INFO_BW_5:
6561 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6562 break;
6563 case RATE_INFO_BW_8:
6564 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6565 break;
6566 case RATE_INFO_BW_10:
6567 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6568 break;
6569 case RATE_INFO_BW_16:
6570 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6571 break;
6572 default:
6573 WARN_ON(1);
6574 fallthrough;
6575 case RATE_INFO_BW_20:
6576 rate_flg = 0;
6577 break;
6578 case RATE_INFO_BW_40:
6579 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6580 break;
6581 case RATE_INFO_BW_80:
6582 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6583 break;
6584 case RATE_INFO_BW_160:
6585 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6586 break;
6587 case RATE_INFO_BW_HE_RU:
6588 rate_flg = 0;
6589 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6590 break;
6591 case RATE_INFO_BW_320:
6592 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6593 break;
6594 case RATE_INFO_BW_EHT_RU:
6595 rate_flg = 0;
6596 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6597 break;
6598 }
6599
6600 if (rate_flg && nla_put_flag(msg, rate_flg))
6601 return false;
6602
6603 if (info->flags & RATE_INFO_FLAGS_MCS) {
6604 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6605 return false;
6606 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6607 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6608 return false;
6609 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6610 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6611 return false;
6612 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6613 return false;
6614 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6615 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6616 return false;
6617 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6618 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6619 return false;
6620 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6621 return false;
6622 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6623 return false;
6624 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6625 return false;
6626 if (info->bw == RATE_INFO_BW_HE_RU &&
6627 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6628 info->he_ru_alloc))
6629 return false;
6630 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6631 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6632 return false;
6633 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6634 return false;
6635 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6636 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6637 return false;
6638 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6639 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6640 return false;
6641 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6642 return false;
6643 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6644 return false;
6645 if (info->bw == RATE_INFO_BW_EHT_RU &&
6646 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6647 info->eht_ru_alloc))
6648 return false;
6649 }
6650
6651 nla_nest_end(msg, rate);
6652 return true;
6653 }
6654
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)6655 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6656 int id)
6657 {
6658 void *attr;
6659 int i = 0;
6660
6661 if (!mask)
6662 return true;
6663
6664 attr = nla_nest_start_noflag(msg, id);
6665 if (!attr)
6666 return false;
6667
6668 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6669 if (!(mask & BIT(i)))
6670 continue;
6671
6672 if (nla_put_u8(msg, i, signal[i]))
6673 return false;
6674 }
6675
6676 nla_nest_end(msg, attr);
6677
6678 return true;
6679 }
6680
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)6681 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6682 u32 seq, int flags,
6683 struct cfg80211_registered_device *rdev,
6684 struct net_device *dev,
6685 const u8 *mac_addr, struct station_info *sinfo)
6686 {
6687 void *hdr;
6688 struct nlattr *sinfoattr, *bss_param;
6689
6690 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6691 if (!hdr) {
6692 cfg80211_sinfo_release_content(sinfo);
6693 return -1;
6694 }
6695
6696 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6697 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6698 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6699 goto nla_put_failure;
6700
6701 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6702 if (!sinfoattr)
6703 goto nla_put_failure;
6704
6705 #define PUT_SINFO(attr, memb, type) do { \
6706 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
6707 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6708 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
6709 sinfo->memb)) \
6710 goto nla_put_failure; \
6711 } while (0)
6712 #define PUT_SINFO_U64(attr, memb) do { \
6713 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6714 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
6715 sinfo->memb, NL80211_STA_INFO_PAD)) \
6716 goto nla_put_failure; \
6717 } while (0)
6718
6719 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6720 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6721 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6722
6723 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6724 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6725 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6726 (u32)sinfo->rx_bytes))
6727 goto nla_put_failure;
6728
6729 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6730 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6731 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6732 (u32)sinfo->tx_bytes))
6733 goto nla_put_failure;
6734
6735 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6736 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6737 PUT_SINFO(LLID, llid, u16);
6738 PUT_SINFO(PLID, plid, u16);
6739 PUT_SINFO(PLINK_STATE, plink_state, u8);
6740 PUT_SINFO_U64(RX_DURATION, rx_duration);
6741 PUT_SINFO_U64(TX_DURATION, tx_duration);
6742
6743 if (wiphy_ext_feature_isset(&rdev->wiphy,
6744 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6745 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6746
6747 switch (rdev->wiphy.signal_type) {
6748 case CFG80211_SIGNAL_TYPE_MBM:
6749 PUT_SINFO(SIGNAL, signal, u8);
6750 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6751 break;
6752 default:
6753 break;
6754 }
6755 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6756 if (!nl80211_put_signal(msg, sinfo->chains,
6757 sinfo->chain_signal,
6758 NL80211_STA_INFO_CHAIN_SIGNAL))
6759 goto nla_put_failure;
6760 }
6761 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6762 if (!nl80211_put_signal(msg, sinfo->chains,
6763 sinfo->chain_signal_avg,
6764 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6765 goto nla_put_failure;
6766 }
6767 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6768 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6769 NL80211_STA_INFO_TX_BITRATE))
6770 goto nla_put_failure;
6771 }
6772 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6773 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6774 NL80211_STA_INFO_RX_BITRATE))
6775 goto nla_put_failure;
6776 }
6777
6778 PUT_SINFO(RX_PACKETS, rx_packets, u32);
6779 PUT_SINFO(TX_PACKETS, tx_packets, u32);
6780 PUT_SINFO(TX_RETRIES, tx_retries, u32);
6781 PUT_SINFO(TX_FAILED, tx_failed, u32);
6782 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6783 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6784 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6785 PUT_SINFO(LOCAL_PM, local_pm, u32);
6786 PUT_SINFO(PEER_PM, peer_pm, u32);
6787 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6788 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6789 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6790
6791 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6792 bss_param = nla_nest_start_noflag(msg,
6793 NL80211_STA_INFO_BSS_PARAM);
6794 if (!bss_param)
6795 goto nla_put_failure;
6796
6797 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6798 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6799 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6800 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6801 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6802 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6803 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6804 sinfo->bss_param.dtim_period) ||
6805 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6806 sinfo->bss_param.beacon_interval))
6807 goto nla_put_failure;
6808
6809 nla_nest_end(msg, bss_param);
6810 }
6811 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6812 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6813 sizeof(struct nl80211_sta_flag_update),
6814 &sinfo->sta_flags))
6815 goto nla_put_failure;
6816
6817 PUT_SINFO_U64(T_OFFSET, t_offset);
6818 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6819 PUT_SINFO_U64(BEACON_RX, rx_beacon);
6820 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6821 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6822 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6823 if (wiphy_ext_feature_isset(&rdev->wiphy,
6824 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6825 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6826 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6827 }
6828
6829 #undef PUT_SINFO
6830 #undef PUT_SINFO_U64
6831
6832 if (sinfo->pertid) {
6833 struct nlattr *tidsattr;
6834 int tid;
6835
6836 tidsattr = nla_nest_start_noflag(msg,
6837 NL80211_STA_INFO_TID_STATS);
6838 if (!tidsattr)
6839 goto nla_put_failure;
6840
6841 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6842 struct cfg80211_tid_stats *tidstats;
6843 struct nlattr *tidattr;
6844
6845 tidstats = &sinfo->pertid[tid];
6846
6847 if (!tidstats->filled)
6848 continue;
6849
6850 tidattr = nla_nest_start_noflag(msg, tid + 1);
6851 if (!tidattr)
6852 goto nla_put_failure;
6853
6854 #define PUT_TIDVAL_U64(attr, memb) do { \
6855 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
6856 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
6857 tidstats->memb, NL80211_TID_STATS_PAD)) \
6858 goto nla_put_failure; \
6859 } while (0)
6860
6861 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6862 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6863 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6864 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6865
6866 #undef PUT_TIDVAL_U64
6867 if ((tidstats->filled &
6868 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6869 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6870 NL80211_TID_STATS_TXQ_STATS))
6871 goto nla_put_failure;
6872
6873 nla_nest_end(msg, tidattr);
6874 }
6875
6876 nla_nest_end(msg, tidsattr);
6877 }
6878
6879 nla_nest_end(msg, sinfoattr);
6880
6881 if (sinfo->assoc_req_ies_len &&
6882 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6883 sinfo->assoc_req_ies))
6884 goto nla_put_failure;
6885
6886 if (sinfo->assoc_resp_ies_len &&
6887 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6888 sinfo->assoc_resp_ies))
6889 goto nla_put_failure;
6890
6891 if (sinfo->mlo_params_valid) {
6892 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6893 sinfo->assoc_link_id))
6894 goto nla_put_failure;
6895
6896 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6897 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6898 sinfo->mld_addr))
6899 goto nla_put_failure;
6900 }
6901
6902 cfg80211_sinfo_release_content(sinfo);
6903 genlmsg_end(msg, hdr);
6904 return 0;
6905
6906 nla_put_failure:
6907 cfg80211_sinfo_release_content(sinfo);
6908 genlmsg_cancel(msg, hdr);
6909 return -EMSGSIZE;
6910 }
6911
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)6912 static int nl80211_dump_station(struct sk_buff *skb,
6913 struct netlink_callback *cb)
6914 {
6915 struct station_info sinfo;
6916 struct cfg80211_registered_device *rdev;
6917 struct wireless_dev *wdev;
6918 u8 mac_addr[ETH_ALEN];
6919 int sta_idx = cb->args[2];
6920 int err;
6921
6922 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6923 if (err)
6924 return err;
6925 /* nl80211_prepare_wdev_dump acquired it in the successful case */
6926 __acquire(&rdev->wiphy.mtx);
6927
6928 if (!wdev->netdev) {
6929 err = -EINVAL;
6930 goto out_err;
6931 }
6932
6933 if (!rdev->ops->dump_station) {
6934 err = -EOPNOTSUPP;
6935 goto out_err;
6936 }
6937
6938 while (1) {
6939 memset(&sinfo, 0, sizeof(sinfo));
6940 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6941 mac_addr, &sinfo);
6942 if (err == -ENOENT)
6943 break;
6944 if (err)
6945 goto out_err;
6946
6947 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6948 NETLINK_CB(cb->skb).portid,
6949 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6950 rdev, wdev->netdev, mac_addr,
6951 &sinfo) < 0)
6952 goto out;
6953
6954 sta_idx++;
6955 }
6956
6957 out:
6958 cb->args[2] = sta_idx;
6959 err = skb->len;
6960 out_err:
6961 wiphy_unlock(&rdev->wiphy);
6962
6963 return err;
6964 }
6965
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)6966 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6967 {
6968 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6969 struct net_device *dev = info->user_ptr[1];
6970 struct station_info sinfo;
6971 struct sk_buff *msg;
6972 u8 *mac_addr = NULL;
6973 int err;
6974
6975 memset(&sinfo, 0, sizeof(sinfo));
6976
6977 if (!info->attrs[NL80211_ATTR_MAC])
6978 return -EINVAL;
6979
6980 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6981
6982 if (!rdev->ops->get_station)
6983 return -EOPNOTSUPP;
6984
6985 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6986 if (err)
6987 return err;
6988
6989 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6990 if (!msg) {
6991 cfg80211_sinfo_release_content(&sinfo);
6992 return -ENOMEM;
6993 }
6994
6995 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6996 info->snd_portid, info->snd_seq, 0,
6997 rdev, dev, mac_addr, &sinfo) < 0) {
6998 nlmsg_free(msg);
6999 return -ENOBUFS;
7000 }
7001
7002 return genlmsg_reply(msg, info);
7003 }
7004
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)7005 int cfg80211_check_station_change(struct wiphy *wiphy,
7006 struct station_parameters *params,
7007 enum cfg80211_station_type statype)
7008 {
7009 if (params->listen_interval != -1 &&
7010 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7011 return -EINVAL;
7012
7013 if (params->support_p2p_ps != -1 &&
7014 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7015 return -EINVAL;
7016
7017 if (params->aid &&
7018 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
7019 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7020 return -EINVAL;
7021
7022 /* When you run into this, adjust the code below for the new flag */
7023 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7024
7025 switch (statype) {
7026 case CFG80211_STA_MESH_PEER_KERNEL:
7027 case CFG80211_STA_MESH_PEER_USER:
7028 /*
7029 * No ignoring the TDLS flag here -- the userspace mesh
7030 * code doesn't have the bug of including TDLS in the
7031 * mask everywhere.
7032 */
7033 if (params->sta_flags_mask &
7034 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7035 BIT(NL80211_STA_FLAG_MFP) |
7036 BIT(NL80211_STA_FLAG_AUTHORIZED)))
7037 return -EINVAL;
7038 break;
7039 case CFG80211_STA_TDLS_PEER_SETUP:
7040 case CFG80211_STA_TDLS_PEER_ACTIVE:
7041 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7042 return -EINVAL;
7043 /* ignore since it can't change */
7044 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7045 break;
7046 default:
7047 /* disallow mesh-specific things */
7048 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
7049 return -EINVAL;
7050 if (params->local_pm)
7051 return -EINVAL;
7052 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7053 return -EINVAL;
7054 }
7055
7056 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7057 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
7058 /* TDLS can't be set, ... */
7059 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
7060 return -EINVAL;
7061 /*
7062 * ... but don't bother the driver with it. This works around
7063 * a hostapd/wpa_supplicant issue -- it always includes the
7064 * TLDS_PEER flag in the mask even for AP mode.
7065 */
7066 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7067 }
7068
7069 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7070 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7071 /* reject other things that can't change */
7072 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
7073 return -EINVAL;
7074 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
7075 return -EINVAL;
7076 if (params->link_sta_params.supported_rates)
7077 return -EINVAL;
7078 if (params->ext_capab || params->link_sta_params.ht_capa ||
7079 params->link_sta_params.vht_capa ||
7080 params->link_sta_params.he_capa ||
7081 params->link_sta_params.eht_capa)
7082 return -EINVAL;
7083 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7084 return -EINVAL;
7085 }
7086
7087 if (statype != CFG80211_STA_AP_CLIENT &&
7088 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7089 if (params->vlan)
7090 return -EINVAL;
7091 }
7092
7093 switch (statype) {
7094 case CFG80211_STA_AP_MLME_CLIENT:
7095 /* Use this only for authorizing/unauthorizing a station */
7096 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
7097 return -EOPNOTSUPP;
7098 break;
7099 case CFG80211_STA_AP_CLIENT:
7100 case CFG80211_STA_AP_CLIENT_UNASSOC:
7101 /* accept only the listed bits */
7102 if (params->sta_flags_mask &
7103 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7104 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7105 BIT(NL80211_STA_FLAG_ASSOCIATED) |
7106 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7107 BIT(NL80211_STA_FLAG_WME) |
7108 BIT(NL80211_STA_FLAG_MFP) |
7109 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
7110 return -EINVAL;
7111
7112 /* but authenticated/associated only if driver handles it */
7113 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7114 params->sta_flags_mask &
7115 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7116 BIT(NL80211_STA_FLAG_ASSOCIATED)))
7117 return -EINVAL;
7118 break;
7119 case CFG80211_STA_IBSS:
7120 case CFG80211_STA_AP_STA:
7121 /* reject any changes other than AUTHORIZED */
7122 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
7123 return -EINVAL;
7124 break;
7125 case CFG80211_STA_TDLS_PEER_SETUP:
7126 /* reject any changes other than AUTHORIZED or WME */
7127 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7128 BIT(NL80211_STA_FLAG_WME)))
7129 return -EINVAL;
7130 /* force (at least) rates when authorizing */
7131 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
7132 !params->link_sta_params.supported_rates)
7133 return -EINVAL;
7134 break;
7135 case CFG80211_STA_TDLS_PEER_ACTIVE:
7136 /* reject any changes */
7137 return -EINVAL;
7138 case CFG80211_STA_MESH_PEER_KERNEL:
7139 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7140 return -EINVAL;
7141 break;
7142 case CFG80211_STA_MESH_PEER_USER:
7143 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
7144 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
7145 return -EINVAL;
7146 break;
7147 }
7148
7149 /*
7150 * Older kernel versions ignored this attribute entirely, so don't
7151 * reject attempts to update it but mark it as unused instead so the
7152 * driver won't look at the data.
7153 */
7154 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7155 statype != CFG80211_STA_TDLS_PEER_SETUP)
7156 params->link_sta_params.opmode_notif_used = false;
7157
7158 return 0;
7159 }
7160 EXPORT_SYMBOL(cfg80211_check_station_change);
7161
7162 /*
7163 * Get vlan interface making sure it is running and on the right wiphy.
7164 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)7165 static struct net_device *get_vlan(struct genl_info *info,
7166 struct cfg80211_registered_device *rdev)
7167 {
7168 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7169 struct net_device *v;
7170 int ret;
7171
7172 if (!vlanattr)
7173 return NULL;
7174
7175 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7176 if (!v)
7177 return ERR_PTR(-ENODEV);
7178
7179 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7180 ret = -EINVAL;
7181 goto error;
7182 }
7183
7184 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7185 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7186 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7187 ret = -EINVAL;
7188 goto error;
7189 }
7190
7191 if (!netif_running(v)) {
7192 ret = -ENETDOWN;
7193 goto error;
7194 }
7195
7196 return v;
7197 error:
7198 dev_put(v);
7199 return ERR_PTR(ret);
7200 }
7201
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)7202 static int nl80211_parse_sta_wme(struct genl_info *info,
7203 struct station_parameters *params)
7204 {
7205 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7206 struct nlattr *nla;
7207 int err;
7208
7209 /* parse WME attributes if present */
7210 if (!info->attrs[NL80211_ATTR_STA_WME])
7211 return 0;
7212
7213 nla = info->attrs[NL80211_ATTR_STA_WME];
7214 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7215 nl80211_sta_wme_policy,
7216 info->extack);
7217 if (err)
7218 return err;
7219
7220 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7221 params->uapsd_queues = nla_get_u8(
7222 tb[NL80211_STA_WME_UAPSD_QUEUES]);
7223 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7224 return -EINVAL;
7225
7226 if (tb[NL80211_STA_WME_MAX_SP])
7227 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7228
7229 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7230 return -EINVAL;
7231
7232 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7233
7234 return 0;
7235 }
7236
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)7237 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7238 struct station_parameters *params)
7239 {
7240 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7241 params->supported_channels =
7242 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7243 params->supported_channels_len =
7244 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7245 /*
7246 * Need to include at least one (first channel, number of
7247 * channels) tuple for each subband (checked in policy),
7248 * and must have proper tuples for the rest of the data as well.
7249 */
7250 if (params->supported_channels_len % 2)
7251 return -EINVAL;
7252 }
7253
7254 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7255 params->supported_oper_classes =
7256 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7257 params->supported_oper_classes_len =
7258 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7259 }
7260 return 0;
7261 }
7262
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)7263 static int nl80211_set_station_tdls(struct genl_info *info,
7264 struct station_parameters *params)
7265 {
7266 int err;
7267 /* Dummy STA entry gets updated once the peer capabilities are known */
7268 if (info->attrs[NL80211_ATTR_PEER_AID])
7269 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7270 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7271 params->link_sta_params.ht_capa =
7272 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7273 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7274 params->link_sta_params.vht_capa =
7275 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7276 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7277 params->link_sta_params.he_capa =
7278 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7279 params->link_sta_params.he_capa_len =
7280 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7281
7282 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7283 params->link_sta_params.eht_capa =
7284 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7285 params->link_sta_params.eht_capa_len =
7286 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7287
7288 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7289 (const u8 *)params->link_sta_params.eht_capa,
7290 params->link_sta_params.eht_capa_len,
7291 false))
7292 return -EINVAL;
7293 }
7294 }
7295
7296 err = nl80211_parse_sta_channel_info(info, params);
7297 if (err)
7298 return err;
7299
7300 return nl80211_parse_sta_wme(info, params);
7301 }
7302
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)7303 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7304 struct sta_txpwr *txpwr,
7305 bool *txpwr_set)
7306 {
7307 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7308 int idx;
7309
7310 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7311 if (!rdev->ops->set_tx_power ||
7312 !wiphy_ext_feature_isset(&rdev->wiphy,
7313 NL80211_EXT_FEATURE_STA_TX_PWR))
7314 return -EOPNOTSUPP;
7315
7316 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7317 txpwr->type = nla_get_u8(info->attrs[idx]);
7318
7319 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7320 idx = NL80211_ATTR_STA_TX_POWER;
7321
7322 if (info->attrs[idx])
7323 txpwr->power = nla_get_s16(info->attrs[idx]);
7324 else
7325 return -EINVAL;
7326 }
7327
7328 *txpwr_set = true;
7329 } else {
7330 *txpwr_set = false;
7331 }
7332
7333 return 0;
7334 }
7335
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)7336 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7337 {
7338 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7339 struct net_device *dev = info->user_ptr[1];
7340 struct station_parameters params;
7341 u8 *mac_addr;
7342 int err;
7343
7344 memset(¶ms, 0, sizeof(params));
7345
7346 if (!rdev->ops->change_station)
7347 return -EOPNOTSUPP;
7348
7349 /*
7350 * AID and listen_interval properties can be set only for unassociated
7351 * station. Include these parameters here and will check them in
7352 * cfg80211_check_station_change().
7353 */
7354 if (info->attrs[NL80211_ATTR_STA_AID])
7355 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7356
7357 if (info->attrs[NL80211_ATTR_VLAN_ID])
7358 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7359
7360 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7361 params.listen_interval =
7362 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7363 else
7364 params.listen_interval = -1;
7365
7366 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7367 params.support_p2p_ps =
7368 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7369 else
7370 params.support_p2p_ps = -1;
7371
7372 if (!info->attrs[NL80211_ATTR_MAC])
7373 return -EINVAL;
7374
7375 params.link_sta_params.link_id =
7376 nl80211_link_id_or_invalid(info->attrs);
7377
7378 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7379 /* If MLD_ADDR attribute is set then this is an MLD station
7380 * and the MLD_ADDR attribute holds the MLD address and the
7381 * MAC attribute holds for the LINK address.
7382 * In that case, the link_id is also expected to be valid.
7383 */
7384 if (params.link_sta_params.link_id < 0)
7385 return -EINVAL;
7386
7387 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7388 params.link_sta_params.mld_mac = mac_addr;
7389 params.link_sta_params.link_mac =
7390 nla_data(info->attrs[NL80211_ATTR_MAC]);
7391 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7392 return -EINVAL;
7393 } else {
7394 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7395 }
7396
7397
7398 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7399 params.link_sta_params.supported_rates =
7400 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7401 params.link_sta_params.supported_rates_len =
7402 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7403 }
7404
7405 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7406 params.capability =
7407 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7408 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7409 }
7410
7411 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7412 params.ext_capab =
7413 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7414 params.ext_capab_len =
7415 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7416 }
7417
7418 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7419 return -EINVAL;
7420
7421 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7422 params.plink_action =
7423 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7424
7425 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7426 params.plink_state =
7427 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7428 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7429 params.peer_aid = nla_get_u16(
7430 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7431 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7432 }
7433
7434 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7435 params.local_pm = nla_get_u32(
7436 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7437
7438 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7439 params.link_sta_params.opmode_notif_used = true;
7440 params.link_sta_params.opmode_notif =
7441 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7442 }
7443
7444 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7445 params.link_sta_params.he_6ghz_capa =
7446 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7447
7448 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7449 params.airtime_weight =
7450 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7451
7452 if (params.airtime_weight &&
7453 !wiphy_ext_feature_isset(&rdev->wiphy,
7454 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7455 return -EOPNOTSUPP;
7456
7457 err = nl80211_parse_sta_txpower_setting(info,
7458 ¶ms.link_sta_params.txpwr,
7459 ¶ms.link_sta_params.txpwr_set);
7460 if (err)
7461 return err;
7462
7463 /* Include parameters for TDLS peer (will check later) */
7464 err = nl80211_set_station_tdls(info, ¶ms);
7465 if (err)
7466 return err;
7467
7468 params.vlan = get_vlan(info, rdev);
7469 if (IS_ERR(params.vlan))
7470 return PTR_ERR(params.vlan);
7471
7472 switch (dev->ieee80211_ptr->iftype) {
7473 case NL80211_IFTYPE_AP:
7474 case NL80211_IFTYPE_AP_VLAN:
7475 case NL80211_IFTYPE_P2P_GO:
7476 case NL80211_IFTYPE_P2P_CLIENT:
7477 case NL80211_IFTYPE_STATION:
7478 case NL80211_IFTYPE_ADHOC:
7479 case NL80211_IFTYPE_MESH_POINT:
7480 break;
7481 default:
7482 err = -EOPNOTSUPP;
7483 goto out_put_vlan;
7484 }
7485
7486 /* driver will call cfg80211_check_station_change() */
7487 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
7488
7489 out_put_vlan:
7490 dev_put(params.vlan);
7491
7492 return err;
7493 }
7494
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)7495 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7496 {
7497 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7498 int err;
7499 struct net_device *dev = info->user_ptr[1];
7500 struct wireless_dev *wdev = dev->ieee80211_ptr;
7501 struct station_parameters params;
7502 u8 *mac_addr = NULL;
7503 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7504 BIT(NL80211_STA_FLAG_ASSOCIATED);
7505
7506 memset(¶ms, 0, sizeof(params));
7507
7508 if (!rdev->ops->add_station)
7509 return -EOPNOTSUPP;
7510
7511 if (!info->attrs[NL80211_ATTR_MAC])
7512 return -EINVAL;
7513
7514 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7515 return -EINVAL;
7516
7517 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7518 return -EINVAL;
7519
7520 if (!info->attrs[NL80211_ATTR_STA_AID] &&
7521 !info->attrs[NL80211_ATTR_PEER_AID])
7522 return -EINVAL;
7523
7524 params.link_sta_params.link_id =
7525 nl80211_link_id_or_invalid(info->attrs);
7526
7527 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7528 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7529 params.link_sta_params.mld_mac = mac_addr;
7530 params.link_sta_params.link_mac =
7531 nla_data(info->attrs[NL80211_ATTR_MAC]);
7532 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7533 return -EINVAL;
7534 } else {
7535 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7536 }
7537
7538 params.link_sta_params.supported_rates =
7539 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7540 params.link_sta_params.supported_rates_len =
7541 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7542 params.listen_interval =
7543 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7544
7545 if (info->attrs[NL80211_ATTR_VLAN_ID])
7546 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7547
7548 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7549 params.support_p2p_ps =
7550 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7551 } else {
7552 /*
7553 * if not specified, assume it's supported for P2P GO interface,
7554 * and is NOT supported for AP interface
7555 */
7556 params.support_p2p_ps =
7557 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7558 }
7559
7560 if (info->attrs[NL80211_ATTR_PEER_AID])
7561 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7562 else
7563 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7564
7565 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7566 params.capability =
7567 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7568 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7569 }
7570
7571 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7572 params.ext_capab =
7573 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7574 params.ext_capab_len =
7575 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7576 }
7577
7578 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7579 params.link_sta_params.ht_capa =
7580 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7581
7582 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7583 params.link_sta_params.vht_capa =
7584 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7585
7586 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7587 params.link_sta_params.he_capa =
7588 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7589 params.link_sta_params.he_capa_len =
7590 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7591
7592 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7593 params.link_sta_params.eht_capa =
7594 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7595 params.link_sta_params.eht_capa_len =
7596 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7597
7598 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7599 (const u8 *)params.link_sta_params.eht_capa,
7600 params.link_sta_params.eht_capa_len,
7601 false))
7602 return -EINVAL;
7603 }
7604 }
7605
7606 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7607 params.link_sta_params.he_6ghz_capa =
7608 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7609
7610 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7611 params.link_sta_params.opmode_notif_used = true;
7612 params.link_sta_params.opmode_notif =
7613 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7614 }
7615
7616 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7617 params.plink_action =
7618 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7619
7620 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7621 params.airtime_weight =
7622 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7623
7624 if (params.airtime_weight &&
7625 !wiphy_ext_feature_isset(&rdev->wiphy,
7626 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7627 return -EOPNOTSUPP;
7628
7629 err = nl80211_parse_sta_txpower_setting(info,
7630 ¶ms.link_sta_params.txpwr,
7631 ¶ms.link_sta_params.txpwr_set);
7632 if (err)
7633 return err;
7634
7635 err = nl80211_parse_sta_channel_info(info, ¶ms);
7636 if (err)
7637 return err;
7638
7639 err = nl80211_parse_sta_wme(info, ¶ms);
7640 if (err)
7641 return err;
7642
7643 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7644 return -EINVAL;
7645
7646 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7647 * as userspace might just pass through the capabilities from the IEs
7648 * directly, rather than enforcing this restriction and returning an
7649 * error in this case.
7650 */
7651 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7652 params.link_sta_params.ht_capa = NULL;
7653 params.link_sta_params.vht_capa = NULL;
7654
7655 /* HE and EHT require WME */
7656 if (params.link_sta_params.he_capa_len ||
7657 params.link_sta_params.he_6ghz_capa ||
7658 params.link_sta_params.eht_capa_len)
7659 return -EINVAL;
7660 }
7661
7662 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7663 if (params.link_sta_params.he_6ghz_capa &&
7664 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7665 return -EINVAL;
7666
7667 /* When you run into this, adjust the code below for the new flag */
7668 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7669
7670 switch (dev->ieee80211_ptr->iftype) {
7671 case NL80211_IFTYPE_AP:
7672 case NL80211_IFTYPE_AP_VLAN:
7673 case NL80211_IFTYPE_P2P_GO:
7674 /* ignore WME attributes if iface/sta is not capable */
7675 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7676 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7677 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7678
7679 /* TDLS peers cannot be added */
7680 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7681 info->attrs[NL80211_ATTR_PEER_AID])
7682 return -EINVAL;
7683 /* but don't bother the driver with it */
7684 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7685
7686 /* allow authenticated/associated only if driver handles it */
7687 if (!(rdev->wiphy.features &
7688 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7689 params.sta_flags_mask & auth_assoc)
7690 return -EINVAL;
7691
7692 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7693 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
7694 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7695 return -EINVAL;
7696
7697 /* Older userspace, or userspace wanting to be compatible with
7698 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7699 * and assoc flags in the mask, but assumes the station will be
7700 * added as associated anyway since this was the required driver
7701 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7702 * introduced.
7703 * In order to not bother drivers with this quirk in the API
7704 * set the flags in both the mask and set for new stations in
7705 * this case.
7706 */
7707 if (!(params.sta_flags_mask & auth_assoc)) {
7708 params.sta_flags_mask |= auth_assoc;
7709 params.sta_flags_set |= auth_assoc;
7710 }
7711
7712 /* must be last in here for error handling */
7713 params.vlan = get_vlan(info, rdev);
7714 if (IS_ERR(params.vlan))
7715 return PTR_ERR(params.vlan);
7716 break;
7717 case NL80211_IFTYPE_MESH_POINT:
7718 /* ignore uAPSD data */
7719 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7720
7721 /* associated is disallowed */
7722 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7723 return -EINVAL;
7724 /* TDLS peers cannot be added */
7725 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7726 info->attrs[NL80211_ATTR_PEER_AID])
7727 return -EINVAL;
7728 break;
7729 case NL80211_IFTYPE_STATION:
7730 case NL80211_IFTYPE_P2P_CLIENT:
7731 /* ignore uAPSD data */
7732 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7733
7734 /* these are disallowed */
7735 if (params.sta_flags_mask &
7736 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7737 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7738 return -EINVAL;
7739 /* Only TDLS peers can be added */
7740 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7741 return -EINVAL;
7742 /* Can only add if TDLS ... */
7743 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7744 return -EOPNOTSUPP;
7745 /* ... with external setup is supported */
7746 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7747 return -EOPNOTSUPP;
7748 /*
7749 * Older wpa_supplicant versions always mark the TDLS peer
7750 * as authorized, but it shouldn't yet be.
7751 */
7752 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7753 break;
7754 default:
7755 return -EOPNOTSUPP;
7756 }
7757
7758 /* be aware of params.vlan when changing code here */
7759
7760 if (wdev->valid_links) {
7761 if (params.link_sta_params.link_id < 0) {
7762 err = -EINVAL;
7763 goto out;
7764 }
7765 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7766 err = -ENOLINK;
7767 goto out;
7768 }
7769 } else {
7770 if (params.link_sta_params.link_id >= 0) {
7771 err = -EINVAL;
7772 goto out;
7773 }
7774 }
7775 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
7776 out:
7777 dev_put(params.vlan);
7778 return err;
7779 }
7780
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)7781 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7782 {
7783 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7784 struct net_device *dev = info->user_ptr[1];
7785 struct wireless_dev *wdev = dev->ieee80211_ptr;
7786 struct station_del_parameters params;
7787 int link_id = nl80211_link_id_or_invalid(info->attrs);
7788
7789 memset(¶ms, 0, sizeof(params));
7790
7791 if (info->attrs[NL80211_ATTR_MAC])
7792 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7793
7794 switch (wdev->iftype) {
7795 case NL80211_IFTYPE_AP:
7796 case NL80211_IFTYPE_AP_VLAN:
7797 case NL80211_IFTYPE_MESH_POINT:
7798 case NL80211_IFTYPE_P2P_GO:
7799 /* always accept these */
7800 break;
7801 case NL80211_IFTYPE_ADHOC:
7802 /* conditionally accept */
7803 if (wiphy_ext_feature_isset(&rdev->wiphy,
7804 NL80211_EXT_FEATURE_DEL_IBSS_STA))
7805 break;
7806 return -EINVAL;
7807 default:
7808 return -EINVAL;
7809 }
7810
7811 if (!rdev->ops->del_station)
7812 return -EOPNOTSUPP;
7813
7814 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7815 params.subtype =
7816 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7817 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7818 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7819 return -EINVAL;
7820 } else {
7821 /* Default to Deauthentication frame */
7822 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7823 }
7824
7825 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7826 params.reason_code =
7827 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7828 if (params.reason_code == 0)
7829 return -EINVAL; /* 0 is reserved */
7830 } else {
7831 /* Default to reason code 2 */
7832 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7833 }
7834
7835 /* Link ID not expected in case of non-ML operation */
7836 if (!wdev->valid_links && link_id != -1)
7837 return -EINVAL;
7838
7839 /* If given, a valid link ID should be passed during MLO */
7840 if (wdev->valid_links && link_id >= 0 &&
7841 !(wdev->valid_links & BIT(link_id)))
7842 return -EINVAL;
7843
7844 params.link_id = link_id;
7845
7846 return rdev_del_station(rdev, dev, ¶ms);
7847 }
7848
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)7849 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7850 int flags, struct net_device *dev,
7851 u8 *dst, u8 *next_hop,
7852 struct mpath_info *pinfo)
7853 {
7854 void *hdr;
7855 struct nlattr *pinfoattr;
7856
7857 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7858 if (!hdr)
7859 return -1;
7860
7861 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7862 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7863 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7864 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7865 goto nla_put_failure;
7866
7867 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7868 if (!pinfoattr)
7869 goto nla_put_failure;
7870 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7871 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7872 pinfo->frame_qlen))
7873 goto nla_put_failure;
7874 if (((pinfo->filled & MPATH_INFO_SN) &&
7875 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7876 ((pinfo->filled & MPATH_INFO_METRIC) &&
7877 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7878 pinfo->metric)) ||
7879 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7880 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7881 pinfo->exptime)) ||
7882 ((pinfo->filled & MPATH_INFO_FLAGS) &&
7883 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7884 pinfo->flags)) ||
7885 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7886 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7887 pinfo->discovery_timeout)) ||
7888 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7889 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7890 pinfo->discovery_retries)) ||
7891 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7892 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7893 pinfo->hop_count)) ||
7894 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7895 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7896 pinfo->path_change_count)))
7897 goto nla_put_failure;
7898
7899 nla_nest_end(msg, pinfoattr);
7900
7901 genlmsg_end(msg, hdr);
7902 return 0;
7903
7904 nla_put_failure:
7905 genlmsg_cancel(msg, hdr);
7906 return -EMSGSIZE;
7907 }
7908
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)7909 static int nl80211_dump_mpath(struct sk_buff *skb,
7910 struct netlink_callback *cb)
7911 {
7912 struct mpath_info pinfo;
7913 struct cfg80211_registered_device *rdev;
7914 struct wireless_dev *wdev;
7915 u8 dst[ETH_ALEN];
7916 u8 next_hop[ETH_ALEN];
7917 int path_idx = cb->args[2];
7918 int err;
7919
7920 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7921 if (err)
7922 return err;
7923 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7924 __acquire(&rdev->wiphy.mtx);
7925
7926 if (!rdev->ops->dump_mpath) {
7927 err = -EOPNOTSUPP;
7928 goto out_err;
7929 }
7930
7931 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7932 err = -EOPNOTSUPP;
7933 goto out_err;
7934 }
7935
7936 while (1) {
7937 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7938 next_hop, &pinfo);
7939 if (err == -ENOENT)
7940 break;
7941 if (err)
7942 goto out_err;
7943
7944 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7945 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7946 wdev->netdev, dst, next_hop,
7947 &pinfo) < 0)
7948 goto out;
7949
7950 path_idx++;
7951 }
7952
7953 out:
7954 cb->args[2] = path_idx;
7955 err = skb->len;
7956 out_err:
7957 wiphy_unlock(&rdev->wiphy);
7958 return err;
7959 }
7960
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)7961 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7962 {
7963 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7964 int err;
7965 struct net_device *dev = info->user_ptr[1];
7966 struct mpath_info pinfo;
7967 struct sk_buff *msg;
7968 u8 *dst = NULL;
7969 u8 next_hop[ETH_ALEN];
7970
7971 memset(&pinfo, 0, sizeof(pinfo));
7972
7973 if (!info->attrs[NL80211_ATTR_MAC])
7974 return -EINVAL;
7975
7976 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7977
7978 if (!rdev->ops->get_mpath)
7979 return -EOPNOTSUPP;
7980
7981 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7982 return -EOPNOTSUPP;
7983
7984 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7985 if (err)
7986 return err;
7987
7988 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7989 if (!msg)
7990 return -ENOMEM;
7991
7992 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7993 dev, dst, next_hop, &pinfo) < 0) {
7994 nlmsg_free(msg);
7995 return -ENOBUFS;
7996 }
7997
7998 return genlmsg_reply(msg, info);
7999 }
8000
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)8001 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
8002 {
8003 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8004 struct net_device *dev = info->user_ptr[1];
8005 u8 *dst = NULL;
8006 u8 *next_hop = NULL;
8007
8008 if (!info->attrs[NL80211_ATTR_MAC])
8009 return -EINVAL;
8010
8011 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8012 return -EINVAL;
8013
8014 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8015 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8016
8017 if (!rdev->ops->change_mpath)
8018 return -EOPNOTSUPP;
8019
8020 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8021 return -EOPNOTSUPP;
8022
8023 return rdev_change_mpath(rdev, dev, dst, next_hop);
8024 }
8025
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)8026 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
8027 {
8028 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8029 struct net_device *dev = info->user_ptr[1];
8030 u8 *dst = NULL;
8031 u8 *next_hop = NULL;
8032
8033 if (!info->attrs[NL80211_ATTR_MAC])
8034 return -EINVAL;
8035
8036 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8037 return -EINVAL;
8038
8039 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8040 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8041
8042 if (!rdev->ops->add_mpath)
8043 return -EOPNOTSUPP;
8044
8045 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8046 return -EOPNOTSUPP;
8047
8048 return rdev_add_mpath(rdev, dev, dst, next_hop);
8049 }
8050
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)8051 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
8052 {
8053 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8054 struct net_device *dev = info->user_ptr[1];
8055 u8 *dst = NULL;
8056
8057 if (info->attrs[NL80211_ATTR_MAC])
8058 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8059
8060 if (!rdev->ops->del_mpath)
8061 return -EOPNOTSUPP;
8062
8063 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8064 return -EOPNOTSUPP;
8065
8066 return rdev_del_mpath(rdev, dev, dst);
8067 }
8068
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)8069 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
8070 {
8071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8072 int err;
8073 struct net_device *dev = info->user_ptr[1];
8074 struct mpath_info pinfo;
8075 struct sk_buff *msg;
8076 u8 *dst = NULL;
8077 u8 mpp[ETH_ALEN];
8078
8079 memset(&pinfo, 0, sizeof(pinfo));
8080
8081 if (!info->attrs[NL80211_ATTR_MAC])
8082 return -EINVAL;
8083
8084 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8085
8086 if (!rdev->ops->get_mpp)
8087 return -EOPNOTSUPP;
8088
8089 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8090 return -EOPNOTSUPP;
8091
8092 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
8093 if (err)
8094 return err;
8095
8096 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8097 if (!msg)
8098 return -ENOMEM;
8099
8100 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8101 dev, dst, mpp, &pinfo) < 0) {
8102 nlmsg_free(msg);
8103 return -ENOBUFS;
8104 }
8105
8106 return genlmsg_reply(msg, info);
8107 }
8108
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)8109 static int nl80211_dump_mpp(struct sk_buff *skb,
8110 struct netlink_callback *cb)
8111 {
8112 struct mpath_info pinfo;
8113 struct cfg80211_registered_device *rdev;
8114 struct wireless_dev *wdev;
8115 u8 dst[ETH_ALEN];
8116 u8 mpp[ETH_ALEN];
8117 int path_idx = cb->args[2];
8118 int err;
8119
8120 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8121 if (err)
8122 return err;
8123 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8124 __acquire(&rdev->wiphy.mtx);
8125
8126 if (!rdev->ops->dump_mpp) {
8127 err = -EOPNOTSUPP;
8128 goto out_err;
8129 }
8130
8131 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8132 err = -EOPNOTSUPP;
8133 goto out_err;
8134 }
8135
8136 while (1) {
8137 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
8138 mpp, &pinfo);
8139 if (err == -ENOENT)
8140 break;
8141 if (err)
8142 goto out_err;
8143
8144 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8145 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8146 wdev->netdev, dst, mpp,
8147 &pinfo) < 0)
8148 goto out;
8149
8150 path_idx++;
8151 }
8152
8153 out:
8154 cb->args[2] = path_idx;
8155 err = skb->len;
8156 out_err:
8157 wiphy_unlock(&rdev->wiphy);
8158 return err;
8159 }
8160
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)8161 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
8162 {
8163 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8164 struct net_device *dev = info->user_ptr[1];
8165 struct bss_parameters params;
8166
8167 memset(¶ms, 0, sizeof(params));
8168 params.link_id = nl80211_link_id_or_invalid(info->attrs);
8169 /* default to not changing parameters */
8170 params.use_cts_prot = -1;
8171 params.use_short_preamble = -1;
8172 params.use_short_slot_time = -1;
8173 params.ap_isolate = -1;
8174 params.ht_opmode = -1;
8175 params.p2p_ctwindow = -1;
8176 params.p2p_opp_ps = -1;
8177
8178 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
8179 params.use_cts_prot =
8180 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8181 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8182 params.use_short_preamble =
8183 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8184 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8185 params.use_short_slot_time =
8186 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8187 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8188 params.basic_rates =
8189 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8190 params.basic_rates_len =
8191 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8192 }
8193 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8194 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8195 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8196 params.ht_opmode =
8197 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8198
8199 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8200 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8201 return -EINVAL;
8202 params.p2p_ctwindow =
8203 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8204 if (params.p2p_ctwindow != 0 &&
8205 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8206 return -EINVAL;
8207 }
8208
8209 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8210 u8 tmp;
8211
8212 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8213 return -EINVAL;
8214 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8215 params.p2p_opp_ps = tmp;
8216 if (params.p2p_opp_ps &&
8217 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8218 return -EINVAL;
8219 }
8220
8221 if (!rdev->ops->change_bss)
8222 return -EOPNOTSUPP;
8223
8224 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8225 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8226 return -EOPNOTSUPP;
8227
8228 return rdev_change_bss(rdev, dev, ¶ms);
8229 }
8230
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)8231 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8232 {
8233 char *data = NULL;
8234 bool is_indoor;
8235 enum nl80211_user_reg_hint_type user_reg_hint_type;
8236 u32 owner_nlportid;
8237
8238 /*
8239 * You should only get this when cfg80211 hasn't yet initialized
8240 * completely when built-in to the kernel right between the time
8241 * window between nl80211_init() and regulatory_init(), if that is
8242 * even possible.
8243 */
8244 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8245 return -EINPROGRESS;
8246
8247 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8248 user_reg_hint_type =
8249 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8250 else
8251 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8252
8253 switch (user_reg_hint_type) {
8254 case NL80211_USER_REG_HINT_USER:
8255 case NL80211_USER_REG_HINT_CELL_BASE:
8256 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8257 return -EINVAL;
8258
8259 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8260 return regulatory_hint_user(data, user_reg_hint_type);
8261 case NL80211_USER_REG_HINT_INDOOR:
8262 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8263 owner_nlportid = info->snd_portid;
8264 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8265 } else {
8266 owner_nlportid = 0;
8267 is_indoor = true;
8268 }
8269
8270 regulatory_hint_indoor(is_indoor, owner_nlportid);
8271 return 0;
8272 default:
8273 return -EINVAL;
8274 }
8275 }
8276
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)8277 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8278 {
8279 return reg_reload_regdb();
8280 }
8281
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)8282 static int nl80211_get_mesh_config(struct sk_buff *skb,
8283 struct genl_info *info)
8284 {
8285 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8286 struct net_device *dev = info->user_ptr[1];
8287 struct wireless_dev *wdev = dev->ieee80211_ptr;
8288 struct mesh_config cur_params;
8289 int err = 0;
8290 void *hdr;
8291 struct nlattr *pinfoattr;
8292 struct sk_buff *msg;
8293
8294 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8295 return -EOPNOTSUPP;
8296
8297 if (!rdev->ops->get_mesh_config)
8298 return -EOPNOTSUPP;
8299
8300 /* If not connected, get default parameters */
8301 if (!wdev->u.mesh.id_len)
8302 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8303 else
8304 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8305
8306 if (err)
8307 return err;
8308
8309 /* Draw up a netlink message to send back */
8310 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8311 if (!msg)
8312 return -ENOMEM;
8313 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8314 NL80211_CMD_GET_MESH_CONFIG);
8315 if (!hdr)
8316 goto out;
8317 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8318 if (!pinfoattr)
8319 goto nla_put_failure;
8320 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8321 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8322 cur_params.dot11MeshRetryTimeout) ||
8323 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8324 cur_params.dot11MeshConfirmTimeout) ||
8325 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8326 cur_params.dot11MeshHoldingTimeout) ||
8327 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8328 cur_params.dot11MeshMaxPeerLinks) ||
8329 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8330 cur_params.dot11MeshMaxRetries) ||
8331 nla_put_u8(msg, NL80211_MESHCONF_TTL,
8332 cur_params.dot11MeshTTL) ||
8333 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8334 cur_params.element_ttl) ||
8335 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8336 cur_params.auto_open_plinks) ||
8337 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8338 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8339 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8340 cur_params.dot11MeshHWMPmaxPREQretries) ||
8341 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8342 cur_params.path_refresh_time) ||
8343 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8344 cur_params.min_discovery_timeout) ||
8345 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8346 cur_params.dot11MeshHWMPactivePathTimeout) ||
8347 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8348 cur_params.dot11MeshHWMPpreqMinInterval) ||
8349 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8350 cur_params.dot11MeshHWMPperrMinInterval) ||
8351 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8352 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8353 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8354 cur_params.dot11MeshHWMPRootMode) ||
8355 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8356 cur_params.dot11MeshHWMPRannInterval) ||
8357 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8358 cur_params.dot11MeshGateAnnouncementProtocol) ||
8359 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8360 cur_params.dot11MeshForwarding) ||
8361 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8362 cur_params.rssi_threshold) ||
8363 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8364 cur_params.ht_opmode) ||
8365 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8366 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8367 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8368 cur_params.dot11MeshHWMProotInterval) ||
8369 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8370 cur_params.dot11MeshHWMPconfirmationInterval) ||
8371 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8372 cur_params.power_mode) ||
8373 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8374 cur_params.dot11MeshAwakeWindowDuration) ||
8375 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8376 cur_params.plink_timeout) ||
8377 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8378 cur_params.dot11MeshConnectedToMeshGate) ||
8379 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8380 cur_params.dot11MeshNolearn) ||
8381 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8382 cur_params.dot11MeshConnectedToAuthServer))
8383 goto nla_put_failure;
8384 nla_nest_end(msg, pinfoattr);
8385 genlmsg_end(msg, hdr);
8386 return genlmsg_reply(msg, info);
8387
8388 nla_put_failure:
8389 out:
8390 nlmsg_free(msg);
8391 return -ENOBUFS;
8392 }
8393
8394 static const struct nla_policy
8395 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8396 [NL80211_MESHCONF_RETRY_TIMEOUT] =
8397 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8398 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8399 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8400 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8401 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8402 [NL80211_MESHCONF_MAX_PEER_LINKS] =
8403 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8404 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8405 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8406 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8407 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8408 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8409 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8410 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8411 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8412 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8413 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8414 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8415 NLA_POLICY_MIN(NLA_U16, 1),
8416 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8417 NLA_POLICY_MIN(NLA_U16, 1),
8418 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8419 NLA_POLICY_MIN(NLA_U16, 1),
8420 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8421 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8422 NLA_POLICY_MIN(NLA_U16, 1),
8423 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8424 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8425 [NL80211_MESHCONF_RSSI_THRESHOLD] =
8426 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8427 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8428 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8429 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8430 NLA_POLICY_MIN(NLA_U16, 1),
8431 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8432 NLA_POLICY_MIN(NLA_U16, 1),
8433 [NL80211_MESHCONF_POWER_MODE] =
8434 NLA_POLICY_RANGE(NLA_U32,
8435 NL80211_MESH_POWER_ACTIVE,
8436 NL80211_MESH_POWER_MAX),
8437 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8438 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8439 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8440 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8441 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8442 };
8443
8444 static const struct nla_policy
8445 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8446 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8447 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8448 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8449 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8450 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8451 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8452 [NL80211_MESH_SETUP_IE] =
8453 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8454 IEEE80211_MAX_DATA_LEN),
8455 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8456 };
8457
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)8458 static int nl80211_parse_mesh_config(struct genl_info *info,
8459 struct mesh_config *cfg,
8460 u32 *mask_out)
8461 {
8462 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8463 u32 mask = 0;
8464 u16 ht_opmode;
8465
8466 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
8467 do { \
8468 if (tb[attr]) { \
8469 cfg->param = fn(tb[attr]); \
8470 mask |= BIT((attr) - 1); \
8471 } \
8472 } while (0)
8473
8474 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8475 return -EINVAL;
8476 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8477 return -EINVAL;
8478
8479 /* This makes sure that there aren't more than 32 mesh config
8480 * parameters (otherwise our bitfield scheme would not work.) */
8481 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8482
8483 /* Fill in the params struct */
8484 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8485 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8486 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8487 NL80211_MESHCONF_CONFIRM_TIMEOUT,
8488 nla_get_u16);
8489 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8490 NL80211_MESHCONF_HOLDING_TIMEOUT,
8491 nla_get_u16);
8492 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8493 NL80211_MESHCONF_MAX_PEER_LINKS,
8494 nla_get_u16);
8495 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8496 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8497 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8498 NL80211_MESHCONF_TTL, nla_get_u8);
8499 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8500 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8501 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8502 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8503 nla_get_u8);
8504 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8505 mask,
8506 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8507 nla_get_u32);
8508 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8509 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8510 nla_get_u8);
8511 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8512 NL80211_MESHCONF_PATH_REFRESH_TIME,
8513 nla_get_u32);
8514 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8515 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8516 return -EINVAL;
8517 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8518 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8519 nla_get_u16);
8520 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8521 mask,
8522 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8523 nla_get_u32);
8524 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8525 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8526 cfg->dot11MeshHWMPactivePathTimeout > 65535))
8527 return -EINVAL;
8528 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8529 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8530 nla_get_u16);
8531 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8532 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8533 nla_get_u16);
8534 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8535 dot11MeshHWMPnetDiameterTraversalTime, mask,
8536 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8537 nla_get_u16);
8538 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8539 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8540 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8541 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8542 nla_get_u16);
8543 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8544 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8545 nla_get_u8);
8546 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8547 NL80211_MESHCONF_FORWARDING, nla_get_u8);
8548 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8549 NL80211_MESHCONF_RSSI_THRESHOLD,
8550 nla_get_s32);
8551 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8552 NL80211_MESHCONF_CONNECTED_TO_GATE,
8553 nla_get_u8);
8554 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8555 NL80211_MESHCONF_CONNECTED_TO_AS,
8556 nla_get_u8);
8557 /*
8558 * Check HT operation mode based on
8559 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8560 */
8561 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8562 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8563
8564 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8565 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8566 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8567 return -EINVAL;
8568
8569 /* NON_HT_STA bit is reserved, but some programs set it */
8570 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8571
8572 cfg->ht_opmode = ht_opmode;
8573 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8574 }
8575 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8576 dot11MeshHWMPactivePathToRootTimeout, mask,
8577 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8578 nla_get_u32);
8579 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8580 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8581 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8582 return -EINVAL;
8583 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8584 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8585 nla_get_u16);
8586 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8587 mask,
8588 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8589 nla_get_u16);
8590 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8591 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8592 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8593 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8594 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8595 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8596 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8597 NL80211_MESHCONF_NOLEARN, nla_get_u8);
8598 if (mask_out)
8599 *mask_out = mask;
8600
8601 return 0;
8602
8603 #undef FILL_IN_MESH_PARAM_IF_SET
8604 }
8605
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)8606 static int nl80211_parse_mesh_setup(struct genl_info *info,
8607 struct mesh_setup *setup)
8608 {
8609 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8610 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8611
8612 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8613 return -EINVAL;
8614 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8615 return -EINVAL;
8616
8617 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8618 setup->sync_method =
8619 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8620 IEEE80211_SYNC_METHOD_VENDOR :
8621 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8622
8623 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8624 setup->path_sel_proto =
8625 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8626 IEEE80211_PATH_PROTOCOL_VENDOR :
8627 IEEE80211_PATH_PROTOCOL_HWMP;
8628
8629 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8630 setup->path_metric =
8631 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8632 IEEE80211_PATH_METRIC_VENDOR :
8633 IEEE80211_PATH_METRIC_AIRTIME;
8634
8635 if (tb[NL80211_MESH_SETUP_IE]) {
8636 struct nlattr *ieattr =
8637 tb[NL80211_MESH_SETUP_IE];
8638 setup->ie = nla_data(ieattr);
8639 setup->ie_len = nla_len(ieattr);
8640 }
8641 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8642 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8643 return -EINVAL;
8644 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8645 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8646 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8647 if (setup->is_secure)
8648 setup->user_mpm = true;
8649
8650 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8651 if (!setup->user_mpm)
8652 return -EINVAL;
8653 setup->auth_id =
8654 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8655 }
8656
8657 return 0;
8658 }
8659
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)8660 static int nl80211_update_mesh_config(struct sk_buff *skb,
8661 struct genl_info *info)
8662 {
8663 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8664 struct net_device *dev = info->user_ptr[1];
8665 struct wireless_dev *wdev = dev->ieee80211_ptr;
8666 struct mesh_config cfg = {};
8667 u32 mask;
8668 int err;
8669
8670 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8671 return -EOPNOTSUPP;
8672
8673 if (!rdev->ops->update_mesh_config)
8674 return -EOPNOTSUPP;
8675
8676 err = nl80211_parse_mesh_config(info, &cfg, &mask);
8677 if (err)
8678 return err;
8679
8680 if (!wdev->u.mesh.id_len)
8681 err = -ENOLINK;
8682
8683 if (!err)
8684 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8685
8686 return err;
8687 }
8688
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)8689 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8690 struct sk_buff *msg)
8691 {
8692 struct nlattr *nl_reg_rules;
8693 unsigned int i;
8694
8695 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8696 (regdom->dfs_region &&
8697 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8698 goto nla_put_failure;
8699
8700 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8701 if (!nl_reg_rules)
8702 goto nla_put_failure;
8703
8704 for (i = 0; i < regdom->n_reg_rules; i++) {
8705 struct nlattr *nl_reg_rule;
8706 const struct ieee80211_reg_rule *reg_rule;
8707 const struct ieee80211_freq_range *freq_range;
8708 const struct ieee80211_power_rule *power_rule;
8709 unsigned int max_bandwidth_khz;
8710
8711 reg_rule = ®dom->reg_rules[i];
8712 freq_range = ®_rule->freq_range;
8713 power_rule = ®_rule->power_rule;
8714
8715 nl_reg_rule = nla_nest_start_noflag(msg, i);
8716 if (!nl_reg_rule)
8717 goto nla_put_failure;
8718
8719 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8720 if (!max_bandwidth_khz)
8721 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8722 reg_rule);
8723
8724 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8725 reg_rule->flags) ||
8726 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8727 freq_range->start_freq_khz) ||
8728 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8729 freq_range->end_freq_khz) ||
8730 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8731 max_bandwidth_khz) ||
8732 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8733 power_rule->max_antenna_gain) ||
8734 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8735 power_rule->max_eirp) ||
8736 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8737 reg_rule->dfs_cac_ms))
8738 goto nla_put_failure;
8739
8740 if ((reg_rule->flags & NL80211_RRF_PSD) &&
8741 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
8742 reg_rule->psd))
8743 goto nla_put_failure;
8744
8745 nla_nest_end(msg, nl_reg_rule);
8746 }
8747
8748 nla_nest_end(msg, nl_reg_rules);
8749 return 0;
8750
8751 nla_put_failure:
8752 return -EMSGSIZE;
8753 }
8754
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)8755 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8756 {
8757 const struct ieee80211_regdomain *regdom = NULL;
8758 struct cfg80211_registered_device *rdev;
8759 struct wiphy *wiphy = NULL;
8760 struct sk_buff *msg;
8761 int err = -EMSGSIZE;
8762 void *hdr;
8763
8764 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8765 if (!msg)
8766 return -ENOBUFS;
8767
8768 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8769 NL80211_CMD_GET_REG);
8770 if (!hdr)
8771 goto put_failure;
8772
8773 rtnl_lock();
8774
8775 if (info->attrs[NL80211_ATTR_WIPHY]) {
8776 bool self_managed;
8777
8778 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8779 if (IS_ERR(rdev)) {
8780 err = PTR_ERR(rdev);
8781 goto nla_put_failure;
8782 }
8783
8784 wiphy = &rdev->wiphy;
8785 self_managed = wiphy->regulatory_flags &
8786 REGULATORY_WIPHY_SELF_MANAGED;
8787
8788 rcu_read_lock();
8789
8790 regdom = get_wiphy_regdom(wiphy);
8791
8792 /* a self-managed-reg device must have a private regdom */
8793 if (WARN_ON(!regdom && self_managed)) {
8794 err = -EINVAL;
8795 goto nla_put_failure_rcu;
8796 }
8797
8798 if (regdom &&
8799 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8800 goto nla_put_failure_rcu;
8801 } else {
8802 rcu_read_lock();
8803 }
8804
8805 if (!wiphy && reg_last_request_cell_base() &&
8806 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8807 NL80211_USER_REG_HINT_CELL_BASE))
8808 goto nla_put_failure_rcu;
8809
8810 if (!regdom)
8811 regdom = rcu_dereference(cfg80211_regdomain);
8812
8813 if (nl80211_put_regdom(regdom, msg))
8814 goto nla_put_failure_rcu;
8815
8816 rcu_read_unlock();
8817
8818 genlmsg_end(msg, hdr);
8819 rtnl_unlock();
8820 return genlmsg_reply(msg, info);
8821
8822 nla_put_failure_rcu:
8823 rcu_read_unlock();
8824 nla_put_failure:
8825 rtnl_unlock();
8826 put_failure:
8827 nlmsg_free(msg);
8828 return err;
8829 }
8830
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)8831 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8832 u32 seq, int flags, struct wiphy *wiphy,
8833 const struct ieee80211_regdomain *regdom)
8834 {
8835 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8836 NL80211_CMD_GET_REG);
8837
8838 if (!hdr)
8839 return -1;
8840
8841 genl_dump_check_consistent(cb, hdr);
8842
8843 if (nl80211_put_regdom(regdom, msg))
8844 goto nla_put_failure;
8845
8846 if (!wiphy && reg_last_request_cell_base() &&
8847 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8848 NL80211_USER_REG_HINT_CELL_BASE))
8849 goto nla_put_failure;
8850
8851 if (wiphy &&
8852 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8853 goto nla_put_failure;
8854
8855 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8856 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8857 goto nla_put_failure;
8858
8859 genlmsg_end(msg, hdr);
8860 return 0;
8861
8862 nla_put_failure:
8863 genlmsg_cancel(msg, hdr);
8864 return -EMSGSIZE;
8865 }
8866
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)8867 static int nl80211_get_reg_dump(struct sk_buff *skb,
8868 struct netlink_callback *cb)
8869 {
8870 const struct ieee80211_regdomain *regdom = NULL;
8871 struct cfg80211_registered_device *rdev;
8872 int err, reg_idx, start = cb->args[2];
8873
8874 rcu_read_lock();
8875
8876 if (cfg80211_regdomain && start == 0) {
8877 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8878 NLM_F_MULTI, NULL,
8879 rcu_dereference(cfg80211_regdomain));
8880 if (err < 0)
8881 goto out_err;
8882 }
8883
8884 /* the global regdom is idx 0 */
8885 reg_idx = 1;
8886 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8887 regdom = get_wiphy_regdom(&rdev->wiphy);
8888 if (!regdom)
8889 continue;
8890
8891 if (++reg_idx <= start)
8892 continue;
8893
8894 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8895 NLM_F_MULTI, &rdev->wiphy, regdom);
8896 if (err < 0) {
8897 reg_idx--;
8898 break;
8899 }
8900 }
8901
8902 cb->args[2] = reg_idx;
8903 err = skb->len;
8904 out_err:
8905 rcu_read_unlock();
8906 return err;
8907 }
8908
8909 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8910 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8911 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
8912 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
8913 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
8914 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
8915 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
8916 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
8917 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
8918 };
8919
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)8920 static int parse_reg_rule(struct nlattr *tb[],
8921 struct ieee80211_reg_rule *reg_rule)
8922 {
8923 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
8924 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
8925
8926 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8927 return -EINVAL;
8928 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8929 return -EINVAL;
8930 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8931 return -EINVAL;
8932 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8933 return -EINVAL;
8934 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8935 return -EINVAL;
8936
8937 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8938
8939 freq_range->start_freq_khz =
8940 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8941 freq_range->end_freq_khz =
8942 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8943 freq_range->max_bandwidth_khz =
8944 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8945
8946 power_rule->max_eirp =
8947 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8948
8949 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8950 power_rule->max_antenna_gain =
8951 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8952
8953 if (tb[NL80211_ATTR_DFS_CAC_TIME])
8954 reg_rule->dfs_cac_ms =
8955 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8956
8957 return 0;
8958 }
8959
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)8960 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8961 {
8962 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8963 struct nlattr *nl_reg_rule;
8964 char *alpha2;
8965 int rem_reg_rules, r;
8966 u32 num_rules = 0, rule_idx = 0;
8967 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8968 struct ieee80211_regdomain *rd;
8969
8970 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8971 return -EINVAL;
8972
8973 if (!info->attrs[NL80211_ATTR_REG_RULES])
8974 return -EINVAL;
8975
8976 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8977
8978 if (info->attrs[NL80211_ATTR_DFS_REGION])
8979 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8980
8981 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8982 rem_reg_rules) {
8983 num_rules++;
8984 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8985 return -EINVAL;
8986 }
8987
8988 rtnl_lock();
8989 if (!reg_is_valid_request(alpha2)) {
8990 r = -EINVAL;
8991 goto out;
8992 }
8993
8994 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8995 if (!rd) {
8996 r = -ENOMEM;
8997 goto out;
8998 }
8999
9000 rd->n_reg_rules = num_rules;
9001 rd->alpha2[0] = alpha2[0];
9002 rd->alpha2[1] = alpha2[1];
9003
9004 /*
9005 * Disable DFS master mode if the DFS region was
9006 * not supported or known on this kernel.
9007 */
9008 if (reg_supported_dfs_region(dfs_region))
9009 rd->dfs_region = dfs_region;
9010
9011 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9012 rem_reg_rules) {
9013 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
9014 nl_reg_rule, reg_rule_policy,
9015 info->extack);
9016 if (r)
9017 goto bad_reg;
9018 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
9019 if (r)
9020 goto bad_reg;
9021
9022 rule_idx++;
9023
9024 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
9025 r = -EINVAL;
9026 goto bad_reg;
9027 }
9028 }
9029
9030 r = set_regdom(rd, REGD_SOURCE_CRDA);
9031 /* set_regdom takes ownership of rd */
9032 rd = NULL;
9033 bad_reg:
9034 kfree(rd);
9035 out:
9036 rtnl_unlock();
9037 return r;
9038 }
9039 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
9040
validate_scan_freqs(struct nlattr * freqs)9041 static int validate_scan_freqs(struct nlattr *freqs)
9042 {
9043 struct nlattr *attr1, *attr2;
9044 int n_channels = 0, tmp1, tmp2;
9045
9046 nla_for_each_nested(attr1, freqs, tmp1)
9047 if (nla_len(attr1) != sizeof(u32))
9048 return 0;
9049
9050 nla_for_each_nested(attr1, freqs, tmp1) {
9051 n_channels++;
9052 /*
9053 * Some hardware has a limited channel list for
9054 * scanning, and it is pretty much nonsensical
9055 * to scan for a channel twice, so disallow that
9056 * and don't require drivers to check that the
9057 * channel list they get isn't longer than what
9058 * they can scan, as long as they can scan all
9059 * the channels they registered at once.
9060 */
9061 nla_for_each_nested(attr2, freqs, tmp2)
9062 if (attr1 != attr2 &&
9063 nla_get_u32(attr1) == nla_get_u32(attr2))
9064 return 0;
9065 }
9066
9067 return n_channels;
9068 }
9069
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)9070 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
9071 {
9072 return b < NUM_NL80211_BANDS && wiphy->bands[b];
9073 }
9074
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)9075 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
9076 struct cfg80211_bss_selection *bss_select)
9077 {
9078 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
9079 struct nlattr *nest;
9080 int err;
9081 bool found = false;
9082 int i;
9083
9084 /* only process one nested attribute */
9085 nest = nla_data(nla);
9086 if (!nla_ok(nest, nla_len(nest)))
9087 return -EINVAL;
9088
9089 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
9090 nest, nl80211_bss_select_policy,
9091 NULL);
9092 if (err)
9093 return err;
9094
9095 /* only one attribute may be given */
9096 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
9097 if (attr[i]) {
9098 if (found)
9099 return -EINVAL;
9100 found = true;
9101 }
9102 }
9103
9104 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
9105
9106 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
9107 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
9108
9109 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
9110 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
9111 bss_select->param.band_pref =
9112 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
9113 if (!is_band_valid(wiphy, bss_select->param.band_pref))
9114 return -EINVAL;
9115 }
9116
9117 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
9118 struct nl80211_bss_select_rssi_adjust *adj_param;
9119
9120 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
9121 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
9122 bss_select->param.adjust.band = adj_param->band;
9123 bss_select->param.adjust.delta = adj_param->delta;
9124 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
9125 return -EINVAL;
9126 }
9127
9128 /* user-space did not provide behaviour attribute */
9129 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
9130 return -EINVAL;
9131
9132 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
9133 return -EINVAL;
9134
9135 return 0;
9136 }
9137
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)9138 int nl80211_parse_random_mac(struct nlattr **attrs,
9139 u8 *mac_addr, u8 *mac_addr_mask)
9140 {
9141 int i;
9142
9143 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
9144 eth_zero_addr(mac_addr);
9145 eth_zero_addr(mac_addr_mask);
9146 mac_addr[0] = 0x2;
9147 mac_addr_mask[0] = 0x3;
9148
9149 return 0;
9150 }
9151
9152 /* need both or none */
9153 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
9154 return -EINVAL;
9155
9156 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
9157 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
9158
9159 /* don't allow or configure an mcast address */
9160 if (!is_multicast_ether_addr(mac_addr_mask) ||
9161 is_multicast_ether_addr(mac_addr))
9162 return -EINVAL;
9163
9164 /*
9165 * allow users to pass a MAC address that has bits set outside
9166 * of the mask, but don't bother drivers with having to deal
9167 * with such bits
9168 */
9169 for (i = 0; i < ETH_ALEN; i++)
9170 mac_addr[i] &= mac_addr_mask[i];
9171
9172 return 0;
9173 }
9174
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)9175 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
9176 struct ieee80211_channel *chan)
9177 {
9178 unsigned int link_id;
9179 bool all_ok = true;
9180
9181 lockdep_assert_wiphy(wdev->wiphy);
9182
9183 if (!cfg80211_beaconing_iface_active(wdev))
9184 return true;
9185
9186 /*
9187 * FIXME: check if we have a free HW resource/link for chan
9188 *
9189 * This, as well as the FIXME below, requires knowing the link
9190 * capabilities of the hardware.
9191 */
9192
9193 /* we cannot leave radar channels */
9194 for_each_valid_link(wdev, link_id) {
9195 struct cfg80211_chan_def *chandef;
9196
9197 chandef = wdev_chandef(wdev, link_id);
9198 if (!chandef || !chandef->chan)
9199 continue;
9200
9201 /*
9202 * FIXME: don't require all_ok, but rather check only the
9203 * correct HW resource/link onto which 'chan' falls,
9204 * as only that link leaves the channel for doing
9205 * the off-channel operation.
9206 */
9207
9208 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9209 all_ok = false;
9210 }
9211
9212 if (all_ok)
9213 return true;
9214
9215 return regulatory_pre_cac_allowed(wdev->wiphy);
9216 }
9217
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)9218 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9219 enum nl80211_ext_feature_index feat)
9220 {
9221 if (!(flags & flag))
9222 return true;
9223 if (wiphy_ext_feature_isset(wiphy, feat))
9224 return true;
9225 return false;
9226 }
9227
9228 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)9229 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9230 void *request, struct nlattr **attrs,
9231 bool is_sched_scan)
9232 {
9233 u8 *mac_addr, *mac_addr_mask;
9234 u32 *flags;
9235 enum nl80211_feature_flags randomness_flag;
9236
9237 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9238 return 0;
9239
9240 if (is_sched_scan) {
9241 struct cfg80211_sched_scan_request *req = request;
9242
9243 randomness_flag = wdev ?
9244 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9245 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9246 flags = &req->flags;
9247 mac_addr = req->mac_addr;
9248 mac_addr_mask = req->mac_addr_mask;
9249 } else {
9250 struct cfg80211_scan_request *req = request;
9251
9252 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9253 flags = &req->flags;
9254 mac_addr = req->mac_addr;
9255 mac_addr_mask = req->mac_addr_mask;
9256 }
9257
9258 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9259
9260 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9261 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9262 !nl80211_check_scan_feat(wiphy, *flags,
9263 NL80211_SCAN_FLAG_LOW_SPAN,
9264 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9265 !nl80211_check_scan_feat(wiphy, *flags,
9266 NL80211_SCAN_FLAG_LOW_POWER,
9267 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9268 !nl80211_check_scan_feat(wiphy, *flags,
9269 NL80211_SCAN_FLAG_HIGH_ACCURACY,
9270 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9271 !nl80211_check_scan_feat(wiphy, *flags,
9272 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9273 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9274 !nl80211_check_scan_feat(wiphy, *flags,
9275 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9276 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9277 !nl80211_check_scan_feat(wiphy, *flags,
9278 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9279 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9280 !nl80211_check_scan_feat(wiphy, *flags,
9281 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9282 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9283 !nl80211_check_scan_feat(wiphy, *flags,
9284 NL80211_SCAN_FLAG_RANDOM_SN,
9285 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9286 !nl80211_check_scan_feat(wiphy, *flags,
9287 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9288 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9289 return -EOPNOTSUPP;
9290
9291 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9292 int err;
9293
9294 if (!(wiphy->features & randomness_flag) ||
9295 (wdev && wdev->connected))
9296 return -EOPNOTSUPP;
9297
9298 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9299 if (err)
9300 return err;
9301 }
9302
9303 return 0;
9304 }
9305
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)9306 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9307 {
9308 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9309 struct wireless_dev *wdev = info->user_ptr[1];
9310 struct cfg80211_scan_request *request;
9311 struct nlattr *scan_freqs = NULL;
9312 bool scan_freqs_khz = false;
9313 struct nlattr *attr;
9314 struct wiphy *wiphy;
9315 int err, tmp, n_ssids = 0, n_channels, i;
9316 size_t ie_len, size;
9317 size_t ssids_offset, ie_offset;
9318
9319 wiphy = &rdev->wiphy;
9320
9321 if (wdev->iftype == NL80211_IFTYPE_NAN)
9322 return -EOPNOTSUPP;
9323
9324 if (!rdev->ops->scan)
9325 return -EOPNOTSUPP;
9326
9327 if (rdev->scan_req || rdev->scan_msg)
9328 return -EBUSY;
9329
9330 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9331 if (!wiphy_ext_feature_isset(wiphy,
9332 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9333 return -EOPNOTSUPP;
9334 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9335 scan_freqs_khz = true;
9336 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9337 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9338
9339 if (scan_freqs) {
9340 n_channels = validate_scan_freqs(scan_freqs);
9341 if (!n_channels)
9342 return -EINVAL;
9343 } else {
9344 n_channels = ieee80211_get_num_supported_channels(wiphy);
9345 }
9346
9347 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9348 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9349 n_ssids++;
9350
9351 if (n_ssids > wiphy->max_scan_ssids)
9352 return -EINVAL;
9353
9354 if (info->attrs[NL80211_ATTR_IE])
9355 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9356 else
9357 ie_len = 0;
9358
9359 if (ie_len > wiphy->max_scan_ie_len)
9360 return -EINVAL;
9361
9362 size = struct_size(request, channels, n_channels);
9363 ssids_offset = size;
9364 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9365 ie_offset = size;
9366 size = size_add(size, ie_len);
9367 request = kzalloc(size, GFP_KERNEL);
9368 if (!request)
9369 return -ENOMEM;
9370 request->n_channels = n_channels;
9371
9372 if (n_ssids)
9373 request->ssids = (void *)request + ssids_offset;
9374 request->n_ssids = n_ssids;
9375 if (ie_len)
9376 request->ie = (void *)request + ie_offset;
9377
9378 i = 0;
9379 if (scan_freqs) {
9380 /* user specified, bail out if channel not found */
9381 nla_for_each_nested(attr, scan_freqs, tmp) {
9382 struct ieee80211_channel *chan;
9383 int freq = nla_get_u32(attr);
9384
9385 if (!scan_freqs_khz)
9386 freq = MHZ_TO_KHZ(freq);
9387
9388 chan = ieee80211_get_channel_khz(wiphy, freq);
9389 if (!chan) {
9390 err = -EINVAL;
9391 goto out_free;
9392 }
9393
9394 /* ignore disabled channels */
9395 if (chan->flags & IEEE80211_CHAN_DISABLED)
9396 continue;
9397
9398 request->channels[i] = chan;
9399 i++;
9400 }
9401 } else {
9402 enum nl80211_band band;
9403
9404 /* all channels */
9405 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9406 int j;
9407
9408 if (!wiphy->bands[band])
9409 continue;
9410 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9411 struct ieee80211_channel *chan;
9412
9413 chan = &wiphy->bands[band]->channels[j];
9414
9415 if (chan->flags & IEEE80211_CHAN_DISABLED)
9416 continue;
9417
9418 request->channels[i] = chan;
9419 i++;
9420 }
9421 }
9422 }
9423
9424 if (!i) {
9425 err = -EINVAL;
9426 goto out_free;
9427 }
9428
9429 request->n_channels = i;
9430
9431 for (i = 0; i < request->n_channels; i++) {
9432 struct ieee80211_channel *chan = request->channels[i];
9433
9434 /* if we can go off-channel to the target channel we're good */
9435 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9436 continue;
9437
9438 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9439 err = -EBUSY;
9440 goto out_free;
9441 }
9442 }
9443
9444 i = 0;
9445 if (n_ssids) {
9446 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9447 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9448 err = -EINVAL;
9449 goto out_free;
9450 }
9451 request->ssids[i].ssid_len = nla_len(attr);
9452 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9453 i++;
9454 }
9455 }
9456
9457 if (info->attrs[NL80211_ATTR_IE]) {
9458 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9459 memcpy((void *)request->ie,
9460 nla_data(info->attrs[NL80211_ATTR_IE]),
9461 request->ie_len);
9462 }
9463
9464 for (i = 0; i < NUM_NL80211_BANDS; i++)
9465 if (wiphy->bands[i])
9466 request->rates[i] =
9467 (1 << wiphy->bands[i]->n_bitrates) - 1;
9468
9469 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9470 nla_for_each_nested(attr,
9471 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9472 tmp) {
9473 enum nl80211_band band = nla_type(attr);
9474
9475 if (band < 0 || band >= NUM_NL80211_BANDS) {
9476 err = -EINVAL;
9477 goto out_free;
9478 }
9479
9480 if (!wiphy->bands[band])
9481 continue;
9482
9483 err = ieee80211_get_ratemask(wiphy->bands[band],
9484 nla_data(attr),
9485 nla_len(attr),
9486 &request->rates[band]);
9487 if (err)
9488 goto out_free;
9489 }
9490 }
9491
9492 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9493 request->duration =
9494 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9495 request->duration_mandatory =
9496 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9497 }
9498
9499 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9500 false);
9501 if (err)
9502 goto out_free;
9503
9504 request->no_cck =
9505 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9506
9507 /* Initial implementation used NL80211_ATTR_MAC to set the specific
9508 * BSSID to scan for. This was problematic because that same attribute
9509 * was already used for another purpose (local random MAC address). The
9510 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9511 * compatibility with older userspace components, also use the
9512 * NL80211_ATTR_MAC value here if it can be determined to be used for
9513 * the specific BSSID use case instead of the random MAC address
9514 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9515 */
9516 if (info->attrs[NL80211_ATTR_BSSID])
9517 memcpy(request->bssid,
9518 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9519 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9520 info->attrs[NL80211_ATTR_MAC])
9521 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9522 ETH_ALEN);
9523 else
9524 eth_broadcast_addr(request->bssid);
9525
9526 request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs);
9527 request->wdev = wdev;
9528 request->wiphy = &rdev->wiphy;
9529 request->scan_start = jiffies;
9530
9531 rdev->scan_req = request;
9532 err = cfg80211_scan(rdev);
9533
9534 if (err)
9535 goto out_free;
9536
9537 nl80211_send_scan_start(rdev, wdev);
9538 dev_hold(wdev->netdev);
9539
9540 return 0;
9541
9542 out_free:
9543 rdev->scan_req = NULL;
9544 kfree(request);
9545
9546 return err;
9547 }
9548
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)9549 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9550 {
9551 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9552 struct wireless_dev *wdev = info->user_ptr[1];
9553
9554 if (!rdev->ops->abort_scan)
9555 return -EOPNOTSUPP;
9556
9557 if (rdev->scan_msg)
9558 return 0;
9559
9560 if (!rdev->scan_req)
9561 return -ENOENT;
9562
9563 rdev_abort_scan(rdev, wdev);
9564 return 0;
9565 }
9566
9567 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)9568 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9569 struct cfg80211_sched_scan_request *request,
9570 struct nlattr **attrs)
9571 {
9572 int tmp, err, i = 0;
9573 struct nlattr *attr;
9574
9575 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9576 u32 interval;
9577
9578 /*
9579 * If scan plans are not specified,
9580 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9581 * case one scan plan will be set with the specified scan
9582 * interval and infinite number of iterations.
9583 */
9584 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9585 if (!interval)
9586 return -EINVAL;
9587
9588 request->scan_plans[0].interval =
9589 DIV_ROUND_UP(interval, MSEC_PER_SEC);
9590 if (!request->scan_plans[0].interval)
9591 return -EINVAL;
9592
9593 if (request->scan_plans[0].interval >
9594 wiphy->max_sched_scan_plan_interval)
9595 request->scan_plans[0].interval =
9596 wiphy->max_sched_scan_plan_interval;
9597
9598 return 0;
9599 }
9600
9601 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9602 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9603
9604 if (WARN_ON(i >= n_plans))
9605 return -EINVAL;
9606
9607 err = nla_parse_nested_deprecated(plan,
9608 NL80211_SCHED_SCAN_PLAN_MAX,
9609 attr, nl80211_plan_policy,
9610 NULL);
9611 if (err)
9612 return err;
9613
9614 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9615 return -EINVAL;
9616
9617 request->scan_plans[i].interval =
9618 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9619 if (!request->scan_plans[i].interval ||
9620 request->scan_plans[i].interval >
9621 wiphy->max_sched_scan_plan_interval)
9622 return -EINVAL;
9623
9624 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9625 request->scan_plans[i].iterations =
9626 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9627 if (!request->scan_plans[i].iterations ||
9628 (request->scan_plans[i].iterations >
9629 wiphy->max_sched_scan_plan_iterations))
9630 return -EINVAL;
9631 } else if (i < n_plans - 1) {
9632 /*
9633 * All scan plans but the last one must specify
9634 * a finite number of iterations
9635 */
9636 return -EINVAL;
9637 }
9638
9639 i++;
9640 }
9641
9642 /*
9643 * The last scan plan must not specify the number of
9644 * iterations, it is supposed to run infinitely
9645 */
9646 if (request->scan_plans[n_plans - 1].iterations)
9647 return -EINVAL;
9648
9649 return 0;
9650 }
9651
9652 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)9653 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9654 struct nlattr **attrs, int max_match_sets)
9655 {
9656 struct cfg80211_sched_scan_request *request;
9657 struct nlattr *attr;
9658 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9659 enum nl80211_band band;
9660 size_t ie_len, size;
9661 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9662 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9663
9664 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9665 n_channels = validate_scan_freqs(
9666 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9667 if (!n_channels)
9668 return ERR_PTR(-EINVAL);
9669 } else {
9670 n_channels = ieee80211_get_num_supported_channels(wiphy);
9671 }
9672
9673 if (attrs[NL80211_ATTR_SCAN_SSIDS])
9674 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9675 tmp)
9676 n_ssids++;
9677
9678 if (n_ssids > wiphy->max_sched_scan_ssids)
9679 return ERR_PTR(-EINVAL);
9680
9681 /*
9682 * First, count the number of 'real' matchsets. Due to an issue with
9683 * the old implementation, matchsets containing only the RSSI attribute
9684 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9685 * RSSI for all matchsets, rather than their own matchset for reporting
9686 * all APs with a strong RSSI. This is needed to be compatible with
9687 * older userspace that treated a matchset with only the RSSI as the
9688 * global RSSI for all other matchsets - if there are other matchsets.
9689 */
9690 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9691 nla_for_each_nested(attr,
9692 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9693 tmp) {
9694 struct nlattr *rssi;
9695
9696 err = nla_parse_nested_deprecated(tb,
9697 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9698 attr,
9699 nl80211_match_policy,
9700 NULL);
9701 if (err)
9702 return ERR_PTR(err);
9703
9704 /* SSID and BSSID are mutually exclusive */
9705 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9706 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9707 return ERR_PTR(-EINVAL);
9708
9709 /* add other standalone attributes here */
9710 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9711 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9712 n_match_sets++;
9713 continue;
9714 }
9715 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9716 if (rssi)
9717 default_match_rssi = nla_get_s32(rssi);
9718 }
9719 }
9720
9721 /* However, if there's no other matchset, add the RSSI one */
9722 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9723 n_match_sets = 1;
9724
9725 if (n_match_sets > max_match_sets)
9726 return ERR_PTR(-EINVAL);
9727
9728 if (attrs[NL80211_ATTR_IE])
9729 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9730 else
9731 ie_len = 0;
9732
9733 if (ie_len > wiphy->max_sched_scan_ie_len)
9734 return ERR_PTR(-EINVAL);
9735
9736 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9737 /*
9738 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9739 * each scan plan already specifies its own interval
9740 */
9741 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9742 return ERR_PTR(-EINVAL);
9743
9744 nla_for_each_nested(attr,
9745 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9746 n_plans++;
9747 } else {
9748 /*
9749 * The scan interval attribute is kept for backward
9750 * compatibility. If no scan plans are specified and sched scan
9751 * interval is specified, one scan plan will be set with this
9752 * scan interval and infinite number of iterations.
9753 */
9754 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9755 return ERR_PTR(-EINVAL);
9756
9757 n_plans = 1;
9758 }
9759
9760 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9761 return ERR_PTR(-EINVAL);
9762
9763 if (!wiphy_ext_feature_isset(
9764 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9765 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9766 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9767 return ERR_PTR(-EINVAL);
9768
9769 size = struct_size(request, channels, n_channels);
9770 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9771 size = size_add(size, array_size(sizeof(*request->match_sets),
9772 n_match_sets));
9773 size = size_add(size, array_size(sizeof(*request->scan_plans),
9774 n_plans));
9775 size = size_add(size, ie_len);
9776 request = kzalloc(size, GFP_KERNEL);
9777 if (!request)
9778 return ERR_PTR(-ENOMEM);
9779
9780 if (n_ssids)
9781 request->ssids = (void *)request +
9782 struct_size(request, channels, n_channels);
9783 request->n_ssids = n_ssids;
9784 if (ie_len) {
9785 if (n_ssids)
9786 request->ie = (void *)(request->ssids + n_ssids);
9787 else
9788 request->ie = (void *)(request->channels + n_channels);
9789 }
9790
9791 if (n_match_sets) {
9792 if (request->ie)
9793 request->match_sets = (void *)(request->ie + ie_len);
9794 else if (n_ssids)
9795 request->match_sets =
9796 (void *)(request->ssids + n_ssids);
9797 else
9798 request->match_sets =
9799 (void *)(request->channels + n_channels);
9800 }
9801 request->n_match_sets = n_match_sets;
9802
9803 if (n_match_sets)
9804 request->scan_plans = (void *)(request->match_sets +
9805 n_match_sets);
9806 else if (request->ie)
9807 request->scan_plans = (void *)(request->ie + ie_len);
9808 else if (n_ssids)
9809 request->scan_plans = (void *)(request->ssids + n_ssids);
9810 else
9811 request->scan_plans = (void *)(request->channels + n_channels);
9812
9813 request->n_scan_plans = n_plans;
9814
9815 i = 0;
9816 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9817 /* user specified, bail out if channel not found */
9818 nla_for_each_nested(attr,
9819 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9820 tmp) {
9821 struct ieee80211_channel *chan;
9822
9823 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9824
9825 if (!chan) {
9826 err = -EINVAL;
9827 goto out_free;
9828 }
9829
9830 /* ignore disabled channels */
9831 if (chan->flags & IEEE80211_CHAN_DISABLED)
9832 continue;
9833
9834 request->channels[i] = chan;
9835 i++;
9836 }
9837 } else {
9838 /* all channels */
9839 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9840 int j;
9841
9842 if (!wiphy->bands[band])
9843 continue;
9844 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9845 struct ieee80211_channel *chan;
9846
9847 chan = &wiphy->bands[band]->channels[j];
9848
9849 if (chan->flags & IEEE80211_CHAN_DISABLED)
9850 continue;
9851
9852 request->channels[i] = chan;
9853 i++;
9854 }
9855 }
9856 }
9857
9858 if (!i) {
9859 err = -EINVAL;
9860 goto out_free;
9861 }
9862
9863 request->n_channels = i;
9864
9865 i = 0;
9866 if (n_ssids) {
9867 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9868 tmp) {
9869 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9870 err = -EINVAL;
9871 goto out_free;
9872 }
9873 request->ssids[i].ssid_len = nla_len(attr);
9874 memcpy(request->ssids[i].ssid, nla_data(attr),
9875 nla_len(attr));
9876 i++;
9877 }
9878 }
9879
9880 i = 0;
9881 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9882 nla_for_each_nested(attr,
9883 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9884 tmp) {
9885 struct nlattr *ssid, *bssid, *rssi;
9886
9887 err = nla_parse_nested_deprecated(tb,
9888 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9889 attr,
9890 nl80211_match_policy,
9891 NULL);
9892 if (err)
9893 goto out_free;
9894 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9895 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9896
9897 if (!ssid && !bssid) {
9898 i++;
9899 continue;
9900 }
9901
9902 if (WARN_ON(i >= n_match_sets)) {
9903 /* this indicates a programming error,
9904 * the loop above should have verified
9905 * things properly
9906 */
9907 err = -EINVAL;
9908 goto out_free;
9909 }
9910
9911 if (ssid) {
9912 memcpy(request->match_sets[i].ssid.ssid,
9913 nla_data(ssid), nla_len(ssid));
9914 request->match_sets[i].ssid.ssid_len =
9915 nla_len(ssid);
9916 }
9917 if (bssid)
9918 memcpy(request->match_sets[i].bssid,
9919 nla_data(bssid), ETH_ALEN);
9920
9921 /* special attribute - old implementation w/a */
9922 request->match_sets[i].rssi_thold = default_match_rssi;
9923 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9924 if (rssi)
9925 request->match_sets[i].rssi_thold =
9926 nla_get_s32(rssi);
9927 i++;
9928 }
9929
9930 /* there was no other matchset, so the RSSI one is alone */
9931 if (i == 0 && n_match_sets)
9932 request->match_sets[0].rssi_thold = default_match_rssi;
9933
9934 request->min_rssi_thold = INT_MAX;
9935 for (i = 0; i < n_match_sets; i++)
9936 request->min_rssi_thold =
9937 min(request->match_sets[i].rssi_thold,
9938 request->min_rssi_thold);
9939 } else {
9940 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9941 }
9942
9943 if (ie_len) {
9944 request->ie_len = ie_len;
9945 memcpy((void *)request->ie,
9946 nla_data(attrs[NL80211_ATTR_IE]),
9947 request->ie_len);
9948 }
9949
9950 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9951 if (err)
9952 goto out_free;
9953
9954 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9955 request->delay =
9956 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9957
9958 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9959 request->relative_rssi = nla_get_s8(
9960 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9961 request->relative_rssi_set = true;
9962 }
9963
9964 if (request->relative_rssi_set &&
9965 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9966 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9967
9968 rssi_adjust = nla_data(
9969 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9970 request->rssi_adjust.band = rssi_adjust->band;
9971 request->rssi_adjust.delta = rssi_adjust->delta;
9972 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9973 err = -EINVAL;
9974 goto out_free;
9975 }
9976 }
9977
9978 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9979 if (err)
9980 goto out_free;
9981
9982 request->scan_start = jiffies;
9983
9984 return request;
9985
9986 out_free:
9987 kfree(request);
9988 return ERR_PTR(err);
9989 }
9990
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)9991 static int nl80211_start_sched_scan(struct sk_buff *skb,
9992 struct genl_info *info)
9993 {
9994 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9995 struct net_device *dev = info->user_ptr[1];
9996 struct wireless_dev *wdev = dev->ieee80211_ptr;
9997 struct cfg80211_sched_scan_request *sched_scan_req;
9998 bool want_multi;
9999 int err;
10000
10001 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
10002 return -EOPNOTSUPP;
10003
10004 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
10005 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
10006 if (err)
10007 return err;
10008
10009 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
10010 info->attrs,
10011 rdev->wiphy.max_match_sets);
10012
10013 err = PTR_ERR_OR_ZERO(sched_scan_req);
10014 if (err)
10015 goto out_err;
10016
10017 /* leave request id zero for legacy request
10018 * or if driver does not support multi-scheduled scan
10019 */
10020 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
10021 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
10022
10023 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
10024 if (err)
10025 goto out_free;
10026
10027 sched_scan_req->dev = dev;
10028 sched_scan_req->wiphy = &rdev->wiphy;
10029
10030 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10031 sched_scan_req->owner_nlportid = info->snd_portid;
10032
10033 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
10034
10035 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
10036 return 0;
10037
10038 out_free:
10039 kfree(sched_scan_req);
10040 out_err:
10041 return err;
10042 }
10043
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)10044 static int nl80211_stop_sched_scan(struct sk_buff *skb,
10045 struct genl_info *info)
10046 {
10047 struct cfg80211_sched_scan_request *req;
10048 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10049 u64 cookie;
10050
10051 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
10052 return -EOPNOTSUPP;
10053
10054 if (info->attrs[NL80211_ATTR_COOKIE]) {
10055 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10056 return __cfg80211_stop_sched_scan(rdev, cookie, false);
10057 }
10058
10059 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
10060 struct cfg80211_sched_scan_request,
10061 list);
10062 if (!req || req->reqid ||
10063 (req->owner_nlportid &&
10064 req->owner_nlportid != info->snd_portid))
10065 return -ENOENT;
10066
10067 return cfg80211_stop_sched_scan_req(rdev, req, false);
10068 }
10069
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)10070 static int nl80211_start_radar_detection(struct sk_buff *skb,
10071 struct genl_info *info)
10072 {
10073 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10074 struct net_device *dev = info->user_ptr[1];
10075 struct wireless_dev *wdev = dev->ieee80211_ptr;
10076 int link_id = nl80211_link_id(info->attrs);
10077 struct wiphy *wiphy = wdev->wiphy;
10078 struct cfg80211_chan_def chandef;
10079 enum nl80211_dfs_regions dfs_region;
10080 unsigned int cac_time_ms;
10081 int err = -EINVAL;
10082
10083 flush_delayed_work(&rdev->dfs_update_channels_wk);
10084
10085 switch (wdev->iftype) {
10086 case NL80211_IFTYPE_AP:
10087 case NL80211_IFTYPE_P2P_GO:
10088 case NL80211_IFTYPE_MESH_POINT:
10089 case NL80211_IFTYPE_ADHOC:
10090 break;
10091 default:
10092 /* caution - see cfg80211_beaconing_iface_active() below */
10093 return -EINVAL;
10094 }
10095
10096 wiphy_lock(wiphy);
10097
10098 dfs_region = reg_get_dfs_region(wiphy);
10099 if (dfs_region == NL80211_DFS_UNSET)
10100 goto unlock;
10101
10102 err = nl80211_parse_chandef(rdev, info, &chandef);
10103 if (err)
10104 goto unlock;
10105
10106 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10107 if (err < 0)
10108 goto unlock;
10109
10110 if (err == 0) {
10111 err = -EINVAL;
10112 goto unlock;
10113 }
10114
10115 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
10116 err = -EINVAL;
10117 goto unlock;
10118 }
10119
10120 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
10121 err = cfg80211_start_background_radar_detection(rdev, wdev,
10122 &chandef);
10123 goto unlock;
10124 }
10125
10126 if (cfg80211_beaconing_iface_active(wdev)) {
10127 /* During MLO other link(s) can beacon, only the current link
10128 * can not already beacon
10129 */
10130 if (wdev->valid_links &&
10131 !wdev->links[link_id].ap.beacon_interval) {
10132 /* nothing */
10133 } else {
10134 err = -EBUSY;
10135 goto unlock;
10136 }
10137 }
10138
10139 if (wdev->links[link_id].cac_started) {
10140 err = -EBUSY;
10141 goto unlock;
10142 }
10143
10144 /* CAC start is offloaded to HW and can't be started manually */
10145 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
10146 err = -EOPNOTSUPP;
10147 goto unlock;
10148 }
10149
10150 if (!rdev->ops->start_radar_detection) {
10151 err = -EOPNOTSUPP;
10152 goto unlock;
10153 }
10154
10155 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
10156 if (WARN_ON(!cac_time_ms))
10157 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10158
10159 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
10160 link_id);
10161 if (!err) {
10162 switch (wdev->iftype) {
10163 case NL80211_IFTYPE_AP:
10164 case NL80211_IFTYPE_P2P_GO:
10165 wdev->links[0].ap.chandef = chandef;
10166 break;
10167 case NL80211_IFTYPE_ADHOC:
10168 wdev->u.ibss.chandef = chandef;
10169 break;
10170 case NL80211_IFTYPE_MESH_POINT:
10171 wdev->u.mesh.chandef = chandef;
10172 break;
10173 default:
10174 break;
10175 }
10176 wdev->links[link_id].cac_started = true;
10177 wdev->links[link_id].cac_start_time = jiffies;
10178 wdev->links[link_id].cac_time_ms = cac_time_ms;
10179 }
10180 unlock:
10181 wiphy_unlock(wiphy);
10182
10183 return err;
10184 }
10185
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)10186 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10187 struct genl_info *info)
10188 {
10189 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10190 struct net_device *dev = info->user_ptr[1];
10191 struct wireless_dev *wdev = dev->ieee80211_ptr;
10192 struct wiphy *wiphy = wdev->wiphy;
10193 struct cfg80211_chan_def chandef;
10194 enum nl80211_dfs_regions dfs_region;
10195 int err;
10196
10197 dfs_region = reg_get_dfs_region(wiphy);
10198 if (dfs_region == NL80211_DFS_UNSET) {
10199 GENL_SET_ERR_MSG(info,
10200 "DFS Region is not set. Unexpected Radar indication");
10201 return -EINVAL;
10202 }
10203
10204 err = nl80211_parse_chandef(rdev, info, &chandef);
10205 if (err) {
10206 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10207 return err;
10208 }
10209
10210 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10211 if (err < 0) {
10212 GENL_SET_ERR_MSG(info, "chandef is invalid");
10213 return err;
10214 }
10215
10216 if (err == 0) {
10217 GENL_SET_ERR_MSG(info,
10218 "Unexpected Radar indication for chandef/iftype");
10219 return -EINVAL;
10220 }
10221
10222 /* Do not process this notification if radar is already detected
10223 * by kernel on this channel, and return success.
10224 */
10225 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10226 return 0;
10227
10228 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10229
10230 cfg80211_sched_dfs_chan_update(rdev);
10231
10232 rdev->radar_chandef = chandef;
10233
10234 /* Propagate this notification to other radios as well */
10235 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10236
10237 return 0;
10238 }
10239
nl80211_parse_counter_offsets(struct cfg80211_registered_device * rdev,const u8 * data,size_t datalen,int first_count,struct nlattr * attr,const u16 ** offsets,unsigned int * n_offsets)10240 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
10241 const u8 *data, size_t datalen,
10242 int first_count, struct nlattr *attr,
10243 const u16 **offsets, unsigned int *n_offsets)
10244 {
10245 int i;
10246
10247 *n_offsets = 0;
10248
10249 if (!attr)
10250 return 0;
10251
10252 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
10253 return -EINVAL;
10254
10255 *n_offsets = nla_len(attr) / sizeof(u16);
10256 if (rdev->wiphy.max_num_csa_counters &&
10257 (*n_offsets > rdev->wiphy.max_num_csa_counters))
10258 return -EINVAL;
10259
10260 *offsets = nla_data(attr);
10261
10262 /* sanity checks - counters should fit and be the same */
10263 for (i = 0; i < *n_offsets; i++) {
10264 u16 offset = (*offsets)[i];
10265
10266 if (offset >= datalen)
10267 return -EINVAL;
10268
10269 if (first_count != -1 && data[offset] != first_count)
10270 return -EINVAL;
10271 }
10272
10273 return 0;
10274 }
10275
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)10276 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10277 {
10278 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10279 unsigned int link_id = nl80211_link_id(info->attrs);
10280 struct net_device *dev = info->user_ptr[1];
10281 struct wireless_dev *wdev = dev->ieee80211_ptr;
10282 struct cfg80211_csa_settings params;
10283 struct nlattr **csa_attrs = NULL;
10284 int err;
10285 bool need_new_beacon = false;
10286 bool need_handle_dfs_flag = true;
10287 u32 cs_count;
10288
10289 if (!rdev->ops->channel_switch ||
10290 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10291 return -EOPNOTSUPP;
10292
10293 switch (dev->ieee80211_ptr->iftype) {
10294 case NL80211_IFTYPE_AP:
10295 case NL80211_IFTYPE_P2P_GO:
10296 need_new_beacon = true;
10297 /* For all modes except AP the handle_dfs flag needs to be
10298 * supplied to tell the kernel that userspace will handle radar
10299 * events when they happen. Otherwise a switch to a channel
10300 * requiring DFS will be rejected.
10301 */
10302 need_handle_dfs_flag = false;
10303
10304 /* useless if AP is not running */
10305 if (!wdev->links[link_id].ap.beacon_interval)
10306 return -ENOTCONN;
10307 break;
10308 case NL80211_IFTYPE_ADHOC:
10309 if (!wdev->u.ibss.ssid_len)
10310 return -ENOTCONN;
10311 break;
10312 case NL80211_IFTYPE_MESH_POINT:
10313 if (!wdev->u.mesh.id_len)
10314 return -ENOTCONN;
10315 break;
10316 default:
10317 return -EOPNOTSUPP;
10318 }
10319
10320 memset(¶ms, 0, sizeof(params));
10321 params.beacon_csa.ftm_responder = -1;
10322
10323 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10324 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10325 return -EINVAL;
10326
10327 /* only important for AP, IBSS and mesh create IEs internally */
10328 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10329 return -EINVAL;
10330
10331 /* Even though the attribute is u32, the specification says
10332 * u8, so let's make sure we don't overflow.
10333 */
10334 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10335 if (cs_count > 255)
10336 return -EINVAL;
10337
10338 params.count = cs_count;
10339
10340 if (!need_new_beacon)
10341 goto skip_beacons;
10342
10343 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
10344 info->extack);
10345 if (err)
10346 goto free;
10347
10348 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10349 GFP_KERNEL);
10350 if (!csa_attrs) {
10351 err = -ENOMEM;
10352 goto free;
10353 }
10354
10355 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10356 info->attrs[NL80211_ATTR_CSA_IES],
10357 nl80211_policy, info->extack);
10358 if (err)
10359 goto free;
10360
10361 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
10362 info->extack);
10363 if (err)
10364 goto free;
10365
10366 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10367 err = -EINVAL;
10368 goto free;
10369 }
10370
10371 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
10372 params.beacon_csa.tail_len,
10373 params.count,
10374 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
10375 ¶ms.counter_offsets_beacon,
10376 ¶ms.n_counter_offsets_beacon);
10377 if (err)
10378 goto free;
10379
10380 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
10381 params.beacon_csa.probe_resp_len,
10382 params.count,
10383 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
10384 ¶ms.counter_offsets_presp,
10385 ¶ms.n_counter_offsets_presp);
10386 if (err)
10387 goto free;
10388
10389 skip_beacons:
10390 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
10391 if (err)
10392 goto free;
10393
10394 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
10395 wdev->iftype)) {
10396 err = -EINVAL;
10397 goto free;
10398 }
10399
10400 err = cfg80211_chandef_dfs_required(wdev->wiphy,
10401 ¶ms.chandef,
10402 wdev->iftype);
10403 if (err < 0)
10404 goto free;
10405
10406 if (err > 0) {
10407 params.radar_required = true;
10408 if (need_handle_dfs_flag &&
10409 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10410 err = -EINVAL;
10411 goto free;
10412 }
10413 }
10414
10415 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10416 params.block_tx = true;
10417
10418 params.link_id = link_id;
10419 err = rdev_channel_switch(rdev, dev, ¶ms);
10420
10421 free:
10422 kfree(params.beacon_after.mbssid_ies);
10423 kfree(params.beacon_csa.mbssid_ies);
10424 kfree(params.beacon_after.rnr_ies);
10425 kfree(params.beacon_csa.rnr_ies);
10426 kfree(csa_attrs);
10427 return err;
10428 }
10429
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)10430 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10431 u32 seq, int flags,
10432 struct cfg80211_registered_device *rdev,
10433 struct wireless_dev *wdev,
10434 struct cfg80211_internal_bss *intbss)
10435 {
10436 struct cfg80211_bss *res = &intbss->pub;
10437 const struct cfg80211_bss_ies *ies;
10438 unsigned int link_id;
10439 void *hdr;
10440 struct nlattr *bss;
10441
10442 lockdep_assert_wiphy(wdev->wiphy);
10443
10444 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10445 NL80211_CMD_NEW_SCAN_RESULTS);
10446 if (!hdr)
10447 return -1;
10448
10449 genl_dump_check_consistent(cb, hdr);
10450
10451 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10452 goto nla_put_failure;
10453 if (wdev->netdev &&
10454 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10455 goto nla_put_failure;
10456 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10457 NL80211_ATTR_PAD))
10458 goto nla_put_failure;
10459
10460 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10461 if (!bss)
10462 goto nla_put_failure;
10463 if ((!is_zero_ether_addr(res->bssid) &&
10464 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10465 goto nla_put_failure;
10466
10467 rcu_read_lock();
10468 /* indicate whether we have probe response data or not */
10469 if (rcu_access_pointer(res->proberesp_ies) &&
10470 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10471 goto fail_unlock_rcu;
10472
10473 /* this pointer prefers to be pointed to probe response data
10474 * but is always valid
10475 */
10476 ies = rcu_dereference(res->ies);
10477 if (ies) {
10478 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10479 NL80211_BSS_PAD))
10480 goto fail_unlock_rcu;
10481 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10482 ies->len, ies->data))
10483 goto fail_unlock_rcu;
10484 }
10485
10486 /* and this pointer is always (unless driver didn't know) beacon data */
10487 ies = rcu_dereference(res->beacon_ies);
10488 if (ies && ies->from_beacon) {
10489 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10490 NL80211_BSS_PAD))
10491 goto fail_unlock_rcu;
10492 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10493 ies->len, ies->data))
10494 goto fail_unlock_rcu;
10495 }
10496 rcu_read_unlock();
10497
10498 if (res->beacon_interval &&
10499 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10500 goto nla_put_failure;
10501 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10502 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10503 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10504 res->channel->freq_offset) ||
10505 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10506 jiffies_to_msecs(jiffies - intbss->ts)))
10507 goto nla_put_failure;
10508
10509 if (intbss->parent_tsf &&
10510 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10511 intbss->parent_tsf, NL80211_BSS_PAD) ||
10512 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10513 intbss->parent_bssid)))
10514 goto nla_put_failure;
10515
10516 if (intbss->ts_boottime &&
10517 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10518 intbss->ts_boottime, NL80211_BSS_PAD))
10519 goto nla_put_failure;
10520
10521 if (!nl80211_put_signal(msg, intbss->pub.chains,
10522 intbss->pub.chain_signal,
10523 NL80211_BSS_CHAIN_SIGNAL))
10524 goto nla_put_failure;
10525
10526 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
10527 switch (rdev->wiphy.signal_type) {
10528 case CFG80211_SIGNAL_TYPE_MBM:
10529 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
10530 res->signal))
10531 goto nla_put_failure;
10532 break;
10533 case CFG80211_SIGNAL_TYPE_UNSPEC:
10534 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
10535 res->signal))
10536 goto nla_put_failure;
10537 break;
10538 default:
10539 break;
10540 }
10541 }
10542
10543 switch (wdev->iftype) {
10544 case NL80211_IFTYPE_P2P_CLIENT:
10545 case NL80211_IFTYPE_STATION:
10546 for_each_valid_link(wdev, link_id) {
10547 if (intbss == wdev->links[link_id].client.current_bss &&
10548 (nla_put_u32(msg, NL80211_BSS_STATUS,
10549 NL80211_BSS_STATUS_ASSOCIATED) ||
10550 (wdev->valid_links &&
10551 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10552 link_id) ||
10553 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10554 wdev->u.client.connected_addr)))))
10555 goto nla_put_failure;
10556 }
10557 break;
10558 case NL80211_IFTYPE_ADHOC:
10559 if (intbss == wdev->u.ibss.current_bss &&
10560 nla_put_u32(msg, NL80211_BSS_STATUS,
10561 NL80211_BSS_STATUS_IBSS_JOINED))
10562 goto nla_put_failure;
10563 break;
10564 default:
10565 break;
10566 }
10567
10568 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
10569 goto nla_put_failure;
10570
10571 if (res->cannot_use_reasons &&
10572 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
10573 res->cannot_use_reasons,
10574 NL80211_BSS_PAD))
10575 goto nla_put_failure;
10576
10577 nla_nest_end(msg, bss);
10578
10579 genlmsg_end(msg, hdr);
10580 return 0;
10581
10582 fail_unlock_rcu:
10583 rcu_read_unlock();
10584 nla_put_failure:
10585 genlmsg_cancel(msg, hdr);
10586 return -EMSGSIZE;
10587 }
10588
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)10589 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10590 {
10591 struct cfg80211_registered_device *rdev;
10592 struct cfg80211_internal_bss *scan;
10593 struct wireless_dev *wdev;
10594 struct nlattr **attrbuf;
10595 int start = cb->args[2], idx = 0;
10596 bool dump_include_use_data;
10597 int err;
10598
10599 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10600 if (!attrbuf)
10601 return -ENOMEM;
10602
10603 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10604 if (err) {
10605 kfree(attrbuf);
10606 return err;
10607 }
10608 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10609 __acquire(&rdev->wiphy.mtx);
10610
10611 dump_include_use_data =
10612 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
10613 kfree(attrbuf);
10614
10615 spin_lock_bh(&rdev->bss_lock);
10616
10617 /*
10618 * dump_scan will be called multiple times to break up the scan results
10619 * into multiple messages. It is unlikely that any more bss-es will be
10620 * expired after the first call, so only call only call this on the
10621 * first dump_scan invocation.
10622 */
10623 if (start == 0)
10624 cfg80211_bss_expire(rdev);
10625
10626 cb->seq = rdev->bss_generation;
10627
10628 list_for_each_entry(scan, &rdev->bss_list, list) {
10629 if (++idx <= start)
10630 continue;
10631 if (!dump_include_use_data &&
10632 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
10633 continue;
10634 if (nl80211_send_bss(skb, cb,
10635 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10636 rdev, wdev, scan) < 0) {
10637 idx--;
10638 break;
10639 }
10640 }
10641
10642 spin_unlock_bh(&rdev->bss_lock);
10643
10644 cb->args[2] = idx;
10645 wiphy_unlock(&rdev->wiphy);
10646
10647 return skb->len;
10648 }
10649
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)10650 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10651 int flags, struct net_device *dev,
10652 bool allow_radio_stats,
10653 struct survey_info *survey)
10654 {
10655 void *hdr;
10656 struct nlattr *infoattr;
10657
10658 /* skip radio stats if userspace didn't request them */
10659 if (!survey->channel && !allow_radio_stats)
10660 return 0;
10661
10662 hdr = nl80211hdr_put(msg, portid, seq, flags,
10663 NL80211_CMD_NEW_SURVEY_RESULTS);
10664 if (!hdr)
10665 return -ENOMEM;
10666
10667 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10668 goto nla_put_failure;
10669
10670 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10671 if (!infoattr)
10672 goto nla_put_failure;
10673
10674 if (survey->channel &&
10675 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10676 survey->channel->center_freq))
10677 goto nla_put_failure;
10678
10679 if (survey->channel && survey->channel->freq_offset &&
10680 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10681 survey->channel->freq_offset))
10682 goto nla_put_failure;
10683
10684 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10685 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10686 goto nla_put_failure;
10687 if ((survey->filled & SURVEY_INFO_IN_USE) &&
10688 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10689 goto nla_put_failure;
10690 if ((survey->filled & SURVEY_INFO_TIME) &&
10691 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10692 survey->time, NL80211_SURVEY_INFO_PAD))
10693 goto nla_put_failure;
10694 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10695 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10696 survey->time_busy, NL80211_SURVEY_INFO_PAD))
10697 goto nla_put_failure;
10698 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10699 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10700 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10701 goto nla_put_failure;
10702 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10703 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10704 survey->time_rx, NL80211_SURVEY_INFO_PAD))
10705 goto nla_put_failure;
10706 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10707 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10708 survey->time_tx, NL80211_SURVEY_INFO_PAD))
10709 goto nla_put_failure;
10710 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10711 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10712 survey->time_scan, NL80211_SURVEY_INFO_PAD))
10713 goto nla_put_failure;
10714 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10715 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10716 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10717 goto nla_put_failure;
10718
10719 nla_nest_end(msg, infoattr);
10720
10721 genlmsg_end(msg, hdr);
10722 return 0;
10723
10724 nla_put_failure:
10725 genlmsg_cancel(msg, hdr);
10726 return -EMSGSIZE;
10727 }
10728
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)10729 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10730 {
10731 struct nlattr **attrbuf;
10732 struct survey_info survey;
10733 struct cfg80211_registered_device *rdev;
10734 struct wireless_dev *wdev;
10735 int survey_idx = cb->args[2];
10736 int res;
10737 bool radio_stats;
10738
10739 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10740 if (!attrbuf)
10741 return -ENOMEM;
10742
10743 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10744 if (res) {
10745 kfree(attrbuf);
10746 return res;
10747 }
10748 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10749 __acquire(&rdev->wiphy.mtx);
10750
10751 /* prepare_wdev_dump parsed the attributes */
10752 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10753
10754 if (!wdev->netdev) {
10755 res = -EINVAL;
10756 goto out_err;
10757 }
10758
10759 if (!rdev->ops->dump_survey) {
10760 res = -EOPNOTSUPP;
10761 goto out_err;
10762 }
10763
10764 while (1) {
10765 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10766 if (res == -ENOENT)
10767 break;
10768 if (res)
10769 goto out_err;
10770
10771 /* don't send disabled channels, but do send non-channel data */
10772 if (survey.channel &&
10773 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10774 survey_idx++;
10775 continue;
10776 }
10777
10778 if (nl80211_send_survey(skb,
10779 NETLINK_CB(cb->skb).portid,
10780 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10781 wdev->netdev, radio_stats, &survey) < 0)
10782 goto out;
10783 survey_idx++;
10784 }
10785
10786 out:
10787 cb->args[2] = survey_idx;
10788 res = skb->len;
10789 out_err:
10790 kfree(attrbuf);
10791 wiphy_unlock(&rdev->wiphy);
10792 return res;
10793 }
10794
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)10795 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10796 {
10797 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10798 struct net_device *dev = info->user_ptr[1];
10799 struct ieee80211_channel *chan;
10800 const u8 *bssid, *ssid;
10801 int err, ssid_len;
10802 enum nl80211_auth_type auth_type;
10803 struct key_parse key;
10804 bool local_state_change;
10805 struct cfg80211_auth_request req = {};
10806 u32 freq;
10807
10808 if (!info->attrs[NL80211_ATTR_MAC])
10809 return -EINVAL;
10810
10811 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10812 return -EINVAL;
10813
10814 if (!info->attrs[NL80211_ATTR_SSID])
10815 return -EINVAL;
10816
10817 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10818 return -EINVAL;
10819
10820 err = nl80211_parse_key(info, &key);
10821 if (err)
10822 return err;
10823
10824 if (key.idx >= 0) {
10825 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10826 return -EINVAL;
10827 if (!key.p.key || !key.p.key_len)
10828 return -EINVAL;
10829 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10830 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10831 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10832 key.p.key_len != WLAN_KEY_LEN_WEP104))
10833 return -EINVAL;
10834 if (key.idx > 3)
10835 return -EINVAL;
10836 } else {
10837 key.p.key_len = 0;
10838 key.p.key = NULL;
10839 }
10840
10841 if (key.idx >= 0) {
10842 int i;
10843 bool ok = false;
10844
10845 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10846 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10847 ok = true;
10848 break;
10849 }
10850 }
10851 if (!ok)
10852 return -EINVAL;
10853 }
10854
10855 if (!rdev->ops->auth)
10856 return -EOPNOTSUPP;
10857
10858 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10859 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10860 return -EOPNOTSUPP;
10861
10862 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10863 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10864 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10865 freq +=
10866 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10867
10868 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10869 if (!chan)
10870 return -EINVAL;
10871
10872 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10873 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10874
10875 if (info->attrs[NL80211_ATTR_IE]) {
10876 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10877 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10878 }
10879
10880 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10881 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10882 return -EINVAL;
10883
10884 if ((auth_type == NL80211_AUTHTYPE_SAE ||
10885 auth_type == NL80211_AUTHTYPE_FILS_SK ||
10886 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10887 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10888 !info->attrs[NL80211_ATTR_AUTH_DATA])
10889 return -EINVAL;
10890
10891 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10892 if (auth_type != NL80211_AUTHTYPE_SAE &&
10893 auth_type != NL80211_AUTHTYPE_FILS_SK &&
10894 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10895 auth_type != NL80211_AUTHTYPE_FILS_PK)
10896 return -EINVAL;
10897 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10898 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10899 }
10900
10901 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10902
10903 /*
10904 * Since we no longer track auth state, ignore
10905 * requests to only change local state.
10906 */
10907 if (local_state_change)
10908 return 0;
10909
10910 req.auth_type = auth_type;
10911 req.key = key.p.key;
10912 req.key_len = key.p.key_len;
10913 req.key_idx = key.idx;
10914 req.link_id = nl80211_link_id_or_invalid(info->attrs);
10915 if (req.link_id >= 0) {
10916 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10917 return -EINVAL;
10918 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10919 return -EINVAL;
10920 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10921 if (!is_valid_ether_addr(req.ap_mld_addr))
10922 return -EINVAL;
10923 }
10924
10925 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10926 IEEE80211_BSS_TYPE_ESS,
10927 IEEE80211_PRIVACY_ANY);
10928 if (!req.bss)
10929 return -ENOENT;
10930
10931 err = cfg80211_mlme_auth(rdev, dev, &req);
10932
10933 cfg80211_put_bss(&rdev->wiphy, req.bss);
10934
10935 return err;
10936 }
10937
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)10938 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10939 struct genl_info *info)
10940 {
10941 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10942 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10943 return -EINVAL;
10944 }
10945
10946 if (!rdev->ops->tx_control_port ||
10947 !wiphy_ext_feature_isset(&rdev->wiphy,
10948 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10949 return -EOPNOTSUPP;
10950
10951 return 0;
10952 }
10953
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)10954 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10955 struct genl_info *info,
10956 struct cfg80211_crypto_settings *settings,
10957 int cipher_limit)
10958 {
10959 memset(settings, 0, sizeof(*settings));
10960
10961 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10962
10963 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10964 u16 proto;
10965
10966 proto = nla_get_u16(
10967 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10968 settings->control_port_ethertype = cpu_to_be16(proto);
10969 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10970 proto != ETH_P_PAE)
10971 return -EINVAL;
10972 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10973 settings->control_port_no_encrypt = true;
10974 } else
10975 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10976
10977 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10978 int r = validate_pae_over_nl80211(rdev, info);
10979
10980 if (r < 0)
10981 return r;
10982
10983 settings->control_port_over_nl80211 = true;
10984
10985 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10986 settings->control_port_no_preauth = true;
10987 }
10988
10989 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10990 void *data;
10991 int len, i;
10992
10993 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10994 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10995 settings->n_ciphers_pairwise = len / sizeof(u32);
10996
10997 if (len % sizeof(u32))
10998 return -EINVAL;
10999
11000 if (settings->n_ciphers_pairwise > cipher_limit)
11001 return -EINVAL;
11002
11003 memcpy(settings->ciphers_pairwise, data, len);
11004
11005 for (i = 0; i < settings->n_ciphers_pairwise; i++)
11006 if (!cfg80211_supported_cipher_suite(
11007 &rdev->wiphy,
11008 settings->ciphers_pairwise[i]))
11009 return -EINVAL;
11010 }
11011
11012 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
11013 settings->cipher_group =
11014 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
11015 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
11016 settings->cipher_group))
11017 return -EINVAL;
11018 }
11019
11020 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
11021 settings->wpa_versions =
11022 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
11023
11024 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
11025 void *data;
11026 int len;
11027
11028 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
11029 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
11030 settings->n_akm_suites = len / sizeof(u32);
11031
11032 if (len % sizeof(u32))
11033 return -EINVAL;
11034
11035 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
11036 return -EINVAL;
11037
11038 memcpy(settings->akm_suites, data, len);
11039 }
11040
11041 if (info->attrs[NL80211_ATTR_PMK]) {
11042 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
11043 return -EINVAL;
11044 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11045 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
11046 !wiphy_ext_feature_isset(&rdev->wiphy,
11047 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
11048 return -EINVAL;
11049 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11050 }
11051
11052 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
11053 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11054 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
11055 !wiphy_ext_feature_isset(&rdev->wiphy,
11056 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
11057 return -EINVAL;
11058 settings->sae_pwd =
11059 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11060 settings->sae_pwd_len =
11061 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11062 }
11063
11064 if (info->attrs[NL80211_ATTR_SAE_PWE])
11065 settings->sae_pwe =
11066 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
11067 else
11068 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
11069
11070 return 0;
11071 }
11072
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs,int assoc_link_id,int link_id)11073 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
11074 const u8 *ssid, int ssid_len,
11075 struct nlattr **attrs,
11076 int assoc_link_id, int link_id)
11077 {
11078 struct ieee80211_channel *chan;
11079 struct cfg80211_bss *bss;
11080 const u8 *bssid;
11081 u32 freq, use_for = 0;
11082
11083 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
11084 return ERR_PTR(-EINVAL);
11085
11086 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
11087
11088 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
11089 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11090 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11091
11092 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11093 if (!chan)
11094 return ERR_PTR(-EINVAL);
11095
11096 if (assoc_link_id >= 0)
11097 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
11098 if (assoc_link_id == link_id)
11099 use_for |= NL80211_BSS_USE_FOR_NORMAL;
11100
11101 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
11102 ssid, ssid_len,
11103 IEEE80211_BSS_TYPE_ESS,
11104 IEEE80211_PRIVACY_ANY,
11105 use_for);
11106 if (!bss)
11107 return ERR_PTR(-ENOENT);
11108
11109 return bss;
11110 }
11111
nl80211_associate(struct sk_buff * skb,struct genl_info * info)11112 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
11113 {
11114 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11115 struct net_device *dev = info->user_ptr[1];
11116 struct cfg80211_assoc_request req = {};
11117 struct nlattr **attrs = NULL;
11118 const u8 *ap_addr, *ssid;
11119 unsigned int link_id;
11120 int err, ssid_len;
11121
11122 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11123 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11124 return -EPERM;
11125
11126 if (!info->attrs[NL80211_ATTR_SSID])
11127 return -EINVAL;
11128
11129 if (!rdev->ops->assoc)
11130 return -EOPNOTSUPP;
11131
11132 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11133 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11134 return -EOPNOTSUPP;
11135
11136 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11137 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11138
11139 if (info->attrs[NL80211_ATTR_IE]) {
11140 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11141 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11142
11143 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11144 req.ie, req.ie_len)) {
11145 NL_SET_ERR_MSG_ATTR(info->extack,
11146 info->attrs[NL80211_ATTR_IE],
11147 "non-inheritance makes no sense");
11148 return -EINVAL;
11149 }
11150 }
11151
11152 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11153 enum nl80211_mfp mfp =
11154 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11155 if (mfp == NL80211_MFP_REQUIRED)
11156 req.use_mfp = true;
11157 else if (mfp != NL80211_MFP_NO)
11158 return -EINVAL;
11159 }
11160
11161 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11162 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11163
11164 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11165 req.flags |= ASSOC_REQ_DISABLE_HT;
11166
11167 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11168 memcpy(&req.ht_capa_mask,
11169 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11170 sizeof(req.ht_capa_mask));
11171
11172 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11173 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11174 return -EINVAL;
11175 memcpy(&req.ht_capa,
11176 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11177 sizeof(req.ht_capa));
11178 }
11179
11180 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11181 req.flags |= ASSOC_REQ_DISABLE_VHT;
11182
11183 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11184 req.flags |= ASSOC_REQ_DISABLE_HE;
11185
11186 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11187 req.flags |= ASSOC_REQ_DISABLE_EHT;
11188
11189 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11190 memcpy(&req.vht_capa_mask,
11191 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11192 sizeof(req.vht_capa_mask));
11193
11194 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11195 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11196 return -EINVAL;
11197 memcpy(&req.vht_capa,
11198 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11199 sizeof(req.vht_capa));
11200 }
11201
11202 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11203 if (!((rdev->wiphy.features &
11204 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11205 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11206 !wiphy_ext_feature_isset(&rdev->wiphy,
11207 NL80211_EXT_FEATURE_RRM))
11208 return -EINVAL;
11209 req.flags |= ASSOC_REQ_USE_RRM;
11210 }
11211
11212 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11213 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11214 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11215 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11216 return -EINVAL;
11217 req.fils_nonces =
11218 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11219 }
11220
11221 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11222 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11223 return -EINVAL;
11224 memcpy(&req.s1g_capa_mask,
11225 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11226 sizeof(req.s1g_capa_mask));
11227 }
11228
11229 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11230 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11231 return -EINVAL;
11232 memcpy(&req.s1g_capa,
11233 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11234 sizeof(req.s1g_capa));
11235 }
11236
11237 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
11238 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11239 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
11240 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
11241 return -EINVAL;
11242 }
11243 req.flags |= ASSOC_REQ_SPP_AMSDU;
11244 }
11245
11246 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11247
11248 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11249 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11250 struct nlattr *link;
11251 int rem = 0;
11252
11253 if (req.link_id < 0)
11254 return -EINVAL;
11255
11256 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11257 return -EINVAL;
11258
11259 if (info->attrs[NL80211_ATTR_MAC] ||
11260 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11261 !info->attrs[NL80211_ATTR_MLD_ADDR])
11262 return -EINVAL;
11263
11264 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11265 ap_addr = req.ap_mld_addr;
11266
11267 attrs = kzalloc(attrsize, GFP_KERNEL);
11268 if (!attrs)
11269 return -ENOMEM;
11270
11271 nla_for_each_nested(link,
11272 info->attrs[NL80211_ATTR_MLO_LINKS],
11273 rem) {
11274 memset(attrs, 0, attrsize);
11275
11276 nla_parse_nested(attrs, NL80211_ATTR_MAX,
11277 link, NULL, NULL);
11278
11279 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11280 err = -EINVAL;
11281 NL_SET_BAD_ATTR(info->extack, link);
11282 goto free;
11283 }
11284
11285 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11286 /* cannot use the same link ID again */
11287 if (req.links[link_id].bss) {
11288 err = -EINVAL;
11289 NL_SET_BAD_ATTR(info->extack, link);
11290 goto free;
11291 }
11292 req.links[link_id].bss =
11293 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
11294 req.link_id, link_id);
11295 if (IS_ERR(req.links[link_id].bss)) {
11296 err = PTR_ERR(req.links[link_id].bss);
11297 req.links[link_id].bss = NULL;
11298 NL_SET_ERR_MSG_ATTR(info->extack,
11299 link, "Error fetching BSS for link");
11300 goto free;
11301 }
11302
11303 if (attrs[NL80211_ATTR_IE]) {
11304 req.links[link_id].elems =
11305 nla_data(attrs[NL80211_ATTR_IE]);
11306 req.links[link_id].elems_len =
11307 nla_len(attrs[NL80211_ATTR_IE]);
11308
11309 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11310 req.links[link_id].elems,
11311 req.links[link_id].elems_len)) {
11312 NL_SET_ERR_MSG_ATTR(info->extack,
11313 attrs[NL80211_ATTR_IE],
11314 "cannot deal with fragmentation");
11315 err = -EINVAL;
11316 goto free;
11317 }
11318
11319 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11320 req.links[link_id].elems,
11321 req.links[link_id].elems_len)) {
11322 NL_SET_ERR_MSG_ATTR(info->extack,
11323 attrs[NL80211_ATTR_IE],
11324 "cannot deal with non-inheritance");
11325 err = -EINVAL;
11326 goto free;
11327 }
11328 }
11329
11330 req.links[link_id].disabled =
11331 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11332 }
11333
11334 if (!req.links[req.link_id].bss) {
11335 err = -EINVAL;
11336 goto free;
11337 }
11338
11339 if (req.links[req.link_id].elems_len) {
11340 GENL_SET_ERR_MSG(info,
11341 "cannot have per-link elems on assoc link");
11342 err = -EINVAL;
11343 goto free;
11344 }
11345
11346 if (req.links[req.link_id].disabled) {
11347 GENL_SET_ERR_MSG(info,
11348 "cannot have assoc link disabled");
11349 err = -EINVAL;
11350 goto free;
11351 }
11352
11353 kfree(attrs);
11354 attrs = NULL;
11355 } else {
11356 if (req.link_id >= 0)
11357 return -EINVAL;
11358
11359 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
11360 -1, -1);
11361 if (IS_ERR(req.bss))
11362 return PTR_ERR(req.bss);
11363 ap_addr = req.bss->bssid;
11364 }
11365
11366 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11367 if (!err) {
11368 struct nlattr *link;
11369 int rem = 0;
11370
11371 err = cfg80211_mlme_assoc(rdev, dev, &req,
11372 info->extack);
11373
11374 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11375 dev->ieee80211_ptr->conn_owner_nlportid =
11376 info->snd_portid;
11377 memcpy(dev->ieee80211_ptr->disconnect_bssid,
11378 ap_addr, ETH_ALEN);
11379 }
11380
11381 /* Report error from first problematic link */
11382 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11383 nla_for_each_nested(link,
11384 info->attrs[NL80211_ATTR_MLO_LINKS],
11385 rem) {
11386 struct nlattr *link_id_attr =
11387 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
11388
11389 if (!link_id_attr)
11390 continue;
11391
11392 link_id = nla_get_u8(link_id_attr);
11393
11394 if (link_id == req.link_id)
11395 continue;
11396
11397 if (!req.links[link_id].error ||
11398 WARN_ON(req.links[link_id].error > 0))
11399 continue;
11400
11401 WARN_ON(err >= 0);
11402
11403 NL_SET_BAD_ATTR(info->extack, link);
11404 err = req.links[link_id].error;
11405 break;
11406 }
11407 }
11408 }
11409
11410 free:
11411 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11412 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11413 cfg80211_put_bss(&rdev->wiphy, req.bss);
11414 kfree(attrs);
11415
11416 return err;
11417 }
11418
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)11419 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11420 {
11421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11422 struct net_device *dev = info->user_ptr[1];
11423 const u8 *ie = NULL, *bssid;
11424 int ie_len = 0;
11425 u16 reason_code;
11426 bool local_state_change;
11427
11428 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11429 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11430 return -EPERM;
11431
11432 if (!info->attrs[NL80211_ATTR_MAC])
11433 return -EINVAL;
11434
11435 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11436 return -EINVAL;
11437
11438 if (!rdev->ops->deauth)
11439 return -EOPNOTSUPP;
11440
11441 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11442 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11443 return -EOPNOTSUPP;
11444
11445 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11446
11447 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11448 if (reason_code == 0) {
11449 /* Reason Code 0 is reserved */
11450 return -EINVAL;
11451 }
11452
11453 if (info->attrs[NL80211_ATTR_IE]) {
11454 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11455 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11456 }
11457
11458 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11459
11460 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11461 local_state_change);
11462 }
11463
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)11464 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11465 {
11466 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11467 struct net_device *dev = info->user_ptr[1];
11468 const u8 *ie = NULL, *bssid;
11469 int ie_len = 0;
11470 u16 reason_code;
11471 bool local_state_change;
11472
11473 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11474 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11475 return -EPERM;
11476
11477 if (!info->attrs[NL80211_ATTR_MAC])
11478 return -EINVAL;
11479
11480 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11481 return -EINVAL;
11482
11483 if (!rdev->ops->disassoc)
11484 return -EOPNOTSUPP;
11485
11486 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11487 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11488 return -EOPNOTSUPP;
11489
11490 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11491
11492 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11493 if (reason_code == 0) {
11494 /* Reason Code 0 is reserved */
11495 return -EINVAL;
11496 }
11497
11498 if (info->attrs[NL80211_ATTR_IE]) {
11499 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11500 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11501 }
11502
11503 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11504
11505 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11506 local_state_change);
11507 }
11508
11509 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)11510 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11511 int mcast_rate[NUM_NL80211_BANDS],
11512 int rateval)
11513 {
11514 struct wiphy *wiphy = &rdev->wiphy;
11515 bool found = false;
11516 int band, i;
11517
11518 for (band = 0; band < NUM_NL80211_BANDS; band++) {
11519 struct ieee80211_supported_band *sband;
11520
11521 sband = wiphy->bands[band];
11522 if (!sband)
11523 continue;
11524
11525 for (i = 0; i < sband->n_bitrates; i++) {
11526 if (sband->bitrates[i].bitrate == rateval) {
11527 mcast_rate[band] = i + 1;
11528 found = true;
11529 break;
11530 }
11531 }
11532 }
11533
11534 return found;
11535 }
11536
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)11537 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11538 {
11539 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11540 struct net_device *dev = info->user_ptr[1];
11541 struct cfg80211_ibss_params ibss;
11542 struct wiphy *wiphy;
11543 struct cfg80211_cached_keys *connkeys = NULL;
11544 int err;
11545
11546 memset(&ibss, 0, sizeof(ibss));
11547
11548 if (!info->attrs[NL80211_ATTR_SSID] ||
11549 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11550 return -EINVAL;
11551
11552 ibss.beacon_interval = 100;
11553
11554 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11555 ibss.beacon_interval =
11556 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11557
11558 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11559 ibss.beacon_interval);
11560 if (err)
11561 return err;
11562
11563 if (!rdev->ops->join_ibss)
11564 return -EOPNOTSUPP;
11565
11566 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11567 return -EOPNOTSUPP;
11568
11569 wiphy = &rdev->wiphy;
11570
11571 if (info->attrs[NL80211_ATTR_MAC]) {
11572 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11573
11574 if (!is_valid_ether_addr(ibss.bssid))
11575 return -EINVAL;
11576 }
11577 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11578 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11579
11580 if (info->attrs[NL80211_ATTR_IE]) {
11581 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11582 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11583 }
11584
11585 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11586 if (err)
11587 return err;
11588
11589 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11590 NL80211_IFTYPE_ADHOC))
11591 return -EINVAL;
11592
11593 switch (ibss.chandef.width) {
11594 case NL80211_CHAN_WIDTH_5:
11595 case NL80211_CHAN_WIDTH_10:
11596 case NL80211_CHAN_WIDTH_20_NOHT:
11597 break;
11598 case NL80211_CHAN_WIDTH_20:
11599 case NL80211_CHAN_WIDTH_40:
11600 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11601 return -EINVAL;
11602 break;
11603 case NL80211_CHAN_WIDTH_80:
11604 case NL80211_CHAN_WIDTH_80P80:
11605 case NL80211_CHAN_WIDTH_160:
11606 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11607 return -EINVAL;
11608 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11609 NL80211_EXT_FEATURE_VHT_IBSS))
11610 return -EINVAL;
11611 break;
11612 case NL80211_CHAN_WIDTH_320:
11613 return -EINVAL;
11614 default:
11615 return -EINVAL;
11616 }
11617
11618 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11619 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11620
11621 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11622 u8 *rates =
11623 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11624 int n_rates =
11625 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11626 struct ieee80211_supported_band *sband =
11627 wiphy->bands[ibss.chandef.chan->band];
11628
11629 err = ieee80211_get_ratemask(sband, rates, n_rates,
11630 &ibss.basic_rates);
11631 if (err)
11632 return err;
11633 }
11634
11635 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11636 memcpy(&ibss.ht_capa_mask,
11637 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11638 sizeof(ibss.ht_capa_mask));
11639
11640 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11641 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11642 return -EINVAL;
11643 memcpy(&ibss.ht_capa,
11644 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11645 sizeof(ibss.ht_capa));
11646 }
11647
11648 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11649 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11650 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11651 return -EINVAL;
11652
11653 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11654 bool no_ht = false;
11655
11656 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11657 if (IS_ERR(connkeys))
11658 return PTR_ERR(connkeys);
11659
11660 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11661 no_ht) {
11662 kfree_sensitive(connkeys);
11663 return -EINVAL;
11664 }
11665 }
11666
11667 ibss.control_port =
11668 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11669
11670 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11671 int r = validate_pae_over_nl80211(rdev, info);
11672
11673 if (r < 0) {
11674 kfree_sensitive(connkeys);
11675 return r;
11676 }
11677
11678 ibss.control_port_over_nl80211 = true;
11679 }
11680
11681 ibss.userspace_handles_dfs =
11682 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11683
11684 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11685 if (err)
11686 kfree_sensitive(connkeys);
11687 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11688 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11689
11690 return err;
11691 }
11692
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)11693 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11694 {
11695 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11696 struct net_device *dev = info->user_ptr[1];
11697
11698 if (!rdev->ops->leave_ibss)
11699 return -EOPNOTSUPP;
11700
11701 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11702 return -EOPNOTSUPP;
11703
11704 return cfg80211_leave_ibss(rdev, dev, false);
11705 }
11706
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)11707 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11708 {
11709 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11710 struct net_device *dev = info->user_ptr[1];
11711 int mcast_rate[NUM_NL80211_BANDS];
11712 u32 nla_rate;
11713
11714 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11715 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11716 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11717 return -EOPNOTSUPP;
11718
11719 if (!rdev->ops->set_mcast_rate)
11720 return -EOPNOTSUPP;
11721
11722 memset(mcast_rate, 0, sizeof(mcast_rate));
11723
11724 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11725 return -EINVAL;
11726
11727 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11728 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11729 return -EINVAL;
11730
11731 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11732 }
11733
11734 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)11735 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11736 struct wireless_dev *wdev, int approxlen,
11737 u32 portid, u32 seq, enum nl80211_commands cmd,
11738 enum nl80211_attrs attr,
11739 const struct nl80211_vendor_cmd_info *info,
11740 gfp_t gfp)
11741 {
11742 struct sk_buff *skb;
11743 void *hdr;
11744 struct nlattr *data;
11745
11746 skb = nlmsg_new(approxlen + 100, gfp);
11747 if (!skb)
11748 return NULL;
11749
11750 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11751 if (!hdr) {
11752 kfree_skb(skb);
11753 return NULL;
11754 }
11755
11756 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11757 goto nla_put_failure;
11758
11759 if (info) {
11760 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11761 info->vendor_id))
11762 goto nla_put_failure;
11763 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11764 info->subcmd))
11765 goto nla_put_failure;
11766 }
11767
11768 if (wdev) {
11769 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11770 wdev_id(wdev), NL80211_ATTR_PAD))
11771 goto nla_put_failure;
11772 if (wdev->netdev &&
11773 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11774 wdev->netdev->ifindex))
11775 goto nla_put_failure;
11776 }
11777
11778 data = nla_nest_start_noflag(skb, attr);
11779 if (!data)
11780 goto nla_put_failure;
11781
11782 ((void **)skb->cb)[0] = rdev;
11783 ((void **)skb->cb)[1] = hdr;
11784 ((void **)skb->cb)[2] = data;
11785
11786 return skb;
11787
11788 nla_put_failure:
11789 kfree_skb(skb);
11790 return NULL;
11791 }
11792
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)11793 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11794 struct wireless_dev *wdev,
11795 enum nl80211_commands cmd,
11796 enum nl80211_attrs attr,
11797 unsigned int portid,
11798 int vendor_event_idx,
11799 int approxlen, gfp_t gfp)
11800 {
11801 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11802 const struct nl80211_vendor_cmd_info *info;
11803
11804 switch (cmd) {
11805 case NL80211_CMD_TESTMODE:
11806 if (WARN_ON(vendor_event_idx != -1))
11807 return NULL;
11808 info = NULL;
11809 break;
11810 case NL80211_CMD_VENDOR:
11811 if (WARN_ON(vendor_event_idx < 0 ||
11812 vendor_event_idx >= wiphy->n_vendor_events))
11813 return NULL;
11814 info = &wiphy->vendor_events[vendor_event_idx];
11815 break;
11816 default:
11817 WARN_ON(1);
11818 return NULL;
11819 }
11820
11821 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11822 cmd, attr, info, gfp);
11823 }
11824 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11825
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)11826 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11827 {
11828 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11829 void *hdr = ((void **)skb->cb)[1];
11830 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11831 struct nlattr *data = ((void **)skb->cb)[2];
11832 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11833
11834 /* clear CB data for netlink core to own from now on */
11835 memset(skb->cb, 0, sizeof(skb->cb));
11836
11837 nla_nest_end(skb, data);
11838 genlmsg_end(skb, hdr);
11839
11840 if (nlhdr->nlmsg_pid) {
11841 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11842 nlhdr->nlmsg_pid);
11843 } else {
11844 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11845 mcgrp = NL80211_MCGRP_VENDOR;
11846
11847 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11848 skb, 0, mcgrp, gfp);
11849 }
11850 }
11851 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11852
11853 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)11854 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11855 {
11856 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11857 struct wireless_dev *wdev;
11858 int err;
11859
11860 lockdep_assert_held(&rdev->wiphy.mtx);
11861
11862 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11863 info->attrs);
11864
11865 if (!rdev->ops->testmode_cmd)
11866 return -EOPNOTSUPP;
11867
11868 if (IS_ERR(wdev)) {
11869 err = PTR_ERR(wdev);
11870 if (err != -EINVAL)
11871 return err;
11872 wdev = NULL;
11873 } else if (wdev->wiphy != &rdev->wiphy) {
11874 return -EINVAL;
11875 }
11876
11877 if (!info->attrs[NL80211_ATTR_TESTDATA])
11878 return -EINVAL;
11879
11880 rdev->cur_cmd_info = info;
11881 err = rdev_testmode_cmd(rdev, wdev,
11882 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11883 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11884 rdev->cur_cmd_info = NULL;
11885
11886 return err;
11887 }
11888
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)11889 static int nl80211_testmode_dump(struct sk_buff *skb,
11890 struct netlink_callback *cb)
11891 {
11892 struct cfg80211_registered_device *rdev;
11893 struct nlattr **attrbuf = NULL;
11894 int err;
11895 long phy_idx;
11896 void *data = NULL;
11897 int data_len = 0;
11898
11899 rtnl_lock();
11900
11901 if (cb->args[0]) {
11902 /*
11903 * 0 is a valid index, but not valid for args[0],
11904 * so we need to offset by 1.
11905 */
11906 phy_idx = cb->args[0] - 1;
11907
11908 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11909 if (!rdev) {
11910 err = -ENOENT;
11911 goto out_err;
11912 }
11913 } else {
11914 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11915 GFP_KERNEL);
11916 if (!attrbuf) {
11917 err = -ENOMEM;
11918 goto out_err;
11919 }
11920
11921 err = nlmsg_parse_deprecated(cb->nlh,
11922 GENL_HDRLEN + nl80211_fam.hdrsize,
11923 attrbuf, nl80211_fam.maxattr,
11924 nl80211_policy, NULL);
11925 if (err)
11926 goto out_err;
11927
11928 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11929 if (IS_ERR(rdev)) {
11930 err = PTR_ERR(rdev);
11931 goto out_err;
11932 }
11933 phy_idx = rdev->wiphy_idx;
11934
11935 if (attrbuf[NL80211_ATTR_TESTDATA])
11936 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11937 }
11938
11939 if (cb->args[1]) {
11940 data = nla_data((void *)cb->args[1]);
11941 data_len = nla_len((void *)cb->args[1]);
11942 }
11943
11944 if (!rdev->ops->testmode_dump) {
11945 err = -EOPNOTSUPP;
11946 goto out_err;
11947 }
11948
11949 while (1) {
11950 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11951 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11952 NL80211_CMD_TESTMODE);
11953 struct nlattr *tmdata;
11954
11955 if (!hdr)
11956 break;
11957
11958 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11959 genlmsg_cancel(skb, hdr);
11960 break;
11961 }
11962
11963 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11964 if (!tmdata) {
11965 genlmsg_cancel(skb, hdr);
11966 break;
11967 }
11968 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11969 nla_nest_end(skb, tmdata);
11970
11971 if (err == -ENOBUFS || err == -ENOENT) {
11972 genlmsg_cancel(skb, hdr);
11973 break;
11974 } else if (err) {
11975 genlmsg_cancel(skb, hdr);
11976 goto out_err;
11977 }
11978
11979 genlmsg_end(skb, hdr);
11980 }
11981
11982 err = skb->len;
11983 /* see above */
11984 cb->args[0] = phy_idx + 1;
11985 out_err:
11986 kfree(attrbuf);
11987 rtnl_unlock();
11988 return err;
11989 }
11990 #endif
11991
nl80211_connect(struct sk_buff * skb,struct genl_info * info)11992 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11993 {
11994 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11995 struct net_device *dev = info->user_ptr[1];
11996 struct cfg80211_connect_params connect;
11997 struct wiphy *wiphy;
11998 struct cfg80211_cached_keys *connkeys = NULL;
11999 u32 freq = 0;
12000 int err;
12001
12002 memset(&connect, 0, sizeof(connect));
12003
12004 if (!info->attrs[NL80211_ATTR_SSID] ||
12005 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12006 return -EINVAL;
12007
12008 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12009 connect.auth_type =
12010 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12011 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
12012 NL80211_CMD_CONNECT))
12013 return -EINVAL;
12014 } else
12015 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
12016
12017 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
12018
12019 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
12020 !wiphy_ext_feature_isset(&rdev->wiphy,
12021 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12022 return -EINVAL;
12023 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
12024
12025 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
12026 NL80211_MAX_NR_CIPHER_SUITES);
12027 if (err)
12028 return err;
12029
12030 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12031 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12032 return -EOPNOTSUPP;
12033
12034 wiphy = &rdev->wiphy;
12035
12036 connect.bg_scan_period = -1;
12037 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
12038 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
12039 connect.bg_scan_period =
12040 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
12041 }
12042
12043 if (info->attrs[NL80211_ATTR_MAC])
12044 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12045 else if (info->attrs[NL80211_ATTR_MAC_HINT])
12046 connect.bssid_hint =
12047 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
12048 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12049 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12050
12051 if (info->attrs[NL80211_ATTR_IE]) {
12052 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12053 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12054 }
12055
12056 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12057 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12058 if (connect.mfp == NL80211_MFP_OPTIONAL &&
12059 !wiphy_ext_feature_isset(&rdev->wiphy,
12060 NL80211_EXT_FEATURE_MFP_OPTIONAL))
12061 return -EOPNOTSUPP;
12062 } else {
12063 connect.mfp = NL80211_MFP_NO;
12064 }
12065
12066 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12067 connect.prev_bssid =
12068 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12069
12070 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
12071 freq = MHZ_TO_KHZ(nla_get_u32(
12072 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
12073 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12074 freq +=
12075 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12076
12077 if (freq) {
12078 connect.channel = nl80211_get_valid_chan(wiphy, freq);
12079 if (!connect.channel)
12080 return -EINVAL;
12081 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
12082 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
12083 freq = MHZ_TO_KHZ(freq);
12084 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
12085 if (!connect.channel_hint)
12086 return -EINVAL;
12087 }
12088
12089 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
12090 connect.edmg.channels =
12091 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
12092
12093 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
12094 connect.edmg.bw_config =
12095 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
12096 }
12097
12098 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12099 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
12100 if (IS_ERR(connkeys))
12101 return PTR_ERR(connkeys);
12102 }
12103
12104 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12105 connect.flags |= ASSOC_REQ_DISABLE_HT;
12106
12107 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12108 memcpy(&connect.ht_capa_mask,
12109 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12110 sizeof(connect.ht_capa_mask));
12111
12112 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12113 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
12114 kfree_sensitive(connkeys);
12115 return -EINVAL;
12116 }
12117 memcpy(&connect.ht_capa,
12118 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12119 sizeof(connect.ht_capa));
12120 }
12121
12122 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12123 connect.flags |= ASSOC_REQ_DISABLE_VHT;
12124
12125 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12126 connect.flags |= ASSOC_REQ_DISABLE_HE;
12127
12128 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12129 connect.flags |= ASSOC_REQ_DISABLE_EHT;
12130
12131 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12132 memcpy(&connect.vht_capa_mask,
12133 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12134 sizeof(connect.vht_capa_mask));
12135
12136 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12137 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
12138 kfree_sensitive(connkeys);
12139 return -EINVAL;
12140 }
12141 memcpy(&connect.vht_capa,
12142 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12143 sizeof(connect.vht_capa));
12144 }
12145
12146 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12147 if (!((rdev->wiphy.features &
12148 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12149 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12150 !wiphy_ext_feature_isset(&rdev->wiphy,
12151 NL80211_EXT_FEATURE_RRM)) {
12152 kfree_sensitive(connkeys);
12153 return -EINVAL;
12154 }
12155 connect.flags |= ASSOC_REQ_USE_RRM;
12156 }
12157
12158 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
12159 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
12160 kfree_sensitive(connkeys);
12161 return -EOPNOTSUPP;
12162 }
12163
12164 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
12165 /* bss selection makes no sense if bssid is set */
12166 if (connect.bssid) {
12167 kfree_sensitive(connkeys);
12168 return -EINVAL;
12169 }
12170
12171 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
12172 wiphy, &connect.bss_select);
12173 if (err) {
12174 kfree_sensitive(connkeys);
12175 return err;
12176 }
12177 }
12178
12179 if (wiphy_ext_feature_isset(&rdev->wiphy,
12180 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
12181 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12182 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12183 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12184 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12185 connect.fils_erp_username =
12186 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12187 connect.fils_erp_username_len =
12188 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12189 connect.fils_erp_realm =
12190 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12191 connect.fils_erp_realm_len =
12192 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12193 connect.fils_erp_next_seq_num =
12194 nla_get_u16(
12195 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12196 connect.fils_erp_rrk =
12197 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12198 connect.fils_erp_rrk_len =
12199 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12200 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12201 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12202 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12203 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12204 kfree_sensitive(connkeys);
12205 return -EINVAL;
12206 }
12207
12208 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12209 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12210 kfree_sensitive(connkeys);
12211 GENL_SET_ERR_MSG(info,
12212 "external auth requires connection ownership");
12213 return -EINVAL;
12214 }
12215 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12216 }
12217
12218 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12219 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12220
12221 err = cfg80211_connect(rdev, dev, &connect, connkeys,
12222 connect.prev_bssid);
12223 if (err)
12224 kfree_sensitive(connkeys);
12225
12226 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12227 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12228 if (connect.bssid)
12229 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12230 connect.bssid, ETH_ALEN);
12231 else
12232 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12233 }
12234
12235 return err;
12236 }
12237
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)12238 static int nl80211_update_connect_params(struct sk_buff *skb,
12239 struct genl_info *info)
12240 {
12241 struct cfg80211_connect_params connect = {};
12242 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12243 struct net_device *dev = info->user_ptr[1];
12244 struct wireless_dev *wdev = dev->ieee80211_ptr;
12245 bool fils_sk_offload;
12246 u32 auth_type;
12247 u32 changed = 0;
12248
12249 if (!rdev->ops->update_connect_params)
12250 return -EOPNOTSUPP;
12251
12252 if (info->attrs[NL80211_ATTR_IE]) {
12253 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12254 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12255 changed |= UPDATE_ASSOC_IES;
12256 }
12257
12258 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12259 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12260
12261 /*
12262 * when driver supports fils-sk offload all attributes must be
12263 * provided. So the else covers "fils-sk-not-all" and
12264 * "no-fils-sk-any".
12265 */
12266 if (fils_sk_offload &&
12267 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12268 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12269 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12270 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12271 connect.fils_erp_username =
12272 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12273 connect.fils_erp_username_len =
12274 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12275 connect.fils_erp_realm =
12276 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12277 connect.fils_erp_realm_len =
12278 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12279 connect.fils_erp_next_seq_num =
12280 nla_get_u16(
12281 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12282 connect.fils_erp_rrk =
12283 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12284 connect.fils_erp_rrk_len =
12285 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12286 changed |= UPDATE_FILS_ERP_INFO;
12287 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12288 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12289 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12290 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12291 return -EINVAL;
12292 }
12293
12294 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12295 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12296 if (!nl80211_valid_auth_type(rdev, auth_type,
12297 NL80211_CMD_CONNECT))
12298 return -EINVAL;
12299
12300 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12301 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12302 return -EINVAL;
12303
12304 connect.auth_type = auth_type;
12305 changed |= UPDATE_AUTH_TYPE;
12306 }
12307
12308 if (!wdev->connected)
12309 return -ENOLINK;
12310
12311 return rdev_update_connect_params(rdev, dev, &connect, changed);
12312 }
12313
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)12314 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12315 {
12316 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12317 struct net_device *dev = info->user_ptr[1];
12318 u16 reason;
12319
12320 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12321 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12322 return -EPERM;
12323
12324 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12325 reason = WLAN_REASON_DEAUTH_LEAVING;
12326 else
12327 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12328
12329 if (reason == 0)
12330 return -EINVAL;
12331
12332 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12333 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12334 return -EOPNOTSUPP;
12335
12336 return cfg80211_disconnect(rdev, dev, reason, true);
12337 }
12338
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)12339 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12340 {
12341 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12342 struct net *net;
12343 int err;
12344
12345 if (info->attrs[NL80211_ATTR_PID]) {
12346 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12347
12348 net = get_net_ns_by_pid(pid);
12349 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12350 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12351
12352 net = get_net_ns_by_fd(fd);
12353 } else {
12354 return -EINVAL;
12355 }
12356
12357 if (IS_ERR(net))
12358 return PTR_ERR(net);
12359
12360 err = 0;
12361
12362 /* check if anything to do */
12363 if (!net_eq(wiphy_net(&rdev->wiphy), net))
12364 err = cfg80211_switch_netns(rdev, net);
12365
12366 put_net(net);
12367 return err;
12368 }
12369
nl80211_set_pmksa(struct sk_buff * skb,struct genl_info * info)12370 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
12371 {
12372 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12373 struct net_device *dev = info->user_ptr[1];
12374 struct cfg80211_pmksa pmksa;
12375 bool ap_pmksa_caching_support = false;
12376
12377 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12378
12379 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12380 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12381
12382 if (!info->attrs[NL80211_ATTR_PMKID])
12383 return -EINVAL;
12384
12385 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12386
12387 if (info->attrs[NL80211_ATTR_MAC]) {
12388 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12389 } else if (info->attrs[NL80211_ATTR_SSID] &&
12390 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12391 info->attrs[NL80211_ATTR_PMK]) {
12392 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12393 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12394 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12395 } else {
12396 return -EINVAL;
12397 }
12398
12399 if (info->attrs[NL80211_ATTR_PMK]) {
12400 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12401 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12402 }
12403
12404 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12405 pmksa.pmk_lifetime =
12406 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12407
12408 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12409 pmksa.pmk_reauth_threshold =
12410 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12411
12412 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12413 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12414 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12415 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12416 ap_pmksa_caching_support))
12417 return -EOPNOTSUPP;
12418
12419 if (!rdev->ops->set_pmksa)
12420 return -EOPNOTSUPP;
12421
12422 return rdev_set_pmksa(rdev, dev, &pmksa);
12423 }
12424
nl80211_del_pmksa(struct sk_buff * skb,struct genl_info * info)12425 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
12426 {
12427 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12428 struct net_device *dev = info->user_ptr[1];
12429 struct cfg80211_pmksa pmksa;
12430 bool sae_offload_support = false;
12431 bool owe_offload_support = false;
12432 bool ap_pmksa_caching_support = false;
12433
12434 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12435
12436 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12437 NL80211_EXT_FEATURE_SAE_OFFLOAD);
12438 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12439 NL80211_EXT_FEATURE_OWE_OFFLOAD);
12440 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12441 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12442
12443 if (info->attrs[NL80211_ATTR_PMKID])
12444 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12445
12446 if (info->attrs[NL80211_ATTR_MAC]) {
12447 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12448 } else if (info->attrs[NL80211_ATTR_SSID]) {
12449 /* SSID based pmksa flush suppported only for FILS,
12450 * OWE/SAE OFFLOAD cases
12451 */
12452 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12453 info->attrs[NL80211_ATTR_PMK]) {
12454 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12455 } else if (!sae_offload_support && !owe_offload_support) {
12456 return -EINVAL;
12457 }
12458 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12459 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12460 } else {
12461 return -EINVAL;
12462 }
12463
12464 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12465 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12466 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12467 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12468 ap_pmksa_caching_support))
12469 return -EOPNOTSUPP;
12470
12471 if (!rdev->ops->del_pmksa)
12472 return -EOPNOTSUPP;
12473
12474 return rdev_del_pmksa(rdev, dev, &pmksa);
12475 }
12476
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)12477 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12478 {
12479 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12480 struct net_device *dev = info->user_ptr[1];
12481
12482 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12483 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12484 return -EOPNOTSUPP;
12485
12486 if (!rdev->ops->flush_pmksa)
12487 return -EOPNOTSUPP;
12488
12489 return rdev_flush_pmksa(rdev, dev);
12490 }
12491
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)12492 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12493 {
12494 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12495 struct net_device *dev = info->user_ptr[1];
12496 u8 action_code, dialog_token;
12497 u32 peer_capability = 0;
12498 u16 status_code;
12499 u8 *peer;
12500 int link_id;
12501 bool initiator;
12502
12503 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12504 !rdev->ops->tdls_mgmt)
12505 return -EOPNOTSUPP;
12506
12507 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12508 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12509 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12510 !info->attrs[NL80211_ATTR_IE] ||
12511 !info->attrs[NL80211_ATTR_MAC])
12512 return -EINVAL;
12513
12514 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12515 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12516 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12517 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12518 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12519 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12520 peer_capability =
12521 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12522 link_id = nl80211_link_id_or_invalid(info->attrs);
12523
12524 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12525 dialog_token, status_code, peer_capability,
12526 initiator,
12527 nla_data(info->attrs[NL80211_ATTR_IE]),
12528 nla_len(info->attrs[NL80211_ATTR_IE]));
12529 }
12530
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)12531 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12532 {
12533 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12534 struct net_device *dev = info->user_ptr[1];
12535 enum nl80211_tdls_operation operation;
12536 u8 *peer;
12537
12538 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12539 !rdev->ops->tdls_oper)
12540 return -EOPNOTSUPP;
12541
12542 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12543 !info->attrs[NL80211_ATTR_MAC])
12544 return -EINVAL;
12545
12546 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12547 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12548
12549 return rdev_tdls_oper(rdev, dev, peer, operation);
12550 }
12551
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12552 static int nl80211_remain_on_channel(struct sk_buff *skb,
12553 struct genl_info *info)
12554 {
12555 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12556 unsigned int link_id = nl80211_link_id(info->attrs);
12557 struct wireless_dev *wdev = info->user_ptr[1];
12558 struct cfg80211_chan_def chandef;
12559 struct sk_buff *msg;
12560 void *hdr;
12561 u64 cookie;
12562 u32 duration;
12563 int err;
12564
12565 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12566 !info->attrs[NL80211_ATTR_DURATION])
12567 return -EINVAL;
12568
12569 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12570
12571 if (!rdev->ops->remain_on_channel ||
12572 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12573 return -EOPNOTSUPP;
12574
12575 /*
12576 * We should be on that channel for at least a minimum amount of
12577 * time (10ms) but no longer than the driver supports.
12578 */
12579 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12580 duration > rdev->wiphy.max_remain_on_channel_duration)
12581 return -EINVAL;
12582
12583 err = nl80211_parse_chandef(rdev, info, &chandef);
12584 if (err)
12585 return err;
12586
12587 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12588 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12589
12590 oper_chandef = wdev_chandef(wdev, link_id);
12591
12592 if (WARN_ON(!oper_chandef)) {
12593 /* cannot happen since we must beacon to get here */
12594 WARN_ON(1);
12595 return -EBUSY;
12596 }
12597
12598 /* note: returns first one if identical chandefs */
12599 compat_chandef = cfg80211_chandef_compatible(&chandef,
12600 oper_chandef);
12601
12602 if (compat_chandef != &chandef)
12603 return -EBUSY;
12604 }
12605
12606 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12607 if (!msg)
12608 return -ENOMEM;
12609
12610 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12611 NL80211_CMD_REMAIN_ON_CHANNEL);
12612 if (!hdr) {
12613 err = -ENOBUFS;
12614 goto free_msg;
12615 }
12616
12617 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12618 duration, &cookie);
12619
12620 if (err)
12621 goto free_msg;
12622
12623 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12624 NL80211_ATTR_PAD))
12625 goto nla_put_failure;
12626
12627 genlmsg_end(msg, hdr);
12628
12629 return genlmsg_reply(msg, info);
12630
12631 nla_put_failure:
12632 err = -ENOBUFS;
12633 free_msg:
12634 nlmsg_free(msg);
12635 return err;
12636 }
12637
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12638 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12639 struct genl_info *info)
12640 {
12641 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12642 struct wireless_dev *wdev = info->user_ptr[1];
12643 u64 cookie;
12644
12645 if (!info->attrs[NL80211_ATTR_COOKIE])
12646 return -EINVAL;
12647
12648 if (!rdev->ops->cancel_remain_on_channel)
12649 return -EOPNOTSUPP;
12650
12651 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12652
12653 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12654 }
12655
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)12656 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12657 struct genl_info *info)
12658 {
12659 struct cfg80211_bitrate_mask mask;
12660 unsigned int link_id = nl80211_link_id(info->attrs);
12661 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12662 struct net_device *dev = info->user_ptr[1];
12663 int err;
12664
12665 if (!rdev->ops->set_bitrate_mask)
12666 return -EOPNOTSUPP;
12667
12668 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12669 NL80211_ATTR_TX_RATES, &mask,
12670 dev, true, link_id);
12671 if (err)
12672 return err;
12673
12674 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12675 }
12676
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)12677 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12678 {
12679 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12680 struct wireless_dev *wdev = info->user_ptr[1];
12681 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12682
12683 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12684 return -EINVAL;
12685
12686 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12687 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12688
12689 switch (wdev->iftype) {
12690 case NL80211_IFTYPE_STATION:
12691 case NL80211_IFTYPE_ADHOC:
12692 case NL80211_IFTYPE_P2P_CLIENT:
12693 case NL80211_IFTYPE_AP:
12694 case NL80211_IFTYPE_AP_VLAN:
12695 case NL80211_IFTYPE_MESH_POINT:
12696 case NL80211_IFTYPE_P2P_GO:
12697 case NL80211_IFTYPE_P2P_DEVICE:
12698 break;
12699 case NL80211_IFTYPE_NAN:
12700 if (!wiphy_ext_feature_isset(wdev->wiphy,
12701 NL80211_EXT_FEATURE_SECURE_NAN))
12702 return -EOPNOTSUPP;
12703 break;
12704 default:
12705 return -EOPNOTSUPP;
12706 }
12707
12708 /* not much point in registering if we can't reply */
12709 if (!rdev->ops->mgmt_tx)
12710 return -EOPNOTSUPP;
12711
12712 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12713 !wiphy_ext_feature_isset(&rdev->wiphy,
12714 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12715 GENL_SET_ERR_MSG(info,
12716 "multicast RX registrations are not supported");
12717 return -EOPNOTSUPP;
12718 }
12719
12720 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12721 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12722 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12723 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12724 info->extack);
12725 }
12726
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)12727 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12728 {
12729 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12730 struct wireless_dev *wdev = info->user_ptr[1];
12731 struct cfg80211_chan_def chandef;
12732 int err;
12733 void *hdr = NULL;
12734 u64 cookie;
12735 struct sk_buff *msg = NULL;
12736 struct cfg80211_mgmt_tx_params params = {
12737 .dont_wait_for_ack =
12738 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12739 };
12740
12741 if (!info->attrs[NL80211_ATTR_FRAME])
12742 return -EINVAL;
12743
12744 if (!rdev->ops->mgmt_tx)
12745 return -EOPNOTSUPP;
12746
12747 switch (wdev->iftype) {
12748 case NL80211_IFTYPE_P2P_DEVICE:
12749 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12750 return -EINVAL;
12751 break;
12752 case NL80211_IFTYPE_STATION:
12753 case NL80211_IFTYPE_ADHOC:
12754 case NL80211_IFTYPE_P2P_CLIENT:
12755 case NL80211_IFTYPE_AP:
12756 case NL80211_IFTYPE_AP_VLAN:
12757 case NL80211_IFTYPE_MESH_POINT:
12758 case NL80211_IFTYPE_P2P_GO:
12759 break;
12760 case NL80211_IFTYPE_NAN:
12761 if (!wiphy_ext_feature_isset(wdev->wiphy,
12762 NL80211_EXT_FEATURE_SECURE_NAN))
12763 return -EOPNOTSUPP;
12764 break;
12765 default:
12766 return -EOPNOTSUPP;
12767 }
12768
12769 if (info->attrs[NL80211_ATTR_DURATION]) {
12770 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12771 return -EINVAL;
12772 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12773
12774 /*
12775 * We should wait on the channel for at least a minimum amount
12776 * of time (10ms) but no longer than the driver supports.
12777 */
12778 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12779 params.wait > rdev->wiphy.max_remain_on_channel_duration)
12780 return -EINVAL;
12781 }
12782
12783 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12784
12785 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12786 return -EINVAL;
12787
12788 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12789
12790 /* get the channel if any has been specified, otherwise pass NULL to
12791 * the driver. The latter will use the current one
12792 */
12793 chandef.chan = NULL;
12794 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12795 err = nl80211_parse_chandef(rdev, info, &chandef);
12796 if (err)
12797 return err;
12798 }
12799
12800 if (!chandef.chan && params.offchan)
12801 return -EINVAL;
12802
12803 if (params.offchan &&
12804 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
12805 return -EBUSY;
12806
12807 params.link_id = nl80211_link_id_or_invalid(info->attrs);
12808 /*
12809 * This now races due to the unlock, but we cannot check
12810 * the valid links for the _station_ anyway, so that's up
12811 * to the driver.
12812 */
12813 if (params.link_id >= 0 &&
12814 !(wdev->valid_links & BIT(params.link_id)))
12815 return -EINVAL;
12816
12817 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12818 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12819
12820 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
12821 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
12822 ¶ms.csa_offsets,
12823 ¶ms.n_csa_offsets);
12824 if (err)
12825 return err;
12826
12827 if (!params.dont_wait_for_ack) {
12828 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12829 if (!msg)
12830 return -ENOMEM;
12831
12832 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12833 NL80211_CMD_FRAME);
12834 if (!hdr) {
12835 err = -ENOBUFS;
12836 goto free_msg;
12837 }
12838 }
12839
12840 params.chan = chandef.chan;
12841 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
12842 if (err)
12843 goto free_msg;
12844
12845 if (msg) {
12846 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12847 NL80211_ATTR_PAD))
12848 goto nla_put_failure;
12849
12850 genlmsg_end(msg, hdr);
12851 return genlmsg_reply(msg, info);
12852 }
12853
12854 return 0;
12855
12856 nla_put_failure:
12857 err = -ENOBUFS;
12858 free_msg:
12859 nlmsg_free(msg);
12860 return err;
12861 }
12862
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)12863 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12864 {
12865 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12866 struct wireless_dev *wdev = info->user_ptr[1];
12867 u64 cookie;
12868
12869 if (!info->attrs[NL80211_ATTR_COOKIE])
12870 return -EINVAL;
12871
12872 if (!rdev->ops->mgmt_tx_cancel_wait)
12873 return -EOPNOTSUPP;
12874
12875 switch (wdev->iftype) {
12876 case NL80211_IFTYPE_STATION:
12877 case NL80211_IFTYPE_ADHOC:
12878 case NL80211_IFTYPE_P2P_CLIENT:
12879 case NL80211_IFTYPE_AP:
12880 case NL80211_IFTYPE_AP_VLAN:
12881 case NL80211_IFTYPE_P2P_GO:
12882 case NL80211_IFTYPE_P2P_DEVICE:
12883 break;
12884 case NL80211_IFTYPE_NAN:
12885 if (!wiphy_ext_feature_isset(wdev->wiphy,
12886 NL80211_EXT_FEATURE_SECURE_NAN))
12887 return -EOPNOTSUPP;
12888 break;
12889 default:
12890 return -EOPNOTSUPP;
12891 }
12892
12893 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12894
12895 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12896 }
12897
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)12898 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12899 {
12900 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12901 struct wireless_dev *wdev;
12902 struct net_device *dev = info->user_ptr[1];
12903 u8 ps_state;
12904 bool state;
12905 int err;
12906
12907 if (!info->attrs[NL80211_ATTR_PS_STATE])
12908 return -EINVAL;
12909
12910 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12911
12912 wdev = dev->ieee80211_ptr;
12913
12914 if (!rdev->ops->set_power_mgmt)
12915 return -EOPNOTSUPP;
12916
12917 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12918
12919 if (state == wdev->ps)
12920 return 0;
12921
12922 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12923 if (!err)
12924 wdev->ps = state;
12925 return err;
12926 }
12927
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)12928 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12929 {
12930 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12931 enum nl80211_ps_state ps_state;
12932 struct wireless_dev *wdev;
12933 struct net_device *dev = info->user_ptr[1];
12934 struct sk_buff *msg;
12935 void *hdr;
12936 int err;
12937
12938 wdev = dev->ieee80211_ptr;
12939
12940 if (!rdev->ops->set_power_mgmt)
12941 return -EOPNOTSUPP;
12942
12943 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12944 if (!msg)
12945 return -ENOMEM;
12946
12947 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12948 NL80211_CMD_GET_POWER_SAVE);
12949 if (!hdr) {
12950 err = -ENOBUFS;
12951 goto free_msg;
12952 }
12953
12954 if (wdev->ps)
12955 ps_state = NL80211_PS_ENABLED;
12956 else
12957 ps_state = NL80211_PS_DISABLED;
12958
12959 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12960 goto nla_put_failure;
12961
12962 genlmsg_end(msg, hdr);
12963 return genlmsg_reply(msg, info);
12964
12965 nla_put_failure:
12966 err = -ENOBUFS;
12967 free_msg:
12968 nlmsg_free(msg);
12969 return err;
12970 }
12971
12972 static const struct nla_policy
12973 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12974 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12975 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12976 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12977 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12978 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12979 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12980 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12981 };
12982
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)12983 static int nl80211_set_cqm_txe(struct genl_info *info,
12984 u32 rate, u32 pkts, u32 intvl)
12985 {
12986 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12987 struct net_device *dev = info->user_ptr[1];
12988 struct wireless_dev *wdev = dev->ieee80211_ptr;
12989
12990 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12991 return -EINVAL;
12992
12993 if (!rdev->ops->set_cqm_txe_config)
12994 return -EOPNOTSUPP;
12995
12996 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12997 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12998 return -EOPNOTSUPP;
12999
13000 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
13001 }
13002
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)13003 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
13004 struct net_device *dev,
13005 struct cfg80211_cqm_config *cqm_config)
13006 {
13007 struct wireless_dev *wdev = dev->ieee80211_ptr;
13008 s32 last, low, high;
13009 u32 hyst;
13010 int i, n, low_index;
13011 int err;
13012
13013 /*
13014 * Obtain current RSSI value if possible, if not and no RSSI threshold
13015 * event has been received yet, we should receive an event after a
13016 * connection is established and enough beacons received to calculate
13017 * the average.
13018 */
13019 if (!cqm_config->last_rssi_event_value &&
13020 wdev->links[0].client.current_bss &&
13021 rdev->ops->get_station) {
13022 struct station_info sinfo = {};
13023 u8 *mac_addr;
13024
13025 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
13026
13027 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
13028 if (err)
13029 return err;
13030
13031 cfg80211_sinfo_release_content(&sinfo);
13032 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
13033 cqm_config->last_rssi_event_value =
13034 (s8) sinfo.rx_beacon_signal_avg;
13035 }
13036
13037 last = cqm_config->last_rssi_event_value;
13038 hyst = cqm_config->rssi_hyst;
13039 n = cqm_config->n_rssi_thresholds;
13040
13041 for (i = 0; i < n; i++) {
13042 i = array_index_nospec(i, n);
13043 if (last < cqm_config->rssi_thresholds[i])
13044 break;
13045 }
13046
13047 low_index = i - 1;
13048 if (low_index >= 0) {
13049 low_index = array_index_nospec(low_index, n);
13050 low = cqm_config->rssi_thresholds[low_index] - hyst;
13051 } else {
13052 low = S32_MIN;
13053 }
13054 if (i < n) {
13055 i = array_index_nospec(i, n);
13056 high = cqm_config->rssi_thresholds[i] + hyst - 1;
13057 } else {
13058 high = S32_MAX;
13059 }
13060
13061 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
13062 }
13063
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)13064 static int nl80211_set_cqm_rssi(struct genl_info *info,
13065 const s32 *thresholds, int n_thresholds,
13066 u32 hysteresis)
13067 {
13068 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13069 struct cfg80211_cqm_config *cqm_config = NULL, *old;
13070 struct net_device *dev = info->user_ptr[1];
13071 struct wireless_dev *wdev = dev->ieee80211_ptr;
13072 s32 prev = S32_MIN;
13073 int i, err;
13074
13075 /* Check all values negative and sorted */
13076 for (i = 0; i < n_thresholds; i++) {
13077 if (thresholds[i] > 0 || thresholds[i] <= prev)
13078 return -EINVAL;
13079
13080 prev = thresholds[i];
13081 }
13082
13083 if (wdev->iftype != NL80211_IFTYPE_STATION &&
13084 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13085 return -EOPNOTSUPP;
13086
13087 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
13088 n_thresholds = 0;
13089
13090 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
13091
13092 /* if already disabled just succeed */
13093 if (!n_thresholds && !old)
13094 return 0;
13095
13096 if (n_thresholds > 1) {
13097 if (!wiphy_ext_feature_isset(&rdev->wiphy,
13098 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
13099 !rdev->ops->set_cqm_rssi_range_config)
13100 return -EOPNOTSUPP;
13101 } else {
13102 if (!rdev->ops->set_cqm_rssi_config)
13103 return -EOPNOTSUPP;
13104 }
13105
13106 if (n_thresholds) {
13107 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
13108 n_thresholds),
13109 GFP_KERNEL);
13110 if (!cqm_config)
13111 return -ENOMEM;
13112
13113 cqm_config->rssi_hyst = hysteresis;
13114 cqm_config->n_rssi_thresholds = n_thresholds;
13115 memcpy(cqm_config->rssi_thresholds, thresholds,
13116 flex_array_size(cqm_config, rssi_thresholds,
13117 n_thresholds));
13118 cqm_config->use_range_api = n_thresholds > 1 ||
13119 !rdev->ops->set_cqm_rssi_config;
13120
13121 rcu_assign_pointer(wdev->cqm_config, cqm_config);
13122
13123 if (cqm_config->use_range_api)
13124 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
13125 else
13126 err = rdev_set_cqm_rssi_config(rdev, dev,
13127 thresholds[0],
13128 hysteresis);
13129 } else {
13130 RCU_INIT_POINTER(wdev->cqm_config, NULL);
13131 /* if enabled as range also disable via range */
13132 if (old->use_range_api)
13133 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
13134 else
13135 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
13136 }
13137
13138 if (err) {
13139 rcu_assign_pointer(wdev->cqm_config, old);
13140 kfree_rcu(cqm_config, rcu_head);
13141 } else {
13142 kfree_rcu(old, rcu_head);
13143 }
13144
13145 return err;
13146 }
13147
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)13148 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
13149 {
13150 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
13151 struct nlattr *cqm;
13152 int err;
13153
13154 cqm = info->attrs[NL80211_ATTR_CQM];
13155 if (!cqm)
13156 return -EINVAL;
13157
13158 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
13159 nl80211_attr_cqm_policy,
13160 info->extack);
13161 if (err)
13162 return err;
13163
13164 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
13165 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
13166 const s32 *thresholds =
13167 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13168 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13169 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
13170
13171 if (len % 4)
13172 return -EINVAL;
13173
13174 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
13175 hysteresis);
13176 }
13177
13178 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
13179 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
13180 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
13181 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
13182 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
13183 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
13184
13185 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
13186 }
13187
13188 return -EINVAL;
13189 }
13190
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)13191 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
13192 {
13193 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13194 struct net_device *dev = info->user_ptr[1];
13195 struct ocb_setup setup = {};
13196 int err;
13197
13198 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13199 if (err)
13200 return err;
13201
13202 return cfg80211_join_ocb(rdev, dev, &setup);
13203 }
13204
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)13205 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
13206 {
13207 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13208 struct net_device *dev = info->user_ptr[1];
13209
13210 return cfg80211_leave_ocb(rdev, dev);
13211 }
13212
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)13213 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
13214 {
13215 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13216 struct net_device *dev = info->user_ptr[1];
13217 struct mesh_config cfg;
13218 struct mesh_setup setup;
13219 int err;
13220
13221 /* start with default */
13222 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13223 memcpy(&setup, &default_mesh_setup, sizeof(setup));
13224
13225 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13226 /* and parse parameters if given */
13227 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13228 if (err)
13229 return err;
13230 }
13231
13232 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13233 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13234 return -EINVAL;
13235
13236 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13237 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13238
13239 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13240 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13241 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13242 return -EINVAL;
13243
13244 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13245 setup.beacon_interval =
13246 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13247
13248 err = cfg80211_validate_beacon_int(rdev,
13249 NL80211_IFTYPE_MESH_POINT,
13250 setup.beacon_interval);
13251 if (err)
13252 return err;
13253 }
13254
13255 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13256 setup.dtim_period =
13257 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13258 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13259 return -EINVAL;
13260 }
13261
13262 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13263 /* parse additional setup parameters if given */
13264 err = nl80211_parse_mesh_setup(info, &setup);
13265 if (err)
13266 return err;
13267 }
13268
13269 if (setup.user_mpm)
13270 cfg.auto_open_plinks = false;
13271
13272 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13273 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13274 if (err)
13275 return err;
13276 } else {
13277 /* __cfg80211_join_mesh() will sort it out */
13278 setup.chandef.chan = NULL;
13279 }
13280
13281 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13282 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13283 int n_rates =
13284 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13285 struct ieee80211_supported_band *sband;
13286
13287 if (!setup.chandef.chan)
13288 return -EINVAL;
13289
13290 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13291
13292 err = ieee80211_get_ratemask(sband, rates, n_rates,
13293 &setup.basic_rates);
13294 if (err)
13295 return err;
13296 }
13297
13298 if (info->attrs[NL80211_ATTR_TX_RATES]) {
13299 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13300 NL80211_ATTR_TX_RATES,
13301 &setup.beacon_rate,
13302 dev, false, 0);
13303 if (err)
13304 return err;
13305
13306 if (!setup.chandef.chan)
13307 return -EINVAL;
13308
13309 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13310 &setup.beacon_rate);
13311 if (err)
13312 return err;
13313 }
13314
13315 setup.userspace_handles_dfs =
13316 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13317
13318 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13319 int r = validate_pae_over_nl80211(rdev, info);
13320
13321 if (r < 0)
13322 return r;
13323
13324 setup.control_port_over_nl80211 = true;
13325 }
13326
13327 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13328 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13329 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13330
13331 return err;
13332 }
13333
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)13334 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13335 {
13336 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13337 struct net_device *dev = info->user_ptr[1];
13338
13339 return cfg80211_leave_mesh(rdev, dev);
13340 }
13341
13342 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13343 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13344 struct cfg80211_registered_device *rdev)
13345 {
13346 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13347 struct nlattr *nl_pats, *nl_pat;
13348 int i, pat_len;
13349
13350 if (!wowlan->n_patterns)
13351 return 0;
13352
13353 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13354 if (!nl_pats)
13355 return -ENOBUFS;
13356
13357 for (i = 0; i < wowlan->n_patterns; i++) {
13358 nl_pat = nla_nest_start_noflag(msg, i + 1);
13359 if (!nl_pat)
13360 return -ENOBUFS;
13361 pat_len = wowlan->patterns[i].pattern_len;
13362 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13363 wowlan->patterns[i].mask) ||
13364 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13365 wowlan->patterns[i].pattern) ||
13366 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13367 wowlan->patterns[i].pkt_offset))
13368 return -ENOBUFS;
13369 nla_nest_end(msg, nl_pat);
13370 }
13371 nla_nest_end(msg, nl_pats);
13372
13373 return 0;
13374 }
13375
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)13376 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13377 struct cfg80211_wowlan_tcp *tcp)
13378 {
13379 struct nlattr *nl_tcp;
13380
13381 if (!tcp)
13382 return 0;
13383
13384 nl_tcp = nla_nest_start_noflag(msg,
13385 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13386 if (!nl_tcp)
13387 return -ENOBUFS;
13388
13389 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13390 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13391 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13392 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13393 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13394 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13395 tcp->payload_len, tcp->payload) ||
13396 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13397 tcp->data_interval) ||
13398 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13399 tcp->wake_len, tcp->wake_data) ||
13400 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13401 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13402 return -ENOBUFS;
13403
13404 if (tcp->payload_seq.len &&
13405 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13406 sizeof(tcp->payload_seq), &tcp->payload_seq))
13407 return -ENOBUFS;
13408
13409 if (tcp->payload_tok.len &&
13410 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13411 sizeof(tcp->payload_tok) + tcp->tokens_size,
13412 &tcp->payload_tok))
13413 return -ENOBUFS;
13414
13415 nla_nest_end(msg, nl_tcp);
13416
13417 return 0;
13418 }
13419
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)13420 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13421 struct cfg80211_sched_scan_request *req)
13422 {
13423 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13424 int i;
13425
13426 if (!req)
13427 return 0;
13428
13429 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13430 if (!nd)
13431 return -ENOBUFS;
13432
13433 if (req->n_scan_plans == 1 &&
13434 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13435 req->scan_plans[0].interval * 1000))
13436 return -ENOBUFS;
13437
13438 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13439 return -ENOBUFS;
13440
13441 if (req->relative_rssi_set) {
13442 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13443
13444 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13445 req->relative_rssi))
13446 return -ENOBUFS;
13447
13448 rssi_adjust.band = req->rssi_adjust.band;
13449 rssi_adjust.delta = req->rssi_adjust.delta;
13450 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13451 sizeof(rssi_adjust), &rssi_adjust))
13452 return -ENOBUFS;
13453 }
13454
13455 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13456 if (!freqs)
13457 return -ENOBUFS;
13458
13459 for (i = 0; i < req->n_channels; i++) {
13460 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13461 return -ENOBUFS;
13462 }
13463
13464 nla_nest_end(msg, freqs);
13465
13466 if (req->n_match_sets) {
13467 matches = nla_nest_start_noflag(msg,
13468 NL80211_ATTR_SCHED_SCAN_MATCH);
13469 if (!matches)
13470 return -ENOBUFS;
13471
13472 for (i = 0; i < req->n_match_sets; i++) {
13473 match = nla_nest_start_noflag(msg, i);
13474 if (!match)
13475 return -ENOBUFS;
13476
13477 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13478 req->match_sets[i].ssid.ssid_len,
13479 req->match_sets[i].ssid.ssid))
13480 return -ENOBUFS;
13481 nla_nest_end(msg, match);
13482 }
13483 nla_nest_end(msg, matches);
13484 }
13485
13486 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13487 if (!scan_plans)
13488 return -ENOBUFS;
13489
13490 for (i = 0; i < req->n_scan_plans; i++) {
13491 scan_plan = nla_nest_start_noflag(msg, i + 1);
13492 if (!scan_plan)
13493 return -ENOBUFS;
13494
13495 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13496 req->scan_plans[i].interval) ||
13497 (req->scan_plans[i].iterations &&
13498 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13499 req->scan_plans[i].iterations)))
13500 return -ENOBUFS;
13501 nla_nest_end(msg, scan_plan);
13502 }
13503 nla_nest_end(msg, scan_plans);
13504
13505 nla_nest_end(msg, nd);
13506
13507 return 0;
13508 }
13509
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)13510 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13511 {
13512 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13513 struct sk_buff *msg;
13514 void *hdr;
13515 u32 size = NLMSG_DEFAULT_SIZE;
13516
13517 if (!rdev->wiphy.wowlan)
13518 return -EOPNOTSUPP;
13519
13520 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13521 /* adjust size to have room for all the data */
13522 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13523 rdev->wiphy.wowlan_config->tcp->payload_len +
13524 rdev->wiphy.wowlan_config->tcp->wake_len +
13525 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13526 }
13527
13528 msg = nlmsg_new(size, GFP_KERNEL);
13529 if (!msg)
13530 return -ENOMEM;
13531
13532 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13533 NL80211_CMD_GET_WOWLAN);
13534 if (!hdr)
13535 goto nla_put_failure;
13536
13537 if (rdev->wiphy.wowlan_config) {
13538 struct nlattr *nl_wowlan;
13539
13540 nl_wowlan = nla_nest_start_noflag(msg,
13541 NL80211_ATTR_WOWLAN_TRIGGERS);
13542 if (!nl_wowlan)
13543 goto nla_put_failure;
13544
13545 if ((rdev->wiphy.wowlan_config->any &&
13546 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13547 (rdev->wiphy.wowlan_config->disconnect &&
13548 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13549 (rdev->wiphy.wowlan_config->magic_pkt &&
13550 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13551 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13552 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13553 (rdev->wiphy.wowlan_config->eap_identity_req &&
13554 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13555 (rdev->wiphy.wowlan_config->four_way_handshake &&
13556 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13557 (rdev->wiphy.wowlan_config->rfkill_release &&
13558 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13559 goto nla_put_failure;
13560
13561 if (nl80211_send_wowlan_patterns(msg, rdev))
13562 goto nla_put_failure;
13563
13564 if (nl80211_send_wowlan_tcp(msg,
13565 rdev->wiphy.wowlan_config->tcp))
13566 goto nla_put_failure;
13567
13568 if (nl80211_send_wowlan_nd(
13569 msg,
13570 rdev->wiphy.wowlan_config->nd_config))
13571 goto nla_put_failure;
13572
13573 nla_nest_end(msg, nl_wowlan);
13574 }
13575
13576 genlmsg_end(msg, hdr);
13577 return genlmsg_reply(msg, info);
13578
13579 nla_put_failure:
13580 nlmsg_free(msg);
13581 return -ENOBUFS;
13582 }
13583
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)13584 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13585 struct nlattr *attr,
13586 struct cfg80211_wowlan *trig)
13587 {
13588 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13589 struct cfg80211_wowlan_tcp *cfg;
13590 struct nl80211_wowlan_tcp_data_token *tok = NULL;
13591 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13592 u32 size;
13593 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13594 int err, port;
13595
13596 if (!rdev->wiphy.wowlan->tcp)
13597 return -EINVAL;
13598
13599 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13600 nl80211_wowlan_tcp_policy, NULL);
13601 if (err)
13602 return err;
13603
13604 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13605 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13606 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13607 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13608 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13609 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13610 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13611 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13612 return -EINVAL;
13613
13614 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13615 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13616 return -EINVAL;
13617
13618 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13619 rdev->wiphy.wowlan->tcp->data_interval_max ||
13620 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13621 return -EINVAL;
13622
13623 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13624 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13625 return -EINVAL;
13626
13627 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13628 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13629 return -EINVAL;
13630
13631 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13632 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13633
13634 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13635 tokens_size = tokln - sizeof(*tok);
13636
13637 if (!tok->len || tokens_size % tok->len)
13638 return -EINVAL;
13639 if (!rdev->wiphy.wowlan->tcp->tok)
13640 return -EINVAL;
13641 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13642 return -EINVAL;
13643 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13644 return -EINVAL;
13645 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13646 return -EINVAL;
13647 if (tok->offset + tok->len > data_size)
13648 return -EINVAL;
13649 }
13650
13651 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13652 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13653 if (!rdev->wiphy.wowlan->tcp->seq)
13654 return -EINVAL;
13655 if (seq->len == 0 || seq->len > 4)
13656 return -EINVAL;
13657 if (seq->len + seq->offset > data_size)
13658 return -EINVAL;
13659 }
13660
13661 size = sizeof(*cfg);
13662 size += data_size;
13663 size += wake_size + wake_mask_size;
13664 size += tokens_size;
13665
13666 cfg = kzalloc(size, GFP_KERNEL);
13667 if (!cfg)
13668 return -ENOMEM;
13669 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13670 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13671 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13672 ETH_ALEN);
13673 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13674 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13675 else
13676 port = 0;
13677 #ifdef CONFIG_INET
13678 /* allocate a socket and port for it and use it */
13679 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13680 IPPROTO_TCP, &cfg->sock, 1);
13681 if (err) {
13682 kfree(cfg);
13683 return err;
13684 }
13685 if (inet_csk_get_port(cfg->sock->sk, port)) {
13686 sock_release(cfg->sock);
13687 kfree(cfg);
13688 return -EADDRINUSE;
13689 }
13690 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13691 #else
13692 if (!port) {
13693 kfree(cfg);
13694 return -EINVAL;
13695 }
13696 cfg->src_port = port;
13697 #endif
13698
13699 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13700 cfg->payload_len = data_size;
13701 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13702 memcpy((void *)cfg->payload,
13703 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13704 data_size);
13705 if (seq)
13706 cfg->payload_seq = *seq;
13707 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13708 cfg->wake_len = wake_size;
13709 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13710 memcpy((void *)cfg->wake_data,
13711 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13712 wake_size);
13713 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13714 data_size + wake_size;
13715 memcpy((void *)cfg->wake_mask,
13716 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13717 wake_mask_size);
13718 if (tok) {
13719 cfg->tokens_size = tokens_size;
13720 cfg->payload_tok = *tok;
13721 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13722 tokens_size);
13723 }
13724
13725 trig->tcp = cfg;
13726
13727 return 0;
13728 }
13729
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)13730 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13731 const struct wiphy_wowlan_support *wowlan,
13732 struct nlattr *attr,
13733 struct cfg80211_wowlan *trig)
13734 {
13735 struct nlattr **tb;
13736 int err;
13737
13738 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13739 if (!tb)
13740 return -ENOMEM;
13741
13742 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13743 err = -EOPNOTSUPP;
13744 goto out;
13745 }
13746
13747 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13748 nl80211_policy, NULL);
13749 if (err)
13750 goto out;
13751
13752 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13753 wowlan->max_nd_match_sets);
13754 err = PTR_ERR_OR_ZERO(trig->nd_config);
13755 if (err)
13756 trig->nd_config = NULL;
13757
13758 out:
13759 kfree(tb);
13760 return err;
13761 }
13762
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)13763 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13764 {
13765 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13766 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13767 struct cfg80211_wowlan new_triggers = {};
13768 struct cfg80211_wowlan *ntrig;
13769 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13770 int err, i;
13771 bool prev_enabled = rdev->wiphy.wowlan_config;
13772 bool regular = false;
13773
13774 if (!wowlan)
13775 return -EOPNOTSUPP;
13776
13777 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13778 cfg80211_rdev_free_wowlan(rdev);
13779 rdev->wiphy.wowlan_config = NULL;
13780 goto set_wakeup;
13781 }
13782
13783 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13784 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13785 nl80211_wowlan_policy, info->extack);
13786 if (err)
13787 return err;
13788
13789 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13790 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13791 return -EINVAL;
13792 new_triggers.any = true;
13793 }
13794
13795 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13796 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13797 return -EINVAL;
13798 new_triggers.disconnect = true;
13799 regular = true;
13800 }
13801
13802 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13803 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13804 return -EINVAL;
13805 new_triggers.magic_pkt = true;
13806 regular = true;
13807 }
13808
13809 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13810 return -EINVAL;
13811
13812 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13813 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13814 return -EINVAL;
13815 new_triggers.gtk_rekey_failure = true;
13816 regular = true;
13817 }
13818
13819 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13820 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13821 return -EINVAL;
13822 new_triggers.eap_identity_req = true;
13823 regular = true;
13824 }
13825
13826 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13827 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13828 return -EINVAL;
13829 new_triggers.four_way_handshake = true;
13830 regular = true;
13831 }
13832
13833 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13834 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13835 return -EINVAL;
13836 new_triggers.rfkill_release = true;
13837 regular = true;
13838 }
13839
13840 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13841 struct nlattr *pat;
13842 int n_patterns = 0;
13843 int rem, pat_len, mask_len, pkt_offset;
13844 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13845
13846 regular = true;
13847
13848 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13849 rem)
13850 n_patterns++;
13851 if (n_patterns > wowlan->n_patterns)
13852 return -EINVAL;
13853
13854 new_triggers.patterns = kcalloc(n_patterns,
13855 sizeof(new_triggers.patterns[0]),
13856 GFP_KERNEL);
13857 if (!new_triggers.patterns)
13858 return -ENOMEM;
13859
13860 new_triggers.n_patterns = n_patterns;
13861 i = 0;
13862
13863 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13864 rem) {
13865 u8 *mask_pat;
13866
13867 err = nla_parse_nested_deprecated(pat_tb,
13868 MAX_NL80211_PKTPAT,
13869 pat,
13870 nl80211_packet_pattern_policy,
13871 info->extack);
13872 if (err)
13873 goto error;
13874
13875 err = -EINVAL;
13876 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13877 !pat_tb[NL80211_PKTPAT_PATTERN])
13878 goto error;
13879 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13880 mask_len = DIV_ROUND_UP(pat_len, 8);
13881 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13882 goto error;
13883 if (pat_len > wowlan->pattern_max_len ||
13884 pat_len < wowlan->pattern_min_len)
13885 goto error;
13886
13887 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13888 pkt_offset = 0;
13889 else
13890 pkt_offset = nla_get_u32(
13891 pat_tb[NL80211_PKTPAT_OFFSET]);
13892 if (pkt_offset > wowlan->max_pkt_offset)
13893 goto error;
13894 new_triggers.patterns[i].pkt_offset = pkt_offset;
13895
13896 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13897 if (!mask_pat) {
13898 err = -ENOMEM;
13899 goto error;
13900 }
13901 new_triggers.patterns[i].mask = mask_pat;
13902 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13903 mask_len);
13904 mask_pat += mask_len;
13905 new_triggers.patterns[i].pattern = mask_pat;
13906 new_triggers.patterns[i].pattern_len = pat_len;
13907 memcpy(mask_pat,
13908 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13909 pat_len);
13910 i++;
13911 }
13912 }
13913
13914 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13915 regular = true;
13916 err = nl80211_parse_wowlan_tcp(
13917 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13918 &new_triggers);
13919 if (err)
13920 goto error;
13921 }
13922
13923 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13924 regular = true;
13925 err = nl80211_parse_wowlan_nd(
13926 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13927 &new_triggers);
13928 if (err)
13929 goto error;
13930 }
13931
13932 /* The 'any' trigger means the device continues operating more or less
13933 * as in its normal operation mode and wakes up the host on most of the
13934 * normal interrupts (like packet RX, ...)
13935 * It therefore makes little sense to combine with the more constrained
13936 * wakeup trigger modes.
13937 */
13938 if (new_triggers.any && regular) {
13939 err = -EINVAL;
13940 goto error;
13941 }
13942
13943 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13944 if (!ntrig) {
13945 err = -ENOMEM;
13946 goto error;
13947 }
13948 cfg80211_rdev_free_wowlan(rdev);
13949 rdev->wiphy.wowlan_config = ntrig;
13950
13951 set_wakeup:
13952 if (rdev->ops->set_wakeup &&
13953 prev_enabled != !!rdev->wiphy.wowlan_config)
13954 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13955
13956 return 0;
13957 error:
13958 for (i = 0; i < new_triggers.n_patterns; i++)
13959 kfree(new_triggers.patterns[i].mask);
13960 kfree(new_triggers.patterns);
13961 if (new_triggers.tcp && new_triggers.tcp->sock)
13962 sock_release(new_triggers.tcp->sock);
13963 kfree(new_triggers.tcp);
13964 kfree(new_triggers.nd_config);
13965 return err;
13966 }
13967 #endif
13968
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13969 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13970 struct cfg80211_registered_device *rdev)
13971 {
13972 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13973 int i, j, pat_len;
13974 struct cfg80211_coalesce_rules *rule;
13975
13976 if (!rdev->coalesce->n_rules)
13977 return 0;
13978
13979 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13980 if (!nl_rules)
13981 return -ENOBUFS;
13982
13983 for (i = 0; i < rdev->coalesce->n_rules; i++) {
13984 nl_rule = nla_nest_start_noflag(msg, i + 1);
13985 if (!nl_rule)
13986 return -ENOBUFS;
13987
13988 rule = &rdev->coalesce->rules[i];
13989 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13990 rule->delay))
13991 return -ENOBUFS;
13992
13993 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13994 rule->condition))
13995 return -ENOBUFS;
13996
13997 nl_pats = nla_nest_start_noflag(msg,
13998 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13999 if (!nl_pats)
14000 return -ENOBUFS;
14001
14002 for (j = 0; j < rule->n_patterns; j++) {
14003 nl_pat = nla_nest_start_noflag(msg, j + 1);
14004 if (!nl_pat)
14005 return -ENOBUFS;
14006 pat_len = rule->patterns[j].pattern_len;
14007 if (nla_put(msg, NL80211_PKTPAT_MASK,
14008 DIV_ROUND_UP(pat_len, 8),
14009 rule->patterns[j].mask) ||
14010 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14011 rule->patterns[j].pattern) ||
14012 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14013 rule->patterns[j].pkt_offset))
14014 return -ENOBUFS;
14015 nla_nest_end(msg, nl_pat);
14016 }
14017 nla_nest_end(msg, nl_pats);
14018 nla_nest_end(msg, nl_rule);
14019 }
14020 nla_nest_end(msg, nl_rules);
14021
14022 return 0;
14023 }
14024
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)14025 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
14026 {
14027 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14028 struct sk_buff *msg;
14029 void *hdr;
14030
14031 if (!rdev->wiphy.coalesce)
14032 return -EOPNOTSUPP;
14033
14034 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14035 if (!msg)
14036 return -ENOMEM;
14037
14038 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14039 NL80211_CMD_GET_COALESCE);
14040 if (!hdr)
14041 goto nla_put_failure;
14042
14043 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
14044 goto nla_put_failure;
14045
14046 genlmsg_end(msg, hdr);
14047 return genlmsg_reply(msg, info);
14048
14049 nla_put_failure:
14050 nlmsg_free(msg);
14051 return -ENOBUFS;
14052 }
14053
cfg80211_free_coalesce(struct cfg80211_coalesce * coalesce)14054 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
14055 {
14056 int i, j;
14057 struct cfg80211_coalesce_rules *rule;
14058
14059 if (!coalesce)
14060 return;
14061
14062 for (i = 0; i < coalesce->n_rules; i++) {
14063 rule = &coalesce->rules[i];
14064 if (!rule)
14065 continue;
14066 for (j = 0; j < rule->n_patterns; j++)
14067 kfree(rule->patterns[j].mask);
14068 kfree(rule->patterns);
14069 }
14070 kfree(coalesce);
14071 }
14072
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)14073 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
14074 struct nlattr *rule,
14075 struct cfg80211_coalesce_rules *new_rule)
14076 {
14077 int err, i;
14078 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14079 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
14080 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
14081 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14082
14083 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
14084 rule, nl80211_coalesce_policy, NULL);
14085 if (err)
14086 return err;
14087
14088 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
14089 new_rule->delay =
14090 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
14091 if (new_rule->delay > coalesce->max_delay)
14092 return -EINVAL;
14093
14094 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
14095 new_rule->condition =
14096 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
14097
14098 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
14099 return -EINVAL;
14100
14101 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14102 rem)
14103 n_patterns++;
14104 if (n_patterns > coalesce->n_patterns)
14105 return -EINVAL;
14106
14107 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
14108 GFP_KERNEL);
14109 if (!new_rule->patterns)
14110 return -ENOMEM;
14111
14112 new_rule->n_patterns = n_patterns;
14113 i = 0;
14114
14115 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14116 rem) {
14117 u8 *mask_pat;
14118
14119 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
14120 pat,
14121 nl80211_packet_pattern_policy,
14122 NULL);
14123 if (err)
14124 return err;
14125
14126 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14127 !pat_tb[NL80211_PKTPAT_PATTERN])
14128 return -EINVAL;
14129 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14130 mask_len = DIV_ROUND_UP(pat_len, 8);
14131 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14132 return -EINVAL;
14133 if (pat_len > coalesce->pattern_max_len ||
14134 pat_len < coalesce->pattern_min_len)
14135 return -EINVAL;
14136
14137 if (!pat_tb[NL80211_PKTPAT_OFFSET])
14138 pkt_offset = 0;
14139 else
14140 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
14141 if (pkt_offset > coalesce->max_pkt_offset)
14142 return -EINVAL;
14143 new_rule->patterns[i].pkt_offset = pkt_offset;
14144
14145 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14146 if (!mask_pat)
14147 return -ENOMEM;
14148
14149 new_rule->patterns[i].mask = mask_pat;
14150 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14151 mask_len);
14152
14153 mask_pat += mask_len;
14154 new_rule->patterns[i].pattern = mask_pat;
14155 new_rule->patterns[i].pattern_len = pat_len;
14156 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14157 pat_len);
14158 i++;
14159 }
14160
14161 return 0;
14162 }
14163
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)14164 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
14165 {
14166 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14167 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14168 struct cfg80211_coalesce *new_coalesce;
14169 int err, rem_rule, n_rules = 0, i;
14170 struct nlattr *rule;
14171
14172 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
14173 return -EOPNOTSUPP;
14174
14175 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
14176 cfg80211_free_coalesce(rdev->coalesce);
14177 rdev->coalesce = NULL;
14178 rdev_set_coalesce(rdev, NULL);
14179 return 0;
14180 }
14181
14182 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14183 rem_rule)
14184 n_rules++;
14185 if (n_rules > coalesce->n_rules)
14186 return -EINVAL;
14187
14188 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
14189 GFP_KERNEL);
14190 if (!new_coalesce)
14191 return -ENOMEM;
14192
14193 new_coalesce->n_rules = n_rules;
14194 i = 0;
14195
14196 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14197 rem_rule) {
14198 err = nl80211_parse_coalesce_rule(rdev, rule,
14199 &new_coalesce->rules[i]);
14200 if (err)
14201 goto error;
14202
14203 i++;
14204 }
14205
14206 err = rdev_set_coalesce(rdev, new_coalesce);
14207 if (err)
14208 goto error;
14209
14210 cfg80211_free_coalesce(rdev->coalesce);
14211 rdev->coalesce = new_coalesce;
14212
14213 return 0;
14214 error:
14215 cfg80211_free_coalesce(new_coalesce);
14216
14217 return err;
14218 }
14219
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)14220 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14221 {
14222 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14223 struct net_device *dev = info->user_ptr[1];
14224 struct wireless_dev *wdev = dev->ieee80211_ptr;
14225 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14226 struct cfg80211_gtk_rekey_data rekey_data = {};
14227 int err;
14228
14229 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14230 return -EINVAL;
14231
14232 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14233 info->attrs[NL80211_ATTR_REKEY_DATA],
14234 nl80211_rekey_policy, info->extack);
14235 if (err)
14236 return err;
14237
14238 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14239 !tb[NL80211_REKEY_DATA_KCK])
14240 return -EINVAL;
14241 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14242 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14243 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14244 return -ERANGE;
14245 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14246 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14247 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14248 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14249 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14250 return -ERANGE;
14251
14252 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14253 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14254 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14255 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14256 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14257 if (tb[NL80211_REKEY_DATA_AKM])
14258 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14259
14260 if (!wdev->connected)
14261 return -ENOTCONN;
14262
14263 if (!rdev->ops->set_rekey_data)
14264 return -EOPNOTSUPP;
14265
14266 return rdev_set_rekey_data(rdev, dev, &rekey_data);
14267 }
14268
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)14269 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14270 struct genl_info *info)
14271 {
14272 struct net_device *dev = info->user_ptr[1];
14273 struct wireless_dev *wdev = dev->ieee80211_ptr;
14274
14275 if (wdev->iftype != NL80211_IFTYPE_AP &&
14276 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14277 return -EINVAL;
14278
14279 if (wdev->ap_unexpected_nlportid)
14280 return -EBUSY;
14281
14282 wdev->ap_unexpected_nlportid = info->snd_portid;
14283 return 0;
14284 }
14285
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)14286 static int nl80211_probe_client(struct sk_buff *skb,
14287 struct genl_info *info)
14288 {
14289 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14290 struct net_device *dev = info->user_ptr[1];
14291 struct wireless_dev *wdev = dev->ieee80211_ptr;
14292 struct sk_buff *msg;
14293 void *hdr;
14294 const u8 *addr;
14295 u64 cookie;
14296 int err;
14297
14298 if (wdev->iftype != NL80211_IFTYPE_AP &&
14299 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14300 return -EOPNOTSUPP;
14301
14302 if (!info->attrs[NL80211_ATTR_MAC])
14303 return -EINVAL;
14304
14305 if (!rdev->ops->probe_client)
14306 return -EOPNOTSUPP;
14307
14308 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14309 if (!msg)
14310 return -ENOMEM;
14311
14312 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14313 NL80211_CMD_PROBE_CLIENT);
14314 if (!hdr) {
14315 err = -ENOBUFS;
14316 goto free_msg;
14317 }
14318
14319 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14320
14321 err = rdev_probe_client(rdev, dev, addr, &cookie);
14322 if (err)
14323 goto free_msg;
14324
14325 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14326 NL80211_ATTR_PAD))
14327 goto nla_put_failure;
14328
14329 genlmsg_end(msg, hdr);
14330
14331 return genlmsg_reply(msg, info);
14332
14333 nla_put_failure:
14334 err = -ENOBUFS;
14335 free_msg:
14336 nlmsg_free(msg);
14337 return err;
14338 }
14339
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)14340 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14341 {
14342 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14343 struct cfg80211_beacon_registration *reg, *nreg;
14344 int rv;
14345
14346 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14347 return -EOPNOTSUPP;
14348
14349 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14350 if (!nreg)
14351 return -ENOMEM;
14352
14353 /* First, check if already registered. */
14354 spin_lock_bh(&rdev->beacon_registrations_lock);
14355 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14356 if (reg->nlportid == info->snd_portid) {
14357 rv = -EALREADY;
14358 goto out_err;
14359 }
14360 }
14361 /* Add it to the list */
14362 nreg->nlportid = info->snd_portid;
14363 list_add(&nreg->list, &rdev->beacon_registrations);
14364
14365 spin_unlock_bh(&rdev->beacon_registrations_lock);
14366
14367 return 0;
14368 out_err:
14369 spin_unlock_bh(&rdev->beacon_registrations_lock);
14370 kfree(nreg);
14371 return rv;
14372 }
14373
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)14374 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14375 {
14376 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14377 struct wireless_dev *wdev = info->user_ptr[1];
14378 int err;
14379
14380 if (!rdev->ops->start_p2p_device)
14381 return -EOPNOTSUPP;
14382
14383 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14384 return -EOPNOTSUPP;
14385
14386 if (wdev_running(wdev))
14387 return 0;
14388
14389 if (rfkill_blocked(rdev->wiphy.rfkill))
14390 return -ERFKILL;
14391
14392 err = rdev_start_p2p_device(rdev, wdev);
14393 if (err)
14394 return err;
14395
14396 wdev->is_running = true;
14397 rdev->opencount++;
14398
14399 return 0;
14400 }
14401
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)14402 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14403 {
14404 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14405 struct wireless_dev *wdev = info->user_ptr[1];
14406
14407 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14408 return -EOPNOTSUPP;
14409
14410 if (!rdev->ops->stop_p2p_device)
14411 return -EOPNOTSUPP;
14412
14413 cfg80211_stop_p2p_device(rdev, wdev);
14414
14415 return 0;
14416 }
14417
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)14418 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14419 {
14420 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14421 struct wireless_dev *wdev = info->user_ptr[1];
14422 struct cfg80211_nan_conf conf = {};
14423 int err;
14424
14425 if (wdev->iftype != NL80211_IFTYPE_NAN)
14426 return -EOPNOTSUPP;
14427
14428 if (wdev_running(wdev))
14429 return -EEXIST;
14430
14431 if (rfkill_blocked(rdev->wiphy.rfkill))
14432 return -ERFKILL;
14433
14434 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14435 return -EINVAL;
14436
14437 conf.master_pref =
14438 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14439
14440 if (info->attrs[NL80211_ATTR_BANDS]) {
14441 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14442
14443 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14444 return -EOPNOTSUPP;
14445
14446 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14447 return -EINVAL;
14448
14449 conf.bands = bands;
14450 }
14451
14452 err = rdev_start_nan(rdev, wdev, &conf);
14453 if (err)
14454 return err;
14455
14456 wdev->is_running = true;
14457 rdev->opencount++;
14458
14459 return 0;
14460 }
14461
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)14462 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14463 {
14464 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14465 struct wireless_dev *wdev = info->user_ptr[1];
14466
14467 if (wdev->iftype != NL80211_IFTYPE_NAN)
14468 return -EOPNOTSUPP;
14469
14470 cfg80211_stop_nan(rdev, wdev);
14471
14472 return 0;
14473 }
14474
validate_nan_filter(struct nlattr * filter_attr)14475 static int validate_nan_filter(struct nlattr *filter_attr)
14476 {
14477 struct nlattr *attr;
14478 int len = 0, n_entries = 0, rem;
14479
14480 nla_for_each_nested(attr, filter_attr, rem) {
14481 len += nla_len(attr);
14482 n_entries++;
14483 }
14484
14485 if (len >= U8_MAX)
14486 return -EINVAL;
14487
14488 return n_entries;
14489 }
14490
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)14491 static int handle_nan_filter(struct nlattr *attr_filter,
14492 struct cfg80211_nan_func *func,
14493 bool tx)
14494 {
14495 struct nlattr *attr;
14496 int n_entries, rem, i;
14497 struct cfg80211_nan_func_filter *filter;
14498
14499 n_entries = validate_nan_filter(attr_filter);
14500 if (n_entries < 0)
14501 return n_entries;
14502
14503 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14504
14505 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14506 if (!filter)
14507 return -ENOMEM;
14508
14509 i = 0;
14510 nla_for_each_nested(attr, attr_filter, rem) {
14511 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14512 if (!filter[i].filter)
14513 goto err;
14514
14515 filter[i].len = nla_len(attr);
14516 i++;
14517 }
14518 if (tx) {
14519 func->num_tx_filters = n_entries;
14520 func->tx_filters = filter;
14521 } else {
14522 func->num_rx_filters = n_entries;
14523 func->rx_filters = filter;
14524 }
14525
14526 return 0;
14527
14528 err:
14529 i = 0;
14530 nla_for_each_nested(attr, attr_filter, rem) {
14531 kfree(filter[i].filter);
14532 i++;
14533 }
14534 kfree(filter);
14535 return -ENOMEM;
14536 }
14537
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)14538 static int nl80211_nan_add_func(struct sk_buff *skb,
14539 struct genl_info *info)
14540 {
14541 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14542 struct wireless_dev *wdev = info->user_ptr[1];
14543 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14544 struct cfg80211_nan_func *func;
14545 struct sk_buff *msg = NULL;
14546 void *hdr = NULL;
14547 int err = 0;
14548
14549 if (wdev->iftype != NL80211_IFTYPE_NAN)
14550 return -EOPNOTSUPP;
14551
14552 if (!wdev_running(wdev))
14553 return -ENOTCONN;
14554
14555 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14556 return -EINVAL;
14557
14558 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14559 info->attrs[NL80211_ATTR_NAN_FUNC],
14560 nl80211_nan_func_policy,
14561 info->extack);
14562 if (err)
14563 return err;
14564
14565 func = kzalloc(sizeof(*func), GFP_KERNEL);
14566 if (!func)
14567 return -ENOMEM;
14568
14569 func->cookie = cfg80211_assign_cookie(rdev);
14570
14571 if (!tb[NL80211_NAN_FUNC_TYPE]) {
14572 err = -EINVAL;
14573 goto out;
14574 }
14575
14576
14577 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14578
14579 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14580 err = -EINVAL;
14581 goto out;
14582 }
14583
14584 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14585 sizeof(func->service_id));
14586
14587 func->close_range =
14588 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14589
14590 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14591 func->serv_spec_info_len =
14592 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14593 func->serv_spec_info =
14594 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14595 func->serv_spec_info_len,
14596 GFP_KERNEL);
14597 if (!func->serv_spec_info) {
14598 err = -ENOMEM;
14599 goto out;
14600 }
14601 }
14602
14603 if (tb[NL80211_NAN_FUNC_TTL])
14604 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14605
14606 switch (func->type) {
14607 case NL80211_NAN_FUNC_PUBLISH:
14608 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14609 err = -EINVAL;
14610 goto out;
14611 }
14612
14613 func->publish_type =
14614 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14615 func->publish_bcast =
14616 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14617
14618 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14619 func->publish_bcast) {
14620 err = -EINVAL;
14621 goto out;
14622 }
14623 break;
14624 case NL80211_NAN_FUNC_SUBSCRIBE:
14625 func->subscribe_active =
14626 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14627 break;
14628 case NL80211_NAN_FUNC_FOLLOW_UP:
14629 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14630 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14631 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14632 err = -EINVAL;
14633 goto out;
14634 }
14635
14636 func->followup_id =
14637 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14638 func->followup_reqid =
14639 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14640 memcpy(func->followup_dest.addr,
14641 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14642 sizeof(func->followup_dest.addr));
14643 if (func->ttl) {
14644 err = -EINVAL;
14645 goto out;
14646 }
14647 break;
14648 default:
14649 err = -EINVAL;
14650 goto out;
14651 }
14652
14653 if (tb[NL80211_NAN_FUNC_SRF]) {
14654 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14655
14656 err = nla_parse_nested_deprecated(srf_tb,
14657 NL80211_NAN_SRF_ATTR_MAX,
14658 tb[NL80211_NAN_FUNC_SRF],
14659 nl80211_nan_srf_policy,
14660 info->extack);
14661 if (err)
14662 goto out;
14663
14664 func->srf_include =
14665 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14666
14667 if (srf_tb[NL80211_NAN_SRF_BF]) {
14668 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14669 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14670 err = -EINVAL;
14671 goto out;
14672 }
14673
14674 func->srf_bf_len =
14675 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14676 func->srf_bf =
14677 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14678 func->srf_bf_len, GFP_KERNEL);
14679 if (!func->srf_bf) {
14680 err = -ENOMEM;
14681 goto out;
14682 }
14683
14684 func->srf_bf_idx =
14685 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14686 } else {
14687 struct nlattr *attr, *mac_attr =
14688 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14689 int n_entries, rem, i = 0;
14690
14691 if (!mac_attr) {
14692 err = -EINVAL;
14693 goto out;
14694 }
14695
14696 n_entries = validate_acl_mac_addrs(mac_attr);
14697 if (n_entries <= 0) {
14698 err = -EINVAL;
14699 goto out;
14700 }
14701
14702 func->srf_num_macs = n_entries;
14703 func->srf_macs =
14704 kcalloc(n_entries, sizeof(*func->srf_macs),
14705 GFP_KERNEL);
14706 if (!func->srf_macs) {
14707 err = -ENOMEM;
14708 goto out;
14709 }
14710
14711 nla_for_each_nested(attr, mac_attr, rem)
14712 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14713 sizeof(*func->srf_macs));
14714 }
14715 }
14716
14717 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14718 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14719 func, true);
14720 if (err)
14721 goto out;
14722 }
14723
14724 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14725 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14726 func, false);
14727 if (err)
14728 goto out;
14729 }
14730
14731 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14732 if (!msg) {
14733 err = -ENOMEM;
14734 goto out;
14735 }
14736
14737 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14738 NL80211_CMD_ADD_NAN_FUNCTION);
14739 /* This can't really happen - we just allocated 4KB */
14740 if (WARN_ON(!hdr)) {
14741 err = -ENOMEM;
14742 goto out;
14743 }
14744
14745 err = rdev_add_nan_func(rdev, wdev, func);
14746 out:
14747 if (err < 0) {
14748 cfg80211_free_nan_func(func);
14749 nlmsg_free(msg);
14750 return err;
14751 }
14752
14753 /* propagate the instance id and cookie to userspace */
14754 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14755 NL80211_ATTR_PAD))
14756 goto nla_put_failure;
14757
14758 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14759 if (!func_attr)
14760 goto nla_put_failure;
14761
14762 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14763 func->instance_id))
14764 goto nla_put_failure;
14765
14766 nla_nest_end(msg, func_attr);
14767
14768 genlmsg_end(msg, hdr);
14769 return genlmsg_reply(msg, info);
14770
14771 nla_put_failure:
14772 nlmsg_free(msg);
14773 return -ENOBUFS;
14774 }
14775
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)14776 static int nl80211_nan_del_func(struct sk_buff *skb,
14777 struct genl_info *info)
14778 {
14779 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14780 struct wireless_dev *wdev = info->user_ptr[1];
14781 u64 cookie;
14782
14783 if (wdev->iftype != NL80211_IFTYPE_NAN)
14784 return -EOPNOTSUPP;
14785
14786 if (!wdev_running(wdev))
14787 return -ENOTCONN;
14788
14789 if (!info->attrs[NL80211_ATTR_COOKIE])
14790 return -EINVAL;
14791
14792 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14793
14794 rdev_del_nan_func(rdev, wdev, cookie);
14795
14796 return 0;
14797 }
14798
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)14799 static int nl80211_nan_change_config(struct sk_buff *skb,
14800 struct genl_info *info)
14801 {
14802 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14803 struct wireless_dev *wdev = info->user_ptr[1];
14804 struct cfg80211_nan_conf conf = {};
14805 u32 changed = 0;
14806
14807 if (wdev->iftype != NL80211_IFTYPE_NAN)
14808 return -EOPNOTSUPP;
14809
14810 if (!wdev_running(wdev))
14811 return -ENOTCONN;
14812
14813 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14814 conf.master_pref =
14815 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14816 if (conf.master_pref <= 1 || conf.master_pref == 255)
14817 return -EINVAL;
14818
14819 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14820 }
14821
14822 if (info->attrs[NL80211_ATTR_BANDS]) {
14823 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14824
14825 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14826 return -EOPNOTSUPP;
14827
14828 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14829 return -EINVAL;
14830
14831 conf.bands = bands;
14832 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14833 }
14834
14835 if (!changed)
14836 return -EINVAL;
14837
14838 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14839 }
14840
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)14841 void cfg80211_nan_match(struct wireless_dev *wdev,
14842 struct cfg80211_nan_match_params *match, gfp_t gfp)
14843 {
14844 struct wiphy *wiphy = wdev->wiphy;
14845 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14846 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14847 struct sk_buff *msg;
14848 void *hdr;
14849
14850 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14851 return;
14852
14853 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14854 if (!msg)
14855 return;
14856
14857 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14858 if (!hdr) {
14859 nlmsg_free(msg);
14860 return;
14861 }
14862
14863 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14864 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14865 wdev->netdev->ifindex)) ||
14866 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14867 NL80211_ATTR_PAD))
14868 goto nla_put_failure;
14869
14870 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14871 NL80211_ATTR_PAD) ||
14872 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14873 goto nla_put_failure;
14874
14875 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14876 if (!match_attr)
14877 goto nla_put_failure;
14878
14879 local_func_attr = nla_nest_start_noflag(msg,
14880 NL80211_NAN_MATCH_FUNC_LOCAL);
14881 if (!local_func_attr)
14882 goto nla_put_failure;
14883
14884 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14885 goto nla_put_failure;
14886
14887 nla_nest_end(msg, local_func_attr);
14888
14889 peer_func_attr = nla_nest_start_noflag(msg,
14890 NL80211_NAN_MATCH_FUNC_PEER);
14891 if (!peer_func_attr)
14892 goto nla_put_failure;
14893
14894 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14895 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14896 goto nla_put_failure;
14897
14898 if (match->info && match->info_len &&
14899 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14900 match->info))
14901 goto nla_put_failure;
14902
14903 nla_nest_end(msg, peer_func_attr);
14904 nla_nest_end(msg, match_attr);
14905 genlmsg_end(msg, hdr);
14906
14907 if (!wdev->owner_nlportid)
14908 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14909 msg, 0, NL80211_MCGRP_NAN, gfp);
14910 else
14911 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14912 wdev->owner_nlportid);
14913
14914 return;
14915
14916 nla_put_failure:
14917 nlmsg_free(msg);
14918 }
14919 EXPORT_SYMBOL(cfg80211_nan_match);
14920
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)14921 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14922 u8 inst_id,
14923 enum nl80211_nan_func_term_reason reason,
14924 u64 cookie, gfp_t gfp)
14925 {
14926 struct wiphy *wiphy = wdev->wiphy;
14927 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14928 struct sk_buff *msg;
14929 struct nlattr *func_attr;
14930 void *hdr;
14931
14932 if (WARN_ON(!inst_id))
14933 return;
14934
14935 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14936 if (!msg)
14937 return;
14938
14939 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14940 if (!hdr) {
14941 nlmsg_free(msg);
14942 return;
14943 }
14944
14945 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14946 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14947 wdev->netdev->ifindex)) ||
14948 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14949 NL80211_ATTR_PAD))
14950 goto nla_put_failure;
14951
14952 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14953 NL80211_ATTR_PAD))
14954 goto nla_put_failure;
14955
14956 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14957 if (!func_attr)
14958 goto nla_put_failure;
14959
14960 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14961 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14962 goto nla_put_failure;
14963
14964 nla_nest_end(msg, func_attr);
14965 genlmsg_end(msg, hdr);
14966
14967 if (!wdev->owner_nlportid)
14968 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14969 msg, 0, NL80211_MCGRP_NAN, gfp);
14970 else
14971 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14972 wdev->owner_nlportid);
14973
14974 return;
14975
14976 nla_put_failure:
14977 nlmsg_free(msg);
14978 }
14979 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14980
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)14981 static int nl80211_get_protocol_features(struct sk_buff *skb,
14982 struct genl_info *info)
14983 {
14984 void *hdr;
14985 struct sk_buff *msg;
14986
14987 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14988 if (!msg)
14989 return -ENOMEM;
14990
14991 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14992 NL80211_CMD_GET_PROTOCOL_FEATURES);
14993 if (!hdr)
14994 goto nla_put_failure;
14995
14996 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14997 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14998 goto nla_put_failure;
14999
15000 genlmsg_end(msg, hdr);
15001 return genlmsg_reply(msg, info);
15002
15003 nla_put_failure:
15004 kfree_skb(msg);
15005 return -ENOBUFS;
15006 }
15007
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)15008 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
15009 {
15010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15011 struct cfg80211_update_ft_ies_params ft_params;
15012 struct net_device *dev = info->user_ptr[1];
15013
15014 if (!rdev->ops->update_ft_ies)
15015 return -EOPNOTSUPP;
15016
15017 if (!info->attrs[NL80211_ATTR_MDID] ||
15018 !info->attrs[NL80211_ATTR_IE])
15019 return -EINVAL;
15020
15021 memset(&ft_params, 0, sizeof(ft_params));
15022 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
15023 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15024 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15025
15026 return rdev_update_ft_ies(rdev, dev, &ft_params);
15027 }
15028
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)15029 static int nl80211_crit_protocol_start(struct sk_buff *skb,
15030 struct genl_info *info)
15031 {
15032 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15033 struct wireless_dev *wdev = info->user_ptr[1];
15034 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
15035 u16 duration;
15036 int ret;
15037
15038 if (!rdev->ops->crit_proto_start)
15039 return -EOPNOTSUPP;
15040
15041 if (WARN_ON(!rdev->ops->crit_proto_stop))
15042 return -EINVAL;
15043
15044 if (rdev->crit_proto_nlportid)
15045 return -EBUSY;
15046
15047 /* determine protocol if provided */
15048 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
15049 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
15050
15051 if (proto >= NUM_NL80211_CRIT_PROTO)
15052 return -EINVAL;
15053
15054 /* timeout must be provided */
15055 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
15056 return -EINVAL;
15057
15058 duration =
15059 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
15060
15061 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
15062 if (!ret)
15063 rdev->crit_proto_nlportid = info->snd_portid;
15064
15065 return ret;
15066 }
15067
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)15068 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
15069 struct genl_info *info)
15070 {
15071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15072 struct wireless_dev *wdev = info->user_ptr[1];
15073
15074 if (!rdev->ops->crit_proto_stop)
15075 return -EOPNOTSUPP;
15076
15077 if (rdev->crit_proto_nlportid) {
15078 rdev->crit_proto_nlportid = 0;
15079 rdev_crit_proto_stop(rdev, wdev);
15080 }
15081 return 0;
15082 }
15083
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)15084 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
15085 struct nlattr *attr,
15086 struct netlink_ext_ack *extack)
15087 {
15088 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
15089 if (attr->nla_type & NLA_F_NESTED) {
15090 NL_SET_ERR_MSG_ATTR(extack, attr,
15091 "unexpected nested data");
15092 return -EINVAL;
15093 }
15094
15095 return 0;
15096 }
15097
15098 if (!(attr->nla_type & NLA_F_NESTED)) {
15099 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
15100 return -EINVAL;
15101 }
15102
15103 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
15104 }
15105
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)15106 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
15107 {
15108 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15109 struct wireless_dev *wdev =
15110 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
15111 info->attrs);
15112 int i, err;
15113 u32 vid, subcmd;
15114
15115 if (!rdev->wiphy.vendor_commands)
15116 return -EOPNOTSUPP;
15117
15118 if (IS_ERR(wdev)) {
15119 err = PTR_ERR(wdev);
15120 if (err != -EINVAL)
15121 return err;
15122 wdev = NULL;
15123 } else if (wdev->wiphy != &rdev->wiphy) {
15124 return -EINVAL;
15125 }
15126
15127 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
15128 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
15129 return -EINVAL;
15130
15131 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
15132 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
15133 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
15134 const struct wiphy_vendor_command *vcmd;
15135 void *data = NULL;
15136 int len = 0;
15137
15138 vcmd = &rdev->wiphy.vendor_commands[i];
15139
15140 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15141 continue;
15142
15143 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15144 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15145 if (!wdev)
15146 return -EINVAL;
15147 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15148 !wdev->netdev)
15149 return -EINVAL;
15150
15151 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15152 if (!wdev_running(wdev))
15153 return -ENETDOWN;
15154 }
15155 } else {
15156 wdev = NULL;
15157 }
15158
15159 if (!vcmd->doit)
15160 return -EOPNOTSUPP;
15161
15162 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
15163 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15164 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15165
15166 err = nl80211_vendor_check_policy(vcmd,
15167 info->attrs[NL80211_ATTR_VENDOR_DATA],
15168 info->extack);
15169 if (err)
15170 return err;
15171 }
15172
15173 rdev->cur_cmd_info = info;
15174 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
15175 rdev->cur_cmd_info = NULL;
15176 return err;
15177 }
15178
15179 return -EOPNOTSUPP;
15180 }
15181
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)15182 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
15183 struct netlink_callback *cb,
15184 struct cfg80211_registered_device **rdev,
15185 struct wireless_dev **wdev)
15186 {
15187 struct nlattr **attrbuf;
15188 u32 vid, subcmd;
15189 unsigned int i;
15190 int vcmd_idx = -1;
15191 int err;
15192 void *data = NULL;
15193 unsigned int data_len = 0;
15194
15195 if (cb->args[0]) {
15196 /* subtract the 1 again here */
15197 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15198 struct wireless_dev *tmp;
15199
15200 if (!wiphy)
15201 return -ENODEV;
15202 *rdev = wiphy_to_rdev(wiphy);
15203 *wdev = NULL;
15204
15205 if (cb->args[1]) {
15206 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15207 if (tmp->identifier == cb->args[1] - 1) {
15208 *wdev = tmp;
15209 break;
15210 }
15211 }
15212 }
15213
15214 /* keep rtnl locked in successful case */
15215 return 0;
15216 }
15217
15218 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15219 if (!attrbuf)
15220 return -ENOMEM;
15221
15222 err = nlmsg_parse_deprecated(cb->nlh,
15223 GENL_HDRLEN + nl80211_fam.hdrsize,
15224 attrbuf, nl80211_fam.maxattr,
15225 nl80211_policy, NULL);
15226 if (err)
15227 goto out;
15228
15229 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15230 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15231 err = -EINVAL;
15232 goto out;
15233 }
15234
15235 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15236 if (IS_ERR(*wdev))
15237 *wdev = NULL;
15238
15239 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15240 if (IS_ERR(*rdev)) {
15241 err = PTR_ERR(*rdev);
15242 goto out;
15243 }
15244
15245 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15246 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15247
15248 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15249 const struct wiphy_vendor_command *vcmd;
15250
15251 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15252
15253 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15254 continue;
15255
15256 if (!vcmd->dumpit) {
15257 err = -EOPNOTSUPP;
15258 goto out;
15259 }
15260
15261 vcmd_idx = i;
15262 break;
15263 }
15264
15265 if (vcmd_idx < 0) {
15266 err = -EOPNOTSUPP;
15267 goto out;
15268 }
15269
15270 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15271 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15272 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15273
15274 err = nl80211_vendor_check_policy(
15275 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15276 attrbuf[NL80211_ATTR_VENDOR_DATA],
15277 cb->extack);
15278 if (err)
15279 goto out;
15280 }
15281
15282 /* 0 is the first index - add 1 to parse only once */
15283 cb->args[0] = (*rdev)->wiphy_idx + 1;
15284 /* add 1 to know if it was NULL */
15285 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15286 cb->args[2] = vcmd_idx;
15287 cb->args[3] = (unsigned long)data;
15288 cb->args[4] = data_len;
15289
15290 /* keep rtnl locked in successful case */
15291 err = 0;
15292 out:
15293 kfree(attrbuf);
15294 return err;
15295 }
15296
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)15297 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15298 struct netlink_callback *cb)
15299 {
15300 struct cfg80211_registered_device *rdev;
15301 struct wireless_dev *wdev;
15302 unsigned int vcmd_idx;
15303 const struct wiphy_vendor_command *vcmd;
15304 void *data;
15305 int data_len;
15306 int err;
15307 struct nlattr *vendor_data;
15308
15309 rtnl_lock();
15310 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15311 if (err)
15312 goto out;
15313
15314 vcmd_idx = cb->args[2];
15315 data = (void *)cb->args[3];
15316 data_len = cb->args[4];
15317 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15318
15319 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15320 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15321 if (!wdev) {
15322 err = -EINVAL;
15323 goto out;
15324 }
15325 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15326 !wdev->netdev) {
15327 err = -EINVAL;
15328 goto out;
15329 }
15330
15331 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15332 if (!wdev_running(wdev)) {
15333 err = -ENETDOWN;
15334 goto out;
15335 }
15336 }
15337 }
15338
15339 while (1) {
15340 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15341 cb->nlh->nlmsg_seq, NLM_F_MULTI,
15342 NL80211_CMD_VENDOR);
15343 if (!hdr)
15344 break;
15345
15346 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15347 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15348 wdev_id(wdev),
15349 NL80211_ATTR_PAD))) {
15350 genlmsg_cancel(skb, hdr);
15351 break;
15352 }
15353
15354 vendor_data = nla_nest_start_noflag(skb,
15355 NL80211_ATTR_VENDOR_DATA);
15356 if (!vendor_data) {
15357 genlmsg_cancel(skb, hdr);
15358 break;
15359 }
15360
15361 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15362 (unsigned long *)&cb->args[5]);
15363 nla_nest_end(skb, vendor_data);
15364
15365 if (err == -ENOBUFS || err == -ENOENT) {
15366 genlmsg_cancel(skb, hdr);
15367 break;
15368 } else if (err <= 0) {
15369 genlmsg_cancel(skb, hdr);
15370 goto out;
15371 }
15372
15373 genlmsg_end(skb, hdr);
15374 }
15375
15376 err = skb->len;
15377 out:
15378 rtnl_unlock();
15379 return err;
15380 }
15381
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)15382 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15383 enum nl80211_commands cmd,
15384 enum nl80211_attrs attr,
15385 int approxlen)
15386 {
15387 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15388
15389 if (WARN_ON(!rdev->cur_cmd_info))
15390 return NULL;
15391
15392 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15393 rdev->cur_cmd_info->snd_portid,
15394 rdev->cur_cmd_info->snd_seq,
15395 cmd, attr, NULL, GFP_KERNEL);
15396 }
15397 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15398
cfg80211_vendor_cmd_reply(struct sk_buff * skb)15399 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15400 {
15401 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15402 void *hdr = ((void **)skb->cb)[1];
15403 struct nlattr *data = ((void **)skb->cb)[2];
15404
15405 /* clear CB data for netlink core to own from now on */
15406 memset(skb->cb, 0, sizeof(skb->cb));
15407
15408 if (WARN_ON(!rdev->cur_cmd_info)) {
15409 kfree_skb(skb);
15410 return -EINVAL;
15411 }
15412
15413 nla_nest_end(skb, data);
15414 genlmsg_end(skb, hdr);
15415 return genlmsg_reply(skb, rdev->cur_cmd_info);
15416 }
15417 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15418
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)15419 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15420 {
15421 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15422
15423 if (WARN_ON(!rdev->cur_cmd_info))
15424 return 0;
15425
15426 return rdev->cur_cmd_info->snd_portid;
15427 }
15428 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15429
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)15430 static int nl80211_set_qos_map(struct sk_buff *skb,
15431 struct genl_info *info)
15432 {
15433 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15434 struct cfg80211_qos_map *qos_map = NULL;
15435 struct net_device *dev = info->user_ptr[1];
15436 u8 *pos, len, num_des, des_len, des;
15437 int ret;
15438
15439 if (!rdev->ops->set_qos_map)
15440 return -EOPNOTSUPP;
15441
15442 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15443 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15444 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15445
15446 if (len % 2)
15447 return -EINVAL;
15448
15449 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15450 if (!qos_map)
15451 return -ENOMEM;
15452
15453 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15454 if (num_des) {
15455 des_len = num_des *
15456 sizeof(struct cfg80211_dscp_exception);
15457 memcpy(qos_map->dscp_exception, pos, des_len);
15458 qos_map->num_des = num_des;
15459 for (des = 0; des < num_des; des++) {
15460 if (qos_map->dscp_exception[des].up > 7) {
15461 kfree(qos_map);
15462 return -EINVAL;
15463 }
15464 }
15465 pos += des_len;
15466 }
15467 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15468 }
15469
15470 ret = nl80211_key_allowed(dev->ieee80211_ptr);
15471 if (!ret)
15472 ret = rdev_set_qos_map(rdev, dev, qos_map);
15473
15474 kfree(qos_map);
15475 return ret;
15476 }
15477
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)15478 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15479 {
15480 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15481 struct net_device *dev = info->user_ptr[1];
15482 struct wireless_dev *wdev = dev->ieee80211_ptr;
15483 const u8 *peer;
15484 u8 tsid, up;
15485 u16 admitted_time = 0;
15486
15487 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15488 return -EOPNOTSUPP;
15489
15490 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15491 !info->attrs[NL80211_ATTR_USER_PRIO])
15492 return -EINVAL;
15493
15494 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15495 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15496
15497 /* WMM uses TIDs 0-7 even for TSPEC */
15498 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15499 /* TODO: handle 802.11 TSPEC/admission control
15500 * need more attributes for that (e.g. BA session requirement);
15501 * change the WMM adminssion test above to allow both then
15502 */
15503 return -EINVAL;
15504 }
15505
15506 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15507
15508 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15509 admitted_time =
15510 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15511 if (!admitted_time)
15512 return -EINVAL;
15513 }
15514
15515 switch (wdev->iftype) {
15516 case NL80211_IFTYPE_STATION:
15517 case NL80211_IFTYPE_P2P_CLIENT:
15518 if (wdev->connected)
15519 break;
15520 return -ENOTCONN;
15521 default:
15522 return -EOPNOTSUPP;
15523 }
15524
15525 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15526 }
15527
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)15528 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15529 {
15530 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15531 struct net_device *dev = info->user_ptr[1];
15532 const u8 *peer;
15533 u8 tsid;
15534
15535 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15536 return -EINVAL;
15537
15538 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15539 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15540
15541 return rdev_del_tx_ts(rdev, dev, tsid, peer);
15542 }
15543
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)15544 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15545 struct genl_info *info)
15546 {
15547 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15548 struct net_device *dev = info->user_ptr[1];
15549 struct wireless_dev *wdev = dev->ieee80211_ptr;
15550 struct cfg80211_chan_def chandef = {};
15551 const u8 *addr;
15552 u8 oper_class;
15553 int err;
15554
15555 if (!rdev->ops->tdls_channel_switch ||
15556 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15557 return -EOPNOTSUPP;
15558
15559 switch (dev->ieee80211_ptr->iftype) {
15560 case NL80211_IFTYPE_STATION:
15561 case NL80211_IFTYPE_P2P_CLIENT:
15562 break;
15563 default:
15564 return -EOPNOTSUPP;
15565 }
15566
15567 if (!info->attrs[NL80211_ATTR_MAC] ||
15568 !info->attrs[NL80211_ATTR_OPER_CLASS])
15569 return -EINVAL;
15570
15571 err = nl80211_parse_chandef(rdev, info, &chandef);
15572 if (err)
15573 return err;
15574
15575 /*
15576 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15577 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15578 * specification is not defined for them.
15579 */
15580 if (chandef.chan->band == NL80211_BAND_2GHZ &&
15581 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15582 chandef.width != NL80211_CHAN_WIDTH_20)
15583 return -EINVAL;
15584
15585 /* we will be active on the TDLS link */
15586 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15587 wdev->iftype))
15588 return -EINVAL;
15589
15590 /* don't allow switching to DFS channels */
15591 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15592 return -EINVAL;
15593
15594 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15595 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15596
15597 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15598 }
15599
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)15600 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15601 struct genl_info *info)
15602 {
15603 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15604 struct net_device *dev = info->user_ptr[1];
15605 const u8 *addr;
15606
15607 if (!rdev->ops->tdls_channel_switch ||
15608 !rdev->ops->tdls_cancel_channel_switch ||
15609 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15610 return -EOPNOTSUPP;
15611
15612 switch (dev->ieee80211_ptr->iftype) {
15613 case NL80211_IFTYPE_STATION:
15614 case NL80211_IFTYPE_P2P_CLIENT:
15615 break;
15616 default:
15617 return -EOPNOTSUPP;
15618 }
15619
15620 if (!info->attrs[NL80211_ATTR_MAC])
15621 return -EINVAL;
15622
15623 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15624
15625 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15626
15627 return 0;
15628 }
15629
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)15630 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15631 struct genl_info *info)
15632 {
15633 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15634 struct net_device *dev = info->user_ptr[1];
15635 struct wireless_dev *wdev = dev->ieee80211_ptr;
15636 const struct nlattr *nla;
15637 bool enabled;
15638
15639 if (!rdev->ops->set_multicast_to_unicast)
15640 return -EOPNOTSUPP;
15641
15642 if (wdev->iftype != NL80211_IFTYPE_AP &&
15643 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15644 return -EOPNOTSUPP;
15645
15646 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15647 enabled = nla_get_flag(nla);
15648
15649 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15650 }
15651
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)15652 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15653 {
15654 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15655 struct net_device *dev = info->user_ptr[1];
15656 struct wireless_dev *wdev = dev->ieee80211_ptr;
15657 struct cfg80211_pmk_conf pmk_conf = {};
15658
15659 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15660 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15661 return -EOPNOTSUPP;
15662
15663 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15664 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15665 return -EOPNOTSUPP;
15666
15667 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15668 return -EINVAL;
15669
15670 if (!wdev->connected)
15671 return -ENOTCONN;
15672
15673 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15674 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
15675 return -EINVAL;
15676
15677 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15678 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15679 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15680 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
15681 return -EINVAL;
15682
15683 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15684 pmk_conf.pmk_r0_name =
15685 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15686
15687 return rdev_set_pmk(rdev, dev, &pmk_conf);
15688 }
15689
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)15690 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15691 {
15692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15693 struct net_device *dev = info->user_ptr[1];
15694 struct wireless_dev *wdev = dev->ieee80211_ptr;
15695 const u8 *aa;
15696
15697 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15698 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15699 return -EOPNOTSUPP;
15700
15701 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15702 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15703 return -EOPNOTSUPP;
15704
15705 if (!info->attrs[NL80211_ATTR_MAC])
15706 return -EINVAL;
15707
15708 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15709 return rdev_del_pmk(rdev, dev, aa);
15710 }
15711
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)15712 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15713 {
15714 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15715 struct net_device *dev = info->user_ptr[1];
15716 struct cfg80211_external_auth_params params;
15717
15718 if (!rdev->ops->external_auth)
15719 return -EOPNOTSUPP;
15720
15721 if (!info->attrs[NL80211_ATTR_SSID] &&
15722 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15723 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15724 return -EINVAL;
15725
15726 if (!info->attrs[NL80211_ATTR_BSSID])
15727 return -EINVAL;
15728
15729 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15730 return -EINVAL;
15731
15732 memset(¶ms, 0, sizeof(params));
15733
15734 if (info->attrs[NL80211_ATTR_SSID]) {
15735 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15736 if (params.ssid.ssid_len == 0)
15737 return -EINVAL;
15738 memcpy(params.ssid.ssid,
15739 nla_data(info->attrs[NL80211_ATTR_SSID]),
15740 params.ssid.ssid_len);
15741 }
15742
15743 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15744 ETH_ALEN);
15745
15746 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15747
15748 if (info->attrs[NL80211_ATTR_PMKID])
15749 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15750
15751 return rdev_external_auth(rdev, dev, ¶ms);
15752 }
15753
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)15754 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15755 {
15756 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15757 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15758 struct net_device *dev = info->user_ptr[1];
15759 struct wireless_dev *wdev = dev->ieee80211_ptr;
15760 const u8 *buf;
15761 size_t len;
15762 u8 *dest;
15763 u16 proto;
15764 bool noencrypt;
15765 u64 cookie = 0;
15766 int link_id;
15767 int err;
15768
15769 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15770 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15771 return -EOPNOTSUPP;
15772
15773 if (!rdev->ops->tx_control_port)
15774 return -EOPNOTSUPP;
15775
15776 if (!info->attrs[NL80211_ATTR_FRAME] ||
15777 !info->attrs[NL80211_ATTR_MAC] ||
15778 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15779 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15780 return -EINVAL;
15781 }
15782
15783 switch (wdev->iftype) {
15784 case NL80211_IFTYPE_AP:
15785 case NL80211_IFTYPE_P2P_GO:
15786 case NL80211_IFTYPE_MESH_POINT:
15787 break;
15788 case NL80211_IFTYPE_ADHOC:
15789 if (wdev->u.ibss.current_bss)
15790 break;
15791 return -ENOTCONN;
15792 case NL80211_IFTYPE_STATION:
15793 case NL80211_IFTYPE_P2P_CLIENT:
15794 if (wdev->connected)
15795 break;
15796 return -ENOTCONN;
15797 default:
15798 return -EOPNOTSUPP;
15799 }
15800
15801 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15802 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15803 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15804 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15805 noencrypt =
15806 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15807
15808 link_id = nl80211_link_id_or_invalid(info->attrs);
15809
15810 err = rdev_tx_control_port(rdev, dev, buf, len,
15811 dest, cpu_to_be16(proto), noencrypt, link_id,
15812 dont_wait_for_ack ? NULL : &cookie);
15813 if (!err && !dont_wait_for_ack)
15814 nl_set_extack_cookie_u64(info->extack, cookie);
15815 return err;
15816 }
15817
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)15818 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15819 struct genl_info *info)
15820 {
15821 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15822 struct net_device *dev = info->user_ptr[1];
15823 struct wireless_dev *wdev = dev->ieee80211_ptr;
15824 struct cfg80211_ftm_responder_stats ftm_stats = {};
15825 unsigned int link_id = nl80211_link_id(info->attrs);
15826 struct sk_buff *msg;
15827 void *hdr;
15828 struct nlattr *ftm_stats_attr;
15829 int err;
15830
15831 if (wdev->iftype != NL80211_IFTYPE_AP ||
15832 !wdev->links[link_id].ap.beacon_interval)
15833 return -EOPNOTSUPP;
15834
15835 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15836 if (err)
15837 return err;
15838
15839 if (!ftm_stats.filled)
15840 return -ENODATA;
15841
15842 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15843 if (!msg)
15844 return -ENOMEM;
15845
15846 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15847 NL80211_CMD_GET_FTM_RESPONDER_STATS);
15848 if (!hdr)
15849 goto nla_put_failure;
15850
15851 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15852 goto nla_put_failure;
15853
15854 ftm_stats_attr = nla_nest_start_noflag(msg,
15855 NL80211_ATTR_FTM_RESPONDER_STATS);
15856 if (!ftm_stats_attr)
15857 goto nla_put_failure;
15858
15859 #define SET_FTM(field, name, type) \
15860 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15861 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
15862 ftm_stats.field)) \
15863 goto nla_put_failure; } while (0)
15864 #define SET_FTM_U64(field, name) \
15865 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15866 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
15867 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
15868 goto nla_put_failure; } while (0)
15869
15870 SET_FTM(success_num, SUCCESS_NUM, u32);
15871 SET_FTM(partial_num, PARTIAL_NUM, u32);
15872 SET_FTM(failed_num, FAILED_NUM, u32);
15873 SET_FTM(asap_num, ASAP_NUM, u32);
15874 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15875 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15876 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15877 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15878 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15879 #undef SET_FTM
15880
15881 nla_nest_end(msg, ftm_stats_attr);
15882
15883 genlmsg_end(msg, hdr);
15884 return genlmsg_reply(msg, info);
15885
15886 nla_put_failure:
15887 nlmsg_free(msg);
15888 return -ENOBUFS;
15889 }
15890
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)15891 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15892 {
15893 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15894 struct cfg80211_update_owe_info owe_info;
15895 struct net_device *dev = info->user_ptr[1];
15896
15897 if (!rdev->ops->update_owe_info)
15898 return -EOPNOTSUPP;
15899
15900 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15901 !info->attrs[NL80211_ATTR_MAC])
15902 return -EINVAL;
15903
15904 memset(&owe_info, 0, sizeof(owe_info));
15905 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15906 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15907
15908 if (info->attrs[NL80211_ATTR_IE]) {
15909 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15910 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15911 }
15912
15913 return rdev_update_owe_info(rdev, dev, &owe_info);
15914 }
15915
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)15916 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15917 {
15918 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15919 struct net_device *dev = info->user_ptr[1];
15920 struct wireless_dev *wdev = dev->ieee80211_ptr;
15921 struct station_info sinfo = {};
15922 const u8 *buf;
15923 size_t len;
15924 u8 *dest;
15925 int err;
15926
15927 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15928 return -EOPNOTSUPP;
15929
15930 if (!info->attrs[NL80211_ATTR_MAC] ||
15931 !info->attrs[NL80211_ATTR_FRAME]) {
15932 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15933 return -EINVAL;
15934 }
15935
15936 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15937 return -EOPNOTSUPP;
15938
15939 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15940 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15941 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15942
15943 if (len < sizeof(struct ethhdr))
15944 return -EINVAL;
15945
15946 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15947 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15948 return -EINVAL;
15949
15950 err = rdev_get_station(rdev, dev, dest, &sinfo);
15951 if (err)
15952 return err;
15953
15954 cfg80211_sinfo_release_content(&sinfo);
15955
15956 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15957 }
15958
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)15959 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15960 struct nlattr *attrs[], struct net_device *dev,
15961 struct cfg80211_tid_cfg *tid_conf,
15962 struct genl_info *info, const u8 *peer,
15963 unsigned int link_id)
15964 {
15965 struct netlink_ext_ack *extack = info->extack;
15966 u64 mask;
15967 int err;
15968
15969 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15970 return -EINVAL;
15971
15972 tid_conf->config_override =
15973 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15974 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15975
15976 if (tid_conf->config_override) {
15977 if (rdev->ops->reset_tid_config) {
15978 err = rdev_reset_tid_config(rdev, dev, peer,
15979 tid_conf->tids);
15980 if (err)
15981 return err;
15982 } else {
15983 return -EINVAL;
15984 }
15985 }
15986
15987 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15988 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15989 tid_conf->noack =
15990 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15991 }
15992
15993 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15994 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15995 tid_conf->retry_short =
15996 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15997
15998 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15999 return -EINVAL;
16000 }
16001
16002 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
16003 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
16004 tid_conf->retry_long =
16005 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
16006
16007 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
16008 return -EINVAL;
16009 }
16010
16011 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
16012 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
16013 tid_conf->ampdu =
16014 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
16015 }
16016
16017 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
16018 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
16019 tid_conf->rtscts =
16020 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
16021 }
16022
16023 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
16024 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
16025 tid_conf->amsdu =
16026 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
16027 }
16028
16029 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
16030 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
16031
16032 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
16033
16034 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
16035 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
16036 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
16037 &tid_conf->txrate_mask, dev,
16038 true, link_id);
16039 if (err)
16040 return err;
16041
16042 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
16043 }
16044 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
16045 }
16046
16047 if (peer)
16048 mask = rdev->wiphy.tid_config_support.peer;
16049 else
16050 mask = rdev->wiphy.tid_config_support.vif;
16051
16052 if (tid_conf->mask & ~mask) {
16053 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
16054 return -EOPNOTSUPP;
16055 }
16056
16057 return 0;
16058 }
16059
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)16060 static int nl80211_set_tid_config(struct sk_buff *skb,
16061 struct genl_info *info)
16062 {
16063 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16064 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
16065 unsigned int link_id = nl80211_link_id(info->attrs);
16066 struct net_device *dev = info->user_ptr[1];
16067 struct cfg80211_tid_config *tid_config;
16068 struct nlattr *tid;
16069 int conf_idx = 0, rem_conf;
16070 int ret = -EINVAL;
16071 u32 num_conf = 0;
16072
16073 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
16074 return -EINVAL;
16075
16076 if (!rdev->ops->set_tid_config)
16077 return -EOPNOTSUPP;
16078
16079 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16080 rem_conf)
16081 num_conf++;
16082
16083 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
16084 GFP_KERNEL);
16085 if (!tid_config)
16086 return -ENOMEM;
16087
16088 tid_config->n_tid_conf = num_conf;
16089
16090 if (info->attrs[NL80211_ATTR_MAC])
16091 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16092
16093 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16094 rem_conf) {
16095 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
16096 tid, NULL, NULL);
16097
16098 if (ret)
16099 goto bad_tid_conf;
16100
16101 ret = parse_tid_conf(rdev, attrs, dev,
16102 &tid_config->tid_conf[conf_idx],
16103 info, tid_config->peer, link_id);
16104 if (ret)
16105 goto bad_tid_conf;
16106
16107 conf_idx++;
16108 }
16109
16110 ret = rdev_set_tid_config(rdev, dev, tid_config);
16111
16112 bad_tid_conf:
16113 kfree(tid_config);
16114 return ret;
16115 }
16116
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)16117 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
16118 {
16119 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16120 struct cfg80211_color_change_settings params = {};
16121 struct net_device *dev = info->user_ptr[1];
16122 struct wireless_dev *wdev = dev->ieee80211_ptr;
16123 struct nlattr **tb;
16124 u16 offset;
16125 int err;
16126
16127 if (!rdev->ops->color_change)
16128 return -EOPNOTSUPP;
16129
16130 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16131 NL80211_EXT_FEATURE_BSS_COLOR))
16132 return -EOPNOTSUPP;
16133
16134 if (wdev->iftype != NL80211_IFTYPE_AP)
16135 return -EOPNOTSUPP;
16136
16137 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
16138 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
16139 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
16140 return -EINVAL;
16141
16142 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16143 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16144
16145 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
16146 info->extack);
16147 if (err)
16148 return err;
16149
16150 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16151 if (!tb)
16152 return -ENOMEM;
16153
16154 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16155 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16156 nl80211_policy, info->extack);
16157 if (err)
16158 goto out;
16159
16160 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
16161 info->extack);
16162 if (err)
16163 goto out;
16164
16165 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16166 err = -EINVAL;
16167 goto out;
16168 }
16169
16170 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16171 err = -EINVAL;
16172 goto out;
16173 }
16174
16175 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16176 if (offset >= params.beacon_color_change.tail_len) {
16177 err = -EINVAL;
16178 goto out;
16179 }
16180
16181 if (params.beacon_color_change.tail[offset] != params.count) {
16182 err = -EINVAL;
16183 goto out;
16184 }
16185
16186 params.counter_offset_beacon = offset;
16187
16188 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16189 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16190 sizeof(u16)) {
16191 err = -EINVAL;
16192 goto out;
16193 }
16194
16195 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16196 if (offset >= params.beacon_color_change.probe_resp_len) {
16197 err = -EINVAL;
16198 goto out;
16199 }
16200
16201 if (params.beacon_color_change.probe_resp[offset] !=
16202 params.count) {
16203 err = -EINVAL;
16204 goto out;
16205 }
16206
16207 params.counter_offset_presp = offset;
16208 }
16209
16210 params.link_id = nl80211_link_id(info->attrs);
16211 err = rdev_color_change(rdev, dev, ¶ms);
16212
16213 out:
16214 kfree(params.beacon_next.mbssid_ies);
16215 kfree(params.beacon_color_change.mbssid_ies);
16216 kfree(params.beacon_next.rnr_ies);
16217 kfree(params.beacon_color_change.rnr_ies);
16218 kfree(tb);
16219 return err;
16220 }
16221
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)16222 static int nl80211_set_fils_aad(struct sk_buff *skb,
16223 struct genl_info *info)
16224 {
16225 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16226 struct net_device *dev = info->user_ptr[1];
16227 struct cfg80211_fils_aad fils_aad = {};
16228 u8 *nonces;
16229
16230 if (!info->attrs[NL80211_ATTR_MAC] ||
16231 !info->attrs[NL80211_ATTR_FILS_KEK] ||
16232 !info->attrs[NL80211_ATTR_FILS_NONCES])
16233 return -EINVAL;
16234
16235 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16236 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16237 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16238 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16239 fils_aad.snonce = nonces;
16240 fils_aad.anonce = nonces + FILS_NONCE_LEN;
16241
16242 return rdev_set_fils_aad(rdev, dev, &fils_aad);
16243 }
16244
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)16245 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16246 {
16247 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16248 unsigned int link_id = nl80211_link_id(info->attrs);
16249 struct net_device *dev = info->user_ptr[1];
16250 struct wireless_dev *wdev = dev->ieee80211_ptr;
16251 int ret;
16252
16253 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16254 return -EINVAL;
16255
16256 switch (wdev->iftype) {
16257 case NL80211_IFTYPE_AP:
16258 break;
16259 default:
16260 return -EINVAL;
16261 }
16262
16263 if (!info->attrs[NL80211_ATTR_MAC] ||
16264 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16265 return -EINVAL;
16266
16267 wdev->valid_links |= BIT(link_id);
16268 ether_addr_copy(wdev->links[link_id].addr,
16269 nla_data(info->attrs[NL80211_ATTR_MAC]));
16270
16271 ret = rdev_add_intf_link(rdev, wdev, link_id);
16272 if (ret) {
16273 wdev->valid_links &= ~BIT(link_id);
16274 eth_zero_addr(wdev->links[link_id].addr);
16275 }
16276
16277 return ret;
16278 }
16279
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)16280 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16281 {
16282 unsigned int link_id = nl80211_link_id(info->attrs);
16283 struct net_device *dev = info->user_ptr[1];
16284 struct wireless_dev *wdev = dev->ieee80211_ptr;
16285
16286 /* cannot remove if there's no link */
16287 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16288 return -EINVAL;
16289
16290 switch (wdev->iftype) {
16291 case NL80211_IFTYPE_AP:
16292 break;
16293 default:
16294 return -EINVAL;
16295 }
16296
16297 cfg80211_remove_link(wdev, link_id);
16298
16299 return 0;
16300 }
16301
16302 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)16303 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16304 bool add)
16305 {
16306 struct link_station_parameters params = {};
16307 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16308 struct net_device *dev = info->user_ptr[1];
16309 int err;
16310
16311 if ((add && !rdev->ops->add_link_station) ||
16312 (!add && !rdev->ops->mod_link_station))
16313 return -EOPNOTSUPP;
16314
16315 if (add && !info->attrs[NL80211_ATTR_MAC])
16316 return -EINVAL;
16317
16318 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16319 return -EINVAL;
16320
16321 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16322 return -EINVAL;
16323
16324 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16325
16326 if (info->attrs[NL80211_ATTR_MAC]) {
16327 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16328 if (!is_valid_ether_addr(params.link_mac))
16329 return -EINVAL;
16330 }
16331
16332 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16333 return -EINVAL;
16334
16335 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16336
16337 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16338 params.supported_rates =
16339 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16340 params.supported_rates_len =
16341 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16342 }
16343
16344 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16345 params.ht_capa =
16346 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16347
16348 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16349 params.vht_capa =
16350 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16351
16352 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16353 params.he_capa =
16354 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16355 params.he_capa_len =
16356 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16357
16358 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16359 params.eht_capa =
16360 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16361 params.eht_capa_len =
16362 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16363
16364 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16365 (const u8 *)params.eht_capa,
16366 params.eht_capa_len,
16367 false))
16368 return -EINVAL;
16369 }
16370 }
16371
16372 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16373 params.he_6ghz_capa =
16374 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16375
16376 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16377 params.opmode_notif_used = true;
16378 params.opmode_notif =
16379 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16380 }
16381
16382 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
16383 ¶ms.txpwr_set);
16384 if (err)
16385 return err;
16386
16387 if (add)
16388 return rdev_add_link_station(rdev, dev, ¶ms);
16389
16390 return rdev_mod_link_station(rdev, dev, ¶ms);
16391 }
16392
16393 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)16394 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16395 {
16396 return nl80211_add_mod_link_station(skb, info, true);
16397 }
16398
16399 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)16400 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16401 {
16402 return nl80211_add_mod_link_station(skb, info, false);
16403 }
16404
16405 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)16406 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16407 {
16408 struct link_station_del_parameters params = {};
16409 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16410 struct net_device *dev = info->user_ptr[1];
16411
16412 if (!rdev->ops->del_link_station)
16413 return -EOPNOTSUPP;
16414
16415 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16416 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16417 return -EINVAL;
16418
16419 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16420 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16421
16422 return rdev_del_link_station(rdev, dev, ¶ms);
16423 }
16424
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)16425 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16426 struct genl_info *info)
16427 {
16428 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16429 struct net_device *dev = info->user_ptr[1];
16430 struct cfg80211_set_hw_timestamp hwts = {};
16431
16432 if (!rdev->wiphy.hw_timestamp_max_peers)
16433 return -EOPNOTSUPP;
16434
16435 if (!info->attrs[NL80211_ATTR_MAC] &&
16436 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16437 return -EOPNOTSUPP;
16438
16439 if (info->attrs[NL80211_ATTR_MAC])
16440 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16441
16442 hwts.enable =
16443 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16444
16445 return rdev_set_hw_timestamp(rdev, dev, &hwts);
16446 }
16447
16448 static int
nl80211_set_ttlm(struct sk_buff * skb,struct genl_info * info)16449 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
16450 {
16451 struct cfg80211_ttlm_params params = {};
16452 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16453 struct net_device *dev = info->user_ptr[1];
16454 struct wireless_dev *wdev = dev->ieee80211_ptr;
16455
16456 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16457 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16458 return -EOPNOTSUPP;
16459
16460 if (!wdev->connected)
16461 return -ENOLINK;
16462
16463 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
16464 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
16465 return -EINVAL;
16466
16467 nla_memcpy(params.dlink,
16468 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
16469 sizeof(params.dlink));
16470 nla_memcpy(params.ulink,
16471 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
16472 sizeof(params.ulink));
16473
16474 return rdev_set_ttlm(rdev, dev, ¶ms);
16475 }
16476
16477 #define NL80211_FLAG_NEED_WIPHY 0x01
16478 #define NL80211_FLAG_NEED_NETDEV 0x02
16479 #define NL80211_FLAG_NEED_RTNL 0x04
16480 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
16481 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
16482 NL80211_FLAG_CHECK_NETDEV_UP)
16483 #define NL80211_FLAG_NEED_WDEV 0x10
16484 /* If a netdev is associated, it must be UP, P2P must be started */
16485 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
16486 NL80211_FLAG_CHECK_NETDEV_UP)
16487 #define NL80211_FLAG_CLEAR_SKB 0x20
16488 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
16489 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
16490 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
16491
16492 #define INTERNAL_FLAG_SELECTORS(__sel) \
16493 SELECTOR(__sel, NONE, 0) /* must be first */ \
16494 SELECTOR(__sel, WIPHY, \
16495 NL80211_FLAG_NEED_WIPHY) \
16496 SELECTOR(__sel, WDEV, \
16497 NL80211_FLAG_NEED_WDEV) \
16498 SELECTOR(__sel, NETDEV, \
16499 NL80211_FLAG_NEED_NETDEV) \
16500 SELECTOR(__sel, NETDEV_LINK, \
16501 NL80211_FLAG_NEED_NETDEV | \
16502 NL80211_FLAG_MLO_VALID_LINK_ID) \
16503 SELECTOR(__sel, NETDEV_NO_MLO, \
16504 NL80211_FLAG_NEED_NETDEV | \
16505 NL80211_FLAG_MLO_UNSUPPORTED) \
16506 SELECTOR(__sel, WIPHY_RTNL, \
16507 NL80211_FLAG_NEED_WIPHY | \
16508 NL80211_FLAG_NEED_RTNL) \
16509 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
16510 NL80211_FLAG_NEED_WIPHY | \
16511 NL80211_FLAG_NEED_RTNL | \
16512 NL80211_FLAG_NO_WIPHY_MTX) \
16513 SELECTOR(__sel, WDEV_RTNL, \
16514 NL80211_FLAG_NEED_WDEV | \
16515 NL80211_FLAG_NEED_RTNL) \
16516 SELECTOR(__sel, NETDEV_RTNL, \
16517 NL80211_FLAG_NEED_NETDEV | \
16518 NL80211_FLAG_NEED_RTNL) \
16519 SELECTOR(__sel, NETDEV_UP, \
16520 NL80211_FLAG_NEED_NETDEV_UP) \
16521 SELECTOR(__sel, NETDEV_UP_LINK, \
16522 NL80211_FLAG_NEED_NETDEV_UP | \
16523 NL80211_FLAG_MLO_VALID_LINK_ID) \
16524 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
16525 NL80211_FLAG_NEED_NETDEV_UP | \
16526 NL80211_FLAG_MLO_UNSUPPORTED) \
16527 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
16528 NL80211_FLAG_NEED_NETDEV_UP | \
16529 NL80211_FLAG_CLEAR_SKB | \
16530 NL80211_FLAG_MLO_UNSUPPORTED) \
16531 SELECTOR(__sel, NETDEV_UP_NOTMX, \
16532 NL80211_FLAG_NEED_NETDEV_UP | \
16533 NL80211_FLAG_NO_WIPHY_MTX) \
16534 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
16535 NL80211_FLAG_NEED_NETDEV_UP | \
16536 NL80211_FLAG_NO_WIPHY_MTX | \
16537 NL80211_FLAG_MLO_VALID_LINK_ID) \
16538 SELECTOR(__sel, NETDEV_UP_CLEAR, \
16539 NL80211_FLAG_NEED_NETDEV_UP | \
16540 NL80211_FLAG_CLEAR_SKB) \
16541 SELECTOR(__sel, WDEV_UP, \
16542 NL80211_FLAG_NEED_WDEV_UP) \
16543 SELECTOR(__sel, WDEV_UP_LINK, \
16544 NL80211_FLAG_NEED_WDEV_UP | \
16545 NL80211_FLAG_MLO_VALID_LINK_ID) \
16546 SELECTOR(__sel, WDEV_UP_RTNL, \
16547 NL80211_FLAG_NEED_WDEV_UP | \
16548 NL80211_FLAG_NEED_RTNL) \
16549 SELECTOR(__sel, WIPHY_CLEAR, \
16550 NL80211_FLAG_NEED_WIPHY | \
16551 NL80211_FLAG_CLEAR_SKB)
16552
16553 enum nl80211_internal_flags_selector {
16554 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
16555 INTERNAL_FLAG_SELECTORS(_)
16556 #undef SELECTOR
16557 };
16558
16559 static u32 nl80211_internal_flags[] = {
16560 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
16561 INTERNAL_FLAG_SELECTORS(_)
16562 #undef SELECTOR
16563 };
16564
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16565 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16566 struct sk_buff *skb,
16567 struct genl_info *info)
16568 {
16569 struct cfg80211_registered_device *rdev = NULL;
16570 struct wireless_dev *wdev = NULL;
16571 struct net_device *dev = NULL;
16572 u32 internal_flags;
16573 int err;
16574
16575 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16576 return -EINVAL;
16577
16578 internal_flags = nl80211_internal_flags[ops->internal_flags];
16579
16580 rtnl_lock();
16581 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16582 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16583 if (IS_ERR(rdev)) {
16584 err = PTR_ERR(rdev);
16585 goto out_unlock;
16586 }
16587 info->user_ptr[0] = rdev;
16588 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16589 internal_flags & NL80211_FLAG_NEED_WDEV) {
16590 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16591 info->attrs);
16592 if (IS_ERR(wdev)) {
16593 err = PTR_ERR(wdev);
16594 goto out_unlock;
16595 }
16596
16597 dev = wdev->netdev;
16598 dev_hold(dev);
16599 rdev = wiphy_to_rdev(wdev->wiphy);
16600
16601 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16602 if (!dev) {
16603 err = -EINVAL;
16604 goto out_unlock;
16605 }
16606
16607 info->user_ptr[1] = dev;
16608 } else {
16609 info->user_ptr[1] = wdev;
16610 }
16611
16612 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16613 !wdev_running(wdev)) {
16614 err = -ENETDOWN;
16615 goto out_unlock;
16616 }
16617
16618 info->user_ptr[0] = rdev;
16619 }
16620
16621 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16622 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16623
16624 if (!wdev) {
16625 err = -EINVAL;
16626 goto out_unlock;
16627 }
16628
16629 /* MLO -> require valid link ID */
16630 if (wdev->valid_links &&
16631 (!link_id ||
16632 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16633 err = -EINVAL;
16634 goto out_unlock;
16635 }
16636
16637 /* non-MLO -> no link ID attribute accepted */
16638 if (!wdev->valid_links && link_id) {
16639 err = -EINVAL;
16640 goto out_unlock;
16641 }
16642 }
16643
16644 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16645 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16646 (wdev && wdev->valid_links)) {
16647 err = -EINVAL;
16648 goto out_unlock;
16649 }
16650 }
16651
16652 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16653 wiphy_lock(&rdev->wiphy);
16654 /* we keep the mutex locked until post_doit */
16655 __release(&rdev->wiphy.mtx);
16656 }
16657 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16658 rtnl_unlock();
16659
16660 return 0;
16661 out_unlock:
16662 rtnl_unlock();
16663 dev_put(dev);
16664 return err;
16665 }
16666
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16667 static void nl80211_post_doit(const struct genl_split_ops *ops,
16668 struct sk_buff *skb,
16669 struct genl_info *info)
16670 {
16671 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16672
16673 if (info->user_ptr[1]) {
16674 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16675 struct wireless_dev *wdev = info->user_ptr[1];
16676
16677 dev_put(wdev->netdev);
16678 } else {
16679 dev_put(info->user_ptr[1]);
16680 }
16681 }
16682
16683 if (info->user_ptr[0] &&
16684 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16685 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16686
16687 /* we kept the mutex locked since pre_doit */
16688 __acquire(&rdev->wiphy.mtx);
16689 wiphy_unlock(&rdev->wiphy);
16690 }
16691
16692 if (internal_flags & NL80211_FLAG_NEED_RTNL)
16693 rtnl_unlock();
16694
16695 /* If needed, clear the netlink message payload from the SKB
16696 * as it might contain key data that shouldn't stick around on
16697 * the heap after the SKB is freed. The netlink message header
16698 * is still needed for further processing, so leave it intact.
16699 */
16700 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16701 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16702
16703 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16704 }
16705 }
16706
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)16707 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16708 struct cfg80211_sar_specs *sar_specs,
16709 struct nlattr *spec[], int index)
16710 {
16711 u32 range_index, i;
16712
16713 if (!sar_specs || !spec)
16714 return -EINVAL;
16715
16716 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16717 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16718 return -EINVAL;
16719
16720 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16721
16722 /* check if range_index exceeds num_freq_ranges */
16723 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16724 return -EINVAL;
16725
16726 /* check if range_index duplicates */
16727 for (i = 0; i < index; i++) {
16728 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16729 return -EINVAL;
16730 }
16731
16732 sar_specs->sub_specs[index].power =
16733 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16734
16735 sar_specs->sub_specs[index].freq_range_index = range_index;
16736
16737 return 0;
16738 }
16739
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)16740 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16741 {
16742 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16743 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16744 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16745 struct cfg80211_sar_specs *sar_spec;
16746 enum nl80211_sar_type type;
16747 struct nlattr *spec_list;
16748 u32 specs;
16749 int rem, err;
16750
16751 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16752 return -EOPNOTSUPP;
16753
16754 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16755 return -EINVAL;
16756
16757 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16758 info->attrs[NL80211_ATTR_SAR_SPEC],
16759 NULL, NULL);
16760
16761 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16762 return -EINVAL;
16763
16764 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16765 if (type != rdev->wiphy.sar_capa->type)
16766 return -EINVAL;
16767
16768 specs = 0;
16769 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16770 specs++;
16771
16772 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16773 return -EINVAL;
16774
16775 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16776 if (!sar_spec)
16777 return -ENOMEM;
16778
16779 sar_spec->type = type;
16780 specs = 0;
16781 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16782 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16783 spec_list, NULL, NULL);
16784
16785 switch (type) {
16786 case NL80211_SAR_TYPE_POWER:
16787 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16788 spec, specs)) {
16789 err = -EINVAL;
16790 goto error;
16791 }
16792 break;
16793 default:
16794 err = -EINVAL;
16795 goto error;
16796 }
16797 specs++;
16798 }
16799
16800 sar_spec->num_sub_specs = specs;
16801
16802 rdev->cur_cmd_info = info;
16803 err = rdev_set_sar_specs(rdev, sar_spec);
16804 rdev->cur_cmd_info = NULL;
16805 error:
16806 kfree(sar_spec);
16807 return err;
16808 }
16809
16810 #define SELECTOR(__sel, name, value) \
16811 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16812 int __missing_selector(void);
16813 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16814
16815 static const struct genl_ops nl80211_ops[] = {
16816 {
16817 .cmd = NL80211_CMD_GET_WIPHY,
16818 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16819 .doit = nl80211_get_wiphy,
16820 .dumpit = nl80211_dump_wiphy,
16821 .done = nl80211_dump_wiphy_done,
16822 /* can be retrieved by unprivileged users */
16823 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16824 },
16825 };
16826
16827 static const struct genl_small_ops nl80211_small_ops[] = {
16828 {
16829 .cmd = NL80211_CMD_SET_WIPHY,
16830 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16831 .doit = nl80211_set_wiphy,
16832 .flags = GENL_UNS_ADMIN_PERM,
16833 },
16834 {
16835 .cmd = NL80211_CMD_GET_INTERFACE,
16836 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16837 .doit = nl80211_get_interface,
16838 .dumpit = nl80211_dump_interface,
16839 /* can be retrieved by unprivileged users */
16840 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16841 },
16842 {
16843 .cmd = NL80211_CMD_SET_INTERFACE,
16844 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16845 .doit = nl80211_set_interface,
16846 .flags = GENL_UNS_ADMIN_PERM,
16847 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16848 NL80211_FLAG_NEED_RTNL),
16849 },
16850 {
16851 .cmd = NL80211_CMD_NEW_INTERFACE,
16852 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16853 .doit = nl80211_new_interface,
16854 .flags = GENL_UNS_ADMIN_PERM,
16855 .internal_flags =
16856 IFLAGS(NL80211_FLAG_NEED_WIPHY |
16857 NL80211_FLAG_NEED_RTNL |
16858 /* we take the wiphy mutex later ourselves */
16859 NL80211_FLAG_NO_WIPHY_MTX),
16860 },
16861 {
16862 .cmd = NL80211_CMD_DEL_INTERFACE,
16863 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16864 .doit = nl80211_del_interface,
16865 .flags = GENL_UNS_ADMIN_PERM,
16866 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16867 NL80211_FLAG_NEED_RTNL),
16868 },
16869 {
16870 .cmd = NL80211_CMD_GET_KEY,
16871 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16872 .doit = nl80211_get_key,
16873 .flags = GENL_UNS_ADMIN_PERM,
16874 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16875 },
16876 {
16877 .cmd = NL80211_CMD_SET_KEY,
16878 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16879 .doit = nl80211_set_key,
16880 .flags = GENL_UNS_ADMIN_PERM,
16881 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16882 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16883 NL80211_FLAG_CLEAR_SKB),
16884 },
16885 {
16886 .cmd = NL80211_CMD_NEW_KEY,
16887 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16888 .doit = nl80211_new_key,
16889 .flags = GENL_UNS_ADMIN_PERM,
16890 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16891 NL80211_FLAG_CLEAR_SKB),
16892 },
16893 {
16894 .cmd = NL80211_CMD_DEL_KEY,
16895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16896 .doit = nl80211_del_key,
16897 .flags = GENL_UNS_ADMIN_PERM,
16898 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16899 },
16900 {
16901 .cmd = NL80211_CMD_SET_BEACON,
16902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16903 .flags = GENL_UNS_ADMIN_PERM,
16904 .doit = nl80211_set_beacon,
16905 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16906 NL80211_FLAG_MLO_VALID_LINK_ID),
16907 },
16908 {
16909 .cmd = NL80211_CMD_START_AP,
16910 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16911 .flags = GENL_UNS_ADMIN_PERM,
16912 .doit = nl80211_start_ap,
16913 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16914 NL80211_FLAG_MLO_VALID_LINK_ID),
16915 },
16916 {
16917 .cmd = NL80211_CMD_STOP_AP,
16918 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16919 .flags = GENL_UNS_ADMIN_PERM,
16920 .doit = nl80211_stop_ap,
16921 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16922 NL80211_FLAG_MLO_VALID_LINK_ID),
16923 },
16924 {
16925 .cmd = NL80211_CMD_GET_STATION,
16926 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16927 .doit = nl80211_get_station,
16928 .dumpit = nl80211_dump_station,
16929 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16930 },
16931 {
16932 .cmd = NL80211_CMD_SET_STATION,
16933 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16934 .doit = nl80211_set_station,
16935 .flags = GENL_UNS_ADMIN_PERM,
16936 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16937 },
16938 {
16939 .cmd = NL80211_CMD_NEW_STATION,
16940 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16941 .doit = nl80211_new_station,
16942 .flags = GENL_UNS_ADMIN_PERM,
16943 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16944 },
16945 {
16946 .cmd = NL80211_CMD_DEL_STATION,
16947 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16948 .doit = nl80211_del_station,
16949 .flags = GENL_UNS_ADMIN_PERM,
16950 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
16951 * whether MAC address is passed or not. If MAC address is
16952 * passed, then even during MLO, link ID is not required.
16953 */
16954 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16955 },
16956 {
16957 .cmd = NL80211_CMD_GET_MPATH,
16958 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16959 .doit = nl80211_get_mpath,
16960 .dumpit = nl80211_dump_mpath,
16961 .flags = GENL_UNS_ADMIN_PERM,
16962 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16963 },
16964 {
16965 .cmd = NL80211_CMD_GET_MPP,
16966 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16967 .doit = nl80211_get_mpp,
16968 .dumpit = nl80211_dump_mpp,
16969 .flags = GENL_UNS_ADMIN_PERM,
16970 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16971 },
16972 {
16973 .cmd = NL80211_CMD_SET_MPATH,
16974 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16975 .doit = nl80211_set_mpath,
16976 .flags = GENL_UNS_ADMIN_PERM,
16977 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16978 },
16979 {
16980 .cmd = NL80211_CMD_NEW_MPATH,
16981 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16982 .doit = nl80211_new_mpath,
16983 .flags = GENL_UNS_ADMIN_PERM,
16984 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16985 },
16986 {
16987 .cmd = NL80211_CMD_DEL_MPATH,
16988 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16989 .doit = nl80211_del_mpath,
16990 .flags = GENL_UNS_ADMIN_PERM,
16991 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16992 },
16993 {
16994 .cmd = NL80211_CMD_SET_BSS,
16995 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16996 .doit = nl80211_set_bss,
16997 .flags = GENL_UNS_ADMIN_PERM,
16998 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16999 NL80211_FLAG_MLO_VALID_LINK_ID),
17000 },
17001 {
17002 .cmd = NL80211_CMD_GET_REG,
17003 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17004 .doit = nl80211_get_reg_do,
17005 .dumpit = nl80211_get_reg_dump,
17006 /* can be retrieved by unprivileged users */
17007 },
17008 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
17009 {
17010 .cmd = NL80211_CMD_SET_REG,
17011 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17012 .doit = nl80211_set_reg,
17013 .flags = GENL_ADMIN_PERM,
17014 },
17015 #endif
17016 {
17017 .cmd = NL80211_CMD_REQ_SET_REG,
17018 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17019 .doit = nl80211_req_set_reg,
17020 .flags = GENL_ADMIN_PERM,
17021 },
17022 {
17023 .cmd = NL80211_CMD_RELOAD_REGDB,
17024 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17025 .doit = nl80211_reload_regdb,
17026 .flags = GENL_ADMIN_PERM,
17027 },
17028 {
17029 .cmd = NL80211_CMD_GET_MESH_CONFIG,
17030 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17031 .doit = nl80211_get_mesh_config,
17032 /* can be retrieved by unprivileged users */
17033 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17034 },
17035 {
17036 .cmd = NL80211_CMD_SET_MESH_CONFIG,
17037 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17038 .doit = nl80211_update_mesh_config,
17039 .flags = GENL_UNS_ADMIN_PERM,
17040 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17041 },
17042 {
17043 .cmd = NL80211_CMD_TRIGGER_SCAN,
17044 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17045 .doit = nl80211_trigger_scan,
17046 .flags = GENL_UNS_ADMIN_PERM,
17047 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17048 },
17049 {
17050 .cmd = NL80211_CMD_ABORT_SCAN,
17051 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17052 .doit = nl80211_abort_scan,
17053 .flags = GENL_UNS_ADMIN_PERM,
17054 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17055 },
17056 {
17057 .cmd = NL80211_CMD_GET_SCAN,
17058 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17059 .dumpit = nl80211_dump_scan,
17060 },
17061 {
17062 .cmd = NL80211_CMD_START_SCHED_SCAN,
17063 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17064 .doit = nl80211_start_sched_scan,
17065 .flags = GENL_UNS_ADMIN_PERM,
17066 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17067 },
17068 {
17069 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
17070 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17071 .doit = nl80211_stop_sched_scan,
17072 .flags = GENL_UNS_ADMIN_PERM,
17073 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17074 },
17075 {
17076 .cmd = NL80211_CMD_AUTHENTICATE,
17077 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17078 .doit = nl80211_authenticate,
17079 .flags = GENL_UNS_ADMIN_PERM,
17080 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17081 NL80211_FLAG_CLEAR_SKB),
17082 },
17083 {
17084 .cmd = NL80211_CMD_ASSOCIATE,
17085 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17086 .doit = nl80211_associate,
17087 .flags = GENL_UNS_ADMIN_PERM,
17088 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17089 NL80211_FLAG_CLEAR_SKB),
17090 },
17091 {
17092 .cmd = NL80211_CMD_DEAUTHENTICATE,
17093 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17094 .doit = nl80211_deauthenticate,
17095 .flags = GENL_UNS_ADMIN_PERM,
17096 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17097 },
17098 {
17099 .cmd = NL80211_CMD_DISASSOCIATE,
17100 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17101 .doit = nl80211_disassociate,
17102 .flags = GENL_UNS_ADMIN_PERM,
17103 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17104 },
17105 {
17106 .cmd = NL80211_CMD_JOIN_IBSS,
17107 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17108 .doit = nl80211_join_ibss,
17109 .flags = GENL_UNS_ADMIN_PERM,
17110 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17111 },
17112 {
17113 .cmd = NL80211_CMD_LEAVE_IBSS,
17114 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115 .doit = nl80211_leave_ibss,
17116 .flags = GENL_UNS_ADMIN_PERM,
17117 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17118 },
17119 #ifdef CONFIG_NL80211_TESTMODE
17120 {
17121 .cmd = NL80211_CMD_TESTMODE,
17122 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17123 .doit = nl80211_testmode_do,
17124 .dumpit = nl80211_testmode_dump,
17125 .flags = GENL_UNS_ADMIN_PERM,
17126 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17127 },
17128 #endif
17129 {
17130 .cmd = NL80211_CMD_CONNECT,
17131 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17132 .doit = nl80211_connect,
17133 .flags = GENL_UNS_ADMIN_PERM,
17134 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17135 NL80211_FLAG_CLEAR_SKB),
17136 },
17137 {
17138 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
17139 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17140 .doit = nl80211_update_connect_params,
17141 .flags = GENL_ADMIN_PERM,
17142 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17143 NL80211_FLAG_CLEAR_SKB),
17144 },
17145 {
17146 .cmd = NL80211_CMD_DISCONNECT,
17147 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17148 .doit = nl80211_disconnect,
17149 .flags = GENL_UNS_ADMIN_PERM,
17150 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17151 },
17152 {
17153 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
17154 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17155 .doit = nl80211_wiphy_netns,
17156 .flags = GENL_UNS_ADMIN_PERM,
17157 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17158 NL80211_FLAG_NEED_RTNL |
17159 NL80211_FLAG_NO_WIPHY_MTX),
17160 },
17161 {
17162 .cmd = NL80211_CMD_GET_SURVEY,
17163 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17164 .dumpit = nl80211_dump_survey,
17165 },
17166 {
17167 .cmd = NL80211_CMD_SET_PMKSA,
17168 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17169 .doit = nl80211_set_pmksa,
17170 .flags = GENL_UNS_ADMIN_PERM,
17171 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17172 NL80211_FLAG_CLEAR_SKB),
17173 },
17174 {
17175 .cmd = NL80211_CMD_DEL_PMKSA,
17176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17177 .doit = nl80211_del_pmksa,
17178 .flags = GENL_UNS_ADMIN_PERM,
17179 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17180 },
17181 {
17182 .cmd = NL80211_CMD_FLUSH_PMKSA,
17183 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17184 .doit = nl80211_flush_pmksa,
17185 .flags = GENL_UNS_ADMIN_PERM,
17186 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17187 },
17188 {
17189 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17190 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17191 .doit = nl80211_remain_on_channel,
17192 .flags = GENL_UNS_ADMIN_PERM,
17193 /* FIXME: requiring a link ID here is probably not good */
17194 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17195 NL80211_FLAG_MLO_VALID_LINK_ID),
17196 },
17197 {
17198 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17199 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17200 .doit = nl80211_cancel_remain_on_channel,
17201 .flags = GENL_UNS_ADMIN_PERM,
17202 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17203 },
17204 {
17205 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17206 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17207 .doit = nl80211_set_tx_bitrate_mask,
17208 .flags = GENL_UNS_ADMIN_PERM,
17209 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17210 NL80211_FLAG_MLO_VALID_LINK_ID),
17211 },
17212 {
17213 .cmd = NL80211_CMD_REGISTER_FRAME,
17214 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17215 .doit = nl80211_register_mgmt,
17216 .flags = GENL_UNS_ADMIN_PERM,
17217 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17218 },
17219 {
17220 .cmd = NL80211_CMD_FRAME,
17221 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17222 .doit = nl80211_tx_mgmt,
17223 .flags = GENL_UNS_ADMIN_PERM,
17224 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17225 },
17226 {
17227 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17228 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17229 .doit = nl80211_tx_mgmt_cancel_wait,
17230 .flags = GENL_UNS_ADMIN_PERM,
17231 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17232 },
17233 {
17234 .cmd = NL80211_CMD_SET_POWER_SAVE,
17235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17236 .doit = nl80211_set_power_save,
17237 .flags = GENL_UNS_ADMIN_PERM,
17238 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17239 },
17240 {
17241 .cmd = NL80211_CMD_GET_POWER_SAVE,
17242 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17243 .doit = nl80211_get_power_save,
17244 /* can be retrieved by unprivileged users */
17245 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17246 },
17247 {
17248 .cmd = NL80211_CMD_SET_CQM,
17249 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17250 .doit = nl80211_set_cqm,
17251 .flags = GENL_UNS_ADMIN_PERM,
17252 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17253 },
17254 {
17255 .cmd = NL80211_CMD_SET_CHANNEL,
17256 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17257 .doit = nl80211_set_channel,
17258 .flags = GENL_UNS_ADMIN_PERM,
17259 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17260 NL80211_FLAG_MLO_VALID_LINK_ID),
17261 },
17262 {
17263 .cmd = NL80211_CMD_JOIN_MESH,
17264 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17265 .doit = nl80211_join_mesh,
17266 .flags = GENL_UNS_ADMIN_PERM,
17267 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17268 },
17269 {
17270 .cmd = NL80211_CMD_LEAVE_MESH,
17271 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17272 .doit = nl80211_leave_mesh,
17273 .flags = GENL_UNS_ADMIN_PERM,
17274 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17275 },
17276 {
17277 .cmd = NL80211_CMD_JOIN_OCB,
17278 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17279 .doit = nl80211_join_ocb,
17280 .flags = GENL_UNS_ADMIN_PERM,
17281 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17282 },
17283 {
17284 .cmd = NL80211_CMD_LEAVE_OCB,
17285 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17286 .doit = nl80211_leave_ocb,
17287 .flags = GENL_UNS_ADMIN_PERM,
17288 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17289 },
17290 #ifdef CONFIG_PM
17291 {
17292 .cmd = NL80211_CMD_GET_WOWLAN,
17293 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17294 .doit = nl80211_get_wowlan,
17295 /* can be retrieved by unprivileged users */
17296 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17297 },
17298 {
17299 .cmd = NL80211_CMD_SET_WOWLAN,
17300 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17301 .doit = nl80211_set_wowlan,
17302 .flags = GENL_UNS_ADMIN_PERM,
17303 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17304 },
17305 #endif
17306 {
17307 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17308 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17309 .doit = nl80211_set_rekey_data,
17310 .flags = GENL_UNS_ADMIN_PERM,
17311 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17312 NL80211_FLAG_CLEAR_SKB),
17313 },
17314 {
17315 .cmd = NL80211_CMD_TDLS_MGMT,
17316 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17317 .doit = nl80211_tdls_mgmt,
17318 .flags = GENL_UNS_ADMIN_PERM,
17319 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17320 NL80211_FLAG_MLO_VALID_LINK_ID),
17321 },
17322 {
17323 .cmd = NL80211_CMD_TDLS_OPER,
17324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17325 .doit = nl80211_tdls_oper,
17326 .flags = GENL_UNS_ADMIN_PERM,
17327 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17328 },
17329 {
17330 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17332 .doit = nl80211_register_unexpected_frame,
17333 .flags = GENL_UNS_ADMIN_PERM,
17334 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17335 },
17336 {
17337 .cmd = NL80211_CMD_PROBE_CLIENT,
17338 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17339 .doit = nl80211_probe_client,
17340 .flags = GENL_UNS_ADMIN_PERM,
17341 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17342 },
17343 {
17344 .cmd = NL80211_CMD_REGISTER_BEACONS,
17345 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17346 .doit = nl80211_register_beacons,
17347 .flags = GENL_UNS_ADMIN_PERM,
17348 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17349 },
17350 {
17351 .cmd = NL80211_CMD_SET_NOACK_MAP,
17352 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17353 .doit = nl80211_set_noack_map,
17354 .flags = GENL_UNS_ADMIN_PERM,
17355 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17356 },
17357 {
17358 .cmd = NL80211_CMD_START_P2P_DEVICE,
17359 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17360 .doit = nl80211_start_p2p_device,
17361 .flags = GENL_UNS_ADMIN_PERM,
17362 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17363 NL80211_FLAG_NEED_RTNL),
17364 },
17365 {
17366 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17367 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17368 .doit = nl80211_stop_p2p_device,
17369 .flags = GENL_UNS_ADMIN_PERM,
17370 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17371 NL80211_FLAG_NEED_RTNL),
17372 },
17373 {
17374 .cmd = NL80211_CMD_START_NAN,
17375 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17376 .doit = nl80211_start_nan,
17377 .flags = GENL_ADMIN_PERM,
17378 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17379 NL80211_FLAG_NEED_RTNL),
17380 },
17381 {
17382 .cmd = NL80211_CMD_STOP_NAN,
17383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17384 .doit = nl80211_stop_nan,
17385 .flags = GENL_ADMIN_PERM,
17386 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17387 NL80211_FLAG_NEED_RTNL),
17388 },
17389 {
17390 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17392 .doit = nl80211_nan_add_func,
17393 .flags = GENL_ADMIN_PERM,
17394 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17395 },
17396 {
17397 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17398 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17399 .doit = nl80211_nan_del_func,
17400 .flags = GENL_ADMIN_PERM,
17401 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17402 },
17403 {
17404 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17405 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17406 .doit = nl80211_nan_change_config,
17407 .flags = GENL_ADMIN_PERM,
17408 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17409 },
17410 {
17411 .cmd = NL80211_CMD_SET_MCAST_RATE,
17412 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17413 .doit = nl80211_set_mcast_rate,
17414 .flags = GENL_UNS_ADMIN_PERM,
17415 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17416 },
17417 {
17418 .cmd = NL80211_CMD_SET_MAC_ACL,
17419 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17420 .doit = nl80211_set_mac_acl,
17421 .flags = GENL_UNS_ADMIN_PERM,
17422 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17423 NL80211_FLAG_MLO_UNSUPPORTED),
17424 },
17425 {
17426 .cmd = NL80211_CMD_RADAR_DETECT,
17427 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17428 .doit = nl80211_start_radar_detection,
17429 .flags = GENL_UNS_ADMIN_PERM,
17430 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17431 NL80211_FLAG_NO_WIPHY_MTX |
17432 NL80211_FLAG_MLO_VALID_LINK_ID),
17433 },
17434 {
17435 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17436 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17437 .doit = nl80211_get_protocol_features,
17438 },
17439 {
17440 .cmd = NL80211_CMD_UPDATE_FT_IES,
17441 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17442 .doit = nl80211_update_ft_ies,
17443 .flags = GENL_UNS_ADMIN_PERM,
17444 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17445 },
17446 {
17447 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17448 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17449 .doit = nl80211_crit_protocol_start,
17450 .flags = GENL_UNS_ADMIN_PERM,
17451 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17452 },
17453 {
17454 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17455 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17456 .doit = nl80211_crit_protocol_stop,
17457 .flags = GENL_UNS_ADMIN_PERM,
17458 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17459 },
17460 {
17461 .cmd = NL80211_CMD_GET_COALESCE,
17462 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17463 .doit = nl80211_get_coalesce,
17464 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17465 },
17466 {
17467 .cmd = NL80211_CMD_SET_COALESCE,
17468 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17469 .doit = nl80211_set_coalesce,
17470 .flags = GENL_UNS_ADMIN_PERM,
17471 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17472 },
17473 {
17474 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17475 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17476 .doit = nl80211_channel_switch,
17477 .flags = GENL_UNS_ADMIN_PERM,
17478 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17479 NL80211_FLAG_MLO_VALID_LINK_ID),
17480 },
17481 {
17482 .cmd = NL80211_CMD_VENDOR,
17483 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17484 .doit = nl80211_vendor_cmd,
17485 .dumpit = nl80211_vendor_cmd_dump,
17486 .flags = GENL_UNS_ADMIN_PERM,
17487 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17488 NL80211_FLAG_CLEAR_SKB),
17489 },
17490 {
17491 .cmd = NL80211_CMD_SET_QOS_MAP,
17492 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17493 .doit = nl80211_set_qos_map,
17494 .flags = GENL_UNS_ADMIN_PERM,
17495 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17496 },
17497 {
17498 .cmd = NL80211_CMD_ADD_TX_TS,
17499 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17500 .doit = nl80211_add_tx_ts,
17501 .flags = GENL_UNS_ADMIN_PERM,
17502 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17503 NL80211_FLAG_MLO_UNSUPPORTED),
17504 },
17505 {
17506 .cmd = NL80211_CMD_DEL_TX_TS,
17507 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17508 .doit = nl80211_del_tx_ts,
17509 .flags = GENL_UNS_ADMIN_PERM,
17510 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17511 },
17512 {
17513 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17514 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17515 .doit = nl80211_tdls_channel_switch,
17516 .flags = GENL_UNS_ADMIN_PERM,
17517 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17518 },
17519 {
17520 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17521 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17522 .doit = nl80211_tdls_cancel_channel_switch,
17523 .flags = GENL_UNS_ADMIN_PERM,
17524 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17525 },
17526 {
17527 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17528 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17529 .doit = nl80211_set_multicast_to_unicast,
17530 .flags = GENL_UNS_ADMIN_PERM,
17531 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17532 },
17533 {
17534 .cmd = NL80211_CMD_SET_PMK,
17535 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17536 .doit = nl80211_set_pmk,
17537 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17538 NL80211_FLAG_CLEAR_SKB),
17539 },
17540 {
17541 .cmd = NL80211_CMD_DEL_PMK,
17542 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17543 .doit = nl80211_del_pmk,
17544 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17545 },
17546 {
17547 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17548 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17549 .doit = nl80211_external_auth,
17550 .flags = GENL_ADMIN_PERM,
17551 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17552 },
17553 {
17554 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17555 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17556 .doit = nl80211_tx_control_port,
17557 .flags = GENL_UNS_ADMIN_PERM,
17558 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17559 },
17560 {
17561 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17562 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17563 .doit = nl80211_get_ftm_responder_stats,
17564 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17565 NL80211_FLAG_MLO_VALID_LINK_ID),
17566 },
17567 {
17568 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17569 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17570 .doit = nl80211_pmsr_start,
17571 .flags = GENL_UNS_ADMIN_PERM,
17572 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17573 },
17574 {
17575 .cmd = NL80211_CMD_NOTIFY_RADAR,
17576 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17577 .doit = nl80211_notify_radar_detection,
17578 .flags = GENL_UNS_ADMIN_PERM,
17579 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17580 },
17581 {
17582 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17583 .doit = nl80211_update_owe_info,
17584 .flags = GENL_ADMIN_PERM,
17585 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17586 },
17587 {
17588 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17589 .doit = nl80211_probe_mesh_link,
17590 .flags = GENL_UNS_ADMIN_PERM,
17591 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17592 },
17593 {
17594 .cmd = NL80211_CMD_SET_TID_CONFIG,
17595 .doit = nl80211_set_tid_config,
17596 .flags = GENL_UNS_ADMIN_PERM,
17597 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17598 NL80211_FLAG_MLO_VALID_LINK_ID),
17599 },
17600 {
17601 .cmd = NL80211_CMD_SET_SAR_SPECS,
17602 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17603 .doit = nl80211_set_sar_specs,
17604 .flags = GENL_UNS_ADMIN_PERM,
17605 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17606 NL80211_FLAG_NEED_RTNL),
17607 },
17608 {
17609 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17610 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17611 .doit = nl80211_color_change,
17612 .flags = GENL_UNS_ADMIN_PERM,
17613 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17614 NL80211_FLAG_MLO_VALID_LINK_ID),
17615 },
17616 {
17617 .cmd = NL80211_CMD_SET_FILS_AAD,
17618 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17619 .doit = nl80211_set_fils_aad,
17620 .flags = GENL_UNS_ADMIN_PERM,
17621 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17622 },
17623 {
17624 .cmd = NL80211_CMD_ADD_LINK,
17625 .doit = nl80211_add_link,
17626 .flags = GENL_UNS_ADMIN_PERM,
17627 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17628 },
17629 {
17630 .cmd = NL80211_CMD_REMOVE_LINK,
17631 .doit = nl80211_remove_link,
17632 .flags = GENL_UNS_ADMIN_PERM,
17633 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17634 NL80211_FLAG_MLO_VALID_LINK_ID),
17635 },
17636 {
17637 .cmd = NL80211_CMD_ADD_LINK_STA,
17638 .doit = nl80211_add_link_station,
17639 .flags = GENL_UNS_ADMIN_PERM,
17640 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17641 NL80211_FLAG_MLO_VALID_LINK_ID),
17642 },
17643 {
17644 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17645 .doit = nl80211_modify_link_station,
17646 .flags = GENL_UNS_ADMIN_PERM,
17647 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17648 NL80211_FLAG_MLO_VALID_LINK_ID),
17649 },
17650 {
17651 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17652 .doit = nl80211_remove_link_station,
17653 .flags = GENL_UNS_ADMIN_PERM,
17654 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17655 NL80211_FLAG_MLO_VALID_LINK_ID),
17656 },
17657 {
17658 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17659 .doit = nl80211_set_hw_timestamp,
17660 .flags = GENL_UNS_ADMIN_PERM,
17661 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17662 },
17663 {
17664 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
17665 .doit = nl80211_set_ttlm,
17666 .flags = GENL_UNS_ADMIN_PERM,
17667 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17668 },
17669 };
17670
17671 static struct genl_family nl80211_fam __ro_after_init = {
17672 .name = NL80211_GENL_NAME, /* have users key off the name instead */
17673 .hdrsize = 0, /* no private header */
17674 .version = 1, /* no particular meaning now */
17675 .maxattr = NL80211_ATTR_MAX,
17676 .policy = nl80211_policy,
17677 .netnsok = true,
17678 .pre_doit = nl80211_pre_doit,
17679 .post_doit = nl80211_post_doit,
17680 .module = THIS_MODULE,
17681 .ops = nl80211_ops,
17682 .n_ops = ARRAY_SIZE(nl80211_ops),
17683 .small_ops = nl80211_small_ops,
17684 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17685 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17686 .mcgrps = nl80211_mcgrps,
17687 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17688 .parallel_ops = true,
17689 };
17690
17691 /* notification functions */
17692
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)17693 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17694 enum nl80211_commands cmd)
17695 {
17696 struct sk_buff *msg;
17697 struct nl80211_dump_wiphy_state state = {};
17698
17699 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17700 cmd != NL80211_CMD_DEL_WIPHY);
17701
17702 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17703 if (!msg)
17704 return;
17705
17706 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17707 nlmsg_free(msg);
17708 return;
17709 }
17710
17711 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17712 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17713 }
17714
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)17715 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17716 struct wireless_dev *wdev,
17717 enum nl80211_commands cmd)
17718 {
17719 struct sk_buff *msg;
17720
17721 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17722 if (!msg)
17723 return;
17724
17725 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17726 nlmsg_free(msg);
17727 return;
17728 }
17729
17730 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17731 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17732 }
17733
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)17734 static int nl80211_add_scan_req(struct sk_buff *msg,
17735 struct cfg80211_registered_device *rdev)
17736 {
17737 struct cfg80211_scan_request *req = rdev->scan_req;
17738 struct nlattr *nest;
17739 int i;
17740 struct cfg80211_scan_info *info;
17741
17742 if (WARN_ON(!req))
17743 return 0;
17744
17745 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17746 if (!nest)
17747 goto nla_put_failure;
17748 for (i = 0; i < req->n_ssids; i++) {
17749 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17750 goto nla_put_failure;
17751 }
17752 nla_nest_end(msg, nest);
17753
17754 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17755 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17756 if (!nest)
17757 goto nla_put_failure;
17758 for (i = 0; i < req->n_channels; i++) {
17759 if (nla_put_u32(msg, i,
17760 ieee80211_channel_to_khz(req->channels[i])))
17761 goto nla_put_failure;
17762 }
17763 nla_nest_end(msg, nest);
17764 } else {
17765 nest = nla_nest_start_noflag(msg,
17766 NL80211_ATTR_SCAN_FREQUENCIES);
17767 if (!nest)
17768 goto nla_put_failure;
17769 for (i = 0; i < req->n_channels; i++) {
17770 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17771 goto nla_put_failure;
17772 }
17773 nla_nest_end(msg, nest);
17774 }
17775
17776 if (req->ie &&
17777 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17778 goto nla_put_failure;
17779
17780 if (req->flags &&
17781 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17782 goto nla_put_failure;
17783
17784 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17785 &rdev->scan_req->info;
17786 if (info->scan_start_tsf &&
17787 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17788 info->scan_start_tsf, NL80211_BSS_PAD) ||
17789 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17790 info->tsf_bssid)))
17791 goto nla_put_failure;
17792
17793 return 0;
17794 nla_put_failure:
17795 return -ENOBUFS;
17796 }
17797
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)17798 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17799 struct cfg80211_registered_device *rdev,
17800 struct wireless_dev *wdev,
17801 u32 portid, u32 seq, int flags,
17802 u32 cmd)
17803 {
17804 void *hdr;
17805
17806 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17807 if (!hdr)
17808 return -1;
17809
17810 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17811 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17812 wdev->netdev->ifindex)) ||
17813 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17814 NL80211_ATTR_PAD))
17815 goto nla_put_failure;
17816
17817 /* ignore errors and send incomplete event anyway */
17818 nl80211_add_scan_req(msg, rdev);
17819
17820 genlmsg_end(msg, hdr);
17821 return 0;
17822
17823 nla_put_failure:
17824 genlmsg_cancel(msg, hdr);
17825 return -EMSGSIZE;
17826 }
17827
17828 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)17829 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17830 struct cfg80211_sched_scan_request *req, u32 cmd)
17831 {
17832 void *hdr;
17833
17834 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17835 if (!hdr)
17836 return -1;
17837
17838 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17839 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17840 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17841 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17842 NL80211_ATTR_PAD))
17843 goto nla_put_failure;
17844
17845 genlmsg_end(msg, hdr);
17846 return 0;
17847
17848 nla_put_failure:
17849 genlmsg_cancel(msg, hdr);
17850 return -EMSGSIZE;
17851 }
17852
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)17853 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17854 struct wireless_dev *wdev)
17855 {
17856 struct sk_buff *msg;
17857
17858 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17859 if (!msg)
17860 return;
17861
17862 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17863 NL80211_CMD_TRIGGER_SCAN) < 0) {
17864 nlmsg_free(msg);
17865 return;
17866 }
17867
17868 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17869 NL80211_MCGRP_SCAN, GFP_KERNEL);
17870 }
17871
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)17872 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17873 struct wireless_dev *wdev, bool aborted)
17874 {
17875 struct sk_buff *msg;
17876
17877 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17878 if (!msg)
17879 return NULL;
17880
17881 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17882 aborted ? NL80211_CMD_SCAN_ABORTED :
17883 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17884 nlmsg_free(msg);
17885 return NULL;
17886 }
17887
17888 return msg;
17889 }
17890
17891 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)17892 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17893 struct sk_buff *msg)
17894 {
17895 if (!msg)
17896 return;
17897
17898 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17899 NL80211_MCGRP_SCAN, GFP_KERNEL);
17900 }
17901
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)17902 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17903 {
17904 struct sk_buff *msg;
17905
17906 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17907 if (!msg)
17908 return;
17909
17910 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17911 nlmsg_free(msg);
17912 return;
17913 }
17914
17915 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17916 NL80211_MCGRP_SCAN, GFP_KERNEL);
17917 }
17918
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)17919 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17920 struct regulatory_request *request)
17921 {
17922 /* Userspace can always count this one always being set */
17923 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17924 goto nla_put_failure;
17925
17926 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17927 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17928 NL80211_REGDOM_TYPE_WORLD))
17929 goto nla_put_failure;
17930 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17931 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17932 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17933 goto nla_put_failure;
17934 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17935 request->intersect) {
17936 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17937 NL80211_REGDOM_TYPE_INTERSECTION))
17938 goto nla_put_failure;
17939 } else {
17940 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17941 NL80211_REGDOM_TYPE_COUNTRY) ||
17942 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17943 request->alpha2))
17944 goto nla_put_failure;
17945 }
17946
17947 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17948 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17949
17950 if (wiphy &&
17951 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17952 goto nla_put_failure;
17953
17954 if (wiphy &&
17955 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17956 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17957 goto nla_put_failure;
17958 }
17959
17960 return true;
17961
17962 nla_put_failure:
17963 return false;
17964 }
17965
17966 /*
17967 * This can happen on global regulatory changes or device specific settings
17968 * based on custom regulatory domains.
17969 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)17970 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17971 struct regulatory_request *request)
17972 {
17973 struct sk_buff *msg;
17974 void *hdr;
17975
17976 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17977 if (!msg)
17978 return;
17979
17980 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17981 if (!hdr)
17982 goto nla_put_failure;
17983
17984 if (!nl80211_reg_change_event_fill(msg, request))
17985 goto nla_put_failure;
17986
17987 genlmsg_end(msg, hdr);
17988
17989 rcu_read_lock();
17990 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17991 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17992 rcu_read_unlock();
17993
17994 return;
17995
17996 nla_put_failure:
17997 nlmsg_free(msg);
17998 }
17999
18000 struct nl80211_mlme_event {
18001 enum nl80211_commands cmd;
18002 const u8 *buf;
18003 size_t buf_len;
18004 int uapsd_queues;
18005 const u8 *req_ies;
18006 size_t req_ies_len;
18007 bool reconnect;
18008 };
18009
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct nl80211_mlme_event * event,gfp_t gfp)18010 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
18011 struct net_device *netdev,
18012 const struct nl80211_mlme_event *event,
18013 gfp_t gfp)
18014 {
18015 struct sk_buff *msg;
18016 void *hdr;
18017
18018 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
18019 if (!msg)
18020 return;
18021
18022 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
18023 if (!hdr) {
18024 nlmsg_free(msg);
18025 return;
18026 }
18027
18028 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18029 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18030 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
18031 (event->req_ies &&
18032 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
18033 event->req_ies)))
18034 goto nla_put_failure;
18035
18036 if (event->reconnect &&
18037 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
18038 goto nla_put_failure;
18039
18040 if (event->uapsd_queues >= 0) {
18041 struct nlattr *nla_wmm =
18042 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
18043 if (!nla_wmm)
18044 goto nla_put_failure;
18045
18046 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
18047 event->uapsd_queues))
18048 goto nla_put_failure;
18049
18050 nla_nest_end(msg, nla_wmm);
18051 }
18052
18053 genlmsg_end(msg, hdr);
18054
18055 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18056 NL80211_MCGRP_MLME, gfp);
18057 return;
18058
18059 nla_put_failure:
18060 nlmsg_free(msg);
18061 }
18062
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)18063 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
18064 struct net_device *netdev, const u8 *buf,
18065 size_t len, gfp_t gfp)
18066 {
18067 struct nl80211_mlme_event event = {
18068 .cmd = NL80211_CMD_AUTHENTICATE,
18069 .buf = buf,
18070 .buf_len = len,
18071 .uapsd_queues = -1,
18072 };
18073
18074 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18075 }
18076
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct cfg80211_rx_assoc_resp_data * data)18077 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
18078 struct net_device *netdev,
18079 const struct cfg80211_rx_assoc_resp_data *data)
18080 {
18081 struct nl80211_mlme_event event = {
18082 .cmd = NL80211_CMD_ASSOCIATE,
18083 .buf = data->buf,
18084 .buf_len = data->len,
18085 .uapsd_queues = data->uapsd_queues,
18086 .req_ies = data->req_ies,
18087 .req_ies_len = data->req_ies_len,
18088 };
18089
18090 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
18091 }
18092
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)18093 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
18094 struct net_device *netdev, const u8 *buf,
18095 size_t len, bool reconnect, gfp_t gfp)
18096 {
18097 struct nl80211_mlme_event event = {
18098 .cmd = NL80211_CMD_DEAUTHENTICATE,
18099 .buf = buf,
18100 .buf_len = len,
18101 .reconnect = reconnect,
18102 .uapsd_queues = -1,
18103 };
18104
18105 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18106 }
18107
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)18108 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
18109 struct net_device *netdev, const u8 *buf,
18110 size_t len, bool reconnect, gfp_t gfp)
18111 {
18112 struct nl80211_mlme_event event = {
18113 .cmd = NL80211_CMD_DISASSOCIATE,
18114 .buf = buf,
18115 .buf_len = len,
18116 .reconnect = reconnect,
18117 .uapsd_queues = -1,
18118 };
18119
18120 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18121 }
18122
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)18123 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
18124 size_t len)
18125 {
18126 struct wireless_dev *wdev = dev->ieee80211_ptr;
18127 struct wiphy *wiphy = wdev->wiphy;
18128 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18129 const struct ieee80211_mgmt *mgmt = (void *)buf;
18130 struct nl80211_mlme_event event = {
18131 .buf = buf,
18132 .buf_len = len,
18133 .uapsd_queues = -1,
18134 };
18135
18136 if (WARN_ON(len < 2))
18137 return;
18138
18139 if (ieee80211_is_deauth(mgmt->frame_control)) {
18140 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
18141 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
18142 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
18143 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
18144 if (wdev->unprot_beacon_reported &&
18145 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
18146 return;
18147 event.cmd = NL80211_CMD_UNPROT_BEACON;
18148 wdev->unprot_beacon_reported = jiffies;
18149 } else {
18150 return;
18151 }
18152
18153 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
18154 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
18155 }
18156 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
18157
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)18158 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
18159 struct net_device *netdev, int cmd,
18160 const u8 *addr, gfp_t gfp)
18161 {
18162 struct sk_buff *msg;
18163 void *hdr;
18164
18165 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18166 if (!msg)
18167 return;
18168
18169 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18170 if (!hdr) {
18171 nlmsg_free(msg);
18172 return;
18173 }
18174
18175 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18176 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18177 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18178 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18179 goto nla_put_failure;
18180
18181 genlmsg_end(msg, hdr);
18182
18183 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18184 NL80211_MCGRP_MLME, gfp);
18185 return;
18186
18187 nla_put_failure:
18188 nlmsg_free(msg);
18189 }
18190
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18191 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
18192 struct net_device *netdev, const u8 *addr,
18193 gfp_t gfp)
18194 {
18195 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
18196 addr, gfp);
18197 }
18198
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18199 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
18200 struct net_device *netdev, const u8 *addr,
18201 gfp_t gfp)
18202 {
18203 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18204 addr, gfp);
18205 }
18206
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)18207 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18208 struct net_device *netdev,
18209 struct cfg80211_connect_resp_params *cr,
18210 gfp_t gfp)
18211 {
18212 struct sk_buff *msg;
18213 void *hdr;
18214 unsigned int link;
18215 size_t link_info_size = 0;
18216 const u8 *connected_addr = cr->valid_links ?
18217 cr->ap_mld_addr : cr->links[0].bssid;
18218
18219 if (cr->valid_links) {
18220 for_each_valid_link(cr, link) {
18221 /* Nested attribute header */
18222 link_info_size += NLA_HDRLEN;
18223 /* Link ID */
18224 link_info_size += nla_total_size(sizeof(u8));
18225 link_info_size += cr->links[link].addr ?
18226 nla_total_size(ETH_ALEN) : 0;
18227 link_info_size += (cr->links[link].bssid ||
18228 cr->links[link].bss) ?
18229 nla_total_size(ETH_ALEN) : 0;
18230 link_info_size += nla_total_size(sizeof(u16));
18231 }
18232 }
18233
18234 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18235 cr->fils.kek_len + cr->fils.pmk_len +
18236 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18237 gfp);
18238 if (!msg)
18239 return;
18240
18241 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18242 if (!hdr) {
18243 nlmsg_free(msg);
18244 return;
18245 }
18246
18247 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18248 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18249 (connected_addr &&
18250 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18251 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18252 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18253 cr->status) ||
18254 (cr->status < 0 &&
18255 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18256 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18257 cr->timeout_reason))) ||
18258 (cr->req_ie &&
18259 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18260 (cr->resp_ie &&
18261 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18262 cr->resp_ie)) ||
18263 (cr->fils.update_erp_next_seq_num &&
18264 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18265 cr->fils.erp_next_seq_num)) ||
18266 (cr->status == WLAN_STATUS_SUCCESS &&
18267 ((cr->fils.kek &&
18268 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18269 cr->fils.kek)) ||
18270 (cr->fils.pmk &&
18271 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18272 (cr->fils.pmkid &&
18273 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18274 goto nla_put_failure;
18275
18276 if (cr->valid_links) {
18277 int i = 1;
18278 struct nlattr *nested;
18279
18280 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18281 if (!nested)
18282 goto nla_put_failure;
18283
18284 for_each_valid_link(cr, link) {
18285 struct nlattr *nested_mlo_links;
18286 const u8 *bssid = cr->links[link].bss ?
18287 cr->links[link].bss->bssid :
18288 cr->links[link].bssid;
18289
18290 nested_mlo_links = nla_nest_start(msg, i);
18291 if (!nested_mlo_links)
18292 goto nla_put_failure;
18293
18294 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18295 (bssid &&
18296 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18297 (cr->links[link].addr &&
18298 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18299 cr->links[link].addr)) ||
18300 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18301 cr->links[link].status))
18302 goto nla_put_failure;
18303
18304 nla_nest_end(msg, nested_mlo_links);
18305 i++;
18306 }
18307 nla_nest_end(msg, nested);
18308 }
18309
18310 genlmsg_end(msg, hdr);
18311
18312 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18313 NL80211_MCGRP_MLME, gfp);
18314 return;
18315
18316 nla_put_failure:
18317 nlmsg_free(msg);
18318 }
18319
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)18320 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18321 struct net_device *netdev,
18322 struct cfg80211_roam_info *info, gfp_t gfp)
18323 {
18324 struct sk_buff *msg;
18325 void *hdr;
18326 size_t link_info_size = 0;
18327 unsigned int link;
18328 const u8 *connected_addr = info->ap_mld_addr ?
18329 info->ap_mld_addr :
18330 (info->links[0].bss ?
18331 info->links[0].bss->bssid :
18332 info->links[0].bssid);
18333
18334 if (info->valid_links) {
18335 for_each_valid_link(info, link) {
18336 /* Nested attribute header */
18337 link_info_size += NLA_HDRLEN;
18338 /* Link ID */
18339 link_info_size += nla_total_size(sizeof(u8));
18340 link_info_size += info->links[link].addr ?
18341 nla_total_size(ETH_ALEN) : 0;
18342 link_info_size += (info->links[link].bssid ||
18343 info->links[link].bss) ?
18344 nla_total_size(ETH_ALEN) : 0;
18345 }
18346 }
18347
18348 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18349 info->fils.kek_len + info->fils.pmk_len +
18350 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18351 link_info_size, gfp);
18352 if (!msg)
18353 return;
18354
18355 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18356 if (!hdr) {
18357 nlmsg_free(msg);
18358 return;
18359 }
18360
18361 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18362 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18363 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18364 (info->req_ie &&
18365 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18366 info->req_ie)) ||
18367 (info->resp_ie &&
18368 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18369 info->resp_ie)) ||
18370 (info->fils.update_erp_next_seq_num &&
18371 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18372 info->fils.erp_next_seq_num)) ||
18373 (info->fils.kek &&
18374 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18375 info->fils.kek)) ||
18376 (info->fils.pmk &&
18377 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18378 (info->fils.pmkid &&
18379 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18380 goto nla_put_failure;
18381
18382 if (info->valid_links) {
18383 int i = 1;
18384 struct nlattr *nested;
18385
18386 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18387 if (!nested)
18388 goto nla_put_failure;
18389
18390 for_each_valid_link(info, link) {
18391 struct nlattr *nested_mlo_links;
18392 const u8 *bssid = info->links[link].bss ?
18393 info->links[link].bss->bssid :
18394 info->links[link].bssid;
18395
18396 nested_mlo_links = nla_nest_start(msg, i);
18397 if (!nested_mlo_links)
18398 goto nla_put_failure;
18399
18400 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18401 (bssid &&
18402 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18403 (info->links[link].addr &&
18404 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18405 info->links[link].addr)))
18406 goto nla_put_failure;
18407
18408 nla_nest_end(msg, nested_mlo_links);
18409 i++;
18410 }
18411 nla_nest_end(msg, nested);
18412 }
18413
18414 genlmsg_end(msg, hdr);
18415
18416 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18417 NL80211_MCGRP_MLME, gfp);
18418 return;
18419
18420 nla_put_failure:
18421 nlmsg_free(msg);
18422 }
18423
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * peer_addr,const u8 * td_bitmap,u8 td_bitmap_len)18424 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18425 struct net_device *netdev, const u8 *peer_addr,
18426 const u8 *td_bitmap, u8 td_bitmap_len)
18427 {
18428 struct sk_buff *msg;
18429 void *hdr;
18430
18431 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18432 if (!msg)
18433 return;
18434
18435 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18436 if (!hdr) {
18437 nlmsg_free(msg);
18438 return;
18439 }
18440
18441 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18442 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18443 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
18444 goto nla_put_failure;
18445
18446 if ((td_bitmap_len > 0) && td_bitmap)
18447 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18448 td_bitmap_len, td_bitmap))
18449 goto nla_put_failure;
18450
18451 genlmsg_end(msg, hdr);
18452
18453 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18454 NL80211_MCGRP_MLME, GFP_KERNEL);
18455 return;
18456
18457 nla_put_failure:
18458 nlmsg_free(msg);
18459 }
18460
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)18461 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18462 struct net_device *netdev, u16 reason,
18463 const u8 *ie, size_t ie_len, bool from_ap)
18464 {
18465 struct sk_buff *msg;
18466 void *hdr;
18467
18468 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18469 if (!msg)
18470 return;
18471
18472 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18473 if (!hdr) {
18474 nlmsg_free(msg);
18475 return;
18476 }
18477
18478 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18479 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18480 (reason &&
18481 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18482 (from_ap &&
18483 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18484 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18485 goto nla_put_failure;
18486
18487 genlmsg_end(msg, hdr);
18488
18489 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18490 NL80211_MCGRP_MLME, GFP_KERNEL);
18491 return;
18492
18493 nla_put_failure:
18494 nlmsg_free(msg);
18495 }
18496
cfg80211_links_removed(struct net_device * dev,u16 link_mask)18497 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18498 {
18499 struct wireless_dev *wdev = dev->ieee80211_ptr;
18500 struct wiphy *wiphy = wdev->wiphy;
18501 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18502 struct sk_buff *msg;
18503 struct nlattr *links;
18504 void *hdr;
18505
18506 lockdep_assert_wiphy(wdev->wiphy);
18507 trace_cfg80211_links_removed(dev, link_mask);
18508
18509 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18510 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18511 return;
18512
18513 if (WARN_ON(!wdev->valid_links || !link_mask ||
18514 (wdev->valid_links & link_mask) != link_mask ||
18515 wdev->valid_links == link_mask))
18516 return;
18517
18518 cfg80211_wdev_release_link_bsses(wdev, link_mask);
18519 wdev->valid_links &= ~link_mask;
18520
18521 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18522 if (!msg)
18523 return;
18524
18525 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18526 if (!hdr) {
18527 nlmsg_free(msg);
18528 return;
18529 }
18530
18531 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18532 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18533 goto nla_put_failure;
18534
18535 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18536 if (!links)
18537 goto nla_put_failure;
18538
18539 while (link_mask) {
18540 struct nlattr *link;
18541 int link_id = __ffs(link_mask);
18542
18543 link = nla_nest_start(msg, link_id + 1);
18544 if (!link)
18545 goto nla_put_failure;
18546
18547 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18548 goto nla_put_failure;
18549
18550 nla_nest_end(msg, link);
18551 link_mask &= ~(1 << link_id);
18552 }
18553
18554 nla_nest_end(msg, links);
18555
18556 genlmsg_end(msg, hdr);
18557
18558 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18559 NL80211_MCGRP_MLME, GFP_KERNEL);
18560 return;
18561
18562 nla_put_failure:
18563 nlmsg_free(msg);
18564 }
18565 EXPORT_SYMBOL(cfg80211_links_removed);
18566
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)18567 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18568 struct net_device *netdev, const u8 *bssid,
18569 gfp_t gfp)
18570 {
18571 struct sk_buff *msg;
18572 void *hdr;
18573
18574 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18575 if (!msg)
18576 return;
18577
18578 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18579 if (!hdr) {
18580 nlmsg_free(msg);
18581 return;
18582 }
18583
18584 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18585 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18586 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18587 goto nla_put_failure;
18588
18589 genlmsg_end(msg, hdr);
18590
18591 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18592 NL80211_MCGRP_MLME, gfp);
18593 return;
18594
18595 nla_put_failure:
18596 nlmsg_free(msg);
18597 }
18598
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)18599 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18600 const u8 *ie, u8 ie_len,
18601 int sig_dbm, gfp_t gfp)
18602 {
18603 struct wireless_dev *wdev = dev->ieee80211_ptr;
18604 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18605 struct sk_buff *msg;
18606 void *hdr;
18607
18608 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18609 return;
18610
18611 trace_cfg80211_notify_new_peer_candidate(dev, addr);
18612
18613 msg = nlmsg_new(100 + ie_len, gfp);
18614 if (!msg)
18615 return;
18616
18617 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18618 if (!hdr) {
18619 nlmsg_free(msg);
18620 return;
18621 }
18622
18623 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18624 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18625 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18626 (ie_len && ie &&
18627 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18628 (sig_dbm &&
18629 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18630 goto nla_put_failure;
18631
18632 genlmsg_end(msg, hdr);
18633
18634 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18635 NL80211_MCGRP_MLME, gfp);
18636 return;
18637
18638 nla_put_failure:
18639 nlmsg_free(msg);
18640 }
18641 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18642
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)18643 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18644 struct net_device *netdev, const u8 *addr,
18645 enum nl80211_key_type key_type, int key_id,
18646 const u8 *tsc, gfp_t gfp)
18647 {
18648 struct sk_buff *msg;
18649 void *hdr;
18650
18651 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18652 if (!msg)
18653 return;
18654
18655 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18656 if (!hdr) {
18657 nlmsg_free(msg);
18658 return;
18659 }
18660
18661 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18662 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18663 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18664 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18665 (key_id != -1 &&
18666 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18667 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18668 goto nla_put_failure;
18669
18670 genlmsg_end(msg, hdr);
18671
18672 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18673 NL80211_MCGRP_MLME, gfp);
18674 return;
18675
18676 nla_put_failure:
18677 nlmsg_free(msg);
18678 }
18679
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)18680 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18681 struct ieee80211_channel *channel_before,
18682 struct ieee80211_channel *channel_after)
18683 {
18684 struct sk_buff *msg;
18685 void *hdr;
18686 struct nlattr *nl_freq;
18687
18688 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18689 if (!msg)
18690 return;
18691
18692 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18693 if (!hdr) {
18694 nlmsg_free(msg);
18695 return;
18696 }
18697
18698 /*
18699 * Since we are applying the beacon hint to a wiphy we know its
18700 * wiphy_idx is valid
18701 */
18702 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18703 goto nla_put_failure;
18704
18705 /* Before */
18706 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18707 if (!nl_freq)
18708 goto nla_put_failure;
18709
18710 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18711 goto nla_put_failure;
18712 nla_nest_end(msg, nl_freq);
18713
18714 /* After */
18715 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18716 if (!nl_freq)
18717 goto nla_put_failure;
18718
18719 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18720 goto nla_put_failure;
18721 nla_nest_end(msg, nl_freq);
18722
18723 genlmsg_end(msg, hdr);
18724
18725 rcu_read_lock();
18726 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18727 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18728 rcu_read_unlock();
18729
18730 return;
18731
18732 nla_put_failure:
18733 nlmsg_free(msg);
18734 }
18735
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18736 static void nl80211_send_remain_on_chan_event(
18737 int cmd, struct cfg80211_registered_device *rdev,
18738 struct wireless_dev *wdev, u64 cookie,
18739 struct ieee80211_channel *chan,
18740 unsigned int duration, gfp_t gfp)
18741 {
18742 struct sk_buff *msg;
18743 void *hdr;
18744
18745 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18746 if (!msg)
18747 return;
18748
18749 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18750 if (!hdr) {
18751 nlmsg_free(msg);
18752 return;
18753 }
18754
18755 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18756 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18757 wdev->netdev->ifindex)) ||
18758 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18759 NL80211_ATTR_PAD) ||
18760 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18761 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18762 NL80211_CHAN_NO_HT) ||
18763 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18764 NL80211_ATTR_PAD))
18765 goto nla_put_failure;
18766
18767 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18768 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18769 goto nla_put_failure;
18770
18771 genlmsg_end(msg, hdr);
18772
18773 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18774 NL80211_MCGRP_MLME, gfp);
18775 return;
18776
18777 nla_put_failure:
18778 nlmsg_free(msg);
18779 }
18780
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)18781 void cfg80211_assoc_comeback(struct net_device *netdev,
18782 const u8 *ap_addr, u32 timeout)
18783 {
18784 struct wireless_dev *wdev = netdev->ieee80211_ptr;
18785 struct wiphy *wiphy = wdev->wiphy;
18786 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18787 struct sk_buff *msg;
18788 void *hdr;
18789
18790 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18791
18792 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18793 if (!msg)
18794 return;
18795
18796 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18797 if (!hdr) {
18798 nlmsg_free(msg);
18799 return;
18800 }
18801
18802 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18803 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18804 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18805 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18806 goto nla_put_failure;
18807
18808 genlmsg_end(msg, hdr);
18809
18810 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18811 NL80211_MCGRP_MLME, GFP_KERNEL);
18812 return;
18813
18814 nla_put_failure:
18815 nlmsg_free(msg);
18816 }
18817 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18818
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18819 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18820 struct ieee80211_channel *chan,
18821 unsigned int duration, gfp_t gfp)
18822 {
18823 struct wiphy *wiphy = wdev->wiphy;
18824 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18825
18826 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18827 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18828 rdev, wdev, cookie, chan,
18829 duration, gfp);
18830 }
18831 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18832
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18833 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18834 struct ieee80211_channel *chan,
18835 gfp_t gfp)
18836 {
18837 struct wiphy *wiphy = wdev->wiphy;
18838 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18839
18840 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18841 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18842 rdev, wdev, cookie, chan, 0, gfp);
18843 }
18844 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18845
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18846 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18847 struct ieee80211_channel *chan,
18848 gfp_t gfp)
18849 {
18850 struct wiphy *wiphy = wdev->wiphy;
18851 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18852
18853 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18854 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18855 rdev, wdev, cookie, chan, 0, gfp);
18856 }
18857 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18858
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)18859 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18860 struct station_info *sinfo, gfp_t gfp)
18861 {
18862 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18863 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18864 struct sk_buff *msg;
18865
18866 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18867
18868 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18869 if (!msg)
18870 return;
18871
18872 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18873 rdev, dev, mac_addr, sinfo) < 0) {
18874 nlmsg_free(msg);
18875 return;
18876 }
18877
18878 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18879 NL80211_MCGRP_MLME, gfp);
18880 }
18881 EXPORT_SYMBOL(cfg80211_new_sta);
18882
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)18883 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18884 struct station_info *sinfo, gfp_t gfp)
18885 {
18886 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18887 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18888 struct sk_buff *msg;
18889 struct station_info empty_sinfo = {};
18890
18891 if (!sinfo)
18892 sinfo = &empty_sinfo;
18893
18894 trace_cfg80211_del_sta(dev, mac_addr);
18895
18896 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18897 if (!msg) {
18898 cfg80211_sinfo_release_content(sinfo);
18899 return;
18900 }
18901
18902 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18903 rdev, dev, mac_addr, sinfo) < 0) {
18904 nlmsg_free(msg);
18905 return;
18906 }
18907
18908 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18909 NL80211_MCGRP_MLME, gfp);
18910 }
18911 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18912
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)18913 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18914 enum nl80211_connect_failed_reason reason,
18915 gfp_t gfp)
18916 {
18917 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18918 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18919 struct sk_buff *msg;
18920 void *hdr;
18921
18922 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18923 if (!msg)
18924 return;
18925
18926 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18927 if (!hdr) {
18928 nlmsg_free(msg);
18929 return;
18930 }
18931
18932 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18933 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18934 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18935 goto nla_put_failure;
18936
18937 genlmsg_end(msg, hdr);
18938
18939 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18940 NL80211_MCGRP_MLME, gfp);
18941 return;
18942
18943 nla_put_failure:
18944 nlmsg_free(msg);
18945 }
18946 EXPORT_SYMBOL(cfg80211_conn_failed);
18947
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)18948 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18949 const u8 *addr, gfp_t gfp)
18950 {
18951 struct wireless_dev *wdev = dev->ieee80211_ptr;
18952 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18953 struct sk_buff *msg;
18954 void *hdr;
18955 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18956
18957 if (!nlportid)
18958 return false;
18959
18960 msg = nlmsg_new(100, gfp);
18961 if (!msg)
18962 return true;
18963
18964 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18965 if (!hdr) {
18966 nlmsg_free(msg);
18967 return true;
18968 }
18969
18970 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18971 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18972 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18973 goto nla_put_failure;
18974
18975 genlmsg_end(msg, hdr);
18976 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18977 return true;
18978
18979 nla_put_failure:
18980 nlmsg_free(msg);
18981 return true;
18982 }
18983
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)18984 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18985 const u8 *addr, gfp_t gfp)
18986 {
18987 struct wireless_dev *wdev = dev->ieee80211_ptr;
18988 bool ret;
18989
18990 trace_cfg80211_rx_spurious_frame(dev, addr);
18991
18992 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18993 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18994 trace_cfg80211_return_bool(false);
18995 return false;
18996 }
18997 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18998 addr, gfp);
18999 trace_cfg80211_return_bool(ret);
19000 return ret;
19001 }
19002 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
19003
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)19004 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
19005 const u8 *addr, gfp_t gfp)
19006 {
19007 struct wireless_dev *wdev = dev->ieee80211_ptr;
19008 bool ret;
19009
19010 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
19011
19012 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19013 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
19014 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
19015 trace_cfg80211_return_bool(false);
19016 return false;
19017 }
19018 ret = __nl80211_unexpected_frame(dev,
19019 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
19020 addr, gfp);
19021 trace_cfg80211_return_bool(ret);
19022 return ret;
19023 }
19024 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
19025
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)19026 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
19027 struct wireless_dev *wdev, u32 nlportid,
19028 struct cfg80211_rx_info *info, gfp_t gfp)
19029 {
19030 struct net_device *netdev = wdev->netdev;
19031 struct sk_buff *msg;
19032 void *hdr;
19033
19034 msg = nlmsg_new(100 + info->len, gfp);
19035 if (!msg)
19036 return -ENOMEM;
19037
19038 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19039 if (!hdr) {
19040 nlmsg_free(msg);
19041 return -ENOMEM;
19042 }
19043
19044 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19045 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19046 netdev->ifindex)) ||
19047 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19048 NL80211_ATTR_PAD) ||
19049 (info->have_link_id &&
19050 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
19051 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
19052 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
19053 (info->sig_dbm &&
19054 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
19055 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
19056 (info->flags &&
19057 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
19058 (info->rx_tstamp && nla_put_u64_64bit(msg,
19059 NL80211_ATTR_RX_HW_TIMESTAMP,
19060 info->rx_tstamp,
19061 NL80211_ATTR_PAD)) ||
19062 (info->ack_tstamp && nla_put_u64_64bit(msg,
19063 NL80211_ATTR_TX_HW_TIMESTAMP,
19064 info->ack_tstamp,
19065 NL80211_ATTR_PAD)))
19066 goto nla_put_failure;
19067
19068 genlmsg_end(msg, hdr);
19069
19070 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19071
19072 nla_put_failure:
19073 nlmsg_free(msg);
19074 return -ENOBUFS;
19075 }
19076
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)19077 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
19078 struct cfg80211_tx_status *status,
19079 gfp_t gfp, enum nl80211_commands command)
19080 {
19081 struct wiphy *wiphy = wdev->wiphy;
19082 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19083 struct net_device *netdev = wdev->netdev;
19084 struct sk_buff *msg;
19085 void *hdr;
19086
19087 if (command == NL80211_CMD_FRAME_TX_STATUS)
19088 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
19089 status->ack);
19090 else
19091 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
19092 status->ack);
19093
19094 msg = nlmsg_new(100 + status->len, gfp);
19095 if (!msg)
19096 return;
19097
19098 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
19099 if (!hdr) {
19100 nlmsg_free(msg);
19101 return;
19102 }
19103
19104 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19105 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19106 netdev->ifindex)) ||
19107 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19108 NL80211_ATTR_PAD) ||
19109 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
19110 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
19111 NL80211_ATTR_PAD) ||
19112 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19113 (status->tx_tstamp &&
19114 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
19115 status->tx_tstamp, NL80211_ATTR_PAD)) ||
19116 (status->ack_tstamp &&
19117 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
19118 status->ack_tstamp, NL80211_ATTR_PAD)))
19119 goto nla_put_failure;
19120
19121 genlmsg_end(msg, hdr);
19122
19123 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19124 NL80211_MCGRP_MLME, gfp);
19125 return;
19126
19127 nla_put_failure:
19128 nlmsg_free(msg);
19129 }
19130
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)19131 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
19132 const u8 *buf, size_t len, bool ack,
19133 gfp_t gfp)
19134 {
19135 struct cfg80211_tx_status status = {
19136 .cookie = cookie,
19137 .buf = buf,
19138 .len = len,
19139 .ack = ack
19140 };
19141
19142 nl80211_frame_tx_status(wdev, &status, gfp,
19143 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
19144 }
19145 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
19146
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)19147 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
19148 struct cfg80211_tx_status *status, gfp_t gfp)
19149 {
19150 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
19151 }
19152 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
19153
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)19154 static int __nl80211_rx_control_port(struct net_device *dev,
19155 struct sk_buff *skb,
19156 bool unencrypted,
19157 int link_id,
19158 gfp_t gfp)
19159 {
19160 struct wireless_dev *wdev = dev->ieee80211_ptr;
19161 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19162 struct ethhdr *ehdr = eth_hdr(skb);
19163 const u8 *addr = ehdr->h_source;
19164 u16 proto = be16_to_cpu(skb->protocol);
19165 struct sk_buff *msg;
19166 void *hdr;
19167 struct nlattr *frame;
19168
19169 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
19170
19171 if (!nlportid)
19172 return -ENOENT;
19173
19174 msg = nlmsg_new(100 + skb->len, gfp);
19175 if (!msg)
19176 return -ENOMEM;
19177
19178 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
19179 if (!hdr) {
19180 nlmsg_free(msg);
19181 return -ENOBUFS;
19182 }
19183
19184 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19185 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19186 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19187 NL80211_ATTR_PAD) ||
19188 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19189 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
19190 (link_id >= 0 &&
19191 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
19192 (unencrypted && nla_put_flag(msg,
19193 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
19194 goto nla_put_failure;
19195
19196 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
19197 if (!frame)
19198 goto nla_put_failure;
19199
19200 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
19201 genlmsg_end(msg, hdr);
19202
19203 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19204
19205 nla_put_failure:
19206 nlmsg_free(msg);
19207 return -ENOBUFS;
19208 }
19209
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)19210 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19211 bool unencrypted, int link_id)
19212 {
19213 int ret;
19214
19215 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19216 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19217 GFP_ATOMIC);
19218 trace_cfg80211_return_bool(ret == 0);
19219 return ret == 0;
19220 }
19221 EXPORT_SYMBOL(cfg80211_rx_control_port);
19222
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)19223 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19224 const char *mac, gfp_t gfp)
19225 {
19226 struct wireless_dev *wdev = dev->ieee80211_ptr;
19227 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19228 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19229 void **cb;
19230
19231 if (!msg)
19232 return NULL;
19233
19234 cb = (void **)msg->cb;
19235
19236 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19237 if (!cb[0]) {
19238 nlmsg_free(msg);
19239 return NULL;
19240 }
19241
19242 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19243 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19244 goto nla_put_failure;
19245
19246 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19247 goto nla_put_failure;
19248
19249 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19250 if (!cb[1])
19251 goto nla_put_failure;
19252
19253 cb[2] = rdev;
19254
19255 return msg;
19256 nla_put_failure:
19257 nlmsg_free(msg);
19258 return NULL;
19259 }
19260
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)19261 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19262 {
19263 void **cb = (void **)msg->cb;
19264 struct cfg80211_registered_device *rdev = cb[2];
19265
19266 nla_nest_end(msg, cb[1]);
19267 genlmsg_end(msg, cb[0]);
19268
19269 memset(msg->cb, 0, sizeof(msg->cb));
19270
19271 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19272 NL80211_MCGRP_MLME, gfp);
19273 }
19274
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)19275 void cfg80211_cqm_rssi_notify(struct net_device *dev,
19276 enum nl80211_cqm_rssi_threshold_event rssi_event,
19277 s32 rssi_level, gfp_t gfp)
19278 {
19279 struct wireless_dev *wdev = dev->ieee80211_ptr;
19280 struct cfg80211_cqm_config *cqm_config;
19281
19282 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19283
19284 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19285 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19286 return;
19287
19288 rcu_read_lock();
19289 cqm_config = rcu_dereference(wdev->cqm_config);
19290 if (cqm_config) {
19291 cqm_config->last_rssi_event_value = rssi_level;
19292 cqm_config->last_rssi_event_type = rssi_event;
19293 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19294 }
19295 rcu_read_unlock();
19296 }
19297 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19298
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)19299 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19300 {
19301 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19302 cqm_rssi_work);
19303 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19304 enum nl80211_cqm_rssi_threshold_event rssi_event;
19305 struct cfg80211_cqm_config *cqm_config;
19306 struct sk_buff *msg;
19307 s32 rssi_level;
19308
19309 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
19310 if (!cqm_config)
19311 return;
19312
19313 if (cqm_config->use_range_api)
19314 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19315
19316 rssi_level = cqm_config->last_rssi_event_value;
19317 rssi_event = cqm_config->last_rssi_event_type;
19318
19319 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19320 if (!msg)
19321 return;
19322
19323 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19324 rssi_event))
19325 goto nla_put_failure;
19326
19327 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19328 rssi_level))
19329 goto nla_put_failure;
19330
19331 cfg80211_send_cqm(msg, GFP_KERNEL);
19332
19333 return;
19334
19335 nla_put_failure:
19336 nlmsg_free(msg);
19337 }
19338
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)19339 void cfg80211_cqm_txe_notify(struct net_device *dev,
19340 const u8 *peer, u32 num_packets,
19341 u32 rate, u32 intvl, gfp_t gfp)
19342 {
19343 struct sk_buff *msg;
19344
19345 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19346 if (!msg)
19347 return;
19348
19349 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19350 goto nla_put_failure;
19351
19352 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19353 goto nla_put_failure;
19354
19355 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19356 goto nla_put_failure;
19357
19358 cfg80211_send_cqm(msg, gfp);
19359 return;
19360
19361 nla_put_failure:
19362 nlmsg_free(msg);
19363 }
19364 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19365
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)19366 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19367 const u8 *peer, u32 num_packets, gfp_t gfp)
19368 {
19369 struct sk_buff *msg;
19370
19371 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19372
19373 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19374 if (!msg)
19375 return;
19376
19377 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19378 goto nla_put_failure;
19379
19380 cfg80211_send_cqm(msg, gfp);
19381 return;
19382
19383 nla_put_failure:
19384 nlmsg_free(msg);
19385 }
19386 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19387
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)19388 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19389 {
19390 struct sk_buff *msg;
19391
19392 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19393 if (!msg)
19394 return;
19395
19396 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19397 goto nla_put_failure;
19398
19399 cfg80211_send_cqm(msg, gfp);
19400 return;
19401
19402 nla_put_failure:
19403 nlmsg_free(msg);
19404 }
19405 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19406
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19407 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19408 struct net_device *netdev, const u8 *bssid,
19409 const u8 *replay_ctr, gfp_t gfp)
19410 {
19411 struct sk_buff *msg;
19412 struct nlattr *rekey_attr;
19413 void *hdr;
19414
19415 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19416 if (!msg)
19417 return;
19418
19419 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19420 if (!hdr) {
19421 nlmsg_free(msg);
19422 return;
19423 }
19424
19425 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19426 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19427 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19428 goto nla_put_failure;
19429
19430 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19431 if (!rekey_attr)
19432 goto nla_put_failure;
19433
19434 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19435 NL80211_REPLAY_CTR_LEN, replay_ctr))
19436 goto nla_put_failure;
19437
19438 nla_nest_end(msg, rekey_attr);
19439
19440 genlmsg_end(msg, hdr);
19441
19442 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19443 NL80211_MCGRP_MLME, gfp);
19444 return;
19445
19446 nla_put_failure:
19447 nlmsg_free(msg);
19448 }
19449
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19450 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19451 const u8 *replay_ctr, gfp_t gfp)
19452 {
19453 struct wireless_dev *wdev = dev->ieee80211_ptr;
19454 struct wiphy *wiphy = wdev->wiphy;
19455 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19456
19457 trace_cfg80211_gtk_rekey_notify(dev, bssid);
19458 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19459 }
19460 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19461
19462 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19463 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19464 struct net_device *netdev, int index,
19465 const u8 *bssid, bool preauth, gfp_t gfp)
19466 {
19467 struct sk_buff *msg;
19468 struct nlattr *attr;
19469 void *hdr;
19470
19471 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19472 if (!msg)
19473 return;
19474
19475 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19476 if (!hdr) {
19477 nlmsg_free(msg);
19478 return;
19479 }
19480
19481 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19482 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19483 goto nla_put_failure;
19484
19485 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19486 if (!attr)
19487 goto nla_put_failure;
19488
19489 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19490 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19491 (preauth &&
19492 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19493 goto nla_put_failure;
19494
19495 nla_nest_end(msg, attr);
19496
19497 genlmsg_end(msg, hdr);
19498
19499 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19500 NL80211_MCGRP_MLME, gfp);
19501 return;
19502
19503 nla_put_failure:
19504 nlmsg_free(msg);
19505 }
19506
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19507 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19508 const u8 *bssid, bool preauth, gfp_t gfp)
19509 {
19510 struct wireless_dev *wdev = dev->ieee80211_ptr;
19511 struct wiphy *wiphy = wdev->wiphy;
19512 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19513
19514 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19515 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19516 }
19517 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19518
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)19519 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19520 struct net_device *netdev,
19521 unsigned int link_id,
19522 struct cfg80211_chan_def *chandef,
19523 gfp_t gfp,
19524 enum nl80211_commands notif,
19525 u8 count, bool quiet)
19526 {
19527 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19528 struct sk_buff *msg;
19529 void *hdr;
19530
19531 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19532 if (!msg)
19533 return;
19534
19535 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19536 if (!hdr) {
19537 nlmsg_free(msg);
19538 return;
19539 }
19540
19541 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19542 goto nla_put_failure;
19543
19544 if (wdev->valid_links &&
19545 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19546 goto nla_put_failure;
19547
19548 if (nl80211_send_chandef(msg, chandef))
19549 goto nla_put_failure;
19550
19551 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19552 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19553 goto nla_put_failure;
19554 if (quiet &&
19555 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19556 goto nla_put_failure;
19557 }
19558
19559 genlmsg_end(msg, hdr);
19560
19561 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19562 NL80211_MCGRP_MLME, gfp);
19563 return;
19564
19565 nla_put_failure:
19566 nlmsg_free(msg);
19567 }
19568
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)19569 void cfg80211_ch_switch_notify(struct net_device *dev,
19570 struct cfg80211_chan_def *chandef,
19571 unsigned int link_id)
19572 {
19573 struct wireless_dev *wdev = dev->ieee80211_ptr;
19574 struct wiphy *wiphy = wdev->wiphy;
19575 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19576
19577 lockdep_assert_wiphy(wdev->wiphy);
19578 WARN_INVALID_LINK_ID(wdev, link_id);
19579
19580 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
19581
19582 switch (wdev->iftype) {
19583 case NL80211_IFTYPE_STATION:
19584 case NL80211_IFTYPE_P2P_CLIENT:
19585 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19586 cfg80211_update_assoc_bss_entry(wdev, link_id,
19587 chandef->chan);
19588 break;
19589 case NL80211_IFTYPE_MESH_POINT:
19590 wdev->u.mesh.chandef = *chandef;
19591 wdev->u.mesh.preset_chandef = *chandef;
19592 break;
19593 case NL80211_IFTYPE_AP:
19594 case NL80211_IFTYPE_P2P_GO:
19595 wdev->links[link_id].ap.chandef = *chandef;
19596 break;
19597 case NL80211_IFTYPE_ADHOC:
19598 wdev->u.ibss.chandef = *chandef;
19599 break;
19600 default:
19601 WARN_ON(1);
19602 break;
19603 }
19604
19605 cfg80211_schedule_channels_check(wdev);
19606 cfg80211_sched_dfs_chan_update(rdev);
19607
19608 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19609 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
19610 }
19611 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19612
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet)19613 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19614 struct cfg80211_chan_def *chandef,
19615 unsigned int link_id, u8 count,
19616 bool quiet)
19617 {
19618 struct wireless_dev *wdev = dev->ieee80211_ptr;
19619 struct wiphy *wiphy = wdev->wiphy;
19620 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19621
19622 lockdep_assert_wiphy(wdev->wiphy);
19623 WARN_INVALID_LINK_ID(wdev, link_id);
19624
19625 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
19626
19627
19628 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19629 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19630 count, quiet);
19631 }
19632 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19633
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap,u8 link_id)19634 int cfg80211_bss_color_notify(struct net_device *dev,
19635 enum nl80211_commands cmd, u8 count,
19636 u64 color_bitmap, u8 link_id)
19637 {
19638 struct wireless_dev *wdev = dev->ieee80211_ptr;
19639 struct wiphy *wiphy = wdev->wiphy;
19640 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19641 struct sk_buff *msg;
19642 void *hdr;
19643
19644 lockdep_assert_wiphy(wdev->wiphy);
19645
19646 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19647
19648 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19649 if (!msg)
19650 return -ENOMEM;
19651
19652 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19653 if (!hdr)
19654 goto nla_put_failure;
19655
19656 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19657 goto nla_put_failure;
19658
19659 if (wdev->valid_links &&
19660 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19661 goto nla_put_failure;
19662
19663 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19664 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19665 goto nla_put_failure;
19666
19667 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19668 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19669 color_bitmap, NL80211_ATTR_PAD))
19670 goto nla_put_failure;
19671
19672 genlmsg_end(msg, hdr);
19673
19674 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19675 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19676
19677 nla_put_failure:
19678 nlmsg_free(msg);
19679 return -EINVAL;
19680 }
19681 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19682
19683 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)19684 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19685 const struct cfg80211_chan_def *chandef,
19686 enum nl80211_radar_event event,
19687 struct net_device *netdev, gfp_t gfp)
19688 {
19689 struct sk_buff *msg;
19690 void *hdr;
19691
19692 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19693 if (!msg)
19694 return;
19695
19696 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19697 if (!hdr) {
19698 nlmsg_free(msg);
19699 return;
19700 }
19701
19702 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19703 goto nla_put_failure;
19704
19705 /* NOP and radar events don't need a netdev parameter */
19706 if (netdev) {
19707 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19708
19709 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19710 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19711 NL80211_ATTR_PAD))
19712 goto nla_put_failure;
19713 }
19714
19715 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19716 goto nla_put_failure;
19717
19718 if (nl80211_send_chandef(msg, chandef))
19719 goto nla_put_failure;
19720
19721 genlmsg_end(msg, hdr);
19722
19723 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19724 NL80211_MCGRP_MLME, gfp);
19725 return;
19726
19727 nla_put_failure:
19728 nlmsg_free(msg);
19729 }
19730
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)19731 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19732 struct sta_opmode_info *sta_opmode,
19733 gfp_t gfp)
19734 {
19735 struct sk_buff *msg;
19736 struct wireless_dev *wdev = dev->ieee80211_ptr;
19737 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19738 void *hdr;
19739
19740 if (WARN_ON(!mac))
19741 return;
19742
19743 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19744 if (!msg)
19745 return;
19746
19747 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19748 if (!hdr) {
19749 nlmsg_free(msg);
19750 return;
19751 }
19752
19753 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19754 goto nla_put_failure;
19755
19756 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19757 goto nla_put_failure;
19758
19759 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19760 goto nla_put_failure;
19761
19762 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19763 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19764 goto nla_put_failure;
19765
19766 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19767 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19768 goto nla_put_failure;
19769
19770 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19771 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19772 goto nla_put_failure;
19773
19774 genlmsg_end(msg, hdr);
19775
19776 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19777 NL80211_MCGRP_MLME, gfp);
19778
19779 return;
19780
19781 nla_put_failure:
19782 nlmsg_free(msg);
19783 }
19784 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19785
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)19786 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19787 u64 cookie, bool acked, s32 ack_signal,
19788 bool is_valid_ack_signal, gfp_t gfp)
19789 {
19790 struct wireless_dev *wdev = dev->ieee80211_ptr;
19791 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19792 struct sk_buff *msg;
19793 void *hdr;
19794
19795 trace_cfg80211_probe_status(dev, addr, cookie, acked);
19796
19797 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19798
19799 if (!msg)
19800 return;
19801
19802 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19803 if (!hdr) {
19804 nlmsg_free(msg);
19805 return;
19806 }
19807
19808 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19809 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19810 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19811 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19812 NL80211_ATTR_PAD) ||
19813 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19814 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19815 ack_signal)))
19816 goto nla_put_failure;
19817
19818 genlmsg_end(msg, hdr);
19819
19820 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19821 NL80211_MCGRP_MLME, gfp);
19822 return;
19823
19824 nla_put_failure:
19825 nlmsg_free(msg);
19826 }
19827 EXPORT_SYMBOL(cfg80211_probe_status);
19828
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)19829 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19830 size_t len, int freq, int sig_dbm)
19831 {
19832 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19833 struct sk_buff *msg;
19834 void *hdr;
19835 struct cfg80211_beacon_registration *reg;
19836
19837 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19838
19839 spin_lock_bh(&rdev->beacon_registrations_lock);
19840 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19841 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19842 if (!msg) {
19843 spin_unlock_bh(&rdev->beacon_registrations_lock);
19844 return;
19845 }
19846
19847 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19848 if (!hdr)
19849 goto nla_put_failure;
19850
19851 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19852 (freq &&
19853 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19854 KHZ_TO_MHZ(freq)) ||
19855 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19856 freq % 1000))) ||
19857 (sig_dbm &&
19858 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19859 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19860 goto nla_put_failure;
19861
19862 genlmsg_end(msg, hdr);
19863
19864 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19865 }
19866 spin_unlock_bh(&rdev->beacon_registrations_lock);
19867 return;
19868
19869 nla_put_failure:
19870 spin_unlock_bh(&rdev->beacon_registrations_lock);
19871 nlmsg_free(msg);
19872 }
19873 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19874
19875 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)19876 static int cfg80211_net_detect_results(struct sk_buff *msg,
19877 struct cfg80211_wowlan_wakeup *wakeup)
19878 {
19879 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19880 struct nlattr *nl_results, *nl_match, *nl_freqs;
19881 int i, j;
19882
19883 nl_results = nla_nest_start_noflag(msg,
19884 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19885 if (!nl_results)
19886 return -EMSGSIZE;
19887
19888 for (i = 0; i < nd->n_matches; i++) {
19889 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19890
19891 nl_match = nla_nest_start_noflag(msg, i);
19892 if (!nl_match)
19893 break;
19894
19895 /* The SSID attribute is optional in nl80211, but for
19896 * simplicity reasons it's always present in the
19897 * cfg80211 structure. If a driver can't pass the
19898 * SSID, that needs to be changed. A zero length SSID
19899 * is still a valid SSID (wildcard), so it cannot be
19900 * used for this purpose.
19901 */
19902 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19903 match->ssid.ssid)) {
19904 nla_nest_cancel(msg, nl_match);
19905 goto out;
19906 }
19907
19908 if (match->n_channels) {
19909 nl_freqs = nla_nest_start_noflag(msg,
19910 NL80211_ATTR_SCAN_FREQUENCIES);
19911 if (!nl_freqs) {
19912 nla_nest_cancel(msg, nl_match);
19913 goto out;
19914 }
19915
19916 for (j = 0; j < match->n_channels; j++) {
19917 if (nla_put_u32(msg, j, match->channels[j])) {
19918 nla_nest_cancel(msg, nl_freqs);
19919 nla_nest_cancel(msg, nl_match);
19920 goto out;
19921 }
19922 }
19923
19924 nla_nest_end(msg, nl_freqs);
19925 }
19926
19927 nla_nest_end(msg, nl_match);
19928 }
19929
19930 out:
19931 nla_nest_end(msg, nl_results);
19932 return 0;
19933 }
19934
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)19935 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19936 struct cfg80211_wowlan_wakeup *wakeup,
19937 gfp_t gfp)
19938 {
19939 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19940 struct sk_buff *msg;
19941 void *hdr;
19942 int size = 200;
19943
19944 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19945
19946 if (wakeup)
19947 size += wakeup->packet_present_len;
19948
19949 msg = nlmsg_new(size, gfp);
19950 if (!msg)
19951 return;
19952
19953 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19954 if (!hdr)
19955 goto free_msg;
19956
19957 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19958 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19959 NL80211_ATTR_PAD))
19960 goto free_msg;
19961
19962 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19963 wdev->netdev->ifindex))
19964 goto free_msg;
19965
19966 if (wakeup) {
19967 struct nlattr *reasons;
19968
19969 reasons = nla_nest_start_noflag(msg,
19970 NL80211_ATTR_WOWLAN_TRIGGERS);
19971 if (!reasons)
19972 goto free_msg;
19973
19974 if (wakeup->disconnect &&
19975 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19976 goto free_msg;
19977 if (wakeup->magic_pkt &&
19978 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19979 goto free_msg;
19980 if (wakeup->gtk_rekey_failure &&
19981 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19982 goto free_msg;
19983 if (wakeup->eap_identity_req &&
19984 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19985 goto free_msg;
19986 if (wakeup->four_way_handshake &&
19987 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19988 goto free_msg;
19989 if (wakeup->rfkill_release &&
19990 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19991 goto free_msg;
19992
19993 if (wakeup->pattern_idx >= 0 &&
19994 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19995 wakeup->pattern_idx))
19996 goto free_msg;
19997
19998 if (wakeup->tcp_match &&
19999 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
20000 goto free_msg;
20001
20002 if (wakeup->tcp_connlost &&
20003 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
20004 goto free_msg;
20005
20006 if (wakeup->tcp_nomoretokens &&
20007 nla_put_flag(msg,
20008 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
20009 goto free_msg;
20010
20011 if (wakeup->unprot_deauth_disassoc &&
20012 nla_put_flag(msg,
20013 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
20014 goto free_msg;
20015
20016 if (wakeup->packet) {
20017 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
20018 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
20019
20020 if (!wakeup->packet_80211) {
20021 pkt_attr =
20022 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
20023 len_attr =
20024 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
20025 }
20026
20027 if (wakeup->packet_len &&
20028 nla_put_u32(msg, len_attr, wakeup->packet_len))
20029 goto free_msg;
20030
20031 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
20032 wakeup->packet))
20033 goto free_msg;
20034 }
20035
20036 if (wakeup->net_detect &&
20037 cfg80211_net_detect_results(msg, wakeup))
20038 goto free_msg;
20039
20040 nla_nest_end(msg, reasons);
20041 }
20042
20043 genlmsg_end(msg, hdr);
20044
20045 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20046 NL80211_MCGRP_MLME, gfp);
20047 return;
20048
20049 free_msg:
20050 nlmsg_free(msg);
20051 }
20052 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
20053 #endif
20054
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)20055 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
20056 enum nl80211_tdls_operation oper,
20057 u16 reason_code, gfp_t gfp)
20058 {
20059 struct wireless_dev *wdev = dev->ieee80211_ptr;
20060 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20061 struct sk_buff *msg;
20062 void *hdr;
20063
20064 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
20065 reason_code);
20066
20067 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20068 if (!msg)
20069 return;
20070
20071 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
20072 if (!hdr) {
20073 nlmsg_free(msg);
20074 return;
20075 }
20076
20077 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20078 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20079 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
20080 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
20081 (reason_code > 0 &&
20082 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
20083 goto nla_put_failure;
20084
20085 genlmsg_end(msg, hdr);
20086
20087 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20088 NL80211_MCGRP_MLME, gfp);
20089 return;
20090
20091 nla_put_failure:
20092 nlmsg_free(msg);
20093 }
20094 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
20095
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)20096 static int nl80211_netlink_notify(struct notifier_block * nb,
20097 unsigned long state,
20098 void *_notify)
20099 {
20100 struct netlink_notify *notify = _notify;
20101 struct cfg80211_registered_device *rdev;
20102 struct wireless_dev *wdev;
20103 struct cfg80211_beacon_registration *reg, *tmp;
20104
20105 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
20106 return NOTIFY_DONE;
20107
20108 rcu_read_lock();
20109
20110 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
20111 struct cfg80211_sched_scan_request *sched_scan_req;
20112
20113 list_for_each_entry_rcu(sched_scan_req,
20114 &rdev->sched_scan_req_list,
20115 list) {
20116 if (sched_scan_req->owner_nlportid == notify->portid) {
20117 sched_scan_req->nl_owner_dead = true;
20118 wiphy_work_queue(&rdev->wiphy,
20119 &rdev->sched_scan_stop_wk);
20120 }
20121 }
20122
20123 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
20124 cfg80211_mlme_unregister_socket(wdev, notify->portid);
20125
20126 if (wdev->owner_nlportid == notify->portid) {
20127 wdev->nl_owner_dead = true;
20128 schedule_work(&rdev->destroy_work);
20129 } else if (wdev->conn_owner_nlportid == notify->portid) {
20130 schedule_work(&wdev->disconnect_wk);
20131 }
20132
20133 cfg80211_release_pmsr(wdev, notify->portid);
20134 }
20135
20136 spin_lock_bh(&rdev->beacon_registrations_lock);
20137 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
20138 list) {
20139 if (reg->nlportid == notify->portid) {
20140 list_del(®->list);
20141 kfree(reg);
20142 break;
20143 }
20144 }
20145 spin_unlock_bh(&rdev->beacon_registrations_lock);
20146 }
20147
20148 rcu_read_unlock();
20149
20150 /*
20151 * It is possible that the user space process that is controlling the
20152 * indoor setting disappeared, so notify the regulatory core.
20153 */
20154 regulatory_netlink_notify(notify->portid);
20155 return NOTIFY_OK;
20156 }
20157
20158 static struct notifier_block nl80211_netlink_notifier = {
20159 .notifier_call = nl80211_netlink_notify,
20160 };
20161
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)20162 void cfg80211_ft_event(struct net_device *netdev,
20163 struct cfg80211_ft_event_params *ft_event)
20164 {
20165 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20166 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20167 struct sk_buff *msg;
20168 void *hdr;
20169
20170 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
20171
20172 if (!ft_event->target_ap)
20173 return;
20174
20175 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
20176 GFP_KERNEL);
20177 if (!msg)
20178 return;
20179
20180 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
20181 if (!hdr)
20182 goto out;
20183
20184 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20185 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20186 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
20187 goto out;
20188
20189 if (ft_event->ies &&
20190 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
20191 goto out;
20192 if (ft_event->ric_ies &&
20193 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
20194 ft_event->ric_ies))
20195 goto out;
20196
20197 genlmsg_end(msg, hdr);
20198
20199 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20200 NL80211_MCGRP_MLME, GFP_KERNEL);
20201 return;
20202 out:
20203 nlmsg_free(msg);
20204 }
20205 EXPORT_SYMBOL(cfg80211_ft_event);
20206
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)20207 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
20208 {
20209 struct cfg80211_registered_device *rdev;
20210 struct sk_buff *msg;
20211 void *hdr;
20212 u32 nlportid;
20213
20214 rdev = wiphy_to_rdev(wdev->wiphy);
20215 if (!rdev->crit_proto_nlportid)
20216 return;
20217
20218 nlportid = rdev->crit_proto_nlportid;
20219 rdev->crit_proto_nlportid = 0;
20220
20221 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20222 if (!msg)
20223 return;
20224
20225 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
20226 if (!hdr)
20227 goto nla_put_failure;
20228
20229 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20230 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20231 NL80211_ATTR_PAD))
20232 goto nla_put_failure;
20233
20234 genlmsg_end(msg, hdr);
20235
20236 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20237 return;
20238
20239 nla_put_failure:
20240 nlmsg_free(msg);
20241 }
20242 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20243
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)20244 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20245 {
20246 struct wiphy *wiphy = wdev->wiphy;
20247 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20248 struct sk_buff *msg;
20249 void *hdr;
20250
20251 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20252 if (!msg)
20253 return;
20254
20255 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20256 if (!hdr)
20257 goto out;
20258
20259 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20260 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20261 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20262 NL80211_ATTR_PAD) ||
20263 (wdev->valid_links &&
20264 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20265 goto out;
20266
20267 genlmsg_end(msg, hdr);
20268
20269 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20270 NL80211_MCGRP_MLME, GFP_KERNEL);
20271 return;
20272 out:
20273 nlmsg_free(msg);
20274 }
20275
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)20276 int cfg80211_external_auth_request(struct net_device *dev,
20277 struct cfg80211_external_auth_params *params,
20278 gfp_t gfp)
20279 {
20280 struct wireless_dev *wdev = dev->ieee80211_ptr;
20281 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20282 struct sk_buff *msg;
20283 void *hdr;
20284
20285 if (!wdev->conn_owner_nlportid)
20286 return -EINVAL;
20287
20288 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20289 if (!msg)
20290 return -ENOMEM;
20291
20292 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20293 if (!hdr)
20294 goto nla_put_failure;
20295
20296 /* Some historical mistakes in drivers <-> userspace interface (notably
20297 * between drivers and wpa_supplicant) led to a big-endian conversion
20298 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
20299 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
20300 * benefit of older wpa_supplicant versions, send this particular value
20301 * in big-endian. Note that newer wpa_supplicant will also detect this
20302 * particular value in big endian still, so it all continues to work.
20303 */
20304 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
20305 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
20306 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
20307 goto nla_put_failure;
20308 } else {
20309 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
20310 params->key_mgmt_suite))
20311 goto nla_put_failure;
20312 }
20313
20314 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20315 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20316 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20317 params->action) ||
20318 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20319 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20320 params->ssid.ssid) ||
20321 (!is_zero_ether_addr(params->mld_addr) &&
20322 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20323 goto nla_put_failure;
20324
20325 genlmsg_end(msg, hdr);
20326 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20327 wdev->conn_owner_nlportid);
20328 return 0;
20329
20330 nla_put_failure:
20331 nlmsg_free(msg);
20332 return -ENOBUFS;
20333 }
20334 EXPORT_SYMBOL(cfg80211_external_auth_request);
20335
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)20336 void cfg80211_update_owe_info_event(struct net_device *netdev,
20337 struct cfg80211_update_owe_info *owe_info,
20338 gfp_t gfp)
20339 {
20340 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20341 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20342 struct sk_buff *msg;
20343 void *hdr;
20344
20345 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20346
20347 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20348 if (!msg)
20349 return;
20350
20351 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20352 if (!hdr)
20353 goto nla_put_failure;
20354
20355 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20356 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20357 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20358 goto nla_put_failure;
20359
20360 if (!owe_info->ie_len ||
20361 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20362 goto nla_put_failure;
20363
20364 if (owe_info->assoc_link_id != -1) {
20365 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20366 owe_info->assoc_link_id))
20367 goto nla_put_failure;
20368
20369 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20370 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20371 owe_info->peer_mld_addr))
20372 goto nla_put_failure;
20373 }
20374
20375 genlmsg_end(msg, hdr);
20376
20377 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20378 NL80211_MCGRP_MLME, gfp);
20379 return;
20380
20381 nla_put_failure:
20382 genlmsg_cancel(msg, hdr);
20383 nlmsg_free(msg);
20384 }
20385 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20386
cfg80211_schedule_channels_check(struct wireless_dev * wdev)20387 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
20388 {
20389 struct wiphy *wiphy = wdev->wiphy;
20390
20391 /* Schedule channels check if NO_IR or DFS relaxations are supported */
20392 if (wdev->iftype == NL80211_IFTYPE_STATION &&
20393 (wiphy_ext_feature_isset(wiphy,
20394 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
20395 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
20396 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
20397 reg_check_channels();
20398 }
20399 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
20400
20401 /* initialisation/exit functions */
20402
nl80211_init(void)20403 int __init nl80211_init(void)
20404 {
20405 int err;
20406
20407 err = genl_register_family(&nl80211_fam);
20408 if (err)
20409 return err;
20410
20411 err = netlink_register_notifier(&nl80211_netlink_notifier);
20412 if (err)
20413 goto err_out;
20414
20415 return 0;
20416 err_out:
20417 genl_unregister_family(&nl80211_fam);
20418 return err;
20419 }
20420
nl80211_exit(void)20421 void nl80211_exit(void)
20422 {
20423 netlink_unregister_notifier(&nl80211_netlink_notifier);
20424 genl_unregister_family(&nl80211_fam);
20425 }
20426