1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2025 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 unsigned int fixedlen, hdrlen;
233 bool s1g_bcn;
234
235 if (len < offsetofend(typeof(*mgmt), frame_control))
236 goto err;
237
238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
239 if (s1g_bcn) {
240 fixedlen = offsetof(struct ieee80211_ext,
241 u.s1g_beacon.variable);
242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
243 } else {
244 fixedlen = offsetof(struct ieee80211_mgmt,
245 u.beacon.variable);
246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
247 }
248
249 if (len < fixedlen)
250 goto err;
251
252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
253 goto err;
254
255 data += fixedlen;
256 len -= fixedlen;
257
258 for_each_element(elem, data, len) {
259 /* nothing */
260 }
261
262 if (for_each_element_completed(elem, data, len))
263 return 0;
264
265 err:
266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
267 return -EINVAL;
268 }
269
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)270 static int validate_ie_attr(const struct nlattr *attr,
271 struct netlink_ext_ack *extack)
272 {
273 const u8 *data = nla_data(attr);
274 unsigned int len = nla_len(attr);
275 const struct element *elem;
276
277 for_each_element(elem, data, len) {
278 /* nothing */
279 }
280
281 if (for_each_element_completed(elem, data, len))
282 return 0;
283
284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
285 return -EINVAL;
286 }
287
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)288 static int validate_he_capa(const struct nlattr *attr,
289 struct netlink_ext_ack *extack)
290 {
291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
292 return -EINVAL;
293
294 return 0;
295 }
296
validate_supported_selectors(const struct nlattr * attr,struct netlink_ext_ack * extack)297 static int validate_supported_selectors(const struct nlattr *attr,
298 struct netlink_ext_ack *extack)
299 {
300 const u8 *supported_selectors = nla_data(attr);
301 u8 supported_selectors_len = nla_len(attr);
302
303 /* The top bit must not be set as it is not part of the selector */
304 for (int i = 0; i < supported_selectors_len; i++) {
305 if (supported_selectors[i] & 0x80)
306 return -EINVAL;
307 }
308
309 return 0;
310 }
311
312 /* policy for the attributes */
313 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
314
315 static const struct nla_policy
316 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
317 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
318 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
319 .len = U8_MAX },
320 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
321 .len = U8_MAX },
322 };
323
324 static const struct nla_policy
325 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
326 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
327 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
328 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
329 NLA_POLICY_MAX(NLA_U8, 15),
330 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
331 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
332 NLA_POLICY_MAX(NLA_U8, 15),
333 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
334 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
335 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
336 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
337 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
338 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
339 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
340 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
341 };
342
343 static const struct nla_policy
344 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
345 [NL80211_PMSR_TYPE_FTM] =
346 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
347 };
348
349 static const struct nla_policy
350 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
351 [NL80211_PMSR_REQ_ATTR_DATA] =
352 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
353 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
354 };
355
356 static const struct nla_policy
357 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
358 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
359 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
360 [NL80211_PMSR_PEER_ATTR_REQ] =
361 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
362 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
363 };
364
365 static const struct nla_policy
366 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
367 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
368 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
369 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
370 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
371 [NL80211_PMSR_ATTR_PEERS] =
372 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
373 };
374
375 static const struct nla_policy
376 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
377 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
378 NLA_POLICY_RANGE(NLA_U8, 1, 20),
379 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
380 NLA_POLICY_RANGE(NLA_U8, 1, 20),
381 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
382 NLA_POLICY_RANGE(NLA_U8, 1, 20),
383 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
384 NLA_POLICY_EXACT_LEN(8),
385 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
386 NLA_POLICY_EXACT_LEN(8),
387 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
388 };
389
390 static const struct nla_policy
391 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
392 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
393 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
394 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
395 };
396
397 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
398 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
399 .len = NL80211_MAX_SUPP_RATES },
400 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
401 .len = NL80211_MAX_SUPP_HT_RATES },
402 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
403 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
404 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
405 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
406 NL80211_RATE_INFO_HE_GI_0_8,
407 NL80211_RATE_INFO_HE_GI_3_2),
408 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
409 NL80211_RATE_INFO_HE_1XLTF,
410 NL80211_RATE_INFO_HE_4XLTF),
411 };
412
413 static const struct nla_policy
414 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
415 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
416 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
417 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
418 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
419 [NL80211_TID_CONFIG_ATTR_NOACK] =
420 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
421 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
422 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
423 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
424 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
425 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
426 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
427 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
428 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
429 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
430 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
431 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
432 NLA_POLICY_NESTED(nl80211_txattr_policy),
433 };
434
435 static const struct nla_policy
436 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
437 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
438 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
439 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
440 NLA_POLICY_RANGE(NLA_BINARY,
441 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
442 IEEE80211_MAX_DATA_LEN),
443 };
444
445 static const struct nla_policy
446 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
447 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
448 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
449 .len = IEEE80211_MAX_DATA_LEN }
450 };
451
452 static const struct nla_policy
453 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
454 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
455 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
456 };
457
458 static const struct nla_policy
459 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
460 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
461 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
462 };
463
464 static const struct nla_policy
465 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
466 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
467 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
468 NLA_POLICY_MIN(NLA_U8, 1),
469 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
470 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
471 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
472 };
473
474 static const struct nla_policy
475 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
476 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
477 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
478 };
479
480 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
481 .min = 0,
482 .max = 0xffff,
483 };
484
485 static const struct netlink_range_validation q_range = {
486 .max = INT_MAX,
487 };
488
489 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
490 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
491 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
492 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
493 .len = 20-1 },
494 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
495
496 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
497 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
498 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
499 NL80211_EDMG_CHANNELS_MIN,
500 NL80211_EDMG_CHANNELS_MAX),
501 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
502 NL80211_EDMG_BW_CONFIG_MIN,
503 NL80211_EDMG_BW_CONFIG_MAX),
504
505 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
506 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
507 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
508 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
509
510 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
511 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
512 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
513 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
514 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
515 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
516
517 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
518 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
519 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
520
521 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
522 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
523
524 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
525 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
526 .len = WLAN_MAX_KEY_LEN },
527 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
528 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
529 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
530 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
531 [NL80211_ATTR_KEY_TYPE] =
532 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
533
534 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
535 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
536 [NL80211_ATTR_BEACON_HEAD] =
537 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
538 IEEE80211_MAX_DATA_LEN),
539 [NL80211_ATTR_BEACON_TAIL] =
540 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
541 IEEE80211_MAX_DATA_LEN),
542 [NL80211_ATTR_STA_AID] =
543 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
544 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
545 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
546 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
547 .len = NL80211_MAX_SUPP_RATES },
548 [NL80211_ATTR_STA_PLINK_ACTION] =
549 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
550 [NL80211_ATTR_STA_TX_POWER_SETTING] =
551 NLA_POLICY_RANGE(NLA_U8,
552 NL80211_TX_POWER_AUTOMATIC,
553 NL80211_TX_POWER_FIXED),
554 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
555 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
556 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
557 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
558 .len = IEEE80211_MAX_MESH_ID_LEN },
559 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
560
561 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
562 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
563 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
564
565 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
566 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
567 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
568 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
569 .len = NL80211_MAX_SUPP_RATES },
570 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
571
572 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
573 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
574
575 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
576
577 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
578 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
579 validate_ie_attr,
580 IEEE80211_MAX_DATA_LEN),
581 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
582 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
583
584 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
585 .len = IEEE80211_MAX_SSID_LEN },
586 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
587 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
588 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
589 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
590 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
591 NL80211_MFP_NO,
592 NL80211_MFP_OPTIONAL),
593 [NL80211_ATTR_STA_FLAGS2] =
594 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
595 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
596 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
597 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
598 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
599 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
600 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
601 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
602 [NL80211_ATTR_WPA_VERSIONS] =
603 NLA_POLICY_RANGE(NLA_U32, 0,
604 NL80211_WPA_VERSION_1 |
605 NL80211_WPA_VERSION_2 |
606 NL80211_WPA_VERSION_3),
607 [NL80211_ATTR_PID] = { .type = NLA_U32 },
608 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
609 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
610 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
611 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
612 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
613 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
614 .len = IEEE80211_MAX_DATA_LEN },
615 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
616 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
617 NL80211_PS_DISABLED,
618 NL80211_PS_ENABLED),
619 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
620 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
621 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
622 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
623 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
624 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
625 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
626 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
627 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
628 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
629 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
630 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
631 [NL80211_ATTR_STA_PLINK_STATE] =
632 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
633 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
634 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
635 [NL80211_ATTR_MESH_PEER_AID] =
636 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
637 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
638 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
639 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
640 [NL80211_ATTR_HIDDEN_SSID] =
641 NLA_POLICY_RANGE(NLA_U32,
642 NL80211_HIDDEN_SSID_NOT_IN_USE,
643 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
644 [NL80211_ATTR_IE_PROBE_RESP] =
645 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
646 IEEE80211_MAX_DATA_LEN),
647 [NL80211_ATTR_IE_ASSOC_RESP] =
648 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
649 IEEE80211_MAX_DATA_LEN),
650 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
651 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
652 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
653 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
654 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
655 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
656 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
657 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
658 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
659 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
660 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
661 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
662 .len = IEEE80211_MAX_DATA_LEN },
663 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
664 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
665 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
666 .len = NL80211_HT_CAPABILITY_LEN
667 },
668 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
669 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
670 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
671 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
672 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
673
674 /* need to include at least Auth Transaction and Status Code */
675 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
676
677 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
678 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
679 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
680 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
681 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
682 NLA_POLICY_RANGE(NLA_U32,
683 NL80211_MESH_POWER_UNKNOWN + 1,
684 NL80211_MESH_POWER_MAX),
685 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
686 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
687 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
688 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
689 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
690 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
691 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
692 .len = NL80211_VHT_CAPABILITY_LEN,
693 },
694 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
695 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
696 .len = IEEE80211_MAX_DATA_LEN },
697 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
698 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
699 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
700 [NL80211_ATTR_PEER_AID] =
701 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
702 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
703 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
704 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
705 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
706 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
707 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
708 /*
709 * The value of the Length field of the Supported Operating
710 * Classes element is between 2 and 253.
711 */
712 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
713 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
714 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
715 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
716 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
717 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
718 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
719 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
720 IEEE80211_QOS_MAP_LEN_MIN,
721 IEEE80211_QOS_MAP_LEN_MAX),
722 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
723 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
724 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
725 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
726 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
727 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
728 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
729 [NL80211_ATTR_USER_PRIO] =
730 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
731 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
732 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
733 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
734 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
735 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
736 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
737 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
738 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
739 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
740 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
741 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
742 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
743 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
744 .len = VHT_MUMIMO_GROUPS_DATA_LEN
745 },
746 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
747 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
748 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
749 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
750 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
751 .len = FILS_MAX_KEK_LEN },
752 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
753 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
754 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
755 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
756 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
757 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
758 },
759 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
760 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
761 .len = FILS_ERP_MAX_USERNAME_LEN },
762 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
763 .len = FILS_ERP_MAX_REALM_LEN },
764 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
765 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
766 .len = FILS_ERP_MAX_RRK_LEN },
767 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
768 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
769 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
770 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
771 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
772
773 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
774 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
775 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
776 [NL80211_ATTR_HE_CAPABILITY] =
777 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
778 NL80211_HE_MAX_CAPABILITY_LEN),
779 [NL80211_ATTR_FTM_RESPONDER] =
780 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
781 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
782 [NL80211_ATTR_PEER_MEASUREMENTS] =
783 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
784 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
785 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
786 .len = SAE_PASSWORD_MAX_LEN },
787 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
788 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
789 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
790 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
791 [NL80211_ATTR_TID_CONFIG] =
792 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
793 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
794 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
795 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
796 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
797 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
798 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
799 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
800 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
801 [NL80211_ATTR_FILS_DISCOVERY] =
802 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
803 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
804 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
805 [NL80211_ATTR_S1G_CAPABILITY] =
806 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
807 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
808 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
809 [NL80211_ATTR_SAE_PWE] =
810 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
811 NL80211_SAE_PWE_BOTH),
812 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
813 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
814 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
815 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
816 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
817 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
818 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
819 [NL80211_ATTR_MBSSID_CONFIG] =
820 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
821 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
822 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
823 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
824 [NL80211_ATTR_EHT_CAPABILITY] =
825 NLA_POLICY_RANGE(NLA_BINARY,
826 NL80211_EHT_MIN_CAPABILITY_LEN,
827 NL80211_EHT_MAX_CAPABILITY_LEN),
828 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
829 [NL80211_ATTR_MLO_LINKS] =
830 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
831 [NL80211_ATTR_MLO_LINK_ID] =
832 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
833 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
834 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
835 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
836 [NL80211_ATTR_PUNCT_BITMAP] =
837 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
838
839 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
840 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
841 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
842 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
843 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
844 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
845 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
846 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
847 [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
848 [NL80211_ATTR_SUPPORTED_SELECTORS] =
849 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
850 NL80211_MAX_SUPP_SELECTORS),
851 [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
852 [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
853 [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
854 };
855
856 /* policy for the key attributes */
857 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
858 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
859 [NL80211_KEY_IDX] = { .type = NLA_U8 },
860 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
861 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
862 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
863 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
864 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
865 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
866 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
867 };
868
869 /* policy for the key default flags */
870 static const struct nla_policy
871 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
872 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
873 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
874 };
875
876 #ifdef CONFIG_PM
877 /* policy for WoWLAN attributes */
878 static const struct nla_policy
879 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
880 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
881 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
882 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
883 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
884 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
885 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
886 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
887 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
888 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
889 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
890 };
891
892 static const struct nla_policy
893 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
894 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
895 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
896 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
897 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
898 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
899 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
900 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
901 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
902 },
903 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
904 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
905 },
906 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
907 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
908 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
909 };
910 #endif /* CONFIG_PM */
911
912 /* policy for coalesce rule attributes */
913 static const struct nla_policy
914 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
915 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
916 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
917 NLA_POLICY_RANGE(NLA_U32,
918 NL80211_COALESCE_CONDITION_MATCH,
919 NL80211_COALESCE_CONDITION_NO_MATCH),
920 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
921 };
922
923 /* policy for GTK rekey offload attributes */
924 static const struct nla_policy
925 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
926 [NL80211_REKEY_DATA_KEK] = {
927 .type = NLA_BINARY,
928 .len = NL80211_KEK_EXT_LEN
929 },
930 [NL80211_REKEY_DATA_KCK] = {
931 .type = NLA_BINARY,
932 .len = NL80211_KCK_EXT_LEN_32
933 },
934 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
935 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
936 };
937
938 static const struct nla_policy
939 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
940 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
941 .len = IEEE80211_MAX_SSID_LEN },
942 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
943 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
944 };
945
946 static const struct nla_policy
947 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
948 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
949 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
950 };
951
952 static const struct nla_policy
953 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
954 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
955 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
956 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
957 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
958 },
959 };
960
961 /* policy for NAN function attributes */
962 static const struct nla_policy
963 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
964 [NL80211_NAN_FUNC_TYPE] =
965 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
966 [NL80211_NAN_FUNC_SERVICE_ID] = {
967 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
968 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
969 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
970 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
971 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
972 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
973 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
974 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
975 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
976 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
977 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
978 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
979 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
980 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
981 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
982 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
983 };
984
985 /* policy for Service Response Filter attributes */
986 static const struct nla_policy
987 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
988 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
989 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
990 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
991 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
992 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
993 };
994
995 /* policy for packet pattern attributes */
996 static const struct nla_policy
997 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
998 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
999 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1000 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1001 };
1002
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)1003 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1004 struct cfg80211_registered_device **rdev,
1005 struct wireless_dev **wdev,
1006 struct nlattr **attrbuf)
1007 {
1008 int err;
1009
1010 if (!cb->args[0]) {
1011 struct nlattr **attrbuf_free = NULL;
1012
1013 if (!attrbuf) {
1014 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1015 GFP_KERNEL);
1016 if (!attrbuf)
1017 return -ENOMEM;
1018 attrbuf_free = attrbuf;
1019 }
1020
1021 err = nlmsg_parse_deprecated(cb->nlh,
1022 GENL_HDRLEN + nl80211_fam.hdrsize,
1023 attrbuf, nl80211_fam.maxattr,
1024 nl80211_policy, NULL);
1025 if (err) {
1026 kfree(attrbuf_free);
1027 return err;
1028 }
1029
1030 rtnl_lock();
1031 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1032 attrbuf);
1033 kfree(attrbuf_free);
1034 if (IS_ERR(*wdev)) {
1035 rtnl_unlock();
1036 return PTR_ERR(*wdev);
1037 }
1038 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1039 mutex_lock(&(*rdev)->wiphy.mtx);
1040 rtnl_unlock();
1041 /* 0 is the first index - add 1 to parse only once */
1042 cb->args[0] = (*rdev)->wiphy_idx + 1;
1043 cb->args[1] = (*wdev)->identifier;
1044 } else {
1045 /* subtract the 1 again here */
1046 struct wiphy *wiphy;
1047 struct wireless_dev *tmp;
1048
1049 rtnl_lock();
1050 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1051 if (!wiphy) {
1052 rtnl_unlock();
1053 return -ENODEV;
1054 }
1055 *rdev = wiphy_to_rdev(wiphy);
1056 *wdev = NULL;
1057
1058 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1059 if (tmp->identifier == cb->args[1]) {
1060 *wdev = tmp;
1061 break;
1062 }
1063 }
1064
1065 if (!*wdev) {
1066 rtnl_unlock();
1067 return -ENODEV;
1068 }
1069 mutex_lock(&(*rdev)->wiphy.mtx);
1070 rtnl_unlock();
1071 }
1072
1073 return 0;
1074 }
1075
1076 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1077 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1078 int flags, u8 cmd)
1079 {
1080 /* since there is no private header just add the generic one */
1081 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1082 }
1083
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1084 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1085 const struct ieee80211_reg_rule *rule)
1086 {
1087 int j;
1088 struct nlattr *nl_wmm_rules =
1089 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1090
1091 if (!nl_wmm_rules)
1092 goto nla_put_failure;
1093
1094 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1095 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1096
1097 if (!nl_wmm_rule)
1098 goto nla_put_failure;
1099
1100 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1101 rule->wmm_rule.client[j].cw_min) ||
1102 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1103 rule->wmm_rule.client[j].cw_max) ||
1104 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1105 rule->wmm_rule.client[j].aifsn) ||
1106 nla_put_u16(msg, NL80211_WMMR_TXOP,
1107 rule->wmm_rule.client[j].cot))
1108 goto nla_put_failure;
1109
1110 nla_nest_end(msg, nl_wmm_rule);
1111 }
1112 nla_nest_end(msg, nl_wmm_rules);
1113
1114 return 0;
1115
1116 nla_put_failure:
1117 return -ENOBUFS;
1118 }
1119
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1120 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1121 struct ieee80211_channel *chan,
1122 bool large)
1123 {
1124 /* Some channels must be completely excluded from the
1125 * list to protect old user-space tools from breaking
1126 */
1127 if (!large && chan->flags &
1128 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1129 return 0;
1130 if (!large && chan->freq_offset)
1131 return 0;
1132
1133 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1134 chan->center_freq))
1135 goto nla_put_failure;
1136
1137 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1138 goto nla_put_failure;
1139
1140 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1141 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1142 goto nla_put_failure;
1143
1144 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1145 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1146 goto nla_put_failure;
1147 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1148 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1149 goto nla_put_failure;
1150 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1151 goto nla_put_failure;
1152 }
1153 if (chan->flags & IEEE80211_CHAN_RADAR) {
1154 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1155 goto nla_put_failure;
1156 if (large) {
1157 u32 time;
1158
1159 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1160
1161 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1162 chan->dfs_state))
1163 goto nla_put_failure;
1164 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1165 time))
1166 goto nla_put_failure;
1167 if (nla_put_u32(msg,
1168 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1169 chan->dfs_cac_ms))
1170 goto nla_put_failure;
1171 }
1172 }
1173
1174 if (large) {
1175 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1176 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1177 goto nla_put_failure;
1178 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1179 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1180 goto nla_put_failure;
1181 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1182 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1183 goto nla_put_failure;
1184 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1185 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1186 goto nla_put_failure;
1187 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1188 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1189 goto nla_put_failure;
1190 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1191 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1192 goto nla_put_failure;
1193 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1194 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1195 goto nla_put_failure;
1196 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1197 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1198 goto nla_put_failure;
1199 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1200 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1201 goto nla_put_failure;
1202 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1203 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1204 goto nla_put_failure;
1205 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1206 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1207 goto nla_put_failure;
1208 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1209 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1210 goto nla_put_failure;
1211 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1212 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1213 goto nla_put_failure;
1214 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1215 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1216 goto nla_put_failure;
1217 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1218 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1219 goto nla_put_failure;
1220 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1221 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1222 goto nla_put_failure;
1223 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1224 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1225 goto nla_put_failure;
1226 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1227 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1228 goto nla_put_failure;
1229 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1230 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1231 goto nla_put_failure;
1232 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1233 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1234 goto nla_put_failure;
1235 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1236 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1237 goto nla_put_failure;
1238 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1239 nla_put_flag(msg,
1240 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1241 goto nla_put_failure;
1242 }
1243
1244 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1245 DBM_TO_MBM(chan->max_power)))
1246 goto nla_put_failure;
1247
1248 if (large) {
1249 const struct ieee80211_reg_rule *rule =
1250 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1251
1252 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1253 if (nl80211_msg_put_wmm_rules(msg, rule))
1254 goto nla_put_failure;
1255 }
1256 }
1257
1258 return 0;
1259
1260 nla_put_failure:
1261 return -ENOBUFS;
1262 }
1263
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1264 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1265 struct cfg80211_txq_stats *txqstats,
1266 int attrtype)
1267 {
1268 struct nlattr *txqattr;
1269
1270 #define PUT_TXQVAL_U32(attr, memb) do { \
1271 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1272 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1273 return false; \
1274 } while (0)
1275
1276 txqattr = nla_nest_start_noflag(msg, attrtype);
1277 if (!txqattr)
1278 return false;
1279
1280 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1281 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1282 PUT_TXQVAL_U32(FLOWS, flows);
1283 PUT_TXQVAL_U32(DROPS, drops);
1284 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1285 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1286 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1287 PUT_TXQVAL_U32(COLLISIONS, collisions);
1288 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1289 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1290 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1291 nla_nest_end(msg, txqattr);
1292
1293 #undef PUT_TXQVAL_U32
1294 return true;
1295 }
1296
1297 /* netlink command implementations */
1298
1299 /**
1300 * nl80211_link_id - return link ID
1301 * @attrs: attributes to look at
1302 *
1303 * Returns: the link ID or 0 if not given
1304 *
1305 * Note this function doesn't do any validation of the link
1306 * ID validity wrt. links that were actually added, so it must
1307 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1308 * or if additional validation is done.
1309 */
nl80211_link_id(struct nlattr ** attrs)1310 static unsigned int nl80211_link_id(struct nlattr **attrs)
1311 {
1312 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1313
1314 return nla_get_u8_default(linkid, 0);
1315 }
1316
nl80211_link_id_or_invalid(struct nlattr ** attrs)1317 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1318 {
1319 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1320
1321 if (!linkid)
1322 return -1;
1323
1324 return nla_get_u8(linkid);
1325 }
1326
1327 struct key_parse {
1328 struct key_params p;
1329 int idx;
1330 int type;
1331 bool def, defmgmt, defbeacon;
1332 bool def_uni, def_multi;
1333 };
1334
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1335 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1336 struct key_parse *k)
1337 {
1338 struct nlattr *tb[NL80211_KEY_MAX + 1];
1339 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1340 nl80211_key_policy,
1341 info->extack);
1342 if (err)
1343 return err;
1344
1345 k->def = !!tb[NL80211_KEY_DEFAULT];
1346 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1347 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1348
1349 if (k->def) {
1350 k->def_uni = true;
1351 k->def_multi = true;
1352 }
1353 if (k->defmgmt || k->defbeacon)
1354 k->def_multi = true;
1355
1356 if (tb[NL80211_KEY_IDX])
1357 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1358
1359 if (tb[NL80211_KEY_DATA]) {
1360 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1361 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1362 }
1363
1364 if (tb[NL80211_KEY_SEQ]) {
1365 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1366 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1367 }
1368
1369 if (tb[NL80211_KEY_CIPHER])
1370 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1371
1372 if (tb[NL80211_KEY_TYPE])
1373 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1374
1375 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1376 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1377
1378 err = nla_parse_nested_deprecated(kdt,
1379 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1380 tb[NL80211_KEY_DEFAULT_TYPES],
1381 nl80211_key_default_policy,
1382 info->extack);
1383 if (err)
1384 return err;
1385
1386 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1387 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1388 }
1389
1390 if (tb[NL80211_KEY_MODE])
1391 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1392
1393 return 0;
1394 }
1395
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1396 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1397 {
1398 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1399 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1400 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1401 }
1402
1403 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1404 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1405 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1406 }
1407
1408 if (info->attrs[NL80211_ATTR_KEY_IDX])
1409 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1410
1411 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1412 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1413
1414 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1415 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1416
1417 if (k->def) {
1418 k->def_uni = true;
1419 k->def_multi = true;
1420 }
1421 if (k->defmgmt)
1422 k->def_multi = true;
1423
1424 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1425 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1426
1427 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1428 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1429 int err = nla_parse_nested_deprecated(kdt,
1430 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1431 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1432 nl80211_key_default_policy,
1433 info->extack);
1434 if (err)
1435 return err;
1436
1437 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1438 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1439 }
1440
1441 return 0;
1442 }
1443
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1444 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1445 {
1446 int err;
1447
1448 memset(k, 0, sizeof(*k));
1449 k->idx = -1;
1450 k->type = -1;
1451
1452 if (info->attrs[NL80211_ATTR_KEY])
1453 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1454 else
1455 err = nl80211_parse_key_old(info, k);
1456
1457 if (err)
1458 return err;
1459
1460 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1461 (k->defbeacon ? 1 : 0) > 1) {
1462 GENL_SET_ERR_MSG(info,
1463 "key with multiple default flags is invalid");
1464 return -EINVAL;
1465 }
1466
1467 if (k->defmgmt || k->defbeacon) {
1468 if (k->def_uni || !k->def_multi) {
1469 GENL_SET_ERR_MSG(info,
1470 "defmgmt/defbeacon key must be mcast");
1471 return -EINVAL;
1472 }
1473 }
1474
1475 if (k->idx != -1) {
1476 if (k->defmgmt) {
1477 if (k->idx < 4 || k->idx > 5) {
1478 GENL_SET_ERR_MSG(info,
1479 "defmgmt key idx not 4 or 5");
1480 return -EINVAL;
1481 }
1482 } else if (k->defbeacon) {
1483 if (k->idx < 6 || k->idx > 7) {
1484 GENL_SET_ERR_MSG(info,
1485 "defbeacon key idx not 6 or 7");
1486 return -EINVAL;
1487 }
1488 } else if (k->def) {
1489 if (k->idx < 0 || k->idx > 3) {
1490 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1491 return -EINVAL;
1492 }
1493 } else {
1494 if (k->idx < 0 || k->idx > 7) {
1495 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1496 return -EINVAL;
1497 }
1498 }
1499 }
1500
1501 return 0;
1502 }
1503
1504 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1505 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1506 struct genl_info *info, bool *no_ht)
1507 {
1508 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1509 struct key_parse parse;
1510 struct nlattr *key;
1511 struct cfg80211_cached_keys *result;
1512 int rem, err, def = 0;
1513 bool have_key = false;
1514
1515 nla_for_each_nested(key, keys, rem) {
1516 have_key = true;
1517 break;
1518 }
1519
1520 if (!have_key)
1521 return NULL;
1522
1523 result = kzalloc(sizeof(*result), GFP_KERNEL);
1524 if (!result)
1525 return ERR_PTR(-ENOMEM);
1526
1527 result->def = -1;
1528
1529 nla_for_each_nested(key, keys, rem) {
1530 memset(&parse, 0, sizeof(parse));
1531 parse.idx = -1;
1532
1533 err = nl80211_parse_key_new(info, key, &parse);
1534 if (err)
1535 goto error;
1536 err = -EINVAL;
1537 if (!parse.p.key)
1538 goto error;
1539 if (parse.idx < 0 || parse.idx > 3) {
1540 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1541 goto error;
1542 }
1543 if (parse.def) {
1544 if (def) {
1545 GENL_SET_ERR_MSG(info,
1546 "only one key can be default");
1547 goto error;
1548 }
1549 def = 1;
1550 result->def = parse.idx;
1551 if (!parse.def_uni || !parse.def_multi)
1552 goto error;
1553 } else if (parse.defmgmt)
1554 goto error;
1555 err = cfg80211_validate_key_settings(rdev, &parse.p,
1556 parse.idx, false, NULL);
1557 if (err)
1558 goto error;
1559 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1560 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1561 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1562 err = -EINVAL;
1563 goto error;
1564 }
1565 result->params[parse.idx].cipher = parse.p.cipher;
1566 result->params[parse.idx].key_len = parse.p.key_len;
1567 result->params[parse.idx].key = result->data[parse.idx];
1568 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1569
1570 /* must be WEP key if we got here */
1571 if (no_ht)
1572 *no_ht = true;
1573 }
1574
1575 if (result->def < 0) {
1576 err = -EINVAL;
1577 GENL_SET_ERR_MSG(info, "need a default/TX key");
1578 goto error;
1579 }
1580
1581 return result;
1582 error:
1583 kfree(result);
1584 return ERR_PTR(err);
1585 }
1586
nl80211_key_allowed(struct wireless_dev * wdev)1587 static int nl80211_key_allowed(struct wireless_dev *wdev)
1588 {
1589 lockdep_assert_wiphy(wdev->wiphy);
1590
1591 switch (wdev->iftype) {
1592 case NL80211_IFTYPE_AP:
1593 case NL80211_IFTYPE_AP_VLAN:
1594 case NL80211_IFTYPE_P2P_GO:
1595 case NL80211_IFTYPE_MESH_POINT:
1596 break;
1597 case NL80211_IFTYPE_ADHOC:
1598 if (wdev->u.ibss.current_bss)
1599 return 0;
1600 return -ENOLINK;
1601 case NL80211_IFTYPE_STATION:
1602 case NL80211_IFTYPE_P2P_CLIENT:
1603 if (wdev->connected)
1604 return 0;
1605 return -ENOLINK;
1606 case NL80211_IFTYPE_NAN:
1607 if (wiphy_ext_feature_isset(wdev->wiphy,
1608 NL80211_EXT_FEATURE_SECURE_NAN))
1609 return 0;
1610 return -EINVAL;
1611 case NL80211_IFTYPE_UNSPECIFIED:
1612 case NL80211_IFTYPE_OCB:
1613 case NL80211_IFTYPE_MONITOR:
1614 case NL80211_IFTYPE_P2P_DEVICE:
1615 case NL80211_IFTYPE_WDS:
1616 case NUM_NL80211_IFTYPES:
1617 return -EINVAL;
1618 }
1619
1620 return 0;
1621 }
1622
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1623 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1624 u32 freq)
1625 {
1626 struct ieee80211_channel *chan;
1627
1628 chan = ieee80211_get_channel_khz(wiphy, freq);
1629 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1630 return NULL;
1631 return chan;
1632 }
1633
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1634 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1635 {
1636 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1637 int i;
1638
1639 if (!nl_modes)
1640 goto nla_put_failure;
1641
1642 i = 0;
1643 while (ifmodes) {
1644 if ((ifmodes & 1) && nla_put_flag(msg, i))
1645 goto nla_put_failure;
1646 ifmodes >>= 1;
1647 i++;
1648 }
1649
1650 nla_nest_end(msg, nl_modes);
1651 return 0;
1652
1653 nla_put_failure:
1654 return -ENOBUFS;
1655 }
1656
nl80211_put_ifcomb_data(struct sk_buff * msg,bool large,int idx,const struct ieee80211_iface_combination * c,u16 nested)1657 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1658 const struct ieee80211_iface_combination *c,
1659 u16 nested)
1660 {
1661 struct nlattr *nl_combi, *nl_limits;
1662 int i;
1663
1664 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1665 if (!nl_combi)
1666 goto nla_put_failure;
1667
1668 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1669 nested);
1670 if (!nl_limits)
1671 goto nla_put_failure;
1672
1673 for (i = 0; i < c->n_limits; i++) {
1674 struct nlattr *nl_limit;
1675
1676 nl_limit = nla_nest_start_noflag(msg, i + 1);
1677 if (!nl_limit)
1678 goto nla_put_failure;
1679 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1680 goto nla_put_failure;
1681 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1682 c->limits[i].types))
1683 goto nla_put_failure;
1684 nla_nest_end(msg, nl_limit);
1685 }
1686
1687 nla_nest_end(msg, nl_limits);
1688
1689 if (c->beacon_int_infra_match &&
1690 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1691 goto nla_put_failure;
1692 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1693 c->num_different_channels) ||
1694 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1695 c->max_interfaces))
1696 goto nla_put_failure;
1697 if (large &&
1698 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1699 c->radar_detect_widths) ||
1700 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1701 c->radar_detect_regions)))
1702 goto nla_put_failure;
1703 if (c->beacon_int_min_gcd &&
1704 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1705 c->beacon_int_min_gcd))
1706 goto nla_put_failure;
1707
1708 nla_nest_end(msg, nl_combi);
1709
1710 return 0;
1711 nla_put_failure:
1712 return -ENOBUFS;
1713 }
1714
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,int attr,int radio,bool large,u16 nested)1715 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1716 struct sk_buff *msg,
1717 int attr, int radio,
1718 bool large, u16 nested)
1719 {
1720 const struct ieee80211_iface_combination *c;
1721 struct nlattr *nl_combis;
1722 int i, n;
1723
1724 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1725 if (!nl_combis)
1726 goto nla_put_failure;
1727
1728 if (radio >= 0) {
1729 c = wiphy->radio[0].iface_combinations;
1730 n = wiphy->radio[0].n_iface_combinations;
1731 } else {
1732 c = wiphy->iface_combinations;
1733 n = wiphy->n_iface_combinations;
1734 }
1735 for (i = 0; i < n; i++)
1736 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1737 goto nla_put_failure;
1738
1739 nla_nest_end(msg, nl_combis);
1740
1741 return 0;
1742 nla_put_failure:
1743 return -ENOBUFS;
1744 }
1745
1746 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1747 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1748 struct sk_buff *msg)
1749 {
1750 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1751 struct nlattr *nl_tcp;
1752
1753 if (!tcp)
1754 return 0;
1755
1756 nl_tcp = nla_nest_start_noflag(msg,
1757 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1758 if (!nl_tcp)
1759 return -ENOBUFS;
1760
1761 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1762 tcp->data_payload_max))
1763 return -ENOBUFS;
1764
1765 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1766 tcp->data_payload_max))
1767 return -ENOBUFS;
1768
1769 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1770 return -ENOBUFS;
1771
1772 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1773 sizeof(*tcp->tok), tcp->tok))
1774 return -ENOBUFS;
1775
1776 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1777 tcp->data_interval_max))
1778 return -ENOBUFS;
1779
1780 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1781 tcp->wake_payload_max))
1782 return -ENOBUFS;
1783
1784 nla_nest_end(msg, nl_tcp);
1785 return 0;
1786 }
1787
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1788 static int nl80211_send_wowlan(struct sk_buff *msg,
1789 struct cfg80211_registered_device *rdev,
1790 bool large)
1791 {
1792 struct nlattr *nl_wowlan;
1793
1794 if (!rdev->wiphy.wowlan)
1795 return 0;
1796
1797 nl_wowlan = nla_nest_start_noflag(msg,
1798 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1799 if (!nl_wowlan)
1800 return -ENOBUFS;
1801
1802 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1803 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1804 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1805 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1806 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1807 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1808 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1809 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1810 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1811 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1812 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1813 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1814 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1815 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1816 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1817 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1818 return -ENOBUFS;
1819
1820 if (rdev->wiphy.wowlan->n_patterns) {
1821 struct nl80211_pattern_support pat = {
1822 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1823 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1824 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1825 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1826 };
1827
1828 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1829 sizeof(pat), &pat))
1830 return -ENOBUFS;
1831 }
1832
1833 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1834 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1835 rdev->wiphy.wowlan->max_nd_match_sets))
1836 return -ENOBUFS;
1837
1838 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1839 return -ENOBUFS;
1840
1841 nla_nest_end(msg, nl_wowlan);
1842
1843 return 0;
1844 }
1845 #endif
1846
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1847 static int nl80211_send_coalesce(struct sk_buff *msg,
1848 struct cfg80211_registered_device *rdev)
1849 {
1850 struct nl80211_coalesce_rule_support rule;
1851
1852 if (!rdev->wiphy.coalesce)
1853 return 0;
1854
1855 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1856 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1857 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1858 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1859 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1860 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1861
1862 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1863 return -ENOBUFS;
1864
1865 return 0;
1866 }
1867
1868 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1869 nl80211_send_iftype_data(struct sk_buff *msg,
1870 const struct ieee80211_supported_band *sband,
1871 const struct ieee80211_sband_iftype_data *iftdata)
1872 {
1873 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1874 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1875
1876 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1877 iftdata->types_mask))
1878 return -ENOBUFS;
1879
1880 if (he_cap->has_he) {
1881 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1882 sizeof(he_cap->he_cap_elem.mac_cap_info),
1883 he_cap->he_cap_elem.mac_cap_info) ||
1884 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1885 sizeof(he_cap->he_cap_elem.phy_cap_info),
1886 he_cap->he_cap_elem.phy_cap_info) ||
1887 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1888 sizeof(he_cap->he_mcs_nss_supp),
1889 &he_cap->he_mcs_nss_supp) ||
1890 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1891 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1892 return -ENOBUFS;
1893 }
1894
1895 if (eht_cap->has_eht && he_cap->has_he) {
1896 u8 mcs_nss_size, ppe_thresh_size;
1897 u16 ppe_thres_hdr;
1898 bool is_ap;
1899
1900 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1901 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1902
1903 mcs_nss_size =
1904 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1905 &eht_cap->eht_cap_elem,
1906 is_ap);
1907
1908 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1909 ppe_thresh_size =
1910 ieee80211_eht_ppe_size(ppe_thres_hdr,
1911 eht_cap->eht_cap_elem.phy_cap_info);
1912
1913 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1914 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1915 eht_cap->eht_cap_elem.mac_cap_info) ||
1916 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1917 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1918 eht_cap->eht_cap_elem.phy_cap_info) ||
1919 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1920 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1921 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1922 ppe_thresh_size, eht_cap->eht_ppe_thres))
1923 return -ENOBUFS;
1924 }
1925
1926 if (sband->band == NL80211_BAND_6GHZ &&
1927 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1928 sizeof(iftdata->he_6ghz_capa),
1929 &iftdata->he_6ghz_capa))
1930 return -ENOBUFS;
1931
1932 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1933 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1934 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1935 return -ENOBUFS;
1936
1937 return 0;
1938 }
1939
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)1940 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1941 struct ieee80211_supported_band *sband,
1942 bool large)
1943 {
1944 struct nlattr *nl_rates, *nl_rate;
1945 struct ieee80211_rate *rate;
1946 int i;
1947
1948 /* add HT info */
1949 if (sband->ht_cap.ht_supported &&
1950 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1951 sizeof(sband->ht_cap.mcs),
1952 &sband->ht_cap.mcs) ||
1953 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1954 sband->ht_cap.cap) ||
1955 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1956 sband->ht_cap.ampdu_factor) ||
1957 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1958 sband->ht_cap.ampdu_density)))
1959 return -ENOBUFS;
1960
1961 /* add VHT info */
1962 if (sband->vht_cap.vht_supported &&
1963 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1964 sizeof(sband->vht_cap.vht_mcs),
1965 &sband->vht_cap.vht_mcs) ||
1966 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1967 sband->vht_cap.cap)))
1968 return -ENOBUFS;
1969
1970 if (large && sband->n_iftype_data) {
1971 struct nlattr *nl_iftype_data =
1972 nla_nest_start_noflag(msg,
1973 NL80211_BAND_ATTR_IFTYPE_DATA);
1974 const struct ieee80211_sband_iftype_data *iftd;
1975 int err;
1976
1977 if (!nl_iftype_data)
1978 return -ENOBUFS;
1979
1980 for_each_sband_iftype_data(sband, i, iftd) {
1981 struct nlattr *iftdata;
1982
1983 iftdata = nla_nest_start_noflag(msg, i + 1);
1984 if (!iftdata)
1985 return -ENOBUFS;
1986
1987 err = nl80211_send_iftype_data(msg, sband, iftd);
1988 if (err)
1989 return err;
1990
1991 nla_nest_end(msg, iftdata);
1992 }
1993
1994 nla_nest_end(msg, nl_iftype_data);
1995 }
1996
1997 /* add EDMG info */
1998 if (large && sband->edmg_cap.channels &&
1999 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2000 sband->edmg_cap.channels) ||
2001 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2002 sband->edmg_cap.bw_config)))
2003
2004 return -ENOBUFS;
2005
2006 /* add bitrates */
2007 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2008 if (!nl_rates)
2009 return -ENOBUFS;
2010
2011 for (i = 0; i < sband->n_bitrates; i++) {
2012 nl_rate = nla_nest_start_noflag(msg, i);
2013 if (!nl_rate)
2014 return -ENOBUFS;
2015
2016 rate = &sband->bitrates[i];
2017 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2018 rate->bitrate))
2019 return -ENOBUFS;
2020 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2021 nla_put_flag(msg,
2022 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2023 return -ENOBUFS;
2024
2025 nla_nest_end(msg, nl_rate);
2026 }
2027
2028 nla_nest_end(msg, nl_rates);
2029
2030 /* S1G capabilities */
2031 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2032 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2033 sizeof(sband->s1g_cap.cap),
2034 sband->s1g_cap.cap) ||
2035 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2036 sizeof(sband->s1g_cap.nss_mcs),
2037 sband->s1g_cap.nss_mcs)))
2038 return -ENOBUFS;
2039
2040 return 0;
2041 }
2042
2043 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)2044 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2045 const struct ieee80211_txrx_stypes *mgmt_stypes)
2046 {
2047 u16 stypes;
2048 struct nlattr *nl_ftypes, *nl_ifs;
2049 enum nl80211_iftype ift;
2050 int i;
2051
2052 if (!mgmt_stypes)
2053 return 0;
2054
2055 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2056 if (!nl_ifs)
2057 return -ENOBUFS;
2058
2059 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2060 nl_ftypes = nla_nest_start_noflag(msg, ift);
2061 if (!nl_ftypes)
2062 return -ENOBUFS;
2063 i = 0;
2064 stypes = mgmt_stypes[ift].tx;
2065 while (stypes) {
2066 if ((stypes & 1) &&
2067 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2068 (i << 4) | IEEE80211_FTYPE_MGMT))
2069 return -ENOBUFS;
2070 stypes >>= 1;
2071 i++;
2072 }
2073 nla_nest_end(msg, nl_ftypes);
2074 }
2075
2076 nla_nest_end(msg, nl_ifs);
2077
2078 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2079 if (!nl_ifs)
2080 return -ENOBUFS;
2081
2082 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2083 nl_ftypes = nla_nest_start_noflag(msg, ift);
2084 if (!nl_ftypes)
2085 return -ENOBUFS;
2086 i = 0;
2087 stypes = mgmt_stypes[ift].rx;
2088 while (stypes) {
2089 if ((stypes & 1) &&
2090 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2091 (i << 4) | IEEE80211_FTYPE_MGMT))
2092 return -ENOBUFS;
2093 stypes >>= 1;
2094 i++;
2095 }
2096 nla_nest_end(msg, nl_ftypes);
2097 }
2098 nla_nest_end(msg, nl_ifs);
2099
2100 return 0;
2101 }
2102
2103 #define CMD(op, n) \
2104 do { \
2105 if (rdev->ops->op) { \
2106 i++; \
2107 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2108 goto nla_put_failure; \
2109 } \
2110 } while (0)
2111
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2112 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2113 struct sk_buff *msg)
2114 {
2115 int i = 0;
2116
2117 /*
2118 * do *NOT* add anything into this function, new things need to be
2119 * advertised only to new versions of userspace that can deal with
2120 * the split (and they can't possibly care about new features...
2121 */
2122 CMD(add_virtual_intf, NEW_INTERFACE);
2123 CMD(change_virtual_intf, SET_INTERFACE);
2124 CMD(add_key, NEW_KEY);
2125 CMD(start_ap, START_AP);
2126 CMD(add_station, NEW_STATION);
2127 CMD(add_mpath, NEW_MPATH);
2128 CMD(update_mesh_config, SET_MESH_CONFIG);
2129 CMD(change_bss, SET_BSS);
2130 CMD(auth, AUTHENTICATE);
2131 CMD(assoc, ASSOCIATE);
2132 CMD(deauth, DEAUTHENTICATE);
2133 CMD(disassoc, DISASSOCIATE);
2134 CMD(join_ibss, JOIN_IBSS);
2135 CMD(join_mesh, JOIN_MESH);
2136 CMD(set_pmksa, SET_PMKSA);
2137 CMD(del_pmksa, DEL_PMKSA);
2138 CMD(flush_pmksa, FLUSH_PMKSA);
2139 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2140 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2141 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2142 CMD(mgmt_tx, FRAME);
2143 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2144 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2145 i++;
2146 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2147 goto nla_put_failure;
2148 }
2149 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2150 rdev->ops->join_mesh) {
2151 i++;
2152 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2153 goto nla_put_failure;
2154 }
2155 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2156 CMD(tdls_mgmt, TDLS_MGMT);
2157 CMD(tdls_oper, TDLS_OPER);
2158 }
2159 if (rdev->wiphy.max_sched_scan_reqs)
2160 CMD(sched_scan_start, START_SCHED_SCAN);
2161 CMD(probe_client, PROBE_CLIENT);
2162 CMD(set_noack_map, SET_NOACK_MAP);
2163 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2164 i++;
2165 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2166 goto nla_put_failure;
2167 }
2168 CMD(start_p2p_device, START_P2P_DEVICE);
2169 CMD(set_mcast_rate, SET_MCAST_RATE);
2170 #ifdef CONFIG_NL80211_TESTMODE
2171 CMD(testmode_cmd, TESTMODE);
2172 #endif
2173
2174 if (rdev->ops->connect || rdev->ops->auth) {
2175 i++;
2176 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2177 goto nla_put_failure;
2178 }
2179
2180 if (rdev->ops->disconnect || rdev->ops->deauth) {
2181 i++;
2182 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2183 goto nla_put_failure;
2184 }
2185
2186 return i;
2187 nla_put_failure:
2188 return -ENOBUFS;
2189 }
2190
2191 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2192 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2193 struct sk_buff *msg)
2194 {
2195 struct nlattr *ftm;
2196
2197 if (!cap->ftm.supported)
2198 return 0;
2199
2200 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2201 if (!ftm)
2202 return -ENOBUFS;
2203
2204 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2205 return -ENOBUFS;
2206 if (cap->ftm.non_asap &&
2207 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2208 return -ENOBUFS;
2209 if (cap->ftm.request_lci &&
2210 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2211 return -ENOBUFS;
2212 if (cap->ftm.request_civicloc &&
2213 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2214 return -ENOBUFS;
2215 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2216 cap->ftm.preambles))
2217 return -ENOBUFS;
2218 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2219 cap->ftm.bandwidths))
2220 return -ENOBUFS;
2221 if (cap->ftm.max_bursts_exponent >= 0 &&
2222 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2223 cap->ftm.max_bursts_exponent))
2224 return -ENOBUFS;
2225 if (cap->ftm.max_ftms_per_burst &&
2226 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2227 cap->ftm.max_ftms_per_burst))
2228 return -ENOBUFS;
2229 if (cap->ftm.trigger_based &&
2230 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2231 return -ENOBUFS;
2232 if (cap->ftm.non_trigger_based &&
2233 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2234 return -ENOBUFS;
2235
2236 nla_nest_end(msg, ftm);
2237 return 0;
2238 }
2239
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2240 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2241 struct sk_buff *msg)
2242 {
2243 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2244 struct nlattr *pmsr, *caps;
2245
2246 if (!cap)
2247 return 0;
2248
2249 /*
2250 * we don't need to clean up anything here since the caller
2251 * will genlmsg_cancel() if we fail
2252 */
2253
2254 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2255 if (!pmsr)
2256 return -ENOBUFS;
2257
2258 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2259 return -ENOBUFS;
2260
2261 if (cap->report_ap_tsf &&
2262 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2263 return -ENOBUFS;
2264
2265 if (cap->randomize_mac_addr &&
2266 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2267 return -ENOBUFS;
2268
2269 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2270 if (!caps)
2271 return -ENOBUFS;
2272
2273 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2274 return -ENOBUFS;
2275
2276 nla_nest_end(msg, caps);
2277 nla_nest_end(msg, pmsr);
2278
2279 return 0;
2280 }
2281
2282 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2283 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2284 struct sk_buff *msg)
2285 {
2286 int i;
2287 struct nlattr *nested, *nested_akms;
2288 const struct wiphy_iftype_akm_suites *iftype_akms;
2289
2290 if (!rdev->wiphy.num_iftype_akm_suites ||
2291 !rdev->wiphy.iftype_akm_suites)
2292 return 0;
2293
2294 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2295 if (!nested)
2296 return -ENOBUFS;
2297
2298 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2299 nested_akms = nla_nest_start(msg, i + 1);
2300 if (!nested_akms)
2301 return -ENOBUFS;
2302
2303 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2304
2305 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2306 iftype_akms->iftypes_mask))
2307 return -ENOBUFS;
2308
2309 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2310 sizeof(u32) * iftype_akms->n_akm_suites,
2311 iftype_akms->akm_suites)) {
2312 return -ENOBUFS;
2313 }
2314 nla_nest_end(msg, nested_akms);
2315 }
2316
2317 nla_nest_end(msg, nested);
2318
2319 return 0;
2320 }
2321
2322 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2323 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2324 struct sk_buff *msg)
2325 {
2326 struct nlattr *supp;
2327
2328 if (!rdev->wiphy.tid_config_support.vif &&
2329 !rdev->wiphy.tid_config_support.peer)
2330 return 0;
2331
2332 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2333 if (!supp)
2334 return -ENOSPC;
2335
2336 if (rdev->wiphy.tid_config_support.vif &&
2337 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2338 rdev->wiphy.tid_config_support.vif,
2339 NL80211_TID_CONFIG_ATTR_PAD))
2340 goto fail;
2341
2342 if (rdev->wiphy.tid_config_support.peer &&
2343 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2344 rdev->wiphy.tid_config_support.peer,
2345 NL80211_TID_CONFIG_ATTR_PAD))
2346 goto fail;
2347
2348 /* for now we just use the same value ... makes more sense */
2349 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2350 rdev->wiphy.tid_config_support.max_retry))
2351 goto fail;
2352 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2353 rdev->wiphy.tid_config_support.max_retry))
2354 goto fail;
2355
2356 nla_nest_end(msg, supp);
2357
2358 return 0;
2359 fail:
2360 nla_nest_cancel(msg, supp);
2361 return -ENOBUFS;
2362 }
2363
2364 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2365 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2366 struct sk_buff *msg)
2367 {
2368 struct nlattr *sar_capa, *specs, *sub_freq_range;
2369 u8 num_freq_ranges;
2370 int i;
2371
2372 if (!rdev->wiphy.sar_capa)
2373 return 0;
2374
2375 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2376
2377 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2378 if (!sar_capa)
2379 return -ENOSPC;
2380
2381 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2382 goto fail;
2383
2384 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2385 if (!specs)
2386 goto fail;
2387
2388 /* report supported freq_ranges */
2389 for (i = 0; i < num_freq_ranges; i++) {
2390 sub_freq_range = nla_nest_start(msg, i + 1);
2391 if (!sub_freq_range)
2392 goto fail;
2393
2394 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2395 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2396 goto fail;
2397
2398 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2399 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2400 goto fail;
2401
2402 nla_nest_end(msg, sub_freq_range);
2403 }
2404
2405 nla_nest_end(msg, specs);
2406 nla_nest_end(msg, sar_capa);
2407
2408 return 0;
2409 fail:
2410 nla_nest_cancel(msg, sar_capa);
2411 return -ENOBUFS;
2412 }
2413
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2414 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2415 {
2416 struct nlattr *config;
2417
2418 if (!wiphy->mbssid_max_interfaces)
2419 return 0;
2420
2421 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2422 if (!config)
2423 return -ENOBUFS;
2424
2425 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2426 wiphy->mbssid_max_interfaces))
2427 goto fail;
2428
2429 if (wiphy->ema_max_profile_periodicity &&
2430 nla_put_u8(msg,
2431 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2432 wiphy->ema_max_profile_periodicity))
2433 goto fail;
2434
2435 nla_nest_end(msg, config);
2436 return 0;
2437
2438 fail:
2439 nla_nest_cancel(msg, config);
2440 return -ENOBUFS;
2441 }
2442
nl80211_put_radio(struct wiphy * wiphy,struct sk_buff * msg,int idx)2443 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2444 {
2445 const struct wiphy_radio *r = &wiphy->radio[idx];
2446 struct nlattr *radio, *freq;
2447 int i;
2448
2449 radio = nla_nest_start(msg, idx);
2450 if (!radio)
2451 return -ENOBUFS;
2452
2453 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2454 goto nla_put_failure;
2455
2456 if (r->antenna_mask &&
2457 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2458 r->antenna_mask))
2459 goto nla_put_failure;
2460
2461 for (i = 0; i < r->n_freq_range; i++) {
2462 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2463
2464 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2465 if (!freq)
2466 goto nla_put_failure;
2467
2468 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2469 range->start_freq) ||
2470 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2471 range->end_freq))
2472 goto nla_put_failure;
2473
2474 nla_nest_end(msg, freq);
2475 }
2476
2477 for (i = 0; i < r->n_iface_combinations; i++)
2478 if (nl80211_put_ifcomb_data(msg, true,
2479 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2480 &r->iface_combinations[i],
2481 NLA_F_NESTED))
2482 goto nla_put_failure;
2483
2484 nla_nest_end(msg, radio);
2485
2486 return 0;
2487
2488 nla_put_failure:
2489 return -ENOBUFS;
2490 }
2491
nl80211_put_radios(struct wiphy * wiphy,struct sk_buff * msg)2492 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2493 {
2494 struct nlattr *radios;
2495 int i;
2496
2497 if (!wiphy->n_radio)
2498 return 0;
2499
2500 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2501 if (!radios)
2502 return -ENOBUFS;
2503
2504 for (i = 0; i < wiphy->n_radio; i++)
2505 if (nl80211_put_radio(wiphy, msg, i))
2506 goto fail;
2507
2508 nla_nest_end(msg, radios);
2509
2510 if (nl80211_put_iface_combinations(wiphy, msg,
2511 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2512 -1, true, NLA_F_NESTED))
2513 return -ENOBUFS;
2514
2515 return 0;
2516
2517 fail:
2518 nla_nest_cancel(msg, radios);
2519 return -ENOBUFS;
2520 }
2521
2522 struct nl80211_dump_wiphy_state {
2523 s64 filter_wiphy;
2524 long start;
2525 long split_start, band_start, chan_start, capa_start;
2526 bool split;
2527 };
2528
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2529 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2530 enum nl80211_commands cmd,
2531 struct sk_buff *msg, u32 portid, u32 seq,
2532 int flags, struct nl80211_dump_wiphy_state *state)
2533 {
2534 void *hdr;
2535 struct nlattr *nl_bands, *nl_band;
2536 struct nlattr *nl_freqs, *nl_freq;
2537 struct nlattr *nl_cmds;
2538 enum nl80211_band band;
2539 struct ieee80211_channel *chan;
2540 int i;
2541 const struct ieee80211_txrx_stypes *mgmt_stypes =
2542 rdev->wiphy.mgmt_stypes;
2543 u32 features;
2544
2545 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2546 if (!hdr)
2547 return -ENOBUFS;
2548
2549 if (WARN_ON(!state))
2550 return -EINVAL;
2551
2552 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2553 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2554 wiphy_name(&rdev->wiphy)) ||
2555 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2556 cfg80211_rdev_list_generation))
2557 goto nla_put_failure;
2558
2559 if (cmd != NL80211_CMD_NEW_WIPHY)
2560 goto finish;
2561
2562 switch (state->split_start) {
2563 case 0:
2564 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2565 rdev->wiphy.retry_short) ||
2566 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2567 rdev->wiphy.retry_long) ||
2568 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2569 rdev->wiphy.frag_threshold) ||
2570 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2571 rdev->wiphy.rts_threshold) ||
2572 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2573 rdev->wiphy.coverage_class) ||
2574 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2575 rdev->wiphy.max_scan_ssids) ||
2576 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2577 rdev->wiphy.max_sched_scan_ssids) ||
2578 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2579 rdev->wiphy.max_scan_ie_len) ||
2580 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2581 rdev->wiphy.max_sched_scan_ie_len) ||
2582 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2583 rdev->wiphy.max_match_sets))
2584 goto nla_put_failure;
2585
2586 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2587 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2588 goto nla_put_failure;
2589 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2590 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2591 goto nla_put_failure;
2592 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2593 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2594 goto nla_put_failure;
2595 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2596 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2597 goto nla_put_failure;
2598 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2599 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2600 goto nla_put_failure;
2601 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2602 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2603 goto nla_put_failure;
2604 state->split_start++;
2605 if (state->split)
2606 break;
2607 fallthrough;
2608 case 1:
2609 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2610 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2611 rdev->wiphy.cipher_suites))
2612 goto nla_put_failure;
2613
2614 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2615 rdev->wiphy.max_num_pmkids))
2616 goto nla_put_failure;
2617
2618 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2619 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2620 goto nla_put_failure;
2621
2622 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2623 rdev->wiphy.available_antennas_tx) ||
2624 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2625 rdev->wiphy.available_antennas_rx))
2626 goto nla_put_failure;
2627
2628 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2629 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2630 rdev->wiphy.probe_resp_offload))
2631 goto nla_put_failure;
2632
2633 if ((rdev->wiphy.available_antennas_tx ||
2634 rdev->wiphy.available_antennas_rx) &&
2635 rdev->ops->get_antenna) {
2636 u32 tx_ant = 0, rx_ant = 0;
2637 int res;
2638
2639 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2640 if (!res) {
2641 if (nla_put_u32(msg,
2642 NL80211_ATTR_WIPHY_ANTENNA_TX,
2643 tx_ant) ||
2644 nla_put_u32(msg,
2645 NL80211_ATTR_WIPHY_ANTENNA_RX,
2646 rx_ant))
2647 goto nla_put_failure;
2648 }
2649 }
2650
2651 state->split_start++;
2652 if (state->split)
2653 break;
2654 fallthrough;
2655 case 2:
2656 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2657 rdev->wiphy.interface_modes))
2658 goto nla_put_failure;
2659 state->split_start++;
2660 if (state->split)
2661 break;
2662 fallthrough;
2663 case 3:
2664 nl_bands = nla_nest_start_noflag(msg,
2665 NL80211_ATTR_WIPHY_BANDS);
2666 if (!nl_bands)
2667 goto nla_put_failure;
2668
2669 for (band = state->band_start;
2670 band < (state->split ?
2671 NUM_NL80211_BANDS :
2672 NL80211_BAND_60GHZ + 1);
2673 band++) {
2674 struct ieee80211_supported_band *sband;
2675
2676 /* omit higher bands for ancient software */
2677 if (band > NL80211_BAND_5GHZ && !state->split)
2678 break;
2679
2680 sband = rdev->wiphy.bands[band];
2681
2682 if (!sband)
2683 continue;
2684
2685 nl_band = nla_nest_start_noflag(msg, band);
2686 if (!nl_band)
2687 goto nla_put_failure;
2688
2689 switch (state->chan_start) {
2690 case 0:
2691 if (nl80211_send_band_rateinfo(msg, sband,
2692 state->split))
2693 goto nla_put_failure;
2694 state->chan_start++;
2695 if (state->split)
2696 break;
2697 fallthrough;
2698 default:
2699 /* add frequencies */
2700 nl_freqs = nla_nest_start_noflag(msg,
2701 NL80211_BAND_ATTR_FREQS);
2702 if (!nl_freqs)
2703 goto nla_put_failure;
2704
2705 for (i = state->chan_start - 1;
2706 i < sband->n_channels;
2707 i++) {
2708 nl_freq = nla_nest_start_noflag(msg,
2709 i);
2710 if (!nl_freq)
2711 goto nla_put_failure;
2712
2713 chan = &sband->channels[i];
2714
2715 if (nl80211_msg_put_channel(
2716 msg, &rdev->wiphy, chan,
2717 state->split))
2718 goto nla_put_failure;
2719
2720 nla_nest_end(msg, nl_freq);
2721 if (state->split)
2722 break;
2723 }
2724 if (i < sband->n_channels)
2725 state->chan_start = i + 2;
2726 else
2727 state->chan_start = 0;
2728 nla_nest_end(msg, nl_freqs);
2729 }
2730
2731 nla_nest_end(msg, nl_band);
2732
2733 if (state->split) {
2734 /* start again here */
2735 if (state->chan_start)
2736 band--;
2737 break;
2738 }
2739 }
2740 nla_nest_end(msg, nl_bands);
2741
2742 if (band < NUM_NL80211_BANDS)
2743 state->band_start = band + 1;
2744 else
2745 state->band_start = 0;
2746
2747 /* if bands & channels are done, continue outside */
2748 if (state->band_start == 0 && state->chan_start == 0)
2749 state->split_start++;
2750 if (state->split)
2751 break;
2752 fallthrough;
2753 case 4:
2754 nl_cmds = nla_nest_start_noflag(msg,
2755 NL80211_ATTR_SUPPORTED_COMMANDS);
2756 if (!nl_cmds)
2757 goto nla_put_failure;
2758
2759 i = nl80211_add_commands_unsplit(rdev, msg);
2760 if (i < 0)
2761 goto nla_put_failure;
2762 if (state->split) {
2763 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2764 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2765 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2766 CMD(channel_switch, CHANNEL_SWITCH);
2767 CMD(set_qos_map, SET_QOS_MAP);
2768 if (rdev->wiphy.features &
2769 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2770 CMD(add_tx_ts, ADD_TX_TS);
2771 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2772 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2773 CMD(update_ft_ies, UPDATE_FT_IES);
2774 if (rdev->wiphy.sar_capa)
2775 CMD(set_sar_specs, SET_SAR_SPECS);
2776 CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2777 }
2778 #undef CMD
2779
2780 nla_nest_end(msg, nl_cmds);
2781 state->split_start++;
2782 if (state->split)
2783 break;
2784 fallthrough;
2785 case 5:
2786 if (rdev->ops->remain_on_channel &&
2787 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2788 nla_put_u32(msg,
2789 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2790 rdev->wiphy.max_remain_on_channel_duration))
2791 goto nla_put_failure;
2792
2793 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2794 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2795 goto nla_put_failure;
2796
2797 state->split_start++;
2798 if (state->split)
2799 break;
2800 fallthrough;
2801 case 6:
2802 #ifdef CONFIG_PM
2803 if (nl80211_send_wowlan(msg, rdev, state->split))
2804 goto nla_put_failure;
2805 state->split_start++;
2806 if (state->split)
2807 break;
2808 #else
2809 state->split_start++;
2810 #endif
2811 fallthrough;
2812 case 7:
2813 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2814 rdev->wiphy.software_iftypes))
2815 goto nla_put_failure;
2816
2817 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2818 NL80211_ATTR_INTERFACE_COMBINATIONS,
2819 rdev->wiphy.n_radio ? 0 : -1,
2820 state->split, 0))
2821 goto nla_put_failure;
2822
2823 state->split_start++;
2824 if (state->split)
2825 break;
2826 fallthrough;
2827 case 8:
2828 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2829 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2830 rdev->wiphy.ap_sme_capa))
2831 goto nla_put_failure;
2832
2833 features = rdev->wiphy.features;
2834 /*
2835 * We can only add the per-channel limit information if the
2836 * dump is split, otherwise it makes it too big. Therefore
2837 * only advertise it in that case.
2838 */
2839 if (state->split)
2840 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2841 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2842 goto nla_put_failure;
2843
2844 if (rdev->wiphy.ht_capa_mod_mask &&
2845 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2846 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2847 rdev->wiphy.ht_capa_mod_mask))
2848 goto nla_put_failure;
2849
2850 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2851 rdev->wiphy.max_acl_mac_addrs &&
2852 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2853 rdev->wiphy.max_acl_mac_addrs))
2854 goto nla_put_failure;
2855
2856 /*
2857 * Any information below this point is only available to
2858 * applications that can deal with it being split. This
2859 * helps ensure that newly added capabilities don't break
2860 * older tools by overrunning their buffers.
2861 *
2862 * We still increment split_start so that in the split
2863 * case we'll continue with more data in the next round,
2864 * but break unconditionally so unsplit data stops here.
2865 */
2866 if (state->split)
2867 state->split_start++;
2868 else
2869 state->split_start = 0;
2870 break;
2871 case 9:
2872 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2873 goto nla_put_failure;
2874
2875 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2876 rdev->wiphy.max_sched_scan_plans) ||
2877 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2878 rdev->wiphy.max_sched_scan_plan_interval) ||
2879 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2880 rdev->wiphy.max_sched_scan_plan_iterations))
2881 goto nla_put_failure;
2882
2883 if (rdev->wiphy.extended_capabilities &&
2884 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2885 rdev->wiphy.extended_capabilities_len,
2886 rdev->wiphy.extended_capabilities) ||
2887 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2888 rdev->wiphy.extended_capabilities_len,
2889 rdev->wiphy.extended_capabilities_mask)))
2890 goto nla_put_failure;
2891
2892 if (rdev->wiphy.vht_capa_mod_mask &&
2893 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2894 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2895 rdev->wiphy.vht_capa_mod_mask))
2896 goto nla_put_failure;
2897
2898 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2899 rdev->wiphy.perm_addr))
2900 goto nla_put_failure;
2901
2902 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2903 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2904 rdev->wiphy.addr_mask))
2905 goto nla_put_failure;
2906
2907 if (rdev->wiphy.n_addresses > 1) {
2908 void *attr;
2909
2910 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2911 if (!attr)
2912 goto nla_put_failure;
2913
2914 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2915 if (nla_put(msg, i + 1, ETH_ALEN,
2916 rdev->wiphy.addresses[i].addr))
2917 goto nla_put_failure;
2918
2919 nla_nest_end(msg, attr);
2920 }
2921
2922 state->split_start++;
2923 break;
2924 case 10:
2925 if (nl80211_send_coalesce(msg, rdev))
2926 goto nla_put_failure;
2927
2928 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2929 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2930 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2931 goto nla_put_failure;
2932
2933 if (rdev->wiphy.max_ap_assoc_sta &&
2934 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2935 rdev->wiphy.max_ap_assoc_sta))
2936 goto nla_put_failure;
2937
2938 state->split_start++;
2939 break;
2940 case 11:
2941 if (rdev->wiphy.n_vendor_commands) {
2942 const struct nl80211_vendor_cmd_info *info;
2943 struct nlattr *nested;
2944
2945 nested = nla_nest_start_noflag(msg,
2946 NL80211_ATTR_VENDOR_DATA);
2947 if (!nested)
2948 goto nla_put_failure;
2949
2950 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2951 info = &rdev->wiphy.vendor_commands[i].info;
2952 if (nla_put(msg, i + 1, sizeof(*info), info))
2953 goto nla_put_failure;
2954 }
2955 nla_nest_end(msg, nested);
2956 }
2957
2958 if (rdev->wiphy.n_vendor_events) {
2959 const struct nl80211_vendor_cmd_info *info;
2960 struct nlattr *nested;
2961
2962 nested = nla_nest_start_noflag(msg,
2963 NL80211_ATTR_VENDOR_EVENTS);
2964 if (!nested)
2965 goto nla_put_failure;
2966
2967 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2968 info = &rdev->wiphy.vendor_events[i];
2969 if (nla_put(msg, i + 1, sizeof(*info), info))
2970 goto nla_put_failure;
2971 }
2972 nla_nest_end(msg, nested);
2973 }
2974 state->split_start++;
2975 break;
2976 case 12:
2977 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2978 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2979 rdev->wiphy.max_num_csa_counters))
2980 goto nla_put_failure;
2981
2982 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2983 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2984 goto nla_put_failure;
2985
2986 if (rdev->wiphy.max_sched_scan_reqs &&
2987 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2988 rdev->wiphy.max_sched_scan_reqs))
2989 goto nla_put_failure;
2990
2991 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2992 sizeof(rdev->wiphy.ext_features),
2993 rdev->wiphy.ext_features))
2994 goto nla_put_failure;
2995
2996 if (rdev->wiphy.bss_select_support) {
2997 struct nlattr *nested;
2998 u32 bss_select_support = rdev->wiphy.bss_select_support;
2999
3000 nested = nla_nest_start_noflag(msg,
3001 NL80211_ATTR_BSS_SELECT);
3002 if (!nested)
3003 goto nla_put_failure;
3004
3005 i = 0;
3006 while (bss_select_support) {
3007 if ((bss_select_support & 1) &&
3008 nla_put_flag(msg, i))
3009 goto nla_put_failure;
3010 i++;
3011 bss_select_support >>= 1;
3012 }
3013 nla_nest_end(msg, nested);
3014 }
3015
3016 state->split_start++;
3017 break;
3018 case 13:
3019 if (rdev->wiphy.num_iftype_ext_capab &&
3020 rdev->wiphy.iftype_ext_capab) {
3021 struct nlattr *nested_ext_capab, *nested;
3022
3023 nested = nla_nest_start_noflag(msg,
3024 NL80211_ATTR_IFTYPE_EXT_CAPA);
3025 if (!nested)
3026 goto nla_put_failure;
3027
3028 for (i = state->capa_start;
3029 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3030 const struct wiphy_iftype_ext_capab *capab;
3031
3032 capab = &rdev->wiphy.iftype_ext_capab[i];
3033
3034 nested_ext_capab = nla_nest_start_noflag(msg,
3035 i);
3036 if (!nested_ext_capab ||
3037 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3038 capab->iftype) ||
3039 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3040 capab->extended_capabilities_len,
3041 capab->extended_capabilities) ||
3042 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3043 capab->extended_capabilities_len,
3044 capab->extended_capabilities_mask))
3045 goto nla_put_failure;
3046
3047 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3048 (nla_put_u16(msg,
3049 NL80211_ATTR_EML_CAPABILITY,
3050 capab->eml_capabilities) ||
3051 nla_put_u16(msg,
3052 NL80211_ATTR_MLD_CAPA_AND_OPS,
3053 capab->mld_capa_and_ops)))
3054 goto nla_put_failure;
3055
3056 nla_nest_end(msg, nested_ext_capab);
3057 if (state->split)
3058 break;
3059 }
3060 nla_nest_end(msg, nested);
3061 if (i < rdev->wiphy.num_iftype_ext_capab) {
3062 state->capa_start = i + 1;
3063 break;
3064 }
3065 }
3066
3067 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3068 rdev->wiphy.nan_supported_bands))
3069 goto nla_put_failure;
3070
3071 if (wiphy_ext_feature_isset(&rdev->wiphy,
3072 NL80211_EXT_FEATURE_TXQS)) {
3073 struct cfg80211_txq_stats txqstats = {};
3074 int res;
3075
3076 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3077 if (!res &&
3078 !nl80211_put_txq_stats(msg, &txqstats,
3079 NL80211_ATTR_TXQ_STATS))
3080 goto nla_put_failure;
3081
3082 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3083 rdev->wiphy.txq_limit))
3084 goto nla_put_failure;
3085 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3086 rdev->wiphy.txq_memory_limit))
3087 goto nla_put_failure;
3088 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3089 rdev->wiphy.txq_quantum))
3090 goto nla_put_failure;
3091 }
3092
3093 state->split_start++;
3094 break;
3095 case 14:
3096 if (nl80211_send_pmsr_capa(rdev, msg))
3097 goto nla_put_failure;
3098
3099 state->split_start++;
3100 break;
3101 case 15:
3102 if (rdev->wiphy.akm_suites &&
3103 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3104 sizeof(u32) * rdev->wiphy.n_akm_suites,
3105 rdev->wiphy.akm_suites))
3106 goto nla_put_failure;
3107
3108 if (nl80211_put_iftype_akm_suites(rdev, msg))
3109 goto nla_put_failure;
3110
3111 if (nl80211_put_tid_config_support(rdev, msg))
3112 goto nla_put_failure;
3113 state->split_start++;
3114 break;
3115 case 16:
3116 if (nl80211_put_sar_specs(rdev, msg))
3117 goto nla_put_failure;
3118
3119 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3120 goto nla_put_failure;
3121
3122 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3123 rdev->wiphy.max_num_akm_suites))
3124 goto nla_put_failure;
3125
3126 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3127 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3128
3129 if (rdev->wiphy.hw_timestamp_max_peers &&
3130 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3131 rdev->wiphy.hw_timestamp_max_peers))
3132 goto nla_put_failure;
3133
3134 state->split_start++;
3135 break;
3136 case 17:
3137 if (nl80211_put_radios(&rdev->wiphy, msg))
3138 goto nla_put_failure;
3139
3140 /* done */
3141 state->split_start = 0;
3142 break;
3143 }
3144 finish:
3145 genlmsg_end(msg, hdr);
3146 return 0;
3147
3148 nla_put_failure:
3149 genlmsg_cancel(msg, hdr);
3150 return -EMSGSIZE;
3151 }
3152
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3153 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3154 struct netlink_callback *cb,
3155 struct nl80211_dump_wiphy_state *state)
3156 {
3157 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3158 int ret;
3159
3160 if (!tb)
3161 return -ENOMEM;
3162
3163 ret = nlmsg_parse_deprecated(cb->nlh,
3164 GENL_HDRLEN + nl80211_fam.hdrsize,
3165 tb, nl80211_fam.maxattr,
3166 nl80211_policy, NULL);
3167 /* ignore parse errors for backward compatibility */
3168 if (ret) {
3169 ret = 0;
3170 goto out;
3171 }
3172
3173 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3174 if (tb[NL80211_ATTR_WIPHY])
3175 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3176 if (tb[NL80211_ATTR_WDEV])
3177 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3178 if (tb[NL80211_ATTR_IFINDEX]) {
3179 struct net_device *netdev;
3180 struct cfg80211_registered_device *rdev;
3181 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3182
3183 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3184 if (!netdev) {
3185 ret = -ENODEV;
3186 goto out;
3187 }
3188 if (netdev->ieee80211_ptr) {
3189 rdev = wiphy_to_rdev(
3190 netdev->ieee80211_ptr->wiphy);
3191 state->filter_wiphy = rdev->wiphy_idx;
3192 }
3193 }
3194
3195 ret = 0;
3196 out:
3197 kfree(tb);
3198 return ret;
3199 }
3200
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3201 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3202 {
3203 int idx = 0, ret;
3204 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3205 struct cfg80211_registered_device *rdev;
3206
3207 rtnl_lock();
3208 if (!state) {
3209 state = kzalloc(sizeof(*state), GFP_KERNEL);
3210 if (!state) {
3211 rtnl_unlock();
3212 return -ENOMEM;
3213 }
3214 state->filter_wiphy = -1;
3215 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3216 if (ret) {
3217 kfree(state);
3218 rtnl_unlock();
3219 return ret;
3220 }
3221 cb->args[0] = (long)state;
3222 }
3223
3224 for_each_rdev(rdev) {
3225 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3226 continue;
3227 if (++idx <= state->start)
3228 continue;
3229 if (state->filter_wiphy != -1 &&
3230 state->filter_wiphy != rdev->wiphy_idx)
3231 continue;
3232 wiphy_lock(&rdev->wiphy);
3233 /* attempt to fit multiple wiphy data chunks into the skb */
3234 do {
3235 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3236 skb,
3237 NETLINK_CB(cb->skb).portid,
3238 cb->nlh->nlmsg_seq,
3239 NLM_F_MULTI, state);
3240 if (ret < 0) {
3241 /*
3242 * If sending the wiphy data didn't fit (ENOBUFS
3243 * or EMSGSIZE returned), this SKB is still
3244 * empty (so it's not too big because another
3245 * wiphy dataset is already in the skb) and
3246 * we've not tried to adjust the dump allocation
3247 * yet ... then adjust the alloc size to be
3248 * bigger, and return 1 but with the empty skb.
3249 * This results in an empty message being RX'ed
3250 * in userspace, but that is ignored.
3251 *
3252 * We can then retry with the larger buffer.
3253 */
3254 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3255 !skb->len && !state->split &&
3256 cb->min_dump_alloc < 4096) {
3257 cb->min_dump_alloc = 4096;
3258 state->split_start = 0;
3259 wiphy_unlock(&rdev->wiphy);
3260 rtnl_unlock();
3261 return 1;
3262 }
3263 idx--;
3264 break;
3265 }
3266 } while (state->split_start > 0);
3267 wiphy_unlock(&rdev->wiphy);
3268 break;
3269 }
3270 rtnl_unlock();
3271
3272 state->start = idx;
3273
3274 return skb->len;
3275 }
3276
nl80211_dump_wiphy_done(struct netlink_callback * cb)3277 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3278 {
3279 kfree((void *)cb->args[0]);
3280 return 0;
3281 }
3282
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3283 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3284 {
3285 struct sk_buff *msg;
3286 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3287 struct nl80211_dump_wiphy_state state = {};
3288
3289 msg = nlmsg_new(4096, GFP_KERNEL);
3290 if (!msg)
3291 return -ENOMEM;
3292
3293 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3294 info->snd_portid, info->snd_seq, 0,
3295 &state) < 0) {
3296 nlmsg_free(msg);
3297 return -ENOBUFS;
3298 }
3299
3300 return genlmsg_reply(msg, info);
3301 }
3302
3303 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3304 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3305 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3306 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3307 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3308 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3309 };
3310
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3311 static int parse_txq_params(struct nlattr *tb[],
3312 struct ieee80211_txq_params *txq_params)
3313 {
3314 u8 ac;
3315
3316 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3317 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3318 !tb[NL80211_TXQ_ATTR_AIFS])
3319 return -EINVAL;
3320
3321 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3322 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3323 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3324 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3325 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3326
3327 if (ac >= NL80211_NUM_ACS)
3328 return -EINVAL;
3329 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3330 return 0;
3331 }
3332
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3333 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3334 {
3335 /*
3336 * You can only set the channel explicitly for some interfaces,
3337 * most have their channel managed via their respective
3338 * "establish a connection" command (connect, join, ...)
3339 *
3340 * For AP/GO and mesh mode, the channel can be set with the
3341 * channel userspace API, but is only stored and passed to the
3342 * low-level driver when the AP starts or the mesh is joined.
3343 * This is for backward compatibility, userspace can also give
3344 * the channel in the start-ap or join-mesh commands instead.
3345 *
3346 * Monitors are special as they are normally slaved to
3347 * whatever else is going on, so they have their own special
3348 * operation to set the monitor channel if possible.
3349 */
3350 return !wdev ||
3351 wdev->iftype == NL80211_IFTYPE_AP ||
3352 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3353 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3354 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3355 }
3356
_nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,bool monitor,struct cfg80211_chan_def * chandef)3357 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3358 struct genl_info *info, bool monitor,
3359 struct cfg80211_chan_def *chandef)
3360 {
3361 struct netlink_ext_ack *extack = info->extack;
3362 struct nlattr **attrs = info->attrs;
3363 u32 control_freq;
3364
3365 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3366 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3367 "Frequency is missing");
3368 return -EINVAL;
3369 }
3370
3371 control_freq = MHZ_TO_KHZ(
3372 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3373 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3374 control_freq +=
3375 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3376
3377 memset(chandef, 0, sizeof(*chandef));
3378 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3379 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3380 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3381 chandef->freq1_offset = control_freq % 1000;
3382 chandef->center_freq2 = 0;
3383
3384 if (!chandef->chan) {
3385 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3386 "Unknown channel");
3387 return -EINVAL;
3388 }
3389
3390 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3391 enum nl80211_channel_type chantype;
3392
3393 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3394
3395 switch (chantype) {
3396 case NL80211_CHAN_NO_HT:
3397 case NL80211_CHAN_HT20:
3398 case NL80211_CHAN_HT40PLUS:
3399 case NL80211_CHAN_HT40MINUS:
3400 cfg80211_chandef_create(chandef, chandef->chan,
3401 chantype);
3402 /* user input for center_freq is incorrect */
3403 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3404 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3405 NL_SET_ERR_MSG_ATTR(extack,
3406 attrs[NL80211_ATTR_CENTER_FREQ1],
3407 "bad center frequency 1");
3408 return -EINVAL;
3409 }
3410 /* center_freq2 must be zero */
3411 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3412 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3413 NL_SET_ERR_MSG_ATTR(extack,
3414 attrs[NL80211_ATTR_CENTER_FREQ2],
3415 "center frequency 2 can't be used");
3416 return -EINVAL;
3417 }
3418 break;
3419 default:
3420 NL_SET_ERR_MSG_ATTR(extack,
3421 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3422 "invalid channel type");
3423 return -EINVAL;
3424 }
3425 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3426 chandef->width =
3427 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3428 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3429 /* User input error for channel width doesn't match channel */
3430 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3431 NL_SET_ERR_MSG_ATTR(extack,
3432 attrs[NL80211_ATTR_CHANNEL_WIDTH],
3433 "bad channel width");
3434 return -EINVAL;
3435 }
3436 }
3437 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3438 chandef->center_freq1 =
3439 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3440 chandef->freq1_offset =
3441 nla_get_u32_default(attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET],
3442 0);
3443 }
3444 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3445 chandef->center_freq2 =
3446 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3447 }
3448
3449 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3450 chandef->edmg.channels =
3451 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3452
3453 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3454 chandef->edmg.bw_config =
3455 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3456 } else {
3457 chandef->edmg.bw_config = 0;
3458 chandef->edmg.channels = 0;
3459 }
3460
3461 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3462 chandef->punctured =
3463 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3464
3465 if (chandef->punctured &&
3466 !wiphy_ext_feature_isset(&rdev->wiphy,
3467 NL80211_EXT_FEATURE_PUNCT)) {
3468 NL_SET_ERR_MSG(extack,
3469 "driver doesn't support puncturing");
3470 return -EINVAL;
3471 }
3472 }
3473
3474 if (!cfg80211_chandef_valid(chandef)) {
3475 NL_SET_ERR_MSG(extack, "invalid channel definition");
3476 return -EINVAL;
3477 }
3478
3479 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3480 IEEE80211_CHAN_DISABLED,
3481 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3482 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3483 return -EINVAL;
3484 }
3485
3486 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3487 chandef->width == NL80211_CHAN_WIDTH_10) &&
3488 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3489 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3490 return -EINVAL;
3491 }
3492
3493 return 0;
3494 }
3495
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3496 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3497 struct genl_info *info,
3498 struct cfg80211_chan_def *chandef)
3499 {
3500 return _nl80211_parse_chandef(rdev, info, false, chandef);
3501 }
3502
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3503 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3504 struct net_device *dev,
3505 struct genl_info *info,
3506 int _link_id)
3507 {
3508 struct cfg80211_chan_def chandef;
3509 int result;
3510 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3511 struct wireless_dev *wdev = NULL;
3512 int link_id = _link_id;
3513
3514 if (dev)
3515 wdev = dev->ieee80211_ptr;
3516 if (!nl80211_can_set_dev_channel(wdev))
3517 return -EOPNOTSUPP;
3518 if (wdev)
3519 iftype = wdev->iftype;
3520
3521 if (link_id < 0) {
3522 if (wdev && wdev->valid_links)
3523 return -EINVAL;
3524 link_id = 0;
3525 }
3526
3527 result = _nl80211_parse_chandef(rdev, info,
3528 iftype == NL80211_IFTYPE_MONITOR,
3529 &chandef);
3530 if (result)
3531 return result;
3532
3533 switch (iftype) {
3534 case NL80211_IFTYPE_AP:
3535 case NL80211_IFTYPE_P2P_GO:
3536 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3537 iftype))
3538 return -EINVAL;
3539 if (wdev->links[link_id].ap.beacon_interval) {
3540 struct ieee80211_channel *cur_chan;
3541
3542 if (!dev || !rdev->ops->set_ap_chanwidth ||
3543 !(rdev->wiphy.features &
3544 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3545 return -EBUSY;
3546
3547 /* Only allow dynamic channel width changes */
3548 cur_chan = wdev->links[link_id].ap.chandef.chan;
3549 if (chandef.chan != cur_chan)
3550 return -EBUSY;
3551
3552 /* only allow this for regular channel widths */
3553 switch (wdev->links[link_id].ap.chandef.width) {
3554 case NL80211_CHAN_WIDTH_20_NOHT:
3555 case NL80211_CHAN_WIDTH_20:
3556 case NL80211_CHAN_WIDTH_40:
3557 case NL80211_CHAN_WIDTH_80:
3558 case NL80211_CHAN_WIDTH_80P80:
3559 case NL80211_CHAN_WIDTH_160:
3560 case NL80211_CHAN_WIDTH_320:
3561 break;
3562 default:
3563 return -EINVAL;
3564 }
3565
3566 switch (chandef.width) {
3567 case NL80211_CHAN_WIDTH_20_NOHT:
3568 case NL80211_CHAN_WIDTH_20:
3569 case NL80211_CHAN_WIDTH_40:
3570 case NL80211_CHAN_WIDTH_80:
3571 case NL80211_CHAN_WIDTH_80P80:
3572 case NL80211_CHAN_WIDTH_160:
3573 case NL80211_CHAN_WIDTH_320:
3574 break;
3575 default:
3576 return -EINVAL;
3577 }
3578
3579 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3580 &chandef);
3581 if (result)
3582 return result;
3583 wdev->links[link_id].ap.chandef = chandef;
3584 } else {
3585 wdev->u.ap.preset_chandef = chandef;
3586 }
3587 return 0;
3588 case NL80211_IFTYPE_MESH_POINT:
3589 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3590 case NL80211_IFTYPE_MONITOR:
3591 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3592 default:
3593 break;
3594 }
3595
3596 return -EINVAL;
3597 }
3598
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3599 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3600 {
3601 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3602 int link_id = nl80211_link_id_or_invalid(info->attrs);
3603 struct net_device *netdev = info->user_ptr[1];
3604
3605 return __nl80211_set_channel(rdev, netdev, info, link_id);
3606 }
3607
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3608 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3609 {
3610 struct cfg80211_registered_device *rdev = NULL;
3611 struct net_device *netdev = NULL;
3612 struct wireless_dev *wdev;
3613 int result = 0, rem_txq_params = 0;
3614 struct nlattr *nl_txq_params;
3615 u32 changed;
3616 u8 retry_short = 0, retry_long = 0;
3617 u32 frag_threshold = 0, rts_threshold = 0;
3618 u8 coverage_class = 0;
3619 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3620
3621 rtnl_lock();
3622 /*
3623 * Try to find the wiphy and netdev. Normally this
3624 * function shouldn't need the netdev, but this is
3625 * done for backward compatibility -- previously
3626 * setting the channel was done per wiphy, but now
3627 * it is per netdev. Previous userland like hostapd
3628 * also passed a netdev to set_wiphy, so that it is
3629 * possible to let that go to the right netdev!
3630 */
3631
3632 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3633 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3634
3635 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3636 if (netdev && netdev->ieee80211_ptr)
3637 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3638 else
3639 netdev = NULL;
3640 }
3641
3642 if (!netdev) {
3643 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3644 info->attrs);
3645 if (IS_ERR(rdev)) {
3646 rtnl_unlock();
3647 return PTR_ERR(rdev);
3648 }
3649 wdev = NULL;
3650 netdev = NULL;
3651 result = 0;
3652 } else
3653 wdev = netdev->ieee80211_ptr;
3654
3655 guard(wiphy)(&rdev->wiphy);
3656
3657 /*
3658 * end workaround code, by now the rdev is available
3659 * and locked, and wdev may or may not be NULL.
3660 */
3661
3662 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3663 result = cfg80211_dev_rename(
3664 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3665 rtnl_unlock();
3666
3667 if (result)
3668 return result;
3669
3670 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3671 struct ieee80211_txq_params txq_params;
3672 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3673
3674 if (!rdev->ops->set_txq_params)
3675 return -EOPNOTSUPP;
3676
3677 if (!netdev)
3678 return -EINVAL;
3679
3680 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3681 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3682 return -EINVAL;
3683
3684 if (!netif_running(netdev))
3685 return -ENETDOWN;
3686
3687 nla_for_each_nested(nl_txq_params,
3688 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3689 rem_txq_params) {
3690 result = nla_parse_nested_deprecated(tb,
3691 NL80211_TXQ_ATTR_MAX,
3692 nl_txq_params,
3693 txq_params_policy,
3694 info->extack);
3695 if (result)
3696 return result;
3697
3698 result = parse_txq_params(tb, &txq_params);
3699 if (result)
3700 return result;
3701
3702 txq_params.link_id =
3703 nl80211_link_id_or_invalid(info->attrs);
3704
3705 if (txq_params.link_id >= 0 &&
3706 !(netdev->ieee80211_ptr->valid_links &
3707 BIT(txq_params.link_id)))
3708 result = -ENOLINK;
3709 else if (txq_params.link_id >= 0 &&
3710 !netdev->ieee80211_ptr->valid_links)
3711 result = -EINVAL;
3712 else
3713 result = rdev_set_txq_params(rdev, netdev,
3714 &txq_params);
3715 if (result)
3716 return result;
3717 }
3718 }
3719
3720 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3721 int link_id = nl80211_link_id_or_invalid(info->attrs);
3722
3723 if (wdev) {
3724 result = __nl80211_set_channel(
3725 rdev,
3726 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3727 info, link_id);
3728 } else {
3729 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3730 }
3731
3732 if (result)
3733 return result;
3734 }
3735
3736 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3737 struct wireless_dev *txp_wdev = wdev;
3738 enum nl80211_tx_power_setting type;
3739 int idx, mbm = 0;
3740
3741 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3742 txp_wdev = NULL;
3743
3744 if (!rdev->ops->set_tx_power)
3745 return -EOPNOTSUPP;
3746
3747 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3748 type = nla_get_u32(info->attrs[idx]);
3749
3750 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3751 (type != NL80211_TX_POWER_AUTOMATIC))
3752 return -EINVAL;
3753
3754 if (type != NL80211_TX_POWER_AUTOMATIC) {
3755 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3756 mbm = nla_get_u32(info->attrs[idx]);
3757 }
3758
3759 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3760 if (result)
3761 return result;
3762 }
3763
3764 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3765 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3766 u32 tx_ant, rx_ant;
3767
3768 if ((!rdev->wiphy.available_antennas_tx &&
3769 !rdev->wiphy.available_antennas_rx) ||
3770 !rdev->ops->set_antenna)
3771 return -EOPNOTSUPP;
3772
3773 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3774 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3775
3776 /* reject antenna configurations which don't match the
3777 * available antenna masks, except for the "all" mask */
3778 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3779 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3780 return -EINVAL;
3781
3782 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3783 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3784
3785 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3786 if (result)
3787 return result;
3788 }
3789
3790 changed = 0;
3791
3792 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3793 retry_short = nla_get_u8(
3794 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3795
3796 changed |= WIPHY_PARAM_RETRY_SHORT;
3797 }
3798
3799 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3800 retry_long = nla_get_u8(
3801 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3802
3803 changed |= WIPHY_PARAM_RETRY_LONG;
3804 }
3805
3806 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3807 frag_threshold = nla_get_u32(
3808 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3809 if (frag_threshold < 256)
3810 return -EINVAL;
3811
3812 if (frag_threshold != (u32) -1) {
3813 /*
3814 * Fragments (apart from the last one) are required to
3815 * have even length. Make the fragmentation code
3816 * simpler by stripping LSB should someone try to use
3817 * odd threshold value.
3818 */
3819 frag_threshold &= ~0x1;
3820 }
3821 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3822 }
3823
3824 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3825 rts_threshold = nla_get_u32(
3826 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3827 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3828 }
3829
3830 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3831 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3832 return -EINVAL;
3833
3834 coverage_class = nla_get_u8(
3835 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3836 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3837 }
3838
3839 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3840 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3841 return -EOPNOTSUPP;
3842
3843 changed |= WIPHY_PARAM_DYN_ACK;
3844 }
3845
3846 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3847 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3848 NL80211_EXT_FEATURE_TXQS))
3849 return -EOPNOTSUPP;
3850
3851 txq_limit = nla_get_u32(
3852 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3853 changed |= WIPHY_PARAM_TXQ_LIMIT;
3854 }
3855
3856 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3857 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3858 NL80211_EXT_FEATURE_TXQS))
3859 return -EOPNOTSUPP;
3860
3861 txq_memory_limit = nla_get_u32(
3862 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3863 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3864 }
3865
3866 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3867 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3868 NL80211_EXT_FEATURE_TXQS))
3869 return -EOPNOTSUPP;
3870
3871 txq_quantum = nla_get_u32(
3872 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3873 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3874 }
3875
3876 if (changed) {
3877 u8 old_retry_short, old_retry_long;
3878 u32 old_frag_threshold, old_rts_threshold;
3879 u8 old_coverage_class;
3880 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3881
3882 if (!rdev->ops->set_wiphy_params)
3883 return -EOPNOTSUPP;
3884
3885 old_retry_short = rdev->wiphy.retry_short;
3886 old_retry_long = rdev->wiphy.retry_long;
3887 old_frag_threshold = rdev->wiphy.frag_threshold;
3888 old_rts_threshold = rdev->wiphy.rts_threshold;
3889 old_coverage_class = rdev->wiphy.coverage_class;
3890 old_txq_limit = rdev->wiphy.txq_limit;
3891 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3892 old_txq_quantum = rdev->wiphy.txq_quantum;
3893
3894 if (changed & WIPHY_PARAM_RETRY_SHORT)
3895 rdev->wiphy.retry_short = retry_short;
3896 if (changed & WIPHY_PARAM_RETRY_LONG)
3897 rdev->wiphy.retry_long = retry_long;
3898 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3899 rdev->wiphy.frag_threshold = frag_threshold;
3900 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3901 rdev->wiphy.rts_threshold = rts_threshold;
3902 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3903 rdev->wiphy.coverage_class = coverage_class;
3904 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3905 rdev->wiphy.txq_limit = txq_limit;
3906 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3907 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3908 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3909 rdev->wiphy.txq_quantum = txq_quantum;
3910
3911 result = rdev_set_wiphy_params(rdev, changed);
3912 if (result) {
3913 rdev->wiphy.retry_short = old_retry_short;
3914 rdev->wiphy.retry_long = old_retry_long;
3915 rdev->wiphy.frag_threshold = old_frag_threshold;
3916 rdev->wiphy.rts_threshold = old_rts_threshold;
3917 rdev->wiphy.coverage_class = old_coverage_class;
3918 rdev->wiphy.txq_limit = old_txq_limit;
3919 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3920 rdev->wiphy.txq_quantum = old_txq_quantum;
3921 return result;
3922 }
3923 }
3924
3925 return 0;
3926 }
3927
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)3928 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3929 {
3930 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3931 return -EINVAL;
3932
3933 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3934 chandef->chan->center_freq))
3935 return -ENOBUFS;
3936 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3937 chandef->chan->freq_offset))
3938 return -ENOBUFS;
3939 switch (chandef->width) {
3940 case NL80211_CHAN_WIDTH_20_NOHT:
3941 case NL80211_CHAN_WIDTH_20:
3942 case NL80211_CHAN_WIDTH_40:
3943 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3944 cfg80211_get_chandef_type(chandef)))
3945 return -ENOBUFS;
3946 break;
3947 default:
3948 break;
3949 }
3950 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3951 return -ENOBUFS;
3952 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3953 return -ENOBUFS;
3954 if (chandef->center_freq2 &&
3955 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3956 return -ENOBUFS;
3957 if (chandef->punctured &&
3958 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
3959 return -ENOBUFS;
3960
3961 return 0;
3962 }
3963 EXPORT_SYMBOL(nl80211_send_chandef);
3964
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)3965 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3966 struct cfg80211_registered_device *rdev,
3967 struct wireless_dev *wdev,
3968 enum nl80211_commands cmd)
3969 {
3970 struct net_device *dev = wdev->netdev;
3971 void *hdr;
3972
3973 lockdep_assert_wiphy(&rdev->wiphy);
3974
3975 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3976 cmd != NL80211_CMD_DEL_INTERFACE &&
3977 cmd != NL80211_CMD_SET_INTERFACE);
3978
3979 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3980 if (!hdr)
3981 return -1;
3982
3983 if (dev &&
3984 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3985 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3986 goto nla_put_failure;
3987
3988 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3989 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3990 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3991 NL80211_ATTR_PAD) ||
3992 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3993 nla_put_u32(msg, NL80211_ATTR_GENERATION,
3994 rdev->devlist_generation ^
3995 (cfg80211_rdev_list_generation << 2)) ||
3996 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
3997 nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
3998 goto nla_put_failure;
3999
4000 if (rdev->ops->get_channel && !wdev->valid_links) {
4001 struct cfg80211_chan_def chandef = {};
4002 int ret;
4003
4004 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4005 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4006 goto nla_put_failure;
4007 }
4008
4009 if (rdev->ops->get_tx_power && !wdev->valid_links) {
4010 int dbm, ret;
4011
4012 ret = rdev_get_tx_power(rdev, wdev, 0, &dbm);
4013 if (ret == 0 &&
4014 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4015 DBM_TO_MBM(dbm)))
4016 goto nla_put_failure;
4017 }
4018
4019 switch (wdev->iftype) {
4020 case NL80211_IFTYPE_AP:
4021 case NL80211_IFTYPE_P2P_GO:
4022 if (wdev->u.ap.ssid_len &&
4023 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4024 wdev->u.ap.ssid))
4025 goto nla_put_failure;
4026 break;
4027 case NL80211_IFTYPE_STATION:
4028 case NL80211_IFTYPE_P2P_CLIENT:
4029 if (wdev->u.client.ssid_len &&
4030 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4031 wdev->u.client.ssid))
4032 goto nla_put_failure;
4033 break;
4034 case NL80211_IFTYPE_ADHOC:
4035 if (wdev->u.ibss.ssid_len &&
4036 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4037 wdev->u.ibss.ssid))
4038 goto nla_put_failure;
4039 break;
4040 default:
4041 /* nothing */
4042 break;
4043 }
4044
4045 if (rdev->ops->get_txq_stats) {
4046 struct cfg80211_txq_stats txqstats = {};
4047 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4048
4049 if (ret == 0 &&
4050 !nl80211_put_txq_stats(msg, &txqstats,
4051 NL80211_ATTR_TXQ_STATS))
4052 goto nla_put_failure;
4053 }
4054
4055 if (wdev->valid_links) {
4056 unsigned int link_id;
4057 struct nlattr *links = nla_nest_start(msg,
4058 NL80211_ATTR_MLO_LINKS);
4059
4060 if (!links)
4061 goto nla_put_failure;
4062
4063 for_each_valid_link(wdev, link_id) {
4064 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4065 struct cfg80211_chan_def chandef = {};
4066 int ret;
4067
4068 if (!link)
4069 goto nla_put_failure;
4070
4071 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4072 goto nla_put_failure;
4073 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4074 wdev->links[link_id].addr))
4075 goto nla_put_failure;
4076
4077 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4078 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4079 goto nla_put_failure;
4080
4081 if (rdev->ops->get_tx_power) {
4082 int dbm, ret;
4083
4084 ret = rdev_get_tx_power(rdev, wdev, link_id, &dbm);
4085 if (ret == 0 &&
4086 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4087 DBM_TO_MBM(dbm)))
4088 goto nla_put_failure;
4089 }
4090 nla_nest_end(msg, link);
4091 }
4092
4093 nla_nest_end(msg, links);
4094 }
4095
4096 genlmsg_end(msg, hdr);
4097 return 0;
4098
4099 nla_put_failure:
4100 genlmsg_cancel(msg, hdr);
4101 return -EMSGSIZE;
4102 }
4103
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)4104 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4105 {
4106 int wp_idx = 0;
4107 int if_idx = 0;
4108 int wp_start = cb->args[0];
4109 int if_start = cb->args[1];
4110 int filter_wiphy = -1;
4111 struct cfg80211_registered_device *rdev;
4112 struct wireless_dev *wdev;
4113 int ret;
4114
4115 rtnl_lock();
4116 if (!cb->args[2]) {
4117 struct nl80211_dump_wiphy_state state = {
4118 .filter_wiphy = -1,
4119 };
4120
4121 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4122 if (ret)
4123 goto out_unlock;
4124
4125 filter_wiphy = state.filter_wiphy;
4126
4127 /*
4128 * if filtering, set cb->args[2] to +1 since 0 is the default
4129 * value needed to determine that parsing is necessary.
4130 */
4131 if (filter_wiphy >= 0)
4132 cb->args[2] = filter_wiphy + 1;
4133 else
4134 cb->args[2] = -1;
4135 } else if (cb->args[2] > 0) {
4136 filter_wiphy = cb->args[2] - 1;
4137 }
4138
4139 for_each_rdev(rdev) {
4140 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4141 continue;
4142 if (wp_idx < wp_start) {
4143 wp_idx++;
4144 continue;
4145 }
4146
4147 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4148 continue;
4149
4150 if_idx = 0;
4151
4152 guard(wiphy)(&rdev->wiphy);
4153
4154 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4155 if (if_idx < if_start) {
4156 if_idx++;
4157 continue;
4158 }
4159
4160 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4161 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4162 rdev, wdev,
4163 NL80211_CMD_NEW_INTERFACE) < 0)
4164 goto out;
4165
4166 if_idx++;
4167 }
4168
4169 if_start = 0;
4170 wp_idx++;
4171 }
4172 out:
4173 cb->args[0] = wp_idx;
4174 cb->args[1] = if_idx;
4175
4176 ret = skb->len;
4177 out_unlock:
4178 rtnl_unlock();
4179
4180 return ret;
4181 }
4182
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4183 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4184 {
4185 struct sk_buff *msg;
4186 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4187 struct wireless_dev *wdev = info->user_ptr[1];
4188
4189 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4190 if (!msg)
4191 return -ENOMEM;
4192
4193 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4194 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4195 nlmsg_free(msg);
4196 return -ENOBUFS;
4197 }
4198
4199 return genlmsg_reply(msg, info);
4200 }
4201
4202 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4203 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4204 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4205 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4206 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4207 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4208 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4209 [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4210 };
4211
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4212 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4213 {
4214 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4215 int flag;
4216
4217 *mntrflags = 0;
4218
4219 if (!nla)
4220 return -EINVAL;
4221
4222 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4223 return -EINVAL;
4224
4225 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4226 if (flags[flag])
4227 *mntrflags |= (1<<flag);
4228
4229 /* cooked monitor mode is incompatible with other modes */
4230 if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4231 *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4232 return -EOPNOTSUPP;
4233
4234 *mntrflags |= MONITOR_FLAG_CHANGED;
4235
4236 return 0;
4237 }
4238
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4239 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4240 enum nl80211_iftype type,
4241 struct genl_info *info,
4242 struct vif_params *params)
4243 {
4244 bool change = false;
4245 int err;
4246
4247 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4248 if (type != NL80211_IFTYPE_MONITOR)
4249 return -EINVAL;
4250
4251 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4252 ¶ms->flags);
4253 if (err)
4254 return err;
4255
4256 change = true;
4257 }
4258
4259 /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4260 if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4261 return -EOPNOTSUPP;
4262
4263 if (params->flags & MONITOR_FLAG_ACTIVE &&
4264 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4265 return -EOPNOTSUPP;
4266
4267 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4268 const u8 *mumimo_groups;
4269 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4270
4271 if (type != NL80211_IFTYPE_MONITOR)
4272 return -EINVAL;
4273
4274 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4275 return -EOPNOTSUPP;
4276
4277 mumimo_groups =
4278 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4279
4280 /* bits 0 and 63 are reserved and must be zero */
4281 if ((mumimo_groups[0] & BIT(0)) ||
4282 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4283 return -EINVAL;
4284
4285 params->vht_mumimo_groups = mumimo_groups;
4286 change = true;
4287 }
4288
4289 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4290 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4291
4292 if (type != NL80211_IFTYPE_MONITOR)
4293 return -EINVAL;
4294
4295 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4296 return -EOPNOTSUPP;
4297
4298 params->vht_mumimo_follow_addr =
4299 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4300 change = true;
4301 }
4302
4303 return change ? 1 : 0;
4304 }
4305
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4306 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4307 struct net_device *netdev, u8 use_4addr,
4308 enum nl80211_iftype iftype)
4309 {
4310 if (!use_4addr) {
4311 if (netdev && netif_is_bridge_port(netdev))
4312 return -EBUSY;
4313 return 0;
4314 }
4315
4316 switch (iftype) {
4317 case NL80211_IFTYPE_AP_VLAN:
4318 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4319 return 0;
4320 break;
4321 case NL80211_IFTYPE_STATION:
4322 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4323 return 0;
4324 break;
4325 default:
4326 break;
4327 }
4328
4329 return -EOPNOTSUPP;
4330 }
4331
nl80211_parse_vif_radio_mask(struct genl_info * info,u32 * radio_mask)4332 static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4333 u32 *radio_mask)
4334 {
4335 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4336 struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4337 u32 mask, allowed;
4338
4339 if (!attr) {
4340 *radio_mask = 0;
4341 return 0;
4342 }
4343
4344 allowed = BIT(rdev->wiphy.n_radio) - 1;
4345 mask = nla_get_u32(attr);
4346 if (mask & ~allowed)
4347 return -EINVAL;
4348 if (!mask)
4349 mask = allowed;
4350 *radio_mask = mask;
4351
4352 return 1;
4353 }
4354
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4355 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4356 {
4357 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4358 struct vif_params params;
4359 int err;
4360 enum nl80211_iftype otype, ntype;
4361 struct net_device *dev = info->user_ptr[1];
4362 struct wireless_dev *wdev = dev->ieee80211_ptr;
4363 u32 radio_mask = 0;
4364 bool change = false;
4365
4366 memset(¶ms, 0, sizeof(params));
4367
4368 otype = ntype = dev->ieee80211_ptr->iftype;
4369
4370 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4371 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4372 if (otype != ntype)
4373 change = true;
4374 }
4375
4376 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4377 if (ntype != NL80211_IFTYPE_MESH_POINT)
4378 return -EINVAL;
4379 if (otype != NL80211_IFTYPE_MESH_POINT)
4380 return -EINVAL;
4381 if (netif_running(dev))
4382 return -EBUSY;
4383
4384 wdev->u.mesh.id_up_len =
4385 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4386 memcpy(wdev->u.mesh.id,
4387 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4388 wdev->u.mesh.id_up_len);
4389 }
4390
4391 if (info->attrs[NL80211_ATTR_4ADDR]) {
4392 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4393 change = true;
4394 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4395 if (err)
4396 return err;
4397 } else {
4398 params.use_4addr = -1;
4399 }
4400
4401 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4402 if (err < 0)
4403 return err;
4404 if (err > 0)
4405 change = true;
4406
4407 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4408 if (err < 0)
4409 return err;
4410 if (err && netif_running(dev))
4411 return -EBUSY;
4412
4413 if (change)
4414 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4415 else
4416 err = 0;
4417
4418 if (!err && params.use_4addr != -1)
4419 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4420
4421 if (radio_mask)
4422 wdev->radio_mask = radio_mask;
4423
4424 if (change && !err)
4425 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4426
4427 return err;
4428 }
4429
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4430 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4431 {
4432 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4433 struct vif_params params;
4434 struct wireless_dev *wdev;
4435 struct sk_buff *msg;
4436 u32 radio_mask;
4437 int err;
4438 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4439
4440 memset(¶ms, 0, sizeof(params));
4441
4442 if (!info->attrs[NL80211_ATTR_IFNAME])
4443 return -EINVAL;
4444
4445 if (info->attrs[NL80211_ATTR_IFTYPE])
4446 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4447
4448 if (!rdev->ops->add_virtual_intf)
4449 return -EOPNOTSUPP;
4450
4451 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4452 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4453 info->attrs[NL80211_ATTR_MAC]) {
4454 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4455 ETH_ALEN);
4456 if (!is_valid_ether_addr(params.macaddr))
4457 return -EADDRNOTAVAIL;
4458 }
4459
4460 if (info->attrs[NL80211_ATTR_4ADDR]) {
4461 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4462 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4463 if (err)
4464 return err;
4465 }
4466
4467 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4468 return -EOPNOTSUPP;
4469
4470 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4471 if (err < 0)
4472 return err;
4473
4474 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4475 if (err < 0)
4476 return err;
4477
4478 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4479 if (!msg)
4480 return -ENOMEM;
4481
4482 wdev = rdev_add_virtual_intf(rdev,
4483 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4484 NET_NAME_USER, type, ¶ms);
4485 if (WARN_ON(!wdev)) {
4486 nlmsg_free(msg);
4487 return -EPROTO;
4488 } else if (IS_ERR(wdev)) {
4489 nlmsg_free(msg);
4490 return PTR_ERR(wdev);
4491 }
4492
4493 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4494 wdev->owner_nlportid = info->snd_portid;
4495
4496 switch (type) {
4497 case NL80211_IFTYPE_MESH_POINT:
4498 if (!info->attrs[NL80211_ATTR_MESH_ID])
4499 break;
4500 wdev->u.mesh.id_up_len =
4501 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4502 memcpy(wdev->u.mesh.id,
4503 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4504 wdev->u.mesh.id_up_len);
4505 break;
4506 case NL80211_IFTYPE_NAN:
4507 case NL80211_IFTYPE_P2P_DEVICE:
4508 /*
4509 * P2P Device and NAN do not have a netdev, so don't go
4510 * through the netdev notifier and must be added here
4511 */
4512 cfg80211_init_wdev(wdev);
4513 cfg80211_register_wdev(rdev, wdev);
4514 break;
4515 default:
4516 break;
4517 }
4518
4519 if (radio_mask)
4520 wdev->radio_mask = radio_mask;
4521
4522 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4523 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4524 nlmsg_free(msg);
4525 return -ENOBUFS;
4526 }
4527
4528 return genlmsg_reply(msg, info);
4529 }
4530
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4531 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4532 {
4533 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4534
4535 /* to avoid failing a new interface creation due to pending removal */
4536 cfg80211_destroy_ifaces(rdev);
4537
4538 guard(wiphy)(&rdev->wiphy);
4539
4540 return _nl80211_new_interface(skb, info);
4541 }
4542
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4543 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4544 {
4545 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4546 struct wireless_dev *wdev = info->user_ptr[1];
4547
4548 if (!rdev->ops->del_virtual_intf)
4549 return -EOPNOTSUPP;
4550
4551 /*
4552 * We hold RTNL, so this is safe, without RTNL opencount cannot
4553 * reach 0, and thus the rdev cannot be deleted.
4554 *
4555 * We need to do it for the dev_close(), since that will call
4556 * the netdev notifiers, and we need to acquire the mutex there
4557 * but don't know if we get there from here or from some other
4558 * place (e.g. "ip link set ... down").
4559 */
4560 mutex_unlock(&rdev->wiphy.mtx);
4561
4562 /*
4563 * If we remove a wireless device without a netdev then clear
4564 * user_ptr[1] so that nl80211_post_doit won't dereference it
4565 * to check if it needs to do dev_put(). Otherwise it crashes
4566 * since the wdev has been freed, unlike with a netdev where
4567 * we need the dev_put() for the netdev to really be freed.
4568 */
4569 if (!wdev->netdev)
4570 info->user_ptr[1] = NULL;
4571 else
4572 dev_close(wdev->netdev);
4573
4574 mutex_lock(&rdev->wiphy.mtx);
4575
4576 return cfg80211_remove_virtual_intf(rdev, wdev);
4577 }
4578
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4579 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4580 {
4581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4582 struct net_device *dev = info->user_ptr[1];
4583 u16 noack_map;
4584
4585 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4586 return -EINVAL;
4587
4588 if (!rdev->ops->set_noack_map)
4589 return -EOPNOTSUPP;
4590
4591 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4592
4593 return rdev_set_noack_map(rdev, dev, noack_map);
4594 }
4595
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4596 static int nl80211_validate_key_link_id(struct genl_info *info,
4597 struct wireless_dev *wdev,
4598 int link_id, bool pairwise)
4599 {
4600 if (pairwise) {
4601 if (link_id != -1) {
4602 GENL_SET_ERR_MSG(info,
4603 "link ID not allowed for pairwise key");
4604 return -EINVAL;
4605 }
4606
4607 return 0;
4608 }
4609
4610 if (wdev->valid_links) {
4611 if (link_id == -1) {
4612 GENL_SET_ERR_MSG(info,
4613 "link ID must for MLO group key");
4614 return -EINVAL;
4615 }
4616 if (!(wdev->valid_links & BIT(link_id))) {
4617 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4618 return -EINVAL;
4619 }
4620 } else if (link_id != -1) {
4621 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4622 return -EINVAL;
4623 }
4624
4625 return 0;
4626 }
4627
4628 struct get_key_cookie {
4629 struct sk_buff *msg;
4630 int error;
4631 int idx;
4632 };
4633
get_key_callback(void * c,struct key_params * params)4634 static void get_key_callback(void *c, struct key_params *params)
4635 {
4636 struct nlattr *key;
4637 struct get_key_cookie *cookie = c;
4638
4639 if ((params->seq &&
4640 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4641 params->seq_len, params->seq)) ||
4642 (params->cipher &&
4643 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4644 params->cipher)))
4645 goto nla_put_failure;
4646
4647 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4648 if (!key)
4649 goto nla_put_failure;
4650
4651 if ((params->seq &&
4652 nla_put(cookie->msg, NL80211_KEY_SEQ,
4653 params->seq_len, params->seq)) ||
4654 (params->cipher &&
4655 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4656 params->cipher)))
4657 goto nla_put_failure;
4658
4659 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4660 goto nla_put_failure;
4661
4662 nla_nest_end(cookie->msg, key);
4663
4664 return;
4665 nla_put_failure:
4666 cookie->error = 1;
4667 }
4668
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4669 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4670 {
4671 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4672 int err;
4673 struct net_device *dev = info->user_ptr[1];
4674 u8 key_idx = 0;
4675 const u8 *mac_addr = NULL;
4676 bool pairwise;
4677 struct get_key_cookie cookie = {
4678 .error = 0,
4679 };
4680 void *hdr;
4681 struct sk_buff *msg;
4682 bool bigtk_support = false;
4683 int link_id = nl80211_link_id_or_invalid(info->attrs);
4684 struct wireless_dev *wdev = dev->ieee80211_ptr;
4685
4686 if (wiphy_ext_feature_isset(&rdev->wiphy,
4687 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4688 bigtk_support = true;
4689
4690 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4691 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4692 wiphy_ext_feature_isset(&rdev->wiphy,
4693 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4694 bigtk_support = true;
4695
4696 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4697 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4698
4699 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4700 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4701 return -EINVAL;
4702 }
4703 }
4704
4705 if (info->attrs[NL80211_ATTR_MAC])
4706 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4707
4708 pairwise = !!mac_addr;
4709 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4710 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4711
4712 if (kt != NL80211_KEYTYPE_GROUP &&
4713 kt != NL80211_KEYTYPE_PAIRWISE)
4714 return -EINVAL;
4715 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4716 }
4717
4718 if (!rdev->ops->get_key)
4719 return -EOPNOTSUPP;
4720
4721 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4722 return -ENOENT;
4723
4724 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4725 if (!msg)
4726 return -ENOMEM;
4727
4728 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4729 NL80211_CMD_NEW_KEY);
4730 if (!hdr)
4731 goto nla_put_failure;
4732
4733 cookie.msg = msg;
4734 cookie.idx = key_idx;
4735
4736 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4737 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4738 goto nla_put_failure;
4739 if (mac_addr &&
4740 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4741 goto nla_put_failure;
4742
4743 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4744 if (err)
4745 goto free_msg;
4746
4747 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4748 &cookie, get_key_callback);
4749
4750 if (err)
4751 goto free_msg;
4752
4753 if (cookie.error)
4754 goto nla_put_failure;
4755
4756 genlmsg_end(msg, hdr);
4757 return genlmsg_reply(msg, info);
4758
4759 nla_put_failure:
4760 err = -ENOBUFS;
4761 free_msg:
4762 nlmsg_free(msg);
4763 return err;
4764 }
4765
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4766 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4767 {
4768 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4769 struct key_parse key;
4770 int err;
4771 struct net_device *dev = info->user_ptr[1];
4772 int link_id = nl80211_link_id_or_invalid(info->attrs);
4773 struct wireless_dev *wdev = dev->ieee80211_ptr;
4774
4775 err = nl80211_parse_key(info, &key);
4776 if (err)
4777 return err;
4778
4779 if (key.idx < 0)
4780 return -EINVAL;
4781
4782 /* Only support setting default key and
4783 * Extended Key ID action NL80211_KEY_SET_TX.
4784 */
4785 if (!key.def && !key.defmgmt && !key.defbeacon &&
4786 !(key.p.mode == NL80211_KEY_SET_TX))
4787 return -EINVAL;
4788
4789 if (key.def) {
4790 if (!rdev->ops->set_default_key)
4791 return -EOPNOTSUPP;
4792
4793 err = nl80211_key_allowed(wdev);
4794 if (err)
4795 return err;
4796
4797 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4798 if (err)
4799 return err;
4800
4801 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4802 key.def_uni, key.def_multi);
4803
4804 if (err)
4805 return err;
4806
4807 #ifdef CONFIG_CFG80211_WEXT
4808 wdev->wext.default_key = key.idx;
4809 #endif
4810 return 0;
4811 } else if (key.defmgmt) {
4812 if (key.def_uni || !key.def_multi)
4813 return -EINVAL;
4814
4815 if (!rdev->ops->set_default_mgmt_key)
4816 return -EOPNOTSUPP;
4817
4818 err = nl80211_key_allowed(wdev);
4819 if (err)
4820 return err;
4821
4822 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4823 if (err)
4824 return err;
4825
4826 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4827 if (err)
4828 return err;
4829
4830 #ifdef CONFIG_CFG80211_WEXT
4831 wdev->wext.default_mgmt_key = key.idx;
4832 #endif
4833 return 0;
4834 } else if (key.defbeacon) {
4835 if (key.def_uni || !key.def_multi)
4836 return -EINVAL;
4837
4838 if (!rdev->ops->set_default_beacon_key)
4839 return -EOPNOTSUPP;
4840
4841 err = nl80211_key_allowed(wdev);
4842 if (err)
4843 return err;
4844
4845 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4846 if (err)
4847 return err;
4848
4849 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4850 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4851 wiphy_ext_feature_isset(&rdev->wiphy,
4852 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4853 u8 *mac_addr = NULL;
4854
4855 if (info->attrs[NL80211_ATTR_MAC])
4856 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4857
4858 if (!mac_addr || key.idx < 0 || key.idx > 1)
4859 return -EINVAL;
4860
4861 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4862 if (err)
4863 return err;
4864
4865 return rdev_add_key(rdev, dev, link_id, key.idx,
4866 NL80211_KEYTYPE_PAIRWISE,
4867 mac_addr, &key.p);
4868 }
4869
4870 return -EINVAL;
4871 }
4872
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)4873 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4874 {
4875 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4876 int err;
4877 struct net_device *dev = info->user_ptr[1];
4878 struct key_parse key;
4879 const u8 *mac_addr = NULL;
4880 int link_id = nl80211_link_id_or_invalid(info->attrs);
4881 struct wireless_dev *wdev = dev->ieee80211_ptr;
4882
4883 err = nl80211_parse_key(info, &key);
4884 if (err)
4885 return err;
4886
4887 if (!key.p.key) {
4888 GENL_SET_ERR_MSG(info, "no key");
4889 return -EINVAL;
4890 }
4891
4892 if (info->attrs[NL80211_ATTR_MAC])
4893 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4894
4895 if (key.type == -1) {
4896 if (mac_addr)
4897 key.type = NL80211_KEYTYPE_PAIRWISE;
4898 else
4899 key.type = NL80211_KEYTYPE_GROUP;
4900 }
4901
4902 /* for now */
4903 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4904 key.type != NL80211_KEYTYPE_GROUP) {
4905 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4906 return -EINVAL;
4907 }
4908
4909 if (key.type == NL80211_KEYTYPE_GROUP &&
4910 info->attrs[NL80211_ATTR_VLAN_ID])
4911 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4912
4913 if (!rdev->ops->add_key)
4914 return -EOPNOTSUPP;
4915
4916 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4917 key.type == NL80211_KEYTYPE_PAIRWISE,
4918 mac_addr)) {
4919 GENL_SET_ERR_MSG(info, "key setting validation failed");
4920 return -EINVAL;
4921 }
4922
4923 err = nl80211_key_allowed(wdev);
4924 if (err)
4925 GENL_SET_ERR_MSG(info, "key not allowed");
4926
4927 if (!err)
4928 err = nl80211_validate_key_link_id(info, wdev, link_id,
4929 key.type == NL80211_KEYTYPE_PAIRWISE);
4930
4931 if (!err) {
4932 err = rdev_add_key(rdev, dev, link_id, key.idx,
4933 key.type == NL80211_KEYTYPE_PAIRWISE,
4934 mac_addr, &key.p);
4935 if (err)
4936 GENL_SET_ERR_MSG(info, "key addition failed");
4937 }
4938
4939 return err;
4940 }
4941
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)4942 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4943 {
4944 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4945 int err;
4946 struct net_device *dev = info->user_ptr[1];
4947 u8 *mac_addr = NULL;
4948 struct key_parse key;
4949 int link_id = nl80211_link_id_or_invalid(info->attrs);
4950 struct wireless_dev *wdev = dev->ieee80211_ptr;
4951
4952 err = nl80211_parse_key(info, &key);
4953 if (err)
4954 return err;
4955
4956 if (info->attrs[NL80211_ATTR_MAC])
4957 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4958
4959 if (key.type == -1) {
4960 if (mac_addr)
4961 key.type = NL80211_KEYTYPE_PAIRWISE;
4962 else
4963 key.type = NL80211_KEYTYPE_GROUP;
4964 }
4965
4966 /* for now */
4967 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4968 key.type != NL80211_KEYTYPE_GROUP)
4969 return -EINVAL;
4970
4971 if (!cfg80211_valid_key_idx(rdev, key.idx,
4972 key.type == NL80211_KEYTYPE_PAIRWISE))
4973 return -EINVAL;
4974
4975 if (!rdev->ops->del_key)
4976 return -EOPNOTSUPP;
4977
4978 err = nl80211_key_allowed(wdev);
4979
4980 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4981 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4982 err = -ENOENT;
4983
4984 if (!err)
4985 err = nl80211_validate_key_link_id(info, wdev, link_id,
4986 key.type == NL80211_KEYTYPE_PAIRWISE);
4987
4988 if (!err)
4989 err = rdev_del_key(rdev, dev, link_id, key.idx,
4990 key.type == NL80211_KEYTYPE_PAIRWISE,
4991 mac_addr);
4992
4993 #ifdef CONFIG_CFG80211_WEXT
4994 if (!err) {
4995 if (key.idx == wdev->wext.default_key)
4996 wdev->wext.default_key = -1;
4997 else if (key.idx == wdev->wext.default_mgmt_key)
4998 wdev->wext.default_mgmt_key = -1;
4999 }
5000 #endif
5001
5002 return err;
5003 }
5004
5005 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)5006 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5007 {
5008 struct nlattr *attr;
5009 int n_entries = 0, tmp;
5010
5011 nla_for_each_nested(attr, nl_attr, tmp) {
5012 if (nla_len(attr) != ETH_ALEN)
5013 return -EINVAL;
5014
5015 n_entries++;
5016 }
5017
5018 return n_entries;
5019 }
5020
5021 /*
5022 * This function parses ACL information and allocates memory for ACL data.
5023 * On successful return, the calling function is responsible to free the
5024 * ACL buffer returned by this function.
5025 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)5026 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5027 struct genl_info *info)
5028 {
5029 enum nl80211_acl_policy acl_policy;
5030 struct nlattr *attr;
5031 struct cfg80211_acl_data *acl;
5032 int i = 0, n_entries, tmp;
5033
5034 if (!wiphy->max_acl_mac_addrs)
5035 return ERR_PTR(-EOPNOTSUPP);
5036
5037 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5038 return ERR_PTR(-EINVAL);
5039
5040 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5041 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5042 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5043 return ERR_PTR(-EINVAL);
5044
5045 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5046 return ERR_PTR(-EINVAL);
5047
5048 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5049 if (n_entries < 0)
5050 return ERR_PTR(n_entries);
5051
5052 if (n_entries > wiphy->max_acl_mac_addrs)
5053 return ERR_PTR(-EOPNOTSUPP);
5054
5055 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5056 if (!acl)
5057 return ERR_PTR(-ENOMEM);
5058 acl->n_acl_entries = n_entries;
5059
5060 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5061 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5062 i++;
5063 }
5064 acl->acl_policy = acl_policy;
5065
5066 return acl;
5067 }
5068
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)5069 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5070 {
5071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5072 struct net_device *dev = info->user_ptr[1];
5073 struct cfg80211_acl_data *acl;
5074 int err;
5075
5076 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5077 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5078 return -EOPNOTSUPP;
5079
5080 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5081 return -EINVAL;
5082
5083 acl = parse_acl_data(&rdev->wiphy, info);
5084 if (IS_ERR(acl))
5085 return PTR_ERR(acl);
5086
5087 err = rdev_set_mac_acl(rdev, dev, acl);
5088
5089 kfree(acl);
5090
5091 return err;
5092 }
5093
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)5094 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5095 u8 *rates, u8 rates_len)
5096 {
5097 u8 i;
5098 u32 mask = 0;
5099
5100 for (i = 0; i < rates_len; i++) {
5101 int rate = (rates[i] & 0x7f) * 5;
5102 int ridx;
5103
5104 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5105 struct ieee80211_rate *srate =
5106 &sband->bitrates[ridx];
5107 if (rate == srate->bitrate) {
5108 mask |= 1 << ridx;
5109 break;
5110 }
5111 }
5112 if (ridx == sband->n_bitrates)
5113 return 0; /* rate not found */
5114 }
5115
5116 return mask;
5117 }
5118
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])5119 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5120 u8 *rates, u8 rates_len,
5121 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5122 {
5123 u8 i;
5124
5125 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5126
5127 for (i = 0; i < rates_len; i++) {
5128 int ridx, rbit;
5129
5130 ridx = rates[i] / 8;
5131 rbit = BIT(rates[i] % 8);
5132
5133 /* check validity */
5134 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5135 return false;
5136
5137 /* check availability */
5138 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5139 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5140 mcs[ridx] |= rbit;
5141 else
5142 return false;
5143 }
5144
5145 return true;
5146 }
5147
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)5148 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5149 {
5150 u16 mcs_mask = 0;
5151
5152 switch (vht_mcs_map) {
5153 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5154 break;
5155 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5156 mcs_mask = 0x00FF;
5157 break;
5158 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5159 mcs_mask = 0x01FF;
5160 break;
5161 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5162 mcs_mask = 0x03FF;
5163 break;
5164 default:
5165 break;
5166 }
5167
5168 return mcs_mask;
5169 }
5170
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5171 static void vht_build_mcs_mask(u16 vht_mcs_map,
5172 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5173 {
5174 u8 nss;
5175
5176 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5177 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5178 vht_mcs_map >>= 2;
5179 }
5180 }
5181
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5182 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5183 struct nl80211_txrate_vht *txrate,
5184 u16 mcs[NL80211_VHT_NSS_MAX])
5185 {
5186 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5187 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5188 u8 i;
5189
5190 if (!sband->vht_cap.vht_supported)
5191 return false;
5192
5193 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5194
5195 /* Build vht_mcs_mask from VHT capabilities */
5196 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5197
5198 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5199 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5200 mcs[i] = txrate->mcs[i];
5201 else
5202 return false;
5203 }
5204
5205 return true;
5206 }
5207
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5208 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5209 {
5210 switch (he_mcs_map) {
5211 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5212 return 0;
5213 case IEEE80211_HE_MCS_SUPPORT_0_7:
5214 return 0x00FF;
5215 case IEEE80211_HE_MCS_SUPPORT_0_9:
5216 return 0x03FF;
5217 case IEEE80211_HE_MCS_SUPPORT_0_11:
5218 return 0xFFF;
5219 default:
5220 break;
5221 }
5222 return 0;
5223 }
5224
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5225 static void he_build_mcs_mask(u16 he_mcs_map,
5226 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5227 {
5228 u8 nss;
5229
5230 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5231 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5232 he_mcs_map >>= 2;
5233 }
5234 }
5235
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5236 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5237 const struct ieee80211_sta_he_cap *he_cap)
5238 {
5239 struct net_device *dev = info->user_ptr[1];
5240 struct wireless_dev *wdev = dev->ieee80211_ptr;
5241 struct cfg80211_chan_def *chandef;
5242 __le16 tx_mcs;
5243
5244 chandef = wdev_chandef(wdev, link_id);
5245 if (!chandef) {
5246 /*
5247 * This is probably broken, but we never maintained
5248 * a chandef in these cases, so it always was.
5249 */
5250 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5251 }
5252
5253 switch (chandef->width) {
5254 case NL80211_CHAN_WIDTH_80P80:
5255 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5256 break;
5257 case NL80211_CHAN_WIDTH_160:
5258 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5259 break;
5260 default:
5261 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5262 break;
5263 }
5264
5265 return le16_to_cpu(tx_mcs);
5266 }
5267
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5268 static bool he_set_mcs_mask(struct genl_info *info,
5269 struct wireless_dev *wdev,
5270 struct ieee80211_supported_band *sband,
5271 struct nl80211_txrate_he *txrate,
5272 u16 mcs[NL80211_HE_NSS_MAX],
5273 unsigned int link_id)
5274 {
5275 const struct ieee80211_sta_he_cap *he_cap;
5276 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5277 u16 tx_mcs_map = 0;
5278 u8 i;
5279
5280 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5281 if (!he_cap)
5282 return false;
5283
5284 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5285
5286 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5287
5288 /* Build he_mcs_mask from HE capabilities */
5289 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5290
5291 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5292 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5293 mcs[i] = txrate->mcs[i];
5294 else
5295 return false;
5296 }
5297
5298 return true;
5299 }
5300
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5301 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5302 struct nlattr *attrs[],
5303 enum nl80211_attrs attr,
5304 struct cfg80211_bitrate_mask *mask,
5305 struct net_device *dev,
5306 bool default_all_enabled,
5307 unsigned int link_id)
5308 {
5309 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5310 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5311 struct wireless_dev *wdev = dev->ieee80211_ptr;
5312 int rem, i;
5313 struct nlattr *tx_rates;
5314 struct ieee80211_supported_band *sband;
5315 u16 vht_tx_mcs_map, he_tx_mcs_map;
5316
5317 memset(mask, 0, sizeof(*mask));
5318 /* Default to all rates enabled */
5319 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5320 const struct ieee80211_sta_he_cap *he_cap;
5321
5322 if (!default_all_enabled)
5323 break;
5324
5325 sband = rdev->wiphy.bands[i];
5326
5327 if (!sband)
5328 continue;
5329
5330 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5331 memcpy(mask->control[i].ht_mcs,
5332 sband->ht_cap.mcs.rx_mask,
5333 sizeof(mask->control[i].ht_mcs));
5334
5335 if (sband->vht_cap.vht_supported) {
5336 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5337 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5338 }
5339
5340 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5341 if (!he_cap)
5342 continue;
5343
5344 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5345 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5346
5347 mask->control[i].he_gi = 0xFF;
5348 mask->control[i].he_ltf = 0xFF;
5349 }
5350
5351 /* if no rates are given set it back to the defaults */
5352 if (!attrs[attr])
5353 goto out;
5354
5355 /* The nested attribute uses enum nl80211_band as the index. This maps
5356 * directly to the enum nl80211_band values used in cfg80211.
5357 */
5358 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5359 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5360 enum nl80211_band band = nla_type(tx_rates);
5361 int err;
5362
5363 if (band < 0 || band >= NUM_NL80211_BANDS)
5364 return -EINVAL;
5365 sband = rdev->wiphy.bands[band];
5366 if (sband == NULL)
5367 return -EINVAL;
5368 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5369 tx_rates,
5370 nl80211_txattr_policy,
5371 info->extack);
5372 if (err)
5373 return err;
5374 if (tb[NL80211_TXRATE_LEGACY]) {
5375 mask->control[band].legacy = rateset_to_mask(
5376 sband,
5377 nla_data(tb[NL80211_TXRATE_LEGACY]),
5378 nla_len(tb[NL80211_TXRATE_LEGACY]));
5379 if ((mask->control[band].legacy == 0) &&
5380 nla_len(tb[NL80211_TXRATE_LEGACY]))
5381 return -EINVAL;
5382 }
5383 if (tb[NL80211_TXRATE_HT]) {
5384 if (!ht_rateset_to_mask(
5385 sband,
5386 nla_data(tb[NL80211_TXRATE_HT]),
5387 nla_len(tb[NL80211_TXRATE_HT]),
5388 mask->control[band].ht_mcs))
5389 return -EINVAL;
5390 }
5391
5392 if (tb[NL80211_TXRATE_VHT]) {
5393 if (!vht_set_mcs_mask(
5394 sband,
5395 nla_data(tb[NL80211_TXRATE_VHT]),
5396 mask->control[band].vht_mcs))
5397 return -EINVAL;
5398 }
5399
5400 if (tb[NL80211_TXRATE_GI]) {
5401 mask->control[band].gi =
5402 nla_get_u8(tb[NL80211_TXRATE_GI]);
5403 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5404 return -EINVAL;
5405 }
5406 if (tb[NL80211_TXRATE_HE] &&
5407 !he_set_mcs_mask(info, wdev, sband,
5408 nla_data(tb[NL80211_TXRATE_HE]),
5409 mask->control[band].he_mcs,
5410 link_id))
5411 return -EINVAL;
5412
5413 if (tb[NL80211_TXRATE_HE_GI])
5414 mask->control[band].he_gi =
5415 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5416 if (tb[NL80211_TXRATE_HE_LTF])
5417 mask->control[band].he_ltf =
5418 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5419
5420 if (mask->control[band].legacy == 0) {
5421 /* don't allow empty legacy rates if HT, VHT or HE
5422 * are not even supported.
5423 */
5424 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5425 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5426 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5427 return -EINVAL;
5428
5429 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5430 if (mask->control[band].ht_mcs[i])
5431 goto out;
5432
5433 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5434 if (mask->control[band].vht_mcs[i])
5435 goto out;
5436
5437 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5438 if (mask->control[band].he_mcs[i])
5439 goto out;
5440
5441 /* legacy and mcs rates may not be both empty */
5442 return -EINVAL;
5443 }
5444 }
5445
5446 out:
5447 return 0;
5448 }
5449
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5450 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5451 enum nl80211_band band,
5452 struct cfg80211_bitrate_mask *beacon_rate)
5453 {
5454 u32 count_ht, count_vht, count_he, i;
5455 u32 rate = beacon_rate->control[band].legacy;
5456
5457 /* Allow only one rate */
5458 if (hweight32(rate) > 1)
5459 return -EINVAL;
5460
5461 count_ht = 0;
5462 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5463 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5464 return -EINVAL;
5465 } else if (beacon_rate->control[band].ht_mcs[i]) {
5466 count_ht++;
5467 if (count_ht > 1)
5468 return -EINVAL;
5469 }
5470 if (count_ht && rate)
5471 return -EINVAL;
5472 }
5473
5474 count_vht = 0;
5475 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5476 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5477 return -EINVAL;
5478 } else if (beacon_rate->control[band].vht_mcs[i]) {
5479 count_vht++;
5480 if (count_vht > 1)
5481 return -EINVAL;
5482 }
5483 if (count_vht && rate)
5484 return -EINVAL;
5485 }
5486
5487 count_he = 0;
5488 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5489 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5490 return -EINVAL;
5491 } else if (beacon_rate->control[band].he_mcs[i]) {
5492 count_he++;
5493 if (count_he > 1)
5494 return -EINVAL;
5495 }
5496 if (count_he && rate)
5497 return -EINVAL;
5498 }
5499
5500 if ((count_ht && count_vht && count_he) ||
5501 (!rate && !count_ht && !count_vht && !count_he))
5502 return -EINVAL;
5503
5504 if (rate &&
5505 !wiphy_ext_feature_isset(&rdev->wiphy,
5506 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5507 return -EINVAL;
5508 if (count_ht &&
5509 !wiphy_ext_feature_isset(&rdev->wiphy,
5510 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5511 return -EINVAL;
5512 if (count_vht &&
5513 !wiphy_ext_feature_isset(&rdev->wiphy,
5514 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5515 return -EINVAL;
5516 if (count_he &&
5517 !wiphy_ext_feature_isset(&rdev->wiphy,
5518 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5519 return -EINVAL;
5520
5521 return 0;
5522 }
5523
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5524 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5525 struct net_device *dev,
5526 struct nlattr *attrs,
5527 struct cfg80211_mbssid_config *config,
5528 u8 num_elems)
5529 {
5530 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5531
5532 if (!wiphy->mbssid_max_interfaces)
5533 return -EOPNOTSUPP;
5534
5535 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5536 NULL) ||
5537 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5538 return -EINVAL;
5539
5540 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5541 if (config->ema) {
5542 if (!wiphy->ema_max_profile_periodicity)
5543 return -EOPNOTSUPP;
5544
5545 if (num_elems > wiphy->ema_max_profile_periodicity)
5546 return -EINVAL;
5547 }
5548
5549 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5550 if (config->index >= wiphy->mbssid_max_interfaces ||
5551 (!config->index && !num_elems))
5552 return -EINVAL;
5553
5554 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5555 u32 tx_ifindex =
5556 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5557
5558 if ((!config->index && tx_ifindex != dev->ifindex) ||
5559 (config->index && tx_ifindex == dev->ifindex))
5560 return -EINVAL;
5561
5562 if (tx_ifindex != dev->ifindex) {
5563 struct net_device *tx_netdev =
5564 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5565
5566 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5567 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5568 tx_netdev->ieee80211_ptr->iftype !=
5569 NL80211_IFTYPE_AP) {
5570 dev_put(tx_netdev);
5571 return -EINVAL;
5572 }
5573
5574 config->tx_wdev = tx_netdev->ieee80211_ptr;
5575 } else {
5576 config->tx_wdev = dev->ieee80211_ptr;
5577 }
5578 } else if (!config->index) {
5579 config->tx_wdev = dev->ieee80211_ptr;
5580 } else {
5581 return -EINVAL;
5582 }
5583
5584 return 0;
5585 }
5586
5587 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)5588 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5589 {
5590 struct nlattr *nl_elems;
5591 struct cfg80211_mbssid_elems *elems;
5592 int rem_elems;
5593 u8 i = 0, num_elems = 0;
5594
5595 if (!wiphy->mbssid_max_interfaces)
5596 return ERR_PTR(-EINVAL);
5597
5598 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5599 if (num_elems >= 255)
5600 return ERR_PTR(-EINVAL);
5601 num_elems++;
5602 }
5603
5604 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5605 if (!elems)
5606 return ERR_PTR(-ENOMEM);
5607 elems->cnt = num_elems;
5608
5609 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5610 elems->elem[i].data = nla_data(nl_elems);
5611 elems->elem[i].len = nla_len(nl_elems);
5612 i++;
5613 }
5614 return elems;
5615 }
5616
5617 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)5618 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5619 struct netlink_ext_ack *extack)
5620 {
5621 struct nlattr *nl_elems;
5622 struct cfg80211_rnr_elems *elems;
5623 int rem_elems;
5624 u8 i = 0, num_elems = 0;
5625
5626 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5627 int ret;
5628
5629 ret = validate_ie_attr(nl_elems, extack);
5630 if (ret)
5631 return ERR_PTR(ret);
5632
5633 num_elems++;
5634 }
5635
5636 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5637 if (!elems)
5638 return ERR_PTR(-ENOMEM);
5639 elems->cnt = num_elems;
5640
5641 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5642 elems->elem[i].data = nla_data(nl_elems);
5643 elems->elem[i].len = nla_len(nl_elems);
5644 i++;
5645 }
5646 return elems;
5647 }
5648
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)5649 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5650 struct cfg80211_he_bss_color *he_bss_color)
5651 {
5652 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5653 int err;
5654
5655 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5656 he_bss_color_policy, NULL);
5657 if (err)
5658 return err;
5659
5660 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5661 return -EINVAL;
5662
5663 he_bss_color->color =
5664 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5665 he_bss_color->enabled =
5666 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5667 he_bss_color->partial =
5668 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5669
5670 return 0;
5671 }
5672
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)5673 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5674 struct nlattr *attrs[],
5675 struct cfg80211_beacon_data *bcn,
5676 struct netlink_ext_ack *extack)
5677 {
5678 bool haveinfo = false;
5679 int err;
5680
5681 memset(bcn, 0, sizeof(*bcn));
5682
5683 bcn->link_id = nl80211_link_id(attrs);
5684
5685 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5686 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5687 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5688 if (!bcn->head_len)
5689 return -EINVAL;
5690 haveinfo = true;
5691 }
5692
5693 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5694 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5695 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5696 haveinfo = true;
5697 }
5698
5699 if (!haveinfo)
5700 return -EINVAL;
5701
5702 if (attrs[NL80211_ATTR_IE]) {
5703 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5704 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5705 }
5706
5707 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5708 bcn->proberesp_ies =
5709 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5710 bcn->proberesp_ies_len =
5711 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5712 }
5713
5714 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5715 bcn->assocresp_ies =
5716 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5717 bcn->assocresp_ies_len =
5718 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5719 }
5720
5721 if (attrs[NL80211_ATTR_PROBE_RESP]) {
5722 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5723 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5724 }
5725
5726 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5727 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5728
5729 err = nla_parse_nested_deprecated(tb,
5730 NL80211_FTM_RESP_ATTR_MAX,
5731 attrs[NL80211_ATTR_FTM_RESPONDER],
5732 NULL, NULL);
5733 if (err)
5734 return err;
5735
5736 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5737 wiphy_ext_feature_isset(&rdev->wiphy,
5738 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5739 bcn->ftm_responder = 1;
5740 else
5741 return -EOPNOTSUPP;
5742
5743 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5744 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5745 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5746 }
5747
5748 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5749 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5750 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5751 }
5752 } else {
5753 bcn->ftm_responder = -1;
5754 }
5755
5756 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5757 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5758 &bcn->he_bss_color);
5759 if (err)
5760 return err;
5761 bcn->he_bss_color_valid = true;
5762 }
5763
5764 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5765 struct cfg80211_mbssid_elems *mbssid =
5766 nl80211_parse_mbssid_elems(&rdev->wiphy,
5767 attrs[NL80211_ATTR_MBSSID_ELEMS]);
5768
5769 if (IS_ERR(mbssid))
5770 return PTR_ERR(mbssid);
5771
5772 bcn->mbssid_ies = mbssid;
5773
5774 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5775 struct cfg80211_rnr_elems *rnr =
5776 nl80211_parse_rnr_elems(&rdev->wiphy,
5777 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5778 extack);
5779
5780 if (IS_ERR(rnr))
5781 return PTR_ERR(rnr);
5782
5783 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5784 return -EINVAL;
5785
5786 bcn->rnr_ies = rnr;
5787 }
5788 }
5789
5790 return 0;
5791 }
5792
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)5793 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5794 struct ieee80211_he_obss_pd *he_obss_pd)
5795 {
5796 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5797 int err;
5798
5799 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5800 he_obss_pd_policy, NULL);
5801 if (err)
5802 return err;
5803
5804 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5805 return -EINVAL;
5806
5807 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5808
5809 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5810 he_obss_pd->min_offset =
5811 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5812 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5813 he_obss_pd->max_offset =
5814 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5815 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5816 he_obss_pd->non_srg_max_offset =
5817 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5818
5819 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5820 return -EINVAL;
5821
5822 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5823 memcpy(he_obss_pd->bss_color_bitmap,
5824 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5825 sizeof(he_obss_pd->bss_color_bitmap));
5826
5827 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5828 memcpy(he_obss_pd->partial_bssid_bitmap,
5829 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5830 sizeof(he_obss_pd->partial_bssid_bitmap));
5831
5832 he_obss_pd->enable = true;
5833
5834 return 0;
5835 }
5836
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_fils_discovery * fd)5837 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5838 struct nlattr *attrs,
5839 struct cfg80211_fils_discovery *fd)
5840 {
5841 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5842 int ret;
5843
5844 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5845 NL80211_EXT_FEATURE_FILS_DISCOVERY))
5846 return -EINVAL;
5847
5848 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5849 NULL, NULL);
5850 if (ret)
5851 return ret;
5852
5853 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
5854 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
5855 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
5856 fd->update = true;
5857 return 0;
5858 }
5859
5860 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5861 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5862 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5863 return -EINVAL;
5864
5865 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5866 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5867 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5868 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5869 fd->update = true;
5870 return 0;
5871 }
5872
5873 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_unsol_bcast_probe_resp * presp)5874 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5875 struct nlattr *attrs,
5876 struct cfg80211_unsol_bcast_probe_resp *presp)
5877 {
5878 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5879 int ret;
5880
5881 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5882 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5883 return -EINVAL;
5884
5885 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5886 attrs, NULL, NULL);
5887 if (ret)
5888 return ret;
5889
5890 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
5891 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
5892 presp->update = true;
5893 return 0;
5894 }
5895
5896 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5897 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5898 return -EINVAL;
5899
5900 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5901 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5902 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5903 presp->update = true;
5904 return 0;
5905 }
5906
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)5907 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5908 const struct element *rates)
5909 {
5910 int i;
5911
5912 if (!rates)
5913 return;
5914
5915 for (i = 0; i < rates->datalen; i++) {
5916 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5917 params->ht_required = true;
5918 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5919 params->vht_required = true;
5920 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5921 params->he_required = true;
5922 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5923 params->sae_h2e_required = true;
5924 }
5925 }
5926
5927 /*
5928 * Since the nl80211 API didn't include, from the beginning, attributes about
5929 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5930 * benefit of drivers that rebuild IEs in the firmware.
5931 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)5932 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5933 {
5934 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
5935 size_t ies_len = bcn->tail_len;
5936 const u8 *ies = bcn->tail;
5937 const struct element *rates;
5938 const struct element *cap;
5939
5940 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5941 nl80211_check_ap_rate_selectors(params, rates);
5942
5943 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5944 nl80211_check_ap_rate_selectors(params, rates);
5945
5946 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5947 if (cap && cap->datalen >= sizeof(*params->ht_cap))
5948 params->ht_cap = (void *)cap->data;
5949 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5950 if (cap && cap->datalen >= sizeof(*params->vht_cap))
5951 params->vht_cap = (void *)cap->data;
5952 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5953 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5954 params->he_cap = (void *)(cap->data + 1);
5955 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5956 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5957 params->he_oper = (void *)(cap->data + 1);
5958 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5959 if (cap) {
5960 if (!cap->datalen)
5961 return -EINVAL;
5962 params->eht_cap = (void *)(cap->data + 1);
5963 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5964 (const u8 *)params->eht_cap,
5965 cap->datalen - 1, true))
5966 return -EINVAL;
5967 }
5968 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5969 if (cap) {
5970 if (!cap->datalen)
5971 return -EINVAL;
5972 params->eht_oper = (void *)(cap->data + 1);
5973 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5974 cap->datalen - 1))
5975 return -EINVAL;
5976 }
5977 return 0;
5978 }
5979
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)5980 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5981 struct cfg80211_ap_settings *params)
5982 {
5983 struct wireless_dev *wdev;
5984
5985 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5986 if (wdev->iftype != NL80211_IFTYPE_AP &&
5987 wdev->iftype != NL80211_IFTYPE_P2P_GO)
5988 continue;
5989
5990 if (!wdev->u.ap.preset_chandef.chan)
5991 continue;
5992
5993 params->chandef = wdev->u.ap.preset_chandef;
5994 return true;
5995 }
5996
5997 return false;
5998 }
5999
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)6000 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6001 enum nl80211_auth_type auth_type,
6002 enum nl80211_commands cmd)
6003 {
6004 if (auth_type > NL80211_AUTHTYPE_MAX)
6005 return false;
6006
6007 switch (cmd) {
6008 case NL80211_CMD_AUTHENTICATE:
6009 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6010 auth_type == NL80211_AUTHTYPE_SAE)
6011 return false;
6012 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6013 NL80211_EXT_FEATURE_FILS_STA) &&
6014 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6015 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6016 auth_type == NL80211_AUTHTYPE_FILS_PK))
6017 return false;
6018 return true;
6019 case NL80211_CMD_CONNECT:
6020 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6021 !wiphy_ext_feature_isset(&rdev->wiphy,
6022 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6023 auth_type == NL80211_AUTHTYPE_SAE)
6024 return false;
6025
6026 /* FILS with SK PFS or PK not supported yet */
6027 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6028 auth_type == NL80211_AUTHTYPE_FILS_PK)
6029 return false;
6030 if (!wiphy_ext_feature_isset(
6031 &rdev->wiphy,
6032 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6033 auth_type == NL80211_AUTHTYPE_FILS_SK)
6034 return false;
6035 return true;
6036 case NL80211_CMD_START_AP:
6037 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6038 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6039 auth_type == NL80211_AUTHTYPE_SAE)
6040 return false;
6041 /* FILS not supported yet */
6042 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6043 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6044 auth_type == NL80211_AUTHTYPE_FILS_PK)
6045 return false;
6046 return true;
6047 default:
6048 return false;
6049 }
6050 }
6051
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)6052 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6053 unsigned int link_id)
6054 {
6055 struct wiphy *wiphy = wdev->wiphy;
6056 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6057 struct sk_buff *msg;
6058 void *hdr;
6059
6060 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6061 if (!msg)
6062 return;
6063
6064 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6065 if (!hdr)
6066 goto out;
6067
6068 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6069 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6070 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6071 NL80211_ATTR_PAD) ||
6072 (wdev->u.ap.ssid_len &&
6073 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6074 wdev->u.ap.ssid)) ||
6075 (wdev->valid_links &&
6076 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6077 goto out;
6078
6079 genlmsg_end(msg, hdr);
6080
6081 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6082 NL80211_MCGRP_MLME, GFP_KERNEL);
6083 return;
6084 out:
6085 nlmsg_free(msg);
6086 }
6087
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)6088 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6089 {
6090 struct ieee80211_channel *channel = params->chandef.chan;
6091
6092 if ((params->he_cap || params->he_oper) &&
6093 (channel->flags & IEEE80211_CHAN_NO_HE))
6094 return -EOPNOTSUPP;
6095
6096 if ((params->eht_cap || params->eht_oper) &&
6097 (channel->flags & IEEE80211_CHAN_NO_EHT))
6098 return -EOPNOTSUPP;
6099
6100 return 0;
6101 }
6102
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)6103 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6104 {
6105 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6106 struct cfg80211_beaconing_check_config beacon_check = {};
6107 unsigned int link_id = nl80211_link_id(info->attrs);
6108 struct net_device *dev = info->user_ptr[1];
6109 struct wireless_dev *wdev = dev->ieee80211_ptr;
6110 struct cfg80211_ap_settings *params;
6111 int err;
6112
6113 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6114 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6115 return -EOPNOTSUPP;
6116
6117 if (!rdev->ops->start_ap)
6118 return -EOPNOTSUPP;
6119
6120 if (wdev->links[link_id].cac_started)
6121 return -EBUSY;
6122
6123 if (wdev->links[link_id].ap.beacon_interval)
6124 return -EALREADY;
6125
6126 /* these are required for START_AP */
6127 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6128 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6129 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6130 return -EINVAL;
6131
6132 if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6133 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6134 return -EOPNOTSUPP;
6135
6136 params = kzalloc(sizeof(*params), GFP_KERNEL);
6137 if (!params)
6138 return -ENOMEM;
6139
6140 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6141 info->extack);
6142 if (err)
6143 goto out;
6144
6145 params->beacon_interval =
6146 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6147 params->dtim_period =
6148 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6149
6150 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6151 params->beacon_interval);
6152 if (err)
6153 goto out;
6154
6155 /*
6156 * In theory, some of these attributes should be required here
6157 * but since they were not used when the command was originally
6158 * added, keep them optional for old user space programs to let
6159 * them continue to work with drivers that do not need the
6160 * additional information -- drivers must check!
6161 */
6162 if (info->attrs[NL80211_ATTR_SSID]) {
6163 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6164 params->ssid_len =
6165 nla_len(info->attrs[NL80211_ATTR_SSID]);
6166 if (params->ssid_len == 0) {
6167 err = -EINVAL;
6168 goto out;
6169 }
6170
6171 if (wdev->u.ap.ssid_len &&
6172 (wdev->u.ap.ssid_len != params->ssid_len ||
6173 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6174 /* require identical SSID for MLO */
6175 err = -EINVAL;
6176 goto out;
6177 }
6178 } else if (wdev->valid_links) {
6179 /* require SSID for MLO */
6180 err = -EINVAL;
6181 goto out;
6182 }
6183
6184 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6185 params->hidden_ssid = nla_get_u32(
6186 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6187
6188 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6189
6190 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6191 params->auth_type = nla_get_u32(
6192 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6193 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6194 NL80211_CMD_START_AP)) {
6195 err = -EINVAL;
6196 goto out;
6197 }
6198 } else
6199 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6200
6201 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6202 NL80211_MAX_NR_CIPHER_SUITES);
6203 if (err)
6204 goto out;
6205
6206 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6207 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6208 err = -EOPNOTSUPP;
6209 goto out;
6210 }
6211 params->inactivity_timeout = nla_get_u16(
6212 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6213 }
6214
6215 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6216 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6217 err = -EINVAL;
6218 goto out;
6219 }
6220 params->p2p_ctwindow =
6221 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6222 if (params->p2p_ctwindow != 0 &&
6223 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6224 err = -EINVAL;
6225 goto out;
6226 }
6227 }
6228
6229 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6230 u8 tmp;
6231
6232 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6233 err = -EINVAL;
6234 goto out;
6235 }
6236 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6237 params->p2p_opp_ps = tmp;
6238 if (params->p2p_opp_ps != 0 &&
6239 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6240 err = -EINVAL;
6241 goto out;
6242 }
6243 }
6244
6245 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6246 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6247 if (err)
6248 goto out;
6249 } else if (wdev->valid_links) {
6250 /* with MLD need to specify the channel configuration */
6251 err = -EINVAL;
6252 goto out;
6253 } else if (wdev->u.ap.preset_chandef.chan) {
6254 params->chandef = wdev->u.ap.preset_chandef;
6255 } else if (!nl80211_get_ap_channel(rdev, params)) {
6256 err = -EINVAL;
6257 goto out;
6258 }
6259
6260 beacon_check.iftype = wdev->iftype;
6261 beacon_check.relax = true;
6262 beacon_check.reg_power =
6263 cfg80211_get_6ghz_power_type(params->beacon.tail,
6264 params->beacon.tail_len);
6265 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, ¶ms->chandef,
6266 &beacon_check)) {
6267 err = -EINVAL;
6268 goto out;
6269 }
6270
6271 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6272 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6273 NL80211_ATTR_TX_RATES,
6274 ¶ms->beacon_rate,
6275 dev, false, link_id);
6276 if (err)
6277 goto out;
6278
6279 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6280 ¶ms->beacon_rate);
6281 if (err)
6282 goto out;
6283 }
6284
6285 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6286 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6287 err = -EOPNOTSUPP;
6288 goto out;
6289 }
6290
6291 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6292 params->acl = parse_acl_data(&rdev->wiphy, info);
6293 if (IS_ERR(params->acl)) {
6294 err = PTR_ERR(params->acl);
6295 params->acl = NULL;
6296 goto out;
6297 }
6298 }
6299
6300 params->twt_responder =
6301 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6302
6303 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6304 err = nl80211_parse_he_obss_pd(
6305 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6306 ¶ms->he_obss_pd);
6307 if (err)
6308 goto out;
6309 }
6310
6311 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6312 err = nl80211_parse_fils_discovery(rdev,
6313 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6314 ¶ms->fils_discovery);
6315 if (err)
6316 goto out;
6317 }
6318
6319 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6320 err = nl80211_parse_unsol_bcast_probe_resp(
6321 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6322 ¶ms->unsol_bcast_probe_resp);
6323 if (err)
6324 goto out;
6325 }
6326
6327 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6328 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6329 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6330 ¶ms->mbssid_config,
6331 params->beacon.mbssid_ies ?
6332 params->beacon.mbssid_ies->cnt :
6333 0);
6334 if (err)
6335 goto out;
6336 }
6337
6338 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6339 err = -EINVAL;
6340 goto out;
6341 }
6342
6343 err = nl80211_calculate_ap_params(params);
6344 if (err)
6345 goto out;
6346
6347 err = nl80211_validate_ap_phy_operation(params);
6348 if (err)
6349 goto out;
6350
6351 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6352 params->flags = nla_get_u32(
6353 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6354 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6355 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6356
6357 if (wdev->conn_owner_nlportid &&
6358 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6359 wdev->conn_owner_nlportid != info->snd_portid) {
6360 err = -EINVAL;
6361 goto out;
6362 }
6363
6364 /* FIXME: validate MLO/link-id against driver capabilities */
6365
6366 err = rdev_start_ap(rdev, dev, params);
6367 if (!err) {
6368 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6369 wdev->links[link_id].ap.chandef = params->chandef;
6370 wdev->u.ap.ssid_len = params->ssid_len;
6371 memcpy(wdev->u.ap.ssid, params->ssid,
6372 params->ssid_len);
6373
6374 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6375 wdev->conn_owner_nlportid = info->snd_portid;
6376
6377 nl80211_send_ap_started(wdev, link_id);
6378 }
6379 out:
6380 kfree(params->acl);
6381 kfree(params->beacon.mbssid_ies);
6382 if (params->mbssid_config.tx_wdev &&
6383 params->mbssid_config.tx_wdev->netdev &&
6384 params->mbssid_config.tx_wdev->netdev != dev)
6385 dev_put(params->mbssid_config.tx_wdev->netdev);
6386 kfree(params->beacon.rnr_ies);
6387 kfree(params);
6388
6389 return err;
6390 }
6391
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6392 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6393 {
6394 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6395 struct cfg80211_beaconing_check_config beacon_check = {};
6396 unsigned int link_id = nl80211_link_id(info->attrs);
6397 struct net_device *dev = info->user_ptr[1];
6398 struct wireless_dev *wdev = dev->ieee80211_ptr;
6399 struct cfg80211_ap_update *params;
6400 struct nlattr *attr;
6401 int err;
6402
6403 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6404 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6405 return -EOPNOTSUPP;
6406
6407 if (!rdev->ops->change_beacon)
6408 return -EOPNOTSUPP;
6409
6410 if (!wdev->links[link_id].ap.beacon_interval)
6411 return -EINVAL;
6412
6413 params = kzalloc(sizeof(*params), GFP_KERNEL);
6414 if (!params)
6415 return -ENOMEM;
6416
6417 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
6418 info->extack);
6419 if (err)
6420 goto out;
6421
6422 /* recheck beaconing is permitted with possibly changed power type */
6423 beacon_check.iftype = wdev->iftype;
6424 beacon_check.relax = true;
6425 beacon_check.reg_power =
6426 cfg80211_get_6ghz_power_type(params->beacon.tail,
6427 params->beacon.tail_len);
6428 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6429 &wdev->links[link_id].ap.chandef,
6430 &beacon_check)) {
6431 err = -EINVAL;
6432 goto out;
6433 }
6434
6435 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6436 if (attr) {
6437 err = nl80211_parse_fils_discovery(rdev, attr,
6438 ¶ms->fils_discovery);
6439 if (err)
6440 goto out;
6441 }
6442
6443 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6444 if (attr) {
6445 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6446 ¶ms->unsol_bcast_probe_resp);
6447 if (err)
6448 goto out;
6449 }
6450
6451 err = rdev_change_beacon(rdev, dev, params);
6452
6453 out:
6454 kfree(params->beacon.mbssid_ies);
6455 kfree(params->beacon.rnr_ies);
6456 kfree(params);
6457 return err;
6458 }
6459
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6460 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6461 {
6462 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6463 unsigned int link_id = nl80211_link_id(info->attrs);
6464 struct net_device *dev = info->user_ptr[1];
6465
6466 return cfg80211_stop_ap(rdev, dev, link_id, false);
6467 }
6468
6469 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6470 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6471 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6472 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6473 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6474 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6475 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6476 };
6477
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6478 static int parse_station_flags(struct genl_info *info,
6479 enum nl80211_iftype iftype,
6480 struct station_parameters *params)
6481 {
6482 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6483 struct nlattr *nla;
6484 int flag;
6485
6486 /*
6487 * Try parsing the new attribute first so userspace
6488 * can specify both for older kernels.
6489 */
6490 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6491 if (nla) {
6492 struct nl80211_sta_flag_update *sta_flags;
6493
6494 sta_flags = nla_data(nla);
6495 params->sta_flags_mask = sta_flags->mask;
6496 params->sta_flags_set = sta_flags->set;
6497 params->sta_flags_set &= params->sta_flags_mask;
6498 if ((params->sta_flags_mask |
6499 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6500 return -EINVAL;
6501 return 0;
6502 }
6503
6504 /* if present, parse the old attribute */
6505
6506 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6507 if (!nla)
6508 return 0;
6509
6510 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6511 return -EINVAL;
6512
6513 /*
6514 * Only allow certain flags for interface types so that
6515 * other attributes are silently ignored. Remember that
6516 * this is backward compatibility code with old userspace
6517 * and shouldn't be hit in other cases anyway.
6518 */
6519 switch (iftype) {
6520 case NL80211_IFTYPE_AP:
6521 case NL80211_IFTYPE_AP_VLAN:
6522 case NL80211_IFTYPE_P2P_GO:
6523 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6524 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6525 BIT(NL80211_STA_FLAG_WME) |
6526 BIT(NL80211_STA_FLAG_MFP);
6527 break;
6528 case NL80211_IFTYPE_P2P_CLIENT:
6529 case NL80211_IFTYPE_STATION:
6530 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6531 BIT(NL80211_STA_FLAG_TDLS_PEER);
6532 break;
6533 case NL80211_IFTYPE_MESH_POINT:
6534 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6535 BIT(NL80211_STA_FLAG_MFP) |
6536 BIT(NL80211_STA_FLAG_AUTHORIZED);
6537 break;
6538 default:
6539 return -EINVAL;
6540 }
6541
6542 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6543 if (flags[flag]) {
6544 params->sta_flags_set |= (1<<flag);
6545
6546 /* no longer support new API additions in old API */
6547 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6548 return -EINVAL;
6549 }
6550 }
6551
6552 return 0;
6553 }
6554
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)6555 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6556 {
6557 struct nlattr *rate;
6558 u32 bitrate;
6559 u16 bitrate_compat;
6560 enum nl80211_rate_info rate_flg;
6561
6562 rate = nla_nest_start_noflag(msg, attr);
6563 if (!rate)
6564 return false;
6565
6566 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6567 bitrate = cfg80211_calculate_bitrate(info);
6568 /* report 16-bit bitrate only if we can */
6569 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6570 if (bitrate > 0 &&
6571 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6572 return false;
6573 if (bitrate_compat > 0 &&
6574 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6575 return false;
6576
6577 switch (info->bw) {
6578 case RATE_INFO_BW_1:
6579 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6580 break;
6581 case RATE_INFO_BW_2:
6582 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6583 break;
6584 case RATE_INFO_BW_4:
6585 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6586 break;
6587 case RATE_INFO_BW_5:
6588 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6589 break;
6590 case RATE_INFO_BW_8:
6591 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6592 break;
6593 case RATE_INFO_BW_10:
6594 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6595 break;
6596 case RATE_INFO_BW_16:
6597 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6598 break;
6599 default:
6600 WARN_ON(1);
6601 fallthrough;
6602 case RATE_INFO_BW_20:
6603 rate_flg = 0;
6604 break;
6605 case RATE_INFO_BW_40:
6606 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6607 break;
6608 case RATE_INFO_BW_80:
6609 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6610 break;
6611 case RATE_INFO_BW_160:
6612 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6613 break;
6614 case RATE_INFO_BW_HE_RU:
6615 rate_flg = 0;
6616 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6617 break;
6618 case RATE_INFO_BW_320:
6619 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6620 break;
6621 case RATE_INFO_BW_EHT_RU:
6622 rate_flg = 0;
6623 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6624 break;
6625 }
6626
6627 if (rate_flg && nla_put_flag(msg, rate_flg))
6628 return false;
6629
6630 if (info->flags & RATE_INFO_FLAGS_MCS) {
6631 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6632 return false;
6633 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6634 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6635 return false;
6636 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6637 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6638 return false;
6639 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6640 return false;
6641 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6642 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6643 return false;
6644 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6645 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6646 return false;
6647 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6648 return false;
6649 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6650 return false;
6651 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6652 return false;
6653 if (info->bw == RATE_INFO_BW_HE_RU &&
6654 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6655 info->he_ru_alloc))
6656 return false;
6657 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6658 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6659 return false;
6660 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6661 return false;
6662 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6663 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6664 return false;
6665 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6666 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6667 return false;
6668 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6669 return false;
6670 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6671 return false;
6672 if (info->bw == RATE_INFO_BW_EHT_RU &&
6673 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6674 info->eht_ru_alloc))
6675 return false;
6676 }
6677
6678 nla_nest_end(msg, rate);
6679 return true;
6680 }
6681
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)6682 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6683 int id)
6684 {
6685 void *attr;
6686 int i = 0;
6687
6688 if (!mask)
6689 return true;
6690
6691 attr = nla_nest_start_noflag(msg, id);
6692 if (!attr)
6693 return false;
6694
6695 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6696 if (!(mask & BIT(i)))
6697 continue;
6698
6699 if (nla_put_u8(msg, i, signal[i]))
6700 return false;
6701 }
6702
6703 nla_nest_end(msg, attr);
6704
6705 return true;
6706 }
6707
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)6708 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6709 u32 seq, int flags,
6710 struct cfg80211_registered_device *rdev,
6711 struct net_device *dev,
6712 const u8 *mac_addr, struct station_info *sinfo)
6713 {
6714 void *hdr;
6715 struct nlattr *sinfoattr, *bss_param;
6716
6717 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6718 if (!hdr) {
6719 cfg80211_sinfo_release_content(sinfo);
6720 return -1;
6721 }
6722
6723 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6724 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6725 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6726 goto nla_put_failure;
6727
6728 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6729 if (!sinfoattr)
6730 goto nla_put_failure;
6731
6732 #define PUT_SINFO(attr, memb, type) do { \
6733 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
6734 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6735 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
6736 sinfo->memb)) \
6737 goto nla_put_failure; \
6738 } while (0)
6739 #define PUT_SINFO_U64(attr, memb) do { \
6740 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6741 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
6742 sinfo->memb, NL80211_STA_INFO_PAD)) \
6743 goto nla_put_failure; \
6744 } while (0)
6745
6746 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6747 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6748 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6749
6750 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6751 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6752 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6753 (u32)sinfo->rx_bytes))
6754 goto nla_put_failure;
6755
6756 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6757 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6758 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6759 (u32)sinfo->tx_bytes))
6760 goto nla_put_failure;
6761
6762 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6763 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6764 PUT_SINFO_U64(RX_DURATION, rx_duration);
6765 PUT_SINFO_U64(TX_DURATION, tx_duration);
6766
6767 if (wiphy_ext_feature_isset(&rdev->wiphy,
6768 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6769 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6770
6771 switch (rdev->wiphy.signal_type) {
6772 case CFG80211_SIGNAL_TYPE_MBM:
6773 PUT_SINFO(SIGNAL, signal, u8);
6774 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6775 break;
6776 default:
6777 break;
6778 }
6779 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6780 if (!nl80211_put_signal(msg, sinfo->chains,
6781 sinfo->chain_signal,
6782 NL80211_STA_INFO_CHAIN_SIGNAL))
6783 goto nla_put_failure;
6784 }
6785 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6786 if (!nl80211_put_signal(msg, sinfo->chains,
6787 sinfo->chain_signal_avg,
6788 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6789 goto nla_put_failure;
6790 }
6791 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6792 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6793 NL80211_STA_INFO_TX_BITRATE))
6794 goto nla_put_failure;
6795 }
6796 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6797 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6798 NL80211_STA_INFO_RX_BITRATE))
6799 goto nla_put_failure;
6800 }
6801
6802 PUT_SINFO(RX_PACKETS, rx_packets, u32);
6803 PUT_SINFO(TX_PACKETS, tx_packets, u32);
6804 PUT_SINFO(TX_RETRIES, tx_retries, u32);
6805 PUT_SINFO(TX_FAILED, tx_failed, u32);
6806 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6807 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6808
6809 PUT_SINFO(LLID, llid, u16);
6810 PUT_SINFO(PLID, plid, u16);
6811 PUT_SINFO(PLINK_STATE, plink_state, u8);
6812 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6813 PUT_SINFO(LOCAL_PM, local_pm, u32);
6814 PUT_SINFO(PEER_PM, peer_pm, u32);
6815 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6816 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6817 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6818 PUT_SINFO_U64(T_OFFSET, t_offset);
6819
6820 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6821 bss_param = nla_nest_start_noflag(msg,
6822 NL80211_STA_INFO_BSS_PARAM);
6823 if (!bss_param)
6824 goto nla_put_failure;
6825
6826 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6827 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6828 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6829 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6830 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6831 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6832 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6833 sinfo->bss_param.dtim_period) ||
6834 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6835 sinfo->bss_param.beacon_interval))
6836 goto nla_put_failure;
6837
6838 nla_nest_end(msg, bss_param);
6839 }
6840 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6841 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6842 sizeof(struct nl80211_sta_flag_update),
6843 &sinfo->sta_flags))
6844 goto nla_put_failure;
6845
6846 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6847 PUT_SINFO_U64(BEACON_RX, rx_beacon);
6848 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6849 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6850 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6851 if (wiphy_ext_feature_isset(&rdev->wiphy,
6852 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6853 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6854 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6855 }
6856
6857 #undef PUT_SINFO
6858 #undef PUT_SINFO_U64
6859
6860 if (sinfo->pertid) {
6861 struct nlattr *tidsattr;
6862 int tid;
6863
6864 tidsattr = nla_nest_start_noflag(msg,
6865 NL80211_STA_INFO_TID_STATS);
6866 if (!tidsattr)
6867 goto nla_put_failure;
6868
6869 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6870 struct cfg80211_tid_stats *tidstats;
6871 struct nlattr *tidattr;
6872
6873 tidstats = &sinfo->pertid[tid];
6874
6875 if (!tidstats->filled)
6876 continue;
6877
6878 tidattr = nla_nest_start_noflag(msg, tid + 1);
6879 if (!tidattr)
6880 goto nla_put_failure;
6881
6882 #define PUT_TIDVAL_U64(attr, memb) do { \
6883 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
6884 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
6885 tidstats->memb, NL80211_TID_STATS_PAD)) \
6886 goto nla_put_failure; \
6887 } while (0)
6888
6889 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6890 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6891 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6892 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6893
6894 #undef PUT_TIDVAL_U64
6895 if ((tidstats->filled &
6896 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6897 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6898 NL80211_TID_STATS_TXQ_STATS))
6899 goto nla_put_failure;
6900
6901 nla_nest_end(msg, tidattr);
6902 }
6903
6904 nla_nest_end(msg, tidsattr);
6905 }
6906
6907 nla_nest_end(msg, sinfoattr);
6908
6909 if (sinfo->assoc_req_ies_len &&
6910 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6911 sinfo->assoc_req_ies))
6912 goto nla_put_failure;
6913
6914 if (sinfo->assoc_resp_ies_len &&
6915 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6916 sinfo->assoc_resp_ies))
6917 goto nla_put_failure;
6918
6919 if (sinfo->mlo_params_valid) {
6920 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6921 sinfo->assoc_link_id))
6922 goto nla_put_failure;
6923
6924 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6925 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6926 sinfo->mld_addr))
6927 goto nla_put_failure;
6928 }
6929
6930 cfg80211_sinfo_release_content(sinfo);
6931 genlmsg_end(msg, hdr);
6932 return 0;
6933
6934 nla_put_failure:
6935 cfg80211_sinfo_release_content(sinfo);
6936 genlmsg_cancel(msg, hdr);
6937 return -EMSGSIZE;
6938 }
6939
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)6940 static int nl80211_dump_station(struct sk_buff *skb,
6941 struct netlink_callback *cb)
6942 {
6943 struct station_info sinfo;
6944 struct cfg80211_registered_device *rdev;
6945 struct wireless_dev *wdev;
6946 u8 mac_addr[ETH_ALEN];
6947 int sta_idx = cb->args[2];
6948 int err;
6949
6950 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6951 if (err)
6952 return err;
6953 /* nl80211_prepare_wdev_dump acquired it in the successful case */
6954 __acquire(&rdev->wiphy.mtx);
6955
6956 if (!wdev->netdev) {
6957 err = -EINVAL;
6958 goto out_err;
6959 }
6960
6961 if (!rdev->ops->dump_station) {
6962 err = -EOPNOTSUPP;
6963 goto out_err;
6964 }
6965
6966 while (1) {
6967 memset(&sinfo, 0, sizeof(sinfo));
6968 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6969 mac_addr, &sinfo);
6970 if (err == -ENOENT)
6971 break;
6972 if (err)
6973 goto out_err;
6974
6975 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6976 NETLINK_CB(cb->skb).portid,
6977 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6978 rdev, wdev->netdev, mac_addr,
6979 &sinfo) < 0)
6980 goto out;
6981
6982 sta_idx++;
6983 }
6984
6985 out:
6986 cb->args[2] = sta_idx;
6987 err = skb->len;
6988 out_err:
6989 wiphy_unlock(&rdev->wiphy);
6990
6991 return err;
6992 }
6993
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)6994 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6995 {
6996 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6997 struct net_device *dev = info->user_ptr[1];
6998 struct station_info sinfo;
6999 struct sk_buff *msg;
7000 u8 *mac_addr = NULL;
7001 int err;
7002
7003 memset(&sinfo, 0, sizeof(sinfo));
7004
7005 if (!info->attrs[NL80211_ATTR_MAC])
7006 return -EINVAL;
7007
7008 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7009
7010 if (!rdev->ops->get_station)
7011 return -EOPNOTSUPP;
7012
7013 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7014 if (err)
7015 return err;
7016
7017 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7018 if (!msg) {
7019 cfg80211_sinfo_release_content(&sinfo);
7020 return -ENOMEM;
7021 }
7022
7023 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7024 info->snd_portid, info->snd_seq, 0,
7025 rdev, dev, mac_addr, &sinfo) < 0) {
7026 nlmsg_free(msg);
7027 return -ENOBUFS;
7028 }
7029
7030 return genlmsg_reply(msg, info);
7031 }
7032
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)7033 int cfg80211_check_station_change(struct wiphy *wiphy,
7034 struct station_parameters *params,
7035 enum cfg80211_station_type statype)
7036 {
7037 if (params->listen_interval != -1 &&
7038 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7039 return -EINVAL;
7040
7041 if (params->support_p2p_ps != -1 &&
7042 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7043 return -EINVAL;
7044
7045 if (params->aid &&
7046 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
7047 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7048 return -EINVAL;
7049
7050 /* When you run into this, adjust the code below for the new flag */
7051 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7052
7053 switch (statype) {
7054 case CFG80211_STA_MESH_PEER_KERNEL:
7055 case CFG80211_STA_MESH_PEER_USER:
7056 /*
7057 * No ignoring the TDLS flag here -- the userspace mesh
7058 * code doesn't have the bug of including TDLS in the
7059 * mask everywhere.
7060 */
7061 if (params->sta_flags_mask &
7062 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7063 BIT(NL80211_STA_FLAG_MFP) |
7064 BIT(NL80211_STA_FLAG_AUTHORIZED)))
7065 return -EINVAL;
7066 break;
7067 case CFG80211_STA_TDLS_PEER_SETUP:
7068 case CFG80211_STA_TDLS_PEER_ACTIVE:
7069 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7070 return -EINVAL;
7071 /* ignore since it can't change */
7072 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7073 break;
7074 default:
7075 /* disallow mesh-specific things */
7076 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
7077 return -EINVAL;
7078 if (params->local_pm)
7079 return -EINVAL;
7080 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7081 return -EINVAL;
7082 }
7083
7084 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7085 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
7086 /* TDLS can't be set, ... */
7087 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
7088 return -EINVAL;
7089 /*
7090 * ... but don't bother the driver with it. This works around
7091 * a hostapd/wpa_supplicant issue -- it always includes the
7092 * TLDS_PEER flag in the mask even for AP mode.
7093 */
7094 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7095 }
7096
7097 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7098 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7099 /* reject other things that can't change */
7100 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
7101 return -EINVAL;
7102 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
7103 return -EINVAL;
7104 if (params->link_sta_params.supported_rates)
7105 return -EINVAL;
7106 if (params->ext_capab || params->link_sta_params.ht_capa ||
7107 params->link_sta_params.vht_capa ||
7108 params->link_sta_params.he_capa ||
7109 params->link_sta_params.eht_capa)
7110 return -EINVAL;
7111 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7112 return -EINVAL;
7113 }
7114
7115 if (statype != CFG80211_STA_AP_CLIENT &&
7116 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7117 if (params->vlan)
7118 return -EINVAL;
7119 }
7120
7121 switch (statype) {
7122 case CFG80211_STA_AP_MLME_CLIENT:
7123 /* Use this only for authorizing/unauthorizing a station */
7124 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
7125 return -EOPNOTSUPP;
7126 break;
7127 case CFG80211_STA_AP_CLIENT:
7128 case CFG80211_STA_AP_CLIENT_UNASSOC:
7129 /* accept only the listed bits */
7130 if (params->sta_flags_mask &
7131 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7132 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7133 BIT(NL80211_STA_FLAG_ASSOCIATED) |
7134 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7135 BIT(NL80211_STA_FLAG_WME) |
7136 BIT(NL80211_STA_FLAG_MFP) |
7137 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
7138 return -EINVAL;
7139
7140 /* but authenticated/associated only if driver handles it */
7141 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7142 params->sta_flags_mask &
7143 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7144 BIT(NL80211_STA_FLAG_ASSOCIATED)))
7145 return -EINVAL;
7146 break;
7147 case CFG80211_STA_IBSS:
7148 case CFG80211_STA_AP_STA:
7149 /* reject any changes other than AUTHORIZED */
7150 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
7151 return -EINVAL;
7152 break;
7153 case CFG80211_STA_TDLS_PEER_SETUP:
7154 /* reject any changes other than AUTHORIZED or WME */
7155 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7156 BIT(NL80211_STA_FLAG_WME)))
7157 return -EINVAL;
7158 /* force (at least) rates when authorizing */
7159 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
7160 !params->link_sta_params.supported_rates)
7161 return -EINVAL;
7162 break;
7163 case CFG80211_STA_TDLS_PEER_ACTIVE:
7164 /* reject any changes */
7165 return -EINVAL;
7166 case CFG80211_STA_MESH_PEER_KERNEL:
7167 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7168 return -EINVAL;
7169 break;
7170 case CFG80211_STA_MESH_PEER_USER:
7171 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
7172 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
7173 return -EINVAL;
7174 break;
7175 }
7176
7177 /*
7178 * Older kernel versions ignored this attribute entirely, so don't
7179 * reject attempts to update it but mark it as unused instead so the
7180 * driver won't look at the data.
7181 */
7182 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7183 statype != CFG80211_STA_TDLS_PEER_SETUP)
7184 params->link_sta_params.opmode_notif_used = false;
7185
7186 return 0;
7187 }
7188 EXPORT_SYMBOL(cfg80211_check_station_change);
7189
7190 /*
7191 * Get vlan interface making sure it is running and on the right wiphy.
7192 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)7193 static struct net_device *get_vlan(struct genl_info *info,
7194 struct cfg80211_registered_device *rdev)
7195 {
7196 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7197 struct net_device *v;
7198 int ret;
7199
7200 if (!vlanattr)
7201 return NULL;
7202
7203 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7204 if (!v)
7205 return ERR_PTR(-ENODEV);
7206
7207 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7208 ret = -EINVAL;
7209 goto error;
7210 }
7211
7212 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7213 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7214 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7215 ret = -EINVAL;
7216 goto error;
7217 }
7218
7219 if (!netif_running(v)) {
7220 ret = -ENETDOWN;
7221 goto error;
7222 }
7223
7224 return v;
7225 error:
7226 dev_put(v);
7227 return ERR_PTR(ret);
7228 }
7229
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)7230 static int nl80211_parse_sta_wme(struct genl_info *info,
7231 struct station_parameters *params)
7232 {
7233 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7234 struct nlattr *nla;
7235 int err;
7236
7237 /* parse WME attributes if present */
7238 if (!info->attrs[NL80211_ATTR_STA_WME])
7239 return 0;
7240
7241 nla = info->attrs[NL80211_ATTR_STA_WME];
7242 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7243 nl80211_sta_wme_policy,
7244 info->extack);
7245 if (err)
7246 return err;
7247
7248 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7249 params->uapsd_queues = nla_get_u8(
7250 tb[NL80211_STA_WME_UAPSD_QUEUES]);
7251 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7252 return -EINVAL;
7253
7254 if (tb[NL80211_STA_WME_MAX_SP])
7255 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7256
7257 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7258 return -EINVAL;
7259
7260 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7261
7262 return 0;
7263 }
7264
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)7265 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7266 struct station_parameters *params)
7267 {
7268 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7269 params->supported_channels =
7270 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7271 params->supported_channels_len =
7272 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7273 /*
7274 * Need to include at least one (first channel, number of
7275 * channels) tuple for each subband (checked in policy),
7276 * and must have proper tuples for the rest of the data as well.
7277 */
7278 if (params->supported_channels_len % 2)
7279 return -EINVAL;
7280 }
7281
7282 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7283 params->supported_oper_classes =
7284 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7285 params->supported_oper_classes_len =
7286 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7287 }
7288 return 0;
7289 }
7290
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)7291 static int nl80211_set_station_tdls(struct genl_info *info,
7292 struct station_parameters *params)
7293 {
7294 int err;
7295 /* Dummy STA entry gets updated once the peer capabilities are known */
7296 if (info->attrs[NL80211_ATTR_PEER_AID])
7297 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7298 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7299 params->link_sta_params.ht_capa =
7300 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7301 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7302 params->link_sta_params.vht_capa =
7303 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7304 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7305 params->link_sta_params.he_capa =
7306 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7307 params->link_sta_params.he_capa_len =
7308 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7309
7310 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7311 params->link_sta_params.eht_capa =
7312 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7313 params->link_sta_params.eht_capa_len =
7314 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7315
7316 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7317 (const u8 *)params->link_sta_params.eht_capa,
7318 params->link_sta_params.eht_capa_len,
7319 false))
7320 return -EINVAL;
7321 }
7322 }
7323
7324 err = nl80211_parse_sta_channel_info(info, params);
7325 if (err)
7326 return err;
7327
7328 return nl80211_parse_sta_wme(info, params);
7329 }
7330
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)7331 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7332 struct sta_txpwr *txpwr,
7333 bool *txpwr_set)
7334 {
7335 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7336 int idx;
7337
7338 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7339 if (!rdev->ops->set_tx_power ||
7340 !wiphy_ext_feature_isset(&rdev->wiphy,
7341 NL80211_EXT_FEATURE_STA_TX_PWR))
7342 return -EOPNOTSUPP;
7343
7344 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7345 txpwr->type = nla_get_u8(info->attrs[idx]);
7346
7347 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7348 idx = NL80211_ATTR_STA_TX_POWER;
7349
7350 if (info->attrs[idx])
7351 txpwr->power = nla_get_s16(info->attrs[idx]);
7352 else
7353 return -EINVAL;
7354 }
7355
7356 *txpwr_set = true;
7357 } else {
7358 *txpwr_set = false;
7359 }
7360
7361 return 0;
7362 }
7363
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)7364 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7365 {
7366 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7367 struct net_device *dev = info->user_ptr[1];
7368 struct station_parameters params;
7369 u8 *mac_addr;
7370 int err;
7371
7372 memset(¶ms, 0, sizeof(params));
7373
7374 if (!rdev->ops->change_station)
7375 return -EOPNOTSUPP;
7376
7377 /*
7378 * AID and listen_interval properties can be set only for unassociated
7379 * station. Include these parameters here and will check them in
7380 * cfg80211_check_station_change().
7381 */
7382 if (info->attrs[NL80211_ATTR_STA_AID])
7383 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7384
7385 if (info->attrs[NL80211_ATTR_VLAN_ID])
7386 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7387
7388 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7389 params.listen_interval =
7390 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7391 else
7392 params.listen_interval = -1;
7393
7394 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7395 params.support_p2p_ps =
7396 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7397 else
7398 params.support_p2p_ps = -1;
7399
7400 if (!info->attrs[NL80211_ATTR_MAC])
7401 return -EINVAL;
7402
7403 params.link_sta_params.link_id =
7404 nl80211_link_id_or_invalid(info->attrs);
7405
7406 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7407 /* If MLD_ADDR attribute is set then this is an MLD station
7408 * and the MLD_ADDR attribute holds the MLD address and the
7409 * MAC attribute holds for the LINK address.
7410 * In that case, the link_id is also expected to be valid.
7411 */
7412 if (params.link_sta_params.link_id < 0)
7413 return -EINVAL;
7414
7415 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7416 params.link_sta_params.mld_mac = mac_addr;
7417 params.link_sta_params.link_mac =
7418 nla_data(info->attrs[NL80211_ATTR_MAC]);
7419 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7420 return -EINVAL;
7421 } else {
7422 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7423 }
7424
7425
7426 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7427 params.link_sta_params.supported_rates =
7428 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7429 params.link_sta_params.supported_rates_len =
7430 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7431 }
7432
7433 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7434 params.capability =
7435 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7436 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7437 }
7438
7439 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7440 params.ext_capab =
7441 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7442 params.ext_capab_len =
7443 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7444 }
7445
7446 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7447 return -EINVAL;
7448
7449 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7450 params.plink_action =
7451 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7452
7453 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7454 params.plink_state =
7455 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7456 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7457 params.peer_aid = nla_get_u16(
7458 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7459 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7460 }
7461
7462 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7463 params.local_pm = nla_get_u32(
7464 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7465
7466 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7467 params.link_sta_params.opmode_notif_used = true;
7468 params.link_sta_params.opmode_notif =
7469 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7470 }
7471
7472 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7473 params.link_sta_params.he_6ghz_capa =
7474 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7475
7476 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7477 params.airtime_weight =
7478 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7479
7480 if (params.airtime_weight &&
7481 !wiphy_ext_feature_isset(&rdev->wiphy,
7482 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7483 return -EOPNOTSUPP;
7484
7485 err = nl80211_parse_sta_txpower_setting(info,
7486 ¶ms.link_sta_params.txpwr,
7487 ¶ms.link_sta_params.txpwr_set);
7488 if (err)
7489 return err;
7490
7491 /* Include parameters for TDLS peer (will check later) */
7492 err = nl80211_set_station_tdls(info, ¶ms);
7493 if (err)
7494 return err;
7495
7496 params.vlan = get_vlan(info, rdev);
7497 if (IS_ERR(params.vlan))
7498 return PTR_ERR(params.vlan);
7499
7500 switch (dev->ieee80211_ptr->iftype) {
7501 case NL80211_IFTYPE_AP:
7502 case NL80211_IFTYPE_AP_VLAN:
7503 case NL80211_IFTYPE_P2P_GO:
7504 case NL80211_IFTYPE_P2P_CLIENT:
7505 case NL80211_IFTYPE_STATION:
7506 case NL80211_IFTYPE_ADHOC:
7507 case NL80211_IFTYPE_MESH_POINT:
7508 break;
7509 default:
7510 err = -EOPNOTSUPP;
7511 goto out_put_vlan;
7512 }
7513
7514 /* driver will call cfg80211_check_station_change() */
7515 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
7516
7517 out_put_vlan:
7518 dev_put(params.vlan);
7519
7520 return err;
7521 }
7522
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)7523 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7524 {
7525 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7526 int err;
7527 struct net_device *dev = info->user_ptr[1];
7528 struct wireless_dev *wdev = dev->ieee80211_ptr;
7529 struct station_parameters params;
7530 u8 *mac_addr = NULL;
7531 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7532 BIT(NL80211_STA_FLAG_ASSOCIATED);
7533
7534 memset(¶ms, 0, sizeof(params));
7535
7536 if (!rdev->ops->add_station)
7537 return -EOPNOTSUPP;
7538
7539 if (!info->attrs[NL80211_ATTR_MAC])
7540 return -EINVAL;
7541
7542 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7543 return -EINVAL;
7544
7545 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7546 return -EINVAL;
7547
7548 if (!info->attrs[NL80211_ATTR_STA_AID] &&
7549 !info->attrs[NL80211_ATTR_PEER_AID])
7550 return -EINVAL;
7551
7552 params.link_sta_params.link_id =
7553 nl80211_link_id_or_invalid(info->attrs);
7554
7555 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7556 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7557 params.link_sta_params.mld_mac = mac_addr;
7558 params.link_sta_params.link_mac =
7559 nla_data(info->attrs[NL80211_ATTR_MAC]);
7560 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7561 return -EINVAL;
7562 } else {
7563 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7564 }
7565
7566 params.link_sta_params.supported_rates =
7567 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7568 params.link_sta_params.supported_rates_len =
7569 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7570 params.listen_interval =
7571 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7572
7573 if (info->attrs[NL80211_ATTR_VLAN_ID])
7574 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7575
7576 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7577 params.support_p2p_ps =
7578 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7579 } else {
7580 /*
7581 * if not specified, assume it's supported for P2P GO interface,
7582 * and is NOT supported for AP interface
7583 */
7584 params.support_p2p_ps =
7585 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7586 }
7587
7588 if (info->attrs[NL80211_ATTR_PEER_AID])
7589 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7590 else
7591 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7592
7593 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7594 params.capability =
7595 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7596 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7597 }
7598
7599 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7600 params.ext_capab =
7601 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7602 params.ext_capab_len =
7603 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7604 }
7605
7606 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7607 params.link_sta_params.ht_capa =
7608 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7609
7610 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7611 params.link_sta_params.vht_capa =
7612 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7613
7614 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7615 params.link_sta_params.he_capa =
7616 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7617 params.link_sta_params.he_capa_len =
7618 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7619
7620 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7621 params.link_sta_params.eht_capa =
7622 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7623 params.link_sta_params.eht_capa_len =
7624 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7625
7626 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7627 (const u8 *)params.link_sta_params.eht_capa,
7628 params.link_sta_params.eht_capa_len,
7629 false))
7630 return -EINVAL;
7631 }
7632 }
7633
7634 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7635 params.link_sta_params.he_6ghz_capa =
7636 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7637
7638 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7639 params.link_sta_params.opmode_notif_used = true;
7640 params.link_sta_params.opmode_notif =
7641 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7642 }
7643
7644 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7645 params.plink_action =
7646 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7647
7648 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7649 params.airtime_weight =
7650 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7651
7652 if (params.airtime_weight &&
7653 !wiphy_ext_feature_isset(&rdev->wiphy,
7654 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7655 return -EOPNOTSUPP;
7656
7657 err = nl80211_parse_sta_txpower_setting(info,
7658 ¶ms.link_sta_params.txpwr,
7659 ¶ms.link_sta_params.txpwr_set);
7660 if (err)
7661 return err;
7662
7663 err = nl80211_parse_sta_channel_info(info, ¶ms);
7664 if (err)
7665 return err;
7666
7667 err = nl80211_parse_sta_wme(info, ¶ms);
7668 if (err)
7669 return err;
7670
7671 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7672 return -EINVAL;
7673
7674 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7675 * as userspace might just pass through the capabilities from the IEs
7676 * directly, rather than enforcing this restriction and returning an
7677 * error in this case.
7678 */
7679 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7680 params.link_sta_params.ht_capa = NULL;
7681 params.link_sta_params.vht_capa = NULL;
7682
7683 /* HE and EHT require WME */
7684 if (params.link_sta_params.he_capa_len ||
7685 params.link_sta_params.he_6ghz_capa ||
7686 params.link_sta_params.eht_capa_len)
7687 return -EINVAL;
7688 }
7689
7690 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7691 if (params.link_sta_params.he_6ghz_capa &&
7692 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7693 return -EINVAL;
7694
7695 /* When you run into this, adjust the code below for the new flag */
7696 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7697
7698 switch (dev->ieee80211_ptr->iftype) {
7699 case NL80211_IFTYPE_AP:
7700 case NL80211_IFTYPE_AP_VLAN:
7701 case NL80211_IFTYPE_P2P_GO:
7702 /* ignore WME attributes if iface/sta is not capable */
7703 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7704 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7705 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7706
7707 /* TDLS peers cannot be added */
7708 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7709 info->attrs[NL80211_ATTR_PEER_AID])
7710 return -EINVAL;
7711 /* but don't bother the driver with it */
7712 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7713
7714 /* allow authenticated/associated only if driver handles it */
7715 if (!(rdev->wiphy.features &
7716 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7717 params.sta_flags_mask & auth_assoc)
7718 return -EINVAL;
7719
7720 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7721 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
7722 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7723 return -EINVAL;
7724
7725 /* Older userspace, or userspace wanting to be compatible with
7726 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7727 * and assoc flags in the mask, but assumes the station will be
7728 * added as associated anyway since this was the required driver
7729 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7730 * introduced.
7731 * In order to not bother drivers with this quirk in the API
7732 * set the flags in both the mask and set for new stations in
7733 * this case.
7734 */
7735 if (!(params.sta_flags_mask & auth_assoc)) {
7736 params.sta_flags_mask |= auth_assoc;
7737 params.sta_flags_set |= auth_assoc;
7738 }
7739
7740 /* must be last in here for error handling */
7741 params.vlan = get_vlan(info, rdev);
7742 if (IS_ERR(params.vlan))
7743 return PTR_ERR(params.vlan);
7744 break;
7745 case NL80211_IFTYPE_MESH_POINT:
7746 /* ignore uAPSD data */
7747 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7748
7749 /* associated is disallowed */
7750 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7751 return -EINVAL;
7752 /* TDLS peers cannot be added */
7753 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7754 info->attrs[NL80211_ATTR_PEER_AID])
7755 return -EINVAL;
7756 break;
7757 case NL80211_IFTYPE_STATION:
7758 case NL80211_IFTYPE_P2P_CLIENT:
7759 /* ignore uAPSD data */
7760 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7761
7762 /* these are disallowed */
7763 if (params.sta_flags_mask &
7764 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7765 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7766 return -EINVAL;
7767 /* Only TDLS peers can be added */
7768 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7769 return -EINVAL;
7770 /* Can only add if TDLS ... */
7771 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7772 return -EOPNOTSUPP;
7773 /* ... with external setup is supported */
7774 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7775 return -EOPNOTSUPP;
7776 /*
7777 * Older wpa_supplicant versions always mark the TDLS peer
7778 * as authorized, but it shouldn't yet be.
7779 */
7780 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7781 break;
7782 default:
7783 return -EOPNOTSUPP;
7784 }
7785
7786 /* be aware of params.vlan when changing code here */
7787
7788 if (wdev->valid_links) {
7789 if (params.link_sta_params.link_id < 0) {
7790 err = -EINVAL;
7791 goto out;
7792 }
7793 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7794 err = -ENOLINK;
7795 goto out;
7796 }
7797 } else {
7798 if (params.link_sta_params.link_id >= 0) {
7799 err = -EINVAL;
7800 goto out;
7801 }
7802 }
7803 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
7804 out:
7805 dev_put(params.vlan);
7806 return err;
7807 }
7808
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)7809 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7810 {
7811 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7812 struct net_device *dev = info->user_ptr[1];
7813 struct wireless_dev *wdev = dev->ieee80211_ptr;
7814 struct station_del_parameters params;
7815 int link_id = nl80211_link_id_or_invalid(info->attrs);
7816
7817 memset(¶ms, 0, sizeof(params));
7818
7819 if (info->attrs[NL80211_ATTR_MAC])
7820 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7821
7822 switch (wdev->iftype) {
7823 case NL80211_IFTYPE_AP:
7824 case NL80211_IFTYPE_AP_VLAN:
7825 case NL80211_IFTYPE_MESH_POINT:
7826 case NL80211_IFTYPE_P2P_GO:
7827 /* always accept these */
7828 break;
7829 case NL80211_IFTYPE_ADHOC:
7830 /* conditionally accept */
7831 if (wiphy_ext_feature_isset(&rdev->wiphy,
7832 NL80211_EXT_FEATURE_DEL_IBSS_STA))
7833 break;
7834 return -EINVAL;
7835 default:
7836 return -EINVAL;
7837 }
7838
7839 if (!rdev->ops->del_station)
7840 return -EOPNOTSUPP;
7841
7842 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7843 params.subtype =
7844 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7845 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7846 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7847 return -EINVAL;
7848 } else {
7849 /* Default to Deauthentication frame */
7850 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7851 }
7852
7853 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7854 params.reason_code =
7855 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7856 if (params.reason_code == 0)
7857 return -EINVAL; /* 0 is reserved */
7858 } else {
7859 /* Default to reason code 2 */
7860 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7861 }
7862
7863 /* Link ID not expected in case of non-ML operation */
7864 if (!wdev->valid_links && link_id != -1)
7865 return -EINVAL;
7866
7867 /* If given, a valid link ID should be passed during MLO */
7868 if (wdev->valid_links && link_id >= 0 &&
7869 !(wdev->valid_links & BIT(link_id)))
7870 return -EINVAL;
7871
7872 params.link_id = link_id;
7873
7874 return rdev_del_station(rdev, dev, ¶ms);
7875 }
7876
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)7877 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7878 int flags, struct net_device *dev,
7879 u8 *dst, u8 *next_hop,
7880 struct mpath_info *pinfo)
7881 {
7882 void *hdr;
7883 struct nlattr *pinfoattr;
7884
7885 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7886 if (!hdr)
7887 return -1;
7888
7889 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7890 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7891 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7892 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7893 goto nla_put_failure;
7894
7895 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7896 if (!pinfoattr)
7897 goto nla_put_failure;
7898 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7899 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7900 pinfo->frame_qlen))
7901 goto nla_put_failure;
7902 if (((pinfo->filled & MPATH_INFO_SN) &&
7903 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7904 ((pinfo->filled & MPATH_INFO_METRIC) &&
7905 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7906 pinfo->metric)) ||
7907 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7908 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7909 pinfo->exptime)) ||
7910 ((pinfo->filled & MPATH_INFO_FLAGS) &&
7911 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7912 pinfo->flags)) ||
7913 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7914 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7915 pinfo->discovery_timeout)) ||
7916 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7917 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7918 pinfo->discovery_retries)) ||
7919 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7920 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7921 pinfo->hop_count)) ||
7922 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7923 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7924 pinfo->path_change_count)))
7925 goto nla_put_failure;
7926
7927 nla_nest_end(msg, pinfoattr);
7928
7929 genlmsg_end(msg, hdr);
7930 return 0;
7931
7932 nla_put_failure:
7933 genlmsg_cancel(msg, hdr);
7934 return -EMSGSIZE;
7935 }
7936
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)7937 static int nl80211_dump_mpath(struct sk_buff *skb,
7938 struct netlink_callback *cb)
7939 {
7940 struct mpath_info pinfo;
7941 struct cfg80211_registered_device *rdev;
7942 struct wireless_dev *wdev;
7943 u8 dst[ETH_ALEN];
7944 u8 next_hop[ETH_ALEN];
7945 int path_idx = cb->args[2];
7946 int err;
7947
7948 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7949 if (err)
7950 return err;
7951 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7952 __acquire(&rdev->wiphy.mtx);
7953
7954 if (!rdev->ops->dump_mpath) {
7955 err = -EOPNOTSUPP;
7956 goto out_err;
7957 }
7958
7959 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7960 err = -EOPNOTSUPP;
7961 goto out_err;
7962 }
7963
7964 while (1) {
7965 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7966 next_hop, &pinfo);
7967 if (err == -ENOENT)
7968 break;
7969 if (err)
7970 goto out_err;
7971
7972 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7973 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7974 wdev->netdev, dst, next_hop,
7975 &pinfo) < 0)
7976 goto out;
7977
7978 path_idx++;
7979 }
7980
7981 out:
7982 cb->args[2] = path_idx;
7983 err = skb->len;
7984 out_err:
7985 wiphy_unlock(&rdev->wiphy);
7986 return err;
7987 }
7988
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)7989 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7990 {
7991 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7992 int err;
7993 struct net_device *dev = info->user_ptr[1];
7994 struct mpath_info pinfo;
7995 struct sk_buff *msg;
7996 u8 *dst = NULL;
7997 u8 next_hop[ETH_ALEN];
7998
7999 memset(&pinfo, 0, sizeof(pinfo));
8000
8001 if (!info->attrs[NL80211_ATTR_MAC])
8002 return -EINVAL;
8003
8004 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8005
8006 if (!rdev->ops->get_mpath)
8007 return -EOPNOTSUPP;
8008
8009 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8010 return -EOPNOTSUPP;
8011
8012 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8013 if (err)
8014 return err;
8015
8016 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8017 if (!msg)
8018 return -ENOMEM;
8019
8020 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8021 dev, dst, next_hop, &pinfo) < 0) {
8022 nlmsg_free(msg);
8023 return -ENOBUFS;
8024 }
8025
8026 return genlmsg_reply(msg, info);
8027 }
8028
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)8029 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
8030 {
8031 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8032 struct net_device *dev = info->user_ptr[1];
8033 u8 *dst = NULL;
8034 u8 *next_hop = NULL;
8035
8036 if (!info->attrs[NL80211_ATTR_MAC])
8037 return -EINVAL;
8038
8039 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8040 return -EINVAL;
8041
8042 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8043 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8044
8045 if (!rdev->ops->change_mpath)
8046 return -EOPNOTSUPP;
8047
8048 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8049 return -EOPNOTSUPP;
8050
8051 return rdev_change_mpath(rdev, dev, dst, next_hop);
8052 }
8053
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)8054 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
8055 {
8056 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8057 struct net_device *dev = info->user_ptr[1];
8058 u8 *dst = NULL;
8059 u8 *next_hop = NULL;
8060
8061 if (!info->attrs[NL80211_ATTR_MAC])
8062 return -EINVAL;
8063
8064 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8065 return -EINVAL;
8066
8067 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8068 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8069
8070 if (!rdev->ops->add_mpath)
8071 return -EOPNOTSUPP;
8072
8073 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8074 return -EOPNOTSUPP;
8075
8076 return rdev_add_mpath(rdev, dev, dst, next_hop);
8077 }
8078
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)8079 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
8080 {
8081 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8082 struct net_device *dev = info->user_ptr[1];
8083 u8 *dst = NULL;
8084
8085 if (info->attrs[NL80211_ATTR_MAC])
8086 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8087
8088 if (!rdev->ops->del_mpath)
8089 return -EOPNOTSUPP;
8090
8091 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8092 return -EOPNOTSUPP;
8093
8094 return rdev_del_mpath(rdev, dev, dst);
8095 }
8096
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)8097 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
8098 {
8099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8100 int err;
8101 struct net_device *dev = info->user_ptr[1];
8102 struct mpath_info pinfo;
8103 struct sk_buff *msg;
8104 u8 *dst = NULL;
8105 u8 mpp[ETH_ALEN];
8106
8107 memset(&pinfo, 0, sizeof(pinfo));
8108
8109 if (!info->attrs[NL80211_ATTR_MAC])
8110 return -EINVAL;
8111
8112 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8113
8114 if (!rdev->ops->get_mpp)
8115 return -EOPNOTSUPP;
8116
8117 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8118 return -EOPNOTSUPP;
8119
8120 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
8121 if (err)
8122 return err;
8123
8124 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8125 if (!msg)
8126 return -ENOMEM;
8127
8128 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8129 dev, dst, mpp, &pinfo) < 0) {
8130 nlmsg_free(msg);
8131 return -ENOBUFS;
8132 }
8133
8134 return genlmsg_reply(msg, info);
8135 }
8136
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)8137 static int nl80211_dump_mpp(struct sk_buff *skb,
8138 struct netlink_callback *cb)
8139 {
8140 struct mpath_info pinfo;
8141 struct cfg80211_registered_device *rdev;
8142 struct wireless_dev *wdev;
8143 u8 dst[ETH_ALEN];
8144 u8 mpp[ETH_ALEN];
8145 int path_idx = cb->args[2];
8146 int err;
8147
8148 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8149 if (err)
8150 return err;
8151 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8152 __acquire(&rdev->wiphy.mtx);
8153
8154 if (!rdev->ops->dump_mpp) {
8155 err = -EOPNOTSUPP;
8156 goto out_err;
8157 }
8158
8159 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8160 err = -EOPNOTSUPP;
8161 goto out_err;
8162 }
8163
8164 while (1) {
8165 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
8166 mpp, &pinfo);
8167 if (err == -ENOENT)
8168 break;
8169 if (err)
8170 goto out_err;
8171
8172 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8173 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8174 wdev->netdev, dst, mpp,
8175 &pinfo) < 0)
8176 goto out;
8177
8178 path_idx++;
8179 }
8180
8181 out:
8182 cb->args[2] = path_idx;
8183 err = skb->len;
8184 out_err:
8185 wiphy_unlock(&rdev->wiphy);
8186 return err;
8187 }
8188
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)8189 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
8190 {
8191 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8192 struct net_device *dev = info->user_ptr[1];
8193 struct bss_parameters params;
8194
8195 memset(¶ms, 0, sizeof(params));
8196 params.link_id = nl80211_link_id_or_invalid(info->attrs);
8197 /* default to not changing parameters */
8198 params.use_cts_prot = -1;
8199 params.use_short_preamble = -1;
8200 params.use_short_slot_time = -1;
8201 params.ap_isolate = -1;
8202 params.ht_opmode = -1;
8203 params.p2p_ctwindow = -1;
8204 params.p2p_opp_ps = -1;
8205
8206 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
8207 params.use_cts_prot =
8208 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8209 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8210 params.use_short_preamble =
8211 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8212 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8213 params.use_short_slot_time =
8214 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8215 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8216 params.basic_rates =
8217 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8218 params.basic_rates_len =
8219 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8220 }
8221 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8222 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8223 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8224 params.ht_opmode =
8225 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8226
8227 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8228 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8229 return -EINVAL;
8230 params.p2p_ctwindow =
8231 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8232 if (params.p2p_ctwindow != 0 &&
8233 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8234 return -EINVAL;
8235 }
8236
8237 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8238 u8 tmp;
8239
8240 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8241 return -EINVAL;
8242 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8243 params.p2p_opp_ps = tmp;
8244 if (params.p2p_opp_ps &&
8245 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8246 return -EINVAL;
8247 }
8248
8249 if (!rdev->ops->change_bss)
8250 return -EOPNOTSUPP;
8251
8252 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8253 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8254 return -EOPNOTSUPP;
8255
8256 return rdev_change_bss(rdev, dev, ¶ms);
8257 }
8258
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)8259 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8260 {
8261 char *data = NULL;
8262 bool is_indoor;
8263 enum nl80211_user_reg_hint_type user_reg_hint_type;
8264 u32 owner_nlportid;
8265
8266 /*
8267 * You should only get this when cfg80211 hasn't yet initialized
8268 * completely when built-in to the kernel right between the time
8269 * window between nl80211_init() and regulatory_init(), if that is
8270 * even possible.
8271 */
8272 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8273 return -EINPROGRESS;
8274
8275 user_reg_hint_type =
8276 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
8277 NL80211_USER_REG_HINT_USER);
8278
8279 switch (user_reg_hint_type) {
8280 case NL80211_USER_REG_HINT_USER:
8281 case NL80211_USER_REG_HINT_CELL_BASE:
8282 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8283 return -EINVAL;
8284
8285 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8286 return regulatory_hint_user(data, user_reg_hint_type);
8287 case NL80211_USER_REG_HINT_INDOOR:
8288 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8289 owner_nlportid = info->snd_portid;
8290 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8291 } else {
8292 owner_nlportid = 0;
8293 is_indoor = true;
8294 }
8295
8296 regulatory_hint_indoor(is_indoor, owner_nlportid);
8297 return 0;
8298 default:
8299 return -EINVAL;
8300 }
8301 }
8302
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)8303 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8304 {
8305 return reg_reload_regdb();
8306 }
8307
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)8308 static int nl80211_get_mesh_config(struct sk_buff *skb,
8309 struct genl_info *info)
8310 {
8311 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8312 struct net_device *dev = info->user_ptr[1];
8313 struct wireless_dev *wdev = dev->ieee80211_ptr;
8314 struct mesh_config cur_params;
8315 int err = 0;
8316 void *hdr;
8317 struct nlattr *pinfoattr;
8318 struct sk_buff *msg;
8319
8320 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8321 return -EOPNOTSUPP;
8322
8323 if (!rdev->ops->get_mesh_config)
8324 return -EOPNOTSUPP;
8325
8326 /* If not connected, get default parameters */
8327 if (!wdev->u.mesh.id_len)
8328 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8329 else
8330 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8331
8332 if (err)
8333 return err;
8334
8335 /* Draw up a netlink message to send back */
8336 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8337 if (!msg)
8338 return -ENOMEM;
8339 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8340 NL80211_CMD_GET_MESH_CONFIG);
8341 if (!hdr)
8342 goto out;
8343 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8344 if (!pinfoattr)
8345 goto nla_put_failure;
8346 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8347 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8348 cur_params.dot11MeshRetryTimeout) ||
8349 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8350 cur_params.dot11MeshConfirmTimeout) ||
8351 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8352 cur_params.dot11MeshHoldingTimeout) ||
8353 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8354 cur_params.dot11MeshMaxPeerLinks) ||
8355 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8356 cur_params.dot11MeshMaxRetries) ||
8357 nla_put_u8(msg, NL80211_MESHCONF_TTL,
8358 cur_params.dot11MeshTTL) ||
8359 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8360 cur_params.element_ttl) ||
8361 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8362 cur_params.auto_open_plinks) ||
8363 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8364 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8365 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8366 cur_params.dot11MeshHWMPmaxPREQretries) ||
8367 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8368 cur_params.path_refresh_time) ||
8369 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8370 cur_params.min_discovery_timeout) ||
8371 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8372 cur_params.dot11MeshHWMPactivePathTimeout) ||
8373 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8374 cur_params.dot11MeshHWMPpreqMinInterval) ||
8375 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8376 cur_params.dot11MeshHWMPperrMinInterval) ||
8377 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8378 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8379 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8380 cur_params.dot11MeshHWMPRootMode) ||
8381 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8382 cur_params.dot11MeshHWMPRannInterval) ||
8383 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8384 cur_params.dot11MeshGateAnnouncementProtocol) ||
8385 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8386 cur_params.dot11MeshForwarding) ||
8387 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8388 cur_params.rssi_threshold) ||
8389 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8390 cur_params.ht_opmode) ||
8391 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8392 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8393 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8394 cur_params.dot11MeshHWMProotInterval) ||
8395 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8396 cur_params.dot11MeshHWMPconfirmationInterval) ||
8397 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8398 cur_params.power_mode) ||
8399 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8400 cur_params.dot11MeshAwakeWindowDuration) ||
8401 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8402 cur_params.plink_timeout) ||
8403 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8404 cur_params.dot11MeshConnectedToMeshGate) ||
8405 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8406 cur_params.dot11MeshNolearn) ||
8407 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8408 cur_params.dot11MeshConnectedToAuthServer))
8409 goto nla_put_failure;
8410 nla_nest_end(msg, pinfoattr);
8411 genlmsg_end(msg, hdr);
8412 return genlmsg_reply(msg, info);
8413
8414 nla_put_failure:
8415 out:
8416 nlmsg_free(msg);
8417 return -ENOBUFS;
8418 }
8419
8420 static const struct nla_policy
8421 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8422 [NL80211_MESHCONF_RETRY_TIMEOUT] =
8423 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8424 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8425 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8426 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8427 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8428 [NL80211_MESHCONF_MAX_PEER_LINKS] =
8429 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8430 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8431 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8432 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8433 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8434 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8435 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8436 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8437 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8438 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8439 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8440 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8441 NLA_POLICY_MIN(NLA_U16, 1),
8442 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8443 NLA_POLICY_MIN(NLA_U16, 1),
8444 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8445 NLA_POLICY_MIN(NLA_U16, 1),
8446 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8447 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8448 NLA_POLICY_MIN(NLA_U16, 1),
8449 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8450 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8451 [NL80211_MESHCONF_RSSI_THRESHOLD] =
8452 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8453 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8454 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8455 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8456 NLA_POLICY_MIN(NLA_U16, 1),
8457 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8458 NLA_POLICY_MIN(NLA_U16, 1),
8459 [NL80211_MESHCONF_POWER_MODE] =
8460 NLA_POLICY_RANGE(NLA_U32,
8461 NL80211_MESH_POWER_ACTIVE,
8462 NL80211_MESH_POWER_MAX),
8463 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8464 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8465 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8466 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8467 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8468 };
8469
8470 static const struct nla_policy
8471 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8472 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8473 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8474 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8475 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8476 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8477 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8478 [NL80211_MESH_SETUP_IE] =
8479 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8480 IEEE80211_MAX_DATA_LEN),
8481 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8482 };
8483
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)8484 static int nl80211_parse_mesh_config(struct genl_info *info,
8485 struct mesh_config *cfg,
8486 u32 *mask_out)
8487 {
8488 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8489 u32 mask = 0;
8490 u16 ht_opmode;
8491
8492 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
8493 do { \
8494 if (tb[attr]) { \
8495 cfg->param = fn(tb[attr]); \
8496 mask |= BIT((attr) - 1); \
8497 } \
8498 } while (0)
8499
8500 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8501 return -EINVAL;
8502 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8503 return -EINVAL;
8504
8505 /* This makes sure that there aren't more than 32 mesh config
8506 * parameters (otherwise our bitfield scheme would not work.) */
8507 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8508
8509 /* Fill in the params struct */
8510 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8511 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8512 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8513 NL80211_MESHCONF_CONFIRM_TIMEOUT,
8514 nla_get_u16);
8515 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8516 NL80211_MESHCONF_HOLDING_TIMEOUT,
8517 nla_get_u16);
8518 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8519 NL80211_MESHCONF_MAX_PEER_LINKS,
8520 nla_get_u16);
8521 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8522 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8523 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8524 NL80211_MESHCONF_TTL, nla_get_u8);
8525 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8526 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8527 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8528 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8529 nla_get_u8);
8530 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8531 mask,
8532 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8533 nla_get_u32);
8534 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8535 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8536 nla_get_u8);
8537 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8538 NL80211_MESHCONF_PATH_REFRESH_TIME,
8539 nla_get_u32);
8540 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8541 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8542 return -EINVAL;
8543 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8544 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8545 nla_get_u16);
8546 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8547 mask,
8548 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8549 nla_get_u32);
8550 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8551 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8552 cfg->dot11MeshHWMPactivePathTimeout > 65535))
8553 return -EINVAL;
8554 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8555 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8556 nla_get_u16);
8557 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8558 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8559 nla_get_u16);
8560 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8561 dot11MeshHWMPnetDiameterTraversalTime, mask,
8562 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8563 nla_get_u16);
8564 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8565 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8566 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8567 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8568 nla_get_u16);
8569 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8570 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8571 nla_get_u8);
8572 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8573 NL80211_MESHCONF_FORWARDING, nla_get_u8);
8574 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8575 NL80211_MESHCONF_RSSI_THRESHOLD,
8576 nla_get_s32);
8577 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8578 NL80211_MESHCONF_CONNECTED_TO_GATE,
8579 nla_get_u8);
8580 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8581 NL80211_MESHCONF_CONNECTED_TO_AS,
8582 nla_get_u8);
8583 /*
8584 * Check HT operation mode based on
8585 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8586 */
8587 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8588 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8589
8590 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8591 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8592 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8593 return -EINVAL;
8594
8595 /* NON_HT_STA bit is reserved, but some programs set it */
8596 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8597
8598 cfg->ht_opmode = ht_opmode;
8599 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8600 }
8601 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8602 dot11MeshHWMPactivePathToRootTimeout, mask,
8603 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8604 nla_get_u32);
8605 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8606 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8607 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8608 return -EINVAL;
8609 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8610 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8611 nla_get_u16);
8612 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8613 mask,
8614 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8615 nla_get_u16);
8616 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8617 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8618 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8619 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8620 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8621 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8622 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8623 NL80211_MESHCONF_NOLEARN, nla_get_u8);
8624 if (mask_out)
8625 *mask_out = mask;
8626
8627 return 0;
8628
8629 #undef FILL_IN_MESH_PARAM_IF_SET
8630 }
8631
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)8632 static int nl80211_parse_mesh_setup(struct genl_info *info,
8633 struct mesh_setup *setup)
8634 {
8635 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8636 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8637
8638 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8639 return -EINVAL;
8640 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8641 return -EINVAL;
8642
8643 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8644 setup->sync_method =
8645 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8646 IEEE80211_SYNC_METHOD_VENDOR :
8647 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8648
8649 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8650 setup->path_sel_proto =
8651 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8652 IEEE80211_PATH_PROTOCOL_VENDOR :
8653 IEEE80211_PATH_PROTOCOL_HWMP;
8654
8655 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8656 setup->path_metric =
8657 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8658 IEEE80211_PATH_METRIC_VENDOR :
8659 IEEE80211_PATH_METRIC_AIRTIME;
8660
8661 if (tb[NL80211_MESH_SETUP_IE]) {
8662 struct nlattr *ieattr =
8663 tb[NL80211_MESH_SETUP_IE];
8664 setup->ie = nla_data(ieattr);
8665 setup->ie_len = nla_len(ieattr);
8666 }
8667 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8668 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8669 return -EINVAL;
8670 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8671 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8672 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8673 if (setup->is_secure)
8674 setup->user_mpm = true;
8675
8676 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8677 if (!setup->user_mpm)
8678 return -EINVAL;
8679 setup->auth_id =
8680 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8681 }
8682
8683 return 0;
8684 }
8685
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)8686 static int nl80211_update_mesh_config(struct sk_buff *skb,
8687 struct genl_info *info)
8688 {
8689 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8690 struct net_device *dev = info->user_ptr[1];
8691 struct wireless_dev *wdev = dev->ieee80211_ptr;
8692 struct mesh_config cfg = {};
8693 u32 mask;
8694 int err;
8695
8696 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8697 return -EOPNOTSUPP;
8698
8699 if (!rdev->ops->update_mesh_config)
8700 return -EOPNOTSUPP;
8701
8702 err = nl80211_parse_mesh_config(info, &cfg, &mask);
8703 if (err)
8704 return err;
8705
8706 if (!wdev->u.mesh.id_len)
8707 err = -ENOLINK;
8708
8709 if (!err)
8710 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8711
8712 return err;
8713 }
8714
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)8715 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8716 struct sk_buff *msg)
8717 {
8718 struct nlattr *nl_reg_rules;
8719 unsigned int i;
8720
8721 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8722 (regdom->dfs_region &&
8723 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8724 goto nla_put_failure;
8725
8726 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8727 if (!nl_reg_rules)
8728 goto nla_put_failure;
8729
8730 for (i = 0; i < regdom->n_reg_rules; i++) {
8731 struct nlattr *nl_reg_rule;
8732 const struct ieee80211_reg_rule *reg_rule;
8733 const struct ieee80211_freq_range *freq_range;
8734 const struct ieee80211_power_rule *power_rule;
8735 unsigned int max_bandwidth_khz;
8736
8737 reg_rule = ®dom->reg_rules[i];
8738 freq_range = ®_rule->freq_range;
8739 power_rule = ®_rule->power_rule;
8740
8741 nl_reg_rule = nla_nest_start_noflag(msg, i);
8742 if (!nl_reg_rule)
8743 goto nla_put_failure;
8744
8745 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8746 if (!max_bandwidth_khz)
8747 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8748 reg_rule);
8749
8750 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8751 reg_rule->flags) ||
8752 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8753 freq_range->start_freq_khz) ||
8754 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8755 freq_range->end_freq_khz) ||
8756 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8757 max_bandwidth_khz) ||
8758 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8759 power_rule->max_antenna_gain) ||
8760 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8761 power_rule->max_eirp) ||
8762 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8763 reg_rule->dfs_cac_ms))
8764 goto nla_put_failure;
8765
8766 if ((reg_rule->flags & NL80211_RRF_PSD) &&
8767 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
8768 reg_rule->psd))
8769 goto nla_put_failure;
8770
8771 nla_nest_end(msg, nl_reg_rule);
8772 }
8773
8774 nla_nest_end(msg, nl_reg_rules);
8775 return 0;
8776
8777 nla_put_failure:
8778 return -EMSGSIZE;
8779 }
8780
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)8781 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8782 {
8783 const struct ieee80211_regdomain *regdom = NULL;
8784 struct cfg80211_registered_device *rdev;
8785 struct wiphy *wiphy = NULL;
8786 struct sk_buff *msg;
8787 int err = -EMSGSIZE;
8788 void *hdr;
8789
8790 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8791 if (!msg)
8792 return -ENOBUFS;
8793
8794 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8795 NL80211_CMD_GET_REG);
8796 if (!hdr)
8797 goto put_failure;
8798
8799 rtnl_lock();
8800
8801 if (info->attrs[NL80211_ATTR_WIPHY]) {
8802 bool self_managed;
8803
8804 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8805 if (IS_ERR(rdev)) {
8806 err = PTR_ERR(rdev);
8807 goto nla_put_failure;
8808 }
8809
8810 wiphy = &rdev->wiphy;
8811 self_managed = wiphy->regulatory_flags &
8812 REGULATORY_WIPHY_SELF_MANAGED;
8813
8814 rcu_read_lock();
8815
8816 regdom = get_wiphy_regdom(wiphy);
8817
8818 /* a self-managed-reg device must have a private regdom */
8819 if (WARN_ON(!regdom && self_managed)) {
8820 err = -EINVAL;
8821 goto nla_put_failure_rcu;
8822 }
8823
8824 if (regdom &&
8825 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8826 goto nla_put_failure_rcu;
8827 } else {
8828 rcu_read_lock();
8829 }
8830
8831 if (!wiphy && reg_last_request_cell_base() &&
8832 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8833 NL80211_USER_REG_HINT_CELL_BASE))
8834 goto nla_put_failure_rcu;
8835
8836 if (!regdom)
8837 regdom = rcu_dereference(cfg80211_regdomain);
8838
8839 if (nl80211_put_regdom(regdom, msg))
8840 goto nla_put_failure_rcu;
8841
8842 rcu_read_unlock();
8843
8844 genlmsg_end(msg, hdr);
8845 rtnl_unlock();
8846 return genlmsg_reply(msg, info);
8847
8848 nla_put_failure_rcu:
8849 rcu_read_unlock();
8850 nla_put_failure:
8851 rtnl_unlock();
8852 put_failure:
8853 nlmsg_free(msg);
8854 return err;
8855 }
8856
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)8857 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8858 u32 seq, int flags, struct wiphy *wiphy,
8859 const struct ieee80211_regdomain *regdom)
8860 {
8861 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8862 NL80211_CMD_GET_REG);
8863
8864 if (!hdr)
8865 return -1;
8866
8867 genl_dump_check_consistent(cb, hdr);
8868
8869 if (nl80211_put_regdom(regdom, msg))
8870 goto nla_put_failure;
8871
8872 if (!wiphy && reg_last_request_cell_base() &&
8873 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8874 NL80211_USER_REG_HINT_CELL_BASE))
8875 goto nla_put_failure;
8876
8877 if (wiphy &&
8878 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8879 goto nla_put_failure;
8880
8881 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8882 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8883 goto nla_put_failure;
8884
8885 genlmsg_end(msg, hdr);
8886 return 0;
8887
8888 nla_put_failure:
8889 genlmsg_cancel(msg, hdr);
8890 return -EMSGSIZE;
8891 }
8892
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)8893 static int nl80211_get_reg_dump(struct sk_buff *skb,
8894 struct netlink_callback *cb)
8895 {
8896 const struct ieee80211_regdomain *regdom = NULL;
8897 struct cfg80211_registered_device *rdev;
8898 int err, reg_idx, start = cb->args[2];
8899
8900 rcu_read_lock();
8901
8902 if (cfg80211_regdomain && start == 0) {
8903 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8904 NLM_F_MULTI, NULL,
8905 rcu_dereference(cfg80211_regdomain));
8906 if (err < 0)
8907 goto out_err;
8908 }
8909
8910 /* the global regdom is idx 0 */
8911 reg_idx = 1;
8912 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8913 regdom = get_wiphy_regdom(&rdev->wiphy);
8914 if (!regdom)
8915 continue;
8916
8917 if (++reg_idx <= start)
8918 continue;
8919
8920 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8921 NLM_F_MULTI, &rdev->wiphy, regdom);
8922 if (err < 0) {
8923 reg_idx--;
8924 break;
8925 }
8926 }
8927
8928 cb->args[2] = reg_idx;
8929 err = skb->len;
8930 out_err:
8931 rcu_read_unlock();
8932 return err;
8933 }
8934
8935 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8936 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8937 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
8938 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
8939 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
8940 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
8941 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
8942 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
8943 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
8944 };
8945
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)8946 static int parse_reg_rule(struct nlattr *tb[],
8947 struct ieee80211_reg_rule *reg_rule)
8948 {
8949 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
8950 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
8951
8952 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8953 return -EINVAL;
8954 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8955 return -EINVAL;
8956 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8957 return -EINVAL;
8958 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8959 return -EINVAL;
8960 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8961 return -EINVAL;
8962
8963 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8964
8965 freq_range->start_freq_khz =
8966 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8967 freq_range->end_freq_khz =
8968 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8969 freq_range->max_bandwidth_khz =
8970 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8971
8972 power_rule->max_eirp =
8973 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8974
8975 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8976 power_rule->max_antenna_gain =
8977 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8978
8979 if (tb[NL80211_ATTR_DFS_CAC_TIME])
8980 reg_rule->dfs_cac_ms =
8981 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8982
8983 return 0;
8984 }
8985
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)8986 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8987 {
8988 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8989 struct nlattr *nl_reg_rule;
8990 char *alpha2;
8991 int rem_reg_rules, r;
8992 u32 num_rules = 0, rule_idx = 0;
8993 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8994 struct ieee80211_regdomain *rd;
8995
8996 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8997 return -EINVAL;
8998
8999 if (!info->attrs[NL80211_ATTR_REG_RULES])
9000 return -EINVAL;
9001
9002 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9003
9004 if (info->attrs[NL80211_ATTR_DFS_REGION])
9005 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
9006
9007 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9008 rem_reg_rules) {
9009 num_rules++;
9010 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
9011 return -EINVAL;
9012 }
9013
9014 rtnl_lock();
9015 if (!reg_is_valid_request(alpha2)) {
9016 r = -EINVAL;
9017 goto out;
9018 }
9019
9020 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
9021 if (!rd) {
9022 r = -ENOMEM;
9023 goto out;
9024 }
9025
9026 rd->n_reg_rules = num_rules;
9027 rd->alpha2[0] = alpha2[0];
9028 rd->alpha2[1] = alpha2[1];
9029
9030 /*
9031 * Disable DFS master mode if the DFS region was
9032 * not supported or known on this kernel.
9033 */
9034 if (reg_supported_dfs_region(dfs_region))
9035 rd->dfs_region = dfs_region;
9036
9037 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9038 rem_reg_rules) {
9039 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
9040 nl_reg_rule, reg_rule_policy,
9041 info->extack);
9042 if (r)
9043 goto bad_reg;
9044 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
9045 if (r)
9046 goto bad_reg;
9047
9048 rule_idx++;
9049
9050 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
9051 r = -EINVAL;
9052 goto bad_reg;
9053 }
9054 }
9055
9056 r = set_regdom(rd, REGD_SOURCE_CRDA);
9057 /* set_regdom takes ownership of rd */
9058 rd = NULL;
9059 bad_reg:
9060 kfree(rd);
9061 out:
9062 rtnl_unlock();
9063 return r;
9064 }
9065 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
9066
validate_scan_freqs(struct nlattr * freqs)9067 static int validate_scan_freqs(struct nlattr *freqs)
9068 {
9069 struct nlattr *attr1, *attr2;
9070 int n_channels = 0, tmp1, tmp2;
9071
9072 nla_for_each_nested(attr1, freqs, tmp1)
9073 if (nla_len(attr1) != sizeof(u32))
9074 return 0;
9075
9076 nla_for_each_nested(attr1, freqs, tmp1) {
9077 n_channels++;
9078 /*
9079 * Some hardware has a limited channel list for
9080 * scanning, and it is pretty much nonsensical
9081 * to scan for a channel twice, so disallow that
9082 * and don't require drivers to check that the
9083 * channel list they get isn't longer than what
9084 * they can scan, as long as they can scan all
9085 * the channels they registered at once.
9086 */
9087 nla_for_each_nested(attr2, freqs, tmp2)
9088 if (attr1 != attr2 &&
9089 nla_get_u32(attr1) == nla_get_u32(attr2))
9090 return 0;
9091 }
9092
9093 return n_channels;
9094 }
9095
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)9096 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
9097 {
9098 return b < NUM_NL80211_BANDS && wiphy->bands[b];
9099 }
9100
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)9101 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
9102 struct cfg80211_bss_selection *bss_select)
9103 {
9104 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
9105 struct nlattr *nest;
9106 int err;
9107 bool found = false;
9108 int i;
9109
9110 /* only process one nested attribute */
9111 nest = nla_data(nla);
9112 if (!nla_ok(nest, nla_len(nest)))
9113 return -EINVAL;
9114
9115 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
9116 nest, nl80211_bss_select_policy,
9117 NULL);
9118 if (err)
9119 return err;
9120
9121 /* only one attribute may be given */
9122 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
9123 if (attr[i]) {
9124 if (found)
9125 return -EINVAL;
9126 found = true;
9127 }
9128 }
9129
9130 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
9131
9132 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
9133 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
9134
9135 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
9136 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
9137 bss_select->param.band_pref =
9138 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
9139 if (!is_band_valid(wiphy, bss_select->param.band_pref))
9140 return -EINVAL;
9141 }
9142
9143 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
9144 struct nl80211_bss_select_rssi_adjust *adj_param;
9145
9146 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
9147 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
9148 bss_select->param.adjust.band = adj_param->band;
9149 bss_select->param.adjust.delta = adj_param->delta;
9150 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
9151 return -EINVAL;
9152 }
9153
9154 /* user-space did not provide behaviour attribute */
9155 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
9156 return -EINVAL;
9157
9158 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
9159 return -EINVAL;
9160
9161 return 0;
9162 }
9163
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)9164 int nl80211_parse_random_mac(struct nlattr **attrs,
9165 u8 *mac_addr, u8 *mac_addr_mask)
9166 {
9167 int i;
9168
9169 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
9170 eth_zero_addr(mac_addr);
9171 eth_zero_addr(mac_addr_mask);
9172 mac_addr[0] = 0x2;
9173 mac_addr_mask[0] = 0x3;
9174
9175 return 0;
9176 }
9177
9178 /* need both or none */
9179 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
9180 return -EINVAL;
9181
9182 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
9183 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
9184
9185 /* don't allow or configure an mcast address */
9186 if (!is_multicast_ether_addr(mac_addr_mask) ||
9187 is_multicast_ether_addr(mac_addr))
9188 return -EINVAL;
9189
9190 /*
9191 * allow users to pass a MAC address that has bits set outside
9192 * of the mask, but don't bother drivers with having to deal
9193 * with such bits
9194 */
9195 for (i = 0; i < ETH_ALEN; i++)
9196 mac_addr[i] &= mac_addr_mask[i];
9197
9198 return 0;
9199 }
9200
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)9201 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
9202 struct ieee80211_channel *chan)
9203 {
9204 unsigned int link_id;
9205 bool all_ok = true;
9206
9207 lockdep_assert_wiphy(wdev->wiphy);
9208
9209 if (!cfg80211_wdev_channel_allowed(wdev, chan))
9210 return false;
9211
9212 if (!cfg80211_beaconing_iface_active(wdev))
9213 return true;
9214
9215 /*
9216 * FIXME: check if we have a free HW resource/link for chan
9217 *
9218 * This, as well as the FIXME below, requires knowing the link
9219 * capabilities of the hardware.
9220 */
9221
9222 /* we cannot leave radar channels */
9223 for_each_valid_link(wdev, link_id) {
9224 struct cfg80211_chan_def *chandef;
9225
9226 chandef = wdev_chandef(wdev, link_id);
9227 if (!chandef || !chandef->chan)
9228 continue;
9229
9230 /*
9231 * FIXME: don't require all_ok, but rather check only the
9232 * correct HW resource/link onto which 'chan' falls,
9233 * as only that link leaves the channel for doing
9234 * the off-channel operation.
9235 */
9236
9237 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9238 all_ok = false;
9239 }
9240
9241 if (all_ok)
9242 return true;
9243
9244 return regulatory_pre_cac_allowed(wdev->wiphy);
9245 }
9246
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)9247 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9248 enum nl80211_ext_feature_index feat)
9249 {
9250 if (!(flags & flag))
9251 return true;
9252 if (wiphy_ext_feature_isset(wiphy, feat))
9253 return true;
9254 return false;
9255 }
9256
9257 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)9258 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9259 void *request, struct nlattr **attrs,
9260 bool is_sched_scan)
9261 {
9262 u8 *mac_addr, *mac_addr_mask;
9263 u32 *flags;
9264 enum nl80211_feature_flags randomness_flag;
9265
9266 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9267 return 0;
9268
9269 if (is_sched_scan) {
9270 struct cfg80211_sched_scan_request *req = request;
9271
9272 randomness_flag = wdev ?
9273 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9274 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9275 flags = &req->flags;
9276 mac_addr = req->mac_addr;
9277 mac_addr_mask = req->mac_addr_mask;
9278 } else {
9279 struct cfg80211_scan_request *req = request;
9280
9281 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9282 flags = &req->flags;
9283 mac_addr = req->mac_addr;
9284 mac_addr_mask = req->mac_addr_mask;
9285 }
9286
9287 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9288
9289 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9290 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9291 !nl80211_check_scan_feat(wiphy, *flags,
9292 NL80211_SCAN_FLAG_LOW_SPAN,
9293 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9294 !nl80211_check_scan_feat(wiphy, *flags,
9295 NL80211_SCAN_FLAG_LOW_POWER,
9296 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9297 !nl80211_check_scan_feat(wiphy, *flags,
9298 NL80211_SCAN_FLAG_HIGH_ACCURACY,
9299 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9300 !nl80211_check_scan_feat(wiphy, *flags,
9301 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9302 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9303 !nl80211_check_scan_feat(wiphy, *flags,
9304 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9305 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9306 !nl80211_check_scan_feat(wiphy, *flags,
9307 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9308 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9309 !nl80211_check_scan_feat(wiphy, *flags,
9310 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9311 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9312 !nl80211_check_scan_feat(wiphy, *flags,
9313 NL80211_SCAN_FLAG_RANDOM_SN,
9314 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9315 !nl80211_check_scan_feat(wiphy, *flags,
9316 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9317 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9318 return -EOPNOTSUPP;
9319
9320 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9321 int err;
9322
9323 if (!(wiphy->features & randomness_flag) ||
9324 (wdev && wdev->connected))
9325 return -EOPNOTSUPP;
9326
9327 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9328 if (err)
9329 return err;
9330 }
9331
9332 return 0;
9333 }
9334
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)9335 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9336 {
9337 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9338 struct wireless_dev *wdev = info->user_ptr[1];
9339 struct cfg80211_scan_request *request;
9340 struct nlattr *scan_freqs = NULL;
9341 bool scan_freqs_khz = false;
9342 struct nlattr *attr;
9343 struct wiphy *wiphy;
9344 int err, tmp, n_ssids = 0, n_channels, i;
9345 size_t ie_len, size;
9346 size_t ssids_offset, ie_offset;
9347
9348 wiphy = &rdev->wiphy;
9349
9350 if (wdev->iftype == NL80211_IFTYPE_NAN)
9351 return -EOPNOTSUPP;
9352
9353 if (!rdev->ops->scan)
9354 return -EOPNOTSUPP;
9355
9356 if (rdev->scan_req || rdev->scan_msg)
9357 return -EBUSY;
9358
9359 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9360 if (!wiphy_ext_feature_isset(wiphy,
9361 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9362 return -EOPNOTSUPP;
9363 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9364 scan_freqs_khz = true;
9365 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9366 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9367
9368 if (scan_freqs) {
9369 n_channels = validate_scan_freqs(scan_freqs);
9370 if (!n_channels)
9371 return -EINVAL;
9372 } else {
9373 n_channels = ieee80211_get_num_supported_channels(wiphy);
9374 }
9375
9376 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9377 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9378 n_ssids++;
9379
9380 if (n_ssids > wiphy->max_scan_ssids)
9381 return -EINVAL;
9382
9383 if (info->attrs[NL80211_ATTR_IE])
9384 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9385 else
9386 ie_len = 0;
9387
9388 if (ie_len > wiphy->max_scan_ie_len)
9389 return -EINVAL;
9390
9391 size = struct_size(request, channels, n_channels);
9392 ssids_offset = size;
9393 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9394 ie_offset = size;
9395 size = size_add(size, ie_len);
9396 request = kzalloc(size, GFP_KERNEL);
9397 if (!request)
9398 return -ENOMEM;
9399 request->n_channels = n_channels;
9400
9401 if (n_ssids)
9402 request->ssids = (void *)request + ssids_offset;
9403 request->n_ssids = n_ssids;
9404 if (ie_len)
9405 request->ie = (void *)request + ie_offset;
9406
9407 i = 0;
9408 if (scan_freqs) {
9409 /* user specified, bail out if channel not found */
9410 nla_for_each_nested(attr, scan_freqs, tmp) {
9411 struct ieee80211_channel *chan;
9412 int freq = nla_get_u32(attr);
9413
9414 if (!scan_freqs_khz)
9415 freq = MHZ_TO_KHZ(freq);
9416
9417 chan = ieee80211_get_channel_khz(wiphy, freq);
9418 if (!chan) {
9419 err = -EINVAL;
9420 goto out_free;
9421 }
9422
9423 /* ignore disabled channels */
9424 if (chan->flags & IEEE80211_CHAN_DISABLED ||
9425 !cfg80211_wdev_channel_allowed(wdev, chan))
9426 continue;
9427
9428 request->channels[i] = chan;
9429 i++;
9430 }
9431 } else {
9432 enum nl80211_band band;
9433
9434 /* all channels */
9435 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9436 int j;
9437
9438 if (!wiphy->bands[band])
9439 continue;
9440 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9441 struct ieee80211_channel *chan;
9442
9443 chan = &wiphy->bands[band]->channels[j];
9444
9445 if (chan->flags & IEEE80211_CHAN_DISABLED ||
9446 !cfg80211_wdev_channel_allowed(wdev, chan))
9447 continue;
9448
9449 request->channels[i] = chan;
9450 i++;
9451 }
9452 }
9453 }
9454
9455 if (!i) {
9456 err = -EINVAL;
9457 goto out_free;
9458 }
9459
9460 request->n_channels = i;
9461
9462 for (i = 0; i < request->n_channels; i++) {
9463 struct ieee80211_channel *chan = request->channels[i];
9464
9465 /* if we can go off-channel to the target channel we're good */
9466 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9467 continue;
9468
9469 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9470 err = -EBUSY;
9471 goto out_free;
9472 }
9473 }
9474
9475 i = 0;
9476 if (n_ssids) {
9477 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9478 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9479 err = -EINVAL;
9480 goto out_free;
9481 }
9482 request->ssids[i].ssid_len = nla_len(attr);
9483 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9484 i++;
9485 }
9486 }
9487
9488 if (info->attrs[NL80211_ATTR_IE]) {
9489 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9490 memcpy((void *)request->ie,
9491 nla_data(info->attrs[NL80211_ATTR_IE]),
9492 request->ie_len);
9493 }
9494
9495 for (i = 0; i < NUM_NL80211_BANDS; i++)
9496 if (wiphy->bands[i])
9497 request->rates[i] =
9498 (1 << wiphy->bands[i]->n_bitrates) - 1;
9499
9500 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9501 nla_for_each_nested(attr,
9502 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9503 tmp) {
9504 enum nl80211_band band = nla_type(attr);
9505
9506 if (band < 0 || band >= NUM_NL80211_BANDS) {
9507 err = -EINVAL;
9508 goto out_free;
9509 }
9510
9511 if (!wiphy->bands[band])
9512 continue;
9513
9514 err = ieee80211_get_ratemask(wiphy->bands[band],
9515 nla_data(attr),
9516 nla_len(attr),
9517 &request->rates[band]);
9518 if (err)
9519 goto out_free;
9520 }
9521 }
9522
9523 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9524 request->duration =
9525 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9526 request->duration_mandatory =
9527 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9528 }
9529
9530 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9531 false);
9532 if (err)
9533 goto out_free;
9534
9535 request->no_cck =
9536 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9537
9538 /* Initial implementation used NL80211_ATTR_MAC to set the specific
9539 * BSSID to scan for. This was problematic because that same attribute
9540 * was already used for another purpose (local random MAC address). The
9541 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9542 * compatibility with older userspace components, also use the
9543 * NL80211_ATTR_MAC value here if it can be determined to be used for
9544 * the specific BSSID use case instead of the random MAC address
9545 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9546 */
9547 if (info->attrs[NL80211_ATTR_BSSID])
9548 memcpy(request->bssid,
9549 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9550 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9551 info->attrs[NL80211_ATTR_MAC])
9552 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9553 ETH_ALEN);
9554 else
9555 eth_broadcast_addr(request->bssid);
9556
9557 request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs);
9558 request->wdev = wdev;
9559 request->wiphy = &rdev->wiphy;
9560 request->scan_start = jiffies;
9561
9562 rdev->scan_req = request;
9563 err = cfg80211_scan(rdev);
9564
9565 if (err)
9566 goto out_free;
9567
9568 nl80211_send_scan_start(rdev, wdev);
9569 dev_hold(wdev->netdev);
9570
9571 return 0;
9572
9573 out_free:
9574 rdev->scan_req = NULL;
9575 kfree(request);
9576
9577 return err;
9578 }
9579
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)9580 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9581 {
9582 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9583 struct wireless_dev *wdev = info->user_ptr[1];
9584
9585 if (!rdev->ops->abort_scan)
9586 return -EOPNOTSUPP;
9587
9588 if (rdev->scan_msg)
9589 return 0;
9590
9591 if (!rdev->scan_req)
9592 return -ENOENT;
9593
9594 rdev_abort_scan(rdev, wdev);
9595 return 0;
9596 }
9597
9598 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)9599 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9600 struct cfg80211_sched_scan_request *request,
9601 struct nlattr **attrs)
9602 {
9603 int tmp, err, i = 0;
9604 struct nlattr *attr;
9605
9606 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9607 u32 interval;
9608
9609 /*
9610 * If scan plans are not specified,
9611 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9612 * case one scan plan will be set with the specified scan
9613 * interval and infinite number of iterations.
9614 */
9615 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9616 if (!interval)
9617 return -EINVAL;
9618
9619 request->scan_plans[0].interval =
9620 DIV_ROUND_UP(interval, MSEC_PER_SEC);
9621 if (!request->scan_plans[0].interval)
9622 return -EINVAL;
9623
9624 if (request->scan_plans[0].interval >
9625 wiphy->max_sched_scan_plan_interval)
9626 request->scan_plans[0].interval =
9627 wiphy->max_sched_scan_plan_interval;
9628
9629 return 0;
9630 }
9631
9632 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9633 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9634
9635 if (WARN_ON(i >= n_plans))
9636 return -EINVAL;
9637
9638 err = nla_parse_nested_deprecated(plan,
9639 NL80211_SCHED_SCAN_PLAN_MAX,
9640 attr, nl80211_plan_policy,
9641 NULL);
9642 if (err)
9643 return err;
9644
9645 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9646 return -EINVAL;
9647
9648 request->scan_plans[i].interval =
9649 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9650 if (!request->scan_plans[i].interval ||
9651 request->scan_plans[i].interval >
9652 wiphy->max_sched_scan_plan_interval)
9653 return -EINVAL;
9654
9655 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9656 request->scan_plans[i].iterations =
9657 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9658 if (!request->scan_plans[i].iterations ||
9659 (request->scan_plans[i].iterations >
9660 wiphy->max_sched_scan_plan_iterations))
9661 return -EINVAL;
9662 } else if (i < n_plans - 1) {
9663 /*
9664 * All scan plans but the last one must specify
9665 * a finite number of iterations
9666 */
9667 return -EINVAL;
9668 }
9669
9670 i++;
9671 }
9672
9673 /*
9674 * The last scan plan must not specify the number of
9675 * iterations, it is supposed to run infinitely
9676 */
9677 if (request->scan_plans[n_plans - 1].iterations)
9678 return -EINVAL;
9679
9680 return 0;
9681 }
9682
9683 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)9684 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9685 struct nlattr **attrs, int max_match_sets)
9686 {
9687 struct cfg80211_sched_scan_request *request;
9688 struct nlattr *attr;
9689 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9690 enum nl80211_band band;
9691 size_t ie_len, size;
9692 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9693 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9694
9695 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9696 n_channels = validate_scan_freqs(
9697 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9698 if (!n_channels)
9699 return ERR_PTR(-EINVAL);
9700 } else {
9701 n_channels = ieee80211_get_num_supported_channels(wiphy);
9702 }
9703
9704 if (attrs[NL80211_ATTR_SCAN_SSIDS])
9705 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9706 tmp)
9707 n_ssids++;
9708
9709 if (n_ssids > wiphy->max_sched_scan_ssids)
9710 return ERR_PTR(-EINVAL);
9711
9712 /*
9713 * First, count the number of 'real' matchsets. Due to an issue with
9714 * the old implementation, matchsets containing only the RSSI attribute
9715 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9716 * RSSI for all matchsets, rather than their own matchset for reporting
9717 * all APs with a strong RSSI. This is needed to be compatible with
9718 * older userspace that treated a matchset with only the RSSI as the
9719 * global RSSI for all other matchsets - if there are other matchsets.
9720 */
9721 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9722 nla_for_each_nested(attr,
9723 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9724 tmp) {
9725 struct nlattr *rssi;
9726
9727 err = nla_parse_nested_deprecated(tb,
9728 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9729 attr,
9730 nl80211_match_policy,
9731 NULL);
9732 if (err)
9733 return ERR_PTR(err);
9734
9735 /* SSID and BSSID are mutually exclusive */
9736 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9737 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9738 return ERR_PTR(-EINVAL);
9739
9740 /* add other standalone attributes here */
9741 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9742 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9743 n_match_sets++;
9744 continue;
9745 }
9746 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9747 if (rssi)
9748 default_match_rssi = nla_get_s32(rssi);
9749 }
9750 }
9751
9752 /* However, if there's no other matchset, add the RSSI one */
9753 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9754 n_match_sets = 1;
9755
9756 if (n_match_sets > max_match_sets)
9757 return ERR_PTR(-EINVAL);
9758
9759 if (attrs[NL80211_ATTR_IE])
9760 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9761 else
9762 ie_len = 0;
9763
9764 if (ie_len > wiphy->max_sched_scan_ie_len)
9765 return ERR_PTR(-EINVAL);
9766
9767 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9768 /*
9769 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9770 * each scan plan already specifies its own interval
9771 */
9772 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9773 return ERR_PTR(-EINVAL);
9774
9775 nla_for_each_nested(attr,
9776 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9777 n_plans++;
9778 } else {
9779 /*
9780 * The scan interval attribute is kept for backward
9781 * compatibility. If no scan plans are specified and sched scan
9782 * interval is specified, one scan plan will be set with this
9783 * scan interval and infinite number of iterations.
9784 */
9785 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9786 return ERR_PTR(-EINVAL);
9787
9788 n_plans = 1;
9789 }
9790
9791 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9792 return ERR_PTR(-EINVAL);
9793
9794 if (!wiphy_ext_feature_isset(
9795 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9796 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9797 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9798 return ERR_PTR(-EINVAL);
9799
9800 size = struct_size(request, channels, n_channels);
9801 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9802 size = size_add(size, array_size(sizeof(*request->match_sets),
9803 n_match_sets));
9804 size = size_add(size, array_size(sizeof(*request->scan_plans),
9805 n_plans));
9806 size = size_add(size, ie_len);
9807 request = kzalloc(size, GFP_KERNEL);
9808 if (!request)
9809 return ERR_PTR(-ENOMEM);
9810 request->n_channels = n_channels;
9811
9812 if (n_ssids)
9813 request->ssids = (void *)request +
9814 struct_size(request, channels, n_channels);
9815 request->n_ssids = n_ssids;
9816 if (ie_len) {
9817 if (n_ssids)
9818 request->ie = (void *)(request->ssids + n_ssids);
9819 else
9820 request->ie = (void *)(request->channels + n_channels);
9821 }
9822
9823 if (n_match_sets) {
9824 if (request->ie)
9825 request->match_sets = (void *)(request->ie + ie_len);
9826 else if (n_ssids)
9827 request->match_sets =
9828 (void *)(request->ssids + n_ssids);
9829 else
9830 request->match_sets =
9831 (void *)(request->channels + n_channels);
9832 }
9833 request->n_match_sets = n_match_sets;
9834
9835 if (n_match_sets)
9836 request->scan_plans = (void *)(request->match_sets +
9837 n_match_sets);
9838 else if (request->ie)
9839 request->scan_plans = (void *)(request->ie + ie_len);
9840 else if (n_ssids)
9841 request->scan_plans = (void *)(request->ssids + n_ssids);
9842 else
9843 request->scan_plans = (void *)(request->channels + n_channels);
9844
9845 request->n_scan_plans = n_plans;
9846
9847 i = 0;
9848 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9849 /* user specified, bail out if channel not found */
9850 nla_for_each_nested(attr,
9851 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9852 tmp) {
9853 struct ieee80211_channel *chan;
9854
9855 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9856
9857 if (!chan) {
9858 err = -EINVAL;
9859 goto out_free;
9860 }
9861
9862 /* ignore disabled channels */
9863 if (chan->flags & IEEE80211_CHAN_DISABLED)
9864 continue;
9865
9866 request->channels[i] = chan;
9867 i++;
9868 }
9869 } else {
9870 /* all channels */
9871 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9872 int j;
9873
9874 if (!wiphy->bands[band])
9875 continue;
9876 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9877 struct ieee80211_channel *chan;
9878
9879 chan = &wiphy->bands[band]->channels[j];
9880
9881 if (chan->flags & IEEE80211_CHAN_DISABLED)
9882 continue;
9883
9884 request->channels[i] = chan;
9885 i++;
9886 }
9887 }
9888 }
9889
9890 if (!i) {
9891 err = -EINVAL;
9892 goto out_free;
9893 }
9894
9895 request->n_channels = i;
9896
9897 i = 0;
9898 if (n_ssids) {
9899 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9900 tmp) {
9901 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9902 err = -EINVAL;
9903 goto out_free;
9904 }
9905 request->ssids[i].ssid_len = nla_len(attr);
9906 memcpy(request->ssids[i].ssid, nla_data(attr),
9907 nla_len(attr));
9908 i++;
9909 }
9910 }
9911
9912 i = 0;
9913 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9914 nla_for_each_nested(attr,
9915 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9916 tmp) {
9917 struct nlattr *ssid, *bssid, *rssi;
9918
9919 err = nla_parse_nested_deprecated(tb,
9920 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9921 attr,
9922 nl80211_match_policy,
9923 NULL);
9924 if (err)
9925 goto out_free;
9926 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9927 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9928
9929 if (!ssid && !bssid) {
9930 i++;
9931 continue;
9932 }
9933
9934 if (WARN_ON(i >= n_match_sets)) {
9935 /* this indicates a programming error,
9936 * the loop above should have verified
9937 * things properly
9938 */
9939 err = -EINVAL;
9940 goto out_free;
9941 }
9942
9943 if (ssid) {
9944 memcpy(request->match_sets[i].ssid.ssid,
9945 nla_data(ssid), nla_len(ssid));
9946 request->match_sets[i].ssid.ssid_len =
9947 nla_len(ssid);
9948 }
9949 if (bssid)
9950 memcpy(request->match_sets[i].bssid,
9951 nla_data(bssid), ETH_ALEN);
9952
9953 /* special attribute - old implementation w/a */
9954 request->match_sets[i].rssi_thold = default_match_rssi;
9955 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9956 if (rssi)
9957 request->match_sets[i].rssi_thold =
9958 nla_get_s32(rssi);
9959 i++;
9960 }
9961
9962 /* there was no other matchset, so the RSSI one is alone */
9963 if (i == 0 && n_match_sets)
9964 request->match_sets[0].rssi_thold = default_match_rssi;
9965
9966 request->min_rssi_thold = INT_MAX;
9967 for (i = 0; i < n_match_sets; i++)
9968 request->min_rssi_thold =
9969 min(request->match_sets[i].rssi_thold,
9970 request->min_rssi_thold);
9971 } else {
9972 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9973 }
9974
9975 if (ie_len) {
9976 request->ie_len = ie_len;
9977 memcpy((void *)request->ie,
9978 nla_data(attrs[NL80211_ATTR_IE]),
9979 request->ie_len);
9980 }
9981
9982 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9983 if (err)
9984 goto out_free;
9985
9986 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9987 request->delay =
9988 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9989
9990 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9991 request->relative_rssi = nla_get_s8(
9992 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9993 request->relative_rssi_set = true;
9994 }
9995
9996 if (request->relative_rssi_set &&
9997 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9998 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9999
10000 rssi_adjust = nla_data(
10001 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
10002 request->rssi_adjust.band = rssi_adjust->band;
10003 request->rssi_adjust.delta = rssi_adjust->delta;
10004 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
10005 err = -EINVAL;
10006 goto out_free;
10007 }
10008 }
10009
10010 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
10011 if (err)
10012 goto out_free;
10013
10014 request->scan_start = jiffies;
10015
10016 return request;
10017
10018 out_free:
10019 kfree(request);
10020 return ERR_PTR(err);
10021 }
10022
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)10023 static int nl80211_start_sched_scan(struct sk_buff *skb,
10024 struct genl_info *info)
10025 {
10026 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10027 struct net_device *dev = info->user_ptr[1];
10028 struct wireless_dev *wdev = dev->ieee80211_ptr;
10029 struct cfg80211_sched_scan_request *sched_scan_req;
10030 bool want_multi;
10031 int err;
10032
10033 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
10034 return -EOPNOTSUPP;
10035
10036 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
10037 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
10038 if (err)
10039 return err;
10040
10041 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
10042 info->attrs,
10043 rdev->wiphy.max_match_sets);
10044
10045 err = PTR_ERR_OR_ZERO(sched_scan_req);
10046 if (err)
10047 goto out_err;
10048
10049 /* leave request id zero for legacy request
10050 * or if driver does not support multi-scheduled scan
10051 */
10052 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
10053 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
10054
10055 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
10056 if (err)
10057 goto out_free;
10058
10059 sched_scan_req->dev = dev;
10060 sched_scan_req->wiphy = &rdev->wiphy;
10061
10062 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10063 sched_scan_req->owner_nlportid = info->snd_portid;
10064
10065 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
10066
10067 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
10068 return 0;
10069
10070 out_free:
10071 kfree(sched_scan_req);
10072 out_err:
10073 return err;
10074 }
10075
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)10076 static int nl80211_stop_sched_scan(struct sk_buff *skb,
10077 struct genl_info *info)
10078 {
10079 struct cfg80211_sched_scan_request *req;
10080 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10081 u64 cookie;
10082
10083 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
10084 return -EOPNOTSUPP;
10085
10086 if (info->attrs[NL80211_ATTR_COOKIE]) {
10087 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10088 return __cfg80211_stop_sched_scan(rdev, cookie, false);
10089 }
10090
10091 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
10092 struct cfg80211_sched_scan_request,
10093 list);
10094 if (!req || req->reqid ||
10095 (req->owner_nlportid &&
10096 req->owner_nlportid != info->snd_portid))
10097 return -ENOENT;
10098
10099 return cfg80211_stop_sched_scan_req(rdev, req, false);
10100 }
10101
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)10102 static int nl80211_start_radar_detection(struct sk_buff *skb,
10103 struct genl_info *info)
10104 {
10105 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10106 struct net_device *dev = info->user_ptr[1];
10107 struct wireless_dev *wdev = dev->ieee80211_ptr;
10108 int link_id = nl80211_link_id(info->attrs);
10109 struct wiphy *wiphy = wdev->wiphy;
10110 struct cfg80211_chan_def chandef;
10111 enum nl80211_dfs_regions dfs_region;
10112 unsigned int cac_time_ms;
10113 int err;
10114
10115 flush_delayed_work(&rdev->dfs_update_channels_wk);
10116
10117 switch (wdev->iftype) {
10118 case NL80211_IFTYPE_AP:
10119 case NL80211_IFTYPE_P2P_GO:
10120 case NL80211_IFTYPE_MESH_POINT:
10121 case NL80211_IFTYPE_ADHOC:
10122 break;
10123 default:
10124 /* caution - see cfg80211_beaconing_iface_active() below */
10125 return -EINVAL;
10126 }
10127
10128 guard(wiphy)(wiphy);
10129
10130 dfs_region = reg_get_dfs_region(wiphy);
10131 if (dfs_region == NL80211_DFS_UNSET)
10132 return -EINVAL;
10133
10134 err = nl80211_parse_chandef(rdev, info, &chandef);
10135 if (err)
10136 return err;
10137
10138 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10139 if (err < 0)
10140 return err;
10141
10142 if (err == 0)
10143 return -EINVAL;
10144
10145 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
10146 return -EINVAL;
10147
10148 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
10149 return cfg80211_start_background_radar_detection(rdev, wdev,
10150 &chandef);
10151
10152 if (cfg80211_beaconing_iface_active(wdev)) {
10153 /* During MLO other link(s) can beacon, only the current link
10154 * can not already beacon
10155 */
10156 if (wdev->valid_links &&
10157 !wdev->links[link_id].ap.beacon_interval) {
10158 /* nothing */
10159 } else {
10160 return -EBUSY;
10161 }
10162 }
10163
10164 if (wdev->links[link_id].cac_started)
10165 return -EBUSY;
10166
10167 /* CAC start is offloaded to HW and can't be started manually */
10168 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
10169 return -EOPNOTSUPP;
10170
10171 if (!rdev->ops->start_radar_detection)
10172 return -EOPNOTSUPP;
10173
10174 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
10175 if (WARN_ON(!cac_time_ms))
10176 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10177
10178 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
10179 link_id);
10180 if (err)
10181 return err;
10182
10183 switch (wdev->iftype) {
10184 case NL80211_IFTYPE_AP:
10185 case NL80211_IFTYPE_P2P_GO:
10186 wdev->links[link_id].ap.chandef = chandef;
10187 break;
10188 case NL80211_IFTYPE_ADHOC:
10189 wdev->u.ibss.chandef = chandef;
10190 break;
10191 case NL80211_IFTYPE_MESH_POINT:
10192 wdev->u.mesh.chandef = chandef;
10193 break;
10194 default:
10195 break;
10196 }
10197 wdev->links[link_id].cac_started = true;
10198 wdev->links[link_id].cac_start_time = jiffies;
10199 wdev->links[link_id].cac_time_ms = cac_time_ms;
10200
10201 return 0;
10202 }
10203
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)10204 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10205 struct genl_info *info)
10206 {
10207 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10208 struct net_device *dev = info->user_ptr[1];
10209 struct wireless_dev *wdev = dev->ieee80211_ptr;
10210 struct wiphy *wiphy = wdev->wiphy;
10211 struct cfg80211_chan_def chandef;
10212 enum nl80211_dfs_regions dfs_region;
10213 int err;
10214
10215 dfs_region = reg_get_dfs_region(wiphy);
10216 if (dfs_region == NL80211_DFS_UNSET) {
10217 GENL_SET_ERR_MSG(info,
10218 "DFS Region is not set. Unexpected Radar indication");
10219 return -EINVAL;
10220 }
10221
10222 err = nl80211_parse_chandef(rdev, info, &chandef);
10223 if (err) {
10224 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10225 return err;
10226 }
10227
10228 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10229 if (err < 0) {
10230 GENL_SET_ERR_MSG(info, "chandef is invalid");
10231 return err;
10232 }
10233
10234 if (err == 0) {
10235 GENL_SET_ERR_MSG(info,
10236 "Unexpected Radar indication for chandef/iftype");
10237 return -EINVAL;
10238 }
10239
10240 /* Do not process this notification if radar is already detected
10241 * by kernel on this channel, and return success.
10242 */
10243 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10244 return 0;
10245
10246 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10247
10248 cfg80211_sched_dfs_chan_update(rdev);
10249
10250 rdev->radar_chandef = chandef;
10251
10252 /* Propagate this notification to other radios as well */
10253 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10254
10255 return 0;
10256 }
10257
nl80211_parse_counter_offsets(struct cfg80211_registered_device * rdev,const u8 * data,size_t datalen,int first_count,struct nlattr * attr,const u16 ** offsets,unsigned int * n_offsets)10258 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
10259 const u8 *data, size_t datalen,
10260 int first_count, struct nlattr *attr,
10261 const u16 **offsets, unsigned int *n_offsets)
10262 {
10263 int i;
10264
10265 *n_offsets = 0;
10266
10267 if (!attr)
10268 return 0;
10269
10270 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
10271 return -EINVAL;
10272
10273 *n_offsets = nla_len(attr) / sizeof(u16);
10274 if (rdev->wiphy.max_num_csa_counters &&
10275 (*n_offsets > rdev->wiphy.max_num_csa_counters))
10276 return -EINVAL;
10277
10278 *offsets = nla_data(attr);
10279
10280 /* sanity checks - counters should fit and be the same */
10281 for (i = 0; i < *n_offsets; i++) {
10282 u16 offset = (*offsets)[i];
10283
10284 if (offset >= datalen)
10285 return -EINVAL;
10286
10287 if (first_count != -1 && data[offset] != first_count)
10288 return -EINVAL;
10289 }
10290
10291 return 0;
10292 }
10293
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)10294 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10295 {
10296 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10297 unsigned int link_id = nl80211_link_id(info->attrs);
10298 struct net_device *dev = info->user_ptr[1];
10299 struct wireless_dev *wdev = dev->ieee80211_ptr;
10300 struct cfg80211_csa_settings params;
10301 struct nlattr **csa_attrs = NULL;
10302 int err;
10303 bool need_new_beacon = false;
10304 bool need_handle_dfs_flag = true;
10305 u32 cs_count;
10306
10307 if (!rdev->ops->channel_switch ||
10308 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10309 return -EOPNOTSUPP;
10310
10311 switch (dev->ieee80211_ptr->iftype) {
10312 case NL80211_IFTYPE_AP:
10313 case NL80211_IFTYPE_P2P_GO:
10314 need_new_beacon = true;
10315 /* For all modes except AP the handle_dfs flag needs to be
10316 * supplied to tell the kernel that userspace will handle radar
10317 * events when they happen. Otherwise a switch to a channel
10318 * requiring DFS will be rejected.
10319 */
10320 need_handle_dfs_flag = false;
10321
10322 /* useless if AP is not running */
10323 if (!wdev->links[link_id].ap.beacon_interval)
10324 return -ENOTCONN;
10325 break;
10326 case NL80211_IFTYPE_ADHOC:
10327 if (!wdev->u.ibss.ssid_len)
10328 return -ENOTCONN;
10329 break;
10330 case NL80211_IFTYPE_MESH_POINT:
10331 if (!wdev->u.mesh.id_len)
10332 return -ENOTCONN;
10333 break;
10334 default:
10335 return -EOPNOTSUPP;
10336 }
10337
10338 memset(¶ms, 0, sizeof(params));
10339 params.beacon_csa.ftm_responder = -1;
10340
10341 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10342 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10343 return -EINVAL;
10344
10345 /* only important for AP, IBSS and mesh create IEs internally */
10346 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10347 return -EINVAL;
10348
10349 /* Even though the attribute is u32, the specification says
10350 * u8, so let's make sure we don't overflow.
10351 */
10352 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10353 if (cs_count > 255)
10354 return -EINVAL;
10355
10356 params.count = cs_count;
10357
10358 if (!need_new_beacon)
10359 goto skip_beacons;
10360
10361 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
10362 info->extack);
10363 if (err)
10364 goto free;
10365
10366 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10367 GFP_KERNEL);
10368 if (!csa_attrs) {
10369 err = -ENOMEM;
10370 goto free;
10371 }
10372
10373 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10374 info->attrs[NL80211_ATTR_CSA_IES],
10375 nl80211_policy, info->extack);
10376 if (err)
10377 goto free;
10378
10379 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
10380 info->extack);
10381 if (err)
10382 goto free;
10383
10384 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10385 err = -EINVAL;
10386 goto free;
10387 }
10388
10389 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
10390 params.beacon_csa.tail_len,
10391 params.count,
10392 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
10393 ¶ms.counter_offsets_beacon,
10394 ¶ms.n_counter_offsets_beacon);
10395 if (err)
10396 goto free;
10397
10398 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
10399 params.beacon_csa.probe_resp_len,
10400 params.count,
10401 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
10402 ¶ms.counter_offsets_presp,
10403 ¶ms.n_counter_offsets_presp);
10404 if (err)
10405 goto free;
10406
10407 skip_beacons:
10408 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
10409 if (err)
10410 goto free;
10411
10412 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
10413 wdev->iftype)) {
10414 err = -EINVAL;
10415 goto free;
10416 }
10417
10418 err = cfg80211_chandef_dfs_required(wdev->wiphy,
10419 ¶ms.chandef,
10420 wdev->iftype);
10421 if (err < 0)
10422 goto free;
10423
10424 if (err > 0) {
10425 params.radar_required = true;
10426 if (need_handle_dfs_flag &&
10427 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10428 err = -EINVAL;
10429 goto free;
10430 }
10431 }
10432
10433 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10434 params.block_tx = true;
10435
10436 params.link_id = link_id;
10437 err = rdev_channel_switch(rdev, dev, ¶ms);
10438
10439 free:
10440 kfree(params.beacon_after.mbssid_ies);
10441 kfree(params.beacon_csa.mbssid_ies);
10442 kfree(params.beacon_after.rnr_ies);
10443 kfree(params.beacon_csa.rnr_ies);
10444 kfree(csa_attrs);
10445 return err;
10446 }
10447
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)10448 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10449 u32 seq, int flags,
10450 struct cfg80211_registered_device *rdev,
10451 struct wireless_dev *wdev,
10452 struct cfg80211_internal_bss *intbss)
10453 {
10454 struct cfg80211_bss *res = &intbss->pub;
10455 const struct cfg80211_bss_ies *ies;
10456 unsigned int link_id;
10457 void *hdr;
10458 struct nlattr *bss;
10459
10460 lockdep_assert_wiphy(wdev->wiphy);
10461
10462 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10463 NL80211_CMD_NEW_SCAN_RESULTS);
10464 if (!hdr)
10465 return -1;
10466
10467 genl_dump_check_consistent(cb, hdr);
10468
10469 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10470 goto nla_put_failure;
10471 if (wdev->netdev &&
10472 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10473 goto nla_put_failure;
10474 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10475 NL80211_ATTR_PAD))
10476 goto nla_put_failure;
10477
10478 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10479 if (!bss)
10480 goto nla_put_failure;
10481 if ((!is_zero_ether_addr(res->bssid) &&
10482 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10483 goto nla_put_failure;
10484
10485 rcu_read_lock();
10486 /* indicate whether we have probe response data or not */
10487 if (rcu_access_pointer(res->proberesp_ies) &&
10488 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10489 goto fail_unlock_rcu;
10490
10491 /* this pointer prefers to be pointed to probe response data
10492 * but is always valid
10493 */
10494 ies = rcu_dereference(res->ies);
10495 if (ies) {
10496 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10497 NL80211_BSS_PAD))
10498 goto fail_unlock_rcu;
10499 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10500 ies->len, ies->data))
10501 goto fail_unlock_rcu;
10502 }
10503
10504 /* and this pointer is always (unless driver didn't know) beacon data */
10505 ies = rcu_dereference(res->beacon_ies);
10506 if (ies && ies->from_beacon) {
10507 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10508 NL80211_BSS_PAD))
10509 goto fail_unlock_rcu;
10510 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10511 ies->len, ies->data))
10512 goto fail_unlock_rcu;
10513 }
10514 rcu_read_unlock();
10515
10516 if (res->beacon_interval &&
10517 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10518 goto nla_put_failure;
10519 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10520 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10521 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10522 res->channel->freq_offset) ||
10523 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10524 jiffies_to_msecs(jiffies - intbss->ts)))
10525 goto nla_put_failure;
10526
10527 if (intbss->parent_tsf &&
10528 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10529 intbss->parent_tsf, NL80211_BSS_PAD) ||
10530 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10531 intbss->parent_bssid)))
10532 goto nla_put_failure;
10533
10534 if (res->ts_boottime &&
10535 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10536 res->ts_boottime, NL80211_BSS_PAD))
10537 goto nla_put_failure;
10538
10539 if (!nl80211_put_signal(msg, intbss->pub.chains,
10540 intbss->pub.chain_signal,
10541 NL80211_BSS_CHAIN_SIGNAL))
10542 goto nla_put_failure;
10543
10544 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
10545 switch (rdev->wiphy.signal_type) {
10546 case CFG80211_SIGNAL_TYPE_MBM:
10547 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
10548 res->signal))
10549 goto nla_put_failure;
10550 break;
10551 case CFG80211_SIGNAL_TYPE_UNSPEC:
10552 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
10553 res->signal))
10554 goto nla_put_failure;
10555 break;
10556 default:
10557 break;
10558 }
10559 }
10560
10561 switch (wdev->iftype) {
10562 case NL80211_IFTYPE_P2P_CLIENT:
10563 case NL80211_IFTYPE_STATION:
10564 for_each_valid_link(wdev, link_id) {
10565 if (intbss == wdev->links[link_id].client.current_bss &&
10566 (nla_put_u32(msg, NL80211_BSS_STATUS,
10567 NL80211_BSS_STATUS_ASSOCIATED) ||
10568 (wdev->valid_links &&
10569 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10570 link_id) ||
10571 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10572 wdev->u.client.connected_addr)))))
10573 goto nla_put_failure;
10574 }
10575 break;
10576 case NL80211_IFTYPE_ADHOC:
10577 if (intbss == wdev->u.ibss.current_bss &&
10578 nla_put_u32(msg, NL80211_BSS_STATUS,
10579 NL80211_BSS_STATUS_IBSS_JOINED))
10580 goto nla_put_failure;
10581 break;
10582 default:
10583 break;
10584 }
10585
10586 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
10587 goto nla_put_failure;
10588
10589 if (res->cannot_use_reasons &&
10590 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
10591 res->cannot_use_reasons,
10592 NL80211_BSS_PAD))
10593 goto nla_put_failure;
10594
10595 nla_nest_end(msg, bss);
10596
10597 genlmsg_end(msg, hdr);
10598 return 0;
10599
10600 fail_unlock_rcu:
10601 rcu_read_unlock();
10602 nla_put_failure:
10603 genlmsg_cancel(msg, hdr);
10604 return -EMSGSIZE;
10605 }
10606
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)10607 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10608 {
10609 struct cfg80211_registered_device *rdev;
10610 struct cfg80211_internal_bss *scan;
10611 struct wireless_dev *wdev;
10612 struct nlattr **attrbuf;
10613 int start = cb->args[2], idx = 0;
10614 bool dump_include_use_data;
10615 int err;
10616
10617 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10618 if (!attrbuf)
10619 return -ENOMEM;
10620
10621 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10622 if (err) {
10623 kfree(attrbuf);
10624 return err;
10625 }
10626 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10627 __acquire(&rdev->wiphy.mtx);
10628
10629 dump_include_use_data =
10630 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
10631 kfree(attrbuf);
10632
10633 spin_lock_bh(&rdev->bss_lock);
10634
10635 /*
10636 * dump_scan will be called multiple times to break up the scan results
10637 * into multiple messages. It is unlikely that any more bss-es will be
10638 * expired after the first call, so only call only call this on the
10639 * first dump_scan invocation.
10640 */
10641 if (start == 0)
10642 cfg80211_bss_expire(rdev);
10643
10644 cb->seq = rdev->bss_generation;
10645
10646 list_for_each_entry(scan, &rdev->bss_list, list) {
10647 if (++idx <= start)
10648 continue;
10649 if (!dump_include_use_data &&
10650 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
10651 continue;
10652 if (nl80211_send_bss(skb, cb,
10653 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10654 rdev, wdev, scan) < 0) {
10655 idx--;
10656 break;
10657 }
10658 }
10659
10660 spin_unlock_bh(&rdev->bss_lock);
10661
10662 cb->args[2] = idx;
10663 wiphy_unlock(&rdev->wiphy);
10664
10665 return skb->len;
10666 }
10667
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)10668 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10669 int flags, struct net_device *dev,
10670 bool allow_radio_stats,
10671 struct survey_info *survey)
10672 {
10673 void *hdr;
10674 struct nlattr *infoattr;
10675
10676 /* skip radio stats if userspace didn't request them */
10677 if (!survey->channel && !allow_radio_stats)
10678 return 0;
10679
10680 hdr = nl80211hdr_put(msg, portid, seq, flags,
10681 NL80211_CMD_NEW_SURVEY_RESULTS);
10682 if (!hdr)
10683 return -ENOMEM;
10684
10685 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10686 goto nla_put_failure;
10687
10688 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10689 if (!infoattr)
10690 goto nla_put_failure;
10691
10692 if (survey->channel &&
10693 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10694 survey->channel->center_freq))
10695 goto nla_put_failure;
10696
10697 if (survey->channel && survey->channel->freq_offset &&
10698 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10699 survey->channel->freq_offset))
10700 goto nla_put_failure;
10701
10702 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10703 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10704 goto nla_put_failure;
10705 if ((survey->filled & SURVEY_INFO_IN_USE) &&
10706 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10707 goto nla_put_failure;
10708 if ((survey->filled & SURVEY_INFO_TIME) &&
10709 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10710 survey->time, NL80211_SURVEY_INFO_PAD))
10711 goto nla_put_failure;
10712 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10713 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10714 survey->time_busy, NL80211_SURVEY_INFO_PAD))
10715 goto nla_put_failure;
10716 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10717 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10718 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10719 goto nla_put_failure;
10720 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10721 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10722 survey->time_rx, NL80211_SURVEY_INFO_PAD))
10723 goto nla_put_failure;
10724 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10725 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10726 survey->time_tx, NL80211_SURVEY_INFO_PAD))
10727 goto nla_put_failure;
10728 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10729 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10730 survey->time_scan, NL80211_SURVEY_INFO_PAD))
10731 goto nla_put_failure;
10732 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10733 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10734 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10735 goto nla_put_failure;
10736
10737 nla_nest_end(msg, infoattr);
10738
10739 genlmsg_end(msg, hdr);
10740 return 0;
10741
10742 nla_put_failure:
10743 genlmsg_cancel(msg, hdr);
10744 return -EMSGSIZE;
10745 }
10746
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)10747 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10748 {
10749 struct nlattr **attrbuf;
10750 struct survey_info survey;
10751 struct cfg80211_registered_device *rdev;
10752 struct wireless_dev *wdev;
10753 int survey_idx = cb->args[2];
10754 int res;
10755 bool radio_stats;
10756
10757 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10758 if (!attrbuf)
10759 return -ENOMEM;
10760
10761 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10762 if (res) {
10763 kfree(attrbuf);
10764 return res;
10765 }
10766 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10767 __acquire(&rdev->wiphy.mtx);
10768
10769 /* prepare_wdev_dump parsed the attributes */
10770 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10771
10772 if (!wdev->netdev) {
10773 res = -EINVAL;
10774 goto out_err;
10775 }
10776
10777 if (!rdev->ops->dump_survey) {
10778 res = -EOPNOTSUPP;
10779 goto out_err;
10780 }
10781
10782 while (1) {
10783 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10784 if (res == -ENOENT)
10785 break;
10786 if (res)
10787 goto out_err;
10788
10789 /* don't send disabled channels, but do send non-channel data */
10790 if (survey.channel &&
10791 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10792 survey_idx++;
10793 continue;
10794 }
10795
10796 if (nl80211_send_survey(skb,
10797 NETLINK_CB(cb->skb).portid,
10798 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10799 wdev->netdev, radio_stats, &survey) < 0)
10800 goto out;
10801 survey_idx++;
10802 }
10803
10804 out:
10805 cb->args[2] = survey_idx;
10806 res = skb->len;
10807 out_err:
10808 kfree(attrbuf);
10809 wiphy_unlock(&rdev->wiphy);
10810 return res;
10811 }
10812
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)10813 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10814 {
10815 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10816 struct net_device *dev = info->user_ptr[1];
10817 struct ieee80211_channel *chan;
10818 const u8 *bssid, *ssid;
10819 int err, ssid_len;
10820 enum nl80211_auth_type auth_type;
10821 struct key_parse key;
10822 bool local_state_change;
10823 struct cfg80211_auth_request req = {};
10824 u32 freq;
10825
10826 if (!info->attrs[NL80211_ATTR_MAC])
10827 return -EINVAL;
10828
10829 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10830 return -EINVAL;
10831
10832 if (!info->attrs[NL80211_ATTR_SSID])
10833 return -EINVAL;
10834
10835 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10836 return -EINVAL;
10837
10838 err = nl80211_parse_key(info, &key);
10839 if (err)
10840 return err;
10841
10842 if (key.idx >= 0) {
10843 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10844 return -EINVAL;
10845 if (!key.p.key || !key.p.key_len)
10846 return -EINVAL;
10847 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10848 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10849 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10850 key.p.key_len != WLAN_KEY_LEN_WEP104))
10851 return -EINVAL;
10852 if (key.idx > 3)
10853 return -EINVAL;
10854 } else {
10855 key.p.key_len = 0;
10856 key.p.key = NULL;
10857 }
10858
10859 if (key.idx >= 0) {
10860 int i;
10861 bool ok = false;
10862
10863 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10864 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10865 ok = true;
10866 break;
10867 }
10868 }
10869 if (!ok)
10870 return -EINVAL;
10871 }
10872
10873 if (!rdev->ops->auth)
10874 return -EOPNOTSUPP;
10875
10876 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10877 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10878 return -EOPNOTSUPP;
10879
10880 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10881 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10882 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10883 freq +=
10884 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10885
10886 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10887 if (!chan)
10888 return -EINVAL;
10889
10890 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10891 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10892
10893 if (info->attrs[NL80211_ATTR_IE]) {
10894 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10895 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10896 }
10897
10898 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
10899 req.supported_selectors =
10900 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10901 req.supported_selectors_len =
10902 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10903 }
10904
10905 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10906 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10907 return -EINVAL;
10908
10909 if ((auth_type == NL80211_AUTHTYPE_SAE ||
10910 auth_type == NL80211_AUTHTYPE_FILS_SK ||
10911 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10912 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10913 !info->attrs[NL80211_ATTR_AUTH_DATA])
10914 return -EINVAL;
10915
10916 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10917 if (auth_type != NL80211_AUTHTYPE_SAE &&
10918 auth_type != NL80211_AUTHTYPE_FILS_SK &&
10919 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10920 auth_type != NL80211_AUTHTYPE_FILS_PK)
10921 return -EINVAL;
10922 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10923 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10924 }
10925
10926 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10927
10928 /*
10929 * Since we no longer track auth state, ignore
10930 * requests to only change local state.
10931 */
10932 if (local_state_change)
10933 return 0;
10934
10935 req.auth_type = auth_type;
10936 req.key = key.p.key;
10937 req.key_len = key.p.key_len;
10938 req.key_idx = key.idx;
10939 req.link_id = nl80211_link_id_or_invalid(info->attrs);
10940 if (req.link_id >= 0) {
10941 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10942 return -EINVAL;
10943 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10944 return -EINVAL;
10945 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10946 if (!is_valid_ether_addr(req.ap_mld_addr))
10947 return -EINVAL;
10948 }
10949
10950 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10951 IEEE80211_BSS_TYPE_ESS,
10952 IEEE80211_PRIVACY_ANY);
10953 if (!req.bss)
10954 return -ENOENT;
10955
10956 err = cfg80211_mlme_auth(rdev, dev, &req);
10957
10958 cfg80211_put_bss(&rdev->wiphy, req.bss);
10959
10960 return err;
10961 }
10962
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)10963 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10964 struct genl_info *info)
10965 {
10966 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10967 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10968 return -EINVAL;
10969 }
10970
10971 if (!rdev->ops->tx_control_port ||
10972 !wiphy_ext_feature_isset(&rdev->wiphy,
10973 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10974 return -EOPNOTSUPP;
10975
10976 return 0;
10977 }
10978
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)10979 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10980 struct genl_info *info,
10981 struct cfg80211_crypto_settings *settings,
10982 int cipher_limit)
10983 {
10984 memset(settings, 0, sizeof(*settings));
10985
10986 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10987
10988 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10989 u16 proto;
10990
10991 proto = nla_get_u16(
10992 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10993 settings->control_port_ethertype = cpu_to_be16(proto);
10994 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10995 proto != ETH_P_PAE)
10996 return -EINVAL;
10997 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10998 settings->control_port_no_encrypt = true;
10999 } else
11000 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
11001
11002 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11003 int r = validate_pae_over_nl80211(rdev, info);
11004
11005 if (r < 0)
11006 return r;
11007
11008 settings->control_port_over_nl80211 = true;
11009
11010 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
11011 settings->control_port_no_preauth = true;
11012 }
11013
11014 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
11015 void *data;
11016 int len, i;
11017
11018 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11019 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11020 settings->n_ciphers_pairwise = len / sizeof(u32);
11021
11022 if (len % sizeof(u32))
11023 return -EINVAL;
11024
11025 if (settings->n_ciphers_pairwise > cipher_limit)
11026 return -EINVAL;
11027
11028 memcpy(settings->ciphers_pairwise, data, len);
11029
11030 for (i = 0; i < settings->n_ciphers_pairwise; i++)
11031 if (!cfg80211_supported_cipher_suite(
11032 &rdev->wiphy,
11033 settings->ciphers_pairwise[i]))
11034 return -EINVAL;
11035 }
11036
11037 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
11038 settings->cipher_group =
11039 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
11040 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
11041 settings->cipher_group))
11042 return -EINVAL;
11043 }
11044
11045 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
11046 settings->wpa_versions =
11047 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
11048
11049 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
11050 void *data;
11051 int len;
11052
11053 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
11054 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
11055 settings->n_akm_suites = len / sizeof(u32);
11056
11057 if (len % sizeof(u32))
11058 return -EINVAL;
11059
11060 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
11061 return -EINVAL;
11062
11063 memcpy(settings->akm_suites, data, len);
11064 }
11065
11066 if (info->attrs[NL80211_ATTR_PMK]) {
11067 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
11068 return -EINVAL;
11069 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11070 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
11071 !wiphy_ext_feature_isset(&rdev->wiphy,
11072 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
11073 return -EINVAL;
11074 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11075 }
11076
11077 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
11078 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11079 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
11080 !wiphy_ext_feature_isset(&rdev->wiphy,
11081 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
11082 return -EINVAL;
11083 settings->sae_pwd =
11084 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11085 settings->sae_pwd_len =
11086 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11087 }
11088
11089 settings->sae_pwe =
11090 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
11091 NL80211_SAE_PWE_UNSPECIFIED);
11092
11093 return 0;
11094 }
11095
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs,int assoc_link_id,int link_id)11096 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
11097 const u8 *ssid, int ssid_len,
11098 struct nlattr **attrs,
11099 int assoc_link_id, int link_id)
11100 {
11101 struct ieee80211_channel *chan;
11102 struct cfg80211_bss *bss;
11103 const u8 *bssid;
11104 u32 freq, use_for = 0;
11105
11106 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
11107 return ERR_PTR(-EINVAL);
11108
11109 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
11110
11111 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
11112 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11113 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11114
11115 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11116 if (!chan)
11117 return ERR_PTR(-EINVAL);
11118
11119 if (assoc_link_id >= 0)
11120 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
11121 if (assoc_link_id == link_id)
11122 use_for |= NL80211_BSS_USE_FOR_NORMAL;
11123
11124 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
11125 ssid, ssid_len,
11126 IEEE80211_BSS_TYPE_ESS,
11127 IEEE80211_PRIVACY_ANY,
11128 use_for);
11129 if (!bss)
11130 return ERR_PTR(-ENOENT);
11131
11132 return bss;
11133 }
11134
nl80211_process_links(struct cfg80211_registered_device * rdev,struct cfg80211_assoc_link * links,int assoc_link_id,const u8 * ssid,int ssid_len,struct genl_info * info)11135 static int nl80211_process_links(struct cfg80211_registered_device *rdev,
11136 struct cfg80211_assoc_link *links,
11137 int assoc_link_id,
11138 const u8 *ssid, int ssid_len,
11139 struct genl_info *info)
11140 {
11141 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
11142 struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
11143 struct nlattr *link;
11144 unsigned int link_id;
11145 int rem, err;
11146
11147 if (!attrs)
11148 return -ENOMEM;
11149
11150 nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
11151 memset(attrs, 0, attrsize);
11152
11153 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
11154
11155 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11156 NL_SET_BAD_ATTR(info->extack, link);
11157 return -EINVAL;
11158 }
11159
11160 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11161 /* cannot use the same link ID again */
11162 if (links[link_id].bss) {
11163 NL_SET_BAD_ATTR(info->extack, link);
11164 return -EINVAL;
11165 }
11166 links[link_id].bss =
11167 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
11168 assoc_link_id, link_id);
11169 if (IS_ERR(links[link_id].bss)) {
11170 err = PTR_ERR(links[link_id].bss);
11171 links[link_id].bss = NULL;
11172 NL_SET_ERR_MSG_ATTR(info->extack, link,
11173 "Error fetching BSS for link");
11174 return err;
11175 }
11176
11177 if (attrs[NL80211_ATTR_IE]) {
11178 links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
11179 links[link_id].elems_len =
11180 nla_len(attrs[NL80211_ATTR_IE]);
11181
11182 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11183 links[link_id].elems,
11184 links[link_id].elems_len)) {
11185 NL_SET_ERR_MSG_ATTR(info->extack,
11186 attrs[NL80211_ATTR_IE],
11187 "cannot deal with fragmentation");
11188 return -EINVAL;
11189 }
11190
11191 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11192 links[link_id].elems,
11193 links[link_id].elems_len)) {
11194 NL_SET_ERR_MSG_ATTR(info->extack,
11195 attrs[NL80211_ATTR_IE],
11196 "cannot deal with non-inheritance");
11197 return -EINVAL;
11198 }
11199 }
11200
11201 links[link_id].disabled =
11202 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11203 }
11204
11205 return 0;
11206 }
11207
nl80211_associate(struct sk_buff * skb,struct genl_info * info)11208 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
11209 {
11210 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11211 struct net_device *dev = info->user_ptr[1];
11212 struct cfg80211_assoc_request req = {};
11213 const u8 *ap_addr, *ssid;
11214 unsigned int link_id;
11215 int err, ssid_len;
11216
11217 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11218 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11219 return -EPERM;
11220
11221 if (!info->attrs[NL80211_ATTR_SSID])
11222 return -EINVAL;
11223
11224 if (!rdev->ops->assoc)
11225 return -EOPNOTSUPP;
11226
11227 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11228 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11229 return -EOPNOTSUPP;
11230
11231 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11232 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11233
11234 if (info->attrs[NL80211_ATTR_IE]) {
11235 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11236 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11237
11238 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11239 req.ie, req.ie_len)) {
11240 NL_SET_ERR_MSG_ATTR(info->extack,
11241 info->attrs[NL80211_ATTR_IE],
11242 "non-inheritance makes no sense");
11243 return -EINVAL;
11244 }
11245 }
11246
11247 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11248 enum nl80211_mfp mfp =
11249 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11250 if (mfp == NL80211_MFP_REQUIRED)
11251 req.use_mfp = true;
11252 else if (mfp != NL80211_MFP_NO)
11253 return -EINVAL;
11254 }
11255
11256 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11257 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11258
11259 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11260 req.supported_selectors =
11261 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11262 req.supported_selectors_len =
11263 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11264 }
11265
11266 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11267 req.flags |= ASSOC_REQ_DISABLE_HT;
11268
11269 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11270 memcpy(&req.ht_capa_mask,
11271 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11272 sizeof(req.ht_capa_mask));
11273
11274 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11275 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11276 return -EINVAL;
11277 memcpy(&req.ht_capa,
11278 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11279 sizeof(req.ht_capa));
11280 }
11281
11282 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11283 req.flags |= ASSOC_REQ_DISABLE_VHT;
11284
11285 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11286 req.flags |= ASSOC_REQ_DISABLE_HE;
11287
11288 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11289 req.flags |= ASSOC_REQ_DISABLE_EHT;
11290
11291 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11292 memcpy(&req.vht_capa_mask,
11293 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11294 sizeof(req.vht_capa_mask));
11295
11296 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11297 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11298 return -EINVAL;
11299 memcpy(&req.vht_capa,
11300 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11301 sizeof(req.vht_capa));
11302 }
11303
11304 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11305 if (!((rdev->wiphy.features &
11306 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11307 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11308 !wiphy_ext_feature_isset(&rdev->wiphy,
11309 NL80211_EXT_FEATURE_RRM))
11310 return -EINVAL;
11311 req.flags |= ASSOC_REQ_USE_RRM;
11312 }
11313
11314 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11315 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11316 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11317 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11318 return -EINVAL;
11319 req.fils_nonces =
11320 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11321 }
11322
11323 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11324 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11325 return -EINVAL;
11326 memcpy(&req.s1g_capa_mask,
11327 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11328 sizeof(req.s1g_capa_mask));
11329 }
11330
11331 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11332 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11333 return -EINVAL;
11334 memcpy(&req.s1g_capa,
11335 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11336 sizeof(req.s1g_capa));
11337 }
11338
11339 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
11340 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11341 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
11342 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
11343 return -EINVAL;
11344 }
11345 req.flags |= ASSOC_REQ_SPP_AMSDU;
11346 }
11347
11348 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11349
11350 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11351 if (req.link_id < 0)
11352 return -EINVAL;
11353
11354 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11355 return -EINVAL;
11356
11357 if (info->attrs[NL80211_ATTR_MAC] ||
11358 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11359 !info->attrs[NL80211_ATTR_MLD_ADDR])
11360 return -EINVAL;
11361
11362 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11363 ap_addr = req.ap_mld_addr;
11364
11365 err = nl80211_process_links(rdev, req.links, req.link_id,
11366 ssid, ssid_len, info);
11367 if (err)
11368 goto free;
11369
11370 if (!req.links[req.link_id].bss) {
11371 err = -EINVAL;
11372 goto free;
11373 }
11374
11375 if (req.links[req.link_id].elems_len) {
11376 GENL_SET_ERR_MSG(info,
11377 "cannot have per-link elems on assoc link");
11378 err = -EINVAL;
11379 goto free;
11380 }
11381
11382 if (req.links[req.link_id].disabled) {
11383 GENL_SET_ERR_MSG(info,
11384 "cannot have assoc link disabled");
11385 err = -EINVAL;
11386 goto free;
11387 }
11388
11389 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11390 req.ext_mld_capa_ops =
11391 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
11392 } else {
11393 if (req.link_id >= 0)
11394 return -EINVAL;
11395
11396 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
11397 -1, -1);
11398 if (IS_ERR(req.bss))
11399 return PTR_ERR(req.bss);
11400 ap_addr = req.bss->bssid;
11401
11402 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11403 return -EINVAL;
11404 }
11405
11406 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11407 if (!err) {
11408 struct nlattr *link;
11409 int rem = 0;
11410
11411 err = cfg80211_mlme_assoc(rdev, dev, &req,
11412 info->extack);
11413
11414 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11415 dev->ieee80211_ptr->conn_owner_nlportid =
11416 info->snd_portid;
11417 memcpy(dev->ieee80211_ptr->disconnect_bssid,
11418 ap_addr, ETH_ALEN);
11419 }
11420
11421 /* Report error from first problematic link */
11422 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11423 nla_for_each_nested(link,
11424 info->attrs[NL80211_ATTR_MLO_LINKS],
11425 rem) {
11426 struct nlattr *link_id_attr =
11427 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
11428
11429 if (!link_id_attr)
11430 continue;
11431
11432 link_id = nla_get_u8(link_id_attr);
11433
11434 if (link_id == req.link_id)
11435 continue;
11436
11437 if (!req.links[link_id].error ||
11438 WARN_ON(req.links[link_id].error > 0))
11439 continue;
11440
11441 WARN_ON(err >= 0);
11442
11443 NL_SET_BAD_ATTR(info->extack, link);
11444 err = req.links[link_id].error;
11445 break;
11446 }
11447 }
11448 }
11449
11450 free:
11451 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11452 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11453 cfg80211_put_bss(&rdev->wiphy, req.bss);
11454
11455 return err;
11456 }
11457
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)11458 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11459 {
11460 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11461 struct net_device *dev = info->user_ptr[1];
11462 const u8 *ie = NULL, *bssid;
11463 int ie_len = 0;
11464 u16 reason_code;
11465 bool local_state_change;
11466
11467 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11468 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11469 return -EPERM;
11470
11471 if (!info->attrs[NL80211_ATTR_MAC])
11472 return -EINVAL;
11473
11474 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11475 return -EINVAL;
11476
11477 if (!rdev->ops->deauth)
11478 return -EOPNOTSUPP;
11479
11480 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11481 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11482 return -EOPNOTSUPP;
11483
11484 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11485
11486 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11487 if (reason_code == 0) {
11488 /* Reason Code 0 is reserved */
11489 return -EINVAL;
11490 }
11491
11492 if (info->attrs[NL80211_ATTR_IE]) {
11493 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11494 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11495 }
11496
11497 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11498
11499 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11500 local_state_change);
11501 }
11502
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)11503 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11504 {
11505 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11506 struct net_device *dev = info->user_ptr[1];
11507 const u8 *ie = NULL, *bssid;
11508 int ie_len = 0;
11509 u16 reason_code;
11510 bool local_state_change;
11511
11512 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11513 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11514 return -EPERM;
11515
11516 if (!info->attrs[NL80211_ATTR_MAC])
11517 return -EINVAL;
11518
11519 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11520 return -EINVAL;
11521
11522 if (!rdev->ops->disassoc)
11523 return -EOPNOTSUPP;
11524
11525 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11526 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11527 return -EOPNOTSUPP;
11528
11529 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11530
11531 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11532 if (reason_code == 0) {
11533 /* Reason Code 0 is reserved */
11534 return -EINVAL;
11535 }
11536
11537 if (info->attrs[NL80211_ATTR_IE]) {
11538 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11539 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11540 }
11541
11542 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11543
11544 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11545 local_state_change);
11546 }
11547
11548 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)11549 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11550 int mcast_rate[NUM_NL80211_BANDS],
11551 int rateval)
11552 {
11553 struct wiphy *wiphy = &rdev->wiphy;
11554 bool found = false;
11555 int band, i;
11556
11557 for (band = 0; band < NUM_NL80211_BANDS; band++) {
11558 struct ieee80211_supported_band *sband;
11559
11560 sband = wiphy->bands[band];
11561 if (!sband)
11562 continue;
11563
11564 for (i = 0; i < sband->n_bitrates; i++) {
11565 if (sband->bitrates[i].bitrate == rateval) {
11566 mcast_rate[band] = i + 1;
11567 found = true;
11568 break;
11569 }
11570 }
11571 }
11572
11573 return found;
11574 }
11575
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)11576 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11577 {
11578 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11579 struct net_device *dev = info->user_ptr[1];
11580 struct cfg80211_ibss_params ibss;
11581 struct wiphy *wiphy;
11582 struct cfg80211_cached_keys *connkeys = NULL;
11583 int err;
11584
11585 memset(&ibss, 0, sizeof(ibss));
11586
11587 if (!info->attrs[NL80211_ATTR_SSID] ||
11588 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11589 return -EINVAL;
11590
11591 ibss.beacon_interval = 100;
11592
11593 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11594 ibss.beacon_interval =
11595 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11596
11597 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11598 ibss.beacon_interval);
11599 if (err)
11600 return err;
11601
11602 if (!rdev->ops->join_ibss)
11603 return -EOPNOTSUPP;
11604
11605 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11606 return -EOPNOTSUPP;
11607
11608 wiphy = &rdev->wiphy;
11609
11610 if (info->attrs[NL80211_ATTR_MAC]) {
11611 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11612
11613 if (!is_valid_ether_addr(ibss.bssid))
11614 return -EINVAL;
11615 }
11616 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11617 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11618
11619 if (info->attrs[NL80211_ATTR_IE]) {
11620 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11621 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11622 }
11623
11624 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11625 if (err)
11626 return err;
11627
11628 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11629 NL80211_IFTYPE_ADHOC))
11630 return -EINVAL;
11631
11632 switch (ibss.chandef.width) {
11633 case NL80211_CHAN_WIDTH_5:
11634 case NL80211_CHAN_WIDTH_10:
11635 case NL80211_CHAN_WIDTH_20_NOHT:
11636 break;
11637 case NL80211_CHAN_WIDTH_20:
11638 case NL80211_CHAN_WIDTH_40:
11639 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11640 return -EINVAL;
11641 break;
11642 case NL80211_CHAN_WIDTH_80:
11643 case NL80211_CHAN_WIDTH_80P80:
11644 case NL80211_CHAN_WIDTH_160:
11645 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11646 return -EINVAL;
11647 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11648 NL80211_EXT_FEATURE_VHT_IBSS))
11649 return -EINVAL;
11650 break;
11651 case NL80211_CHAN_WIDTH_320:
11652 return -EINVAL;
11653 default:
11654 return -EINVAL;
11655 }
11656
11657 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11658 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11659
11660 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11661 u8 *rates =
11662 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11663 int n_rates =
11664 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11665 struct ieee80211_supported_band *sband =
11666 wiphy->bands[ibss.chandef.chan->band];
11667
11668 err = ieee80211_get_ratemask(sband, rates, n_rates,
11669 &ibss.basic_rates);
11670 if (err)
11671 return err;
11672 }
11673
11674 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11675 memcpy(&ibss.ht_capa_mask,
11676 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11677 sizeof(ibss.ht_capa_mask));
11678
11679 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11680 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11681 return -EINVAL;
11682 memcpy(&ibss.ht_capa,
11683 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11684 sizeof(ibss.ht_capa));
11685 }
11686
11687 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11688 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11689 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11690 return -EINVAL;
11691
11692 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11693 bool no_ht = false;
11694
11695 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11696 if (IS_ERR(connkeys))
11697 return PTR_ERR(connkeys);
11698
11699 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11700 no_ht) {
11701 kfree_sensitive(connkeys);
11702 return -EINVAL;
11703 }
11704 }
11705
11706 ibss.control_port =
11707 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11708
11709 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11710 int r = validate_pae_over_nl80211(rdev, info);
11711
11712 if (r < 0) {
11713 kfree_sensitive(connkeys);
11714 return r;
11715 }
11716
11717 ibss.control_port_over_nl80211 = true;
11718 }
11719
11720 ibss.userspace_handles_dfs =
11721 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11722
11723 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11724 if (err)
11725 kfree_sensitive(connkeys);
11726 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11727 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11728
11729 return err;
11730 }
11731
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)11732 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11733 {
11734 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11735 struct net_device *dev = info->user_ptr[1];
11736
11737 if (!rdev->ops->leave_ibss)
11738 return -EOPNOTSUPP;
11739
11740 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11741 return -EOPNOTSUPP;
11742
11743 return cfg80211_leave_ibss(rdev, dev, false);
11744 }
11745
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)11746 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11747 {
11748 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11749 struct net_device *dev = info->user_ptr[1];
11750 int mcast_rate[NUM_NL80211_BANDS];
11751 u32 nla_rate;
11752
11753 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11754 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11755 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11756 return -EOPNOTSUPP;
11757
11758 if (!rdev->ops->set_mcast_rate)
11759 return -EOPNOTSUPP;
11760
11761 memset(mcast_rate, 0, sizeof(mcast_rate));
11762
11763 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11764 return -EINVAL;
11765
11766 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11767 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11768 return -EINVAL;
11769
11770 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11771 }
11772
11773 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)11774 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11775 struct wireless_dev *wdev, int approxlen,
11776 u32 portid, u32 seq, enum nl80211_commands cmd,
11777 enum nl80211_attrs attr,
11778 const struct nl80211_vendor_cmd_info *info,
11779 gfp_t gfp)
11780 {
11781 struct sk_buff *skb;
11782 void *hdr;
11783 struct nlattr *data;
11784
11785 skb = nlmsg_new(approxlen + 100, gfp);
11786 if (!skb)
11787 return NULL;
11788
11789 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11790 if (!hdr) {
11791 kfree_skb(skb);
11792 return NULL;
11793 }
11794
11795 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11796 goto nla_put_failure;
11797
11798 if (info) {
11799 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11800 info->vendor_id))
11801 goto nla_put_failure;
11802 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11803 info->subcmd))
11804 goto nla_put_failure;
11805 }
11806
11807 if (wdev) {
11808 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11809 wdev_id(wdev), NL80211_ATTR_PAD))
11810 goto nla_put_failure;
11811 if (wdev->netdev &&
11812 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11813 wdev->netdev->ifindex))
11814 goto nla_put_failure;
11815 }
11816
11817 data = nla_nest_start_noflag(skb, attr);
11818 if (!data)
11819 goto nla_put_failure;
11820
11821 ((void **)skb->cb)[0] = rdev;
11822 ((void **)skb->cb)[1] = hdr;
11823 ((void **)skb->cb)[2] = data;
11824
11825 return skb;
11826
11827 nla_put_failure:
11828 kfree_skb(skb);
11829 return NULL;
11830 }
11831
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)11832 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11833 struct wireless_dev *wdev,
11834 enum nl80211_commands cmd,
11835 enum nl80211_attrs attr,
11836 unsigned int portid,
11837 int vendor_event_idx,
11838 int approxlen, gfp_t gfp)
11839 {
11840 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11841 const struct nl80211_vendor_cmd_info *info;
11842
11843 switch (cmd) {
11844 case NL80211_CMD_TESTMODE:
11845 if (WARN_ON(vendor_event_idx != -1))
11846 return NULL;
11847 info = NULL;
11848 break;
11849 case NL80211_CMD_VENDOR:
11850 if (WARN_ON(vendor_event_idx < 0 ||
11851 vendor_event_idx >= wiphy->n_vendor_events))
11852 return NULL;
11853 info = &wiphy->vendor_events[vendor_event_idx];
11854 break;
11855 default:
11856 WARN_ON(1);
11857 return NULL;
11858 }
11859
11860 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11861 cmd, attr, info, gfp);
11862 }
11863 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11864
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)11865 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11866 {
11867 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11868 void *hdr = ((void **)skb->cb)[1];
11869 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11870 struct nlattr *data = ((void **)skb->cb)[2];
11871 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11872
11873 /* clear CB data for netlink core to own from now on */
11874 memset(skb->cb, 0, sizeof(skb->cb));
11875
11876 nla_nest_end(skb, data);
11877 genlmsg_end(skb, hdr);
11878
11879 if (nlhdr->nlmsg_pid) {
11880 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11881 nlhdr->nlmsg_pid);
11882 } else {
11883 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11884 mcgrp = NL80211_MCGRP_VENDOR;
11885
11886 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11887 skb, 0, mcgrp, gfp);
11888 }
11889 }
11890 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11891
11892 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)11893 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11894 {
11895 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11896 struct wireless_dev *wdev;
11897 int err;
11898
11899 lockdep_assert_held(&rdev->wiphy.mtx);
11900
11901 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11902 info->attrs);
11903
11904 if (!rdev->ops->testmode_cmd)
11905 return -EOPNOTSUPP;
11906
11907 if (IS_ERR(wdev)) {
11908 err = PTR_ERR(wdev);
11909 if (err != -EINVAL)
11910 return err;
11911 wdev = NULL;
11912 } else if (wdev->wiphy != &rdev->wiphy) {
11913 return -EINVAL;
11914 }
11915
11916 if (!info->attrs[NL80211_ATTR_TESTDATA])
11917 return -EINVAL;
11918
11919 rdev->cur_cmd_info = info;
11920 err = rdev_testmode_cmd(rdev, wdev,
11921 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11922 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11923 rdev->cur_cmd_info = NULL;
11924
11925 return err;
11926 }
11927
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)11928 static int nl80211_testmode_dump(struct sk_buff *skb,
11929 struct netlink_callback *cb)
11930 {
11931 struct cfg80211_registered_device *rdev;
11932 struct nlattr **attrbuf = NULL;
11933 int err;
11934 long phy_idx;
11935 void *data = NULL;
11936 int data_len = 0;
11937
11938 rtnl_lock();
11939
11940 if (cb->args[0]) {
11941 /*
11942 * 0 is a valid index, but not valid for args[0],
11943 * so we need to offset by 1.
11944 */
11945 phy_idx = cb->args[0] - 1;
11946
11947 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11948 if (!rdev) {
11949 err = -ENOENT;
11950 goto out_err;
11951 }
11952 } else {
11953 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11954 GFP_KERNEL);
11955 if (!attrbuf) {
11956 err = -ENOMEM;
11957 goto out_err;
11958 }
11959
11960 err = nlmsg_parse_deprecated(cb->nlh,
11961 GENL_HDRLEN + nl80211_fam.hdrsize,
11962 attrbuf, nl80211_fam.maxattr,
11963 nl80211_policy, NULL);
11964 if (err)
11965 goto out_err;
11966
11967 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11968 if (IS_ERR(rdev)) {
11969 err = PTR_ERR(rdev);
11970 goto out_err;
11971 }
11972 phy_idx = rdev->wiphy_idx;
11973
11974 if (attrbuf[NL80211_ATTR_TESTDATA])
11975 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11976 }
11977
11978 if (cb->args[1]) {
11979 data = nla_data((void *)cb->args[1]);
11980 data_len = nla_len((void *)cb->args[1]);
11981 }
11982
11983 if (!rdev->ops->testmode_dump) {
11984 err = -EOPNOTSUPP;
11985 goto out_err;
11986 }
11987
11988 while (1) {
11989 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11990 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11991 NL80211_CMD_TESTMODE);
11992 struct nlattr *tmdata;
11993
11994 if (!hdr)
11995 break;
11996
11997 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11998 genlmsg_cancel(skb, hdr);
11999 break;
12000 }
12001
12002 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
12003 if (!tmdata) {
12004 genlmsg_cancel(skb, hdr);
12005 break;
12006 }
12007 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
12008 nla_nest_end(skb, tmdata);
12009
12010 if (err == -ENOBUFS || err == -ENOENT) {
12011 genlmsg_cancel(skb, hdr);
12012 break;
12013 } else if (err) {
12014 genlmsg_cancel(skb, hdr);
12015 goto out_err;
12016 }
12017
12018 genlmsg_end(skb, hdr);
12019 }
12020
12021 err = skb->len;
12022 /* see above */
12023 cb->args[0] = phy_idx + 1;
12024 out_err:
12025 kfree(attrbuf);
12026 rtnl_unlock();
12027 return err;
12028 }
12029 #endif
12030
nl80211_connect(struct sk_buff * skb,struct genl_info * info)12031 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
12032 {
12033 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12034 struct net_device *dev = info->user_ptr[1];
12035 struct cfg80211_connect_params connect;
12036 struct wiphy *wiphy;
12037 struct cfg80211_cached_keys *connkeys = NULL;
12038 u32 freq = 0;
12039 int err;
12040
12041 memset(&connect, 0, sizeof(connect));
12042
12043 if (!info->attrs[NL80211_ATTR_SSID] ||
12044 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12045 return -EINVAL;
12046
12047 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12048 connect.auth_type =
12049 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12050 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
12051 NL80211_CMD_CONNECT))
12052 return -EINVAL;
12053 } else
12054 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
12055
12056 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
12057
12058 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
12059 !wiphy_ext_feature_isset(&rdev->wiphy,
12060 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12061 return -EINVAL;
12062 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
12063
12064 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
12065 NL80211_MAX_NR_CIPHER_SUITES);
12066 if (err)
12067 return err;
12068
12069 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12070 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12071 return -EOPNOTSUPP;
12072
12073 wiphy = &rdev->wiphy;
12074
12075 connect.bg_scan_period = -1;
12076 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
12077 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
12078 connect.bg_scan_period =
12079 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
12080 }
12081
12082 if (info->attrs[NL80211_ATTR_MAC])
12083 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12084 else if (info->attrs[NL80211_ATTR_MAC_HINT])
12085 connect.bssid_hint =
12086 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
12087 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12088 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12089
12090 if (info->attrs[NL80211_ATTR_IE]) {
12091 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12092 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12093 }
12094
12095 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12096 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12097 if (connect.mfp == NL80211_MFP_OPTIONAL &&
12098 !wiphy_ext_feature_isset(&rdev->wiphy,
12099 NL80211_EXT_FEATURE_MFP_OPTIONAL))
12100 return -EOPNOTSUPP;
12101 } else {
12102 connect.mfp = NL80211_MFP_NO;
12103 }
12104
12105 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12106 connect.prev_bssid =
12107 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12108
12109 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
12110 freq = MHZ_TO_KHZ(nla_get_u32(
12111 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
12112 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12113 freq +=
12114 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12115
12116 if (freq) {
12117 connect.channel = nl80211_get_valid_chan(wiphy, freq);
12118 if (!connect.channel)
12119 return -EINVAL;
12120 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
12121 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
12122 freq = MHZ_TO_KHZ(freq);
12123 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
12124 if (!connect.channel_hint)
12125 return -EINVAL;
12126 }
12127
12128 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
12129 connect.edmg.channels =
12130 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
12131
12132 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
12133 connect.edmg.bw_config =
12134 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
12135 }
12136
12137 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12138 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
12139 if (IS_ERR(connkeys))
12140 return PTR_ERR(connkeys);
12141 }
12142
12143 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12144 connect.flags |= ASSOC_REQ_DISABLE_HT;
12145
12146 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12147 memcpy(&connect.ht_capa_mask,
12148 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12149 sizeof(connect.ht_capa_mask));
12150
12151 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12152 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
12153 kfree_sensitive(connkeys);
12154 return -EINVAL;
12155 }
12156 memcpy(&connect.ht_capa,
12157 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12158 sizeof(connect.ht_capa));
12159 }
12160
12161 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12162 connect.flags |= ASSOC_REQ_DISABLE_VHT;
12163
12164 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12165 connect.flags |= ASSOC_REQ_DISABLE_HE;
12166
12167 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12168 connect.flags |= ASSOC_REQ_DISABLE_EHT;
12169
12170 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12171 memcpy(&connect.vht_capa_mask,
12172 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12173 sizeof(connect.vht_capa_mask));
12174
12175 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12176 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
12177 kfree_sensitive(connkeys);
12178 return -EINVAL;
12179 }
12180 memcpy(&connect.vht_capa,
12181 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12182 sizeof(connect.vht_capa));
12183 }
12184
12185 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12186 if (!((rdev->wiphy.features &
12187 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12188 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12189 !wiphy_ext_feature_isset(&rdev->wiphy,
12190 NL80211_EXT_FEATURE_RRM)) {
12191 kfree_sensitive(connkeys);
12192 return -EINVAL;
12193 }
12194 connect.flags |= ASSOC_REQ_USE_RRM;
12195 }
12196
12197 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
12198 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
12199 kfree_sensitive(connkeys);
12200 return -EOPNOTSUPP;
12201 }
12202
12203 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
12204 /* bss selection makes no sense if bssid is set */
12205 if (connect.bssid) {
12206 kfree_sensitive(connkeys);
12207 return -EINVAL;
12208 }
12209
12210 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
12211 wiphy, &connect.bss_select);
12212 if (err) {
12213 kfree_sensitive(connkeys);
12214 return err;
12215 }
12216 }
12217
12218 if (wiphy_ext_feature_isset(&rdev->wiphy,
12219 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
12220 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12221 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12222 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12223 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12224 connect.fils_erp_username =
12225 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12226 connect.fils_erp_username_len =
12227 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12228 connect.fils_erp_realm =
12229 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12230 connect.fils_erp_realm_len =
12231 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12232 connect.fils_erp_next_seq_num =
12233 nla_get_u16(
12234 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12235 connect.fils_erp_rrk =
12236 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12237 connect.fils_erp_rrk_len =
12238 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12239 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12240 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12241 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12242 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12243 kfree_sensitive(connkeys);
12244 return -EINVAL;
12245 }
12246
12247 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12248 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12249 kfree_sensitive(connkeys);
12250 GENL_SET_ERR_MSG(info,
12251 "external auth requires connection ownership");
12252 return -EINVAL;
12253 }
12254 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12255 }
12256
12257 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12258 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12259
12260 err = cfg80211_connect(rdev, dev, &connect, connkeys,
12261 connect.prev_bssid);
12262 if (err)
12263 kfree_sensitive(connkeys);
12264
12265 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12266 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12267 if (connect.bssid)
12268 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12269 connect.bssid, ETH_ALEN);
12270 else
12271 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12272 }
12273
12274 return err;
12275 }
12276
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)12277 static int nl80211_update_connect_params(struct sk_buff *skb,
12278 struct genl_info *info)
12279 {
12280 struct cfg80211_connect_params connect = {};
12281 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12282 struct net_device *dev = info->user_ptr[1];
12283 struct wireless_dev *wdev = dev->ieee80211_ptr;
12284 bool fils_sk_offload;
12285 u32 auth_type;
12286 u32 changed = 0;
12287
12288 if (!rdev->ops->update_connect_params)
12289 return -EOPNOTSUPP;
12290
12291 if (info->attrs[NL80211_ATTR_IE]) {
12292 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12293 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12294 changed |= UPDATE_ASSOC_IES;
12295 }
12296
12297 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12298 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12299
12300 /*
12301 * when driver supports fils-sk offload all attributes must be
12302 * provided. So the else covers "fils-sk-not-all" and
12303 * "no-fils-sk-any".
12304 */
12305 if (fils_sk_offload &&
12306 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12307 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12308 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12309 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12310 connect.fils_erp_username =
12311 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12312 connect.fils_erp_username_len =
12313 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12314 connect.fils_erp_realm =
12315 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12316 connect.fils_erp_realm_len =
12317 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12318 connect.fils_erp_next_seq_num =
12319 nla_get_u16(
12320 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12321 connect.fils_erp_rrk =
12322 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12323 connect.fils_erp_rrk_len =
12324 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12325 changed |= UPDATE_FILS_ERP_INFO;
12326 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12327 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12328 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12329 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12330 return -EINVAL;
12331 }
12332
12333 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12334 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12335 if (!nl80211_valid_auth_type(rdev, auth_type,
12336 NL80211_CMD_CONNECT))
12337 return -EINVAL;
12338
12339 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12340 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12341 return -EINVAL;
12342
12343 connect.auth_type = auth_type;
12344 changed |= UPDATE_AUTH_TYPE;
12345 }
12346
12347 if (!wdev->connected)
12348 return -ENOLINK;
12349
12350 return rdev_update_connect_params(rdev, dev, &connect, changed);
12351 }
12352
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)12353 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12354 {
12355 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12356 struct net_device *dev = info->user_ptr[1];
12357 u16 reason;
12358
12359 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12360 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12361 return -EPERM;
12362
12363 reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
12364 WLAN_REASON_DEAUTH_LEAVING);
12365
12366 if (reason == 0)
12367 return -EINVAL;
12368
12369 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12370 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12371 return -EOPNOTSUPP;
12372
12373 return cfg80211_disconnect(rdev, dev, reason, true);
12374 }
12375
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)12376 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12377 {
12378 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12379 struct net *net;
12380 int err;
12381
12382 if (info->attrs[NL80211_ATTR_PID]) {
12383 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12384
12385 net = get_net_ns_by_pid(pid);
12386 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12387 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12388
12389 net = get_net_ns_by_fd(fd);
12390 } else {
12391 return -EINVAL;
12392 }
12393
12394 if (IS_ERR(net))
12395 return PTR_ERR(net);
12396
12397 err = 0;
12398
12399 /* check if anything to do */
12400 if (!net_eq(wiphy_net(&rdev->wiphy), net))
12401 err = cfg80211_switch_netns(rdev, net);
12402
12403 put_net(net);
12404 return err;
12405 }
12406
nl80211_set_pmksa(struct sk_buff * skb,struct genl_info * info)12407 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
12408 {
12409 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12410 struct net_device *dev = info->user_ptr[1];
12411 struct cfg80211_pmksa pmksa;
12412 bool ap_pmksa_caching_support = false;
12413
12414 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12415
12416 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12417 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12418
12419 if (!info->attrs[NL80211_ATTR_PMKID])
12420 return -EINVAL;
12421
12422 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12423
12424 if (info->attrs[NL80211_ATTR_MAC]) {
12425 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12426 } else if (info->attrs[NL80211_ATTR_SSID] &&
12427 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12428 info->attrs[NL80211_ATTR_PMK]) {
12429 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12430 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12431 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12432 } else {
12433 return -EINVAL;
12434 }
12435
12436 if (info->attrs[NL80211_ATTR_PMK]) {
12437 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12438 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12439 }
12440
12441 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12442 pmksa.pmk_lifetime =
12443 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12444
12445 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12446 pmksa.pmk_reauth_threshold =
12447 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12448
12449 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12450 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12451 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12452 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12453 ap_pmksa_caching_support))
12454 return -EOPNOTSUPP;
12455
12456 if (!rdev->ops->set_pmksa)
12457 return -EOPNOTSUPP;
12458
12459 return rdev_set_pmksa(rdev, dev, &pmksa);
12460 }
12461
nl80211_del_pmksa(struct sk_buff * skb,struct genl_info * info)12462 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
12463 {
12464 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12465 struct net_device *dev = info->user_ptr[1];
12466 struct cfg80211_pmksa pmksa;
12467 bool sae_offload_support = false;
12468 bool owe_offload_support = false;
12469 bool ap_pmksa_caching_support = false;
12470
12471 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12472
12473 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12474 NL80211_EXT_FEATURE_SAE_OFFLOAD);
12475 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12476 NL80211_EXT_FEATURE_OWE_OFFLOAD);
12477 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12478 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12479
12480 if (info->attrs[NL80211_ATTR_PMKID])
12481 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12482
12483 if (info->attrs[NL80211_ATTR_MAC]) {
12484 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12485 } else if (info->attrs[NL80211_ATTR_SSID]) {
12486 /* SSID based pmksa flush supported only for FILS,
12487 * OWE/SAE OFFLOAD cases
12488 */
12489 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12490 info->attrs[NL80211_ATTR_PMK]) {
12491 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12492 } else if (!sae_offload_support && !owe_offload_support) {
12493 return -EINVAL;
12494 }
12495 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12496 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12497 } else {
12498 return -EINVAL;
12499 }
12500
12501 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12502 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12503 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12504 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12505 ap_pmksa_caching_support))
12506 return -EOPNOTSUPP;
12507
12508 if (!rdev->ops->del_pmksa)
12509 return -EOPNOTSUPP;
12510
12511 return rdev_del_pmksa(rdev, dev, &pmksa);
12512 }
12513
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)12514 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12515 {
12516 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12517 struct net_device *dev = info->user_ptr[1];
12518
12519 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12520 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12521 return -EOPNOTSUPP;
12522
12523 if (!rdev->ops->flush_pmksa)
12524 return -EOPNOTSUPP;
12525
12526 return rdev_flush_pmksa(rdev, dev);
12527 }
12528
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)12529 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12530 {
12531 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12532 struct net_device *dev = info->user_ptr[1];
12533 u8 action_code, dialog_token;
12534 u32 peer_capability = 0;
12535 u16 status_code;
12536 u8 *peer;
12537 int link_id;
12538 bool initiator;
12539
12540 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12541 !rdev->ops->tdls_mgmt)
12542 return -EOPNOTSUPP;
12543
12544 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12545 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12546 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12547 !info->attrs[NL80211_ATTR_IE] ||
12548 !info->attrs[NL80211_ATTR_MAC])
12549 return -EINVAL;
12550
12551 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12552 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12553 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12554 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12555 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12556 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12557 peer_capability =
12558 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12559 link_id = nl80211_link_id_or_invalid(info->attrs);
12560
12561 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12562 dialog_token, status_code, peer_capability,
12563 initiator,
12564 nla_data(info->attrs[NL80211_ATTR_IE]),
12565 nla_len(info->attrs[NL80211_ATTR_IE]));
12566 }
12567
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)12568 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12569 {
12570 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12571 struct net_device *dev = info->user_ptr[1];
12572 enum nl80211_tdls_operation operation;
12573 u8 *peer;
12574
12575 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12576 !rdev->ops->tdls_oper)
12577 return -EOPNOTSUPP;
12578
12579 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12580 !info->attrs[NL80211_ATTR_MAC])
12581 return -EINVAL;
12582
12583 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12584 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12585
12586 return rdev_tdls_oper(rdev, dev, peer, operation);
12587 }
12588
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12589 static int nl80211_remain_on_channel(struct sk_buff *skb,
12590 struct genl_info *info)
12591 {
12592 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12593 unsigned int link_id = nl80211_link_id(info->attrs);
12594 struct wireless_dev *wdev = info->user_ptr[1];
12595 struct cfg80211_chan_def chandef;
12596 struct sk_buff *msg;
12597 void *hdr;
12598 u64 cookie;
12599 u32 duration;
12600 int err;
12601
12602 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12603 !info->attrs[NL80211_ATTR_DURATION])
12604 return -EINVAL;
12605
12606 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12607
12608 if (!rdev->ops->remain_on_channel ||
12609 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12610 return -EOPNOTSUPP;
12611
12612 /*
12613 * We should be on that channel for at least a minimum amount of
12614 * time (10ms) but no longer than the driver supports.
12615 */
12616 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12617 duration > rdev->wiphy.max_remain_on_channel_duration)
12618 return -EINVAL;
12619
12620 err = nl80211_parse_chandef(rdev, info, &chandef);
12621 if (err)
12622 return err;
12623
12624 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12625 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12626
12627 oper_chandef = wdev_chandef(wdev, link_id);
12628
12629 if (WARN_ON(!oper_chandef)) {
12630 /* cannot happen since we must beacon to get here */
12631 WARN_ON(1);
12632 return -EBUSY;
12633 }
12634
12635 /* note: returns first one if identical chandefs */
12636 compat_chandef = cfg80211_chandef_compatible(&chandef,
12637 oper_chandef);
12638
12639 if (compat_chandef != &chandef)
12640 return -EBUSY;
12641 }
12642
12643 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12644 if (!msg)
12645 return -ENOMEM;
12646
12647 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12648 NL80211_CMD_REMAIN_ON_CHANNEL);
12649 if (!hdr) {
12650 err = -ENOBUFS;
12651 goto free_msg;
12652 }
12653
12654 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12655 duration, &cookie);
12656
12657 if (err)
12658 goto free_msg;
12659
12660 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12661 NL80211_ATTR_PAD))
12662 goto nla_put_failure;
12663
12664 genlmsg_end(msg, hdr);
12665
12666 return genlmsg_reply(msg, info);
12667
12668 nla_put_failure:
12669 err = -ENOBUFS;
12670 free_msg:
12671 nlmsg_free(msg);
12672 return err;
12673 }
12674
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12675 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12676 struct genl_info *info)
12677 {
12678 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12679 struct wireless_dev *wdev = info->user_ptr[1];
12680 u64 cookie;
12681
12682 if (!info->attrs[NL80211_ATTR_COOKIE])
12683 return -EINVAL;
12684
12685 if (!rdev->ops->cancel_remain_on_channel)
12686 return -EOPNOTSUPP;
12687
12688 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12689
12690 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12691 }
12692
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)12693 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12694 struct genl_info *info)
12695 {
12696 struct cfg80211_bitrate_mask mask;
12697 unsigned int link_id = nl80211_link_id(info->attrs);
12698 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12699 struct net_device *dev = info->user_ptr[1];
12700 int err;
12701
12702 if (!rdev->ops->set_bitrate_mask)
12703 return -EOPNOTSUPP;
12704
12705 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12706 NL80211_ATTR_TX_RATES, &mask,
12707 dev, true, link_id);
12708 if (err)
12709 return err;
12710
12711 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12712 }
12713
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)12714 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12715 {
12716 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12717 struct wireless_dev *wdev = info->user_ptr[1];
12718 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12719
12720 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12721 return -EINVAL;
12722
12723 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12724 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12725
12726 switch (wdev->iftype) {
12727 case NL80211_IFTYPE_STATION:
12728 case NL80211_IFTYPE_ADHOC:
12729 case NL80211_IFTYPE_P2P_CLIENT:
12730 case NL80211_IFTYPE_AP:
12731 case NL80211_IFTYPE_AP_VLAN:
12732 case NL80211_IFTYPE_MESH_POINT:
12733 case NL80211_IFTYPE_P2P_GO:
12734 case NL80211_IFTYPE_P2P_DEVICE:
12735 break;
12736 case NL80211_IFTYPE_NAN:
12737 if (!wiphy_ext_feature_isset(wdev->wiphy,
12738 NL80211_EXT_FEATURE_SECURE_NAN))
12739 return -EOPNOTSUPP;
12740 break;
12741 default:
12742 return -EOPNOTSUPP;
12743 }
12744
12745 /* not much point in registering if we can't reply */
12746 if (!rdev->ops->mgmt_tx)
12747 return -EOPNOTSUPP;
12748
12749 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12750 !wiphy_ext_feature_isset(&rdev->wiphy,
12751 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12752 GENL_SET_ERR_MSG(info,
12753 "multicast RX registrations are not supported");
12754 return -EOPNOTSUPP;
12755 }
12756
12757 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12758 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12759 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12760 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12761 info->extack);
12762 }
12763
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)12764 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12765 {
12766 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12767 struct wireless_dev *wdev = info->user_ptr[1];
12768 struct cfg80211_chan_def chandef;
12769 int err;
12770 void *hdr = NULL;
12771 u64 cookie;
12772 struct sk_buff *msg = NULL;
12773 struct cfg80211_mgmt_tx_params params = {
12774 .dont_wait_for_ack =
12775 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12776 };
12777
12778 if (!info->attrs[NL80211_ATTR_FRAME])
12779 return -EINVAL;
12780
12781 if (!rdev->ops->mgmt_tx)
12782 return -EOPNOTSUPP;
12783
12784 switch (wdev->iftype) {
12785 case NL80211_IFTYPE_P2P_DEVICE:
12786 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12787 return -EINVAL;
12788 break;
12789 case NL80211_IFTYPE_STATION:
12790 case NL80211_IFTYPE_ADHOC:
12791 case NL80211_IFTYPE_P2P_CLIENT:
12792 case NL80211_IFTYPE_AP:
12793 case NL80211_IFTYPE_AP_VLAN:
12794 case NL80211_IFTYPE_MESH_POINT:
12795 case NL80211_IFTYPE_P2P_GO:
12796 break;
12797 case NL80211_IFTYPE_NAN:
12798 if (!wiphy_ext_feature_isset(wdev->wiphy,
12799 NL80211_EXT_FEATURE_SECURE_NAN))
12800 return -EOPNOTSUPP;
12801 break;
12802 default:
12803 return -EOPNOTSUPP;
12804 }
12805
12806 if (info->attrs[NL80211_ATTR_DURATION]) {
12807 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12808 return -EINVAL;
12809 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12810
12811 /*
12812 * We should wait on the channel for at least a minimum amount
12813 * of time (10ms) but no longer than the driver supports.
12814 */
12815 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12816 params.wait > rdev->wiphy.max_remain_on_channel_duration)
12817 return -EINVAL;
12818 }
12819
12820 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12821
12822 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12823 return -EINVAL;
12824
12825 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12826
12827 /* get the channel if any has been specified, otherwise pass NULL to
12828 * the driver. The latter will use the current one
12829 */
12830 chandef.chan = NULL;
12831 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12832 err = nl80211_parse_chandef(rdev, info, &chandef);
12833 if (err)
12834 return err;
12835 }
12836
12837 if (!chandef.chan && params.offchan)
12838 return -EINVAL;
12839
12840 if (params.offchan &&
12841 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
12842 return -EBUSY;
12843
12844 params.link_id = nl80211_link_id_or_invalid(info->attrs);
12845 /*
12846 * This now races due to the unlock, but we cannot check
12847 * the valid links for the _station_ anyway, so that's up
12848 * to the driver.
12849 */
12850 if (params.link_id >= 0 &&
12851 !(wdev->valid_links & BIT(params.link_id)))
12852 return -EINVAL;
12853
12854 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12855 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12856
12857 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
12858 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
12859 ¶ms.csa_offsets,
12860 ¶ms.n_csa_offsets);
12861 if (err)
12862 return err;
12863
12864 if (!params.dont_wait_for_ack) {
12865 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12866 if (!msg)
12867 return -ENOMEM;
12868
12869 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12870 NL80211_CMD_FRAME);
12871 if (!hdr) {
12872 err = -ENOBUFS;
12873 goto free_msg;
12874 }
12875 }
12876
12877 params.chan = chandef.chan;
12878 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
12879 if (err)
12880 goto free_msg;
12881
12882 if (msg) {
12883 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12884 NL80211_ATTR_PAD))
12885 goto nla_put_failure;
12886
12887 genlmsg_end(msg, hdr);
12888 return genlmsg_reply(msg, info);
12889 }
12890
12891 return 0;
12892
12893 nla_put_failure:
12894 err = -ENOBUFS;
12895 free_msg:
12896 nlmsg_free(msg);
12897 return err;
12898 }
12899
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)12900 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12901 {
12902 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12903 struct wireless_dev *wdev = info->user_ptr[1];
12904 u64 cookie;
12905
12906 if (!info->attrs[NL80211_ATTR_COOKIE])
12907 return -EINVAL;
12908
12909 if (!rdev->ops->mgmt_tx_cancel_wait)
12910 return -EOPNOTSUPP;
12911
12912 switch (wdev->iftype) {
12913 case NL80211_IFTYPE_STATION:
12914 case NL80211_IFTYPE_ADHOC:
12915 case NL80211_IFTYPE_P2P_CLIENT:
12916 case NL80211_IFTYPE_AP:
12917 case NL80211_IFTYPE_AP_VLAN:
12918 case NL80211_IFTYPE_P2P_GO:
12919 case NL80211_IFTYPE_P2P_DEVICE:
12920 break;
12921 case NL80211_IFTYPE_NAN:
12922 if (!wiphy_ext_feature_isset(wdev->wiphy,
12923 NL80211_EXT_FEATURE_SECURE_NAN))
12924 return -EOPNOTSUPP;
12925 break;
12926 default:
12927 return -EOPNOTSUPP;
12928 }
12929
12930 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12931
12932 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12933 }
12934
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)12935 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12936 {
12937 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12938 struct wireless_dev *wdev;
12939 struct net_device *dev = info->user_ptr[1];
12940 u8 ps_state;
12941 bool state;
12942 int err;
12943
12944 if (!info->attrs[NL80211_ATTR_PS_STATE])
12945 return -EINVAL;
12946
12947 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12948
12949 wdev = dev->ieee80211_ptr;
12950
12951 if (!rdev->ops->set_power_mgmt)
12952 return -EOPNOTSUPP;
12953
12954 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12955
12956 if (state == wdev->ps)
12957 return 0;
12958
12959 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12960 if (!err)
12961 wdev->ps = state;
12962 return err;
12963 }
12964
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)12965 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12966 {
12967 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12968 enum nl80211_ps_state ps_state;
12969 struct wireless_dev *wdev;
12970 struct net_device *dev = info->user_ptr[1];
12971 struct sk_buff *msg;
12972 void *hdr;
12973 int err;
12974
12975 wdev = dev->ieee80211_ptr;
12976
12977 if (!rdev->ops->set_power_mgmt)
12978 return -EOPNOTSUPP;
12979
12980 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12981 if (!msg)
12982 return -ENOMEM;
12983
12984 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12985 NL80211_CMD_GET_POWER_SAVE);
12986 if (!hdr) {
12987 err = -ENOBUFS;
12988 goto free_msg;
12989 }
12990
12991 if (wdev->ps)
12992 ps_state = NL80211_PS_ENABLED;
12993 else
12994 ps_state = NL80211_PS_DISABLED;
12995
12996 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12997 goto nla_put_failure;
12998
12999 genlmsg_end(msg, hdr);
13000 return genlmsg_reply(msg, info);
13001
13002 nla_put_failure:
13003 err = -ENOBUFS;
13004 free_msg:
13005 nlmsg_free(msg);
13006 return err;
13007 }
13008
13009 static const struct nla_policy
13010 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
13011 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
13012 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
13013 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
13014 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
13015 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
13016 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
13017 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
13018 };
13019
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)13020 static int nl80211_set_cqm_txe(struct genl_info *info,
13021 u32 rate, u32 pkts, u32 intvl)
13022 {
13023 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13024 struct net_device *dev = info->user_ptr[1];
13025 struct wireless_dev *wdev = dev->ieee80211_ptr;
13026
13027 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
13028 return -EINVAL;
13029
13030 if (!rdev->ops->set_cqm_txe_config)
13031 return -EOPNOTSUPP;
13032
13033 if (wdev->iftype != NL80211_IFTYPE_STATION &&
13034 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13035 return -EOPNOTSUPP;
13036
13037 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
13038 }
13039
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)13040 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
13041 struct net_device *dev,
13042 struct cfg80211_cqm_config *cqm_config)
13043 {
13044 struct wireless_dev *wdev = dev->ieee80211_ptr;
13045 s32 last, low, high;
13046 u32 hyst;
13047 int i, n, low_index;
13048 int err;
13049
13050 /*
13051 * Obtain current RSSI value if possible, if not and no RSSI threshold
13052 * event has been received yet, we should receive an event after a
13053 * connection is established and enough beacons received to calculate
13054 * the average.
13055 */
13056 if (!cqm_config->last_rssi_event_value &&
13057 wdev->links[0].client.current_bss &&
13058 rdev->ops->get_station) {
13059 struct station_info sinfo = {};
13060 u8 *mac_addr;
13061
13062 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
13063
13064 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
13065 if (err)
13066 return err;
13067
13068 cfg80211_sinfo_release_content(&sinfo);
13069 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
13070 cqm_config->last_rssi_event_value =
13071 (s8) sinfo.rx_beacon_signal_avg;
13072 }
13073
13074 last = cqm_config->last_rssi_event_value;
13075 hyst = cqm_config->rssi_hyst;
13076 n = cqm_config->n_rssi_thresholds;
13077
13078 for (i = 0; i < n; i++) {
13079 i = array_index_nospec(i, n);
13080 if (last < cqm_config->rssi_thresholds[i])
13081 break;
13082 }
13083
13084 low_index = i - 1;
13085 if (low_index >= 0) {
13086 low_index = array_index_nospec(low_index, n);
13087 low = cqm_config->rssi_thresholds[low_index] - hyst;
13088 } else {
13089 low = S32_MIN;
13090 }
13091 if (i < n) {
13092 i = array_index_nospec(i, n);
13093 high = cqm_config->rssi_thresholds[i] + hyst - 1;
13094 } else {
13095 high = S32_MAX;
13096 }
13097
13098 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
13099 }
13100
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)13101 static int nl80211_set_cqm_rssi(struct genl_info *info,
13102 const s32 *thresholds, int n_thresholds,
13103 u32 hysteresis)
13104 {
13105 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13106 struct cfg80211_cqm_config *cqm_config = NULL, *old;
13107 struct net_device *dev = info->user_ptr[1];
13108 struct wireless_dev *wdev = dev->ieee80211_ptr;
13109 s32 prev = S32_MIN;
13110 int i, err;
13111
13112 /* Check all values negative and sorted */
13113 for (i = 0; i < n_thresholds; i++) {
13114 if (thresholds[i] > 0 || thresholds[i] <= prev)
13115 return -EINVAL;
13116
13117 prev = thresholds[i];
13118 }
13119
13120 if (wdev->iftype != NL80211_IFTYPE_STATION &&
13121 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13122 return -EOPNOTSUPP;
13123
13124 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
13125 n_thresholds = 0;
13126
13127 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
13128
13129 /* if already disabled just succeed */
13130 if (!n_thresholds && !old)
13131 return 0;
13132
13133 if (n_thresholds > 1) {
13134 if (!wiphy_ext_feature_isset(&rdev->wiphy,
13135 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
13136 !rdev->ops->set_cqm_rssi_range_config)
13137 return -EOPNOTSUPP;
13138 } else {
13139 if (!rdev->ops->set_cqm_rssi_config)
13140 return -EOPNOTSUPP;
13141 }
13142
13143 if (n_thresholds) {
13144 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
13145 n_thresholds),
13146 GFP_KERNEL);
13147 if (!cqm_config)
13148 return -ENOMEM;
13149
13150 cqm_config->rssi_hyst = hysteresis;
13151 cqm_config->n_rssi_thresholds = n_thresholds;
13152 memcpy(cqm_config->rssi_thresholds, thresholds,
13153 flex_array_size(cqm_config, rssi_thresholds,
13154 n_thresholds));
13155 cqm_config->use_range_api = n_thresholds > 1 ||
13156 !rdev->ops->set_cqm_rssi_config;
13157
13158 rcu_assign_pointer(wdev->cqm_config, cqm_config);
13159
13160 if (cqm_config->use_range_api)
13161 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
13162 else
13163 err = rdev_set_cqm_rssi_config(rdev, dev,
13164 thresholds[0],
13165 hysteresis);
13166 } else {
13167 RCU_INIT_POINTER(wdev->cqm_config, NULL);
13168 /* if enabled as range also disable via range */
13169 if (old->use_range_api)
13170 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
13171 else
13172 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
13173 }
13174
13175 if (err) {
13176 rcu_assign_pointer(wdev->cqm_config, old);
13177 kfree_rcu(cqm_config, rcu_head);
13178 } else {
13179 kfree_rcu(old, rcu_head);
13180 }
13181
13182 return err;
13183 }
13184
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)13185 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
13186 {
13187 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
13188 struct nlattr *cqm;
13189 int err;
13190
13191 cqm = info->attrs[NL80211_ATTR_CQM];
13192 if (!cqm)
13193 return -EINVAL;
13194
13195 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
13196 nl80211_attr_cqm_policy,
13197 info->extack);
13198 if (err)
13199 return err;
13200
13201 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
13202 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
13203 const s32 *thresholds =
13204 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13205 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13206 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
13207
13208 if (len % 4)
13209 return -EINVAL;
13210
13211 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
13212 hysteresis);
13213 }
13214
13215 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
13216 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
13217 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
13218 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
13219 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
13220 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
13221
13222 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
13223 }
13224
13225 return -EINVAL;
13226 }
13227
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)13228 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
13229 {
13230 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13231 struct net_device *dev = info->user_ptr[1];
13232 struct ocb_setup setup = {};
13233 int err;
13234
13235 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13236 if (err)
13237 return err;
13238
13239 return cfg80211_join_ocb(rdev, dev, &setup);
13240 }
13241
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)13242 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
13243 {
13244 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13245 struct net_device *dev = info->user_ptr[1];
13246
13247 return cfg80211_leave_ocb(rdev, dev);
13248 }
13249
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)13250 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
13251 {
13252 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13253 struct net_device *dev = info->user_ptr[1];
13254 struct mesh_config cfg;
13255 struct mesh_setup setup;
13256 int err;
13257
13258 /* start with default */
13259 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13260 memcpy(&setup, &default_mesh_setup, sizeof(setup));
13261
13262 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13263 /* and parse parameters if given */
13264 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13265 if (err)
13266 return err;
13267 }
13268
13269 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13270 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13271 return -EINVAL;
13272
13273 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13274 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13275
13276 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13277 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13278 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13279 return -EINVAL;
13280
13281 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13282 setup.beacon_interval =
13283 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13284
13285 err = cfg80211_validate_beacon_int(rdev,
13286 NL80211_IFTYPE_MESH_POINT,
13287 setup.beacon_interval);
13288 if (err)
13289 return err;
13290 }
13291
13292 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13293 setup.dtim_period =
13294 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13295 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13296 return -EINVAL;
13297 }
13298
13299 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13300 /* parse additional setup parameters if given */
13301 err = nl80211_parse_mesh_setup(info, &setup);
13302 if (err)
13303 return err;
13304 }
13305
13306 if (setup.user_mpm)
13307 cfg.auto_open_plinks = false;
13308
13309 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13310 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13311 if (err)
13312 return err;
13313 } else {
13314 /* __cfg80211_join_mesh() will sort it out */
13315 setup.chandef.chan = NULL;
13316 }
13317
13318 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13319 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13320 int n_rates =
13321 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13322 struct ieee80211_supported_band *sband;
13323
13324 if (!setup.chandef.chan)
13325 return -EINVAL;
13326
13327 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13328
13329 err = ieee80211_get_ratemask(sband, rates, n_rates,
13330 &setup.basic_rates);
13331 if (err)
13332 return err;
13333 }
13334
13335 if (info->attrs[NL80211_ATTR_TX_RATES]) {
13336 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13337 NL80211_ATTR_TX_RATES,
13338 &setup.beacon_rate,
13339 dev, false, 0);
13340 if (err)
13341 return err;
13342
13343 if (!setup.chandef.chan)
13344 return -EINVAL;
13345
13346 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13347 &setup.beacon_rate);
13348 if (err)
13349 return err;
13350 }
13351
13352 setup.userspace_handles_dfs =
13353 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13354
13355 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13356 int r = validate_pae_over_nl80211(rdev, info);
13357
13358 if (r < 0)
13359 return r;
13360
13361 setup.control_port_over_nl80211 = true;
13362 }
13363
13364 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13365 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13366 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13367
13368 return err;
13369 }
13370
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)13371 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13372 {
13373 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13374 struct net_device *dev = info->user_ptr[1];
13375
13376 return cfg80211_leave_mesh(rdev, dev);
13377 }
13378
13379 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13380 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13381 struct cfg80211_registered_device *rdev)
13382 {
13383 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13384 struct nlattr *nl_pats, *nl_pat;
13385 int i, pat_len;
13386
13387 if (!wowlan->n_patterns)
13388 return 0;
13389
13390 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13391 if (!nl_pats)
13392 return -ENOBUFS;
13393
13394 for (i = 0; i < wowlan->n_patterns; i++) {
13395 nl_pat = nla_nest_start_noflag(msg, i + 1);
13396 if (!nl_pat)
13397 return -ENOBUFS;
13398 pat_len = wowlan->patterns[i].pattern_len;
13399 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13400 wowlan->patterns[i].mask) ||
13401 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13402 wowlan->patterns[i].pattern) ||
13403 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13404 wowlan->patterns[i].pkt_offset))
13405 return -ENOBUFS;
13406 nla_nest_end(msg, nl_pat);
13407 }
13408 nla_nest_end(msg, nl_pats);
13409
13410 return 0;
13411 }
13412
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)13413 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13414 struct cfg80211_wowlan_tcp *tcp)
13415 {
13416 struct nlattr *nl_tcp;
13417
13418 if (!tcp)
13419 return 0;
13420
13421 nl_tcp = nla_nest_start_noflag(msg,
13422 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13423 if (!nl_tcp)
13424 return -ENOBUFS;
13425
13426 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13427 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13428 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13429 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13430 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13431 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13432 tcp->payload_len, tcp->payload) ||
13433 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13434 tcp->data_interval) ||
13435 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13436 tcp->wake_len, tcp->wake_data) ||
13437 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13438 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13439 return -ENOBUFS;
13440
13441 if (tcp->payload_seq.len &&
13442 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13443 sizeof(tcp->payload_seq), &tcp->payload_seq))
13444 return -ENOBUFS;
13445
13446 if (tcp->payload_tok.len &&
13447 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13448 sizeof(tcp->payload_tok) + tcp->tokens_size,
13449 &tcp->payload_tok))
13450 return -ENOBUFS;
13451
13452 nla_nest_end(msg, nl_tcp);
13453
13454 return 0;
13455 }
13456
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)13457 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13458 struct cfg80211_sched_scan_request *req)
13459 {
13460 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13461 int i;
13462
13463 if (!req)
13464 return 0;
13465
13466 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13467 if (!nd)
13468 return -ENOBUFS;
13469
13470 if (req->n_scan_plans == 1 &&
13471 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13472 req->scan_plans[0].interval * 1000))
13473 return -ENOBUFS;
13474
13475 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13476 return -ENOBUFS;
13477
13478 if (req->relative_rssi_set) {
13479 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13480
13481 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13482 req->relative_rssi))
13483 return -ENOBUFS;
13484
13485 rssi_adjust.band = req->rssi_adjust.band;
13486 rssi_adjust.delta = req->rssi_adjust.delta;
13487 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13488 sizeof(rssi_adjust), &rssi_adjust))
13489 return -ENOBUFS;
13490 }
13491
13492 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13493 if (!freqs)
13494 return -ENOBUFS;
13495
13496 for (i = 0; i < req->n_channels; i++) {
13497 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13498 return -ENOBUFS;
13499 }
13500
13501 nla_nest_end(msg, freqs);
13502
13503 if (req->n_match_sets) {
13504 matches = nla_nest_start_noflag(msg,
13505 NL80211_ATTR_SCHED_SCAN_MATCH);
13506 if (!matches)
13507 return -ENOBUFS;
13508
13509 for (i = 0; i < req->n_match_sets; i++) {
13510 match = nla_nest_start_noflag(msg, i);
13511 if (!match)
13512 return -ENOBUFS;
13513
13514 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13515 req->match_sets[i].ssid.ssid_len,
13516 req->match_sets[i].ssid.ssid))
13517 return -ENOBUFS;
13518 nla_nest_end(msg, match);
13519 }
13520 nla_nest_end(msg, matches);
13521 }
13522
13523 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13524 if (!scan_plans)
13525 return -ENOBUFS;
13526
13527 for (i = 0; i < req->n_scan_plans; i++) {
13528 scan_plan = nla_nest_start_noflag(msg, i + 1);
13529 if (!scan_plan)
13530 return -ENOBUFS;
13531
13532 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13533 req->scan_plans[i].interval) ||
13534 (req->scan_plans[i].iterations &&
13535 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13536 req->scan_plans[i].iterations)))
13537 return -ENOBUFS;
13538 nla_nest_end(msg, scan_plan);
13539 }
13540 nla_nest_end(msg, scan_plans);
13541
13542 nla_nest_end(msg, nd);
13543
13544 return 0;
13545 }
13546
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)13547 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13548 {
13549 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13550 struct sk_buff *msg;
13551 void *hdr;
13552 u32 size = NLMSG_DEFAULT_SIZE;
13553
13554 if (!rdev->wiphy.wowlan)
13555 return -EOPNOTSUPP;
13556
13557 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13558 /* adjust size to have room for all the data */
13559 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13560 rdev->wiphy.wowlan_config->tcp->payload_len +
13561 rdev->wiphy.wowlan_config->tcp->wake_len +
13562 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13563 }
13564
13565 msg = nlmsg_new(size, GFP_KERNEL);
13566 if (!msg)
13567 return -ENOMEM;
13568
13569 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13570 NL80211_CMD_GET_WOWLAN);
13571 if (!hdr)
13572 goto nla_put_failure;
13573
13574 if (rdev->wiphy.wowlan_config) {
13575 struct nlattr *nl_wowlan;
13576
13577 nl_wowlan = nla_nest_start_noflag(msg,
13578 NL80211_ATTR_WOWLAN_TRIGGERS);
13579 if (!nl_wowlan)
13580 goto nla_put_failure;
13581
13582 if ((rdev->wiphy.wowlan_config->any &&
13583 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13584 (rdev->wiphy.wowlan_config->disconnect &&
13585 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13586 (rdev->wiphy.wowlan_config->magic_pkt &&
13587 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13588 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13589 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13590 (rdev->wiphy.wowlan_config->eap_identity_req &&
13591 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13592 (rdev->wiphy.wowlan_config->four_way_handshake &&
13593 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13594 (rdev->wiphy.wowlan_config->rfkill_release &&
13595 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13596 goto nla_put_failure;
13597
13598 if (nl80211_send_wowlan_patterns(msg, rdev))
13599 goto nla_put_failure;
13600
13601 if (nl80211_send_wowlan_tcp(msg,
13602 rdev->wiphy.wowlan_config->tcp))
13603 goto nla_put_failure;
13604
13605 if (nl80211_send_wowlan_nd(
13606 msg,
13607 rdev->wiphy.wowlan_config->nd_config))
13608 goto nla_put_failure;
13609
13610 nla_nest_end(msg, nl_wowlan);
13611 }
13612
13613 genlmsg_end(msg, hdr);
13614 return genlmsg_reply(msg, info);
13615
13616 nla_put_failure:
13617 nlmsg_free(msg);
13618 return -ENOBUFS;
13619 }
13620
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)13621 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13622 struct nlattr *attr,
13623 struct cfg80211_wowlan *trig)
13624 {
13625 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13626 struct cfg80211_wowlan_tcp *cfg;
13627 struct nl80211_wowlan_tcp_data_token *tok = NULL;
13628 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13629 u32 size;
13630 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13631 int err, port;
13632
13633 if (!rdev->wiphy.wowlan->tcp)
13634 return -EINVAL;
13635
13636 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13637 nl80211_wowlan_tcp_policy, NULL);
13638 if (err)
13639 return err;
13640
13641 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13642 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13643 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13644 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13645 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13646 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13647 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13648 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13649 return -EINVAL;
13650
13651 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13652 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13653 return -EINVAL;
13654
13655 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13656 rdev->wiphy.wowlan->tcp->data_interval_max ||
13657 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13658 return -EINVAL;
13659
13660 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13661 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13662 return -EINVAL;
13663
13664 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13665 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13666 return -EINVAL;
13667
13668 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13669 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13670
13671 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13672 tokens_size = tokln - sizeof(*tok);
13673
13674 if (!tok->len || tokens_size % tok->len)
13675 return -EINVAL;
13676 if (!rdev->wiphy.wowlan->tcp->tok)
13677 return -EINVAL;
13678 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13679 return -EINVAL;
13680 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13681 return -EINVAL;
13682 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13683 return -EINVAL;
13684 if (tok->offset + tok->len > data_size)
13685 return -EINVAL;
13686 }
13687
13688 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13689 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13690 if (!rdev->wiphy.wowlan->tcp->seq)
13691 return -EINVAL;
13692 if (seq->len == 0 || seq->len > 4)
13693 return -EINVAL;
13694 if (seq->len + seq->offset > data_size)
13695 return -EINVAL;
13696 }
13697
13698 size = sizeof(*cfg);
13699 size += data_size;
13700 size += wake_size + wake_mask_size;
13701 size += tokens_size;
13702
13703 cfg = kzalloc(size, GFP_KERNEL);
13704 if (!cfg)
13705 return -ENOMEM;
13706 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13707 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13708 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13709 ETH_ALEN);
13710 port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
13711 #ifdef CONFIG_INET
13712 /* allocate a socket and port for it and use it */
13713 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13714 IPPROTO_TCP, &cfg->sock, 1);
13715 if (err) {
13716 kfree(cfg);
13717 return err;
13718 }
13719 if (inet_csk_get_port(cfg->sock->sk, port)) {
13720 sock_release(cfg->sock);
13721 kfree(cfg);
13722 return -EADDRINUSE;
13723 }
13724 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13725 #else
13726 if (!port) {
13727 kfree(cfg);
13728 return -EINVAL;
13729 }
13730 cfg->src_port = port;
13731 #endif
13732
13733 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13734 cfg->payload_len = data_size;
13735 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13736 memcpy((void *)cfg->payload,
13737 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13738 data_size);
13739 if (seq)
13740 cfg->payload_seq = *seq;
13741 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13742 cfg->wake_len = wake_size;
13743 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13744 memcpy((void *)cfg->wake_data,
13745 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13746 wake_size);
13747 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13748 data_size + wake_size;
13749 memcpy((void *)cfg->wake_mask,
13750 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13751 wake_mask_size);
13752 if (tok) {
13753 cfg->tokens_size = tokens_size;
13754 cfg->payload_tok = *tok;
13755 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13756 tokens_size);
13757 }
13758
13759 trig->tcp = cfg;
13760
13761 return 0;
13762 }
13763
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)13764 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13765 const struct wiphy_wowlan_support *wowlan,
13766 struct nlattr *attr,
13767 struct cfg80211_wowlan *trig)
13768 {
13769 struct nlattr **tb;
13770 int err;
13771
13772 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13773 if (!tb)
13774 return -ENOMEM;
13775
13776 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13777 err = -EOPNOTSUPP;
13778 goto out;
13779 }
13780
13781 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13782 nl80211_policy, NULL);
13783 if (err)
13784 goto out;
13785
13786 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13787 wowlan->max_nd_match_sets);
13788 err = PTR_ERR_OR_ZERO(trig->nd_config);
13789 if (err)
13790 trig->nd_config = NULL;
13791
13792 out:
13793 kfree(tb);
13794 return err;
13795 }
13796
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)13797 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13798 {
13799 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13800 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13801 struct cfg80211_wowlan new_triggers = {};
13802 struct cfg80211_wowlan *ntrig;
13803 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13804 int err, i;
13805 bool prev_enabled = rdev->wiphy.wowlan_config;
13806 bool regular = false;
13807
13808 if (!wowlan)
13809 return -EOPNOTSUPP;
13810
13811 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13812 cfg80211_rdev_free_wowlan(rdev);
13813 rdev->wiphy.wowlan_config = NULL;
13814 goto set_wakeup;
13815 }
13816
13817 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13818 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13819 nl80211_wowlan_policy, info->extack);
13820 if (err)
13821 return err;
13822
13823 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13824 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13825 return -EINVAL;
13826 new_triggers.any = true;
13827 }
13828
13829 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13830 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13831 return -EINVAL;
13832 new_triggers.disconnect = true;
13833 regular = true;
13834 }
13835
13836 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13837 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13838 return -EINVAL;
13839 new_triggers.magic_pkt = true;
13840 regular = true;
13841 }
13842
13843 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13844 return -EINVAL;
13845
13846 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13847 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13848 return -EINVAL;
13849 new_triggers.gtk_rekey_failure = true;
13850 regular = true;
13851 }
13852
13853 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13854 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13855 return -EINVAL;
13856 new_triggers.eap_identity_req = true;
13857 regular = true;
13858 }
13859
13860 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13861 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13862 return -EINVAL;
13863 new_triggers.four_way_handshake = true;
13864 regular = true;
13865 }
13866
13867 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13868 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13869 return -EINVAL;
13870 new_triggers.rfkill_release = true;
13871 regular = true;
13872 }
13873
13874 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13875 struct nlattr *pat;
13876 int n_patterns = 0;
13877 int rem, pat_len, mask_len, pkt_offset;
13878 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13879
13880 regular = true;
13881
13882 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13883 rem)
13884 n_patterns++;
13885 if (n_patterns > wowlan->n_patterns)
13886 return -EINVAL;
13887
13888 new_triggers.patterns = kcalloc(n_patterns,
13889 sizeof(new_triggers.patterns[0]),
13890 GFP_KERNEL);
13891 if (!new_triggers.patterns)
13892 return -ENOMEM;
13893
13894 new_triggers.n_patterns = n_patterns;
13895 i = 0;
13896
13897 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13898 rem) {
13899 u8 *mask_pat;
13900
13901 err = nla_parse_nested_deprecated(pat_tb,
13902 MAX_NL80211_PKTPAT,
13903 pat,
13904 nl80211_packet_pattern_policy,
13905 info->extack);
13906 if (err)
13907 goto error;
13908
13909 err = -EINVAL;
13910 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13911 !pat_tb[NL80211_PKTPAT_PATTERN])
13912 goto error;
13913 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13914 mask_len = DIV_ROUND_UP(pat_len, 8);
13915 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13916 goto error;
13917 if (pat_len > wowlan->pattern_max_len ||
13918 pat_len < wowlan->pattern_min_len)
13919 goto error;
13920
13921 pkt_offset =
13922 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
13923 0);
13924 if (pkt_offset > wowlan->max_pkt_offset)
13925 goto error;
13926 new_triggers.patterns[i].pkt_offset = pkt_offset;
13927
13928 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13929 if (!mask_pat) {
13930 err = -ENOMEM;
13931 goto error;
13932 }
13933 new_triggers.patterns[i].mask = mask_pat;
13934 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13935 mask_len);
13936 mask_pat += mask_len;
13937 new_triggers.patterns[i].pattern = mask_pat;
13938 new_triggers.patterns[i].pattern_len = pat_len;
13939 memcpy(mask_pat,
13940 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13941 pat_len);
13942 i++;
13943 }
13944 }
13945
13946 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13947 regular = true;
13948 err = nl80211_parse_wowlan_tcp(
13949 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13950 &new_triggers);
13951 if (err)
13952 goto error;
13953 }
13954
13955 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13956 regular = true;
13957 err = nl80211_parse_wowlan_nd(
13958 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13959 &new_triggers);
13960 if (err)
13961 goto error;
13962 }
13963
13964 /* The 'any' trigger means the device continues operating more or less
13965 * as in its normal operation mode and wakes up the host on most of the
13966 * normal interrupts (like packet RX, ...)
13967 * It therefore makes little sense to combine with the more constrained
13968 * wakeup trigger modes.
13969 */
13970 if (new_triggers.any && regular) {
13971 err = -EINVAL;
13972 goto error;
13973 }
13974
13975 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13976 if (!ntrig) {
13977 err = -ENOMEM;
13978 goto error;
13979 }
13980 cfg80211_rdev_free_wowlan(rdev);
13981 rdev->wiphy.wowlan_config = ntrig;
13982
13983 set_wakeup:
13984 if (rdev->ops->set_wakeup &&
13985 prev_enabled != !!rdev->wiphy.wowlan_config)
13986 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13987
13988 return 0;
13989 error:
13990 for (i = 0; i < new_triggers.n_patterns; i++)
13991 kfree(new_triggers.patterns[i].mask);
13992 kfree(new_triggers.patterns);
13993 if (new_triggers.tcp && new_triggers.tcp->sock)
13994 sock_release(new_triggers.tcp->sock);
13995 kfree(new_triggers.tcp);
13996 kfree(new_triggers.nd_config);
13997 return err;
13998 }
13999 #endif
14000
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)14001 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
14002 struct cfg80211_registered_device *rdev)
14003 {
14004 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
14005 int i, j, pat_len;
14006 struct cfg80211_coalesce_rules *rule;
14007
14008 if (!rdev->coalesce->n_rules)
14009 return 0;
14010
14011 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
14012 if (!nl_rules)
14013 return -ENOBUFS;
14014
14015 for (i = 0; i < rdev->coalesce->n_rules; i++) {
14016 nl_rule = nla_nest_start_noflag(msg, i + 1);
14017 if (!nl_rule)
14018 return -ENOBUFS;
14019
14020 rule = &rdev->coalesce->rules[i];
14021 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
14022 rule->delay))
14023 return -ENOBUFS;
14024
14025 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
14026 rule->condition))
14027 return -ENOBUFS;
14028
14029 nl_pats = nla_nest_start_noflag(msg,
14030 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
14031 if (!nl_pats)
14032 return -ENOBUFS;
14033
14034 for (j = 0; j < rule->n_patterns; j++) {
14035 nl_pat = nla_nest_start_noflag(msg, j + 1);
14036 if (!nl_pat)
14037 return -ENOBUFS;
14038 pat_len = rule->patterns[j].pattern_len;
14039 if (nla_put(msg, NL80211_PKTPAT_MASK,
14040 DIV_ROUND_UP(pat_len, 8),
14041 rule->patterns[j].mask) ||
14042 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14043 rule->patterns[j].pattern) ||
14044 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14045 rule->patterns[j].pkt_offset))
14046 return -ENOBUFS;
14047 nla_nest_end(msg, nl_pat);
14048 }
14049 nla_nest_end(msg, nl_pats);
14050 nla_nest_end(msg, nl_rule);
14051 }
14052 nla_nest_end(msg, nl_rules);
14053
14054 return 0;
14055 }
14056
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)14057 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
14058 {
14059 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14060 struct sk_buff *msg;
14061 void *hdr;
14062
14063 if (!rdev->wiphy.coalesce)
14064 return -EOPNOTSUPP;
14065
14066 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14067 if (!msg)
14068 return -ENOMEM;
14069
14070 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14071 NL80211_CMD_GET_COALESCE);
14072 if (!hdr)
14073 goto nla_put_failure;
14074
14075 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
14076 goto nla_put_failure;
14077
14078 genlmsg_end(msg, hdr);
14079 return genlmsg_reply(msg, info);
14080
14081 nla_put_failure:
14082 nlmsg_free(msg);
14083 return -ENOBUFS;
14084 }
14085
cfg80211_free_coalesce(struct cfg80211_coalesce * coalesce)14086 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
14087 {
14088 int i, j;
14089 struct cfg80211_coalesce_rules *rule;
14090
14091 if (!coalesce)
14092 return;
14093
14094 for (i = 0; i < coalesce->n_rules; i++) {
14095 rule = &coalesce->rules[i];
14096 for (j = 0; j < rule->n_patterns; j++)
14097 kfree(rule->patterns[j].mask);
14098 kfree(rule->patterns);
14099 }
14100 kfree(coalesce);
14101 }
14102
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)14103 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
14104 struct nlattr *rule,
14105 struct cfg80211_coalesce_rules *new_rule)
14106 {
14107 int err, i;
14108 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14109 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
14110 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
14111 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14112
14113 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
14114 rule, nl80211_coalesce_policy, NULL);
14115 if (err)
14116 return err;
14117
14118 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
14119 new_rule->delay =
14120 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
14121 if (new_rule->delay > coalesce->max_delay)
14122 return -EINVAL;
14123
14124 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
14125 new_rule->condition =
14126 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
14127
14128 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
14129 return -EINVAL;
14130
14131 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14132 rem)
14133 n_patterns++;
14134 if (n_patterns > coalesce->n_patterns)
14135 return -EINVAL;
14136
14137 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
14138 GFP_KERNEL);
14139 if (!new_rule->patterns)
14140 return -ENOMEM;
14141
14142 new_rule->n_patterns = n_patterns;
14143 i = 0;
14144
14145 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14146 rem) {
14147 u8 *mask_pat;
14148
14149 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
14150 pat,
14151 nl80211_packet_pattern_policy,
14152 NULL);
14153 if (err)
14154 return err;
14155
14156 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14157 !pat_tb[NL80211_PKTPAT_PATTERN])
14158 return -EINVAL;
14159 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14160 mask_len = DIV_ROUND_UP(pat_len, 8);
14161 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14162 return -EINVAL;
14163 if (pat_len > coalesce->pattern_max_len ||
14164 pat_len < coalesce->pattern_min_len)
14165 return -EINVAL;
14166
14167 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14168 0);
14169 if (pkt_offset > coalesce->max_pkt_offset)
14170 return -EINVAL;
14171 new_rule->patterns[i].pkt_offset = pkt_offset;
14172
14173 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14174 if (!mask_pat)
14175 return -ENOMEM;
14176
14177 new_rule->patterns[i].mask = mask_pat;
14178 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14179 mask_len);
14180
14181 mask_pat += mask_len;
14182 new_rule->patterns[i].pattern = mask_pat;
14183 new_rule->patterns[i].pattern_len = pat_len;
14184 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14185 pat_len);
14186 i++;
14187 }
14188
14189 return 0;
14190 }
14191
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)14192 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
14193 {
14194 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14195 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14196 struct cfg80211_coalesce *new_coalesce;
14197 int err, rem_rule, n_rules = 0, i;
14198 struct nlattr *rule;
14199
14200 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
14201 return -EOPNOTSUPP;
14202
14203 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
14204 cfg80211_free_coalesce(rdev->coalesce);
14205 rdev->coalesce = NULL;
14206 rdev_set_coalesce(rdev, NULL);
14207 return 0;
14208 }
14209
14210 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14211 rem_rule)
14212 n_rules++;
14213 if (n_rules > coalesce->n_rules)
14214 return -EINVAL;
14215
14216 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
14217 GFP_KERNEL);
14218 if (!new_coalesce)
14219 return -ENOMEM;
14220
14221 new_coalesce->n_rules = n_rules;
14222 i = 0;
14223
14224 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14225 rem_rule) {
14226 err = nl80211_parse_coalesce_rule(rdev, rule,
14227 &new_coalesce->rules[i]);
14228 if (err)
14229 goto error;
14230
14231 i++;
14232 }
14233
14234 err = rdev_set_coalesce(rdev, new_coalesce);
14235 if (err)
14236 goto error;
14237
14238 cfg80211_free_coalesce(rdev->coalesce);
14239 rdev->coalesce = new_coalesce;
14240
14241 return 0;
14242 error:
14243 cfg80211_free_coalesce(new_coalesce);
14244
14245 return err;
14246 }
14247
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)14248 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14249 {
14250 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14251 struct net_device *dev = info->user_ptr[1];
14252 struct wireless_dev *wdev = dev->ieee80211_ptr;
14253 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14254 struct cfg80211_gtk_rekey_data rekey_data = {};
14255 int err;
14256
14257 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14258 return -EINVAL;
14259
14260 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14261 info->attrs[NL80211_ATTR_REKEY_DATA],
14262 nl80211_rekey_policy, info->extack);
14263 if (err)
14264 return err;
14265
14266 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14267 !tb[NL80211_REKEY_DATA_KCK])
14268 return -EINVAL;
14269 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14270 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14271 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14272 return -ERANGE;
14273 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14274 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14275 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14276 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14277 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14278 return -ERANGE;
14279
14280 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14281 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14282 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14283 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14284 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14285 if (tb[NL80211_REKEY_DATA_AKM])
14286 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14287
14288 if (!wdev->connected)
14289 return -ENOTCONN;
14290
14291 if (!rdev->ops->set_rekey_data)
14292 return -EOPNOTSUPP;
14293
14294 return rdev_set_rekey_data(rdev, dev, &rekey_data);
14295 }
14296
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)14297 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14298 struct genl_info *info)
14299 {
14300 struct net_device *dev = info->user_ptr[1];
14301 struct wireless_dev *wdev = dev->ieee80211_ptr;
14302
14303 if (wdev->iftype != NL80211_IFTYPE_AP &&
14304 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14305 return -EINVAL;
14306
14307 if (wdev->ap_unexpected_nlportid)
14308 return -EBUSY;
14309
14310 wdev->ap_unexpected_nlportid = info->snd_portid;
14311 return 0;
14312 }
14313
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)14314 static int nl80211_probe_client(struct sk_buff *skb,
14315 struct genl_info *info)
14316 {
14317 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14318 struct net_device *dev = info->user_ptr[1];
14319 struct wireless_dev *wdev = dev->ieee80211_ptr;
14320 struct sk_buff *msg;
14321 void *hdr;
14322 const u8 *addr;
14323 u64 cookie;
14324 int err;
14325
14326 if (wdev->iftype != NL80211_IFTYPE_AP &&
14327 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14328 return -EOPNOTSUPP;
14329
14330 if (!info->attrs[NL80211_ATTR_MAC])
14331 return -EINVAL;
14332
14333 if (!rdev->ops->probe_client)
14334 return -EOPNOTSUPP;
14335
14336 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14337 if (!msg)
14338 return -ENOMEM;
14339
14340 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14341 NL80211_CMD_PROBE_CLIENT);
14342 if (!hdr) {
14343 err = -ENOBUFS;
14344 goto free_msg;
14345 }
14346
14347 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14348
14349 err = rdev_probe_client(rdev, dev, addr, &cookie);
14350 if (err)
14351 goto free_msg;
14352
14353 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14354 NL80211_ATTR_PAD))
14355 goto nla_put_failure;
14356
14357 genlmsg_end(msg, hdr);
14358
14359 return genlmsg_reply(msg, info);
14360
14361 nla_put_failure:
14362 err = -ENOBUFS;
14363 free_msg:
14364 nlmsg_free(msg);
14365 return err;
14366 }
14367
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)14368 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14369 {
14370 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14371 struct cfg80211_beacon_registration *reg, *nreg;
14372 int rv;
14373
14374 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14375 return -EOPNOTSUPP;
14376
14377 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14378 if (!nreg)
14379 return -ENOMEM;
14380
14381 /* First, check if already registered. */
14382 spin_lock_bh(&rdev->beacon_registrations_lock);
14383 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14384 if (reg->nlportid == info->snd_portid) {
14385 rv = -EALREADY;
14386 goto out_err;
14387 }
14388 }
14389 /* Add it to the list */
14390 nreg->nlportid = info->snd_portid;
14391 list_add(&nreg->list, &rdev->beacon_registrations);
14392
14393 spin_unlock_bh(&rdev->beacon_registrations_lock);
14394
14395 return 0;
14396 out_err:
14397 spin_unlock_bh(&rdev->beacon_registrations_lock);
14398 kfree(nreg);
14399 return rv;
14400 }
14401
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)14402 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14403 {
14404 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14405 struct wireless_dev *wdev = info->user_ptr[1];
14406 int err;
14407
14408 if (!rdev->ops->start_p2p_device)
14409 return -EOPNOTSUPP;
14410
14411 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14412 return -EOPNOTSUPP;
14413
14414 if (wdev_running(wdev))
14415 return 0;
14416
14417 if (rfkill_blocked(rdev->wiphy.rfkill))
14418 return -ERFKILL;
14419
14420 err = rdev_start_p2p_device(rdev, wdev);
14421 if (err)
14422 return err;
14423
14424 wdev->is_running = true;
14425 rdev->opencount++;
14426
14427 return 0;
14428 }
14429
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)14430 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14431 {
14432 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14433 struct wireless_dev *wdev = info->user_ptr[1];
14434
14435 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14436 return -EOPNOTSUPP;
14437
14438 if (!rdev->ops->stop_p2p_device)
14439 return -EOPNOTSUPP;
14440
14441 cfg80211_stop_p2p_device(rdev, wdev);
14442
14443 return 0;
14444 }
14445
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)14446 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14447 {
14448 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14449 struct wireless_dev *wdev = info->user_ptr[1];
14450 struct cfg80211_nan_conf conf = {};
14451 int err;
14452
14453 if (wdev->iftype != NL80211_IFTYPE_NAN)
14454 return -EOPNOTSUPP;
14455
14456 if (wdev_running(wdev))
14457 return -EEXIST;
14458
14459 if (rfkill_blocked(rdev->wiphy.rfkill))
14460 return -ERFKILL;
14461
14462 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14463 return -EINVAL;
14464
14465 conf.master_pref =
14466 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14467
14468 if (info->attrs[NL80211_ATTR_BANDS]) {
14469 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14470
14471 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14472 return -EOPNOTSUPP;
14473
14474 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14475 return -EINVAL;
14476
14477 conf.bands = bands;
14478 }
14479
14480 err = rdev_start_nan(rdev, wdev, &conf);
14481 if (err)
14482 return err;
14483
14484 wdev->is_running = true;
14485 rdev->opencount++;
14486
14487 return 0;
14488 }
14489
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)14490 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14491 {
14492 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14493 struct wireless_dev *wdev = info->user_ptr[1];
14494
14495 if (wdev->iftype != NL80211_IFTYPE_NAN)
14496 return -EOPNOTSUPP;
14497
14498 cfg80211_stop_nan(rdev, wdev);
14499
14500 return 0;
14501 }
14502
validate_nan_filter(struct nlattr * filter_attr)14503 static int validate_nan_filter(struct nlattr *filter_attr)
14504 {
14505 struct nlattr *attr;
14506 int len = 0, n_entries = 0, rem;
14507
14508 nla_for_each_nested(attr, filter_attr, rem) {
14509 len += nla_len(attr);
14510 n_entries++;
14511 }
14512
14513 if (len >= U8_MAX)
14514 return -EINVAL;
14515
14516 return n_entries;
14517 }
14518
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)14519 static int handle_nan_filter(struct nlattr *attr_filter,
14520 struct cfg80211_nan_func *func,
14521 bool tx)
14522 {
14523 struct nlattr *attr;
14524 int n_entries, rem, i;
14525 struct cfg80211_nan_func_filter *filter;
14526
14527 n_entries = validate_nan_filter(attr_filter);
14528 if (n_entries < 0)
14529 return n_entries;
14530
14531 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14532
14533 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14534 if (!filter)
14535 return -ENOMEM;
14536
14537 i = 0;
14538 nla_for_each_nested(attr, attr_filter, rem) {
14539 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14540 if (!filter[i].filter)
14541 goto err;
14542
14543 filter[i].len = nla_len(attr);
14544 i++;
14545 }
14546 if (tx) {
14547 func->num_tx_filters = n_entries;
14548 func->tx_filters = filter;
14549 } else {
14550 func->num_rx_filters = n_entries;
14551 func->rx_filters = filter;
14552 }
14553
14554 return 0;
14555
14556 err:
14557 i = 0;
14558 nla_for_each_nested(attr, attr_filter, rem) {
14559 kfree(filter[i].filter);
14560 i++;
14561 }
14562 kfree(filter);
14563 return -ENOMEM;
14564 }
14565
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)14566 static int nl80211_nan_add_func(struct sk_buff *skb,
14567 struct genl_info *info)
14568 {
14569 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14570 struct wireless_dev *wdev = info->user_ptr[1];
14571 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14572 struct cfg80211_nan_func *func;
14573 struct sk_buff *msg = NULL;
14574 void *hdr = NULL;
14575 int err = 0;
14576
14577 if (wdev->iftype != NL80211_IFTYPE_NAN)
14578 return -EOPNOTSUPP;
14579
14580 if (!wdev_running(wdev))
14581 return -ENOTCONN;
14582
14583 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14584 return -EINVAL;
14585
14586 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14587 info->attrs[NL80211_ATTR_NAN_FUNC],
14588 nl80211_nan_func_policy,
14589 info->extack);
14590 if (err)
14591 return err;
14592
14593 func = kzalloc(sizeof(*func), GFP_KERNEL);
14594 if (!func)
14595 return -ENOMEM;
14596
14597 func->cookie = cfg80211_assign_cookie(rdev);
14598
14599 if (!tb[NL80211_NAN_FUNC_TYPE]) {
14600 err = -EINVAL;
14601 goto out;
14602 }
14603
14604
14605 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14606
14607 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14608 err = -EINVAL;
14609 goto out;
14610 }
14611
14612 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14613 sizeof(func->service_id));
14614
14615 func->close_range =
14616 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14617
14618 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14619 func->serv_spec_info_len =
14620 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14621 func->serv_spec_info =
14622 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14623 func->serv_spec_info_len,
14624 GFP_KERNEL);
14625 if (!func->serv_spec_info) {
14626 err = -ENOMEM;
14627 goto out;
14628 }
14629 }
14630
14631 if (tb[NL80211_NAN_FUNC_TTL])
14632 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14633
14634 switch (func->type) {
14635 case NL80211_NAN_FUNC_PUBLISH:
14636 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14637 err = -EINVAL;
14638 goto out;
14639 }
14640
14641 func->publish_type =
14642 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14643 func->publish_bcast =
14644 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14645
14646 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14647 func->publish_bcast) {
14648 err = -EINVAL;
14649 goto out;
14650 }
14651 break;
14652 case NL80211_NAN_FUNC_SUBSCRIBE:
14653 func->subscribe_active =
14654 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14655 break;
14656 case NL80211_NAN_FUNC_FOLLOW_UP:
14657 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14658 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14659 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14660 err = -EINVAL;
14661 goto out;
14662 }
14663
14664 func->followup_id =
14665 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14666 func->followup_reqid =
14667 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14668 memcpy(func->followup_dest.addr,
14669 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14670 sizeof(func->followup_dest.addr));
14671 if (func->ttl) {
14672 err = -EINVAL;
14673 goto out;
14674 }
14675 break;
14676 default:
14677 err = -EINVAL;
14678 goto out;
14679 }
14680
14681 if (tb[NL80211_NAN_FUNC_SRF]) {
14682 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14683
14684 err = nla_parse_nested_deprecated(srf_tb,
14685 NL80211_NAN_SRF_ATTR_MAX,
14686 tb[NL80211_NAN_FUNC_SRF],
14687 nl80211_nan_srf_policy,
14688 info->extack);
14689 if (err)
14690 goto out;
14691
14692 func->srf_include =
14693 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14694
14695 if (srf_tb[NL80211_NAN_SRF_BF]) {
14696 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14697 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14698 err = -EINVAL;
14699 goto out;
14700 }
14701
14702 func->srf_bf_len =
14703 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14704 func->srf_bf =
14705 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14706 func->srf_bf_len, GFP_KERNEL);
14707 if (!func->srf_bf) {
14708 err = -ENOMEM;
14709 goto out;
14710 }
14711
14712 func->srf_bf_idx =
14713 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14714 } else {
14715 struct nlattr *attr, *mac_attr =
14716 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14717 int n_entries, rem, i = 0;
14718
14719 if (!mac_attr) {
14720 err = -EINVAL;
14721 goto out;
14722 }
14723
14724 n_entries = validate_acl_mac_addrs(mac_attr);
14725 if (n_entries <= 0) {
14726 err = -EINVAL;
14727 goto out;
14728 }
14729
14730 func->srf_num_macs = n_entries;
14731 func->srf_macs =
14732 kcalloc(n_entries, sizeof(*func->srf_macs),
14733 GFP_KERNEL);
14734 if (!func->srf_macs) {
14735 err = -ENOMEM;
14736 goto out;
14737 }
14738
14739 nla_for_each_nested(attr, mac_attr, rem)
14740 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14741 sizeof(*func->srf_macs));
14742 }
14743 }
14744
14745 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14746 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14747 func, true);
14748 if (err)
14749 goto out;
14750 }
14751
14752 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14753 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14754 func, false);
14755 if (err)
14756 goto out;
14757 }
14758
14759 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14760 if (!msg) {
14761 err = -ENOMEM;
14762 goto out;
14763 }
14764
14765 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14766 NL80211_CMD_ADD_NAN_FUNCTION);
14767 /* This can't really happen - we just allocated 4KB */
14768 if (WARN_ON(!hdr)) {
14769 err = -ENOMEM;
14770 goto out;
14771 }
14772
14773 err = rdev_add_nan_func(rdev, wdev, func);
14774 out:
14775 if (err < 0) {
14776 cfg80211_free_nan_func(func);
14777 nlmsg_free(msg);
14778 return err;
14779 }
14780
14781 /* propagate the instance id and cookie to userspace */
14782 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14783 NL80211_ATTR_PAD))
14784 goto nla_put_failure;
14785
14786 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14787 if (!func_attr)
14788 goto nla_put_failure;
14789
14790 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14791 func->instance_id))
14792 goto nla_put_failure;
14793
14794 nla_nest_end(msg, func_attr);
14795
14796 genlmsg_end(msg, hdr);
14797 return genlmsg_reply(msg, info);
14798
14799 nla_put_failure:
14800 nlmsg_free(msg);
14801 return -ENOBUFS;
14802 }
14803
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)14804 static int nl80211_nan_del_func(struct sk_buff *skb,
14805 struct genl_info *info)
14806 {
14807 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14808 struct wireless_dev *wdev = info->user_ptr[1];
14809 u64 cookie;
14810
14811 if (wdev->iftype != NL80211_IFTYPE_NAN)
14812 return -EOPNOTSUPP;
14813
14814 if (!wdev_running(wdev))
14815 return -ENOTCONN;
14816
14817 if (!info->attrs[NL80211_ATTR_COOKIE])
14818 return -EINVAL;
14819
14820 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14821
14822 rdev_del_nan_func(rdev, wdev, cookie);
14823
14824 return 0;
14825 }
14826
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)14827 static int nl80211_nan_change_config(struct sk_buff *skb,
14828 struct genl_info *info)
14829 {
14830 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14831 struct wireless_dev *wdev = info->user_ptr[1];
14832 struct cfg80211_nan_conf conf = {};
14833 u32 changed = 0;
14834
14835 if (wdev->iftype != NL80211_IFTYPE_NAN)
14836 return -EOPNOTSUPP;
14837
14838 if (!wdev_running(wdev))
14839 return -ENOTCONN;
14840
14841 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14842 conf.master_pref =
14843 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14844 if (conf.master_pref <= 1 || conf.master_pref == 255)
14845 return -EINVAL;
14846
14847 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14848 }
14849
14850 if (info->attrs[NL80211_ATTR_BANDS]) {
14851 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14852
14853 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14854 return -EOPNOTSUPP;
14855
14856 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14857 return -EINVAL;
14858
14859 conf.bands = bands;
14860 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14861 }
14862
14863 if (!changed)
14864 return -EINVAL;
14865
14866 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14867 }
14868
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)14869 void cfg80211_nan_match(struct wireless_dev *wdev,
14870 struct cfg80211_nan_match_params *match, gfp_t gfp)
14871 {
14872 struct wiphy *wiphy = wdev->wiphy;
14873 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14874 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14875 struct sk_buff *msg;
14876 void *hdr;
14877
14878 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14879 return;
14880
14881 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14882 if (!msg)
14883 return;
14884
14885 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14886 if (!hdr) {
14887 nlmsg_free(msg);
14888 return;
14889 }
14890
14891 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14892 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14893 wdev->netdev->ifindex)) ||
14894 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14895 NL80211_ATTR_PAD))
14896 goto nla_put_failure;
14897
14898 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14899 NL80211_ATTR_PAD) ||
14900 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14901 goto nla_put_failure;
14902
14903 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14904 if (!match_attr)
14905 goto nla_put_failure;
14906
14907 local_func_attr = nla_nest_start_noflag(msg,
14908 NL80211_NAN_MATCH_FUNC_LOCAL);
14909 if (!local_func_attr)
14910 goto nla_put_failure;
14911
14912 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14913 goto nla_put_failure;
14914
14915 nla_nest_end(msg, local_func_attr);
14916
14917 peer_func_attr = nla_nest_start_noflag(msg,
14918 NL80211_NAN_MATCH_FUNC_PEER);
14919 if (!peer_func_attr)
14920 goto nla_put_failure;
14921
14922 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14923 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14924 goto nla_put_failure;
14925
14926 if (match->info && match->info_len &&
14927 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14928 match->info))
14929 goto nla_put_failure;
14930
14931 nla_nest_end(msg, peer_func_attr);
14932 nla_nest_end(msg, match_attr);
14933 genlmsg_end(msg, hdr);
14934
14935 if (!wdev->owner_nlportid)
14936 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14937 msg, 0, NL80211_MCGRP_NAN, gfp);
14938 else
14939 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14940 wdev->owner_nlportid);
14941
14942 return;
14943
14944 nla_put_failure:
14945 nlmsg_free(msg);
14946 }
14947 EXPORT_SYMBOL(cfg80211_nan_match);
14948
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)14949 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14950 u8 inst_id,
14951 enum nl80211_nan_func_term_reason reason,
14952 u64 cookie, gfp_t gfp)
14953 {
14954 struct wiphy *wiphy = wdev->wiphy;
14955 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14956 struct sk_buff *msg;
14957 struct nlattr *func_attr;
14958 void *hdr;
14959
14960 if (WARN_ON(!inst_id))
14961 return;
14962
14963 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14964 if (!msg)
14965 return;
14966
14967 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14968 if (!hdr) {
14969 nlmsg_free(msg);
14970 return;
14971 }
14972
14973 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14974 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14975 wdev->netdev->ifindex)) ||
14976 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14977 NL80211_ATTR_PAD))
14978 goto nla_put_failure;
14979
14980 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14981 NL80211_ATTR_PAD))
14982 goto nla_put_failure;
14983
14984 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14985 if (!func_attr)
14986 goto nla_put_failure;
14987
14988 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14989 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14990 goto nla_put_failure;
14991
14992 nla_nest_end(msg, func_attr);
14993 genlmsg_end(msg, hdr);
14994
14995 if (!wdev->owner_nlportid)
14996 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14997 msg, 0, NL80211_MCGRP_NAN, gfp);
14998 else
14999 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
15000 wdev->owner_nlportid);
15001
15002 return;
15003
15004 nla_put_failure:
15005 nlmsg_free(msg);
15006 }
15007 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
15008
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)15009 static int nl80211_get_protocol_features(struct sk_buff *skb,
15010 struct genl_info *info)
15011 {
15012 void *hdr;
15013 struct sk_buff *msg;
15014
15015 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15016 if (!msg)
15017 return -ENOMEM;
15018
15019 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15020 NL80211_CMD_GET_PROTOCOL_FEATURES);
15021 if (!hdr)
15022 goto nla_put_failure;
15023
15024 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
15025 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
15026 goto nla_put_failure;
15027
15028 genlmsg_end(msg, hdr);
15029 return genlmsg_reply(msg, info);
15030
15031 nla_put_failure:
15032 kfree_skb(msg);
15033 return -ENOBUFS;
15034 }
15035
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)15036 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
15037 {
15038 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15039 struct cfg80211_update_ft_ies_params ft_params;
15040 struct net_device *dev = info->user_ptr[1];
15041
15042 if (!rdev->ops->update_ft_ies)
15043 return -EOPNOTSUPP;
15044
15045 if (!info->attrs[NL80211_ATTR_MDID] ||
15046 !info->attrs[NL80211_ATTR_IE])
15047 return -EINVAL;
15048
15049 memset(&ft_params, 0, sizeof(ft_params));
15050 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
15051 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15052 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15053
15054 return rdev_update_ft_ies(rdev, dev, &ft_params);
15055 }
15056
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)15057 static int nl80211_crit_protocol_start(struct sk_buff *skb,
15058 struct genl_info *info)
15059 {
15060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15061 struct wireless_dev *wdev = info->user_ptr[1];
15062 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
15063 u16 duration;
15064 int ret;
15065
15066 if (!rdev->ops->crit_proto_start)
15067 return -EOPNOTSUPP;
15068
15069 if (WARN_ON(!rdev->ops->crit_proto_stop))
15070 return -EINVAL;
15071
15072 if (rdev->crit_proto_nlportid)
15073 return -EBUSY;
15074
15075 /* determine protocol if provided */
15076 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
15077 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
15078
15079 if (proto >= NUM_NL80211_CRIT_PROTO)
15080 return -EINVAL;
15081
15082 /* timeout must be provided */
15083 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
15084 return -EINVAL;
15085
15086 duration =
15087 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
15088
15089 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
15090 if (!ret)
15091 rdev->crit_proto_nlportid = info->snd_portid;
15092
15093 return ret;
15094 }
15095
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)15096 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
15097 struct genl_info *info)
15098 {
15099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15100 struct wireless_dev *wdev = info->user_ptr[1];
15101
15102 if (!rdev->ops->crit_proto_stop)
15103 return -EOPNOTSUPP;
15104
15105 if (rdev->crit_proto_nlportid) {
15106 rdev->crit_proto_nlportid = 0;
15107 rdev_crit_proto_stop(rdev, wdev);
15108 }
15109 return 0;
15110 }
15111
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)15112 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
15113 struct nlattr *attr,
15114 struct netlink_ext_ack *extack)
15115 {
15116 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
15117 if (attr->nla_type & NLA_F_NESTED) {
15118 NL_SET_ERR_MSG_ATTR(extack, attr,
15119 "unexpected nested data");
15120 return -EINVAL;
15121 }
15122
15123 return 0;
15124 }
15125
15126 if (!(attr->nla_type & NLA_F_NESTED)) {
15127 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
15128 return -EINVAL;
15129 }
15130
15131 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
15132 }
15133
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)15134 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
15135 {
15136 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15137 struct wireless_dev *wdev =
15138 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
15139 info->attrs);
15140 int i, err;
15141 u32 vid, subcmd;
15142
15143 if (!rdev->wiphy.vendor_commands)
15144 return -EOPNOTSUPP;
15145
15146 if (IS_ERR(wdev)) {
15147 err = PTR_ERR(wdev);
15148 if (err != -EINVAL)
15149 return err;
15150 wdev = NULL;
15151 } else if (wdev->wiphy != &rdev->wiphy) {
15152 return -EINVAL;
15153 }
15154
15155 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
15156 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
15157 return -EINVAL;
15158
15159 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
15160 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
15161 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
15162 const struct wiphy_vendor_command *vcmd;
15163 void *data = NULL;
15164 int len = 0;
15165
15166 vcmd = &rdev->wiphy.vendor_commands[i];
15167
15168 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15169 continue;
15170
15171 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15172 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15173 if (!wdev)
15174 return -EINVAL;
15175 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15176 !wdev->netdev)
15177 return -EINVAL;
15178
15179 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15180 if (!wdev_running(wdev))
15181 return -ENETDOWN;
15182 }
15183 } else {
15184 wdev = NULL;
15185 }
15186
15187 if (!vcmd->doit)
15188 return -EOPNOTSUPP;
15189
15190 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
15191 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15192 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15193
15194 err = nl80211_vendor_check_policy(vcmd,
15195 info->attrs[NL80211_ATTR_VENDOR_DATA],
15196 info->extack);
15197 if (err)
15198 return err;
15199 }
15200
15201 rdev->cur_cmd_info = info;
15202 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
15203 rdev->cur_cmd_info = NULL;
15204 return err;
15205 }
15206
15207 return -EOPNOTSUPP;
15208 }
15209
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)15210 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
15211 struct netlink_callback *cb,
15212 struct cfg80211_registered_device **rdev,
15213 struct wireless_dev **wdev)
15214 {
15215 struct nlattr **attrbuf;
15216 u32 vid, subcmd;
15217 unsigned int i;
15218 int vcmd_idx = -1;
15219 int err;
15220 void *data = NULL;
15221 unsigned int data_len = 0;
15222
15223 if (cb->args[0]) {
15224 /* subtract the 1 again here */
15225 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15226 struct wireless_dev *tmp;
15227
15228 if (!wiphy)
15229 return -ENODEV;
15230 *rdev = wiphy_to_rdev(wiphy);
15231 *wdev = NULL;
15232
15233 if (cb->args[1]) {
15234 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15235 if (tmp->identifier == cb->args[1] - 1) {
15236 *wdev = tmp;
15237 break;
15238 }
15239 }
15240 }
15241
15242 /* keep rtnl locked in successful case */
15243 return 0;
15244 }
15245
15246 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15247 if (!attrbuf)
15248 return -ENOMEM;
15249
15250 err = nlmsg_parse_deprecated(cb->nlh,
15251 GENL_HDRLEN + nl80211_fam.hdrsize,
15252 attrbuf, nl80211_fam.maxattr,
15253 nl80211_policy, NULL);
15254 if (err)
15255 goto out;
15256
15257 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15258 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15259 err = -EINVAL;
15260 goto out;
15261 }
15262
15263 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15264 if (IS_ERR(*wdev))
15265 *wdev = NULL;
15266
15267 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15268 if (IS_ERR(*rdev)) {
15269 err = PTR_ERR(*rdev);
15270 goto out;
15271 }
15272
15273 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15274 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15275
15276 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15277 const struct wiphy_vendor_command *vcmd;
15278
15279 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15280
15281 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15282 continue;
15283
15284 if (!vcmd->dumpit) {
15285 err = -EOPNOTSUPP;
15286 goto out;
15287 }
15288
15289 vcmd_idx = i;
15290 break;
15291 }
15292
15293 if (vcmd_idx < 0) {
15294 err = -EOPNOTSUPP;
15295 goto out;
15296 }
15297
15298 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15299 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15300 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15301
15302 err = nl80211_vendor_check_policy(
15303 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15304 attrbuf[NL80211_ATTR_VENDOR_DATA],
15305 cb->extack);
15306 if (err)
15307 goto out;
15308 }
15309
15310 /* 0 is the first index - add 1 to parse only once */
15311 cb->args[0] = (*rdev)->wiphy_idx + 1;
15312 /* add 1 to know if it was NULL */
15313 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15314 cb->args[2] = vcmd_idx;
15315 cb->args[3] = (unsigned long)data;
15316 cb->args[4] = data_len;
15317
15318 /* keep rtnl locked in successful case */
15319 err = 0;
15320 out:
15321 kfree(attrbuf);
15322 return err;
15323 }
15324
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)15325 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15326 struct netlink_callback *cb)
15327 {
15328 struct cfg80211_registered_device *rdev;
15329 struct wireless_dev *wdev;
15330 unsigned int vcmd_idx;
15331 const struct wiphy_vendor_command *vcmd;
15332 void *data;
15333 int data_len;
15334 int err;
15335 struct nlattr *vendor_data;
15336
15337 rtnl_lock();
15338 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15339 if (err)
15340 goto out;
15341
15342 vcmd_idx = cb->args[2];
15343 data = (void *)cb->args[3];
15344 data_len = cb->args[4];
15345 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15346
15347 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15348 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15349 if (!wdev) {
15350 err = -EINVAL;
15351 goto out;
15352 }
15353 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15354 !wdev->netdev) {
15355 err = -EINVAL;
15356 goto out;
15357 }
15358
15359 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15360 if (!wdev_running(wdev)) {
15361 err = -ENETDOWN;
15362 goto out;
15363 }
15364 }
15365 }
15366
15367 while (1) {
15368 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15369 cb->nlh->nlmsg_seq, NLM_F_MULTI,
15370 NL80211_CMD_VENDOR);
15371 if (!hdr)
15372 break;
15373
15374 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15375 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15376 wdev_id(wdev),
15377 NL80211_ATTR_PAD))) {
15378 genlmsg_cancel(skb, hdr);
15379 break;
15380 }
15381
15382 vendor_data = nla_nest_start_noflag(skb,
15383 NL80211_ATTR_VENDOR_DATA);
15384 if (!vendor_data) {
15385 genlmsg_cancel(skb, hdr);
15386 break;
15387 }
15388
15389 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15390 (unsigned long *)&cb->args[5]);
15391 nla_nest_end(skb, vendor_data);
15392
15393 if (err == -ENOBUFS || err == -ENOENT) {
15394 genlmsg_cancel(skb, hdr);
15395 break;
15396 } else if (err <= 0) {
15397 genlmsg_cancel(skb, hdr);
15398 goto out;
15399 }
15400
15401 genlmsg_end(skb, hdr);
15402 }
15403
15404 err = skb->len;
15405 out:
15406 rtnl_unlock();
15407 return err;
15408 }
15409
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)15410 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15411 enum nl80211_commands cmd,
15412 enum nl80211_attrs attr,
15413 int approxlen)
15414 {
15415 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15416
15417 if (WARN_ON(!rdev->cur_cmd_info))
15418 return NULL;
15419
15420 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15421 rdev->cur_cmd_info->snd_portid,
15422 rdev->cur_cmd_info->snd_seq,
15423 cmd, attr, NULL, GFP_KERNEL);
15424 }
15425 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15426
cfg80211_vendor_cmd_reply(struct sk_buff * skb)15427 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15428 {
15429 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15430 void *hdr = ((void **)skb->cb)[1];
15431 struct nlattr *data = ((void **)skb->cb)[2];
15432
15433 /* clear CB data for netlink core to own from now on */
15434 memset(skb->cb, 0, sizeof(skb->cb));
15435
15436 if (WARN_ON(!rdev->cur_cmd_info)) {
15437 kfree_skb(skb);
15438 return -EINVAL;
15439 }
15440
15441 nla_nest_end(skb, data);
15442 genlmsg_end(skb, hdr);
15443 return genlmsg_reply(skb, rdev->cur_cmd_info);
15444 }
15445 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15446
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)15447 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15448 {
15449 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15450
15451 if (WARN_ON(!rdev->cur_cmd_info))
15452 return 0;
15453
15454 return rdev->cur_cmd_info->snd_portid;
15455 }
15456 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15457
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)15458 static int nl80211_set_qos_map(struct sk_buff *skb,
15459 struct genl_info *info)
15460 {
15461 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15462 struct cfg80211_qos_map *qos_map = NULL;
15463 struct net_device *dev = info->user_ptr[1];
15464 u8 *pos, len, num_des, des_len, des;
15465 int ret;
15466
15467 if (!rdev->ops->set_qos_map)
15468 return -EOPNOTSUPP;
15469
15470 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15471 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15472 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15473
15474 if (len % 2)
15475 return -EINVAL;
15476
15477 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15478 if (!qos_map)
15479 return -ENOMEM;
15480
15481 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15482 if (num_des) {
15483 des_len = num_des *
15484 sizeof(struct cfg80211_dscp_exception);
15485 memcpy(qos_map->dscp_exception, pos, des_len);
15486 qos_map->num_des = num_des;
15487 for (des = 0; des < num_des; des++) {
15488 if (qos_map->dscp_exception[des].up > 7) {
15489 kfree(qos_map);
15490 return -EINVAL;
15491 }
15492 }
15493 pos += des_len;
15494 }
15495 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15496 }
15497
15498 ret = nl80211_key_allowed(dev->ieee80211_ptr);
15499 if (!ret)
15500 ret = rdev_set_qos_map(rdev, dev, qos_map);
15501
15502 kfree(qos_map);
15503 return ret;
15504 }
15505
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)15506 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15507 {
15508 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15509 struct net_device *dev = info->user_ptr[1];
15510 struct wireless_dev *wdev = dev->ieee80211_ptr;
15511 const u8 *peer;
15512 u8 tsid, up;
15513 u16 admitted_time = 0;
15514
15515 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15516 return -EOPNOTSUPP;
15517
15518 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15519 !info->attrs[NL80211_ATTR_USER_PRIO])
15520 return -EINVAL;
15521
15522 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15523 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15524
15525 /* WMM uses TIDs 0-7 even for TSPEC */
15526 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15527 /* TODO: handle 802.11 TSPEC/admission control
15528 * need more attributes for that (e.g. BA session requirement);
15529 * change the WMM admission test above to allow both then
15530 */
15531 return -EINVAL;
15532 }
15533
15534 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15535
15536 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15537 admitted_time =
15538 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15539 if (!admitted_time)
15540 return -EINVAL;
15541 }
15542
15543 switch (wdev->iftype) {
15544 case NL80211_IFTYPE_STATION:
15545 case NL80211_IFTYPE_P2P_CLIENT:
15546 if (wdev->connected)
15547 break;
15548 return -ENOTCONN;
15549 default:
15550 return -EOPNOTSUPP;
15551 }
15552
15553 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15554 }
15555
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)15556 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15557 {
15558 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15559 struct net_device *dev = info->user_ptr[1];
15560 const u8 *peer;
15561 u8 tsid;
15562
15563 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15564 return -EINVAL;
15565
15566 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15567 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15568
15569 return rdev_del_tx_ts(rdev, dev, tsid, peer);
15570 }
15571
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)15572 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15573 struct genl_info *info)
15574 {
15575 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15576 struct net_device *dev = info->user_ptr[1];
15577 struct wireless_dev *wdev = dev->ieee80211_ptr;
15578 struct cfg80211_chan_def chandef = {};
15579 const u8 *addr;
15580 u8 oper_class;
15581 int err;
15582
15583 if (!rdev->ops->tdls_channel_switch ||
15584 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15585 return -EOPNOTSUPP;
15586
15587 switch (dev->ieee80211_ptr->iftype) {
15588 case NL80211_IFTYPE_STATION:
15589 case NL80211_IFTYPE_P2P_CLIENT:
15590 break;
15591 default:
15592 return -EOPNOTSUPP;
15593 }
15594
15595 if (!info->attrs[NL80211_ATTR_MAC] ||
15596 !info->attrs[NL80211_ATTR_OPER_CLASS])
15597 return -EINVAL;
15598
15599 err = nl80211_parse_chandef(rdev, info, &chandef);
15600 if (err)
15601 return err;
15602
15603 /*
15604 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15605 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15606 * specification is not defined for them.
15607 */
15608 if (chandef.chan->band == NL80211_BAND_2GHZ &&
15609 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15610 chandef.width != NL80211_CHAN_WIDTH_20)
15611 return -EINVAL;
15612
15613 /* we will be active on the TDLS link */
15614 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15615 wdev->iftype))
15616 return -EINVAL;
15617
15618 /* don't allow switching to DFS channels */
15619 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15620 return -EINVAL;
15621
15622 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15623 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15624
15625 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15626 }
15627
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)15628 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15629 struct genl_info *info)
15630 {
15631 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15632 struct net_device *dev = info->user_ptr[1];
15633 const u8 *addr;
15634
15635 if (!rdev->ops->tdls_channel_switch ||
15636 !rdev->ops->tdls_cancel_channel_switch ||
15637 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15638 return -EOPNOTSUPP;
15639
15640 switch (dev->ieee80211_ptr->iftype) {
15641 case NL80211_IFTYPE_STATION:
15642 case NL80211_IFTYPE_P2P_CLIENT:
15643 break;
15644 default:
15645 return -EOPNOTSUPP;
15646 }
15647
15648 if (!info->attrs[NL80211_ATTR_MAC])
15649 return -EINVAL;
15650
15651 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15652
15653 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15654
15655 return 0;
15656 }
15657
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)15658 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15659 struct genl_info *info)
15660 {
15661 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15662 struct net_device *dev = info->user_ptr[1];
15663 struct wireless_dev *wdev = dev->ieee80211_ptr;
15664 const struct nlattr *nla;
15665 bool enabled;
15666
15667 if (!rdev->ops->set_multicast_to_unicast)
15668 return -EOPNOTSUPP;
15669
15670 if (wdev->iftype != NL80211_IFTYPE_AP &&
15671 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15672 return -EOPNOTSUPP;
15673
15674 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15675 enabled = nla_get_flag(nla);
15676
15677 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15678 }
15679
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)15680 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15681 {
15682 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15683 struct net_device *dev = info->user_ptr[1];
15684 struct wireless_dev *wdev = dev->ieee80211_ptr;
15685 struct cfg80211_pmk_conf pmk_conf = {};
15686
15687 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15688 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15689 return -EOPNOTSUPP;
15690
15691 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15692 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15693 return -EOPNOTSUPP;
15694
15695 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15696 return -EINVAL;
15697
15698 if (!wdev->connected)
15699 return -ENOTCONN;
15700
15701 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15702 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
15703 return -EINVAL;
15704
15705 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15706 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15707 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15708 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
15709 return -EINVAL;
15710
15711 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15712 pmk_conf.pmk_r0_name =
15713 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15714
15715 return rdev_set_pmk(rdev, dev, &pmk_conf);
15716 }
15717
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)15718 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15719 {
15720 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15721 struct net_device *dev = info->user_ptr[1];
15722 struct wireless_dev *wdev = dev->ieee80211_ptr;
15723 const u8 *aa;
15724
15725 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15726 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15727 return -EOPNOTSUPP;
15728
15729 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15730 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15731 return -EOPNOTSUPP;
15732
15733 if (!info->attrs[NL80211_ATTR_MAC])
15734 return -EINVAL;
15735
15736 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15737 return rdev_del_pmk(rdev, dev, aa);
15738 }
15739
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)15740 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15741 {
15742 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15743 struct net_device *dev = info->user_ptr[1];
15744 struct cfg80211_external_auth_params params;
15745
15746 if (!rdev->ops->external_auth)
15747 return -EOPNOTSUPP;
15748
15749 if (!info->attrs[NL80211_ATTR_SSID] &&
15750 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15751 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15752 return -EINVAL;
15753
15754 if (!info->attrs[NL80211_ATTR_BSSID])
15755 return -EINVAL;
15756
15757 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15758 return -EINVAL;
15759
15760 memset(¶ms, 0, sizeof(params));
15761
15762 if (info->attrs[NL80211_ATTR_SSID]) {
15763 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15764 if (params.ssid.ssid_len == 0)
15765 return -EINVAL;
15766 memcpy(params.ssid.ssid,
15767 nla_data(info->attrs[NL80211_ATTR_SSID]),
15768 params.ssid.ssid_len);
15769 }
15770
15771 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15772 ETH_ALEN);
15773
15774 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15775
15776 if (info->attrs[NL80211_ATTR_PMKID])
15777 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15778
15779 return rdev_external_auth(rdev, dev, ¶ms);
15780 }
15781
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)15782 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15783 {
15784 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15785 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15786 struct net_device *dev = info->user_ptr[1];
15787 struct wireless_dev *wdev = dev->ieee80211_ptr;
15788 const u8 *buf;
15789 size_t len;
15790 u8 *dest;
15791 u16 proto;
15792 bool noencrypt;
15793 u64 cookie = 0;
15794 int link_id;
15795 int err;
15796
15797 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15798 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15799 return -EOPNOTSUPP;
15800
15801 if (!rdev->ops->tx_control_port)
15802 return -EOPNOTSUPP;
15803
15804 if (!info->attrs[NL80211_ATTR_FRAME] ||
15805 !info->attrs[NL80211_ATTR_MAC] ||
15806 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15807 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15808 return -EINVAL;
15809 }
15810
15811 switch (wdev->iftype) {
15812 case NL80211_IFTYPE_AP:
15813 case NL80211_IFTYPE_P2P_GO:
15814 case NL80211_IFTYPE_MESH_POINT:
15815 break;
15816 case NL80211_IFTYPE_ADHOC:
15817 if (wdev->u.ibss.current_bss)
15818 break;
15819 return -ENOTCONN;
15820 case NL80211_IFTYPE_STATION:
15821 case NL80211_IFTYPE_P2P_CLIENT:
15822 if (wdev->connected)
15823 break;
15824 return -ENOTCONN;
15825 default:
15826 return -EOPNOTSUPP;
15827 }
15828
15829 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15830 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15831 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15832 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15833 noencrypt =
15834 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15835
15836 link_id = nl80211_link_id_or_invalid(info->attrs);
15837
15838 err = rdev_tx_control_port(rdev, dev, buf, len,
15839 dest, cpu_to_be16(proto), noencrypt, link_id,
15840 dont_wait_for_ack ? NULL : &cookie);
15841 if (!err && !dont_wait_for_ack)
15842 nl_set_extack_cookie_u64(info->extack, cookie);
15843 return err;
15844 }
15845
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)15846 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15847 struct genl_info *info)
15848 {
15849 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15850 struct net_device *dev = info->user_ptr[1];
15851 struct wireless_dev *wdev = dev->ieee80211_ptr;
15852 struct cfg80211_ftm_responder_stats ftm_stats = {};
15853 unsigned int link_id = nl80211_link_id(info->attrs);
15854 struct sk_buff *msg;
15855 void *hdr;
15856 struct nlattr *ftm_stats_attr;
15857 int err;
15858
15859 if (wdev->iftype != NL80211_IFTYPE_AP ||
15860 !wdev->links[link_id].ap.beacon_interval)
15861 return -EOPNOTSUPP;
15862
15863 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15864 if (err)
15865 return err;
15866
15867 if (!ftm_stats.filled)
15868 return -ENODATA;
15869
15870 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15871 if (!msg)
15872 return -ENOMEM;
15873
15874 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15875 NL80211_CMD_GET_FTM_RESPONDER_STATS);
15876 if (!hdr)
15877 goto nla_put_failure;
15878
15879 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15880 goto nla_put_failure;
15881
15882 ftm_stats_attr = nla_nest_start_noflag(msg,
15883 NL80211_ATTR_FTM_RESPONDER_STATS);
15884 if (!ftm_stats_attr)
15885 goto nla_put_failure;
15886
15887 #define SET_FTM(field, name, type) \
15888 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15889 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
15890 ftm_stats.field)) \
15891 goto nla_put_failure; } while (0)
15892 #define SET_FTM_U64(field, name) \
15893 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15894 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
15895 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
15896 goto nla_put_failure; } while (0)
15897
15898 SET_FTM(success_num, SUCCESS_NUM, u32);
15899 SET_FTM(partial_num, PARTIAL_NUM, u32);
15900 SET_FTM(failed_num, FAILED_NUM, u32);
15901 SET_FTM(asap_num, ASAP_NUM, u32);
15902 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15903 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15904 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15905 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15906 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15907 #undef SET_FTM
15908
15909 nla_nest_end(msg, ftm_stats_attr);
15910
15911 genlmsg_end(msg, hdr);
15912 return genlmsg_reply(msg, info);
15913
15914 nla_put_failure:
15915 nlmsg_free(msg);
15916 return -ENOBUFS;
15917 }
15918
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)15919 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15920 {
15921 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15922 struct cfg80211_update_owe_info owe_info;
15923 struct net_device *dev = info->user_ptr[1];
15924
15925 if (!rdev->ops->update_owe_info)
15926 return -EOPNOTSUPP;
15927
15928 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15929 !info->attrs[NL80211_ATTR_MAC])
15930 return -EINVAL;
15931
15932 memset(&owe_info, 0, sizeof(owe_info));
15933 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15934 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15935
15936 if (info->attrs[NL80211_ATTR_IE]) {
15937 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15938 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15939 }
15940
15941 return rdev_update_owe_info(rdev, dev, &owe_info);
15942 }
15943
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)15944 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15945 {
15946 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15947 struct net_device *dev = info->user_ptr[1];
15948 struct wireless_dev *wdev = dev->ieee80211_ptr;
15949 struct station_info sinfo = {};
15950 const u8 *buf;
15951 size_t len;
15952 u8 *dest;
15953 int err;
15954
15955 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15956 return -EOPNOTSUPP;
15957
15958 if (!info->attrs[NL80211_ATTR_MAC] ||
15959 !info->attrs[NL80211_ATTR_FRAME]) {
15960 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15961 return -EINVAL;
15962 }
15963
15964 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15965 return -EOPNOTSUPP;
15966
15967 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15968 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15969 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15970
15971 if (len < sizeof(struct ethhdr))
15972 return -EINVAL;
15973
15974 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15975 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15976 return -EINVAL;
15977
15978 err = rdev_get_station(rdev, dev, dest, &sinfo);
15979 if (err)
15980 return err;
15981
15982 cfg80211_sinfo_release_content(&sinfo);
15983
15984 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15985 }
15986
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)15987 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15988 struct nlattr *attrs[], struct net_device *dev,
15989 struct cfg80211_tid_cfg *tid_conf,
15990 struct genl_info *info, const u8 *peer,
15991 unsigned int link_id)
15992 {
15993 struct netlink_ext_ack *extack = info->extack;
15994 u64 mask;
15995 int err;
15996
15997 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15998 return -EINVAL;
15999
16000 tid_conf->config_override =
16001 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
16002 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
16003
16004 if (tid_conf->config_override) {
16005 if (rdev->ops->reset_tid_config) {
16006 err = rdev_reset_tid_config(rdev, dev, peer,
16007 tid_conf->tids);
16008 if (err)
16009 return err;
16010 } else {
16011 return -EINVAL;
16012 }
16013 }
16014
16015 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
16016 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
16017 tid_conf->noack =
16018 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
16019 }
16020
16021 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
16022 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
16023 tid_conf->retry_short =
16024 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
16025
16026 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
16027 return -EINVAL;
16028 }
16029
16030 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
16031 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
16032 tid_conf->retry_long =
16033 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
16034
16035 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
16036 return -EINVAL;
16037 }
16038
16039 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
16040 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
16041 tid_conf->ampdu =
16042 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
16043 }
16044
16045 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
16046 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
16047 tid_conf->rtscts =
16048 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
16049 }
16050
16051 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
16052 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
16053 tid_conf->amsdu =
16054 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
16055 }
16056
16057 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
16058 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
16059
16060 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
16061
16062 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
16063 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
16064 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
16065 &tid_conf->txrate_mask, dev,
16066 true, link_id);
16067 if (err)
16068 return err;
16069
16070 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
16071 }
16072 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
16073 }
16074
16075 if (peer)
16076 mask = rdev->wiphy.tid_config_support.peer;
16077 else
16078 mask = rdev->wiphy.tid_config_support.vif;
16079
16080 if (tid_conf->mask & ~mask) {
16081 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
16082 return -EOPNOTSUPP;
16083 }
16084
16085 return 0;
16086 }
16087
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)16088 static int nl80211_set_tid_config(struct sk_buff *skb,
16089 struct genl_info *info)
16090 {
16091 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16092 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
16093 unsigned int link_id = nl80211_link_id(info->attrs);
16094 struct net_device *dev = info->user_ptr[1];
16095 struct cfg80211_tid_config *tid_config;
16096 struct nlattr *tid;
16097 int conf_idx = 0, rem_conf;
16098 int ret = -EINVAL;
16099 u32 num_conf = 0;
16100
16101 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
16102 return -EINVAL;
16103
16104 if (!rdev->ops->set_tid_config)
16105 return -EOPNOTSUPP;
16106
16107 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16108 rem_conf)
16109 num_conf++;
16110
16111 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
16112 GFP_KERNEL);
16113 if (!tid_config)
16114 return -ENOMEM;
16115
16116 tid_config->n_tid_conf = num_conf;
16117
16118 if (info->attrs[NL80211_ATTR_MAC])
16119 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16120
16121 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16122 rem_conf) {
16123 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
16124 tid, NULL, NULL);
16125
16126 if (ret)
16127 goto bad_tid_conf;
16128
16129 ret = parse_tid_conf(rdev, attrs, dev,
16130 &tid_config->tid_conf[conf_idx],
16131 info, tid_config->peer, link_id);
16132 if (ret)
16133 goto bad_tid_conf;
16134
16135 conf_idx++;
16136 }
16137
16138 ret = rdev_set_tid_config(rdev, dev, tid_config);
16139
16140 bad_tid_conf:
16141 kfree(tid_config);
16142 return ret;
16143 }
16144
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)16145 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
16146 {
16147 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16148 struct cfg80211_color_change_settings params = {};
16149 struct net_device *dev = info->user_ptr[1];
16150 struct wireless_dev *wdev = dev->ieee80211_ptr;
16151 struct nlattr **tb;
16152 u16 offset;
16153 int err;
16154
16155 if (!rdev->ops->color_change)
16156 return -EOPNOTSUPP;
16157
16158 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16159 NL80211_EXT_FEATURE_BSS_COLOR))
16160 return -EOPNOTSUPP;
16161
16162 if (wdev->iftype != NL80211_IFTYPE_AP)
16163 return -EOPNOTSUPP;
16164
16165 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
16166 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
16167 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
16168 return -EINVAL;
16169
16170 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16171 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16172
16173 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
16174 info->extack);
16175 if (err)
16176 return err;
16177
16178 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16179 if (!tb)
16180 return -ENOMEM;
16181
16182 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16183 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16184 nl80211_policy, info->extack);
16185 if (err)
16186 goto out;
16187
16188 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
16189 info->extack);
16190 if (err)
16191 goto out;
16192
16193 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16194 err = -EINVAL;
16195 goto out;
16196 }
16197
16198 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16199 err = -EINVAL;
16200 goto out;
16201 }
16202
16203 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16204 if (offset >= params.beacon_color_change.tail_len) {
16205 err = -EINVAL;
16206 goto out;
16207 }
16208
16209 if (params.beacon_color_change.tail[offset] != params.count) {
16210 err = -EINVAL;
16211 goto out;
16212 }
16213
16214 params.counter_offset_beacon = offset;
16215
16216 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16217 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16218 sizeof(u16)) {
16219 err = -EINVAL;
16220 goto out;
16221 }
16222
16223 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16224 if (offset >= params.beacon_color_change.probe_resp_len) {
16225 err = -EINVAL;
16226 goto out;
16227 }
16228
16229 if (params.beacon_color_change.probe_resp[offset] !=
16230 params.count) {
16231 err = -EINVAL;
16232 goto out;
16233 }
16234
16235 params.counter_offset_presp = offset;
16236 }
16237
16238 params.link_id = nl80211_link_id(info->attrs);
16239 err = rdev_color_change(rdev, dev, ¶ms);
16240
16241 out:
16242 kfree(params.beacon_next.mbssid_ies);
16243 kfree(params.beacon_color_change.mbssid_ies);
16244 kfree(params.beacon_next.rnr_ies);
16245 kfree(params.beacon_color_change.rnr_ies);
16246 kfree(tb);
16247 return err;
16248 }
16249
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)16250 static int nl80211_set_fils_aad(struct sk_buff *skb,
16251 struct genl_info *info)
16252 {
16253 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16254 struct net_device *dev = info->user_ptr[1];
16255 struct cfg80211_fils_aad fils_aad = {};
16256 u8 *nonces;
16257
16258 if (!info->attrs[NL80211_ATTR_MAC] ||
16259 !info->attrs[NL80211_ATTR_FILS_KEK] ||
16260 !info->attrs[NL80211_ATTR_FILS_NONCES])
16261 return -EINVAL;
16262
16263 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16264 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16265 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16266 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16267 fils_aad.snonce = nonces;
16268 fils_aad.anonce = nonces + FILS_NONCE_LEN;
16269
16270 return rdev_set_fils_aad(rdev, dev, &fils_aad);
16271 }
16272
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)16273 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16274 {
16275 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16276 unsigned int link_id = nl80211_link_id(info->attrs);
16277 struct net_device *dev = info->user_ptr[1];
16278 struct wireless_dev *wdev = dev->ieee80211_ptr;
16279 int ret;
16280
16281 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16282 return -EINVAL;
16283
16284 switch (wdev->iftype) {
16285 case NL80211_IFTYPE_AP:
16286 break;
16287 default:
16288 return -EINVAL;
16289 }
16290
16291 if (!info->attrs[NL80211_ATTR_MAC] ||
16292 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16293 return -EINVAL;
16294
16295 wdev->valid_links |= BIT(link_id);
16296 ether_addr_copy(wdev->links[link_id].addr,
16297 nla_data(info->attrs[NL80211_ATTR_MAC]));
16298
16299 ret = rdev_add_intf_link(rdev, wdev, link_id);
16300 if (ret) {
16301 wdev->valid_links &= ~BIT(link_id);
16302 eth_zero_addr(wdev->links[link_id].addr);
16303 }
16304
16305 return ret;
16306 }
16307
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)16308 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16309 {
16310 unsigned int link_id = nl80211_link_id(info->attrs);
16311 struct net_device *dev = info->user_ptr[1];
16312 struct wireless_dev *wdev = dev->ieee80211_ptr;
16313
16314 /* cannot remove if there's no link */
16315 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16316 return -EINVAL;
16317
16318 switch (wdev->iftype) {
16319 case NL80211_IFTYPE_AP:
16320 break;
16321 default:
16322 return -EINVAL;
16323 }
16324
16325 cfg80211_remove_link(wdev, link_id);
16326
16327 return 0;
16328 }
16329
16330 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)16331 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16332 bool add)
16333 {
16334 struct link_station_parameters params = {};
16335 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16336 struct net_device *dev = info->user_ptr[1];
16337 int err;
16338
16339 if ((add && !rdev->ops->add_link_station) ||
16340 (!add && !rdev->ops->mod_link_station))
16341 return -EOPNOTSUPP;
16342
16343 if (add && !info->attrs[NL80211_ATTR_MAC])
16344 return -EINVAL;
16345
16346 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16347 return -EINVAL;
16348
16349 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16350 return -EINVAL;
16351
16352 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16353
16354 if (info->attrs[NL80211_ATTR_MAC]) {
16355 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16356 if (!is_valid_ether_addr(params.link_mac))
16357 return -EINVAL;
16358 }
16359
16360 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16361 return -EINVAL;
16362
16363 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16364
16365 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16366 params.supported_rates =
16367 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16368 params.supported_rates_len =
16369 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16370 }
16371
16372 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16373 params.ht_capa =
16374 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16375
16376 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16377 params.vht_capa =
16378 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16379
16380 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16381 params.he_capa =
16382 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16383 params.he_capa_len =
16384 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16385
16386 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16387 params.eht_capa =
16388 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16389 params.eht_capa_len =
16390 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16391
16392 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16393 (const u8 *)params.eht_capa,
16394 params.eht_capa_len,
16395 false))
16396 return -EINVAL;
16397 }
16398 }
16399
16400 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16401 params.he_6ghz_capa =
16402 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16403
16404 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16405 params.opmode_notif_used = true;
16406 params.opmode_notif =
16407 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16408 }
16409
16410 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
16411 ¶ms.txpwr_set);
16412 if (err)
16413 return err;
16414
16415 if (add)
16416 return rdev_add_link_station(rdev, dev, ¶ms);
16417
16418 return rdev_mod_link_station(rdev, dev, ¶ms);
16419 }
16420
16421 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)16422 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16423 {
16424 return nl80211_add_mod_link_station(skb, info, true);
16425 }
16426
16427 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)16428 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16429 {
16430 return nl80211_add_mod_link_station(skb, info, false);
16431 }
16432
16433 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)16434 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16435 {
16436 struct link_station_del_parameters params = {};
16437 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16438 struct net_device *dev = info->user_ptr[1];
16439
16440 if (!rdev->ops->del_link_station)
16441 return -EOPNOTSUPP;
16442
16443 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16444 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16445 return -EINVAL;
16446
16447 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16448 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16449
16450 return rdev_del_link_station(rdev, dev, ¶ms);
16451 }
16452
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)16453 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16454 struct genl_info *info)
16455 {
16456 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16457 struct net_device *dev = info->user_ptr[1];
16458 struct cfg80211_set_hw_timestamp hwts = {};
16459
16460 if (!rdev->wiphy.hw_timestamp_max_peers)
16461 return -EOPNOTSUPP;
16462
16463 if (!info->attrs[NL80211_ATTR_MAC] &&
16464 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16465 return -EOPNOTSUPP;
16466
16467 if (info->attrs[NL80211_ATTR_MAC])
16468 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16469
16470 hwts.enable =
16471 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16472
16473 return rdev_set_hw_timestamp(rdev, dev, &hwts);
16474 }
16475
16476 static int
nl80211_set_ttlm(struct sk_buff * skb,struct genl_info * info)16477 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
16478 {
16479 struct cfg80211_ttlm_params params = {};
16480 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16481 struct net_device *dev = info->user_ptr[1];
16482 struct wireless_dev *wdev = dev->ieee80211_ptr;
16483
16484 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16485 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16486 return -EOPNOTSUPP;
16487
16488 if (!wdev->connected)
16489 return -ENOLINK;
16490
16491 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
16492 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
16493 return -EINVAL;
16494
16495 nla_memcpy(params.dlink,
16496 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
16497 sizeof(params.dlink));
16498 nla_memcpy(params.ulink,
16499 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
16500 sizeof(params.ulink));
16501
16502 return rdev_set_ttlm(rdev, dev, ¶ms);
16503 }
16504
nl80211_assoc_ml_reconf(struct sk_buff * skb,struct genl_info * info)16505 static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
16506 {
16507 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16508 struct net_device *dev = info->user_ptr[1];
16509 struct wireless_dev *wdev = dev->ieee80211_ptr;
16510 struct cfg80211_ml_reconf_req req = {};
16511 unsigned int link_id;
16512 u16 add_links;
16513 int err;
16514
16515 if (!wdev->valid_links)
16516 return -EINVAL;
16517
16518 if (dev->ieee80211_ptr->conn_owner_nlportid &&
16519 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
16520 return -EPERM;
16521
16522 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
16523 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
16524 return -EOPNOTSUPP;
16525
16526 add_links = 0;
16527 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
16528 err = nl80211_process_links(rdev, req.add_links,
16529 /* mark as MLO, but not assoc */
16530 IEEE80211_MLD_MAX_NUM_LINKS,
16531 NULL, 0, info);
16532 if (err)
16533 return err;
16534
16535 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
16536 link_id++) {
16537 if (!req.add_links[link_id].bss)
16538 continue;
16539 add_links |= BIT(link_id);
16540 }
16541 }
16542
16543 if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
16544 req.rem_links =
16545 nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
16546
16547 /* Validate that existing links are not added, removed links are valid
16548 * and don't allow adding and removing the same links
16549 */
16550 if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
16551 (wdev->valid_links & add_links) ||
16552 ((wdev->valid_links & req.rem_links) != req.rem_links)) {
16553 err = -EINVAL;
16554 goto out;
16555 }
16556
16557 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
16558 req.ext_mld_capa_ops =
16559 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
16560
16561 err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
16562
16563 out:
16564 for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
16565 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
16566
16567 return err;
16568 }
16569
16570 static int
nl80211_epcs_cfg(struct sk_buff * skb,struct genl_info * info)16571 nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
16572 {
16573 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16574 struct net_device *dev = info->user_ptr[1];
16575 struct wireless_dev *wdev = dev->ieee80211_ptr;
16576 bool val;
16577
16578 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16579 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16580 return -EOPNOTSUPP;
16581
16582 if (!wdev->connected)
16583 return -ENOLINK;
16584
16585 val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
16586
16587 return rdev_set_epcs(rdev, dev, val);
16588 }
16589
16590 #define NL80211_FLAG_NEED_WIPHY 0x01
16591 #define NL80211_FLAG_NEED_NETDEV 0x02
16592 #define NL80211_FLAG_NEED_RTNL 0x04
16593 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
16594 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
16595 NL80211_FLAG_CHECK_NETDEV_UP)
16596 #define NL80211_FLAG_NEED_WDEV 0x10
16597 /* If a netdev is associated, it must be UP, P2P must be started */
16598 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
16599 NL80211_FLAG_CHECK_NETDEV_UP)
16600 #define NL80211_FLAG_CLEAR_SKB 0x20
16601 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
16602 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
16603 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
16604
16605 #define INTERNAL_FLAG_SELECTORS(__sel) \
16606 SELECTOR(__sel, NONE, 0) /* must be first */ \
16607 SELECTOR(__sel, WIPHY, \
16608 NL80211_FLAG_NEED_WIPHY) \
16609 SELECTOR(__sel, WDEV, \
16610 NL80211_FLAG_NEED_WDEV) \
16611 SELECTOR(__sel, NETDEV, \
16612 NL80211_FLAG_NEED_NETDEV) \
16613 SELECTOR(__sel, NETDEV_LINK, \
16614 NL80211_FLAG_NEED_NETDEV | \
16615 NL80211_FLAG_MLO_VALID_LINK_ID) \
16616 SELECTOR(__sel, NETDEV_NO_MLO, \
16617 NL80211_FLAG_NEED_NETDEV | \
16618 NL80211_FLAG_MLO_UNSUPPORTED) \
16619 SELECTOR(__sel, WIPHY_RTNL, \
16620 NL80211_FLAG_NEED_WIPHY | \
16621 NL80211_FLAG_NEED_RTNL) \
16622 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
16623 NL80211_FLAG_NEED_WIPHY | \
16624 NL80211_FLAG_NEED_RTNL | \
16625 NL80211_FLAG_NO_WIPHY_MTX) \
16626 SELECTOR(__sel, WDEV_RTNL, \
16627 NL80211_FLAG_NEED_WDEV | \
16628 NL80211_FLAG_NEED_RTNL) \
16629 SELECTOR(__sel, NETDEV_RTNL, \
16630 NL80211_FLAG_NEED_NETDEV | \
16631 NL80211_FLAG_NEED_RTNL) \
16632 SELECTOR(__sel, NETDEV_UP, \
16633 NL80211_FLAG_NEED_NETDEV_UP) \
16634 SELECTOR(__sel, NETDEV_UP_LINK, \
16635 NL80211_FLAG_NEED_NETDEV_UP | \
16636 NL80211_FLAG_MLO_VALID_LINK_ID) \
16637 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
16638 NL80211_FLAG_NEED_NETDEV_UP | \
16639 NL80211_FLAG_MLO_UNSUPPORTED) \
16640 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
16641 NL80211_FLAG_NEED_NETDEV_UP | \
16642 NL80211_FLAG_CLEAR_SKB | \
16643 NL80211_FLAG_MLO_UNSUPPORTED) \
16644 SELECTOR(__sel, NETDEV_UP_NOTMX, \
16645 NL80211_FLAG_NEED_NETDEV_UP | \
16646 NL80211_FLAG_NO_WIPHY_MTX) \
16647 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
16648 NL80211_FLAG_NEED_NETDEV_UP | \
16649 NL80211_FLAG_NO_WIPHY_MTX | \
16650 NL80211_FLAG_MLO_VALID_LINK_ID) \
16651 SELECTOR(__sel, NETDEV_UP_CLEAR, \
16652 NL80211_FLAG_NEED_NETDEV_UP | \
16653 NL80211_FLAG_CLEAR_SKB) \
16654 SELECTOR(__sel, WDEV_UP, \
16655 NL80211_FLAG_NEED_WDEV_UP) \
16656 SELECTOR(__sel, WDEV_UP_LINK, \
16657 NL80211_FLAG_NEED_WDEV_UP | \
16658 NL80211_FLAG_MLO_VALID_LINK_ID) \
16659 SELECTOR(__sel, WDEV_UP_RTNL, \
16660 NL80211_FLAG_NEED_WDEV_UP | \
16661 NL80211_FLAG_NEED_RTNL) \
16662 SELECTOR(__sel, WIPHY_CLEAR, \
16663 NL80211_FLAG_NEED_WIPHY | \
16664 NL80211_FLAG_CLEAR_SKB)
16665
16666 enum nl80211_internal_flags_selector {
16667 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
16668 INTERNAL_FLAG_SELECTORS(_)
16669 #undef SELECTOR
16670 };
16671
16672 static u32 nl80211_internal_flags[] = {
16673 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
16674 INTERNAL_FLAG_SELECTORS(_)
16675 #undef SELECTOR
16676 };
16677
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16678 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16679 struct sk_buff *skb,
16680 struct genl_info *info)
16681 {
16682 struct cfg80211_registered_device *rdev = NULL;
16683 struct wireless_dev *wdev = NULL;
16684 struct net_device *dev = NULL;
16685 u32 internal_flags;
16686 int err;
16687
16688 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16689 return -EINVAL;
16690
16691 internal_flags = nl80211_internal_flags[ops->internal_flags];
16692
16693 rtnl_lock();
16694 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16695 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16696 if (IS_ERR(rdev)) {
16697 err = PTR_ERR(rdev);
16698 goto out_unlock;
16699 }
16700 info->user_ptr[0] = rdev;
16701 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16702 internal_flags & NL80211_FLAG_NEED_WDEV) {
16703 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16704 info->attrs);
16705 if (IS_ERR(wdev)) {
16706 err = PTR_ERR(wdev);
16707 goto out_unlock;
16708 }
16709
16710 dev = wdev->netdev;
16711 dev_hold(dev);
16712 rdev = wiphy_to_rdev(wdev->wiphy);
16713
16714 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16715 if (!dev) {
16716 err = -EINVAL;
16717 goto out_unlock;
16718 }
16719
16720 info->user_ptr[1] = dev;
16721 } else {
16722 info->user_ptr[1] = wdev;
16723 }
16724
16725 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16726 !wdev_running(wdev)) {
16727 err = -ENETDOWN;
16728 goto out_unlock;
16729 }
16730
16731 info->user_ptr[0] = rdev;
16732 }
16733
16734 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16735 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16736
16737 if (!wdev) {
16738 err = -EINVAL;
16739 goto out_unlock;
16740 }
16741
16742 /* MLO -> require valid link ID */
16743 if (wdev->valid_links &&
16744 (!link_id ||
16745 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16746 err = -EINVAL;
16747 goto out_unlock;
16748 }
16749
16750 /* non-MLO -> no link ID attribute accepted */
16751 if (!wdev->valid_links && link_id) {
16752 err = -EINVAL;
16753 goto out_unlock;
16754 }
16755 }
16756
16757 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16758 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16759 (wdev && wdev->valid_links)) {
16760 err = -EINVAL;
16761 goto out_unlock;
16762 }
16763 }
16764
16765 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16766 wiphy_lock(&rdev->wiphy);
16767 /* we keep the mutex locked until post_doit */
16768 __release(&rdev->wiphy.mtx);
16769 }
16770 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16771 rtnl_unlock();
16772
16773 return 0;
16774 out_unlock:
16775 rtnl_unlock();
16776 dev_put(dev);
16777 return err;
16778 }
16779
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16780 static void nl80211_post_doit(const struct genl_split_ops *ops,
16781 struct sk_buff *skb,
16782 struct genl_info *info)
16783 {
16784 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16785
16786 if (info->user_ptr[1]) {
16787 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16788 struct wireless_dev *wdev = info->user_ptr[1];
16789
16790 dev_put(wdev->netdev);
16791 } else {
16792 dev_put(info->user_ptr[1]);
16793 }
16794 }
16795
16796 if (info->user_ptr[0] &&
16797 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16798 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16799
16800 /* we kept the mutex locked since pre_doit */
16801 __acquire(&rdev->wiphy.mtx);
16802 wiphy_unlock(&rdev->wiphy);
16803 }
16804
16805 if (internal_flags & NL80211_FLAG_NEED_RTNL)
16806 rtnl_unlock();
16807
16808 /* If needed, clear the netlink message payload from the SKB
16809 * as it might contain key data that shouldn't stick around on
16810 * the heap after the SKB is freed. The netlink message header
16811 * is still needed for further processing, so leave it intact.
16812 */
16813 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16814 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16815
16816 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16817 }
16818 }
16819
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)16820 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16821 struct cfg80211_sar_specs *sar_specs,
16822 struct nlattr *spec[], int index)
16823 {
16824 u32 range_index, i;
16825
16826 if (!sar_specs || !spec)
16827 return -EINVAL;
16828
16829 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16830 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16831 return -EINVAL;
16832
16833 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16834
16835 /* check if range_index exceeds num_freq_ranges */
16836 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16837 return -EINVAL;
16838
16839 /* check if range_index duplicates */
16840 for (i = 0; i < index; i++) {
16841 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16842 return -EINVAL;
16843 }
16844
16845 sar_specs->sub_specs[index].power =
16846 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16847
16848 sar_specs->sub_specs[index].freq_range_index = range_index;
16849
16850 return 0;
16851 }
16852
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)16853 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16854 {
16855 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16856 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16857 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16858 struct cfg80211_sar_specs *sar_spec;
16859 enum nl80211_sar_type type;
16860 struct nlattr *spec_list;
16861 u32 specs;
16862 int rem, err;
16863
16864 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16865 return -EOPNOTSUPP;
16866
16867 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16868 return -EINVAL;
16869
16870 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16871 info->attrs[NL80211_ATTR_SAR_SPEC],
16872 NULL, NULL);
16873
16874 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16875 return -EINVAL;
16876
16877 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16878 if (type != rdev->wiphy.sar_capa->type)
16879 return -EINVAL;
16880
16881 specs = 0;
16882 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16883 specs++;
16884
16885 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16886 return -EINVAL;
16887
16888 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16889 if (!sar_spec)
16890 return -ENOMEM;
16891
16892 sar_spec->type = type;
16893 specs = 0;
16894 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16895 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16896 spec_list, NULL, NULL);
16897
16898 switch (type) {
16899 case NL80211_SAR_TYPE_POWER:
16900 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16901 spec, specs)) {
16902 err = -EINVAL;
16903 goto error;
16904 }
16905 break;
16906 default:
16907 err = -EINVAL;
16908 goto error;
16909 }
16910 specs++;
16911 }
16912
16913 sar_spec->num_sub_specs = specs;
16914
16915 rdev->cur_cmd_info = info;
16916 err = rdev_set_sar_specs(rdev, sar_spec);
16917 rdev->cur_cmd_info = NULL;
16918 error:
16919 kfree(sar_spec);
16920 return err;
16921 }
16922
16923 #define SELECTOR(__sel, name, value) \
16924 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16925 int __missing_selector(void);
16926 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16927
16928 static const struct genl_ops nl80211_ops[] = {
16929 {
16930 .cmd = NL80211_CMD_GET_WIPHY,
16931 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16932 .doit = nl80211_get_wiphy,
16933 .dumpit = nl80211_dump_wiphy,
16934 .done = nl80211_dump_wiphy_done,
16935 /* can be retrieved by unprivileged users */
16936 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16937 },
16938 };
16939
16940 static const struct genl_small_ops nl80211_small_ops[] = {
16941 {
16942 .cmd = NL80211_CMD_SET_WIPHY,
16943 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16944 .doit = nl80211_set_wiphy,
16945 .flags = GENL_UNS_ADMIN_PERM,
16946 },
16947 {
16948 .cmd = NL80211_CMD_GET_INTERFACE,
16949 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16950 .doit = nl80211_get_interface,
16951 .dumpit = nl80211_dump_interface,
16952 /* can be retrieved by unprivileged users */
16953 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16954 },
16955 {
16956 .cmd = NL80211_CMD_SET_INTERFACE,
16957 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16958 .doit = nl80211_set_interface,
16959 .flags = GENL_UNS_ADMIN_PERM,
16960 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16961 NL80211_FLAG_NEED_RTNL),
16962 },
16963 {
16964 .cmd = NL80211_CMD_NEW_INTERFACE,
16965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16966 .doit = nl80211_new_interface,
16967 .flags = GENL_UNS_ADMIN_PERM,
16968 .internal_flags =
16969 IFLAGS(NL80211_FLAG_NEED_WIPHY |
16970 NL80211_FLAG_NEED_RTNL |
16971 /* we take the wiphy mutex later ourselves */
16972 NL80211_FLAG_NO_WIPHY_MTX),
16973 },
16974 {
16975 .cmd = NL80211_CMD_DEL_INTERFACE,
16976 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16977 .doit = nl80211_del_interface,
16978 .flags = GENL_UNS_ADMIN_PERM,
16979 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16980 NL80211_FLAG_NEED_RTNL),
16981 },
16982 {
16983 .cmd = NL80211_CMD_GET_KEY,
16984 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16985 .doit = nl80211_get_key,
16986 .flags = GENL_UNS_ADMIN_PERM,
16987 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16988 },
16989 {
16990 .cmd = NL80211_CMD_SET_KEY,
16991 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16992 .doit = nl80211_set_key,
16993 .flags = GENL_UNS_ADMIN_PERM,
16994 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16995 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16996 NL80211_FLAG_CLEAR_SKB),
16997 },
16998 {
16999 .cmd = NL80211_CMD_NEW_KEY,
17000 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17001 .doit = nl80211_new_key,
17002 .flags = GENL_UNS_ADMIN_PERM,
17003 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17004 NL80211_FLAG_CLEAR_SKB),
17005 },
17006 {
17007 .cmd = NL80211_CMD_DEL_KEY,
17008 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17009 .doit = nl80211_del_key,
17010 .flags = GENL_UNS_ADMIN_PERM,
17011 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17012 },
17013 {
17014 .cmd = NL80211_CMD_SET_BEACON,
17015 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17016 .flags = GENL_UNS_ADMIN_PERM,
17017 .doit = nl80211_set_beacon,
17018 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17019 NL80211_FLAG_MLO_VALID_LINK_ID),
17020 },
17021 {
17022 .cmd = NL80211_CMD_START_AP,
17023 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17024 .flags = GENL_UNS_ADMIN_PERM,
17025 .doit = nl80211_start_ap,
17026 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17027 NL80211_FLAG_MLO_VALID_LINK_ID),
17028 },
17029 {
17030 .cmd = NL80211_CMD_STOP_AP,
17031 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17032 .flags = GENL_UNS_ADMIN_PERM,
17033 .doit = nl80211_stop_ap,
17034 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17035 NL80211_FLAG_MLO_VALID_LINK_ID),
17036 },
17037 {
17038 .cmd = NL80211_CMD_GET_STATION,
17039 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17040 .doit = nl80211_get_station,
17041 .dumpit = nl80211_dump_station,
17042 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17043 },
17044 {
17045 .cmd = NL80211_CMD_SET_STATION,
17046 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17047 .doit = nl80211_set_station,
17048 .flags = GENL_UNS_ADMIN_PERM,
17049 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17050 },
17051 {
17052 .cmd = NL80211_CMD_NEW_STATION,
17053 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17054 .doit = nl80211_new_station,
17055 .flags = GENL_UNS_ADMIN_PERM,
17056 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17057 },
17058 {
17059 .cmd = NL80211_CMD_DEL_STATION,
17060 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17061 .doit = nl80211_del_station,
17062 .flags = GENL_UNS_ADMIN_PERM,
17063 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
17064 * whether MAC address is passed or not. If MAC address is
17065 * passed, then even during MLO, link ID is not required.
17066 */
17067 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17068 },
17069 {
17070 .cmd = NL80211_CMD_GET_MPATH,
17071 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17072 .doit = nl80211_get_mpath,
17073 .dumpit = nl80211_dump_mpath,
17074 .flags = GENL_UNS_ADMIN_PERM,
17075 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17076 },
17077 {
17078 .cmd = NL80211_CMD_GET_MPP,
17079 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17080 .doit = nl80211_get_mpp,
17081 .dumpit = nl80211_dump_mpp,
17082 .flags = GENL_UNS_ADMIN_PERM,
17083 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17084 },
17085 {
17086 .cmd = NL80211_CMD_SET_MPATH,
17087 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17088 .doit = nl80211_set_mpath,
17089 .flags = GENL_UNS_ADMIN_PERM,
17090 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17091 },
17092 {
17093 .cmd = NL80211_CMD_NEW_MPATH,
17094 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17095 .doit = nl80211_new_mpath,
17096 .flags = GENL_UNS_ADMIN_PERM,
17097 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17098 },
17099 {
17100 .cmd = NL80211_CMD_DEL_MPATH,
17101 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17102 .doit = nl80211_del_mpath,
17103 .flags = GENL_UNS_ADMIN_PERM,
17104 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17105 },
17106 {
17107 .cmd = NL80211_CMD_SET_BSS,
17108 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17109 .doit = nl80211_set_bss,
17110 .flags = GENL_UNS_ADMIN_PERM,
17111 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17112 NL80211_FLAG_MLO_VALID_LINK_ID),
17113 },
17114 {
17115 .cmd = NL80211_CMD_GET_REG,
17116 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17117 .doit = nl80211_get_reg_do,
17118 .dumpit = nl80211_get_reg_dump,
17119 /* can be retrieved by unprivileged users */
17120 },
17121 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
17122 {
17123 .cmd = NL80211_CMD_SET_REG,
17124 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17125 .doit = nl80211_set_reg,
17126 .flags = GENL_ADMIN_PERM,
17127 },
17128 #endif
17129 {
17130 .cmd = NL80211_CMD_REQ_SET_REG,
17131 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17132 .doit = nl80211_req_set_reg,
17133 .flags = GENL_ADMIN_PERM,
17134 },
17135 {
17136 .cmd = NL80211_CMD_RELOAD_REGDB,
17137 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17138 .doit = nl80211_reload_regdb,
17139 .flags = GENL_ADMIN_PERM,
17140 },
17141 {
17142 .cmd = NL80211_CMD_GET_MESH_CONFIG,
17143 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17144 .doit = nl80211_get_mesh_config,
17145 /* can be retrieved by unprivileged users */
17146 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17147 },
17148 {
17149 .cmd = NL80211_CMD_SET_MESH_CONFIG,
17150 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17151 .doit = nl80211_update_mesh_config,
17152 .flags = GENL_UNS_ADMIN_PERM,
17153 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17154 },
17155 {
17156 .cmd = NL80211_CMD_TRIGGER_SCAN,
17157 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17158 .doit = nl80211_trigger_scan,
17159 .flags = GENL_UNS_ADMIN_PERM,
17160 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17161 },
17162 {
17163 .cmd = NL80211_CMD_ABORT_SCAN,
17164 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17165 .doit = nl80211_abort_scan,
17166 .flags = GENL_UNS_ADMIN_PERM,
17167 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17168 },
17169 {
17170 .cmd = NL80211_CMD_GET_SCAN,
17171 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17172 .dumpit = nl80211_dump_scan,
17173 },
17174 {
17175 .cmd = NL80211_CMD_START_SCHED_SCAN,
17176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17177 .doit = nl80211_start_sched_scan,
17178 .flags = GENL_UNS_ADMIN_PERM,
17179 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17180 },
17181 {
17182 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
17183 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17184 .doit = nl80211_stop_sched_scan,
17185 .flags = GENL_UNS_ADMIN_PERM,
17186 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17187 },
17188 {
17189 .cmd = NL80211_CMD_AUTHENTICATE,
17190 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17191 .doit = nl80211_authenticate,
17192 .flags = GENL_UNS_ADMIN_PERM,
17193 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17194 NL80211_FLAG_CLEAR_SKB),
17195 },
17196 {
17197 .cmd = NL80211_CMD_ASSOCIATE,
17198 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17199 .doit = nl80211_associate,
17200 .flags = GENL_UNS_ADMIN_PERM,
17201 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17202 NL80211_FLAG_CLEAR_SKB),
17203 },
17204 {
17205 .cmd = NL80211_CMD_DEAUTHENTICATE,
17206 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17207 .doit = nl80211_deauthenticate,
17208 .flags = GENL_UNS_ADMIN_PERM,
17209 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17210 },
17211 {
17212 .cmd = NL80211_CMD_DISASSOCIATE,
17213 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17214 .doit = nl80211_disassociate,
17215 .flags = GENL_UNS_ADMIN_PERM,
17216 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17217 },
17218 {
17219 .cmd = NL80211_CMD_JOIN_IBSS,
17220 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17221 .doit = nl80211_join_ibss,
17222 .flags = GENL_UNS_ADMIN_PERM,
17223 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17224 },
17225 {
17226 .cmd = NL80211_CMD_LEAVE_IBSS,
17227 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17228 .doit = nl80211_leave_ibss,
17229 .flags = GENL_UNS_ADMIN_PERM,
17230 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17231 },
17232 #ifdef CONFIG_NL80211_TESTMODE
17233 {
17234 .cmd = NL80211_CMD_TESTMODE,
17235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17236 .doit = nl80211_testmode_do,
17237 .dumpit = nl80211_testmode_dump,
17238 .flags = GENL_UNS_ADMIN_PERM,
17239 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17240 },
17241 #endif
17242 {
17243 .cmd = NL80211_CMD_CONNECT,
17244 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17245 .doit = nl80211_connect,
17246 .flags = GENL_UNS_ADMIN_PERM,
17247 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17248 NL80211_FLAG_CLEAR_SKB),
17249 },
17250 {
17251 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
17252 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17253 .doit = nl80211_update_connect_params,
17254 .flags = GENL_ADMIN_PERM,
17255 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17256 NL80211_FLAG_CLEAR_SKB),
17257 },
17258 {
17259 .cmd = NL80211_CMD_DISCONNECT,
17260 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17261 .doit = nl80211_disconnect,
17262 .flags = GENL_UNS_ADMIN_PERM,
17263 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17264 },
17265 {
17266 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
17267 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17268 .doit = nl80211_wiphy_netns,
17269 .flags = GENL_UNS_ADMIN_PERM,
17270 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17271 NL80211_FLAG_NEED_RTNL |
17272 NL80211_FLAG_NO_WIPHY_MTX),
17273 },
17274 {
17275 .cmd = NL80211_CMD_GET_SURVEY,
17276 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17277 .dumpit = nl80211_dump_survey,
17278 },
17279 {
17280 .cmd = NL80211_CMD_SET_PMKSA,
17281 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17282 .doit = nl80211_set_pmksa,
17283 .flags = GENL_UNS_ADMIN_PERM,
17284 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17285 NL80211_FLAG_CLEAR_SKB),
17286 },
17287 {
17288 .cmd = NL80211_CMD_DEL_PMKSA,
17289 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17290 .doit = nl80211_del_pmksa,
17291 .flags = GENL_UNS_ADMIN_PERM,
17292 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17293 },
17294 {
17295 .cmd = NL80211_CMD_FLUSH_PMKSA,
17296 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17297 .doit = nl80211_flush_pmksa,
17298 .flags = GENL_UNS_ADMIN_PERM,
17299 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17300 },
17301 {
17302 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17303 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17304 .doit = nl80211_remain_on_channel,
17305 .flags = GENL_UNS_ADMIN_PERM,
17306 /* FIXME: requiring a link ID here is probably not good */
17307 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17308 NL80211_FLAG_MLO_VALID_LINK_ID),
17309 },
17310 {
17311 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17312 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17313 .doit = nl80211_cancel_remain_on_channel,
17314 .flags = GENL_UNS_ADMIN_PERM,
17315 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17316 },
17317 {
17318 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17319 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17320 .doit = nl80211_set_tx_bitrate_mask,
17321 .flags = GENL_UNS_ADMIN_PERM,
17322 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17323 NL80211_FLAG_MLO_VALID_LINK_ID),
17324 },
17325 {
17326 .cmd = NL80211_CMD_REGISTER_FRAME,
17327 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17328 .doit = nl80211_register_mgmt,
17329 .flags = GENL_UNS_ADMIN_PERM,
17330 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17331 },
17332 {
17333 .cmd = NL80211_CMD_FRAME,
17334 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17335 .doit = nl80211_tx_mgmt,
17336 .flags = GENL_UNS_ADMIN_PERM,
17337 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17338 },
17339 {
17340 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17341 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17342 .doit = nl80211_tx_mgmt_cancel_wait,
17343 .flags = GENL_UNS_ADMIN_PERM,
17344 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17345 },
17346 {
17347 .cmd = NL80211_CMD_SET_POWER_SAVE,
17348 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17349 .doit = nl80211_set_power_save,
17350 .flags = GENL_UNS_ADMIN_PERM,
17351 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17352 },
17353 {
17354 .cmd = NL80211_CMD_GET_POWER_SAVE,
17355 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17356 .doit = nl80211_get_power_save,
17357 /* can be retrieved by unprivileged users */
17358 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17359 },
17360 {
17361 .cmd = NL80211_CMD_SET_CQM,
17362 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17363 .doit = nl80211_set_cqm,
17364 .flags = GENL_UNS_ADMIN_PERM,
17365 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17366 },
17367 {
17368 .cmd = NL80211_CMD_SET_CHANNEL,
17369 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17370 .doit = nl80211_set_channel,
17371 .flags = GENL_UNS_ADMIN_PERM,
17372 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17373 NL80211_FLAG_MLO_VALID_LINK_ID),
17374 },
17375 {
17376 .cmd = NL80211_CMD_JOIN_MESH,
17377 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17378 .doit = nl80211_join_mesh,
17379 .flags = GENL_UNS_ADMIN_PERM,
17380 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17381 },
17382 {
17383 .cmd = NL80211_CMD_LEAVE_MESH,
17384 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17385 .doit = nl80211_leave_mesh,
17386 .flags = GENL_UNS_ADMIN_PERM,
17387 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17388 },
17389 {
17390 .cmd = NL80211_CMD_JOIN_OCB,
17391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17392 .doit = nl80211_join_ocb,
17393 .flags = GENL_UNS_ADMIN_PERM,
17394 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17395 },
17396 {
17397 .cmd = NL80211_CMD_LEAVE_OCB,
17398 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17399 .doit = nl80211_leave_ocb,
17400 .flags = GENL_UNS_ADMIN_PERM,
17401 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17402 },
17403 #ifdef CONFIG_PM
17404 {
17405 .cmd = NL80211_CMD_GET_WOWLAN,
17406 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17407 .doit = nl80211_get_wowlan,
17408 /* can be retrieved by unprivileged users */
17409 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17410 },
17411 {
17412 .cmd = NL80211_CMD_SET_WOWLAN,
17413 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17414 .doit = nl80211_set_wowlan,
17415 .flags = GENL_UNS_ADMIN_PERM,
17416 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17417 },
17418 #endif
17419 {
17420 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17421 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17422 .doit = nl80211_set_rekey_data,
17423 .flags = GENL_UNS_ADMIN_PERM,
17424 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17425 NL80211_FLAG_CLEAR_SKB),
17426 },
17427 {
17428 .cmd = NL80211_CMD_TDLS_MGMT,
17429 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17430 .doit = nl80211_tdls_mgmt,
17431 .flags = GENL_UNS_ADMIN_PERM,
17432 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17433 NL80211_FLAG_MLO_VALID_LINK_ID),
17434 },
17435 {
17436 .cmd = NL80211_CMD_TDLS_OPER,
17437 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17438 .doit = nl80211_tdls_oper,
17439 .flags = GENL_UNS_ADMIN_PERM,
17440 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17441 },
17442 {
17443 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17444 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17445 .doit = nl80211_register_unexpected_frame,
17446 .flags = GENL_UNS_ADMIN_PERM,
17447 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17448 },
17449 {
17450 .cmd = NL80211_CMD_PROBE_CLIENT,
17451 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17452 .doit = nl80211_probe_client,
17453 .flags = GENL_UNS_ADMIN_PERM,
17454 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17455 },
17456 {
17457 .cmd = NL80211_CMD_REGISTER_BEACONS,
17458 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17459 .doit = nl80211_register_beacons,
17460 .flags = GENL_UNS_ADMIN_PERM,
17461 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17462 },
17463 {
17464 .cmd = NL80211_CMD_SET_NOACK_MAP,
17465 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17466 .doit = nl80211_set_noack_map,
17467 .flags = GENL_UNS_ADMIN_PERM,
17468 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17469 },
17470 {
17471 .cmd = NL80211_CMD_START_P2P_DEVICE,
17472 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17473 .doit = nl80211_start_p2p_device,
17474 .flags = GENL_UNS_ADMIN_PERM,
17475 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17476 NL80211_FLAG_NEED_RTNL),
17477 },
17478 {
17479 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17480 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17481 .doit = nl80211_stop_p2p_device,
17482 .flags = GENL_UNS_ADMIN_PERM,
17483 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17484 NL80211_FLAG_NEED_RTNL),
17485 },
17486 {
17487 .cmd = NL80211_CMD_START_NAN,
17488 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17489 .doit = nl80211_start_nan,
17490 .flags = GENL_ADMIN_PERM,
17491 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17492 NL80211_FLAG_NEED_RTNL),
17493 },
17494 {
17495 .cmd = NL80211_CMD_STOP_NAN,
17496 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17497 .doit = nl80211_stop_nan,
17498 .flags = GENL_ADMIN_PERM,
17499 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17500 NL80211_FLAG_NEED_RTNL),
17501 },
17502 {
17503 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17504 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17505 .doit = nl80211_nan_add_func,
17506 .flags = GENL_ADMIN_PERM,
17507 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17508 },
17509 {
17510 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17511 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17512 .doit = nl80211_nan_del_func,
17513 .flags = GENL_ADMIN_PERM,
17514 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17515 },
17516 {
17517 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17518 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17519 .doit = nl80211_nan_change_config,
17520 .flags = GENL_ADMIN_PERM,
17521 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17522 },
17523 {
17524 .cmd = NL80211_CMD_SET_MCAST_RATE,
17525 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17526 .doit = nl80211_set_mcast_rate,
17527 .flags = GENL_UNS_ADMIN_PERM,
17528 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17529 },
17530 {
17531 .cmd = NL80211_CMD_SET_MAC_ACL,
17532 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17533 .doit = nl80211_set_mac_acl,
17534 .flags = GENL_UNS_ADMIN_PERM,
17535 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17536 NL80211_FLAG_MLO_UNSUPPORTED),
17537 },
17538 {
17539 .cmd = NL80211_CMD_RADAR_DETECT,
17540 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17541 .doit = nl80211_start_radar_detection,
17542 .flags = GENL_UNS_ADMIN_PERM,
17543 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17544 NL80211_FLAG_NO_WIPHY_MTX |
17545 NL80211_FLAG_MLO_VALID_LINK_ID),
17546 },
17547 {
17548 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17549 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17550 .doit = nl80211_get_protocol_features,
17551 },
17552 {
17553 .cmd = NL80211_CMD_UPDATE_FT_IES,
17554 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17555 .doit = nl80211_update_ft_ies,
17556 .flags = GENL_UNS_ADMIN_PERM,
17557 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17558 },
17559 {
17560 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17561 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17562 .doit = nl80211_crit_protocol_start,
17563 .flags = GENL_UNS_ADMIN_PERM,
17564 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17565 },
17566 {
17567 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17568 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17569 .doit = nl80211_crit_protocol_stop,
17570 .flags = GENL_UNS_ADMIN_PERM,
17571 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17572 },
17573 {
17574 .cmd = NL80211_CMD_GET_COALESCE,
17575 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17576 .doit = nl80211_get_coalesce,
17577 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17578 },
17579 {
17580 .cmd = NL80211_CMD_SET_COALESCE,
17581 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17582 .doit = nl80211_set_coalesce,
17583 .flags = GENL_UNS_ADMIN_PERM,
17584 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17585 },
17586 {
17587 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17588 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17589 .doit = nl80211_channel_switch,
17590 .flags = GENL_UNS_ADMIN_PERM,
17591 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17592 NL80211_FLAG_MLO_VALID_LINK_ID),
17593 },
17594 {
17595 .cmd = NL80211_CMD_VENDOR,
17596 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17597 .doit = nl80211_vendor_cmd,
17598 .dumpit = nl80211_vendor_cmd_dump,
17599 .flags = GENL_UNS_ADMIN_PERM,
17600 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17601 NL80211_FLAG_CLEAR_SKB),
17602 },
17603 {
17604 .cmd = NL80211_CMD_SET_QOS_MAP,
17605 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17606 .doit = nl80211_set_qos_map,
17607 .flags = GENL_UNS_ADMIN_PERM,
17608 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17609 },
17610 {
17611 .cmd = NL80211_CMD_ADD_TX_TS,
17612 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17613 .doit = nl80211_add_tx_ts,
17614 .flags = GENL_UNS_ADMIN_PERM,
17615 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17616 NL80211_FLAG_MLO_UNSUPPORTED),
17617 },
17618 {
17619 .cmd = NL80211_CMD_DEL_TX_TS,
17620 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17621 .doit = nl80211_del_tx_ts,
17622 .flags = GENL_UNS_ADMIN_PERM,
17623 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17624 },
17625 {
17626 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17627 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17628 .doit = nl80211_tdls_channel_switch,
17629 .flags = GENL_UNS_ADMIN_PERM,
17630 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17631 },
17632 {
17633 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17634 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17635 .doit = nl80211_tdls_cancel_channel_switch,
17636 .flags = GENL_UNS_ADMIN_PERM,
17637 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17638 },
17639 {
17640 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17641 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17642 .doit = nl80211_set_multicast_to_unicast,
17643 .flags = GENL_UNS_ADMIN_PERM,
17644 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17645 },
17646 {
17647 .cmd = NL80211_CMD_SET_PMK,
17648 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17649 .doit = nl80211_set_pmk,
17650 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17651 NL80211_FLAG_CLEAR_SKB),
17652 },
17653 {
17654 .cmd = NL80211_CMD_DEL_PMK,
17655 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17656 .doit = nl80211_del_pmk,
17657 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17658 },
17659 {
17660 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17661 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17662 .doit = nl80211_external_auth,
17663 .flags = GENL_ADMIN_PERM,
17664 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17665 },
17666 {
17667 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17668 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17669 .doit = nl80211_tx_control_port,
17670 .flags = GENL_UNS_ADMIN_PERM,
17671 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17672 },
17673 {
17674 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17675 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17676 .doit = nl80211_get_ftm_responder_stats,
17677 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17678 NL80211_FLAG_MLO_VALID_LINK_ID),
17679 },
17680 {
17681 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17682 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17683 .doit = nl80211_pmsr_start,
17684 .flags = GENL_UNS_ADMIN_PERM,
17685 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17686 },
17687 {
17688 .cmd = NL80211_CMD_NOTIFY_RADAR,
17689 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17690 .doit = nl80211_notify_radar_detection,
17691 .flags = GENL_UNS_ADMIN_PERM,
17692 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17693 },
17694 {
17695 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17696 .doit = nl80211_update_owe_info,
17697 .flags = GENL_ADMIN_PERM,
17698 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17699 },
17700 {
17701 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17702 .doit = nl80211_probe_mesh_link,
17703 .flags = GENL_UNS_ADMIN_PERM,
17704 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17705 },
17706 {
17707 .cmd = NL80211_CMD_SET_TID_CONFIG,
17708 .doit = nl80211_set_tid_config,
17709 .flags = GENL_UNS_ADMIN_PERM,
17710 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17711 NL80211_FLAG_MLO_VALID_LINK_ID),
17712 },
17713 {
17714 .cmd = NL80211_CMD_SET_SAR_SPECS,
17715 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17716 .doit = nl80211_set_sar_specs,
17717 .flags = GENL_UNS_ADMIN_PERM,
17718 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17719 NL80211_FLAG_NEED_RTNL),
17720 },
17721 {
17722 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17723 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17724 .doit = nl80211_color_change,
17725 .flags = GENL_UNS_ADMIN_PERM,
17726 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17727 NL80211_FLAG_MLO_VALID_LINK_ID),
17728 },
17729 {
17730 .cmd = NL80211_CMD_SET_FILS_AAD,
17731 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17732 .doit = nl80211_set_fils_aad,
17733 .flags = GENL_UNS_ADMIN_PERM,
17734 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17735 },
17736 {
17737 .cmd = NL80211_CMD_ADD_LINK,
17738 .doit = nl80211_add_link,
17739 .flags = GENL_UNS_ADMIN_PERM,
17740 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17741 },
17742 {
17743 .cmd = NL80211_CMD_REMOVE_LINK,
17744 .doit = nl80211_remove_link,
17745 .flags = GENL_UNS_ADMIN_PERM,
17746 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17747 NL80211_FLAG_MLO_VALID_LINK_ID),
17748 },
17749 {
17750 .cmd = NL80211_CMD_ADD_LINK_STA,
17751 .doit = nl80211_add_link_station,
17752 .flags = GENL_UNS_ADMIN_PERM,
17753 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17754 NL80211_FLAG_MLO_VALID_LINK_ID),
17755 },
17756 {
17757 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17758 .doit = nl80211_modify_link_station,
17759 .flags = GENL_UNS_ADMIN_PERM,
17760 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17761 NL80211_FLAG_MLO_VALID_LINK_ID),
17762 },
17763 {
17764 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17765 .doit = nl80211_remove_link_station,
17766 .flags = GENL_UNS_ADMIN_PERM,
17767 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17768 NL80211_FLAG_MLO_VALID_LINK_ID),
17769 },
17770 {
17771 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17772 .doit = nl80211_set_hw_timestamp,
17773 .flags = GENL_UNS_ADMIN_PERM,
17774 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17775 },
17776 {
17777 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
17778 .doit = nl80211_set_ttlm,
17779 .flags = GENL_UNS_ADMIN_PERM,
17780 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17781 },
17782 {
17783 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
17784 .doit = nl80211_assoc_ml_reconf,
17785 .flags = GENL_UNS_ADMIN_PERM,
17786 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17787 },
17788 {
17789 .cmd = NL80211_CMD_EPCS_CFG,
17790 .doit = nl80211_epcs_cfg,
17791 .flags = GENL_UNS_ADMIN_PERM,
17792 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17793 },
17794 };
17795
17796 static struct genl_family nl80211_fam __ro_after_init = {
17797 .name = NL80211_GENL_NAME, /* have users key off the name instead */
17798 .hdrsize = 0, /* no private header */
17799 .version = 1, /* no particular meaning now */
17800 .maxattr = NL80211_ATTR_MAX,
17801 .policy = nl80211_policy,
17802 .netnsok = true,
17803 .pre_doit = nl80211_pre_doit,
17804 .post_doit = nl80211_post_doit,
17805 .module = THIS_MODULE,
17806 .ops = nl80211_ops,
17807 .n_ops = ARRAY_SIZE(nl80211_ops),
17808 .small_ops = nl80211_small_ops,
17809 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17810 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17811 .mcgrps = nl80211_mcgrps,
17812 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17813 .parallel_ops = true,
17814 };
17815
17816 /* notification functions */
17817
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)17818 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17819 enum nl80211_commands cmd)
17820 {
17821 struct sk_buff *msg;
17822 struct nl80211_dump_wiphy_state state = {};
17823
17824 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17825 cmd != NL80211_CMD_DEL_WIPHY);
17826
17827 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17828 if (!msg)
17829 return;
17830
17831 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17832 nlmsg_free(msg);
17833 return;
17834 }
17835
17836 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17837 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17838 }
17839
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)17840 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17841 struct wireless_dev *wdev,
17842 enum nl80211_commands cmd)
17843 {
17844 struct sk_buff *msg;
17845
17846 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17847 if (!msg)
17848 return;
17849
17850 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17851 nlmsg_free(msg);
17852 return;
17853 }
17854
17855 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17856 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17857 }
17858
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)17859 static int nl80211_add_scan_req(struct sk_buff *msg,
17860 struct cfg80211_registered_device *rdev)
17861 {
17862 struct cfg80211_scan_request *req = rdev->scan_req;
17863 struct nlattr *nest;
17864 int i;
17865 struct cfg80211_scan_info *info;
17866
17867 if (WARN_ON(!req))
17868 return 0;
17869
17870 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17871 if (!nest)
17872 goto nla_put_failure;
17873 for (i = 0; i < req->n_ssids; i++) {
17874 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17875 goto nla_put_failure;
17876 }
17877 nla_nest_end(msg, nest);
17878
17879 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17880 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17881 if (!nest)
17882 goto nla_put_failure;
17883 for (i = 0; i < req->n_channels; i++) {
17884 if (nla_put_u32(msg, i,
17885 ieee80211_channel_to_khz(req->channels[i])))
17886 goto nla_put_failure;
17887 }
17888 nla_nest_end(msg, nest);
17889 } else {
17890 nest = nla_nest_start_noflag(msg,
17891 NL80211_ATTR_SCAN_FREQUENCIES);
17892 if (!nest)
17893 goto nla_put_failure;
17894 for (i = 0; i < req->n_channels; i++) {
17895 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17896 goto nla_put_failure;
17897 }
17898 nla_nest_end(msg, nest);
17899 }
17900
17901 if (req->ie &&
17902 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17903 goto nla_put_failure;
17904
17905 if (req->flags &&
17906 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17907 goto nla_put_failure;
17908
17909 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17910 &rdev->scan_req->info;
17911 if (info->scan_start_tsf &&
17912 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17913 info->scan_start_tsf, NL80211_BSS_PAD) ||
17914 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17915 info->tsf_bssid)))
17916 goto nla_put_failure;
17917
17918 return 0;
17919 nla_put_failure:
17920 return -ENOBUFS;
17921 }
17922
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)17923 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17924 struct cfg80211_registered_device *rdev,
17925 struct wireless_dev *wdev,
17926 u32 portid, u32 seq, int flags,
17927 u32 cmd)
17928 {
17929 void *hdr;
17930
17931 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17932 if (!hdr)
17933 return -1;
17934
17935 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17936 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17937 wdev->netdev->ifindex)) ||
17938 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17939 NL80211_ATTR_PAD))
17940 goto nla_put_failure;
17941
17942 /* ignore errors and send incomplete event anyway */
17943 nl80211_add_scan_req(msg, rdev);
17944
17945 genlmsg_end(msg, hdr);
17946 return 0;
17947
17948 nla_put_failure:
17949 genlmsg_cancel(msg, hdr);
17950 return -EMSGSIZE;
17951 }
17952
17953 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)17954 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17955 struct cfg80211_sched_scan_request *req, u32 cmd)
17956 {
17957 void *hdr;
17958
17959 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17960 if (!hdr)
17961 return -1;
17962
17963 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17964 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17965 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17966 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17967 NL80211_ATTR_PAD))
17968 goto nla_put_failure;
17969
17970 genlmsg_end(msg, hdr);
17971 return 0;
17972
17973 nla_put_failure:
17974 genlmsg_cancel(msg, hdr);
17975 return -EMSGSIZE;
17976 }
17977
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)17978 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17979 struct wireless_dev *wdev)
17980 {
17981 struct sk_buff *msg;
17982
17983 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17984 if (!msg)
17985 return;
17986
17987 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17988 NL80211_CMD_TRIGGER_SCAN) < 0) {
17989 nlmsg_free(msg);
17990 return;
17991 }
17992
17993 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17994 NL80211_MCGRP_SCAN, GFP_KERNEL);
17995 }
17996
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)17997 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17998 struct wireless_dev *wdev, bool aborted)
17999 {
18000 struct sk_buff *msg;
18001
18002 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18003 if (!msg)
18004 return NULL;
18005
18006 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
18007 aborted ? NL80211_CMD_SCAN_ABORTED :
18008 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
18009 nlmsg_free(msg);
18010 return NULL;
18011 }
18012
18013 return msg;
18014 }
18015
18016 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)18017 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
18018 struct sk_buff *msg)
18019 {
18020 if (!msg)
18021 return;
18022
18023 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18024 NL80211_MCGRP_SCAN, GFP_KERNEL);
18025 }
18026
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)18027 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
18028 {
18029 struct sk_buff *msg;
18030
18031 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18032 if (!msg)
18033 return;
18034
18035 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
18036 nlmsg_free(msg);
18037 return;
18038 }
18039
18040 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
18041 NL80211_MCGRP_SCAN, GFP_KERNEL);
18042 }
18043
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)18044 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
18045 struct regulatory_request *request)
18046 {
18047 /* Userspace can always count this one always being set */
18048 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
18049 goto nla_put_failure;
18050
18051 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
18052 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18053 NL80211_REGDOM_TYPE_WORLD))
18054 goto nla_put_failure;
18055 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
18056 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18057 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
18058 goto nla_put_failure;
18059 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
18060 request->intersect) {
18061 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18062 NL80211_REGDOM_TYPE_INTERSECTION))
18063 goto nla_put_failure;
18064 } else {
18065 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18066 NL80211_REGDOM_TYPE_COUNTRY) ||
18067 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
18068 request->alpha2))
18069 goto nla_put_failure;
18070 }
18071
18072 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
18073 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
18074
18075 if (wiphy &&
18076 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
18077 goto nla_put_failure;
18078
18079 if (wiphy &&
18080 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
18081 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
18082 goto nla_put_failure;
18083 }
18084
18085 return true;
18086
18087 nla_put_failure:
18088 return false;
18089 }
18090
18091 /*
18092 * This can happen on global regulatory changes or device specific settings
18093 * based on custom regulatory domains.
18094 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)18095 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
18096 struct regulatory_request *request)
18097 {
18098 struct sk_buff *msg;
18099 void *hdr;
18100
18101 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18102 if (!msg)
18103 return;
18104
18105 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
18106 if (!hdr)
18107 goto nla_put_failure;
18108
18109 if (!nl80211_reg_change_event_fill(msg, request))
18110 goto nla_put_failure;
18111
18112 genlmsg_end(msg, hdr);
18113
18114 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18115 NL80211_MCGRP_REGULATORY);
18116
18117 return;
18118
18119 nla_put_failure:
18120 nlmsg_free(msg);
18121 }
18122
18123 struct nl80211_mlme_event {
18124 enum nl80211_commands cmd;
18125 const u8 *buf;
18126 size_t buf_len;
18127 int uapsd_queues;
18128 const u8 *req_ies;
18129 size_t req_ies_len;
18130 bool reconnect;
18131 };
18132
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct nl80211_mlme_event * event,gfp_t gfp)18133 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
18134 struct net_device *netdev,
18135 const struct nl80211_mlme_event *event,
18136 gfp_t gfp)
18137 {
18138 struct sk_buff *msg;
18139 void *hdr;
18140
18141 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
18142 if (!msg)
18143 return;
18144
18145 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
18146 if (!hdr) {
18147 nlmsg_free(msg);
18148 return;
18149 }
18150
18151 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18152 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18153 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
18154 (event->req_ies &&
18155 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
18156 event->req_ies)))
18157 goto nla_put_failure;
18158
18159 if (event->reconnect &&
18160 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
18161 goto nla_put_failure;
18162
18163 if (event->uapsd_queues >= 0) {
18164 struct nlattr *nla_wmm =
18165 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
18166 if (!nla_wmm)
18167 goto nla_put_failure;
18168
18169 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
18170 event->uapsd_queues))
18171 goto nla_put_failure;
18172
18173 nla_nest_end(msg, nla_wmm);
18174 }
18175
18176 genlmsg_end(msg, hdr);
18177
18178 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18179 NL80211_MCGRP_MLME, gfp);
18180 return;
18181
18182 nla_put_failure:
18183 nlmsg_free(msg);
18184 }
18185
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)18186 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
18187 struct net_device *netdev, const u8 *buf,
18188 size_t len, gfp_t gfp)
18189 {
18190 struct nl80211_mlme_event event = {
18191 .cmd = NL80211_CMD_AUTHENTICATE,
18192 .buf = buf,
18193 .buf_len = len,
18194 .uapsd_queues = -1,
18195 };
18196
18197 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18198 }
18199
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const struct cfg80211_rx_assoc_resp_data * data)18200 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
18201 struct net_device *netdev,
18202 const struct cfg80211_rx_assoc_resp_data *data)
18203 {
18204 struct nl80211_mlme_event event = {
18205 .cmd = NL80211_CMD_ASSOCIATE,
18206 .buf = data->buf,
18207 .buf_len = data->len,
18208 .uapsd_queues = data->uapsd_queues,
18209 .req_ies = data->req_ies,
18210 .req_ies_len = data->req_ies_len,
18211 };
18212
18213 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
18214 }
18215
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)18216 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
18217 struct net_device *netdev, const u8 *buf,
18218 size_t len, bool reconnect, gfp_t gfp)
18219 {
18220 struct nl80211_mlme_event event = {
18221 .cmd = NL80211_CMD_DEAUTHENTICATE,
18222 .buf = buf,
18223 .buf_len = len,
18224 .reconnect = reconnect,
18225 .uapsd_queues = -1,
18226 };
18227
18228 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18229 }
18230
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)18231 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
18232 struct net_device *netdev, const u8 *buf,
18233 size_t len, bool reconnect, gfp_t gfp)
18234 {
18235 struct nl80211_mlme_event event = {
18236 .cmd = NL80211_CMD_DISASSOCIATE,
18237 .buf = buf,
18238 .buf_len = len,
18239 .reconnect = reconnect,
18240 .uapsd_queues = -1,
18241 };
18242
18243 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18244 }
18245
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)18246 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
18247 size_t len)
18248 {
18249 struct wireless_dev *wdev = dev->ieee80211_ptr;
18250 struct wiphy *wiphy = wdev->wiphy;
18251 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18252 const struct ieee80211_mgmt *mgmt = (void *)buf;
18253 struct nl80211_mlme_event event = {
18254 .buf = buf,
18255 .buf_len = len,
18256 .uapsd_queues = -1,
18257 };
18258
18259 if (WARN_ON(len < 2))
18260 return;
18261
18262 if (ieee80211_is_deauth(mgmt->frame_control)) {
18263 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
18264 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
18265 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
18266 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
18267 if (wdev->unprot_beacon_reported &&
18268 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
18269 return;
18270 event.cmd = NL80211_CMD_UNPROT_BEACON;
18271 wdev->unprot_beacon_reported = jiffies;
18272 } else {
18273 return;
18274 }
18275
18276 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
18277 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
18278 }
18279 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
18280
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)18281 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
18282 struct net_device *netdev, int cmd,
18283 const u8 *addr, gfp_t gfp)
18284 {
18285 struct sk_buff *msg;
18286 void *hdr;
18287
18288 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18289 if (!msg)
18290 return;
18291
18292 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18293 if (!hdr) {
18294 nlmsg_free(msg);
18295 return;
18296 }
18297
18298 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18299 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18300 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18301 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18302 goto nla_put_failure;
18303
18304 genlmsg_end(msg, hdr);
18305
18306 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18307 NL80211_MCGRP_MLME, gfp);
18308 return;
18309
18310 nla_put_failure:
18311 nlmsg_free(msg);
18312 }
18313
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18314 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
18315 struct net_device *netdev, const u8 *addr,
18316 gfp_t gfp)
18317 {
18318 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
18319 addr, gfp);
18320 }
18321
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18322 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
18323 struct net_device *netdev, const u8 *addr,
18324 gfp_t gfp)
18325 {
18326 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18327 addr, gfp);
18328 }
18329
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)18330 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18331 struct net_device *netdev,
18332 struct cfg80211_connect_resp_params *cr,
18333 gfp_t gfp)
18334 {
18335 struct sk_buff *msg;
18336 void *hdr;
18337 unsigned int link;
18338 size_t link_info_size = 0;
18339 const u8 *connected_addr = cr->valid_links ?
18340 cr->ap_mld_addr : cr->links[0].bssid;
18341
18342 if (cr->valid_links) {
18343 for_each_valid_link(cr, link) {
18344 /* Nested attribute header */
18345 link_info_size += NLA_HDRLEN;
18346 /* Link ID */
18347 link_info_size += nla_total_size(sizeof(u8));
18348 link_info_size += cr->links[link].addr ?
18349 nla_total_size(ETH_ALEN) : 0;
18350 link_info_size += (cr->links[link].bssid ||
18351 cr->links[link].bss) ?
18352 nla_total_size(ETH_ALEN) : 0;
18353 link_info_size += nla_total_size(sizeof(u16));
18354 }
18355 }
18356
18357 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18358 cr->fils.kek_len + cr->fils.pmk_len +
18359 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18360 gfp);
18361 if (!msg)
18362 return;
18363
18364 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18365 if (!hdr) {
18366 nlmsg_free(msg);
18367 return;
18368 }
18369
18370 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18371 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18372 (connected_addr &&
18373 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18374 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18375 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18376 cr->status) ||
18377 (cr->status < 0 &&
18378 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18379 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18380 cr->timeout_reason))) ||
18381 (cr->req_ie &&
18382 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18383 (cr->resp_ie &&
18384 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18385 cr->resp_ie)) ||
18386 (cr->fils.update_erp_next_seq_num &&
18387 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18388 cr->fils.erp_next_seq_num)) ||
18389 (cr->status == WLAN_STATUS_SUCCESS &&
18390 ((cr->fils.kek &&
18391 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18392 cr->fils.kek)) ||
18393 (cr->fils.pmk &&
18394 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18395 (cr->fils.pmkid &&
18396 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18397 goto nla_put_failure;
18398
18399 if (cr->valid_links) {
18400 int i = 1;
18401 struct nlattr *nested;
18402
18403 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18404 if (!nested)
18405 goto nla_put_failure;
18406
18407 for_each_valid_link(cr, link) {
18408 struct nlattr *nested_mlo_links;
18409 const u8 *bssid = cr->links[link].bss ?
18410 cr->links[link].bss->bssid :
18411 cr->links[link].bssid;
18412
18413 nested_mlo_links = nla_nest_start(msg, i);
18414 if (!nested_mlo_links)
18415 goto nla_put_failure;
18416
18417 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18418 (bssid &&
18419 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18420 (cr->links[link].addr &&
18421 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18422 cr->links[link].addr)) ||
18423 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18424 cr->links[link].status))
18425 goto nla_put_failure;
18426
18427 nla_nest_end(msg, nested_mlo_links);
18428 i++;
18429 }
18430 nla_nest_end(msg, nested);
18431 }
18432
18433 genlmsg_end(msg, hdr);
18434
18435 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18436 NL80211_MCGRP_MLME, gfp);
18437 return;
18438
18439 nla_put_failure:
18440 nlmsg_free(msg);
18441 }
18442
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)18443 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18444 struct net_device *netdev,
18445 struct cfg80211_roam_info *info, gfp_t gfp)
18446 {
18447 struct sk_buff *msg;
18448 void *hdr;
18449 size_t link_info_size = 0;
18450 unsigned int link;
18451 const u8 *connected_addr = info->ap_mld_addr ?
18452 info->ap_mld_addr :
18453 (info->links[0].bss ?
18454 info->links[0].bss->bssid :
18455 info->links[0].bssid);
18456
18457 if (info->valid_links) {
18458 for_each_valid_link(info, link) {
18459 /* Nested attribute header */
18460 link_info_size += NLA_HDRLEN;
18461 /* Link ID */
18462 link_info_size += nla_total_size(sizeof(u8));
18463 link_info_size += info->links[link].addr ?
18464 nla_total_size(ETH_ALEN) : 0;
18465 link_info_size += (info->links[link].bssid ||
18466 info->links[link].bss) ?
18467 nla_total_size(ETH_ALEN) : 0;
18468 }
18469 }
18470
18471 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18472 info->fils.kek_len + info->fils.pmk_len +
18473 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18474 link_info_size, gfp);
18475 if (!msg)
18476 return;
18477
18478 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18479 if (!hdr) {
18480 nlmsg_free(msg);
18481 return;
18482 }
18483
18484 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18485 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18486 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18487 (info->req_ie &&
18488 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18489 info->req_ie)) ||
18490 (info->resp_ie &&
18491 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18492 info->resp_ie)) ||
18493 (info->fils.update_erp_next_seq_num &&
18494 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18495 info->fils.erp_next_seq_num)) ||
18496 (info->fils.kek &&
18497 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18498 info->fils.kek)) ||
18499 (info->fils.pmk &&
18500 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18501 (info->fils.pmkid &&
18502 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18503 goto nla_put_failure;
18504
18505 if (info->valid_links) {
18506 int i = 1;
18507 struct nlattr *nested;
18508
18509 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18510 if (!nested)
18511 goto nla_put_failure;
18512
18513 for_each_valid_link(info, link) {
18514 struct nlattr *nested_mlo_links;
18515 const u8 *bssid = info->links[link].bss ?
18516 info->links[link].bss->bssid :
18517 info->links[link].bssid;
18518
18519 nested_mlo_links = nla_nest_start(msg, i);
18520 if (!nested_mlo_links)
18521 goto nla_put_failure;
18522
18523 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18524 (bssid &&
18525 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18526 (info->links[link].addr &&
18527 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18528 info->links[link].addr)))
18529 goto nla_put_failure;
18530
18531 nla_nest_end(msg, nested_mlo_links);
18532 i++;
18533 }
18534 nla_nest_end(msg, nested);
18535 }
18536
18537 genlmsg_end(msg, hdr);
18538
18539 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18540 NL80211_MCGRP_MLME, gfp);
18541 return;
18542
18543 nla_put_failure:
18544 nlmsg_free(msg);
18545 }
18546
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * peer_addr,const u8 * td_bitmap,u8 td_bitmap_len)18547 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18548 struct net_device *netdev, const u8 *peer_addr,
18549 const u8 *td_bitmap, u8 td_bitmap_len)
18550 {
18551 struct sk_buff *msg;
18552 void *hdr;
18553
18554 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18555 if (!msg)
18556 return;
18557
18558 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18559 if (!hdr) {
18560 nlmsg_free(msg);
18561 return;
18562 }
18563
18564 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18565 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18566 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
18567 goto nla_put_failure;
18568
18569 if (td_bitmap_len > 0 && td_bitmap &&
18570 nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
18571 goto nla_put_failure;
18572
18573 genlmsg_end(msg, hdr);
18574
18575 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18576 NL80211_MCGRP_MLME, GFP_KERNEL);
18577 return;
18578
18579 nla_put_failure:
18580 nlmsg_free(msg);
18581 }
18582
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)18583 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18584 struct net_device *netdev, u16 reason,
18585 const u8 *ie, size_t ie_len, bool from_ap)
18586 {
18587 struct sk_buff *msg;
18588 void *hdr;
18589
18590 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18591 if (!msg)
18592 return;
18593
18594 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18595 if (!hdr) {
18596 nlmsg_free(msg);
18597 return;
18598 }
18599
18600 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18601 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18602 (reason &&
18603 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18604 (from_ap &&
18605 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18606 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18607 goto nla_put_failure;
18608
18609 genlmsg_end(msg, hdr);
18610
18611 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18612 NL80211_MCGRP_MLME, GFP_KERNEL);
18613 return;
18614
18615 nla_put_failure:
18616 nlmsg_free(msg);
18617 }
18618
cfg80211_links_removed(struct net_device * dev,u16 link_mask)18619 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18620 {
18621 struct wireless_dev *wdev = dev->ieee80211_ptr;
18622 struct wiphy *wiphy = wdev->wiphy;
18623 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18624 struct sk_buff *msg;
18625 struct nlattr *links;
18626 void *hdr;
18627
18628 lockdep_assert_wiphy(wdev->wiphy);
18629 trace_cfg80211_links_removed(dev, link_mask);
18630
18631 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18632 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18633 return;
18634
18635 if (WARN_ON(!wdev->valid_links || !link_mask ||
18636 (wdev->valid_links & link_mask) != link_mask ||
18637 wdev->valid_links == link_mask))
18638 return;
18639
18640 cfg80211_wdev_release_link_bsses(wdev, link_mask);
18641 wdev->valid_links &= ~link_mask;
18642
18643 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18644 if (!msg)
18645 return;
18646
18647 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18648 if (!hdr) {
18649 nlmsg_free(msg);
18650 return;
18651 }
18652
18653 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18654 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18655 goto nla_put_failure;
18656
18657 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18658 if (!links)
18659 goto nla_put_failure;
18660
18661 while (link_mask) {
18662 struct nlattr *link;
18663 int link_id = __ffs(link_mask);
18664
18665 link = nla_nest_start(msg, link_id + 1);
18666 if (!link)
18667 goto nla_put_failure;
18668
18669 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18670 goto nla_put_failure;
18671
18672 nla_nest_end(msg, link);
18673 link_mask &= ~(1 << link_id);
18674 }
18675
18676 nla_nest_end(msg, links);
18677
18678 genlmsg_end(msg, hdr);
18679
18680 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18681 NL80211_MCGRP_MLME, GFP_KERNEL);
18682 return;
18683
18684 nla_put_failure:
18685 nlmsg_free(msg);
18686 }
18687 EXPORT_SYMBOL(cfg80211_links_removed);
18688
nl80211_mlo_reconf_add_done(struct net_device * dev,struct cfg80211_mlo_reconf_done_data * data)18689 void nl80211_mlo_reconf_add_done(struct net_device *dev,
18690 struct cfg80211_mlo_reconf_done_data *data)
18691 {
18692 struct wireless_dev *wdev = dev->ieee80211_ptr;
18693 struct wiphy *wiphy = wdev->wiphy;
18694 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18695 struct nl80211_mlme_event event = {
18696 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
18697 .buf = data->buf,
18698 .buf_len = data->len,
18699 .uapsd_queues = -1,
18700 };
18701
18702 nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
18703 }
18704 EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
18705
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)18706 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18707 struct net_device *netdev, const u8 *bssid,
18708 gfp_t gfp)
18709 {
18710 struct sk_buff *msg;
18711 void *hdr;
18712
18713 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18714 if (!msg)
18715 return;
18716
18717 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18718 if (!hdr) {
18719 nlmsg_free(msg);
18720 return;
18721 }
18722
18723 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18724 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18725 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18726 goto nla_put_failure;
18727
18728 genlmsg_end(msg, hdr);
18729
18730 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18731 NL80211_MCGRP_MLME, gfp);
18732 return;
18733
18734 nla_put_failure:
18735 nlmsg_free(msg);
18736 }
18737
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)18738 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18739 const u8 *ie, u8 ie_len,
18740 int sig_dbm, gfp_t gfp)
18741 {
18742 struct wireless_dev *wdev = dev->ieee80211_ptr;
18743 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18744 struct sk_buff *msg;
18745 void *hdr;
18746
18747 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18748 return;
18749
18750 trace_cfg80211_notify_new_peer_candidate(dev, addr);
18751
18752 msg = nlmsg_new(100 + ie_len, gfp);
18753 if (!msg)
18754 return;
18755
18756 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18757 if (!hdr) {
18758 nlmsg_free(msg);
18759 return;
18760 }
18761
18762 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18763 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18764 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18765 (ie_len && ie &&
18766 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18767 (sig_dbm &&
18768 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18769 goto nla_put_failure;
18770
18771 genlmsg_end(msg, hdr);
18772
18773 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18774 NL80211_MCGRP_MLME, gfp);
18775 return;
18776
18777 nla_put_failure:
18778 nlmsg_free(msg);
18779 }
18780 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18781
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)18782 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18783 struct net_device *netdev, const u8 *addr,
18784 enum nl80211_key_type key_type, int key_id,
18785 const u8 *tsc, gfp_t gfp)
18786 {
18787 struct sk_buff *msg;
18788 void *hdr;
18789
18790 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18791 if (!msg)
18792 return;
18793
18794 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18795 if (!hdr) {
18796 nlmsg_free(msg);
18797 return;
18798 }
18799
18800 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18801 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18802 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18803 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18804 (key_id != -1 &&
18805 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18806 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18807 goto nla_put_failure;
18808
18809 genlmsg_end(msg, hdr);
18810
18811 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18812 NL80211_MCGRP_MLME, gfp);
18813 return;
18814
18815 nla_put_failure:
18816 nlmsg_free(msg);
18817 }
18818
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)18819 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18820 struct ieee80211_channel *channel_before,
18821 struct ieee80211_channel *channel_after)
18822 {
18823 struct sk_buff *msg;
18824 void *hdr;
18825 struct nlattr *nl_freq;
18826
18827 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18828 if (!msg)
18829 return;
18830
18831 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18832 if (!hdr) {
18833 nlmsg_free(msg);
18834 return;
18835 }
18836
18837 /*
18838 * Since we are applying the beacon hint to a wiphy we know its
18839 * wiphy_idx is valid
18840 */
18841 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18842 goto nla_put_failure;
18843
18844 /* Before */
18845 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18846 if (!nl_freq)
18847 goto nla_put_failure;
18848
18849 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18850 goto nla_put_failure;
18851 nla_nest_end(msg, nl_freq);
18852
18853 /* After */
18854 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18855 if (!nl_freq)
18856 goto nla_put_failure;
18857
18858 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18859 goto nla_put_failure;
18860 nla_nest_end(msg, nl_freq);
18861
18862 genlmsg_end(msg, hdr);
18863
18864 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18865 NL80211_MCGRP_REGULATORY);
18866
18867 return;
18868
18869 nla_put_failure:
18870 nlmsg_free(msg);
18871 }
18872
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18873 static void nl80211_send_remain_on_chan_event(
18874 int cmd, struct cfg80211_registered_device *rdev,
18875 struct wireless_dev *wdev, u64 cookie,
18876 struct ieee80211_channel *chan,
18877 unsigned int duration, gfp_t gfp)
18878 {
18879 struct sk_buff *msg;
18880 void *hdr;
18881
18882 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18883 if (!msg)
18884 return;
18885
18886 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18887 if (!hdr) {
18888 nlmsg_free(msg);
18889 return;
18890 }
18891
18892 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18893 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18894 wdev->netdev->ifindex)) ||
18895 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18896 NL80211_ATTR_PAD) ||
18897 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18898 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18899 NL80211_CHAN_NO_HT) ||
18900 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18901 NL80211_ATTR_PAD))
18902 goto nla_put_failure;
18903
18904 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18905 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18906 goto nla_put_failure;
18907
18908 genlmsg_end(msg, hdr);
18909
18910 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18911 NL80211_MCGRP_MLME, gfp);
18912 return;
18913
18914 nla_put_failure:
18915 nlmsg_free(msg);
18916 }
18917
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)18918 void cfg80211_assoc_comeback(struct net_device *netdev,
18919 const u8 *ap_addr, u32 timeout)
18920 {
18921 struct wireless_dev *wdev = netdev->ieee80211_ptr;
18922 struct wiphy *wiphy = wdev->wiphy;
18923 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18924 struct sk_buff *msg;
18925 void *hdr;
18926
18927 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18928
18929 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18930 if (!msg)
18931 return;
18932
18933 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18934 if (!hdr) {
18935 nlmsg_free(msg);
18936 return;
18937 }
18938
18939 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18940 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18941 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18942 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18943 goto nla_put_failure;
18944
18945 genlmsg_end(msg, hdr);
18946
18947 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18948 NL80211_MCGRP_MLME, GFP_KERNEL);
18949 return;
18950
18951 nla_put_failure:
18952 nlmsg_free(msg);
18953 }
18954 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18955
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18956 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18957 struct ieee80211_channel *chan,
18958 unsigned int duration, gfp_t gfp)
18959 {
18960 struct wiphy *wiphy = wdev->wiphy;
18961 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18962
18963 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18964 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18965 rdev, wdev, cookie, chan,
18966 duration, gfp);
18967 }
18968 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18969
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18970 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18971 struct ieee80211_channel *chan,
18972 gfp_t gfp)
18973 {
18974 struct wiphy *wiphy = wdev->wiphy;
18975 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18976
18977 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18978 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18979 rdev, wdev, cookie, chan, 0, gfp);
18980 }
18981 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18982
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18983 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18984 struct ieee80211_channel *chan,
18985 gfp_t gfp)
18986 {
18987 struct wiphy *wiphy = wdev->wiphy;
18988 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18989
18990 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18991 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18992 rdev, wdev, cookie, chan, 0, gfp);
18993 }
18994 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18995
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)18996 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18997 struct station_info *sinfo, gfp_t gfp)
18998 {
18999 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19000 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19001 struct sk_buff *msg;
19002
19003 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
19004
19005 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19006 if (!msg)
19007 return;
19008
19009 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
19010 rdev, dev, mac_addr, sinfo) < 0) {
19011 nlmsg_free(msg);
19012 return;
19013 }
19014
19015 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19016 NL80211_MCGRP_MLME, gfp);
19017 }
19018 EXPORT_SYMBOL(cfg80211_new_sta);
19019
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)19020 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
19021 struct station_info *sinfo, gfp_t gfp)
19022 {
19023 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19024 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19025 struct sk_buff *msg;
19026 struct station_info empty_sinfo = {};
19027
19028 if (!sinfo)
19029 sinfo = &empty_sinfo;
19030
19031 trace_cfg80211_del_sta(dev, mac_addr);
19032
19033 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19034 if (!msg) {
19035 cfg80211_sinfo_release_content(sinfo);
19036 return;
19037 }
19038
19039 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
19040 rdev, dev, mac_addr, sinfo) < 0) {
19041 nlmsg_free(msg);
19042 return;
19043 }
19044
19045 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19046 NL80211_MCGRP_MLME, gfp);
19047 }
19048 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
19049
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)19050 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
19051 enum nl80211_connect_failed_reason reason,
19052 gfp_t gfp)
19053 {
19054 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19055 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19056 struct sk_buff *msg;
19057 void *hdr;
19058
19059 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
19060 if (!msg)
19061 return;
19062
19063 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
19064 if (!hdr) {
19065 nlmsg_free(msg);
19066 return;
19067 }
19068
19069 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19070 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
19071 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
19072 goto nla_put_failure;
19073
19074 genlmsg_end(msg, hdr);
19075
19076 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19077 NL80211_MCGRP_MLME, gfp);
19078 return;
19079
19080 nla_put_failure:
19081 nlmsg_free(msg);
19082 }
19083 EXPORT_SYMBOL(cfg80211_conn_failed);
19084
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)19085 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
19086 const u8 *addr, gfp_t gfp)
19087 {
19088 struct wireless_dev *wdev = dev->ieee80211_ptr;
19089 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19090 struct sk_buff *msg;
19091 void *hdr;
19092 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
19093
19094 if (!nlportid)
19095 return false;
19096
19097 msg = nlmsg_new(100, gfp);
19098 if (!msg)
19099 return true;
19100
19101 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19102 if (!hdr) {
19103 nlmsg_free(msg);
19104 return true;
19105 }
19106
19107 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19108 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19109 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19110 goto nla_put_failure;
19111
19112 genlmsg_end(msg, hdr);
19113 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19114 return true;
19115
19116 nla_put_failure:
19117 nlmsg_free(msg);
19118 return true;
19119 }
19120
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)19121 bool cfg80211_rx_spurious_frame(struct net_device *dev,
19122 const u8 *addr, gfp_t gfp)
19123 {
19124 struct wireless_dev *wdev = dev->ieee80211_ptr;
19125 bool ret;
19126
19127 trace_cfg80211_rx_spurious_frame(dev, addr);
19128
19129 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19130 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
19131 trace_cfg80211_return_bool(false);
19132 return false;
19133 }
19134 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
19135 addr, gfp);
19136 trace_cfg80211_return_bool(ret);
19137 return ret;
19138 }
19139 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
19140
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)19141 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
19142 const u8 *addr, gfp_t gfp)
19143 {
19144 struct wireless_dev *wdev = dev->ieee80211_ptr;
19145 bool ret;
19146
19147 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
19148
19149 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19150 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
19151 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
19152 trace_cfg80211_return_bool(false);
19153 return false;
19154 }
19155 ret = __nl80211_unexpected_frame(dev,
19156 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
19157 addr, gfp);
19158 trace_cfg80211_return_bool(ret);
19159 return ret;
19160 }
19161 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
19162
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)19163 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
19164 struct wireless_dev *wdev, u32 nlportid,
19165 struct cfg80211_rx_info *info, gfp_t gfp)
19166 {
19167 struct net_device *netdev = wdev->netdev;
19168 struct sk_buff *msg;
19169 void *hdr;
19170
19171 msg = nlmsg_new(100 + info->len, gfp);
19172 if (!msg)
19173 return -ENOMEM;
19174
19175 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19176 if (!hdr) {
19177 nlmsg_free(msg);
19178 return -ENOMEM;
19179 }
19180
19181 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19182 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19183 netdev->ifindex)) ||
19184 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19185 NL80211_ATTR_PAD) ||
19186 (info->have_link_id &&
19187 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
19188 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
19189 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
19190 (info->sig_dbm &&
19191 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
19192 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
19193 (info->flags &&
19194 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
19195 (info->rx_tstamp && nla_put_u64_64bit(msg,
19196 NL80211_ATTR_RX_HW_TIMESTAMP,
19197 info->rx_tstamp,
19198 NL80211_ATTR_PAD)) ||
19199 (info->ack_tstamp && nla_put_u64_64bit(msg,
19200 NL80211_ATTR_TX_HW_TIMESTAMP,
19201 info->ack_tstamp,
19202 NL80211_ATTR_PAD)))
19203 goto nla_put_failure;
19204
19205 genlmsg_end(msg, hdr);
19206
19207 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19208
19209 nla_put_failure:
19210 nlmsg_free(msg);
19211 return -ENOBUFS;
19212 }
19213
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)19214 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
19215 struct cfg80211_tx_status *status,
19216 gfp_t gfp, enum nl80211_commands command)
19217 {
19218 struct wiphy *wiphy = wdev->wiphy;
19219 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19220 struct net_device *netdev = wdev->netdev;
19221 struct sk_buff *msg;
19222 void *hdr;
19223
19224 if (command == NL80211_CMD_FRAME_TX_STATUS)
19225 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
19226 status->ack);
19227 else
19228 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
19229 status->ack);
19230
19231 msg = nlmsg_new(100 + status->len, gfp);
19232 if (!msg)
19233 return;
19234
19235 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
19236 if (!hdr) {
19237 nlmsg_free(msg);
19238 return;
19239 }
19240
19241 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19242 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19243 netdev->ifindex)) ||
19244 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19245 NL80211_ATTR_PAD) ||
19246 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
19247 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
19248 NL80211_ATTR_PAD) ||
19249 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19250 (status->tx_tstamp &&
19251 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
19252 status->tx_tstamp, NL80211_ATTR_PAD)) ||
19253 (status->ack_tstamp &&
19254 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
19255 status->ack_tstamp, NL80211_ATTR_PAD)))
19256 goto nla_put_failure;
19257
19258 genlmsg_end(msg, hdr);
19259
19260 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19261 NL80211_MCGRP_MLME, gfp);
19262 return;
19263
19264 nla_put_failure:
19265 nlmsg_free(msg);
19266 }
19267
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)19268 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
19269 const u8 *buf, size_t len, bool ack,
19270 gfp_t gfp)
19271 {
19272 struct cfg80211_tx_status status = {
19273 .cookie = cookie,
19274 .buf = buf,
19275 .len = len,
19276 .ack = ack
19277 };
19278
19279 nl80211_frame_tx_status(wdev, &status, gfp,
19280 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
19281 }
19282 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
19283
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)19284 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
19285 struct cfg80211_tx_status *status, gfp_t gfp)
19286 {
19287 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
19288 }
19289 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
19290
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)19291 static int __nl80211_rx_control_port(struct net_device *dev,
19292 struct sk_buff *skb,
19293 bool unencrypted,
19294 int link_id,
19295 gfp_t gfp)
19296 {
19297 struct wireless_dev *wdev = dev->ieee80211_ptr;
19298 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19299 struct ethhdr *ehdr = eth_hdr(skb);
19300 const u8 *addr = ehdr->h_source;
19301 u16 proto = be16_to_cpu(skb->protocol);
19302 struct sk_buff *msg;
19303 void *hdr;
19304 struct nlattr *frame;
19305
19306 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
19307
19308 if (!nlportid)
19309 return -ENOENT;
19310
19311 msg = nlmsg_new(100 + skb->len, gfp);
19312 if (!msg)
19313 return -ENOMEM;
19314
19315 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
19316 if (!hdr) {
19317 nlmsg_free(msg);
19318 return -ENOBUFS;
19319 }
19320
19321 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19322 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19323 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19324 NL80211_ATTR_PAD) ||
19325 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19326 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
19327 (link_id >= 0 &&
19328 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
19329 (unencrypted && nla_put_flag(msg,
19330 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
19331 goto nla_put_failure;
19332
19333 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
19334 if (!frame)
19335 goto nla_put_failure;
19336
19337 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
19338 genlmsg_end(msg, hdr);
19339
19340 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19341
19342 nla_put_failure:
19343 nlmsg_free(msg);
19344 return -ENOBUFS;
19345 }
19346
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)19347 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19348 bool unencrypted, int link_id)
19349 {
19350 int ret;
19351
19352 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19353 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19354 GFP_ATOMIC);
19355 trace_cfg80211_return_bool(ret == 0);
19356 return ret == 0;
19357 }
19358 EXPORT_SYMBOL(cfg80211_rx_control_port);
19359
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)19360 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19361 const char *mac, gfp_t gfp)
19362 {
19363 struct wireless_dev *wdev = dev->ieee80211_ptr;
19364 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19365 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19366 void **cb;
19367
19368 if (!msg)
19369 return NULL;
19370
19371 cb = (void **)msg->cb;
19372
19373 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19374 if (!cb[0]) {
19375 nlmsg_free(msg);
19376 return NULL;
19377 }
19378
19379 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19380 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19381 goto nla_put_failure;
19382
19383 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19384 goto nla_put_failure;
19385
19386 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19387 if (!cb[1])
19388 goto nla_put_failure;
19389
19390 cb[2] = rdev;
19391
19392 return msg;
19393 nla_put_failure:
19394 nlmsg_free(msg);
19395 return NULL;
19396 }
19397
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)19398 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19399 {
19400 void **cb = (void **)msg->cb;
19401 struct cfg80211_registered_device *rdev = cb[2];
19402
19403 nla_nest_end(msg, cb[1]);
19404 genlmsg_end(msg, cb[0]);
19405
19406 memset(msg->cb, 0, sizeof(msg->cb));
19407
19408 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19409 NL80211_MCGRP_MLME, gfp);
19410 }
19411
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)19412 void cfg80211_cqm_rssi_notify(struct net_device *dev,
19413 enum nl80211_cqm_rssi_threshold_event rssi_event,
19414 s32 rssi_level, gfp_t gfp)
19415 {
19416 struct wireless_dev *wdev = dev->ieee80211_ptr;
19417 struct cfg80211_cqm_config *cqm_config;
19418
19419 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19420
19421 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19422 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19423 return;
19424
19425 rcu_read_lock();
19426 cqm_config = rcu_dereference(wdev->cqm_config);
19427 if (cqm_config) {
19428 cqm_config->last_rssi_event_value = rssi_level;
19429 cqm_config->last_rssi_event_type = rssi_event;
19430 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19431 }
19432 rcu_read_unlock();
19433 }
19434 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19435
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)19436 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19437 {
19438 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19439 cqm_rssi_work);
19440 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19441 enum nl80211_cqm_rssi_threshold_event rssi_event;
19442 struct cfg80211_cqm_config *cqm_config;
19443 struct sk_buff *msg;
19444 s32 rssi_level;
19445
19446 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
19447 if (!cqm_config)
19448 return;
19449
19450 if (cqm_config->use_range_api)
19451 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19452
19453 rssi_level = cqm_config->last_rssi_event_value;
19454 rssi_event = cqm_config->last_rssi_event_type;
19455
19456 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19457 if (!msg)
19458 return;
19459
19460 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19461 rssi_event))
19462 goto nla_put_failure;
19463
19464 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19465 rssi_level))
19466 goto nla_put_failure;
19467
19468 cfg80211_send_cqm(msg, GFP_KERNEL);
19469
19470 return;
19471
19472 nla_put_failure:
19473 nlmsg_free(msg);
19474 }
19475
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)19476 void cfg80211_cqm_txe_notify(struct net_device *dev,
19477 const u8 *peer, u32 num_packets,
19478 u32 rate, u32 intvl, gfp_t gfp)
19479 {
19480 struct sk_buff *msg;
19481
19482 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19483 if (!msg)
19484 return;
19485
19486 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19487 goto nla_put_failure;
19488
19489 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19490 goto nla_put_failure;
19491
19492 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19493 goto nla_put_failure;
19494
19495 cfg80211_send_cqm(msg, gfp);
19496 return;
19497
19498 nla_put_failure:
19499 nlmsg_free(msg);
19500 }
19501 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19502
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)19503 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19504 const u8 *peer, u32 num_packets, gfp_t gfp)
19505 {
19506 struct sk_buff *msg;
19507
19508 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19509
19510 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19511 if (!msg)
19512 return;
19513
19514 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19515 goto nla_put_failure;
19516
19517 cfg80211_send_cqm(msg, gfp);
19518 return;
19519
19520 nla_put_failure:
19521 nlmsg_free(msg);
19522 }
19523 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19524
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)19525 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19526 {
19527 struct sk_buff *msg;
19528
19529 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19530 if (!msg)
19531 return;
19532
19533 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19534 goto nla_put_failure;
19535
19536 cfg80211_send_cqm(msg, gfp);
19537 return;
19538
19539 nla_put_failure:
19540 nlmsg_free(msg);
19541 }
19542 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19543
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19544 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19545 struct net_device *netdev, const u8 *bssid,
19546 const u8 *replay_ctr, gfp_t gfp)
19547 {
19548 struct sk_buff *msg;
19549 struct nlattr *rekey_attr;
19550 void *hdr;
19551
19552 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19553 if (!msg)
19554 return;
19555
19556 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19557 if (!hdr) {
19558 nlmsg_free(msg);
19559 return;
19560 }
19561
19562 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19563 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19564 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19565 goto nla_put_failure;
19566
19567 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19568 if (!rekey_attr)
19569 goto nla_put_failure;
19570
19571 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19572 NL80211_REPLAY_CTR_LEN, replay_ctr))
19573 goto nla_put_failure;
19574
19575 nla_nest_end(msg, rekey_attr);
19576
19577 genlmsg_end(msg, hdr);
19578
19579 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19580 NL80211_MCGRP_MLME, gfp);
19581 return;
19582
19583 nla_put_failure:
19584 nlmsg_free(msg);
19585 }
19586
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19587 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19588 const u8 *replay_ctr, gfp_t gfp)
19589 {
19590 struct wireless_dev *wdev = dev->ieee80211_ptr;
19591 struct wiphy *wiphy = wdev->wiphy;
19592 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19593
19594 trace_cfg80211_gtk_rekey_notify(dev, bssid);
19595 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19596 }
19597 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19598
19599 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19600 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19601 struct net_device *netdev, int index,
19602 const u8 *bssid, bool preauth, gfp_t gfp)
19603 {
19604 struct sk_buff *msg;
19605 struct nlattr *attr;
19606 void *hdr;
19607
19608 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19609 if (!msg)
19610 return;
19611
19612 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19613 if (!hdr) {
19614 nlmsg_free(msg);
19615 return;
19616 }
19617
19618 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19619 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19620 goto nla_put_failure;
19621
19622 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19623 if (!attr)
19624 goto nla_put_failure;
19625
19626 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19627 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19628 (preauth &&
19629 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19630 goto nla_put_failure;
19631
19632 nla_nest_end(msg, attr);
19633
19634 genlmsg_end(msg, hdr);
19635
19636 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19637 NL80211_MCGRP_MLME, gfp);
19638 return;
19639
19640 nla_put_failure:
19641 nlmsg_free(msg);
19642 }
19643
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19644 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19645 const u8 *bssid, bool preauth, gfp_t gfp)
19646 {
19647 struct wireless_dev *wdev = dev->ieee80211_ptr;
19648 struct wiphy *wiphy = wdev->wiphy;
19649 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19650
19651 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19652 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19653 }
19654 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19655
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)19656 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19657 struct net_device *netdev,
19658 unsigned int link_id,
19659 struct cfg80211_chan_def *chandef,
19660 gfp_t gfp,
19661 enum nl80211_commands notif,
19662 u8 count, bool quiet)
19663 {
19664 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19665 struct sk_buff *msg;
19666 void *hdr;
19667
19668 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19669 if (!msg)
19670 return;
19671
19672 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19673 if (!hdr) {
19674 nlmsg_free(msg);
19675 return;
19676 }
19677
19678 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19679 goto nla_put_failure;
19680
19681 if (wdev->valid_links &&
19682 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19683 goto nla_put_failure;
19684
19685 if (nl80211_send_chandef(msg, chandef))
19686 goto nla_put_failure;
19687
19688 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19689 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19690 goto nla_put_failure;
19691 if (quiet &&
19692 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19693 goto nla_put_failure;
19694 }
19695
19696 genlmsg_end(msg, hdr);
19697
19698 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19699 NL80211_MCGRP_MLME, gfp);
19700 return;
19701
19702 nla_put_failure:
19703 nlmsg_free(msg);
19704 }
19705
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)19706 void cfg80211_ch_switch_notify(struct net_device *dev,
19707 struct cfg80211_chan_def *chandef,
19708 unsigned int link_id)
19709 {
19710 struct wireless_dev *wdev = dev->ieee80211_ptr;
19711 struct wiphy *wiphy = wdev->wiphy;
19712 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19713
19714 lockdep_assert_wiphy(wdev->wiphy);
19715 WARN_INVALID_LINK_ID(wdev, link_id);
19716
19717 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
19718
19719 switch (wdev->iftype) {
19720 case NL80211_IFTYPE_STATION:
19721 case NL80211_IFTYPE_P2P_CLIENT:
19722 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19723 cfg80211_update_assoc_bss_entry(wdev, link_id,
19724 chandef->chan);
19725 break;
19726 case NL80211_IFTYPE_MESH_POINT:
19727 wdev->u.mesh.chandef = *chandef;
19728 wdev->u.mesh.preset_chandef = *chandef;
19729 break;
19730 case NL80211_IFTYPE_AP:
19731 case NL80211_IFTYPE_P2P_GO:
19732 wdev->links[link_id].ap.chandef = *chandef;
19733 break;
19734 case NL80211_IFTYPE_ADHOC:
19735 wdev->u.ibss.chandef = *chandef;
19736 break;
19737 default:
19738 WARN_ON(1);
19739 break;
19740 }
19741
19742 cfg80211_schedule_channels_check(wdev);
19743 cfg80211_sched_dfs_chan_update(rdev);
19744
19745 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19746 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
19747 }
19748 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19749
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet)19750 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19751 struct cfg80211_chan_def *chandef,
19752 unsigned int link_id, u8 count,
19753 bool quiet)
19754 {
19755 struct wireless_dev *wdev = dev->ieee80211_ptr;
19756 struct wiphy *wiphy = wdev->wiphy;
19757 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19758
19759 lockdep_assert_wiphy(wdev->wiphy);
19760 WARN_INVALID_LINK_ID(wdev, link_id);
19761
19762 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
19763
19764
19765 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19766 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19767 count, quiet);
19768 }
19769 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19770
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap,u8 link_id)19771 int cfg80211_bss_color_notify(struct net_device *dev,
19772 enum nl80211_commands cmd, u8 count,
19773 u64 color_bitmap, u8 link_id)
19774 {
19775 struct wireless_dev *wdev = dev->ieee80211_ptr;
19776 struct wiphy *wiphy = wdev->wiphy;
19777 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19778 struct sk_buff *msg;
19779 void *hdr;
19780
19781 lockdep_assert_wiphy(wdev->wiphy);
19782
19783 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19784
19785 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19786 if (!msg)
19787 return -ENOMEM;
19788
19789 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19790 if (!hdr)
19791 goto nla_put_failure;
19792
19793 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19794 goto nla_put_failure;
19795
19796 if (wdev->valid_links &&
19797 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19798 goto nla_put_failure;
19799
19800 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19801 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19802 goto nla_put_failure;
19803
19804 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19805 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19806 color_bitmap, NL80211_ATTR_PAD))
19807 goto nla_put_failure;
19808
19809 genlmsg_end(msg, hdr);
19810
19811 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19812 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19813
19814 nla_put_failure:
19815 nlmsg_free(msg);
19816 return -EINVAL;
19817 }
19818 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19819
19820 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)19821 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19822 const struct cfg80211_chan_def *chandef,
19823 enum nl80211_radar_event event,
19824 struct net_device *netdev, gfp_t gfp)
19825 {
19826 struct sk_buff *msg;
19827 void *hdr;
19828
19829 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19830 if (!msg)
19831 return;
19832
19833 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19834 if (!hdr) {
19835 nlmsg_free(msg);
19836 return;
19837 }
19838
19839 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19840 goto nla_put_failure;
19841
19842 /* NOP and radar events don't need a netdev parameter */
19843 if (netdev) {
19844 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19845
19846 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19847 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19848 NL80211_ATTR_PAD))
19849 goto nla_put_failure;
19850 }
19851
19852 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19853 goto nla_put_failure;
19854
19855 if (nl80211_send_chandef(msg, chandef))
19856 goto nla_put_failure;
19857
19858 genlmsg_end(msg, hdr);
19859
19860 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19861 NL80211_MCGRP_MLME, gfp);
19862 return;
19863
19864 nla_put_failure:
19865 nlmsg_free(msg);
19866 }
19867
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)19868 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19869 struct sta_opmode_info *sta_opmode,
19870 gfp_t gfp)
19871 {
19872 struct sk_buff *msg;
19873 struct wireless_dev *wdev = dev->ieee80211_ptr;
19874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19875 void *hdr;
19876
19877 if (WARN_ON(!mac))
19878 return;
19879
19880 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19881 if (!msg)
19882 return;
19883
19884 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19885 if (!hdr) {
19886 nlmsg_free(msg);
19887 return;
19888 }
19889
19890 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19891 goto nla_put_failure;
19892
19893 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19894 goto nla_put_failure;
19895
19896 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19897 goto nla_put_failure;
19898
19899 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19900 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19901 goto nla_put_failure;
19902
19903 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19904 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19905 goto nla_put_failure;
19906
19907 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19908 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19909 goto nla_put_failure;
19910
19911 genlmsg_end(msg, hdr);
19912
19913 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19914 NL80211_MCGRP_MLME, gfp);
19915
19916 return;
19917
19918 nla_put_failure:
19919 nlmsg_free(msg);
19920 }
19921 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19922
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)19923 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19924 u64 cookie, bool acked, s32 ack_signal,
19925 bool is_valid_ack_signal, gfp_t gfp)
19926 {
19927 struct wireless_dev *wdev = dev->ieee80211_ptr;
19928 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19929 struct sk_buff *msg;
19930 void *hdr;
19931
19932 trace_cfg80211_probe_status(dev, addr, cookie, acked);
19933
19934 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19935
19936 if (!msg)
19937 return;
19938
19939 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19940 if (!hdr) {
19941 nlmsg_free(msg);
19942 return;
19943 }
19944
19945 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19946 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19947 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19948 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19949 NL80211_ATTR_PAD) ||
19950 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19951 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19952 ack_signal)))
19953 goto nla_put_failure;
19954
19955 genlmsg_end(msg, hdr);
19956
19957 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19958 NL80211_MCGRP_MLME, gfp);
19959 return;
19960
19961 nla_put_failure:
19962 nlmsg_free(msg);
19963 }
19964 EXPORT_SYMBOL(cfg80211_probe_status);
19965
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)19966 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19967 size_t len, int freq, int sig_dbm)
19968 {
19969 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19970 struct sk_buff *msg;
19971 void *hdr;
19972 struct cfg80211_beacon_registration *reg;
19973
19974 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19975
19976 spin_lock_bh(&rdev->beacon_registrations_lock);
19977 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19978 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19979 if (!msg) {
19980 spin_unlock_bh(&rdev->beacon_registrations_lock);
19981 return;
19982 }
19983
19984 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19985 if (!hdr)
19986 goto nla_put_failure;
19987
19988 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19989 (freq &&
19990 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19991 KHZ_TO_MHZ(freq)) ||
19992 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19993 freq % 1000))) ||
19994 (sig_dbm &&
19995 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19996 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19997 goto nla_put_failure;
19998
19999 genlmsg_end(msg, hdr);
20000
20001 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
20002 }
20003 spin_unlock_bh(&rdev->beacon_registrations_lock);
20004 return;
20005
20006 nla_put_failure:
20007 spin_unlock_bh(&rdev->beacon_registrations_lock);
20008 nlmsg_free(msg);
20009 }
20010 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
20011
20012 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)20013 static int cfg80211_net_detect_results(struct sk_buff *msg,
20014 struct cfg80211_wowlan_wakeup *wakeup)
20015 {
20016 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
20017 struct nlattr *nl_results, *nl_match, *nl_freqs;
20018 int i, j;
20019
20020 nl_results = nla_nest_start_noflag(msg,
20021 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
20022 if (!nl_results)
20023 return -EMSGSIZE;
20024
20025 for (i = 0; i < nd->n_matches; i++) {
20026 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
20027
20028 nl_match = nla_nest_start_noflag(msg, i);
20029 if (!nl_match)
20030 break;
20031
20032 /* The SSID attribute is optional in nl80211, but for
20033 * simplicity reasons it's always present in the
20034 * cfg80211 structure. If a driver can't pass the
20035 * SSID, that needs to be changed. A zero length SSID
20036 * is still a valid SSID (wildcard), so it cannot be
20037 * used for this purpose.
20038 */
20039 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
20040 match->ssid.ssid)) {
20041 nla_nest_cancel(msg, nl_match);
20042 goto out;
20043 }
20044
20045 if (match->n_channels) {
20046 nl_freqs = nla_nest_start_noflag(msg,
20047 NL80211_ATTR_SCAN_FREQUENCIES);
20048 if (!nl_freqs) {
20049 nla_nest_cancel(msg, nl_match);
20050 goto out;
20051 }
20052
20053 for (j = 0; j < match->n_channels; j++) {
20054 if (nla_put_u32(msg, j, match->channels[j])) {
20055 nla_nest_cancel(msg, nl_freqs);
20056 nla_nest_cancel(msg, nl_match);
20057 goto out;
20058 }
20059 }
20060
20061 nla_nest_end(msg, nl_freqs);
20062 }
20063
20064 nla_nest_end(msg, nl_match);
20065 }
20066
20067 out:
20068 nla_nest_end(msg, nl_results);
20069 return 0;
20070 }
20071
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)20072 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
20073 struct cfg80211_wowlan_wakeup *wakeup,
20074 gfp_t gfp)
20075 {
20076 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20077 struct sk_buff *msg;
20078 void *hdr;
20079 int size = 200;
20080
20081 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
20082
20083 if (wakeup)
20084 size += wakeup->packet_present_len;
20085
20086 msg = nlmsg_new(size, gfp);
20087 if (!msg)
20088 return;
20089
20090 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
20091 if (!hdr)
20092 goto free_msg;
20093
20094 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20095 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20096 NL80211_ATTR_PAD))
20097 goto free_msg;
20098
20099 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20100 wdev->netdev->ifindex))
20101 goto free_msg;
20102
20103 if (wakeup) {
20104 struct nlattr *reasons;
20105
20106 reasons = nla_nest_start_noflag(msg,
20107 NL80211_ATTR_WOWLAN_TRIGGERS);
20108 if (!reasons)
20109 goto free_msg;
20110
20111 if (wakeup->disconnect &&
20112 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
20113 goto free_msg;
20114 if (wakeup->magic_pkt &&
20115 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
20116 goto free_msg;
20117 if (wakeup->gtk_rekey_failure &&
20118 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
20119 goto free_msg;
20120 if (wakeup->eap_identity_req &&
20121 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
20122 goto free_msg;
20123 if (wakeup->four_way_handshake &&
20124 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
20125 goto free_msg;
20126 if (wakeup->rfkill_release &&
20127 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
20128 goto free_msg;
20129
20130 if (wakeup->pattern_idx >= 0 &&
20131 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
20132 wakeup->pattern_idx))
20133 goto free_msg;
20134
20135 if (wakeup->tcp_match &&
20136 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
20137 goto free_msg;
20138
20139 if (wakeup->tcp_connlost &&
20140 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
20141 goto free_msg;
20142
20143 if (wakeup->tcp_nomoretokens &&
20144 nla_put_flag(msg,
20145 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
20146 goto free_msg;
20147
20148 if (wakeup->unprot_deauth_disassoc &&
20149 nla_put_flag(msg,
20150 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
20151 goto free_msg;
20152
20153 if (wakeup->packet) {
20154 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
20155 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
20156
20157 if (!wakeup->packet_80211) {
20158 pkt_attr =
20159 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
20160 len_attr =
20161 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
20162 }
20163
20164 if (wakeup->packet_len &&
20165 nla_put_u32(msg, len_attr, wakeup->packet_len))
20166 goto free_msg;
20167
20168 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
20169 wakeup->packet))
20170 goto free_msg;
20171 }
20172
20173 if (wakeup->net_detect &&
20174 cfg80211_net_detect_results(msg, wakeup))
20175 goto free_msg;
20176
20177 nla_nest_end(msg, reasons);
20178 }
20179
20180 genlmsg_end(msg, hdr);
20181
20182 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20183 NL80211_MCGRP_MLME, gfp);
20184 return;
20185
20186 free_msg:
20187 nlmsg_free(msg);
20188 }
20189 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
20190 #endif
20191
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)20192 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
20193 enum nl80211_tdls_operation oper,
20194 u16 reason_code, gfp_t gfp)
20195 {
20196 struct wireless_dev *wdev = dev->ieee80211_ptr;
20197 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20198 struct sk_buff *msg;
20199 void *hdr;
20200
20201 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
20202 reason_code);
20203
20204 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20205 if (!msg)
20206 return;
20207
20208 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
20209 if (!hdr) {
20210 nlmsg_free(msg);
20211 return;
20212 }
20213
20214 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20215 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20216 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
20217 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
20218 (reason_code > 0 &&
20219 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
20220 goto nla_put_failure;
20221
20222 genlmsg_end(msg, hdr);
20223
20224 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20225 NL80211_MCGRP_MLME, gfp);
20226 return;
20227
20228 nla_put_failure:
20229 nlmsg_free(msg);
20230 }
20231 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
20232
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)20233 static int nl80211_netlink_notify(struct notifier_block * nb,
20234 unsigned long state,
20235 void *_notify)
20236 {
20237 struct netlink_notify *notify = _notify;
20238 struct cfg80211_registered_device *rdev;
20239 struct wireless_dev *wdev;
20240 struct cfg80211_beacon_registration *reg, *tmp;
20241
20242 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
20243 return NOTIFY_DONE;
20244
20245 rcu_read_lock();
20246
20247 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
20248 struct cfg80211_sched_scan_request *sched_scan_req;
20249
20250 list_for_each_entry_rcu(sched_scan_req,
20251 &rdev->sched_scan_req_list,
20252 list) {
20253 if (sched_scan_req->owner_nlportid == notify->portid) {
20254 sched_scan_req->nl_owner_dead = true;
20255 wiphy_work_queue(&rdev->wiphy,
20256 &rdev->sched_scan_stop_wk);
20257 }
20258 }
20259
20260 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
20261 cfg80211_mlme_unregister_socket(wdev, notify->portid);
20262
20263 if (wdev->owner_nlportid == notify->portid) {
20264 wdev->nl_owner_dead = true;
20265 schedule_work(&rdev->destroy_work);
20266 } else if (wdev->conn_owner_nlportid == notify->portid) {
20267 schedule_work(&wdev->disconnect_wk);
20268 }
20269
20270 cfg80211_release_pmsr(wdev, notify->portid);
20271 }
20272
20273 spin_lock_bh(&rdev->beacon_registrations_lock);
20274 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
20275 list) {
20276 if (reg->nlportid == notify->portid) {
20277 list_del(®->list);
20278 kfree(reg);
20279 break;
20280 }
20281 }
20282 spin_unlock_bh(&rdev->beacon_registrations_lock);
20283 }
20284
20285 rcu_read_unlock();
20286
20287 /*
20288 * It is possible that the user space process that is controlling the
20289 * indoor setting disappeared, so notify the regulatory core.
20290 */
20291 regulatory_netlink_notify(notify->portid);
20292 return NOTIFY_OK;
20293 }
20294
20295 static struct notifier_block nl80211_netlink_notifier = {
20296 .notifier_call = nl80211_netlink_notify,
20297 };
20298
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)20299 void cfg80211_ft_event(struct net_device *netdev,
20300 struct cfg80211_ft_event_params *ft_event)
20301 {
20302 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20303 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20304 struct sk_buff *msg;
20305 void *hdr;
20306
20307 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
20308
20309 if (!ft_event->target_ap)
20310 return;
20311
20312 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
20313 GFP_KERNEL);
20314 if (!msg)
20315 return;
20316
20317 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
20318 if (!hdr)
20319 goto out;
20320
20321 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20322 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20323 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
20324 goto out;
20325
20326 if (ft_event->ies &&
20327 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
20328 goto out;
20329 if (ft_event->ric_ies &&
20330 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
20331 ft_event->ric_ies))
20332 goto out;
20333
20334 genlmsg_end(msg, hdr);
20335
20336 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20337 NL80211_MCGRP_MLME, GFP_KERNEL);
20338 return;
20339 out:
20340 nlmsg_free(msg);
20341 }
20342 EXPORT_SYMBOL(cfg80211_ft_event);
20343
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)20344 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
20345 {
20346 struct cfg80211_registered_device *rdev;
20347 struct sk_buff *msg;
20348 void *hdr;
20349 u32 nlportid;
20350
20351 rdev = wiphy_to_rdev(wdev->wiphy);
20352 if (!rdev->crit_proto_nlportid)
20353 return;
20354
20355 nlportid = rdev->crit_proto_nlportid;
20356 rdev->crit_proto_nlportid = 0;
20357
20358 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20359 if (!msg)
20360 return;
20361
20362 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
20363 if (!hdr)
20364 goto nla_put_failure;
20365
20366 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20367 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20368 NL80211_ATTR_PAD))
20369 goto nla_put_failure;
20370
20371 genlmsg_end(msg, hdr);
20372
20373 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20374 return;
20375
20376 nla_put_failure:
20377 nlmsg_free(msg);
20378 }
20379 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20380
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)20381 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20382 {
20383 struct wiphy *wiphy = wdev->wiphy;
20384 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20385 struct sk_buff *msg;
20386 void *hdr;
20387
20388 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20389 if (!msg)
20390 return;
20391
20392 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20393 if (!hdr)
20394 goto out;
20395
20396 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20397 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20398 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20399 NL80211_ATTR_PAD) ||
20400 (wdev->valid_links &&
20401 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20402 goto out;
20403
20404 genlmsg_end(msg, hdr);
20405
20406 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20407 NL80211_MCGRP_MLME, GFP_KERNEL);
20408 return;
20409 out:
20410 nlmsg_free(msg);
20411 }
20412
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)20413 int cfg80211_external_auth_request(struct net_device *dev,
20414 struct cfg80211_external_auth_params *params,
20415 gfp_t gfp)
20416 {
20417 struct wireless_dev *wdev = dev->ieee80211_ptr;
20418 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20419 struct sk_buff *msg;
20420 void *hdr;
20421
20422 if (!wdev->conn_owner_nlportid)
20423 return -EINVAL;
20424
20425 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20426 if (!msg)
20427 return -ENOMEM;
20428
20429 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20430 if (!hdr)
20431 goto nla_put_failure;
20432
20433 /* Some historical mistakes in drivers <-> userspace interface (notably
20434 * between drivers and wpa_supplicant) led to a big-endian conversion
20435 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
20436 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
20437 * benefit of older wpa_supplicant versions, send this particular value
20438 * in big-endian. Note that newer wpa_supplicant will also detect this
20439 * particular value in big endian still, so it all continues to work.
20440 */
20441 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
20442 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
20443 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
20444 goto nla_put_failure;
20445 } else {
20446 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
20447 params->key_mgmt_suite))
20448 goto nla_put_failure;
20449 }
20450
20451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20452 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20453 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20454 params->action) ||
20455 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20456 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20457 params->ssid.ssid) ||
20458 (!is_zero_ether_addr(params->mld_addr) &&
20459 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20460 goto nla_put_failure;
20461
20462 genlmsg_end(msg, hdr);
20463 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20464 wdev->conn_owner_nlportid);
20465 return 0;
20466
20467 nla_put_failure:
20468 nlmsg_free(msg);
20469 return -ENOBUFS;
20470 }
20471 EXPORT_SYMBOL(cfg80211_external_auth_request);
20472
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)20473 void cfg80211_update_owe_info_event(struct net_device *netdev,
20474 struct cfg80211_update_owe_info *owe_info,
20475 gfp_t gfp)
20476 {
20477 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20478 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20479 struct sk_buff *msg;
20480 void *hdr;
20481
20482 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20483
20484 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20485 if (!msg)
20486 return;
20487
20488 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20489 if (!hdr)
20490 goto nla_put_failure;
20491
20492 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20493 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20494 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20495 goto nla_put_failure;
20496
20497 if (!owe_info->ie_len ||
20498 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20499 goto nla_put_failure;
20500
20501 if (owe_info->assoc_link_id != -1) {
20502 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20503 owe_info->assoc_link_id))
20504 goto nla_put_failure;
20505
20506 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20507 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20508 owe_info->peer_mld_addr))
20509 goto nla_put_failure;
20510 }
20511
20512 genlmsg_end(msg, hdr);
20513
20514 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20515 NL80211_MCGRP_MLME, gfp);
20516 return;
20517
20518 nla_put_failure:
20519 genlmsg_cancel(msg, hdr);
20520 nlmsg_free(msg);
20521 }
20522 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20523
cfg80211_schedule_channels_check(struct wireless_dev * wdev)20524 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
20525 {
20526 struct wiphy *wiphy = wdev->wiphy;
20527
20528 /* Schedule channels check if NO_IR or DFS relaxations are supported */
20529 if (wdev->iftype == NL80211_IFTYPE_STATION &&
20530 (wiphy_ext_feature_isset(wiphy,
20531 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
20532 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
20533 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
20534 reg_check_channels();
20535 }
20536 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
20537
cfg80211_epcs_changed(struct net_device * netdev,bool enabled)20538 void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
20539 {
20540 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20541 struct wiphy *wiphy = wdev->wiphy;
20542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20543 struct sk_buff *msg;
20544 void *hdr;
20545
20546 trace_cfg80211_epcs_changed(wdev, enabled);
20547
20548 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20549 if (!msg)
20550 return;
20551
20552 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
20553 if (!hdr) {
20554 nlmsg_free(msg);
20555 return;
20556 }
20557
20558 if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
20559 goto nla_put_failure;
20560
20561 genlmsg_end(msg, hdr);
20562 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20563 NL80211_MCGRP_MLME, GFP_KERNEL);
20564 return;
20565
20566 nla_put_failure:
20567 nlmsg_free(msg);
20568 }
20569 EXPORT_SYMBOL(cfg80211_epcs_changed);
20570
20571 /* initialisation/exit functions */
20572
nl80211_init(void)20573 int __init nl80211_init(void)
20574 {
20575 int err;
20576
20577 err = genl_register_family(&nl80211_fam);
20578 if (err)
20579 return err;
20580
20581 err = netlink_register_notifier(&nl80211_netlink_notifier);
20582 if (err)
20583 goto err_out;
20584
20585 return 0;
20586 err_out:
20587 genl_unregister_family(&nl80211_fam);
20588 return err;
20589 }
20590
nl80211_exit(void)20591 void nl80211_exit(void)
20592 {
20593 netlink_unregister_notifier(&nl80211_netlink_notifier);
20594 genl_unregister_family(&nl80211_fam);
20595 }
20596