1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2023 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev, 68 struct net *netns, struct nlattr **attrs) 69 { 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id = 0; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 if (!have_ifidx && !have_wdev_id) 78 return ERR_PTR(-EINVAL); 79 80 if (have_ifidx) 81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 82 if (have_wdev_id) { 83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 84 wiphy_idx = wdev_id >> 32; 85 } 86 87 if (rdev) { 88 struct wireless_dev *wdev; 89 90 lockdep_assert_held(&rdev->wiphy.mtx); 91 92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 93 if (have_ifidx && wdev->netdev && 94 wdev->netdev->ifindex == ifidx) { 95 result = wdev; 96 break; 97 } 98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 99 result = wdev; 100 break; 101 } 102 } 103 104 return result ?: ERR_PTR(-ENODEV); 105 } 106 107 ASSERT_RTNL(); 108 109 for_each_rdev(rdev) { 110 struct wireless_dev *wdev; 111 112 if (wiphy_net(&rdev->wiphy) != netns) 113 continue; 114 115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 116 continue; 117 118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 119 if (have_ifidx && wdev->netdev && 120 wdev->netdev->ifindex == ifidx) { 121 result = wdev; 122 break; 123 } 124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 125 result = wdev; 126 break; 127 } 128 } 129 130 if (result) 131 break; 132 } 133 134 if (result) 135 return result; 136 return ERR_PTR(-ENODEV); 137 } 138 139 static struct cfg80211_registered_device * 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 141 { 142 struct cfg80211_registered_device *rdev = NULL, *tmp; 143 struct net_device *netdev; 144 145 ASSERT_RTNL(); 146 147 if (!attrs[NL80211_ATTR_WIPHY] && 148 !attrs[NL80211_ATTR_IFINDEX] && 149 !attrs[NL80211_ATTR_WDEV]) 150 return ERR_PTR(-EINVAL); 151 152 if (attrs[NL80211_ATTR_WIPHY]) 153 rdev = cfg80211_rdev_by_wiphy_idx( 154 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 155 156 if (attrs[NL80211_ATTR_WDEV]) { 157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 158 struct wireless_dev *wdev; 159 bool found = false; 160 161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 162 if (tmp) { 163 /* make sure wdev exists */ 164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 165 if (wdev->identifier != (u32)wdev_id) 166 continue; 167 found = true; 168 break; 169 } 170 171 if (!found) 172 tmp = NULL; 173 174 if (rdev && tmp != rdev) 175 return ERR_PTR(-EINVAL); 176 rdev = tmp; 177 } 178 } 179 180 if (attrs[NL80211_ATTR_IFINDEX]) { 181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 182 183 netdev = __dev_get_by_index(netns, ifindex); 184 if (netdev) { 185 if (netdev->ieee80211_ptr) 186 tmp = wiphy_to_rdev( 187 netdev->ieee80211_ptr->wiphy); 188 else 189 tmp = NULL; 190 191 /* not wireless device -- return error */ 192 if (!tmp) 193 return ERR_PTR(-EINVAL); 194 195 /* mismatch -- return error */ 196 if (rdev && tmp != rdev) 197 return ERR_PTR(-EINVAL); 198 199 rdev = tmp; 200 } 201 } 202 203 if (!rdev) 204 return ERR_PTR(-ENODEV); 205 206 if (netns != wiphy_net(&rdev->wiphy)) 207 return ERR_PTR(-ENODEV); 208 209 return rdev; 210 } 211 212 /* 213 * This function returns a pointer to the driver 214 * that the genl_info item that is passed refers to. 215 * 216 * The result of this can be a PTR_ERR and hence must 217 * be checked with IS_ERR() for errors. 218 */ 219 static struct cfg80211_registered_device * 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 221 { 222 return __cfg80211_rdev_from_attrs(netns, info->attrs); 223 } 224 225 static int validate_beacon_head(const struct nlattr *attr, 226 struct netlink_ext_ack *extack) 227 { 228 const u8 *data = nla_data(attr); 229 unsigned int len = nla_len(attr); 230 const struct element *elem; 231 const struct ieee80211_mgmt *mgmt = (void *)data; 232 unsigned int fixedlen, hdrlen; 233 bool s1g_bcn; 234 235 if (len < offsetofend(typeof(*mgmt), frame_control)) 236 goto err; 237 238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 239 if (s1g_bcn) { 240 fixedlen = offsetof(struct ieee80211_ext, 241 u.s1g_beacon.variable); 242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 243 } else { 244 fixedlen = offsetof(struct ieee80211_mgmt, 245 u.beacon.variable); 246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 247 } 248 249 if (len < fixedlen) 250 goto err; 251 252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 253 goto err; 254 255 data += fixedlen; 256 len -= fixedlen; 257 258 for_each_element(elem, data, len) { 259 /* nothing */ 260 } 261 262 if (for_each_element_completed(elem, data, len)) 263 return 0; 264 265 err: 266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 267 return -EINVAL; 268 } 269 270 static int validate_ie_attr(const struct nlattr *attr, 271 struct netlink_ext_ack *extack) 272 { 273 const u8 *data = nla_data(attr); 274 unsigned int len = nla_len(attr); 275 const struct element *elem; 276 277 for_each_element(elem, data, len) { 278 /* nothing */ 279 } 280 281 if (for_each_element_completed(elem, data, len)) 282 return 0; 283 284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 285 return -EINVAL; 286 } 287 288 static int validate_he_capa(const struct nlattr *attr, 289 struct netlink_ext_ack *extack) 290 { 291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr))) 292 return -EINVAL; 293 294 return 0; 295 } 296 297 /* policy for the attributes */ 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 299 300 static const struct nla_policy 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 304 .len = U8_MAX }, 305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 306 .len = U8_MAX }, 307 }; 308 309 static const struct nla_policy 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 314 NLA_POLICY_MAX(NLA_U8, 15), 315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 317 NLA_POLICY_MAX(NLA_U8, 15), 318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 319 NLA_POLICY_MAX(NLA_U8, 31), 320 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 322 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 323 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 324 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 325 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG }, 326 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 }, 327 }; 328 329 static const struct nla_policy 330 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 331 [NL80211_PMSR_TYPE_FTM] = 332 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 333 }; 334 335 static const struct nla_policy 336 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 337 [NL80211_PMSR_REQ_ATTR_DATA] = 338 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 339 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 340 }; 341 342 static const struct nla_policy 343 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 344 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 345 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 346 [NL80211_PMSR_PEER_ATTR_REQ] = 347 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 348 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 349 }; 350 351 static const struct nla_policy 352 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 353 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 354 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 355 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 356 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 357 [NL80211_PMSR_ATTR_PEERS] = 358 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy), 359 }; 360 361 static const struct nla_policy 362 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 363 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 364 NLA_POLICY_RANGE(NLA_U8, 1, 20), 365 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 366 NLA_POLICY_RANGE(NLA_U8, 1, 20), 367 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 368 NLA_POLICY_RANGE(NLA_U8, 1, 20), 369 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 370 NLA_POLICY_EXACT_LEN(8), 371 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 372 NLA_POLICY_EXACT_LEN(8), 373 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 374 }; 375 376 static const struct nla_policy 377 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 378 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 379 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 380 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 381 }; 382 383 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 384 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 385 .len = NL80211_MAX_SUPP_RATES }, 386 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 387 .len = NL80211_MAX_SUPP_HT_RATES }, 388 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 389 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 390 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 391 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 392 NL80211_RATE_INFO_HE_GI_0_8, 393 NL80211_RATE_INFO_HE_GI_3_2), 394 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 395 NL80211_RATE_INFO_HE_1XLTF, 396 NL80211_RATE_INFO_HE_4XLTF), 397 }; 398 399 static const struct nla_policy 400 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 401 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 402 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 403 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 404 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 405 [NL80211_TID_CONFIG_ATTR_NOACK] = 406 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 407 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 408 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 409 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 410 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 411 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 412 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 413 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 414 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 415 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 416 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 417 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 418 NLA_POLICY_NESTED(nl80211_txattr_policy), 419 }; 420 421 static const struct nla_policy 422 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 423 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 424 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 425 [NL80211_FILS_DISCOVERY_ATTR_TMPL] = 426 NLA_POLICY_RANGE(NLA_BINARY, 427 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 428 IEEE80211_MAX_DATA_LEN), 429 }; 430 431 static const struct nla_policy 432 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 434 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 435 .len = IEEE80211_MAX_DATA_LEN } 436 }; 437 438 static const struct nla_policy 439 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = { 440 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 }, 441 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 }, 442 }; 443 444 static const struct nla_policy 445 sar_policy[NL80211_SAR_ATTR_MAX + 1] = { 446 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE), 447 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy), 448 }; 449 450 static const struct nla_policy 451 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = { 452 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2), 453 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] = 454 NLA_POLICY_MIN(NLA_U8, 1), 455 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 }, 456 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 }, 457 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG }, 458 }; 459 460 static const struct nla_policy 461 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 462 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 463 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 464 }; 465 466 static const struct netlink_range_validation nl80211_punct_bitmap_range = { 467 .min = 0, 468 .max = 0xffff, 469 }; 470 471 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 472 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 473 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 474 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 475 .len = 20-1 }, 476 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 477 478 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 479 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 480 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 481 NL80211_EDMG_CHANNELS_MIN, 482 NL80211_EDMG_CHANNELS_MAX), 483 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 484 NL80211_EDMG_BW_CONFIG_MIN, 485 NL80211_EDMG_BW_CONFIG_MAX), 486 487 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 488 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 489 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 490 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 491 492 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 493 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 494 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 495 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 496 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 497 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 498 499 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 500 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 501 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 502 503 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 504 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 505 506 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 507 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 508 .len = WLAN_MAX_KEY_LEN }, 509 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 510 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 511 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 512 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 513 [NL80211_ATTR_KEY_TYPE] = 514 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 515 516 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 517 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 518 [NL80211_ATTR_BEACON_HEAD] = 519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 520 IEEE80211_MAX_DATA_LEN), 521 [NL80211_ATTR_BEACON_TAIL] = 522 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 523 IEEE80211_MAX_DATA_LEN), 524 [NL80211_ATTR_STA_AID] = 525 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 526 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 527 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 528 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 529 .len = NL80211_MAX_SUPP_RATES }, 530 [NL80211_ATTR_STA_PLINK_ACTION] = 531 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 532 [NL80211_ATTR_STA_TX_POWER_SETTING] = 533 NLA_POLICY_RANGE(NLA_U8, 534 NL80211_TX_POWER_AUTOMATIC, 535 NL80211_TX_POWER_FIXED), 536 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 537 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 538 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 539 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 540 .len = IEEE80211_MAX_MESH_ID_LEN }, 541 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 542 543 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 544 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 545 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 546 547 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 548 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 549 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 550 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 551 .len = NL80211_MAX_SUPP_RATES }, 552 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 553 554 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 555 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 556 557 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 558 559 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 560 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 561 validate_ie_attr, 562 IEEE80211_MAX_DATA_LEN), 563 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 564 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 565 566 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 567 .len = IEEE80211_MAX_SSID_LEN }, 568 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 569 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 570 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 572 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 573 NL80211_MFP_NO, 574 NL80211_MFP_OPTIONAL), 575 [NL80211_ATTR_STA_FLAGS2] = 576 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)), 577 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 578 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 579 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 580 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 581 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 582 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 583 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 584 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 585 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 586 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 587 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 588 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 589 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 590 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 591 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 592 .len = IEEE80211_MAX_DATA_LEN }, 593 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 594 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 595 NL80211_PS_DISABLED, 596 NL80211_PS_ENABLED), 597 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 598 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 599 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 600 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 601 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 602 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 603 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 604 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 605 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 606 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 607 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 608 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 609 [NL80211_ATTR_STA_PLINK_STATE] = 610 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 611 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 612 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 613 [NL80211_ATTR_MESH_PEER_AID] = 614 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 615 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 616 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 617 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 618 [NL80211_ATTR_HIDDEN_SSID] = 619 NLA_POLICY_RANGE(NLA_U32, 620 NL80211_HIDDEN_SSID_NOT_IN_USE, 621 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 622 [NL80211_ATTR_IE_PROBE_RESP] = 623 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 624 IEEE80211_MAX_DATA_LEN), 625 [NL80211_ATTR_IE_ASSOC_RESP] = 626 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 627 IEEE80211_MAX_DATA_LEN), 628 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 629 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy), 630 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 631 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 632 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 633 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 634 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 635 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 636 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 637 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 638 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 639 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 640 .len = IEEE80211_MAX_DATA_LEN }, 641 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 642 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 643 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 644 .len = NL80211_HT_CAPABILITY_LEN 645 }, 646 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 647 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 648 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 649 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 650 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 651 652 /* need to include at least Auth Transaction and Status Code */ 653 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 654 655 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 656 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 657 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 658 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 659 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 660 NLA_POLICY_RANGE(NLA_U32, 661 NL80211_MESH_POWER_UNKNOWN + 1, 662 NL80211_MESH_POWER_MAX), 663 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 664 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 665 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 666 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 667 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 668 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 669 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 670 .len = NL80211_VHT_CAPABILITY_LEN, 671 }, 672 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 673 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 674 .len = IEEE80211_MAX_DATA_LEN }, 675 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 676 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 677 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 678 [NL80211_ATTR_PEER_AID] = 679 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 680 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 681 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 682 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 683 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 684 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 685 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 686 /* 687 * The value of the Length field of the Supported Operating 688 * Classes element is between 2 and 253. 689 */ 690 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 691 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 692 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 693 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 694 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 695 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 696 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 697 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 698 IEEE80211_QOS_MAP_LEN_MIN, 699 IEEE80211_QOS_MAP_LEN_MAX), 700 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 701 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 702 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 703 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 704 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 705 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 707 [NL80211_ATTR_USER_PRIO] = 708 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 709 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 710 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 711 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 712 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 713 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 714 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 715 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 716 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 717 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 718 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 719 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 720 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 721 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 722 .len = VHT_MUMIMO_GROUPS_DATA_LEN 723 }, 724 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 725 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 726 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 727 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 728 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 729 .len = FILS_MAX_KEK_LEN }, 730 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 731 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 732 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 733 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 734 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 735 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 736 }, 737 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 738 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 739 .len = FILS_ERP_MAX_USERNAME_LEN }, 740 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 741 .len = FILS_ERP_MAX_REALM_LEN }, 742 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 743 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 744 .len = FILS_ERP_MAX_RRK_LEN }, 745 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 746 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 747 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 748 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 749 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 750 751 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 752 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 753 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 754 [NL80211_ATTR_HE_CAPABILITY] = 755 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, 756 NL80211_HE_MAX_CAPABILITY_LEN), 757 [NL80211_ATTR_FTM_RESPONDER] = 758 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 759 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 760 [NL80211_ATTR_PEER_MEASUREMENTS] = 761 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 762 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 763 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 764 .len = SAE_PASSWORD_MAX_LEN }, 765 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 766 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 767 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 768 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 769 [NL80211_ATTR_TID_CONFIG] = 770 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 771 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 772 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 773 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 774 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 775 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 776 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 777 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 778 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 779 [NL80211_ATTR_FILS_DISCOVERY] = 780 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 781 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 782 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 783 [NL80211_ATTR_S1G_CAPABILITY] = 784 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 785 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 786 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 787 [NL80211_ATTR_SAE_PWE] = 788 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK, 789 NL80211_SAE_PWE_BOTH), 790 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT }, 791 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy), 792 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG }, 793 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 }, 794 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 }, 795 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 }, 796 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy), 797 [NL80211_ATTR_MBSSID_CONFIG] = 798 NLA_POLICY_NESTED(nl80211_mbssid_config_policy), 799 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED }, 800 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG }, 801 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 }, 802 [NL80211_ATTR_EHT_CAPABILITY] = 803 NLA_POLICY_RANGE(NLA_BINARY, 804 NL80211_EHT_MIN_CAPABILITY_LEN, 805 NL80211_EHT_MAX_CAPABILITY_LEN), 806 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG }, 807 [NL80211_ATTR_MLO_LINKS] = 808 NLA_POLICY_NESTED_ARRAY(nl80211_policy), 809 [NL80211_ATTR_MLO_LINK_ID] = 810 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS), 811 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN), 812 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG }, 813 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT }, 814 [NL80211_ATTR_PUNCT_BITMAP] = 815 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range), 816 817 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 }, 818 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG }, 819 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED }, 820 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG }, 821 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG }, 822 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8), 823 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8), 824 }; 825 826 /* policy for the key attributes */ 827 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 828 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 829 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 830 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 831 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 832 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 833 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 834 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 835 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 836 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 837 }; 838 839 /* policy for the key default flags */ 840 static const struct nla_policy 841 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 842 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 843 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 844 }; 845 846 #ifdef CONFIG_PM 847 /* policy for WoWLAN attributes */ 848 static const struct nla_policy 849 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 850 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 851 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 852 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 853 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 854 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 855 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 856 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 857 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 858 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 859 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 860 }; 861 862 static const struct nla_policy 863 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 864 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 865 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 866 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 867 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 868 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 869 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 870 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 871 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 872 }, 873 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 874 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 875 }, 876 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 877 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 878 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 879 }; 880 #endif /* CONFIG_PM */ 881 882 /* policy for coalesce rule attributes */ 883 static const struct nla_policy 884 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 885 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 886 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 887 NLA_POLICY_RANGE(NLA_U32, 888 NL80211_COALESCE_CONDITION_MATCH, 889 NL80211_COALESCE_CONDITION_NO_MATCH), 890 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 891 }; 892 893 /* policy for GTK rekey offload attributes */ 894 static const struct nla_policy 895 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 896 [NL80211_REKEY_DATA_KEK] = { 897 .type = NLA_BINARY, 898 .len = NL80211_KEK_EXT_LEN 899 }, 900 [NL80211_REKEY_DATA_KCK] = { 901 .type = NLA_BINARY, 902 .len = NL80211_KCK_EXT_LEN_32 903 }, 904 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 905 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 906 }; 907 908 static const struct nla_policy 909 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 910 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 911 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 912 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 913 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 914 [NL80211_BAND_LC] = { .type = NLA_S32 }, 915 }; 916 917 static const struct nla_policy 918 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 919 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 920 .len = IEEE80211_MAX_SSID_LEN }, 921 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 922 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 923 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 924 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 925 }; 926 927 static const struct nla_policy 928 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 929 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 930 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 931 }; 932 933 static const struct nla_policy 934 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 935 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 936 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 937 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 938 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 939 }, 940 }; 941 942 /* policy for NAN function attributes */ 943 static const struct nla_policy 944 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 945 [NL80211_NAN_FUNC_TYPE] = 946 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 947 [NL80211_NAN_FUNC_SERVICE_ID] = { 948 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 949 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 950 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 951 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 952 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 953 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 954 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 955 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 956 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 957 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 958 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 959 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 960 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 961 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 962 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 963 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 964 }; 965 966 /* policy for Service Response Filter attributes */ 967 static const struct nla_policy 968 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 969 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 970 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 971 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 972 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 973 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 974 }; 975 976 /* policy for packet pattern attributes */ 977 static const struct nla_policy 978 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 979 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 980 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 981 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 982 }; 983 984 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 985 struct cfg80211_registered_device **rdev, 986 struct wireless_dev **wdev, 987 struct nlattr **attrbuf) 988 { 989 int err; 990 991 if (!cb->args[0]) { 992 struct nlattr **attrbuf_free = NULL; 993 994 if (!attrbuf) { 995 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 996 GFP_KERNEL); 997 if (!attrbuf) 998 return -ENOMEM; 999 attrbuf_free = attrbuf; 1000 } 1001 1002 err = nlmsg_parse_deprecated(cb->nlh, 1003 GENL_HDRLEN + nl80211_fam.hdrsize, 1004 attrbuf, nl80211_fam.maxattr, 1005 nl80211_policy, NULL); 1006 if (err) { 1007 kfree(attrbuf_free); 1008 return err; 1009 } 1010 1011 rtnl_lock(); 1012 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk), 1013 attrbuf); 1014 kfree(attrbuf_free); 1015 if (IS_ERR(*wdev)) { 1016 rtnl_unlock(); 1017 return PTR_ERR(*wdev); 1018 } 1019 *rdev = wiphy_to_rdev((*wdev)->wiphy); 1020 mutex_lock(&(*rdev)->wiphy.mtx); 1021 rtnl_unlock(); 1022 /* 0 is the first index - add 1 to parse only once */ 1023 cb->args[0] = (*rdev)->wiphy_idx + 1; 1024 cb->args[1] = (*wdev)->identifier; 1025 } else { 1026 /* subtract the 1 again here */ 1027 struct wiphy *wiphy; 1028 struct wireless_dev *tmp; 1029 1030 rtnl_lock(); 1031 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 1032 if (!wiphy) { 1033 rtnl_unlock(); 1034 return -ENODEV; 1035 } 1036 *rdev = wiphy_to_rdev(wiphy); 1037 *wdev = NULL; 1038 1039 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 1040 if (tmp->identifier == cb->args[1]) { 1041 *wdev = tmp; 1042 break; 1043 } 1044 } 1045 1046 if (!*wdev) { 1047 rtnl_unlock(); 1048 return -ENODEV; 1049 } 1050 mutex_lock(&(*rdev)->wiphy.mtx); 1051 rtnl_unlock(); 1052 } 1053 1054 return 0; 1055 } 1056 1057 /* message building helper */ 1058 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 1059 int flags, u8 cmd) 1060 { 1061 /* since there is no private header just add the generic one */ 1062 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 1063 } 1064 1065 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 1066 const struct ieee80211_reg_rule *rule) 1067 { 1068 int j; 1069 struct nlattr *nl_wmm_rules = 1070 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 1071 1072 if (!nl_wmm_rules) 1073 goto nla_put_failure; 1074 1075 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 1076 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 1077 1078 if (!nl_wmm_rule) 1079 goto nla_put_failure; 1080 1081 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 1082 rule->wmm_rule.client[j].cw_min) || 1083 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 1084 rule->wmm_rule.client[j].cw_max) || 1085 nla_put_u8(msg, NL80211_WMMR_AIFSN, 1086 rule->wmm_rule.client[j].aifsn) || 1087 nla_put_u16(msg, NL80211_WMMR_TXOP, 1088 rule->wmm_rule.client[j].cot)) 1089 goto nla_put_failure; 1090 1091 nla_nest_end(msg, nl_wmm_rule); 1092 } 1093 nla_nest_end(msg, nl_wmm_rules); 1094 1095 return 0; 1096 1097 nla_put_failure: 1098 return -ENOBUFS; 1099 } 1100 1101 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 1102 struct ieee80211_channel *chan, 1103 bool large) 1104 { 1105 /* Some channels must be completely excluded from the 1106 * list to protect old user-space tools from breaking 1107 */ 1108 if (!large && chan->flags & 1109 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 1110 return 0; 1111 if (!large && chan->freq_offset) 1112 return 0; 1113 1114 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 1115 chan->center_freq)) 1116 goto nla_put_failure; 1117 1118 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 1119 goto nla_put_failure; 1120 1121 if ((chan->flags & IEEE80211_CHAN_PSD) && 1122 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd)) 1123 goto nla_put_failure; 1124 1125 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1126 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1127 goto nla_put_failure; 1128 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1129 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1130 goto nla_put_failure; 1131 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1132 goto nla_put_failure; 1133 } 1134 if (chan->flags & IEEE80211_CHAN_RADAR) { 1135 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1136 goto nla_put_failure; 1137 if (large) { 1138 u32 time; 1139 1140 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1141 1142 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1143 chan->dfs_state)) 1144 goto nla_put_failure; 1145 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1146 time)) 1147 goto nla_put_failure; 1148 if (nla_put_u32(msg, 1149 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1150 chan->dfs_cac_ms)) 1151 goto nla_put_failure; 1152 } 1153 } 1154 1155 if (large) { 1156 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1157 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1158 goto nla_put_failure; 1159 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1160 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1161 goto nla_put_failure; 1162 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1163 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1164 goto nla_put_failure; 1165 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1166 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1167 goto nla_put_failure; 1168 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1169 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1170 goto nla_put_failure; 1171 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1172 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1173 goto nla_put_failure; 1174 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1175 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1176 goto nla_put_failure; 1177 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1178 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1179 goto nla_put_failure; 1180 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1181 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1182 goto nla_put_failure; 1183 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1184 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1185 goto nla_put_failure; 1186 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1187 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1188 goto nla_put_failure; 1189 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1190 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1191 goto nla_put_failure; 1192 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1193 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1194 goto nla_put_failure; 1195 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1196 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1197 goto nla_put_failure; 1198 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) && 1199 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ)) 1200 goto nla_put_failure; 1201 if ((chan->flags & IEEE80211_CHAN_NO_EHT) && 1202 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT)) 1203 goto nla_put_failure; 1204 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) && 1205 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT)) 1206 goto nla_put_failure; 1207 if ((chan->flags & IEEE80211_CHAN_NO_UHB_VLP_CLIENT) && 1208 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHB_VLP_CLIENT)) 1209 goto nla_put_failure; 1210 if ((chan->flags & IEEE80211_CHAN_NO_UHB_AFC_CLIENT) && 1211 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHB_AFC_CLIENT)) 1212 goto nla_put_failure; 1213 } 1214 1215 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1216 DBM_TO_MBM(chan->max_power))) 1217 goto nla_put_failure; 1218 1219 if (large) { 1220 const struct ieee80211_reg_rule *rule = 1221 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1222 1223 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1224 if (nl80211_msg_put_wmm_rules(msg, rule)) 1225 goto nla_put_failure; 1226 } 1227 } 1228 1229 return 0; 1230 1231 nla_put_failure: 1232 return -ENOBUFS; 1233 } 1234 1235 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1236 struct cfg80211_txq_stats *txqstats, 1237 int attrtype) 1238 { 1239 struct nlattr *txqattr; 1240 1241 #define PUT_TXQVAL_U32(attr, memb) do { \ 1242 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1243 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1244 return false; \ 1245 } while (0) 1246 1247 txqattr = nla_nest_start_noflag(msg, attrtype); 1248 if (!txqattr) 1249 return false; 1250 1251 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1252 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1253 PUT_TXQVAL_U32(FLOWS, flows); 1254 PUT_TXQVAL_U32(DROPS, drops); 1255 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1256 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1257 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1258 PUT_TXQVAL_U32(COLLISIONS, collisions); 1259 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1260 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1261 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1262 nla_nest_end(msg, txqattr); 1263 1264 #undef PUT_TXQVAL_U32 1265 return true; 1266 } 1267 1268 /* netlink command implementations */ 1269 1270 /** 1271 * nl80211_link_id - return link ID 1272 * @attrs: attributes to look at 1273 * 1274 * Returns: the link ID or 0 if not given 1275 * 1276 * Note this function doesn't do any validation of the link 1277 * ID validity wrt. links that were actually added, so it must 1278 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID 1279 * or if additional validation is done. 1280 */ 1281 static unsigned int nl80211_link_id(struct nlattr **attrs) 1282 { 1283 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1284 1285 if (!linkid) 1286 return 0; 1287 1288 return nla_get_u8(linkid); 1289 } 1290 1291 static int nl80211_link_id_or_invalid(struct nlattr **attrs) 1292 { 1293 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1294 1295 if (!linkid) 1296 return -1; 1297 1298 return nla_get_u8(linkid); 1299 } 1300 1301 struct key_parse { 1302 struct key_params p; 1303 int idx; 1304 int type; 1305 bool def, defmgmt, defbeacon; 1306 bool def_uni, def_multi; 1307 }; 1308 1309 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1310 struct key_parse *k) 1311 { 1312 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1313 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1314 nl80211_key_policy, 1315 info->extack); 1316 if (err) 1317 return err; 1318 1319 k->def = !!tb[NL80211_KEY_DEFAULT]; 1320 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1321 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1322 1323 if (k->def) { 1324 k->def_uni = true; 1325 k->def_multi = true; 1326 } 1327 if (k->defmgmt || k->defbeacon) 1328 k->def_multi = true; 1329 1330 if (tb[NL80211_KEY_IDX]) 1331 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1332 1333 if (tb[NL80211_KEY_DATA]) { 1334 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1335 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1336 } 1337 1338 if (tb[NL80211_KEY_SEQ]) { 1339 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1340 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1341 } 1342 1343 if (tb[NL80211_KEY_CIPHER]) 1344 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1345 1346 if (tb[NL80211_KEY_TYPE]) 1347 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1348 1349 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1350 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1351 1352 err = nla_parse_nested_deprecated(kdt, 1353 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1354 tb[NL80211_KEY_DEFAULT_TYPES], 1355 nl80211_key_default_policy, 1356 info->extack); 1357 if (err) 1358 return err; 1359 1360 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1361 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1362 } 1363 1364 if (tb[NL80211_KEY_MODE]) 1365 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1366 1367 return 0; 1368 } 1369 1370 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1371 { 1372 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1373 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1374 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1375 } 1376 1377 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1378 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1379 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1380 } 1381 1382 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1383 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1384 1385 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1386 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1387 1388 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1389 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1390 1391 if (k->def) { 1392 k->def_uni = true; 1393 k->def_multi = true; 1394 } 1395 if (k->defmgmt) 1396 k->def_multi = true; 1397 1398 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1399 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1400 1401 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1402 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1403 int err = nla_parse_nested_deprecated(kdt, 1404 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1405 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1406 nl80211_key_default_policy, 1407 info->extack); 1408 if (err) 1409 return err; 1410 1411 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1412 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1413 } 1414 1415 return 0; 1416 } 1417 1418 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1419 { 1420 int err; 1421 1422 memset(k, 0, sizeof(*k)); 1423 k->idx = -1; 1424 k->type = -1; 1425 1426 if (info->attrs[NL80211_ATTR_KEY]) 1427 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1428 else 1429 err = nl80211_parse_key_old(info, k); 1430 1431 if (err) 1432 return err; 1433 1434 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1435 (k->defbeacon ? 1 : 0) > 1) { 1436 GENL_SET_ERR_MSG(info, 1437 "key with multiple default flags is invalid"); 1438 return -EINVAL; 1439 } 1440 1441 if (k->defmgmt || k->defbeacon) { 1442 if (k->def_uni || !k->def_multi) { 1443 GENL_SET_ERR_MSG(info, 1444 "defmgmt/defbeacon key must be mcast"); 1445 return -EINVAL; 1446 } 1447 } 1448 1449 if (k->idx != -1) { 1450 if (k->defmgmt) { 1451 if (k->idx < 4 || k->idx > 5) { 1452 GENL_SET_ERR_MSG(info, 1453 "defmgmt key idx not 4 or 5"); 1454 return -EINVAL; 1455 } 1456 } else if (k->defbeacon) { 1457 if (k->idx < 6 || k->idx > 7) { 1458 GENL_SET_ERR_MSG(info, 1459 "defbeacon key idx not 6 or 7"); 1460 return -EINVAL; 1461 } 1462 } else if (k->def) { 1463 if (k->idx < 0 || k->idx > 3) { 1464 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1465 return -EINVAL; 1466 } 1467 } else { 1468 if (k->idx < 0 || k->idx > 7) { 1469 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1470 return -EINVAL; 1471 } 1472 } 1473 } 1474 1475 return 0; 1476 } 1477 1478 static struct cfg80211_cached_keys * 1479 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1480 struct genl_info *info, bool *no_ht) 1481 { 1482 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1483 struct key_parse parse; 1484 struct nlattr *key; 1485 struct cfg80211_cached_keys *result; 1486 int rem, err, def = 0; 1487 bool have_key = false; 1488 1489 nla_for_each_nested(key, keys, rem) { 1490 have_key = true; 1491 break; 1492 } 1493 1494 if (!have_key) 1495 return NULL; 1496 1497 result = kzalloc(sizeof(*result), GFP_KERNEL); 1498 if (!result) 1499 return ERR_PTR(-ENOMEM); 1500 1501 result->def = -1; 1502 1503 nla_for_each_nested(key, keys, rem) { 1504 memset(&parse, 0, sizeof(parse)); 1505 parse.idx = -1; 1506 1507 err = nl80211_parse_key_new(info, key, &parse); 1508 if (err) 1509 goto error; 1510 err = -EINVAL; 1511 if (!parse.p.key) 1512 goto error; 1513 if (parse.idx < 0 || parse.idx > 3) { 1514 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1515 goto error; 1516 } 1517 if (parse.def) { 1518 if (def) { 1519 GENL_SET_ERR_MSG(info, 1520 "only one key can be default"); 1521 goto error; 1522 } 1523 def = 1; 1524 result->def = parse.idx; 1525 if (!parse.def_uni || !parse.def_multi) 1526 goto error; 1527 } else if (parse.defmgmt) 1528 goto error; 1529 err = cfg80211_validate_key_settings(rdev, &parse.p, 1530 parse.idx, false, NULL); 1531 if (err) 1532 goto error; 1533 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1534 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1535 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1536 err = -EINVAL; 1537 goto error; 1538 } 1539 result->params[parse.idx].cipher = parse.p.cipher; 1540 result->params[parse.idx].key_len = parse.p.key_len; 1541 result->params[parse.idx].key = result->data[parse.idx]; 1542 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1543 1544 /* must be WEP key if we got here */ 1545 if (no_ht) 1546 *no_ht = true; 1547 } 1548 1549 if (result->def < 0) { 1550 err = -EINVAL; 1551 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1552 goto error; 1553 } 1554 1555 return result; 1556 error: 1557 kfree(result); 1558 return ERR_PTR(err); 1559 } 1560 1561 static int nl80211_key_allowed(struct wireless_dev *wdev) 1562 { 1563 lockdep_assert_wiphy(wdev->wiphy); 1564 1565 switch (wdev->iftype) { 1566 case NL80211_IFTYPE_AP: 1567 case NL80211_IFTYPE_AP_VLAN: 1568 case NL80211_IFTYPE_P2P_GO: 1569 case NL80211_IFTYPE_MESH_POINT: 1570 break; 1571 case NL80211_IFTYPE_ADHOC: 1572 if (wdev->u.ibss.current_bss) 1573 return 0; 1574 return -ENOLINK; 1575 case NL80211_IFTYPE_STATION: 1576 case NL80211_IFTYPE_P2P_CLIENT: 1577 if (wdev->connected) 1578 return 0; 1579 return -ENOLINK; 1580 case NL80211_IFTYPE_NAN: 1581 if (wiphy_ext_feature_isset(wdev->wiphy, 1582 NL80211_EXT_FEATURE_SECURE_NAN)) 1583 return 0; 1584 return -EINVAL; 1585 case NL80211_IFTYPE_UNSPECIFIED: 1586 case NL80211_IFTYPE_OCB: 1587 case NL80211_IFTYPE_MONITOR: 1588 case NL80211_IFTYPE_P2P_DEVICE: 1589 case NL80211_IFTYPE_WDS: 1590 case NUM_NL80211_IFTYPES: 1591 return -EINVAL; 1592 } 1593 1594 return 0; 1595 } 1596 1597 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1598 u32 freq) 1599 { 1600 struct ieee80211_channel *chan; 1601 1602 chan = ieee80211_get_channel_khz(wiphy, freq); 1603 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1604 return NULL; 1605 return chan; 1606 } 1607 1608 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1609 { 1610 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1611 int i; 1612 1613 if (!nl_modes) 1614 goto nla_put_failure; 1615 1616 i = 0; 1617 while (ifmodes) { 1618 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1619 goto nla_put_failure; 1620 ifmodes >>= 1; 1621 i++; 1622 } 1623 1624 nla_nest_end(msg, nl_modes); 1625 return 0; 1626 1627 nla_put_failure: 1628 return -ENOBUFS; 1629 } 1630 1631 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1632 struct sk_buff *msg, 1633 bool large) 1634 { 1635 struct nlattr *nl_combis; 1636 int i, j; 1637 1638 nl_combis = nla_nest_start_noflag(msg, 1639 NL80211_ATTR_INTERFACE_COMBINATIONS); 1640 if (!nl_combis) 1641 goto nla_put_failure; 1642 1643 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1644 const struct ieee80211_iface_combination *c; 1645 struct nlattr *nl_combi, *nl_limits; 1646 1647 c = &wiphy->iface_combinations[i]; 1648 1649 nl_combi = nla_nest_start_noflag(msg, i + 1); 1650 if (!nl_combi) 1651 goto nla_put_failure; 1652 1653 nl_limits = nla_nest_start_noflag(msg, 1654 NL80211_IFACE_COMB_LIMITS); 1655 if (!nl_limits) 1656 goto nla_put_failure; 1657 1658 for (j = 0; j < c->n_limits; j++) { 1659 struct nlattr *nl_limit; 1660 1661 nl_limit = nla_nest_start_noflag(msg, j + 1); 1662 if (!nl_limit) 1663 goto nla_put_failure; 1664 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1665 c->limits[j].max)) 1666 goto nla_put_failure; 1667 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1668 c->limits[j].types)) 1669 goto nla_put_failure; 1670 nla_nest_end(msg, nl_limit); 1671 } 1672 1673 nla_nest_end(msg, nl_limits); 1674 1675 if (c->beacon_int_infra_match && 1676 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1677 goto nla_put_failure; 1678 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1679 c->num_different_channels) || 1680 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1681 c->max_interfaces)) 1682 goto nla_put_failure; 1683 if (large && 1684 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1685 c->radar_detect_widths) || 1686 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1687 c->radar_detect_regions))) 1688 goto nla_put_failure; 1689 if (c->beacon_int_min_gcd && 1690 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1691 c->beacon_int_min_gcd)) 1692 goto nla_put_failure; 1693 1694 nla_nest_end(msg, nl_combi); 1695 } 1696 1697 nla_nest_end(msg, nl_combis); 1698 1699 return 0; 1700 nla_put_failure: 1701 return -ENOBUFS; 1702 } 1703 1704 #ifdef CONFIG_PM 1705 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1706 struct sk_buff *msg) 1707 { 1708 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1709 struct nlattr *nl_tcp; 1710 1711 if (!tcp) 1712 return 0; 1713 1714 nl_tcp = nla_nest_start_noflag(msg, 1715 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1716 if (!nl_tcp) 1717 return -ENOBUFS; 1718 1719 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1720 tcp->data_payload_max)) 1721 return -ENOBUFS; 1722 1723 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1724 tcp->data_payload_max)) 1725 return -ENOBUFS; 1726 1727 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1728 return -ENOBUFS; 1729 1730 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1731 sizeof(*tcp->tok), tcp->tok)) 1732 return -ENOBUFS; 1733 1734 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1735 tcp->data_interval_max)) 1736 return -ENOBUFS; 1737 1738 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1739 tcp->wake_payload_max)) 1740 return -ENOBUFS; 1741 1742 nla_nest_end(msg, nl_tcp); 1743 return 0; 1744 } 1745 1746 static int nl80211_send_wowlan(struct sk_buff *msg, 1747 struct cfg80211_registered_device *rdev, 1748 bool large) 1749 { 1750 struct nlattr *nl_wowlan; 1751 1752 if (!rdev->wiphy.wowlan) 1753 return 0; 1754 1755 nl_wowlan = nla_nest_start_noflag(msg, 1756 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1757 if (!nl_wowlan) 1758 return -ENOBUFS; 1759 1760 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1761 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1762 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1763 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1764 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1765 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1766 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1767 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1768 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1769 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1770 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1771 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1772 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1773 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1774 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1775 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1776 return -ENOBUFS; 1777 1778 if (rdev->wiphy.wowlan->n_patterns) { 1779 struct nl80211_pattern_support pat = { 1780 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1781 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1782 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1783 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1784 }; 1785 1786 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1787 sizeof(pat), &pat)) 1788 return -ENOBUFS; 1789 } 1790 1791 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1792 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1793 rdev->wiphy.wowlan->max_nd_match_sets)) 1794 return -ENOBUFS; 1795 1796 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1797 return -ENOBUFS; 1798 1799 nla_nest_end(msg, nl_wowlan); 1800 1801 return 0; 1802 } 1803 #endif 1804 1805 static int nl80211_send_coalesce(struct sk_buff *msg, 1806 struct cfg80211_registered_device *rdev) 1807 { 1808 struct nl80211_coalesce_rule_support rule; 1809 1810 if (!rdev->wiphy.coalesce) 1811 return 0; 1812 1813 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1814 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1815 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1816 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1817 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1818 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1819 1820 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1821 return -ENOBUFS; 1822 1823 return 0; 1824 } 1825 1826 static int 1827 nl80211_send_iftype_data(struct sk_buff *msg, 1828 const struct ieee80211_supported_band *sband, 1829 const struct ieee80211_sband_iftype_data *iftdata) 1830 { 1831 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1832 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap; 1833 1834 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1835 iftdata->types_mask)) 1836 return -ENOBUFS; 1837 1838 if (he_cap->has_he) { 1839 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1840 sizeof(he_cap->he_cap_elem.mac_cap_info), 1841 he_cap->he_cap_elem.mac_cap_info) || 1842 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1843 sizeof(he_cap->he_cap_elem.phy_cap_info), 1844 he_cap->he_cap_elem.phy_cap_info) || 1845 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1846 sizeof(he_cap->he_mcs_nss_supp), 1847 &he_cap->he_mcs_nss_supp) || 1848 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1849 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1850 return -ENOBUFS; 1851 } 1852 1853 if (eht_cap->has_eht && he_cap->has_he) { 1854 u8 mcs_nss_size, ppe_thresh_size; 1855 u16 ppe_thres_hdr; 1856 bool is_ap; 1857 1858 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) || 1859 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO); 1860 1861 mcs_nss_size = 1862 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem, 1863 &eht_cap->eht_cap_elem, 1864 is_ap); 1865 1866 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]); 1867 ppe_thresh_size = 1868 ieee80211_eht_ppe_size(ppe_thres_hdr, 1869 eht_cap->eht_cap_elem.phy_cap_info); 1870 1871 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC, 1872 sizeof(eht_cap->eht_cap_elem.mac_cap_info), 1873 eht_cap->eht_cap_elem.mac_cap_info) || 1874 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY, 1875 sizeof(eht_cap->eht_cap_elem.phy_cap_info), 1876 eht_cap->eht_cap_elem.phy_cap_info) || 1877 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET, 1878 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) || 1879 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE, 1880 ppe_thresh_size, eht_cap->eht_ppe_thres)) 1881 return -ENOBUFS; 1882 } 1883 1884 if (sband->band == NL80211_BAND_6GHZ && 1885 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1886 sizeof(iftdata->he_6ghz_capa), 1887 &iftdata->he_6ghz_capa)) 1888 return -ENOBUFS; 1889 1890 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len && 1891 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS, 1892 iftdata->vendor_elems.len, iftdata->vendor_elems.data)) 1893 return -ENOBUFS; 1894 1895 return 0; 1896 } 1897 1898 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1899 struct ieee80211_supported_band *sband, 1900 bool large) 1901 { 1902 struct nlattr *nl_rates, *nl_rate; 1903 struct ieee80211_rate *rate; 1904 int i; 1905 1906 /* add HT info */ 1907 if (sband->ht_cap.ht_supported && 1908 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1909 sizeof(sband->ht_cap.mcs), 1910 &sband->ht_cap.mcs) || 1911 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1912 sband->ht_cap.cap) || 1913 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1914 sband->ht_cap.ampdu_factor) || 1915 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1916 sband->ht_cap.ampdu_density))) 1917 return -ENOBUFS; 1918 1919 /* add VHT info */ 1920 if (sband->vht_cap.vht_supported && 1921 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1922 sizeof(sband->vht_cap.vht_mcs), 1923 &sband->vht_cap.vht_mcs) || 1924 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1925 sband->vht_cap.cap))) 1926 return -ENOBUFS; 1927 1928 if (large && sband->n_iftype_data) { 1929 struct nlattr *nl_iftype_data = 1930 nla_nest_start_noflag(msg, 1931 NL80211_BAND_ATTR_IFTYPE_DATA); 1932 const struct ieee80211_sband_iftype_data *iftd; 1933 int err; 1934 1935 if (!nl_iftype_data) 1936 return -ENOBUFS; 1937 1938 for_each_sband_iftype_data(sband, i, iftd) { 1939 struct nlattr *iftdata; 1940 1941 iftdata = nla_nest_start_noflag(msg, i + 1); 1942 if (!iftdata) 1943 return -ENOBUFS; 1944 1945 err = nl80211_send_iftype_data(msg, sband, iftd); 1946 if (err) 1947 return err; 1948 1949 nla_nest_end(msg, iftdata); 1950 } 1951 1952 nla_nest_end(msg, nl_iftype_data); 1953 } 1954 1955 /* add EDMG info */ 1956 if (large && sband->edmg_cap.channels && 1957 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1958 sband->edmg_cap.channels) || 1959 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1960 sband->edmg_cap.bw_config))) 1961 1962 return -ENOBUFS; 1963 1964 /* add bitrates */ 1965 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1966 if (!nl_rates) 1967 return -ENOBUFS; 1968 1969 for (i = 0; i < sband->n_bitrates; i++) { 1970 nl_rate = nla_nest_start_noflag(msg, i); 1971 if (!nl_rate) 1972 return -ENOBUFS; 1973 1974 rate = &sband->bitrates[i]; 1975 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1976 rate->bitrate)) 1977 return -ENOBUFS; 1978 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1979 nla_put_flag(msg, 1980 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1981 return -ENOBUFS; 1982 1983 nla_nest_end(msg, nl_rate); 1984 } 1985 1986 nla_nest_end(msg, nl_rates); 1987 1988 /* S1G capabilities */ 1989 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g && 1990 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA, 1991 sizeof(sband->s1g_cap.cap), 1992 sband->s1g_cap.cap) || 1993 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET, 1994 sizeof(sband->s1g_cap.nss_mcs), 1995 sband->s1g_cap.nss_mcs))) 1996 return -ENOBUFS; 1997 1998 return 0; 1999 } 2000 2001 static int 2002 nl80211_send_mgmt_stypes(struct sk_buff *msg, 2003 const struct ieee80211_txrx_stypes *mgmt_stypes) 2004 { 2005 u16 stypes; 2006 struct nlattr *nl_ftypes, *nl_ifs; 2007 enum nl80211_iftype ift; 2008 int i; 2009 2010 if (!mgmt_stypes) 2011 return 0; 2012 2013 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 2014 if (!nl_ifs) 2015 return -ENOBUFS; 2016 2017 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 2018 nl_ftypes = nla_nest_start_noflag(msg, ift); 2019 if (!nl_ftypes) 2020 return -ENOBUFS; 2021 i = 0; 2022 stypes = mgmt_stypes[ift].tx; 2023 while (stypes) { 2024 if ((stypes & 1) && 2025 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 2026 (i << 4) | IEEE80211_FTYPE_MGMT)) 2027 return -ENOBUFS; 2028 stypes >>= 1; 2029 i++; 2030 } 2031 nla_nest_end(msg, nl_ftypes); 2032 } 2033 2034 nla_nest_end(msg, nl_ifs); 2035 2036 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 2037 if (!nl_ifs) 2038 return -ENOBUFS; 2039 2040 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 2041 nl_ftypes = nla_nest_start_noflag(msg, ift); 2042 if (!nl_ftypes) 2043 return -ENOBUFS; 2044 i = 0; 2045 stypes = mgmt_stypes[ift].rx; 2046 while (stypes) { 2047 if ((stypes & 1) && 2048 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 2049 (i << 4) | IEEE80211_FTYPE_MGMT)) 2050 return -ENOBUFS; 2051 stypes >>= 1; 2052 i++; 2053 } 2054 nla_nest_end(msg, nl_ftypes); 2055 } 2056 nla_nest_end(msg, nl_ifs); 2057 2058 return 0; 2059 } 2060 2061 #define CMD(op, n) \ 2062 do { \ 2063 if (rdev->ops->op) { \ 2064 i++; \ 2065 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 2066 goto nla_put_failure; \ 2067 } \ 2068 } while (0) 2069 2070 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 2071 struct sk_buff *msg) 2072 { 2073 int i = 0; 2074 2075 /* 2076 * do *NOT* add anything into this function, new things need to be 2077 * advertised only to new versions of userspace that can deal with 2078 * the split (and they can't possibly care about new features... 2079 */ 2080 CMD(add_virtual_intf, NEW_INTERFACE); 2081 CMD(change_virtual_intf, SET_INTERFACE); 2082 CMD(add_key, NEW_KEY); 2083 CMD(start_ap, START_AP); 2084 CMD(add_station, NEW_STATION); 2085 CMD(add_mpath, NEW_MPATH); 2086 CMD(update_mesh_config, SET_MESH_CONFIG); 2087 CMD(change_bss, SET_BSS); 2088 CMD(auth, AUTHENTICATE); 2089 CMD(assoc, ASSOCIATE); 2090 CMD(deauth, DEAUTHENTICATE); 2091 CMD(disassoc, DISASSOCIATE); 2092 CMD(join_ibss, JOIN_IBSS); 2093 CMD(join_mesh, JOIN_MESH); 2094 CMD(set_pmksa, SET_PMKSA); 2095 CMD(del_pmksa, DEL_PMKSA); 2096 CMD(flush_pmksa, FLUSH_PMKSA); 2097 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 2098 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 2099 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 2100 CMD(mgmt_tx, FRAME); 2101 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 2102 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 2103 i++; 2104 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 2105 goto nla_put_failure; 2106 } 2107 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 2108 rdev->ops->join_mesh) { 2109 i++; 2110 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 2111 goto nla_put_failure; 2112 } 2113 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 2114 CMD(tdls_mgmt, TDLS_MGMT); 2115 CMD(tdls_oper, TDLS_OPER); 2116 } 2117 if (rdev->wiphy.max_sched_scan_reqs) 2118 CMD(sched_scan_start, START_SCHED_SCAN); 2119 CMD(probe_client, PROBE_CLIENT); 2120 CMD(set_noack_map, SET_NOACK_MAP); 2121 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 2122 i++; 2123 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 2124 goto nla_put_failure; 2125 } 2126 CMD(start_p2p_device, START_P2P_DEVICE); 2127 CMD(set_mcast_rate, SET_MCAST_RATE); 2128 #ifdef CONFIG_NL80211_TESTMODE 2129 CMD(testmode_cmd, TESTMODE); 2130 #endif 2131 2132 if (rdev->ops->connect || rdev->ops->auth) { 2133 i++; 2134 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 2135 goto nla_put_failure; 2136 } 2137 2138 if (rdev->ops->disconnect || rdev->ops->deauth) { 2139 i++; 2140 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 2141 goto nla_put_failure; 2142 } 2143 2144 return i; 2145 nla_put_failure: 2146 return -ENOBUFS; 2147 } 2148 2149 static int 2150 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 2151 struct sk_buff *msg) 2152 { 2153 struct nlattr *ftm; 2154 2155 if (!cap->ftm.supported) 2156 return 0; 2157 2158 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 2159 if (!ftm) 2160 return -ENOBUFS; 2161 2162 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 2163 return -ENOBUFS; 2164 if (cap->ftm.non_asap && 2165 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 2166 return -ENOBUFS; 2167 if (cap->ftm.request_lci && 2168 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 2169 return -ENOBUFS; 2170 if (cap->ftm.request_civicloc && 2171 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 2172 return -ENOBUFS; 2173 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 2174 cap->ftm.preambles)) 2175 return -ENOBUFS; 2176 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 2177 cap->ftm.bandwidths)) 2178 return -ENOBUFS; 2179 if (cap->ftm.max_bursts_exponent >= 0 && 2180 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 2181 cap->ftm.max_bursts_exponent)) 2182 return -ENOBUFS; 2183 if (cap->ftm.max_ftms_per_burst && 2184 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 2185 cap->ftm.max_ftms_per_burst)) 2186 return -ENOBUFS; 2187 if (cap->ftm.trigger_based && 2188 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 2189 return -ENOBUFS; 2190 if (cap->ftm.non_trigger_based && 2191 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 2192 return -ENOBUFS; 2193 2194 nla_nest_end(msg, ftm); 2195 return 0; 2196 } 2197 2198 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 2199 struct sk_buff *msg) 2200 { 2201 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 2202 struct nlattr *pmsr, *caps; 2203 2204 if (!cap) 2205 return 0; 2206 2207 /* 2208 * we don't need to clean up anything here since the caller 2209 * will genlmsg_cancel() if we fail 2210 */ 2211 2212 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 2213 if (!pmsr) 2214 return -ENOBUFS; 2215 2216 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 2217 return -ENOBUFS; 2218 2219 if (cap->report_ap_tsf && 2220 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 2221 return -ENOBUFS; 2222 2223 if (cap->randomize_mac_addr && 2224 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2225 return -ENOBUFS; 2226 2227 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2228 if (!caps) 2229 return -ENOBUFS; 2230 2231 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2232 return -ENOBUFS; 2233 2234 nla_nest_end(msg, caps); 2235 nla_nest_end(msg, pmsr); 2236 2237 return 0; 2238 } 2239 2240 static int 2241 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2242 struct sk_buff *msg) 2243 { 2244 int i; 2245 struct nlattr *nested, *nested_akms; 2246 const struct wiphy_iftype_akm_suites *iftype_akms; 2247 2248 if (!rdev->wiphy.num_iftype_akm_suites || 2249 !rdev->wiphy.iftype_akm_suites) 2250 return 0; 2251 2252 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2253 if (!nested) 2254 return -ENOBUFS; 2255 2256 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2257 nested_akms = nla_nest_start(msg, i + 1); 2258 if (!nested_akms) 2259 return -ENOBUFS; 2260 2261 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2262 2263 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2264 iftype_akms->iftypes_mask)) 2265 return -ENOBUFS; 2266 2267 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2268 sizeof(u32) * iftype_akms->n_akm_suites, 2269 iftype_akms->akm_suites)) { 2270 return -ENOBUFS; 2271 } 2272 nla_nest_end(msg, nested_akms); 2273 } 2274 2275 nla_nest_end(msg, nested); 2276 2277 return 0; 2278 } 2279 2280 static int 2281 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2282 struct sk_buff *msg) 2283 { 2284 struct nlattr *supp; 2285 2286 if (!rdev->wiphy.tid_config_support.vif && 2287 !rdev->wiphy.tid_config_support.peer) 2288 return 0; 2289 2290 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2291 if (!supp) 2292 return -ENOSPC; 2293 2294 if (rdev->wiphy.tid_config_support.vif && 2295 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2296 rdev->wiphy.tid_config_support.vif, 2297 NL80211_TID_CONFIG_ATTR_PAD)) 2298 goto fail; 2299 2300 if (rdev->wiphy.tid_config_support.peer && 2301 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2302 rdev->wiphy.tid_config_support.peer, 2303 NL80211_TID_CONFIG_ATTR_PAD)) 2304 goto fail; 2305 2306 /* for now we just use the same value ... makes more sense */ 2307 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2308 rdev->wiphy.tid_config_support.max_retry)) 2309 goto fail; 2310 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2311 rdev->wiphy.tid_config_support.max_retry)) 2312 goto fail; 2313 2314 nla_nest_end(msg, supp); 2315 2316 return 0; 2317 fail: 2318 nla_nest_cancel(msg, supp); 2319 return -ENOBUFS; 2320 } 2321 2322 static int 2323 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev, 2324 struct sk_buff *msg) 2325 { 2326 struct nlattr *sar_capa, *specs, *sub_freq_range; 2327 u8 num_freq_ranges; 2328 int i; 2329 2330 if (!rdev->wiphy.sar_capa) 2331 return 0; 2332 2333 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges; 2334 2335 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC); 2336 if (!sar_capa) 2337 return -ENOSPC; 2338 2339 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type)) 2340 goto fail; 2341 2342 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS); 2343 if (!specs) 2344 goto fail; 2345 2346 /* report supported freq_ranges */ 2347 for (i = 0; i < num_freq_ranges; i++) { 2348 sub_freq_range = nla_nest_start(msg, i + 1); 2349 if (!sub_freq_range) 2350 goto fail; 2351 2352 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ, 2353 rdev->wiphy.sar_capa->freq_ranges[i].start_freq)) 2354 goto fail; 2355 2356 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ, 2357 rdev->wiphy.sar_capa->freq_ranges[i].end_freq)) 2358 goto fail; 2359 2360 nla_nest_end(msg, sub_freq_range); 2361 } 2362 2363 nla_nest_end(msg, specs); 2364 nla_nest_end(msg, sar_capa); 2365 2366 return 0; 2367 fail: 2368 nla_nest_cancel(msg, sar_capa); 2369 return -ENOBUFS; 2370 } 2371 2372 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg) 2373 { 2374 struct nlattr *config; 2375 2376 if (!wiphy->mbssid_max_interfaces) 2377 return 0; 2378 2379 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG); 2380 if (!config) 2381 return -ENOBUFS; 2382 2383 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES, 2384 wiphy->mbssid_max_interfaces)) 2385 goto fail; 2386 2387 if (wiphy->ema_max_profile_periodicity && 2388 nla_put_u8(msg, 2389 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY, 2390 wiphy->ema_max_profile_periodicity)) 2391 goto fail; 2392 2393 nla_nest_end(msg, config); 2394 return 0; 2395 2396 fail: 2397 nla_nest_cancel(msg, config); 2398 return -ENOBUFS; 2399 } 2400 2401 struct nl80211_dump_wiphy_state { 2402 s64 filter_wiphy; 2403 long start; 2404 long split_start, band_start, chan_start, capa_start; 2405 bool split; 2406 }; 2407 2408 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2409 enum nl80211_commands cmd, 2410 struct sk_buff *msg, u32 portid, u32 seq, 2411 int flags, struct nl80211_dump_wiphy_state *state) 2412 { 2413 void *hdr; 2414 struct nlattr *nl_bands, *nl_band; 2415 struct nlattr *nl_freqs, *nl_freq; 2416 struct nlattr *nl_cmds; 2417 enum nl80211_band band; 2418 struct ieee80211_channel *chan; 2419 int i; 2420 const struct ieee80211_txrx_stypes *mgmt_stypes = 2421 rdev->wiphy.mgmt_stypes; 2422 u32 features; 2423 2424 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2425 if (!hdr) 2426 return -ENOBUFS; 2427 2428 if (WARN_ON(!state)) 2429 return -EINVAL; 2430 2431 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2432 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2433 wiphy_name(&rdev->wiphy)) || 2434 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2435 cfg80211_rdev_list_generation)) 2436 goto nla_put_failure; 2437 2438 if (cmd != NL80211_CMD_NEW_WIPHY) 2439 goto finish; 2440 2441 switch (state->split_start) { 2442 case 0: 2443 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2444 rdev->wiphy.retry_short) || 2445 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2446 rdev->wiphy.retry_long) || 2447 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2448 rdev->wiphy.frag_threshold) || 2449 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2450 rdev->wiphy.rts_threshold) || 2451 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2452 rdev->wiphy.coverage_class) || 2453 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2454 rdev->wiphy.max_scan_ssids) || 2455 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2456 rdev->wiphy.max_sched_scan_ssids) || 2457 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2458 rdev->wiphy.max_scan_ie_len) || 2459 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2460 rdev->wiphy.max_sched_scan_ie_len) || 2461 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2462 rdev->wiphy.max_match_sets)) 2463 goto nla_put_failure; 2464 2465 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2466 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2467 goto nla_put_failure; 2468 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2469 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2470 goto nla_put_failure; 2471 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2472 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2473 goto nla_put_failure; 2474 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2475 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2476 goto nla_put_failure; 2477 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2478 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2479 goto nla_put_failure; 2480 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2481 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2482 goto nla_put_failure; 2483 state->split_start++; 2484 if (state->split) 2485 break; 2486 fallthrough; 2487 case 1: 2488 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2489 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2490 rdev->wiphy.cipher_suites)) 2491 goto nla_put_failure; 2492 2493 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2494 rdev->wiphy.max_num_pmkids)) 2495 goto nla_put_failure; 2496 2497 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2498 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2499 goto nla_put_failure; 2500 2501 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2502 rdev->wiphy.available_antennas_tx) || 2503 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2504 rdev->wiphy.available_antennas_rx)) 2505 goto nla_put_failure; 2506 2507 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2508 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2509 rdev->wiphy.probe_resp_offload)) 2510 goto nla_put_failure; 2511 2512 if ((rdev->wiphy.available_antennas_tx || 2513 rdev->wiphy.available_antennas_rx) && 2514 rdev->ops->get_antenna) { 2515 u32 tx_ant = 0, rx_ant = 0; 2516 int res; 2517 2518 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2519 if (!res) { 2520 if (nla_put_u32(msg, 2521 NL80211_ATTR_WIPHY_ANTENNA_TX, 2522 tx_ant) || 2523 nla_put_u32(msg, 2524 NL80211_ATTR_WIPHY_ANTENNA_RX, 2525 rx_ant)) 2526 goto nla_put_failure; 2527 } 2528 } 2529 2530 state->split_start++; 2531 if (state->split) 2532 break; 2533 fallthrough; 2534 case 2: 2535 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2536 rdev->wiphy.interface_modes)) 2537 goto nla_put_failure; 2538 state->split_start++; 2539 if (state->split) 2540 break; 2541 fallthrough; 2542 case 3: 2543 nl_bands = nla_nest_start_noflag(msg, 2544 NL80211_ATTR_WIPHY_BANDS); 2545 if (!nl_bands) 2546 goto nla_put_failure; 2547 2548 for (band = state->band_start; 2549 band < (state->split ? 2550 NUM_NL80211_BANDS : 2551 NL80211_BAND_60GHZ + 1); 2552 band++) { 2553 struct ieee80211_supported_band *sband; 2554 2555 /* omit higher bands for ancient software */ 2556 if (band > NL80211_BAND_5GHZ && !state->split) 2557 break; 2558 2559 sband = rdev->wiphy.bands[band]; 2560 2561 if (!sband) 2562 continue; 2563 2564 nl_band = nla_nest_start_noflag(msg, band); 2565 if (!nl_band) 2566 goto nla_put_failure; 2567 2568 switch (state->chan_start) { 2569 case 0: 2570 if (nl80211_send_band_rateinfo(msg, sband, 2571 state->split)) 2572 goto nla_put_failure; 2573 state->chan_start++; 2574 if (state->split) 2575 break; 2576 fallthrough; 2577 default: 2578 /* add frequencies */ 2579 nl_freqs = nla_nest_start_noflag(msg, 2580 NL80211_BAND_ATTR_FREQS); 2581 if (!nl_freqs) 2582 goto nla_put_failure; 2583 2584 for (i = state->chan_start - 1; 2585 i < sband->n_channels; 2586 i++) { 2587 nl_freq = nla_nest_start_noflag(msg, 2588 i); 2589 if (!nl_freq) 2590 goto nla_put_failure; 2591 2592 chan = &sband->channels[i]; 2593 2594 if (nl80211_msg_put_channel( 2595 msg, &rdev->wiphy, chan, 2596 state->split)) 2597 goto nla_put_failure; 2598 2599 nla_nest_end(msg, nl_freq); 2600 if (state->split) 2601 break; 2602 } 2603 if (i < sband->n_channels) 2604 state->chan_start = i + 2; 2605 else 2606 state->chan_start = 0; 2607 nla_nest_end(msg, nl_freqs); 2608 } 2609 2610 nla_nest_end(msg, nl_band); 2611 2612 if (state->split) { 2613 /* start again here */ 2614 if (state->chan_start) 2615 band--; 2616 break; 2617 } 2618 } 2619 nla_nest_end(msg, nl_bands); 2620 2621 if (band < NUM_NL80211_BANDS) 2622 state->band_start = band + 1; 2623 else 2624 state->band_start = 0; 2625 2626 /* if bands & channels are done, continue outside */ 2627 if (state->band_start == 0 && state->chan_start == 0) 2628 state->split_start++; 2629 if (state->split) 2630 break; 2631 fallthrough; 2632 case 4: 2633 nl_cmds = nla_nest_start_noflag(msg, 2634 NL80211_ATTR_SUPPORTED_COMMANDS); 2635 if (!nl_cmds) 2636 goto nla_put_failure; 2637 2638 i = nl80211_add_commands_unsplit(rdev, msg); 2639 if (i < 0) 2640 goto nla_put_failure; 2641 if (state->split) { 2642 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2643 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2644 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2645 CMD(channel_switch, CHANNEL_SWITCH); 2646 CMD(set_qos_map, SET_QOS_MAP); 2647 if (rdev->wiphy.features & 2648 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2649 CMD(add_tx_ts, ADD_TX_TS); 2650 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2651 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2652 CMD(update_ft_ies, UPDATE_FT_IES); 2653 if (rdev->wiphy.sar_capa) 2654 CMD(set_sar_specs, SET_SAR_SPECS); 2655 } 2656 #undef CMD 2657 2658 nla_nest_end(msg, nl_cmds); 2659 state->split_start++; 2660 if (state->split) 2661 break; 2662 fallthrough; 2663 case 5: 2664 if (rdev->ops->remain_on_channel && 2665 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2666 nla_put_u32(msg, 2667 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2668 rdev->wiphy.max_remain_on_channel_duration)) 2669 goto nla_put_failure; 2670 2671 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2672 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2673 goto nla_put_failure; 2674 2675 state->split_start++; 2676 if (state->split) 2677 break; 2678 fallthrough; 2679 case 6: 2680 #ifdef CONFIG_PM 2681 if (nl80211_send_wowlan(msg, rdev, state->split)) 2682 goto nla_put_failure; 2683 state->split_start++; 2684 if (state->split) 2685 break; 2686 #else 2687 state->split_start++; 2688 #endif 2689 fallthrough; 2690 case 7: 2691 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2692 rdev->wiphy.software_iftypes)) 2693 goto nla_put_failure; 2694 2695 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2696 state->split)) 2697 goto nla_put_failure; 2698 2699 state->split_start++; 2700 if (state->split) 2701 break; 2702 fallthrough; 2703 case 8: 2704 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2705 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2706 rdev->wiphy.ap_sme_capa)) 2707 goto nla_put_failure; 2708 2709 features = rdev->wiphy.features; 2710 /* 2711 * We can only add the per-channel limit information if the 2712 * dump is split, otherwise it makes it too big. Therefore 2713 * only advertise it in that case. 2714 */ 2715 if (state->split) 2716 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2717 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2718 goto nla_put_failure; 2719 2720 if (rdev->wiphy.ht_capa_mod_mask && 2721 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2722 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2723 rdev->wiphy.ht_capa_mod_mask)) 2724 goto nla_put_failure; 2725 2726 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2727 rdev->wiphy.max_acl_mac_addrs && 2728 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2729 rdev->wiphy.max_acl_mac_addrs)) 2730 goto nla_put_failure; 2731 2732 /* 2733 * Any information below this point is only available to 2734 * applications that can deal with it being split. This 2735 * helps ensure that newly added capabilities don't break 2736 * older tools by overrunning their buffers. 2737 * 2738 * We still increment split_start so that in the split 2739 * case we'll continue with more data in the next round, 2740 * but break unconditionally so unsplit data stops here. 2741 */ 2742 if (state->split) 2743 state->split_start++; 2744 else 2745 state->split_start = 0; 2746 break; 2747 case 9: 2748 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2749 goto nla_put_failure; 2750 2751 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2752 rdev->wiphy.max_sched_scan_plans) || 2753 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2754 rdev->wiphy.max_sched_scan_plan_interval) || 2755 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2756 rdev->wiphy.max_sched_scan_plan_iterations)) 2757 goto nla_put_failure; 2758 2759 if (rdev->wiphy.extended_capabilities && 2760 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2761 rdev->wiphy.extended_capabilities_len, 2762 rdev->wiphy.extended_capabilities) || 2763 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2764 rdev->wiphy.extended_capabilities_len, 2765 rdev->wiphy.extended_capabilities_mask))) 2766 goto nla_put_failure; 2767 2768 if (rdev->wiphy.vht_capa_mod_mask && 2769 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2770 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2771 rdev->wiphy.vht_capa_mod_mask)) 2772 goto nla_put_failure; 2773 2774 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2775 rdev->wiphy.perm_addr)) 2776 goto nla_put_failure; 2777 2778 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2779 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2780 rdev->wiphy.addr_mask)) 2781 goto nla_put_failure; 2782 2783 if (rdev->wiphy.n_addresses > 1) { 2784 void *attr; 2785 2786 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2787 if (!attr) 2788 goto nla_put_failure; 2789 2790 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2791 if (nla_put(msg, i + 1, ETH_ALEN, 2792 rdev->wiphy.addresses[i].addr)) 2793 goto nla_put_failure; 2794 2795 nla_nest_end(msg, attr); 2796 } 2797 2798 state->split_start++; 2799 break; 2800 case 10: 2801 if (nl80211_send_coalesce(msg, rdev)) 2802 goto nla_put_failure; 2803 2804 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2805 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2806 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2807 goto nla_put_failure; 2808 2809 if (rdev->wiphy.max_ap_assoc_sta && 2810 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2811 rdev->wiphy.max_ap_assoc_sta)) 2812 goto nla_put_failure; 2813 2814 state->split_start++; 2815 break; 2816 case 11: 2817 if (rdev->wiphy.n_vendor_commands) { 2818 const struct nl80211_vendor_cmd_info *info; 2819 struct nlattr *nested; 2820 2821 nested = nla_nest_start_noflag(msg, 2822 NL80211_ATTR_VENDOR_DATA); 2823 if (!nested) 2824 goto nla_put_failure; 2825 2826 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2827 info = &rdev->wiphy.vendor_commands[i].info; 2828 if (nla_put(msg, i + 1, sizeof(*info), info)) 2829 goto nla_put_failure; 2830 } 2831 nla_nest_end(msg, nested); 2832 } 2833 2834 if (rdev->wiphy.n_vendor_events) { 2835 const struct nl80211_vendor_cmd_info *info; 2836 struct nlattr *nested; 2837 2838 nested = nla_nest_start_noflag(msg, 2839 NL80211_ATTR_VENDOR_EVENTS); 2840 if (!nested) 2841 goto nla_put_failure; 2842 2843 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2844 info = &rdev->wiphy.vendor_events[i]; 2845 if (nla_put(msg, i + 1, sizeof(*info), info)) 2846 goto nla_put_failure; 2847 } 2848 nla_nest_end(msg, nested); 2849 } 2850 state->split_start++; 2851 break; 2852 case 12: 2853 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2854 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2855 rdev->wiphy.max_num_csa_counters)) 2856 goto nla_put_failure; 2857 2858 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2859 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2860 goto nla_put_failure; 2861 2862 if (rdev->wiphy.max_sched_scan_reqs && 2863 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2864 rdev->wiphy.max_sched_scan_reqs)) 2865 goto nla_put_failure; 2866 2867 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2868 sizeof(rdev->wiphy.ext_features), 2869 rdev->wiphy.ext_features)) 2870 goto nla_put_failure; 2871 2872 if (rdev->wiphy.bss_select_support) { 2873 struct nlattr *nested; 2874 u32 bss_select_support = rdev->wiphy.bss_select_support; 2875 2876 nested = nla_nest_start_noflag(msg, 2877 NL80211_ATTR_BSS_SELECT); 2878 if (!nested) 2879 goto nla_put_failure; 2880 2881 i = 0; 2882 while (bss_select_support) { 2883 if ((bss_select_support & 1) && 2884 nla_put_flag(msg, i)) 2885 goto nla_put_failure; 2886 i++; 2887 bss_select_support >>= 1; 2888 } 2889 nla_nest_end(msg, nested); 2890 } 2891 2892 state->split_start++; 2893 break; 2894 case 13: 2895 if (rdev->wiphy.num_iftype_ext_capab && 2896 rdev->wiphy.iftype_ext_capab) { 2897 struct nlattr *nested_ext_capab, *nested; 2898 2899 nested = nla_nest_start_noflag(msg, 2900 NL80211_ATTR_IFTYPE_EXT_CAPA); 2901 if (!nested) 2902 goto nla_put_failure; 2903 2904 for (i = state->capa_start; 2905 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2906 const struct wiphy_iftype_ext_capab *capab; 2907 2908 capab = &rdev->wiphy.iftype_ext_capab[i]; 2909 2910 nested_ext_capab = nla_nest_start_noflag(msg, 2911 i); 2912 if (!nested_ext_capab || 2913 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2914 capab->iftype) || 2915 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2916 capab->extended_capabilities_len, 2917 capab->extended_capabilities) || 2918 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2919 capab->extended_capabilities_len, 2920 capab->extended_capabilities_mask)) 2921 goto nla_put_failure; 2922 2923 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO && 2924 (nla_put_u16(msg, 2925 NL80211_ATTR_EML_CAPABILITY, 2926 capab->eml_capabilities) || 2927 nla_put_u16(msg, 2928 NL80211_ATTR_MLD_CAPA_AND_OPS, 2929 capab->mld_capa_and_ops))) 2930 goto nla_put_failure; 2931 2932 nla_nest_end(msg, nested_ext_capab); 2933 if (state->split) 2934 break; 2935 } 2936 nla_nest_end(msg, nested); 2937 if (i < rdev->wiphy.num_iftype_ext_capab) { 2938 state->capa_start = i + 1; 2939 break; 2940 } 2941 } 2942 2943 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2944 rdev->wiphy.nan_supported_bands)) 2945 goto nla_put_failure; 2946 2947 if (wiphy_ext_feature_isset(&rdev->wiphy, 2948 NL80211_EXT_FEATURE_TXQS)) { 2949 struct cfg80211_txq_stats txqstats = {}; 2950 int res; 2951 2952 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2953 if (!res && 2954 !nl80211_put_txq_stats(msg, &txqstats, 2955 NL80211_ATTR_TXQ_STATS)) 2956 goto nla_put_failure; 2957 2958 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2959 rdev->wiphy.txq_limit)) 2960 goto nla_put_failure; 2961 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2962 rdev->wiphy.txq_memory_limit)) 2963 goto nla_put_failure; 2964 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2965 rdev->wiphy.txq_quantum)) 2966 goto nla_put_failure; 2967 } 2968 2969 state->split_start++; 2970 break; 2971 case 14: 2972 if (nl80211_send_pmsr_capa(rdev, msg)) 2973 goto nla_put_failure; 2974 2975 state->split_start++; 2976 break; 2977 case 15: 2978 if (rdev->wiphy.akm_suites && 2979 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2980 sizeof(u32) * rdev->wiphy.n_akm_suites, 2981 rdev->wiphy.akm_suites)) 2982 goto nla_put_failure; 2983 2984 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2985 goto nla_put_failure; 2986 2987 if (nl80211_put_tid_config_support(rdev, msg)) 2988 goto nla_put_failure; 2989 state->split_start++; 2990 break; 2991 case 16: 2992 if (nl80211_put_sar_specs(rdev, msg)) 2993 goto nla_put_failure; 2994 2995 if (nl80211_put_mbssid_support(&rdev->wiphy, msg)) 2996 goto nla_put_failure; 2997 2998 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES, 2999 rdev->wiphy.max_num_akm_suites)) 3000 goto nla_put_failure; 3001 3002 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO) 3003 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT); 3004 3005 if (rdev->wiphy.hw_timestamp_max_peers && 3006 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS, 3007 rdev->wiphy.hw_timestamp_max_peers)) 3008 goto nla_put_failure; 3009 3010 /* done */ 3011 state->split_start = 0; 3012 break; 3013 } 3014 finish: 3015 genlmsg_end(msg, hdr); 3016 return 0; 3017 3018 nla_put_failure: 3019 genlmsg_cancel(msg, hdr); 3020 return -EMSGSIZE; 3021 } 3022 3023 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 3024 struct netlink_callback *cb, 3025 struct nl80211_dump_wiphy_state *state) 3026 { 3027 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 3028 int ret; 3029 3030 if (!tb) 3031 return -ENOMEM; 3032 3033 ret = nlmsg_parse_deprecated(cb->nlh, 3034 GENL_HDRLEN + nl80211_fam.hdrsize, 3035 tb, nl80211_fam.maxattr, 3036 nl80211_policy, NULL); 3037 /* ignore parse errors for backward compatibility */ 3038 if (ret) { 3039 ret = 0; 3040 goto out; 3041 } 3042 3043 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 3044 if (tb[NL80211_ATTR_WIPHY]) 3045 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 3046 if (tb[NL80211_ATTR_WDEV]) 3047 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 3048 if (tb[NL80211_ATTR_IFINDEX]) { 3049 struct net_device *netdev; 3050 struct cfg80211_registered_device *rdev; 3051 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 3052 3053 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 3054 if (!netdev) { 3055 ret = -ENODEV; 3056 goto out; 3057 } 3058 if (netdev->ieee80211_ptr) { 3059 rdev = wiphy_to_rdev( 3060 netdev->ieee80211_ptr->wiphy); 3061 state->filter_wiphy = rdev->wiphy_idx; 3062 } 3063 } 3064 3065 ret = 0; 3066 out: 3067 kfree(tb); 3068 return ret; 3069 } 3070 3071 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 3072 { 3073 int idx = 0, ret; 3074 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 3075 struct cfg80211_registered_device *rdev; 3076 3077 rtnl_lock(); 3078 if (!state) { 3079 state = kzalloc(sizeof(*state), GFP_KERNEL); 3080 if (!state) { 3081 rtnl_unlock(); 3082 return -ENOMEM; 3083 } 3084 state->filter_wiphy = -1; 3085 ret = nl80211_dump_wiphy_parse(skb, cb, state); 3086 if (ret) { 3087 kfree(state); 3088 rtnl_unlock(); 3089 return ret; 3090 } 3091 cb->args[0] = (long)state; 3092 } 3093 3094 for_each_rdev(rdev) { 3095 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3096 continue; 3097 if (++idx <= state->start) 3098 continue; 3099 if (state->filter_wiphy != -1 && 3100 state->filter_wiphy != rdev->wiphy_idx) 3101 continue; 3102 wiphy_lock(&rdev->wiphy); 3103 /* attempt to fit multiple wiphy data chunks into the skb */ 3104 do { 3105 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 3106 skb, 3107 NETLINK_CB(cb->skb).portid, 3108 cb->nlh->nlmsg_seq, 3109 NLM_F_MULTI, state); 3110 if (ret < 0) { 3111 /* 3112 * If sending the wiphy data didn't fit (ENOBUFS 3113 * or EMSGSIZE returned), this SKB is still 3114 * empty (so it's not too big because another 3115 * wiphy dataset is already in the skb) and 3116 * we've not tried to adjust the dump allocation 3117 * yet ... then adjust the alloc size to be 3118 * bigger, and return 1 but with the empty skb. 3119 * This results in an empty message being RX'ed 3120 * in userspace, but that is ignored. 3121 * 3122 * We can then retry with the larger buffer. 3123 */ 3124 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 3125 !skb->len && !state->split && 3126 cb->min_dump_alloc < 4096) { 3127 cb->min_dump_alloc = 4096; 3128 state->split_start = 0; 3129 wiphy_unlock(&rdev->wiphy); 3130 rtnl_unlock(); 3131 return 1; 3132 } 3133 idx--; 3134 break; 3135 } 3136 } while (state->split_start > 0); 3137 wiphy_unlock(&rdev->wiphy); 3138 break; 3139 } 3140 rtnl_unlock(); 3141 3142 state->start = idx; 3143 3144 return skb->len; 3145 } 3146 3147 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 3148 { 3149 kfree((void *)cb->args[0]); 3150 return 0; 3151 } 3152 3153 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 3154 { 3155 struct sk_buff *msg; 3156 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3157 struct nl80211_dump_wiphy_state state = {}; 3158 3159 msg = nlmsg_new(4096, GFP_KERNEL); 3160 if (!msg) 3161 return -ENOMEM; 3162 3163 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 3164 info->snd_portid, info->snd_seq, 0, 3165 &state) < 0) { 3166 nlmsg_free(msg); 3167 return -ENOBUFS; 3168 } 3169 3170 return genlmsg_reply(msg, info); 3171 } 3172 3173 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 3174 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 3175 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 3176 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 3177 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 3178 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 3179 }; 3180 3181 static int parse_txq_params(struct nlattr *tb[], 3182 struct ieee80211_txq_params *txq_params) 3183 { 3184 u8 ac; 3185 3186 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 3187 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 3188 !tb[NL80211_TXQ_ATTR_AIFS]) 3189 return -EINVAL; 3190 3191 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 3192 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 3193 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 3194 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 3195 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 3196 3197 if (ac >= NL80211_NUM_ACS) 3198 return -EINVAL; 3199 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 3200 return 0; 3201 } 3202 3203 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 3204 { 3205 /* 3206 * You can only set the channel explicitly for some interfaces, 3207 * most have their channel managed via their respective 3208 * "establish a connection" command (connect, join, ...) 3209 * 3210 * For AP/GO and mesh mode, the channel can be set with the 3211 * channel userspace API, but is only stored and passed to the 3212 * low-level driver when the AP starts or the mesh is joined. 3213 * This is for backward compatibility, userspace can also give 3214 * the channel in the start-ap or join-mesh commands instead. 3215 * 3216 * Monitors are special as they are normally slaved to 3217 * whatever else is going on, so they have their own special 3218 * operation to set the monitor channel if possible. 3219 */ 3220 return !wdev || 3221 wdev->iftype == NL80211_IFTYPE_AP || 3222 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 3223 wdev->iftype == NL80211_IFTYPE_MONITOR || 3224 wdev->iftype == NL80211_IFTYPE_P2P_GO; 3225 } 3226 3227 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev, 3228 struct genl_info *info, 3229 const struct cfg80211_chan_def *chandef, 3230 u16 *punct_bitmap) 3231 { 3232 if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT)) 3233 return -EINVAL; 3234 3235 *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]); 3236 if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef)) 3237 return -EINVAL; 3238 3239 return 0; 3240 } 3241 3242 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 3243 struct genl_info *info, 3244 struct cfg80211_chan_def *chandef) 3245 { 3246 struct netlink_ext_ack *extack = info->extack; 3247 struct nlattr **attrs = info->attrs; 3248 u32 control_freq; 3249 3250 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) { 3251 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3252 "Frequency is missing"); 3253 return -EINVAL; 3254 } 3255 3256 control_freq = MHZ_TO_KHZ( 3257 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 3258 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 3259 control_freq += 3260 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 3261 3262 memset(chandef, 0, sizeof(*chandef)); 3263 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 3264 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 3265 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 3266 chandef->freq1_offset = control_freq % 1000; 3267 chandef->center_freq2 = 0; 3268 3269 /* Primary channel not allowed */ 3270 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 3271 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3272 "Channel is disabled"); 3273 return -EINVAL; 3274 } 3275 3276 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 3277 enum nl80211_channel_type chantype; 3278 3279 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 3280 3281 switch (chantype) { 3282 case NL80211_CHAN_NO_HT: 3283 case NL80211_CHAN_HT20: 3284 case NL80211_CHAN_HT40PLUS: 3285 case NL80211_CHAN_HT40MINUS: 3286 cfg80211_chandef_create(chandef, chandef->chan, 3287 chantype); 3288 /* user input for center_freq is incorrect */ 3289 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 3290 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 3291 NL_SET_ERR_MSG_ATTR(extack, 3292 attrs[NL80211_ATTR_CENTER_FREQ1], 3293 "bad center frequency 1"); 3294 return -EINVAL; 3295 } 3296 /* center_freq2 must be zero */ 3297 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 3298 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 3299 NL_SET_ERR_MSG_ATTR(extack, 3300 attrs[NL80211_ATTR_CENTER_FREQ2], 3301 "center frequency 2 can't be used"); 3302 return -EINVAL; 3303 } 3304 break; 3305 default: 3306 NL_SET_ERR_MSG_ATTR(extack, 3307 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 3308 "invalid channel type"); 3309 return -EINVAL; 3310 } 3311 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 3312 chandef->width = 3313 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 3314 if (chandef->chan->band == NL80211_BAND_S1GHZ) { 3315 /* User input error for channel width doesn't match channel */ 3316 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) { 3317 NL_SET_ERR_MSG_ATTR(extack, 3318 attrs[NL80211_ATTR_CHANNEL_WIDTH], 3319 "bad channel width"); 3320 return -EINVAL; 3321 } 3322 } 3323 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 3324 chandef->center_freq1 = 3325 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 3326 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 3327 chandef->freq1_offset = nla_get_u32( 3328 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 3329 else 3330 chandef->freq1_offset = 0; 3331 } 3332 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 3333 chandef->center_freq2 = 3334 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 3335 } 3336 3337 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 3338 chandef->edmg.channels = 3339 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 3340 3341 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 3342 chandef->edmg.bw_config = 3343 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 3344 } else { 3345 chandef->edmg.bw_config = 0; 3346 chandef->edmg.channels = 0; 3347 } 3348 3349 if (!cfg80211_chandef_valid(chandef)) { 3350 NL_SET_ERR_MSG(extack, "invalid channel definition"); 3351 return -EINVAL; 3352 } 3353 3354 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 3355 IEEE80211_CHAN_DISABLED)) { 3356 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 3357 return -EINVAL; 3358 } 3359 3360 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 3361 chandef->width == NL80211_CHAN_WIDTH_10) && 3362 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 3363 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 3364 return -EINVAL; 3365 } 3366 3367 return 0; 3368 } 3369 3370 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3371 struct net_device *dev, 3372 struct genl_info *info, 3373 int _link_id) 3374 { 3375 struct cfg80211_chan_def chandef; 3376 int result; 3377 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3378 struct wireless_dev *wdev = NULL; 3379 int link_id = _link_id; 3380 3381 if (dev) 3382 wdev = dev->ieee80211_ptr; 3383 if (!nl80211_can_set_dev_channel(wdev)) 3384 return -EOPNOTSUPP; 3385 if (wdev) 3386 iftype = wdev->iftype; 3387 3388 if (link_id < 0) { 3389 if (wdev && wdev->valid_links) 3390 return -EINVAL; 3391 link_id = 0; 3392 } 3393 3394 result = nl80211_parse_chandef(rdev, info, &chandef); 3395 if (result) 3396 return result; 3397 3398 switch (iftype) { 3399 case NL80211_IFTYPE_AP: 3400 case NL80211_IFTYPE_P2P_GO: 3401 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3402 iftype)) 3403 return -EINVAL; 3404 if (wdev->links[link_id].ap.beacon_interval) { 3405 struct ieee80211_channel *cur_chan; 3406 3407 if (!dev || !rdev->ops->set_ap_chanwidth || 3408 !(rdev->wiphy.features & 3409 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) 3410 return -EBUSY; 3411 3412 /* Only allow dynamic channel width changes */ 3413 cur_chan = wdev->links[link_id].ap.chandef.chan; 3414 if (chandef.chan != cur_chan) 3415 return -EBUSY; 3416 3417 result = rdev_set_ap_chanwidth(rdev, dev, link_id, 3418 &chandef); 3419 if (result) 3420 return result; 3421 wdev->links[link_id].ap.chandef = chandef; 3422 } else { 3423 wdev->u.ap.preset_chandef = chandef; 3424 } 3425 return 0; 3426 case NL80211_IFTYPE_MESH_POINT: 3427 return cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3428 case NL80211_IFTYPE_MONITOR: 3429 return cfg80211_set_monitor_channel(rdev, &chandef); 3430 default: 3431 break; 3432 } 3433 3434 return -EINVAL; 3435 } 3436 3437 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3438 { 3439 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3440 int link_id = nl80211_link_id_or_invalid(info->attrs); 3441 struct net_device *netdev = info->user_ptr[1]; 3442 3443 return __nl80211_set_channel(rdev, netdev, info, link_id); 3444 } 3445 3446 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3447 { 3448 struct cfg80211_registered_device *rdev = NULL; 3449 struct net_device *netdev = NULL; 3450 struct wireless_dev *wdev; 3451 int result = 0, rem_txq_params = 0; 3452 struct nlattr *nl_txq_params; 3453 u32 changed; 3454 u8 retry_short = 0, retry_long = 0; 3455 u32 frag_threshold = 0, rts_threshold = 0; 3456 u8 coverage_class = 0; 3457 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3458 3459 rtnl_lock(); 3460 /* 3461 * Try to find the wiphy and netdev. Normally this 3462 * function shouldn't need the netdev, but this is 3463 * done for backward compatibility -- previously 3464 * setting the channel was done per wiphy, but now 3465 * it is per netdev. Previous userland like hostapd 3466 * also passed a netdev to set_wiphy, so that it is 3467 * possible to let that go to the right netdev! 3468 */ 3469 3470 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3471 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3472 3473 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3474 if (netdev && netdev->ieee80211_ptr) 3475 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3476 else 3477 netdev = NULL; 3478 } 3479 3480 if (!netdev) { 3481 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3482 info->attrs); 3483 if (IS_ERR(rdev)) { 3484 rtnl_unlock(); 3485 return PTR_ERR(rdev); 3486 } 3487 wdev = NULL; 3488 netdev = NULL; 3489 result = 0; 3490 } else 3491 wdev = netdev->ieee80211_ptr; 3492 3493 wiphy_lock(&rdev->wiphy); 3494 3495 /* 3496 * end workaround code, by now the rdev is available 3497 * and locked, and wdev may or may not be NULL. 3498 */ 3499 3500 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3501 result = cfg80211_dev_rename( 3502 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3503 rtnl_unlock(); 3504 3505 if (result) 3506 goto out; 3507 3508 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3509 struct ieee80211_txq_params txq_params; 3510 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3511 3512 if (!rdev->ops->set_txq_params) { 3513 result = -EOPNOTSUPP; 3514 goto out; 3515 } 3516 3517 if (!netdev) { 3518 result = -EINVAL; 3519 goto out; 3520 } 3521 3522 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3523 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 3524 result = -EINVAL; 3525 goto out; 3526 } 3527 3528 if (!netif_running(netdev)) { 3529 result = -ENETDOWN; 3530 goto out; 3531 } 3532 3533 nla_for_each_nested(nl_txq_params, 3534 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3535 rem_txq_params) { 3536 result = nla_parse_nested_deprecated(tb, 3537 NL80211_TXQ_ATTR_MAX, 3538 nl_txq_params, 3539 txq_params_policy, 3540 info->extack); 3541 if (result) 3542 goto out; 3543 result = parse_txq_params(tb, &txq_params); 3544 if (result) 3545 goto out; 3546 3547 txq_params.link_id = 3548 nl80211_link_id_or_invalid(info->attrs); 3549 3550 if (txq_params.link_id >= 0 && 3551 !(netdev->ieee80211_ptr->valid_links & 3552 BIT(txq_params.link_id))) 3553 result = -ENOLINK; 3554 else if (txq_params.link_id >= 0 && 3555 !netdev->ieee80211_ptr->valid_links) 3556 result = -EINVAL; 3557 else 3558 result = rdev_set_txq_params(rdev, netdev, 3559 &txq_params); 3560 if (result) 3561 goto out; 3562 } 3563 } 3564 3565 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3566 int link_id = nl80211_link_id_or_invalid(info->attrs); 3567 3568 if (wdev) { 3569 result = __nl80211_set_channel( 3570 rdev, 3571 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3572 info, link_id); 3573 } else { 3574 result = __nl80211_set_channel(rdev, netdev, info, link_id); 3575 } 3576 3577 if (result) 3578 goto out; 3579 } 3580 3581 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3582 struct wireless_dev *txp_wdev = wdev; 3583 enum nl80211_tx_power_setting type; 3584 int idx, mbm = 0; 3585 3586 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3587 txp_wdev = NULL; 3588 3589 if (!rdev->ops->set_tx_power) { 3590 result = -EOPNOTSUPP; 3591 goto out; 3592 } 3593 3594 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3595 type = nla_get_u32(info->attrs[idx]); 3596 3597 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3598 (type != NL80211_TX_POWER_AUTOMATIC)) { 3599 result = -EINVAL; 3600 goto out; 3601 } 3602 3603 if (type != NL80211_TX_POWER_AUTOMATIC) { 3604 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3605 mbm = nla_get_u32(info->attrs[idx]); 3606 } 3607 3608 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3609 if (result) 3610 goto out; 3611 } 3612 3613 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3614 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3615 u32 tx_ant, rx_ant; 3616 3617 if ((!rdev->wiphy.available_antennas_tx && 3618 !rdev->wiphy.available_antennas_rx) || 3619 !rdev->ops->set_antenna) { 3620 result = -EOPNOTSUPP; 3621 goto out; 3622 } 3623 3624 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3625 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3626 3627 /* reject antenna configurations which don't match the 3628 * available antenna masks, except for the "all" mask */ 3629 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3630 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) { 3631 result = -EINVAL; 3632 goto out; 3633 } 3634 3635 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3636 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3637 3638 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3639 if (result) 3640 goto out; 3641 } 3642 3643 changed = 0; 3644 3645 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3646 retry_short = nla_get_u8( 3647 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3648 3649 changed |= WIPHY_PARAM_RETRY_SHORT; 3650 } 3651 3652 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3653 retry_long = nla_get_u8( 3654 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3655 3656 changed |= WIPHY_PARAM_RETRY_LONG; 3657 } 3658 3659 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3660 frag_threshold = nla_get_u32( 3661 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3662 if (frag_threshold < 256) { 3663 result = -EINVAL; 3664 goto out; 3665 } 3666 3667 if (frag_threshold != (u32) -1) { 3668 /* 3669 * Fragments (apart from the last one) are required to 3670 * have even length. Make the fragmentation code 3671 * simpler by stripping LSB should someone try to use 3672 * odd threshold value. 3673 */ 3674 frag_threshold &= ~0x1; 3675 } 3676 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3677 } 3678 3679 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3680 rts_threshold = nla_get_u32( 3681 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3682 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3683 } 3684 3685 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3686 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3687 result = -EINVAL; 3688 goto out; 3689 } 3690 3691 coverage_class = nla_get_u8( 3692 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3693 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3694 } 3695 3696 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3697 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) { 3698 result = -EOPNOTSUPP; 3699 goto out; 3700 } 3701 3702 changed |= WIPHY_PARAM_DYN_ACK; 3703 } 3704 3705 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3706 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3707 NL80211_EXT_FEATURE_TXQS)) { 3708 result = -EOPNOTSUPP; 3709 goto out; 3710 } 3711 txq_limit = nla_get_u32( 3712 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3713 changed |= WIPHY_PARAM_TXQ_LIMIT; 3714 } 3715 3716 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3717 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3718 NL80211_EXT_FEATURE_TXQS)) { 3719 result = -EOPNOTSUPP; 3720 goto out; 3721 } 3722 txq_memory_limit = nla_get_u32( 3723 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3724 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3725 } 3726 3727 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3728 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3729 NL80211_EXT_FEATURE_TXQS)) { 3730 result = -EOPNOTSUPP; 3731 goto out; 3732 } 3733 txq_quantum = nla_get_u32( 3734 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3735 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3736 } 3737 3738 if (changed) { 3739 u8 old_retry_short, old_retry_long; 3740 u32 old_frag_threshold, old_rts_threshold; 3741 u8 old_coverage_class; 3742 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3743 3744 if (!rdev->ops->set_wiphy_params) { 3745 result = -EOPNOTSUPP; 3746 goto out; 3747 } 3748 3749 old_retry_short = rdev->wiphy.retry_short; 3750 old_retry_long = rdev->wiphy.retry_long; 3751 old_frag_threshold = rdev->wiphy.frag_threshold; 3752 old_rts_threshold = rdev->wiphy.rts_threshold; 3753 old_coverage_class = rdev->wiphy.coverage_class; 3754 old_txq_limit = rdev->wiphy.txq_limit; 3755 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3756 old_txq_quantum = rdev->wiphy.txq_quantum; 3757 3758 if (changed & WIPHY_PARAM_RETRY_SHORT) 3759 rdev->wiphy.retry_short = retry_short; 3760 if (changed & WIPHY_PARAM_RETRY_LONG) 3761 rdev->wiphy.retry_long = retry_long; 3762 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3763 rdev->wiphy.frag_threshold = frag_threshold; 3764 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3765 rdev->wiphy.rts_threshold = rts_threshold; 3766 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3767 rdev->wiphy.coverage_class = coverage_class; 3768 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3769 rdev->wiphy.txq_limit = txq_limit; 3770 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3771 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3772 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3773 rdev->wiphy.txq_quantum = txq_quantum; 3774 3775 result = rdev_set_wiphy_params(rdev, changed); 3776 if (result) { 3777 rdev->wiphy.retry_short = old_retry_short; 3778 rdev->wiphy.retry_long = old_retry_long; 3779 rdev->wiphy.frag_threshold = old_frag_threshold; 3780 rdev->wiphy.rts_threshold = old_rts_threshold; 3781 rdev->wiphy.coverage_class = old_coverage_class; 3782 rdev->wiphy.txq_limit = old_txq_limit; 3783 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3784 rdev->wiphy.txq_quantum = old_txq_quantum; 3785 goto out; 3786 } 3787 } 3788 3789 result = 0; 3790 3791 out: 3792 wiphy_unlock(&rdev->wiphy); 3793 return result; 3794 } 3795 3796 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef) 3797 { 3798 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3799 return -EINVAL; 3800 3801 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3802 chandef->chan->center_freq)) 3803 return -ENOBUFS; 3804 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3805 chandef->chan->freq_offset)) 3806 return -ENOBUFS; 3807 switch (chandef->width) { 3808 case NL80211_CHAN_WIDTH_20_NOHT: 3809 case NL80211_CHAN_WIDTH_20: 3810 case NL80211_CHAN_WIDTH_40: 3811 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3812 cfg80211_get_chandef_type(chandef))) 3813 return -ENOBUFS; 3814 break; 3815 default: 3816 break; 3817 } 3818 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3819 return -ENOBUFS; 3820 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3821 return -ENOBUFS; 3822 if (chandef->center_freq2 && 3823 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3824 return -ENOBUFS; 3825 return 0; 3826 } 3827 EXPORT_SYMBOL(nl80211_send_chandef); 3828 3829 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3830 struct cfg80211_registered_device *rdev, 3831 struct wireless_dev *wdev, 3832 enum nl80211_commands cmd) 3833 { 3834 struct net_device *dev = wdev->netdev; 3835 void *hdr; 3836 3837 lockdep_assert_wiphy(&rdev->wiphy); 3838 3839 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3840 cmd != NL80211_CMD_DEL_INTERFACE && 3841 cmd != NL80211_CMD_SET_INTERFACE); 3842 3843 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3844 if (!hdr) 3845 return -1; 3846 3847 if (dev && 3848 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3849 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3850 goto nla_put_failure; 3851 3852 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3853 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3854 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3855 NL80211_ATTR_PAD) || 3856 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3857 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3858 rdev->devlist_generation ^ 3859 (cfg80211_rdev_list_generation << 2)) || 3860 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3861 goto nla_put_failure; 3862 3863 if (rdev->ops->get_channel && !wdev->valid_links) { 3864 struct cfg80211_chan_def chandef = {}; 3865 int ret; 3866 3867 ret = rdev_get_channel(rdev, wdev, 0, &chandef); 3868 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3869 goto nla_put_failure; 3870 } 3871 3872 if (rdev->ops->get_tx_power) { 3873 int dbm, ret; 3874 3875 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3876 if (ret == 0 && 3877 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3878 DBM_TO_MBM(dbm))) 3879 goto nla_put_failure; 3880 } 3881 3882 switch (wdev->iftype) { 3883 case NL80211_IFTYPE_AP: 3884 case NL80211_IFTYPE_P2P_GO: 3885 if (wdev->u.ap.ssid_len && 3886 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 3887 wdev->u.ap.ssid)) 3888 goto nla_put_failure; 3889 break; 3890 case NL80211_IFTYPE_STATION: 3891 case NL80211_IFTYPE_P2P_CLIENT: 3892 if (wdev->u.client.ssid_len && 3893 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len, 3894 wdev->u.client.ssid)) 3895 goto nla_put_failure; 3896 break; 3897 case NL80211_IFTYPE_ADHOC: 3898 if (wdev->u.ibss.ssid_len && 3899 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len, 3900 wdev->u.ibss.ssid)) 3901 goto nla_put_failure; 3902 break; 3903 default: 3904 /* nothing */ 3905 break; 3906 } 3907 3908 if (rdev->ops->get_txq_stats) { 3909 struct cfg80211_txq_stats txqstats = {}; 3910 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3911 3912 if (ret == 0 && 3913 !nl80211_put_txq_stats(msg, &txqstats, 3914 NL80211_ATTR_TXQ_STATS)) 3915 goto nla_put_failure; 3916 } 3917 3918 if (wdev->valid_links) { 3919 unsigned int link_id; 3920 struct nlattr *links = nla_nest_start(msg, 3921 NL80211_ATTR_MLO_LINKS); 3922 3923 if (!links) 3924 goto nla_put_failure; 3925 3926 for_each_valid_link(wdev, link_id) { 3927 struct nlattr *link = nla_nest_start(msg, link_id + 1); 3928 struct cfg80211_chan_def chandef = {}; 3929 int ret; 3930 3931 if (!link) 3932 goto nla_put_failure; 3933 3934 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 3935 goto nla_put_failure; 3936 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 3937 wdev->links[link_id].addr)) 3938 goto nla_put_failure; 3939 3940 ret = rdev_get_channel(rdev, wdev, link_id, &chandef); 3941 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3942 goto nla_put_failure; 3943 3944 nla_nest_end(msg, link); 3945 } 3946 3947 nla_nest_end(msg, links); 3948 } 3949 3950 genlmsg_end(msg, hdr); 3951 return 0; 3952 3953 nla_put_failure: 3954 genlmsg_cancel(msg, hdr); 3955 return -EMSGSIZE; 3956 } 3957 3958 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3959 { 3960 int wp_idx = 0; 3961 int if_idx = 0; 3962 int wp_start = cb->args[0]; 3963 int if_start = cb->args[1]; 3964 int filter_wiphy = -1; 3965 struct cfg80211_registered_device *rdev; 3966 struct wireless_dev *wdev; 3967 int ret; 3968 3969 rtnl_lock(); 3970 if (!cb->args[2]) { 3971 struct nl80211_dump_wiphy_state state = { 3972 .filter_wiphy = -1, 3973 }; 3974 3975 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3976 if (ret) 3977 goto out_unlock; 3978 3979 filter_wiphy = state.filter_wiphy; 3980 3981 /* 3982 * if filtering, set cb->args[2] to +1 since 0 is the default 3983 * value needed to determine that parsing is necessary. 3984 */ 3985 if (filter_wiphy >= 0) 3986 cb->args[2] = filter_wiphy + 1; 3987 else 3988 cb->args[2] = -1; 3989 } else if (cb->args[2] > 0) { 3990 filter_wiphy = cb->args[2] - 1; 3991 } 3992 3993 for_each_rdev(rdev) { 3994 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3995 continue; 3996 if (wp_idx < wp_start) { 3997 wp_idx++; 3998 continue; 3999 } 4000 4001 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 4002 continue; 4003 4004 if_idx = 0; 4005 4006 wiphy_lock(&rdev->wiphy); 4007 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 4008 if (if_idx < if_start) { 4009 if_idx++; 4010 continue; 4011 } 4012 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 4013 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4014 rdev, wdev, 4015 NL80211_CMD_NEW_INTERFACE) < 0) { 4016 wiphy_unlock(&rdev->wiphy); 4017 goto out; 4018 } 4019 if_idx++; 4020 } 4021 wiphy_unlock(&rdev->wiphy); 4022 4023 wp_idx++; 4024 } 4025 out: 4026 cb->args[0] = wp_idx; 4027 cb->args[1] = if_idx; 4028 4029 ret = skb->len; 4030 out_unlock: 4031 rtnl_unlock(); 4032 4033 return ret; 4034 } 4035 4036 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 4037 { 4038 struct sk_buff *msg; 4039 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4040 struct wireless_dev *wdev = info->user_ptr[1]; 4041 4042 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4043 if (!msg) 4044 return -ENOMEM; 4045 4046 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4047 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4048 nlmsg_free(msg); 4049 return -ENOBUFS; 4050 } 4051 4052 return genlmsg_reply(msg, info); 4053 } 4054 4055 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 4056 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 4057 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 4058 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 4059 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 4060 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 4061 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 4062 }; 4063 4064 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 4065 { 4066 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 4067 int flag; 4068 4069 *mntrflags = 0; 4070 4071 if (!nla) 4072 return -EINVAL; 4073 4074 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 4075 return -EINVAL; 4076 4077 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 4078 if (flags[flag]) 4079 *mntrflags |= (1<<flag); 4080 4081 *mntrflags |= MONITOR_FLAG_CHANGED; 4082 4083 return 0; 4084 } 4085 4086 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 4087 enum nl80211_iftype type, 4088 struct genl_info *info, 4089 struct vif_params *params) 4090 { 4091 bool change = false; 4092 int err; 4093 4094 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 4095 if (type != NL80211_IFTYPE_MONITOR) 4096 return -EINVAL; 4097 4098 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 4099 ¶ms->flags); 4100 if (err) 4101 return err; 4102 4103 change = true; 4104 } 4105 4106 if (params->flags & MONITOR_FLAG_ACTIVE && 4107 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 4108 return -EOPNOTSUPP; 4109 4110 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 4111 const u8 *mumimo_groups; 4112 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4113 4114 if (type != NL80211_IFTYPE_MONITOR) 4115 return -EINVAL; 4116 4117 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4118 return -EOPNOTSUPP; 4119 4120 mumimo_groups = 4121 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 4122 4123 /* bits 0 and 63 are reserved and must be zero */ 4124 if ((mumimo_groups[0] & BIT(0)) || 4125 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 4126 return -EINVAL; 4127 4128 params->vht_mumimo_groups = mumimo_groups; 4129 change = true; 4130 } 4131 4132 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 4133 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4134 4135 if (type != NL80211_IFTYPE_MONITOR) 4136 return -EINVAL; 4137 4138 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4139 return -EOPNOTSUPP; 4140 4141 params->vht_mumimo_follow_addr = 4142 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 4143 change = true; 4144 } 4145 4146 return change ? 1 : 0; 4147 } 4148 4149 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 4150 struct net_device *netdev, u8 use_4addr, 4151 enum nl80211_iftype iftype) 4152 { 4153 if (!use_4addr) { 4154 if (netdev && netif_is_bridge_port(netdev)) 4155 return -EBUSY; 4156 return 0; 4157 } 4158 4159 switch (iftype) { 4160 case NL80211_IFTYPE_AP_VLAN: 4161 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 4162 return 0; 4163 break; 4164 case NL80211_IFTYPE_STATION: 4165 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 4166 return 0; 4167 break; 4168 default: 4169 break; 4170 } 4171 4172 return -EOPNOTSUPP; 4173 } 4174 4175 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 4176 { 4177 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4178 struct vif_params params; 4179 int err; 4180 enum nl80211_iftype otype, ntype; 4181 struct net_device *dev = info->user_ptr[1]; 4182 bool change = false; 4183 4184 memset(¶ms, 0, sizeof(params)); 4185 4186 otype = ntype = dev->ieee80211_ptr->iftype; 4187 4188 if (info->attrs[NL80211_ATTR_IFTYPE]) { 4189 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4190 if (otype != ntype) 4191 change = true; 4192 } 4193 4194 if (info->attrs[NL80211_ATTR_MESH_ID]) { 4195 struct wireless_dev *wdev = dev->ieee80211_ptr; 4196 4197 if (ntype != NL80211_IFTYPE_MESH_POINT) 4198 return -EINVAL; 4199 if (netif_running(dev)) 4200 return -EBUSY; 4201 4202 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4203 IEEE80211_MAX_MESH_ID_LEN); 4204 wdev->u.mesh.id_up_len = 4205 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4206 memcpy(wdev->u.mesh.id, 4207 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4208 wdev->u.mesh.id_up_len); 4209 } 4210 4211 if (info->attrs[NL80211_ATTR_4ADDR]) { 4212 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4213 change = true; 4214 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 4215 if (err) 4216 return err; 4217 } else { 4218 params.use_4addr = -1; 4219 } 4220 4221 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 4222 if (err < 0) 4223 return err; 4224 if (err > 0) 4225 change = true; 4226 4227 if (change) 4228 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 4229 else 4230 err = 0; 4231 4232 if (!err && params.use_4addr != -1) 4233 dev->ieee80211_ptr->use_4addr = params.use_4addr; 4234 4235 if (change && !err) { 4236 struct wireless_dev *wdev = dev->ieee80211_ptr; 4237 4238 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 4239 } 4240 4241 return err; 4242 } 4243 4244 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4245 { 4246 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4247 struct vif_params params; 4248 struct wireless_dev *wdev; 4249 struct sk_buff *msg; 4250 int err; 4251 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 4252 4253 memset(¶ms, 0, sizeof(params)); 4254 4255 if (!info->attrs[NL80211_ATTR_IFNAME]) 4256 return -EINVAL; 4257 4258 if (info->attrs[NL80211_ATTR_IFTYPE]) 4259 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4260 4261 if (!rdev->ops->add_virtual_intf) 4262 return -EOPNOTSUPP; 4263 4264 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 4265 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 4266 info->attrs[NL80211_ATTR_MAC]) { 4267 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 4268 ETH_ALEN); 4269 if (!is_valid_ether_addr(params.macaddr)) 4270 return -EADDRNOTAVAIL; 4271 } 4272 4273 if (info->attrs[NL80211_ATTR_4ADDR]) { 4274 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4275 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 4276 if (err) 4277 return err; 4278 } 4279 4280 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 4281 return -EOPNOTSUPP; 4282 4283 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 4284 if (err < 0) 4285 return err; 4286 4287 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4288 if (!msg) 4289 return -ENOMEM; 4290 4291 wdev = rdev_add_virtual_intf(rdev, 4292 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 4293 NET_NAME_USER, type, ¶ms); 4294 if (WARN_ON(!wdev)) { 4295 nlmsg_free(msg); 4296 return -EPROTO; 4297 } else if (IS_ERR(wdev)) { 4298 nlmsg_free(msg); 4299 return PTR_ERR(wdev); 4300 } 4301 4302 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 4303 wdev->owner_nlportid = info->snd_portid; 4304 4305 switch (type) { 4306 case NL80211_IFTYPE_MESH_POINT: 4307 if (!info->attrs[NL80211_ATTR_MESH_ID]) 4308 break; 4309 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4310 IEEE80211_MAX_MESH_ID_LEN); 4311 wdev->u.mesh.id_up_len = 4312 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4313 memcpy(wdev->u.mesh.id, 4314 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4315 wdev->u.mesh.id_up_len); 4316 break; 4317 case NL80211_IFTYPE_NAN: 4318 case NL80211_IFTYPE_P2P_DEVICE: 4319 /* 4320 * P2P Device and NAN do not have a netdev, so don't go 4321 * through the netdev notifier and must be added here 4322 */ 4323 cfg80211_init_wdev(wdev); 4324 cfg80211_register_wdev(rdev, wdev); 4325 break; 4326 default: 4327 break; 4328 } 4329 4330 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4331 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4332 nlmsg_free(msg); 4333 return -ENOBUFS; 4334 } 4335 4336 return genlmsg_reply(msg, info); 4337 } 4338 4339 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4340 { 4341 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4342 int ret; 4343 4344 /* to avoid failing a new interface creation due to pending removal */ 4345 cfg80211_destroy_ifaces(rdev); 4346 4347 wiphy_lock(&rdev->wiphy); 4348 ret = _nl80211_new_interface(skb, info); 4349 wiphy_unlock(&rdev->wiphy); 4350 4351 return ret; 4352 } 4353 4354 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 4355 { 4356 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4357 struct wireless_dev *wdev = info->user_ptr[1]; 4358 4359 if (!rdev->ops->del_virtual_intf) 4360 return -EOPNOTSUPP; 4361 4362 /* 4363 * We hold RTNL, so this is safe, without RTNL opencount cannot 4364 * reach 0, and thus the rdev cannot be deleted. 4365 * 4366 * We need to do it for the dev_close(), since that will call 4367 * the netdev notifiers, and we need to acquire the mutex there 4368 * but don't know if we get there from here or from some other 4369 * place (e.g. "ip link set ... down"). 4370 */ 4371 mutex_unlock(&rdev->wiphy.mtx); 4372 4373 /* 4374 * If we remove a wireless device without a netdev then clear 4375 * user_ptr[1] so that nl80211_post_doit won't dereference it 4376 * to check if it needs to do dev_put(). Otherwise it crashes 4377 * since the wdev has been freed, unlike with a netdev where 4378 * we need the dev_put() for the netdev to really be freed. 4379 */ 4380 if (!wdev->netdev) 4381 info->user_ptr[1] = NULL; 4382 else 4383 dev_close(wdev->netdev); 4384 4385 mutex_lock(&rdev->wiphy.mtx); 4386 4387 return cfg80211_remove_virtual_intf(rdev, wdev); 4388 } 4389 4390 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 4391 { 4392 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4393 struct net_device *dev = info->user_ptr[1]; 4394 u16 noack_map; 4395 4396 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 4397 return -EINVAL; 4398 4399 if (!rdev->ops->set_noack_map) 4400 return -EOPNOTSUPP; 4401 4402 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 4403 4404 return rdev_set_noack_map(rdev, dev, noack_map); 4405 } 4406 4407 static int nl80211_validate_key_link_id(struct genl_info *info, 4408 struct wireless_dev *wdev, 4409 int link_id, bool pairwise) 4410 { 4411 if (pairwise) { 4412 if (link_id != -1) { 4413 GENL_SET_ERR_MSG(info, 4414 "link ID not allowed for pairwise key"); 4415 return -EINVAL; 4416 } 4417 4418 return 0; 4419 } 4420 4421 if (wdev->valid_links) { 4422 if (link_id == -1) { 4423 GENL_SET_ERR_MSG(info, 4424 "link ID must for MLO group key"); 4425 return -EINVAL; 4426 } 4427 if (!(wdev->valid_links & BIT(link_id))) { 4428 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key"); 4429 return -EINVAL; 4430 } 4431 } else if (link_id != -1) { 4432 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key"); 4433 return -EINVAL; 4434 } 4435 4436 return 0; 4437 } 4438 4439 struct get_key_cookie { 4440 struct sk_buff *msg; 4441 int error; 4442 int idx; 4443 }; 4444 4445 static void get_key_callback(void *c, struct key_params *params) 4446 { 4447 struct nlattr *key; 4448 struct get_key_cookie *cookie = c; 4449 4450 if ((params->key && 4451 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 4452 params->key_len, params->key)) || 4453 (params->seq && 4454 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 4455 params->seq_len, params->seq)) || 4456 (params->cipher && 4457 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 4458 params->cipher))) 4459 goto nla_put_failure; 4460 4461 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 4462 if (!key) 4463 goto nla_put_failure; 4464 4465 if ((params->key && 4466 nla_put(cookie->msg, NL80211_KEY_DATA, 4467 params->key_len, params->key)) || 4468 (params->seq && 4469 nla_put(cookie->msg, NL80211_KEY_SEQ, 4470 params->seq_len, params->seq)) || 4471 (params->cipher && 4472 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 4473 params->cipher))) 4474 goto nla_put_failure; 4475 4476 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 4477 goto nla_put_failure; 4478 4479 nla_nest_end(cookie->msg, key); 4480 4481 return; 4482 nla_put_failure: 4483 cookie->error = 1; 4484 } 4485 4486 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 4487 { 4488 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4489 int err; 4490 struct net_device *dev = info->user_ptr[1]; 4491 u8 key_idx = 0; 4492 const u8 *mac_addr = NULL; 4493 bool pairwise; 4494 struct get_key_cookie cookie = { 4495 .error = 0, 4496 }; 4497 void *hdr; 4498 struct sk_buff *msg; 4499 bool bigtk_support = false; 4500 int link_id = nl80211_link_id_or_invalid(info->attrs); 4501 struct wireless_dev *wdev = dev->ieee80211_ptr; 4502 4503 if (wiphy_ext_feature_isset(&rdev->wiphy, 4504 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 4505 bigtk_support = true; 4506 4507 if ((wdev->iftype == NL80211_IFTYPE_STATION || 4508 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && 4509 wiphy_ext_feature_isset(&rdev->wiphy, 4510 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 4511 bigtk_support = true; 4512 4513 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 4514 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 4515 4516 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 4517 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 4518 return -EINVAL; 4519 } 4520 } 4521 4522 if (info->attrs[NL80211_ATTR_MAC]) 4523 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4524 4525 pairwise = !!mac_addr; 4526 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4527 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4528 4529 if (kt != NL80211_KEYTYPE_GROUP && 4530 kt != NL80211_KEYTYPE_PAIRWISE) 4531 return -EINVAL; 4532 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4533 } 4534 4535 if (!rdev->ops->get_key) 4536 return -EOPNOTSUPP; 4537 4538 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4539 return -ENOENT; 4540 4541 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4542 if (!msg) 4543 return -ENOMEM; 4544 4545 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4546 NL80211_CMD_NEW_KEY); 4547 if (!hdr) 4548 goto nla_put_failure; 4549 4550 cookie.msg = msg; 4551 cookie.idx = key_idx; 4552 4553 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4554 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4555 goto nla_put_failure; 4556 if (mac_addr && 4557 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4558 goto nla_put_failure; 4559 4560 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise); 4561 if (err) 4562 goto free_msg; 4563 4564 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr, 4565 &cookie, get_key_callback); 4566 4567 if (err) 4568 goto free_msg; 4569 4570 if (cookie.error) 4571 goto nla_put_failure; 4572 4573 genlmsg_end(msg, hdr); 4574 return genlmsg_reply(msg, info); 4575 4576 nla_put_failure: 4577 err = -ENOBUFS; 4578 free_msg: 4579 nlmsg_free(msg); 4580 return err; 4581 } 4582 4583 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4584 { 4585 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4586 struct key_parse key; 4587 int err; 4588 struct net_device *dev = info->user_ptr[1]; 4589 int link_id = nl80211_link_id_or_invalid(info->attrs); 4590 struct wireless_dev *wdev = dev->ieee80211_ptr; 4591 4592 err = nl80211_parse_key(info, &key); 4593 if (err) 4594 return err; 4595 4596 if (key.idx < 0) 4597 return -EINVAL; 4598 4599 /* Only support setting default key and 4600 * Extended Key ID action NL80211_KEY_SET_TX. 4601 */ 4602 if (!key.def && !key.defmgmt && !key.defbeacon && 4603 !(key.p.mode == NL80211_KEY_SET_TX)) 4604 return -EINVAL; 4605 4606 if (key.def) { 4607 if (!rdev->ops->set_default_key) 4608 return -EOPNOTSUPP; 4609 4610 err = nl80211_key_allowed(wdev); 4611 if (err) 4612 return err; 4613 4614 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4615 if (err) 4616 return err; 4617 4618 err = rdev_set_default_key(rdev, dev, link_id, key.idx, 4619 key.def_uni, key.def_multi); 4620 4621 if (err) 4622 return err; 4623 4624 #ifdef CONFIG_CFG80211_WEXT 4625 wdev->wext.default_key = key.idx; 4626 #endif 4627 return 0; 4628 } else if (key.defmgmt) { 4629 if (key.def_uni || !key.def_multi) 4630 return -EINVAL; 4631 4632 if (!rdev->ops->set_default_mgmt_key) 4633 return -EOPNOTSUPP; 4634 4635 err = nl80211_key_allowed(wdev); 4636 if (err) 4637 return err; 4638 4639 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4640 if (err) 4641 return err; 4642 4643 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx); 4644 if (err) 4645 return err; 4646 4647 #ifdef CONFIG_CFG80211_WEXT 4648 wdev->wext.default_mgmt_key = key.idx; 4649 #endif 4650 return 0; 4651 } else if (key.defbeacon) { 4652 if (key.def_uni || !key.def_multi) 4653 return -EINVAL; 4654 4655 if (!rdev->ops->set_default_beacon_key) 4656 return -EOPNOTSUPP; 4657 4658 err = nl80211_key_allowed(wdev); 4659 if (err) 4660 return err; 4661 4662 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4663 if (err) 4664 return err; 4665 4666 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx); 4667 } else if (key.p.mode == NL80211_KEY_SET_TX && 4668 wiphy_ext_feature_isset(&rdev->wiphy, 4669 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4670 u8 *mac_addr = NULL; 4671 4672 if (info->attrs[NL80211_ATTR_MAC]) 4673 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4674 4675 if (!mac_addr || key.idx < 0 || key.idx > 1) 4676 return -EINVAL; 4677 4678 err = nl80211_validate_key_link_id(info, wdev, link_id, true); 4679 if (err) 4680 return err; 4681 4682 return rdev_add_key(rdev, dev, link_id, key.idx, 4683 NL80211_KEYTYPE_PAIRWISE, 4684 mac_addr, &key.p); 4685 } 4686 4687 return -EINVAL; 4688 } 4689 4690 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4691 { 4692 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4693 int err; 4694 struct net_device *dev = info->user_ptr[1]; 4695 struct key_parse key; 4696 const u8 *mac_addr = NULL; 4697 int link_id = nl80211_link_id_or_invalid(info->attrs); 4698 struct wireless_dev *wdev = dev->ieee80211_ptr; 4699 4700 err = nl80211_parse_key(info, &key); 4701 if (err) 4702 return err; 4703 4704 if (!key.p.key) { 4705 GENL_SET_ERR_MSG(info, "no key"); 4706 return -EINVAL; 4707 } 4708 4709 if (info->attrs[NL80211_ATTR_MAC]) 4710 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4711 4712 if (key.type == -1) { 4713 if (mac_addr) 4714 key.type = NL80211_KEYTYPE_PAIRWISE; 4715 else 4716 key.type = NL80211_KEYTYPE_GROUP; 4717 } 4718 4719 /* for now */ 4720 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4721 key.type != NL80211_KEYTYPE_GROUP) { 4722 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4723 return -EINVAL; 4724 } 4725 4726 if (key.type == NL80211_KEYTYPE_GROUP && 4727 info->attrs[NL80211_ATTR_VLAN_ID]) 4728 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4729 4730 if (!rdev->ops->add_key) 4731 return -EOPNOTSUPP; 4732 4733 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4734 key.type == NL80211_KEYTYPE_PAIRWISE, 4735 mac_addr)) { 4736 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4737 return -EINVAL; 4738 } 4739 4740 err = nl80211_key_allowed(wdev); 4741 if (err) 4742 GENL_SET_ERR_MSG(info, "key not allowed"); 4743 4744 if (!err) 4745 err = nl80211_validate_key_link_id(info, wdev, link_id, 4746 key.type == NL80211_KEYTYPE_PAIRWISE); 4747 4748 if (!err) { 4749 err = rdev_add_key(rdev, dev, link_id, key.idx, 4750 key.type == NL80211_KEYTYPE_PAIRWISE, 4751 mac_addr, &key.p); 4752 if (err) 4753 GENL_SET_ERR_MSG(info, "key addition failed"); 4754 } 4755 4756 return err; 4757 } 4758 4759 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4760 { 4761 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4762 int err; 4763 struct net_device *dev = info->user_ptr[1]; 4764 u8 *mac_addr = NULL; 4765 struct key_parse key; 4766 int link_id = nl80211_link_id_or_invalid(info->attrs); 4767 struct wireless_dev *wdev = dev->ieee80211_ptr; 4768 4769 err = nl80211_parse_key(info, &key); 4770 if (err) 4771 return err; 4772 4773 if (info->attrs[NL80211_ATTR_MAC]) 4774 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4775 4776 if (key.type == -1) { 4777 if (mac_addr) 4778 key.type = NL80211_KEYTYPE_PAIRWISE; 4779 else 4780 key.type = NL80211_KEYTYPE_GROUP; 4781 } 4782 4783 /* for now */ 4784 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4785 key.type != NL80211_KEYTYPE_GROUP) 4786 return -EINVAL; 4787 4788 if (!cfg80211_valid_key_idx(rdev, key.idx, 4789 key.type == NL80211_KEYTYPE_PAIRWISE)) 4790 return -EINVAL; 4791 4792 if (!rdev->ops->del_key) 4793 return -EOPNOTSUPP; 4794 4795 err = nl80211_key_allowed(wdev); 4796 4797 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4798 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4799 err = -ENOENT; 4800 4801 if (!err) 4802 err = nl80211_validate_key_link_id(info, wdev, link_id, 4803 key.type == NL80211_KEYTYPE_PAIRWISE); 4804 4805 if (!err) 4806 err = rdev_del_key(rdev, dev, link_id, key.idx, 4807 key.type == NL80211_KEYTYPE_PAIRWISE, 4808 mac_addr); 4809 4810 #ifdef CONFIG_CFG80211_WEXT 4811 if (!err) { 4812 if (key.idx == wdev->wext.default_key) 4813 wdev->wext.default_key = -1; 4814 else if (key.idx == wdev->wext.default_mgmt_key) 4815 wdev->wext.default_mgmt_key = -1; 4816 } 4817 #endif 4818 4819 return err; 4820 } 4821 4822 /* This function returns an error or the number of nested attributes */ 4823 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4824 { 4825 struct nlattr *attr; 4826 int n_entries = 0, tmp; 4827 4828 nla_for_each_nested(attr, nl_attr, tmp) { 4829 if (nla_len(attr) != ETH_ALEN) 4830 return -EINVAL; 4831 4832 n_entries++; 4833 } 4834 4835 return n_entries; 4836 } 4837 4838 /* 4839 * This function parses ACL information and allocates memory for ACL data. 4840 * On successful return, the calling function is responsible to free the 4841 * ACL buffer returned by this function. 4842 */ 4843 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4844 struct genl_info *info) 4845 { 4846 enum nl80211_acl_policy acl_policy; 4847 struct nlattr *attr; 4848 struct cfg80211_acl_data *acl; 4849 int i = 0, n_entries, tmp; 4850 4851 if (!wiphy->max_acl_mac_addrs) 4852 return ERR_PTR(-EOPNOTSUPP); 4853 4854 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4855 return ERR_PTR(-EINVAL); 4856 4857 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4858 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4859 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4860 return ERR_PTR(-EINVAL); 4861 4862 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4863 return ERR_PTR(-EINVAL); 4864 4865 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4866 if (n_entries < 0) 4867 return ERR_PTR(n_entries); 4868 4869 if (n_entries > wiphy->max_acl_mac_addrs) 4870 return ERR_PTR(-EOPNOTSUPP); 4871 4872 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4873 if (!acl) 4874 return ERR_PTR(-ENOMEM); 4875 acl->n_acl_entries = n_entries; 4876 4877 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4878 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4879 i++; 4880 } 4881 acl->acl_policy = acl_policy; 4882 4883 return acl; 4884 } 4885 4886 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4887 { 4888 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4889 struct net_device *dev = info->user_ptr[1]; 4890 struct cfg80211_acl_data *acl; 4891 int err; 4892 4893 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4894 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4895 return -EOPNOTSUPP; 4896 4897 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval) 4898 return -EINVAL; 4899 4900 acl = parse_acl_data(&rdev->wiphy, info); 4901 if (IS_ERR(acl)) 4902 return PTR_ERR(acl); 4903 4904 err = rdev_set_mac_acl(rdev, dev, acl); 4905 4906 kfree(acl); 4907 4908 return err; 4909 } 4910 4911 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4912 u8 *rates, u8 rates_len) 4913 { 4914 u8 i; 4915 u32 mask = 0; 4916 4917 for (i = 0; i < rates_len; i++) { 4918 int rate = (rates[i] & 0x7f) * 5; 4919 int ridx; 4920 4921 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4922 struct ieee80211_rate *srate = 4923 &sband->bitrates[ridx]; 4924 if (rate == srate->bitrate) { 4925 mask |= 1 << ridx; 4926 break; 4927 } 4928 } 4929 if (ridx == sband->n_bitrates) 4930 return 0; /* rate not found */ 4931 } 4932 4933 return mask; 4934 } 4935 4936 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4937 u8 *rates, u8 rates_len, 4938 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4939 { 4940 u8 i; 4941 4942 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4943 4944 for (i = 0; i < rates_len; i++) { 4945 int ridx, rbit; 4946 4947 ridx = rates[i] / 8; 4948 rbit = BIT(rates[i] % 8); 4949 4950 /* check validity */ 4951 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4952 return false; 4953 4954 /* check availability */ 4955 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4956 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4957 mcs[ridx] |= rbit; 4958 else 4959 return false; 4960 } 4961 4962 return true; 4963 } 4964 4965 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4966 { 4967 u16 mcs_mask = 0; 4968 4969 switch (vht_mcs_map) { 4970 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4971 break; 4972 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4973 mcs_mask = 0x00FF; 4974 break; 4975 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4976 mcs_mask = 0x01FF; 4977 break; 4978 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4979 mcs_mask = 0x03FF; 4980 break; 4981 default: 4982 break; 4983 } 4984 4985 return mcs_mask; 4986 } 4987 4988 static void vht_build_mcs_mask(u16 vht_mcs_map, 4989 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4990 { 4991 u8 nss; 4992 4993 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4994 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4995 vht_mcs_map >>= 2; 4996 } 4997 } 4998 4999 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 5000 struct nl80211_txrate_vht *txrate, 5001 u16 mcs[NL80211_VHT_NSS_MAX]) 5002 { 5003 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 5004 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 5005 u8 i; 5006 5007 if (!sband->vht_cap.vht_supported) 5008 return false; 5009 5010 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 5011 5012 /* Build vht_mcs_mask from VHT capabilities */ 5013 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5014 5015 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5016 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5017 mcs[i] = txrate->mcs[i]; 5018 else 5019 return false; 5020 } 5021 5022 return true; 5023 } 5024 5025 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 5026 { 5027 switch (he_mcs_map) { 5028 case IEEE80211_HE_MCS_NOT_SUPPORTED: 5029 return 0; 5030 case IEEE80211_HE_MCS_SUPPORT_0_7: 5031 return 0x00FF; 5032 case IEEE80211_HE_MCS_SUPPORT_0_9: 5033 return 0x03FF; 5034 case IEEE80211_HE_MCS_SUPPORT_0_11: 5035 return 0xFFF; 5036 default: 5037 break; 5038 } 5039 return 0; 5040 } 5041 5042 static void he_build_mcs_mask(u16 he_mcs_map, 5043 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 5044 { 5045 u8 nss; 5046 5047 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 5048 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 5049 he_mcs_map >>= 2; 5050 } 5051 } 5052 5053 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id, 5054 const struct ieee80211_sta_he_cap *he_cap) 5055 { 5056 struct net_device *dev = info->user_ptr[1]; 5057 struct wireless_dev *wdev = dev->ieee80211_ptr; 5058 struct cfg80211_chan_def *chandef; 5059 __le16 tx_mcs; 5060 5061 chandef = wdev_chandef(wdev, link_id); 5062 if (!chandef) { 5063 /* 5064 * This is probably broken, but we never maintained 5065 * a chandef in these cases, so it always was. 5066 */ 5067 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80); 5068 } 5069 5070 switch (chandef->width) { 5071 case NL80211_CHAN_WIDTH_80P80: 5072 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 5073 break; 5074 case NL80211_CHAN_WIDTH_160: 5075 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 5076 break; 5077 default: 5078 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 5079 break; 5080 } 5081 5082 return le16_to_cpu(tx_mcs); 5083 } 5084 5085 static bool he_set_mcs_mask(struct genl_info *info, 5086 struct wireless_dev *wdev, 5087 struct ieee80211_supported_band *sband, 5088 struct nl80211_txrate_he *txrate, 5089 u16 mcs[NL80211_HE_NSS_MAX], 5090 unsigned int link_id) 5091 { 5092 const struct ieee80211_sta_he_cap *he_cap; 5093 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 5094 u16 tx_mcs_map = 0; 5095 u8 i; 5096 5097 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5098 if (!he_cap) 5099 return false; 5100 5101 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 5102 5103 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5104 5105 /* Build he_mcs_mask from HE capabilities */ 5106 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5107 5108 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5109 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5110 mcs[i] = txrate->mcs[i]; 5111 else 5112 return false; 5113 } 5114 5115 return true; 5116 } 5117 5118 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 5119 struct nlattr *attrs[], 5120 enum nl80211_attrs attr, 5121 struct cfg80211_bitrate_mask *mask, 5122 struct net_device *dev, 5123 bool default_all_enabled, 5124 unsigned int link_id) 5125 { 5126 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 5127 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5128 struct wireless_dev *wdev = dev->ieee80211_ptr; 5129 int rem, i; 5130 struct nlattr *tx_rates; 5131 struct ieee80211_supported_band *sband; 5132 u16 vht_tx_mcs_map, he_tx_mcs_map; 5133 5134 memset(mask, 0, sizeof(*mask)); 5135 /* Default to all rates enabled */ 5136 for (i = 0; i < NUM_NL80211_BANDS; i++) { 5137 const struct ieee80211_sta_he_cap *he_cap; 5138 5139 if (!default_all_enabled) 5140 break; 5141 5142 sband = rdev->wiphy.bands[i]; 5143 5144 if (!sband) 5145 continue; 5146 5147 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 5148 memcpy(mask->control[i].ht_mcs, 5149 sband->ht_cap.mcs.rx_mask, 5150 sizeof(mask->control[i].ht_mcs)); 5151 5152 if (sband->vht_cap.vht_supported) { 5153 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 5154 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 5155 } 5156 5157 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5158 if (!he_cap) 5159 continue; 5160 5161 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5162 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 5163 5164 mask->control[i].he_gi = 0xFF; 5165 mask->control[i].he_ltf = 0xFF; 5166 } 5167 5168 /* if no rates are given set it back to the defaults */ 5169 if (!attrs[attr]) 5170 goto out; 5171 5172 /* The nested attribute uses enum nl80211_band as the index. This maps 5173 * directly to the enum nl80211_band values used in cfg80211. 5174 */ 5175 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 5176 nla_for_each_nested(tx_rates, attrs[attr], rem) { 5177 enum nl80211_band band = nla_type(tx_rates); 5178 int err; 5179 5180 if (band < 0 || band >= NUM_NL80211_BANDS) 5181 return -EINVAL; 5182 sband = rdev->wiphy.bands[band]; 5183 if (sband == NULL) 5184 return -EINVAL; 5185 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 5186 tx_rates, 5187 nl80211_txattr_policy, 5188 info->extack); 5189 if (err) 5190 return err; 5191 if (tb[NL80211_TXRATE_LEGACY]) { 5192 mask->control[band].legacy = rateset_to_mask( 5193 sband, 5194 nla_data(tb[NL80211_TXRATE_LEGACY]), 5195 nla_len(tb[NL80211_TXRATE_LEGACY])); 5196 if ((mask->control[band].legacy == 0) && 5197 nla_len(tb[NL80211_TXRATE_LEGACY])) 5198 return -EINVAL; 5199 } 5200 if (tb[NL80211_TXRATE_HT]) { 5201 if (!ht_rateset_to_mask( 5202 sband, 5203 nla_data(tb[NL80211_TXRATE_HT]), 5204 nla_len(tb[NL80211_TXRATE_HT]), 5205 mask->control[band].ht_mcs)) 5206 return -EINVAL; 5207 } 5208 5209 if (tb[NL80211_TXRATE_VHT]) { 5210 if (!vht_set_mcs_mask( 5211 sband, 5212 nla_data(tb[NL80211_TXRATE_VHT]), 5213 mask->control[band].vht_mcs)) 5214 return -EINVAL; 5215 } 5216 5217 if (tb[NL80211_TXRATE_GI]) { 5218 mask->control[band].gi = 5219 nla_get_u8(tb[NL80211_TXRATE_GI]); 5220 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 5221 return -EINVAL; 5222 } 5223 if (tb[NL80211_TXRATE_HE] && 5224 !he_set_mcs_mask(info, wdev, sband, 5225 nla_data(tb[NL80211_TXRATE_HE]), 5226 mask->control[band].he_mcs, 5227 link_id)) 5228 return -EINVAL; 5229 5230 if (tb[NL80211_TXRATE_HE_GI]) 5231 mask->control[band].he_gi = 5232 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 5233 if (tb[NL80211_TXRATE_HE_LTF]) 5234 mask->control[band].he_ltf = 5235 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 5236 5237 if (mask->control[band].legacy == 0) { 5238 /* don't allow empty legacy rates if HT, VHT or HE 5239 * are not even supported. 5240 */ 5241 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 5242 rdev->wiphy.bands[band]->vht_cap.vht_supported || 5243 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 5244 return -EINVAL; 5245 5246 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 5247 if (mask->control[band].ht_mcs[i]) 5248 goto out; 5249 5250 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 5251 if (mask->control[band].vht_mcs[i]) 5252 goto out; 5253 5254 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 5255 if (mask->control[band].he_mcs[i]) 5256 goto out; 5257 5258 /* legacy and mcs rates may not be both empty */ 5259 return -EINVAL; 5260 } 5261 } 5262 5263 out: 5264 return 0; 5265 } 5266 5267 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 5268 enum nl80211_band band, 5269 struct cfg80211_bitrate_mask *beacon_rate) 5270 { 5271 u32 count_ht, count_vht, count_he, i; 5272 u32 rate = beacon_rate->control[band].legacy; 5273 5274 /* Allow only one rate */ 5275 if (hweight32(rate) > 1) 5276 return -EINVAL; 5277 5278 count_ht = 0; 5279 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 5280 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 5281 return -EINVAL; 5282 } else if (beacon_rate->control[band].ht_mcs[i]) { 5283 count_ht++; 5284 if (count_ht > 1) 5285 return -EINVAL; 5286 } 5287 if (count_ht && rate) 5288 return -EINVAL; 5289 } 5290 5291 count_vht = 0; 5292 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5293 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 5294 return -EINVAL; 5295 } else if (beacon_rate->control[band].vht_mcs[i]) { 5296 count_vht++; 5297 if (count_vht > 1) 5298 return -EINVAL; 5299 } 5300 if (count_vht && rate) 5301 return -EINVAL; 5302 } 5303 5304 count_he = 0; 5305 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5306 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) { 5307 return -EINVAL; 5308 } else if (beacon_rate->control[band].he_mcs[i]) { 5309 count_he++; 5310 if (count_he > 1) 5311 return -EINVAL; 5312 } 5313 if (count_he && rate) 5314 return -EINVAL; 5315 } 5316 5317 if ((count_ht && count_vht && count_he) || 5318 (!rate && !count_ht && !count_vht && !count_he)) 5319 return -EINVAL; 5320 5321 if (rate && 5322 !wiphy_ext_feature_isset(&rdev->wiphy, 5323 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 5324 return -EINVAL; 5325 if (count_ht && 5326 !wiphy_ext_feature_isset(&rdev->wiphy, 5327 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 5328 return -EINVAL; 5329 if (count_vht && 5330 !wiphy_ext_feature_isset(&rdev->wiphy, 5331 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 5332 return -EINVAL; 5333 if (count_he && 5334 !wiphy_ext_feature_isset(&rdev->wiphy, 5335 NL80211_EXT_FEATURE_BEACON_RATE_HE)) 5336 return -EINVAL; 5337 5338 return 0; 5339 } 5340 5341 static int nl80211_parse_mbssid_config(struct wiphy *wiphy, 5342 struct net_device *dev, 5343 struct nlattr *attrs, 5344 struct cfg80211_mbssid_config *config, 5345 u8 num_elems) 5346 { 5347 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1]; 5348 5349 if (!wiphy->mbssid_max_interfaces) 5350 return -EOPNOTSUPP; 5351 5352 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL, 5353 NULL) || 5354 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]) 5355 return -EINVAL; 5356 5357 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]); 5358 if (config->ema) { 5359 if (!wiphy->ema_max_profile_periodicity) 5360 return -EOPNOTSUPP; 5361 5362 if (num_elems > wiphy->ema_max_profile_periodicity) 5363 return -EINVAL; 5364 } 5365 5366 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]); 5367 if (config->index >= wiphy->mbssid_max_interfaces || 5368 (!config->index && !num_elems)) 5369 return -EINVAL; 5370 5371 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) { 5372 u32 tx_ifindex = 5373 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]); 5374 5375 if ((!config->index && tx_ifindex != dev->ifindex) || 5376 (config->index && tx_ifindex == dev->ifindex)) 5377 return -EINVAL; 5378 5379 if (tx_ifindex != dev->ifindex) { 5380 struct net_device *tx_netdev = 5381 dev_get_by_index(wiphy_net(wiphy), tx_ifindex); 5382 5383 if (!tx_netdev || !tx_netdev->ieee80211_ptr || 5384 tx_netdev->ieee80211_ptr->wiphy != wiphy || 5385 tx_netdev->ieee80211_ptr->iftype != 5386 NL80211_IFTYPE_AP) { 5387 dev_put(tx_netdev); 5388 return -EINVAL; 5389 } 5390 5391 config->tx_wdev = tx_netdev->ieee80211_ptr; 5392 } else { 5393 config->tx_wdev = dev->ieee80211_ptr; 5394 } 5395 } else if (!config->index) { 5396 config->tx_wdev = dev->ieee80211_ptr; 5397 } else { 5398 return -EINVAL; 5399 } 5400 5401 return 0; 5402 } 5403 5404 static struct cfg80211_mbssid_elems * 5405 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs) 5406 { 5407 struct nlattr *nl_elems; 5408 struct cfg80211_mbssid_elems *elems; 5409 int rem_elems; 5410 u8 i = 0, num_elems = 0; 5411 5412 if (!wiphy->mbssid_max_interfaces) 5413 return ERR_PTR(-EINVAL); 5414 5415 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5416 if (num_elems >= 255) 5417 return ERR_PTR(-EINVAL); 5418 num_elems++; 5419 } 5420 5421 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL); 5422 if (!elems) 5423 return ERR_PTR(-ENOMEM); 5424 elems->cnt = num_elems; 5425 5426 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5427 elems->elem[i].data = nla_data(nl_elems); 5428 elems->elem[i].len = nla_len(nl_elems); 5429 i++; 5430 } 5431 return elems; 5432 } 5433 5434 static struct cfg80211_rnr_elems * 5435 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs, 5436 struct netlink_ext_ack *extack) 5437 { 5438 struct nlattr *nl_elems; 5439 struct cfg80211_rnr_elems *elems; 5440 int rem_elems; 5441 u8 i = 0, num_elems = 0; 5442 5443 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5444 int ret; 5445 5446 ret = validate_ie_attr(nl_elems, extack); 5447 if (ret) 5448 return ERR_PTR(ret); 5449 5450 num_elems++; 5451 } 5452 5453 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL); 5454 if (!elems) 5455 return ERR_PTR(-ENOMEM); 5456 elems->cnt = num_elems; 5457 5458 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5459 elems->elem[i].data = nla_data(nl_elems); 5460 elems->elem[i].len = nla_len(nl_elems); 5461 i++; 5462 } 5463 return elems; 5464 } 5465 5466 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 5467 struct cfg80211_he_bss_color *he_bss_color) 5468 { 5469 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 5470 int err; 5471 5472 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 5473 he_bss_color_policy, NULL); 5474 if (err) 5475 return err; 5476 5477 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 5478 return -EINVAL; 5479 5480 he_bss_color->color = 5481 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 5482 he_bss_color->enabled = 5483 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 5484 he_bss_color->partial = 5485 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 5486 5487 return 0; 5488 } 5489 5490 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 5491 struct nlattr *attrs[], 5492 struct cfg80211_beacon_data *bcn, 5493 struct netlink_ext_ack *extack) 5494 { 5495 bool haveinfo = false; 5496 int err; 5497 5498 memset(bcn, 0, sizeof(*bcn)); 5499 5500 bcn->link_id = nl80211_link_id(attrs); 5501 5502 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 5503 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 5504 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 5505 if (!bcn->head_len) 5506 return -EINVAL; 5507 haveinfo = true; 5508 } 5509 5510 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 5511 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 5512 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 5513 haveinfo = true; 5514 } 5515 5516 if (!haveinfo) 5517 return -EINVAL; 5518 5519 if (attrs[NL80211_ATTR_IE]) { 5520 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 5521 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 5522 } 5523 5524 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 5525 bcn->proberesp_ies = 5526 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5527 bcn->proberesp_ies_len = 5528 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5529 } 5530 5531 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 5532 bcn->assocresp_ies = 5533 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5534 bcn->assocresp_ies_len = 5535 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5536 } 5537 5538 if (attrs[NL80211_ATTR_PROBE_RESP]) { 5539 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 5540 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 5541 } 5542 5543 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 5544 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 5545 5546 err = nla_parse_nested_deprecated(tb, 5547 NL80211_FTM_RESP_ATTR_MAX, 5548 attrs[NL80211_ATTR_FTM_RESPONDER], 5549 NULL, NULL); 5550 if (err) 5551 return err; 5552 5553 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 5554 wiphy_ext_feature_isset(&rdev->wiphy, 5555 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 5556 bcn->ftm_responder = 1; 5557 else 5558 return -EOPNOTSUPP; 5559 5560 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 5561 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 5562 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 5563 } 5564 5565 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 5566 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5567 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5568 } 5569 } else { 5570 bcn->ftm_responder = -1; 5571 } 5572 5573 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5574 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR], 5575 &bcn->he_bss_color); 5576 if (err) 5577 return err; 5578 bcn->he_bss_color_valid = true; 5579 } 5580 5581 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) { 5582 struct cfg80211_mbssid_elems *mbssid = 5583 nl80211_parse_mbssid_elems(&rdev->wiphy, 5584 attrs[NL80211_ATTR_MBSSID_ELEMS]); 5585 5586 if (IS_ERR(mbssid)) 5587 return PTR_ERR(mbssid); 5588 5589 bcn->mbssid_ies = mbssid; 5590 5591 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) { 5592 struct cfg80211_rnr_elems *rnr = 5593 nl80211_parse_rnr_elems(&rdev->wiphy, 5594 attrs[NL80211_ATTR_EMA_RNR_ELEMS], 5595 extack); 5596 5597 if (IS_ERR(rnr)) 5598 return PTR_ERR(rnr); 5599 5600 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) 5601 return -EINVAL; 5602 5603 bcn->rnr_ies = rnr; 5604 } 5605 } 5606 5607 return 0; 5608 } 5609 5610 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 5611 struct ieee80211_he_obss_pd *he_obss_pd) 5612 { 5613 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 5614 int err; 5615 5616 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 5617 he_obss_pd_policy, NULL); 5618 if (err) 5619 return err; 5620 5621 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 5622 return -EINVAL; 5623 5624 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 5625 5626 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 5627 he_obss_pd->min_offset = 5628 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 5629 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 5630 he_obss_pd->max_offset = 5631 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 5632 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 5633 he_obss_pd->non_srg_max_offset = 5634 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 5635 5636 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 5637 return -EINVAL; 5638 5639 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 5640 memcpy(he_obss_pd->bss_color_bitmap, 5641 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 5642 sizeof(he_obss_pd->bss_color_bitmap)); 5643 5644 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 5645 memcpy(he_obss_pd->partial_bssid_bitmap, 5646 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 5647 sizeof(he_obss_pd->partial_bssid_bitmap)); 5648 5649 he_obss_pd->enable = true; 5650 5651 return 0; 5652 } 5653 5654 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 5655 struct nlattr *attrs, 5656 struct cfg80211_fils_discovery *fd) 5657 { 5658 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 5659 int ret; 5660 5661 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5662 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 5663 return -EINVAL; 5664 5665 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 5666 NULL, NULL); 5667 if (ret) 5668 return ret; 5669 5670 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] && 5671 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] && 5672 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) { 5673 fd->update = true; 5674 return 0; 5675 } 5676 5677 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 5678 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 5679 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 5680 return -EINVAL; 5681 5682 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5683 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5684 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 5685 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 5686 fd->update = true; 5687 return 0; 5688 } 5689 5690 static int 5691 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 5692 struct nlattr *attrs, 5693 struct cfg80211_unsol_bcast_probe_resp *presp) 5694 { 5695 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 5696 int ret; 5697 5698 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5699 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 5700 return -EINVAL; 5701 5702 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 5703 attrs, NULL, NULL); 5704 if (ret) 5705 return ret; 5706 5707 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] && 5708 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) { 5709 presp->update = true; 5710 return 0; 5711 } 5712 5713 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 5714 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 5715 return -EINVAL; 5716 5717 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5718 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5719 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5720 presp->update = true; 5721 return 0; 5722 } 5723 5724 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5725 const struct element *rates) 5726 { 5727 int i; 5728 5729 if (!rates) 5730 return; 5731 5732 for (i = 0; i < rates->datalen; i++) { 5733 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5734 params->ht_required = true; 5735 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5736 params->vht_required = true; 5737 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5738 params->he_required = true; 5739 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E) 5740 params->sae_h2e_required = true; 5741 } 5742 } 5743 5744 /* 5745 * Since the nl80211 API didn't include, from the beginning, attributes about 5746 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5747 * benefit of drivers that rebuild IEs in the firmware. 5748 */ 5749 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5750 { 5751 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5752 size_t ies_len = bcn->tail_len; 5753 const u8 *ies = bcn->tail; 5754 const struct element *rates; 5755 const struct element *cap; 5756 5757 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len); 5758 nl80211_check_ap_rate_selectors(params, rates); 5759 5760 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5761 nl80211_check_ap_rate_selectors(params, rates); 5762 5763 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5764 if (cap && cap->datalen >= sizeof(*params->ht_cap)) 5765 params->ht_cap = (void *)cap->data; 5766 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5767 if (cap && cap->datalen >= sizeof(*params->vht_cap)) 5768 params->vht_cap = (void *)cap->data; 5769 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5770 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1) 5771 params->he_cap = (void *)(cap->data + 1); 5772 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5773 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) 5774 params->he_oper = (void *)(cap->data + 1); 5775 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len); 5776 if (cap) { 5777 if (!cap->datalen) 5778 return -EINVAL; 5779 params->eht_cap = (void *)(cap->data + 1); 5780 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap, 5781 (const u8 *)params->eht_cap, 5782 cap->datalen - 1, true)) 5783 return -EINVAL; 5784 } 5785 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len); 5786 if (cap) { 5787 if (!cap->datalen) 5788 return -EINVAL; 5789 params->eht_oper = (void *)(cap->data + 1); 5790 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper, 5791 cap->datalen - 1)) 5792 return -EINVAL; 5793 } 5794 return 0; 5795 } 5796 5797 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5798 struct cfg80211_ap_settings *params) 5799 { 5800 struct wireless_dev *wdev; 5801 5802 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5803 if (wdev->iftype != NL80211_IFTYPE_AP && 5804 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5805 continue; 5806 5807 if (!wdev->u.ap.preset_chandef.chan) 5808 continue; 5809 5810 params->chandef = wdev->u.ap.preset_chandef; 5811 return true; 5812 } 5813 5814 return false; 5815 } 5816 5817 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5818 enum nl80211_auth_type auth_type, 5819 enum nl80211_commands cmd) 5820 { 5821 if (auth_type > NL80211_AUTHTYPE_MAX) 5822 return false; 5823 5824 switch (cmd) { 5825 case NL80211_CMD_AUTHENTICATE: 5826 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5827 auth_type == NL80211_AUTHTYPE_SAE) 5828 return false; 5829 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5830 NL80211_EXT_FEATURE_FILS_STA) && 5831 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5832 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5833 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5834 return false; 5835 return true; 5836 case NL80211_CMD_CONNECT: 5837 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5838 !wiphy_ext_feature_isset(&rdev->wiphy, 5839 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5840 auth_type == NL80211_AUTHTYPE_SAE) 5841 return false; 5842 5843 /* FILS with SK PFS or PK not supported yet */ 5844 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5845 auth_type == NL80211_AUTHTYPE_FILS_PK) 5846 return false; 5847 if (!wiphy_ext_feature_isset( 5848 &rdev->wiphy, 5849 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5850 auth_type == NL80211_AUTHTYPE_FILS_SK) 5851 return false; 5852 return true; 5853 case NL80211_CMD_START_AP: 5854 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5855 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5856 auth_type == NL80211_AUTHTYPE_SAE) 5857 return false; 5858 /* FILS not supported yet */ 5859 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5860 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5861 auth_type == NL80211_AUTHTYPE_FILS_PK) 5862 return false; 5863 return true; 5864 default: 5865 return false; 5866 } 5867 } 5868 5869 static void nl80211_send_ap_started(struct wireless_dev *wdev, 5870 unsigned int link_id) 5871 { 5872 struct wiphy *wiphy = wdev->wiphy; 5873 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 5874 struct sk_buff *msg; 5875 void *hdr; 5876 5877 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5878 if (!msg) 5879 return; 5880 5881 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP); 5882 if (!hdr) 5883 goto out; 5884 5885 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 5886 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 5887 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 5888 NL80211_ATTR_PAD) || 5889 (wdev->u.ap.ssid_len && 5890 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 5891 wdev->u.ap.ssid)) || 5892 (wdev->valid_links && 5893 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 5894 goto out; 5895 5896 genlmsg_end(msg, hdr); 5897 5898 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 5899 NL80211_MCGRP_MLME, GFP_KERNEL); 5900 return; 5901 out: 5902 nlmsg_free(msg); 5903 } 5904 5905 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params) 5906 { 5907 struct ieee80211_channel *channel = params->chandef.chan; 5908 5909 if ((params->he_cap || params->he_oper) && 5910 (channel->flags & IEEE80211_CHAN_NO_HE)) 5911 return -EOPNOTSUPP; 5912 5913 if ((params->eht_cap || params->eht_oper) && 5914 (channel->flags & IEEE80211_CHAN_NO_EHT)) 5915 return -EOPNOTSUPP; 5916 5917 return 0; 5918 } 5919 5920 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5921 { 5922 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5923 unsigned int link_id = nl80211_link_id(info->attrs); 5924 struct net_device *dev = info->user_ptr[1]; 5925 struct wireless_dev *wdev = dev->ieee80211_ptr; 5926 struct cfg80211_ap_settings *params; 5927 int err; 5928 5929 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5930 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5931 return -EOPNOTSUPP; 5932 5933 if (!rdev->ops->start_ap) 5934 return -EOPNOTSUPP; 5935 5936 if (wdev->links[link_id].ap.beacon_interval) 5937 return -EALREADY; 5938 5939 /* these are required for START_AP */ 5940 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5941 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5942 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5943 return -EINVAL; 5944 5945 params = kzalloc(sizeof(*params), GFP_KERNEL); 5946 if (!params) 5947 return -ENOMEM; 5948 5949 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon, 5950 info->extack); 5951 if (err) 5952 goto out; 5953 5954 params->beacon_interval = 5955 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5956 params->dtim_period = 5957 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5958 5959 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5960 params->beacon_interval); 5961 if (err) 5962 goto out; 5963 5964 /* 5965 * In theory, some of these attributes should be required here 5966 * but since they were not used when the command was originally 5967 * added, keep them optional for old user space programs to let 5968 * them continue to work with drivers that do not need the 5969 * additional information -- drivers must check! 5970 */ 5971 if (info->attrs[NL80211_ATTR_SSID]) { 5972 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5973 params->ssid_len = 5974 nla_len(info->attrs[NL80211_ATTR_SSID]); 5975 if (params->ssid_len == 0) { 5976 err = -EINVAL; 5977 goto out; 5978 } 5979 5980 if (wdev->u.ap.ssid_len && 5981 (wdev->u.ap.ssid_len != params->ssid_len || 5982 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) { 5983 /* require identical SSID for MLO */ 5984 err = -EINVAL; 5985 goto out; 5986 } 5987 } else if (wdev->valid_links) { 5988 /* require SSID for MLO */ 5989 err = -EINVAL; 5990 goto out; 5991 } 5992 5993 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5994 params->hidden_ssid = nla_get_u32( 5995 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5996 5997 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5998 5999 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 6000 params->auth_type = nla_get_u32( 6001 info->attrs[NL80211_ATTR_AUTH_TYPE]); 6002 if (!nl80211_valid_auth_type(rdev, params->auth_type, 6003 NL80211_CMD_START_AP)) { 6004 err = -EINVAL; 6005 goto out; 6006 } 6007 } else 6008 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC; 6009 6010 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto, 6011 NL80211_MAX_NR_CIPHER_SUITES); 6012 if (err) 6013 goto out; 6014 6015 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 6016 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) { 6017 err = -EOPNOTSUPP; 6018 goto out; 6019 } 6020 params->inactivity_timeout = nla_get_u16( 6021 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 6022 } 6023 6024 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 6025 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6026 err = -EINVAL; 6027 goto out; 6028 } 6029 params->p2p_ctwindow = 6030 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 6031 if (params->p2p_ctwindow != 0 && 6032 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) { 6033 err = -EINVAL; 6034 goto out; 6035 } 6036 } 6037 6038 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 6039 u8 tmp; 6040 6041 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6042 err = -EINVAL; 6043 goto out; 6044 } 6045 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 6046 params->p2p_opp_ps = tmp; 6047 if (params->p2p_opp_ps != 0 && 6048 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) { 6049 err = -EINVAL; 6050 goto out; 6051 } 6052 } 6053 6054 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 6055 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef); 6056 if (err) 6057 goto out; 6058 } else if (wdev->valid_links) { 6059 /* with MLD need to specify the channel configuration */ 6060 err = -EINVAL; 6061 goto out; 6062 } else if (wdev->u.ap.preset_chandef.chan) { 6063 params->chandef = wdev->u.ap.preset_chandef; 6064 } else if (!nl80211_get_ap_channel(rdev, params)) { 6065 err = -EINVAL; 6066 goto out; 6067 } 6068 6069 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 6070 err = nl80211_parse_punct_bitmap(rdev, info, 6071 ¶ms->chandef, 6072 ¶ms->punct_bitmap); 6073 if (err) 6074 goto out; 6075 } 6076 6077 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms->chandef, 6078 wdev->iftype)) { 6079 err = -EINVAL; 6080 goto out; 6081 } 6082 6083 if (info->attrs[NL80211_ATTR_TX_RATES]) { 6084 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 6085 NL80211_ATTR_TX_RATES, 6086 ¶ms->beacon_rate, 6087 dev, false, link_id); 6088 if (err) 6089 goto out; 6090 6091 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band, 6092 ¶ms->beacon_rate); 6093 if (err) 6094 goto out; 6095 } 6096 6097 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 6098 params->smps_mode = 6099 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 6100 switch (params->smps_mode) { 6101 case NL80211_SMPS_OFF: 6102 break; 6103 case NL80211_SMPS_STATIC: 6104 if (!(rdev->wiphy.features & 6105 NL80211_FEATURE_STATIC_SMPS)) { 6106 err = -EINVAL; 6107 goto out; 6108 } 6109 break; 6110 case NL80211_SMPS_DYNAMIC: 6111 if (!(rdev->wiphy.features & 6112 NL80211_FEATURE_DYNAMIC_SMPS)) { 6113 err = -EINVAL; 6114 goto out; 6115 } 6116 break; 6117 default: 6118 err = -EINVAL; 6119 goto out; 6120 } 6121 } else { 6122 params->smps_mode = NL80211_SMPS_OFF; 6123 } 6124 6125 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 6126 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 6127 err = -EOPNOTSUPP; 6128 goto out; 6129 } 6130 6131 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 6132 params->acl = parse_acl_data(&rdev->wiphy, info); 6133 if (IS_ERR(params->acl)) { 6134 err = PTR_ERR(params->acl); 6135 params->acl = NULL; 6136 goto out; 6137 } 6138 } 6139 6140 params->twt_responder = 6141 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 6142 6143 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 6144 err = nl80211_parse_he_obss_pd( 6145 info->attrs[NL80211_ATTR_HE_OBSS_PD], 6146 ¶ms->he_obss_pd); 6147 if (err) 6148 goto out; 6149 } 6150 6151 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 6152 err = nl80211_parse_fils_discovery(rdev, 6153 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 6154 ¶ms->fils_discovery); 6155 if (err) 6156 goto out; 6157 } 6158 6159 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 6160 err = nl80211_parse_unsol_bcast_probe_resp( 6161 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 6162 ¶ms->unsol_bcast_probe_resp); 6163 if (err) 6164 goto out; 6165 } 6166 6167 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) { 6168 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, 6169 info->attrs[NL80211_ATTR_MBSSID_CONFIG], 6170 ¶ms->mbssid_config, 6171 params->beacon.mbssid_ies ? 6172 params->beacon.mbssid_ies->cnt : 6173 0); 6174 if (err) 6175 goto out; 6176 } 6177 6178 if (!params->mbssid_config.ema && params->beacon.rnr_ies) { 6179 err = -EINVAL; 6180 goto out; 6181 } 6182 6183 err = nl80211_calculate_ap_params(params); 6184 if (err) 6185 goto out; 6186 6187 err = nl80211_validate_ap_phy_operation(params); 6188 if (err) 6189 goto out; 6190 6191 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]) 6192 params->flags = nla_get_u32( 6193 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]); 6194 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 6195 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 6196 6197 if (wdev->conn_owner_nlportid && 6198 info->attrs[NL80211_ATTR_SOCKET_OWNER] && 6199 wdev->conn_owner_nlportid != info->snd_portid) { 6200 err = -EINVAL; 6201 goto out; 6202 } 6203 6204 /* FIXME: validate MLO/link-id against driver capabilities */ 6205 6206 err = rdev_start_ap(rdev, dev, params); 6207 if (!err) { 6208 wdev->links[link_id].ap.beacon_interval = params->beacon_interval; 6209 wdev->links[link_id].ap.chandef = params->chandef; 6210 wdev->u.ap.ssid_len = params->ssid_len; 6211 memcpy(wdev->u.ap.ssid, params->ssid, 6212 params->ssid_len); 6213 6214 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 6215 wdev->conn_owner_nlportid = info->snd_portid; 6216 6217 nl80211_send_ap_started(wdev, link_id); 6218 } 6219 out: 6220 kfree(params->acl); 6221 kfree(params->beacon.mbssid_ies); 6222 if (params->mbssid_config.tx_wdev && 6223 params->mbssid_config.tx_wdev->netdev && 6224 params->mbssid_config.tx_wdev->netdev != dev) 6225 dev_put(params->mbssid_config.tx_wdev->netdev); 6226 kfree(params->beacon.rnr_ies); 6227 kfree(params); 6228 6229 return err; 6230 } 6231 6232 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 6233 { 6234 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6235 unsigned int link_id = nl80211_link_id(info->attrs); 6236 struct net_device *dev = info->user_ptr[1]; 6237 struct wireless_dev *wdev = dev->ieee80211_ptr; 6238 struct cfg80211_ap_update *params; 6239 struct nlattr *attr; 6240 int err; 6241 6242 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6243 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6244 return -EOPNOTSUPP; 6245 6246 if (!rdev->ops->change_beacon) 6247 return -EOPNOTSUPP; 6248 6249 if (!wdev->links[link_id].ap.beacon_interval) 6250 return -EINVAL; 6251 6252 params = kzalloc(sizeof(*params), GFP_KERNEL); 6253 if (!params) 6254 return -ENOMEM; 6255 6256 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon, 6257 info->extack); 6258 if (err) 6259 goto out; 6260 6261 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY]; 6262 if (attr) { 6263 err = nl80211_parse_fils_discovery(rdev, attr, 6264 ¶ms->fils_discovery); 6265 if (err) 6266 goto out; 6267 } 6268 6269 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]; 6270 if (attr) { 6271 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr, 6272 ¶ms->unsol_bcast_probe_resp); 6273 if (err) 6274 goto out; 6275 } 6276 6277 err = rdev_change_beacon(rdev, dev, params); 6278 6279 out: 6280 kfree(params->beacon.mbssid_ies); 6281 kfree(params->beacon.rnr_ies); 6282 kfree(params); 6283 return err; 6284 } 6285 6286 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 6287 { 6288 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6289 unsigned int link_id = nl80211_link_id(info->attrs); 6290 struct net_device *dev = info->user_ptr[1]; 6291 6292 return cfg80211_stop_ap(rdev, dev, link_id, false); 6293 } 6294 6295 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 6296 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 6297 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 6298 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 6299 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 6300 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 6301 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 6302 }; 6303 6304 static int parse_station_flags(struct genl_info *info, 6305 enum nl80211_iftype iftype, 6306 struct station_parameters *params) 6307 { 6308 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 6309 struct nlattr *nla; 6310 int flag; 6311 6312 /* 6313 * Try parsing the new attribute first so userspace 6314 * can specify both for older kernels. 6315 */ 6316 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 6317 if (nla) { 6318 struct nl80211_sta_flag_update *sta_flags; 6319 6320 sta_flags = nla_data(nla); 6321 params->sta_flags_mask = sta_flags->mask; 6322 params->sta_flags_set = sta_flags->set; 6323 params->sta_flags_set &= params->sta_flags_mask; 6324 if ((params->sta_flags_mask | 6325 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 6326 return -EINVAL; 6327 return 0; 6328 } 6329 6330 /* if present, parse the old attribute */ 6331 6332 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 6333 if (!nla) 6334 return 0; 6335 6336 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 6337 return -EINVAL; 6338 6339 /* 6340 * Only allow certain flags for interface types so that 6341 * other attributes are silently ignored. Remember that 6342 * this is backward compatibility code with old userspace 6343 * and shouldn't be hit in other cases anyway. 6344 */ 6345 switch (iftype) { 6346 case NL80211_IFTYPE_AP: 6347 case NL80211_IFTYPE_AP_VLAN: 6348 case NL80211_IFTYPE_P2P_GO: 6349 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6350 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6351 BIT(NL80211_STA_FLAG_WME) | 6352 BIT(NL80211_STA_FLAG_MFP); 6353 break; 6354 case NL80211_IFTYPE_P2P_CLIENT: 6355 case NL80211_IFTYPE_STATION: 6356 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6357 BIT(NL80211_STA_FLAG_TDLS_PEER); 6358 break; 6359 case NL80211_IFTYPE_MESH_POINT: 6360 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6361 BIT(NL80211_STA_FLAG_MFP) | 6362 BIT(NL80211_STA_FLAG_AUTHORIZED); 6363 break; 6364 default: 6365 return -EINVAL; 6366 } 6367 6368 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 6369 if (flags[flag]) { 6370 params->sta_flags_set |= (1<<flag); 6371 6372 /* no longer support new API additions in old API */ 6373 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 6374 return -EINVAL; 6375 } 6376 } 6377 6378 return 0; 6379 } 6380 6381 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 6382 { 6383 struct nlattr *rate; 6384 u32 bitrate; 6385 u16 bitrate_compat; 6386 enum nl80211_rate_info rate_flg; 6387 6388 rate = nla_nest_start_noflag(msg, attr); 6389 if (!rate) 6390 return false; 6391 6392 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 6393 bitrate = cfg80211_calculate_bitrate(info); 6394 /* report 16-bit bitrate only if we can */ 6395 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 6396 if (bitrate > 0 && 6397 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 6398 return false; 6399 if (bitrate_compat > 0 && 6400 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 6401 return false; 6402 6403 switch (info->bw) { 6404 case RATE_INFO_BW_1: 6405 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH; 6406 break; 6407 case RATE_INFO_BW_2: 6408 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH; 6409 break; 6410 case RATE_INFO_BW_4: 6411 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH; 6412 break; 6413 case RATE_INFO_BW_5: 6414 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 6415 break; 6416 case RATE_INFO_BW_8: 6417 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH; 6418 break; 6419 case RATE_INFO_BW_10: 6420 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 6421 break; 6422 case RATE_INFO_BW_16: 6423 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH; 6424 break; 6425 default: 6426 WARN_ON(1); 6427 fallthrough; 6428 case RATE_INFO_BW_20: 6429 rate_flg = 0; 6430 break; 6431 case RATE_INFO_BW_40: 6432 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 6433 break; 6434 case RATE_INFO_BW_80: 6435 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 6436 break; 6437 case RATE_INFO_BW_160: 6438 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 6439 break; 6440 case RATE_INFO_BW_HE_RU: 6441 rate_flg = 0; 6442 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 6443 break; 6444 case RATE_INFO_BW_320: 6445 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH; 6446 break; 6447 case RATE_INFO_BW_EHT_RU: 6448 rate_flg = 0; 6449 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS)); 6450 break; 6451 } 6452 6453 if (rate_flg && nla_put_flag(msg, rate_flg)) 6454 return false; 6455 6456 if (info->flags & RATE_INFO_FLAGS_MCS) { 6457 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 6458 return false; 6459 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6460 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6461 return false; 6462 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 6463 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 6464 return false; 6465 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 6466 return false; 6467 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6468 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6469 return false; 6470 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 6471 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 6472 return false; 6473 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 6474 return false; 6475 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 6476 return false; 6477 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 6478 return false; 6479 if (info->bw == RATE_INFO_BW_HE_RU && 6480 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 6481 info->he_ru_alloc)) 6482 return false; 6483 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) { 6484 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs)) 6485 return false; 6486 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss)) 6487 return false; 6488 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6489 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6490 return false; 6491 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) { 6492 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs)) 6493 return false; 6494 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss)) 6495 return false; 6496 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi)) 6497 return false; 6498 if (info->bw == RATE_INFO_BW_EHT_RU && 6499 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC, 6500 info->eht_ru_alloc)) 6501 return false; 6502 } 6503 6504 nla_nest_end(msg, rate); 6505 return true; 6506 } 6507 6508 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 6509 int id) 6510 { 6511 void *attr; 6512 int i = 0; 6513 6514 if (!mask) 6515 return true; 6516 6517 attr = nla_nest_start_noflag(msg, id); 6518 if (!attr) 6519 return false; 6520 6521 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 6522 if (!(mask & BIT(i))) 6523 continue; 6524 6525 if (nla_put_u8(msg, i, signal[i])) 6526 return false; 6527 } 6528 6529 nla_nest_end(msg, attr); 6530 6531 return true; 6532 } 6533 6534 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 6535 u32 seq, int flags, 6536 struct cfg80211_registered_device *rdev, 6537 struct net_device *dev, 6538 const u8 *mac_addr, struct station_info *sinfo) 6539 { 6540 void *hdr; 6541 struct nlattr *sinfoattr, *bss_param; 6542 6543 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 6544 if (!hdr) { 6545 cfg80211_sinfo_release_content(sinfo); 6546 return -1; 6547 } 6548 6549 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6550 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 6551 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 6552 goto nla_put_failure; 6553 6554 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 6555 if (!sinfoattr) 6556 goto nla_put_failure; 6557 6558 #define PUT_SINFO(attr, memb, type) do { \ 6559 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 6560 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6561 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 6562 sinfo->memb)) \ 6563 goto nla_put_failure; \ 6564 } while (0) 6565 #define PUT_SINFO_U64(attr, memb) do { \ 6566 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6567 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 6568 sinfo->memb, NL80211_STA_INFO_PAD)) \ 6569 goto nla_put_failure; \ 6570 } while (0) 6571 6572 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 6573 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 6574 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 6575 6576 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 6577 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 6578 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 6579 (u32)sinfo->rx_bytes)) 6580 goto nla_put_failure; 6581 6582 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 6583 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 6584 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 6585 (u32)sinfo->tx_bytes)) 6586 goto nla_put_failure; 6587 6588 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 6589 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 6590 PUT_SINFO(LLID, llid, u16); 6591 PUT_SINFO(PLID, plid, u16); 6592 PUT_SINFO(PLINK_STATE, plink_state, u8); 6593 PUT_SINFO_U64(RX_DURATION, rx_duration); 6594 PUT_SINFO_U64(TX_DURATION, tx_duration); 6595 6596 if (wiphy_ext_feature_isset(&rdev->wiphy, 6597 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6598 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 6599 6600 switch (rdev->wiphy.signal_type) { 6601 case CFG80211_SIGNAL_TYPE_MBM: 6602 PUT_SINFO(SIGNAL, signal, u8); 6603 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 6604 break; 6605 default: 6606 break; 6607 } 6608 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 6609 if (!nl80211_put_signal(msg, sinfo->chains, 6610 sinfo->chain_signal, 6611 NL80211_STA_INFO_CHAIN_SIGNAL)) 6612 goto nla_put_failure; 6613 } 6614 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 6615 if (!nl80211_put_signal(msg, sinfo->chains, 6616 sinfo->chain_signal_avg, 6617 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 6618 goto nla_put_failure; 6619 } 6620 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 6621 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 6622 NL80211_STA_INFO_TX_BITRATE)) 6623 goto nla_put_failure; 6624 } 6625 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 6626 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 6627 NL80211_STA_INFO_RX_BITRATE)) 6628 goto nla_put_failure; 6629 } 6630 6631 PUT_SINFO(RX_PACKETS, rx_packets, u32); 6632 PUT_SINFO(TX_PACKETS, tx_packets, u32); 6633 PUT_SINFO(TX_RETRIES, tx_retries, u32); 6634 PUT_SINFO(TX_FAILED, tx_failed, u32); 6635 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 6636 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 6637 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 6638 PUT_SINFO(LOCAL_PM, local_pm, u32); 6639 PUT_SINFO(PEER_PM, peer_pm, u32); 6640 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 6641 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 6642 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 6643 6644 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 6645 bss_param = nla_nest_start_noflag(msg, 6646 NL80211_STA_INFO_BSS_PARAM); 6647 if (!bss_param) 6648 goto nla_put_failure; 6649 6650 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 6651 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 6652 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 6653 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 6654 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 6655 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 6656 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 6657 sinfo->bss_param.dtim_period) || 6658 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 6659 sinfo->bss_param.beacon_interval)) 6660 goto nla_put_failure; 6661 6662 nla_nest_end(msg, bss_param); 6663 } 6664 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 6665 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 6666 sizeof(struct nl80211_sta_flag_update), 6667 &sinfo->sta_flags)) 6668 goto nla_put_failure; 6669 6670 PUT_SINFO_U64(T_OFFSET, t_offset); 6671 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 6672 PUT_SINFO_U64(BEACON_RX, rx_beacon); 6673 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 6674 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 6675 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 6676 if (wiphy_ext_feature_isset(&rdev->wiphy, 6677 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 6678 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 6679 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 6680 } 6681 6682 #undef PUT_SINFO 6683 #undef PUT_SINFO_U64 6684 6685 if (sinfo->pertid) { 6686 struct nlattr *tidsattr; 6687 int tid; 6688 6689 tidsattr = nla_nest_start_noflag(msg, 6690 NL80211_STA_INFO_TID_STATS); 6691 if (!tidsattr) 6692 goto nla_put_failure; 6693 6694 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 6695 struct cfg80211_tid_stats *tidstats; 6696 struct nlattr *tidattr; 6697 6698 tidstats = &sinfo->pertid[tid]; 6699 6700 if (!tidstats->filled) 6701 continue; 6702 6703 tidattr = nla_nest_start_noflag(msg, tid + 1); 6704 if (!tidattr) 6705 goto nla_put_failure; 6706 6707 #define PUT_TIDVAL_U64(attr, memb) do { \ 6708 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 6709 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 6710 tidstats->memb, NL80211_TID_STATS_PAD)) \ 6711 goto nla_put_failure; \ 6712 } while (0) 6713 6714 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 6715 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 6716 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 6717 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 6718 6719 #undef PUT_TIDVAL_U64 6720 if ((tidstats->filled & 6721 BIT(NL80211_TID_STATS_TXQ_STATS)) && 6722 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 6723 NL80211_TID_STATS_TXQ_STATS)) 6724 goto nla_put_failure; 6725 6726 nla_nest_end(msg, tidattr); 6727 } 6728 6729 nla_nest_end(msg, tidsattr); 6730 } 6731 6732 nla_nest_end(msg, sinfoattr); 6733 6734 if (sinfo->assoc_req_ies_len && 6735 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 6736 sinfo->assoc_req_ies)) 6737 goto nla_put_failure; 6738 6739 if (sinfo->assoc_resp_ies_len && 6740 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len, 6741 sinfo->assoc_resp_ies)) 6742 goto nla_put_failure; 6743 6744 if (sinfo->mlo_params_valid) { 6745 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 6746 sinfo->assoc_link_id)) 6747 goto nla_put_failure; 6748 6749 if (!is_zero_ether_addr(sinfo->mld_addr) && 6750 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 6751 sinfo->mld_addr)) 6752 goto nla_put_failure; 6753 } 6754 6755 cfg80211_sinfo_release_content(sinfo); 6756 genlmsg_end(msg, hdr); 6757 return 0; 6758 6759 nla_put_failure: 6760 cfg80211_sinfo_release_content(sinfo); 6761 genlmsg_cancel(msg, hdr); 6762 return -EMSGSIZE; 6763 } 6764 6765 static int nl80211_dump_station(struct sk_buff *skb, 6766 struct netlink_callback *cb) 6767 { 6768 struct station_info sinfo; 6769 struct cfg80211_registered_device *rdev; 6770 struct wireless_dev *wdev; 6771 u8 mac_addr[ETH_ALEN]; 6772 int sta_idx = cb->args[2]; 6773 int err; 6774 6775 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 6776 if (err) 6777 return err; 6778 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 6779 __acquire(&rdev->wiphy.mtx); 6780 6781 if (!wdev->netdev) { 6782 err = -EINVAL; 6783 goto out_err; 6784 } 6785 6786 if (!rdev->ops->dump_station) { 6787 err = -EOPNOTSUPP; 6788 goto out_err; 6789 } 6790 6791 while (1) { 6792 memset(&sinfo, 0, sizeof(sinfo)); 6793 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 6794 mac_addr, &sinfo); 6795 if (err == -ENOENT) 6796 break; 6797 if (err) 6798 goto out_err; 6799 6800 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 6801 NETLINK_CB(cb->skb).portid, 6802 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6803 rdev, wdev->netdev, mac_addr, 6804 &sinfo) < 0) 6805 goto out; 6806 6807 sta_idx++; 6808 } 6809 6810 out: 6811 cb->args[2] = sta_idx; 6812 err = skb->len; 6813 out_err: 6814 wiphy_unlock(&rdev->wiphy); 6815 6816 return err; 6817 } 6818 6819 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 6820 { 6821 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6822 struct net_device *dev = info->user_ptr[1]; 6823 struct station_info sinfo; 6824 struct sk_buff *msg; 6825 u8 *mac_addr = NULL; 6826 int err; 6827 6828 memset(&sinfo, 0, sizeof(sinfo)); 6829 6830 if (!info->attrs[NL80211_ATTR_MAC]) 6831 return -EINVAL; 6832 6833 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6834 6835 if (!rdev->ops->get_station) 6836 return -EOPNOTSUPP; 6837 6838 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 6839 if (err) 6840 return err; 6841 6842 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6843 if (!msg) { 6844 cfg80211_sinfo_release_content(&sinfo); 6845 return -ENOMEM; 6846 } 6847 6848 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 6849 info->snd_portid, info->snd_seq, 0, 6850 rdev, dev, mac_addr, &sinfo) < 0) { 6851 nlmsg_free(msg); 6852 return -ENOBUFS; 6853 } 6854 6855 return genlmsg_reply(msg, info); 6856 } 6857 6858 int cfg80211_check_station_change(struct wiphy *wiphy, 6859 struct station_parameters *params, 6860 enum cfg80211_station_type statype) 6861 { 6862 if (params->listen_interval != -1 && 6863 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6864 return -EINVAL; 6865 6866 if (params->support_p2p_ps != -1 && 6867 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6868 return -EINVAL; 6869 6870 if (params->aid && 6871 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 6872 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6873 return -EINVAL; 6874 6875 /* When you run into this, adjust the code below for the new flag */ 6876 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6877 6878 switch (statype) { 6879 case CFG80211_STA_MESH_PEER_KERNEL: 6880 case CFG80211_STA_MESH_PEER_USER: 6881 /* 6882 * No ignoring the TDLS flag here -- the userspace mesh 6883 * code doesn't have the bug of including TDLS in the 6884 * mask everywhere. 6885 */ 6886 if (params->sta_flags_mask & 6887 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6888 BIT(NL80211_STA_FLAG_MFP) | 6889 BIT(NL80211_STA_FLAG_AUTHORIZED))) 6890 return -EINVAL; 6891 break; 6892 case CFG80211_STA_TDLS_PEER_SETUP: 6893 case CFG80211_STA_TDLS_PEER_ACTIVE: 6894 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6895 return -EINVAL; 6896 /* ignore since it can't change */ 6897 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6898 break; 6899 default: 6900 /* disallow mesh-specific things */ 6901 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 6902 return -EINVAL; 6903 if (params->local_pm) 6904 return -EINVAL; 6905 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6906 return -EINVAL; 6907 } 6908 6909 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6910 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 6911 /* TDLS can't be set, ... */ 6912 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 6913 return -EINVAL; 6914 /* 6915 * ... but don't bother the driver with it. This works around 6916 * a hostapd/wpa_supplicant issue -- it always includes the 6917 * TLDS_PEER flag in the mask even for AP mode. 6918 */ 6919 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6920 } 6921 6922 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6923 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6924 /* reject other things that can't change */ 6925 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 6926 return -EINVAL; 6927 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 6928 return -EINVAL; 6929 if (params->link_sta_params.supported_rates) 6930 return -EINVAL; 6931 if (params->ext_capab || params->link_sta_params.ht_capa || 6932 params->link_sta_params.vht_capa || 6933 params->link_sta_params.he_capa || 6934 params->link_sta_params.eht_capa) 6935 return -EINVAL; 6936 } 6937 6938 if (statype != CFG80211_STA_AP_CLIENT && 6939 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6940 if (params->vlan) 6941 return -EINVAL; 6942 } 6943 6944 switch (statype) { 6945 case CFG80211_STA_AP_MLME_CLIENT: 6946 /* Use this only for authorizing/unauthorizing a station */ 6947 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 6948 return -EOPNOTSUPP; 6949 break; 6950 case CFG80211_STA_AP_CLIENT: 6951 case CFG80211_STA_AP_CLIENT_UNASSOC: 6952 /* accept only the listed bits */ 6953 if (params->sta_flags_mask & 6954 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6955 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6956 BIT(NL80211_STA_FLAG_ASSOCIATED) | 6957 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6958 BIT(NL80211_STA_FLAG_WME) | 6959 BIT(NL80211_STA_FLAG_MFP))) 6960 return -EINVAL; 6961 6962 /* but authenticated/associated only if driver handles it */ 6963 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6964 params->sta_flags_mask & 6965 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6966 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6967 return -EINVAL; 6968 break; 6969 case CFG80211_STA_IBSS: 6970 case CFG80211_STA_AP_STA: 6971 /* reject any changes other than AUTHORIZED */ 6972 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6973 return -EINVAL; 6974 break; 6975 case CFG80211_STA_TDLS_PEER_SETUP: 6976 /* reject any changes other than AUTHORIZED or WME */ 6977 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6978 BIT(NL80211_STA_FLAG_WME))) 6979 return -EINVAL; 6980 /* force (at least) rates when authorizing */ 6981 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6982 !params->link_sta_params.supported_rates) 6983 return -EINVAL; 6984 break; 6985 case CFG80211_STA_TDLS_PEER_ACTIVE: 6986 /* reject any changes */ 6987 return -EINVAL; 6988 case CFG80211_STA_MESH_PEER_KERNEL: 6989 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6990 return -EINVAL; 6991 break; 6992 case CFG80211_STA_MESH_PEER_USER: 6993 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6994 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6995 return -EINVAL; 6996 break; 6997 } 6998 6999 /* 7000 * Older kernel versions ignored this attribute entirely, so don't 7001 * reject attempts to update it but mark it as unused instead so the 7002 * driver won't look at the data. 7003 */ 7004 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 7005 statype != CFG80211_STA_TDLS_PEER_SETUP) 7006 params->link_sta_params.opmode_notif_used = false; 7007 7008 return 0; 7009 } 7010 EXPORT_SYMBOL(cfg80211_check_station_change); 7011 7012 /* 7013 * Get vlan interface making sure it is running and on the right wiphy. 7014 */ 7015 static struct net_device *get_vlan(struct genl_info *info, 7016 struct cfg80211_registered_device *rdev) 7017 { 7018 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 7019 struct net_device *v; 7020 int ret; 7021 7022 if (!vlanattr) 7023 return NULL; 7024 7025 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 7026 if (!v) 7027 return ERR_PTR(-ENODEV); 7028 7029 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 7030 ret = -EINVAL; 7031 goto error; 7032 } 7033 7034 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 7035 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7036 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 7037 ret = -EINVAL; 7038 goto error; 7039 } 7040 7041 if (!netif_running(v)) { 7042 ret = -ENETDOWN; 7043 goto error; 7044 } 7045 7046 return v; 7047 error: 7048 dev_put(v); 7049 return ERR_PTR(ret); 7050 } 7051 7052 static int nl80211_parse_sta_wme(struct genl_info *info, 7053 struct station_parameters *params) 7054 { 7055 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 7056 struct nlattr *nla; 7057 int err; 7058 7059 /* parse WME attributes if present */ 7060 if (!info->attrs[NL80211_ATTR_STA_WME]) 7061 return 0; 7062 7063 nla = info->attrs[NL80211_ATTR_STA_WME]; 7064 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 7065 nl80211_sta_wme_policy, 7066 info->extack); 7067 if (err) 7068 return err; 7069 7070 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 7071 params->uapsd_queues = nla_get_u8( 7072 tb[NL80211_STA_WME_UAPSD_QUEUES]); 7073 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 7074 return -EINVAL; 7075 7076 if (tb[NL80211_STA_WME_MAX_SP]) 7077 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 7078 7079 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 7080 return -EINVAL; 7081 7082 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 7083 7084 return 0; 7085 } 7086 7087 static int nl80211_parse_sta_channel_info(struct genl_info *info, 7088 struct station_parameters *params) 7089 { 7090 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 7091 params->supported_channels = 7092 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 7093 params->supported_channels_len = 7094 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 7095 /* 7096 * Need to include at least one (first channel, number of 7097 * channels) tuple for each subband (checked in policy), 7098 * and must have proper tuples for the rest of the data as well. 7099 */ 7100 if (params->supported_channels_len % 2) 7101 return -EINVAL; 7102 } 7103 7104 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 7105 params->supported_oper_classes = 7106 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 7107 params->supported_oper_classes_len = 7108 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 7109 } 7110 return 0; 7111 } 7112 7113 static int nl80211_set_station_tdls(struct genl_info *info, 7114 struct station_parameters *params) 7115 { 7116 int err; 7117 /* Dummy STA entry gets updated once the peer capabilities are known */ 7118 if (info->attrs[NL80211_ATTR_PEER_AID]) 7119 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 7120 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 7121 params->link_sta_params.ht_capa = 7122 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 7123 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 7124 params->link_sta_params.vht_capa = 7125 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 7126 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 7127 params->link_sta_params.he_capa = 7128 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7129 params->link_sta_params.he_capa_len = 7130 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7131 7132 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 7133 params->link_sta_params.eht_capa = 7134 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7135 params->link_sta_params.eht_capa_len = 7136 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7137 7138 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa, 7139 (const u8 *)params->link_sta_params.eht_capa, 7140 params->link_sta_params.eht_capa_len, 7141 false)) 7142 return -EINVAL; 7143 } 7144 } 7145 7146 err = nl80211_parse_sta_channel_info(info, params); 7147 if (err) 7148 return err; 7149 7150 return nl80211_parse_sta_wme(info, params); 7151 } 7152 7153 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 7154 struct sta_txpwr *txpwr, 7155 bool *txpwr_set) 7156 { 7157 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7158 int idx; 7159 7160 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 7161 if (!rdev->ops->set_tx_power || 7162 !wiphy_ext_feature_isset(&rdev->wiphy, 7163 NL80211_EXT_FEATURE_STA_TX_PWR)) 7164 return -EOPNOTSUPP; 7165 7166 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 7167 txpwr->type = nla_get_u8(info->attrs[idx]); 7168 7169 if (txpwr->type == NL80211_TX_POWER_LIMITED) { 7170 idx = NL80211_ATTR_STA_TX_POWER; 7171 7172 if (info->attrs[idx]) 7173 txpwr->power = nla_get_s16(info->attrs[idx]); 7174 else 7175 return -EINVAL; 7176 } 7177 7178 *txpwr_set = true; 7179 } else { 7180 *txpwr_set = false; 7181 } 7182 7183 return 0; 7184 } 7185 7186 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 7187 { 7188 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7189 struct net_device *dev = info->user_ptr[1]; 7190 struct station_parameters params; 7191 u8 *mac_addr; 7192 int err; 7193 7194 memset(¶ms, 0, sizeof(params)); 7195 7196 if (!rdev->ops->change_station) 7197 return -EOPNOTSUPP; 7198 7199 /* 7200 * AID and listen_interval properties can be set only for unassociated 7201 * station. Include these parameters here and will check them in 7202 * cfg80211_check_station_change(). 7203 */ 7204 if (info->attrs[NL80211_ATTR_STA_AID]) 7205 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7206 7207 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7208 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7209 7210 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7211 params.listen_interval = 7212 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7213 else 7214 params.listen_interval = -1; 7215 7216 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 7217 params.support_p2p_ps = 7218 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7219 else 7220 params.support_p2p_ps = -1; 7221 7222 if (!info->attrs[NL80211_ATTR_MAC]) 7223 return -EINVAL; 7224 7225 params.link_sta_params.link_id = 7226 nl80211_link_id_or_invalid(info->attrs); 7227 7228 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7229 /* If MLD_ADDR attribute is set then this is an MLD station 7230 * and the MLD_ADDR attribute holds the MLD address and the 7231 * MAC attribute holds for the LINK address. 7232 * In that case, the link_id is also expected to be valid. 7233 */ 7234 if (params.link_sta_params.link_id < 0) 7235 return -EINVAL; 7236 7237 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7238 params.link_sta_params.mld_mac = mac_addr; 7239 params.link_sta_params.link_mac = 7240 nla_data(info->attrs[NL80211_ATTR_MAC]); 7241 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7242 return -EINVAL; 7243 } else { 7244 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7245 } 7246 7247 7248 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 7249 params.link_sta_params.supported_rates = 7250 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7251 params.link_sta_params.supported_rates_len = 7252 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7253 } 7254 7255 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7256 params.capability = 7257 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7258 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7259 } 7260 7261 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7262 params.ext_capab = 7263 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7264 params.ext_capab_len = 7265 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7266 } 7267 7268 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7269 return -EINVAL; 7270 7271 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7272 params.plink_action = 7273 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7274 7275 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 7276 params.plink_state = 7277 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 7278 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 7279 params.peer_aid = nla_get_u16( 7280 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 7281 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 7282 } 7283 7284 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 7285 params.local_pm = nla_get_u32( 7286 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 7287 7288 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7289 params.link_sta_params.opmode_notif_used = true; 7290 params.link_sta_params.opmode_notif = 7291 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7292 } 7293 7294 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7295 params.link_sta_params.he_6ghz_capa = 7296 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7297 7298 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7299 params.airtime_weight = 7300 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7301 7302 if (params.airtime_weight && 7303 !wiphy_ext_feature_isset(&rdev->wiphy, 7304 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7305 return -EOPNOTSUPP; 7306 7307 err = nl80211_parse_sta_txpower_setting(info, 7308 ¶ms.link_sta_params.txpwr, 7309 ¶ms.link_sta_params.txpwr_set); 7310 if (err) 7311 return err; 7312 7313 /* Include parameters for TDLS peer (will check later) */ 7314 err = nl80211_set_station_tdls(info, ¶ms); 7315 if (err) 7316 return err; 7317 7318 params.vlan = get_vlan(info, rdev); 7319 if (IS_ERR(params.vlan)) 7320 return PTR_ERR(params.vlan); 7321 7322 switch (dev->ieee80211_ptr->iftype) { 7323 case NL80211_IFTYPE_AP: 7324 case NL80211_IFTYPE_AP_VLAN: 7325 case NL80211_IFTYPE_P2P_GO: 7326 case NL80211_IFTYPE_P2P_CLIENT: 7327 case NL80211_IFTYPE_STATION: 7328 case NL80211_IFTYPE_ADHOC: 7329 case NL80211_IFTYPE_MESH_POINT: 7330 break; 7331 default: 7332 err = -EOPNOTSUPP; 7333 goto out_put_vlan; 7334 } 7335 7336 /* driver will call cfg80211_check_station_change() */ 7337 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 7338 7339 out_put_vlan: 7340 dev_put(params.vlan); 7341 7342 return err; 7343 } 7344 7345 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 7346 { 7347 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7348 int err; 7349 struct net_device *dev = info->user_ptr[1]; 7350 struct wireless_dev *wdev = dev->ieee80211_ptr; 7351 struct station_parameters params; 7352 u8 *mac_addr = NULL; 7353 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 7354 BIT(NL80211_STA_FLAG_ASSOCIATED); 7355 7356 memset(¶ms, 0, sizeof(params)); 7357 7358 if (!rdev->ops->add_station) 7359 return -EOPNOTSUPP; 7360 7361 if (!info->attrs[NL80211_ATTR_MAC]) 7362 return -EINVAL; 7363 7364 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7365 return -EINVAL; 7366 7367 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 7368 return -EINVAL; 7369 7370 if (!info->attrs[NL80211_ATTR_STA_AID] && 7371 !info->attrs[NL80211_ATTR_PEER_AID]) 7372 return -EINVAL; 7373 7374 params.link_sta_params.link_id = 7375 nl80211_link_id_or_invalid(info->attrs); 7376 7377 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7378 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7379 params.link_sta_params.mld_mac = mac_addr; 7380 params.link_sta_params.link_mac = 7381 nla_data(info->attrs[NL80211_ATTR_MAC]); 7382 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7383 return -EINVAL; 7384 } else { 7385 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7386 } 7387 7388 params.link_sta_params.supported_rates = 7389 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7390 params.link_sta_params.supported_rates_len = 7391 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7392 params.listen_interval = 7393 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7394 7395 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7396 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7397 7398 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 7399 params.support_p2p_ps = 7400 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7401 } else { 7402 /* 7403 * if not specified, assume it's supported for P2P GO interface, 7404 * and is NOT supported for AP interface 7405 */ 7406 params.support_p2p_ps = 7407 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 7408 } 7409 7410 if (info->attrs[NL80211_ATTR_PEER_AID]) 7411 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 7412 else 7413 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7414 7415 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7416 params.capability = 7417 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7418 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7419 } 7420 7421 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7422 params.ext_capab = 7423 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7424 params.ext_capab_len = 7425 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7426 } 7427 7428 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 7429 params.link_sta_params.ht_capa = 7430 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 7431 7432 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 7433 params.link_sta_params.vht_capa = 7434 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 7435 7436 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 7437 params.link_sta_params.he_capa = 7438 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7439 params.link_sta_params.he_capa_len = 7440 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7441 7442 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 7443 params.link_sta_params.eht_capa = 7444 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7445 params.link_sta_params.eht_capa_len = 7446 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7447 7448 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa, 7449 (const u8 *)params.link_sta_params.eht_capa, 7450 params.link_sta_params.eht_capa_len, 7451 false)) 7452 return -EINVAL; 7453 } 7454 } 7455 7456 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7457 params.link_sta_params.he_6ghz_capa = 7458 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7459 7460 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7461 params.link_sta_params.opmode_notif_used = true; 7462 params.link_sta_params.opmode_notif = 7463 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7464 } 7465 7466 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7467 params.plink_action = 7468 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7469 7470 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7471 params.airtime_weight = 7472 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7473 7474 if (params.airtime_weight && 7475 !wiphy_ext_feature_isset(&rdev->wiphy, 7476 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7477 return -EOPNOTSUPP; 7478 7479 err = nl80211_parse_sta_txpower_setting(info, 7480 ¶ms.link_sta_params.txpwr, 7481 ¶ms.link_sta_params.txpwr_set); 7482 if (err) 7483 return err; 7484 7485 err = nl80211_parse_sta_channel_info(info, ¶ms); 7486 if (err) 7487 return err; 7488 7489 err = nl80211_parse_sta_wme(info, ¶ms); 7490 if (err) 7491 return err; 7492 7493 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7494 return -EINVAL; 7495 7496 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 7497 * as userspace might just pass through the capabilities from the IEs 7498 * directly, rather than enforcing this restriction and returning an 7499 * error in this case. 7500 */ 7501 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 7502 params.link_sta_params.ht_capa = NULL; 7503 params.link_sta_params.vht_capa = NULL; 7504 7505 /* HE and EHT require WME */ 7506 if (params.link_sta_params.he_capa_len || 7507 params.link_sta_params.he_6ghz_capa || 7508 params.link_sta_params.eht_capa_len) 7509 return -EINVAL; 7510 } 7511 7512 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 7513 if (params.link_sta_params.he_6ghz_capa && 7514 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa)) 7515 return -EINVAL; 7516 7517 /* When you run into this, adjust the code below for the new flag */ 7518 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 7519 7520 switch (dev->ieee80211_ptr->iftype) { 7521 case NL80211_IFTYPE_AP: 7522 case NL80211_IFTYPE_AP_VLAN: 7523 case NL80211_IFTYPE_P2P_GO: 7524 /* ignore WME attributes if iface/sta is not capable */ 7525 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 7526 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 7527 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7528 7529 /* TDLS peers cannot be added */ 7530 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7531 info->attrs[NL80211_ATTR_PEER_AID]) 7532 return -EINVAL; 7533 /* but don't bother the driver with it */ 7534 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 7535 7536 /* allow authenticated/associated only if driver handles it */ 7537 if (!(rdev->wiphy.features & 7538 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 7539 params.sta_flags_mask & auth_assoc) 7540 return -EINVAL; 7541 7542 /* Older userspace, or userspace wanting to be compatible with 7543 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 7544 * and assoc flags in the mask, but assumes the station will be 7545 * added as associated anyway since this was the required driver 7546 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 7547 * introduced. 7548 * In order to not bother drivers with this quirk in the API 7549 * set the flags in both the mask and set for new stations in 7550 * this case. 7551 */ 7552 if (!(params.sta_flags_mask & auth_assoc)) { 7553 params.sta_flags_mask |= auth_assoc; 7554 params.sta_flags_set |= auth_assoc; 7555 } 7556 7557 /* must be last in here for error handling */ 7558 params.vlan = get_vlan(info, rdev); 7559 if (IS_ERR(params.vlan)) 7560 return PTR_ERR(params.vlan); 7561 break; 7562 case NL80211_IFTYPE_MESH_POINT: 7563 /* ignore uAPSD data */ 7564 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7565 7566 /* associated is disallowed */ 7567 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 7568 return -EINVAL; 7569 /* TDLS peers cannot be added */ 7570 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7571 info->attrs[NL80211_ATTR_PEER_AID]) 7572 return -EINVAL; 7573 break; 7574 case NL80211_IFTYPE_STATION: 7575 case NL80211_IFTYPE_P2P_CLIENT: 7576 /* ignore uAPSD data */ 7577 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7578 7579 /* these are disallowed */ 7580 if (params.sta_flags_mask & 7581 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 7582 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 7583 return -EINVAL; 7584 /* Only TDLS peers can be added */ 7585 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 7586 return -EINVAL; 7587 /* Can only add if TDLS ... */ 7588 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 7589 return -EOPNOTSUPP; 7590 /* ... with external setup is supported */ 7591 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 7592 return -EOPNOTSUPP; 7593 /* 7594 * Older wpa_supplicant versions always mark the TDLS peer 7595 * as authorized, but it shouldn't yet be. 7596 */ 7597 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 7598 break; 7599 default: 7600 return -EOPNOTSUPP; 7601 } 7602 7603 /* be aware of params.vlan when changing code here */ 7604 7605 if (wdev->valid_links) { 7606 if (params.link_sta_params.link_id < 0) { 7607 err = -EINVAL; 7608 goto out; 7609 } 7610 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) { 7611 err = -ENOLINK; 7612 goto out; 7613 } 7614 } else { 7615 if (params.link_sta_params.link_id >= 0) { 7616 err = -EINVAL; 7617 goto out; 7618 } 7619 } 7620 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 7621 out: 7622 dev_put(params.vlan); 7623 return err; 7624 } 7625 7626 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 7627 { 7628 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7629 struct net_device *dev = info->user_ptr[1]; 7630 struct station_del_parameters params; 7631 7632 memset(¶ms, 0, sizeof(params)); 7633 7634 if (info->attrs[NL80211_ATTR_MAC]) 7635 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 7636 7637 switch (dev->ieee80211_ptr->iftype) { 7638 case NL80211_IFTYPE_AP: 7639 case NL80211_IFTYPE_AP_VLAN: 7640 case NL80211_IFTYPE_MESH_POINT: 7641 case NL80211_IFTYPE_P2P_GO: 7642 /* always accept these */ 7643 break; 7644 case NL80211_IFTYPE_ADHOC: 7645 /* conditionally accept */ 7646 if (wiphy_ext_feature_isset(&rdev->wiphy, 7647 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 7648 break; 7649 return -EINVAL; 7650 default: 7651 return -EINVAL; 7652 } 7653 7654 if (!rdev->ops->del_station) 7655 return -EOPNOTSUPP; 7656 7657 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 7658 params.subtype = 7659 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 7660 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 7661 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 7662 return -EINVAL; 7663 } else { 7664 /* Default to Deauthentication frame */ 7665 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 7666 } 7667 7668 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 7669 params.reason_code = 7670 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 7671 if (params.reason_code == 0) 7672 return -EINVAL; /* 0 is reserved */ 7673 } else { 7674 /* Default to reason code 2 */ 7675 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 7676 } 7677 7678 return rdev_del_station(rdev, dev, ¶ms); 7679 } 7680 7681 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 7682 int flags, struct net_device *dev, 7683 u8 *dst, u8 *next_hop, 7684 struct mpath_info *pinfo) 7685 { 7686 void *hdr; 7687 struct nlattr *pinfoattr; 7688 7689 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 7690 if (!hdr) 7691 return -1; 7692 7693 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7694 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 7695 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 7696 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 7697 goto nla_put_failure; 7698 7699 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 7700 if (!pinfoattr) 7701 goto nla_put_failure; 7702 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 7703 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 7704 pinfo->frame_qlen)) 7705 goto nla_put_failure; 7706 if (((pinfo->filled & MPATH_INFO_SN) && 7707 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 7708 ((pinfo->filled & MPATH_INFO_METRIC) && 7709 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 7710 pinfo->metric)) || 7711 ((pinfo->filled & MPATH_INFO_EXPTIME) && 7712 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 7713 pinfo->exptime)) || 7714 ((pinfo->filled & MPATH_INFO_FLAGS) && 7715 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 7716 pinfo->flags)) || 7717 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 7718 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 7719 pinfo->discovery_timeout)) || 7720 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 7721 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 7722 pinfo->discovery_retries)) || 7723 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 7724 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 7725 pinfo->hop_count)) || 7726 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 7727 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 7728 pinfo->path_change_count))) 7729 goto nla_put_failure; 7730 7731 nla_nest_end(msg, pinfoattr); 7732 7733 genlmsg_end(msg, hdr); 7734 return 0; 7735 7736 nla_put_failure: 7737 genlmsg_cancel(msg, hdr); 7738 return -EMSGSIZE; 7739 } 7740 7741 static int nl80211_dump_mpath(struct sk_buff *skb, 7742 struct netlink_callback *cb) 7743 { 7744 struct mpath_info pinfo; 7745 struct cfg80211_registered_device *rdev; 7746 struct wireless_dev *wdev; 7747 u8 dst[ETH_ALEN]; 7748 u8 next_hop[ETH_ALEN]; 7749 int path_idx = cb->args[2]; 7750 int err; 7751 7752 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7753 if (err) 7754 return err; 7755 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7756 __acquire(&rdev->wiphy.mtx); 7757 7758 if (!rdev->ops->dump_mpath) { 7759 err = -EOPNOTSUPP; 7760 goto out_err; 7761 } 7762 7763 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7764 err = -EOPNOTSUPP; 7765 goto out_err; 7766 } 7767 7768 while (1) { 7769 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 7770 next_hop, &pinfo); 7771 if (err == -ENOENT) 7772 break; 7773 if (err) 7774 goto out_err; 7775 7776 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7777 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7778 wdev->netdev, dst, next_hop, 7779 &pinfo) < 0) 7780 goto out; 7781 7782 path_idx++; 7783 } 7784 7785 out: 7786 cb->args[2] = path_idx; 7787 err = skb->len; 7788 out_err: 7789 wiphy_unlock(&rdev->wiphy); 7790 return err; 7791 } 7792 7793 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 7794 { 7795 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7796 int err; 7797 struct net_device *dev = info->user_ptr[1]; 7798 struct mpath_info pinfo; 7799 struct sk_buff *msg; 7800 u8 *dst = NULL; 7801 u8 next_hop[ETH_ALEN]; 7802 7803 memset(&pinfo, 0, sizeof(pinfo)); 7804 7805 if (!info->attrs[NL80211_ATTR_MAC]) 7806 return -EINVAL; 7807 7808 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7809 7810 if (!rdev->ops->get_mpath) 7811 return -EOPNOTSUPP; 7812 7813 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7814 return -EOPNOTSUPP; 7815 7816 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 7817 if (err) 7818 return err; 7819 7820 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7821 if (!msg) 7822 return -ENOMEM; 7823 7824 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7825 dev, dst, next_hop, &pinfo) < 0) { 7826 nlmsg_free(msg); 7827 return -ENOBUFS; 7828 } 7829 7830 return genlmsg_reply(msg, info); 7831 } 7832 7833 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 7834 { 7835 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7836 struct net_device *dev = info->user_ptr[1]; 7837 u8 *dst = NULL; 7838 u8 *next_hop = NULL; 7839 7840 if (!info->attrs[NL80211_ATTR_MAC]) 7841 return -EINVAL; 7842 7843 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7844 return -EINVAL; 7845 7846 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7847 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7848 7849 if (!rdev->ops->change_mpath) 7850 return -EOPNOTSUPP; 7851 7852 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7853 return -EOPNOTSUPP; 7854 7855 return rdev_change_mpath(rdev, dev, dst, next_hop); 7856 } 7857 7858 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 7859 { 7860 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7861 struct net_device *dev = info->user_ptr[1]; 7862 u8 *dst = NULL; 7863 u8 *next_hop = NULL; 7864 7865 if (!info->attrs[NL80211_ATTR_MAC]) 7866 return -EINVAL; 7867 7868 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7869 return -EINVAL; 7870 7871 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7872 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7873 7874 if (!rdev->ops->add_mpath) 7875 return -EOPNOTSUPP; 7876 7877 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7878 return -EOPNOTSUPP; 7879 7880 return rdev_add_mpath(rdev, dev, dst, next_hop); 7881 } 7882 7883 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 7884 { 7885 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7886 struct net_device *dev = info->user_ptr[1]; 7887 u8 *dst = NULL; 7888 7889 if (info->attrs[NL80211_ATTR_MAC]) 7890 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7891 7892 if (!rdev->ops->del_mpath) 7893 return -EOPNOTSUPP; 7894 7895 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7896 return -EOPNOTSUPP; 7897 7898 return rdev_del_mpath(rdev, dev, dst); 7899 } 7900 7901 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 7902 { 7903 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7904 int err; 7905 struct net_device *dev = info->user_ptr[1]; 7906 struct mpath_info pinfo; 7907 struct sk_buff *msg; 7908 u8 *dst = NULL; 7909 u8 mpp[ETH_ALEN]; 7910 7911 memset(&pinfo, 0, sizeof(pinfo)); 7912 7913 if (!info->attrs[NL80211_ATTR_MAC]) 7914 return -EINVAL; 7915 7916 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7917 7918 if (!rdev->ops->get_mpp) 7919 return -EOPNOTSUPP; 7920 7921 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7922 return -EOPNOTSUPP; 7923 7924 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 7925 if (err) 7926 return err; 7927 7928 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7929 if (!msg) 7930 return -ENOMEM; 7931 7932 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7933 dev, dst, mpp, &pinfo) < 0) { 7934 nlmsg_free(msg); 7935 return -ENOBUFS; 7936 } 7937 7938 return genlmsg_reply(msg, info); 7939 } 7940 7941 static int nl80211_dump_mpp(struct sk_buff *skb, 7942 struct netlink_callback *cb) 7943 { 7944 struct mpath_info pinfo; 7945 struct cfg80211_registered_device *rdev; 7946 struct wireless_dev *wdev; 7947 u8 dst[ETH_ALEN]; 7948 u8 mpp[ETH_ALEN]; 7949 int path_idx = cb->args[2]; 7950 int err; 7951 7952 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7953 if (err) 7954 return err; 7955 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7956 __acquire(&rdev->wiphy.mtx); 7957 7958 if (!rdev->ops->dump_mpp) { 7959 err = -EOPNOTSUPP; 7960 goto out_err; 7961 } 7962 7963 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7964 err = -EOPNOTSUPP; 7965 goto out_err; 7966 } 7967 7968 while (1) { 7969 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 7970 mpp, &pinfo); 7971 if (err == -ENOENT) 7972 break; 7973 if (err) 7974 goto out_err; 7975 7976 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7977 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7978 wdev->netdev, dst, mpp, 7979 &pinfo) < 0) 7980 goto out; 7981 7982 path_idx++; 7983 } 7984 7985 out: 7986 cb->args[2] = path_idx; 7987 err = skb->len; 7988 out_err: 7989 wiphy_unlock(&rdev->wiphy); 7990 return err; 7991 } 7992 7993 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 7994 { 7995 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7996 struct net_device *dev = info->user_ptr[1]; 7997 struct bss_parameters params; 7998 7999 memset(¶ms, 0, sizeof(params)); 8000 params.link_id = nl80211_link_id_or_invalid(info->attrs); 8001 /* default to not changing parameters */ 8002 params.use_cts_prot = -1; 8003 params.use_short_preamble = -1; 8004 params.use_short_slot_time = -1; 8005 params.ap_isolate = -1; 8006 params.ht_opmode = -1; 8007 params.p2p_ctwindow = -1; 8008 params.p2p_opp_ps = -1; 8009 8010 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 8011 params.use_cts_prot = 8012 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 8013 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 8014 params.use_short_preamble = 8015 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 8016 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 8017 params.use_short_slot_time = 8018 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 8019 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8020 params.basic_rates = 8021 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8022 params.basic_rates_len = 8023 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8024 } 8025 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 8026 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 8027 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 8028 params.ht_opmode = 8029 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 8030 8031 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 8032 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8033 return -EINVAL; 8034 params.p2p_ctwindow = 8035 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 8036 if (params.p2p_ctwindow != 0 && 8037 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 8038 return -EINVAL; 8039 } 8040 8041 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 8042 u8 tmp; 8043 8044 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8045 return -EINVAL; 8046 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 8047 params.p2p_opp_ps = tmp; 8048 if (params.p2p_opp_ps && 8049 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 8050 return -EINVAL; 8051 } 8052 8053 if (!rdev->ops->change_bss) 8054 return -EOPNOTSUPP; 8055 8056 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 8057 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8058 return -EOPNOTSUPP; 8059 8060 return rdev_change_bss(rdev, dev, ¶ms); 8061 } 8062 8063 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 8064 { 8065 char *data = NULL; 8066 bool is_indoor; 8067 enum nl80211_user_reg_hint_type user_reg_hint_type; 8068 u32 owner_nlportid; 8069 8070 /* 8071 * You should only get this when cfg80211 hasn't yet initialized 8072 * completely when built-in to the kernel right between the time 8073 * window between nl80211_init() and regulatory_init(), if that is 8074 * even possible. 8075 */ 8076 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 8077 return -EINPROGRESS; 8078 8079 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 8080 user_reg_hint_type = 8081 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 8082 else 8083 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 8084 8085 switch (user_reg_hint_type) { 8086 case NL80211_USER_REG_HINT_USER: 8087 case NL80211_USER_REG_HINT_CELL_BASE: 8088 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 8089 return -EINVAL; 8090 8091 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 8092 return regulatory_hint_user(data, user_reg_hint_type); 8093 case NL80211_USER_REG_HINT_INDOOR: 8094 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8095 owner_nlportid = info->snd_portid; 8096 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 8097 } else { 8098 owner_nlportid = 0; 8099 is_indoor = true; 8100 } 8101 8102 return regulatory_hint_indoor(is_indoor, owner_nlportid); 8103 default: 8104 return -EINVAL; 8105 } 8106 } 8107 8108 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 8109 { 8110 return reg_reload_regdb(); 8111 } 8112 8113 static int nl80211_get_mesh_config(struct sk_buff *skb, 8114 struct genl_info *info) 8115 { 8116 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8117 struct net_device *dev = info->user_ptr[1]; 8118 struct wireless_dev *wdev = dev->ieee80211_ptr; 8119 struct mesh_config cur_params; 8120 int err = 0; 8121 void *hdr; 8122 struct nlattr *pinfoattr; 8123 struct sk_buff *msg; 8124 8125 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8126 return -EOPNOTSUPP; 8127 8128 if (!rdev->ops->get_mesh_config) 8129 return -EOPNOTSUPP; 8130 8131 /* If not connected, get default parameters */ 8132 if (!wdev->u.mesh.id_len) 8133 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 8134 else 8135 err = rdev_get_mesh_config(rdev, dev, &cur_params); 8136 8137 if (err) 8138 return err; 8139 8140 /* Draw up a netlink message to send back */ 8141 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8142 if (!msg) 8143 return -ENOMEM; 8144 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8145 NL80211_CMD_GET_MESH_CONFIG); 8146 if (!hdr) 8147 goto out; 8148 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 8149 if (!pinfoattr) 8150 goto nla_put_failure; 8151 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 8152 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 8153 cur_params.dot11MeshRetryTimeout) || 8154 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 8155 cur_params.dot11MeshConfirmTimeout) || 8156 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 8157 cur_params.dot11MeshHoldingTimeout) || 8158 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 8159 cur_params.dot11MeshMaxPeerLinks) || 8160 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 8161 cur_params.dot11MeshMaxRetries) || 8162 nla_put_u8(msg, NL80211_MESHCONF_TTL, 8163 cur_params.dot11MeshTTL) || 8164 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 8165 cur_params.element_ttl) || 8166 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8167 cur_params.auto_open_plinks) || 8168 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8169 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 8170 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8171 cur_params.dot11MeshHWMPmaxPREQretries) || 8172 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 8173 cur_params.path_refresh_time) || 8174 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8175 cur_params.min_discovery_timeout) || 8176 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8177 cur_params.dot11MeshHWMPactivePathTimeout) || 8178 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8179 cur_params.dot11MeshHWMPpreqMinInterval) || 8180 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8181 cur_params.dot11MeshHWMPperrMinInterval) || 8182 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8183 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 8184 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 8185 cur_params.dot11MeshHWMPRootMode) || 8186 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8187 cur_params.dot11MeshHWMPRannInterval) || 8188 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8189 cur_params.dot11MeshGateAnnouncementProtocol) || 8190 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 8191 cur_params.dot11MeshForwarding) || 8192 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 8193 cur_params.rssi_threshold) || 8194 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 8195 cur_params.ht_opmode) || 8196 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8197 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 8198 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8199 cur_params.dot11MeshHWMProotInterval) || 8200 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8201 cur_params.dot11MeshHWMPconfirmationInterval) || 8202 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 8203 cur_params.power_mode) || 8204 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 8205 cur_params.dot11MeshAwakeWindowDuration) || 8206 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 8207 cur_params.plink_timeout) || 8208 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 8209 cur_params.dot11MeshConnectedToMeshGate) || 8210 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 8211 cur_params.dot11MeshNolearn) || 8212 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 8213 cur_params.dot11MeshConnectedToAuthServer)) 8214 goto nla_put_failure; 8215 nla_nest_end(msg, pinfoattr); 8216 genlmsg_end(msg, hdr); 8217 return genlmsg_reply(msg, info); 8218 8219 nla_put_failure: 8220 out: 8221 nlmsg_free(msg); 8222 return -ENOBUFS; 8223 } 8224 8225 static const struct nla_policy 8226 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 8227 [NL80211_MESHCONF_RETRY_TIMEOUT] = 8228 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8229 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 8230 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8231 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 8232 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8233 [NL80211_MESHCONF_MAX_PEER_LINKS] = 8234 NLA_POLICY_RANGE(NLA_U16, 0, 255), 8235 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 8236 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8237 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8238 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 8239 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 8240 NLA_POLICY_RANGE(NLA_U32, 1, 255), 8241 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 8242 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 8243 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 8244 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 8245 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 8246 NLA_POLICY_MIN(NLA_U16, 1), 8247 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 8248 NLA_POLICY_MIN(NLA_U16, 1), 8249 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 8250 NLA_POLICY_MIN(NLA_U16, 1), 8251 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 8252 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 8253 NLA_POLICY_MIN(NLA_U16, 1), 8254 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 8255 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 8256 [NL80211_MESHCONF_RSSI_THRESHOLD] = 8257 NLA_POLICY_RANGE(NLA_S32, -255, 0), 8258 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 8259 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 8260 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 8261 NLA_POLICY_MIN(NLA_U16, 1), 8262 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 8263 NLA_POLICY_MIN(NLA_U16, 1), 8264 [NL80211_MESHCONF_POWER_MODE] = 8265 NLA_POLICY_RANGE(NLA_U32, 8266 NL80211_MESH_POWER_ACTIVE, 8267 NL80211_MESH_POWER_MAX), 8268 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 8269 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 8270 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8271 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8272 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8273 }; 8274 8275 static const struct nla_policy 8276 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 8277 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 8278 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 8279 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 8280 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 8281 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 8282 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 8283 [NL80211_MESH_SETUP_IE] = 8284 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 8285 IEEE80211_MAX_DATA_LEN), 8286 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 8287 }; 8288 8289 static int nl80211_parse_mesh_config(struct genl_info *info, 8290 struct mesh_config *cfg, 8291 u32 *mask_out) 8292 { 8293 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 8294 u32 mask = 0; 8295 u16 ht_opmode; 8296 8297 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 8298 do { \ 8299 if (tb[attr]) { \ 8300 cfg->param = fn(tb[attr]); \ 8301 mask |= BIT((attr) - 1); \ 8302 } \ 8303 } while (0) 8304 8305 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 8306 return -EINVAL; 8307 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 8308 return -EINVAL; 8309 8310 /* This makes sure that there aren't more than 32 mesh config 8311 * parameters (otherwise our bitfield scheme would not work.) */ 8312 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 8313 8314 /* Fill in the params struct */ 8315 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 8316 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 8317 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 8318 NL80211_MESHCONF_CONFIRM_TIMEOUT, 8319 nla_get_u16); 8320 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 8321 NL80211_MESHCONF_HOLDING_TIMEOUT, 8322 nla_get_u16); 8323 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 8324 NL80211_MESHCONF_MAX_PEER_LINKS, 8325 nla_get_u16); 8326 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 8327 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 8328 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 8329 NL80211_MESHCONF_TTL, nla_get_u8); 8330 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 8331 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 8332 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 8333 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8334 nla_get_u8); 8335 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 8336 mask, 8337 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8338 nla_get_u32); 8339 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 8340 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8341 nla_get_u8); 8342 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 8343 NL80211_MESHCONF_PATH_REFRESH_TIME, 8344 nla_get_u32); 8345 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 8346 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 8347 return -EINVAL; 8348 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 8349 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8350 nla_get_u16); 8351 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 8352 mask, 8353 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8354 nla_get_u32); 8355 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 8356 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 8357 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 8358 return -EINVAL; 8359 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 8360 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8361 nla_get_u16); 8362 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 8363 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8364 nla_get_u16); 8365 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8366 dot11MeshHWMPnetDiameterTraversalTime, mask, 8367 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8368 nla_get_u16); 8369 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 8370 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 8371 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 8372 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8373 nla_get_u16); 8374 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 8375 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8376 nla_get_u8); 8377 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 8378 NL80211_MESHCONF_FORWARDING, nla_get_u8); 8379 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 8380 NL80211_MESHCONF_RSSI_THRESHOLD, 8381 nla_get_s32); 8382 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 8383 NL80211_MESHCONF_CONNECTED_TO_GATE, 8384 nla_get_u8); 8385 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 8386 NL80211_MESHCONF_CONNECTED_TO_AS, 8387 nla_get_u8); 8388 /* 8389 * Check HT operation mode based on 8390 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 8391 */ 8392 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 8393 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 8394 8395 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 8396 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 8397 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 8398 return -EINVAL; 8399 8400 /* NON_HT_STA bit is reserved, but some programs set it */ 8401 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 8402 8403 cfg->ht_opmode = ht_opmode; 8404 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 8405 } 8406 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8407 dot11MeshHWMPactivePathToRootTimeout, mask, 8408 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8409 nla_get_u32); 8410 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 8411 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 8412 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 8413 return -EINVAL; 8414 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 8415 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8416 nla_get_u16); 8417 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 8418 mask, 8419 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8420 nla_get_u16); 8421 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 8422 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 8423 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 8424 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 8425 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 8426 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 8427 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 8428 NL80211_MESHCONF_NOLEARN, nla_get_u8); 8429 if (mask_out) 8430 *mask_out = mask; 8431 8432 return 0; 8433 8434 #undef FILL_IN_MESH_PARAM_IF_SET 8435 } 8436 8437 static int nl80211_parse_mesh_setup(struct genl_info *info, 8438 struct mesh_setup *setup) 8439 { 8440 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8441 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 8442 8443 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 8444 return -EINVAL; 8445 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 8446 return -EINVAL; 8447 8448 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 8449 setup->sync_method = 8450 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 8451 IEEE80211_SYNC_METHOD_VENDOR : 8452 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 8453 8454 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 8455 setup->path_sel_proto = 8456 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 8457 IEEE80211_PATH_PROTOCOL_VENDOR : 8458 IEEE80211_PATH_PROTOCOL_HWMP; 8459 8460 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 8461 setup->path_metric = 8462 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 8463 IEEE80211_PATH_METRIC_VENDOR : 8464 IEEE80211_PATH_METRIC_AIRTIME; 8465 8466 if (tb[NL80211_MESH_SETUP_IE]) { 8467 struct nlattr *ieattr = 8468 tb[NL80211_MESH_SETUP_IE]; 8469 setup->ie = nla_data(ieattr); 8470 setup->ie_len = nla_len(ieattr); 8471 } 8472 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 8473 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 8474 return -EINVAL; 8475 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 8476 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 8477 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 8478 if (setup->is_secure) 8479 setup->user_mpm = true; 8480 8481 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 8482 if (!setup->user_mpm) 8483 return -EINVAL; 8484 setup->auth_id = 8485 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 8486 } 8487 8488 return 0; 8489 } 8490 8491 static int nl80211_update_mesh_config(struct sk_buff *skb, 8492 struct genl_info *info) 8493 { 8494 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8495 struct net_device *dev = info->user_ptr[1]; 8496 struct wireless_dev *wdev = dev->ieee80211_ptr; 8497 struct mesh_config cfg = {}; 8498 u32 mask; 8499 int err; 8500 8501 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8502 return -EOPNOTSUPP; 8503 8504 if (!rdev->ops->update_mesh_config) 8505 return -EOPNOTSUPP; 8506 8507 err = nl80211_parse_mesh_config(info, &cfg, &mask); 8508 if (err) 8509 return err; 8510 8511 if (!wdev->u.mesh.id_len) 8512 err = -ENOLINK; 8513 8514 if (!err) 8515 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 8516 8517 return err; 8518 } 8519 8520 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 8521 struct sk_buff *msg) 8522 { 8523 struct nlattr *nl_reg_rules; 8524 unsigned int i; 8525 8526 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 8527 (regdom->dfs_region && 8528 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 8529 goto nla_put_failure; 8530 8531 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 8532 if (!nl_reg_rules) 8533 goto nla_put_failure; 8534 8535 for (i = 0; i < regdom->n_reg_rules; i++) { 8536 struct nlattr *nl_reg_rule; 8537 const struct ieee80211_reg_rule *reg_rule; 8538 const struct ieee80211_freq_range *freq_range; 8539 const struct ieee80211_power_rule *power_rule; 8540 unsigned int max_bandwidth_khz; 8541 8542 reg_rule = ®dom->reg_rules[i]; 8543 freq_range = ®_rule->freq_range; 8544 power_rule = ®_rule->power_rule; 8545 8546 nl_reg_rule = nla_nest_start_noflag(msg, i); 8547 if (!nl_reg_rule) 8548 goto nla_put_failure; 8549 8550 max_bandwidth_khz = freq_range->max_bandwidth_khz; 8551 if (!max_bandwidth_khz) 8552 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 8553 reg_rule); 8554 8555 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 8556 reg_rule->flags) || 8557 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 8558 freq_range->start_freq_khz) || 8559 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 8560 freq_range->end_freq_khz) || 8561 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 8562 max_bandwidth_khz) || 8563 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 8564 power_rule->max_antenna_gain) || 8565 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 8566 power_rule->max_eirp) || 8567 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 8568 reg_rule->dfs_cac_ms)) 8569 goto nla_put_failure; 8570 8571 if ((reg_rule->flags & NL80211_RRF_PSD) && 8572 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD, 8573 reg_rule->psd)) 8574 goto nla_put_failure; 8575 8576 nla_nest_end(msg, nl_reg_rule); 8577 } 8578 8579 nla_nest_end(msg, nl_reg_rules); 8580 return 0; 8581 8582 nla_put_failure: 8583 return -EMSGSIZE; 8584 } 8585 8586 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 8587 { 8588 const struct ieee80211_regdomain *regdom = NULL; 8589 struct cfg80211_registered_device *rdev; 8590 struct wiphy *wiphy = NULL; 8591 struct sk_buff *msg; 8592 int err = -EMSGSIZE; 8593 void *hdr; 8594 8595 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8596 if (!msg) 8597 return -ENOBUFS; 8598 8599 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8600 NL80211_CMD_GET_REG); 8601 if (!hdr) 8602 goto put_failure; 8603 8604 rtnl_lock(); 8605 8606 if (info->attrs[NL80211_ATTR_WIPHY]) { 8607 bool self_managed; 8608 8609 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 8610 if (IS_ERR(rdev)) { 8611 err = PTR_ERR(rdev); 8612 goto nla_put_failure; 8613 } 8614 8615 wiphy = &rdev->wiphy; 8616 self_managed = wiphy->regulatory_flags & 8617 REGULATORY_WIPHY_SELF_MANAGED; 8618 8619 rcu_read_lock(); 8620 8621 regdom = get_wiphy_regdom(wiphy); 8622 8623 /* a self-managed-reg device must have a private regdom */ 8624 if (WARN_ON(!regdom && self_managed)) { 8625 err = -EINVAL; 8626 goto nla_put_failure_rcu; 8627 } 8628 8629 if (regdom && 8630 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8631 goto nla_put_failure_rcu; 8632 } else { 8633 rcu_read_lock(); 8634 } 8635 8636 if (!wiphy && reg_last_request_cell_base() && 8637 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8638 NL80211_USER_REG_HINT_CELL_BASE)) 8639 goto nla_put_failure_rcu; 8640 8641 if (!regdom) 8642 regdom = rcu_dereference(cfg80211_regdomain); 8643 8644 if (nl80211_put_regdom(regdom, msg)) 8645 goto nla_put_failure_rcu; 8646 8647 rcu_read_unlock(); 8648 8649 genlmsg_end(msg, hdr); 8650 rtnl_unlock(); 8651 return genlmsg_reply(msg, info); 8652 8653 nla_put_failure_rcu: 8654 rcu_read_unlock(); 8655 nla_put_failure: 8656 rtnl_unlock(); 8657 put_failure: 8658 nlmsg_free(msg); 8659 return err; 8660 } 8661 8662 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 8663 u32 seq, int flags, struct wiphy *wiphy, 8664 const struct ieee80211_regdomain *regdom) 8665 { 8666 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 8667 NL80211_CMD_GET_REG); 8668 8669 if (!hdr) 8670 return -1; 8671 8672 genl_dump_check_consistent(cb, hdr); 8673 8674 if (nl80211_put_regdom(regdom, msg)) 8675 goto nla_put_failure; 8676 8677 if (!wiphy && reg_last_request_cell_base() && 8678 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8679 NL80211_USER_REG_HINT_CELL_BASE)) 8680 goto nla_put_failure; 8681 8682 if (wiphy && 8683 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8684 goto nla_put_failure; 8685 8686 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 8687 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 8688 goto nla_put_failure; 8689 8690 genlmsg_end(msg, hdr); 8691 return 0; 8692 8693 nla_put_failure: 8694 genlmsg_cancel(msg, hdr); 8695 return -EMSGSIZE; 8696 } 8697 8698 static int nl80211_get_reg_dump(struct sk_buff *skb, 8699 struct netlink_callback *cb) 8700 { 8701 const struct ieee80211_regdomain *regdom = NULL; 8702 struct cfg80211_registered_device *rdev; 8703 int err, reg_idx, start = cb->args[2]; 8704 8705 rcu_read_lock(); 8706 8707 if (cfg80211_regdomain && start == 0) { 8708 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8709 NLM_F_MULTI, NULL, 8710 rcu_dereference(cfg80211_regdomain)); 8711 if (err < 0) 8712 goto out_err; 8713 } 8714 8715 /* the global regdom is idx 0 */ 8716 reg_idx = 1; 8717 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 8718 regdom = get_wiphy_regdom(&rdev->wiphy); 8719 if (!regdom) 8720 continue; 8721 8722 if (++reg_idx <= start) 8723 continue; 8724 8725 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8726 NLM_F_MULTI, &rdev->wiphy, regdom); 8727 if (err < 0) { 8728 reg_idx--; 8729 break; 8730 } 8731 } 8732 8733 cb->args[2] = reg_idx; 8734 err = skb->len; 8735 out_err: 8736 rcu_read_unlock(); 8737 return err; 8738 } 8739 8740 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 8741 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 8742 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 8743 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 8744 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 8745 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 8746 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 8747 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 8748 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 8749 }; 8750 8751 static int parse_reg_rule(struct nlattr *tb[], 8752 struct ieee80211_reg_rule *reg_rule) 8753 { 8754 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 8755 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 8756 8757 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 8758 return -EINVAL; 8759 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 8760 return -EINVAL; 8761 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 8762 return -EINVAL; 8763 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 8764 return -EINVAL; 8765 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 8766 return -EINVAL; 8767 8768 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 8769 8770 freq_range->start_freq_khz = 8771 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 8772 freq_range->end_freq_khz = 8773 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 8774 freq_range->max_bandwidth_khz = 8775 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 8776 8777 power_rule->max_eirp = 8778 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 8779 8780 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 8781 power_rule->max_antenna_gain = 8782 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 8783 8784 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 8785 reg_rule->dfs_cac_ms = 8786 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 8787 8788 return 0; 8789 } 8790 8791 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 8792 { 8793 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 8794 struct nlattr *nl_reg_rule; 8795 char *alpha2; 8796 int rem_reg_rules, r; 8797 u32 num_rules = 0, rule_idx = 0; 8798 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 8799 struct ieee80211_regdomain *rd; 8800 8801 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 8802 return -EINVAL; 8803 8804 if (!info->attrs[NL80211_ATTR_REG_RULES]) 8805 return -EINVAL; 8806 8807 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 8808 8809 if (info->attrs[NL80211_ATTR_DFS_REGION]) 8810 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 8811 8812 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8813 rem_reg_rules) { 8814 num_rules++; 8815 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 8816 return -EINVAL; 8817 } 8818 8819 rtnl_lock(); 8820 if (!reg_is_valid_request(alpha2)) { 8821 r = -EINVAL; 8822 goto out; 8823 } 8824 8825 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 8826 if (!rd) { 8827 r = -ENOMEM; 8828 goto out; 8829 } 8830 8831 rd->n_reg_rules = num_rules; 8832 rd->alpha2[0] = alpha2[0]; 8833 rd->alpha2[1] = alpha2[1]; 8834 8835 /* 8836 * Disable DFS master mode if the DFS region was 8837 * not supported or known on this kernel. 8838 */ 8839 if (reg_supported_dfs_region(dfs_region)) 8840 rd->dfs_region = dfs_region; 8841 8842 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8843 rem_reg_rules) { 8844 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 8845 nl_reg_rule, reg_rule_policy, 8846 info->extack); 8847 if (r) 8848 goto bad_reg; 8849 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 8850 if (r) 8851 goto bad_reg; 8852 8853 rule_idx++; 8854 8855 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 8856 r = -EINVAL; 8857 goto bad_reg; 8858 } 8859 } 8860 8861 r = set_regdom(rd, REGD_SOURCE_CRDA); 8862 /* set_regdom takes ownership of rd */ 8863 rd = NULL; 8864 bad_reg: 8865 kfree(rd); 8866 out: 8867 rtnl_unlock(); 8868 return r; 8869 } 8870 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 8871 8872 static int validate_scan_freqs(struct nlattr *freqs) 8873 { 8874 struct nlattr *attr1, *attr2; 8875 int n_channels = 0, tmp1, tmp2; 8876 8877 nla_for_each_nested(attr1, freqs, tmp1) 8878 if (nla_len(attr1) != sizeof(u32)) 8879 return 0; 8880 8881 nla_for_each_nested(attr1, freqs, tmp1) { 8882 n_channels++; 8883 /* 8884 * Some hardware has a limited channel list for 8885 * scanning, and it is pretty much nonsensical 8886 * to scan for a channel twice, so disallow that 8887 * and don't require drivers to check that the 8888 * channel list they get isn't longer than what 8889 * they can scan, as long as they can scan all 8890 * the channels they registered at once. 8891 */ 8892 nla_for_each_nested(attr2, freqs, tmp2) 8893 if (attr1 != attr2 && 8894 nla_get_u32(attr1) == nla_get_u32(attr2)) 8895 return 0; 8896 } 8897 8898 return n_channels; 8899 } 8900 8901 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 8902 { 8903 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 8904 } 8905 8906 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 8907 struct cfg80211_bss_selection *bss_select) 8908 { 8909 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 8910 struct nlattr *nest; 8911 int err; 8912 bool found = false; 8913 int i; 8914 8915 /* only process one nested attribute */ 8916 nest = nla_data(nla); 8917 if (!nla_ok(nest, nla_len(nest))) 8918 return -EINVAL; 8919 8920 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 8921 nest, nl80211_bss_select_policy, 8922 NULL); 8923 if (err) 8924 return err; 8925 8926 /* only one attribute may be given */ 8927 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 8928 if (attr[i]) { 8929 if (found) 8930 return -EINVAL; 8931 found = true; 8932 } 8933 } 8934 8935 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 8936 8937 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 8938 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 8939 8940 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 8941 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 8942 bss_select->param.band_pref = 8943 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 8944 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 8945 return -EINVAL; 8946 } 8947 8948 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 8949 struct nl80211_bss_select_rssi_adjust *adj_param; 8950 8951 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 8952 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 8953 bss_select->param.adjust.band = adj_param->band; 8954 bss_select->param.adjust.delta = adj_param->delta; 8955 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 8956 return -EINVAL; 8957 } 8958 8959 /* user-space did not provide behaviour attribute */ 8960 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 8961 return -EINVAL; 8962 8963 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 8964 return -EINVAL; 8965 8966 return 0; 8967 } 8968 8969 int nl80211_parse_random_mac(struct nlattr **attrs, 8970 u8 *mac_addr, u8 *mac_addr_mask) 8971 { 8972 int i; 8973 8974 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 8975 eth_zero_addr(mac_addr); 8976 eth_zero_addr(mac_addr_mask); 8977 mac_addr[0] = 0x2; 8978 mac_addr_mask[0] = 0x3; 8979 8980 return 0; 8981 } 8982 8983 /* need both or none */ 8984 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 8985 return -EINVAL; 8986 8987 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 8988 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 8989 8990 /* don't allow or configure an mcast address */ 8991 if (!is_multicast_ether_addr(mac_addr_mask) || 8992 is_multicast_ether_addr(mac_addr)) 8993 return -EINVAL; 8994 8995 /* 8996 * allow users to pass a MAC address that has bits set outside 8997 * of the mask, but don't bother drivers with having to deal 8998 * with such bits 8999 */ 9000 for (i = 0; i < ETH_ALEN; i++) 9001 mac_addr[i] &= mac_addr_mask[i]; 9002 9003 return 0; 9004 } 9005 9006 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev, 9007 struct ieee80211_channel *chan) 9008 { 9009 unsigned int link_id; 9010 bool all_ok = true; 9011 9012 lockdep_assert_wiphy(wdev->wiphy); 9013 9014 if (!cfg80211_beaconing_iface_active(wdev)) 9015 return true; 9016 9017 /* 9018 * FIXME: check if we have a free HW resource/link for chan 9019 * 9020 * This, as well as the FIXME below, requires knowing the link 9021 * capabilities of the hardware. 9022 */ 9023 9024 /* we cannot leave radar channels */ 9025 for_each_valid_link(wdev, link_id) { 9026 struct cfg80211_chan_def *chandef; 9027 9028 chandef = wdev_chandef(wdev, link_id); 9029 if (!chandef || !chandef->chan) 9030 continue; 9031 9032 /* 9033 * FIXME: don't require all_ok, but rather check only the 9034 * correct HW resource/link onto which 'chan' falls, 9035 * as only that link leaves the channel for doing 9036 * the off-channel operation. 9037 */ 9038 9039 if (chandef->chan->flags & IEEE80211_CHAN_RADAR) 9040 all_ok = false; 9041 } 9042 9043 if (all_ok) 9044 return true; 9045 9046 return regulatory_pre_cac_allowed(wdev->wiphy); 9047 } 9048 9049 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 9050 enum nl80211_ext_feature_index feat) 9051 { 9052 if (!(flags & flag)) 9053 return true; 9054 if (wiphy_ext_feature_isset(wiphy, feat)) 9055 return true; 9056 return false; 9057 } 9058 9059 static int 9060 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 9061 void *request, struct nlattr **attrs, 9062 bool is_sched_scan) 9063 { 9064 u8 *mac_addr, *mac_addr_mask; 9065 u32 *flags; 9066 enum nl80211_feature_flags randomness_flag; 9067 9068 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 9069 return 0; 9070 9071 if (is_sched_scan) { 9072 struct cfg80211_sched_scan_request *req = request; 9073 9074 randomness_flag = wdev ? 9075 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 9076 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 9077 flags = &req->flags; 9078 mac_addr = req->mac_addr; 9079 mac_addr_mask = req->mac_addr_mask; 9080 } else { 9081 struct cfg80211_scan_request *req = request; 9082 9083 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 9084 flags = &req->flags; 9085 mac_addr = req->mac_addr; 9086 mac_addr_mask = req->mac_addr_mask; 9087 } 9088 9089 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 9090 9091 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 9092 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 9093 !nl80211_check_scan_feat(wiphy, *flags, 9094 NL80211_SCAN_FLAG_LOW_SPAN, 9095 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 9096 !nl80211_check_scan_feat(wiphy, *flags, 9097 NL80211_SCAN_FLAG_LOW_POWER, 9098 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 9099 !nl80211_check_scan_feat(wiphy, *flags, 9100 NL80211_SCAN_FLAG_HIGH_ACCURACY, 9101 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 9102 !nl80211_check_scan_feat(wiphy, *flags, 9103 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 9104 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 9105 !nl80211_check_scan_feat(wiphy, *flags, 9106 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 9107 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 9108 !nl80211_check_scan_feat(wiphy, *flags, 9109 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 9110 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 9111 !nl80211_check_scan_feat(wiphy, *flags, 9112 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 9113 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 9114 !nl80211_check_scan_feat(wiphy, *flags, 9115 NL80211_SCAN_FLAG_RANDOM_SN, 9116 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 9117 !nl80211_check_scan_feat(wiphy, *flags, 9118 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 9119 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 9120 return -EOPNOTSUPP; 9121 9122 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 9123 int err; 9124 9125 if (!(wiphy->features & randomness_flag) || 9126 (wdev && wdev->connected)) 9127 return -EOPNOTSUPP; 9128 9129 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 9130 if (err) 9131 return err; 9132 } 9133 9134 return 0; 9135 } 9136 9137 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 9138 { 9139 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9140 struct wireless_dev *wdev = info->user_ptr[1]; 9141 struct cfg80211_scan_request *request; 9142 struct nlattr *scan_freqs = NULL; 9143 bool scan_freqs_khz = false; 9144 struct nlattr *attr; 9145 struct wiphy *wiphy; 9146 int err, tmp, n_ssids = 0, n_channels, i; 9147 size_t ie_len, size; 9148 9149 wiphy = &rdev->wiphy; 9150 9151 if (wdev->iftype == NL80211_IFTYPE_NAN) 9152 return -EOPNOTSUPP; 9153 9154 if (!rdev->ops->scan) 9155 return -EOPNOTSUPP; 9156 9157 if (rdev->scan_req || rdev->scan_msg) 9158 return -EBUSY; 9159 9160 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 9161 if (!wiphy_ext_feature_isset(wiphy, 9162 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 9163 return -EOPNOTSUPP; 9164 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 9165 scan_freqs_khz = true; 9166 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 9167 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 9168 9169 if (scan_freqs) { 9170 n_channels = validate_scan_freqs(scan_freqs); 9171 if (!n_channels) 9172 return -EINVAL; 9173 } else { 9174 n_channels = ieee80211_get_num_supported_channels(wiphy); 9175 } 9176 9177 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 9178 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 9179 n_ssids++; 9180 9181 if (n_ssids > wiphy->max_scan_ssids) 9182 return -EINVAL; 9183 9184 if (info->attrs[NL80211_ATTR_IE]) 9185 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9186 else 9187 ie_len = 0; 9188 9189 if (ie_len > wiphy->max_scan_ie_len) 9190 return -EINVAL; 9191 9192 size = struct_size(request, channels, n_channels); 9193 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids)); 9194 size = size_add(size, ie_len); 9195 request = kzalloc(size, GFP_KERNEL); 9196 if (!request) 9197 return -ENOMEM; 9198 9199 if (n_ssids) 9200 request->ssids = (void *)&request->channels[n_channels]; 9201 request->n_ssids = n_ssids; 9202 if (ie_len) { 9203 if (n_ssids) 9204 request->ie = (void *)(request->ssids + n_ssids); 9205 else 9206 request->ie = (void *)(request->channels + n_channels); 9207 } 9208 9209 i = 0; 9210 if (scan_freqs) { 9211 /* user specified, bail out if channel not found */ 9212 nla_for_each_nested(attr, scan_freqs, tmp) { 9213 struct ieee80211_channel *chan; 9214 int freq = nla_get_u32(attr); 9215 9216 if (!scan_freqs_khz) 9217 freq = MHZ_TO_KHZ(freq); 9218 9219 chan = ieee80211_get_channel_khz(wiphy, freq); 9220 if (!chan) { 9221 err = -EINVAL; 9222 goto out_free; 9223 } 9224 9225 /* ignore disabled channels */ 9226 if (chan->flags & IEEE80211_CHAN_DISABLED) 9227 continue; 9228 9229 request->channels[i] = chan; 9230 i++; 9231 } 9232 } else { 9233 enum nl80211_band band; 9234 9235 /* all channels */ 9236 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9237 int j; 9238 9239 if (!wiphy->bands[band]) 9240 continue; 9241 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9242 struct ieee80211_channel *chan; 9243 9244 chan = &wiphy->bands[band]->channels[j]; 9245 9246 if (chan->flags & IEEE80211_CHAN_DISABLED) 9247 continue; 9248 9249 request->channels[i] = chan; 9250 i++; 9251 } 9252 } 9253 } 9254 9255 if (!i) { 9256 err = -EINVAL; 9257 goto out_free; 9258 } 9259 9260 request->n_channels = i; 9261 9262 for (i = 0; i < request->n_channels; i++) { 9263 struct ieee80211_channel *chan = request->channels[i]; 9264 9265 /* if we can go off-channel to the target channel we're good */ 9266 if (cfg80211_off_channel_oper_allowed(wdev, chan)) 9267 continue; 9268 9269 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) { 9270 err = -EBUSY; 9271 goto out_free; 9272 } 9273 } 9274 9275 i = 0; 9276 if (n_ssids) { 9277 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 9278 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9279 err = -EINVAL; 9280 goto out_free; 9281 } 9282 request->ssids[i].ssid_len = nla_len(attr); 9283 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 9284 i++; 9285 } 9286 } 9287 9288 if (info->attrs[NL80211_ATTR_IE]) { 9289 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9290 memcpy((void *)request->ie, 9291 nla_data(info->attrs[NL80211_ATTR_IE]), 9292 request->ie_len); 9293 } 9294 9295 for (i = 0; i < NUM_NL80211_BANDS; i++) 9296 if (wiphy->bands[i]) 9297 request->rates[i] = 9298 (1 << wiphy->bands[i]->n_bitrates) - 1; 9299 9300 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 9301 nla_for_each_nested(attr, 9302 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 9303 tmp) { 9304 enum nl80211_band band = nla_type(attr); 9305 9306 if (band < 0 || band >= NUM_NL80211_BANDS) { 9307 err = -EINVAL; 9308 goto out_free; 9309 } 9310 9311 if (!wiphy->bands[band]) 9312 continue; 9313 9314 err = ieee80211_get_ratemask(wiphy->bands[band], 9315 nla_data(attr), 9316 nla_len(attr), 9317 &request->rates[band]); 9318 if (err) 9319 goto out_free; 9320 } 9321 } 9322 9323 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 9324 request->duration = 9325 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 9326 request->duration_mandatory = 9327 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 9328 } 9329 9330 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 9331 false); 9332 if (err) 9333 goto out_free; 9334 9335 request->no_cck = 9336 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9337 9338 /* Initial implementation used NL80211_ATTR_MAC to set the specific 9339 * BSSID to scan for. This was problematic because that same attribute 9340 * was already used for another purpose (local random MAC address). The 9341 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 9342 * compatibility with older userspace components, also use the 9343 * NL80211_ATTR_MAC value here if it can be determined to be used for 9344 * the specific BSSID use case instead of the random MAC address 9345 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 9346 */ 9347 if (info->attrs[NL80211_ATTR_BSSID]) 9348 memcpy(request->bssid, 9349 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 9350 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 9351 info->attrs[NL80211_ATTR_MAC]) 9352 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 9353 ETH_ALEN); 9354 else 9355 eth_broadcast_addr(request->bssid); 9356 9357 request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs); 9358 request->wdev = wdev; 9359 request->wiphy = &rdev->wiphy; 9360 request->scan_start = jiffies; 9361 9362 rdev->scan_req = request; 9363 err = cfg80211_scan(rdev); 9364 9365 if (err) 9366 goto out_free; 9367 9368 nl80211_send_scan_start(rdev, wdev); 9369 dev_hold(wdev->netdev); 9370 9371 return 0; 9372 9373 out_free: 9374 rdev->scan_req = NULL; 9375 kfree(request); 9376 9377 return err; 9378 } 9379 9380 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 9381 { 9382 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9383 struct wireless_dev *wdev = info->user_ptr[1]; 9384 9385 if (!rdev->ops->abort_scan) 9386 return -EOPNOTSUPP; 9387 9388 if (rdev->scan_msg) 9389 return 0; 9390 9391 if (!rdev->scan_req) 9392 return -ENOENT; 9393 9394 rdev_abort_scan(rdev, wdev); 9395 return 0; 9396 } 9397 9398 static int 9399 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 9400 struct cfg80211_sched_scan_request *request, 9401 struct nlattr **attrs) 9402 { 9403 int tmp, err, i = 0; 9404 struct nlattr *attr; 9405 9406 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9407 u32 interval; 9408 9409 /* 9410 * If scan plans are not specified, 9411 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 9412 * case one scan plan will be set with the specified scan 9413 * interval and infinite number of iterations. 9414 */ 9415 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 9416 if (!interval) 9417 return -EINVAL; 9418 9419 request->scan_plans[0].interval = 9420 DIV_ROUND_UP(interval, MSEC_PER_SEC); 9421 if (!request->scan_plans[0].interval) 9422 return -EINVAL; 9423 9424 if (request->scan_plans[0].interval > 9425 wiphy->max_sched_scan_plan_interval) 9426 request->scan_plans[0].interval = 9427 wiphy->max_sched_scan_plan_interval; 9428 9429 return 0; 9430 } 9431 9432 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 9433 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 9434 9435 if (WARN_ON(i >= n_plans)) 9436 return -EINVAL; 9437 9438 err = nla_parse_nested_deprecated(plan, 9439 NL80211_SCHED_SCAN_PLAN_MAX, 9440 attr, nl80211_plan_policy, 9441 NULL); 9442 if (err) 9443 return err; 9444 9445 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 9446 return -EINVAL; 9447 9448 request->scan_plans[i].interval = 9449 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 9450 if (!request->scan_plans[i].interval || 9451 request->scan_plans[i].interval > 9452 wiphy->max_sched_scan_plan_interval) 9453 return -EINVAL; 9454 9455 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 9456 request->scan_plans[i].iterations = 9457 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 9458 if (!request->scan_plans[i].iterations || 9459 (request->scan_plans[i].iterations > 9460 wiphy->max_sched_scan_plan_iterations)) 9461 return -EINVAL; 9462 } else if (i < n_plans - 1) { 9463 /* 9464 * All scan plans but the last one must specify 9465 * a finite number of iterations 9466 */ 9467 return -EINVAL; 9468 } 9469 9470 i++; 9471 } 9472 9473 /* 9474 * The last scan plan must not specify the number of 9475 * iterations, it is supposed to run infinitely 9476 */ 9477 if (request->scan_plans[n_plans - 1].iterations) 9478 return -EINVAL; 9479 9480 return 0; 9481 } 9482 9483 static int 9484 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 9485 struct cfg80211_match_set *match_sets, 9486 struct nlattr *tb_band_rssi, 9487 s32 rssi_thold) 9488 { 9489 struct nlattr *attr; 9490 int i, tmp, ret = 0; 9491 9492 if (!wiphy_ext_feature_isset(wiphy, 9493 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 9494 if (tb_band_rssi) 9495 ret = -EOPNOTSUPP; 9496 else 9497 for (i = 0; i < NUM_NL80211_BANDS; i++) 9498 match_sets->per_band_rssi_thold[i] = 9499 NL80211_SCAN_RSSI_THOLD_OFF; 9500 return ret; 9501 } 9502 9503 for (i = 0; i < NUM_NL80211_BANDS; i++) 9504 match_sets->per_band_rssi_thold[i] = rssi_thold; 9505 9506 nla_for_each_nested(attr, tb_band_rssi, tmp) { 9507 enum nl80211_band band = nla_type(attr); 9508 9509 if (band < 0 || band >= NUM_NL80211_BANDS) 9510 return -EINVAL; 9511 9512 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 9513 } 9514 9515 return 0; 9516 } 9517 9518 static struct cfg80211_sched_scan_request * 9519 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 9520 struct nlattr **attrs, int max_match_sets) 9521 { 9522 struct cfg80211_sched_scan_request *request; 9523 struct nlattr *attr; 9524 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 9525 enum nl80211_band band; 9526 size_t ie_len, size; 9527 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 9528 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 9529 9530 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9531 n_channels = validate_scan_freqs( 9532 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 9533 if (!n_channels) 9534 return ERR_PTR(-EINVAL); 9535 } else { 9536 n_channels = ieee80211_get_num_supported_channels(wiphy); 9537 } 9538 9539 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 9540 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9541 tmp) 9542 n_ssids++; 9543 9544 if (n_ssids > wiphy->max_sched_scan_ssids) 9545 return ERR_PTR(-EINVAL); 9546 9547 /* 9548 * First, count the number of 'real' matchsets. Due to an issue with 9549 * the old implementation, matchsets containing only the RSSI attribute 9550 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 9551 * RSSI for all matchsets, rather than their own matchset for reporting 9552 * all APs with a strong RSSI. This is needed to be compatible with 9553 * older userspace that treated a matchset with only the RSSI as the 9554 * global RSSI for all other matchsets - if there are other matchsets. 9555 */ 9556 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9557 nla_for_each_nested(attr, 9558 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9559 tmp) { 9560 struct nlattr *rssi; 9561 9562 err = nla_parse_nested_deprecated(tb, 9563 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9564 attr, 9565 nl80211_match_policy, 9566 NULL); 9567 if (err) 9568 return ERR_PTR(err); 9569 9570 /* SSID and BSSID are mutually exclusive */ 9571 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 9572 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 9573 return ERR_PTR(-EINVAL); 9574 9575 /* add other standalone attributes here */ 9576 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 9577 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 9578 n_match_sets++; 9579 continue; 9580 } 9581 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9582 if (rssi) 9583 default_match_rssi = nla_get_s32(rssi); 9584 } 9585 } 9586 9587 /* However, if there's no other matchset, add the RSSI one */ 9588 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 9589 n_match_sets = 1; 9590 9591 if (n_match_sets > max_match_sets) 9592 return ERR_PTR(-EINVAL); 9593 9594 if (attrs[NL80211_ATTR_IE]) 9595 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 9596 else 9597 ie_len = 0; 9598 9599 if (ie_len > wiphy->max_sched_scan_ie_len) 9600 return ERR_PTR(-EINVAL); 9601 9602 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9603 /* 9604 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 9605 * each scan plan already specifies its own interval 9606 */ 9607 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9608 return ERR_PTR(-EINVAL); 9609 9610 nla_for_each_nested(attr, 9611 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 9612 n_plans++; 9613 } else { 9614 /* 9615 * The scan interval attribute is kept for backward 9616 * compatibility. If no scan plans are specified and sched scan 9617 * interval is specified, one scan plan will be set with this 9618 * scan interval and infinite number of iterations. 9619 */ 9620 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9621 return ERR_PTR(-EINVAL); 9622 9623 n_plans = 1; 9624 } 9625 9626 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 9627 return ERR_PTR(-EINVAL); 9628 9629 if (!wiphy_ext_feature_isset( 9630 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 9631 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 9632 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 9633 return ERR_PTR(-EINVAL); 9634 9635 size = struct_size(request, channels, n_channels); 9636 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids)); 9637 size = size_add(size, array_size(sizeof(*request->match_sets), 9638 n_match_sets)); 9639 size = size_add(size, array_size(sizeof(*request->scan_plans), 9640 n_plans)); 9641 size = size_add(size, ie_len); 9642 request = kzalloc(size, GFP_KERNEL); 9643 if (!request) 9644 return ERR_PTR(-ENOMEM); 9645 9646 if (n_ssids) 9647 request->ssids = (void *)&request->channels[n_channels]; 9648 request->n_ssids = n_ssids; 9649 if (ie_len) { 9650 if (n_ssids) 9651 request->ie = (void *)(request->ssids + n_ssids); 9652 else 9653 request->ie = (void *)(request->channels + n_channels); 9654 } 9655 9656 if (n_match_sets) { 9657 if (request->ie) 9658 request->match_sets = (void *)(request->ie + ie_len); 9659 else if (n_ssids) 9660 request->match_sets = 9661 (void *)(request->ssids + n_ssids); 9662 else 9663 request->match_sets = 9664 (void *)(request->channels + n_channels); 9665 } 9666 request->n_match_sets = n_match_sets; 9667 9668 if (n_match_sets) 9669 request->scan_plans = (void *)(request->match_sets + 9670 n_match_sets); 9671 else if (request->ie) 9672 request->scan_plans = (void *)(request->ie + ie_len); 9673 else if (n_ssids) 9674 request->scan_plans = (void *)(request->ssids + n_ssids); 9675 else 9676 request->scan_plans = (void *)(request->channels + n_channels); 9677 9678 request->n_scan_plans = n_plans; 9679 9680 i = 0; 9681 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9682 /* user specified, bail out if channel not found */ 9683 nla_for_each_nested(attr, 9684 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 9685 tmp) { 9686 struct ieee80211_channel *chan; 9687 9688 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 9689 9690 if (!chan) { 9691 err = -EINVAL; 9692 goto out_free; 9693 } 9694 9695 /* ignore disabled channels */ 9696 if (chan->flags & IEEE80211_CHAN_DISABLED) 9697 continue; 9698 9699 request->channels[i] = chan; 9700 i++; 9701 } 9702 } else { 9703 /* all channels */ 9704 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9705 int j; 9706 9707 if (!wiphy->bands[band]) 9708 continue; 9709 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9710 struct ieee80211_channel *chan; 9711 9712 chan = &wiphy->bands[band]->channels[j]; 9713 9714 if (chan->flags & IEEE80211_CHAN_DISABLED) 9715 continue; 9716 9717 request->channels[i] = chan; 9718 i++; 9719 } 9720 } 9721 } 9722 9723 if (!i) { 9724 err = -EINVAL; 9725 goto out_free; 9726 } 9727 9728 request->n_channels = i; 9729 9730 i = 0; 9731 if (n_ssids) { 9732 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9733 tmp) { 9734 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9735 err = -EINVAL; 9736 goto out_free; 9737 } 9738 request->ssids[i].ssid_len = nla_len(attr); 9739 memcpy(request->ssids[i].ssid, nla_data(attr), 9740 nla_len(attr)); 9741 i++; 9742 } 9743 } 9744 9745 i = 0; 9746 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9747 nla_for_each_nested(attr, 9748 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9749 tmp) { 9750 struct nlattr *ssid, *bssid, *rssi; 9751 9752 err = nla_parse_nested_deprecated(tb, 9753 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9754 attr, 9755 nl80211_match_policy, 9756 NULL); 9757 if (err) 9758 goto out_free; 9759 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 9760 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 9761 9762 if (!ssid && !bssid) { 9763 i++; 9764 continue; 9765 } 9766 9767 if (WARN_ON(i >= n_match_sets)) { 9768 /* this indicates a programming error, 9769 * the loop above should have verified 9770 * things properly 9771 */ 9772 err = -EINVAL; 9773 goto out_free; 9774 } 9775 9776 if (ssid) { 9777 memcpy(request->match_sets[i].ssid.ssid, 9778 nla_data(ssid), nla_len(ssid)); 9779 request->match_sets[i].ssid.ssid_len = 9780 nla_len(ssid); 9781 } 9782 if (bssid) 9783 memcpy(request->match_sets[i].bssid, 9784 nla_data(bssid), ETH_ALEN); 9785 9786 /* special attribute - old implementation w/a */ 9787 request->match_sets[i].rssi_thold = default_match_rssi; 9788 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9789 if (rssi) 9790 request->match_sets[i].rssi_thold = 9791 nla_get_s32(rssi); 9792 9793 /* Parse per band RSSI attribute */ 9794 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 9795 &request->match_sets[i], 9796 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 9797 request->match_sets[i].rssi_thold); 9798 if (err) 9799 goto out_free; 9800 9801 i++; 9802 } 9803 9804 /* there was no other matchset, so the RSSI one is alone */ 9805 if (i == 0 && n_match_sets) 9806 request->match_sets[0].rssi_thold = default_match_rssi; 9807 9808 request->min_rssi_thold = INT_MAX; 9809 for (i = 0; i < n_match_sets; i++) 9810 request->min_rssi_thold = 9811 min(request->match_sets[i].rssi_thold, 9812 request->min_rssi_thold); 9813 } else { 9814 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 9815 } 9816 9817 if (ie_len) { 9818 request->ie_len = ie_len; 9819 memcpy((void *)request->ie, 9820 nla_data(attrs[NL80211_ATTR_IE]), 9821 request->ie_len); 9822 } 9823 9824 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 9825 if (err) 9826 goto out_free; 9827 9828 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 9829 request->delay = 9830 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 9831 9832 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 9833 request->relative_rssi = nla_get_s8( 9834 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 9835 request->relative_rssi_set = true; 9836 } 9837 9838 if (request->relative_rssi_set && 9839 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 9840 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 9841 9842 rssi_adjust = nla_data( 9843 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 9844 request->rssi_adjust.band = rssi_adjust->band; 9845 request->rssi_adjust.delta = rssi_adjust->delta; 9846 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 9847 err = -EINVAL; 9848 goto out_free; 9849 } 9850 } 9851 9852 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 9853 if (err) 9854 goto out_free; 9855 9856 request->scan_start = jiffies; 9857 9858 return request; 9859 9860 out_free: 9861 kfree(request); 9862 return ERR_PTR(err); 9863 } 9864 9865 static int nl80211_start_sched_scan(struct sk_buff *skb, 9866 struct genl_info *info) 9867 { 9868 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9869 struct net_device *dev = info->user_ptr[1]; 9870 struct wireless_dev *wdev = dev->ieee80211_ptr; 9871 struct cfg80211_sched_scan_request *sched_scan_req; 9872 bool want_multi; 9873 int err; 9874 9875 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 9876 return -EOPNOTSUPP; 9877 9878 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 9879 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 9880 if (err) 9881 return err; 9882 9883 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 9884 info->attrs, 9885 rdev->wiphy.max_match_sets); 9886 9887 err = PTR_ERR_OR_ZERO(sched_scan_req); 9888 if (err) 9889 goto out_err; 9890 9891 /* leave request id zero for legacy request 9892 * or if driver does not support multi-scheduled scan 9893 */ 9894 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 9895 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 9896 9897 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 9898 if (err) 9899 goto out_free; 9900 9901 sched_scan_req->dev = dev; 9902 sched_scan_req->wiphy = &rdev->wiphy; 9903 9904 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 9905 sched_scan_req->owner_nlportid = info->snd_portid; 9906 9907 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 9908 9909 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 9910 return 0; 9911 9912 out_free: 9913 kfree(sched_scan_req); 9914 out_err: 9915 return err; 9916 } 9917 9918 static int nl80211_stop_sched_scan(struct sk_buff *skb, 9919 struct genl_info *info) 9920 { 9921 struct cfg80211_sched_scan_request *req; 9922 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9923 u64 cookie; 9924 9925 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 9926 return -EOPNOTSUPP; 9927 9928 if (info->attrs[NL80211_ATTR_COOKIE]) { 9929 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9930 return __cfg80211_stop_sched_scan(rdev, cookie, false); 9931 } 9932 9933 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 9934 struct cfg80211_sched_scan_request, 9935 list); 9936 if (!req || req->reqid || 9937 (req->owner_nlportid && 9938 req->owner_nlportid != info->snd_portid)) 9939 return -ENOENT; 9940 9941 return cfg80211_stop_sched_scan_req(rdev, req, false); 9942 } 9943 9944 static int nl80211_start_radar_detection(struct sk_buff *skb, 9945 struct genl_info *info) 9946 { 9947 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9948 struct net_device *dev = info->user_ptr[1]; 9949 struct wireless_dev *wdev = dev->ieee80211_ptr; 9950 struct wiphy *wiphy = wdev->wiphy; 9951 struct cfg80211_chan_def chandef; 9952 enum nl80211_dfs_regions dfs_region; 9953 unsigned int cac_time_ms; 9954 int err = -EINVAL; 9955 9956 flush_delayed_work(&rdev->dfs_update_channels_wk); 9957 9958 wiphy_lock(wiphy); 9959 9960 dfs_region = reg_get_dfs_region(wiphy); 9961 if (dfs_region == NL80211_DFS_UNSET) 9962 goto unlock; 9963 9964 err = nl80211_parse_chandef(rdev, info, &chandef); 9965 if (err) 9966 goto unlock; 9967 9968 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 9969 if (err < 0) 9970 goto unlock; 9971 9972 if (err == 0) { 9973 err = -EINVAL; 9974 goto unlock; 9975 } 9976 9977 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) { 9978 err = -EINVAL; 9979 goto unlock; 9980 } 9981 9982 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) { 9983 err = cfg80211_start_background_radar_detection(rdev, wdev, 9984 &chandef); 9985 goto unlock; 9986 } 9987 9988 if (netif_carrier_ok(dev)) { 9989 err = -EBUSY; 9990 goto unlock; 9991 } 9992 9993 if (wdev->cac_started) { 9994 err = -EBUSY; 9995 goto unlock; 9996 } 9997 9998 /* CAC start is offloaded to HW and can't be started manually */ 9999 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) { 10000 err = -EOPNOTSUPP; 10001 goto unlock; 10002 } 10003 10004 if (!rdev->ops->start_radar_detection) { 10005 err = -EOPNOTSUPP; 10006 goto unlock; 10007 } 10008 10009 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 10010 if (WARN_ON(!cac_time_ms)) 10011 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 10012 10013 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 10014 if (!err) { 10015 wdev->links[0].ap.chandef = chandef; 10016 wdev->cac_started = true; 10017 wdev->cac_start_time = jiffies; 10018 wdev->cac_time_ms = cac_time_ms; 10019 } 10020 unlock: 10021 wiphy_unlock(wiphy); 10022 10023 return err; 10024 } 10025 10026 static int nl80211_notify_radar_detection(struct sk_buff *skb, 10027 struct genl_info *info) 10028 { 10029 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10030 struct net_device *dev = info->user_ptr[1]; 10031 struct wireless_dev *wdev = dev->ieee80211_ptr; 10032 struct wiphy *wiphy = wdev->wiphy; 10033 struct cfg80211_chan_def chandef; 10034 enum nl80211_dfs_regions dfs_region; 10035 int err; 10036 10037 dfs_region = reg_get_dfs_region(wiphy); 10038 if (dfs_region == NL80211_DFS_UNSET) { 10039 GENL_SET_ERR_MSG(info, 10040 "DFS Region is not set. Unexpected Radar indication"); 10041 return -EINVAL; 10042 } 10043 10044 err = nl80211_parse_chandef(rdev, info, &chandef); 10045 if (err) { 10046 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 10047 return err; 10048 } 10049 10050 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 10051 if (err < 0) { 10052 GENL_SET_ERR_MSG(info, "chandef is invalid"); 10053 return err; 10054 } 10055 10056 if (err == 0) { 10057 GENL_SET_ERR_MSG(info, 10058 "Unexpected Radar indication for chandef/iftype"); 10059 return -EINVAL; 10060 } 10061 10062 /* Do not process this notification if radar is already detected 10063 * by kernel on this channel, and return success. 10064 */ 10065 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 10066 return 0; 10067 10068 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 10069 10070 cfg80211_sched_dfs_chan_update(rdev); 10071 10072 rdev->radar_chandef = chandef; 10073 10074 /* Propagate this notification to other radios as well */ 10075 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 10076 10077 return 0; 10078 } 10079 10080 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 10081 { 10082 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10083 unsigned int link_id = nl80211_link_id(info->attrs); 10084 struct net_device *dev = info->user_ptr[1]; 10085 struct wireless_dev *wdev = dev->ieee80211_ptr; 10086 struct cfg80211_csa_settings params; 10087 struct nlattr **csa_attrs = NULL; 10088 int err; 10089 bool need_new_beacon = false; 10090 bool need_handle_dfs_flag = true; 10091 int len, i; 10092 u32 cs_count; 10093 10094 if (!rdev->ops->channel_switch || 10095 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 10096 return -EOPNOTSUPP; 10097 10098 switch (dev->ieee80211_ptr->iftype) { 10099 case NL80211_IFTYPE_AP: 10100 case NL80211_IFTYPE_P2P_GO: 10101 need_new_beacon = true; 10102 /* For all modes except AP the handle_dfs flag needs to be 10103 * supplied to tell the kernel that userspace will handle radar 10104 * events when they happen. Otherwise a switch to a channel 10105 * requiring DFS will be rejected. 10106 */ 10107 need_handle_dfs_flag = false; 10108 10109 /* useless if AP is not running */ 10110 if (!wdev->links[link_id].ap.beacon_interval) 10111 return -ENOTCONN; 10112 break; 10113 case NL80211_IFTYPE_ADHOC: 10114 if (!wdev->u.ibss.ssid_len) 10115 return -ENOTCONN; 10116 break; 10117 case NL80211_IFTYPE_MESH_POINT: 10118 if (!wdev->u.mesh.id_len) 10119 return -ENOTCONN; 10120 break; 10121 default: 10122 return -EOPNOTSUPP; 10123 } 10124 10125 memset(¶ms, 0, sizeof(params)); 10126 params.beacon_csa.ftm_responder = -1; 10127 10128 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 10129 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 10130 return -EINVAL; 10131 10132 /* only important for AP, IBSS and mesh create IEs internally */ 10133 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 10134 return -EINVAL; 10135 10136 /* Even though the attribute is u32, the specification says 10137 * u8, so let's make sure we don't overflow. 10138 */ 10139 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 10140 if (cs_count > 255) 10141 return -EINVAL; 10142 10143 params.count = cs_count; 10144 10145 if (!need_new_beacon) 10146 goto skip_beacons; 10147 10148 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after, 10149 info->extack); 10150 if (err) 10151 goto free; 10152 10153 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs), 10154 GFP_KERNEL); 10155 if (!csa_attrs) { 10156 err = -ENOMEM; 10157 goto free; 10158 } 10159 10160 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 10161 info->attrs[NL80211_ATTR_CSA_IES], 10162 nl80211_policy, info->extack); 10163 if (err) 10164 goto free; 10165 10166 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa, 10167 info->extack); 10168 if (err) 10169 goto free; 10170 10171 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 10172 err = -EINVAL; 10173 goto free; 10174 } 10175 10176 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10177 if (!len || (len % sizeof(u16))) { 10178 err = -EINVAL; 10179 goto free; 10180 } 10181 10182 params.n_counter_offsets_beacon = len / sizeof(u16); 10183 if (rdev->wiphy.max_num_csa_counters && 10184 (params.n_counter_offsets_beacon > 10185 rdev->wiphy.max_num_csa_counters)) { 10186 err = -EINVAL; 10187 goto free; 10188 } 10189 10190 params.counter_offsets_beacon = 10191 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10192 10193 /* sanity checks - counters should fit and be the same */ 10194 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 10195 u16 offset = params.counter_offsets_beacon[i]; 10196 10197 if (offset >= params.beacon_csa.tail_len) { 10198 err = -EINVAL; 10199 goto free; 10200 } 10201 10202 if (params.beacon_csa.tail[offset] != params.count) { 10203 err = -EINVAL; 10204 goto free; 10205 } 10206 } 10207 10208 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 10209 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10210 if (!len || (len % sizeof(u16))) { 10211 err = -EINVAL; 10212 goto free; 10213 } 10214 10215 params.n_counter_offsets_presp = len / sizeof(u16); 10216 if (rdev->wiphy.max_num_csa_counters && 10217 (params.n_counter_offsets_presp > 10218 rdev->wiphy.max_num_csa_counters)) { 10219 err = -EINVAL; 10220 goto free; 10221 } 10222 10223 params.counter_offsets_presp = 10224 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10225 10226 /* sanity checks - counters should fit and be the same */ 10227 for (i = 0; i < params.n_counter_offsets_presp; i++) { 10228 u16 offset = params.counter_offsets_presp[i]; 10229 10230 if (offset >= params.beacon_csa.probe_resp_len) { 10231 err = -EINVAL; 10232 goto free; 10233 } 10234 10235 if (params.beacon_csa.probe_resp[offset] != 10236 params.count) { 10237 err = -EINVAL; 10238 goto free; 10239 } 10240 } 10241 } 10242 10243 skip_beacons: 10244 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 10245 if (err) 10246 goto free; 10247 10248 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 10249 wdev->iftype)) { 10250 err = -EINVAL; 10251 goto free; 10252 } 10253 10254 err = cfg80211_chandef_dfs_required(wdev->wiphy, 10255 ¶ms.chandef, 10256 wdev->iftype); 10257 if (err < 0) 10258 goto free; 10259 10260 if (err > 0) { 10261 params.radar_required = true; 10262 if (need_handle_dfs_flag && 10263 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 10264 err = -EINVAL; 10265 goto free; 10266 } 10267 } 10268 10269 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 10270 params.block_tx = true; 10271 10272 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 10273 err = nl80211_parse_punct_bitmap(rdev, info, 10274 ¶ms.chandef, 10275 ¶ms.punct_bitmap); 10276 if (err) 10277 goto free; 10278 } 10279 10280 err = rdev_channel_switch(rdev, dev, ¶ms); 10281 10282 free: 10283 kfree(params.beacon_after.mbssid_ies); 10284 kfree(params.beacon_csa.mbssid_ies); 10285 kfree(params.beacon_after.rnr_ies); 10286 kfree(params.beacon_csa.rnr_ies); 10287 kfree(csa_attrs); 10288 return err; 10289 } 10290 10291 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 10292 u32 seq, int flags, 10293 struct cfg80211_registered_device *rdev, 10294 struct wireless_dev *wdev, 10295 struct cfg80211_internal_bss *intbss) 10296 { 10297 struct cfg80211_bss *res = &intbss->pub; 10298 const struct cfg80211_bss_ies *ies; 10299 unsigned int link_id; 10300 void *hdr; 10301 struct nlattr *bss; 10302 10303 lockdep_assert_wiphy(wdev->wiphy); 10304 10305 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 10306 NL80211_CMD_NEW_SCAN_RESULTS); 10307 if (!hdr) 10308 return -1; 10309 10310 genl_dump_check_consistent(cb, hdr); 10311 10312 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 10313 goto nla_put_failure; 10314 if (wdev->netdev && 10315 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 10316 goto nla_put_failure; 10317 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 10318 NL80211_ATTR_PAD)) 10319 goto nla_put_failure; 10320 10321 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 10322 if (!bss) 10323 goto nla_put_failure; 10324 if ((!is_zero_ether_addr(res->bssid) && 10325 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 10326 goto nla_put_failure; 10327 10328 rcu_read_lock(); 10329 /* indicate whether we have probe response data or not */ 10330 if (rcu_access_pointer(res->proberesp_ies) && 10331 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 10332 goto fail_unlock_rcu; 10333 10334 /* this pointer prefers to be pointed to probe response data 10335 * but is always valid 10336 */ 10337 ies = rcu_dereference(res->ies); 10338 if (ies) { 10339 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 10340 NL80211_BSS_PAD)) 10341 goto fail_unlock_rcu; 10342 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 10343 ies->len, ies->data)) 10344 goto fail_unlock_rcu; 10345 } 10346 10347 /* and this pointer is always (unless driver didn't know) beacon data */ 10348 ies = rcu_dereference(res->beacon_ies); 10349 if (ies && ies->from_beacon) { 10350 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 10351 NL80211_BSS_PAD)) 10352 goto fail_unlock_rcu; 10353 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 10354 ies->len, ies->data)) 10355 goto fail_unlock_rcu; 10356 } 10357 rcu_read_unlock(); 10358 10359 if (res->beacon_interval && 10360 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 10361 goto nla_put_failure; 10362 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 10363 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 10364 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 10365 res->channel->freq_offset) || 10366 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 10367 jiffies_to_msecs(jiffies - intbss->ts))) 10368 goto nla_put_failure; 10369 10370 if (intbss->parent_tsf && 10371 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 10372 intbss->parent_tsf, NL80211_BSS_PAD) || 10373 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 10374 intbss->parent_bssid))) 10375 goto nla_put_failure; 10376 10377 if (intbss->ts_boottime && 10378 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 10379 intbss->ts_boottime, NL80211_BSS_PAD)) 10380 goto nla_put_failure; 10381 10382 if (!nl80211_put_signal(msg, intbss->pub.chains, 10383 intbss->pub.chain_signal, 10384 NL80211_BSS_CHAIN_SIGNAL)) 10385 goto nla_put_failure; 10386 10387 switch (rdev->wiphy.signal_type) { 10388 case CFG80211_SIGNAL_TYPE_MBM: 10389 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 10390 goto nla_put_failure; 10391 break; 10392 case CFG80211_SIGNAL_TYPE_UNSPEC: 10393 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 10394 goto nla_put_failure; 10395 break; 10396 default: 10397 break; 10398 } 10399 10400 switch (wdev->iftype) { 10401 case NL80211_IFTYPE_P2P_CLIENT: 10402 case NL80211_IFTYPE_STATION: 10403 for_each_valid_link(wdev, link_id) { 10404 if (intbss == wdev->links[link_id].client.current_bss && 10405 (nla_put_u32(msg, NL80211_BSS_STATUS, 10406 NL80211_BSS_STATUS_ASSOCIATED) || 10407 (wdev->valid_links && 10408 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID, 10409 link_id) || 10410 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN, 10411 wdev->u.client.connected_addr))))) 10412 goto nla_put_failure; 10413 } 10414 break; 10415 case NL80211_IFTYPE_ADHOC: 10416 if (intbss == wdev->u.ibss.current_bss && 10417 nla_put_u32(msg, NL80211_BSS_STATUS, 10418 NL80211_BSS_STATUS_IBSS_JOINED)) 10419 goto nla_put_failure; 10420 break; 10421 default: 10422 break; 10423 } 10424 10425 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for)) 10426 goto nla_put_failure; 10427 10428 if (res->cannot_use_reasons && 10429 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS, 10430 res->cannot_use_reasons, 10431 NL80211_BSS_PAD)) 10432 goto nla_put_failure; 10433 10434 nla_nest_end(msg, bss); 10435 10436 genlmsg_end(msg, hdr); 10437 return 0; 10438 10439 fail_unlock_rcu: 10440 rcu_read_unlock(); 10441 nla_put_failure: 10442 genlmsg_cancel(msg, hdr); 10443 return -EMSGSIZE; 10444 } 10445 10446 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 10447 { 10448 struct cfg80211_registered_device *rdev; 10449 struct cfg80211_internal_bss *scan; 10450 struct wireless_dev *wdev; 10451 struct nlattr **attrbuf; 10452 int start = cb->args[2], idx = 0; 10453 bool dump_include_use_data; 10454 int err; 10455 10456 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 10457 if (!attrbuf) 10458 return -ENOMEM; 10459 10460 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf); 10461 if (err) { 10462 kfree(attrbuf); 10463 return err; 10464 } 10465 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10466 __acquire(&rdev->wiphy.mtx); 10467 10468 dump_include_use_data = 10469 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA]; 10470 kfree(attrbuf); 10471 10472 spin_lock_bh(&rdev->bss_lock); 10473 10474 /* 10475 * dump_scan will be called multiple times to break up the scan results 10476 * into multiple messages. It is unlikely that any more bss-es will be 10477 * expired after the first call, so only call only call this on the 10478 * first dump_scan invocation. 10479 */ 10480 if (start == 0) 10481 cfg80211_bss_expire(rdev); 10482 10483 cb->seq = rdev->bss_generation; 10484 10485 list_for_each_entry(scan, &rdev->bss_list, list) { 10486 if (++idx <= start) 10487 continue; 10488 if (!dump_include_use_data && 10489 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL)) 10490 continue; 10491 if (nl80211_send_bss(skb, cb, 10492 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10493 rdev, wdev, scan) < 0) { 10494 idx--; 10495 break; 10496 } 10497 } 10498 10499 spin_unlock_bh(&rdev->bss_lock); 10500 10501 cb->args[2] = idx; 10502 wiphy_unlock(&rdev->wiphy); 10503 10504 return skb->len; 10505 } 10506 10507 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 10508 int flags, struct net_device *dev, 10509 bool allow_radio_stats, 10510 struct survey_info *survey) 10511 { 10512 void *hdr; 10513 struct nlattr *infoattr; 10514 10515 /* skip radio stats if userspace didn't request them */ 10516 if (!survey->channel && !allow_radio_stats) 10517 return 0; 10518 10519 hdr = nl80211hdr_put(msg, portid, seq, flags, 10520 NL80211_CMD_NEW_SURVEY_RESULTS); 10521 if (!hdr) 10522 return -ENOMEM; 10523 10524 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 10525 goto nla_put_failure; 10526 10527 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 10528 if (!infoattr) 10529 goto nla_put_failure; 10530 10531 if (survey->channel && 10532 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 10533 survey->channel->center_freq)) 10534 goto nla_put_failure; 10535 10536 if (survey->channel && survey->channel->freq_offset && 10537 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 10538 survey->channel->freq_offset)) 10539 goto nla_put_failure; 10540 10541 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 10542 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 10543 goto nla_put_failure; 10544 if ((survey->filled & SURVEY_INFO_IN_USE) && 10545 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 10546 goto nla_put_failure; 10547 if ((survey->filled & SURVEY_INFO_TIME) && 10548 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 10549 survey->time, NL80211_SURVEY_INFO_PAD)) 10550 goto nla_put_failure; 10551 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 10552 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 10553 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 10554 goto nla_put_failure; 10555 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 10556 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 10557 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 10558 goto nla_put_failure; 10559 if ((survey->filled & SURVEY_INFO_TIME_RX) && 10560 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 10561 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 10562 goto nla_put_failure; 10563 if ((survey->filled & SURVEY_INFO_TIME_TX) && 10564 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 10565 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 10566 goto nla_put_failure; 10567 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 10568 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 10569 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 10570 goto nla_put_failure; 10571 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 10572 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 10573 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 10574 goto nla_put_failure; 10575 10576 nla_nest_end(msg, infoattr); 10577 10578 genlmsg_end(msg, hdr); 10579 return 0; 10580 10581 nla_put_failure: 10582 genlmsg_cancel(msg, hdr); 10583 return -EMSGSIZE; 10584 } 10585 10586 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 10587 { 10588 struct nlattr **attrbuf; 10589 struct survey_info survey; 10590 struct cfg80211_registered_device *rdev; 10591 struct wireless_dev *wdev; 10592 int survey_idx = cb->args[2]; 10593 int res; 10594 bool radio_stats; 10595 10596 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 10597 if (!attrbuf) 10598 return -ENOMEM; 10599 10600 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf); 10601 if (res) { 10602 kfree(attrbuf); 10603 return res; 10604 } 10605 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10606 __acquire(&rdev->wiphy.mtx); 10607 10608 /* prepare_wdev_dump parsed the attributes */ 10609 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 10610 10611 if (!wdev->netdev) { 10612 res = -EINVAL; 10613 goto out_err; 10614 } 10615 10616 if (!rdev->ops->dump_survey) { 10617 res = -EOPNOTSUPP; 10618 goto out_err; 10619 } 10620 10621 while (1) { 10622 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 10623 if (res == -ENOENT) 10624 break; 10625 if (res) 10626 goto out_err; 10627 10628 /* don't send disabled channels, but do send non-channel data */ 10629 if (survey.channel && 10630 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 10631 survey_idx++; 10632 continue; 10633 } 10634 10635 if (nl80211_send_survey(skb, 10636 NETLINK_CB(cb->skb).portid, 10637 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10638 wdev->netdev, radio_stats, &survey) < 0) 10639 goto out; 10640 survey_idx++; 10641 } 10642 10643 out: 10644 cb->args[2] = survey_idx; 10645 res = skb->len; 10646 out_err: 10647 kfree(attrbuf); 10648 wiphy_unlock(&rdev->wiphy); 10649 return res; 10650 } 10651 10652 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 10653 { 10654 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 10655 NL80211_WPA_VERSION_2 | 10656 NL80211_WPA_VERSION_3)); 10657 } 10658 10659 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 10660 { 10661 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10662 struct net_device *dev = info->user_ptr[1]; 10663 struct ieee80211_channel *chan; 10664 const u8 *bssid, *ssid; 10665 int err, ssid_len; 10666 enum nl80211_auth_type auth_type; 10667 struct key_parse key; 10668 bool local_state_change; 10669 struct cfg80211_auth_request req = {}; 10670 u32 freq; 10671 10672 if (!info->attrs[NL80211_ATTR_MAC]) 10673 return -EINVAL; 10674 10675 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 10676 return -EINVAL; 10677 10678 if (!info->attrs[NL80211_ATTR_SSID]) 10679 return -EINVAL; 10680 10681 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10682 return -EINVAL; 10683 10684 err = nl80211_parse_key(info, &key); 10685 if (err) 10686 return err; 10687 10688 if (key.idx >= 0) { 10689 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 10690 return -EINVAL; 10691 if (!key.p.key || !key.p.key_len) 10692 return -EINVAL; 10693 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 10694 key.p.key_len != WLAN_KEY_LEN_WEP40) && 10695 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 10696 key.p.key_len != WLAN_KEY_LEN_WEP104)) 10697 return -EINVAL; 10698 if (key.idx > 3) 10699 return -EINVAL; 10700 } else { 10701 key.p.key_len = 0; 10702 key.p.key = NULL; 10703 } 10704 10705 if (key.idx >= 0) { 10706 int i; 10707 bool ok = false; 10708 10709 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 10710 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 10711 ok = true; 10712 break; 10713 } 10714 } 10715 if (!ok) 10716 return -EINVAL; 10717 } 10718 10719 if (!rdev->ops->auth) 10720 return -EOPNOTSUPP; 10721 10722 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10723 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10724 return -EOPNOTSUPP; 10725 10726 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10727 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10728 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10729 freq += 10730 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10731 10732 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10733 if (!chan) 10734 return -EINVAL; 10735 10736 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10737 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10738 10739 if (info->attrs[NL80211_ATTR_IE]) { 10740 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10741 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10742 } 10743 10744 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10745 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 10746 return -EINVAL; 10747 10748 if ((auth_type == NL80211_AUTHTYPE_SAE || 10749 auth_type == NL80211_AUTHTYPE_FILS_SK || 10750 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 10751 auth_type == NL80211_AUTHTYPE_FILS_PK) && 10752 !info->attrs[NL80211_ATTR_AUTH_DATA]) 10753 return -EINVAL; 10754 10755 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 10756 if (auth_type != NL80211_AUTHTYPE_SAE && 10757 auth_type != NL80211_AUTHTYPE_FILS_SK && 10758 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 10759 auth_type != NL80211_AUTHTYPE_FILS_PK) 10760 return -EINVAL; 10761 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 10762 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 10763 } 10764 10765 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 10766 10767 /* 10768 * Since we no longer track auth state, ignore 10769 * requests to only change local state. 10770 */ 10771 if (local_state_change) 10772 return 0; 10773 10774 req.auth_type = auth_type; 10775 req.key = key.p.key; 10776 req.key_len = key.p.key_len; 10777 req.key_idx = key.idx; 10778 req.link_id = nl80211_link_id_or_invalid(info->attrs); 10779 if (req.link_id >= 0) { 10780 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 10781 return -EINVAL; 10782 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 10783 return -EINVAL; 10784 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 10785 if (!is_valid_ether_addr(req.ap_mld_addr)) 10786 return -EINVAL; 10787 } 10788 10789 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 10790 IEEE80211_BSS_TYPE_ESS, 10791 IEEE80211_PRIVACY_ANY); 10792 if (!req.bss) 10793 return -ENOENT; 10794 10795 err = cfg80211_mlme_auth(rdev, dev, &req); 10796 10797 cfg80211_put_bss(&rdev->wiphy, req.bss); 10798 10799 return err; 10800 } 10801 10802 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 10803 struct genl_info *info) 10804 { 10805 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10806 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 10807 return -EINVAL; 10808 } 10809 10810 if (!rdev->ops->tx_control_port || 10811 !wiphy_ext_feature_isset(&rdev->wiphy, 10812 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 10813 return -EOPNOTSUPP; 10814 10815 return 0; 10816 } 10817 10818 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 10819 struct genl_info *info, 10820 struct cfg80211_crypto_settings *settings, 10821 int cipher_limit) 10822 { 10823 memset(settings, 0, sizeof(*settings)); 10824 10825 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 10826 10827 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 10828 u16 proto; 10829 10830 proto = nla_get_u16( 10831 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 10832 settings->control_port_ethertype = cpu_to_be16(proto); 10833 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 10834 proto != ETH_P_PAE) 10835 return -EINVAL; 10836 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 10837 settings->control_port_no_encrypt = true; 10838 } else 10839 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 10840 10841 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10842 int r = validate_pae_over_nl80211(rdev, info); 10843 10844 if (r < 0) 10845 return r; 10846 10847 settings->control_port_over_nl80211 = true; 10848 10849 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 10850 settings->control_port_no_preauth = true; 10851 } 10852 10853 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 10854 void *data; 10855 int len, i; 10856 10857 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10858 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10859 settings->n_ciphers_pairwise = len / sizeof(u32); 10860 10861 if (len % sizeof(u32)) 10862 return -EINVAL; 10863 10864 if (settings->n_ciphers_pairwise > cipher_limit) 10865 return -EINVAL; 10866 10867 memcpy(settings->ciphers_pairwise, data, len); 10868 10869 for (i = 0; i < settings->n_ciphers_pairwise; i++) 10870 if (!cfg80211_supported_cipher_suite( 10871 &rdev->wiphy, 10872 settings->ciphers_pairwise[i])) 10873 return -EINVAL; 10874 } 10875 10876 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 10877 settings->cipher_group = 10878 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 10879 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 10880 settings->cipher_group)) 10881 return -EINVAL; 10882 } 10883 10884 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 10885 settings->wpa_versions = 10886 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 10887 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 10888 return -EINVAL; 10889 } 10890 10891 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 10892 void *data; 10893 int len; 10894 10895 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 10896 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 10897 settings->n_akm_suites = len / sizeof(u32); 10898 10899 if (len % sizeof(u32)) 10900 return -EINVAL; 10901 10902 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites) 10903 return -EINVAL; 10904 10905 memcpy(settings->akm_suites, data, len); 10906 } 10907 10908 if (info->attrs[NL80211_ATTR_PMK]) { 10909 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 10910 return -EINVAL; 10911 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10912 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 10913 !wiphy_ext_feature_isset(&rdev->wiphy, 10914 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 10915 return -EINVAL; 10916 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10917 } 10918 10919 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 10920 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10921 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 10922 !wiphy_ext_feature_isset(&rdev->wiphy, 10923 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 10924 return -EINVAL; 10925 settings->sae_pwd = 10926 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10927 settings->sae_pwd_len = 10928 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10929 } 10930 10931 if (info->attrs[NL80211_ATTR_SAE_PWE]) 10932 settings->sae_pwe = 10933 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]); 10934 else 10935 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED; 10936 10937 return 0; 10938 } 10939 10940 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev, 10941 const u8 *ssid, int ssid_len, 10942 struct nlattr **attrs, 10943 int assoc_link_id, int link_id) 10944 { 10945 struct ieee80211_channel *chan; 10946 struct cfg80211_bss *bss; 10947 const u8 *bssid; 10948 u32 freq, use_for = 0; 10949 10950 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ]) 10951 return ERR_PTR(-EINVAL); 10952 10953 bssid = nla_data(attrs[NL80211_ATTR_MAC]); 10954 10955 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ])); 10956 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10957 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10958 10959 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10960 if (!chan) 10961 return ERR_PTR(-EINVAL); 10962 10963 if (assoc_link_id >= 0) 10964 use_for = NL80211_BSS_USE_FOR_MLD_LINK; 10965 if (assoc_link_id == link_id) 10966 use_for |= NL80211_BSS_USE_FOR_NORMAL; 10967 10968 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid, 10969 ssid, ssid_len, 10970 IEEE80211_BSS_TYPE_ESS, 10971 IEEE80211_PRIVACY_ANY, 10972 use_for); 10973 if (!bss) 10974 return ERR_PTR(-ENOENT); 10975 10976 return bss; 10977 } 10978 10979 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 10980 { 10981 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10982 struct net_device *dev = info->user_ptr[1]; 10983 struct cfg80211_assoc_request req = {}; 10984 struct nlattr **attrs = NULL; 10985 const u8 *ap_addr, *ssid; 10986 unsigned int link_id; 10987 int err, ssid_len; 10988 10989 if (dev->ieee80211_ptr->conn_owner_nlportid && 10990 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10991 return -EPERM; 10992 10993 if (!info->attrs[NL80211_ATTR_SSID]) 10994 return -EINVAL; 10995 10996 if (!rdev->ops->assoc) 10997 return -EOPNOTSUPP; 10998 10999 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11000 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11001 return -EOPNOTSUPP; 11002 11003 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11004 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11005 11006 if (info->attrs[NL80211_ATTR_IE]) { 11007 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11008 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11009 11010 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 11011 req.ie, req.ie_len)) { 11012 NL_SET_ERR_MSG_ATTR(info->extack, 11013 info->attrs[NL80211_ATTR_IE], 11014 "non-inheritance makes no sense"); 11015 return -EINVAL; 11016 } 11017 } 11018 11019 if (info->attrs[NL80211_ATTR_USE_MFP]) { 11020 enum nl80211_mfp mfp = 11021 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 11022 if (mfp == NL80211_MFP_REQUIRED) 11023 req.use_mfp = true; 11024 else if (mfp != NL80211_MFP_NO) 11025 return -EINVAL; 11026 } 11027 11028 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 11029 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 11030 11031 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 11032 req.flags |= ASSOC_REQ_DISABLE_HT; 11033 11034 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11035 memcpy(&req.ht_capa_mask, 11036 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11037 sizeof(req.ht_capa_mask)); 11038 11039 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11040 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11041 return -EINVAL; 11042 memcpy(&req.ht_capa, 11043 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11044 sizeof(req.ht_capa)); 11045 } 11046 11047 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 11048 req.flags |= ASSOC_REQ_DISABLE_VHT; 11049 11050 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 11051 req.flags |= ASSOC_REQ_DISABLE_HE; 11052 11053 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 11054 req.flags |= ASSOC_REQ_DISABLE_EHT; 11055 11056 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11057 memcpy(&req.vht_capa_mask, 11058 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 11059 sizeof(req.vht_capa_mask)); 11060 11061 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 11062 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11063 return -EINVAL; 11064 memcpy(&req.vht_capa, 11065 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 11066 sizeof(req.vht_capa)); 11067 } 11068 11069 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 11070 if (!((rdev->wiphy.features & 11071 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 11072 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 11073 !wiphy_ext_feature_isset(&rdev->wiphy, 11074 NL80211_EXT_FEATURE_RRM)) 11075 return -EINVAL; 11076 req.flags |= ASSOC_REQ_USE_RRM; 11077 } 11078 11079 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 11080 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 11081 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 11082 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 11083 return -EINVAL; 11084 req.fils_nonces = 11085 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 11086 } 11087 11088 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 11089 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 11090 return -EINVAL; 11091 memcpy(&req.s1g_capa_mask, 11092 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 11093 sizeof(req.s1g_capa_mask)); 11094 } 11095 11096 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 11097 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 11098 return -EINVAL; 11099 memcpy(&req.s1g_capa, 11100 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 11101 sizeof(req.s1g_capa)); 11102 } 11103 11104 req.link_id = nl80211_link_id_or_invalid(info->attrs); 11105 11106 if (info->attrs[NL80211_ATTR_MLO_LINKS]) { 11107 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs); 11108 struct nlattr *link; 11109 int rem = 0; 11110 11111 if (req.link_id < 0) 11112 return -EINVAL; 11113 11114 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 11115 return -EINVAL; 11116 11117 if (info->attrs[NL80211_ATTR_MAC] || 11118 info->attrs[NL80211_ATTR_WIPHY_FREQ] || 11119 !info->attrs[NL80211_ATTR_MLD_ADDR]) 11120 return -EINVAL; 11121 11122 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 11123 ap_addr = req.ap_mld_addr; 11124 11125 attrs = kzalloc(attrsize, GFP_KERNEL); 11126 if (!attrs) 11127 return -ENOMEM; 11128 11129 nla_for_each_nested(link, 11130 info->attrs[NL80211_ATTR_MLO_LINKS], 11131 rem) { 11132 memset(attrs, 0, attrsize); 11133 11134 nla_parse_nested(attrs, NL80211_ATTR_MAX, 11135 link, NULL, NULL); 11136 11137 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) { 11138 err = -EINVAL; 11139 NL_SET_BAD_ATTR(info->extack, link); 11140 goto free; 11141 } 11142 11143 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]); 11144 /* cannot use the same link ID again */ 11145 if (req.links[link_id].bss) { 11146 err = -EINVAL; 11147 NL_SET_BAD_ATTR(info->extack, link); 11148 goto free; 11149 } 11150 req.links[link_id].bss = 11151 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs, 11152 req.link_id, link_id); 11153 if (IS_ERR(req.links[link_id].bss)) { 11154 err = PTR_ERR(req.links[link_id].bss); 11155 req.links[link_id].bss = NULL; 11156 NL_SET_ERR_MSG_ATTR(info->extack, 11157 link, "Error fetching BSS for link"); 11158 goto free; 11159 } 11160 11161 if (attrs[NL80211_ATTR_IE]) { 11162 req.links[link_id].elems = 11163 nla_data(attrs[NL80211_ATTR_IE]); 11164 req.links[link_id].elems_len = 11165 nla_len(attrs[NL80211_ATTR_IE]); 11166 11167 if (cfg80211_find_elem(WLAN_EID_FRAGMENT, 11168 req.links[link_id].elems, 11169 req.links[link_id].elems_len)) { 11170 NL_SET_ERR_MSG_ATTR(info->extack, 11171 attrs[NL80211_ATTR_IE], 11172 "cannot deal with fragmentation"); 11173 err = -EINVAL; 11174 goto free; 11175 } 11176 11177 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 11178 req.links[link_id].elems, 11179 req.links[link_id].elems_len)) { 11180 NL_SET_ERR_MSG_ATTR(info->extack, 11181 attrs[NL80211_ATTR_IE], 11182 "cannot deal with non-inheritance"); 11183 err = -EINVAL; 11184 goto free; 11185 } 11186 } 11187 11188 req.links[link_id].disabled = 11189 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]); 11190 } 11191 11192 if (!req.links[req.link_id].bss) { 11193 err = -EINVAL; 11194 goto free; 11195 } 11196 11197 if (req.links[req.link_id].elems_len) { 11198 GENL_SET_ERR_MSG(info, 11199 "cannot have per-link elems on assoc link"); 11200 err = -EINVAL; 11201 goto free; 11202 } 11203 11204 if (req.links[req.link_id].disabled) { 11205 GENL_SET_ERR_MSG(info, 11206 "cannot have assoc link disabled"); 11207 err = -EINVAL; 11208 goto free; 11209 } 11210 11211 kfree(attrs); 11212 attrs = NULL; 11213 } else { 11214 if (req.link_id >= 0) 11215 return -EINVAL; 11216 11217 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs, 11218 -1, -1); 11219 if (IS_ERR(req.bss)) 11220 return PTR_ERR(req.bss); 11221 ap_addr = req.bss->bssid; 11222 } 11223 11224 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 11225 if (!err) { 11226 struct nlattr *link; 11227 int rem = 0; 11228 11229 err = cfg80211_mlme_assoc(rdev, dev, &req); 11230 11231 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 11232 dev->ieee80211_ptr->conn_owner_nlportid = 11233 info->snd_portid; 11234 memcpy(dev->ieee80211_ptr->disconnect_bssid, 11235 ap_addr, ETH_ALEN); 11236 } 11237 11238 /* Report error from first problematic link */ 11239 if (info->attrs[NL80211_ATTR_MLO_LINKS]) { 11240 nla_for_each_nested(link, 11241 info->attrs[NL80211_ATTR_MLO_LINKS], 11242 rem) { 11243 struct nlattr *link_id_attr = 11244 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID); 11245 11246 if (!link_id_attr) 11247 continue; 11248 11249 link_id = nla_get_u8(link_id_attr); 11250 11251 if (link_id == req.link_id) 11252 continue; 11253 11254 if (!req.links[link_id].error || 11255 WARN_ON(req.links[link_id].error > 0)) 11256 continue; 11257 11258 WARN_ON(err >= 0); 11259 11260 NL_SET_BAD_ATTR(info->extack, link); 11261 err = req.links[link_id].error; 11262 break; 11263 } 11264 } 11265 } 11266 11267 free: 11268 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++) 11269 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss); 11270 cfg80211_put_bss(&rdev->wiphy, req.bss); 11271 kfree(attrs); 11272 11273 return err; 11274 } 11275 11276 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 11277 { 11278 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11279 struct net_device *dev = info->user_ptr[1]; 11280 const u8 *ie = NULL, *bssid; 11281 int ie_len = 0; 11282 u16 reason_code; 11283 bool local_state_change; 11284 11285 if (dev->ieee80211_ptr->conn_owner_nlportid && 11286 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11287 return -EPERM; 11288 11289 if (!info->attrs[NL80211_ATTR_MAC]) 11290 return -EINVAL; 11291 11292 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11293 return -EINVAL; 11294 11295 if (!rdev->ops->deauth) 11296 return -EOPNOTSUPP; 11297 11298 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11299 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11300 return -EOPNOTSUPP; 11301 11302 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11303 11304 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11305 if (reason_code == 0) { 11306 /* Reason Code 0 is reserved */ 11307 return -EINVAL; 11308 } 11309 11310 if (info->attrs[NL80211_ATTR_IE]) { 11311 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11312 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11313 } 11314 11315 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11316 11317 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 11318 local_state_change); 11319 } 11320 11321 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 11322 { 11323 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11324 struct net_device *dev = info->user_ptr[1]; 11325 const u8 *ie = NULL, *bssid; 11326 int ie_len = 0; 11327 u16 reason_code; 11328 bool local_state_change; 11329 11330 if (dev->ieee80211_ptr->conn_owner_nlportid && 11331 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11332 return -EPERM; 11333 11334 if (!info->attrs[NL80211_ATTR_MAC]) 11335 return -EINVAL; 11336 11337 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11338 return -EINVAL; 11339 11340 if (!rdev->ops->disassoc) 11341 return -EOPNOTSUPP; 11342 11343 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11344 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11345 return -EOPNOTSUPP; 11346 11347 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11348 11349 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11350 if (reason_code == 0) { 11351 /* Reason Code 0 is reserved */ 11352 return -EINVAL; 11353 } 11354 11355 if (info->attrs[NL80211_ATTR_IE]) { 11356 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11357 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11358 } 11359 11360 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11361 11362 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 11363 local_state_change); 11364 } 11365 11366 static bool 11367 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 11368 int mcast_rate[NUM_NL80211_BANDS], 11369 int rateval) 11370 { 11371 struct wiphy *wiphy = &rdev->wiphy; 11372 bool found = false; 11373 int band, i; 11374 11375 for (band = 0; band < NUM_NL80211_BANDS; band++) { 11376 struct ieee80211_supported_band *sband; 11377 11378 sband = wiphy->bands[band]; 11379 if (!sband) 11380 continue; 11381 11382 for (i = 0; i < sband->n_bitrates; i++) { 11383 if (sband->bitrates[i].bitrate == rateval) { 11384 mcast_rate[band] = i + 1; 11385 found = true; 11386 break; 11387 } 11388 } 11389 } 11390 11391 return found; 11392 } 11393 11394 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 11395 { 11396 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11397 struct net_device *dev = info->user_ptr[1]; 11398 struct cfg80211_ibss_params ibss; 11399 struct wiphy *wiphy; 11400 struct cfg80211_cached_keys *connkeys = NULL; 11401 int err; 11402 11403 memset(&ibss, 0, sizeof(ibss)); 11404 11405 if (!info->attrs[NL80211_ATTR_SSID] || 11406 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11407 return -EINVAL; 11408 11409 ibss.beacon_interval = 100; 11410 11411 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 11412 ibss.beacon_interval = 11413 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11414 11415 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 11416 ibss.beacon_interval); 11417 if (err) 11418 return err; 11419 11420 if (!rdev->ops->join_ibss) 11421 return -EOPNOTSUPP; 11422 11423 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11424 return -EOPNOTSUPP; 11425 11426 wiphy = &rdev->wiphy; 11427 11428 if (info->attrs[NL80211_ATTR_MAC]) { 11429 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11430 11431 if (!is_valid_ether_addr(ibss.bssid)) 11432 return -EINVAL; 11433 } 11434 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11435 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11436 11437 if (info->attrs[NL80211_ATTR_IE]) { 11438 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11439 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11440 } 11441 11442 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 11443 if (err) 11444 return err; 11445 11446 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 11447 NL80211_IFTYPE_ADHOC)) 11448 return -EINVAL; 11449 11450 switch (ibss.chandef.width) { 11451 case NL80211_CHAN_WIDTH_5: 11452 case NL80211_CHAN_WIDTH_10: 11453 case NL80211_CHAN_WIDTH_20_NOHT: 11454 break; 11455 case NL80211_CHAN_WIDTH_20: 11456 case NL80211_CHAN_WIDTH_40: 11457 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11458 return -EINVAL; 11459 break; 11460 case NL80211_CHAN_WIDTH_80: 11461 case NL80211_CHAN_WIDTH_80P80: 11462 case NL80211_CHAN_WIDTH_160: 11463 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11464 return -EINVAL; 11465 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11466 NL80211_EXT_FEATURE_VHT_IBSS)) 11467 return -EINVAL; 11468 break; 11469 case NL80211_CHAN_WIDTH_320: 11470 return -EINVAL; 11471 default: 11472 return -EINVAL; 11473 } 11474 11475 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 11476 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 11477 11478 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11479 u8 *rates = 11480 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11481 int n_rates = 11482 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11483 struct ieee80211_supported_band *sband = 11484 wiphy->bands[ibss.chandef.chan->band]; 11485 11486 err = ieee80211_get_ratemask(sband, rates, n_rates, 11487 &ibss.basic_rates); 11488 if (err) 11489 return err; 11490 } 11491 11492 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11493 memcpy(&ibss.ht_capa_mask, 11494 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11495 sizeof(ibss.ht_capa_mask)); 11496 11497 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11498 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11499 return -EINVAL; 11500 memcpy(&ibss.ht_capa, 11501 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11502 sizeof(ibss.ht_capa)); 11503 } 11504 11505 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11506 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 11507 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11508 return -EINVAL; 11509 11510 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11511 bool no_ht = false; 11512 11513 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 11514 if (IS_ERR(connkeys)) 11515 return PTR_ERR(connkeys); 11516 11517 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 11518 no_ht) { 11519 kfree_sensitive(connkeys); 11520 return -EINVAL; 11521 } 11522 } 11523 11524 ibss.control_port = 11525 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 11526 11527 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11528 int r = validate_pae_over_nl80211(rdev, info); 11529 11530 if (r < 0) { 11531 kfree_sensitive(connkeys); 11532 return r; 11533 } 11534 11535 ibss.control_port_over_nl80211 = true; 11536 } 11537 11538 ibss.userspace_handles_dfs = 11539 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11540 11541 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 11542 if (err) 11543 kfree_sensitive(connkeys); 11544 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11545 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11546 11547 return err; 11548 } 11549 11550 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 11551 { 11552 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11553 struct net_device *dev = info->user_ptr[1]; 11554 11555 if (!rdev->ops->leave_ibss) 11556 return -EOPNOTSUPP; 11557 11558 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11559 return -EOPNOTSUPP; 11560 11561 return cfg80211_leave_ibss(rdev, dev, false); 11562 } 11563 11564 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 11565 { 11566 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11567 struct net_device *dev = info->user_ptr[1]; 11568 int mcast_rate[NUM_NL80211_BANDS]; 11569 u32 nla_rate; 11570 11571 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 11572 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 11573 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 11574 return -EOPNOTSUPP; 11575 11576 if (!rdev->ops->set_mcast_rate) 11577 return -EOPNOTSUPP; 11578 11579 memset(mcast_rate, 0, sizeof(mcast_rate)); 11580 11581 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 11582 return -EINVAL; 11583 11584 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 11585 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 11586 return -EINVAL; 11587 11588 return rdev_set_mcast_rate(rdev, dev, mcast_rate); 11589 } 11590 11591 static struct sk_buff * 11592 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 11593 struct wireless_dev *wdev, int approxlen, 11594 u32 portid, u32 seq, enum nl80211_commands cmd, 11595 enum nl80211_attrs attr, 11596 const struct nl80211_vendor_cmd_info *info, 11597 gfp_t gfp) 11598 { 11599 struct sk_buff *skb; 11600 void *hdr; 11601 struct nlattr *data; 11602 11603 skb = nlmsg_new(approxlen + 100, gfp); 11604 if (!skb) 11605 return NULL; 11606 11607 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 11608 if (!hdr) { 11609 kfree_skb(skb); 11610 return NULL; 11611 } 11612 11613 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 11614 goto nla_put_failure; 11615 11616 if (info) { 11617 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 11618 info->vendor_id)) 11619 goto nla_put_failure; 11620 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 11621 info->subcmd)) 11622 goto nla_put_failure; 11623 } 11624 11625 if (wdev) { 11626 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 11627 wdev_id(wdev), NL80211_ATTR_PAD)) 11628 goto nla_put_failure; 11629 if (wdev->netdev && 11630 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 11631 wdev->netdev->ifindex)) 11632 goto nla_put_failure; 11633 } 11634 11635 data = nla_nest_start_noflag(skb, attr); 11636 if (!data) 11637 goto nla_put_failure; 11638 11639 ((void **)skb->cb)[0] = rdev; 11640 ((void **)skb->cb)[1] = hdr; 11641 ((void **)skb->cb)[2] = data; 11642 11643 return skb; 11644 11645 nla_put_failure: 11646 kfree_skb(skb); 11647 return NULL; 11648 } 11649 11650 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 11651 struct wireless_dev *wdev, 11652 enum nl80211_commands cmd, 11653 enum nl80211_attrs attr, 11654 unsigned int portid, 11655 int vendor_event_idx, 11656 int approxlen, gfp_t gfp) 11657 { 11658 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11659 const struct nl80211_vendor_cmd_info *info; 11660 11661 switch (cmd) { 11662 case NL80211_CMD_TESTMODE: 11663 if (WARN_ON(vendor_event_idx != -1)) 11664 return NULL; 11665 info = NULL; 11666 break; 11667 case NL80211_CMD_VENDOR: 11668 if (WARN_ON(vendor_event_idx < 0 || 11669 vendor_event_idx >= wiphy->n_vendor_events)) 11670 return NULL; 11671 info = &wiphy->vendor_events[vendor_event_idx]; 11672 break; 11673 default: 11674 WARN_ON(1); 11675 return NULL; 11676 } 11677 11678 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 11679 cmd, attr, info, gfp); 11680 } 11681 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 11682 11683 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 11684 { 11685 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 11686 void *hdr = ((void **)skb->cb)[1]; 11687 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 11688 struct nlattr *data = ((void **)skb->cb)[2]; 11689 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 11690 11691 /* clear CB data for netlink core to own from now on */ 11692 memset(skb->cb, 0, sizeof(skb->cb)); 11693 11694 nla_nest_end(skb, data); 11695 genlmsg_end(skb, hdr); 11696 11697 if (nlhdr->nlmsg_pid) { 11698 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 11699 nlhdr->nlmsg_pid); 11700 } else { 11701 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 11702 mcgrp = NL80211_MCGRP_VENDOR; 11703 11704 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11705 skb, 0, mcgrp, gfp); 11706 } 11707 } 11708 EXPORT_SYMBOL(__cfg80211_send_event_skb); 11709 11710 #ifdef CONFIG_NL80211_TESTMODE 11711 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 11712 { 11713 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11714 struct wireless_dev *wdev; 11715 int err; 11716 11717 lockdep_assert_held(&rdev->wiphy.mtx); 11718 11719 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 11720 info->attrs); 11721 11722 if (!rdev->ops->testmode_cmd) 11723 return -EOPNOTSUPP; 11724 11725 if (IS_ERR(wdev)) { 11726 err = PTR_ERR(wdev); 11727 if (err != -EINVAL) 11728 return err; 11729 wdev = NULL; 11730 } else if (wdev->wiphy != &rdev->wiphy) { 11731 return -EINVAL; 11732 } 11733 11734 if (!info->attrs[NL80211_ATTR_TESTDATA]) 11735 return -EINVAL; 11736 11737 rdev->cur_cmd_info = info; 11738 err = rdev_testmode_cmd(rdev, wdev, 11739 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 11740 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 11741 rdev->cur_cmd_info = NULL; 11742 11743 return err; 11744 } 11745 11746 static int nl80211_testmode_dump(struct sk_buff *skb, 11747 struct netlink_callback *cb) 11748 { 11749 struct cfg80211_registered_device *rdev; 11750 struct nlattr **attrbuf = NULL; 11751 int err; 11752 long phy_idx; 11753 void *data = NULL; 11754 int data_len = 0; 11755 11756 rtnl_lock(); 11757 11758 if (cb->args[0]) { 11759 /* 11760 * 0 is a valid index, but not valid for args[0], 11761 * so we need to offset by 1. 11762 */ 11763 phy_idx = cb->args[0] - 1; 11764 11765 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 11766 if (!rdev) { 11767 err = -ENOENT; 11768 goto out_err; 11769 } 11770 } else { 11771 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 11772 GFP_KERNEL); 11773 if (!attrbuf) { 11774 err = -ENOMEM; 11775 goto out_err; 11776 } 11777 11778 err = nlmsg_parse_deprecated(cb->nlh, 11779 GENL_HDRLEN + nl80211_fam.hdrsize, 11780 attrbuf, nl80211_fam.maxattr, 11781 nl80211_policy, NULL); 11782 if (err) 11783 goto out_err; 11784 11785 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11786 if (IS_ERR(rdev)) { 11787 err = PTR_ERR(rdev); 11788 goto out_err; 11789 } 11790 phy_idx = rdev->wiphy_idx; 11791 11792 if (attrbuf[NL80211_ATTR_TESTDATA]) 11793 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 11794 } 11795 11796 if (cb->args[1]) { 11797 data = nla_data((void *)cb->args[1]); 11798 data_len = nla_len((void *)cb->args[1]); 11799 } 11800 11801 if (!rdev->ops->testmode_dump) { 11802 err = -EOPNOTSUPP; 11803 goto out_err; 11804 } 11805 11806 while (1) { 11807 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 11808 cb->nlh->nlmsg_seq, NLM_F_MULTI, 11809 NL80211_CMD_TESTMODE); 11810 struct nlattr *tmdata; 11811 11812 if (!hdr) 11813 break; 11814 11815 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 11816 genlmsg_cancel(skb, hdr); 11817 break; 11818 } 11819 11820 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 11821 if (!tmdata) { 11822 genlmsg_cancel(skb, hdr); 11823 break; 11824 } 11825 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 11826 nla_nest_end(skb, tmdata); 11827 11828 if (err == -ENOBUFS || err == -ENOENT) { 11829 genlmsg_cancel(skb, hdr); 11830 break; 11831 } else if (err) { 11832 genlmsg_cancel(skb, hdr); 11833 goto out_err; 11834 } 11835 11836 genlmsg_end(skb, hdr); 11837 } 11838 11839 err = skb->len; 11840 /* see above */ 11841 cb->args[0] = phy_idx + 1; 11842 out_err: 11843 kfree(attrbuf); 11844 rtnl_unlock(); 11845 return err; 11846 } 11847 #endif 11848 11849 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 11850 { 11851 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11852 struct net_device *dev = info->user_ptr[1]; 11853 struct cfg80211_connect_params connect; 11854 struct wiphy *wiphy; 11855 struct cfg80211_cached_keys *connkeys = NULL; 11856 u32 freq = 0; 11857 int err; 11858 11859 memset(&connect, 0, sizeof(connect)); 11860 11861 if (!info->attrs[NL80211_ATTR_SSID] || 11862 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11863 return -EINVAL; 11864 11865 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 11866 connect.auth_type = 11867 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 11868 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 11869 NL80211_CMD_CONNECT)) 11870 return -EINVAL; 11871 } else 11872 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 11873 11874 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 11875 11876 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 11877 !wiphy_ext_feature_isset(&rdev->wiphy, 11878 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 11879 return -EINVAL; 11880 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 11881 11882 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 11883 NL80211_MAX_NR_CIPHER_SUITES); 11884 if (err) 11885 return err; 11886 11887 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11888 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11889 return -EOPNOTSUPP; 11890 11891 wiphy = &rdev->wiphy; 11892 11893 connect.bg_scan_period = -1; 11894 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 11895 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 11896 connect.bg_scan_period = 11897 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 11898 } 11899 11900 if (info->attrs[NL80211_ATTR_MAC]) 11901 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11902 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 11903 connect.bssid_hint = 11904 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 11905 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11906 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11907 11908 if (info->attrs[NL80211_ATTR_IE]) { 11909 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11910 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11911 } 11912 11913 if (info->attrs[NL80211_ATTR_USE_MFP]) { 11914 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 11915 if (connect.mfp == NL80211_MFP_OPTIONAL && 11916 !wiphy_ext_feature_isset(&rdev->wiphy, 11917 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 11918 return -EOPNOTSUPP; 11919 } else { 11920 connect.mfp = NL80211_MFP_NO; 11921 } 11922 11923 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 11924 connect.prev_bssid = 11925 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 11926 11927 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11928 freq = MHZ_TO_KHZ(nla_get_u32( 11929 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 11930 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 11931 freq += 11932 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 11933 11934 if (freq) { 11935 connect.channel = nl80211_get_valid_chan(wiphy, freq); 11936 if (!connect.channel) 11937 return -EINVAL; 11938 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 11939 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 11940 freq = MHZ_TO_KHZ(freq); 11941 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 11942 if (!connect.channel_hint) 11943 return -EINVAL; 11944 } 11945 11946 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 11947 connect.edmg.channels = 11948 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 11949 11950 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 11951 connect.edmg.bw_config = 11952 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 11953 } 11954 11955 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11956 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 11957 if (IS_ERR(connkeys)) 11958 return PTR_ERR(connkeys); 11959 } 11960 11961 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 11962 connect.flags |= ASSOC_REQ_DISABLE_HT; 11963 11964 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11965 memcpy(&connect.ht_capa_mask, 11966 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11967 sizeof(connect.ht_capa_mask)); 11968 11969 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11970 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 11971 kfree_sensitive(connkeys); 11972 return -EINVAL; 11973 } 11974 memcpy(&connect.ht_capa, 11975 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11976 sizeof(connect.ht_capa)); 11977 } 11978 11979 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 11980 connect.flags |= ASSOC_REQ_DISABLE_VHT; 11981 11982 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 11983 connect.flags |= ASSOC_REQ_DISABLE_HE; 11984 11985 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 11986 connect.flags |= ASSOC_REQ_DISABLE_EHT; 11987 11988 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11989 memcpy(&connect.vht_capa_mask, 11990 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 11991 sizeof(connect.vht_capa_mask)); 11992 11993 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 11994 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 11995 kfree_sensitive(connkeys); 11996 return -EINVAL; 11997 } 11998 memcpy(&connect.vht_capa, 11999 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 12000 sizeof(connect.vht_capa)); 12001 } 12002 12003 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 12004 if (!((rdev->wiphy.features & 12005 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 12006 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 12007 !wiphy_ext_feature_isset(&rdev->wiphy, 12008 NL80211_EXT_FEATURE_RRM)) { 12009 kfree_sensitive(connkeys); 12010 return -EINVAL; 12011 } 12012 connect.flags |= ASSOC_REQ_USE_RRM; 12013 } 12014 12015 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 12016 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 12017 kfree_sensitive(connkeys); 12018 return -EOPNOTSUPP; 12019 } 12020 12021 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 12022 /* bss selection makes no sense if bssid is set */ 12023 if (connect.bssid) { 12024 kfree_sensitive(connkeys); 12025 return -EINVAL; 12026 } 12027 12028 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 12029 wiphy, &connect.bss_select); 12030 if (err) { 12031 kfree_sensitive(connkeys); 12032 return err; 12033 } 12034 } 12035 12036 if (wiphy_ext_feature_isset(&rdev->wiphy, 12037 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 12038 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 12039 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 12040 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 12041 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12042 connect.fils_erp_username = 12043 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12044 connect.fils_erp_username_len = 12045 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12046 connect.fils_erp_realm = 12047 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12048 connect.fils_erp_realm_len = 12049 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12050 connect.fils_erp_next_seq_num = 12051 nla_get_u16( 12052 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 12053 connect.fils_erp_rrk = 12054 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12055 connect.fils_erp_rrk_len = 12056 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12057 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 12058 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 12059 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 12060 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12061 kfree_sensitive(connkeys); 12062 return -EINVAL; 12063 } 12064 12065 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 12066 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 12067 kfree_sensitive(connkeys); 12068 GENL_SET_ERR_MSG(info, 12069 "external auth requires connection ownership"); 12070 return -EINVAL; 12071 } 12072 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 12073 } 12074 12075 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT])) 12076 connect.flags |= CONNECT_REQ_MLO_SUPPORT; 12077 12078 err = cfg80211_connect(rdev, dev, &connect, connkeys, 12079 connect.prev_bssid); 12080 if (err) 12081 kfree_sensitive(connkeys); 12082 12083 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 12084 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 12085 if (connect.bssid) 12086 memcpy(dev->ieee80211_ptr->disconnect_bssid, 12087 connect.bssid, ETH_ALEN); 12088 else 12089 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 12090 } 12091 12092 return err; 12093 } 12094 12095 static int nl80211_update_connect_params(struct sk_buff *skb, 12096 struct genl_info *info) 12097 { 12098 struct cfg80211_connect_params connect = {}; 12099 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12100 struct net_device *dev = info->user_ptr[1]; 12101 struct wireless_dev *wdev = dev->ieee80211_ptr; 12102 bool fils_sk_offload; 12103 u32 auth_type; 12104 u32 changed = 0; 12105 12106 if (!rdev->ops->update_connect_params) 12107 return -EOPNOTSUPP; 12108 12109 if (info->attrs[NL80211_ATTR_IE]) { 12110 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 12111 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 12112 changed |= UPDATE_ASSOC_IES; 12113 } 12114 12115 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 12116 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 12117 12118 /* 12119 * when driver supports fils-sk offload all attributes must be 12120 * provided. So the else covers "fils-sk-not-all" and 12121 * "no-fils-sk-any". 12122 */ 12123 if (fils_sk_offload && 12124 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 12125 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 12126 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 12127 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12128 connect.fils_erp_username = 12129 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12130 connect.fils_erp_username_len = 12131 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12132 connect.fils_erp_realm = 12133 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12134 connect.fils_erp_realm_len = 12135 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12136 connect.fils_erp_next_seq_num = 12137 nla_get_u16( 12138 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 12139 connect.fils_erp_rrk = 12140 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12141 connect.fils_erp_rrk_len = 12142 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12143 changed |= UPDATE_FILS_ERP_INFO; 12144 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 12145 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 12146 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 12147 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12148 return -EINVAL; 12149 } 12150 12151 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 12152 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 12153 if (!nl80211_valid_auth_type(rdev, auth_type, 12154 NL80211_CMD_CONNECT)) 12155 return -EINVAL; 12156 12157 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 12158 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 12159 return -EINVAL; 12160 12161 connect.auth_type = auth_type; 12162 changed |= UPDATE_AUTH_TYPE; 12163 } 12164 12165 if (!wdev->connected) 12166 return -ENOLINK; 12167 12168 return rdev_update_connect_params(rdev, dev, &connect, changed); 12169 } 12170 12171 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 12172 { 12173 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12174 struct net_device *dev = info->user_ptr[1]; 12175 u16 reason; 12176 12177 if (dev->ieee80211_ptr->conn_owner_nlportid && 12178 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 12179 return -EPERM; 12180 12181 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 12182 reason = WLAN_REASON_DEAUTH_LEAVING; 12183 else 12184 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 12185 12186 if (reason == 0) 12187 return -EINVAL; 12188 12189 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12190 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12191 return -EOPNOTSUPP; 12192 12193 return cfg80211_disconnect(rdev, dev, reason, true); 12194 } 12195 12196 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 12197 { 12198 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12199 struct net *net; 12200 int err; 12201 12202 if (info->attrs[NL80211_ATTR_PID]) { 12203 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 12204 12205 net = get_net_ns_by_pid(pid); 12206 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 12207 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 12208 12209 net = get_net_ns_by_fd(fd); 12210 } else { 12211 return -EINVAL; 12212 } 12213 12214 if (IS_ERR(net)) 12215 return PTR_ERR(net); 12216 12217 err = 0; 12218 12219 /* check if anything to do */ 12220 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 12221 err = cfg80211_switch_netns(rdev, net); 12222 12223 put_net(net); 12224 return err; 12225 } 12226 12227 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info) 12228 { 12229 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12230 struct net_device *dev = info->user_ptr[1]; 12231 struct cfg80211_pmksa pmksa; 12232 bool ap_pmksa_caching_support = false; 12233 12234 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 12235 12236 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy, 12237 NL80211_EXT_FEATURE_AP_PMKSA_CACHING); 12238 12239 if (!info->attrs[NL80211_ATTR_PMKID]) 12240 return -EINVAL; 12241 12242 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 12243 12244 if (info->attrs[NL80211_ATTR_MAC]) { 12245 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 12246 } else if (info->attrs[NL80211_ATTR_SSID] && 12247 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 12248 info->attrs[NL80211_ATTR_PMK]) { 12249 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 12250 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12251 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 12252 } else { 12253 return -EINVAL; 12254 } 12255 12256 if (info->attrs[NL80211_ATTR_PMK]) { 12257 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12258 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12259 } 12260 12261 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 12262 pmksa.pmk_lifetime = 12263 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 12264 12265 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 12266 pmksa.pmk_reauth_threshold = 12267 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 12268 12269 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12270 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 12271 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP || 12272 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) && 12273 ap_pmksa_caching_support)) 12274 return -EOPNOTSUPP; 12275 12276 if (!rdev->ops->set_pmksa) 12277 return -EOPNOTSUPP; 12278 12279 return rdev_set_pmksa(rdev, dev, &pmksa); 12280 } 12281 12282 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info) 12283 { 12284 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12285 struct net_device *dev = info->user_ptr[1]; 12286 struct cfg80211_pmksa pmksa; 12287 bool sae_offload_support = false; 12288 bool owe_offload_support = false; 12289 bool ap_pmksa_caching_support = false; 12290 12291 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 12292 12293 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy, 12294 NL80211_EXT_FEATURE_SAE_OFFLOAD); 12295 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy, 12296 NL80211_EXT_FEATURE_OWE_OFFLOAD); 12297 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy, 12298 NL80211_EXT_FEATURE_AP_PMKSA_CACHING); 12299 12300 if (info->attrs[NL80211_ATTR_PMKID]) 12301 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 12302 12303 if (info->attrs[NL80211_ATTR_MAC]) { 12304 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 12305 } else if (info->attrs[NL80211_ATTR_SSID]) { 12306 /* SSID based pmksa flush suppported only for FILS, 12307 * OWE/SAE OFFLOAD cases 12308 */ 12309 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 12310 info->attrs[NL80211_ATTR_PMK]) { 12311 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 12312 } else if (!sae_offload_support && !owe_offload_support) { 12313 return -EINVAL; 12314 } 12315 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 12316 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12317 } else { 12318 return -EINVAL; 12319 } 12320 12321 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12322 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 12323 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP || 12324 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) && 12325 ap_pmksa_caching_support)) 12326 return -EOPNOTSUPP; 12327 12328 if (!rdev->ops->del_pmksa) 12329 return -EOPNOTSUPP; 12330 12331 return rdev_del_pmksa(rdev, dev, &pmksa); 12332 } 12333 12334 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 12335 { 12336 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12337 struct net_device *dev = info->user_ptr[1]; 12338 12339 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12340 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12341 return -EOPNOTSUPP; 12342 12343 if (!rdev->ops->flush_pmksa) 12344 return -EOPNOTSUPP; 12345 12346 return rdev_flush_pmksa(rdev, dev); 12347 } 12348 12349 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 12350 { 12351 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12352 struct net_device *dev = info->user_ptr[1]; 12353 u8 action_code, dialog_token; 12354 u32 peer_capability = 0; 12355 u16 status_code; 12356 u8 *peer; 12357 int link_id; 12358 bool initiator; 12359 12360 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12361 !rdev->ops->tdls_mgmt) 12362 return -EOPNOTSUPP; 12363 12364 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 12365 !info->attrs[NL80211_ATTR_STATUS_CODE] || 12366 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 12367 !info->attrs[NL80211_ATTR_IE] || 12368 !info->attrs[NL80211_ATTR_MAC]) 12369 return -EINVAL; 12370 12371 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12372 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 12373 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 12374 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 12375 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 12376 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 12377 peer_capability = 12378 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 12379 link_id = nl80211_link_id_or_invalid(info->attrs); 12380 12381 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code, 12382 dialog_token, status_code, peer_capability, 12383 initiator, 12384 nla_data(info->attrs[NL80211_ATTR_IE]), 12385 nla_len(info->attrs[NL80211_ATTR_IE])); 12386 } 12387 12388 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 12389 { 12390 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12391 struct net_device *dev = info->user_ptr[1]; 12392 enum nl80211_tdls_operation operation; 12393 u8 *peer; 12394 12395 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12396 !rdev->ops->tdls_oper) 12397 return -EOPNOTSUPP; 12398 12399 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 12400 !info->attrs[NL80211_ATTR_MAC]) 12401 return -EINVAL; 12402 12403 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 12404 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12405 12406 return rdev_tdls_oper(rdev, dev, peer, operation); 12407 } 12408 12409 static int nl80211_remain_on_channel(struct sk_buff *skb, 12410 struct genl_info *info) 12411 { 12412 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12413 unsigned int link_id = nl80211_link_id(info->attrs); 12414 struct wireless_dev *wdev = info->user_ptr[1]; 12415 struct cfg80211_chan_def chandef; 12416 struct sk_buff *msg; 12417 void *hdr; 12418 u64 cookie; 12419 u32 duration; 12420 int err; 12421 12422 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 12423 !info->attrs[NL80211_ATTR_DURATION]) 12424 return -EINVAL; 12425 12426 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12427 12428 if (!rdev->ops->remain_on_channel || 12429 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 12430 return -EOPNOTSUPP; 12431 12432 /* 12433 * We should be on that channel for at least a minimum amount of 12434 * time (10ms) but no longer than the driver supports. 12435 */ 12436 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12437 duration > rdev->wiphy.max_remain_on_channel_duration) 12438 return -EINVAL; 12439 12440 err = nl80211_parse_chandef(rdev, info, &chandef); 12441 if (err) 12442 return err; 12443 12444 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) { 12445 const struct cfg80211_chan_def *oper_chandef, *compat_chandef; 12446 12447 oper_chandef = wdev_chandef(wdev, link_id); 12448 12449 if (WARN_ON(!oper_chandef)) { 12450 /* cannot happen since we must beacon to get here */ 12451 WARN_ON(1); 12452 return -EBUSY; 12453 } 12454 12455 /* note: returns first one if identical chandefs */ 12456 compat_chandef = cfg80211_chandef_compatible(&chandef, 12457 oper_chandef); 12458 12459 if (compat_chandef != &chandef) 12460 return -EBUSY; 12461 } 12462 12463 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12464 if (!msg) 12465 return -ENOMEM; 12466 12467 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12468 NL80211_CMD_REMAIN_ON_CHANNEL); 12469 if (!hdr) { 12470 err = -ENOBUFS; 12471 goto free_msg; 12472 } 12473 12474 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 12475 duration, &cookie); 12476 12477 if (err) 12478 goto free_msg; 12479 12480 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12481 NL80211_ATTR_PAD)) 12482 goto nla_put_failure; 12483 12484 genlmsg_end(msg, hdr); 12485 12486 return genlmsg_reply(msg, info); 12487 12488 nla_put_failure: 12489 err = -ENOBUFS; 12490 free_msg: 12491 nlmsg_free(msg); 12492 return err; 12493 } 12494 12495 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 12496 struct genl_info *info) 12497 { 12498 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12499 struct wireless_dev *wdev = info->user_ptr[1]; 12500 u64 cookie; 12501 12502 if (!info->attrs[NL80211_ATTR_COOKIE]) 12503 return -EINVAL; 12504 12505 if (!rdev->ops->cancel_remain_on_channel) 12506 return -EOPNOTSUPP; 12507 12508 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12509 12510 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 12511 } 12512 12513 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 12514 struct genl_info *info) 12515 { 12516 struct cfg80211_bitrate_mask mask; 12517 unsigned int link_id = nl80211_link_id(info->attrs); 12518 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12519 struct net_device *dev = info->user_ptr[1]; 12520 int err; 12521 12522 if (!rdev->ops->set_bitrate_mask) 12523 return -EOPNOTSUPP; 12524 12525 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 12526 NL80211_ATTR_TX_RATES, &mask, 12527 dev, true, link_id); 12528 if (err) 12529 return err; 12530 12531 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask); 12532 } 12533 12534 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 12535 { 12536 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12537 struct wireless_dev *wdev = info->user_ptr[1]; 12538 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 12539 12540 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 12541 return -EINVAL; 12542 12543 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 12544 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 12545 12546 switch (wdev->iftype) { 12547 case NL80211_IFTYPE_STATION: 12548 case NL80211_IFTYPE_ADHOC: 12549 case NL80211_IFTYPE_P2P_CLIENT: 12550 case NL80211_IFTYPE_AP: 12551 case NL80211_IFTYPE_AP_VLAN: 12552 case NL80211_IFTYPE_MESH_POINT: 12553 case NL80211_IFTYPE_P2P_GO: 12554 case NL80211_IFTYPE_P2P_DEVICE: 12555 break; 12556 case NL80211_IFTYPE_NAN: 12557 if (!wiphy_ext_feature_isset(wdev->wiphy, 12558 NL80211_EXT_FEATURE_SECURE_NAN)) 12559 return -EOPNOTSUPP; 12560 break; 12561 default: 12562 return -EOPNOTSUPP; 12563 } 12564 12565 /* not much point in registering if we can't reply */ 12566 if (!rdev->ops->mgmt_tx) 12567 return -EOPNOTSUPP; 12568 12569 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 12570 !wiphy_ext_feature_isset(&rdev->wiphy, 12571 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 12572 GENL_SET_ERR_MSG(info, 12573 "multicast RX registrations are not supported"); 12574 return -EOPNOTSUPP; 12575 } 12576 12577 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 12578 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12579 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12580 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 12581 info->extack); 12582 } 12583 12584 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 12585 { 12586 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12587 struct wireless_dev *wdev = info->user_ptr[1]; 12588 struct cfg80211_chan_def chandef; 12589 int err; 12590 void *hdr = NULL; 12591 u64 cookie; 12592 struct sk_buff *msg = NULL; 12593 struct cfg80211_mgmt_tx_params params = { 12594 .dont_wait_for_ack = 12595 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 12596 }; 12597 12598 if (!info->attrs[NL80211_ATTR_FRAME]) 12599 return -EINVAL; 12600 12601 if (!rdev->ops->mgmt_tx) 12602 return -EOPNOTSUPP; 12603 12604 switch (wdev->iftype) { 12605 case NL80211_IFTYPE_P2P_DEVICE: 12606 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 12607 return -EINVAL; 12608 break; 12609 case NL80211_IFTYPE_STATION: 12610 case NL80211_IFTYPE_ADHOC: 12611 case NL80211_IFTYPE_P2P_CLIENT: 12612 case NL80211_IFTYPE_AP: 12613 case NL80211_IFTYPE_AP_VLAN: 12614 case NL80211_IFTYPE_MESH_POINT: 12615 case NL80211_IFTYPE_P2P_GO: 12616 break; 12617 case NL80211_IFTYPE_NAN: 12618 if (!wiphy_ext_feature_isset(wdev->wiphy, 12619 NL80211_EXT_FEATURE_SECURE_NAN)) 12620 return -EOPNOTSUPP; 12621 break; 12622 default: 12623 return -EOPNOTSUPP; 12624 } 12625 12626 if (info->attrs[NL80211_ATTR_DURATION]) { 12627 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12628 return -EINVAL; 12629 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12630 12631 /* 12632 * We should wait on the channel for at least a minimum amount 12633 * of time (10ms) but no longer than the driver supports. 12634 */ 12635 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12636 params.wait > rdev->wiphy.max_remain_on_channel_duration) 12637 return -EINVAL; 12638 } 12639 12640 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 12641 12642 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12643 return -EINVAL; 12644 12645 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 12646 12647 /* get the channel if any has been specified, otherwise pass NULL to 12648 * the driver. The latter will use the current one 12649 */ 12650 chandef.chan = NULL; 12651 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 12652 err = nl80211_parse_chandef(rdev, info, &chandef); 12653 if (err) 12654 return err; 12655 } 12656 12657 if (!chandef.chan && params.offchan) 12658 return -EINVAL; 12659 12660 if (params.offchan && 12661 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) 12662 return -EBUSY; 12663 12664 params.link_id = nl80211_link_id_or_invalid(info->attrs); 12665 /* 12666 * This now races due to the unlock, but we cannot check 12667 * the valid links for the _station_ anyway, so that's up 12668 * to the driver. 12669 */ 12670 if (params.link_id >= 0 && 12671 !(wdev->valid_links & BIT(params.link_id))) 12672 return -EINVAL; 12673 12674 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 12675 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 12676 12677 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 12678 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12679 int i; 12680 12681 if (len % sizeof(u16)) 12682 return -EINVAL; 12683 12684 params.n_csa_offsets = len / sizeof(u16); 12685 params.csa_offsets = 12686 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12687 12688 /* check that all the offsets fit the frame */ 12689 for (i = 0; i < params.n_csa_offsets; i++) { 12690 if (params.csa_offsets[i] >= params.len) 12691 return -EINVAL; 12692 } 12693 } 12694 12695 if (!params.dont_wait_for_ack) { 12696 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12697 if (!msg) 12698 return -ENOMEM; 12699 12700 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12701 NL80211_CMD_FRAME); 12702 if (!hdr) { 12703 err = -ENOBUFS; 12704 goto free_msg; 12705 } 12706 } 12707 12708 params.chan = chandef.chan; 12709 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 12710 if (err) 12711 goto free_msg; 12712 12713 if (msg) { 12714 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12715 NL80211_ATTR_PAD)) 12716 goto nla_put_failure; 12717 12718 genlmsg_end(msg, hdr); 12719 return genlmsg_reply(msg, info); 12720 } 12721 12722 return 0; 12723 12724 nla_put_failure: 12725 err = -ENOBUFS; 12726 free_msg: 12727 nlmsg_free(msg); 12728 return err; 12729 } 12730 12731 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 12732 { 12733 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12734 struct wireless_dev *wdev = info->user_ptr[1]; 12735 u64 cookie; 12736 12737 if (!info->attrs[NL80211_ATTR_COOKIE]) 12738 return -EINVAL; 12739 12740 if (!rdev->ops->mgmt_tx_cancel_wait) 12741 return -EOPNOTSUPP; 12742 12743 switch (wdev->iftype) { 12744 case NL80211_IFTYPE_STATION: 12745 case NL80211_IFTYPE_ADHOC: 12746 case NL80211_IFTYPE_P2P_CLIENT: 12747 case NL80211_IFTYPE_AP: 12748 case NL80211_IFTYPE_AP_VLAN: 12749 case NL80211_IFTYPE_P2P_GO: 12750 case NL80211_IFTYPE_P2P_DEVICE: 12751 break; 12752 case NL80211_IFTYPE_NAN: 12753 if (!wiphy_ext_feature_isset(wdev->wiphy, 12754 NL80211_EXT_FEATURE_SECURE_NAN)) 12755 return -EOPNOTSUPP; 12756 break; 12757 default: 12758 return -EOPNOTSUPP; 12759 } 12760 12761 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12762 12763 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 12764 } 12765 12766 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 12767 { 12768 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12769 struct wireless_dev *wdev; 12770 struct net_device *dev = info->user_ptr[1]; 12771 u8 ps_state; 12772 bool state; 12773 int err; 12774 12775 if (!info->attrs[NL80211_ATTR_PS_STATE]) 12776 return -EINVAL; 12777 12778 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 12779 12780 wdev = dev->ieee80211_ptr; 12781 12782 if (!rdev->ops->set_power_mgmt) 12783 return -EOPNOTSUPP; 12784 12785 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 12786 12787 if (state == wdev->ps) 12788 return 0; 12789 12790 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 12791 if (!err) 12792 wdev->ps = state; 12793 return err; 12794 } 12795 12796 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 12797 { 12798 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12799 enum nl80211_ps_state ps_state; 12800 struct wireless_dev *wdev; 12801 struct net_device *dev = info->user_ptr[1]; 12802 struct sk_buff *msg; 12803 void *hdr; 12804 int err; 12805 12806 wdev = dev->ieee80211_ptr; 12807 12808 if (!rdev->ops->set_power_mgmt) 12809 return -EOPNOTSUPP; 12810 12811 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12812 if (!msg) 12813 return -ENOMEM; 12814 12815 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12816 NL80211_CMD_GET_POWER_SAVE); 12817 if (!hdr) { 12818 err = -ENOBUFS; 12819 goto free_msg; 12820 } 12821 12822 if (wdev->ps) 12823 ps_state = NL80211_PS_ENABLED; 12824 else 12825 ps_state = NL80211_PS_DISABLED; 12826 12827 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 12828 goto nla_put_failure; 12829 12830 genlmsg_end(msg, hdr); 12831 return genlmsg_reply(msg, info); 12832 12833 nla_put_failure: 12834 err = -ENOBUFS; 12835 free_msg: 12836 nlmsg_free(msg); 12837 return err; 12838 } 12839 12840 static const struct nla_policy 12841 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 12842 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 12843 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 12844 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 12845 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 12846 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 12847 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 12848 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 12849 }; 12850 12851 static int nl80211_set_cqm_txe(struct genl_info *info, 12852 u32 rate, u32 pkts, u32 intvl) 12853 { 12854 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12855 struct net_device *dev = info->user_ptr[1]; 12856 struct wireless_dev *wdev = dev->ieee80211_ptr; 12857 12858 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 12859 return -EINVAL; 12860 12861 if (!rdev->ops->set_cqm_txe_config) 12862 return -EOPNOTSUPP; 12863 12864 if (wdev->iftype != NL80211_IFTYPE_STATION && 12865 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12866 return -EOPNOTSUPP; 12867 12868 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 12869 } 12870 12871 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 12872 struct net_device *dev, 12873 struct cfg80211_cqm_config *cqm_config) 12874 { 12875 struct wireless_dev *wdev = dev->ieee80211_ptr; 12876 s32 last, low, high; 12877 u32 hyst; 12878 int i, n, low_index; 12879 int err; 12880 12881 /* 12882 * Obtain current RSSI value if possible, if not and no RSSI threshold 12883 * event has been received yet, we should receive an event after a 12884 * connection is established and enough beacons received to calculate 12885 * the average. 12886 */ 12887 if (!cqm_config->last_rssi_event_value && 12888 wdev->links[0].client.current_bss && 12889 rdev->ops->get_station) { 12890 struct station_info sinfo = {}; 12891 u8 *mac_addr; 12892 12893 mac_addr = wdev->links[0].client.current_bss->pub.bssid; 12894 12895 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 12896 if (err) 12897 return err; 12898 12899 cfg80211_sinfo_release_content(&sinfo); 12900 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 12901 cqm_config->last_rssi_event_value = 12902 (s8) sinfo.rx_beacon_signal_avg; 12903 } 12904 12905 last = cqm_config->last_rssi_event_value; 12906 hyst = cqm_config->rssi_hyst; 12907 n = cqm_config->n_rssi_thresholds; 12908 12909 for (i = 0; i < n; i++) { 12910 i = array_index_nospec(i, n); 12911 if (last < cqm_config->rssi_thresholds[i]) 12912 break; 12913 } 12914 12915 low_index = i - 1; 12916 if (low_index >= 0) { 12917 low_index = array_index_nospec(low_index, n); 12918 low = cqm_config->rssi_thresholds[low_index] - hyst; 12919 } else { 12920 low = S32_MIN; 12921 } 12922 if (i < n) { 12923 i = array_index_nospec(i, n); 12924 high = cqm_config->rssi_thresholds[i] + hyst - 1; 12925 } else { 12926 high = S32_MAX; 12927 } 12928 12929 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 12930 } 12931 12932 static int nl80211_set_cqm_rssi(struct genl_info *info, 12933 const s32 *thresholds, int n_thresholds, 12934 u32 hysteresis) 12935 { 12936 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12937 struct cfg80211_cqm_config *cqm_config = NULL, *old; 12938 struct net_device *dev = info->user_ptr[1]; 12939 struct wireless_dev *wdev = dev->ieee80211_ptr; 12940 s32 prev = S32_MIN; 12941 int i, err; 12942 12943 /* Check all values negative and sorted */ 12944 for (i = 0; i < n_thresholds; i++) { 12945 if (thresholds[i] > 0 || thresholds[i] <= prev) 12946 return -EINVAL; 12947 12948 prev = thresholds[i]; 12949 } 12950 12951 if (wdev->iftype != NL80211_IFTYPE_STATION && 12952 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12953 return -EOPNOTSUPP; 12954 12955 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 12956 n_thresholds = 0; 12957 12958 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config); 12959 12960 /* if already disabled just succeed */ 12961 if (!n_thresholds && !old) 12962 return 0; 12963 12964 if (n_thresholds > 1) { 12965 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12966 NL80211_EXT_FEATURE_CQM_RSSI_LIST) || 12967 !rdev->ops->set_cqm_rssi_range_config) 12968 return -EOPNOTSUPP; 12969 } else { 12970 if (!rdev->ops->set_cqm_rssi_config) 12971 return -EOPNOTSUPP; 12972 } 12973 12974 if (n_thresholds) { 12975 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds, 12976 n_thresholds), 12977 GFP_KERNEL); 12978 if (!cqm_config) 12979 return -ENOMEM; 12980 12981 cqm_config->rssi_hyst = hysteresis; 12982 cqm_config->n_rssi_thresholds = n_thresholds; 12983 memcpy(cqm_config->rssi_thresholds, thresholds, 12984 flex_array_size(cqm_config, rssi_thresholds, 12985 n_thresholds)); 12986 cqm_config->use_range_api = n_thresholds > 1 || 12987 !rdev->ops->set_cqm_rssi_config; 12988 12989 rcu_assign_pointer(wdev->cqm_config, cqm_config); 12990 12991 if (cqm_config->use_range_api) 12992 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config); 12993 else 12994 err = rdev_set_cqm_rssi_config(rdev, dev, 12995 thresholds[0], 12996 hysteresis); 12997 } else { 12998 RCU_INIT_POINTER(wdev->cqm_config, NULL); 12999 /* if enabled as range also disable via range */ 13000 if (old->use_range_api) 13001 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 13002 else 13003 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 13004 } 13005 13006 if (err) { 13007 rcu_assign_pointer(wdev->cqm_config, old); 13008 kfree_rcu(cqm_config, rcu_head); 13009 } else { 13010 kfree_rcu(old, rcu_head); 13011 } 13012 13013 return err; 13014 } 13015 13016 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 13017 { 13018 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 13019 struct nlattr *cqm; 13020 int err; 13021 13022 cqm = info->attrs[NL80211_ATTR_CQM]; 13023 if (!cqm) 13024 return -EINVAL; 13025 13026 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 13027 nl80211_attr_cqm_policy, 13028 info->extack); 13029 if (err) 13030 return err; 13031 13032 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 13033 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 13034 const s32 *thresholds = 13035 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 13036 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 13037 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 13038 13039 if (len % 4) 13040 return -EINVAL; 13041 13042 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 13043 hysteresis); 13044 } 13045 13046 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 13047 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 13048 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 13049 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 13050 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 13051 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 13052 13053 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 13054 } 13055 13056 return -EINVAL; 13057 } 13058 13059 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 13060 { 13061 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13062 struct net_device *dev = info->user_ptr[1]; 13063 struct ocb_setup setup = {}; 13064 int err; 13065 13066 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 13067 if (err) 13068 return err; 13069 13070 return cfg80211_join_ocb(rdev, dev, &setup); 13071 } 13072 13073 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 13074 { 13075 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13076 struct net_device *dev = info->user_ptr[1]; 13077 13078 return cfg80211_leave_ocb(rdev, dev); 13079 } 13080 13081 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 13082 { 13083 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13084 struct net_device *dev = info->user_ptr[1]; 13085 struct mesh_config cfg; 13086 struct mesh_setup setup; 13087 int err; 13088 13089 /* start with default */ 13090 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 13091 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 13092 13093 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 13094 /* and parse parameters if given */ 13095 err = nl80211_parse_mesh_config(info, &cfg, NULL); 13096 if (err) 13097 return err; 13098 } 13099 13100 if (!info->attrs[NL80211_ATTR_MESH_ID] || 13101 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 13102 return -EINVAL; 13103 13104 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 13105 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 13106 13107 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 13108 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 13109 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 13110 return -EINVAL; 13111 13112 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 13113 setup.beacon_interval = 13114 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 13115 13116 err = cfg80211_validate_beacon_int(rdev, 13117 NL80211_IFTYPE_MESH_POINT, 13118 setup.beacon_interval); 13119 if (err) 13120 return err; 13121 } 13122 13123 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 13124 setup.dtim_period = 13125 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 13126 if (setup.dtim_period < 1 || setup.dtim_period > 100) 13127 return -EINVAL; 13128 } 13129 13130 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 13131 /* parse additional setup parameters if given */ 13132 err = nl80211_parse_mesh_setup(info, &setup); 13133 if (err) 13134 return err; 13135 } 13136 13137 if (setup.user_mpm) 13138 cfg.auto_open_plinks = false; 13139 13140 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 13141 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 13142 if (err) 13143 return err; 13144 } else { 13145 /* __cfg80211_join_mesh() will sort it out */ 13146 setup.chandef.chan = NULL; 13147 } 13148 13149 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 13150 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 13151 int n_rates = 13152 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 13153 struct ieee80211_supported_band *sband; 13154 13155 if (!setup.chandef.chan) 13156 return -EINVAL; 13157 13158 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 13159 13160 err = ieee80211_get_ratemask(sband, rates, n_rates, 13161 &setup.basic_rates); 13162 if (err) 13163 return err; 13164 } 13165 13166 if (info->attrs[NL80211_ATTR_TX_RATES]) { 13167 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 13168 NL80211_ATTR_TX_RATES, 13169 &setup.beacon_rate, 13170 dev, false, 0); 13171 if (err) 13172 return err; 13173 13174 if (!setup.chandef.chan) 13175 return -EINVAL; 13176 13177 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 13178 &setup.beacon_rate); 13179 if (err) 13180 return err; 13181 } 13182 13183 setup.userspace_handles_dfs = 13184 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 13185 13186 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 13187 int r = validate_pae_over_nl80211(rdev, info); 13188 13189 if (r < 0) 13190 return r; 13191 13192 setup.control_port_over_nl80211 = true; 13193 } 13194 13195 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 13196 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 13197 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 13198 13199 return err; 13200 } 13201 13202 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 13203 { 13204 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13205 struct net_device *dev = info->user_ptr[1]; 13206 13207 return cfg80211_leave_mesh(rdev, dev); 13208 } 13209 13210 #ifdef CONFIG_PM 13211 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 13212 struct cfg80211_registered_device *rdev) 13213 { 13214 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 13215 struct nlattr *nl_pats, *nl_pat; 13216 int i, pat_len; 13217 13218 if (!wowlan->n_patterns) 13219 return 0; 13220 13221 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 13222 if (!nl_pats) 13223 return -ENOBUFS; 13224 13225 for (i = 0; i < wowlan->n_patterns; i++) { 13226 nl_pat = nla_nest_start_noflag(msg, i + 1); 13227 if (!nl_pat) 13228 return -ENOBUFS; 13229 pat_len = wowlan->patterns[i].pattern_len; 13230 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 13231 wowlan->patterns[i].mask) || 13232 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13233 wowlan->patterns[i].pattern) || 13234 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13235 wowlan->patterns[i].pkt_offset)) 13236 return -ENOBUFS; 13237 nla_nest_end(msg, nl_pat); 13238 } 13239 nla_nest_end(msg, nl_pats); 13240 13241 return 0; 13242 } 13243 13244 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 13245 struct cfg80211_wowlan_tcp *tcp) 13246 { 13247 struct nlattr *nl_tcp; 13248 13249 if (!tcp) 13250 return 0; 13251 13252 nl_tcp = nla_nest_start_noflag(msg, 13253 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 13254 if (!nl_tcp) 13255 return -ENOBUFS; 13256 13257 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 13258 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 13259 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 13260 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 13261 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 13262 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 13263 tcp->payload_len, tcp->payload) || 13264 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 13265 tcp->data_interval) || 13266 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 13267 tcp->wake_len, tcp->wake_data) || 13268 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 13269 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 13270 return -ENOBUFS; 13271 13272 if (tcp->payload_seq.len && 13273 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 13274 sizeof(tcp->payload_seq), &tcp->payload_seq)) 13275 return -ENOBUFS; 13276 13277 if (tcp->payload_tok.len && 13278 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 13279 sizeof(tcp->payload_tok) + tcp->tokens_size, 13280 &tcp->payload_tok)) 13281 return -ENOBUFS; 13282 13283 nla_nest_end(msg, nl_tcp); 13284 13285 return 0; 13286 } 13287 13288 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 13289 struct cfg80211_sched_scan_request *req) 13290 { 13291 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 13292 int i; 13293 13294 if (!req) 13295 return 0; 13296 13297 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 13298 if (!nd) 13299 return -ENOBUFS; 13300 13301 if (req->n_scan_plans == 1 && 13302 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 13303 req->scan_plans[0].interval * 1000)) 13304 return -ENOBUFS; 13305 13306 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 13307 return -ENOBUFS; 13308 13309 if (req->relative_rssi_set) { 13310 struct nl80211_bss_select_rssi_adjust rssi_adjust; 13311 13312 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 13313 req->relative_rssi)) 13314 return -ENOBUFS; 13315 13316 rssi_adjust.band = req->rssi_adjust.band; 13317 rssi_adjust.delta = req->rssi_adjust.delta; 13318 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 13319 sizeof(rssi_adjust), &rssi_adjust)) 13320 return -ENOBUFS; 13321 } 13322 13323 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13324 if (!freqs) 13325 return -ENOBUFS; 13326 13327 for (i = 0; i < req->n_channels; i++) { 13328 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13329 return -ENOBUFS; 13330 } 13331 13332 nla_nest_end(msg, freqs); 13333 13334 if (req->n_match_sets) { 13335 matches = nla_nest_start_noflag(msg, 13336 NL80211_ATTR_SCHED_SCAN_MATCH); 13337 if (!matches) 13338 return -ENOBUFS; 13339 13340 for (i = 0; i < req->n_match_sets; i++) { 13341 match = nla_nest_start_noflag(msg, i); 13342 if (!match) 13343 return -ENOBUFS; 13344 13345 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 13346 req->match_sets[i].ssid.ssid_len, 13347 req->match_sets[i].ssid.ssid)) 13348 return -ENOBUFS; 13349 nla_nest_end(msg, match); 13350 } 13351 nla_nest_end(msg, matches); 13352 } 13353 13354 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 13355 if (!scan_plans) 13356 return -ENOBUFS; 13357 13358 for (i = 0; i < req->n_scan_plans; i++) { 13359 scan_plan = nla_nest_start_noflag(msg, i + 1); 13360 if (!scan_plan) 13361 return -ENOBUFS; 13362 13363 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 13364 req->scan_plans[i].interval) || 13365 (req->scan_plans[i].iterations && 13366 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 13367 req->scan_plans[i].iterations))) 13368 return -ENOBUFS; 13369 nla_nest_end(msg, scan_plan); 13370 } 13371 nla_nest_end(msg, scan_plans); 13372 13373 nla_nest_end(msg, nd); 13374 13375 return 0; 13376 } 13377 13378 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 13379 { 13380 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13381 struct sk_buff *msg; 13382 void *hdr; 13383 u32 size = NLMSG_DEFAULT_SIZE; 13384 13385 if (!rdev->wiphy.wowlan) 13386 return -EOPNOTSUPP; 13387 13388 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 13389 /* adjust size to have room for all the data */ 13390 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 13391 rdev->wiphy.wowlan_config->tcp->payload_len + 13392 rdev->wiphy.wowlan_config->tcp->wake_len + 13393 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 13394 } 13395 13396 msg = nlmsg_new(size, GFP_KERNEL); 13397 if (!msg) 13398 return -ENOMEM; 13399 13400 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13401 NL80211_CMD_GET_WOWLAN); 13402 if (!hdr) 13403 goto nla_put_failure; 13404 13405 if (rdev->wiphy.wowlan_config) { 13406 struct nlattr *nl_wowlan; 13407 13408 nl_wowlan = nla_nest_start_noflag(msg, 13409 NL80211_ATTR_WOWLAN_TRIGGERS); 13410 if (!nl_wowlan) 13411 goto nla_put_failure; 13412 13413 if ((rdev->wiphy.wowlan_config->any && 13414 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 13415 (rdev->wiphy.wowlan_config->disconnect && 13416 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 13417 (rdev->wiphy.wowlan_config->magic_pkt && 13418 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 13419 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 13420 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 13421 (rdev->wiphy.wowlan_config->eap_identity_req && 13422 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 13423 (rdev->wiphy.wowlan_config->four_way_handshake && 13424 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 13425 (rdev->wiphy.wowlan_config->rfkill_release && 13426 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 13427 goto nla_put_failure; 13428 13429 if (nl80211_send_wowlan_patterns(msg, rdev)) 13430 goto nla_put_failure; 13431 13432 if (nl80211_send_wowlan_tcp(msg, 13433 rdev->wiphy.wowlan_config->tcp)) 13434 goto nla_put_failure; 13435 13436 if (nl80211_send_wowlan_nd( 13437 msg, 13438 rdev->wiphy.wowlan_config->nd_config)) 13439 goto nla_put_failure; 13440 13441 nla_nest_end(msg, nl_wowlan); 13442 } 13443 13444 genlmsg_end(msg, hdr); 13445 return genlmsg_reply(msg, info); 13446 13447 nla_put_failure: 13448 nlmsg_free(msg); 13449 return -ENOBUFS; 13450 } 13451 13452 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 13453 struct nlattr *attr, 13454 struct cfg80211_wowlan *trig) 13455 { 13456 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 13457 struct cfg80211_wowlan_tcp *cfg; 13458 struct nl80211_wowlan_tcp_data_token *tok = NULL; 13459 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 13460 u32 size; 13461 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 13462 int err, port; 13463 13464 if (!rdev->wiphy.wowlan->tcp) 13465 return -EINVAL; 13466 13467 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 13468 nl80211_wowlan_tcp_policy, NULL); 13469 if (err) 13470 return err; 13471 13472 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 13473 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 13474 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 13475 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 13476 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 13477 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 13478 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 13479 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 13480 return -EINVAL; 13481 13482 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 13483 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 13484 return -EINVAL; 13485 13486 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 13487 rdev->wiphy.wowlan->tcp->data_interval_max || 13488 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 13489 return -EINVAL; 13490 13491 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 13492 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 13493 return -EINVAL; 13494 13495 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 13496 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 13497 return -EINVAL; 13498 13499 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 13500 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13501 13502 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13503 tokens_size = tokln - sizeof(*tok); 13504 13505 if (!tok->len || tokens_size % tok->len) 13506 return -EINVAL; 13507 if (!rdev->wiphy.wowlan->tcp->tok) 13508 return -EINVAL; 13509 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 13510 return -EINVAL; 13511 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 13512 return -EINVAL; 13513 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 13514 return -EINVAL; 13515 if (tok->offset + tok->len > data_size) 13516 return -EINVAL; 13517 } 13518 13519 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 13520 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 13521 if (!rdev->wiphy.wowlan->tcp->seq) 13522 return -EINVAL; 13523 if (seq->len == 0 || seq->len > 4) 13524 return -EINVAL; 13525 if (seq->len + seq->offset > data_size) 13526 return -EINVAL; 13527 } 13528 13529 size = sizeof(*cfg); 13530 size += data_size; 13531 size += wake_size + wake_mask_size; 13532 size += tokens_size; 13533 13534 cfg = kzalloc(size, GFP_KERNEL); 13535 if (!cfg) 13536 return -ENOMEM; 13537 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 13538 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 13539 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 13540 ETH_ALEN); 13541 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 13542 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 13543 else 13544 port = 0; 13545 #ifdef CONFIG_INET 13546 /* allocate a socket and port for it and use it */ 13547 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 13548 IPPROTO_TCP, &cfg->sock, 1); 13549 if (err) { 13550 kfree(cfg); 13551 return err; 13552 } 13553 if (inet_csk_get_port(cfg->sock->sk, port)) { 13554 sock_release(cfg->sock); 13555 kfree(cfg); 13556 return -EADDRINUSE; 13557 } 13558 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 13559 #else 13560 if (!port) { 13561 kfree(cfg); 13562 return -EINVAL; 13563 } 13564 cfg->src_port = port; 13565 #endif 13566 13567 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 13568 cfg->payload_len = data_size; 13569 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 13570 memcpy((void *)cfg->payload, 13571 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 13572 data_size); 13573 if (seq) 13574 cfg->payload_seq = *seq; 13575 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 13576 cfg->wake_len = wake_size; 13577 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 13578 memcpy((void *)cfg->wake_data, 13579 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 13580 wake_size); 13581 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 13582 data_size + wake_size; 13583 memcpy((void *)cfg->wake_mask, 13584 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 13585 wake_mask_size); 13586 if (tok) { 13587 cfg->tokens_size = tokens_size; 13588 cfg->payload_tok = *tok; 13589 memcpy(cfg->payload_tok.token_stream, tok->token_stream, 13590 tokens_size); 13591 } 13592 13593 trig->tcp = cfg; 13594 13595 return 0; 13596 } 13597 13598 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 13599 const struct wiphy_wowlan_support *wowlan, 13600 struct nlattr *attr, 13601 struct cfg80211_wowlan *trig) 13602 { 13603 struct nlattr **tb; 13604 int err; 13605 13606 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 13607 if (!tb) 13608 return -ENOMEM; 13609 13610 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 13611 err = -EOPNOTSUPP; 13612 goto out; 13613 } 13614 13615 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 13616 nl80211_policy, NULL); 13617 if (err) 13618 goto out; 13619 13620 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 13621 wowlan->max_nd_match_sets); 13622 err = PTR_ERR_OR_ZERO(trig->nd_config); 13623 if (err) 13624 trig->nd_config = NULL; 13625 13626 out: 13627 kfree(tb); 13628 return err; 13629 } 13630 13631 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 13632 { 13633 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13634 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 13635 struct cfg80211_wowlan new_triggers = {}; 13636 struct cfg80211_wowlan *ntrig; 13637 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 13638 int err, i; 13639 bool prev_enabled = rdev->wiphy.wowlan_config; 13640 bool regular = false; 13641 13642 if (!wowlan) 13643 return -EOPNOTSUPP; 13644 13645 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 13646 cfg80211_rdev_free_wowlan(rdev); 13647 rdev->wiphy.wowlan_config = NULL; 13648 goto set_wakeup; 13649 } 13650 13651 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 13652 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 13653 nl80211_wowlan_policy, info->extack); 13654 if (err) 13655 return err; 13656 13657 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 13658 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 13659 return -EINVAL; 13660 new_triggers.any = true; 13661 } 13662 13663 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 13664 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 13665 return -EINVAL; 13666 new_triggers.disconnect = true; 13667 regular = true; 13668 } 13669 13670 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 13671 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 13672 return -EINVAL; 13673 new_triggers.magic_pkt = true; 13674 regular = true; 13675 } 13676 13677 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 13678 return -EINVAL; 13679 13680 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 13681 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 13682 return -EINVAL; 13683 new_triggers.gtk_rekey_failure = true; 13684 regular = true; 13685 } 13686 13687 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 13688 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 13689 return -EINVAL; 13690 new_triggers.eap_identity_req = true; 13691 regular = true; 13692 } 13693 13694 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 13695 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 13696 return -EINVAL; 13697 new_triggers.four_way_handshake = true; 13698 regular = true; 13699 } 13700 13701 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 13702 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 13703 return -EINVAL; 13704 new_triggers.rfkill_release = true; 13705 regular = true; 13706 } 13707 13708 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 13709 struct nlattr *pat; 13710 int n_patterns = 0; 13711 int rem, pat_len, mask_len, pkt_offset; 13712 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13713 13714 regular = true; 13715 13716 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13717 rem) 13718 n_patterns++; 13719 if (n_patterns > wowlan->n_patterns) 13720 return -EINVAL; 13721 13722 new_triggers.patterns = kcalloc(n_patterns, 13723 sizeof(new_triggers.patterns[0]), 13724 GFP_KERNEL); 13725 if (!new_triggers.patterns) 13726 return -ENOMEM; 13727 13728 new_triggers.n_patterns = n_patterns; 13729 i = 0; 13730 13731 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13732 rem) { 13733 u8 *mask_pat; 13734 13735 err = nla_parse_nested_deprecated(pat_tb, 13736 MAX_NL80211_PKTPAT, 13737 pat, 13738 nl80211_packet_pattern_policy, 13739 info->extack); 13740 if (err) 13741 goto error; 13742 13743 err = -EINVAL; 13744 if (!pat_tb[NL80211_PKTPAT_MASK] || 13745 !pat_tb[NL80211_PKTPAT_PATTERN]) 13746 goto error; 13747 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 13748 mask_len = DIV_ROUND_UP(pat_len, 8); 13749 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 13750 goto error; 13751 if (pat_len > wowlan->pattern_max_len || 13752 pat_len < wowlan->pattern_min_len) 13753 goto error; 13754 13755 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 13756 pkt_offset = 0; 13757 else 13758 pkt_offset = nla_get_u32( 13759 pat_tb[NL80211_PKTPAT_OFFSET]); 13760 if (pkt_offset > wowlan->max_pkt_offset) 13761 goto error; 13762 new_triggers.patterns[i].pkt_offset = pkt_offset; 13763 13764 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 13765 if (!mask_pat) { 13766 err = -ENOMEM; 13767 goto error; 13768 } 13769 new_triggers.patterns[i].mask = mask_pat; 13770 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 13771 mask_len); 13772 mask_pat += mask_len; 13773 new_triggers.patterns[i].pattern = mask_pat; 13774 new_triggers.patterns[i].pattern_len = pat_len; 13775 memcpy(mask_pat, 13776 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 13777 pat_len); 13778 i++; 13779 } 13780 } 13781 13782 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 13783 regular = true; 13784 err = nl80211_parse_wowlan_tcp( 13785 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 13786 &new_triggers); 13787 if (err) 13788 goto error; 13789 } 13790 13791 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 13792 regular = true; 13793 err = nl80211_parse_wowlan_nd( 13794 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 13795 &new_triggers); 13796 if (err) 13797 goto error; 13798 } 13799 13800 /* The 'any' trigger means the device continues operating more or less 13801 * as in its normal operation mode and wakes up the host on most of the 13802 * normal interrupts (like packet RX, ...) 13803 * It therefore makes little sense to combine with the more constrained 13804 * wakeup trigger modes. 13805 */ 13806 if (new_triggers.any && regular) { 13807 err = -EINVAL; 13808 goto error; 13809 } 13810 13811 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 13812 if (!ntrig) { 13813 err = -ENOMEM; 13814 goto error; 13815 } 13816 cfg80211_rdev_free_wowlan(rdev); 13817 rdev->wiphy.wowlan_config = ntrig; 13818 13819 set_wakeup: 13820 if (rdev->ops->set_wakeup && 13821 prev_enabled != !!rdev->wiphy.wowlan_config) 13822 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 13823 13824 return 0; 13825 error: 13826 for (i = 0; i < new_triggers.n_patterns; i++) 13827 kfree(new_triggers.patterns[i].mask); 13828 kfree(new_triggers.patterns); 13829 if (new_triggers.tcp && new_triggers.tcp->sock) 13830 sock_release(new_triggers.tcp->sock); 13831 kfree(new_triggers.tcp); 13832 kfree(new_triggers.nd_config); 13833 return err; 13834 } 13835 #endif 13836 13837 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 13838 struct cfg80211_registered_device *rdev) 13839 { 13840 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 13841 int i, j, pat_len; 13842 struct cfg80211_coalesce_rules *rule; 13843 13844 if (!rdev->coalesce->n_rules) 13845 return 0; 13846 13847 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 13848 if (!nl_rules) 13849 return -ENOBUFS; 13850 13851 for (i = 0; i < rdev->coalesce->n_rules; i++) { 13852 nl_rule = nla_nest_start_noflag(msg, i + 1); 13853 if (!nl_rule) 13854 return -ENOBUFS; 13855 13856 rule = &rdev->coalesce->rules[i]; 13857 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 13858 rule->delay)) 13859 return -ENOBUFS; 13860 13861 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 13862 rule->condition)) 13863 return -ENOBUFS; 13864 13865 nl_pats = nla_nest_start_noflag(msg, 13866 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 13867 if (!nl_pats) 13868 return -ENOBUFS; 13869 13870 for (j = 0; j < rule->n_patterns; j++) { 13871 nl_pat = nla_nest_start_noflag(msg, j + 1); 13872 if (!nl_pat) 13873 return -ENOBUFS; 13874 pat_len = rule->patterns[j].pattern_len; 13875 if (nla_put(msg, NL80211_PKTPAT_MASK, 13876 DIV_ROUND_UP(pat_len, 8), 13877 rule->patterns[j].mask) || 13878 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13879 rule->patterns[j].pattern) || 13880 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13881 rule->patterns[j].pkt_offset)) 13882 return -ENOBUFS; 13883 nla_nest_end(msg, nl_pat); 13884 } 13885 nla_nest_end(msg, nl_pats); 13886 nla_nest_end(msg, nl_rule); 13887 } 13888 nla_nest_end(msg, nl_rules); 13889 13890 return 0; 13891 } 13892 13893 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 13894 { 13895 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13896 struct sk_buff *msg; 13897 void *hdr; 13898 13899 if (!rdev->wiphy.coalesce) 13900 return -EOPNOTSUPP; 13901 13902 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13903 if (!msg) 13904 return -ENOMEM; 13905 13906 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13907 NL80211_CMD_GET_COALESCE); 13908 if (!hdr) 13909 goto nla_put_failure; 13910 13911 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 13912 goto nla_put_failure; 13913 13914 genlmsg_end(msg, hdr); 13915 return genlmsg_reply(msg, info); 13916 13917 nla_put_failure: 13918 nlmsg_free(msg); 13919 return -ENOBUFS; 13920 } 13921 13922 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 13923 { 13924 struct cfg80211_coalesce *coalesce = rdev->coalesce; 13925 int i, j; 13926 struct cfg80211_coalesce_rules *rule; 13927 13928 if (!coalesce) 13929 return; 13930 13931 for (i = 0; i < coalesce->n_rules; i++) { 13932 rule = &coalesce->rules[i]; 13933 for (j = 0; j < rule->n_patterns; j++) 13934 kfree(rule->patterns[j].mask); 13935 kfree(rule->patterns); 13936 } 13937 kfree(coalesce->rules); 13938 kfree(coalesce); 13939 rdev->coalesce = NULL; 13940 } 13941 13942 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 13943 struct nlattr *rule, 13944 struct cfg80211_coalesce_rules *new_rule) 13945 { 13946 int err, i; 13947 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 13948 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 13949 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 13950 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13951 13952 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 13953 rule, nl80211_coalesce_policy, NULL); 13954 if (err) 13955 return err; 13956 13957 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 13958 new_rule->delay = 13959 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 13960 if (new_rule->delay > coalesce->max_delay) 13961 return -EINVAL; 13962 13963 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 13964 new_rule->condition = 13965 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 13966 13967 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 13968 return -EINVAL; 13969 13970 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13971 rem) 13972 n_patterns++; 13973 if (n_patterns > coalesce->n_patterns) 13974 return -EINVAL; 13975 13976 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 13977 GFP_KERNEL); 13978 if (!new_rule->patterns) 13979 return -ENOMEM; 13980 13981 new_rule->n_patterns = n_patterns; 13982 i = 0; 13983 13984 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13985 rem) { 13986 u8 *mask_pat; 13987 13988 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 13989 pat, 13990 nl80211_packet_pattern_policy, 13991 NULL); 13992 if (err) 13993 return err; 13994 13995 if (!pat_tb[NL80211_PKTPAT_MASK] || 13996 !pat_tb[NL80211_PKTPAT_PATTERN]) 13997 return -EINVAL; 13998 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 13999 mask_len = DIV_ROUND_UP(pat_len, 8); 14000 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 14001 return -EINVAL; 14002 if (pat_len > coalesce->pattern_max_len || 14003 pat_len < coalesce->pattern_min_len) 14004 return -EINVAL; 14005 14006 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 14007 pkt_offset = 0; 14008 else 14009 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 14010 if (pkt_offset > coalesce->max_pkt_offset) 14011 return -EINVAL; 14012 new_rule->patterns[i].pkt_offset = pkt_offset; 14013 14014 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 14015 if (!mask_pat) 14016 return -ENOMEM; 14017 14018 new_rule->patterns[i].mask = mask_pat; 14019 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 14020 mask_len); 14021 14022 mask_pat += mask_len; 14023 new_rule->patterns[i].pattern = mask_pat; 14024 new_rule->patterns[i].pattern_len = pat_len; 14025 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 14026 pat_len); 14027 i++; 14028 } 14029 14030 return 0; 14031 } 14032 14033 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 14034 { 14035 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14036 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 14037 struct cfg80211_coalesce new_coalesce = {}; 14038 struct cfg80211_coalesce *n_coalesce; 14039 int err, rem_rule, n_rules = 0, i, j; 14040 struct nlattr *rule; 14041 struct cfg80211_coalesce_rules *tmp_rule; 14042 14043 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 14044 return -EOPNOTSUPP; 14045 14046 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 14047 cfg80211_rdev_free_coalesce(rdev); 14048 rdev_set_coalesce(rdev, NULL); 14049 return 0; 14050 } 14051 14052 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 14053 rem_rule) 14054 n_rules++; 14055 if (n_rules > coalesce->n_rules) 14056 return -EINVAL; 14057 14058 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 14059 GFP_KERNEL); 14060 if (!new_coalesce.rules) 14061 return -ENOMEM; 14062 14063 new_coalesce.n_rules = n_rules; 14064 i = 0; 14065 14066 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 14067 rem_rule) { 14068 err = nl80211_parse_coalesce_rule(rdev, rule, 14069 &new_coalesce.rules[i]); 14070 if (err) 14071 goto error; 14072 14073 i++; 14074 } 14075 14076 err = rdev_set_coalesce(rdev, &new_coalesce); 14077 if (err) 14078 goto error; 14079 14080 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 14081 if (!n_coalesce) { 14082 err = -ENOMEM; 14083 goto error; 14084 } 14085 cfg80211_rdev_free_coalesce(rdev); 14086 rdev->coalesce = n_coalesce; 14087 14088 return 0; 14089 error: 14090 for (i = 0; i < new_coalesce.n_rules; i++) { 14091 tmp_rule = &new_coalesce.rules[i]; 14092 for (j = 0; j < tmp_rule->n_patterns; j++) 14093 kfree(tmp_rule->patterns[j].mask); 14094 kfree(tmp_rule->patterns); 14095 } 14096 kfree(new_coalesce.rules); 14097 14098 return err; 14099 } 14100 14101 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 14102 { 14103 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14104 struct net_device *dev = info->user_ptr[1]; 14105 struct wireless_dev *wdev = dev->ieee80211_ptr; 14106 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 14107 struct cfg80211_gtk_rekey_data rekey_data = {}; 14108 int err; 14109 14110 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 14111 return -EINVAL; 14112 14113 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 14114 info->attrs[NL80211_ATTR_REKEY_DATA], 14115 nl80211_rekey_policy, info->extack); 14116 if (err) 14117 return err; 14118 14119 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 14120 !tb[NL80211_REKEY_DATA_KCK]) 14121 return -EINVAL; 14122 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 14123 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 14124 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 14125 return -ERANGE; 14126 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 14127 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 14128 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) && 14129 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 && 14130 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32)) 14131 return -ERANGE; 14132 14133 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 14134 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 14135 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 14136 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 14137 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 14138 if (tb[NL80211_REKEY_DATA_AKM]) 14139 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 14140 14141 if (!wdev->connected) 14142 return -ENOTCONN; 14143 14144 if (!rdev->ops->set_rekey_data) 14145 return -EOPNOTSUPP; 14146 14147 return rdev_set_rekey_data(rdev, dev, &rekey_data); 14148 } 14149 14150 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 14151 struct genl_info *info) 14152 { 14153 struct net_device *dev = info->user_ptr[1]; 14154 struct wireless_dev *wdev = dev->ieee80211_ptr; 14155 14156 if (wdev->iftype != NL80211_IFTYPE_AP && 14157 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14158 return -EINVAL; 14159 14160 if (wdev->ap_unexpected_nlportid) 14161 return -EBUSY; 14162 14163 wdev->ap_unexpected_nlportid = info->snd_portid; 14164 return 0; 14165 } 14166 14167 static int nl80211_probe_client(struct sk_buff *skb, 14168 struct genl_info *info) 14169 { 14170 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14171 struct net_device *dev = info->user_ptr[1]; 14172 struct wireless_dev *wdev = dev->ieee80211_ptr; 14173 struct sk_buff *msg; 14174 void *hdr; 14175 const u8 *addr; 14176 u64 cookie; 14177 int err; 14178 14179 if (wdev->iftype != NL80211_IFTYPE_AP && 14180 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14181 return -EOPNOTSUPP; 14182 14183 if (!info->attrs[NL80211_ATTR_MAC]) 14184 return -EINVAL; 14185 14186 if (!rdev->ops->probe_client) 14187 return -EOPNOTSUPP; 14188 14189 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14190 if (!msg) 14191 return -ENOMEM; 14192 14193 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14194 NL80211_CMD_PROBE_CLIENT); 14195 if (!hdr) { 14196 err = -ENOBUFS; 14197 goto free_msg; 14198 } 14199 14200 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14201 14202 err = rdev_probe_client(rdev, dev, addr, &cookie); 14203 if (err) 14204 goto free_msg; 14205 14206 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14207 NL80211_ATTR_PAD)) 14208 goto nla_put_failure; 14209 14210 genlmsg_end(msg, hdr); 14211 14212 return genlmsg_reply(msg, info); 14213 14214 nla_put_failure: 14215 err = -ENOBUFS; 14216 free_msg: 14217 nlmsg_free(msg); 14218 return err; 14219 } 14220 14221 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 14222 { 14223 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14224 struct cfg80211_beacon_registration *reg, *nreg; 14225 int rv; 14226 14227 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 14228 return -EOPNOTSUPP; 14229 14230 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 14231 if (!nreg) 14232 return -ENOMEM; 14233 14234 /* First, check if already registered. */ 14235 spin_lock_bh(&rdev->beacon_registrations_lock); 14236 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14237 if (reg->nlportid == info->snd_portid) { 14238 rv = -EALREADY; 14239 goto out_err; 14240 } 14241 } 14242 /* Add it to the list */ 14243 nreg->nlportid = info->snd_portid; 14244 list_add(&nreg->list, &rdev->beacon_registrations); 14245 14246 spin_unlock_bh(&rdev->beacon_registrations_lock); 14247 14248 return 0; 14249 out_err: 14250 spin_unlock_bh(&rdev->beacon_registrations_lock); 14251 kfree(nreg); 14252 return rv; 14253 } 14254 14255 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 14256 { 14257 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14258 struct wireless_dev *wdev = info->user_ptr[1]; 14259 int err; 14260 14261 if (!rdev->ops->start_p2p_device) 14262 return -EOPNOTSUPP; 14263 14264 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14265 return -EOPNOTSUPP; 14266 14267 if (wdev_running(wdev)) 14268 return 0; 14269 14270 if (rfkill_blocked(rdev->wiphy.rfkill)) 14271 return -ERFKILL; 14272 14273 err = rdev_start_p2p_device(rdev, wdev); 14274 if (err) 14275 return err; 14276 14277 wdev->is_running = true; 14278 rdev->opencount++; 14279 14280 return 0; 14281 } 14282 14283 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 14284 { 14285 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14286 struct wireless_dev *wdev = info->user_ptr[1]; 14287 14288 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14289 return -EOPNOTSUPP; 14290 14291 if (!rdev->ops->stop_p2p_device) 14292 return -EOPNOTSUPP; 14293 14294 cfg80211_stop_p2p_device(rdev, wdev); 14295 14296 return 0; 14297 } 14298 14299 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 14300 { 14301 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14302 struct wireless_dev *wdev = info->user_ptr[1]; 14303 struct cfg80211_nan_conf conf = {}; 14304 int err; 14305 14306 if (wdev->iftype != NL80211_IFTYPE_NAN) 14307 return -EOPNOTSUPP; 14308 14309 if (wdev_running(wdev)) 14310 return -EEXIST; 14311 14312 if (rfkill_blocked(rdev->wiphy.rfkill)) 14313 return -ERFKILL; 14314 14315 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 14316 return -EINVAL; 14317 14318 conf.master_pref = 14319 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14320 14321 if (info->attrs[NL80211_ATTR_BANDS]) { 14322 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14323 14324 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14325 return -EOPNOTSUPP; 14326 14327 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14328 return -EINVAL; 14329 14330 conf.bands = bands; 14331 } 14332 14333 err = rdev_start_nan(rdev, wdev, &conf); 14334 if (err) 14335 return err; 14336 14337 wdev->is_running = true; 14338 rdev->opencount++; 14339 14340 return 0; 14341 } 14342 14343 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 14344 { 14345 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14346 struct wireless_dev *wdev = info->user_ptr[1]; 14347 14348 if (wdev->iftype != NL80211_IFTYPE_NAN) 14349 return -EOPNOTSUPP; 14350 14351 cfg80211_stop_nan(rdev, wdev); 14352 14353 return 0; 14354 } 14355 14356 static int validate_nan_filter(struct nlattr *filter_attr) 14357 { 14358 struct nlattr *attr; 14359 int len = 0, n_entries = 0, rem; 14360 14361 nla_for_each_nested(attr, filter_attr, rem) { 14362 len += nla_len(attr); 14363 n_entries++; 14364 } 14365 14366 if (len >= U8_MAX) 14367 return -EINVAL; 14368 14369 return n_entries; 14370 } 14371 14372 static int handle_nan_filter(struct nlattr *attr_filter, 14373 struct cfg80211_nan_func *func, 14374 bool tx) 14375 { 14376 struct nlattr *attr; 14377 int n_entries, rem, i; 14378 struct cfg80211_nan_func_filter *filter; 14379 14380 n_entries = validate_nan_filter(attr_filter); 14381 if (n_entries < 0) 14382 return n_entries; 14383 14384 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 14385 14386 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 14387 if (!filter) 14388 return -ENOMEM; 14389 14390 i = 0; 14391 nla_for_each_nested(attr, attr_filter, rem) { 14392 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 14393 if (!filter[i].filter) 14394 goto err; 14395 14396 filter[i].len = nla_len(attr); 14397 i++; 14398 } 14399 if (tx) { 14400 func->num_tx_filters = n_entries; 14401 func->tx_filters = filter; 14402 } else { 14403 func->num_rx_filters = n_entries; 14404 func->rx_filters = filter; 14405 } 14406 14407 return 0; 14408 14409 err: 14410 i = 0; 14411 nla_for_each_nested(attr, attr_filter, rem) { 14412 kfree(filter[i].filter); 14413 i++; 14414 } 14415 kfree(filter); 14416 return -ENOMEM; 14417 } 14418 14419 static int nl80211_nan_add_func(struct sk_buff *skb, 14420 struct genl_info *info) 14421 { 14422 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14423 struct wireless_dev *wdev = info->user_ptr[1]; 14424 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 14425 struct cfg80211_nan_func *func; 14426 struct sk_buff *msg = NULL; 14427 void *hdr = NULL; 14428 int err = 0; 14429 14430 if (wdev->iftype != NL80211_IFTYPE_NAN) 14431 return -EOPNOTSUPP; 14432 14433 if (!wdev_running(wdev)) 14434 return -ENOTCONN; 14435 14436 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 14437 return -EINVAL; 14438 14439 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 14440 info->attrs[NL80211_ATTR_NAN_FUNC], 14441 nl80211_nan_func_policy, 14442 info->extack); 14443 if (err) 14444 return err; 14445 14446 func = kzalloc(sizeof(*func), GFP_KERNEL); 14447 if (!func) 14448 return -ENOMEM; 14449 14450 func->cookie = cfg80211_assign_cookie(rdev); 14451 14452 if (!tb[NL80211_NAN_FUNC_TYPE]) { 14453 err = -EINVAL; 14454 goto out; 14455 } 14456 14457 14458 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 14459 14460 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 14461 err = -EINVAL; 14462 goto out; 14463 } 14464 14465 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 14466 sizeof(func->service_id)); 14467 14468 func->close_range = 14469 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 14470 14471 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 14472 func->serv_spec_info_len = 14473 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 14474 func->serv_spec_info = 14475 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 14476 func->serv_spec_info_len, 14477 GFP_KERNEL); 14478 if (!func->serv_spec_info) { 14479 err = -ENOMEM; 14480 goto out; 14481 } 14482 } 14483 14484 if (tb[NL80211_NAN_FUNC_TTL]) 14485 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 14486 14487 switch (func->type) { 14488 case NL80211_NAN_FUNC_PUBLISH: 14489 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 14490 err = -EINVAL; 14491 goto out; 14492 } 14493 14494 func->publish_type = 14495 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 14496 func->publish_bcast = 14497 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 14498 14499 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 14500 func->publish_bcast) { 14501 err = -EINVAL; 14502 goto out; 14503 } 14504 break; 14505 case NL80211_NAN_FUNC_SUBSCRIBE: 14506 func->subscribe_active = 14507 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 14508 break; 14509 case NL80211_NAN_FUNC_FOLLOW_UP: 14510 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 14511 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 14512 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 14513 err = -EINVAL; 14514 goto out; 14515 } 14516 14517 func->followup_id = 14518 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 14519 func->followup_reqid = 14520 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 14521 memcpy(func->followup_dest.addr, 14522 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 14523 sizeof(func->followup_dest.addr)); 14524 if (func->ttl) { 14525 err = -EINVAL; 14526 goto out; 14527 } 14528 break; 14529 default: 14530 err = -EINVAL; 14531 goto out; 14532 } 14533 14534 if (tb[NL80211_NAN_FUNC_SRF]) { 14535 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 14536 14537 err = nla_parse_nested_deprecated(srf_tb, 14538 NL80211_NAN_SRF_ATTR_MAX, 14539 tb[NL80211_NAN_FUNC_SRF], 14540 nl80211_nan_srf_policy, 14541 info->extack); 14542 if (err) 14543 goto out; 14544 14545 func->srf_include = 14546 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 14547 14548 if (srf_tb[NL80211_NAN_SRF_BF]) { 14549 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 14550 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 14551 err = -EINVAL; 14552 goto out; 14553 } 14554 14555 func->srf_bf_len = 14556 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 14557 func->srf_bf = 14558 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 14559 func->srf_bf_len, GFP_KERNEL); 14560 if (!func->srf_bf) { 14561 err = -ENOMEM; 14562 goto out; 14563 } 14564 14565 func->srf_bf_idx = 14566 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 14567 } else { 14568 struct nlattr *attr, *mac_attr = 14569 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 14570 int n_entries, rem, i = 0; 14571 14572 if (!mac_attr) { 14573 err = -EINVAL; 14574 goto out; 14575 } 14576 14577 n_entries = validate_acl_mac_addrs(mac_attr); 14578 if (n_entries <= 0) { 14579 err = -EINVAL; 14580 goto out; 14581 } 14582 14583 func->srf_num_macs = n_entries; 14584 func->srf_macs = 14585 kcalloc(n_entries, sizeof(*func->srf_macs), 14586 GFP_KERNEL); 14587 if (!func->srf_macs) { 14588 err = -ENOMEM; 14589 goto out; 14590 } 14591 14592 nla_for_each_nested(attr, mac_attr, rem) 14593 memcpy(func->srf_macs[i++].addr, nla_data(attr), 14594 sizeof(*func->srf_macs)); 14595 } 14596 } 14597 14598 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 14599 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 14600 func, true); 14601 if (err) 14602 goto out; 14603 } 14604 14605 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 14606 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 14607 func, false); 14608 if (err) 14609 goto out; 14610 } 14611 14612 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14613 if (!msg) { 14614 err = -ENOMEM; 14615 goto out; 14616 } 14617 14618 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14619 NL80211_CMD_ADD_NAN_FUNCTION); 14620 /* This can't really happen - we just allocated 4KB */ 14621 if (WARN_ON(!hdr)) { 14622 err = -ENOMEM; 14623 goto out; 14624 } 14625 14626 err = rdev_add_nan_func(rdev, wdev, func); 14627 out: 14628 if (err < 0) { 14629 cfg80211_free_nan_func(func); 14630 nlmsg_free(msg); 14631 return err; 14632 } 14633 14634 /* propagate the instance id and cookie to userspace */ 14635 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 14636 NL80211_ATTR_PAD)) 14637 goto nla_put_failure; 14638 14639 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14640 if (!func_attr) 14641 goto nla_put_failure; 14642 14643 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 14644 func->instance_id)) 14645 goto nla_put_failure; 14646 14647 nla_nest_end(msg, func_attr); 14648 14649 genlmsg_end(msg, hdr); 14650 return genlmsg_reply(msg, info); 14651 14652 nla_put_failure: 14653 nlmsg_free(msg); 14654 return -ENOBUFS; 14655 } 14656 14657 static int nl80211_nan_del_func(struct sk_buff *skb, 14658 struct genl_info *info) 14659 { 14660 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14661 struct wireless_dev *wdev = info->user_ptr[1]; 14662 u64 cookie; 14663 14664 if (wdev->iftype != NL80211_IFTYPE_NAN) 14665 return -EOPNOTSUPP; 14666 14667 if (!wdev_running(wdev)) 14668 return -ENOTCONN; 14669 14670 if (!info->attrs[NL80211_ATTR_COOKIE]) 14671 return -EINVAL; 14672 14673 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 14674 14675 rdev_del_nan_func(rdev, wdev, cookie); 14676 14677 return 0; 14678 } 14679 14680 static int nl80211_nan_change_config(struct sk_buff *skb, 14681 struct genl_info *info) 14682 { 14683 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14684 struct wireless_dev *wdev = info->user_ptr[1]; 14685 struct cfg80211_nan_conf conf = {}; 14686 u32 changed = 0; 14687 14688 if (wdev->iftype != NL80211_IFTYPE_NAN) 14689 return -EOPNOTSUPP; 14690 14691 if (!wdev_running(wdev)) 14692 return -ENOTCONN; 14693 14694 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 14695 conf.master_pref = 14696 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14697 if (conf.master_pref <= 1 || conf.master_pref == 255) 14698 return -EINVAL; 14699 14700 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 14701 } 14702 14703 if (info->attrs[NL80211_ATTR_BANDS]) { 14704 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14705 14706 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14707 return -EOPNOTSUPP; 14708 14709 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14710 return -EINVAL; 14711 14712 conf.bands = bands; 14713 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 14714 } 14715 14716 if (!changed) 14717 return -EINVAL; 14718 14719 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 14720 } 14721 14722 void cfg80211_nan_match(struct wireless_dev *wdev, 14723 struct cfg80211_nan_match_params *match, gfp_t gfp) 14724 { 14725 struct wiphy *wiphy = wdev->wiphy; 14726 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14727 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 14728 struct sk_buff *msg; 14729 void *hdr; 14730 14731 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 14732 return; 14733 14734 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14735 if (!msg) 14736 return; 14737 14738 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 14739 if (!hdr) { 14740 nlmsg_free(msg); 14741 return; 14742 } 14743 14744 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14745 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14746 wdev->netdev->ifindex)) || 14747 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14748 NL80211_ATTR_PAD)) 14749 goto nla_put_failure; 14750 14751 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 14752 NL80211_ATTR_PAD) || 14753 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 14754 goto nla_put_failure; 14755 14756 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 14757 if (!match_attr) 14758 goto nla_put_failure; 14759 14760 local_func_attr = nla_nest_start_noflag(msg, 14761 NL80211_NAN_MATCH_FUNC_LOCAL); 14762 if (!local_func_attr) 14763 goto nla_put_failure; 14764 14765 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 14766 goto nla_put_failure; 14767 14768 nla_nest_end(msg, local_func_attr); 14769 14770 peer_func_attr = nla_nest_start_noflag(msg, 14771 NL80211_NAN_MATCH_FUNC_PEER); 14772 if (!peer_func_attr) 14773 goto nla_put_failure; 14774 14775 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 14776 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 14777 goto nla_put_failure; 14778 14779 if (match->info && match->info_len && 14780 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 14781 match->info)) 14782 goto nla_put_failure; 14783 14784 nla_nest_end(msg, peer_func_attr); 14785 nla_nest_end(msg, match_attr); 14786 genlmsg_end(msg, hdr); 14787 14788 if (!wdev->owner_nlportid) 14789 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14790 msg, 0, NL80211_MCGRP_NAN, gfp); 14791 else 14792 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14793 wdev->owner_nlportid); 14794 14795 return; 14796 14797 nla_put_failure: 14798 nlmsg_free(msg); 14799 } 14800 EXPORT_SYMBOL(cfg80211_nan_match); 14801 14802 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 14803 u8 inst_id, 14804 enum nl80211_nan_func_term_reason reason, 14805 u64 cookie, gfp_t gfp) 14806 { 14807 struct wiphy *wiphy = wdev->wiphy; 14808 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14809 struct sk_buff *msg; 14810 struct nlattr *func_attr; 14811 void *hdr; 14812 14813 if (WARN_ON(!inst_id)) 14814 return; 14815 14816 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14817 if (!msg) 14818 return; 14819 14820 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 14821 if (!hdr) { 14822 nlmsg_free(msg); 14823 return; 14824 } 14825 14826 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14827 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14828 wdev->netdev->ifindex)) || 14829 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14830 NL80211_ATTR_PAD)) 14831 goto nla_put_failure; 14832 14833 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14834 NL80211_ATTR_PAD)) 14835 goto nla_put_failure; 14836 14837 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14838 if (!func_attr) 14839 goto nla_put_failure; 14840 14841 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 14842 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 14843 goto nla_put_failure; 14844 14845 nla_nest_end(msg, func_attr); 14846 genlmsg_end(msg, hdr); 14847 14848 if (!wdev->owner_nlportid) 14849 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14850 msg, 0, NL80211_MCGRP_NAN, gfp); 14851 else 14852 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14853 wdev->owner_nlportid); 14854 14855 return; 14856 14857 nla_put_failure: 14858 nlmsg_free(msg); 14859 } 14860 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 14861 14862 static int nl80211_get_protocol_features(struct sk_buff *skb, 14863 struct genl_info *info) 14864 { 14865 void *hdr; 14866 struct sk_buff *msg; 14867 14868 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14869 if (!msg) 14870 return -ENOMEM; 14871 14872 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14873 NL80211_CMD_GET_PROTOCOL_FEATURES); 14874 if (!hdr) 14875 goto nla_put_failure; 14876 14877 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 14878 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 14879 goto nla_put_failure; 14880 14881 genlmsg_end(msg, hdr); 14882 return genlmsg_reply(msg, info); 14883 14884 nla_put_failure: 14885 kfree_skb(msg); 14886 return -ENOBUFS; 14887 } 14888 14889 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 14890 { 14891 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14892 struct cfg80211_update_ft_ies_params ft_params; 14893 struct net_device *dev = info->user_ptr[1]; 14894 14895 if (!rdev->ops->update_ft_ies) 14896 return -EOPNOTSUPP; 14897 14898 if (!info->attrs[NL80211_ATTR_MDID] || 14899 !info->attrs[NL80211_ATTR_IE]) 14900 return -EINVAL; 14901 14902 memset(&ft_params, 0, sizeof(ft_params)); 14903 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 14904 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14905 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14906 14907 return rdev_update_ft_ies(rdev, dev, &ft_params); 14908 } 14909 14910 static int nl80211_crit_protocol_start(struct sk_buff *skb, 14911 struct genl_info *info) 14912 { 14913 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14914 struct wireless_dev *wdev = info->user_ptr[1]; 14915 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 14916 u16 duration; 14917 int ret; 14918 14919 if (!rdev->ops->crit_proto_start) 14920 return -EOPNOTSUPP; 14921 14922 if (WARN_ON(!rdev->ops->crit_proto_stop)) 14923 return -EINVAL; 14924 14925 if (rdev->crit_proto_nlportid) 14926 return -EBUSY; 14927 14928 /* determine protocol if provided */ 14929 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 14930 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 14931 14932 if (proto >= NUM_NL80211_CRIT_PROTO) 14933 return -EINVAL; 14934 14935 /* timeout must be provided */ 14936 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 14937 return -EINVAL; 14938 14939 duration = 14940 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 14941 14942 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 14943 if (!ret) 14944 rdev->crit_proto_nlportid = info->snd_portid; 14945 14946 return ret; 14947 } 14948 14949 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 14950 struct genl_info *info) 14951 { 14952 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14953 struct wireless_dev *wdev = info->user_ptr[1]; 14954 14955 if (!rdev->ops->crit_proto_stop) 14956 return -EOPNOTSUPP; 14957 14958 if (rdev->crit_proto_nlportid) { 14959 rdev->crit_proto_nlportid = 0; 14960 rdev_crit_proto_stop(rdev, wdev); 14961 } 14962 return 0; 14963 } 14964 14965 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 14966 struct nlattr *attr, 14967 struct netlink_ext_ack *extack) 14968 { 14969 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 14970 if (attr->nla_type & NLA_F_NESTED) { 14971 NL_SET_ERR_MSG_ATTR(extack, attr, 14972 "unexpected nested data"); 14973 return -EINVAL; 14974 } 14975 14976 return 0; 14977 } 14978 14979 if (!(attr->nla_type & NLA_F_NESTED)) { 14980 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 14981 return -EINVAL; 14982 } 14983 14984 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 14985 } 14986 14987 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 14988 { 14989 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14990 struct wireless_dev *wdev = 14991 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 14992 info->attrs); 14993 int i, err; 14994 u32 vid, subcmd; 14995 14996 if (!rdev->wiphy.vendor_commands) 14997 return -EOPNOTSUPP; 14998 14999 if (IS_ERR(wdev)) { 15000 err = PTR_ERR(wdev); 15001 if (err != -EINVAL) 15002 return err; 15003 wdev = NULL; 15004 } else if (wdev->wiphy != &rdev->wiphy) { 15005 return -EINVAL; 15006 } 15007 15008 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 15009 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 15010 return -EINVAL; 15011 15012 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 15013 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 15014 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 15015 const struct wiphy_vendor_command *vcmd; 15016 void *data = NULL; 15017 int len = 0; 15018 15019 vcmd = &rdev->wiphy.vendor_commands[i]; 15020 15021 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 15022 continue; 15023 15024 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 15025 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 15026 if (!wdev) 15027 return -EINVAL; 15028 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 15029 !wdev->netdev) 15030 return -EINVAL; 15031 15032 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 15033 if (!wdev_running(wdev)) 15034 return -ENETDOWN; 15035 } 15036 } else { 15037 wdev = NULL; 15038 } 15039 15040 if (!vcmd->doit) 15041 return -EOPNOTSUPP; 15042 15043 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 15044 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 15045 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 15046 15047 err = nl80211_vendor_check_policy(vcmd, 15048 info->attrs[NL80211_ATTR_VENDOR_DATA], 15049 info->extack); 15050 if (err) 15051 return err; 15052 } 15053 15054 rdev->cur_cmd_info = info; 15055 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 15056 rdev->cur_cmd_info = NULL; 15057 return err; 15058 } 15059 15060 return -EOPNOTSUPP; 15061 } 15062 15063 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 15064 struct netlink_callback *cb, 15065 struct cfg80211_registered_device **rdev, 15066 struct wireless_dev **wdev) 15067 { 15068 struct nlattr **attrbuf; 15069 u32 vid, subcmd; 15070 unsigned int i; 15071 int vcmd_idx = -1; 15072 int err; 15073 void *data = NULL; 15074 unsigned int data_len = 0; 15075 15076 if (cb->args[0]) { 15077 /* subtract the 1 again here */ 15078 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 15079 struct wireless_dev *tmp; 15080 15081 if (!wiphy) 15082 return -ENODEV; 15083 *rdev = wiphy_to_rdev(wiphy); 15084 *wdev = NULL; 15085 15086 if (cb->args[1]) { 15087 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 15088 if (tmp->identifier == cb->args[1] - 1) { 15089 *wdev = tmp; 15090 break; 15091 } 15092 } 15093 } 15094 15095 /* keep rtnl locked in successful case */ 15096 return 0; 15097 } 15098 15099 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 15100 if (!attrbuf) 15101 return -ENOMEM; 15102 15103 err = nlmsg_parse_deprecated(cb->nlh, 15104 GENL_HDRLEN + nl80211_fam.hdrsize, 15105 attrbuf, nl80211_fam.maxattr, 15106 nl80211_policy, NULL); 15107 if (err) 15108 goto out; 15109 15110 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 15111 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 15112 err = -EINVAL; 15113 goto out; 15114 } 15115 15116 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf); 15117 if (IS_ERR(*wdev)) 15118 *wdev = NULL; 15119 15120 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 15121 if (IS_ERR(*rdev)) { 15122 err = PTR_ERR(*rdev); 15123 goto out; 15124 } 15125 15126 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 15127 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 15128 15129 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 15130 const struct wiphy_vendor_command *vcmd; 15131 15132 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 15133 15134 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 15135 continue; 15136 15137 if (!vcmd->dumpit) { 15138 err = -EOPNOTSUPP; 15139 goto out; 15140 } 15141 15142 vcmd_idx = i; 15143 break; 15144 } 15145 15146 if (vcmd_idx < 0) { 15147 err = -EOPNOTSUPP; 15148 goto out; 15149 } 15150 15151 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 15152 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 15153 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 15154 15155 err = nl80211_vendor_check_policy( 15156 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 15157 attrbuf[NL80211_ATTR_VENDOR_DATA], 15158 cb->extack); 15159 if (err) 15160 goto out; 15161 } 15162 15163 /* 0 is the first index - add 1 to parse only once */ 15164 cb->args[0] = (*rdev)->wiphy_idx + 1; 15165 /* add 1 to know if it was NULL */ 15166 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 15167 cb->args[2] = vcmd_idx; 15168 cb->args[3] = (unsigned long)data; 15169 cb->args[4] = data_len; 15170 15171 /* keep rtnl locked in successful case */ 15172 err = 0; 15173 out: 15174 kfree(attrbuf); 15175 return err; 15176 } 15177 15178 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 15179 struct netlink_callback *cb) 15180 { 15181 struct cfg80211_registered_device *rdev; 15182 struct wireless_dev *wdev; 15183 unsigned int vcmd_idx; 15184 const struct wiphy_vendor_command *vcmd; 15185 void *data; 15186 int data_len; 15187 int err; 15188 struct nlattr *vendor_data; 15189 15190 rtnl_lock(); 15191 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 15192 if (err) 15193 goto out; 15194 15195 vcmd_idx = cb->args[2]; 15196 data = (void *)cb->args[3]; 15197 data_len = cb->args[4]; 15198 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 15199 15200 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 15201 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 15202 if (!wdev) { 15203 err = -EINVAL; 15204 goto out; 15205 } 15206 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 15207 !wdev->netdev) { 15208 err = -EINVAL; 15209 goto out; 15210 } 15211 15212 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 15213 if (!wdev_running(wdev)) { 15214 err = -ENETDOWN; 15215 goto out; 15216 } 15217 } 15218 } 15219 15220 while (1) { 15221 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 15222 cb->nlh->nlmsg_seq, NLM_F_MULTI, 15223 NL80211_CMD_VENDOR); 15224 if (!hdr) 15225 break; 15226 15227 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15228 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 15229 wdev_id(wdev), 15230 NL80211_ATTR_PAD))) { 15231 genlmsg_cancel(skb, hdr); 15232 break; 15233 } 15234 15235 vendor_data = nla_nest_start_noflag(skb, 15236 NL80211_ATTR_VENDOR_DATA); 15237 if (!vendor_data) { 15238 genlmsg_cancel(skb, hdr); 15239 break; 15240 } 15241 15242 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 15243 (unsigned long *)&cb->args[5]); 15244 nla_nest_end(skb, vendor_data); 15245 15246 if (err == -ENOBUFS || err == -ENOENT) { 15247 genlmsg_cancel(skb, hdr); 15248 break; 15249 } else if (err <= 0) { 15250 genlmsg_cancel(skb, hdr); 15251 goto out; 15252 } 15253 15254 genlmsg_end(skb, hdr); 15255 } 15256 15257 err = skb->len; 15258 out: 15259 rtnl_unlock(); 15260 return err; 15261 } 15262 15263 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 15264 enum nl80211_commands cmd, 15265 enum nl80211_attrs attr, 15266 int approxlen) 15267 { 15268 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15269 15270 if (WARN_ON(!rdev->cur_cmd_info)) 15271 return NULL; 15272 15273 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 15274 rdev->cur_cmd_info->snd_portid, 15275 rdev->cur_cmd_info->snd_seq, 15276 cmd, attr, NULL, GFP_KERNEL); 15277 } 15278 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 15279 15280 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 15281 { 15282 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 15283 void *hdr = ((void **)skb->cb)[1]; 15284 struct nlattr *data = ((void **)skb->cb)[2]; 15285 15286 /* clear CB data for netlink core to own from now on */ 15287 memset(skb->cb, 0, sizeof(skb->cb)); 15288 15289 if (WARN_ON(!rdev->cur_cmd_info)) { 15290 kfree_skb(skb); 15291 return -EINVAL; 15292 } 15293 15294 nla_nest_end(skb, data); 15295 genlmsg_end(skb, hdr); 15296 return genlmsg_reply(skb, rdev->cur_cmd_info); 15297 } 15298 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 15299 15300 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 15301 { 15302 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15303 15304 if (WARN_ON(!rdev->cur_cmd_info)) 15305 return 0; 15306 15307 return rdev->cur_cmd_info->snd_portid; 15308 } 15309 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 15310 15311 static int nl80211_set_qos_map(struct sk_buff *skb, 15312 struct genl_info *info) 15313 { 15314 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15315 struct cfg80211_qos_map *qos_map = NULL; 15316 struct net_device *dev = info->user_ptr[1]; 15317 u8 *pos, len, num_des, des_len, des; 15318 int ret; 15319 15320 if (!rdev->ops->set_qos_map) 15321 return -EOPNOTSUPP; 15322 15323 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 15324 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 15325 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 15326 15327 if (len % 2) 15328 return -EINVAL; 15329 15330 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 15331 if (!qos_map) 15332 return -ENOMEM; 15333 15334 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 15335 if (num_des) { 15336 des_len = num_des * 15337 sizeof(struct cfg80211_dscp_exception); 15338 memcpy(qos_map->dscp_exception, pos, des_len); 15339 qos_map->num_des = num_des; 15340 for (des = 0; des < num_des; des++) { 15341 if (qos_map->dscp_exception[des].up > 7) { 15342 kfree(qos_map); 15343 return -EINVAL; 15344 } 15345 } 15346 pos += des_len; 15347 } 15348 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 15349 } 15350 15351 ret = nl80211_key_allowed(dev->ieee80211_ptr); 15352 if (!ret) 15353 ret = rdev_set_qos_map(rdev, dev, qos_map); 15354 15355 kfree(qos_map); 15356 return ret; 15357 } 15358 15359 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 15360 { 15361 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15362 struct net_device *dev = info->user_ptr[1]; 15363 struct wireless_dev *wdev = dev->ieee80211_ptr; 15364 const u8 *peer; 15365 u8 tsid, up; 15366 u16 admitted_time = 0; 15367 15368 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 15369 return -EOPNOTSUPP; 15370 15371 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 15372 !info->attrs[NL80211_ATTR_USER_PRIO]) 15373 return -EINVAL; 15374 15375 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15376 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 15377 15378 /* WMM uses TIDs 0-7 even for TSPEC */ 15379 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 15380 /* TODO: handle 802.11 TSPEC/admission control 15381 * need more attributes for that (e.g. BA session requirement); 15382 * change the WMM adminssion test above to allow both then 15383 */ 15384 return -EINVAL; 15385 } 15386 15387 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15388 15389 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 15390 admitted_time = 15391 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 15392 if (!admitted_time) 15393 return -EINVAL; 15394 } 15395 15396 switch (wdev->iftype) { 15397 case NL80211_IFTYPE_STATION: 15398 case NL80211_IFTYPE_P2P_CLIENT: 15399 if (wdev->connected) 15400 break; 15401 return -ENOTCONN; 15402 default: 15403 return -EOPNOTSUPP; 15404 } 15405 15406 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 15407 } 15408 15409 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 15410 { 15411 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15412 struct net_device *dev = info->user_ptr[1]; 15413 const u8 *peer; 15414 u8 tsid; 15415 15416 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 15417 return -EINVAL; 15418 15419 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15420 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15421 15422 return rdev_del_tx_ts(rdev, dev, tsid, peer); 15423 } 15424 15425 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 15426 struct genl_info *info) 15427 { 15428 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15429 struct net_device *dev = info->user_ptr[1]; 15430 struct wireless_dev *wdev = dev->ieee80211_ptr; 15431 struct cfg80211_chan_def chandef = {}; 15432 const u8 *addr; 15433 u8 oper_class; 15434 int err; 15435 15436 if (!rdev->ops->tdls_channel_switch || 15437 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15438 return -EOPNOTSUPP; 15439 15440 switch (dev->ieee80211_ptr->iftype) { 15441 case NL80211_IFTYPE_STATION: 15442 case NL80211_IFTYPE_P2P_CLIENT: 15443 break; 15444 default: 15445 return -EOPNOTSUPP; 15446 } 15447 15448 if (!info->attrs[NL80211_ATTR_MAC] || 15449 !info->attrs[NL80211_ATTR_OPER_CLASS]) 15450 return -EINVAL; 15451 15452 err = nl80211_parse_chandef(rdev, info, &chandef); 15453 if (err) 15454 return err; 15455 15456 /* 15457 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 15458 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 15459 * specification is not defined for them. 15460 */ 15461 if (chandef.chan->band == NL80211_BAND_2GHZ && 15462 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 15463 chandef.width != NL80211_CHAN_WIDTH_20) 15464 return -EINVAL; 15465 15466 /* we will be active on the TDLS link */ 15467 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 15468 wdev->iftype)) 15469 return -EINVAL; 15470 15471 /* don't allow switching to DFS channels */ 15472 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 15473 return -EINVAL; 15474 15475 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15476 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 15477 15478 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 15479 } 15480 15481 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 15482 struct genl_info *info) 15483 { 15484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15485 struct net_device *dev = info->user_ptr[1]; 15486 const u8 *addr; 15487 15488 if (!rdev->ops->tdls_channel_switch || 15489 !rdev->ops->tdls_cancel_channel_switch || 15490 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15491 return -EOPNOTSUPP; 15492 15493 switch (dev->ieee80211_ptr->iftype) { 15494 case NL80211_IFTYPE_STATION: 15495 case NL80211_IFTYPE_P2P_CLIENT: 15496 break; 15497 default: 15498 return -EOPNOTSUPP; 15499 } 15500 15501 if (!info->attrs[NL80211_ATTR_MAC]) 15502 return -EINVAL; 15503 15504 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15505 15506 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 15507 15508 return 0; 15509 } 15510 15511 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 15512 struct genl_info *info) 15513 { 15514 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15515 struct net_device *dev = info->user_ptr[1]; 15516 struct wireless_dev *wdev = dev->ieee80211_ptr; 15517 const struct nlattr *nla; 15518 bool enabled; 15519 15520 if (!rdev->ops->set_multicast_to_unicast) 15521 return -EOPNOTSUPP; 15522 15523 if (wdev->iftype != NL80211_IFTYPE_AP && 15524 wdev->iftype != NL80211_IFTYPE_P2P_GO) 15525 return -EOPNOTSUPP; 15526 15527 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 15528 enabled = nla_get_flag(nla); 15529 15530 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 15531 } 15532 15533 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 15534 { 15535 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15536 struct net_device *dev = info->user_ptr[1]; 15537 struct wireless_dev *wdev = dev->ieee80211_ptr; 15538 struct cfg80211_pmk_conf pmk_conf = {}; 15539 15540 if (wdev->iftype != NL80211_IFTYPE_STATION && 15541 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15542 return -EOPNOTSUPP; 15543 15544 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15545 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15546 return -EOPNOTSUPP; 15547 15548 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 15549 return -EINVAL; 15550 15551 if (!wdev->connected) 15552 return -ENOTCONN; 15553 15554 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15555 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) 15556 return -EINVAL; 15557 15558 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 15559 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 15560 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 15561 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) 15562 return -EINVAL; 15563 15564 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 15565 pmk_conf.pmk_r0_name = 15566 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 15567 15568 return rdev_set_pmk(rdev, dev, &pmk_conf); 15569 } 15570 15571 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 15572 { 15573 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15574 struct net_device *dev = info->user_ptr[1]; 15575 struct wireless_dev *wdev = dev->ieee80211_ptr; 15576 const u8 *aa; 15577 15578 if (wdev->iftype != NL80211_IFTYPE_STATION && 15579 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15580 return -EOPNOTSUPP; 15581 15582 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15583 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15584 return -EOPNOTSUPP; 15585 15586 if (!info->attrs[NL80211_ATTR_MAC]) 15587 return -EINVAL; 15588 15589 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15590 return rdev_del_pmk(rdev, dev, aa); 15591 } 15592 15593 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 15594 { 15595 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15596 struct net_device *dev = info->user_ptr[1]; 15597 struct cfg80211_external_auth_params params; 15598 15599 if (!rdev->ops->external_auth) 15600 return -EOPNOTSUPP; 15601 15602 if (!info->attrs[NL80211_ATTR_SSID] && 15603 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 15604 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 15605 return -EINVAL; 15606 15607 if (!info->attrs[NL80211_ATTR_BSSID]) 15608 return -EINVAL; 15609 15610 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 15611 return -EINVAL; 15612 15613 memset(¶ms, 0, sizeof(params)); 15614 15615 if (info->attrs[NL80211_ATTR_SSID]) { 15616 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 15617 if (params.ssid.ssid_len == 0) 15618 return -EINVAL; 15619 memcpy(params.ssid.ssid, 15620 nla_data(info->attrs[NL80211_ATTR_SSID]), 15621 params.ssid.ssid_len); 15622 } 15623 15624 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 15625 ETH_ALEN); 15626 15627 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15628 15629 if (info->attrs[NL80211_ATTR_PMKID]) 15630 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 15631 15632 return rdev_external_auth(rdev, dev, ¶ms); 15633 } 15634 15635 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 15636 { 15637 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 15638 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15639 struct net_device *dev = info->user_ptr[1]; 15640 struct wireless_dev *wdev = dev->ieee80211_ptr; 15641 const u8 *buf; 15642 size_t len; 15643 u8 *dest; 15644 u16 proto; 15645 bool noencrypt; 15646 u64 cookie = 0; 15647 int link_id; 15648 int err; 15649 15650 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15651 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 15652 return -EOPNOTSUPP; 15653 15654 if (!rdev->ops->tx_control_port) 15655 return -EOPNOTSUPP; 15656 15657 if (!info->attrs[NL80211_ATTR_FRAME] || 15658 !info->attrs[NL80211_ATTR_MAC] || 15659 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 15660 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 15661 return -EINVAL; 15662 } 15663 15664 switch (wdev->iftype) { 15665 case NL80211_IFTYPE_AP: 15666 case NL80211_IFTYPE_P2P_GO: 15667 case NL80211_IFTYPE_MESH_POINT: 15668 break; 15669 case NL80211_IFTYPE_ADHOC: 15670 if (wdev->u.ibss.current_bss) 15671 break; 15672 return -ENOTCONN; 15673 case NL80211_IFTYPE_STATION: 15674 case NL80211_IFTYPE_P2P_CLIENT: 15675 if (wdev->connected) 15676 break; 15677 return -ENOTCONN; 15678 default: 15679 return -EOPNOTSUPP; 15680 } 15681 15682 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15683 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15684 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15685 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 15686 noencrypt = 15687 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 15688 15689 link_id = nl80211_link_id_or_invalid(info->attrs); 15690 15691 err = rdev_tx_control_port(rdev, dev, buf, len, 15692 dest, cpu_to_be16(proto), noencrypt, link_id, 15693 dont_wait_for_ack ? NULL : &cookie); 15694 if (!err && !dont_wait_for_ack) 15695 nl_set_extack_cookie_u64(info->extack, cookie); 15696 return err; 15697 } 15698 15699 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 15700 struct genl_info *info) 15701 { 15702 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15703 struct net_device *dev = info->user_ptr[1]; 15704 struct wireless_dev *wdev = dev->ieee80211_ptr; 15705 struct cfg80211_ftm_responder_stats ftm_stats = {}; 15706 unsigned int link_id = nl80211_link_id(info->attrs); 15707 struct sk_buff *msg; 15708 void *hdr; 15709 struct nlattr *ftm_stats_attr; 15710 int err; 15711 15712 if (wdev->iftype != NL80211_IFTYPE_AP || 15713 !wdev->links[link_id].ap.beacon_interval) 15714 return -EOPNOTSUPP; 15715 15716 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 15717 if (err) 15718 return err; 15719 15720 if (!ftm_stats.filled) 15721 return -ENODATA; 15722 15723 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15724 if (!msg) 15725 return -ENOMEM; 15726 15727 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 15728 NL80211_CMD_GET_FTM_RESPONDER_STATS); 15729 if (!hdr) 15730 goto nla_put_failure; 15731 15732 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15733 goto nla_put_failure; 15734 15735 ftm_stats_attr = nla_nest_start_noflag(msg, 15736 NL80211_ATTR_FTM_RESPONDER_STATS); 15737 if (!ftm_stats_attr) 15738 goto nla_put_failure; 15739 15740 #define SET_FTM(field, name, type) \ 15741 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15742 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 15743 ftm_stats.field)) \ 15744 goto nla_put_failure; } while (0) 15745 #define SET_FTM_U64(field, name) \ 15746 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15747 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 15748 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 15749 goto nla_put_failure; } while (0) 15750 15751 SET_FTM(success_num, SUCCESS_NUM, u32); 15752 SET_FTM(partial_num, PARTIAL_NUM, u32); 15753 SET_FTM(failed_num, FAILED_NUM, u32); 15754 SET_FTM(asap_num, ASAP_NUM, u32); 15755 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 15756 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 15757 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 15758 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 15759 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 15760 #undef SET_FTM 15761 15762 nla_nest_end(msg, ftm_stats_attr); 15763 15764 genlmsg_end(msg, hdr); 15765 return genlmsg_reply(msg, info); 15766 15767 nla_put_failure: 15768 nlmsg_free(msg); 15769 return -ENOBUFS; 15770 } 15771 15772 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 15773 { 15774 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15775 struct cfg80211_update_owe_info owe_info; 15776 struct net_device *dev = info->user_ptr[1]; 15777 15778 if (!rdev->ops->update_owe_info) 15779 return -EOPNOTSUPP; 15780 15781 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 15782 !info->attrs[NL80211_ATTR_MAC]) 15783 return -EINVAL; 15784 15785 memset(&owe_info, 0, sizeof(owe_info)); 15786 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15787 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 15788 15789 if (info->attrs[NL80211_ATTR_IE]) { 15790 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 15791 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 15792 } 15793 15794 return rdev_update_owe_info(rdev, dev, &owe_info); 15795 } 15796 15797 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 15798 { 15799 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15800 struct net_device *dev = info->user_ptr[1]; 15801 struct wireless_dev *wdev = dev->ieee80211_ptr; 15802 struct station_info sinfo = {}; 15803 const u8 *buf; 15804 size_t len; 15805 u8 *dest; 15806 int err; 15807 15808 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 15809 return -EOPNOTSUPP; 15810 15811 if (!info->attrs[NL80211_ATTR_MAC] || 15812 !info->attrs[NL80211_ATTR_FRAME]) { 15813 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 15814 return -EINVAL; 15815 } 15816 15817 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 15818 return -EOPNOTSUPP; 15819 15820 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15821 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15822 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15823 15824 if (len < sizeof(struct ethhdr)) 15825 return -EINVAL; 15826 15827 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 15828 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 15829 return -EINVAL; 15830 15831 err = rdev_get_station(rdev, dev, dest, &sinfo); 15832 if (err) 15833 return err; 15834 15835 cfg80211_sinfo_release_content(&sinfo); 15836 15837 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 15838 } 15839 15840 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 15841 struct nlattr *attrs[], struct net_device *dev, 15842 struct cfg80211_tid_cfg *tid_conf, 15843 struct genl_info *info, const u8 *peer, 15844 unsigned int link_id) 15845 { 15846 struct netlink_ext_ack *extack = info->extack; 15847 u64 mask; 15848 int err; 15849 15850 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 15851 return -EINVAL; 15852 15853 tid_conf->config_override = 15854 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 15855 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 15856 15857 if (tid_conf->config_override) { 15858 if (rdev->ops->reset_tid_config) { 15859 err = rdev_reset_tid_config(rdev, dev, peer, 15860 tid_conf->tids); 15861 if (err) 15862 return err; 15863 } else { 15864 return -EINVAL; 15865 } 15866 } 15867 15868 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 15869 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 15870 tid_conf->noack = 15871 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 15872 } 15873 15874 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 15875 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 15876 tid_conf->retry_short = 15877 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 15878 15879 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 15880 return -EINVAL; 15881 } 15882 15883 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 15884 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 15885 tid_conf->retry_long = 15886 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 15887 15888 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 15889 return -EINVAL; 15890 } 15891 15892 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 15893 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 15894 tid_conf->ampdu = 15895 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 15896 } 15897 15898 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 15899 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 15900 tid_conf->rtscts = 15901 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 15902 } 15903 15904 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 15905 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 15906 tid_conf->amsdu = 15907 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 15908 } 15909 15910 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 15911 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 15912 15913 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 15914 15915 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 15916 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 15917 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 15918 &tid_conf->txrate_mask, dev, 15919 true, link_id); 15920 if (err) 15921 return err; 15922 15923 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 15924 } 15925 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 15926 } 15927 15928 if (peer) 15929 mask = rdev->wiphy.tid_config_support.peer; 15930 else 15931 mask = rdev->wiphy.tid_config_support.vif; 15932 15933 if (tid_conf->mask & ~mask) { 15934 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 15935 return -EOPNOTSUPP; 15936 } 15937 15938 return 0; 15939 } 15940 15941 static int nl80211_set_tid_config(struct sk_buff *skb, 15942 struct genl_info *info) 15943 { 15944 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15945 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 15946 unsigned int link_id = nl80211_link_id(info->attrs); 15947 struct net_device *dev = info->user_ptr[1]; 15948 struct cfg80211_tid_config *tid_config; 15949 struct nlattr *tid; 15950 int conf_idx = 0, rem_conf; 15951 int ret = -EINVAL; 15952 u32 num_conf = 0; 15953 15954 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 15955 return -EINVAL; 15956 15957 if (!rdev->ops->set_tid_config) 15958 return -EOPNOTSUPP; 15959 15960 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15961 rem_conf) 15962 num_conf++; 15963 15964 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 15965 GFP_KERNEL); 15966 if (!tid_config) 15967 return -ENOMEM; 15968 15969 tid_config->n_tid_conf = num_conf; 15970 15971 if (info->attrs[NL80211_ATTR_MAC]) 15972 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15973 15974 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15975 rem_conf) { 15976 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 15977 tid, NULL, NULL); 15978 15979 if (ret) 15980 goto bad_tid_conf; 15981 15982 ret = parse_tid_conf(rdev, attrs, dev, 15983 &tid_config->tid_conf[conf_idx], 15984 info, tid_config->peer, link_id); 15985 if (ret) 15986 goto bad_tid_conf; 15987 15988 conf_idx++; 15989 } 15990 15991 ret = rdev_set_tid_config(rdev, dev, tid_config); 15992 15993 bad_tid_conf: 15994 kfree(tid_config); 15995 return ret; 15996 } 15997 15998 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info) 15999 { 16000 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16001 struct cfg80211_color_change_settings params = {}; 16002 struct net_device *dev = info->user_ptr[1]; 16003 struct wireless_dev *wdev = dev->ieee80211_ptr; 16004 struct nlattr **tb; 16005 u16 offset; 16006 int err; 16007 16008 if (!rdev->ops->color_change) 16009 return -EOPNOTSUPP; 16010 16011 if (!wiphy_ext_feature_isset(&rdev->wiphy, 16012 NL80211_EXT_FEATURE_BSS_COLOR)) 16013 return -EOPNOTSUPP; 16014 16015 if (wdev->iftype != NL80211_IFTYPE_AP) 16016 return -EOPNOTSUPP; 16017 16018 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] || 16019 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] || 16020 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS]) 16021 return -EINVAL; 16022 16023 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]); 16024 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]); 16025 16026 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next, 16027 info->extack); 16028 if (err) 16029 return err; 16030 16031 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL); 16032 if (!tb) 16033 return -ENOMEM; 16034 16035 err = nla_parse_nested(tb, NL80211_ATTR_MAX, 16036 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS], 16037 nl80211_policy, info->extack); 16038 if (err) 16039 goto out; 16040 16041 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change, 16042 info->extack); 16043 if (err) 16044 goto out; 16045 16046 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 16047 err = -EINVAL; 16048 goto out; 16049 } 16050 16051 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) { 16052 err = -EINVAL; 16053 goto out; 16054 } 16055 16056 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 16057 if (offset >= params.beacon_color_change.tail_len) { 16058 err = -EINVAL; 16059 goto out; 16060 } 16061 16062 if (params.beacon_color_change.tail[offset] != params.count) { 16063 err = -EINVAL; 16064 goto out; 16065 } 16066 16067 params.counter_offset_beacon = offset; 16068 16069 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 16070 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) != 16071 sizeof(u16)) { 16072 err = -EINVAL; 16073 goto out; 16074 } 16075 16076 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 16077 if (offset >= params.beacon_color_change.probe_resp_len) { 16078 err = -EINVAL; 16079 goto out; 16080 } 16081 16082 if (params.beacon_color_change.probe_resp[offset] != 16083 params.count) { 16084 err = -EINVAL; 16085 goto out; 16086 } 16087 16088 params.counter_offset_presp = offset; 16089 } 16090 16091 err = rdev_color_change(rdev, dev, ¶ms); 16092 16093 out: 16094 kfree(params.beacon_next.mbssid_ies); 16095 kfree(params.beacon_color_change.mbssid_ies); 16096 kfree(params.beacon_next.rnr_ies); 16097 kfree(params.beacon_color_change.rnr_ies); 16098 kfree(tb); 16099 return err; 16100 } 16101 16102 static int nl80211_set_fils_aad(struct sk_buff *skb, 16103 struct genl_info *info) 16104 { 16105 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16106 struct net_device *dev = info->user_ptr[1]; 16107 struct cfg80211_fils_aad fils_aad = {}; 16108 u8 *nonces; 16109 16110 if (!info->attrs[NL80211_ATTR_MAC] || 16111 !info->attrs[NL80211_ATTR_FILS_KEK] || 16112 !info->attrs[NL80211_ATTR_FILS_NONCES]) 16113 return -EINVAL; 16114 16115 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]); 16116 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 16117 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 16118 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 16119 fils_aad.snonce = nonces; 16120 fils_aad.anonce = nonces + FILS_NONCE_LEN; 16121 16122 return rdev_set_fils_aad(rdev, dev, &fils_aad); 16123 } 16124 16125 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info) 16126 { 16127 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16128 unsigned int link_id = nl80211_link_id(info->attrs); 16129 struct net_device *dev = info->user_ptr[1]; 16130 struct wireless_dev *wdev = dev->ieee80211_ptr; 16131 int ret; 16132 16133 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)) 16134 return -EINVAL; 16135 16136 switch (wdev->iftype) { 16137 case NL80211_IFTYPE_AP: 16138 break; 16139 default: 16140 return -EINVAL; 16141 } 16142 16143 if (!info->attrs[NL80211_ATTR_MAC] || 16144 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC]))) 16145 return -EINVAL; 16146 16147 wdev->valid_links |= BIT(link_id); 16148 ether_addr_copy(wdev->links[link_id].addr, 16149 nla_data(info->attrs[NL80211_ATTR_MAC])); 16150 16151 ret = rdev_add_intf_link(rdev, wdev, link_id); 16152 if (ret) { 16153 wdev->valid_links &= ~BIT(link_id); 16154 eth_zero_addr(wdev->links[link_id].addr); 16155 } 16156 16157 return ret; 16158 } 16159 16160 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info) 16161 { 16162 unsigned int link_id = nl80211_link_id(info->attrs); 16163 struct net_device *dev = info->user_ptr[1]; 16164 struct wireless_dev *wdev = dev->ieee80211_ptr; 16165 16166 /* cannot remove if there's no link */ 16167 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16168 return -EINVAL; 16169 16170 switch (wdev->iftype) { 16171 case NL80211_IFTYPE_AP: 16172 break; 16173 default: 16174 return -EINVAL; 16175 } 16176 16177 cfg80211_remove_link(wdev, link_id); 16178 16179 return 0; 16180 } 16181 16182 static int 16183 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info, 16184 bool add) 16185 { 16186 struct link_station_parameters params = {}; 16187 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16188 struct net_device *dev = info->user_ptr[1]; 16189 int err; 16190 16191 if ((add && !rdev->ops->add_link_station) || 16192 (!add && !rdev->ops->mod_link_station)) 16193 return -EOPNOTSUPP; 16194 16195 if (add && !info->attrs[NL80211_ATTR_MAC]) 16196 return -EINVAL; 16197 16198 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 16199 return -EINVAL; 16200 16201 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 16202 return -EINVAL; 16203 16204 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16205 16206 if (info->attrs[NL80211_ATTR_MAC]) { 16207 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 16208 if (!is_valid_ether_addr(params.link_mac)) 16209 return -EINVAL; 16210 } 16211 16212 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16213 return -EINVAL; 16214 16215 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16216 16217 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 16218 params.supported_rates = 16219 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16220 params.supported_rates_len = 16221 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16222 } 16223 16224 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 16225 params.ht_capa = 16226 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 16227 16228 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 16229 params.vht_capa = 16230 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 16231 16232 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 16233 params.he_capa = 16234 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16235 params.he_capa_len = 16236 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16237 16238 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 16239 params.eht_capa = 16240 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16241 params.eht_capa_len = 16242 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16243 16244 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa, 16245 (const u8 *)params.eht_capa, 16246 params.eht_capa_len, 16247 false)) 16248 return -EINVAL; 16249 } 16250 } 16251 16252 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 16253 params.he_6ghz_capa = 16254 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 16255 16256 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 16257 params.opmode_notif_used = true; 16258 params.opmode_notif = 16259 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 16260 } 16261 16262 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr, 16263 ¶ms.txpwr_set); 16264 if (err) 16265 return err; 16266 16267 if (add) 16268 return rdev_add_link_station(rdev, dev, ¶ms); 16269 16270 return rdev_mod_link_station(rdev, dev, ¶ms); 16271 } 16272 16273 static int 16274 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info) 16275 { 16276 return nl80211_add_mod_link_station(skb, info, true); 16277 } 16278 16279 static int 16280 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info) 16281 { 16282 return nl80211_add_mod_link_station(skb, info, false); 16283 } 16284 16285 static int 16286 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info) 16287 { 16288 struct link_station_del_parameters params = {}; 16289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16290 struct net_device *dev = info->user_ptr[1]; 16291 16292 if (!rdev->ops->del_link_station) 16293 return -EOPNOTSUPP; 16294 16295 if (!info->attrs[NL80211_ATTR_MLD_ADDR] || 16296 !info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16297 return -EINVAL; 16298 16299 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16300 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16301 16302 return rdev_del_link_station(rdev, dev, ¶ms); 16303 } 16304 16305 static int nl80211_set_hw_timestamp(struct sk_buff *skb, 16306 struct genl_info *info) 16307 { 16308 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16309 struct net_device *dev = info->user_ptr[1]; 16310 struct cfg80211_set_hw_timestamp hwts = {}; 16311 16312 if (!rdev->wiphy.hw_timestamp_max_peers) 16313 return -EOPNOTSUPP; 16314 16315 if (!info->attrs[NL80211_ATTR_MAC] && 16316 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS) 16317 return -EOPNOTSUPP; 16318 16319 if (info->attrs[NL80211_ATTR_MAC]) 16320 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]); 16321 16322 hwts.enable = 16323 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]); 16324 16325 return rdev_set_hw_timestamp(rdev, dev, &hwts); 16326 } 16327 16328 static int 16329 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info) 16330 { 16331 struct cfg80211_ttlm_params params = {}; 16332 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16333 struct net_device *dev = info->user_ptr[1]; 16334 struct wireless_dev *wdev = dev->ieee80211_ptr; 16335 16336 if (wdev->iftype != NL80211_IFTYPE_STATION && 16337 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 16338 return -EOPNOTSUPP; 16339 16340 if (!wdev->connected) 16341 return -ENOLINK; 16342 16343 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] || 16344 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK]) 16345 return -EINVAL; 16346 16347 nla_memcpy(params.dlink, 16348 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK], 16349 sizeof(params.dlink)); 16350 nla_memcpy(params.ulink, 16351 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK], 16352 sizeof(params.ulink)); 16353 16354 return rdev_set_ttlm(rdev, dev, ¶ms); 16355 } 16356 16357 #define NL80211_FLAG_NEED_WIPHY 0x01 16358 #define NL80211_FLAG_NEED_NETDEV 0x02 16359 #define NL80211_FLAG_NEED_RTNL 0x04 16360 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 16361 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 16362 NL80211_FLAG_CHECK_NETDEV_UP) 16363 #define NL80211_FLAG_NEED_WDEV 0x10 16364 /* If a netdev is associated, it must be UP, P2P must be started */ 16365 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 16366 NL80211_FLAG_CHECK_NETDEV_UP) 16367 #define NL80211_FLAG_CLEAR_SKB 0x20 16368 #define NL80211_FLAG_NO_WIPHY_MTX 0x40 16369 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80 16370 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100 16371 16372 #define INTERNAL_FLAG_SELECTORS(__sel) \ 16373 SELECTOR(__sel, NONE, 0) /* must be first */ \ 16374 SELECTOR(__sel, WIPHY, \ 16375 NL80211_FLAG_NEED_WIPHY) \ 16376 SELECTOR(__sel, WDEV, \ 16377 NL80211_FLAG_NEED_WDEV) \ 16378 SELECTOR(__sel, NETDEV, \ 16379 NL80211_FLAG_NEED_NETDEV) \ 16380 SELECTOR(__sel, NETDEV_LINK, \ 16381 NL80211_FLAG_NEED_NETDEV | \ 16382 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16383 SELECTOR(__sel, NETDEV_NO_MLO, \ 16384 NL80211_FLAG_NEED_NETDEV | \ 16385 NL80211_FLAG_MLO_UNSUPPORTED) \ 16386 SELECTOR(__sel, WIPHY_RTNL, \ 16387 NL80211_FLAG_NEED_WIPHY | \ 16388 NL80211_FLAG_NEED_RTNL) \ 16389 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \ 16390 NL80211_FLAG_NEED_WIPHY | \ 16391 NL80211_FLAG_NEED_RTNL | \ 16392 NL80211_FLAG_NO_WIPHY_MTX) \ 16393 SELECTOR(__sel, WDEV_RTNL, \ 16394 NL80211_FLAG_NEED_WDEV | \ 16395 NL80211_FLAG_NEED_RTNL) \ 16396 SELECTOR(__sel, NETDEV_RTNL, \ 16397 NL80211_FLAG_NEED_NETDEV | \ 16398 NL80211_FLAG_NEED_RTNL) \ 16399 SELECTOR(__sel, NETDEV_UP, \ 16400 NL80211_FLAG_NEED_NETDEV_UP) \ 16401 SELECTOR(__sel, NETDEV_UP_LINK, \ 16402 NL80211_FLAG_NEED_NETDEV_UP | \ 16403 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16404 SELECTOR(__sel, NETDEV_UP_NO_MLO, \ 16405 NL80211_FLAG_NEED_NETDEV_UP | \ 16406 NL80211_FLAG_MLO_UNSUPPORTED) \ 16407 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \ 16408 NL80211_FLAG_NEED_NETDEV_UP | \ 16409 NL80211_FLAG_CLEAR_SKB | \ 16410 NL80211_FLAG_MLO_UNSUPPORTED) \ 16411 SELECTOR(__sel, NETDEV_UP_NOTMX, \ 16412 NL80211_FLAG_NEED_NETDEV_UP | \ 16413 NL80211_FLAG_NO_WIPHY_MTX) \ 16414 SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO, \ 16415 NL80211_FLAG_NEED_NETDEV_UP | \ 16416 NL80211_FLAG_NO_WIPHY_MTX | \ 16417 NL80211_FLAG_MLO_UNSUPPORTED) \ 16418 SELECTOR(__sel, NETDEV_UP_CLEAR, \ 16419 NL80211_FLAG_NEED_NETDEV_UP | \ 16420 NL80211_FLAG_CLEAR_SKB) \ 16421 SELECTOR(__sel, WDEV_UP, \ 16422 NL80211_FLAG_NEED_WDEV_UP) \ 16423 SELECTOR(__sel, WDEV_UP_LINK, \ 16424 NL80211_FLAG_NEED_WDEV_UP | \ 16425 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16426 SELECTOR(__sel, WDEV_UP_RTNL, \ 16427 NL80211_FLAG_NEED_WDEV_UP | \ 16428 NL80211_FLAG_NEED_RTNL) \ 16429 SELECTOR(__sel, WIPHY_CLEAR, \ 16430 NL80211_FLAG_NEED_WIPHY | \ 16431 NL80211_FLAG_CLEAR_SKB) 16432 16433 enum nl80211_internal_flags_selector { 16434 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name, 16435 INTERNAL_FLAG_SELECTORS(_) 16436 #undef SELECTOR 16437 }; 16438 16439 static u32 nl80211_internal_flags[] = { 16440 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value, 16441 INTERNAL_FLAG_SELECTORS(_) 16442 #undef SELECTOR 16443 }; 16444 16445 static int nl80211_pre_doit(const struct genl_split_ops *ops, 16446 struct sk_buff *skb, 16447 struct genl_info *info) 16448 { 16449 struct cfg80211_registered_device *rdev = NULL; 16450 struct wireless_dev *wdev = NULL; 16451 struct net_device *dev = NULL; 16452 u32 internal_flags; 16453 int err; 16454 16455 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags))) 16456 return -EINVAL; 16457 16458 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16459 16460 rtnl_lock(); 16461 if (internal_flags & NL80211_FLAG_NEED_WIPHY) { 16462 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 16463 if (IS_ERR(rdev)) { 16464 err = PTR_ERR(rdev); 16465 goto out_unlock; 16466 } 16467 info->user_ptr[0] = rdev; 16468 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV || 16469 internal_flags & NL80211_FLAG_NEED_WDEV) { 16470 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info), 16471 info->attrs); 16472 if (IS_ERR(wdev)) { 16473 err = PTR_ERR(wdev); 16474 goto out_unlock; 16475 } 16476 16477 dev = wdev->netdev; 16478 dev_hold(dev); 16479 rdev = wiphy_to_rdev(wdev->wiphy); 16480 16481 if (internal_flags & NL80211_FLAG_NEED_NETDEV) { 16482 if (!dev) { 16483 err = -EINVAL; 16484 goto out_unlock; 16485 } 16486 16487 info->user_ptr[1] = dev; 16488 } else { 16489 info->user_ptr[1] = wdev; 16490 } 16491 16492 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 16493 !wdev_running(wdev)) { 16494 err = -ENETDOWN; 16495 goto out_unlock; 16496 } 16497 16498 info->user_ptr[0] = rdev; 16499 } 16500 16501 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) { 16502 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID]; 16503 16504 if (!wdev) { 16505 err = -EINVAL; 16506 goto out_unlock; 16507 } 16508 16509 /* MLO -> require valid link ID */ 16510 if (wdev->valid_links && 16511 (!link_id || 16512 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) { 16513 err = -EINVAL; 16514 goto out_unlock; 16515 } 16516 16517 /* non-MLO -> no link ID attribute accepted */ 16518 if (!wdev->valid_links && link_id) { 16519 err = -EINVAL; 16520 goto out_unlock; 16521 } 16522 } 16523 16524 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) { 16525 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] || 16526 (wdev && wdev->valid_links)) { 16527 err = -EINVAL; 16528 goto out_unlock; 16529 } 16530 } 16531 16532 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16533 wiphy_lock(&rdev->wiphy); 16534 /* we keep the mutex locked until post_doit */ 16535 __release(&rdev->wiphy.mtx); 16536 } 16537 if (!(internal_flags & NL80211_FLAG_NEED_RTNL)) 16538 rtnl_unlock(); 16539 16540 return 0; 16541 out_unlock: 16542 rtnl_unlock(); 16543 dev_put(dev); 16544 return err; 16545 } 16546 16547 static void nl80211_post_doit(const struct genl_split_ops *ops, 16548 struct sk_buff *skb, 16549 struct genl_info *info) 16550 { 16551 u32 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16552 16553 if (info->user_ptr[1]) { 16554 if (internal_flags & NL80211_FLAG_NEED_WDEV) { 16555 struct wireless_dev *wdev = info->user_ptr[1]; 16556 16557 dev_put(wdev->netdev); 16558 } else { 16559 dev_put(info->user_ptr[1]); 16560 } 16561 } 16562 16563 if (info->user_ptr[0] && 16564 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16565 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16566 16567 /* we kept the mutex locked since pre_doit */ 16568 __acquire(&rdev->wiphy.mtx); 16569 wiphy_unlock(&rdev->wiphy); 16570 } 16571 16572 if (internal_flags & NL80211_FLAG_NEED_RTNL) 16573 rtnl_unlock(); 16574 16575 /* If needed, clear the netlink message payload from the SKB 16576 * as it might contain key data that shouldn't stick around on 16577 * the heap after the SKB is freed. The netlink message header 16578 * is still needed for further processing, so leave it intact. 16579 */ 16580 if (internal_flags & NL80211_FLAG_CLEAR_SKB) { 16581 struct nlmsghdr *nlh = nlmsg_hdr(skb); 16582 16583 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 16584 } 16585 } 16586 16587 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev, 16588 struct cfg80211_sar_specs *sar_specs, 16589 struct nlattr *spec[], int index) 16590 { 16591 u32 range_index, i; 16592 16593 if (!sar_specs || !spec) 16594 return -EINVAL; 16595 16596 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] || 16597 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]) 16598 return -EINVAL; 16599 16600 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]); 16601 16602 /* check if range_index exceeds num_freq_ranges */ 16603 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges) 16604 return -EINVAL; 16605 16606 /* check if range_index duplicates */ 16607 for (i = 0; i < index; i++) { 16608 if (sar_specs->sub_specs[i].freq_range_index == range_index) 16609 return -EINVAL; 16610 } 16611 16612 sar_specs->sub_specs[index].power = 16613 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]); 16614 16615 sar_specs->sub_specs[index].freq_range_index = range_index; 16616 16617 return 0; 16618 } 16619 16620 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) 16621 { 16622 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16623 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1]; 16624 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1]; 16625 struct cfg80211_sar_specs *sar_spec; 16626 enum nl80211_sar_type type; 16627 struct nlattr *spec_list; 16628 u32 specs; 16629 int rem, err; 16630 16631 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs) 16632 return -EOPNOTSUPP; 16633 16634 if (!info->attrs[NL80211_ATTR_SAR_SPEC]) 16635 return -EINVAL; 16636 16637 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX, 16638 info->attrs[NL80211_ATTR_SAR_SPEC], 16639 NULL, NULL); 16640 16641 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS]) 16642 return -EINVAL; 16643 16644 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]); 16645 if (type != rdev->wiphy.sar_capa->type) 16646 return -EINVAL; 16647 16648 specs = 0; 16649 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) 16650 specs++; 16651 16652 if (specs > rdev->wiphy.sar_capa->num_freq_ranges) 16653 return -EINVAL; 16654 16655 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL); 16656 if (!sar_spec) 16657 return -ENOMEM; 16658 16659 sar_spec->type = type; 16660 specs = 0; 16661 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) { 16662 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX, 16663 spec_list, NULL, NULL); 16664 16665 switch (type) { 16666 case NL80211_SAR_TYPE_POWER: 16667 if (nl80211_set_sar_sub_specs(rdev, sar_spec, 16668 spec, specs)) { 16669 err = -EINVAL; 16670 goto error; 16671 } 16672 break; 16673 default: 16674 err = -EINVAL; 16675 goto error; 16676 } 16677 specs++; 16678 } 16679 16680 sar_spec->num_sub_specs = specs; 16681 16682 rdev->cur_cmd_info = info; 16683 err = rdev_set_sar_specs(rdev, sar_spec); 16684 rdev->cur_cmd_info = NULL; 16685 error: 16686 kfree(sar_spec); 16687 return err; 16688 } 16689 16690 #define SELECTOR(__sel, name, value) \ 16691 ((__sel) == (value)) ? NL80211_IFL_SEL_##name : 16692 int __missing_selector(void); 16693 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector() 16694 16695 static const struct genl_ops nl80211_ops[] = { 16696 { 16697 .cmd = NL80211_CMD_GET_WIPHY, 16698 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16699 .doit = nl80211_get_wiphy, 16700 .dumpit = nl80211_dump_wiphy, 16701 .done = nl80211_dump_wiphy_done, 16702 /* can be retrieved by unprivileged users */ 16703 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16704 }, 16705 }; 16706 16707 static const struct genl_small_ops nl80211_small_ops[] = { 16708 { 16709 .cmd = NL80211_CMD_SET_WIPHY, 16710 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16711 .doit = nl80211_set_wiphy, 16712 .flags = GENL_UNS_ADMIN_PERM, 16713 }, 16714 { 16715 .cmd = NL80211_CMD_GET_INTERFACE, 16716 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16717 .doit = nl80211_get_interface, 16718 .dumpit = nl80211_dump_interface, 16719 /* can be retrieved by unprivileged users */ 16720 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 16721 }, 16722 { 16723 .cmd = NL80211_CMD_SET_INTERFACE, 16724 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16725 .doit = nl80211_set_interface, 16726 .flags = GENL_UNS_ADMIN_PERM, 16727 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 16728 NL80211_FLAG_NEED_RTNL), 16729 }, 16730 { 16731 .cmd = NL80211_CMD_NEW_INTERFACE, 16732 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16733 .doit = nl80211_new_interface, 16734 .flags = GENL_UNS_ADMIN_PERM, 16735 .internal_flags = 16736 IFLAGS(NL80211_FLAG_NEED_WIPHY | 16737 NL80211_FLAG_NEED_RTNL | 16738 /* we take the wiphy mutex later ourselves */ 16739 NL80211_FLAG_NO_WIPHY_MTX), 16740 }, 16741 { 16742 .cmd = NL80211_CMD_DEL_INTERFACE, 16743 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16744 .doit = nl80211_del_interface, 16745 .flags = GENL_UNS_ADMIN_PERM, 16746 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 16747 NL80211_FLAG_NEED_RTNL), 16748 }, 16749 { 16750 .cmd = NL80211_CMD_GET_KEY, 16751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16752 .doit = nl80211_get_key, 16753 .flags = GENL_UNS_ADMIN_PERM, 16754 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16755 }, 16756 { 16757 .cmd = NL80211_CMD_SET_KEY, 16758 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16759 .doit = nl80211_set_key, 16760 .flags = GENL_UNS_ADMIN_PERM, 16761 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */ 16762 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16763 NL80211_FLAG_CLEAR_SKB), 16764 }, 16765 { 16766 .cmd = NL80211_CMD_NEW_KEY, 16767 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16768 .doit = nl80211_new_key, 16769 .flags = GENL_UNS_ADMIN_PERM, 16770 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16771 NL80211_FLAG_CLEAR_SKB), 16772 }, 16773 { 16774 .cmd = NL80211_CMD_DEL_KEY, 16775 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16776 .doit = nl80211_del_key, 16777 .flags = GENL_UNS_ADMIN_PERM, 16778 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16779 }, 16780 { 16781 .cmd = NL80211_CMD_SET_BEACON, 16782 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16783 .flags = GENL_UNS_ADMIN_PERM, 16784 .doit = nl80211_set_beacon, 16785 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16786 NL80211_FLAG_MLO_VALID_LINK_ID), 16787 }, 16788 { 16789 .cmd = NL80211_CMD_START_AP, 16790 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16791 .flags = GENL_UNS_ADMIN_PERM, 16792 .doit = nl80211_start_ap, 16793 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16794 NL80211_FLAG_MLO_VALID_LINK_ID), 16795 }, 16796 { 16797 .cmd = NL80211_CMD_STOP_AP, 16798 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16799 .flags = GENL_UNS_ADMIN_PERM, 16800 .doit = nl80211_stop_ap, 16801 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16802 NL80211_FLAG_MLO_VALID_LINK_ID), 16803 }, 16804 { 16805 .cmd = NL80211_CMD_GET_STATION, 16806 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16807 .doit = nl80211_get_station, 16808 .dumpit = nl80211_dump_station, 16809 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16810 }, 16811 { 16812 .cmd = NL80211_CMD_SET_STATION, 16813 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16814 .doit = nl80211_set_station, 16815 .flags = GENL_UNS_ADMIN_PERM, 16816 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16817 }, 16818 { 16819 .cmd = NL80211_CMD_NEW_STATION, 16820 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16821 .doit = nl80211_new_station, 16822 .flags = GENL_UNS_ADMIN_PERM, 16823 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16824 }, 16825 { 16826 .cmd = NL80211_CMD_DEL_STATION, 16827 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16828 .doit = nl80211_del_station, 16829 .flags = GENL_UNS_ADMIN_PERM, 16830 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16831 }, 16832 { 16833 .cmd = NL80211_CMD_GET_MPATH, 16834 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16835 .doit = nl80211_get_mpath, 16836 .dumpit = nl80211_dump_mpath, 16837 .flags = GENL_UNS_ADMIN_PERM, 16838 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16839 }, 16840 { 16841 .cmd = NL80211_CMD_GET_MPP, 16842 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16843 .doit = nl80211_get_mpp, 16844 .dumpit = nl80211_dump_mpp, 16845 .flags = GENL_UNS_ADMIN_PERM, 16846 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16847 }, 16848 { 16849 .cmd = NL80211_CMD_SET_MPATH, 16850 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16851 .doit = nl80211_set_mpath, 16852 .flags = GENL_UNS_ADMIN_PERM, 16853 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16854 }, 16855 { 16856 .cmd = NL80211_CMD_NEW_MPATH, 16857 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16858 .doit = nl80211_new_mpath, 16859 .flags = GENL_UNS_ADMIN_PERM, 16860 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16861 }, 16862 { 16863 .cmd = NL80211_CMD_DEL_MPATH, 16864 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16865 .doit = nl80211_del_mpath, 16866 .flags = GENL_UNS_ADMIN_PERM, 16867 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16868 }, 16869 { 16870 .cmd = NL80211_CMD_SET_BSS, 16871 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16872 .doit = nl80211_set_bss, 16873 .flags = GENL_UNS_ADMIN_PERM, 16874 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16875 NL80211_FLAG_MLO_VALID_LINK_ID), 16876 }, 16877 { 16878 .cmd = NL80211_CMD_GET_REG, 16879 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16880 .doit = nl80211_get_reg_do, 16881 .dumpit = nl80211_get_reg_dump, 16882 /* can be retrieved by unprivileged users */ 16883 }, 16884 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 16885 { 16886 .cmd = NL80211_CMD_SET_REG, 16887 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16888 .doit = nl80211_set_reg, 16889 .flags = GENL_ADMIN_PERM, 16890 }, 16891 #endif 16892 { 16893 .cmd = NL80211_CMD_REQ_SET_REG, 16894 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16895 .doit = nl80211_req_set_reg, 16896 .flags = GENL_ADMIN_PERM, 16897 }, 16898 { 16899 .cmd = NL80211_CMD_RELOAD_REGDB, 16900 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16901 .doit = nl80211_reload_regdb, 16902 .flags = GENL_ADMIN_PERM, 16903 }, 16904 { 16905 .cmd = NL80211_CMD_GET_MESH_CONFIG, 16906 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16907 .doit = nl80211_get_mesh_config, 16908 /* can be retrieved by unprivileged users */ 16909 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16910 }, 16911 { 16912 .cmd = NL80211_CMD_SET_MESH_CONFIG, 16913 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16914 .doit = nl80211_update_mesh_config, 16915 .flags = GENL_UNS_ADMIN_PERM, 16916 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16917 }, 16918 { 16919 .cmd = NL80211_CMD_TRIGGER_SCAN, 16920 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16921 .doit = nl80211_trigger_scan, 16922 .flags = GENL_UNS_ADMIN_PERM, 16923 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16924 }, 16925 { 16926 .cmd = NL80211_CMD_ABORT_SCAN, 16927 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16928 .doit = nl80211_abort_scan, 16929 .flags = GENL_UNS_ADMIN_PERM, 16930 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16931 }, 16932 { 16933 .cmd = NL80211_CMD_GET_SCAN, 16934 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16935 .dumpit = nl80211_dump_scan, 16936 }, 16937 { 16938 .cmd = NL80211_CMD_START_SCHED_SCAN, 16939 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16940 .doit = nl80211_start_sched_scan, 16941 .flags = GENL_UNS_ADMIN_PERM, 16942 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16943 }, 16944 { 16945 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 16946 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16947 .doit = nl80211_stop_sched_scan, 16948 .flags = GENL_UNS_ADMIN_PERM, 16949 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16950 }, 16951 { 16952 .cmd = NL80211_CMD_AUTHENTICATE, 16953 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16954 .doit = nl80211_authenticate, 16955 .flags = GENL_UNS_ADMIN_PERM, 16956 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16957 NL80211_FLAG_CLEAR_SKB), 16958 }, 16959 { 16960 .cmd = NL80211_CMD_ASSOCIATE, 16961 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16962 .doit = nl80211_associate, 16963 .flags = GENL_UNS_ADMIN_PERM, 16964 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16965 NL80211_FLAG_CLEAR_SKB), 16966 }, 16967 { 16968 .cmd = NL80211_CMD_DEAUTHENTICATE, 16969 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16970 .doit = nl80211_deauthenticate, 16971 .flags = GENL_UNS_ADMIN_PERM, 16972 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16973 }, 16974 { 16975 .cmd = NL80211_CMD_DISASSOCIATE, 16976 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16977 .doit = nl80211_disassociate, 16978 .flags = GENL_UNS_ADMIN_PERM, 16979 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16980 }, 16981 { 16982 .cmd = NL80211_CMD_JOIN_IBSS, 16983 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16984 .doit = nl80211_join_ibss, 16985 .flags = GENL_UNS_ADMIN_PERM, 16986 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16987 }, 16988 { 16989 .cmd = NL80211_CMD_LEAVE_IBSS, 16990 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16991 .doit = nl80211_leave_ibss, 16992 .flags = GENL_UNS_ADMIN_PERM, 16993 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16994 }, 16995 #ifdef CONFIG_NL80211_TESTMODE 16996 { 16997 .cmd = NL80211_CMD_TESTMODE, 16998 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16999 .doit = nl80211_testmode_do, 17000 .dumpit = nl80211_testmode_dump, 17001 .flags = GENL_UNS_ADMIN_PERM, 17002 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17003 }, 17004 #endif 17005 { 17006 .cmd = NL80211_CMD_CONNECT, 17007 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17008 .doit = nl80211_connect, 17009 .flags = GENL_UNS_ADMIN_PERM, 17010 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17011 NL80211_FLAG_CLEAR_SKB), 17012 }, 17013 { 17014 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 17015 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17016 .doit = nl80211_update_connect_params, 17017 .flags = GENL_ADMIN_PERM, 17018 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17019 NL80211_FLAG_CLEAR_SKB), 17020 }, 17021 { 17022 .cmd = NL80211_CMD_DISCONNECT, 17023 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17024 .doit = nl80211_disconnect, 17025 .flags = GENL_UNS_ADMIN_PERM, 17026 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17027 }, 17028 { 17029 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 17030 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17031 .doit = nl80211_wiphy_netns, 17032 .flags = GENL_UNS_ADMIN_PERM, 17033 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17034 NL80211_FLAG_NEED_RTNL | 17035 NL80211_FLAG_NO_WIPHY_MTX), 17036 }, 17037 { 17038 .cmd = NL80211_CMD_GET_SURVEY, 17039 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17040 .dumpit = nl80211_dump_survey, 17041 }, 17042 { 17043 .cmd = NL80211_CMD_SET_PMKSA, 17044 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17045 .doit = nl80211_set_pmksa, 17046 .flags = GENL_UNS_ADMIN_PERM, 17047 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17048 NL80211_FLAG_CLEAR_SKB), 17049 }, 17050 { 17051 .cmd = NL80211_CMD_DEL_PMKSA, 17052 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17053 .doit = nl80211_del_pmksa, 17054 .flags = GENL_UNS_ADMIN_PERM, 17055 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17056 }, 17057 { 17058 .cmd = NL80211_CMD_FLUSH_PMKSA, 17059 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17060 .doit = nl80211_flush_pmksa, 17061 .flags = GENL_UNS_ADMIN_PERM, 17062 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17063 }, 17064 { 17065 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 17066 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17067 .doit = nl80211_remain_on_channel, 17068 .flags = GENL_UNS_ADMIN_PERM, 17069 /* FIXME: requiring a link ID here is probably not good */ 17070 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17071 NL80211_FLAG_MLO_VALID_LINK_ID), 17072 }, 17073 { 17074 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 17075 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17076 .doit = nl80211_cancel_remain_on_channel, 17077 .flags = GENL_UNS_ADMIN_PERM, 17078 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17079 }, 17080 { 17081 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 17082 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17083 .doit = nl80211_set_tx_bitrate_mask, 17084 .flags = GENL_UNS_ADMIN_PERM, 17085 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17086 NL80211_FLAG_MLO_VALID_LINK_ID), 17087 }, 17088 { 17089 .cmd = NL80211_CMD_REGISTER_FRAME, 17090 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17091 .doit = nl80211_register_mgmt, 17092 .flags = GENL_UNS_ADMIN_PERM, 17093 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 17094 }, 17095 { 17096 .cmd = NL80211_CMD_FRAME, 17097 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17098 .doit = nl80211_tx_mgmt, 17099 .flags = GENL_UNS_ADMIN_PERM, 17100 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17101 }, 17102 { 17103 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 17104 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17105 .doit = nl80211_tx_mgmt_cancel_wait, 17106 .flags = GENL_UNS_ADMIN_PERM, 17107 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17108 }, 17109 { 17110 .cmd = NL80211_CMD_SET_POWER_SAVE, 17111 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17112 .doit = nl80211_set_power_save, 17113 .flags = GENL_UNS_ADMIN_PERM, 17114 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17115 }, 17116 { 17117 .cmd = NL80211_CMD_GET_POWER_SAVE, 17118 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17119 .doit = nl80211_get_power_save, 17120 /* can be retrieved by unprivileged users */ 17121 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17122 }, 17123 { 17124 .cmd = NL80211_CMD_SET_CQM, 17125 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17126 .doit = nl80211_set_cqm, 17127 .flags = GENL_UNS_ADMIN_PERM, 17128 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17129 }, 17130 { 17131 .cmd = NL80211_CMD_SET_CHANNEL, 17132 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17133 .doit = nl80211_set_channel, 17134 .flags = GENL_UNS_ADMIN_PERM, 17135 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17136 NL80211_FLAG_MLO_VALID_LINK_ID), 17137 }, 17138 { 17139 .cmd = NL80211_CMD_JOIN_MESH, 17140 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17141 .doit = nl80211_join_mesh, 17142 .flags = GENL_UNS_ADMIN_PERM, 17143 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17144 }, 17145 { 17146 .cmd = NL80211_CMD_LEAVE_MESH, 17147 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17148 .doit = nl80211_leave_mesh, 17149 .flags = GENL_UNS_ADMIN_PERM, 17150 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17151 }, 17152 { 17153 .cmd = NL80211_CMD_JOIN_OCB, 17154 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17155 .doit = nl80211_join_ocb, 17156 .flags = GENL_UNS_ADMIN_PERM, 17157 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17158 }, 17159 { 17160 .cmd = NL80211_CMD_LEAVE_OCB, 17161 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17162 .doit = nl80211_leave_ocb, 17163 .flags = GENL_UNS_ADMIN_PERM, 17164 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17165 }, 17166 #ifdef CONFIG_PM 17167 { 17168 .cmd = NL80211_CMD_GET_WOWLAN, 17169 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17170 .doit = nl80211_get_wowlan, 17171 /* can be retrieved by unprivileged users */ 17172 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17173 }, 17174 { 17175 .cmd = NL80211_CMD_SET_WOWLAN, 17176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17177 .doit = nl80211_set_wowlan, 17178 .flags = GENL_UNS_ADMIN_PERM, 17179 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17180 }, 17181 #endif 17182 { 17183 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 17184 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17185 .doit = nl80211_set_rekey_data, 17186 .flags = GENL_UNS_ADMIN_PERM, 17187 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17188 NL80211_FLAG_CLEAR_SKB), 17189 }, 17190 { 17191 .cmd = NL80211_CMD_TDLS_MGMT, 17192 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17193 .doit = nl80211_tdls_mgmt, 17194 .flags = GENL_UNS_ADMIN_PERM, 17195 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17196 NL80211_FLAG_MLO_VALID_LINK_ID), 17197 }, 17198 { 17199 .cmd = NL80211_CMD_TDLS_OPER, 17200 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17201 .doit = nl80211_tdls_oper, 17202 .flags = GENL_UNS_ADMIN_PERM, 17203 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17204 }, 17205 { 17206 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 17207 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17208 .doit = nl80211_register_unexpected_frame, 17209 .flags = GENL_UNS_ADMIN_PERM, 17210 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17211 }, 17212 { 17213 .cmd = NL80211_CMD_PROBE_CLIENT, 17214 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17215 .doit = nl80211_probe_client, 17216 .flags = GENL_UNS_ADMIN_PERM, 17217 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17218 }, 17219 { 17220 .cmd = NL80211_CMD_REGISTER_BEACONS, 17221 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17222 .doit = nl80211_register_beacons, 17223 .flags = GENL_UNS_ADMIN_PERM, 17224 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17225 }, 17226 { 17227 .cmd = NL80211_CMD_SET_NOACK_MAP, 17228 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17229 .doit = nl80211_set_noack_map, 17230 .flags = GENL_UNS_ADMIN_PERM, 17231 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17232 }, 17233 { 17234 .cmd = NL80211_CMD_START_P2P_DEVICE, 17235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17236 .doit = nl80211_start_p2p_device, 17237 .flags = GENL_UNS_ADMIN_PERM, 17238 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17239 NL80211_FLAG_NEED_RTNL), 17240 }, 17241 { 17242 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 17243 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17244 .doit = nl80211_stop_p2p_device, 17245 .flags = GENL_UNS_ADMIN_PERM, 17246 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17247 NL80211_FLAG_NEED_RTNL), 17248 }, 17249 { 17250 .cmd = NL80211_CMD_START_NAN, 17251 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17252 .doit = nl80211_start_nan, 17253 .flags = GENL_ADMIN_PERM, 17254 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17255 NL80211_FLAG_NEED_RTNL), 17256 }, 17257 { 17258 .cmd = NL80211_CMD_STOP_NAN, 17259 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17260 .doit = nl80211_stop_nan, 17261 .flags = GENL_ADMIN_PERM, 17262 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17263 NL80211_FLAG_NEED_RTNL), 17264 }, 17265 { 17266 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 17267 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17268 .doit = nl80211_nan_add_func, 17269 .flags = GENL_ADMIN_PERM, 17270 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17271 }, 17272 { 17273 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 17274 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17275 .doit = nl80211_nan_del_func, 17276 .flags = GENL_ADMIN_PERM, 17277 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17278 }, 17279 { 17280 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 17281 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17282 .doit = nl80211_nan_change_config, 17283 .flags = GENL_ADMIN_PERM, 17284 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17285 }, 17286 { 17287 .cmd = NL80211_CMD_SET_MCAST_RATE, 17288 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17289 .doit = nl80211_set_mcast_rate, 17290 .flags = GENL_UNS_ADMIN_PERM, 17291 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17292 }, 17293 { 17294 .cmd = NL80211_CMD_SET_MAC_ACL, 17295 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17296 .doit = nl80211_set_mac_acl, 17297 .flags = GENL_UNS_ADMIN_PERM, 17298 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17299 NL80211_FLAG_MLO_UNSUPPORTED), 17300 }, 17301 { 17302 .cmd = NL80211_CMD_RADAR_DETECT, 17303 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17304 .doit = nl80211_start_radar_detection, 17305 .flags = GENL_UNS_ADMIN_PERM, 17306 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17307 NL80211_FLAG_NO_WIPHY_MTX | 17308 NL80211_FLAG_MLO_UNSUPPORTED), 17309 }, 17310 { 17311 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 17312 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17313 .doit = nl80211_get_protocol_features, 17314 }, 17315 { 17316 .cmd = NL80211_CMD_UPDATE_FT_IES, 17317 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17318 .doit = nl80211_update_ft_ies, 17319 .flags = GENL_UNS_ADMIN_PERM, 17320 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17321 }, 17322 { 17323 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 17324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17325 .doit = nl80211_crit_protocol_start, 17326 .flags = GENL_UNS_ADMIN_PERM, 17327 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17328 }, 17329 { 17330 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 17331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17332 .doit = nl80211_crit_protocol_stop, 17333 .flags = GENL_UNS_ADMIN_PERM, 17334 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17335 }, 17336 { 17337 .cmd = NL80211_CMD_GET_COALESCE, 17338 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17339 .doit = nl80211_get_coalesce, 17340 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17341 }, 17342 { 17343 .cmd = NL80211_CMD_SET_COALESCE, 17344 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17345 .doit = nl80211_set_coalesce, 17346 .flags = GENL_UNS_ADMIN_PERM, 17347 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17348 }, 17349 { 17350 .cmd = NL80211_CMD_CHANNEL_SWITCH, 17351 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17352 .doit = nl80211_channel_switch, 17353 .flags = GENL_UNS_ADMIN_PERM, 17354 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17355 NL80211_FLAG_MLO_VALID_LINK_ID), 17356 }, 17357 { 17358 .cmd = NL80211_CMD_VENDOR, 17359 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17360 .doit = nl80211_vendor_cmd, 17361 .dumpit = nl80211_vendor_cmd_dump, 17362 .flags = GENL_UNS_ADMIN_PERM, 17363 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17364 NL80211_FLAG_CLEAR_SKB), 17365 }, 17366 { 17367 .cmd = NL80211_CMD_SET_QOS_MAP, 17368 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17369 .doit = nl80211_set_qos_map, 17370 .flags = GENL_UNS_ADMIN_PERM, 17371 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17372 }, 17373 { 17374 .cmd = NL80211_CMD_ADD_TX_TS, 17375 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17376 .doit = nl80211_add_tx_ts, 17377 .flags = GENL_UNS_ADMIN_PERM, 17378 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17379 NL80211_FLAG_MLO_UNSUPPORTED), 17380 }, 17381 { 17382 .cmd = NL80211_CMD_DEL_TX_TS, 17383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17384 .doit = nl80211_del_tx_ts, 17385 .flags = GENL_UNS_ADMIN_PERM, 17386 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17387 }, 17388 { 17389 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 17390 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17391 .doit = nl80211_tdls_channel_switch, 17392 .flags = GENL_UNS_ADMIN_PERM, 17393 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17394 }, 17395 { 17396 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 17397 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17398 .doit = nl80211_tdls_cancel_channel_switch, 17399 .flags = GENL_UNS_ADMIN_PERM, 17400 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17401 }, 17402 { 17403 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 17404 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17405 .doit = nl80211_set_multicast_to_unicast, 17406 .flags = GENL_UNS_ADMIN_PERM, 17407 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17408 }, 17409 { 17410 .cmd = NL80211_CMD_SET_PMK, 17411 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17412 .doit = nl80211_set_pmk, 17413 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17414 NL80211_FLAG_CLEAR_SKB), 17415 }, 17416 { 17417 .cmd = NL80211_CMD_DEL_PMK, 17418 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17419 .doit = nl80211_del_pmk, 17420 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17421 }, 17422 { 17423 .cmd = NL80211_CMD_EXTERNAL_AUTH, 17424 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17425 .doit = nl80211_external_auth, 17426 .flags = GENL_ADMIN_PERM, 17427 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17428 }, 17429 { 17430 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 17431 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17432 .doit = nl80211_tx_control_port, 17433 .flags = GENL_UNS_ADMIN_PERM, 17434 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17435 }, 17436 { 17437 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 17438 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17439 .doit = nl80211_get_ftm_responder_stats, 17440 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17441 NL80211_FLAG_MLO_VALID_LINK_ID), 17442 }, 17443 { 17444 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 17445 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17446 .doit = nl80211_pmsr_start, 17447 .flags = GENL_UNS_ADMIN_PERM, 17448 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17449 }, 17450 { 17451 .cmd = NL80211_CMD_NOTIFY_RADAR, 17452 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17453 .doit = nl80211_notify_radar_detection, 17454 .flags = GENL_UNS_ADMIN_PERM, 17455 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17456 }, 17457 { 17458 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 17459 .doit = nl80211_update_owe_info, 17460 .flags = GENL_ADMIN_PERM, 17461 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17462 }, 17463 { 17464 .cmd = NL80211_CMD_PROBE_MESH_LINK, 17465 .doit = nl80211_probe_mesh_link, 17466 .flags = GENL_UNS_ADMIN_PERM, 17467 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17468 }, 17469 { 17470 .cmd = NL80211_CMD_SET_TID_CONFIG, 17471 .doit = nl80211_set_tid_config, 17472 .flags = GENL_UNS_ADMIN_PERM, 17473 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17474 NL80211_FLAG_MLO_VALID_LINK_ID), 17475 }, 17476 { 17477 .cmd = NL80211_CMD_SET_SAR_SPECS, 17478 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17479 .doit = nl80211_set_sar_specs, 17480 .flags = GENL_UNS_ADMIN_PERM, 17481 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17482 NL80211_FLAG_NEED_RTNL), 17483 }, 17484 { 17485 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST, 17486 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17487 .doit = nl80211_color_change, 17488 .flags = GENL_UNS_ADMIN_PERM, 17489 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17490 }, 17491 { 17492 .cmd = NL80211_CMD_SET_FILS_AAD, 17493 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17494 .doit = nl80211_set_fils_aad, 17495 .flags = GENL_UNS_ADMIN_PERM, 17496 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17497 }, 17498 { 17499 .cmd = NL80211_CMD_ADD_LINK, 17500 .doit = nl80211_add_link, 17501 .flags = GENL_UNS_ADMIN_PERM, 17502 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17503 }, 17504 { 17505 .cmd = NL80211_CMD_REMOVE_LINK, 17506 .doit = nl80211_remove_link, 17507 .flags = GENL_UNS_ADMIN_PERM, 17508 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17509 NL80211_FLAG_MLO_VALID_LINK_ID), 17510 }, 17511 { 17512 .cmd = NL80211_CMD_ADD_LINK_STA, 17513 .doit = nl80211_add_link_station, 17514 .flags = GENL_UNS_ADMIN_PERM, 17515 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17516 NL80211_FLAG_MLO_VALID_LINK_ID), 17517 }, 17518 { 17519 .cmd = NL80211_CMD_MODIFY_LINK_STA, 17520 .doit = nl80211_modify_link_station, 17521 .flags = GENL_UNS_ADMIN_PERM, 17522 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17523 NL80211_FLAG_MLO_VALID_LINK_ID), 17524 }, 17525 { 17526 .cmd = NL80211_CMD_REMOVE_LINK_STA, 17527 .doit = nl80211_remove_link_station, 17528 .flags = GENL_UNS_ADMIN_PERM, 17529 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17530 NL80211_FLAG_MLO_VALID_LINK_ID), 17531 }, 17532 { 17533 .cmd = NL80211_CMD_SET_HW_TIMESTAMP, 17534 .doit = nl80211_set_hw_timestamp, 17535 .flags = GENL_UNS_ADMIN_PERM, 17536 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17537 }, 17538 { 17539 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING, 17540 .doit = nl80211_set_ttlm, 17541 .flags = GENL_UNS_ADMIN_PERM, 17542 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17543 }, 17544 }; 17545 17546 static struct genl_family nl80211_fam __ro_after_init = { 17547 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 17548 .hdrsize = 0, /* no private header */ 17549 .version = 1, /* no particular meaning now */ 17550 .maxattr = NL80211_ATTR_MAX, 17551 .policy = nl80211_policy, 17552 .netnsok = true, 17553 .pre_doit = nl80211_pre_doit, 17554 .post_doit = nl80211_post_doit, 17555 .module = THIS_MODULE, 17556 .ops = nl80211_ops, 17557 .n_ops = ARRAY_SIZE(nl80211_ops), 17558 .small_ops = nl80211_small_ops, 17559 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 17560 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1, 17561 .mcgrps = nl80211_mcgrps, 17562 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 17563 .parallel_ops = true, 17564 }; 17565 17566 /* notification functions */ 17567 17568 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 17569 enum nl80211_commands cmd) 17570 { 17571 struct sk_buff *msg; 17572 struct nl80211_dump_wiphy_state state = {}; 17573 17574 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 17575 cmd != NL80211_CMD_DEL_WIPHY); 17576 17577 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17578 if (!msg) 17579 return; 17580 17581 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 17582 nlmsg_free(msg); 17583 return; 17584 } 17585 17586 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17587 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17588 } 17589 17590 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 17591 struct wireless_dev *wdev, 17592 enum nl80211_commands cmd) 17593 { 17594 struct sk_buff *msg; 17595 17596 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17597 if (!msg) 17598 return; 17599 17600 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 17601 nlmsg_free(msg); 17602 return; 17603 } 17604 17605 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17606 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17607 } 17608 17609 static int nl80211_add_scan_req(struct sk_buff *msg, 17610 struct cfg80211_registered_device *rdev) 17611 { 17612 struct cfg80211_scan_request *req = rdev->scan_req; 17613 struct nlattr *nest; 17614 int i; 17615 struct cfg80211_scan_info *info; 17616 17617 if (WARN_ON(!req)) 17618 return 0; 17619 17620 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 17621 if (!nest) 17622 goto nla_put_failure; 17623 for (i = 0; i < req->n_ssids; i++) { 17624 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 17625 goto nla_put_failure; 17626 } 17627 nla_nest_end(msg, nest); 17628 17629 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 17630 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 17631 if (!nest) 17632 goto nla_put_failure; 17633 for (i = 0; i < req->n_channels; i++) { 17634 if (nla_put_u32(msg, i, 17635 ieee80211_channel_to_khz(req->channels[i]))) 17636 goto nla_put_failure; 17637 } 17638 nla_nest_end(msg, nest); 17639 } else { 17640 nest = nla_nest_start_noflag(msg, 17641 NL80211_ATTR_SCAN_FREQUENCIES); 17642 if (!nest) 17643 goto nla_put_failure; 17644 for (i = 0; i < req->n_channels; i++) { 17645 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 17646 goto nla_put_failure; 17647 } 17648 nla_nest_end(msg, nest); 17649 } 17650 17651 if (req->ie && 17652 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 17653 goto nla_put_failure; 17654 17655 if (req->flags && 17656 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 17657 goto nla_put_failure; 17658 17659 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 17660 &rdev->scan_req->info; 17661 if (info->scan_start_tsf && 17662 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 17663 info->scan_start_tsf, NL80211_BSS_PAD) || 17664 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 17665 info->tsf_bssid))) 17666 goto nla_put_failure; 17667 17668 return 0; 17669 nla_put_failure: 17670 return -ENOBUFS; 17671 } 17672 17673 static int nl80211_prep_scan_msg(struct sk_buff *msg, 17674 struct cfg80211_registered_device *rdev, 17675 struct wireless_dev *wdev, 17676 u32 portid, u32 seq, int flags, 17677 u32 cmd) 17678 { 17679 void *hdr; 17680 17681 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 17682 if (!hdr) 17683 return -1; 17684 17685 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17686 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17687 wdev->netdev->ifindex)) || 17688 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17689 NL80211_ATTR_PAD)) 17690 goto nla_put_failure; 17691 17692 /* ignore errors and send incomplete event anyway */ 17693 nl80211_add_scan_req(msg, rdev); 17694 17695 genlmsg_end(msg, hdr); 17696 return 0; 17697 17698 nla_put_failure: 17699 genlmsg_cancel(msg, hdr); 17700 return -EMSGSIZE; 17701 } 17702 17703 static int 17704 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 17705 struct cfg80211_sched_scan_request *req, u32 cmd) 17706 { 17707 void *hdr; 17708 17709 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 17710 if (!hdr) 17711 return -1; 17712 17713 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 17714 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 17715 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 17716 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 17717 NL80211_ATTR_PAD)) 17718 goto nla_put_failure; 17719 17720 genlmsg_end(msg, hdr); 17721 return 0; 17722 17723 nla_put_failure: 17724 genlmsg_cancel(msg, hdr); 17725 return -EMSGSIZE; 17726 } 17727 17728 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 17729 struct wireless_dev *wdev) 17730 { 17731 struct sk_buff *msg; 17732 17733 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17734 if (!msg) 17735 return; 17736 17737 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17738 NL80211_CMD_TRIGGER_SCAN) < 0) { 17739 nlmsg_free(msg); 17740 return; 17741 } 17742 17743 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17744 NL80211_MCGRP_SCAN, GFP_KERNEL); 17745 } 17746 17747 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 17748 struct wireless_dev *wdev, bool aborted) 17749 { 17750 struct sk_buff *msg; 17751 17752 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17753 if (!msg) 17754 return NULL; 17755 17756 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17757 aborted ? NL80211_CMD_SCAN_ABORTED : 17758 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 17759 nlmsg_free(msg); 17760 return NULL; 17761 } 17762 17763 return msg; 17764 } 17765 17766 /* send message created by nl80211_build_scan_msg() */ 17767 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 17768 struct sk_buff *msg) 17769 { 17770 if (!msg) 17771 return; 17772 17773 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17774 NL80211_MCGRP_SCAN, GFP_KERNEL); 17775 } 17776 17777 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 17778 { 17779 struct sk_buff *msg; 17780 17781 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17782 if (!msg) 17783 return; 17784 17785 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 17786 nlmsg_free(msg); 17787 return; 17788 } 17789 17790 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 17791 NL80211_MCGRP_SCAN, GFP_KERNEL); 17792 } 17793 17794 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 17795 struct regulatory_request *request) 17796 { 17797 /* Userspace can always count this one always being set */ 17798 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 17799 goto nla_put_failure; 17800 17801 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 17802 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17803 NL80211_REGDOM_TYPE_WORLD)) 17804 goto nla_put_failure; 17805 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 17806 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17807 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 17808 goto nla_put_failure; 17809 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 17810 request->intersect) { 17811 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17812 NL80211_REGDOM_TYPE_INTERSECTION)) 17813 goto nla_put_failure; 17814 } else { 17815 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17816 NL80211_REGDOM_TYPE_COUNTRY) || 17817 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 17818 request->alpha2)) 17819 goto nla_put_failure; 17820 } 17821 17822 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 17823 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 17824 17825 if (wiphy && 17826 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 17827 goto nla_put_failure; 17828 17829 if (wiphy && 17830 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 17831 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 17832 goto nla_put_failure; 17833 } 17834 17835 return true; 17836 17837 nla_put_failure: 17838 return false; 17839 } 17840 17841 /* 17842 * This can happen on global regulatory changes or device specific settings 17843 * based on custom regulatory domains. 17844 */ 17845 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 17846 struct regulatory_request *request) 17847 { 17848 struct sk_buff *msg; 17849 void *hdr; 17850 17851 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17852 if (!msg) 17853 return; 17854 17855 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 17856 if (!hdr) 17857 goto nla_put_failure; 17858 17859 if (!nl80211_reg_change_event_fill(msg, request)) 17860 goto nla_put_failure; 17861 17862 genlmsg_end(msg, hdr); 17863 17864 rcu_read_lock(); 17865 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 17866 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 17867 rcu_read_unlock(); 17868 17869 return; 17870 17871 nla_put_failure: 17872 nlmsg_free(msg); 17873 } 17874 17875 struct nl80211_mlme_event { 17876 enum nl80211_commands cmd; 17877 const u8 *buf; 17878 size_t buf_len; 17879 int uapsd_queues; 17880 const u8 *req_ies; 17881 size_t req_ies_len; 17882 bool reconnect; 17883 }; 17884 17885 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 17886 struct net_device *netdev, 17887 const struct nl80211_mlme_event *event, 17888 gfp_t gfp) 17889 { 17890 struct sk_buff *msg; 17891 void *hdr; 17892 17893 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp); 17894 if (!msg) 17895 return; 17896 17897 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd); 17898 if (!hdr) { 17899 nlmsg_free(msg); 17900 return; 17901 } 17902 17903 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17904 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17905 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) || 17906 (event->req_ies && 17907 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len, 17908 event->req_ies))) 17909 goto nla_put_failure; 17910 17911 if (event->reconnect && 17912 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED)) 17913 goto nla_put_failure; 17914 17915 if (event->uapsd_queues >= 0) { 17916 struct nlattr *nla_wmm = 17917 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 17918 if (!nla_wmm) 17919 goto nla_put_failure; 17920 17921 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 17922 event->uapsd_queues)) 17923 goto nla_put_failure; 17924 17925 nla_nest_end(msg, nla_wmm); 17926 } 17927 17928 genlmsg_end(msg, hdr); 17929 17930 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17931 NL80211_MCGRP_MLME, gfp); 17932 return; 17933 17934 nla_put_failure: 17935 nlmsg_free(msg); 17936 } 17937 17938 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 17939 struct net_device *netdev, const u8 *buf, 17940 size_t len, gfp_t gfp) 17941 { 17942 struct nl80211_mlme_event event = { 17943 .cmd = NL80211_CMD_AUTHENTICATE, 17944 .buf = buf, 17945 .buf_len = len, 17946 .uapsd_queues = -1, 17947 }; 17948 17949 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17950 } 17951 17952 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 17953 struct net_device *netdev, 17954 const struct cfg80211_rx_assoc_resp_data *data) 17955 { 17956 struct nl80211_mlme_event event = { 17957 .cmd = NL80211_CMD_ASSOCIATE, 17958 .buf = data->buf, 17959 .buf_len = data->len, 17960 .uapsd_queues = data->uapsd_queues, 17961 .req_ies = data->req_ies, 17962 .req_ies_len = data->req_ies_len, 17963 }; 17964 17965 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL); 17966 } 17967 17968 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 17969 struct net_device *netdev, const u8 *buf, 17970 size_t len, bool reconnect, gfp_t gfp) 17971 { 17972 struct nl80211_mlme_event event = { 17973 .cmd = NL80211_CMD_DEAUTHENTICATE, 17974 .buf = buf, 17975 .buf_len = len, 17976 .reconnect = reconnect, 17977 .uapsd_queues = -1, 17978 }; 17979 17980 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17981 } 17982 17983 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 17984 struct net_device *netdev, const u8 *buf, 17985 size_t len, bool reconnect, gfp_t gfp) 17986 { 17987 struct nl80211_mlme_event event = { 17988 .cmd = NL80211_CMD_DISASSOCIATE, 17989 .buf = buf, 17990 .buf_len = len, 17991 .reconnect = reconnect, 17992 .uapsd_queues = -1, 17993 }; 17994 17995 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17996 } 17997 17998 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 17999 size_t len) 18000 { 18001 struct wireless_dev *wdev = dev->ieee80211_ptr; 18002 struct wiphy *wiphy = wdev->wiphy; 18003 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18004 const struct ieee80211_mgmt *mgmt = (void *)buf; 18005 struct nl80211_mlme_event event = { 18006 .buf = buf, 18007 .buf_len = len, 18008 .uapsd_queues = -1, 18009 }; 18010 18011 if (WARN_ON(len < 2)) 18012 return; 18013 18014 if (ieee80211_is_deauth(mgmt->frame_control)) { 18015 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 18016 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 18017 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 18018 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 18019 if (wdev->unprot_beacon_reported && 18020 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 18021 return; 18022 event.cmd = NL80211_CMD_UNPROT_BEACON; 18023 wdev->unprot_beacon_reported = jiffies; 18024 } else { 18025 return; 18026 } 18027 18028 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 18029 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC); 18030 } 18031 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 18032 18033 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 18034 struct net_device *netdev, int cmd, 18035 const u8 *addr, gfp_t gfp) 18036 { 18037 struct sk_buff *msg; 18038 void *hdr; 18039 18040 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18041 if (!msg) 18042 return; 18043 18044 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18045 if (!hdr) { 18046 nlmsg_free(msg); 18047 return; 18048 } 18049 18050 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18051 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18052 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 18053 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 18054 goto nla_put_failure; 18055 18056 genlmsg_end(msg, hdr); 18057 18058 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18059 NL80211_MCGRP_MLME, gfp); 18060 return; 18061 18062 nla_put_failure: 18063 nlmsg_free(msg); 18064 } 18065 18066 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 18067 struct net_device *netdev, const u8 *addr, 18068 gfp_t gfp) 18069 { 18070 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 18071 addr, gfp); 18072 } 18073 18074 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 18075 struct net_device *netdev, const u8 *addr, 18076 gfp_t gfp) 18077 { 18078 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 18079 addr, gfp); 18080 } 18081 18082 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 18083 struct net_device *netdev, 18084 struct cfg80211_connect_resp_params *cr, 18085 gfp_t gfp) 18086 { 18087 struct sk_buff *msg; 18088 void *hdr; 18089 unsigned int link; 18090 size_t link_info_size = 0; 18091 const u8 *connected_addr = cr->valid_links ? 18092 cr->ap_mld_addr : cr->links[0].bssid; 18093 18094 if (cr->valid_links) { 18095 for_each_valid_link(cr, link) { 18096 /* Nested attribute header */ 18097 link_info_size += NLA_HDRLEN; 18098 /* Link ID */ 18099 link_info_size += nla_total_size(sizeof(u8)); 18100 link_info_size += cr->links[link].addr ? 18101 nla_total_size(ETH_ALEN) : 0; 18102 link_info_size += (cr->links[link].bssid || 18103 cr->links[link].bss) ? 18104 nla_total_size(ETH_ALEN) : 0; 18105 link_info_size += nla_total_size(sizeof(u16)); 18106 } 18107 } 18108 18109 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 18110 cr->fils.kek_len + cr->fils.pmk_len + 18111 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size, 18112 gfp); 18113 if (!msg) 18114 return; 18115 18116 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 18117 if (!hdr) { 18118 nlmsg_free(msg); 18119 return; 18120 } 18121 18122 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18123 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18124 (connected_addr && 18125 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) || 18126 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 18127 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 18128 cr->status) || 18129 (cr->status < 0 && 18130 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 18131 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 18132 cr->timeout_reason))) || 18133 (cr->req_ie && 18134 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 18135 (cr->resp_ie && 18136 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 18137 cr->resp_ie)) || 18138 (cr->fils.update_erp_next_seq_num && 18139 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 18140 cr->fils.erp_next_seq_num)) || 18141 (cr->status == WLAN_STATUS_SUCCESS && 18142 ((cr->fils.kek && 18143 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 18144 cr->fils.kek)) || 18145 (cr->fils.pmk && 18146 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 18147 (cr->fils.pmkid && 18148 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 18149 goto nla_put_failure; 18150 18151 if (cr->valid_links) { 18152 int i = 1; 18153 struct nlattr *nested; 18154 18155 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18156 if (!nested) 18157 goto nla_put_failure; 18158 18159 for_each_valid_link(cr, link) { 18160 struct nlattr *nested_mlo_links; 18161 const u8 *bssid = cr->links[link].bss ? 18162 cr->links[link].bss->bssid : 18163 cr->links[link].bssid; 18164 18165 nested_mlo_links = nla_nest_start(msg, i); 18166 if (!nested_mlo_links) 18167 goto nla_put_failure; 18168 18169 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 18170 (bssid && 18171 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 18172 (cr->links[link].addr && 18173 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 18174 cr->links[link].addr)) || 18175 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 18176 cr->links[link].status)) 18177 goto nla_put_failure; 18178 18179 nla_nest_end(msg, nested_mlo_links); 18180 i++; 18181 } 18182 nla_nest_end(msg, nested); 18183 } 18184 18185 genlmsg_end(msg, hdr); 18186 18187 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18188 NL80211_MCGRP_MLME, gfp); 18189 return; 18190 18191 nla_put_failure: 18192 nlmsg_free(msg); 18193 } 18194 18195 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 18196 struct net_device *netdev, 18197 struct cfg80211_roam_info *info, gfp_t gfp) 18198 { 18199 struct sk_buff *msg; 18200 void *hdr; 18201 size_t link_info_size = 0; 18202 unsigned int link; 18203 const u8 *connected_addr = info->ap_mld_addr ? 18204 info->ap_mld_addr : 18205 (info->links[0].bss ? 18206 info->links[0].bss->bssid : 18207 info->links[0].bssid); 18208 18209 if (info->valid_links) { 18210 for_each_valid_link(info, link) { 18211 /* Nested attribute header */ 18212 link_info_size += NLA_HDRLEN; 18213 /* Link ID */ 18214 link_info_size += nla_total_size(sizeof(u8)); 18215 link_info_size += info->links[link].addr ? 18216 nla_total_size(ETH_ALEN) : 0; 18217 link_info_size += (info->links[link].bssid || 18218 info->links[link].bss) ? 18219 nla_total_size(ETH_ALEN) : 0; 18220 } 18221 } 18222 18223 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 18224 info->fils.kek_len + info->fils.pmk_len + 18225 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) + 18226 link_info_size, gfp); 18227 if (!msg) 18228 return; 18229 18230 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 18231 if (!hdr) { 18232 nlmsg_free(msg); 18233 return; 18234 } 18235 18236 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18237 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18238 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) || 18239 (info->req_ie && 18240 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 18241 info->req_ie)) || 18242 (info->resp_ie && 18243 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 18244 info->resp_ie)) || 18245 (info->fils.update_erp_next_seq_num && 18246 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 18247 info->fils.erp_next_seq_num)) || 18248 (info->fils.kek && 18249 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 18250 info->fils.kek)) || 18251 (info->fils.pmk && 18252 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 18253 (info->fils.pmkid && 18254 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 18255 goto nla_put_failure; 18256 18257 if (info->valid_links) { 18258 int i = 1; 18259 struct nlattr *nested; 18260 18261 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18262 if (!nested) 18263 goto nla_put_failure; 18264 18265 for_each_valid_link(info, link) { 18266 struct nlattr *nested_mlo_links; 18267 const u8 *bssid = info->links[link].bss ? 18268 info->links[link].bss->bssid : 18269 info->links[link].bssid; 18270 18271 nested_mlo_links = nla_nest_start(msg, i); 18272 if (!nested_mlo_links) 18273 goto nla_put_failure; 18274 18275 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 18276 (bssid && 18277 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 18278 (info->links[link].addr && 18279 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 18280 info->links[link].addr))) 18281 goto nla_put_failure; 18282 18283 nla_nest_end(msg, nested_mlo_links); 18284 i++; 18285 } 18286 nla_nest_end(msg, nested); 18287 } 18288 18289 genlmsg_end(msg, hdr); 18290 18291 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18292 NL80211_MCGRP_MLME, gfp); 18293 return; 18294 18295 nla_put_failure: 18296 nlmsg_free(msg); 18297 } 18298 18299 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 18300 struct net_device *netdev, const u8 *peer_addr, 18301 const u8 *td_bitmap, u8 td_bitmap_len) 18302 { 18303 struct sk_buff *msg; 18304 void *hdr; 18305 18306 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18307 if (!msg) 18308 return; 18309 18310 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 18311 if (!hdr) { 18312 nlmsg_free(msg); 18313 return; 18314 } 18315 18316 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18317 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18318 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr)) 18319 goto nla_put_failure; 18320 18321 if ((td_bitmap_len > 0) && td_bitmap) 18322 if (nla_put(msg, NL80211_ATTR_TD_BITMAP, 18323 td_bitmap_len, td_bitmap)) 18324 goto nla_put_failure; 18325 18326 genlmsg_end(msg, hdr); 18327 18328 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18329 NL80211_MCGRP_MLME, GFP_KERNEL); 18330 return; 18331 18332 nla_put_failure: 18333 nlmsg_free(msg); 18334 } 18335 18336 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 18337 struct net_device *netdev, u16 reason, 18338 const u8 *ie, size_t ie_len, bool from_ap) 18339 { 18340 struct sk_buff *msg; 18341 void *hdr; 18342 18343 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 18344 if (!msg) 18345 return; 18346 18347 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 18348 if (!hdr) { 18349 nlmsg_free(msg); 18350 return; 18351 } 18352 18353 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18354 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18355 (reason && 18356 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 18357 (from_ap && 18358 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 18359 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 18360 goto nla_put_failure; 18361 18362 genlmsg_end(msg, hdr); 18363 18364 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18365 NL80211_MCGRP_MLME, GFP_KERNEL); 18366 return; 18367 18368 nla_put_failure: 18369 nlmsg_free(msg); 18370 } 18371 18372 void cfg80211_links_removed(struct net_device *dev, u16 link_mask) 18373 { 18374 struct wireless_dev *wdev = dev->ieee80211_ptr; 18375 struct wiphy *wiphy = wdev->wiphy; 18376 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18377 struct sk_buff *msg; 18378 struct nlattr *links; 18379 void *hdr; 18380 18381 lockdep_assert_wiphy(wdev->wiphy); 18382 trace_cfg80211_links_removed(dev, link_mask); 18383 18384 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION && 18385 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) 18386 return; 18387 18388 if (WARN_ON(!wdev->valid_links || !link_mask || 18389 (wdev->valid_links & link_mask) != link_mask || 18390 wdev->valid_links == link_mask)) 18391 return; 18392 18393 cfg80211_wdev_release_link_bsses(wdev, link_mask); 18394 wdev->valid_links &= ~link_mask; 18395 18396 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18397 if (!msg) 18398 return; 18399 18400 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED); 18401 if (!hdr) { 18402 nlmsg_free(msg); 18403 return; 18404 } 18405 18406 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18407 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 18408 goto nla_put_failure; 18409 18410 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18411 if (!links) 18412 goto nla_put_failure; 18413 18414 while (link_mask) { 18415 struct nlattr *link; 18416 int link_id = __ffs(link_mask); 18417 18418 link = nla_nest_start(msg, link_id + 1); 18419 if (!link) 18420 goto nla_put_failure; 18421 18422 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 18423 goto nla_put_failure; 18424 18425 nla_nest_end(msg, link); 18426 link_mask &= ~(1 << link_id); 18427 } 18428 18429 nla_nest_end(msg, links); 18430 18431 genlmsg_end(msg, hdr); 18432 18433 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18434 NL80211_MCGRP_MLME, GFP_KERNEL); 18435 return; 18436 18437 nla_put_failure: 18438 nlmsg_free(msg); 18439 } 18440 EXPORT_SYMBOL(cfg80211_links_removed); 18441 18442 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 18443 struct net_device *netdev, const u8 *bssid, 18444 gfp_t gfp) 18445 { 18446 struct sk_buff *msg; 18447 void *hdr; 18448 18449 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18450 if (!msg) 18451 return; 18452 18453 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 18454 if (!hdr) { 18455 nlmsg_free(msg); 18456 return; 18457 } 18458 18459 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18460 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18461 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 18462 goto nla_put_failure; 18463 18464 genlmsg_end(msg, hdr); 18465 18466 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18467 NL80211_MCGRP_MLME, gfp); 18468 return; 18469 18470 nla_put_failure: 18471 nlmsg_free(msg); 18472 } 18473 18474 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 18475 const u8 *ie, u8 ie_len, 18476 int sig_dbm, gfp_t gfp) 18477 { 18478 struct wireless_dev *wdev = dev->ieee80211_ptr; 18479 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18480 struct sk_buff *msg; 18481 void *hdr; 18482 18483 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 18484 return; 18485 18486 trace_cfg80211_notify_new_peer_candidate(dev, addr); 18487 18488 msg = nlmsg_new(100 + ie_len, gfp); 18489 if (!msg) 18490 return; 18491 18492 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 18493 if (!hdr) { 18494 nlmsg_free(msg); 18495 return; 18496 } 18497 18498 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18499 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18500 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 18501 (ie_len && ie && 18502 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 18503 (sig_dbm && 18504 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 18505 goto nla_put_failure; 18506 18507 genlmsg_end(msg, hdr); 18508 18509 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18510 NL80211_MCGRP_MLME, gfp); 18511 return; 18512 18513 nla_put_failure: 18514 nlmsg_free(msg); 18515 } 18516 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 18517 18518 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 18519 struct net_device *netdev, const u8 *addr, 18520 enum nl80211_key_type key_type, int key_id, 18521 const u8 *tsc, gfp_t gfp) 18522 { 18523 struct sk_buff *msg; 18524 void *hdr; 18525 18526 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18527 if (!msg) 18528 return; 18529 18530 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 18531 if (!hdr) { 18532 nlmsg_free(msg); 18533 return; 18534 } 18535 18536 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18537 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18538 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 18539 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 18540 (key_id != -1 && 18541 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 18542 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 18543 goto nla_put_failure; 18544 18545 genlmsg_end(msg, hdr); 18546 18547 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18548 NL80211_MCGRP_MLME, gfp); 18549 return; 18550 18551 nla_put_failure: 18552 nlmsg_free(msg); 18553 } 18554 18555 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 18556 struct ieee80211_channel *channel_before, 18557 struct ieee80211_channel *channel_after) 18558 { 18559 struct sk_buff *msg; 18560 void *hdr; 18561 struct nlattr *nl_freq; 18562 18563 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 18564 if (!msg) 18565 return; 18566 18567 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 18568 if (!hdr) { 18569 nlmsg_free(msg); 18570 return; 18571 } 18572 18573 /* 18574 * Since we are applying the beacon hint to a wiphy we know its 18575 * wiphy_idx is valid 18576 */ 18577 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 18578 goto nla_put_failure; 18579 18580 /* Before */ 18581 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 18582 if (!nl_freq) 18583 goto nla_put_failure; 18584 18585 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 18586 goto nla_put_failure; 18587 nla_nest_end(msg, nl_freq); 18588 18589 /* After */ 18590 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 18591 if (!nl_freq) 18592 goto nla_put_failure; 18593 18594 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 18595 goto nla_put_failure; 18596 nla_nest_end(msg, nl_freq); 18597 18598 genlmsg_end(msg, hdr); 18599 18600 rcu_read_lock(); 18601 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 18602 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 18603 rcu_read_unlock(); 18604 18605 return; 18606 18607 nla_put_failure: 18608 nlmsg_free(msg); 18609 } 18610 18611 static void nl80211_send_remain_on_chan_event( 18612 int cmd, struct cfg80211_registered_device *rdev, 18613 struct wireless_dev *wdev, u64 cookie, 18614 struct ieee80211_channel *chan, 18615 unsigned int duration, gfp_t gfp) 18616 { 18617 struct sk_buff *msg; 18618 void *hdr; 18619 18620 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18621 if (!msg) 18622 return; 18623 18624 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18625 if (!hdr) { 18626 nlmsg_free(msg); 18627 return; 18628 } 18629 18630 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18631 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18632 wdev->netdev->ifindex)) || 18633 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18634 NL80211_ATTR_PAD) || 18635 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 18636 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 18637 NL80211_CHAN_NO_HT) || 18638 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 18639 NL80211_ATTR_PAD)) 18640 goto nla_put_failure; 18641 18642 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 18643 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 18644 goto nla_put_failure; 18645 18646 genlmsg_end(msg, hdr); 18647 18648 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18649 NL80211_MCGRP_MLME, gfp); 18650 return; 18651 18652 nla_put_failure: 18653 nlmsg_free(msg); 18654 } 18655 18656 void cfg80211_assoc_comeback(struct net_device *netdev, 18657 const u8 *ap_addr, u32 timeout) 18658 { 18659 struct wireless_dev *wdev = netdev->ieee80211_ptr; 18660 struct wiphy *wiphy = wdev->wiphy; 18661 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18662 struct sk_buff *msg; 18663 void *hdr; 18664 18665 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout); 18666 18667 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18668 if (!msg) 18669 return; 18670 18671 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK); 18672 if (!hdr) { 18673 nlmsg_free(msg); 18674 return; 18675 } 18676 18677 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18678 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18679 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) || 18680 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout)) 18681 goto nla_put_failure; 18682 18683 genlmsg_end(msg, hdr); 18684 18685 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18686 NL80211_MCGRP_MLME, GFP_KERNEL); 18687 return; 18688 18689 nla_put_failure: 18690 nlmsg_free(msg); 18691 } 18692 EXPORT_SYMBOL(cfg80211_assoc_comeback); 18693 18694 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 18695 struct ieee80211_channel *chan, 18696 unsigned int duration, gfp_t gfp) 18697 { 18698 struct wiphy *wiphy = wdev->wiphy; 18699 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18700 18701 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 18702 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 18703 rdev, wdev, cookie, chan, 18704 duration, gfp); 18705 } 18706 EXPORT_SYMBOL(cfg80211_ready_on_channel); 18707 18708 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 18709 struct ieee80211_channel *chan, 18710 gfp_t gfp) 18711 { 18712 struct wiphy *wiphy = wdev->wiphy; 18713 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18714 18715 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 18716 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 18717 rdev, wdev, cookie, chan, 0, gfp); 18718 } 18719 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 18720 18721 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 18722 struct ieee80211_channel *chan, 18723 gfp_t gfp) 18724 { 18725 struct wiphy *wiphy = wdev->wiphy; 18726 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18727 18728 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 18729 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 18730 rdev, wdev, cookie, chan, 0, gfp); 18731 } 18732 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 18733 18734 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 18735 struct station_info *sinfo, gfp_t gfp) 18736 { 18737 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18738 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18739 struct sk_buff *msg; 18740 18741 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 18742 18743 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18744 if (!msg) 18745 return; 18746 18747 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 18748 rdev, dev, mac_addr, sinfo) < 0) { 18749 nlmsg_free(msg); 18750 return; 18751 } 18752 18753 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18754 NL80211_MCGRP_MLME, gfp); 18755 } 18756 EXPORT_SYMBOL(cfg80211_new_sta); 18757 18758 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 18759 struct station_info *sinfo, gfp_t gfp) 18760 { 18761 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18762 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18763 struct sk_buff *msg; 18764 struct station_info empty_sinfo = {}; 18765 18766 if (!sinfo) 18767 sinfo = &empty_sinfo; 18768 18769 trace_cfg80211_del_sta(dev, mac_addr); 18770 18771 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18772 if (!msg) { 18773 cfg80211_sinfo_release_content(sinfo); 18774 return; 18775 } 18776 18777 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 18778 rdev, dev, mac_addr, sinfo) < 0) { 18779 nlmsg_free(msg); 18780 return; 18781 } 18782 18783 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18784 NL80211_MCGRP_MLME, gfp); 18785 } 18786 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 18787 18788 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 18789 enum nl80211_connect_failed_reason reason, 18790 gfp_t gfp) 18791 { 18792 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18793 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18794 struct sk_buff *msg; 18795 void *hdr; 18796 18797 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 18798 if (!msg) 18799 return; 18800 18801 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 18802 if (!hdr) { 18803 nlmsg_free(msg); 18804 return; 18805 } 18806 18807 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18808 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 18809 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 18810 goto nla_put_failure; 18811 18812 genlmsg_end(msg, hdr); 18813 18814 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18815 NL80211_MCGRP_MLME, gfp); 18816 return; 18817 18818 nla_put_failure: 18819 nlmsg_free(msg); 18820 } 18821 EXPORT_SYMBOL(cfg80211_conn_failed); 18822 18823 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 18824 const u8 *addr, gfp_t gfp) 18825 { 18826 struct wireless_dev *wdev = dev->ieee80211_ptr; 18827 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18828 struct sk_buff *msg; 18829 void *hdr; 18830 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 18831 18832 if (!nlportid) 18833 return false; 18834 18835 msg = nlmsg_new(100, gfp); 18836 if (!msg) 18837 return true; 18838 18839 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18840 if (!hdr) { 18841 nlmsg_free(msg); 18842 return true; 18843 } 18844 18845 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18846 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18847 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 18848 goto nla_put_failure; 18849 18850 genlmsg_end(msg, hdr); 18851 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18852 return true; 18853 18854 nla_put_failure: 18855 nlmsg_free(msg); 18856 return true; 18857 } 18858 18859 bool cfg80211_rx_spurious_frame(struct net_device *dev, 18860 const u8 *addr, gfp_t gfp) 18861 { 18862 struct wireless_dev *wdev = dev->ieee80211_ptr; 18863 bool ret; 18864 18865 trace_cfg80211_rx_spurious_frame(dev, addr); 18866 18867 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18868 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 18869 trace_cfg80211_return_bool(false); 18870 return false; 18871 } 18872 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 18873 addr, gfp); 18874 trace_cfg80211_return_bool(ret); 18875 return ret; 18876 } 18877 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 18878 18879 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 18880 const u8 *addr, gfp_t gfp) 18881 { 18882 struct wireless_dev *wdev = dev->ieee80211_ptr; 18883 bool ret; 18884 18885 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 18886 18887 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18888 wdev->iftype != NL80211_IFTYPE_P2P_GO && 18889 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 18890 trace_cfg80211_return_bool(false); 18891 return false; 18892 } 18893 ret = __nl80211_unexpected_frame(dev, 18894 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 18895 addr, gfp); 18896 trace_cfg80211_return_bool(ret); 18897 return ret; 18898 } 18899 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 18900 18901 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 18902 struct wireless_dev *wdev, u32 nlportid, 18903 struct cfg80211_rx_info *info, gfp_t gfp) 18904 { 18905 struct net_device *netdev = wdev->netdev; 18906 struct sk_buff *msg; 18907 void *hdr; 18908 18909 msg = nlmsg_new(100 + info->len, gfp); 18910 if (!msg) 18911 return -ENOMEM; 18912 18913 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 18914 if (!hdr) { 18915 nlmsg_free(msg); 18916 return -ENOMEM; 18917 } 18918 18919 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18920 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18921 netdev->ifindex)) || 18922 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18923 NL80211_ATTR_PAD) || 18924 (info->have_link_id && 18925 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) || 18926 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) || 18927 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) || 18928 (info->sig_dbm && 18929 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) || 18930 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) || 18931 (info->flags && 18932 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) || 18933 (info->rx_tstamp && nla_put_u64_64bit(msg, 18934 NL80211_ATTR_RX_HW_TIMESTAMP, 18935 info->rx_tstamp, 18936 NL80211_ATTR_PAD)) || 18937 (info->ack_tstamp && nla_put_u64_64bit(msg, 18938 NL80211_ATTR_TX_HW_TIMESTAMP, 18939 info->ack_tstamp, 18940 NL80211_ATTR_PAD))) 18941 goto nla_put_failure; 18942 18943 genlmsg_end(msg, hdr); 18944 18945 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18946 18947 nla_put_failure: 18948 nlmsg_free(msg); 18949 return -ENOBUFS; 18950 } 18951 18952 static void nl80211_frame_tx_status(struct wireless_dev *wdev, 18953 struct cfg80211_tx_status *status, 18954 gfp_t gfp, enum nl80211_commands command) 18955 { 18956 struct wiphy *wiphy = wdev->wiphy; 18957 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18958 struct net_device *netdev = wdev->netdev; 18959 struct sk_buff *msg; 18960 void *hdr; 18961 18962 if (command == NL80211_CMD_FRAME_TX_STATUS) 18963 trace_cfg80211_mgmt_tx_status(wdev, status->cookie, 18964 status->ack); 18965 else 18966 trace_cfg80211_control_port_tx_status(wdev, status->cookie, 18967 status->ack); 18968 18969 msg = nlmsg_new(100 + status->len, gfp); 18970 if (!msg) 18971 return; 18972 18973 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 18974 if (!hdr) { 18975 nlmsg_free(msg); 18976 return; 18977 } 18978 18979 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18980 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18981 netdev->ifindex)) || 18982 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18983 NL80211_ATTR_PAD) || 18984 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) || 18985 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie, 18986 NL80211_ATTR_PAD) || 18987 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) || 18988 (status->tx_tstamp && 18989 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP, 18990 status->tx_tstamp, NL80211_ATTR_PAD)) || 18991 (status->ack_tstamp && 18992 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP, 18993 status->ack_tstamp, NL80211_ATTR_PAD))) 18994 goto nla_put_failure; 18995 18996 genlmsg_end(msg, hdr); 18997 18998 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18999 NL80211_MCGRP_MLME, gfp); 19000 return; 19001 19002 nla_put_failure: 19003 nlmsg_free(msg); 19004 } 19005 19006 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 19007 const u8 *buf, size_t len, bool ack, 19008 gfp_t gfp) 19009 { 19010 struct cfg80211_tx_status status = { 19011 .cookie = cookie, 19012 .buf = buf, 19013 .len = len, 19014 .ack = ack 19015 }; 19016 19017 nl80211_frame_tx_status(wdev, &status, gfp, 19018 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 19019 } 19020 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 19021 19022 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev, 19023 struct cfg80211_tx_status *status, gfp_t gfp) 19024 { 19025 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS); 19026 } 19027 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext); 19028 19029 static int __nl80211_rx_control_port(struct net_device *dev, 19030 struct sk_buff *skb, 19031 bool unencrypted, 19032 int link_id, 19033 gfp_t gfp) 19034 { 19035 struct wireless_dev *wdev = dev->ieee80211_ptr; 19036 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19037 struct ethhdr *ehdr = eth_hdr(skb); 19038 const u8 *addr = ehdr->h_source; 19039 u16 proto = be16_to_cpu(skb->protocol); 19040 struct sk_buff *msg; 19041 void *hdr; 19042 struct nlattr *frame; 19043 19044 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 19045 19046 if (!nlportid) 19047 return -ENOENT; 19048 19049 msg = nlmsg_new(100 + skb->len, gfp); 19050 if (!msg) 19051 return -ENOMEM; 19052 19053 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 19054 if (!hdr) { 19055 nlmsg_free(msg); 19056 return -ENOBUFS; 19057 } 19058 19059 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19060 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19061 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19062 NL80211_ATTR_PAD) || 19063 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 19064 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 19065 (link_id >= 0 && 19066 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) || 19067 (unencrypted && nla_put_flag(msg, 19068 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 19069 goto nla_put_failure; 19070 19071 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 19072 if (!frame) 19073 goto nla_put_failure; 19074 19075 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 19076 genlmsg_end(msg, hdr); 19077 19078 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 19079 19080 nla_put_failure: 19081 nlmsg_free(msg); 19082 return -ENOBUFS; 19083 } 19084 19085 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb, 19086 bool unencrypted, int link_id) 19087 { 19088 int ret; 19089 19090 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id); 19091 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id, 19092 GFP_ATOMIC); 19093 trace_cfg80211_return_bool(ret == 0); 19094 return ret == 0; 19095 } 19096 EXPORT_SYMBOL(cfg80211_rx_control_port); 19097 19098 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 19099 const char *mac, gfp_t gfp) 19100 { 19101 struct wireless_dev *wdev = dev->ieee80211_ptr; 19102 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19103 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19104 void **cb; 19105 19106 if (!msg) 19107 return NULL; 19108 19109 cb = (void **)msg->cb; 19110 19111 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 19112 if (!cb[0]) { 19113 nlmsg_free(msg); 19114 return NULL; 19115 } 19116 19117 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19118 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19119 goto nla_put_failure; 19120 19121 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 19122 goto nla_put_failure; 19123 19124 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 19125 if (!cb[1]) 19126 goto nla_put_failure; 19127 19128 cb[2] = rdev; 19129 19130 return msg; 19131 nla_put_failure: 19132 nlmsg_free(msg); 19133 return NULL; 19134 } 19135 19136 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 19137 { 19138 void **cb = (void **)msg->cb; 19139 struct cfg80211_registered_device *rdev = cb[2]; 19140 19141 nla_nest_end(msg, cb[1]); 19142 genlmsg_end(msg, cb[0]); 19143 19144 memset(msg->cb, 0, sizeof(msg->cb)); 19145 19146 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19147 NL80211_MCGRP_MLME, gfp); 19148 } 19149 19150 void cfg80211_cqm_rssi_notify(struct net_device *dev, 19151 enum nl80211_cqm_rssi_threshold_event rssi_event, 19152 s32 rssi_level, gfp_t gfp) 19153 { 19154 struct wireless_dev *wdev = dev->ieee80211_ptr; 19155 struct cfg80211_cqm_config *cqm_config; 19156 19157 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 19158 19159 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 19160 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 19161 return; 19162 19163 rcu_read_lock(); 19164 cqm_config = rcu_dereference(wdev->cqm_config); 19165 if (cqm_config) { 19166 cqm_config->last_rssi_event_value = rssi_level; 19167 cqm_config->last_rssi_event_type = rssi_event; 19168 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work); 19169 } 19170 rcu_read_unlock(); 19171 } 19172 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 19173 19174 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work) 19175 { 19176 struct wireless_dev *wdev = container_of(work, struct wireless_dev, 19177 cqm_rssi_work); 19178 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19179 enum nl80211_cqm_rssi_threshold_event rssi_event; 19180 struct cfg80211_cqm_config *cqm_config; 19181 struct sk_buff *msg; 19182 s32 rssi_level; 19183 19184 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config); 19185 if (!cqm_config) 19186 return; 19187 19188 if (cqm_config->use_range_api) 19189 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config); 19190 19191 rssi_level = cqm_config->last_rssi_event_value; 19192 rssi_event = cqm_config->last_rssi_event_type; 19193 19194 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL); 19195 if (!msg) 19196 return; 19197 19198 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 19199 rssi_event)) 19200 goto nla_put_failure; 19201 19202 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 19203 rssi_level)) 19204 goto nla_put_failure; 19205 19206 cfg80211_send_cqm(msg, GFP_KERNEL); 19207 19208 return; 19209 19210 nla_put_failure: 19211 nlmsg_free(msg); 19212 } 19213 19214 void cfg80211_cqm_txe_notify(struct net_device *dev, 19215 const u8 *peer, u32 num_packets, 19216 u32 rate, u32 intvl, gfp_t gfp) 19217 { 19218 struct sk_buff *msg; 19219 19220 msg = cfg80211_prepare_cqm(dev, peer, gfp); 19221 if (!msg) 19222 return; 19223 19224 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 19225 goto nla_put_failure; 19226 19227 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 19228 goto nla_put_failure; 19229 19230 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 19231 goto nla_put_failure; 19232 19233 cfg80211_send_cqm(msg, gfp); 19234 return; 19235 19236 nla_put_failure: 19237 nlmsg_free(msg); 19238 } 19239 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 19240 19241 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 19242 const u8 *peer, u32 num_packets, gfp_t gfp) 19243 { 19244 struct sk_buff *msg; 19245 19246 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 19247 19248 msg = cfg80211_prepare_cqm(dev, peer, gfp); 19249 if (!msg) 19250 return; 19251 19252 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 19253 goto nla_put_failure; 19254 19255 cfg80211_send_cqm(msg, gfp); 19256 return; 19257 19258 nla_put_failure: 19259 nlmsg_free(msg); 19260 } 19261 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 19262 19263 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 19264 { 19265 struct sk_buff *msg; 19266 19267 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 19268 if (!msg) 19269 return; 19270 19271 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 19272 goto nla_put_failure; 19273 19274 cfg80211_send_cqm(msg, gfp); 19275 return; 19276 19277 nla_put_failure: 19278 nlmsg_free(msg); 19279 } 19280 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 19281 19282 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 19283 struct net_device *netdev, const u8 *bssid, 19284 const u8 *replay_ctr, gfp_t gfp) 19285 { 19286 struct sk_buff *msg; 19287 struct nlattr *rekey_attr; 19288 void *hdr; 19289 19290 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19291 if (!msg) 19292 return; 19293 19294 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 19295 if (!hdr) { 19296 nlmsg_free(msg); 19297 return; 19298 } 19299 19300 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19301 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19302 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 19303 goto nla_put_failure; 19304 19305 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 19306 if (!rekey_attr) 19307 goto nla_put_failure; 19308 19309 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 19310 NL80211_REPLAY_CTR_LEN, replay_ctr)) 19311 goto nla_put_failure; 19312 19313 nla_nest_end(msg, rekey_attr); 19314 19315 genlmsg_end(msg, hdr); 19316 19317 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19318 NL80211_MCGRP_MLME, gfp); 19319 return; 19320 19321 nla_put_failure: 19322 nlmsg_free(msg); 19323 } 19324 19325 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 19326 const u8 *replay_ctr, gfp_t gfp) 19327 { 19328 struct wireless_dev *wdev = dev->ieee80211_ptr; 19329 struct wiphy *wiphy = wdev->wiphy; 19330 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19331 19332 trace_cfg80211_gtk_rekey_notify(dev, bssid); 19333 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 19334 } 19335 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 19336 19337 static void 19338 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 19339 struct net_device *netdev, int index, 19340 const u8 *bssid, bool preauth, gfp_t gfp) 19341 { 19342 struct sk_buff *msg; 19343 struct nlattr *attr; 19344 void *hdr; 19345 19346 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19347 if (!msg) 19348 return; 19349 19350 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 19351 if (!hdr) { 19352 nlmsg_free(msg); 19353 return; 19354 } 19355 19356 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19357 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19358 goto nla_put_failure; 19359 19360 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 19361 if (!attr) 19362 goto nla_put_failure; 19363 19364 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 19365 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 19366 (preauth && 19367 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 19368 goto nla_put_failure; 19369 19370 nla_nest_end(msg, attr); 19371 19372 genlmsg_end(msg, hdr); 19373 19374 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19375 NL80211_MCGRP_MLME, gfp); 19376 return; 19377 19378 nla_put_failure: 19379 nlmsg_free(msg); 19380 } 19381 19382 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 19383 const u8 *bssid, bool preauth, gfp_t gfp) 19384 { 19385 struct wireless_dev *wdev = dev->ieee80211_ptr; 19386 struct wiphy *wiphy = wdev->wiphy; 19387 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19388 19389 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 19390 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 19391 } 19392 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 19393 19394 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 19395 struct net_device *netdev, 19396 unsigned int link_id, 19397 struct cfg80211_chan_def *chandef, 19398 gfp_t gfp, 19399 enum nl80211_commands notif, 19400 u8 count, bool quiet, u16 punct_bitmap) 19401 { 19402 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19403 struct sk_buff *msg; 19404 void *hdr; 19405 19406 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19407 if (!msg) 19408 return; 19409 19410 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 19411 if (!hdr) { 19412 nlmsg_free(msg); 19413 return; 19414 } 19415 19416 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19417 goto nla_put_failure; 19418 19419 if (wdev->valid_links && 19420 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 19421 goto nla_put_failure; 19422 19423 if (nl80211_send_chandef(msg, chandef)) 19424 goto nla_put_failure; 19425 19426 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) { 19427 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)) 19428 goto nla_put_failure; 19429 if (quiet && 19430 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)) 19431 goto nla_put_failure; 19432 } 19433 19434 if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap)) 19435 goto nla_put_failure; 19436 19437 genlmsg_end(msg, hdr); 19438 19439 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19440 NL80211_MCGRP_MLME, gfp); 19441 return; 19442 19443 nla_put_failure: 19444 nlmsg_free(msg); 19445 } 19446 19447 void cfg80211_ch_switch_notify(struct net_device *dev, 19448 struct cfg80211_chan_def *chandef, 19449 unsigned int link_id, u16 punct_bitmap) 19450 { 19451 struct wireless_dev *wdev = dev->ieee80211_ptr; 19452 struct wiphy *wiphy = wdev->wiphy; 19453 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19454 19455 lockdep_assert_wiphy(wdev->wiphy); 19456 WARN_INVALID_LINK_ID(wdev, link_id); 19457 19458 trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap); 19459 19460 switch (wdev->iftype) { 19461 case NL80211_IFTYPE_STATION: 19462 case NL80211_IFTYPE_P2P_CLIENT: 19463 if (!WARN_ON(!wdev->links[link_id].client.current_bss)) 19464 cfg80211_update_assoc_bss_entry(wdev, link_id, 19465 chandef->chan); 19466 break; 19467 case NL80211_IFTYPE_MESH_POINT: 19468 wdev->u.mesh.chandef = *chandef; 19469 wdev->u.mesh.preset_chandef = *chandef; 19470 break; 19471 case NL80211_IFTYPE_AP: 19472 case NL80211_IFTYPE_P2P_GO: 19473 wdev->links[link_id].ap.chandef = *chandef; 19474 break; 19475 case NL80211_IFTYPE_ADHOC: 19476 wdev->u.ibss.chandef = *chandef; 19477 break; 19478 default: 19479 WARN_ON(1); 19480 break; 19481 } 19482 19483 cfg80211_schedule_channels_check(wdev); 19484 cfg80211_sched_dfs_chan_update(rdev); 19485 19486 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19487 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false, 19488 punct_bitmap); 19489 } 19490 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 19491 19492 void cfg80211_ch_switch_started_notify(struct net_device *dev, 19493 struct cfg80211_chan_def *chandef, 19494 unsigned int link_id, u8 count, 19495 bool quiet, u16 punct_bitmap) 19496 { 19497 struct wireless_dev *wdev = dev->ieee80211_ptr; 19498 struct wiphy *wiphy = wdev->wiphy; 19499 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19500 19501 lockdep_assert_wiphy(wdev->wiphy); 19502 WARN_INVALID_LINK_ID(wdev, link_id); 19503 19504 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id, 19505 punct_bitmap); 19506 19507 19508 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19509 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, 19510 count, quiet, punct_bitmap); 19511 } 19512 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 19513 19514 int cfg80211_bss_color_notify(struct net_device *dev, 19515 enum nl80211_commands cmd, u8 count, 19516 u64 color_bitmap) 19517 { 19518 struct wireless_dev *wdev = dev->ieee80211_ptr; 19519 struct wiphy *wiphy = wdev->wiphy; 19520 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19521 struct sk_buff *msg; 19522 void *hdr; 19523 19524 lockdep_assert_wiphy(wdev->wiphy); 19525 19526 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap); 19527 19528 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 19529 if (!msg) 19530 return -ENOMEM; 19531 19532 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 19533 if (!hdr) 19534 goto nla_put_failure; 19535 19536 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19537 goto nla_put_failure; 19538 19539 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED && 19540 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count)) 19541 goto nla_put_failure; 19542 19543 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION && 19544 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP, 19545 color_bitmap, NL80211_ATTR_PAD)) 19546 goto nla_put_failure; 19547 19548 genlmsg_end(msg, hdr); 19549 19550 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 19551 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL); 19552 19553 nla_put_failure: 19554 nlmsg_free(msg); 19555 return -EINVAL; 19556 } 19557 EXPORT_SYMBOL(cfg80211_bss_color_notify); 19558 19559 void 19560 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 19561 const struct cfg80211_chan_def *chandef, 19562 enum nl80211_radar_event event, 19563 struct net_device *netdev, gfp_t gfp) 19564 { 19565 struct sk_buff *msg; 19566 void *hdr; 19567 19568 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19569 if (!msg) 19570 return; 19571 19572 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 19573 if (!hdr) { 19574 nlmsg_free(msg); 19575 return; 19576 } 19577 19578 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19579 goto nla_put_failure; 19580 19581 /* NOP and radar events don't need a netdev parameter */ 19582 if (netdev) { 19583 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19584 19585 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19586 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19587 NL80211_ATTR_PAD)) 19588 goto nla_put_failure; 19589 } 19590 19591 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 19592 goto nla_put_failure; 19593 19594 if (nl80211_send_chandef(msg, chandef)) 19595 goto nla_put_failure; 19596 19597 genlmsg_end(msg, hdr); 19598 19599 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19600 NL80211_MCGRP_MLME, gfp); 19601 return; 19602 19603 nla_put_failure: 19604 nlmsg_free(msg); 19605 } 19606 19607 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 19608 struct sta_opmode_info *sta_opmode, 19609 gfp_t gfp) 19610 { 19611 struct sk_buff *msg; 19612 struct wireless_dev *wdev = dev->ieee80211_ptr; 19613 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19614 void *hdr; 19615 19616 if (WARN_ON(!mac)) 19617 return; 19618 19619 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19620 if (!msg) 19621 return; 19622 19623 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 19624 if (!hdr) { 19625 nlmsg_free(msg); 19626 return; 19627 } 19628 19629 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19630 goto nla_put_failure; 19631 19632 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19633 goto nla_put_failure; 19634 19635 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 19636 goto nla_put_failure; 19637 19638 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 19639 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 19640 goto nla_put_failure; 19641 19642 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 19643 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 19644 goto nla_put_failure; 19645 19646 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 19647 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 19648 goto nla_put_failure; 19649 19650 genlmsg_end(msg, hdr); 19651 19652 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19653 NL80211_MCGRP_MLME, gfp); 19654 19655 return; 19656 19657 nla_put_failure: 19658 nlmsg_free(msg); 19659 } 19660 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 19661 19662 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 19663 u64 cookie, bool acked, s32 ack_signal, 19664 bool is_valid_ack_signal, gfp_t gfp) 19665 { 19666 struct wireless_dev *wdev = dev->ieee80211_ptr; 19667 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19668 struct sk_buff *msg; 19669 void *hdr; 19670 19671 trace_cfg80211_probe_status(dev, addr, cookie, acked); 19672 19673 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19674 19675 if (!msg) 19676 return; 19677 19678 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 19679 if (!hdr) { 19680 nlmsg_free(msg); 19681 return; 19682 } 19683 19684 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19685 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19686 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 19687 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 19688 NL80211_ATTR_PAD) || 19689 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 19690 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 19691 ack_signal))) 19692 goto nla_put_failure; 19693 19694 genlmsg_end(msg, hdr); 19695 19696 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19697 NL80211_MCGRP_MLME, gfp); 19698 return; 19699 19700 nla_put_failure: 19701 nlmsg_free(msg); 19702 } 19703 EXPORT_SYMBOL(cfg80211_probe_status); 19704 19705 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 19706 size_t len, int freq, int sig_dbm) 19707 { 19708 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19709 struct sk_buff *msg; 19710 void *hdr; 19711 struct cfg80211_beacon_registration *reg; 19712 19713 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 19714 19715 spin_lock_bh(&rdev->beacon_registrations_lock); 19716 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 19717 msg = nlmsg_new(len + 100, GFP_ATOMIC); 19718 if (!msg) { 19719 spin_unlock_bh(&rdev->beacon_registrations_lock); 19720 return; 19721 } 19722 19723 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 19724 if (!hdr) 19725 goto nla_put_failure; 19726 19727 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19728 (freq && 19729 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 19730 KHZ_TO_MHZ(freq)) || 19731 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 19732 freq % 1000))) || 19733 (sig_dbm && 19734 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 19735 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 19736 goto nla_put_failure; 19737 19738 genlmsg_end(msg, hdr); 19739 19740 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 19741 } 19742 spin_unlock_bh(&rdev->beacon_registrations_lock); 19743 return; 19744 19745 nla_put_failure: 19746 spin_unlock_bh(&rdev->beacon_registrations_lock); 19747 nlmsg_free(msg); 19748 } 19749 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 19750 19751 #ifdef CONFIG_PM 19752 static int cfg80211_net_detect_results(struct sk_buff *msg, 19753 struct cfg80211_wowlan_wakeup *wakeup) 19754 { 19755 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 19756 struct nlattr *nl_results, *nl_match, *nl_freqs; 19757 int i, j; 19758 19759 nl_results = nla_nest_start_noflag(msg, 19760 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 19761 if (!nl_results) 19762 return -EMSGSIZE; 19763 19764 for (i = 0; i < nd->n_matches; i++) { 19765 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 19766 19767 nl_match = nla_nest_start_noflag(msg, i); 19768 if (!nl_match) 19769 break; 19770 19771 /* The SSID attribute is optional in nl80211, but for 19772 * simplicity reasons it's always present in the 19773 * cfg80211 structure. If a driver can't pass the 19774 * SSID, that needs to be changed. A zero length SSID 19775 * is still a valid SSID (wildcard), so it cannot be 19776 * used for this purpose. 19777 */ 19778 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 19779 match->ssid.ssid)) { 19780 nla_nest_cancel(msg, nl_match); 19781 goto out; 19782 } 19783 19784 if (match->n_channels) { 19785 nl_freqs = nla_nest_start_noflag(msg, 19786 NL80211_ATTR_SCAN_FREQUENCIES); 19787 if (!nl_freqs) { 19788 nla_nest_cancel(msg, nl_match); 19789 goto out; 19790 } 19791 19792 for (j = 0; j < match->n_channels; j++) { 19793 if (nla_put_u32(msg, j, match->channels[j])) { 19794 nla_nest_cancel(msg, nl_freqs); 19795 nla_nest_cancel(msg, nl_match); 19796 goto out; 19797 } 19798 } 19799 19800 nla_nest_end(msg, nl_freqs); 19801 } 19802 19803 nla_nest_end(msg, nl_match); 19804 } 19805 19806 out: 19807 nla_nest_end(msg, nl_results); 19808 return 0; 19809 } 19810 19811 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 19812 struct cfg80211_wowlan_wakeup *wakeup, 19813 gfp_t gfp) 19814 { 19815 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19816 struct sk_buff *msg; 19817 void *hdr; 19818 int size = 200; 19819 19820 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 19821 19822 if (wakeup) 19823 size += wakeup->packet_present_len; 19824 19825 msg = nlmsg_new(size, gfp); 19826 if (!msg) 19827 return; 19828 19829 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 19830 if (!hdr) 19831 goto free_msg; 19832 19833 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19834 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19835 NL80211_ATTR_PAD)) 19836 goto free_msg; 19837 19838 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 19839 wdev->netdev->ifindex)) 19840 goto free_msg; 19841 19842 if (wakeup) { 19843 struct nlattr *reasons; 19844 19845 reasons = nla_nest_start_noflag(msg, 19846 NL80211_ATTR_WOWLAN_TRIGGERS); 19847 if (!reasons) 19848 goto free_msg; 19849 19850 if (wakeup->disconnect && 19851 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 19852 goto free_msg; 19853 if (wakeup->magic_pkt && 19854 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 19855 goto free_msg; 19856 if (wakeup->gtk_rekey_failure && 19857 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 19858 goto free_msg; 19859 if (wakeup->eap_identity_req && 19860 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 19861 goto free_msg; 19862 if (wakeup->four_way_handshake && 19863 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 19864 goto free_msg; 19865 if (wakeup->rfkill_release && 19866 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 19867 goto free_msg; 19868 19869 if (wakeup->pattern_idx >= 0 && 19870 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 19871 wakeup->pattern_idx)) 19872 goto free_msg; 19873 19874 if (wakeup->tcp_match && 19875 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 19876 goto free_msg; 19877 19878 if (wakeup->tcp_connlost && 19879 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 19880 goto free_msg; 19881 19882 if (wakeup->tcp_nomoretokens && 19883 nla_put_flag(msg, 19884 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 19885 goto free_msg; 19886 19887 if (wakeup->packet) { 19888 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 19889 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 19890 19891 if (!wakeup->packet_80211) { 19892 pkt_attr = 19893 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 19894 len_attr = 19895 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 19896 } 19897 19898 if (wakeup->packet_len && 19899 nla_put_u32(msg, len_attr, wakeup->packet_len)) 19900 goto free_msg; 19901 19902 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 19903 wakeup->packet)) 19904 goto free_msg; 19905 } 19906 19907 if (wakeup->net_detect && 19908 cfg80211_net_detect_results(msg, wakeup)) 19909 goto free_msg; 19910 19911 nla_nest_end(msg, reasons); 19912 } 19913 19914 genlmsg_end(msg, hdr); 19915 19916 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19917 NL80211_MCGRP_MLME, gfp); 19918 return; 19919 19920 free_msg: 19921 nlmsg_free(msg); 19922 } 19923 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 19924 #endif 19925 19926 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 19927 enum nl80211_tdls_operation oper, 19928 u16 reason_code, gfp_t gfp) 19929 { 19930 struct wireless_dev *wdev = dev->ieee80211_ptr; 19931 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19932 struct sk_buff *msg; 19933 void *hdr; 19934 19935 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 19936 reason_code); 19937 19938 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19939 if (!msg) 19940 return; 19941 19942 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 19943 if (!hdr) { 19944 nlmsg_free(msg); 19945 return; 19946 } 19947 19948 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19949 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19950 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 19951 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 19952 (reason_code > 0 && 19953 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 19954 goto nla_put_failure; 19955 19956 genlmsg_end(msg, hdr); 19957 19958 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19959 NL80211_MCGRP_MLME, gfp); 19960 return; 19961 19962 nla_put_failure: 19963 nlmsg_free(msg); 19964 } 19965 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 19966 19967 static int nl80211_netlink_notify(struct notifier_block * nb, 19968 unsigned long state, 19969 void *_notify) 19970 { 19971 struct netlink_notify *notify = _notify; 19972 struct cfg80211_registered_device *rdev; 19973 struct wireless_dev *wdev; 19974 struct cfg80211_beacon_registration *reg, *tmp; 19975 19976 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 19977 return NOTIFY_DONE; 19978 19979 rcu_read_lock(); 19980 19981 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 19982 struct cfg80211_sched_scan_request *sched_scan_req; 19983 19984 list_for_each_entry_rcu(sched_scan_req, 19985 &rdev->sched_scan_req_list, 19986 list) { 19987 if (sched_scan_req->owner_nlportid == notify->portid) { 19988 sched_scan_req->nl_owner_dead = true; 19989 wiphy_work_queue(&rdev->wiphy, 19990 &rdev->sched_scan_stop_wk); 19991 } 19992 } 19993 19994 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 19995 cfg80211_mlme_unregister_socket(wdev, notify->portid); 19996 19997 if (wdev->owner_nlportid == notify->portid) { 19998 wdev->nl_owner_dead = true; 19999 schedule_work(&rdev->destroy_work); 20000 } else if (wdev->conn_owner_nlportid == notify->portid) { 20001 schedule_work(&wdev->disconnect_wk); 20002 } 20003 20004 cfg80211_release_pmsr(wdev, notify->portid); 20005 } 20006 20007 spin_lock_bh(&rdev->beacon_registrations_lock); 20008 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 20009 list) { 20010 if (reg->nlportid == notify->portid) { 20011 list_del(®->list); 20012 kfree(reg); 20013 break; 20014 } 20015 } 20016 spin_unlock_bh(&rdev->beacon_registrations_lock); 20017 } 20018 20019 rcu_read_unlock(); 20020 20021 /* 20022 * It is possible that the user space process that is controlling the 20023 * indoor setting disappeared, so notify the regulatory core. 20024 */ 20025 regulatory_netlink_notify(notify->portid); 20026 return NOTIFY_OK; 20027 } 20028 20029 static struct notifier_block nl80211_netlink_notifier = { 20030 .notifier_call = nl80211_netlink_notify, 20031 }; 20032 20033 void cfg80211_ft_event(struct net_device *netdev, 20034 struct cfg80211_ft_event_params *ft_event) 20035 { 20036 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 20037 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20038 struct sk_buff *msg; 20039 void *hdr; 20040 20041 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 20042 20043 if (!ft_event->target_ap) 20044 return; 20045 20046 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 20047 GFP_KERNEL); 20048 if (!msg) 20049 return; 20050 20051 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 20052 if (!hdr) 20053 goto out; 20054 20055 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20056 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 20057 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 20058 goto out; 20059 20060 if (ft_event->ies && 20061 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 20062 goto out; 20063 if (ft_event->ric_ies && 20064 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 20065 ft_event->ric_ies)) 20066 goto out; 20067 20068 genlmsg_end(msg, hdr); 20069 20070 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 20071 NL80211_MCGRP_MLME, GFP_KERNEL); 20072 return; 20073 out: 20074 nlmsg_free(msg); 20075 } 20076 EXPORT_SYMBOL(cfg80211_ft_event); 20077 20078 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 20079 { 20080 struct cfg80211_registered_device *rdev; 20081 struct sk_buff *msg; 20082 void *hdr; 20083 u32 nlportid; 20084 20085 rdev = wiphy_to_rdev(wdev->wiphy); 20086 if (!rdev->crit_proto_nlportid) 20087 return; 20088 20089 nlportid = rdev->crit_proto_nlportid; 20090 rdev->crit_proto_nlportid = 0; 20091 20092 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20093 if (!msg) 20094 return; 20095 20096 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 20097 if (!hdr) 20098 goto nla_put_failure; 20099 20100 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20101 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 20102 NL80211_ATTR_PAD)) 20103 goto nla_put_failure; 20104 20105 genlmsg_end(msg, hdr); 20106 20107 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 20108 return; 20109 20110 nla_put_failure: 20111 nlmsg_free(msg); 20112 } 20113 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 20114 20115 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id) 20116 { 20117 struct wiphy *wiphy = wdev->wiphy; 20118 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20119 struct sk_buff *msg; 20120 void *hdr; 20121 20122 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 20123 if (!msg) 20124 return; 20125 20126 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 20127 if (!hdr) 20128 goto out; 20129 20130 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20131 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 20132 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 20133 NL80211_ATTR_PAD) || 20134 (wdev->valid_links && 20135 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 20136 goto out; 20137 20138 genlmsg_end(msg, hdr); 20139 20140 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 20141 NL80211_MCGRP_MLME, GFP_KERNEL); 20142 return; 20143 out: 20144 nlmsg_free(msg); 20145 } 20146 20147 int cfg80211_external_auth_request(struct net_device *dev, 20148 struct cfg80211_external_auth_params *params, 20149 gfp_t gfp) 20150 { 20151 struct wireless_dev *wdev = dev->ieee80211_ptr; 20152 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 20153 struct sk_buff *msg; 20154 void *hdr; 20155 20156 if (!wdev->conn_owner_nlportid) 20157 return -EINVAL; 20158 20159 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20160 if (!msg) 20161 return -ENOMEM; 20162 20163 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 20164 if (!hdr) 20165 goto nla_put_failure; 20166 20167 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20168 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 20169 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 20170 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 20171 params->action) || 20172 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 20173 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 20174 params->ssid.ssid) || 20175 (!is_zero_ether_addr(params->mld_addr) && 20176 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr))) 20177 goto nla_put_failure; 20178 20179 genlmsg_end(msg, hdr); 20180 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 20181 wdev->conn_owner_nlportid); 20182 return 0; 20183 20184 nla_put_failure: 20185 nlmsg_free(msg); 20186 return -ENOBUFS; 20187 } 20188 EXPORT_SYMBOL(cfg80211_external_auth_request); 20189 20190 void cfg80211_update_owe_info_event(struct net_device *netdev, 20191 struct cfg80211_update_owe_info *owe_info, 20192 gfp_t gfp) 20193 { 20194 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 20195 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20196 struct sk_buff *msg; 20197 void *hdr; 20198 20199 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 20200 20201 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20202 if (!msg) 20203 return; 20204 20205 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 20206 if (!hdr) 20207 goto nla_put_failure; 20208 20209 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20210 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 20211 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 20212 goto nla_put_failure; 20213 20214 if (!owe_info->ie_len || 20215 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 20216 goto nla_put_failure; 20217 20218 if (owe_info->assoc_link_id != -1) { 20219 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 20220 owe_info->assoc_link_id)) 20221 goto nla_put_failure; 20222 20223 if (!is_zero_ether_addr(owe_info->peer_mld_addr) && 20224 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 20225 owe_info->peer_mld_addr)) 20226 goto nla_put_failure; 20227 } 20228 20229 genlmsg_end(msg, hdr); 20230 20231 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 20232 NL80211_MCGRP_MLME, gfp); 20233 return; 20234 20235 nla_put_failure: 20236 genlmsg_cancel(msg, hdr); 20237 nlmsg_free(msg); 20238 } 20239 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 20240 20241 void cfg80211_schedule_channels_check(struct wireless_dev *wdev) 20242 { 20243 struct wiphy *wiphy = wdev->wiphy; 20244 20245 /* Schedule channels check if NO_IR or DFS relaxations are supported */ 20246 if (wdev->iftype == NL80211_IFTYPE_STATION && 20247 (wiphy_ext_feature_isset(wiphy, 20248 NL80211_EXT_FEATURE_DFS_CONCURRENT) || 20249 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) && 20250 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR))) 20251 reg_check_channels(); 20252 } 20253 EXPORT_SYMBOL(cfg80211_schedule_channels_check); 20254 20255 /* initialisation/exit functions */ 20256 20257 int __init nl80211_init(void) 20258 { 20259 int err; 20260 20261 err = genl_register_family(&nl80211_fam); 20262 if (err) 20263 return err; 20264 20265 err = netlink_register_notifier(&nl80211_netlink_notifier); 20266 if (err) 20267 goto err_out; 20268 20269 return 0; 20270 err_out: 20271 genl_unregister_family(&nl80211_fam); 20272 return err; 20273 } 20274 20275 void nl80211_exit(void) 20276 { 20277 netlink_unregister_notifier(&nl80211_netlink_notifier); 20278 genl_unregister_family(&nl80211_fam); 20279 } 20280