1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2022 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 unsigned int fixedlen, hdrlen;
233 bool s1g_bcn;
234
235 if (len < offsetofend(typeof(*mgmt), frame_control))
236 goto err;
237
238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
239 if (s1g_bcn) {
240 fixedlen = offsetof(struct ieee80211_ext,
241 u.s1g_beacon.variable);
242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
243 } else {
244 fixedlen = offsetof(struct ieee80211_mgmt,
245 u.beacon.variable);
246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
247 }
248
249 if (len < fixedlen)
250 goto err;
251
252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
253 goto err;
254
255 data += fixedlen;
256 len -= fixedlen;
257
258 for_each_element(elem, data, len) {
259 /* nothing */
260 }
261
262 if (for_each_element_completed(elem, data, len))
263 return 0;
264
265 err:
266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
267 return -EINVAL;
268 }
269
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)270 static int validate_ie_attr(const struct nlattr *attr,
271 struct netlink_ext_ack *extack)
272 {
273 const u8 *data = nla_data(attr);
274 unsigned int len = nla_len(attr);
275 const struct element *elem;
276
277 for_each_element(elem, data, len) {
278 /* nothing */
279 }
280
281 if (for_each_element_completed(elem, data, len))
282 return 0;
283
284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
285 return -EINVAL;
286 }
287
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)288 static int validate_he_capa(const struct nlattr *attr,
289 struct netlink_ext_ack *extack)
290 {
291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
292 return -EINVAL;
293
294 return 0;
295 }
296
297 /* policy for the attributes */
298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
299
300 static const struct nla_policy
301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
304 .len = U8_MAX },
305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
306 .len = U8_MAX },
307 };
308
309 static const struct nla_policy
310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
314 NLA_POLICY_MAX(NLA_U8, 15),
315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
317 NLA_POLICY_MAX(NLA_U8, 15),
318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
319 NLA_POLICY_MAX(NLA_U8, 31),
320 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
322 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
323 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
324 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
325 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
326 };
327
328 static const struct nla_policy
329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
330 [NL80211_PMSR_TYPE_FTM] =
331 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
332 };
333
334 static const struct nla_policy
335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
336 [NL80211_PMSR_REQ_ATTR_DATA] =
337 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
338 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
339 };
340
341 static const struct nla_policy
342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
343 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
344 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
345 [NL80211_PMSR_PEER_ATTR_REQ] =
346 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
347 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
348 };
349
350 static const struct nla_policy
351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
352 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
353 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
354 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
355 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
356 [NL80211_PMSR_ATTR_PEERS] =
357 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
358 };
359
360 static const struct nla_policy
361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
362 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
363 NLA_POLICY_RANGE(NLA_U8, 1, 20),
364 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
365 NLA_POLICY_RANGE(NLA_U8, 1, 20),
366 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
367 NLA_POLICY_RANGE(NLA_U8, 1, 20),
368 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
369 NLA_POLICY_EXACT_LEN(8),
370 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
371 NLA_POLICY_EXACT_LEN(8),
372 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
373 };
374
375 static const struct nla_policy
376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
377 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
378 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
379 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
380 };
381
382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
383 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
384 .len = NL80211_MAX_SUPP_RATES },
385 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
386 .len = NL80211_MAX_SUPP_HT_RATES },
387 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
388 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
389 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
390 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
391 NL80211_RATE_INFO_HE_GI_0_8,
392 NL80211_RATE_INFO_HE_GI_3_2),
393 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
394 NL80211_RATE_INFO_HE_1XLTF,
395 NL80211_RATE_INFO_HE_4XLTF),
396 };
397
398 static const struct nla_policy
399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
400 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
401 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
402 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
403 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
404 [NL80211_TID_CONFIG_ATTR_NOACK] =
405 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
406 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
407 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
408 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
409 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
410 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
411 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
412 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
413 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
414 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
415 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
416 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
417 NLA_POLICY_NESTED(nl80211_txattr_policy),
418 };
419
420 static const struct nla_policy
421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
422 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
423 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
424 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
425 NLA_POLICY_RANGE(NLA_BINARY,
426 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
427 IEEE80211_MAX_DATA_LEN),
428 };
429
430 static const struct nla_policy
431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
432 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
434 .len = IEEE80211_MAX_DATA_LEN }
435 };
436
437 static const struct nla_policy
438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
439 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
440 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
441 };
442
443 static const struct nla_policy
444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
445 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
446 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
447 };
448
449 static const struct nla_policy
450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
451 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
452 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
453 NLA_POLICY_MIN(NLA_U8, 1),
454 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
455 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
456 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
457 };
458
459 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
460 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
461 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
462 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
463 .len = 20-1 },
464 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
465
466 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
467 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
468 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
469 NL80211_EDMG_CHANNELS_MIN,
470 NL80211_EDMG_CHANNELS_MAX),
471 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
472 NL80211_EDMG_BW_CONFIG_MIN,
473 NL80211_EDMG_BW_CONFIG_MAX),
474
475 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
476 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
477 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
478 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
479
480 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
481 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
482 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
483 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
484 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
485 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
486
487 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
488 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
489 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
490
491 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
492 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
493
494 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
495 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
496 .len = WLAN_MAX_KEY_LEN },
497 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
498 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
499 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
500 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
501 [NL80211_ATTR_KEY_TYPE] =
502 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
503
504 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
505 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
506 [NL80211_ATTR_BEACON_HEAD] =
507 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
508 IEEE80211_MAX_DATA_LEN),
509 [NL80211_ATTR_BEACON_TAIL] =
510 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
511 IEEE80211_MAX_DATA_LEN),
512 [NL80211_ATTR_STA_AID] =
513 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
514 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
515 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
516 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
517 .len = NL80211_MAX_SUPP_RATES },
518 [NL80211_ATTR_STA_PLINK_ACTION] =
519 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
520 [NL80211_ATTR_STA_TX_POWER_SETTING] =
521 NLA_POLICY_RANGE(NLA_U8,
522 NL80211_TX_POWER_AUTOMATIC,
523 NL80211_TX_POWER_FIXED),
524 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
525 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
526 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
527 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
528 .len = IEEE80211_MAX_MESH_ID_LEN },
529 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
530
531 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
532 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
533 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
534
535 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
536 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
537 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
538 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
539 .len = NL80211_MAX_SUPP_RATES },
540 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
541
542 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
543 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
544
545 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
546
547 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
548 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
549 validate_ie_attr,
550 IEEE80211_MAX_DATA_LEN),
551 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
552 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
553
554 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
555 .len = IEEE80211_MAX_SSID_LEN },
556 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
557 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
558 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
559 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
560 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
561 NL80211_MFP_NO,
562 NL80211_MFP_OPTIONAL),
563 [NL80211_ATTR_STA_FLAGS2] = {
564 .len = sizeof(struct nl80211_sta_flag_update),
565 },
566 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
567 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
568 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
569 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
570 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
571 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
572 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
573 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
574 [NL80211_ATTR_PID] = { .type = NLA_U32 },
575 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
576 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
577 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
578 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
579 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
580 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
581 .len = IEEE80211_MAX_DATA_LEN },
582 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
583 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
584 NL80211_PS_DISABLED,
585 NL80211_PS_ENABLED),
586 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
587 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
588 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
589 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
590 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
591 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
592 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
593 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
594 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
595 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
596 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
597 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
598 [NL80211_ATTR_STA_PLINK_STATE] =
599 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
600 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
601 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
602 [NL80211_ATTR_MESH_PEER_AID] =
603 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
604 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
605 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
606 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
607 [NL80211_ATTR_HIDDEN_SSID] =
608 NLA_POLICY_RANGE(NLA_U32,
609 NL80211_HIDDEN_SSID_NOT_IN_USE,
610 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
611 [NL80211_ATTR_IE_PROBE_RESP] =
612 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
613 IEEE80211_MAX_DATA_LEN),
614 [NL80211_ATTR_IE_ASSOC_RESP] =
615 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
616 IEEE80211_MAX_DATA_LEN),
617 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
618 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
619 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
620 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
621 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
622 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
623 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
624 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
625 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
626 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
627 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
628 .len = IEEE80211_MAX_DATA_LEN },
629 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
630 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
631 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
632 .len = NL80211_HT_CAPABILITY_LEN
633 },
634 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
635 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
636 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
637 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
638 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
639
640 /* need to include at least Auth Transaction and Status Code */
641 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
642
643 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
644 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
645 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
646 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
647 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
648 NLA_POLICY_RANGE(NLA_U32,
649 NL80211_MESH_POWER_UNKNOWN + 1,
650 NL80211_MESH_POWER_MAX),
651 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
652 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
653 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
654 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
655 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
656 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
657 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
658 .len = NL80211_VHT_CAPABILITY_LEN,
659 },
660 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
661 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
662 .len = IEEE80211_MAX_DATA_LEN },
663 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
664 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
665 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
666 [NL80211_ATTR_PEER_AID] =
667 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
668 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
669 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
670 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
671 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
672 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
673 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
674 /*
675 * The value of the Length field of the Supported Operating
676 * Classes element is between 2 and 253.
677 */
678 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
679 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
680 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
681 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
682 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
683 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
684 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
685 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
686 IEEE80211_QOS_MAP_LEN_MIN,
687 IEEE80211_QOS_MAP_LEN_MAX),
688 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
689 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
690 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
691 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
692 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
693 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
694 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
695 [NL80211_ATTR_USER_PRIO] =
696 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
697 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
698 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
699 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
700 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
701 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
702 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
703 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
704 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
705 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
706 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
707 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
708 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
709 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
710 .len = VHT_MUMIMO_GROUPS_DATA_LEN
711 },
712 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
713 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
714 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
715 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
716 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
717 .len = FILS_MAX_KEK_LEN },
718 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
719 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
720 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
721 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
722 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
723 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
724 },
725 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
726 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
727 .len = FILS_ERP_MAX_USERNAME_LEN },
728 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
729 .len = FILS_ERP_MAX_REALM_LEN },
730 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
731 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
732 .len = FILS_ERP_MAX_RRK_LEN },
733 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
734 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
735 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
736 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
737 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
738
739 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
740 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
741 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
742 [NL80211_ATTR_HE_CAPABILITY] =
743 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
744 NL80211_HE_MAX_CAPABILITY_LEN),
745 [NL80211_ATTR_FTM_RESPONDER] =
746 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
747 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
748 [NL80211_ATTR_PEER_MEASUREMENTS] =
749 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
750 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
751 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
752 .len = SAE_PASSWORD_MAX_LEN },
753 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
754 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
755 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
756 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
757 [NL80211_ATTR_TID_CONFIG] =
758 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
759 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
760 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
761 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
762 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
763 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
764 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
765 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
766 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
767 [NL80211_ATTR_FILS_DISCOVERY] =
768 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
769 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
770 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
771 [NL80211_ATTR_S1G_CAPABILITY] =
772 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
773 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
774 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
775 [NL80211_ATTR_SAE_PWE] =
776 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
777 NL80211_SAE_PWE_BOTH),
778 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
779 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
780 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
781 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
782 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
783 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
784 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
785 [NL80211_ATTR_MBSSID_CONFIG] =
786 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
787 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
788 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
789 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
790 [NL80211_ATTR_EHT_CAPABILITY] =
791 NLA_POLICY_RANGE(NLA_BINARY,
792 NL80211_EHT_MIN_CAPABILITY_LEN,
793 NL80211_EHT_MAX_CAPABILITY_LEN),
794 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
795 [NL80211_ATTR_MLO_LINKS] =
796 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
797 [NL80211_ATTR_MLO_LINK_ID] =
798 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
799 };
800
801 /* policy for the key attributes */
802 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
803 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
804 [NL80211_KEY_IDX] = { .type = NLA_U8 },
805 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
806 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
807 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
808 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
809 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
810 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
811 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
812 };
813
814 /* policy for the key default flags */
815 static const struct nla_policy
816 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
817 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
818 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
819 };
820
821 #ifdef CONFIG_PM
822 /* policy for WoWLAN attributes */
823 static const struct nla_policy
824 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
825 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
826 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
827 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
828 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
829 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
830 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
831 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
832 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
833 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
834 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
835 };
836
837 static const struct nla_policy
838 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
839 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
840 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
841 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
842 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
843 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
844 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
845 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
846 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
847 },
848 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
849 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
850 },
851 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
852 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
853 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
854 };
855 #endif /* CONFIG_PM */
856
857 /* policy for coalesce rule attributes */
858 static const struct nla_policy
859 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
860 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
861 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
862 NLA_POLICY_RANGE(NLA_U32,
863 NL80211_COALESCE_CONDITION_MATCH,
864 NL80211_COALESCE_CONDITION_NO_MATCH),
865 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
866 };
867
868 /* policy for GTK rekey offload attributes */
869 static const struct nla_policy
870 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
871 [NL80211_REKEY_DATA_KEK] = {
872 .type = NLA_BINARY,
873 .len = NL80211_KEK_EXT_LEN
874 },
875 [NL80211_REKEY_DATA_KCK] = {
876 .type = NLA_BINARY,
877 .len = NL80211_KCK_EXT_LEN
878 },
879 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
880 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
881 };
882
883 static const struct nla_policy
884 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
885 [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
886 [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
887 [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
888 [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
889 [NL80211_BAND_LC] = { .type = NLA_S32 },
890 };
891
892 static const struct nla_policy
893 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
894 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
895 .len = IEEE80211_MAX_SSID_LEN },
896 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
897 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
898 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
899 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
900 };
901
902 static const struct nla_policy
903 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
904 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
905 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
906 };
907
908 static const struct nla_policy
909 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
910 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
911 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
912 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
913 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
914 },
915 };
916
917 /* policy for NAN function attributes */
918 static const struct nla_policy
919 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
920 [NL80211_NAN_FUNC_TYPE] =
921 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
922 [NL80211_NAN_FUNC_SERVICE_ID] = {
923 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
924 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
925 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
926 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
927 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
928 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
929 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
930 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
931 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
932 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
933 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
934 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
935 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
936 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
937 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
938 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
939 };
940
941 /* policy for Service Response Filter attributes */
942 static const struct nla_policy
943 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
944 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
945 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
946 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
947 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
948 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
949 };
950
951 /* policy for packet pattern attributes */
952 static const struct nla_policy
953 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
954 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
955 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
956 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
957 };
958
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)959 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
960 struct cfg80211_registered_device **rdev,
961 struct wireless_dev **wdev,
962 struct nlattr **attrbuf)
963 {
964 int err;
965
966 if (!cb->args[0]) {
967 struct nlattr **attrbuf_free = NULL;
968
969 if (!attrbuf) {
970 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
971 GFP_KERNEL);
972 if (!attrbuf)
973 return -ENOMEM;
974 attrbuf_free = attrbuf;
975 }
976
977 err = nlmsg_parse_deprecated(cb->nlh,
978 GENL_HDRLEN + nl80211_fam.hdrsize,
979 attrbuf, nl80211_fam.maxattr,
980 nl80211_policy, NULL);
981 if (err) {
982 kfree(attrbuf_free);
983 return err;
984 }
985
986 rtnl_lock();
987 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
988 attrbuf);
989 kfree(attrbuf_free);
990 if (IS_ERR(*wdev)) {
991 rtnl_unlock();
992 return PTR_ERR(*wdev);
993 }
994 *rdev = wiphy_to_rdev((*wdev)->wiphy);
995 mutex_lock(&(*rdev)->wiphy.mtx);
996 rtnl_unlock();
997 /* 0 is the first index - add 1 to parse only once */
998 cb->args[0] = (*rdev)->wiphy_idx + 1;
999 cb->args[1] = (*wdev)->identifier;
1000 } else {
1001 /* subtract the 1 again here */
1002 struct wiphy *wiphy;
1003 struct wireless_dev *tmp;
1004
1005 rtnl_lock();
1006 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1007 if (!wiphy) {
1008 rtnl_unlock();
1009 return -ENODEV;
1010 }
1011 *rdev = wiphy_to_rdev(wiphy);
1012 *wdev = NULL;
1013
1014 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1015 if (tmp->identifier == cb->args[1]) {
1016 *wdev = tmp;
1017 break;
1018 }
1019 }
1020
1021 if (!*wdev) {
1022 rtnl_unlock();
1023 return -ENODEV;
1024 }
1025 mutex_lock(&(*rdev)->wiphy.mtx);
1026 rtnl_unlock();
1027 }
1028
1029 return 0;
1030 }
1031
1032 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1033 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1034 int flags, u8 cmd)
1035 {
1036 /* since there is no private header just add the generic one */
1037 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1038 }
1039
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1040 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1041 const struct ieee80211_reg_rule *rule)
1042 {
1043 int j;
1044 struct nlattr *nl_wmm_rules =
1045 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1046
1047 if (!nl_wmm_rules)
1048 goto nla_put_failure;
1049
1050 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1051 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1052
1053 if (!nl_wmm_rule)
1054 goto nla_put_failure;
1055
1056 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1057 rule->wmm_rule.client[j].cw_min) ||
1058 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1059 rule->wmm_rule.client[j].cw_max) ||
1060 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1061 rule->wmm_rule.client[j].aifsn) ||
1062 nla_put_u16(msg, NL80211_WMMR_TXOP,
1063 rule->wmm_rule.client[j].cot))
1064 goto nla_put_failure;
1065
1066 nla_nest_end(msg, nl_wmm_rule);
1067 }
1068 nla_nest_end(msg, nl_wmm_rules);
1069
1070 return 0;
1071
1072 nla_put_failure:
1073 return -ENOBUFS;
1074 }
1075
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1076 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1077 struct ieee80211_channel *chan,
1078 bool large)
1079 {
1080 /* Some channels must be completely excluded from the
1081 * list to protect old user-space tools from breaking
1082 */
1083 if (!large && chan->flags &
1084 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1085 return 0;
1086 if (!large && chan->freq_offset)
1087 return 0;
1088
1089 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1090 chan->center_freq))
1091 goto nla_put_failure;
1092
1093 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1094 goto nla_put_failure;
1095
1096 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1097 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1098 goto nla_put_failure;
1099 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1100 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1101 goto nla_put_failure;
1102 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1103 goto nla_put_failure;
1104 }
1105 if (chan->flags & IEEE80211_CHAN_RADAR) {
1106 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1107 goto nla_put_failure;
1108 if (large) {
1109 u32 time;
1110
1111 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1112
1113 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1114 chan->dfs_state))
1115 goto nla_put_failure;
1116 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1117 time))
1118 goto nla_put_failure;
1119 if (nla_put_u32(msg,
1120 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1121 chan->dfs_cac_ms))
1122 goto nla_put_failure;
1123 }
1124 }
1125
1126 if (large) {
1127 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1128 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1129 goto nla_put_failure;
1130 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1131 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1132 goto nla_put_failure;
1133 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1134 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1135 goto nla_put_failure;
1136 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1137 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1138 goto nla_put_failure;
1139 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1140 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1141 goto nla_put_failure;
1142 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1143 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1144 goto nla_put_failure;
1145 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1146 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1147 goto nla_put_failure;
1148 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1149 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1150 goto nla_put_failure;
1151 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1152 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1153 goto nla_put_failure;
1154 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1155 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1156 goto nla_put_failure;
1157 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1158 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1159 goto nla_put_failure;
1160 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1161 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1162 goto nla_put_failure;
1163 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1164 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1165 goto nla_put_failure;
1166 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1167 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1168 goto nla_put_failure;
1169 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1170 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1171 goto nla_put_failure;
1172 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1173 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1174 goto nla_put_failure;
1175 }
1176
1177 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1178 DBM_TO_MBM(chan->max_power)))
1179 goto nla_put_failure;
1180
1181 if (large) {
1182 const struct ieee80211_reg_rule *rule =
1183 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1184
1185 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1186 if (nl80211_msg_put_wmm_rules(msg, rule))
1187 goto nla_put_failure;
1188 }
1189 }
1190
1191 return 0;
1192
1193 nla_put_failure:
1194 return -ENOBUFS;
1195 }
1196
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1197 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1198 struct cfg80211_txq_stats *txqstats,
1199 int attrtype)
1200 {
1201 struct nlattr *txqattr;
1202
1203 #define PUT_TXQVAL_U32(attr, memb) do { \
1204 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1205 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1206 return false; \
1207 } while (0)
1208
1209 txqattr = nla_nest_start_noflag(msg, attrtype);
1210 if (!txqattr)
1211 return false;
1212
1213 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1214 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1215 PUT_TXQVAL_U32(FLOWS, flows);
1216 PUT_TXQVAL_U32(DROPS, drops);
1217 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1218 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1219 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1220 PUT_TXQVAL_U32(COLLISIONS, collisions);
1221 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1222 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1223 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1224 nla_nest_end(msg, txqattr);
1225
1226 #undef PUT_TXQVAL_U32
1227 return true;
1228 }
1229
1230 /* netlink command implementations */
1231
1232 /**
1233 * nl80211_link_id - return link ID
1234 * @attrs: attributes to look at
1235 *
1236 * Returns: the link ID or 0 if not given
1237 *
1238 * Note this function doesn't do any validation of the link
1239 * ID validity wrt. links that were actually added, so it must
1240 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1241 * or if additional validation is done.
1242 */
nl80211_link_id(struct nlattr ** attrs)1243 static unsigned int nl80211_link_id(struct nlattr **attrs)
1244 {
1245 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1246
1247 if (!linkid)
1248 return 0;
1249
1250 return nla_get_u8(linkid);
1251 }
1252
nl80211_link_id_or_invalid(struct nlattr ** attrs)1253 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1254 {
1255 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1256
1257 if (!linkid)
1258 return -1;
1259
1260 return nla_get_u8(linkid);
1261 }
1262
1263 struct key_parse {
1264 struct key_params p;
1265 int idx;
1266 int type;
1267 bool def, defmgmt, defbeacon;
1268 bool def_uni, def_multi;
1269 };
1270
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1271 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1272 struct key_parse *k)
1273 {
1274 struct nlattr *tb[NL80211_KEY_MAX + 1];
1275 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1276 nl80211_key_policy,
1277 info->extack);
1278 if (err)
1279 return err;
1280
1281 k->def = !!tb[NL80211_KEY_DEFAULT];
1282 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1283 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1284
1285 if (k->def) {
1286 k->def_uni = true;
1287 k->def_multi = true;
1288 }
1289 if (k->defmgmt || k->defbeacon)
1290 k->def_multi = true;
1291
1292 if (tb[NL80211_KEY_IDX])
1293 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1294
1295 if (tb[NL80211_KEY_DATA]) {
1296 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1297 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1298 }
1299
1300 if (tb[NL80211_KEY_SEQ]) {
1301 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1302 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1303 }
1304
1305 if (tb[NL80211_KEY_CIPHER])
1306 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1307
1308 if (tb[NL80211_KEY_TYPE])
1309 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1310
1311 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1312 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1313
1314 err = nla_parse_nested_deprecated(kdt,
1315 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1316 tb[NL80211_KEY_DEFAULT_TYPES],
1317 nl80211_key_default_policy,
1318 info->extack);
1319 if (err)
1320 return err;
1321
1322 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1323 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1324 }
1325
1326 if (tb[NL80211_KEY_MODE])
1327 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1328
1329 return 0;
1330 }
1331
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1332 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1333 {
1334 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1335 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1336 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1337 }
1338
1339 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1340 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1341 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1342 }
1343
1344 if (info->attrs[NL80211_ATTR_KEY_IDX])
1345 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1346
1347 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1348 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1349
1350 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1351 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1352
1353 if (k->def) {
1354 k->def_uni = true;
1355 k->def_multi = true;
1356 }
1357 if (k->defmgmt)
1358 k->def_multi = true;
1359
1360 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1361 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1362
1363 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1364 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1365 int err = nla_parse_nested_deprecated(kdt,
1366 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1367 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1368 nl80211_key_default_policy,
1369 info->extack);
1370 if (err)
1371 return err;
1372
1373 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1374 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1375 }
1376
1377 return 0;
1378 }
1379
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1380 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1381 {
1382 int err;
1383
1384 memset(k, 0, sizeof(*k));
1385 k->idx = -1;
1386 k->type = -1;
1387
1388 if (info->attrs[NL80211_ATTR_KEY])
1389 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1390 else
1391 err = nl80211_parse_key_old(info, k);
1392
1393 if (err)
1394 return err;
1395
1396 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1397 (k->defbeacon ? 1 : 0) > 1) {
1398 GENL_SET_ERR_MSG(info,
1399 "key with multiple default flags is invalid");
1400 return -EINVAL;
1401 }
1402
1403 if (k->defmgmt || k->defbeacon) {
1404 if (k->def_uni || !k->def_multi) {
1405 GENL_SET_ERR_MSG(info,
1406 "defmgmt/defbeacon key must be mcast");
1407 return -EINVAL;
1408 }
1409 }
1410
1411 if (k->idx != -1) {
1412 if (k->defmgmt) {
1413 if (k->idx < 4 || k->idx > 5) {
1414 GENL_SET_ERR_MSG(info,
1415 "defmgmt key idx not 4 or 5");
1416 return -EINVAL;
1417 }
1418 } else if (k->defbeacon) {
1419 if (k->idx < 6 || k->idx > 7) {
1420 GENL_SET_ERR_MSG(info,
1421 "defbeacon key idx not 6 or 7");
1422 return -EINVAL;
1423 }
1424 } else if (k->def) {
1425 if (k->idx < 0 || k->idx > 3) {
1426 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1427 return -EINVAL;
1428 }
1429 } else {
1430 if (k->idx < 0 || k->idx > 7) {
1431 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1432 return -EINVAL;
1433 }
1434 }
1435 }
1436
1437 return 0;
1438 }
1439
1440 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1441 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1442 struct genl_info *info, bool *no_ht)
1443 {
1444 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1445 struct key_parse parse;
1446 struct nlattr *key;
1447 struct cfg80211_cached_keys *result;
1448 int rem, err, def = 0;
1449 bool have_key = false;
1450
1451 nla_for_each_nested(key, keys, rem) {
1452 have_key = true;
1453 break;
1454 }
1455
1456 if (!have_key)
1457 return NULL;
1458
1459 result = kzalloc(sizeof(*result), GFP_KERNEL);
1460 if (!result)
1461 return ERR_PTR(-ENOMEM);
1462
1463 result->def = -1;
1464
1465 nla_for_each_nested(key, keys, rem) {
1466 memset(&parse, 0, sizeof(parse));
1467 parse.idx = -1;
1468
1469 err = nl80211_parse_key_new(info, key, &parse);
1470 if (err)
1471 goto error;
1472 err = -EINVAL;
1473 if (!parse.p.key)
1474 goto error;
1475 if (parse.idx < 0 || parse.idx > 3) {
1476 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1477 goto error;
1478 }
1479 if (parse.def) {
1480 if (def) {
1481 GENL_SET_ERR_MSG(info,
1482 "only one key can be default");
1483 goto error;
1484 }
1485 def = 1;
1486 result->def = parse.idx;
1487 if (!parse.def_uni || !parse.def_multi)
1488 goto error;
1489 } else if (parse.defmgmt)
1490 goto error;
1491 err = cfg80211_validate_key_settings(rdev, &parse.p,
1492 parse.idx, false, NULL);
1493 if (err)
1494 goto error;
1495 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1496 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1497 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1498 err = -EINVAL;
1499 goto error;
1500 }
1501 result->params[parse.idx].cipher = parse.p.cipher;
1502 result->params[parse.idx].key_len = parse.p.key_len;
1503 result->params[parse.idx].key = result->data[parse.idx];
1504 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1505
1506 /* must be WEP key if we got here */
1507 if (no_ht)
1508 *no_ht = true;
1509 }
1510
1511 if (result->def < 0) {
1512 err = -EINVAL;
1513 GENL_SET_ERR_MSG(info, "need a default/TX key");
1514 goto error;
1515 }
1516
1517 return result;
1518 error:
1519 kfree(result);
1520 return ERR_PTR(err);
1521 }
1522
nl80211_key_allowed(struct wireless_dev * wdev)1523 static int nl80211_key_allowed(struct wireless_dev *wdev)
1524 {
1525 ASSERT_WDEV_LOCK(wdev);
1526
1527 switch (wdev->iftype) {
1528 case NL80211_IFTYPE_AP:
1529 case NL80211_IFTYPE_AP_VLAN:
1530 case NL80211_IFTYPE_P2P_GO:
1531 case NL80211_IFTYPE_MESH_POINT:
1532 break;
1533 case NL80211_IFTYPE_ADHOC:
1534 if (wdev->u.ibss.current_bss)
1535 return 0;
1536 return -ENOLINK;
1537 case NL80211_IFTYPE_STATION:
1538 case NL80211_IFTYPE_P2P_CLIENT:
1539 /* for MLO, require driver validation of the link ID */
1540 if (wdev->connected)
1541 return 0;
1542 return -ENOLINK;
1543 case NL80211_IFTYPE_UNSPECIFIED:
1544 case NL80211_IFTYPE_OCB:
1545 case NL80211_IFTYPE_MONITOR:
1546 case NL80211_IFTYPE_NAN:
1547 case NL80211_IFTYPE_P2P_DEVICE:
1548 case NL80211_IFTYPE_WDS:
1549 case NUM_NL80211_IFTYPES:
1550 return -EINVAL;
1551 }
1552
1553 return 0;
1554 }
1555
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1556 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1557 u32 freq)
1558 {
1559 struct ieee80211_channel *chan;
1560
1561 chan = ieee80211_get_channel_khz(wiphy, freq);
1562 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1563 return NULL;
1564 return chan;
1565 }
1566
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1567 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1568 {
1569 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1570 int i;
1571
1572 if (!nl_modes)
1573 goto nla_put_failure;
1574
1575 i = 0;
1576 while (ifmodes) {
1577 if ((ifmodes & 1) && nla_put_flag(msg, i))
1578 goto nla_put_failure;
1579 ifmodes >>= 1;
1580 i++;
1581 }
1582
1583 nla_nest_end(msg, nl_modes);
1584 return 0;
1585
1586 nla_put_failure:
1587 return -ENOBUFS;
1588 }
1589
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,bool large)1590 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1591 struct sk_buff *msg,
1592 bool large)
1593 {
1594 struct nlattr *nl_combis;
1595 int i, j;
1596
1597 nl_combis = nla_nest_start_noflag(msg,
1598 NL80211_ATTR_INTERFACE_COMBINATIONS);
1599 if (!nl_combis)
1600 goto nla_put_failure;
1601
1602 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1603 const struct ieee80211_iface_combination *c;
1604 struct nlattr *nl_combi, *nl_limits;
1605
1606 c = &wiphy->iface_combinations[i];
1607
1608 nl_combi = nla_nest_start_noflag(msg, i + 1);
1609 if (!nl_combi)
1610 goto nla_put_failure;
1611
1612 nl_limits = nla_nest_start_noflag(msg,
1613 NL80211_IFACE_COMB_LIMITS);
1614 if (!nl_limits)
1615 goto nla_put_failure;
1616
1617 for (j = 0; j < c->n_limits; j++) {
1618 struct nlattr *nl_limit;
1619
1620 nl_limit = nla_nest_start_noflag(msg, j + 1);
1621 if (!nl_limit)
1622 goto nla_put_failure;
1623 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1624 c->limits[j].max))
1625 goto nla_put_failure;
1626 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1627 c->limits[j].types))
1628 goto nla_put_failure;
1629 nla_nest_end(msg, nl_limit);
1630 }
1631
1632 nla_nest_end(msg, nl_limits);
1633
1634 if (c->beacon_int_infra_match &&
1635 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1636 goto nla_put_failure;
1637 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1638 c->num_different_channels) ||
1639 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1640 c->max_interfaces))
1641 goto nla_put_failure;
1642 if (large &&
1643 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1644 c->radar_detect_widths) ||
1645 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1646 c->radar_detect_regions)))
1647 goto nla_put_failure;
1648 if (c->beacon_int_min_gcd &&
1649 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1650 c->beacon_int_min_gcd))
1651 goto nla_put_failure;
1652
1653 nla_nest_end(msg, nl_combi);
1654 }
1655
1656 nla_nest_end(msg, nl_combis);
1657
1658 return 0;
1659 nla_put_failure:
1660 return -ENOBUFS;
1661 }
1662
1663 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1664 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1665 struct sk_buff *msg)
1666 {
1667 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1668 struct nlattr *nl_tcp;
1669
1670 if (!tcp)
1671 return 0;
1672
1673 nl_tcp = nla_nest_start_noflag(msg,
1674 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1675 if (!nl_tcp)
1676 return -ENOBUFS;
1677
1678 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1679 tcp->data_payload_max))
1680 return -ENOBUFS;
1681
1682 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1683 tcp->data_payload_max))
1684 return -ENOBUFS;
1685
1686 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1687 return -ENOBUFS;
1688
1689 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1690 sizeof(*tcp->tok), tcp->tok))
1691 return -ENOBUFS;
1692
1693 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1694 tcp->data_interval_max))
1695 return -ENOBUFS;
1696
1697 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1698 tcp->wake_payload_max))
1699 return -ENOBUFS;
1700
1701 nla_nest_end(msg, nl_tcp);
1702 return 0;
1703 }
1704
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1705 static int nl80211_send_wowlan(struct sk_buff *msg,
1706 struct cfg80211_registered_device *rdev,
1707 bool large)
1708 {
1709 struct nlattr *nl_wowlan;
1710
1711 if (!rdev->wiphy.wowlan)
1712 return 0;
1713
1714 nl_wowlan = nla_nest_start_noflag(msg,
1715 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1716 if (!nl_wowlan)
1717 return -ENOBUFS;
1718
1719 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1720 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1721 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1722 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1723 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1724 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1725 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1726 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1727 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1728 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1729 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1730 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1731 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1732 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1733 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1734 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1735 return -ENOBUFS;
1736
1737 if (rdev->wiphy.wowlan->n_patterns) {
1738 struct nl80211_pattern_support pat = {
1739 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1740 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1741 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1742 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1743 };
1744
1745 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1746 sizeof(pat), &pat))
1747 return -ENOBUFS;
1748 }
1749
1750 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1751 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1752 rdev->wiphy.wowlan->max_nd_match_sets))
1753 return -ENOBUFS;
1754
1755 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1756 return -ENOBUFS;
1757
1758 nla_nest_end(msg, nl_wowlan);
1759
1760 return 0;
1761 }
1762 #endif
1763
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1764 static int nl80211_send_coalesce(struct sk_buff *msg,
1765 struct cfg80211_registered_device *rdev)
1766 {
1767 struct nl80211_coalesce_rule_support rule;
1768
1769 if (!rdev->wiphy.coalesce)
1770 return 0;
1771
1772 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1773 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1774 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1775 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1776 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1777 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1778
1779 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1780 return -ENOBUFS;
1781
1782 return 0;
1783 }
1784
1785 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1786 nl80211_send_iftype_data(struct sk_buff *msg,
1787 const struct ieee80211_supported_band *sband,
1788 const struct ieee80211_sband_iftype_data *iftdata)
1789 {
1790 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1791 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1792
1793 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1794 iftdata->types_mask))
1795 return -ENOBUFS;
1796
1797 if (he_cap->has_he) {
1798 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1799 sizeof(he_cap->he_cap_elem.mac_cap_info),
1800 he_cap->he_cap_elem.mac_cap_info) ||
1801 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1802 sizeof(he_cap->he_cap_elem.phy_cap_info),
1803 he_cap->he_cap_elem.phy_cap_info) ||
1804 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1805 sizeof(he_cap->he_mcs_nss_supp),
1806 &he_cap->he_mcs_nss_supp) ||
1807 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1808 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1809 return -ENOBUFS;
1810 }
1811
1812 if (eht_cap->has_eht && he_cap->has_he) {
1813 u8 mcs_nss_size, ppe_thresh_size;
1814 u16 ppe_thres_hdr;
1815
1816 mcs_nss_size =
1817 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1818 &eht_cap->eht_cap_elem);
1819
1820 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1821 ppe_thresh_size =
1822 ieee80211_eht_ppe_size(ppe_thres_hdr,
1823 eht_cap->eht_cap_elem.phy_cap_info);
1824
1825 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1826 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1827 eht_cap->eht_cap_elem.mac_cap_info) ||
1828 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1829 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1830 eht_cap->eht_cap_elem.phy_cap_info) ||
1831 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1832 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1833 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1834 ppe_thresh_size, eht_cap->eht_ppe_thres))
1835 return -ENOBUFS;
1836 }
1837
1838 if (sband->band == NL80211_BAND_6GHZ &&
1839 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1840 sizeof(iftdata->he_6ghz_capa),
1841 &iftdata->he_6ghz_capa))
1842 return -ENOBUFS;
1843
1844 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1845 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1846 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1847 return -ENOBUFS;
1848
1849 return 0;
1850 }
1851
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)1852 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1853 struct ieee80211_supported_band *sband,
1854 bool large)
1855 {
1856 struct nlattr *nl_rates, *nl_rate;
1857 struct ieee80211_rate *rate;
1858 int i;
1859
1860 /* add HT info */
1861 if (sband->ht_cap.ht_supported &&
1862 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1863 sizeof(sband->ht_cap.mcs),
1864 &sband->ht_cap.mcs) ||
1865 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1866 sband->ht_cap.cap) ||
1867 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1868 sband->ht_cap.ampdu_factor) ||
1869 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1870 sband->ht_cap.ampdu_density)))
1871 return -ENOBUFS;
1872
1873 /* add VHT info */
1874 if (sband->vht_cap.vht_supported &&
1875 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1876 sizeof(sband->vht_cap.vht_mcs),
1877 &sband->vht_cap.vht_mcs) ||
1878 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1879 sband->vht_cap.cap)))
1880 return -ENOBUFS;
1881
1882 if (large && sband->n_iftype_data) {
1883 struct nlattr *nl_iftype_data =
1884 nla_nest_start_noflag(msg,
1885 NL80211_BAND_ATTR_IFTYPE_DATA);
1886 int err;
1887
1888 if (!nl_iftype_data)
1889 return -ENOBUFS;
1890
1891 for (i = 0; i < sband->n_iftype_data; i++) {
1892 struct nlattr *iftdata;
1893
1894 iftdata = nla_nest_start_noflag(msg, i + 1);
1895 if (!iftdata)
1896 return -ENOBUFS;
1897
1898 err = nl80211_send_iftype_data(msg, sband,
1899 &sband->iftype_data[i]);
1900 if (err)
1901 return err;
1902
1903 nla_nest_end(msg, iftdata);
1904 }
1905
1906 nla_nest_end(msg, nl_iftype_data);
1907 }
1908
1909 /* add EDMG info */
1910 if (large && sband->edmg_cap.channels &&
1911 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1912 sband->edmg_cap.channels) ||
1913 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1914 sband->edmg_cap.bw_config)))
1915
1916 return -ENOBUFS;
1917
1918 /* add bitrates */
1919 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1920 if (!nl_rates)
1921 return -ENOBUFS;
1922
1923 for (i = 0; i < sband->n_bitrates; i++) {
1924 nl_rate = nla_nest_start_noflag(msg, i);
1925 if (!nl_rate)
1926 return -ENOBUFS;
1927
1928 rate = &sband->bitrates[i];
1929 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1930 rate->bitrate))
1931 return -ENOBUFS;
1932 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1933 nla_put_flag(msg,
1934 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1935 return -ENOBUFS;
1936
1937 nla_nest_end(msg, nl_rate);
1938 }
1939
1940 nla_nest_end(msg, nl_rates);
1941
1942 return 0;
1943 }
1944
1945 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)1946 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1947 const struct ieee80211_txrx_stypes *mgmt_stypes)
1948 {
1949 u16 stypes;
1950 struct nlattr *nl_ftypes, *nl_ifs;
1951 enum nl80211_iftype ift;
1952 int i;
1953
1954 if (!mgmt_stypes)
1955 return 0;
1956
1957 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1958 if (!nl_ifs)
1959 return -ENOBUFS;
1960
1961 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1962 nl_ftypes = nla_nest_start_noflag(msg, ift);
1963 if (!nl_ftypes)
1964 return -ENOBUFS;
1965 i = 0;
1966 stypes = mgmt_stypes[ift].tx;
1967 while (stypes) {
1968 if ((stypes & 1) &&
1969 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1970 (i << 4) | IEEE80211_FTYPE_MGMT))
1971 return -ENOBUFS;
1972 stypes >>= 1;
1973 i++;
1974 }
1975 nla_nest_end(msg, nl_ftypes);
1976 }
1977
1978 nla_nest_end(msg, nl_ifs);
1979
1980 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1981 if (!nl_ifs)
1982 return -ENOBUFS;
1983
1984 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1985 nl_ftypes = nla_nest_start_noflag(msg, ift);
1986 if (!nl_ftypes)
1987 return -ENOBUFS;
1988 i = 0;
1989 stypes = mgmt_stypes[ift].rx;
1990 while (stypes) {
1991 if ((stypes & 1) &&
1992 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1993 (i << 4) | IEEE80211_FTYPE_MGMT))
1994 return -ENOBUFS;
1995 stypes >>= 1;
1996 i++;
1997 }
1998 nla_nest_end(msg, nl_ftypes);
1999 }
2000 nla_nest_end(msg, nl_ifs);
2001
2002 return 0;
2003 }
2004
2005 #define CMD(op, n) \
2006 do { \
2007 if (rdev->ops->op) { \
2008 i++; \
2009 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2010 goto nla_put_failure; \
2011 } \
2012 } while (0)
2013
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2014 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2015 struct sk_buff *msg)
2016 {
2017 int i = 0;
2018
2019 /*
2020 * do *NOT* add anything into this function, new things need to be
2021 * advertised only to new versions of userspace that can deal with
2022 * the split (and they can't possibly care about new features...
2023 */
2024 CMD(add_virtual_intf, NEW_INTERFACE);
2025 CMD(change_virtual_intf, SET_INTERFACE);
2026 CMD(add_key, NEW_KEY);
2027 CMD(start_ap, START_AP);
2028 CMD(add_station, NEW_STATION);
2029 CMD(add_mpath, NEW_MPATH);
2030 CMD(update_mesh_config, SET_MESH_CONFIG);
2031 CMD(change_bss, SET_BSS);
2032 CMD(auth, AUTHENTICATE);
2033 CMD(assoc, ASSOCIATE);
2034 CMD(deauth, DEAUTHENTICATE);
2035 CMD(disassoc, DISASSOCIATE);
2036 CMD(join_ibss, JOIN_IBSS);
2037 CMD(join_mesh, JOIN_MESH);
2038 CMD(set_pmksa, SET_PMKSA);
2039 CMD(del_pmksa, DEL_PMKSA);
2040 CMD(flush_pmksa, FLUSH_PMKSA);
2041 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2042 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2043 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2044 CMD(mgmt_tx, FRAME);
2045 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2046 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2047 i++;
2048 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2049 goto nla_put_failure;
2050 }
2051 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2052 rdev->ops->join_mesh) {
2053 i++;
2054 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2055 goto nla_put_failure;
2056 }
2057 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2058 CMD(tdls_mgmt, TDLS_MGMT);
2059 CMD(tdls_oper, TDLS_OPER);
2060 }
2061 if (rdev->wiphy.max_sched_scan_reqs)
2062 CMD(sched_scan_start, START_SCHED_SCAN);
2063 CMD(probe_client, PROBE_CLIENT);
2064 CMD(set_noack_map, SET_NOACK_MAP);
2065 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2066 i++;
2067 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2068 goto nla_put_failure;
2069 }
2070 CMD(start_p2p_device, START_P2P_DEVICE);
2071 CMD(set_mcast_rate, SET_MCAST_RATE);
2072 #ifdef CONFIG_NL80211_TESTMODE
2073 CMD(testmode_cmd, TESTMODE);
2074 #endif
2075
2076 if (rdev->ops->connect || rdev->ops->auth) {
2077 i++;
2078 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2079 goto nla_put_failure;
2080 }
2081
2082 if (rdev->ops->disconnect || rdev->ops->deauth) {
2083 i++;
2084 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2085 goto nla_put_failure;
2086 }
2087
2088 return i;
2089 nla_put_failure:
2090 return -ENOBUFS;
2091 }
2092
2093 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2094 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2095 struct sk_buff *msg)
2096 {
2097 struct nlattr *ftm;
2098
2099 if (!cap->ftm.supported)
2100 return 0;
2101
2102 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2103 if (!ftm)
2104 return -ENOBUFS;
2105
2106 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2107 return -ENOBUFS;
2108 if (cap->ftm.non_asap &&
2109 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2110 return -ENOBUFS;
2111 if (cap->ftm.request_lci &&
2112 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2113 return -ENOBUFS;
2114 if (cap->ftm.request_civicloc &&
2115 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2116 return -ENOBUFS;
2117 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2118 cap->ftm.preambles))
2119 return -ENOBUFS;
2120 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2121 cap->ftm.bandwidths))
2122 return -ENOBUFS;
2123 if (cap->ftm.max_bursts_exponent >= 0 &&
2124 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2125 cap->ftm.max_bursts_exponent))
2126 return -ENOBUFS;
2127 if (cap->ftm.max_ftms_per_burst &&
2128 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2129 cap->ftm.max_ftms_per_burst))
2130 return -ENOBUFS;
2131 if (cap->ftm.trigger_based &&
2132 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2133 return -ENOBUFS;
2134 if (cap->ftm.non_trigger_based &&
2135 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2136 return -ENOBUFS;
2137
2138 nla_nest_end(msg, ftm);
2139 return 0;
2140 }
2141
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2142 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2143 struct sk_buff *msg)
2144 {
2145 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2146 struct nlattr *pmsr, *caps;
2147
2148 if (!cap)
2149 return 0;
2150
2151 /*
2152 * we don't need to clean up anything here since the caller
2153 * will genlmsg_cancel() if we fail
2154 */
2155
2156 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2157 if (!pmsr)
2158 return -ENOBUFS;
2159
2160 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2161 return -ENOBUFS;
2162
2163 if (cap->report_ap_tsf &&
2164 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2165 return -ENOBUFS;
2166
2167 if (cap->randomize_mac_addr &&
2168 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2169 return -ENOBUFS;
2170
2171 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2172 if (!caps)
2173 return -ENOBUFS;
2174
2175 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2176 return -ENOBUFS;
2177
2178 nla_nest_end(msg, caps);
2179 nla_nest_end(msg, pmsr);
2180
2181 return 0;
2182 }
2183
2184 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2185 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2186 struct sk_buff *msg)
2187 {
2188 int i;
2189 struct nlattr *nested, *nested_akms;
2190 const struct wiphy_iftype_akm_suites *iftype_akms;
2191
2192 if (!rdev->wiphy.num_iftype_akm_suites ||
2193 !rdev->wiphy.iftype_akm_suites)
2194 return 0;
2195
2196 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2197 if (!nested)
2198 return -ENOBUFS;
2199
2200 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2201 nested_akms = nla_nest_start(msg, i + 1);
2202 if (!nested_akms)
2203 return -ENOBUFS;
2204
2205 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2206
2207 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2208 iftype_akms->iftypes_mask))
2209 return -ENOBUFS;
2210
2211 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2212 sizeof(u32) * iftype_akms->n_akm_suites,
2213 iftype_akms->akm_suites)) {
2214 return -ENOBUFS;
2215 }
2216 nla_nest_end(msg, nested_akms);
2217 }
2218
2219 nla_nest_end(msg, nested);
2220
2221 return 0;
2222 }
2223
2224 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2225 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2226 struct sk_buff *msg)
2227 {
2228 struct nlattr *supp;
2229
2230 if (!rdev->wiphy.tid_config_support.vif &&
2231 !rdev->wiphy.tid_config_support.peer)
2232 return 0;
2233
2234 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2235 if (!supp)
2236 return -ENOSPC;
2237
2238 if (rdev->wiphy.tid_config_support.vif &&
2239 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2240 rdev->wiphy.tid_config_support.vif,
2241 NL80211_TID_CONFIG_ATTR_PAD))
2242 goto fail;
2243
2244 if (rdev->wiphy.tid_config_support.peer &&
2245 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2246 rdev->wiphy.tid_config_support.peer,
2247 NL80211_TID_CONFIG_ATTR_PAD))
2248 goto fail;
2249
2250 /* for now we just use the same value ... makes more sense */
2251 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2252 rdev->wiphy.tid_config_support.max_retry))
2253 goto fail;
2254 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2255 rdev->wiphy.tid_config_support.max_retry))
2256 goto fail;
2257
2258 nla_nest_end(msg, supp);
2259
2260 return 0;
2261 fail:
2262 nla_nest_cancel(msg, supp);
2263 return -ENOBUFS;
2264 }
2265
2266 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2267 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2268 struct sk_buff *msg)
2269 {
2270 struct nlattr *sar_capa, *specs, *sub_freq_range;
2271 u8 num_freq_ranges;
2272 int i;
2273
2274 if (!rdev->wiphy.sar_capa)
2275 return 0;
2276
2277 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2278
2279 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2280 if (!sar_capa)
2281 return -ENOSPC;
2282
2283 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2284 goto fail;
2285
2286 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2287 if (!specs)
2288 goto fail;
2289
2290 /* report supported freq_ranges */
2291 for (i = 0; i < num_freq_ranges; i++) {
2292 sub_freq_range = nla_nest_start(msg, i + 1);
2293 if (!sub_freq_range)
2294 goto fail;
2295
2296 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2297 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2298 goto fail;
2299
2300 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2301 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2302 goto fail;
2303
2304 nla_nest_end(msg, sub_freq_range);
2305 }
2306
2307 nla_nest_end(msg, specs);
2308 nla_nest_end(msg, sar_capa);
2309
2310 return 0;
2311 fail:
2312 nla_nest_cancel(msg, sar_capa);
2313 return -ENOBUFS;
2314 }
2315
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2316 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2317 {
2318 struct nlattr *config;
2319
2320 if (!wiphy->mbssid_max_interfaces)
2321 return 0;
2322
2323 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2324 if (!config)
2325 return -ENOBUFS;
2326
2327 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2328 wiphy->mbssid_max_interfaces))
2329 goto fail;
2330
2331 if (wiphy->ema_max_profile_periodicity &&
2332 nla_put_u8(msg,
2333 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2334 wiphy->ema_max_profile_periodicity))
2335 goto fail;
2336
2337 nla_nest_end(msg, config);
2338 return 0;
2339
2340 fail:
2341 nla_nest_cancel(msg, config);
2342 return -ENOBUFS;
2343 }
2344
2345 struct nl80211_dump_wiphy_state {
2346 s64 filter_wiphy;
2347 long start;
2348 long split_start, band_start, chan_start, capa_start;
2349 bool split;
2350 };
2351
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2352 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2353 enum nl80211_commands cmd,
2354 struct sk_buff *msg, u32 portid, u32 seq,
2355 int flags, struct nl80211_dump_wiphy_state *state)
2356 {
2357 void *hdr;
2358 struct nlattr *nl_bands, *nl_band;
2359 struct nlattr *nl_freqs, *nl_freq;
2360 struct nlattr *nl_cmds;
2361 enum nl80211_band band;
2362 struct ieee80211_channel *chan;
2363 int i;
2364 const struct ieee80211_txrx_stypes *mgmt_stypes =
2365 rdev->wiphy.mgmt_stypes;
2366 u32 features;
2367
2368 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2369 if (!hdr)
2370 return -ENOBUFS;
2371
2372 if (WARN_ON(!state))
2373 return -EINVAL;
2374
2375 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2376 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2377 wiphy_name(&rdev->wiphy)) ||
2378 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2379 cfg80211_rdev_list_generation))
2380 goto nla_put_failure;
2381
2382 if (cmd != NL80211_CMD_NEW_WIPHY)
2383 goto finish;
2384
2385 switch (state->split_start) {
2386 case 0:
2387 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2388 rdev->wiphy.retry_short) ||
2389 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2390 rdev->wiphy.retry_long) ||
2391 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2392 rdev->wiphy.frag_threshold) ||
2393 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2394 rdev->wiphy.rts_threshold) ||
2395 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2396 rdev->wiphy.coverage_class) ||
2397 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2398 rdev->wiphy.max_scan_ssids) ||
2399 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2400 rdev->wiphy.max_sched_scan_ssids) ||
2401 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2402 rdev->wiphy.max_scan_ie_len) ||
2403 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2404 rdev->wiphy.max_sched_scan_ie_len) ||
2405 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2406 rdev->wiphy.max_match_sets))
2407 goto nla_put_failure;
2408
2409 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2410 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2411 goto nla_put_failure;
2412 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2413 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2414 goto nla_put_failure;
2415 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2416 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2417 goto nla_put_failure;
2418 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2419 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2420 goto nla_put_failure;
2421 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2422 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2423 goto nla_put_failure;
2424 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2425 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2426 goto nla_put_failure;
2427 state->split_start++;
2428 if (state->split)
2429 break;
2430 fallthrough;
2431 case 1:
2432 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2433 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2434 rdev->wiphy.cipher_suites))
2435 goto nla_put_failure;
2436
2437 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2438 rdev->wiphy.max_num_pmkids))
2439 goto nla_put_failure;
2440
2441 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2442 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2443 goto nla_put_failure;
2444
2445 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2446 rdev->wiphy.available_antennas_tx) ||
2447 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2448 rdev->wiphy.available_antennas_rx))
2449 goto nla_put_failure;
2450
2451 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2452 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2453 rdev->wiphy.probe_resp_offload))
2454 goto nla_put_failure;
2455
2456 if ((rdev->wiphy.available_antennas_tx ||
2457 rdev->wiphy.available_antennas_rx) &&
2458 rdev->ops->get_antenna) {
2459 u32 tx_ant = 0, rx_ant = 0;
2460 int res;
2461
2462 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2463 if (!res) {
2464 if (nla_put_u32(msg,
2465 NL80211_ATTR_WIPHY_ANTENNA_TX,
2466 tx_ant) ||
2467 nla_put_u32(msg,
2468 NL80211_ATTR_WIPHY_ANTENNA_RX,
2469 rx_ant))
2470 goto nla_put_failure;
2471 }
2472 }
2473
2474 state->split_start++;
2475 if (state->split)
2476 break;
2477 fallthrough;
2478 case 2:
2479 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2480 rdev->wiphy.interface_modes))
2481 goto nla_put_failure;
2482 state->split_start++;
2483 if (state->split)
2484 break;
2485 fallthrough;
2486 case 3:
2487 nl_bands = nla_nest_start_noflag(msg,
2488 NL80211_ATTR_WIPHY_BANDS);
2489 if (!nl_bands)
2490 goto nla_put_failure;
2491
2492 for (band = state->band_start;
2493 band < (state->split ?
2494 NUM_NL80211_BANDS :
2495 NL80211_BAND_60GHZ + 1);
2496 band++) {
2497 struct ieee80211_supported_band *sband;
2498
2499 /* omit higher bands for ancient software */
2500 if (band > NL80211_BAND_5GHZ && !state->split)
2501 break;
2502
2503 sband = rdev->wiphy.bands[band];
2504
2505 if (!sband)
2506 continue;
2507
2508 nl_band = nla_nest_start_noflag(msg, band);
2509 if (!nl_band)
2510 goto nla_put_failure;
2511
2512 switch (state->chan_start) {
2513 case 0:
2514 if (nl80211_send_band_rateinfo(msg, sband,
2515 state->split))
2516 goto nla_put_failure;
2517 state->chan_start++;
2518 if (state->split)
2519 break;
2520 fallthrough;
2521 default:
2522 /* add frequencies */
2523 nl_freqs = nla_nest_start_noflag(msg,
2524 NL80211_BAND_ATTR_FREQS);
2525 if (!nl_freqs)
2526 goto nla_put_failure;
2527
2528 for (i = state->chan_start - 1;
2529 i < sband->n_channels;
2530 i++) {
2531 nl_freq = nla_nest_start_noflag(msg,
2532 i);
2533 if (!nl_freq)
2534 goto nla_put_failure;
2535
2536 chan = &sband->channels[i];
2537
2538 if (nl80211_msg_put_channel(
2539 msg, &rdev->wiphy, chan,
2540 state->split))
2541 goto nla_put_failure;
2542
2543 nla_nest_end(msg, nl_freq);
2544 if (state->split)
2545 break;
2546 }
2547 if (i < sband->n_channels)
2548 state->chan_start = i + 2;
2549 else
2550 state->chan_start = 0;
2551 nla_nest_end(msg, nl_freqs);
2552 }
2553
2554 nla_nest_end(msg, nl_band);
2555
2556 if (state->split) {
2557 /* start again here */
2558 if (state->chan_start)
2559 band--;
2560 break;
2561 }
2562 }
2563 nla_nest_end(msg, nl_bands);
2564
2565 if (band < NUM_NL80211_BANDS)
2566 state->band_start = band + 1;
2567 else
2568 state->band_start = 0;
2569
2570 /* if bands & channels are done, continue outside */
2571 if (state->band_start == 0 && state->chan_start == 0)
2572 state->split_start++;
2573 if (state->split)
2574 break;
2575 fallthrough;
2576 case 4:
2577 nl_cmds = nla_nest_start_noflag(msg,
2578 NL80211_ATTR_SUPPORTED_COMMANDS);
2579 if (!nl_cmds)
2580 goto nla_put_failure;
2581
2582 i = nl80211_add_commands_unsplit(rdev, msg);
2583 if (i < 0)
2584 goto nla_put_failure;
2585 if (state->split) {
2586 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2587 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2588 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2589 CMD(channel_switch, CHANNEL_SWITCH);
2590 CMD(set_qos_map, SET_QOS_MAP);
2591 if (rdev->wiphy.features &
2592 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2593 CMD(add_tx_ts, ADD_TX_TS);
2594 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2595 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2596 CMD(update_ft_ies, UPDATE_FT_IES);
2597 if (rdev->wiphy.sar_capa)
2598 CMD(set_sar_specs, SET_SAR_SPECS);
2599 }
2600 #undef CMD
2601
2602 nla_nest_end(msg, nl_cmds);
2603 state->split_start++;
2604 if (state->split)
2605 break;
2606 fallthrough;
2607 case 5:
2608 if (rdev->ops->remain_on_channel &&
2609 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2610 nla_put_u32(msg,
2611 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2612 rdev->wiphy.max_remain_on_channel_duration))
2613 goto nla_put_failure;
2614
2615 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2616 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2617 goto nla_put_failure;
2618
2619 state->split_start++;
2620 if (state->split)
2621 break;
2622 fallthrough;
2623 case 6:
2624 #ifdef CONFIG_PM
2625 if (nl80211_send_wowlan(msg, rdev, state->split))
2626 goto nla_put_failure;
2627 state->split_start++;
2628 if (state->split)
2629 break;
2630 #else
2631 state->split_start++;
2632 #endif
2633 fallthrough;
2634 case 7:
2635 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2636 rdev->wiphy.software_iftypes))
2637 goto nla_put_failure;
2638
2639 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2640 state->split))
2641 goto nla_put_failure;
2642
2643 state->split_start++;
2644 if (state->split)
2645 break;
2646 fallthrough;
2647 case 8:
2648 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2649 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2650 rdev->wiphy.ap_sme_capa))
2651 goto nla_put_failure;
2652
2653 features = rdev->wiphy.features;
2654 /*
2655 * We can only add the per-channel limit information if the
2656 * dump is split, otherwise it makes it too big. Therefore
2657 * only advertise it in that case.
2658 */
2659 if (state->split)
2660 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2661 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2662 goto nla_put_failure;
2663
2664 if (rdev->wiphy.ht_capa_mod_mask &&
2665 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2666 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2667 rdev->wiphy.ht_capa_mod_mask))
2668 goto nla_put_failure;
2669
2670 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2671 rdev->wiphy.max_acl_mac_addrs &&
2672 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2673 rdev->wiphy.max_acl_mac_addrs))
2674 goto nla_put_failure;
2675
2676 /*
2677 * Any information below this point is only available to
2678 * applications that can deal with it being split. This
2679 * helps ensure that newly added capabilities don't break
2680 * older tools by overrunning their buffers.
2681 *
2682 * We still increment split_start so that in the split
2683 * case we'll continue with more data in the next round,
2684 * but break unconditionally so unsplit data stops here.
2685 */
2686 if (state->split)
2687 state->split_start++;
2688 else
2689 state->split_start = 0;
2690 break;
2691 case 9:
2692 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2693 goto nla_put_failure;
2694
2695 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2696 rdev->wiphy.max_sched_scan_plans) ||
2697 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2698 rdev->wiphy.max_sched_scan_plan_interval) ||
2699 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2700 rdev->wiphy.max_sched_scan_plan_iterations))
2701 goto nla_put_failure;
2702
2703 if (rdev->wiphy.extended_capabilities &&
2704 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2705 rdev->wiphy.extended_capabilities_len,
2706 rdev->wiphy.extended_capabilities) ||
2707 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2708 rdev->wiphy.extended_capabilities_len,
2709 rdev->wiphy.extended_capabilities_mask)))
2710 goto nla_put_failure;
2711
2712 if (rdev->wiphy.vht_capa_mod_mask &&
2713 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2714 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2715 rdev->wiphy.vht_capa_mod_mask))
2716 goto nla_put_failure;
2717
2718 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2719 rdev->wiphy.perm_addr))
2720 goto nla_put_failure;
2721
2722 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2723 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2724 rdev->wiphy.addr_mask))
2725 goto nla_put_failure;
2726
2727 if (rdev->wiphy.n_addresses > 1) {
2728 void *attr;
2729
2730 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2731 if (!attr)
2732 goto nla_put_failure;
2733
2734 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2735 if (nla_put(msg, i + 1, ETH_ALEN,
2736 rdev->wiphy.addresses[i].addr))
2737 goto nla_put_failure;
2738
2739 nla_nest_end(msg, attr);
2740 }
2741
2742 state->split_start++;
2743 break;
2744 case 10:
2745 if (nl80211_send_coalesce(msg, rdev))
2746 goto nla_put_failure;
2747
2748 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2749 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2750 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2751 goto nla_put_failure;
2752
2753 if (rdev->wiphy.max_ap_assoc_sta &&
2754 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2755 rdev->wiphy.max_ap_assoc_sta))
2756 goto nla_put_failure;
2757
2758 state->split_start++;
2759 break;
2760 case 11:
2761 if (rdev->wiphy.n_vendor_commands) {
2762 const struct nl80211_vendor_cmd_info *info;
2763 struct nlattr *nested;
2764
2765 nested = nla_nest_start_noflag(msg,
2766 NL80211_ATTR_VENDOR_DATA);
2767 if (!nested)
2768 goto nla_put_failure;
2769
2770 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2771 info = &rdev->wiphy.vendor_commands[i].info;
2772 if (nla_put(msg, i + 1, sizeof(*info), info))
2773 goto nla_put_failure;
2774 }
2775 nla_nest_end(msg, nested);
2776 }
2777
2778 if (rdev->wiphy.n_vendor_events) {
2779 const struct nl80211_vendor_cmd_info *info;
2780 struct nlattr *nested;
2781
2782 nested = nla_nest_start_noflag(msg,
2783 NL80211_ATTR_VENDOR_EVENTS);
2784 if (!nested)
2785 goto nla_put_failure;
2786
2787 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2788 info = &rdev->wiphy.vendor_events[i];
2789 if (nla_put(msg, i + 1, sizeof(*info), info))
2790 goto nla_put_failure;
2791 }
2792 nla_nest_end(msg, nested);
2793 }
2794 state->split_start++;
2795 break;
2796 case 12:
2797 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2798 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2799 rdev->wiphy.max_num_csa_counters))
2800 goto nla_put_failure;
2801
2802 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2803 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2804 goto nla_put_failure;
2805
2806 if (rdev->wiphy.max_sched_scan_reqs &&
2807 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2808 rdev->wiphy.max_sched_scan_reqs))
2809 goto nla_put_failure;
2810
2811 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2812 sizeof(rdev->wiphy.ext_features),
2813 rdev->wiphy.ext_features))
2814 goto nla_put_failure;
2815
2816 if (rdev->wiphy.bss_select_support) {
2817 struct nlattr *nested;
2818 u32 bss_select_support = rdev->wiphy.bss_select_support;
2819
2820 nested = nla_nest_start_noflag(msg,
2821 NL80211_ATTR_BSS_SELECT);
2822 if (!nested)
2823 goto nla_put_failure;
2824
2825 i = 0;
2826 while (bss_select_support) {
2827 if ((bss_select_support & 1) &&
2828 nla_put_flag(msg, i))
2829 goto nla_put_failure;
2830 i++;
2831 bss_select_support >>= 1;
2832 }
2833 nla_nest_end(msg, nested);
2834 }
2835
2836 state->split_start++;
2837 break;
2838 case 13:
2839 if (rdev->wiphy.num_iftype_ext_capab &&
2840 rdev->wiphy.iftype_ext_capab) {
2841 struct nlattr *nested_ext_capab, *nested;
2842
2843 nested = nla_nest_start_noflag(msg,
2844 NL80211_ATTR_IFTYPE_EXT_CAPA);
2845 if (!nested)
2846 goto nla_put_failure;
2847
2848 for (i = state->capa_start;
2849 i < rdev->wiphy.num_iftype_ext_capab; i++) {
2850 const struct wiphy_iftype_ext_capab *capab;
2851
2852 capab = &rdev->wiphy.iftype_ext_capab[i];
2853
2854 nested_ext_capab = nla_nest_start_noflag(msg,
2855 i);
2856 if (!nested_ext_capab ||
2857 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2858 capab->iftype) ||
2859 nla_put(msg, NL80211_ATTR_EXT_CAPA,
2860 capab->extended_capabilities_len,
2861 capab->extended_capabilities) ||
2862 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2863 capab->extended_capabilities_len,
2864 capab->extended_capabilities_mask))
2865 goto nla_put_failure;
2866
2867 nla_nest_end(msg, nested_ext_capab);
2868 if (state->split)
2869 break;
2870 }
2871 nla_nest_end(msg, nested);
2872 if (i < rdev->wiphy.num_iftype_ext_capab) {
2873 state->capa_start = i + 1;
2874 break;
2875 }
2876 }
2877
2878 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2879 rdev->wiphy.nan_supported_bands))
2880 goto nla_put_failure;
2881
2882 if (wiphy_ext_feature_isset(&rdev->wiphy,
2883 NL80211_EXT_FEATURE_TXQS)) {
2884 struct cfg80211_txq_stats txqstats = {};
2885 int res;
2886
2887 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2888 if (!res &&
2889 !nl80211_put_txq_stats(msg, &txqstats,
2890 NL80211_ATTR_TXQ_STATS))
2891 goto nla_put_failure;
2892
2893 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2894 rdev->wiphy.txq_limit))
2895 goto nla_put_failure;
2896 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2897 rdev->wiphy.txq_memory_limit))
2898 goto nla_put_failure;
2899 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2900 rdev->wiphy.txq_quantum))
2901 goto nla_put_failure;
2902 }
2903
2904 state->split_start++;
2905 break;
2906 case 14:
2907 if (nl80211_send_pmsr_capa(rdev, msg))
2908 goto nla_put_failure;
2909
2910 state->split_start++;
2911 break;
2912 case 15:
2913 if (rdev->wiphy.akm_suites &&
2914 nla_put(msg, NL80211_ATTR_AKM_SUITES,
2915 sizeof(u32) * rdev->wiphy.n_akm_suites,
2916 rdev->wiphy.akm_suites))
2917 goto nla_put_failure;
2918
2919 if (nl80211_put_iftype_akm_suites(rdev, msg))
2920 goto nla_put_failure;
2921
2922 if (nl80211_put_tid_config_support(rdev, msg))
2923 goto nla_put_failure;
2924 state->split_start++;
2925 break;
2926 case 16:
2927 if (nl80211_put_sar_specs(rdev, msg))
2928 goto nla_put_failure;
2929
2930 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2931 goto nla_put_failure;
2932
2933 /* done */
2934 state->split_start = 0;
2935 break;
2936 }
2937 finish:
2938 genlmsg_end(msg, hdr);
2939 return 0;
2940
2941 nla_put_failure:
2942 genlmsg_cancel(msg, hdr);
2943 return -EMSGSIZE;
2944 }
2945
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)2946 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2947 struct netlink_callback *cb,
2948 struct nl80211_dump_wiphy_state *state)
2949 {
2950 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2951 int ret;
2952
2953 if (!tb)
2954 return -ENOMEM;
2955
2956 ret = nlmsg_parse_deprecated(cb->nlh,
2957 GENL_HDRLEN + nl80211_fam.hdrsize,
2958 tb, nl80211_fam.maxattr,
2959 nl80211_policy, NULL);
2960 /* ignore parse errors for backward compatibility */
2961 if (ret) {
2962 ret = 0;
2963 goto out;
2964 }
2965
2966 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2967 if (tb[NL80211_ATTR_WIPHY])
2968 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2969 if (tb[NL80211_ATTR_WDEV])
2970 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2971 if (tb[NL80211_ATTR_IFINDEX]) {
2972 struct net_device *netdev;
2973 struct cfg80211_registered_device *rdev;
2974 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2975
2976 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2977 if (!netdev) {
2978 ret = -ENODEV;
2979 goto out;
2980 }
2981 if (netdev->ieee80211_ptr) {
2982 rdev = wiphy_to_rdev(
2983 netdev->ieee80211_ptr->wiphy);
2984 state->filter_wiphy = rdev->wiphy_idx;
2985 }
2986 }
2987
2988 ret = 0;
2989 out:
2990 kfree(tb);
2991 return ret;
2992 }
2993
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)2994 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2995 {
2996 int idx = 0, ret;
2997 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2998 struct cfg80211_registered_device *rdev;
2999
3000 rtnl_lock();
3001 if (!state) {
3002 state = kzalloc(sizeof(*state), GFP_KERNEL);
3003 if (!state) {
3004 rtnl_unlock();
3005 return -ENOMEM;
3006 }
3007 state->filter_wiphy = -1;
3008 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3009 if (ret) {
3010 kfree(state);
3011 rtnl_unlock();
3012 return ret;
3013 }
3014 cb->args[0] = (long)state;
3015 }
3016
3017 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3018 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3019 continue;
3020 if (++idx <= state->start)
3021 continue;
3022 if (state->filter_wiphy != -1 &&
3023 state->filter_wiphy != rdev->wiphy_idx)
3024 continue;
3025 /* attempt to fit multiple wiphy data chunks into the skb */
3026 do {
3027 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3028 skb,
3029 NETLINK_CB(cb->skb).portid,
3030 cb->nlh->nlmsg_seq,
3031 NLM_F_MULTI, state);
3032 if (ret < 0) {
3033 /*
3034 * If sending the wiphy data didn't fit (ENOBUFS
3035 * or EMSGSIZE returned), this SKB is still
3036 * empty (so it's not too big because another
3037 * wiphy dataset is already in the skb) and
3038 * we've not tried to adjust the dump allocation
3039 * yet ... then adjust the alloc size to be
3040 * bigger, and return 1 but with the empty skb.
3041 * This results in an empty message being RX'ed
3042 * in userspace, but that is ignored.
3043 *
3044 * We can then retry with the larger buffer.
3045 */
3046 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3047 !skb->len && !state->split &&
3048 cb->min_dump_alloc < 4096) {
3049 cb->min_dump_alloc = 4096;
3050 state->split_start = 0;
3051 rtnl_unlock();
3052 return 1;
3053 }
3054 idx--;
3055 break;
3056 }
3057 } while (state->split_start > 0);
3058 break;
3059 }
3060 rtnl_unlock();
3061
3062 state->start = idx;
3063
3064 return skb->len;
3065 }
3066
nl80211_dump_wiphy_done(struct netlink_callback * cb)3067 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3068 {
3069 kfree((void *)cb->args[0]);
3070 return 0;
3071 }
3072
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3073 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3074 {
3075 struct sk_buff *msg;
3076 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3077 struct nl80211_dump_wiphy_state state = {};
3078
3079 msg = nlmsg_new(4096, GFP_KERNEL);
3080 if (!msg)
3081 return -ENOMEM;
3082
3083 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3084 info->snd_portid, info->snd_seq, 0,
3085 &state) < 0) {
3086 nlmsg_free(msg);
3087 return -ENOBUFS;
3088 }
3089
3090 return genlmsg_reply(msg, info);
3091 }
3092
3093 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3094 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3095 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3096 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3097 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3098 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3099 };
3100
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3101 static int parse_txq_params(struct nlattr *tb[],
3102 struct ieee80211_txq_params *txq_params)
3103 {
3104 u8 ac;
3105
3106 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3107 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3108 !tb[NL80211_TXQ_ATTR_AIFS])
3109 return -EINVAL;
3110
3111 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3112 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3113 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3114 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3115 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3116
3117 if (ac >= NL80211_NUM_ACS)
3118 return -EINVAL;
3119 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3120 return 0;
3121 }
3122
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3123 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3124 {
3125 /*
3126 * You can only set the channel explicitly for some interfaces,
3127 * most have their channel managed via their respective
3128 * "establish a connection" command (connect, join, ...)
3129 *
3130 * For AP/GO and mesh mode, the channel can be set with the
3131 * channel userspace API, but is only stored and passed to the
3132 * low-level driver when the AP starts or the mesh is joined.
3133 * This is for backward compatibility, userspace can also give
3134 * the channel in the start-ap or join-mesh commands instead.
3135 *
3136 * Monitors are special as they are normally slaved to
3137 * whatever else is going on, so they have their own special
3138 * operation to set the monitor channel if possible.
3139 */
3140 return !wdev ||
3141 wdev->iftype == NL80211_IFTYPE_AP ||
3142 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3143 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3144 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3145 }
3146
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3147 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3148 struct genl_info *info,
3149 struct cfg80211_chan_def *chandef)
3150 {
3151 struct netlink_ext_ack *extack = info->extack;
3152 struct nlattr **attrs = info->attrs;
3153 u32 control_freq;
3154
3155 if (!attrs[NL80211_ATTR_WIPHY_FREQ])
3156 return -EINVAL;
3157
3158 control_freq = MHZ_TO_KHZ(
3159 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3160 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3161 control_freq +=
3162 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3163
3164 memset(chandef, 0, sizeof(*chandef));
3165 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3166 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3167 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3168 chandef->freq1_offset = control_freq % 1000;
3169 chandef->center_freq2 = 0;
3170
3171 /* Primary channel not allowed */
3172 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3173 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3174 "Channel is disabled");
3175 return -EINVAL;
3176 }
3177
3178 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3179 enum nl80211_channel_type chantype;
3180
3181 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3182
3183 switch (chantype) {
3184 case NL80211_CHAN_NO_HT:
3185 case NL80211_CHAN_HT20:
3186 case NL80211_CHAN_HT40PLUS:
3187 case NL80211_CHAN_HT40MINUS:
3188 cfg80211_chandef_create(chandef, chandef->chan,
3189 chantype);
3190 /* user input for center_freq is incorrect */
3191 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3192 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3193 NL_SET_ERR_MSG_ATTR(extack,
3194 attrs[NL80211_ATTR_CENTER_FREQ1],
3195 "bad center frequency 1");
3196 return -EINVAL;
3197 }
3198 /* center_freq2 must be zero */
3199 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3200 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3201 NL_SET_ERR_MSG_ATTR(extack,
3202 attrs[NL80211_ATTR_CENTER_FREQ2],
3203 "center frequency 2 can't be used");
3204 return -EINVAL;
3205 }
3206 break;
3207 default:
3208 NL_SET_ERR_MSG_ATTR(extack,
3209 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3210 "invalid channel type");
3211 return -EINVAL;
3212 }
3213 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3214 chandef->width =
3215 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3216 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3217 /* User input error for channel width doesn't match channel */
3218 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3219 NL_SET_ERR_MSG_ATTR(extack,
3220 attrs[NL80211_ATTR_CHANNEL_WIDTH],
3221 "bad channel width");
3222 return -EINVAL;
3223 }
3224 }
3225 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3226 chandef->center_freq1 =
3227 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3228 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3229 chandef->freq1_offset = nla_get_u32(
3230 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3231 else
3232 chandef->freq1_offset = 0;
3233 }
3234 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3235 chandef->center_freq2 =
3236 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3237 }
3238
3239 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3240 chandef->edmg.channels =
3241 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3242
3243 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3244 chandef->edmg.bw_config =
3245 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3246 } else {
3247 chandef->edmg.bw_config = 0;
3248 chandef->edmg.channels = 0;
3249 }
3250
3251 if (!cfg80211_chandef_valid(chandef)) {
3252 NL_SET_ERR_MSG(extack, "invalid channel definition");
3253 return -EINVAL;
3254 }
3255
3256 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3257 IEEE80211_CHAN_DISABLED)) {
3258 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3259 return -EINVAL;
3260 }
3261
3262 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3263 chandef->width == NL80211_CHAN_WIDTH_10) &&
3264 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3265 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3266 return -EINVAL;
3267 }
3268
3269 return 0;
3270 }
3271
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3272 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3273 struct net_device *dev,
3274 struct genl_info *info,
3275 int _link_id)
3276 {
3277 struct cfg80211_chan_def chandef;
3278 int result;
3279 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3280 struct wireless_dev *wdev = NULL;
3281 int link_id = _link_id;
3282
3283 if (dev)
3284 wdev = dev->ieee80211_ptr;
3285 if (!nl80211_can_set_dev_channel(wdev))
3286 return -EOPNOTSUPP;
3287 if (wdev)
3288 iftype = wdev->iftype;
3289
3290 if (link_id < 0) {
3291 if (wdev && wdev->valid_links)
3292 return -EINVAL;
3293 link_id = 0;
3294 }
3295
3296 result = nl80211_parse_chandef(rdev, info, &chandef);
3297 if (result)
3298 return result;
3299
3300 switch (iftype) {
3301 case NL80211_IFTYPE_AP:
3302 case NL80211_IFTYPE_P2P_GO:
3303 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3304 iftype))
3305 return -EINVAL;
3306 if (wdev->links[link_id].ap.beacon_interval) {
3307 struct ieee80211_channel *cur_chan;
3308
3309 if (!dev || !rdev->ops->set_ap_chanwidth ||
3310 !(rdev->wiphy.features &
3311 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3312 return -EBUSY;
3313
3314 /* Only allow dynamic channel width changes */
3315 cur_chan = wdev->links[link_id].ap.chandef.chan;
3316 if (chandef.chan != cur_chan)
3317 return -EBUSY;
3318
3319 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3320 &chandef);
3321 if (result)
3322 return result;
3323 wdev->links[link_id].ap.chandef = chandef;
3324 } else {
3325 wdev->u.ap.preset_chandef = chandef;
3326 }
3327 return 0;
3328 case NL80211_IFTYPE_MESH_POINT:
3329 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3330 case NL80211_IFTYPE_MONITOR:
3331 return cfg80211_set_monitor_channel(rdev, &chandef);
3332 default:
3333 break;
3334 }
3335
3336 return -EINVAL;
3337 }
3338
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3339 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3340 {
3341 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3342 int link_id = nl80211_link_id_or_invalid(info->attrs);
3343 struct net_device *netdev = info->user_ptr[1];
3344
3345 return __nl80211_set_channel(rdev, netdev, info, link_id);
3346 }
3347
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3348 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3349 {
3350 struct cfg80211_registered_device *rdev = NULL;
3351 struct net_device *netdev = NULL;
3352 struct wireless_dev *wdev;
3353 int result = 0, rem_txq_params = 0;
3354 struct nlattr *nl_txq_params;
3355 u32 changed;
3356 u8 retry_short = 0, retry_long = 0;
3357 u32 frag_threshold = 0, rts_threshold = 0;
3358 u8 coverage_class = 0;
3359 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3360
3361 rtnl_lock();
3362 /*
3363 * Try to find the wiphy and netdev. Normally this
3364 * function shouldn't need the netdev, but this is
3365 * done for backward compatibility -- previously
3366 * setting the channel was done per wiphy, but now
3367 * it is per netdev. Previous userland like hostapd
3368 * also passed a netdev to set_wiphy, so that it is
3369 * possible to let that go to the right netdev!
3370 */
3371
3372 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3373 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3374
3375 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3376 if (netdev && netdev->ieee80211_ptr)
3377 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3378 else
3379 netdev = NULL;
3380 }
3381
3382 if (!netdev) {
3383 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3384 info->attrs);
3385 if (IS_ERR(rdev)) {
3386 rtnl_unlock();
3387 return PTR_ERR(rdev);
3388 }
3389 wdev = NULL;
3390 netdev = NULL;
3391 result = 0;
3392 } else
3393 wdev = netdev->ieee80211_ptr;
3394
3395 wiphy_lock(&rdev->wiphy);
3396
3397 /*
3398 * end workaround code, by now the rdev is available
3399 * and locked, and wdev may or may not be NULL.
3400 */
3401
3402 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3403 result = cfg80211_dev_rename(
3404 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3405 rtnl_unlock();
3406
3407 if (result)
3408 goto out;
3409
3410 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3411 struct ieee80211_txq_params txq_params;
3412 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3413
3414 if (!rdev->ops->set_txq_params) {
3415 result = -EOPNOTSUPP;
3416 goto out;
3417 }
3418
3419 if (!netdev) {
3420 result = -EINVAL;
3421 goto out;
3422 }
3423
3424 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3425 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3426 result = -EINVAL;
3427 goto out;
3428 }
3429
3430 if (!netif_running(netdev)) {
3431 result = -ENETDOWN;
3432 goto out;
3433 }
3434
3435 nla_for_each_nested(nl_txq_params,
3436 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3437 rem_txq_params) {
3438 result = nla_parse_nested_deprecated(tb,
3439 NL80211_TXQ_ATTR_MAX,
3440 nl_txq_params,
3441 txq_params_policy,
3442 info->extack);
3443 if (result)
3444 goto out;
3445 result = parse_txq_params(tb, &txq_params);
3446 if (result)
3447 goto out;
3448
3449 result = rdev_set_txq_params(rdev, netdev,
3450 &txq_params);
3451 if (result)
3452 goto out;
3453 }
3454 }
3455
3456 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3457 result = __nl80211_set_channel(
3458 rdev,
3459 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3460 info, -1);
3461 if (result)
3462 goto out;
3463 }
3464
3465 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3466 struct wireless_dev *txp_wdev = wdev;
3467 enum nl80211_tx_power_setting type;
3468 int idx, mbm = 0;
3469
3470 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3471 txp_wdev = NULL;
3472
3473 if (!rdev->ops->set_tx_power) {
3474 result = -EOPNOTSUPP;
3475 goto out;
3476 }
3477
3478 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3479 type = nla_get_u32(info->attrs[idx]);
3480
3481 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3482 (type != NL80211_TX_POWER_AUTOMATIC)) {
3483 result = -EINVAL;
3484 goto out;
3485 }
3486
3487 if (type != NL80211_TX_POWER_AUTOMATIC) {
3488 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3489 mbm = nla_get_u32(info->attrs[idx]);
3490 }
3491
3492 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3493 if (result)
3494 goto out;
3495 }
3496
3497 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3498 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3499 u32 tx_ant, rx_ant;
3500
3501 if ((!rdev->wiphy.available_antennas_tx &&
3502 !rdev->wiphy.available_antennas_rx) ||
3503 !rdev->ops->set_antenna) {
3504 result = -EOPNOTSUPP;
3505 goto out;
3506 }
3507
3508 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3509 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3510
3511 /* reject antenna configurations which don't match the
3512 * available antenna masks, except for the "all" mask */
3513 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3514 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3515 result = -EINVAL;
3516 goto out;
3517 }
3518
3519 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3520 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3521
3522 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3523 if (result)
3524 goto out;
3525 }
3526
3527 changed = 0;
3528
3529 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3530 retry_short = nla_get_u8(
3531 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3532
3533 changed |= WIPHY_PARAM_RETRY_SHORT;
3534 }
3535
3536 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3537 retry_long = nla_get_u8(
3538 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3539
3540 changed |= WIPHY_PARAM_RETRY_LONG;
3541 }
3542
3543 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3544 frag_threshold = nla_get_u32(
3545 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3546 if (frag_threshold < 256) {
3547 result = -EINVAL;
3548 goto out;
3549 }
3550
3551 if (frag_threshold != (u32) -1) {
3552 /*
3553 * Fragments (apart from the last one) are required to
3554 * have even length. Make the fragmentation code
3555 * simpler by stripping LSB should someone try to use
3556 * odd threshold value.
3557 */
3558 frag_threshold &= ~0x1;
3559 }
3560 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3561 }
3562
3563 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3564 rts_threshold = nla_get_u32(
3565 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3566 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3567 }
3568
3569 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3570 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3571 result = -EINVAL;
3572 goto out;
3573 }
3574
3575 coverage_class = nla_get_u8(
3576 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3577 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3578 }
3579
3580 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3581 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3582 result = -EOPNOTSUPP;
3583 goto out;
3584 }
3585
3586 changed |= WIPHY_PARAM_DYN_ACK;
3587 }
3588
3589 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3590 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3591 NL80211_EXT_FEATURE_TXQS)) {
3592 result = -EOPNOTSUPP;
3593 goto out;
3594 }
3595 txq_limit = nla_get_u32(
3596 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3597 changed |= WIPHY_PARAM_TXQ_LIMIT;
3598 }
3599
3600 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3601 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3602 NL80211_EXT_FEATURE_TXQS)) {
3603 result = -EOPNOTSUPP;
3604 goto out;
3605 }
3606 txq_memory_limit = nla_get_u32(
3607 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3608 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3609 }
3610
3611 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3612 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3613 NL80211_EXT_FEATURE_TXQS)) {
3614 result = -EOPNOTSUPP;
3615 goto out;
3616 }
3617 txq_quantum = nla_get_u32(
3618 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3619 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3620 }
3621
3622 if (changed) {
3623 u8 old_retry_short, old_retry_long;
3624 u32 old_frag_threshold, old_rts_threshold;
3625 u8 old_coverage_class;
3626 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3627
3628 if (!rdev->ops->set_wiphy_params) {
3629 result = -EOPNOTSUPP;
3630 goto out;
3631 }
3632
3633 old_retry_short = rdev->wiphy.retry_short;
3634 old_retry_long = rdev->wiphy.retry_long;
3635 old_frag_threshold = rdev->wiphy.frag_threshold;
3636 old_rts_threshold = rdev->wiphy.rts_threshold;
3637 old_coverage_class = rdev->wiphy.coverage_class;
3638 old_txq_limit = rdev->wiphy.txq_limit;
3639 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3640 old_txq_quantum = rdev->wiphy.txq_quantum;
3641
3642 if (changed & WIPHY_PARAM_RETRY_SHORT)
3643 rdev->wiphy.retry_short = retry_short;
3644 if (changed & WIPHY_PARAM_RETRY_LONG)
3645 rdev->wiphy.retry_long = retry_long;
3646 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3647 rdev->wiphy.frag_threshold = frag_threshold;
3648 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3649 rdev->wiphy.rts_threshold = rts_threshold;
3650 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3651 rdev->wiphy.coverage_class = coverage_class;
3652 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3653 rdev->wiphy.txq_limit = txq_limit;
3654 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3655 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3656 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3657 rdev->wiphy.txq_quantum = txq_quantum;
3658
3659 result = rdev_set_wiphy_params(rdev, changed);
3660 if (result) {
3661 rdev->wiphy.retry_short = old_retry_short;
3662 rdev->wiphy.retry_long = old_retry_long;
3663 rdev->wiphy.frag_threshold = old_frag_threshold;
3664 rdev->wiphy.rts_threshold = old_rts_threshold;
3665 rdev->wiphy.coverage_class = old_coverage_class;
3666 rdev->wiphy.txq_limit = old_txq_limit;
3667 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3668 rdev->wiphy.txq_quantum = old_txq_quantum;
3669 goto out;
3670 }
3671 }
3672
3673 result = 0;
3674
3675 out:
3676 wiphy_unlock(&rdev->wiphy);
3677 return result;
3678 }
3679
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)3680 static int nl80211_send_chandef(struct sk_buff *msg,
3681 const struct cfg80211_chan_def *chandef)
3682 {
3683 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3684 return -EINVAL;
3685
3686 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3687 chandef->chan->center_freq))
3688 return -ENOBUFS;
3689 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3690 chandef->chan->freq_offset))
3691 return -ENOBUFS;
3692 switch (chandef->width) {
3693 case NL80211_CHAN_WIDTH_20_NOHT:
3694 case NL80211_CHAN_WIDTH_20:
3695 case NL80211_CHAN_WIDTH_40:
3696 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3697 cfg80211_get_chandef_type(chandef)))
3698 return -ENOBUFS;
3699 break;
3700 default:
3701 break;
3702 }
3703 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3704 return -ENOBUFS;
3705 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3706 return -ENOBUFS;
3707 if (chandef->center_freq2 &&
3708 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3709 return -ENOBUFS;
3710 return 0;
3711 }
3712
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)3713 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3714 struct cfg80211_registered_device *rdev,
3715 struct wireless_dev *wdev,
3716 enum nl80211_commands cmd)
3717 {
3718 struct net_device *dev = wdev->netdev;
3719 void *hdr;
3720
3721 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3722 cmd != NL80211_CMD_DEL_INTERFACE &&
3723 cmd != NL80211_CMD_SET_INTERFACE);
3724
3725 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3726 if (!hdr)
3727 return -1;
3728
3729 if (dev &&
3730 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3731 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3732 goto nla_put_failure;
3733
3734 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3735 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3736 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3737 NL80211_ATTR_PAD) ||
3738 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3739 nla_put_u32(msg, NL80211_ATTR_GENERATION,
3740 rdev->devlist_generation ^
3741 (cfg80211_rdev_list_generation << 2)) ||
3742 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3743 goto nla_put_failure;
3744
3745 if (rdev->ops->get_channel && !wdev->valid_links) {
3746 struct cfg80211_chan_def chandef = {};
3747 int ret;
3748
3749 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3750 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3751 goto nla_put_failure;
3752 }
3753
3754 if (rdev->ops->get_tx_power) {
3755 int dbm, ret;
3756
3757 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3758 if (ret == 0 &&
3759 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3760 DBM_TO_MBM(dbm)))
3761 goto nla_put_failure;
3762 }
3763
3764 wdev_lock(wdev);
3765 switch (wdev->iftype) {
3766 case NL80211_IFTYPE_AP:
3767 case NL80211_IFTYPE_P2P_GO:
3768 if (wdev->u.ap.ssid_len &&
3769 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3770 wdev->u.ap.ssid))
3771 goto nla_put_failure_locked;
3772 break;
3773 case NL80211_IFTYPE_STATION:
3774 case NL80211_IFTYPE_P2P_CLIENT:
3775 if (wdev->u.client.ssid_len &&
3776 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3777 wdev->u.client.ssid))
3778 goto nla_put_failure_locked;
3779 break;
3780 case NL80211_IFTYPE_ADHOC:
3781 if (wdev->u.ibss.ssid_len &&
3782 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3783 wdev->u.ibss.ssid))
3784 goto nla_put_failure_locked;
3785 break;
3786 default:
3787 /* nothing */
3788 break;
3789 }
3790 wdev_unlock(wdev);
3791
3792 if (rdev->ops->get_txq_stats) {
3793 struct cfg80211_txq_stats txqstats = {};
3794 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3795
3796 if (ret == 0 &&
3797 !nl80211_put_txq_stats(msg, &txqstats,
3798 NL80211_ATTR_TXQ_STATS))
3799 goto nla_put_failure;
3800 }
3801
3802 genlmsg_end(msg, hdr);
3803 return 0;
3804
3805 nla_put_failure_locked:
3806 wdev_unlock(wdev);
3807 nla_put_failure:
3808 genlmsg_cancel(msg, hdr);
3809 return -EMSGSIZE;
3810 }
3811
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)3812 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3813 {
3814 int wp_idx = 0;
3815 int if_idx = 0;
3816 int wp_start = cb->args[0];
3817 int if_start = cb->args[1];
3818 int filter_wiphy = -1;
3819 struct cfg80211_registered_device *rdev;
3820 struct wireless_dev *wdev;
3821 int ret;
3822
3823 rtnl_lock();
3824 if (!cb->args[2]) {
3825 struct nl80211_dump_wiphy_state state = {
3826 .filter_wiphy = -1,
3827 };
3828
3829 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3830 if (ret)
3831 goto out_unlock;
3832
3833 filter_wiphy = state.filter_wiphy;
3834
3835 /*
3836 * if filtering, set cb->args[2] to +1 since 0 is the default
3837 * value needed to determine that parsing is necessary.
3838 */
3839 if (filter_wiphy >= 0)
3840 cb->args[2] = filter_wiphy + 1;
3841 else
3842 cb->args[2] = -1;
3843 } else if (cb->args[2] > 0) {
3844 filter_wiphy = cb->args[2] - 1;
3845 }
3846
3847 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3848 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3849 continue;
3850 if (wp_idx < wp_start) {
3851 wp_idx++;
3852 continue;
3853 }
3854
3855 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3856 continue;
3857
3858 if_idx = 0;
3859
3860 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3861 if (if_idx < if_start) {
3862 if_idx++;
3863 continue;
3864 }
3865 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3866 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3867 rdev, wdev,
3868 NL80211_CMD_NEW_INTERFACE) < 0) {
3869 goto out;
3870 }
3871 if_idx++;
3872 }
3873
3874 wp_idx++;
3875 }
3876 out:
3877 cb->args[0] = wp_idx;
3878 cb->args[1] = if_idx;
3879
3880 ret = skb->len;
3881 out_unlock:
3882 rtnl_unlock();
3883
3884 return ret;
3885 }
3886
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)3887 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3888 {
3889 struct sk_buff *msg;
3890 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3891 struct wireless_dev *wdev = info->user_ptr[1];
3892
3893 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3894 if (!msg)
3895 return -ENOMEM;
3896
3897 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3898 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3899 nlmsg_free(msg);
3900 return -ENOBUFS;
3901 }
3902
3903 return genlmsg_reply(msg, info);
3904 }
3905
3906 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3907 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3908 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3909 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3910 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3911 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3912 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3913 };
3914
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)3915 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3916 {
3917 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3918 int flag;
3919
3920 *mntrflags = 0;
3921
3922 if (!nla)
3923 return -EINVAL;
3924
3925 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3926 return -EINVAL;
3927
3928 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3929 if (flags[flag])
3930 *mntrflags |= (1<<flag);
3931
3932 *mntrflags |= MONITOR_FLAG_CHANGED;
3933
3934 return 0;
3935 }
3936
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)3937 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3938 enum nl80211_iftype type,
3939 struct genl_info *info,
3940 struct vif_params *params)
3941 {
3942 bool change = false;
3943 int err;
3944
3945 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3946 if (type != NL80211_IFTYPE_MONITOR)
3947 return -EINVAL;
3948
3949 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3950 ¶ms->flags);
3951 if (err)
3952 return err;
3953
3954 change = true;
3955 }
3956
3957 if (params->flags & MONITOR_FLAG_ACTIVE &&
3958 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3959 return -EOPNOTSUPP;
3960
3961 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3962 const u8 *mumimo_groups;
3963 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3964
3965 if (type != NL80211_IFTYPE_MONITOR)
3966 return -EINVAL;
3967
3968 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3969 return -EOPNOTSUPP;
3970
3971 mumimo_groups =
3972 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3973
3974 /* bits 0 and 63 are reserved and must be zero */
3975 if ((mumimo_groups[0] & BIT(0)) ||
3976 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3977 return -EINVAL;
3978
3979 params->vht_mumimo_groups = mumimo_groups;
3980 change = true;
3981 }
3982
3983 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3984 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3985
3986 if (type != NL80211_IFTYPE_MONITOR)
3987 return -EINVAL;
3988
3989 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3990 return -EOPNOTSUPP;
3991
3992 params->vht_mumimo_follow_addr =
3993 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3994 change = true;
3995 }
3996
3997 return change ? 1 : 0;
3998 }
3999
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4000 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4001 struct net_device *netdev, u8 use_4addr,
4002 enum nl80211_iftype iftype)
4003 {
4004 if (!use_4addr) {
4005 if (netdev && netif_is_bridge_port(netdev))
4006 return -EBUSY;
4007 return 0;
4008 }
4009
4010 switch (iftype) {
4011 case NL80211_IFTYPE_AP_VLAN:
4012 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4013 return 0;
4014 break;
4015 case NL80211_IFTYPE_STATION:
4016 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4017 return 0;
4018 break;
4019 default:
4020 break;
4021 }
4022
4023 return -EOPNOTSUPP;
4024 }
4025
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4026 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4027 {
4028 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4029 struct vif_params params;
4030 int err;
4031 enum nl80211_iftype otype, ntype;
4032 struct net_device *dev = info->user_ptr[1];
4033 bool change = false;
4034
4035 memset(¶ms, 0, sizeof(params));
4036
4037 otype = ntype = dev->ieee80211_ptr->iftype;
4038
4039 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4040 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4041 if (otype != ntype)
4042 change = true;
4043 }
4044
4045 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4046 struct wireless_dev *wdev = dev->ieee80211_ptr;
4047
4048 if (ntype != NL80211_IFTYPE_MESH_POINT)
4049 return -EINVAL;
4050 if (netif_running(dev))
4051 return -EBUSY;
4052
4053 wdev_lock(wdev);
4054 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4055 IEEE80211_MAX_MESH_ID_LEN);
4056 wdev->u.mesh.id_up_len =
4057 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4058 memcpy(wdev->u.mesh.id,
4059 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4060 wdev->u.mesh.id_up_len);
4061 wdev_unlock(wdev);
4062 }
4063
4064 if (info->attrs[NL80211_ATTR_4ADDR]) {
4065 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4066 change = true;
4067 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4068 if (err)
4069 return err;
4070 } else {
4071 params.use_4addr = -1;
4072 }
4073
4074 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4075 if (err < 0)
4076 return err;
4077 if (err > 0)
4078 change = true;
4079
4080 if (change)
4081 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4082 else
4083 err = 0;
4084
4085 if (!err && params.use_4addr != -1)
4086 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4087
4088 if (change && !err) {
4089 struct wireless_dev *wdev = dev->ieee80211_ptr;
4090
4091 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4092 }
4093
4094 return err;
4095 }
4096
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4097 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4098 {
4099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4100 struct vif_params params;
4101 struct wireless_dev *wdev;
4102 struct sk_buff *msg;
4103 int err;
4104 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4105
4106 memset(¶ms, 0, sizeof(params));
4107
4108 if (!info->attrs[NL80211_ATTR_IFNAME])
4109 return -EINVAL;
4110
4111 if (info->attrs[NL80211_ATTR_IFTYPE])
4112 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4113
4114 if (!rdev->ops->add_virtual_intf)
4115 return -EOPNOTSUPP;
4116
4117 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4118 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4119 info->attrs[NL80211_ATTR_MAC]) {
4120 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4121 ETH_ALEN);
4122 if (!is_valid_ether_addr(params.macaddr))
4123 return -EADDRNOTAVAIL;
4124 }
4125
4126 if (info->attrs[NL80211_ATTR_4ADDR]) {
4127 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4128 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4129 if (err)
4130 return err;
4131 }
4132
4133 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4134 return -EOPNOTSUPP;
4135
4136 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4137 if (err < 0)
4138 return err;
4139
4140 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4141 if (!msg)
4142 return -ENOMEM;
4143
4144 wdev = rdev_add_virtual_intf(rdev,
4145 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4146 NET_NAME_USER, type, ¶ms);
4147 if (WARN_ON(!wdev)) {
4148 nlmsg_free(msg);
4149 return -EPROTO;
4150 } else if (IS_ERR(wdev)) {
4151 nlmsg_free(msg);
4152 return PTR_ERR(wdev);
4153 }
4154
4155 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4156 wdev->owner_nlportid = info->snd_portid;
4157
4158 switch (type) {
4159 case NL80211_IFTYPE_MESH_POINT:
4160 if (!info->attrs[NL80211_ATTR_MESH_ID])
4161 break;
4162 wdev_lock(wdev);
4163 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4164 IEEE80211_MAX_MESH_ID_LEN);
4165 wdev->u.mesh.id_up_len =
4166 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4167 memcpy(wdev->u.mesh.id,
4168 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4169 wdev->u.mesh.id_up_len);
4170 wdev_unlock(wdev);
4171 break;
4172 case NL80211_IFTYPE_NAN:
4173 case NL80211_IFTYPE_P2P_DEVICE:
4174 /*
4175 * P2P Device and NAN do not have a netdev, so don't go
4176 * through the netdev notifier and must be added here
4177 */
4178 cfg80211_init_wdev(wdev);
4179 cfg80211_register_wdev(rdev, wdev);
4180 break;
4181 default:
4182 break;
4183 }
4184
4185 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4186 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4187 nlmsg_free(msg);
4188 return -ENOBUFS;
4189 }
4190
4191 return genlmsg_reply(msg, info);
4192 }
4193
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4194 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4195 {
4196 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4197 int ret;
4198
4199 /* to avoid failing a new interface creation due to pending removal */
4200 cfg80211_destroy_ifaces(rdev);
4201
4202 wiphy_lock(&rdev->wiphy);
4203 ret = _nl80211_new_interface(skb, info);
4204 wiphy_unlock(&rdev->wiphy);
4205
4206 return ret;
4207 }
4208
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4209 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4210 {
4211 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4212 struct wireless_dev *wdev = info->user_ptr[1];
4213
4214 if (!rdev->ops->del_virtual_intf)
4215 return -EOPNOTSUPP;
4216
4217 /*
4218 * We hold RTNL, so this is safe, without RTNL opencount cannot
4219 * reach 0, and thus the rdev cannot be deleted.
4220 *
4221 * We need to do it for the dev_close(), since that will call
4222 * the netdev notifiers, and we need to acquire the mutex there
4223 * but don't know if we get there from here or from some other
4224 * place (e.g. "ip link set ... down").
4225 */
4226 mutex_unlock(&rdev->wiphy.mtx);
4227
4228 /*
4229 * If we remove a wireless device without a netdev then clear
4230 * user_ptr[1] so that nl80211_post_doit won't dereference it
4231 * to check if it needs to do dev_put(). Otherwise it crashes
4232 * since the wdev has been freed, unlike with a netdev where
4233 * we need the dev_put() for the netdev to really be freed.
4234 */
4235 if (!wdev->netdev)
4236 info->user_ptr[1] = NULL;
4237 else
4238 dev_close(wdev->netdev);
4239
4240 mutex_lock(&rdev->wiphy.mtx);
4241
4242 return rdev_del_virtual_intf(rdev, wdev);
4243 }
4244
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4245 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4246 {
4247 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4248 struct net_device *dev = info->user_ptr[1];
4249 u16 noack_map;
4250
4251 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4252 return -EINVAL;
4253
4254 if (!rdev->ops->set_noack_map)
4255 return -EOPNOTSUPP;
4256
4257 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4258
4259 return rdev_set_noack_map(rdev, dev, noack_map);
4260 }
4261
4262 struct get_key_cookie {
4263 struct sk_buff *msg;
4264 int error;
4265 int idx;
4266 };
4267
get_key_callback(void * c,struct key_params * params)4268 static void get_key_callback(void *c, struct key_params *params)
4269 {
4270 struct nlattr *key;
4271 struct get_key_cookie *cookie = c;
4272
4273 if ((params->key &&
4274 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4275 params->key_len, params->key)) ||
4276 (params->seq &&
4277 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4278 params->seq_len, params->seq)) ||
4279 (params->cipher &&
4280 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4281 params->cipher)))
4282 goto nla_put_failure;
4283
4284 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4285 if (!key)
4286 goto nla_put_failure;
4287
4288 if ((params->key &&
4289 nla_put(cookie->msg, NL80211_KEY_DATA,
4290 params->key_len, params->key)) ||
4291 (params->seq &&
4292 nla_put(cookie->msg, NL80211_KEY_SEQ,
4293 params->seq_len, params->seq)) ||
4294 (params->cipher &&
4295 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4296 params->cipher)))
4297 goto nla_put_failure;
4298
4299 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4300 goto nla_put_failure;
4301
4302 nla_nest_end(cookie->msg, key);
4303
4304 return;
4305 nla_put_failure:
4306 cookie->error = 1;
4307 }
4308
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4309 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4310 {
4311 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4312 int err;
4313 struct net_device *dev = info->user_ptr[1];
4314 u8 key_idx = 0;
4315 const u8 *mac_addr = NULL;
4316 bool pairwise;
4317 struct get_key_cookie cookie = {
4318 .error = 0,
4319 };
4320 void *hdr;
4321 struct sk_buff *msg;
4322 bool bigtk_support = false;
4323
4324 if (wiphy_ext_feature_isset(&rdev->wiphy,
4325 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4326 bigtk_support = true;
4327
4328 if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4329 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4330 wiphy_ext_feature_isset(&rdev->wiphy,
4331 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4332 bigtk_support = true;
4333
4334 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4335 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4336
4337 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4338 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4339 return -EINVAL;
4340 }
4341 }
4342
4343 if (info->attrs[NL80211_ATTR_MAC])
4344 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4345
4346 pairwise = !!mac_addr;
4347 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4348 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4349
4350 if (kt != NL80211_KEYTYPE_GROUP &&
4351 kt != NL80211_KEYTYPE_PAIRWISE)
4352 return -EINVAL;
4353 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4354 }
4355
4356 if (!rdev->ops->get_key)
4357 return -EOPNOTSUPP;
4358
4359 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4360 return -ENOENT;
4361
4362 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4363 if (!msg)
4364 return -ENOMEM;
4365
4366 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4367 NL80211_CMD_NEW_KEY);
4368 if (!hdr)
4369 goto nla_put_failure;
4370
4371 cookie.msg = msg;
4372 cookie.idx = key_idx;
4373
4374 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4375 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4376 goto nla_put_failure;
4377 if (mac_addr &&
4378 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4379 goto nla_put_failure;
4380
4381 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4382 get_key_callback);
4383
4384 if (err)
4385 goto free_msg;
4386
4387 if (cookie.error)
4388 goto nla_put_failure;
4389
4390 genlmsg_end(msg, hdr);
4391 return genlmsg_reply(msg, info);
4392
4393 nla_put_failure:
4394 err = -ENOBUFS;
4395 free_msg:
4396 nlmsg_free(msg);
4397 return err;
4398 }
4399
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4400 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4401 {
4402 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4403 struct key_parse key;
4404 int err;
4405 struct net_device *dev = info->user_ptr[1];
4406
4407 err = nl80211_parse_key(info, &key);
4408 if (err)
4409 return err;
4410
4411 if (key.idx < 0)
4412 return -EINVAL;
4413
4414 /* Only support setting default key and
4415 * Extended Key ID action NL80211_KEY_SET_TX.
4416 */
4417 if (!key.def && !key.defmgmt && !key.defbeacon &&
4418 !(key.p.mode == NL80211_KEY_SET_TX))
4419 return -EINVAL;
4420
4421 wdev_lock(dev->ieee80211_ptr);
4422
4423 if (key.def) {
4424 if (!rdev->ops->set_default_key) {
4425 err = -EOPNOTSUPP;
4426 goto out;
4427 }
4428
4429 err = nl80211_key_allowed(dev->ieee80211_ptr);
4430 if (err)
4431 goto out;
4432
4433 err = rdev_set_default_key(rdev, dev, key.idx,
4434 key.def_uni, key.def_multi);
4435
4436 if (err)
4437 goto out;
4438
4439 #ifdef CONFIG_CFG80211_WEXT
4440 dev->ieee80211_ptr->wext.default_key = key.idx;
4441 #endif
4442 } else if (key.defmgmt) {
4443 if (key.def_uni || !key.def_multi) {
4444 err = -EINVAL;
4445 goto out;
4446 }
4447
4448 if (!rdev->ops->set_default_mgmt_key) {
4449 err = -EOPNOTSUPP;
4450 goto out;
4451 }
4452
4453 err = nl80211_key_allowed(dev->ieee80211_ptr);
4454 if (err)
4455 goto out;
4456
4457 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4458 if (err)
4459 goto out;
4460
4461 #ifdef CONFIG_CFG80211_WEXT
4462 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4463 #endif
4464 } else if (key.defbeacon) {
4465 if (key.def_uni || !key.def_multi) {
4466 err = -EINVAL;
4467 goto out;
4468 }
4469
4470 if (!rdev->ops->set_default_beacon_key) {
4471 err = -EOPNOTSUPP;
4472 goto out;
4473 }
4474
4475 err = nl80211_key_allowed(dev->ieee80211_ptr);
4476 if (err)
4477 goto out;
4478
4479 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4480 if (err)
4481 goto out;
4482 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4483 wiphy_ext_feature_isset(&rdev->wiphy,
4484 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4485 u8 *mac_addr = NULL;
4486
4487 if (info->attrs[NL80211_ATTR_MAC])
4488 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4489
4490 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4491 err = -EINVAL;
4492 goto out;
4493 }
4494
4495 err = rdev_add_key(rdev, dev, key.idx,
4496 NL80211_KEYTYPE_PAIRWISE,
4497 mac_addr, &key.p);
4498 } else {
4499 err = -EINVAL;
4500 }
4501 out:
4502 wdev_unlock(dev->ieee80211_ptr);
4503
4504 return err;
4505 }
4506
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)4507 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4508 {
4509 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4510 int err;
4511 struct net_device *dev = info->user_ptr[1];
4512 struct key_parse key;
4513 const u8 *mac_addr = NULL;
4514
4515 err = nl80211_parse_key(info, &key);
4516 if (err)
4517 return err;
4518
4519 if (!key.p.key) {
4520 GENL_SET_ERR_MSG(info, "no key");
4521 return -EINVAL;
4522 }
4523
4524 if (info->attrs[NL80211_ATTR_MAC])
4525 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4526
4527 if (key.type == -1) {
4528 if (mac_addr)
4529 key.type = NL80211_KEYTYPE_PAIRWISE;
4530 else
4531 key.type = NL80211_KEYTYPE_GROUP;
4532 }
4533
4534 /* for now */
4535 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4536 key.type != NL80211_KEYTYPE_GROUP) {
4537 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4538 return -EINVAL;
4539 }
4540
4541 if (key.type == NL80211_KEYTYPE_GROUP &&
4542 info->attrs[NL80211_ATTR_VLAN_ID])
4543 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4544
4545 if (!rdev->ops->add_key)
4546 return -EOPNOTSUPP;
4547
4548 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4549 key.type == NL80211_KEYTYPE_PAIRWISE,
4550 mac_addr)) {
4551 GENL_SET_ERR_MSG(info, "key setting validation failed");
4552 return -EINVAL;
4553 }
4554
4555 wdev_lock(dev->ieee80211_ptr);
4556 err = nl80211_key_allowed(dev->ieee80211_ptr);
4557 if (err)
4558 GENL_SET_ERR_MSG(info, "key not allowed");
4559 if (!err) {
4560 err = rdev_add_key(rdev, dev, key.idx,
4561 key.type == NL80211_KEYTYPE_PAIRWISE,
4562 mac_addr, &key.p);
4563 if (err)
4564 GENL_SET_ERR_MSG(info, "key addition failed");
4565 }
4566 wdev_unlock(dev->ieee80211_ptr);
4567
4568 return err;
4569 }
4570
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)4571 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4572 {
4573 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4574 int err;
4575 struct net_device *dev = info->user_ptr[1];
4576 u8 *mac_addr = NULL;
4577 struct key_parse key;
4578
4579 err = nl80211_parse_key(info, &key);
4580 if (err)
4581 return err;
4582
4583 if (info->attrs[NL80211_ATTR_MAC])
4584 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4585
4586 if (key.type == -1) {
4587 if (mac_addr)
4588 key.type = NL80211_KEYTYPE_PAIRWISE;
4589 else
4590 key.type = NL80211_KEYTYPE_GROUP;
4591 }
4592
4593 /* for now */
4594 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4595 key.type != NL80211_KEYTYPE_GROUP)
4596 return -EINVAL;
4597
4598 if (!cfg80211_valid_key_idx(rdev, key.idx,
4599 key.type == NL80211_KEYTYPE_PAIRWISE))
4600 return -EINVAL;
4601
4602 if (!rdev->ops->del_key)
4603 return -EOPNOTSUPP;
4604
4605 wdev_lock(dev->ieee80211_ptr);
4606 err = nl80211_key_allowed(dev->ieee80211_ptr);
4607
4608 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4609 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4610 err = -ENOENT;
4611
4612 if (!err)
4613 err = rdev_del_key(rdev, dev, key.idx,
4614 key.type == NL80211_KEYTYPE_PAIRWISE,
4615 mac_addr);
4616
4617 #ifdef CONFIG_CFG80211_WEXT
4618 if (!err) {
4619 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4620 dev->ieee80211_ptr->wext.default_key = -1;
4621 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4622 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4623 }
4624 #endif
4625 wdev_unlock(dev->ieee80211_ptr);
4626
4627 return err;
4628 }
4629
4630 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)4631 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4632 {
4633 struct nlattr *attr;
4634 int n_entries = 0, tmp;
4635
4636 nla_for_each_nested(attr, nl_attr, tmp) {
4637 if (nla_len(attr) != ETH_ALEN)
4638 return -EINVAL;
4639
4640 n_entries++;
4641 }
4642
4643 return n_entries;
4644 }
4645
4646 /*
4647 * This function parses ACL information and allocates memory for ACL data.
4648 * On successful return, the calling function is responsible to free the
4649 * ACL buffer returned by this function.
4650 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)4651 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4652 struct genl_info *info)
4653 {
4654 enum nl80211_acl_policy acl_policy;
4655 struct nlattr *attr;
4656 struct cfg80211_acl_data *acl;
4657 int i = 0, n_entries, tmp;
4658
4659 if (!wiphy->max_acl_mac_addrs)
4660 return ERR_PTR(-EOPNOTSUPP);
4661
4662 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4663 return ERR_PTR(-EINVAL);
4664
4665 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4666 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4667 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4668 return ERR_PTR(-EINVAL);
4669
4670 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4671 return ERR_PTR(-EINVAL);
4672
4673 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4674 if (n_entries < 0)
4675 return ERR_PTR(n_entries);
4676
4677 if (n_entries > wiphy->max_acl_mac_addrs)
4678 return ERR_PTR(-ENOTSUPP);
4679
4680 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4681 if (!acl)
4682 return ERR_PTR(-ENOMEM);
4683
4684 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4685 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4686 i++;
4687 }
4688
4689 acl->n_acl_entries = n_entries;
4690 acl->acl_policy = acl_policy;
4691
4692 return acl;
4693 }
4694
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)4695 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4696 {
4697 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4698 struct net_device *dev = info->user_ptr[1];
4699 struct cfg80211_acl_data *acl;
4700 int err;
4701
4702 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4703 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4704 return -EOPNOTSUPP;
4705
4706 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4707 return -EINVAL;
4708
4709 acl = parse_acl_data(&rdev->wiphy, info);
4710 if (IS_ERR(acl))
4711 return PTR_ERR(acl);
4712
4713 err = rdev_set_mac_acl(rdev, dev, acl);
4714
4715 kfree(acl);
4716
4717 return err;
4718 }
4719
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)4720 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4721 u8 *rates, u8 rates_len)
4722 {
4723 u8 i;
4724 u32 mask = 0;
4725
4726 for (i = 0; i < rates_len; i++) {
4727 int rate = (rates[i] & 0x7f) * 5;
4728 int ridx;
4729
4730 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4731 struct ieee80211_rate *srate =
4732 &sband->bitrates[ridx];
4733 if (rate == srate->bitrate) {
4734 mask |= 1 << ridx;
4735 break;
4736 }
4737 }
4738 if (ridx == sband->n_bitrates)
4739 return 0; /* rate not found */
4740 }
4741
4742 return mask;
4743 }
4744
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])4745 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4746 u8 *rates, u8 rates_len,
4747 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4748 {
4749 u8 i;
4750
4751 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4752
4753 for (i = 0; i < rates_len; i++) {
4754 int ridx, rbit;
4755
4756 ridx = rates[i] / 8;
4757 rbit = BIT(rates[i] % 8);
4758
4759 /* check validity */
4760 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4761 return false;
4762
4763 /* check availability */
4764 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4765 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4766 mcs[ridx] |= rbit;
4767 else
4768 return false;
4769 }
4770
4771 return true;
4772 }
4773
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)4774 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4775 {
4776 u16 mcs_mask = 0;
4777
4778 switch (vht_mcs_map) {
4779 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4780 break;
4781 case IEEE80211_VHT_MCS_SUPPORT_0_7:
4782 mcs_mask = 0x00FF;
4783 break;
4784 case IEEE80211_VHT_MCS_SUPPORT_0_8:
4785 mcs_mask = 0x01FF;
4786 break;
4787 case IEEE80211_VHT_MCS_SUPPORT_0_9:
4788 mcs_mask = 0x03FF;
4789 break;
4790 default:
4791 break;
4792 }
4793
4794 return mcs_mask;
4795 }
4796
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])4797 static void vht_build_mcs_mask(u16 vht_mcs_map,
4798 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4799 {
4800 u8 nss;
4801
4802 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4803 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4804 vht_mcs_map >>= 2;
4805 }
4806 }
4807
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])4808 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4809 struct nl80211_txrate_vht *txrate,
4810 u16 mcs[NL80211_VHT_NSS_MAX])
4811 {
4812 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4813 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4814 u8 i;
4815
4816 if (!sband->vht_cap.vht_supported)
4817 return false;
4818
4819 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4820
4821 /* Build vht_mcs_mask from VHT capabilities */
4822 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4823
4824 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4825 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4826 mcs[i] = txrate->mcs[i];
4827 else
4828 return false;
4829 }
4830
4831 return true;
4832 }
4833
he_mcs_map_to_mcs_mask(u8 he_mcs_map)4834 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4835 {
4836 switch (he_mcs_map) {
4837 case IEEE80211_HE_MCS_NOT_SUPPORTED:
4838 return 0;
4839 case IEEE80211_HE_MCS_SUPPORT_0_7:
4840 return 0x00FF;
4841 case IEEE80211_HE_MCS_SUPPORT_0_9:
4842 return 0x03FF;
4843 case IEEE80211_HE_MCS_SUPPORT_0_11:
4844 return 0xFFF;
4845 default:
4846 break;
4847 }
4848 return 0;
4849 }
4850
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])4851 static void he_build_mcs_mask(u16 he_mcs_map,
4852 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4853 {
4854 u8 nss;
4855
4856 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4857 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4858 he_mcs_map >>= 2;
4859 }
4860 }
4861
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)4862 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
4863 const struct ieee80211_sta_he_cap *he_cap)
4864 {
4865 struct net_device *dev = info->user_ptr[1];
4866 struct wireless_dev *wdev = dev->ieee80211_ptr;
4867 struct cfg80211_chan_def *chandef;
4868 __le16 tx_mcs;
4869
4870 chandef = wdev_chandef(wdev, link_id);
4871 if (!chandef) {
4872 /*
4873 * This is probably broken, but we never maintained
4874 * a chandef in these cases, so it always was.
4875 */
4876 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
4877 }
4878
4879 switch (chandef->width) {
4880 case NL80211_CHAN_WIDTH_80P80:
4881 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4882 break;
4883 case NL80211_CHAN_WIDTH_160:
4884 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4885 break;
4886 default:
4887 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4888 break;
4889 }
4890
4891 return le16_to_cpu(tx_mcs);
4892 }
4893
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)4894 static bool he_set_mcs_mask(struct genl_info *info,
4895 struct wireless_dev *wdev,
4896 struct ieee80211_supported_band *sband,
4897 struct nl80211_txrate_he *txrate,
4898 u16 mcs[NL80211_HE_NSS_MAX],
4899 unsigned int link_id)
4900 {
4901 const struct ieee80211_sta_he_cap *he_cap;
4902 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4903 u16 tx_mcs_map = 0;
4904 u8 i;
4905
4906 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4907 if (!he_cap)
4908 return false;
4909
4910 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4911
4912 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
4913
4914 /* Build he_mcs_mask from HE capabilities */
4915 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4916
4917 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4918 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4919 mcs[i] = txrate->mcs[i];
4920 else
4921 return false;
4922 }
4923
4924 return true;
4925 }
4926
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)4927 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4928 struct nlattr *attrs[],
4929 enum nl80211_attrs attr,
4930 struct cfg80211_bitrate_mask *mask,
4931 struct net_device *dev,
4932 bool default_all_enabled,
4933 unsigned int link_id)
4934 {
4935 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4936 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4937 struct wireless_dev *wdev = dev->ieee80211_ptr;
4938 int rem, i;
4939 struct nlattr *tx_rates;
4940 struct ieee80211_supported_band *sband;
4941 u16 vht_tx_mcs_map, he_tx_mcs_map;
4942
4943 memset(mask, 0, sizeof(*mask));
4944 /* Default to all rates enabled */
4945 for (i = 0; i < NUM_NL80211_BANDS; i++) {
4946 const struct ieee80211_sta_he_cap *he_cap;
4947
4948 if (!default_all_enabled)
4949 break;
4950
4951 sband = rdev->wiphy.bands[i];
4952
4953 if (!sband)
4954 continue;
4955
4956 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4957 memcpy(mask->control[i].ht_mcs,
4958 sband->ht_cap.mcs.rx_mask,
4959 sizeof(mask->control[i].ht_mcs));
4960
4961 if (sband->vht_cap.vht_supported) {
4962 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4963 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4964 }
4965
4966 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4967 if (!he_cap)
4968 continue;
4969
4970 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
4971 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4972
4973 mask->control[i].he_gi = 0xFF;
4974 mask->control[i].he_ltf = 0xFF;
4975 }
4976
4977 /* if no rates are given set it back to the defaults */
4978 if (!attrs[attr])
4979 goto out;
4980
4981 /* The nested attribute uses enum nl80211_band as the index. This maps
4982 * directly to the enum nl80211_band values used in cfg80211.
4983 */
4984 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4985 nla_for_each_nested(tx_rates, attrs[attr], rem) {
4986 enum nl80211_band band = nla_type(tx_rates);
4987 int err;
4988
4989 if (band < 0 || band >= NUM_NL80211_BANDS)
4990 return -EINVAL;
4991 sband = rdev->wiphy.bands[band];
4992 if (sband == NULL)
4993 return -EINVAL;
4994 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4995 tx_rates,
4996 nl80211_txattr_policy,
4997 info->extack);
4998 if (err)
4999 return err;
5000 if (tb[NL80211_TXRATE_LEGACY]) {
5001 mask->control[band].legacy = rateset_to_mask(
5002 sband,
5003 nla_data(tb[NL80211_TXRATE_LEGACY]),
5004 nla_len(tb[NL80211_TXRATE_LEGACY]));
5005 if ((mask->control[band].legacy == 0) &&
5006 nla_len(tb[NL80211_TXRATE_LEGACY]))
5007 return -EINVAL;
5008 }
5009 if (tb[NL80211_TXRATE_HT]) {
5010 if (!ht_rateset_to_mask(
5011 sband,
5012 nla_data(tb[NL80211_TXRATE_HT]),
5013 nla_len(tb[NL80211_TXRATE_HT]),
5014 mask->control[band].ht_mcs))
5015 return -EINVAL;
5016 }
5017
5018 if (tb[NL80211_TXRATE_VHT]) {
5019 if (!vht_set_mcs_mask(
5020 sband,
5021 nla_data(tb[NL80211_TXRATE_VHT]),
5022 mask->control[band].vht_mcs))
5023 return -EINVAL;
5024 }
5025
5026 if (tb[NL80211_TXRATE_GI]) {
5027 mask->control[band].gi =
5028 nla_get_u8(tb[NL80211_TXRATE_GI]);
5029 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5030 return -EINVAL;
5031 }
5032 if (tb[NL80211_TXRATE_HE] &&
5033 !he_set_mcs_mask(info, wdev, sband,
5034 nla_data(tb[NL80211_TXRATE_HE]),
5035 mask->control[band].he_mcs,
5036 link_id))
5037 return -EINVAL;
5038
5039 if (tb[NL80211_TXRATE_HE_GI])
5040 mask->control[band].he_gi =
5041 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5042 if (tb[NL80211_TXRATE_HE_LTF])
5043 mask->control[band].he_ltf =
5044 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5045
5046 if (mask->control[band].legacy == 0) {
5047 /* don't allow empty legacy rates if HT, VHT or HE
5048 * are not even supported.
5049 */
5050 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5051 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5052 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5053 return -EINVAL;
5054
5055 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5056 if (mask->control[band].ht_mcs[i])
5057 goto out;
5058
5059 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5060 if (mask->control[band].vht_mcs[i])
5061 goto out;
5062
5063 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5064 if (mask->control[band].he_mcs[i])
5065 goto out;
5066
5067 /* legacy and mcs rates may not be both empty */
5068 return -EINVAL;
5069 }
5070 }
5071
5072 out:
5073 return 0;
5074 }
5075
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5076 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5077 enum nl80211_band band,
5078 struct cfg80211_bitrate_mask *beacon_rate)
5079 {
5080 u32 count_ht, count_vht, count_he, i;
5081 u32 rate = beacon_rate->control[band].legacy;
5082
5083 /* Allow only one rate */
5084 if (hweight32(rate) > 1)
5085 return -EINVAL;
5086
5087 count_ht = 0;
5088 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5089 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5090 return -EINVAL;
5091 } else if (beacon_rate->control[band].ht_mcs[i]) {
5092 count_ht++;
5093 if (count_ht > 1)
5094 return -EINVAL;
5095 }
5096 if (count_ht && rate)
5097 return -EINVAL;
5098 }
5099
5100 count_vht = 0;
5101 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5102 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5103 return -EINVAL;
5104 } else if (beacon_rate->control[band].vht_mcs[i]) {
5105 count_vht++;
5106 if (count_vht > 1)
5107 return -EINVAL;
5108 }
5109 if (count_vht && rate)
5110 return -EINVAL;
5111 }
5112
5113 count_he = 0;
5114 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5115 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5116 return -EINVAL;
5117 } else if (beacon_rate->control[band].he_mcs[i]) {
5118 count_he++;
5119 if (count_he > 1)
5120 return -EINVAL;
5121 }
5122 if (count_he && rate)
5123 return -EINVAL;
5124 }
5125
5126 if ((count_ht && count_vht && count_he) ||
5127 (!rate && !count_ht && !count_vht && !count_he))
5128 return -EINVAL;
5129
5130 if (rate &&
5131 !wiphy_ext_feature_isset(&rdev->wiphy,
5132 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5133 return -EINVAL;
5134 if (count_ht &&
5135 !wiphy_ext_feature_isset(&rdev->wiphy,
5136 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5137 return -EINVAL;
5138 if (count_vht &&
5139 !wiphy_ext_feature_isset(&rdev->wiphy,
5140 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5141 return -EINVAL;
5142 if (count_he &&
5143 !wiphy_ext_feature_isset(&rdev->wiphy,
5144 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5145 return -EINVAL;
5146
5147 return 0;
5148 }
5149
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5150 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5151 struct net_device *dev,
5152 struct nlattr *attrs,
5153 struct cfg80211_mbssid_config *config,
5154 u8 num_elems)
5155 {
5156 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5157
5158 if (!wiphy->mbssid_max_interfaces)
5159 return -EOPNOTSUPP;
5160
5161 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5162 NULL) ||
5163 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5164 return -EINVAL;
5165
5166 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5167 if (config->ema) {
5168 if (!wiphy->ema_max_profile_periodicity)
5169 return -EOPNOTSUPP;
5170
5171 if (num_elems > wiphy->ema_max_profile_periodicity)
5172 return -EINVAL;
5173 }
5174
5175 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5176 if (config->index >= wiphy->mbssid_max_interfaces ||
5177 (!config->index && !num_elems))
5178 return -EINVAL;
5179
5180 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5181 u32 tx_ifindex =
5182 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5183
5184 if ((!config->index && tx_ifindex != dev->ifindex) ||
5185 (config->index && tx_ifindex == dev->ifindex))
5186 return -EINVAL;
5187
5188 if (tx_ifindex != dev->ifindex) {
5189 struct net_device *tx_netdev =
5190 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5191
5192 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5193 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5194 tx_netdev->ieee80211_ptr->iftype !=
5195 NL80211_IFTYPE_AP) {
5196 dev_put(tx_netdev);
5197 return -EINVAL;
5198 }
5199
5200 config->tx_wdev = tx_netdev->ieee80211_ptr;
5201 } else {
5202 config->tx_wdev = dev->ieee80211_ptr;
5203 }
5204 } else if (!config->index) {
5205 config->tx_wdev = dev->ieee80211_ptr;
5206 } else {
5207 return -EINVAL;
5208 }
5209
5210 return 0;
5211 }
5212
5213 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)5214 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5215 {
5216 struct nlattr *nl_elems;
5217 struct cfg80211_mbssid_elems *elems;
5218 int rem_elems;
5219 u8 i = 0, num_elems = 0;
5220
5221 if (!wiphy->mbssid_max_interfaces)
5222 return ERR_PTR(-EINVAL);
5223
5224 nla_for_each_nested(nl_elems, attrs, rem_elems)
5225 num_elems++;
5226
5227 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5228 if (!elems)
5229 return ERR_PTR(-ENOMEM);
5230
5231 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5232 elems->elem[i].data = nla_data(nl_elems);
5233 elems->elem[i].len = nla_len(nl_elems);
5234 i++;
5235 }
5236 elems->cnt = num_elems;
5237 return elems;
5238 }
5239
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)5240 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5241 struct cfg80211_he_bss_color *he_bss_color)
5242 {
5243 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5244 int err;
5245
5246 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5247 he_bss_color_policy, NULL);
5248 if (err)
5249 return err;
5250
5251 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5252 return -EINVAL;
5253
5254 he_bss_color->color =
5255 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5256 he_bss_color->enabled =
5257 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5258 he_bss_color->partial =
5259 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5260
5261 return 0;
5262 }
5263
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn)5264 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5265 struct nlattr *attrs[],
5266 struct cfg80211_beacon_data *bcn)
5267 {
5268 bool haveinfo = false;
5269 int err;
5270
5271 memset(bcn, 0, sizeof(*bcn));
5272
5273 bcn->link_id = nl80211_link_id(attrs);
5274
5275 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5276 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5277 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5278 if (!bcn->head_len)
5279 return -EINVAL;
5280 haveinfo = true;
5281 }
5282
5283 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5284 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5285 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5286 haveinfo = true;
5287 }
5288
5289 if (!haveinfo)
5290 return -EINVAL;
5291
5292 if (attrs[NL80211_ATTR_IE]) {
5293 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5294 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5295 }
5296
5297 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5298 bcn->proberesp_ies =
5299 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5300 bcn->proberesp_ies_len =
5301 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5302 }
5303
5304 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5305 bcn->assocresp_ies =
5306 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5307 bcn->assocresp_ies_len =
5308 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5309 }
5310
5311 if (attrs[NL80211_ATTR_PROBE_RESP]) {
5312 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5313 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5314 }
5315
5316 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5317 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5318
5319 err = nla_parse_nested_deprecated(tb,
5320 NL80211_FTM_RESP_ATTR_MAX,
5321 attrs[NL80211_ATTR_FTM_RESPONDER],
5322 NULL, NULL);
5323 if (err)
5324 return err;
5325
5326 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5327 wiphy_ext_feature_isset(&rdev->wiphy,
5328 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5329 bcn->ftm_responder = 1;
5330 else
5331 return -EOPNOTSUPP;
5332
5333 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5334 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5335 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5336 }
5337
5338 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5339 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5340 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5341 }
5342 } else {
5343 bcn->ftm_responder = -1;
5344 }
5345
5346 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5347 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5348 &bcn->he_bss_color);
5349 if (err)
5350 return err;
5351 bcn->he_bss_color_valid = true;
5352 }
5353
5354 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5355 struct cfg80211_mbssid_elems *mbssid =
5356 nl80211_parse_mbssid_elems(&rdev->wiphy,
5357 attrs[NL80211_ATTR_MBSSID_ELEMS]);
5358
5359 if (IS_ERR(mbssid))
5360 return PTR_ERR(mbssid);
5361
5362 bcn->mbssid_ies = mbssid;
5363 }
5364
5365 return 0;
5366 }
5367
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)5368 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5369 struct ieee80211_he_obss_pd *he_obss_pd)
5370 {
5371 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5372 int err;
5373
5374 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5375 he_obss_pd_policy, NULL);
5376 if (err)
5377 return err;
5378
5379 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5380 return -EINVAL;
5381
5382 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5383
5384 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5385 he_obss_pd->min_offset =
5386 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5387 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5388 he_obss_pd->max_offset =
5389 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5390 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5391 he_obss_pd->non_srg_max_offset =
5392 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5393
5394 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5395 return -EINVAL;
5396
5397 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5398 memcpy(he_obss_pd->bss_color_bitmap,
5399 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5400 sizeof(he_obss_pd->bss_color_bitmap));
5401
5402 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5403 memcpy(he_obss_pd->partial_bssid_bitmap,
5404 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5405 sizeof(he_obss_pd->partial_bssid_bitmap));
5406
5407 he_obss_pd->enable = true;
5408
5409 return 0;
5410 }
5411
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)5412 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5413 struct nlattr *attrs,
5414 struct cfg80211_ap_settings *params)
5415 {
5416 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5417 int ret;
5418 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery;
5419
5420 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5421 NL80211_EXT_FEATURE_FILS_DISCOVERY))
5422 return -EINVAL;
5423
5424 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5425 NULL, NULL);
5426 if (ret)
5427 return ret;
5428
5429 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5430 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5431 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5432 return -EINVAL;
5433
5434 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5435 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5436 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5437 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5438
5439 return 0;
5440 }
5441
5442 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)5443 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5444 struct nlattr *attrs,
5445 struct cfg80211_ap_settings *params)
5446 {
5447 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5448 int ret;
5449 struct cfg80211_unsol_bcast_probe_resp *presp =
5450 ¶ms->unsol_bcast_probe_resp;
5451
5452 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5453 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5454 return -EINVAL;
5455
5456 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5457 attrs, NULL, NULL);
5458 if (ret)
5459 return ret;
5460
5461 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5462 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5463 return -EINVAL;
5464
5465 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5466 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5467 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5468 return 0;
5469 }
5470
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)5471 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5472 const struct element *rates)
5473 {
5474 int i;
5475
5476 if (!rates)
5477 return;
5478
5479 for (i = 0; i < rates->datalen; i++) {
5480 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5481 params->ht_required = true;
5482 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5483 params->vht_required = true;
5484 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5485 params->he_required = true;
5486 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5487 params->sae_h2e_required = true;
5488 }
5489 }
5490
5491 /*
5492 * Since the nl80211 API didn't include, from the beginning, attributes about
5493 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5494 * benefit of drivers that rebuild IEs in the firmware.
5495 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)5496 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5497 {
5498 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
5499 size_t ies_len = bcn->tail_len;
5500 const u8 *ies = bcn->tail;
5501 const struct element *rates;
5502 const struct element *cap;
5503
5504 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5505 nl80211_check_ap_rate_selectors(params, rates);
5506
5507 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5508 nl80211_check_ap_rate_selectors(params, rates);
5509
5510 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5511 if (cap && cap->datalen >= sizeof(*params->ht_cap))
5512 params->ht_cap = (void *)cap->data;
5513 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5514 if (cap && cap->datalen >= sizeof(*params->vht_cap))
5515 params->vht_cap = (void *)cap->data;
5516 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5517 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5518 params->he_cap = (void *)(cap->data + 1);
5519 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5520 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5521 params->he_oper = (void *)(cap->data + 1);
5522 }
5523
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)5524 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5525 struct cfg80211_ap_settings *params)
5526 {
5527 struct wireless_dev *wdev;
5528
5529 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5530 if (wdev->iftype != NL80211_IFTYPE_AP &&
5531 wdev->iftype != NL80211_IFTYPE_P2P_GO)
5532 continue;
5533
5534 if (!wdev->u.ap.preset_chandef.chan)
5535 continue;
5536
5537 params->chandef = wdev->u.ap.preset_chandef;
5538 return true;
5539 }
5540
5541 return false;
5542 }
5543
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)5544 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5545 enum nl80211_auth_type auth_type,
5546 enum nl80211_commands cmd)
5547 {
5548 if (auth_type > NL80211_AUTHTYPE_MAX)
5549 return false;
5550
5551 switch (cmd) {
5552 case NL80211_CMD_AUTHENTICATE:
5553 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5554 auth_type == NL80211_AUTHTYPE_SAE)
5555 return false;
5556 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5557 NL80211_EXT_FEATURE_FILS_STA) &&
5558 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5559 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5560 auth_type == NL80211_AUTHTYPE_FILS_PK))
5561 return false;
5562 return true;
5563 case NL80211_CMD_CONNECT:
5564 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5565 !wiphy_ext_feature_isset(&rdev->wiphy,
5566 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5567 auth_type == NL80211_AUTHTYPE_SAE)
5568 return false;
5569
5570 /* FILS with SK PFS or PK not supported yet */
5571 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5572 auth_type == NL80211_AUTHTYPE_FILS_PK)
5573 return false;
5574 if (!wiphy_ext_feature_isset(
5575 &rdev->wiphy,
5576 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5577 auth_type == NL80211_AUTHTYPE_FILS_SK)
5578 return false;
5579 return true;
5580 case NL80211_CMD_START_AP:
5581 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5582 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5583 auth_type == NL80211_AUTHTYPE_SAE)
5584 return false;
5585 /* FILS not supported yet */
5586 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5587 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5588 auth_type == NL80211_AUTHTYPE_FILS_PK)
5589 return false;
5590 return true;
5591 default:
5592 return false;
5593 }
5594 }
5595
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)5596 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5597 {
5598 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5599 unsigned int link_id = nl80211_link_id(info->attrs);
5600 struct net_device *dev = info->user_ptr[1];
5601 struct wireless_dev *wdev = dev->ieee80211_ptr;
5602 struct cfg80211_ap_settings *params;
5603 int err;
5604
5605 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5606 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5607 return -EOPNOTSUPP;
5608
5609 if (!rdev->ops->start_ap)
5610 return -EOPNOTSUPP;
5611
5612 if (wdev->links[link_id].ap.beacon_interval)
5613 return -EALREADY;
5614
5615 /* these are required for START_AP */
5616 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5617 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5618 !info->attrs[NL80211_ATTR_BEACON_HEAD])
5619 return -EINVAL;
5620
5621 params = kzalloc(sizeof(*params), GFP_KERNEL);
5622 if (!params)
5623 return -ENOMEM;
5624
5625 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon);
5626 if (err)
5627 goto out;
5628
5629 params->beacon_interval =
5630 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5631 params->dtim_period =
5632 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5633
5634 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5635 params->beacon_interval);
5636 if (err)
5637 goto out;
5638
5639 /*
5640 * In theory, some of these attributes should be required here
5641 * but since they were not used when the command was originally
5642 * added, keep them optional for old user space programs to let
5643 * them continue to work with drivers that do not need the
5644 * additional information -- drivers must check!
5645 */
5646 if (info->attrs[NL80211_ATTR_SSID]) {
5647 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5648 params->ssid_len =
5649 nla_len(info->attrs[NL80211_ATTR_SSID]);
5650 if (params->ssid_len == 0) {
5651 err = -EINVAL;
5652 goto out;
5653 }
5654
5655 if (wdev->u.ap.ssid_len &&
5656 (wdev->u.ap.ssid_len != params->ssid_len ||
5657 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5658 /* require identical SSID for MLO */
5659 err = -EINVAL;
5660 goto out;
5661 }
5662 } else if (wdev->valid_links) {
5663 /* require SSID for MLO */
5664 err = -EINVAL;
5665 goto out;
5666 }
5667
5668 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5669 params->hidden_ssid = nla_get_u32(
5670 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5671
5672 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5673
5674 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5675 params->auth_type = nla_get_u32(
5676 info->attrs[NL80211_ATTR_AUTH_TYPE]);
5677 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5678 NL80211_CMD_START_AP)) {
5679 err = -EINVAL;
5680 goto out;
5681 }
5682 } else
5683 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5684
5685 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
5686 NL80211_MAX_NR_CIPHER_SUITES);
5687 if (err)
5688 goto out;
5689
5690 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5691 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
5692 err = -EOPNOTSUPP;
5693 goto out;
5694 }
5695 params->inactivity_timeout = nla_get_u16(
5696 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5697 }
5698
5699 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5700 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5701 err = -EINVAL;
5702 goto out;
5703 }
5704 params->p2p_ctwindow =
5705 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5706 if (params->p2p_ctwindow != 0 &&
5707 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
5708 err = -EINVAL;
5709 goto out;
5710 }
5711 }
5712
5713 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5714 u8 tmp;
5715
5716 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5717 err = -EINVAL;
5718 goto out;
5719 }
5720 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5721 params->p2p_opp_ps = tmp;
5722 if (params->p2p_opp_ps != 0 &&
5723 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
5724 err = -EINVAL;
5725 goto out;
5726 }
5727 }
5728
5729 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5730 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
5731 if (err)
5732 goto out;
5733 } else if (wdev->valid_links) {
5734 /* with MLD need to specify the channel configuration */
5735 err = -EINVAL;
5736 goto out;
5737 } else if (wdev->u.ap.preset_chandef.chan) {
5738 params->chandef = wdev->u.ap.preset_chandef;
5739 } else if (!nl80211_get_ap_channel(rdev, params)) {
5740 err = -EINVAL;
5741 goto out;
5742 }
5743
5744 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms->chandef,
5745 wdev->iftype)) {
5746 err = -EINVAL;
5747 goto out;
5748 }
5749
5750 wdev_lock(wdev);
5751
5752 if (info->attrs[NL80211_ATTR_TX_RATES]) {
5753 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5754 NL80211_ATTR_TX_RATES,
5755 ¶ms->beacon_rate,
5756 dev, false, link_id);
5757 if (err)
5758 goto out_unlock;
5759
5760 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
5761 ¶ms->beacon_rate);
5762 if (err)
5763 goto out_unlock;
5764 }
5765
5766 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5767 params->smps_mode =
5768 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5769 switch (params->smps_mode) {
5770 case NL80211_SMPS_OFF:
5771 break;
5772 case NL80211_SMPS_STATIC:
5773 if (!(rdev->wiphy.features &
5774 NL80211_FEATURE_STATIC_SMPS)) {
5775 err = -EINVAL;
5776 goto out_unlock;
5777 }
5778 break;
5779 case NL80211_SMPS_DYNAMIC:
5780 if (!(rdev->wiphy.features &
5781 NL80211_FEATURE_DYNAMIC_SMPS)) {
5782 err = -EINVAL;
5783 goto out_unlock;
5784 }
5785 break;
5786 default:
5787 err = -EINVAL;
5788 goto out_unlock;
5789 }
5790 } else {
5791 params->smps_mode = NL80211_SMPS_OFF;
5792 }
5793
5794 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5795 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
5796 err = -EOPNOTSUPP;
5797 goto out_unlock;
5798 }
5799
5800 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5801 params->acl = parse_acl_data(&rdev->wiphy, info);
5802 if (IS_ERR(params->acl)) {
5803 err = PTR_ERR(params->acl);
5804 params->acl = NULL;
5805 goto out_unlock;
5806 }
5807 }
5808
5809 params->twt_responder =
5810 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5811
5812 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5813 err = nl80211_parse_he_obss_pd(
5814 info->attrs[NL80211_ATTR_HE_OBSS_PD],
5815 ¶ms->he_obss_pd);
5816 if (err)
5817 goto out_unlock;
5818 }
5819
5820 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5821 err = nl80211_parse_fils_discovery(rdev,
5822 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5823 params);
5824 if (err)
5825 goto out_unlock;
5826 }
5827
5828 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5829 err = nl80211_parse_unsol_bcast_probe_resp(
5830 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5831 params);
5832 if (err)
5833 goto out_unlock;
5834 }
5835
5836 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
5837 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
5838 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
5839 ¶ms->mbssid_config,
5840 params->beacon.mbssid_ies ?
5841 params->beacon.mbssid_ies->cnt :
5842 0);
5843 if (err)
5844 goto out_unlock;
5845 }
5846
5847 nl80211_calculate_ap_params(params);
5848
5849 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
5850 params->flags = nla_get_u32(
5851 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
5852 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5853 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5854
5855 if (wdev->conn_owner_nlportid &&
5856 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
5857 wdev->conn_owner_nlportid != info->snd_portid) {
5858 err = -EINVAL;
5859 goto out_unlock;
5860 }
5861
5862 /* FIXME: validate MLO/link-id against driver capabilities */
5863
5864 err = rdev_start_ap(rdev, dev, params);
5865 if (!err) {
5866 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
5867 wdev->links[link_id].ap.chandef = params->chandef;
5868 wdev->u.ap.ssid_len = params->ssid_len;
5869 memcpy(wdev->u.ap.ssid, params->ssid,
5870 params->ssid_len);
5871
5872 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5873 wdev->conn_owner_nlportid = info->snd_portid;
5874 }
5875 out_unlock:
5876 wdev_unlock(wdev);
5877 out:
5878 kfree(params->acl);
5879 kfree(params->beacon.mbssid_ies);
5880 if (params->mbssid_config.tx_wdev &&
5881 params->mbssid_config.tx_wdev->netdev &&
5882 params->mbssid_config.tx_wdev->netdev != dev)
5883 dev_put(params->mbssid_config.tx_wdev->netdev);
5884 kfree(params);
5885
5886 return err;
5887 }
5888
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)5889 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5890 {
5891 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5892 unsigned int link_id = nl80211_link_id(info->attrs);
5893 struct net_device *dev = info->user_ptr[1];
5894 struct wireless_dev *wdev = dev->ieee80211_ptr;
5895 struct cfg80211_beacon_data params;
5896 int err;
5897
5898 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5899 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5900 return -EOPNOTSUPP;
5901
5902 if (!rdev->ops->change_beacon)
5903 return -EOPNOTSUPP;
5904
5905 if (!wdev->links[link_id].ap.beacon_interval)
5906 return -EINVAL;
5907
5908 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms);
5909 if (err)
5910 goto out;
5911
5912 wdev_lock(wdev);
5913 err = rdev_change_beacon(rdev, dev, ¶ms);
5914 wdev_unlock(wdev);
5915
5916 out:
5917 kfree(params.mbssid_ies);
5918 return err;
5919 }
5920
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)5921 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5922 {
5923 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5924 unsigned int link_id = nl80211_link_id(info->attrs);
5925 struct net_device *dev = info->user_ptr[1];
5926
5927 return cfg80211_stop_ap(rdev, dev, link_id, false);
5928 }
5929
5930 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5931 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5932 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5933 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5934 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5935 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5936 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5937 };
5938
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)5939 static int parse_station_flags(struct genl_info *info,
5940 enum nl80211_iftype iftype,
5941 struct station_parameters *params)
5942 {
5943 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5944 struct nlattr *nla;
5945 int flag;
5946
5947 /*
5948 * Try parsing the new attribute first so userspace
5949 * can specify both for older kernels.
5950 */
5951 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5952 if (nla) {
5953 struct nl80211_sta_flag_update *sta_flags;
5954
5955 sta_flags = nla_data(nla);
5956 params->sta_flags_mask = sta_flags->mask;
5957 params->sta_flags_set = sta_flags->set;
5958 params->sta_flags_set &= params->sta_flags_mask;
5959 if ((params->sta_flags_mask |
5960 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5961 return -EINVAL;
5962 return 0;
5963 }
5964
5965 /* if present, parse the old attribute */
5966
5967 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5968 if (!nla)
5969 return 0;
5970
5971 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5972 return -EINVAL;
5973
5974 /*
5975 * Only allow certain flags for interface types so that
5976 * other attributes are silently ignored. Remember that
5977 * this is backward compatibility code with old userspace
5978 * and shouldn't be hit in other cases anyway.
5979 */
5980 switch (iftype) {
5981 case NL80211_IFTYPE_AP:
5982 case NL80211_IFTYPE_AP_VLAN:
5983 case NL80211_IFTYPE_P2P_GO:
5984 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5985 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5986 BIT(NL80211_STA_FLAG_WME) |
5987 BIT(NL80211_STA_FLAG_MFP);
5988 break;
5989 case NL80211_IFTYPE_P2P_CLIENT:
5990 case NL80211_IFTYPE_STATION:
5991 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5992 BIT(NL80211_STA_FLAG_TDLS_PEER);
5993 break;
5994 case NL80211_IFTYPE_MESH_POINT:
5995 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5996 BIT(NL80211_STA_FLAG_MFP) |
5997 BIT(NL80211_STA_FLAG_AUTHORIZED);
5998 break;
5999 default:
6000 return -EINVAL;
6001 }
6002
6003 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6004 if (flags[flag]) {
6005 params->sta_flags_set |= (1<<flag);
6006
6007 /* no longer support new API additions in old API */
6008 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6009 return -EINVAL;
6010 }
6011 }
6012
6013 return 0;
6014 }
6015
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)6016 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6017 {
6018 struct nlattr *rate;
6019 u32 bitrate;
6020 u16 bitrate_compat;
6021 enum nl80211_rate_info rate_flg;
6022
6023 rate = nla_nest_start_noflag(msg, attr);
6024 if (!rate)
6025 return false;
6026
6027 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6028 bitrate = cfg80211_calculate_bitrate(info);
6029 /* report 16-bit bitrate only if we can */
6030 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6031 if (bitrate > 0 &&
6032 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6033 return false;
6034 if (bitrate_compat > 0 &&
6035 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6036 return false;
6037
6038 switch (info->bw) {
6039 case RATE_INFO_BW_5:
6040 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6041 break;
6042 case RATE_INFO_BW_10:
6043 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6044 break;
6045 default:
6046 WARN_ON(1);
6047 fallthrough;
6048 case RATE_INFO_BW_20:
6049 rate_flg = 0;
6050 break;
6051 case RATE_INFO_BW_40:
6052 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6053 break;
6054 case RATE_INFO_BW_80:
6055 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6056 break;
6057 case RATE_INFO_BW_160:
6058 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6059 break;
6060 case RATE_INFO_BW_HE_RU:
6061 rate_flg = 0;
6062 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6063 break;
6064 case RATE_INFO_BW_320:
6065 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6066 break;
6067 case RATE_INFO_BW_EHT_RU:
6068 rate_flg = 0;
6069 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6070 break;
6071 }
6072
6073 if (rate_flg && nla_put_flag(msg, rate_flg))
6074 return false;
6075
6076 if (info->flags & RATE_INFO_FLAGS_MCS) {
6077 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6078 return false;
6079 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6080 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6081 return false;
6082 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6083 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6084 return false;
6085 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6086 return false;
6087 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6088 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6089 return false;
6090 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6091 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6092 return false;
6093 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6094 return false;
6095 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6096 return false;
6097 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6098 return false;
6099 if (info->bw == RATE_INFO_BW_HE_RU &&
6100 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6101 info->he_ru_alloc))
6102 return false;
6103 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6104 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6105 return false;
6106 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6107 return false;
6108 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6109 return false;
6110 if (info->bw == RATE_INFO_BW_EHT_RU &&
6111 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6112 info->eht_ru_alloc))
6113 return false;
6114 }
6115
6116 nla_nest_end(msg, rate);
6117 return true;
6118 }
6119
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)6120 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6121 int id)
6122 {
6123 void *attr;
6124 int i = 0;
6125
6126 if (!mask)
6127 return true;
6128
6129 attr = nla_nest_start_noflag(msg, id);
6130 if (!attr)
6131 return false;
6132
6133 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6134 if (!(mask & BIT(i)))
6135 continue;
6136
6137 if (nla_put_u8(msg, i, signal[i]))
6138 return false;
6139 }
6140
6141 nla_nest_end(msg, attr);
6142
6143 return true;
6144 }
6145
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)6146 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6147 u32 seq, int flags,
6148 struct cfg80211_registered_device *rdev,
6149 struct net_device *dev,
6150 const u8 *mac_addr, struct station_info *sinfo)
6151 {
6152 void *hdr;
6153 struct nlattr *sinfoattr, *bss_param;
6154
6155 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6156 if (!hdr) {
6157 cfg80211_sinfo_release_content(sinfo);
6158 return -1;
6159 }
6160
6161 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6162 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6163 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6164 goto nla_put_failure;
6165
6166 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6167 if (!sinfoattr)
6168 goto nla_put_failure;
6169
6170 #define PUT_SINFO(attr, memb, type) do { \
6171 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
6172 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6173 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
6174 sinfo->memb)) \
6175 goto nla_put_failure; \
6176 } while (0)
6177 #define PUT_SINFO_U64(attr, memb) do { \
6178 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6179 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
6180 sinfo->memb, NL80211_STA_INFO_PAD)) \
6181 goto nla_put_failure; \
6182 } while (0)
6183
6184 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6185 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6186 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6187
6188 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6189 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6190 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6191 (u32)sinfo->rx_bytes))
6192 goto nla_put_failure;
6193
6194 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6195 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6196 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6197 (u32)sinfo->tx_bytes))
6198 goto nla_put_failure;
6199
6200 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6201 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6202 PUT_SINFO(LLID, llid, u16);
6203 PUT_SINFO(PLID, plid, u16);
6204 PUT_SINFO(PLINK_STATE, plink_state, u8);
6205 PUT_SINFO_U64(RX_DURATION, rx_duration);
6206 PUT_SINFO_U64(TX_DURATION, tx_duration);
6207
6208 if (wiphy_ext_feature_isset(&rdev->wiphy,
6209 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6210 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6211
6212 switch (rdev->wiphy.signal_type) {
6213 case CFG80211_SIGNAL_TYPE_MBM:
6214 PUT_SINFO(SIGNAL, signal, u8);
6215 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6216 break;
6217 default:
6218 break;
6219 }
6220 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6221 if (!nl80211_put_signal(msg, sinfo->chains,
6222 sinfo->chain_signal,
6223 NL80211_STA_INFO_CHAIN_SIGNAL))
6224 goto nla_put_failure;
6225 }
6226 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6227 if (!nl80211_put_signal(msg, sinfo->chains,
6228 sinfo->chain_signal_avg,
6229 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6230 goto nla_put_failure;
6231 }
6232 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6233 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6234 NL80211_STA_INFO_TX_BITRATE))
6235 goto nla_put_failure;
6236 }
6237 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6238 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6239 NL80211_STA_INFO_RX_BITRATE))
6240 goto nla_put_failure;
6241 }
6242
6243 PUT_SINFO(RX_PACKETS, rx_packets, u32);
6244 PUT_SINFO(TX_PACKETS, tx_packets, u32);
6245 PUT_SINFO(TX_RETRIES, tx_retries, u32);
6246 PUT_SINFO(TX_FAILED, tx_failed, u32);
6247 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6248 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6249 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6250 PUT_SINFO(LOCAL_PM, local_pm, u32);
6251 PUT_SINFO(PEER_PM, peer_pm, u32);
6252 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6253 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6254 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6255
6256 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6257 bss_param = nla_nest_start_noflag(msg,
6258 NL80211_STA_INFO_BSS_PARAM);
6259 if (!bss_param)
6260 goto nla_put_failure;
6261
6262 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6263 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6264 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6265 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6266 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6267 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6268 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6269 sinfo->bss_param.dtim_period) ||
6270 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6271 sinfo->bss_param.beacon_interval))
6272 goto nla_put_failure;
6273
6274 nla_nest_end(msg, bss_param);
6275 }
6276 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6277 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6278 sizeof(struct nl80211_sta_flag_update),
6279 &sinfo->sta_flags))
6280 goto nla_put_failure;
6281
6282 PUT_SINFO_U64(T_OFFSET, t_offset);
6283 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6284 PUT_SINFO_U64(BEACON_RX, rx_beacon);
6285 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6286 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6287 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6288 if (wiphy_ext_feature_isset(&rdev->wiphy,
6289 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6290 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6291 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6292 }
6293
6294 #undef PUT_SINFO
6295 #undef PUT_SINFO_U64
6296
6297 if (sinfo->pertid) {
6298 struct nlattr *tidsattr;
6299 int tid;
6300
6301 tidsattr = nla_nest_start_noflag(msg,
6302 NL80211_STA_INFO_TID_STATS);
6303 if (!tidsattr)
6304 goto nla_put_failure;
6305
6306 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6307 struct cfg80211_tid_stats *tidstats;
6308 struct nlattr *tidattr;
6309
6310 tidstats = &sinfo->pertid[tid];
6311
6312 if (!tidstats->filled)
6313 continue;
6314
6315 tidattr = nla_nest_start_noflag(msg, tid + 1);
6316 if (!tidattr)
6317 goto nla_put_failure;
6318
6319 #define PUT_TIDVAL_U64(attr, memb) do { \
6320 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
6321 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
6322 tidstats->memb, NL80211_TID_STATS_PAD)) \
6323 goto nla_put_failure; \
6324 } while (0)
6325
6326 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6327 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6328 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6329 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6330
6331 #undef PUT_TIDVAL_U64
6332 if ((tidstats->filled &
6333 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6334 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6335 NL80211_TID_STATS_TXQ_STATS))
6336 goto nla_put_failure;
6337
6338 nla_nest_end(msg, tidattr);
6339 }
6340
6341 nla_nest_end(msg, tidsattr);
6342 }
6343
6344 nla_nest_end(msg, sinfoattr);
6345
6346 if (sinfo->assoc_req_ies_len &&
6347 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6348 sinfo->assoc_req_ies))
6349 goto nla_put_failure;
6350
6351 cfg80211_sinfo_release_content(sinfo);
6352 genlmsg_end(msg, hdr);
6353 return 0;
6354
6355 nla_put_failure:
6356 cfg80211_sinfo_release_content(sinfo);
6357 genlmsg_cancel(msg, hdr);
6358 return -EMSGSIZE;
6359 }
6360
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)6361 static int nl80211_dump_station(struct sk_buff *skb,
6362 struct netlink_callback *cb)
6363 {
6364 struct station_info sinfo;
6365 struct cfg80211_registered_device *rdev;
6366 struct wireless_dev *wdev;
6367 u8 mac_addr[ETH_ALEN];
6368 int sta_idx = cb->args[2];
6369 int err;
6370
6371 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6372 if (err)
6373 return err;
6374 /* nl80211_prepare_wdev_dump acquired it in the successful case */
6375 __acquire(&rdev->wiphy.mtx);
6376
6377 if (!wdev->netdev) {
6378 err = -EINVAL;
6379 goto out_err;
6380 }
6381
6382 if (!rdev->ops->dump_station) {
6383 err = -EOPNOTSUPP;
6384 goto out_err;
6385 }
6386
6387 while (1) {
6388 memset(&sinfo, 0, sizeof(sinfo));
6389 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6390 mac_addr, &sinfo);
6391 if (err == -ENOENT)
6392 break;
6393 if (err)
6394 goto out_err;
6395
6396 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6397 NETLINK_CB(cb->skb).portid,
6398 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6399 rdev, wdev->netdev, mac_addr,
6400 &sinfo) < 0)
6401 goto out;
6402
6403 sta_idx++;
6404 }
6405
6406 out:
6407 cb->args[2] = sta_idx;
6408 err = skb->len;
6409 out_err:
6410 wiphy_unlock(&rdev->wiphy);
6411
6412 return err;
6413 }
6414
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)6415 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6416 {
6417 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6418 struct net_device *dev = info->user_ptr[1];
6419 struct station_info sinfo;
6420 struct sk_buff *msg;
6421 u8 *mac_addr = NULL;
6422 int err;
6423
6424 memset(&sinfo, 0, sizeof(sinfo));
6425
6426 if (!info->attrs[NL80211_ATTR_MAC])
6427 return -EINVAL;
6428
6429 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6430
6431 if (!rdev->ops->get_station)
6432 return -EOPNOTSUPP;
6433
6434 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6435 if (err)
6436 return err;
6437
6438 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6439 if (!msg) {
6440 cfg80211_sinfo_release_content(&sinfo);
6441 return -ENOMEM;
6442 }
6443
6444 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6445 info->snd_portid, info->snd_seq, 0,
6446 rdev, dev, mac_addr, &sinfo) < 0) {
6447 nlmsg_free(msg);
6448 return -ENOBUFS;
6449 }
6450
6451 return genlmsg_reply(msg, info);
6452 }
6453
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)6454 int cfg80211_check_station_change(struct wiphy *wiphy,
6455 struct station_parameters *params,
6456 enum cfg80211_station_type statype)
6457 {
6458 if (params->listen_interval != -1 &&
6459 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6460 return -EINVAL;
6461
6462 if (params->support_p2p_ps != -1 &&
6463 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6464 return -EINVAL;
6465
6466 if (params->aid &&
6467 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6468 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6469 return -EINVAL;
6470
6471 /* When you run into this, adjust the code below for the new flag */
6472 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6473
6474 switch (statype) {
6475 case CFG80211_STA_MESH_PEER_KERNEL:
6476 case CFG80211_STA_MESH_PEER_USER:
6477 /*
6478 * No ignoring the TDLS flag here -- the userspace mesh
6479 * code doesn't have the bug of including TDLS in the
6480 * mask everywhere.
6481 */
6482 if (params->sta_flags_mask &
6483 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6484 BIT(NL80211_STA_FLAG_MFP) |
6485 BIT(NL80211_STA_FLAG_AUTHORIZED)))
6486 return -EINVAL;
6487 break;
6488 case CFG80211_STA_TDLS_PEER_SETUP:
6489 case CFG80211_STA_TDLS_PEER_ACTIVE:
6490 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6491 return -EINVAL;
6492 /* ignore since it can't change */
6493 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6494 break;
6495 default:
6496 /* disallow mesh-specific things */
6497 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6498 return -EINVAL;
6499 if (params->local_pm)
6500 return -EINVAL;
6501 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6502 return -EINVAL;
6503 }
6504
6505 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6506 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6507 /* TDLS can't be set, ... */
6508 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6509 return -EINVAL;
6510 /*
6511 * ... but don't bother the driver with it. This works around
6512 * a hostapd/wpa_supplicant issue -- it always includes the
6513 * TLDS_PEER flag in the mask even for AP mode.
6514 */
6515 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6516 }
6517
6518 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6519 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6520 /* reject other things that can't change */
6521 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6522 return -EINVAL;
6523 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6524 return -EINVAL;
6525 if (params->supported_rates)
6526 return -EINVAL;
6527 if (params->ext_capab || params->ht_capa || params->vht_capa ||
6528 params->he_capa || params->eht_capa)
6529 return -EINVAL;
6530 }
6531
6532 if (statype != CFG80211_STA_AP_CLIENT &&
6533 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6534 if (params->vlan)
6535 return -EINVAL;
6536 }
6537
6538 switch (statype) {
6539 case CFG80211_STA_AP_MLME_CLIENT:
6540 /* Use this only for authorizing/unauthorizing a station */
6541 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6542 return -EOPNOTSUPP;
6543 break;
6544 case CFG80211_STA_AP_CLIENT:
6545 case CFG80211_STA_AP_CLIENT_UNASSOC:
6546 /* accept only the listed bits */
6547 if (params->sta_flags_mask &
6548 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6549 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6550 BIT(NL80211_STA_FLAG_ASSOCIATED) |
6551 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6552 BIT(NL80211_STA_FLAG_WME) |
6553 BIT(NL80211_STA_FLAG_MFP)))
6554 return -EINVAL;
6555
6556 /* but authenticated/associated only if driver handles it */
6557 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6558 params->sta_flags_mask &
6559 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6560 BIT(NL80211_STA_FLAG_ASSOCIATED)))
6561 return -EINVAL;
6562 break;
6563 case CFG80211_STA_IBSS:
6564 case CFG80211_STA_AP_STA:
6565 /* reject any changes other than AUTHORIZED */
6566 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6567 return -EINVAL;
6568 break;
6569 case CFG80211_STA_TDLS_PEER_SETUP:
6570 /* reject any changes other than AUTHORIZED or WME */
6571 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6572 BIT(NL80211_STA_FLAG_WME)))
6573 return -EINVAL;
6574 /* force (at least) rates when authorizing */
6575 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6576 !params->supported_rates)
6577 return -EINVAL;
6578 break;
6579 case CFG80211_STA_TDLS_PEER_ACTIVE:
6580 /* reject any changes */
6581 return -EINVAL;
6582 case CFG80211_STA_MESH_PEER_KERNEL:
6583 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6584 return -EINVAL;
6585 break;
6586 case CFG80211_STA_MESH_PEER_USER:
6587 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6588 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6589 return -EINVAL;
6590 break;
6591 }
6592
6593 /*
6594 * Older kernel versions ignored this attribute entirely, so don't
6595 * reject attempts to update it but mark it as unused instead so the
6596 * driver won't look at the data.
6597 */
6598 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6599 statype != CFG80211_STA_TDLS_PEER_SETUP)
6600 params->opmode_notif_used = false;
6601
6602 return 0;
6603 }
6604 EXPORT_SYMBOL(cfg80211_check_station_change);
6605
6606 /*
6607 * Get vlan interface making sure it is running and on the right wiphy.
6608 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)6609 static struct net_device *get_vlan(struct genl_info *info,
6610 struct cfg80211_registered_device *rdev)
6611 {
6612 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6613 struct net_device *v;
6614 int ret;
6615
6616 if (!vlanattr)
6617 return NULL;
6618
6619 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6620 if (!v)
6621 return ERR_PTR(-ENODEV);
6622
6623 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6624 ret = -EINVAL;
6625 goto error;
6626 }
6627
6628 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6629 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6630 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6631 ret = -EINVAL;
6632 goto error;
6633 }
6634
6635 if (!netif_running(v)) {
6636 ret = -ENETDOWN;
6637 goto error;
6638 }
6639
6640 return v;
6641 error:
6642 dev_put(v);
6643 return ERR_PTR(ret);
6644 }
6645
6646 static const struct nla_policy
6647 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6648 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6649 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6650 };
6651
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)6652 static int nl80211_parse_sta_wme(struct genl_info *info,
6653 struct station_parameters *params)
6654 {
6655 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6656 struct nlattr *nla;
6657 int err;
6658
6659 /* parse WME attributes if present */
6660 if (!info->attrs[NL80211_ATTR_STA_WME])
6661 return 0;
6662
6663 nla = info->attrs[NL80211_ATTR_STA_WME];
6664 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6665 nl80211_sta_wme_policy,
6666 info->extack);
6667 if (err)
6668 return err;
6669
6670 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6671 params->uapsd_queues = nla_get_u8(
6672 tb[NL80211_STA_WME_UAPSD_QUEUES]);
6673 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6674 return -EINVAL;
6675
6676 if (tb[NL80211_STA_WME_MAX_SP])
6677 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6678
6679 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6680 return -EINVAL;
6681
6682 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6683
6684 return 0;
6685 }
6686
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)6687 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6688 struct station_parameters *params)
6689 {
6690 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6691 params->supported_channels =
6692 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6693 params->supported_channels_len =
6694 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6695 /*
6696 * Need to include at least one (first channel, number of
6697 * channels) tuple for each subband (checked in policy),
6698 * and must have proper tuples for the rest of the data as well.
6699 */
6700 if (params->supported_channels_len % 2)
6701 return -EINVAL;
6702 }
6703
6704 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6705 params->supported_oper_classes =
6706 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6707 params->supported_oper_classes_len =
6708 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6709 }
6710 return 0;
6711 }
6712
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)6713 static int nl80211_set_station_tdls(struct genl_info *info,
6714 struct station_parameters *params)
6715 {
6716 int err;
6717 /* Dummy STA entry gets updated once the peer capabilities are known */
6718 if (info->attrs[NL80211_ATTR_PEER_AID])
6719 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6720 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6721 params->ht_capa =
6722 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6723 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6724 params->vht_capa =
6725 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6726 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6727 params->he_capa =
6728 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6729 params->he_capa_len =
6730 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6731
6732 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
6733 params->eht_capa =
6734 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
6735 params->eht_capa_len =
6736 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
6737
6738 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_capa,
6739 (const u8 *)params->eht_capa,
6740 params->eht_capa_len))
6741 return -EINVAL;
6742 }
6743 }
6744
6745 err = nl80211_parse_sta_channel_info(info, params);
6746 if (err)
6747 return err;
6748
6749 return nl80211_parse_sta_wme(info, params);
6750 }
6751
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct station_parameters * params)6752 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6753 struct station_parameters *params)
6754 {
6755 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6756 int idx;
6757
6758 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6759 if (!rdev->ops->set_tx_power ||
6760 !wiphy_ext_feature_isset(&rdev->wiphy,
6761 NL80211_EXT_FEATURE_STA_TX_PWR))
6762 return -EOPNOTSUPP;
6763
6764 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6765 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6766
6767 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6768 idx = NL80211_ATTR_STA_TX_POWER;
6769
6770 if (info->attrs[idx])
6771 params->txpwr.power =
6772 nla_get_s16(info->attrs[idx]);
6773 else
6774 return -EINVAL;
6775 }
6776 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6777 }
6778
6779 return 0;
6780 }
6781
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)6782 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6783 {
6784 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6785 struct net_device *dev = info->user_ptr[1];
6786 struct station_parameters params;
6787 u8 *mac_addr;
6788 int err;
6789
6790 memset(¶ms, 0, sizeof(params));
6791
6792 if (!rdev->ops->change_station)
6793 return -EOPNOTSUPP;
6794
6795 /*
6796 * AID and listen_interval properties can be set only for unassociated
6797 * station. Include these parameters here and will check them in
6798 * cfg80211_check_station_change().
6799 */
6800 if (info->attrs[NL80211_ATTR_STA_AID])
6801 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6802
6803 if (info->attrs[NL80211_ATTR_VLAN_ID])
6804 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6805
6806 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6807 params.listen_interval =
6808 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6809 else
6810 params.listen_interval = -1;
6811
6812 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6813 params.support_p2p_ps =
6814 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6815 else
6816 params.support_p2p_ps = -1;
6817
6818 if (!info->attrs[NL80211_ATTR_MAC])
6819 return -EINVAL;
6820
6821 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6822
6823 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6824 params.supported_rates =
6825 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6826 params.supported_rates_len =
6827 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6828 }
6829
6830 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6831 params.capability =
6832 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6833 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6834 }
6835
6836 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6837 params.ext_capab =
6838 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6839 params.ext_capab_len =
6840 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6841 }
6842
6843 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
6844 return -EINVAL;
6845
6846 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6847 params.plink_action =
6848 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6849
6850 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6851 params.plink_state =
6852 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6853 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6854 params.peer_aid = nla_get_u16(
6855 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6856 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6857 }
6858
6859 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6860 params.local_pm = nla_get_u32(
6861 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6862
6863 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6864 params.opmode_notif_used = true;
6865 params.opmode_notif =
6866 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6867 }
6868
6869 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6870 params.he_6ghz_capa =
6871 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6872
6873 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6874 params.airtime_weight =
6875 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6876
6877 if (params.airtime_weight &&
6878 !wiphy_ext_feature_isset(&rdev->wiphy,
6879 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6880 return -EOPNOTSUPP;
6881
6882 err = nl80211_parse_sta_txpower_setting(info, ¶ms);
6883 if (err)
6884 return err;
6885
6886 /* Include parameters for TDLS peer (will check later) */
6887 err = nl80211_set_station_tdls(info, ¶ms);
6888 if (err)
6889 return err;
6890
6891 params.vlan = get_vlan(info, rdev);
6892 if (IS_ERR(params.vlan))
6893 return PTR_ERR(params.vlan);
6894
6895 switch (dev->ieee80211_ptr->iftype) {
6896 case NL80211_IFTYPE_AP:
6897 case NL80211_IFTYPE_AP_VLAN:
6898 case NL80211_IFTYPE_P2P_GO:
6899 case NL80211_IFTYPE_P2P_CLIENT:
6900 case NL80211_IFTYPE_STATION:
6901 case NL80211_IFTYPE_ADHOC:
6902 case NL80211_IFTYPE_MESH_POINT:
6903 break;
6904 default:
6905 err = -EOPNOTSUPP;
6906 goto out_put_vlan;
6907 }
6908
6909 /* driver will call cfg80211_check_station_change() */
6910 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
6911
6912 out_put_vlan:
6913 dev_put(params.vlan);
6914
6915 return err;
6916 }
6917
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)6918 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6919 {
6920 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6921 int err;
6922 struct net_device *dev = info->user_ptr[1];
6923 struct station_parameters params;
6924 u8 *mac_addr = NULL;
6925 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6926 BIT(NL80211_STA_FLAG_ASSOCIATED);
6927
6928 memset(¶ms, 0, sizeof(params));
6929
6930 if (!rdev->ops->add_station)
6931 return -EOPNOTSUPP;
6932
6933 if (!info->attrs[NL80211_ATTR_MAC])
6934 return -EINVAL;
6935
6936 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6937 return -EINVAL;
6938
6939 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6940 return -EINVAL;
6941
6942 if (!info->attrs[NL80211_ATTR_STA_AID] &&
6943 !info->attrs[NL80211_ATTR_PEER_AID])
6944 return -EINVAL;
6945
6946 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6947 params.supported_rates =
6948 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6949 params.supported_rates_len =
6950 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6951 params.listen_interval =
6952 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6953
6954 if (info->attrs[NL80211_ATTR_VLAN_ID])
6955 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6956
6957 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6958 params.support_p2p_ps =
6959 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6960 } else {
6961 /*
6962 * if not specified, assume it's supported for P2P GO interface,
6963 * and is NOT supported for AP interface
6964 */
6965 params.support_p2p_ps =
6966 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6967 }
6968
6969 if (info->attrs[NL80211_ATTR_PEER_AID])
6970 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6971 else
6972 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6973
6974 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6975 params.capability =
6976 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6977 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6978 }
6979
6980 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6981 params.ext_capab =
6982 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6983 params.ext_capab_len =
6984 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6985 }
6986
6987 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6988 params.ht_capa =
6989 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6990
6991 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6992 params.vht_capa =
6993 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6994
6995 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6996 params.he_capa =
6997 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6998 params.he_capa_len =
6999 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7000
7001 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7002 params.eht_capa =
7003 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7004 params.eht_capa_len =
7005 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7006
7007 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
7008 (const u8 *)params.eht_capa,
7009 params.eht_capa_len))
7010 return -EINVAL;
7011 }
7012 }
7013
7014 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7015 params.he_6ghz_capa =
7016 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7017
7018 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7019 params.opmode_notif_used = true;
7020 params.opmode_notif =
7021 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7022 }
7023
7024 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7025 params.plink_action =
7026 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7027
7028 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7029 params.airtime_weight =
7030 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7031
7032 if (params.airtime_weight &&
7033 !wiphy_ext_feature_isset(&rdev->wiphy,
7034 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7035 return -EOPNOTSUPP;
7036
7037 err = nl80211_parse_sta_txpower_setting(info, ¶ms);
7038 if (err)
7039 return err;
7040
7041 err = nl80211_parse_sta_channel_info(info, ¶ms);
7042 if (err)
7043 return err;
7044
7045 err = nl80211_parse_sta_wme(info, ¶ms);
7046 if (err)
7047 return err;
7048
7049 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7050 return -EINVAL;
7051
7052 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7053 * as userspace might just pass through the capabilities from the IEs
7054 * directly, rather than enforcing this restriction and returning an
7055 * error in this case.
7056 */
7057 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7058 params.ht_capa = NULL;
7059 params.vht_capa = NULL;
7060
7061 /* HE and EHT require WME */
7062 if (params.he_capa_len || params.he_6ghz_capa ||
7063 params.eht_capa_len)
7064 return -EINVAL;
7065 }
7066
7067 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7068 if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
7069 return -EINVAL;
7070
7071 /* When you run into this, adjust the code below for the new flag */
7072 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7073
7074 switch (dev->ieee80211_ptr->iftype) {
7075 case NL80211_IFTYPE_AP:
7076 case NL80211_IFTYPE_AP_VLAN:
7077 case NL80211_IFTYPE_P2P_GO:
7078 /* ignore WME attributes if iface/sta is not capable */
7079 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7080 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7081 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7082
7083 /* TDLS peers cannot be added */
7084 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7085 info->attrs[NL80211_ATTR_PEER_AID])
7086 return -EINVAL;
7087 /* but don't bother the driver with it */
7088 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7089
7090 /* allow authenticated/associated only if driver handles it */
7091 if (!(rdev->wiphy.features &
7092 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7093 params.sta_flags_mask & auth_assoc)
7094 return -EINVAL;
7095
7096 /* Older userspace, or userspace wanting to be compatible with
7097 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7098 * and assoc flags in the mask, but assumes the station will be
7099 * added as associated anyway since this was the required driver
7100 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7101 * introduced.
7102 * In order to not bother drivers with this quirk in the API
7103 * set the flags in both the mask and set for new stations in
7104 * this case.
7105 */
7106 if (!(params.sta_flags_mask & auth_assoc)) {
7107 params.sta_flags_mask |= auth_assoc;
7108 params.sta_flags_set |= auth_assoc;
7109 }
7110
7111 /* must be last in here for error handling */
7112 params.vlan = get_vlan(info, rdev);
7113 if (IS_ERR(params.vlan))
7114 return PTR_ERR(params.vlan);
7115 break;
7116 case NL80211_IFTYPE_MESH_POINT:
7117 /* ignore uAPSD data */
7118 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7119
7120 /* associated is disallowed */
7121 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7122 return -EINVAL;
7123 /* TDLS peers cannot be added */
7124 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7125 info->attrs[NL80211_ATTR_PEER_AID])
7126 return -EINVAL;
7127 break;
7128 case NL80211_IFTYPE_STATION:
7129 case NL80211_IFTYPE_P2P_CLIENT:
7130 /* ignore uAPSD data */
7131 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7132
7133 /* these are disallowed */
7134 if (params.sta_flags_mask &
7135 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7136 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7137 return -EINVAL;
7138 /* Only TDLS peers can be added */
7139 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7140 return -EINVAL;
7141 /* Can only add if TDLS ... */
7142 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7143 return -EOPNOTSUPP;
7144 /* ... with external setup is supported */
7145 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7146 return -EOPNOTSUPP;
7147 /*
7148 * Older wpa_supplicant versions always mark the TDLS peer
7149 * as authorized, but it shouldn't yet be.
7150 */
7151 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7152 break;
7153 default:
7154 return -EOPNOTSUPP;
7155 }
7156
7157 /* be aware of params.vlan when changing code here */
7158
7159 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
7160
7161 dev_put(params.vlan);
7162 return err;
7163 }
7164
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)7165 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7166 {
7167 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7168 struct net_device *dev = info->user_ptr[1];
7169 struct station_del_parameters params;
7170
7171 memset(¶ms, 0, sizeof(params));
7172
7173 if (info->attrs[NL80211_ATTR_MAC])
7174 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7175
7176 switch (dev->ieee80211_ptr->iftype) {
7177 case NL80211_IFTYPE_AP:
7178 case NL80211_IFTYPE_AP_VLAN:
7179 case NL80211_IFTYPE_MESH_POINT:
7180 case NL80211_IFTYPE_P2P_GO:
7181 /* always accept these */
7182 break;
7183 case NL80211_IFTYPE_ADHOC:
7184 /* conditionally accept */
7185 if (wiphy_ext_feature_isset(&rdev->wiphy,
7186 NL80211_EXT_FEATURE_DEL_IBSS_STA))
7187 break;
7188 return -EINVAL;
7189 default:
7190 return -EINVAL;
7191 }
7192
7193 if (!rdev->ops->del_station)
7194 return -EOPNOTSUPP;
7195
7196 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7197 params.subtype =
7198 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7199 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7200 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7201 return -EINVAL;
7202 } else {
7203 /* Default to Deauthentication frame */
7204 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7205 }
7206
7207 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7208 params.reason_code =
7209 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7210 if (params.reason_code == 0)
7211 return -EINVAL; /* 0 is reserved */
7212 } else {
7213 /* Default to reason code 2 */
7214 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7215 }
7216
7217 return rdev_del_station(rdev, dev, ¶ms);
7218 }
7219
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)7220 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7221 int flags, struct net_device *dev,
7222 u8 *dst, u8 *next_hop,
7223 struct mpath_info *pinfo)
7224 {
7225 void *hdr;
7226 struct nlattr *pinfoattr;
7227
7228 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7229 if (!hdr)
7230 return -1;
7231
7232 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7233 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7234 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7235 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7236 goto nla_put_failure;
7237
7238 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7239 if (!pinfoattr)
7240 goto nla_put_failure;
7241 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7242 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7243 pinfo->frame_qlen))
7244 goto nla_put_failure;
7245 if (((pinfo->filled & MPATH_INFO_SN) &&
7246 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7247 ((pinfo->filled & MPATH_INFO_METRIC) &&
7248 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7249 pinfo->metric)) ||
7250 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7251 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7252 pinfo->exptime)) ||
7253 ((pinfo->filled & MPATH_INFO_FLAGS) &&
7254 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7255 pinfo->flags)) ||
7256 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7257 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7258 pinfo->discovery_timeout)) ||
7259 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7260 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7261 pinfo->discovery_retries)) ||
7262 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7263 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7264 pinfo->hop_count)) ||
7265 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7266 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7267 pinfo->path_change_count)))
7268 goto nla_put_failure;
7269
7270 nla_nest_end(msg, pinfoattr);
7271
7272 genlmsg_end(msg, hdr);
7273 return 0;
7274
7275 nla_put_failure:
7276 genlmsg_cancel(msg, hdr);
7277 return -EMSGSIZE;
7278 }
7279
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)7280 static int nl80211_dump_mpath(struct sk_buff *skb,
7281 struct netlink_callback *cb)
7282 {
7283 struct mpath_info pinfo;
7284 struct cfg80211_registered_device *rdev;
7285 struct wireless_dev *wdev;
7286 u8 dst[ETH_ALEN];
7287 u8 next_hop[ETH_ALEN];
7288 int path_idx = cb->args[2];
7289 int err;
7290
7291 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7292 if (err)
7293 return err;
7294 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7295 __acquire(&rdev->wiphy.mtx);
7296
7297 if (!rdev->ops->dump_mpath) {
7298 err = -EOPNOTSUPP;
7299 goto out_err;
7300 }
7301
7302 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7303 err = -EOPNOTSUPP;
7304 goto out_err;
7305 }
7306
7307 while (1) {
7308 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7309 next_hop, &pinfo);
7310 if (err == -ENOENT)
7311 break;
7312 if (err)
7313 goto out_err;
7314
7315 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7316 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7317 wdev->netdev, dst, next_hop,
7318 &pinfo) < 0)
7319 goto out;
7320
7321 path_idx++;
7322 }
7323
7324 out:
7325 cb->args[2] = path_idx;
7326 err = skb->len;
7327 out_err:
7328 wiphy_unlock(&rdev->wiphy);
7329 return err;
7330 }
7331
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)7332 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7333 {
7334 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7335 int err;
7336 struct net_device *dev = info->user_ptr[1];
7337 struct mpath_info pinfo;
7338 struct sk_buff *msg;
7339 u8 *dst = NULL;
7340 u8 next_hop[ETH_ALEN];
7341
7342 memset(&pinfo, 0, sizeof(pinfo));
7343
7344 if (!info->attrs[NL80211_ATTR_MAC])
7345 return -EINVAL;
7346
7347 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7348
7349 if (!rdev->ops->get_mpath)
7350 return -EOPNOTSUPP;
7351
7352 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7353 return -EOPNOTSUPP;
7354
7355 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7356 if (err)
7357 return err;
7358
7359 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7360 if (!msg)
7361 return -ENOMEM;
7362
7363 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7364 dev, dst, next_hop, &pinfo) < 0) {
7365 nlmsg_free(msg);
7366 return -ENOBUFS;
7367 }
7368
7369 return genlmsg_reply(msg, info);
7370 }
7371
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)7372 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7373 {
7374 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7375 struct net_device *dev = info->user_ptr[1];
7376 u8 *dst = NULL;
7377 u8 *next_hop = NULL;
7378
7379 if (!info->attrs[NL80211_ATTR_MAC])
7380 return -EINVAL;
7381
7382 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7383 return -EINVAL;
7384
7385 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7386 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7387
7388 if (!rdev->ops->change_mpath)
7389 return -EOPNOTSUPP;
7390
7391 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7392 return -EOPNOTSUPP;
7393
7394 return rdev_change_mpath(rdev, dev, dst, next_hop);
7395 }
7396
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)7397 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7398 {
7399 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7400 struct net_device *dev = info->user_ptr[1];
7401 u8 *dst = NULL;
7402 u8 *next_hop = NULL;
7403
7404 if (!info->attrs[NL80211_ATTR_MAC])
7405 return -EINVAL;
7406
7407 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7408 return -EINVAL;
7409
7410 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7411 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7412
7413 if (!rdev->ops->add_mpath)
7414 return -EOPNOTSUPP;
7415
7416 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7417 return -EOPNOTSUPP;
7418
7419 return rdev_add_mpath(rdev, dev, dst, next_hop);
7420 }
7421
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)7422 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7423 {
7424 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7425 struct net_device *dev = info->user_ptr[1];
7426 u8 *dst = NULL;
7427
7428 if (info->attrs[NL80211_ATTR_MAC])
7429 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7430
7431 if (!rdev->ops->del_mpath)
7432 return -EOPNOTSUPP;
7433
7434 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7435 return -EOPNOTSUPP;
7436
7437 return rdev_del_mpath(rdev, dev, dst);
7438 }
7439
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)7440 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7441 {
7442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7443 int err;
7444 struct net_device *dev = info->user_ptr[1];
7445 struct mpath_info pinfo;
7446 struct sk_buff *msg;
7447 u8 *dst = NULL;
7448 u8 mpp[ETH_ALEN];
7449
7450 memset(&pinfo, 0, sizeof(pinfo));
7451
7452 if (!info->attrs[NL80211_ATTR_MAC])
7453 return -EINVAL;
7454
7455 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7456
7457 if (!rdev->ops->get_mpp)
7458 return -EOPNOTSUPP;
7459
7460 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7461 return -EOPNOTSUPP;
7462
7463 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7464 if (err)
7465 return err;
7466
7467 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7468 if (!msg)
7469 return -ENOMEM;
7470
7471 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7472 dev, dst, mpp, &pinfo) < 0) {
7473 nlmsg_free(msg);
7474 return -ENOBUFS;
7475 }
7476
7477 return genlmsg_reply(msg, info);
7478 }
7479
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)7480 static int nl80211_dump_mpp(struct sk_buff *skb,
7481 struct netlink_callback *cb)
7482 {
7483 struct mpath_info pinfo;
7484 struct cfg80211_registered_device *rdev;
7485 struct wireless_dev *wdev;
7486 u8 dst[ETH_ALEN];
7487 u8 mpp[ETH_ALEN];
7488 int path_idx = cb->args[2];
7489 int err;
7490
7491 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7492 if (err)
7493 return err;
7494 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7495 __acquire(&rdev->wiphy.mtx);
7496
7497 if (!rdev->ops->dump_mpp) {
7498 err = -EOPNOTSUPP;
7499 goto out_err;
7500 }
7501
7502 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7503 err = -EOPNOTSUPP;
7504 goto out_err;
7505 }
7506
7507 while (1) {
7508 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7509 mpp, &pinfo);
7510 if (err == -ENOENT)
7511 break;
7512 if (err)
7513 goto out_err;
7514
7515 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7516 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7517 wdev->netdev, dst, mpp,
7518 &pinfo) < 0)
7519 goto out;
7520
7521 path_idx++;
7522 }
7523
7524 out:
7525 cb->args[2] = path_idx;
7526 err = skb->len;
7527 out_err:
7528 wiphy_unlock(&rdev->wiphy);
7529 return err;
7530 }
7531
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)7532 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7533 {
7534 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7535 struct net_device *dev = info->user_ptr[1];
7536 struct wireless_dev *wdev = dev->ieee80211_ptr;
7537 struct bss_parameters params;
7538 int err;
7539
7540 memset(¶ms, 0, sizeof(params));
7541 /* default to not changing parameters */
7542 params.use_cts_prot = -1;
7543 params.use_short_preamble = -1;
7544 params.use_short_slot_time = -1;
7545 params.ap_isolate = -1;
7546 params.ht_opmode = -1;
7547 params.p2p_ctwindow = -1;
7548 params.p2p_opp_ps = -1;
7549
7550 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7551 params.use_cts_prot =
7552 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7553 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7554 params.use_short_preamble =
7555 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7556 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7557 params.use_short_slot_time =
7558 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7559 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7560 params.basic_rates =
7561 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7562 params.basic_rates_len =
7563 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7564 }
7565 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7566 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7567 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7568 params.ht_opmode =
7569 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7570
7571 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7572 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7573 return -EINVAL;
7574 params.p2p_ctwindow =
7575 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7576 if (params.p2p_ctwindow != 0 &&
7577 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7578 return -EINVAL;
7579 }
7580
7581 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7582 u8 tmp;
7583
7584 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7585 return -EINVAL;
7586 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7587 params.p2p_opp_ps = tmp;
7588 if (params.p2p_opp_ps &&
7589 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7590 return -EINVAL;
7591 }
7592
7593 if (!rdev->ops->change_bss)
7594 return -EOPNOTSUPP;
7595
7596 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7597 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7598 return -EOPNOTSUPP;
7599
7600 wdev_lock(wdev);
7601 err = rdev_change_bss(rdev, dev, ¶ms);
7602 wdev_unlock(wdev);
7603
7604 return err;
7605 }
7606
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)7607 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7608 {
7609 char *data = NULL;
7610 bool is_indoor;
7611 enum nl80211_user_reg_hint_type user_reg_hint_type;
7612 u32 owner_nlportid;
7613
7614 /*
7615 * You should only get this when cfg80211 hasn't yet initialized
7616 * completely when built-in to the kernel right between the time
7617 * window between nl80211_init() and regulatory_init(), if that is
7618 * even possible.
7619 */
7620 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7621 return -EINPROGRESS;
7622
7623 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7624 user_reg_hint_type =
7625 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7626 else
7627 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7628
7629 switch (user_reg_hint_type) {
7630 case NL80211_USER_REG_HINT_USER:
7631 case NL80211_USER_REG_HINT_CELL_BASE:
7632 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7633 return -EINVAL;
7634
7635 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7636 return regulatory_hint_user(data, user_reg_hint_type);
7637 case NL80211_USER_REG_HINT_INDOOR:
7638 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7639 owner_nlportid = info->snd_portid;
7640 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7641 } else {
7642 owner_nlportid = 0;
7643 is_indoor = true;
7644 }
7645
7646 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7647 default:
7648 return -EINVAL;
7649 }
7650 }
7651
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)7652 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7653 {
7654 return reg_reload_regdb();
7655 }
7656
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)7657 static int nl80211_get_mesh_config(struct sk_buff *skb,
7658 struct genl_info *info)
7659 {
7660 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7661 struct net_device *dev = info->user_ptr[1];
7662 struct wireless_dev *wdev = dev->ieee80211_ptr;
7663 struct mesh_config cur_params;
7664 int err = 0;
7665 void *hdr;
7666 struct nlattr *pinfoattr;
7667 struct sk_buff *msg;
7668
7669 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7670 return -EOPNOTSUPP;
7671
7672 if (!rdev->ops->get_mesh_config)
7673 return -EOPNOTSUPP;
7674
7675 wdev_lock(wdev);
7676 /* If not connected, get default parameters */
7677 if (!wdev->u.mesh.id_len)
7678 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7679 else
7680 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7681 wdev_unlock(wdev);
7682
7683 if (err)
7684 return err;
7685
7686 /* Draw up a netlink message to send back */
7687 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7688 if (!msg)
7689 return -ENOMEM;
7690 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7691 NL80211_CMD_GET_MESH_CONFIG);
7692 if (!hdr)
7693 goto out;
7694 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7695 if (!pinfoattr)
7696 goto nla_put_failure;
7697 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7698 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7699 cur_params.dot11MeshRetryTimeout) ||
7700 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7701 cur_params.dot11MeshConfirmTimeout) ||
7702 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7703 cur_params.dot11MeshHoldingTimeout) ||
7704 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7705 cur_params.dot11MeshMaxPeerLinks) ||
7706 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7707 cur_params.dot11MeshMaxRetries) ||
7708 nla_put_u8(msg, NL80211_MESHCONF_TTL,
7709 cur_params.dot11MeshTTL) ||
7710 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7711 cur_params.element_ttl) ||
7712 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7713 cur_params.auto_open_plinks) ||
7714 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7715 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7716 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7717 cur_params.dot11MeshHWMPmaxPREQretries) ||
7718 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7719 cur_params.path_refresh_time) ||
7720 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7721 cur_params.min_discovery_timeout) ||
7722 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7723 cur_params.dot11MeshHWMPactivePathTimeout) ||
7724 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7725 cur_params.dot11MeshHWMPpreqMinInterval) ||
7726 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7727 cur_params.dot11MeshHWMPperrMinInterval) ||
7728 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7729 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7730 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7731 cur_params.dot11MeshHWMPRootMode) ||
7732 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7733 cur_params.dot11MeshHWMPRannInterval) ||
7734 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7735 cur_params.dot11MeshGateAnnouncementProtocol) ||
7736 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7737 cur_params.dot11MeshForwarding) ||
7738 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7739 cur_params.rssi_threshold) ||
7740 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7741 cur_params.ht_opmode) ||
7742 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7743 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7744 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7745 cur_params.dot11MeshHWMProotInterval) ||
7746 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7747 cur_params.dot11MeshHWMPconfirmationInterval) ||
7748 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7749 cur_params.power_mode) ||
7750 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7751 cur_params.dot11MeshAwakeWindowDuration) ||
7752 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7753 cur_params.plink_timeout) ||
7754 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7755 cur_params.dot11MeshConnectedToMeshGate) ||
7756 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7757 cur_params.dot11MeshNolearn) ||
7758 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7759 cur_params.dot11MeshConnectedToAuthServer))
7760 goto nla_put_failure;
7761 nla_nest_end(msg, pinfoattr);
7762 genlmsg_end(msg, hdr);
7763 return genlmsg_reply(msg, info);
7764
7765 nla_put_failure:
7766 out:
7767 nlmsg_free(msg);
7768 return -ENOBUFS;
7769 }
7770
7771 static const struct nla_policy
7772 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7773 [NL80211_MESHCONF_RETRY_TIMEOUT] =
7774 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7775 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7776 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7777 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7778 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7779 [NL80211_MESHCONF_MAX_PEER_LINKS] =
7780 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7781 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7782 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7783 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7784 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7785 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7786 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7787 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7788 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7789 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7790 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7791 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7792 NLA_POLICY_MIN(NLA_U16, 1),
7793 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7794 NLA_POLICY_MIN(NLA_U16, 1),
7795 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7796 NLA_POLICY_MIN(NLA_U16, 1),
7797 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7798 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7799 NLA_POLICY_MIN(NLA_U16, 1),
7800 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7801 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7802 [NL80211_MESHCONF_RSSI_THRESHOLD] =
7803 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7804 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7805 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7806 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7807 NLA_POLICY_MIN(NLA_U16, 1),
7808 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7809 NLA_POLICY_MIN(NLA_U16, 1),
7810 [NL80211_MESHCONF_POWER_MODE] =
7811 NLA_POLICY_RANGE(NLA_U32,
7812 NL80211_MESH_POWER_ACTIVE,
7813 NL80211_MESH_POWER_MAX),
7814 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7815 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7816 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7817 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7818 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7819 };
7820
7821 static const struct nla_policy
7822 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7823 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7824 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7825 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7826 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7827 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7828 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7829 [NL80211_MESH_SETUP_IE] =
7830 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7831 IEEE80211_MAX_DATA_LEN),
7832 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7833 };
7834
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)7835 static int nl80211_parse_mesh_config(struct genl_info *info,
7836 struct mesh_config *cfg,
7837 u32 *mask_out)
7838 {
7839 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7840 u32 mask = 0;
7841 u16 ht_opmode;
7842
7843 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
7844 do { \
7845 if (tb[attr]) { \
7846 cfg->param = fn(tb[attr]); \
7847 mask |= BIT((attr) - 1); \
7848 } \
7849 } while (0)
7850
7851 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7852 return -EINVAL;
7853 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7854 return -EINVAL;
7855
7856 /* This makes sure that there aren't more than 32 mesh config
7857 * parameters (otherwise our bitfield scheme would not work.) */
7858 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7859
7860 /* Fill in the params struct */
7861 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7862 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7863 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7864 NL80211_MESHCONF_CONFIRM_TIMEOUT,
7865 nla_get_u16);
7866 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7867 NL80211_MESHCONF_HOLDING_TIMEOUT,
7868 nla_get_u16);
7869 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7870 NL80211_MESHCONF_MAX_PEER_LINKS,
7871 nla_get_u16);
7872 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7873 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7874 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7875 NL80211_MESHCONF_TTL, nla_get_u8);
7876 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7877 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7878 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7879 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7880 nla_get_u8);
7881 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7882 mask,
7883 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7884 nla_get_u32);
7885 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7886 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7887 nla_get_u8);
7888 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7889 NL80211_MESHCONF_PATH_REFRESH_TIME,
7890 nla_get_u32);
7891 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7892 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7893 return -EINVAL;
7894 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7895 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7896 nla_get_u16);
7897 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7898 mask,
7899 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7900 nla_get_u32);
7901 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7902 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7903 cfg->dot11MeshHWMPactivePathTimeout > 65535))
7904 return -EINVAL;
7905 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7906 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7907 nla_get_u16);
7908 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7909 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7910 nla_get_u16);
7911 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7912 dot11MeshHWMPnetDiameterTraversalTime, mask,
7913 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7914 nla_get_u16);
7915 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7916 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7917 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7918 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7919 nla_get_u16);
7920 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7921 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7922 nla_get_u8);
7923 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7924 NL80211_MESHCONF_FORWARDING, nla_get_u8);
7925 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7926 NL80211_MESHCONF_RSSI_THRESHOLD,
7927 nla_get_s32);
7928 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7929 NL80211_MESHCONF_CONNECTED_TO_GATE,
7930 nla_get_u8);
7931 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7932 NL80211_MESHCONF_CONNECTED_TO_AS,
7933 nla_get_u8);
7934 /*
7935 * Check HT operation mode based on
7936 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7937 */
7938 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7939 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7940
7941 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7942 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7943 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7944 return -EINVAL;
7945
7946 /* NON_HT_STA bit is reserved, but some programs set it */
7947 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7948
7949 cfg->ht_opmode = ht_opmode;
7950 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7951 }
7952 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7953 dot11MeshHWMPactivePathToRootTimeout, mask,
7954 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7955 nla_get_u32);
7956 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7957 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7958 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7959 return -EINVAL;
7960 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7961 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7962 nla_get_u16);
7963 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7964 mask,
7965 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7966 nla_get_u16);
7967 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7968 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7969 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7970 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7971 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7972 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7973 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7974 NL80211_MESHCONF_NOLEARN, nla_get_u8);
7975 if (mask_out)
7976 *mask_out = mask;
7977
7978 return 0;
7979
7980 #undef FILL_IN_MESH_PARAM_IF_SET
7981 }
7982
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)7983 static int nl80211_parse_mesh_setup(struct genl_info *info,
7984 struct mesh_setup *setup)
7985 {
7986 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7987 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7988
7989 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7990 return -EINVAL;
7991 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7992 return -EINVAL;
7993
7994 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7995 setup->sync_method =
7996 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7997 IEEE80211_SYNC_METHOD_VENDOR :
7998 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7999
8000 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8001 setup->path_sel_proto =
8002 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8003 IEEE80211_PATH_PROTOCOL_VENDOR :
8004 IEEE80211_PATH_PROTOCOL_HWMP;
8005
8006 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8007 setup->path_metric =
8008 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8009 IEEE80211_PATH_METRIC_VENDOR :
8010 IEEE80211_PATH_METRIC_AIRTIME;
8011
8012 if (tb[NL80211_MESH_SETUP_IE]) {
8013 struct nlattr *ieattr =
8014 tb[NL80211_MESH_SETUP_IE];
8015 setup->ie = nla_data(ieattr);
8016 setup->ie_len = nla_len(ieattr);
8017 }
8018 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8019 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8020 return -EINVAL;
8021 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8022 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8023 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8024 if (setup->is_secure)
8025 setup->user_mpm = true;
8026
8027 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8028 if (!setup->user_mpm)
8029 return -EINVAL;
8030 setup->auth_id =
8031 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8032 }
8033
8034 return 0;
8035 }
8036
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)8037 static int nl80211_update_mesh_config(struct sk_buff *skb,
8038 struct genl_info *info)
8039 {
8040 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8041 struct net_device *dev = info->user_ptr[1];
8042 struct wireless_dev *wdev = dev->ieee80211_ptr;
8043 struct mesh_config cfg;
8044 u32 mask;
8045 int err;
8046
8047 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8048 return -EOPNOTSUPP;
8049
8050 if (!rdev->ops->update_mesh_config)
8051 return -EOPNOTSUPP;
8052
8053 err = nl80211_parse_mesh_config(info, &cfg, &mask);
8054 if (err)
8055 return err;
8056
8057 wdev_lock(wdev);
8058 if (!wdev->u.mesh.id_len)
8059 err = -ENOLINK;
8060
8061 if (!err)
8062 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8063
8064 wdev_unlock(wdev);
8065
8066 return err;
8067 }
8068
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)8069 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8070 struct sk_buff *msg)
8071 {
8072 struct nlattr *nl_reg_rules;
8073 unsigned int i;
8074
8075 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8076 (regdom->dfs_region &&
8077 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8078 goto nla_put_failure;
8079
8080 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8081 if (!nl_reg_rules)
8082 goto nla_put_failure;
8083
8084 for (i = 0; i < regdom->n_reg_rules; i++) {
8085 struct nlattr *nl_reg_rule;
8086 const struct ieee80211_reg_rule *reg_rule;
8087 const struct ieee80211_freq_range *freq_range;
8088 const struct ieee80211_power_rule *power_rule;
8089 unsigned int max_bandwidth_khz;
8090
8091 reg_rule = ®dom->reg_rules[i];
8092 freq_range = ®_rule->freq_range;
8093 power_rule = ®_rule->power_rule;
8094
8095 nl_reg_rule = nla_nest_start_noflag(msg, i);
8096 if (!nl_reg_rule)
8097 goto nla_put_failure;
8098
8099 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8100 if (!max_bandwidth_khz)
8101 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8102 reg_rule);
8103
8104 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8105 reg_rule->flags) ||
8106 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8107 freq_range->start_freq_khz) ||
8108 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8109 freq_range->end_freq_khz) ||
8110 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8111 max_bandwidth_khz) ||
8112 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8113 power_rule->max_antenna_gain) ||
8114 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8115 power_rule->max_eirp) ||
8116 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8117 reg_rule->dfs_cac_ms))
8118 goto nla_put_failure;
8119
8120 nla_nest_end(msg, nl_reg_rule);
8121 }
8122
8123 nla_nest_end(msg, nl_reg_rules);
8124 return 0;
8125
8126 nla_put_failure:
8127 return -EMSGSIZE;
8128 }
8129
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)8130 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8131 {
8132 const struct ieee80211_regdomain *regdom = NULL;
8133 struct cfg80211_registered_device *rdev;
8134 struct wiphy *wiphy = NULL;
8135 struct sk_buff *msg;
8136 int err = -EMSGSIZE;
8137 void *hdr;
8138
8139 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8140 if (!msg)
8141 return -ENOBUFS;
8142
8143 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8144 NL80211_CMD_GET_REG);
8145 if (!hdr)
8146 goto put_failure;
8147
8148 rtnl_lock();
8149
8150 if (info->attrs[NL80211_ATTR_WIPHY]) {
8151 bool self_managed;
8152
8153 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8154 if (IS_ERR(rdev)) {
8155 err = PTR_ERR(rdev);
8156 goto nla_put_failure;
8157 }
8158
8159 wiphy = &rdev->wiphy;
8160 self_managed = wiphy->regulatory_flags &
8161 REGULATORY_WIPHY_SELF_MANAGED;
8162
8163 rcu_read_lock();
8164
8165 regdom = get_wiphy_regdom(wiphy);
8166
8167 /* a self-managed-reg device must have a private regdom */
8168 if (WARN_ON(!regdom && self_managed)) {
8169 err = -EINVAL;
8170 goto nla_put_failure_rcu;
8171 }
8172
8173 if (regdom &&
8174 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8175 goto nla_put_failure_rcu;
8176 } else {
8177 rcu_read_lock();
8178 }
8179
8180 if (!wiphy && reg_last_request_cell_base() &&
8181 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8182 NL80211_USER_REG_HINT_CELL_BASE))
8183 goto nla_put_failure_rcu;
8184
8185 if (!regdom)
8186 regdom = rcu_dereference(cfg80211_regdomain);
8187
8188 if (nl80211_put_regdom(regdom, msg))
8189 goto nla_put_failure_rcu;
8190
8191 rcu_read_unlock();
8192
8193 genlmsg_end(msg, hdr);
8194 rtnl_unlock();
8195 return genlmsg_reply(msg, info);
8196
8197 nla_put_failure_rcu:
8198 rcu_read_unlock();
8199 nla_put_failure:
8200 rtnl_unlock();
8201 put_failure:
8202 nlmsg_free(msg);
8203 return err;
8204 }
8205
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)8206 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8207 u32 seq, int flags, struct wiphy *wiphy,
8208 const struct ieee80211_regdomain *regdom)
8209 {
8210 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8211 NL80211_CMD_GET_REG);
8212
8213 if (!hdr)
8214 return -1;
8215
8216 genl_dump_check_consistent(cb, hdr);
8217
8218 if (nl80211_put_regdom(regdom, msg))
8219 goto nla_put_failure;
8220
8221 if (!wiphy && reg_last_request_cell_base() &&
8222 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8223 NL80211_USER_REG_HINT_CELL_BASE))
8224 goto nla_put_failure;
8225
8226 if (wiphy &&
8227 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8228 goto nla_put_failure;
8229
8230 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8231 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8232 goto nla_put_failure;
8233
8234 genlmsg_end(msg, hdr);
8235 return 0;
8236
8237 nla_put_failure:
8238 genlmsg_cancel(msg, hdr);
8239 return -EMSGSIZE;
8240 }
8241
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)8242 static int nl80211_get_reg_dump(struct sk_buff *skb,
8243 struct netlink_callback *cb)
8244 {
8245 const struct ieee80211_regdomain *regdom = NULL;
8246 struct cfg80211_registered_device *rdev;
8247 int err, reg_idx, start = cb->args[2];
8248
8249 rcu_read_lock();
8250
8251 if (cfg80211_regdomain && start == 0) {
8252 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8253 NLM_F_MULTI, NULL,
8254 rcu_dereference(cfg80211_regdomain));
8255 if (err < 0)
8256 goto out_err;
8257 }
8258
8259 /* the global regdom is idx 0 */
8260 reg_idx = 1;
8261 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8262 regdom = get_wiphy_regdom(&rdev->wiphy);
8263 if (!regdom)
8264 continue;
8265
8266 if (++reg_idx <= start)
8267 continue;
8268
8269 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8270 NLM_F_MULTI, &rdev->wiphy, regdom);
8271 if (err < 0) {
8272 reg_idx--;
8273 break;
8274 }
8275 }
8276
8277 cb->args[2] = reg_idx;
8278 err = skb->len;
8279 out_err:
8280 rcu_read_unlock();
8281 return err;
8282 }
8283
8284 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8285 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8286 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
8287 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
8288 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
8289 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
8290 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
8291 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
8292 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
8293 };
8294
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)8295 static int parse_reg_rule(struct nlattr *tb[],
8296 struct ieee80211_reg_rule *reg_rule)
8297 {
8298 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
8299 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
8300
8301 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8302 return -EINVAL;
8303 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8304 return -EINVAL;
8305 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8306 return -EINVAL;
8307 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8308 return -EINVAL;
8309 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8310 return -EINVAL;
8311
8312 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8313
8314 freq_range->start_freq_khz =
8315 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8316 freq_range->end_freq_khz =
8317 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8318 freq_range->max_bandwidth_khz =
8319 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8320
8321 power_rule->max_eirp =
8322 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8323
8324 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8325 power_rule->max_antenna_gain =
8326 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8327
8328 if (tb[NL80211_ATTR_DFS_CAC_TIME])
8329 reg_rule->dfs_cac_ms =
8330 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8331
8332 return 0;
8333 }
8334
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)8335 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8336 {
8337 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8338 struct nlattr *nl_reg_rule;
8339 char *alpha2;
8340 int rem_reg_rules, r;
8341 u32 num_rules = 0, rule_idx = 0;
8342 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8343 struct ieee80211_regdomain *rd;
8344
8345 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8346 return -EINVAL;
8347
8348 if (!info->attrs[NL80211_ATTR_REG_RULES])
8349 return -EINVAL;
8350
8351 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8352
8353 if (info->attrs[NL80211_ATTR_DFS_REGION])
8354 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8355
8356 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8357 rem_reg_rules) {
8358 num_rules++;
8359 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8360 return -EINVAL;
8361 }
8362
8363 rtnl_lock();
8364 if (!reg_is_valid_request(alpha2)) {
8365 r = -EINVAL;
8366 goto out;
8367 }
8368
8369 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8370 if (!rd) {
8371 r = -ENOMEM;
8372 goto out;
8373 }
8374
8375 rd->n_reg_rules = num_rules;
8376 rd->alpha2[0] = alpha2[0];
8377 rd->alpha2[1] = alpha2[1];
8378
8379 /*
8380 * Disable DFS master mode if the DFS region was
8381 * not supported or known on this kernel.
8382 */
8383 if (reg_supported_dfs_region(dfs_region))
8384 rd->dfs_region = dfs_region;
8385
8386 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8387 rem_reg_rules) {
8388 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8389 nl_reg_rule, reg_rule_policy,
8390 info->extack);
8391 if (r)
8392 goto bad_reg;
8393 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8394 if (r)
8395 goto bad_reg;
8396
8397 rule_idx++;
8398
8399 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8400 r = -EINVAL;
8401 goto bad_reg;
8402 }
8403 }
8404
8405 r = set_regdom(rd, REGD_SOURCE_CRDA);
8406 /* set_regdom takes ownership of rd */
8407 rd = NULL;
8408 bad_reg:
8409 kfree(rd);
8410 out:
8411 rtnl_unlock();
8412 return r;
8413 }
8414 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8415
validate_scan_freqs(struct nlattr * freqs)8416 static int validate_scan_freqs(struct nlattr *freqs)
8417 {
8418 struct nlattr *attr1, *attr2;
8419 int n_channels = 0, tmp1, tmp2;
8420
8421 nla_for_each_nested(attr1, freqs, tmp1)
8422 if (nla_len(attr1) != sizeof(u32))
8423 return 0;
8424
8425 nla_for_each_nested(attr1, freqs, tmp1) {
8426 n_channels++;
8427 /*
8428 * Some hardware has a limited channel list for
8429 * scanning, and it is pretty much nonsensical
8430 * to scan for a channel twice, so disallow that
8431 * and don't require drivers to check that the
8432 * channel list they get isn't longer than what
8433 * they can scan, as long as they can scan all
8434 * the channels they registered at once.
8435 */
8436 nla_for_each_nested(attr2, freqs, tmp2)
8437 if (attr1 != attr2 &&
8438 nla_get_u32(attr1) == nla_get_u32(attr2))
8439 return 0;
8440 }
8441
8442 return n_channels;
8443 }
8444
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)8445 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8446 {
8447 return b < NUM_NL80211_BANDS && wiphy->bands[b];
8448 }
8449
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)8450 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8451 struct cfg80211_bss_selection *bss_select)
8452 {
8453 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8454 struct nlattr *nest;
8455 int err;
8456 bool found = false;
8457 int i;
8458
8459 /* only process one nested attribute */
8460 nest = nla_data(nla);
8461 if (!nla_ok(nest, nla_len(nest)))
8462 return -EINVAL;
8463
8464 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8465 nest, nl80211_bss_select_policy,
8466 NULL);
8467 if (err)
8468 return err;
8469
8470 /* only one attribute may be given */
8471 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8472 if (attr[i]) {
8473 if (found)
8474 return -EINVAL;
8475 found = true;
8476 }
8477 }
8478
8479 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8480
8481 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8482 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8483
8484 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8485 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8486 bss_select->param.band_pref =
8487 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8488 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8489 return -EINVAL;
8490 }
8491
8492 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8493 struct nl80211_bss_select_rssi_adjust *adj_param;
8494
8495 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8496 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8497 bss_select->param.adjust.band = adj_param->band;
8498 bss_select->param.adjust.delta = adj_param->delta;
8499 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8500 return -EINVAL;
8501 }
8502
8503 /* user-space did not provide behaviour attribute */
8504 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8505 return -EINVAL;
8506
8507 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8508 return -EINVAL;
8509
8510 return 0;
8511 }
8512
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)8513 int nl80211_parse_random_mac(struct nlattr **attrs,
8514 u8 *mac_addr, u8 *mac_addr_mask)
8515 {
8516 int i;
8517
8518 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8519 eth_zero_addr(mac_addr);
8520 eth_zero_addr(mac_addr_mask);
8521 mac_addr[0] = 0x2;
8522 mac_addr_mask[0] = 0x3;
8523
8524 return 0;
8525 }
8526
8527 /* need both or none */
8528 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8529 return -EINVAL;
8530
8531 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8532 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8533
8534 /* don't allow or configure an mcast address */
8535 if (!is_multicast_ether_addr(mac_addr_mask) ||
8536 is_multicast_ether_addr(mac_addr))
8537 return -EINVAL;
8538
8539 /*
8540 * allow users to pass a MAC address that has bits set outside
8541 * of the mask, but don't bother drivers with having to deal
8542 * with such bits
8543 */
8544 for (i = 0; i < ETH_ALEN; i++)
8545 mac_addr[i] &= mac_addr_mask[i];
8546
8547 return 0;
8548 }
8549
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)8550 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8551 struct ieee80211_channel *chan)
8552 {
8553 unsigned int link_id;
8554 bool all_ok = true;
8555
8556 ASSERT_WDEV_LOCK(wdev);
8557
8558 if (!cfg80211_beaconing_iface_active(wdev))
8559 return true;
8560
8561 /*
8562 * FIXME: check if we have a free HW resource/link for chan
8563 *
8564 * This, as well as the FIXME below, requires knowing the link
8565 * capabilities of the hardware.
8566 */
8567
8568 /* we cannot leave radar channels */
8569 for_each_valid_link(wdev, link_id) {
8570 struct cfg80211_chan_def *chandef;
8571
8572 chandef = wdev_chandef(wdev, link_id);
8573 if (!chandef)
8574 continue;
8575
8576 /*
8577 * FIXME: don't require all_ok, but rather check only the
8578 * correct HW resource/link onto which 'chan' falls,
8579 * as only that link leaves the channel for doing
8580 * the off-channel operation.
8581 */
8582
8583 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
8584 all_ok = false;
8585 }
8586
8587 if (all_ok)
8588 return true;
8589
8590 return regulatory_pre_cac_allowed(wdev->wiphy);
8591 }
8592
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)8593 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8594 enum nl80211_ext_feature_index feat)
8595 {
8596 if (!(flags & flag))
8597 return true;
8598 if (wiphy_ext_feature_isset(wiphy, feat))
8599 return true;
8600 return false;
8601 }
8602
8603 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)8604 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8605 void *request, struct nlattr **attrs,
8606 bool is_sched_scan)
8607 {
8608 u8 *mac_addr, *mac_addr_mask;
8609 u32 *flags;
8610 enum nl80211_feature_flags randomness_flag;
8611
8612 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8613 return 0;
8614
8615 if (is_sched_scan) {
8616 struct cfg80211_sched_scan_request *req = request;
8617
8618 randomness_flag = wdev ?
8619 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8620 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8621 flags = &req->flags;
8622 mac_addr = req->mac_addr;
8623 mac_addr_mask = req->mac_addr_mask;
8624 } else {
8625 struct cfg80211_scan_request *req = request;
8626
8627 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8628 flags = &req->flags;
8629 mac_addr = req->mac_addr;
8630 mac_addr_mask = req->mac_addr_mask;
8631 }
8632
8633 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8634
8635 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8636 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8637 !nl80211_check_scan_feat(wiphy, *flags,
8638 NL80211_SCAN_FLAG_LOW_SPAN,
8639 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8640 !nl80211_check_scan_feat(wiphy, *flags,
8641 NL80211_SCAN_FLAG_LOW_POWER,
8642 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8643 !nl80211_check_scan_feat(wiphy, *flags,
8644 NL80211_SCAN_FLAG_HIGH_ACCURACY,
8645 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8646 !nl80211_check_scan_feat(wiphy, *flags,
8647 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8648 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8649 !nl80211_check_scan_feat(wiphy, *flags,
8650 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8651 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8652 !nl80211_check_scan_feat(wiphy, *flags,
8653 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8654 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8655 !nl80211_check_scan_feat(wiphy, *flags,
8656 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8657 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8658 !nl80211_check_scan_feat(wiphy, *flags,
8659 NL80211_SCAN_FLAG_RANDOM_SN,
8660 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8661 !nl80211_check_scan_feat(wiphy, *flags,
8662 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8663 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8664 return -EOPNOTSUPP;
8665
8666 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8667 int err;
8668
8669 if (!(wiphy->features & randomness_flag) ||
8670 (wdev && wdev->connected))
8671 return -EOPNOTSUPP;
8672
8673 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8674 if (err)
8675 return err;
8676 }
8677
8678 return 0;
8679 }
8680
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)8681 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8682 {
8683 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8684 struct wireless_dev *wdev = info->user_ptr[1];
8685 struct cfg80211_scan_request *request;
8686 struct nlattr *scan_freqs = NULL;
8687 bool scan_freqs_khz = false;
8688 struct nlattr *attr;
8689 struct wiphy *wiphy;
8690 int err, tmp, n_ssids = 0, n_channels, i;
8691 size_t ie_len;
8692
8693 wiphy = &rdev->wiphy;
8694
8695 if (wdev->iftype == NL80211_IFTYPE_NAN)
8696 return -EOPNOTSUPP;
8697
8698 if (!rdev->ops->scan)
8699 return -EOPNOTSUPP;
8700
8701 if (rdev->scan_req || rdev->scan_msg)
8702 return -EBUSY;
8703
8704 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8705 if (!wiphy_ext_feature_isset(wiphy,
8706 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8707 return -EOPNOTSUPP;
8708 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8709 scan_freqs_khz = true;
8710 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8711 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8712
8713 if (scan_freqs) {
8714 n_channels = validate_scan_freqs(scan_freqs);
8715 if (!n_channels)
8716 return -EINVAL;
8717 } else {
8718 n_channels = ieee80211_get_num_supported_channels(wiphy);
8719 }
8720
8721 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8722 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8723 n_ssids++;
8724
8725 if (n_ssids > wiphy->max_scan_ssids)
8726 return -EINVAL;
8727
8728 if (info->attrs[NL80211_ATTR_IE])
8729 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8730 else
8731 ie_len = 0;
8732
8733 if (ie_len > wiphy->max_scan_ie_len)
8734 return -EINVAL;
8735
8736 request = kzalloc(sizeof(*request)
8737 + sizeof(*request->ssids) * n_ssids
8738 + sizeof(*request->channels) * n_channels
8739 + ie_len, GFP_KERNEL);
8740 if (!request)
8741 return -ENOMEM;
8742
8743 if (n_ssids)
8744 request->ssids = (void *)&request->channels[n_channels];
8745 request->n_ssids = n_ssids;
8746 if (ie_len) {
8747 if (n_ssids)
8748 request->ie = (void *)(request->ssids + n_ssids);
8749 else
8750 request->ie = (void *)(request->channels + n_channels);
8751 }
8752
8753 i = 0;
8754 if (scan_freqs) {
8755 /* user specified, bail out if channel not found */
8756 nla_for_each_nested(attr, scan_freqs, tmp) {
8757 struct ieee80211_channel *chan;
8758 int freq = nla_get_u32(attr);
8759
8760 if (!scan_freqs_khz)
8761 freq = MHZ_TO_KHZ(freq);
8762
8763 chan = ieee80211_get_channel_khz(wiphy, freq);
8764 if (!chan) {
8765 err = -EINVAL;
8766 goto out_free;
8767 }
8768
8769 /* ignore disabled channels */
8770 if (chan->flags & IEEE80211_CHAN_DISABLED)
8771 continue;
8772
8773 request->channels[i] = chan;
8774 i++;
8775 }
8776 } else {
8777 enum nl80211_band band;
8778
8779 /* all channels */
8780 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8781 int j;
8782
8783 if (!wiphy->bands[band])
8784 continue;
8785 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8786 struct ieee80211_channel *chan;
8787
8788 chan = &wiphy->bands[band]->channels[j];
8789
8790 if (chan->flags & IEEE80211_CHAN_DISABLED)
8791 continue;
8792
8793 request->channels[i] = chan;
8794 i++;
8795 }
8796 }
8797 }
8798
8799 if (!i) {
8800 err = -EINVAL;
8801 goto out_free;
8802 }
8803
8804 request->n_channels = i;
8805
8806 wdev_lock(wdev);
8807 for (i = 0; i < request->n_channels; i++) {
8808 struct ieee80211_channel *chan = request->channels[i];
8809
8810 /* if we can go off-channel to the target channel we're good */
8811 if (cfg80211_off_channel_oper_allowed(wdev, chan))
8812 continue;
8813
8814 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
8815 wdev_unlock(wdev);
8816 err = -EBUSY;
8817 goto out_free;
8818 }
8819 }
8820 wdev_unlock(wdev);
8821
8822 i = 0;
8823 if (n_ssids) {
8824 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8825 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8826 err = -EINVAL;
8827 goto out_free;
8828 }
8829 request->ssids[i].ssid_len = nla_len(attr);
8830 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8831 i++;
8832 }
8833 }
8834
8835 if (info->attrs[NL80211_ATTR_IE]) {
8836 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8837 memcpy((void *)request->ie,
8838 nla_data(info->attrs[NL80211_ATTR_IE]),
8839 request->ie_len);
8840 }
8841
8842 for (i = 0; i < NUM_NL80211_BANDS; i++)
8843 if (wiphy->bands[i])
8844 request->rates[i] =
8845 (1 << wiphy->bands[i]->n_bitrates) - 1;
8846
8847 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8848 nla_for_each_nested(attr,
8849 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8850 tmp) {
8851 enum nl80211_band band = nla_type(attr);
8852
8853 if (band < 0 || band >= NUM_NL80211_BANDS) {
8854 err = -EINVAL;
8855 goto out_free;
8856 }
8857
8858 if (!wiphy->bands[band])
8859 continue;
8860
8861 err = ieee80211_get_ratemask(wiphy->bands[band],
8862 nla_data(attr),
8863 nla_len(attr),
8864 &request->rates[band]);
8865 if (err)
8866 goto out_free;
8867 }
8868 }
8869
8870 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8871 request->duration =
8872 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8873 request->duration_mandatory =
8874 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8875 }
8876
8877 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8878 false);
8879 if (err)
8880 goto out_free;
8881
8882 request->no_cck =
8883 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8884
8885 /* Initial implementation used NL80211_ATTR_MAC to set the specific
8886 * BSSID to scan for. This was problematic because that same attribute
8887 * was already used for another purpose (local random MAC address). The
8888 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8889 * compatibility with older userspace components, also use the
8890 * NL80211_ATTR_MAC value here if it can be determined to be used for
8891 * the specific BSSID use case instead of the random MAC address
8892 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8893 */
8894 if (info->attrs[NL80211_ATTR_BSSID])
8895 memcpy(request->bssid,
8896 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8897 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8898 info->attrs[NL80211_ATTR_MAC])
8899 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8900 ETH_ALEN);
8901 else
8902 eth_broadcast_addr(request->bssid);
8903
8904 request->wdev = wdev;
8905 request->wiphy = &rdev->wiphy;
8906 request->scan_start = jiffies;
8907
8908 rdev->scan_req = request;
8909 err = cfg80211_scan(rdev);
8910
8911 if (err)
8912 goto out_free;
8913
8914 nl80211_send_scan_start(rdev, wdev);
8915 dev_hold(wdev->netdev);
8916
8917 return 0;
8918
8919 out_free:
8920 rdev->scan_req = NULL;
8921 kfree(request);
8922
8923 return err;
8924 }
8925
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)8926 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8927 {
8928 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8929 struct wireless_dev *wdev = info->user_ptr[1];
8930
8931 if (!rdev->ops->abort_scan)
8932 return -EOPNOTSUPP;
8933
8934 if (rdev->scan_msg)
8935 return 0;
8936
8937 if (!rdev->scan_req)
8938 return -ENOENT;
8939
8940 rdev_abort_scan(rdev, wdev);
8941 return 0;
8942 }
8943
8944 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)8945 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8946 struct cfg80211_sched_scan_request *request,
8947 struct nlattr **attrs)
8948 {
8949 int tmp, err, i = 0;
8950 struct nlattr *attr;
8951
8952 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8953 u32 interval;
8954
8955 /*
8956 * If scan plans are not specified,
8957 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8958 * case one scan plan will be set with the specified scan
8959 * interval and infinite number of iterations.
8960 */
8961 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8962 if (!interval)
8963 return -EINVAL;
8964
8965 request->scan_plans[0].interval =
8966 DIV_ROUND_UP(interval, MSEC_PER_SEC);
8967 if (!request->scan_plans[0].interval)
8968 return -EINVAL;
8969
8970 if (request->scan_plans[0].interval >
8971 wiphy->max_sched_scan_plan_interval)
8972 request->scan_plans[0].interval =
8973 wiphy->max_sched_scan_plan_interval;
8974
8975 return 0;
8976 }
8977
8978 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8979 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8980
8981 if (WARN_ON(i >= n_plans))
8982 return -EINVAL;
8983
8984 err = nla_parse_nested_deprecated(plan,
8985 NL80211_SCHED_SCAN_PLAN_MAX,
8986 attr, nl80211_plan_policy,
8987 NULL);
8988 if (err)
8989 return err;
8990
8991 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8992 return -EINVAL;
8993
8994 request->scan_plans[i].interval =
8995 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8996 if (!request->scan_plans[i].interval ||
8997 request->scan_plans[i].interval >
8998 wiphy->max_sched_scan_plan_interval)
8999 return -EINVAL;
9000
9001 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9002 request->scan_plans[i].iterations =
9003 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9004 if (!request->scan_plans[i].iterations ||
9005 (request->scan_plans[i].iterations >
9006 wiphy->max_sched_scan_plan_iterations))
9007 return -EINVAL;
9008 } else if (i < n_plans - 1) {
9009 /*
9010 * All scan plans but the last one must specify
9011 * a finite number of iterations
9012 */
9013 return -EINVAL;
9014 }
9015
9016 i++;
9017 }
9018
9019 /*
9020 * The last scan plan must not specify the number of
9021 * iterations, it is supposed to run infinitely
9022 */
9023 if (request->scan_plans[n_plans - 1].iterations)
9024 return -EINVAL;
9025
9026 return 0;
9027 }
9028
9029 static int
nl80211_parse_sched_scan_per_band_rssi(struct wiphy * wiphy,struct cfg80211_match_set * match_sets,struct nlattr * tb_band_rssi,s32 rssi_thold)9030 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9031 struct cfg80211_match_set *match_sets,
9032 struct nlattr *tb_band_rssi,
9033 s32 rssi_thold)
9034 {
9035 struct nlattr *attr;
9036 int i, tmp, ret = 0;
9037
9038 if (!wiphy_ext_feature_isset(wiphy,
9039 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9040 if (tb_band_rssi)
9041 ret = -EOPNOTSUPP;
9042 else
9043 for (i = 0; i < NUM_NL80211_BANDS; i++)
9044 match_sets->per_band_rssi_thold[i] =
9045 NL80211_SCAN_RSSI_THOLD_OFF;
9046 return ret;
9047 }
9048
9049 for (i = 0; i < NUM_NL80211_BANDS; i++)
9050 match_sets->per_band_rssi_thold[i] = rssi_thold;
9051
9052 nla_for_each_nested(attr, tb_band_rssi, tmp) {
9053 enum nl80211_band band = nla_type(attr);
9054
9055 if (band < 0 || band >= NUM_NL80211_BANDS)
9056 return -EINVAL;
9057
9058 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9059 }
9060
9061 return 0;
9062 }
9063
9064 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)9065 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9066 struct nlattr **attrs, int max_match_sets)
9067 {
9068 struct cfg80211_sched_scan_request *request;
9069 struct nlattr *attr;
9070 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9071 enum nl80211_band band;
9072 size_t ie_len;
9073 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9074 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9075
9076 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9077 n_channels = validate_scan_freqs(
9078 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9079 if (!n_channels)
9080 return ERR_PTR(-EINVAL);
9081 } else {
9082 n_channels = ieee80211_get_num_supported_channels(wiphy);
9083 }
9084
9085 if (attrs[NL80211_ATTR_SCAN_SSIDS])
9086 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9087 tmp)
9088 n_ssids++;
9089
9090 if (n_ssids > wiphy->max_sched_scan_ssids)
9091 return ERR_PTR(-EINVAL);
9092
9093 /*
9094 * First, count the number of 'real' matchsets. Due to an issue with
9095 * the old implementation, matchsets containing only the RSSI attribute
9096 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9097 * RSSI for all matchsets, rather than their own matchset for reporting
9098 * all APs with a strong RSSI. This is needed to be compatible with
9099 * older userspace that treated a matchset with only the RSSI as the
9100 * global RSSI for all other matchsets - if there are other matchsets.
9101 */
9102 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9103 nla_for_each_nested(attr,
9104 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9105 tmp) {
9106 struct nlattr *rssi;
9107
9108 err = nla_parse_nested_deprecated(tb,
9109 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9110 attr,
9111 nl80211_match_policy,
9112 NULL);
9113 if (err)
9114 return ERR_PTR(err);
9115
9116 /* SSID and BSSID are mutually exclusive */
9117 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9118 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9119 return ERR_PTR(-EINVAL);
9120
9121 /* add other standalone attributes here */
9122 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9123 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9124 n_match_sets++;
9125 continue;
9126 }
9127 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9128 if (rssi)
9129 default_match_rssi = nla_get_s32(rssi);
9130 }
9131 }
9132
9133 /* However, if there's no other matchset, add the RSSI one */
9134 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9135 n_match_sets = 1;
9136
9137 if (n_match_sets > max_match_sets)
9138 return ERR_PTR(-EINVAL);
9139
9140 if (attrs[NL80211_ATTR_IE])
9141 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9142 else
9143 ie_len = 0;
9144
9145 if (ie_len > wiphy->max_sched_scan_ie_len)
9146 return ERR_PTR(-EINVAL);
9147
9148 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9149 /*
9150 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9151 * each scan plan already specifies its own interval
9152 */
9153 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9154 return ERR_PTR(-EINVAL);
9155
9156 nla_for_each_nested(attr,
9157 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9158 n_plans++;
9159 } else {
9160 /*
9161 * The scan interval attribute is kept for backward
9162 * compatibility. If no scan plans are specified and sched scan
9163 * interval is specified, one scan plan will be set with this
9164 * scan interval and infinite number of iterations.
9165 */
9166 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9167 return ERR_PTR(-EINVAL);
9168
9169 n_plans = 1;
9170 }
9171
9172 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9173 return ERR_PTR(-EINVAL);
9174
9175 if (!wiphy_ext_feature_isset(
9176 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9177 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9178 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9179 return ERR_PTR(-EINVAL);
9180
9181 request = kzalloc(sizeof(*request)
9182 + sizeof(*request->ssids) * n_ssids
9183 + sizeof(*request->match_sets) * n_match_sets
9184 + sizeof(*request->scan_plans) * n_plans
9185 + sizeof(*request->channels) * n_channels
9186 + ie_len, GFP_KERNEL);
9187 if (!request)
9188 return ERR_PTR(-ENOMEM);
9189
9190 if (n_ssids)
9191 request->ssids = (void *)&request->channels[n_channels];
9192 request->n_ssids = n_ssids;
9193 if (ie_len) {
9194 if (n_ssids)
9195 request->ie = (void *)(request->ssids + n_ssids);
9196 else
9197 request->ie = (void *)(request->channels + n_channels);
9198 }
9199
9200 if (n_match_sets) {
9201 if (request->ie)
9202 request->match_sets = (void *)(request->ie + ie_len);
9203 else if (n_ssids)
9204 request->match_sets =
9205 (void *)(request->ssids + n_ssids);
9206 else
9207 request->match_sets =
9208 (void *)(request->channels + n_channels);
9209 }
9210 request->n_match_sets = n_match_sets;
9211
9212 if (n_match_sets)
9213 request->scan_plans = (void *)(request->match_sets +
9214 n_match_sets);
9215 else if (request->ie)
9216 request->scan_plans = (void *)(request->ie + ie_len);
9217 else if (n_ssids)
9218 request->scan_plans = (void *)(request->ssids + n_ssids);
9219 else
9220 request->scan_plans = (void *)(request->channels + n_channels);
9221
9222 request->n_scan_plans = n_plans;
9223
9224 i = 0;
9225 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9226 /* user specified, bail out if channel not found */
9227 nla_for_each_nested(attr,
9228 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9229 tmp) {
9230 struct ieee80211_channel *chan;
9231
9232 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9233
9234 if (!chan) {
9235 err = -EINVAL;
9236 goto out_free;
9237 }
9238
9239 /* ignore disabled channels */
9240 if (chan->flags & IEEE80211_CHAN_DISABLED)
9241 continue;
9242
9243 request->channels[i] = chan;
9244 i++;
9245 }
9246 } else {
9247 /* all channels */
9248 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9249 int j;
9250
9251 if (!wiphy->bands[band])
9252 continue;
9253 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9254 struct ieee80211_channel *chan;
9255
9256 chan = &wiphy->bands[band]->channels[j];
9257
9258 if (chan->flags & IEEE80211_CHAN_DISABLED)
9259 continue;
9260
9261 request->channels[i] = chan;
9262 i++;
9263 }
9264 }
9265 }
9266
9267 if (!i) {
9268 err = -EINVAL;
9269 goto out_free;
9270 }
9271
9272 request->n_channels = i;
9273
9274 i = 0;
9275 if (n_ssids) {
9276 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9277 tmp) {
9278 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9279 err = -EINVAL;
9280 goto out_free;
9281 }
9282 request->ssids[i].ssid_len = nla_len(attr);
9283 memcpy(request->ssids[i].ssid, nla_data(attr),
9284 nla_len(attr));
9285 i++;
9286 }
9287 }
9288
9289 i = 0;
9290 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9291 nla_for_each_nested(attr,
9292 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9293 tmp) {
9294 struct nlattr *ssid, *bssid, *rssi;
9295
9296 err = nla_parse_nested_deprecated(tb,
9297 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9298 attr,
9299 nl80211_match_policy,
9300 NULL);
9301 if (err)
9302 goto out_free;
9303 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9304 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9305
9306 if (!ssid && !bssid) {
9307 i++;
9308 continue;
9309 }
9310
9311 if (WARN_ON(i >= n_match_sets)) {
9312 /* this indicates a programming error,
9313 * the loop above should have verified
9314 * things properly
9315 */
9316 err = -EINVAL;
9317 goto out_free;
9318 }
9319
9320 if (ssid) {
9321 memcpy(request->match_sets[i].ssid.ssid,
9322 nla_data(ssid), nla_len(ssid));
9323 request->match_sets[i].ssid.ssid_len =
9324 nla_len(ssid);
9325 }
9326 if (bssid)
9327 memcpy(request->match_sets[i].bssid,
9328 nla_data(bssid), ETH_ALEN);
9329
9330 /* special attribute - old implementation w/a */
9331 request->match_sets[i].rssi_thold = default_match_rssi;
9332 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9333 if (rssi)
9334 request->match_sets[i].rssi_thold =
9335 nla_get_s32(rssi);
9336
9337 /* Parse per band RSSI attribute */
9338 err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9339 &request->match_sets[i],
9340 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9341 request->match_sets[i].rssi_thold);
9342 if (err)
9343 goto out_free;
9344
9345 i++;
9346 }
9347
9348 /* there was no other matchset, so the RSSI one is alone */
9349 if (i == 0 && n_match_sets)
9350 request->match_sets[0].rssi_thold = default_match_rssi;
9351
9352 request->min_rssi_thold = INT_MAX;
9353 for (i = 0; i < n_match_sets; i++)
9354 request->min_rssi_thold =
9355 min(request->match_sets[i].rssi_thold,
9356 request->min_rssi_thold);
9357 } else {
9358 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9359 }
9360
9361 if (ie_len) {
9362 request->ie_len = ie_len;
9363 memcpy((void *)request->ie,
9364 nla_data(attrs[NL80211_ATTR_IE]),
9365 request->ie_len);
9366 }
9367
9368 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9369 if (err)
9370 goto out_free;
9371
9372 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9373 request->delay =
9374 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9375
9376 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9377 request->relative_rssi = nla_get_s8(
9378 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9379 request->relative_rssi_set = true;
9380 }
9381
9382 if (request->relative_rssi_set &&
9383 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9384 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9385
9386 rssi_adjust = nla_data(
9387 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9388 request->rssi_adjust.band = rssi_adjust->band;
9389 request->rssi_adjust.delta = rssi_adjust->delta;
9390 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9391 err = -EINVAL;
9392 goto out_free;
9393 }
9394 }
9395
9396 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9397 if (err)
9398 goto out_free;
9399
9400 request->scan_start = jiffies;
9401
9402 return request;
9403
9404 out_free:
9405 kfree(request);
9406 return ERR_PTR(err);
9407 }
9408
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)9409 static int nl80211_start_sched_scan(struct sk_buff *skb,
9410 struct genl_info *info)
9411 {
9412 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9413 struct net_device *dev = info->user_ptr[1];
9414 struct wireless_dev *wdev = dev->ieee80211_ptr;
9415 struct cfg80211_sched_scan_request *sched_scan_req;
9416 bool want_multi;
9417 int err;
9418
9419 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9420 return -EOPNOTSUPP;
9421
9422 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9423 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9424 if (err)
9425 return err;
9426
9427 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9428 info->attrs,
9429 rdev->wiphy.max_match_sets);
9430
9431 err = PTR_ERR_OR_ZERO(sched_scan_req);
9432 if (err)
9433 goto out_err;
9434
9435 /* leave request id zero for legacy request
9436 * or if driver does not support multi-scheduled scan
9437 */
9438 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9439 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9440
9441 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9442 if (err)
9443 goto out_free;
9444
9445 sched_scan_req->dev = dev;
9446 sched_scan_req->wiphy = &rdev->wiphy;
9447
9448 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9449 sched_scan_req->owner_nlportid = info->snd_portid;
9450
9451 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9452
9453 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9454 return 0;
9455
9456 out_free:
9457 kfree(sched_scan_req);
9458 out_err:
9459 return err;
9460 }
9461
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)9462 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9463 struct genl_info *info)
9464 {
9465 struct cfg80211_sched_scan_request *req;
9466 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9467 u64 cookie;
9468
9469 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9470 return -EOPNOTSUPP;
9471
9472 if (info->attrs[NL80211_ATTR_COOKIE]) {
9473 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9474 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9475 }
9476
9477 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9478 struct cfg80211_sched_scan_request,
9479 list);
9480 if (!req || req->reqid ||
9481 (req->owner_nlportid &&
9482 req->owner_nlportid != info->snd_portid))
9483 return -ENOENT;
9484
9485 return cfg80211_stop_sched_scan_req(rdev, req, false);
9486 }
9487
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)9488 static int nl80211_start_radar_detection(struct sk_buff *skb,
9489 struct genl_info *info)
9490 {
9491 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9492 struct net_device *dev = info->user_ptr[1];
9493 struct wireless_dev *wdev = dev->ieee80211_ptr;
9494 struct wiphy *wiphy = wdev->wiphy;
9495 struct cfg80211_chan_def chandef;
9496 enum nl80211_dfs_regions dfs_region;
9497 unsigned int cac_time_ms;
9498 int err = -EINVAL;
9499
9500 flush_delayed_work(&rdev->dfs_update_channels_wk);
9501
9502 wiphy_lock(wiphy);
9503
9504 dfs_region = reg_get_dfs_region(wiphy);
9505 if (dfs_region == NL80211_DFS_UNSET)
9506 goto unlock;
9507
9508 err = nl80211_parse_chandef(rdev, info, &chandef);
9509 if (err)
9510 goto unlock;
9511
9512 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9513 if (err < 0)
9514 goto unlock;
9515
9516 if (err == 0) {
9517 err = -EINVAL;
9518 goto unlock;
9519 }
9520
9521 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9522 err = -EINVAL;
9523 goto unlock;
9524 }
9525
9526 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9527 err = cfg80211_start_background_radar_detection(rdev, wdev,
9528 &chandef);
9529 goto unlock;
9530 }
9531
9532 if (netif_carrier_ok(dev)) {
9533 err = -EBUSY;
9534 goto unlock;
9535 }
9536
9537 if (wdev->cac_started) {
9538 err = -EBUSY;
9539 goto unlock;
9540 }
9541
9542 /* CAC start is offloaded to HW and can't be started manually */
9543 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9544 err = -EOPNOTSUPP;
9545 goto unlock;
9546 }
9547
9548 if (!rdev->ops->start_radar_detection) {
9549 err = -EOPNOTSUPP;
9550 goto unlock;
9551 }
9552
9553 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9554 if (WARN_ON(!cac_time_ms))
9555 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9556
9557 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9558 if (!err) {
9559 wdev->links[0].ap.chandef = chandef;
9560 wdev->cac_started = true;
9561 wdev->cac_start_time = jiffies;
9562 wdev->cac_time_ms = cac_time_ms;
9563 }
9564 unlock:
9565 wiphy_unlock(wiphy);
9566
9567 return err;
9568 }
9569
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)9570 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9571 struct genl_info *info)
9572 {
9573 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9574 struct net_device *dev = info->user_ptr[1];
9575 struct wireless_dev *wdev = dev->ieee80211_ptr;
9576 struct wiphy *wiphy = wdev->wiphy;
9577 struct cfg80211_chan_def chandef;
9578 enum nl80211_dfs_regions dfs_region;
9579 int err;
9580
9581 dfs_region = reg_get_dfs_region(wiphy);
9582 if (dfs_region == NL80211_DFS_UNSET) {
9583 GENL_SET_ERR_MSG(info,
9584 "DFS Region is not set. Unexpected Radar indication");
9585 return -EINVAL;
9586 }
9587
9588 err = nl80211_parse_chandef(rdev, info, &chandef);
9589 if (err) {
9590 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9591 return err;
9592 }
9593
9594 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9595 if (err < 0) {
9596 GENL_SET_ERR_MSG(info, "chandef is invalid");
9597 return err;
9598 }
9599
9600 if (err == 0) {
9601 GENL_SET_ERR_MSG(info,
9602 "Unexpected Radar indication for chandef/iftype");
9603 return -EINVAL;
9604 }
9605
9606 /* Do not process this notification if radar is already detected
9607 * by kernel on this channel, and return success.
9608 */
9609 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9610 return 0;
9611
9612 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9613
9614 cfg80211_sched_dfs_chan_update(rdev);
9615
9616 rdev->radar_chandef = chandef;
9617
9618 /* Propagate this notification to other radios as well */
9619 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9620
9621 return 0;
9622 }
9623
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)9624 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9625 {
9626 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9627 unsigned int link_id = nl80211_link_id(info->attrs);
9628 struct net_device *dev = info->user_ptr[1];
9629 struct wireless_dev *wdev = dev->ieee80211_ptr;
9630 struct cfg80211_csa_settings params;
9631 struct nlattr **csa_attrs = NULL;
9632 int err;
9633 bool need_new_beacon = false;
9634 bool need_handle_dfs_flag = true;
9635 int len, i;
9636 u32 cs_count;
9637
9638 if (!rdev->ops->channel_switch ||
9639 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9640 return -EOPNOTSUPP;
9641
9642 switch (dev->ieee80211_ptr->iftype) {
9643 case NL80211_IFTYPE_AP:
9644 case NL80211_IFTYPE_P2P_GO:
9645 need_new_beacon = true;
9646 /* For all modes except AP the handle_dfs flag needs to be
9647 * supplied to tell the kernel that userspace will handle radar
9648 * events when they happen. Otherwise a switch to a channel
9649 * requiring DFS will be rejected.
9650 */
9651 need_handle_dfs_flag = false;
9652
9653 /* useless if AP is not running */
9654 if (!wdev->links[link_id].ap.beacon_interval)
9655 return -ENOTCONN;
9656 break;
9657 case NL80211_IFTYPE_ADHOC:
9658 if (!wdev->u.ibss.ssid_len)
9659 return -ENOTCONN;
9660 break;
9661 case NL80211_IFTYPE_MESH_POINT:
9662 if (!wdev->u.mesh.id_len)
9663 return -ENOTCONN;
9664 break;
9665 default:
9666 return -EOPNOTSUPP;
9667 }
9668
9669 memset(¶ms, 0, sizeof(params));
9670 params.beacon_csa.ftm_responder = -1;
9671
9672 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9673 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9674 return -EINVAL;
9675
9676 /* only important for AP, IBSS and mesh create IEs internally */
9677 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9678 return -EINVAL;
9679
9680 /* Even though the attribute is u32, the specification says
9681 * u8, so let's make sure we don't overflow.
9682 */
9683 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9684 if (cs_count > 255)
9685 return -EINVAL;
9686
9687 params.count = cs_count;
9688
9689 if (!need_new_beacon)
9690 goto skip_beacons;
9691
9692 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after);
9693 if (err)
9694 goto free;
9695
9696 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
9697 GFP_KERNEL);
9698 if (!csa_attrs) {
9699 err = -ENOMEM;
9700 goto free;
9701 }
9702
9703 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9704 info->attrs[NL80211_ATTR_CSA_IES],
9705 nl80211_policy, info->extack);
9706 if (err)
9707 goto free;
9708
9709 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa);
9710 if (err)
9711 goto free;
9712
9713 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
9714 err = -EINVAL;
9715 goto free;
9716 }
9717
9718 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9719 if (!len || (len % sizeof(u16))) {
9720 err = -EINVAL;
9721 goto free;
9722 }
9723
9724 params.n_counter_offsets_beacon = len / sizeof(u16);
9725 if (rdev->wiphy.max_num_csa_counters &&
9726 (params.n_counter_offsets_beacon >
9727 rdev->wiphy.max_num_csa_counters)) {
9728 err = -EINVAL;
9729 goto free;
9730 }
9731
9732 params.counter_offsets_beacon =
9733 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9734
9735 /* sanity checks - counters should fit and be the same */
9736 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9737 u16 offset = params.counter_offsets_beacon[i];
9738
9739 if (offset >= params.beacon_csa.tail_len) {
9740 err = -EINVAL;
9741 goto free;
9742 }
9743
9744 if (params.beacon_csa.tail[offset] != params.count) {
9745 err = -EINVAL;
9746 goto free;
9747 }
9748 }
9749
9750 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9751 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9752 if (!len || (len % sizeof(u16))) {
9753 err = -EINVAL;
9754 goto free;
9755 }
9756
9757 params.n_counter_offsets_presp = len / sizeof(u16);
9758 if (rdev->wiphy.max_num_csa_counters &&
9759 (params.n_counter_offsets_presp >
9760 rdev->wiphy.max_num_csa_counters)) {
9761 err = -EINVAL;
9762 goto free;
9763 }
9764
9765 params.counter_offsets_presp =
9766 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9767
9768 /* sanity checks - counters should fit and be the same */
9769 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9770 u16 offset = params.counter_offsets_presp[i];
9771
9772 if (offset >= params.beacon_csa.probe_resp_len) {
9773 err = -EINVAL;
9774 goto free;
9775 }
9776
9777 if (params.beacon_csa.probe_resp[offset] !=
9778 params.count) {
9779 err = -EINVAL;
9780 goto free;
9781 }
9782 }
9783 }
9784
9785 skip_beacons:
9786 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
9787 if (err)
9788 goto free;
9789
9790 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
9791 wdev->iftype)) {
9792 err = -EINVAL;
9793 goto free;
9794 }
9795
9796 err = cfg80211_chandef_dfs_required(wdev->wiphy,
9797 ¶ms.chandef,
9798 wdev->iftype);
9799 if (err < 0)
9800 goto free;
9801
9802 if (err > 0) {
9803 params.radar_required = true;
9804 if (need_handle_dfs_flag &&
9805 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9806 err = -EINVAL;
9807 goto free;
9808 }
9809 }
9810
9811 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9812 params.block_tx = true;
9813
9814 wdev_lock(wdev);
9815 err = rdev_channel_switch(rdev, dev, ¶ms);
9816 wdev_unlock(wdev);
9817
9818 free:
9819 kfree(params.beacon_after.mbssid_ies);
9820 kfree(params.beacon_csa.mbssid_ies);
9821 kfree(csa_attrs);
9822 return err;
9823 }
9824
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)9825 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9826 u32 seq, int flags,
9827 struct cfg80211_registered_device *rdev,
9828 struct wireless_dev *wdev,
9829 struct cfg80211_internal_bss *intbss)
9830 {
9831 struct cfg80211_bss *res = &intbss->pub;
9832 const struct cfg80211_bss_ies *ies;
9833 unsigned int link_id;
9834 void *hdr;
9835 struct nlattr *bss;
9836
9837 ASSERT_WDEV_LOCK(wdev);
9838
9839 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9840 NL80211_CMD_NEW_SCAN_RESULTS);
9841 if (!hdr)
9842 return -1;
9843
9844 genl_dump_check_consistent(cb, hdr);
9845
9846 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9847 goto nla_put_failure;
9848 if (wdev->netdev &&
9849 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9850 goto nla_put_failure;
9851 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9852 NL80211_ATTR_PAD))
9853 goto nla_put_failure;
9854
9855 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9856 if (!bss)
9857 goto nla_put_failure;
9858 if ((!is_zero_ether_addr(res->bssid) &&
9859 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9860 goto nla_put_failure;
9861
9862 rcu_read_lock();
9863 /* indicate whether we have probe response data or not */
9864 if (rcu_access_pointer(res->proberesp_ies) &&
9865 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9866 goto fail_unlock_rcu;
9867
9868 /* this pointer prefers to be pointed to probe response data
9869 * but is always valid
9870 */
9871 ies = rcu_dereference(res->ies);
9872 if (ies) {
9873 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9874 NL80211_BSS_PAD))
9875 goto fail_unlock_rcu;
9876 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9877 ies->len, ies->data))
9878 goto fail_unlock_rcu;
9879 }
9880
9881 /* and this pointer is always (unless driver didn't know) beacon data */
9882 ies = rcu_dereference(res->beacon_ies);
9883 if (ies && ies->from_beacon) {
9884 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9885 NL80211_BSS_PAD))
9886 goto fail_unlock_rcu;
9887 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9888 ies->len, ies->data))
9889 goto fail_unlock_rcu;
9890 }
9891 rcu_read_unlock();
9892
9893 if (res->beacon_interval &&
9894 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9895 goto nla_put_failure;
9896 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9897 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9898 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9899 res->channel->freq_offset) ||
9900 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9901 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9902 jiffies_to_msecs(jiffies - intbss->ts)))
9903 goto nla_put_failure;
9904
9905 if (intbss->parent_tsf &&
9906 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9907 intbss->parent_tsf, NL80211_BSS_PAD) ||
9908 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9909 intbss->parent_bssid)))
9910 goto nla_put_failure;
9911
9912 if (intbss->ts_boottime &&
9913 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9914 intbss->ts_boottime, NL80211_BSS_PAD))
9915 goto nla_put_failure;
9916
9917 if (!nl80211_put_signal(msg, intbss->pub.chains,
9918 intbss->pub.chain_signal,
9919 NL80211_BSS_CHAIN_SIGNAL))
9920 goto nla_put_failure;
9921
9922 switch (rdev->wiphy.signal_type) {
9923 case CFG80211_SIGNAL_TYPE_MBM:
9924 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9925 goto nla_put_failure;
9926 break;
9927 case CFG80211_SIGNAL_TYPE_UNSPEC:
9928 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9929 goto nla_put_failure;
9930 break;
9931 default:
9932 break;
9933 }
9934
9935 switch (wdev->iftype) {
9936 case NL80211_IFTYPE_P2P_CLIENT:
9937 case NL80211_IFTYPE_STATION:
9938 for_each_valid_link(wdev, link_id) {
9939 if (intbss == wdev->links[link_id].client.current_bss &&
9940 nla_put_u32(msg, NL80211_BSS_STATUS,
9941 NL80211_BSS_STATUS_ASSOCIATED))
9942 goto nla_put_failure;
9943 }
9944 break;
9945 case NL80211_IFTYPE_ADHOC:
9946 if (intbss == wdev->u.ibss.current_bss &&
9947 nla_put_u32(msg, NL80211_BSS_STATUS,
9948 NL80211_BSS_STATUS_IBSS_JOINED))
9949 goto nla_put_failure;
9950 break;
9951 default:
9952 break;
9953 }
9954
9955 nla_nest_end(msg, bss);
9956
9957 genlmsg_end(msg, hdr);
9958 return 0;
9959
9960 fail_unlock_rcu:
9961 rcu_read_unlock();
9962 nla_put_failure:
9963 genlmsg_cancel(msg, hdr);
9964 return -EMSGSIZE;
9965 }
9966
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)9967 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9968 {
9969 struct cfg80211_registered_device *rdev;
9970 struct cfg80211_internal_bss *scan;
9971 struct wireless_dev *wdev;
9972 int start = cb->args[2], idx = 0;
9973 int err;
9974
9975 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
9976 if (err)
9977 return err;
9978 /* nl80211_prepare_wdev_dump acquired it in the successful case */
9979 __acquire(&rdev->wiphy.mtx);
9980
9981 wdev_lock(wdev);
9982 spin_lock_bh(&rdev->bss_lock);
9983
9984 /*
9985 * dump_scan will be called multiple times to break up the scan results
9986 * into multiple messages. It is unlikely that any more bss-es will be
9987 * expired after the first call, so only call only call this on the
9988 * first dump_scan invocation.
9989 */
9990 if (start == 0)
9991 cfg80211_bss_expire(rdev);
9992
9993 cb->seq = rdev->bss_generation;
9994
9995 list_for_each_entry(scan, &rdev->bss_list, list) {
9996 if (++idx <= start)
9997 continue;
9998 if (nl80211_send_bss(skb, cb,
9999 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10000 rdev, wdev, scan) < 0) {
10001 idx--;
10002 break;
10003 }
10004 }
10005
10006 spin_unlock_bh(&rdev->bss_lock);
10007 wdev_unlock(wdev);
10008
10009 cb->args[2] = idx;
10010 wiphy_unlock(&rdev->wiphy);
10011
10012 return skb->len;
10013 }
10014
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)10015 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10016 int flags, struct net_device *dev,
10017 bool allow_radio_stats,
10018 struct survey_info *survey)
10019 {
10020 void *hdr;
10021 struct nlattr *infoattr;
10022
10023 /* skip radio stats if userspace didn't request them */
10024 if (!survey->channel && !allow_radio_stats)
10025 return 0;
10026
10027 hdr = nl80211hdr_put(msg, portid, seq, flags,
10028 NL80211_CMD_NEW_SURVEY_RESULTS);
10029 if (!hdr)
10030 return -ENOMEM;
10031
10032 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10033 goto nla_put_failure;
10034
10035 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10036 if (!infoattr)
10037 goto nla_put_failure;
10038
10039 if (survey->channel &&
10040 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10041 survey->channel->center_freq))
10042 goto nla_put_failure;
10043
10044 if (survey->channel && survey->channel->freq_offset &&
10045 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10046 survey->channel->freq_offset))
10047 goto nla_put_failure;
10048
10049 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10050 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10051 goto nla_put_failure;
10052 if ((survey->filled & SURVEY_INFO_IN_USE) &&
10053 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10054 goto nla_put_failure;
10055 if ((survey->filled & SURVEY_INFO_TIME) &&
10056 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10057 survey->time, NL80211_SURVEY_INFO_PAD))
10058 goto nla_put_failure;
10059 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10060 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10061 survey->time_busy, NL80211_SURVEY_INFO_PAD))
10062 goto nla_put_failure;
10063 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10064 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10065 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10066 goto nla_put_failure;
10067 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10068 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10069 survey->time_rx, NL80211_SURVEY_INFO_PAD))
10070 goto nla_put_failure;
10071 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10072 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10073 survey->time_tx, NL80211_SURVEY_INFO_PAD))
10074 goto nla_put_failure;
10075 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10076 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10077 survey->time_scan, NL80211_SURVEY_INFO_PAD))
10078 goto nla_put_failure;
10079 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10080 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10081 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10082 goto nla_put_failure;
10083
10084 nla_nest_end(msg, infoattr);
10085
10086 genlmsg_end(msg, hdr);
10087 return 0;
10088
10089 nla_put_failure:
10090 genlmsg_cancel(msg, hdr);
10091 return -EMSGSIZE;
10092 }
10093
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)10094 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10095 {
10096 struct nlattr **attrbuf;
10097 struct survey_info survey;
10098 struct cfg80211_registered_device *rdev;
10099 struct wireless_dev *wdev;
10100 int survey_idx = cb->args[2];
10101 int res;
10102 bool radio_stats;
10103
10104 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10105 if (!attrbuf)
10106 return -ENOMEM;
10107
10108 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10109 if (res) {
10110 kfree(attrbuf);
10111 return res;
10112 }
10113 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10114 __acquire(&rdev->wiphy.mtx);
10115
10116 /* prepare_wdev_dump parsed the attributes */
10117 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10118
10119 if (!wdev->netdev) {
10120 res = -EINVAL;
10121 goto out_err;
10122 }
10123
10124 if (!rdev->ops->dump_survey) {
10125 res = -EOPNOTSUPP;
10126 goto out_err;
10127 }
10128
10129 while (1) {
10130 wdev_lock(wdev);
10131 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10132 wdev_unlock(wdev);
10133 if (res == -ENOENT)
10134 break;
10135 if (res)
10136 goto out_err;
10137
10138 /* don't send disabled channels, but do send non-channel data */
10139 if (survey.channel &&
10140 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10141 survey_idx++;
10142 continue;
10143 }
10144
10145 if (nl80211_send_survey(skb,
10146 NETLINK_CB(cb->skb).portid,
10147 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10148 wdev->netdev, radio_stats, &survey) < 0)
10149 goto out;
10150 survey_idx++;
10151 }
10152
10153 out:
10154 cb->args[2] = survey_idx;
10155 res = skb->len;
10156 out_err:
10157 kfree(attrbuf);
10158 wiphy_unlock(&rdev->wiphy);
10159 return res;
10160 }
10161
nl80211_valid_wpa_versions(u32 wpa_versions)10162 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10163 {
10164 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10165 NL80211_WPA_VERSION_2 |
10166 NL80211_WPA_VERSION_3));
10167 }
10168
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)10169 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10170 {
10171 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10172 struct net_device *dev = info->user_ptr[1];
10173 struct ieee80211_channel *chan;
10174 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
10175 int err, ssid_len, ie_len = 0, auth_data_len = 0;
10176 enum nl80211_auth_type auth_type;
10177 struct key_parse key;
10178 bool local_state_change;
10179 u32 freq;
10180
10181 if (!info->attrs[NL80211_ATTR_MAC])
10182 return -EINVAL;
10183
10184 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10185 return -EINVAL;
10186
10187 if (!info->attrs[NL80211_ATTR_SSID])
10188 return -EINVAL;
10189
10190 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10191 return -EINVAL;
10192
10193 err = nl80211_parse_key(info, &key);
10194 if (err)
10195 return err;
10196
10197 if (key.idx >= 0) {
10198 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10199 return -EINVAL;
10200 if (!key.p.key || !key.p.key_len)
10201 return -EINVAL;
10202 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10203 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10204 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10205 key.p.key_len != WLAN_KEY_LEN_WEP104))
10206 return -EINVAL;
10207 if (key.idx > 3)
10208 return -EINVAL;
10209 } else {
10210 key.p.key_len = 0;
10211 key.p.key = NULL;
10212 }
10213
10214 if (key.idx >= 0) {
10215 int i;
10216 bool ok = false;
10217
10218 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10219 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10220 ok = true;
10221 break;
10222 }
10223 }
10224 if (!ok)
10225 return -EINVAL;
10226 }
10227
10228 if (!rdev->ops->auth)
10229 return -EOPNOTSUPP;
10230
10231 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10232 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10233 return -EOPNOTSUPP;
10234
10235 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10236 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10237 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10238 freq +=
10239 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10240
10241 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10242 if (!chan)
10243 return -EINVAL;
10244
10245 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10246 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10247
10248 if (info->attrs[NL80211_ATTR_IE]) {
10249 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10250 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10251 }
10252
10253 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10254 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10255 return -EINVAL;
10256
10257 if ((auth_type == NL80211_AUTHTYPE_SAE ||
10258 auth_type == NL80211_AUTHTYPE_FILS_SK ||
10259 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10260 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10261 !info->attrs[NL80211_ATTR_AUTH_DATA])
10262 return -EINVAL;
10263
10264 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10265 if (auth_type != NL80211_AUTHTYPE_SAE &&
10266 auth_type != NL80211_AUTHTYPE_FILS_SK &&
10267 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10268 auth_type != NL80211_AUTHTYPE_FILS_PK)
10269 return -EINVAL;
10270 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10271 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10272 }
10273
10274 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10275
10276 /*
10277 * Since we no longer track auth state, ignore
10278 * requests to only change local state.
10279 */
10280 if (local_state_change)
10281 return 0;
10282
10283 wdev_lock(dev->ieee80211_ptr);
10284 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
10285 ssid, ssid_len, ie, ie_len,
10286 key.p.key, key.p.key_len, key.idx,
10287 auth_data, auth_data_len);
10288 wdev_unlock(dev->ieee80211_ptr);
10289 return err;
10290 }
10291
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)10292 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10293 struct genl_info *info)
10294 {
10295 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10296 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10297 return -EINVAL;
10298 }
10299
10300 if (!rdev->ops->tx_control_port ||
10301 !wiphy_ext_feature_isset(&rdev->wiphy,
10302 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10303 return -EOPNOTSUPP;
10304
10305 return 0;
10306 }
10307
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)10308 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10309 struct genl_info *info,
10310 struct cfg80211_crypto_settings *settings,
10311 int cipher_limit)
10312 {
10313 memset(settings, 0, sizeof(*settings));
10314
10315 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10316
10317 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10318 u16 proto;
10319
10320 proto = nla_get_u16(
10321 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10322 settings->control_port_ethertype = cpu_to_be16(proto);
10323 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10324 proto != ETH_P_PAE)
10325 return -EINVAL;
10326 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10327 settings->control_port_no_encrypt = true;
10328 } else
10329 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10330
10331 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10332 int r = validate_pae_over_nl80211(rdev, info);
10333
10334 if (r < 0)
10335 return r;
10336
10337 settings->control_port_over_nl80211 = true;
10338
10339 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10340 settings->control_port_no_preauth = true;
10341 }
10342
10343 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10344 void *data;
10345 int len, i;
10346
10347 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10348 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10349 settings->n_ciphers_pairwise = len / sizeof(u32);
10350
10351 if (len % sizeof(u32))
10352 return -EINVAL;
10353
10354 if (settings->n_ciphers_pairwise > cipher_limit)
10355 return -EINVAL;
10356
10357 memcpy(settings->ciphers_pairwise, data, len);
10358
10359 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10360 if (!cfg80211_supported_cipher_suite(
10361 &rdev->wiphy,
10362 settings->ciphers_pairwise[i]))
10363 return -EINVAL;
10364 }
10365
10366 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10367 settings->cipher_group =
10368 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10369 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10370 settings->cipher_group))
10371 return -EINVAL;
10372 }
10373
10374 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10375 settings->wpa_versions =
10376 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10377 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10378 return -EINVAL;
10379 }
10380
10381 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10382 void *data;
10383 int len;
10384
10385 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10386 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10387 settings->n_akm_suites = len / sizeof(u32);
10388
10389 if (len % sizeof(u32))
10390 return -EINVAL;
10391
10392 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
10393 return -EINVAL;
10394
10395 memcpy(settings->akm_suites, data, len);
10396 }
10397
10398 if (info->attrs[NL80211_ATTR_PMK]) {
10399 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10400 return -EINVAL;
10401 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10402 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10403 !wiphy_ext_feature_isset(&rdev->wiphy,
10404 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10405 return -EINVAL;
10406 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10407 }
10408
10409 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10410 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10411 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10412 !wiphy_ext_feature_isset(&rdev->wiphy,
10413 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10414 return -EINVAL;
10415 settings->sae_pwd =
10416 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10417 settings->sae_pwd_len =
10418 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10419 }
10420
10421 if (info->attrs[NL80211_ATTR_SAE_PWE])
10422 settings->sae_pwe =
10423 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10424 else
10425 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10426
10427 return 0;
10428 }
10429
nl80211_associate(struct sk_buff * skb,struct genl_info * info)10430 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10431 {
10432 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10433 struct net_device *dev = info->user_ptr[1];
10434 struct ieee80211_channel *chan;
10435 struct cfg80211_assoc_request req = {};
10436 const u8 *bssid, *ssid;
10437 int err, ssid_len = 0;
10438 u32 freq;
10439
10440 if (dev->ieee80211_ptr->conn_owner_nlportid &&
10441 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10442 return -EPERM;
10443
10444 if (!info->attrs[NL80211_ATTR_MAC] ||
10445 !info->attrs[NL80211_ATTR_SSID] ||
10446 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
10447 return -EINVAL;
10448
10449 if (!rdev->ops->assoc)
10450 return -EOPNOTSUPP;
10451
10452 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10453 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10454 return -EOPNOTSUPP;
10455
10456 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10457
10458 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10459 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10460 freq +=
10461 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10462 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10463 if (!chan)
10464 return -EINVAL;
10465
10466 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10467 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10468
10469 if (info->attrs[NL80211_ATTR_IE]) {
10470 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10471 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10472 }
10473
10474 if (info->attrs[NL80211_ATTR_USE_MFP]) {
10475 enum nl80211_mfp mfp =
10476 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10477 if (mfp == NL80211_MFP_REQUIRED)
10478 req.use_mfp = true;
10479 else if (mfp != NL80211_MFP_NO)
10480 return -EINVAL;
10481 }
10482
10483 if (info->attrs[NL80211_ATTR_PREV_BSSID])
10484 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10485
10486 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10487 req.flags |= ASSOC_REQ_DISABLE_HT;
10488
10489 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10490 memcpy(&req.ht_capa_mask,
10491 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10492 sizeof(req.ht_capa_mask));
10493
10494 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10495 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10496 return -EINVAL;
10497 memcpy(&req.ht_capa,
10498 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10499 sizeof(req.ht_capa));
10500 }
10501
10502 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10503 req.flags |= ASSOC_REQ_DISABLE_VHT;
10504
10505 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10506 req.flags |= ASSOC_REQ_DISABLE_HE;
10507
10508 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
10509 req.flags |= ASSOC_REQ_DISABLE_EHT;
10510
10511 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10512 memcpy(&req.vht_capa_mask,
10513 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10514 sizeof(req.vht_capa_mask));
10515
10516 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10517 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10518 return -EINVAL;
10519 memcpy(&req.vht_capa,
10520 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10521 sizeof(req.vht_capa));
10522 }
10523
10524 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10525 if (!((rdev->wiphy.features &
10526 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10527 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10528 !wiphy_ext_feature_isset(&rdev->wiphy,
10529 NL80211_EXT_FEATURE_RRM))
10530 return -EINVAL;
10531 req.flags |= ASSOC_REQ_USE_RRM;
10532 }
10533
10534 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10535 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10536 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10537 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10538 return -EINVAL;
10539 req.fils_nonces =
10540 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10541 }
10542
10543 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10544 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10545 return -EINVAL;
10546 memcpy(&req.s1g_capa_mask,
10547 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10548 sizeof(req.s1g_capa_mask));
10549 }
10550
10551 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10552 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10553 return -EINVAL;
10554 memcpy(&req.s1g_capa,
10555 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10556 sizeof(req.s1g_capa));
10557 }
10558
10559 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
10560 if (!err) {
10561 wdev_lock(dev->ieee80211_ptr);
10562
10563 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
10564 ssid, ssid_len, &req);
10565
10566 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10567 dev->ieee80211_ptr->conn_owner_nlportid =
10568 info->snd_portid;
10569 memcpy(dev->ieee80211_ptr->disconnect_bssid,
10570 bssid, ETH_ALEN);
10571 }
10572
10573 wdev_unlock(dev->ieee80211_ptr);
10574 }
10575
10576 return err;
10577 }
10578
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)10579 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
10580 {
10581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10582 struct net_device *dev = info->user_ptr[1];
10583 const u8 *ie = NULL, *bssid;
10584 int ie_len = 0, err;
10585 u16 reason_code;
10586 bool local_state_change;
10587
10588 if (dev->ieee80211_ptr->conn_owner_nlportid &&
10589 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10590 return -EPERM;
10591
10592 if (!info->attrs[NL80211_ATTR_MAC])
10593 return -EINVAL;
10594
10595 if (!info->attrs[NL80211_ATTR_REASON_CODE])
10596 return -EINVAL;
10597
10598 if (!rdev->ops->deauth)
10599 return -EOPNOTSUPP;
10600
10601 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10602 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10603 return -EOPNOTSUPP;
10604
10605 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10606
10607 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10608 if (reason_code == 0) {
10609 /* Reason Code 0 is reserved */
10610 return -EINVAL;
10611 }
10612
10613 if (info->attrs[NL80211_ATTR_IE]) {
10614 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10615 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10616 }
10617
10618 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10619
10620 wdev_lock(dev->ieee80211_ptr);
10621 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
10622 local_state_change);
10623 wdev_unlock(dev->ieee80211_ptr);
10624 return err;
10625 }
10626
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)10627 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
10628 {
10629 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10630 struct net_device *dev = info->user_ptr[1];
10631 const u8 *ie = NULL, *bssid;
10632 int ie_len = 0, err;
10633 u16 reason_code;
10634 bool local_state_change;
10635
10636 if (dev->ieee80211_ptr->conn_owner_nlportid &&
10637 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10638 return -EPERM;
10639
10640 if (!info->attrs[NL80211_ATTR_MAC])
10641 return -EINVAL;
10642
10643 if (!info->attrs[NL80211_ATTR_REASON_CODE])
10644 return -EINVAL;
10645
10646 if (!rdev->ops->disassoc)
10647 return -EOPNOTSUPP;
10648
10649 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10650 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10651 return -EOPNOTSUPP;
10652
10653 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10654
10655 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10656 if (reason_code == 0) {
10657 /* Reason Code 0 is reserved */
10658 return -EINVAL;
10659 }
10660
10661 if (info->attrs[NL80211_ATTR_IE]) {
10662 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10663 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10664 }
10665
10666 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10667
10668 wdev_lock(dev->ieee80211_ptr);
10669 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
10670 local_state_change);
10671 wdev_unlock(dev->ieee80211_ptr);
10672 return err;
10673 }
10674
10675 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)10676 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
10677 int mcast_rate[NUM_NL80211_BANDS],
10678 int rateval)
10679 {
10680 struct wiphy *wiphy = &rdev->wiphy;
10681 bool found = false;
10682 int band, i;
10683
10684 for (band = 0; band < NUM_NL80211_BANDS; band++) {
10685 struct ieee80211_supported_band *sband;
10686
10687 sband = wiphy->bands[band];
10688 if (!sband)
10689 continue;
10690
10691 for (i = 0; i < sband->n_bitrates; i++) {
10692 if (sband->bitrates[i].bitrate == rateval) {
10693 mcast_rate[band] = i + 1;
10694 found = true;
10695 break;
10696 }
10697 }
10698 }
10699
10700 return found;
10701 }
10702
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)10703 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10704 {
10705 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10706 struct net_device *dev = info->user_ptr[1];
10707 struct cfg80211_ibss_params ibss;
10708 struct wiphy *wiphy;
10709 struct cfg80211_cached_keys *connkeys = NULL;
10710 int err;
10711
10712 memset(&ibss, 0, sizeof(ibss));
10713
10714 if (!info->attrs[NL80211_ATTR_SSID] ||
10715 !nla_len(info->attrs[NL80211_ATTR_SSID]))
10716 return -EINVAL;
10717
10718 ibss.beacon_interval = 100;
10719
10720 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10721 ibss.beacon_interval =
10722 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10723
10724 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10725 ibss.beacon_interval);
10726 if (err)
10727 return err;
10728
10729 if (!rdev->ops->join_ibss)
10730 return -EOPNOTSUPP;
10731
10732 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10733 return -EOPNOTSUPP;
10734
10735 wiphy = &rdev->wiphy;
10736
10737 if (info->attrs[NL80211_ATTR_MAC]) {
10738 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10739
10740 if (!is_valid_ether_addr(ibss.bssid))
10741 return -EINVAL;
10742 }
10743 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10744 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10745
10746 if (info->attrs[NL80211_ATTR_IE]) {
10747 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10748 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10749 }
10750
10751 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10752 if (err)
10753 return err;
10754
10755 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10756 NL80211_IFTYPE_ADHOC))
10757 return -EINVAL;
10758
10759 switch (ibss.chandef.width) {
10760 case NL80211_CHAN_WIDTH_5:
10761 case NL80211_CHAN_WIDTH_10:
10762 case NL80211_CHAN_WIDTH_20_NOHT:
10763 break;
10764 case NL80211_CHAN_WIDTH_20:
10765 case NL80211_CHAN_WIDTH_40:
10766 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10767 return -EINVAL;
10768 break;
10769 case NL80211_CHAN_WIDTH_80:
10770 case NL80211_CHAN_WIDTH_80P80:
10771 case NL80211_CHAN_WIDTH_160:
10772 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10773 return -EINVAL;
10774 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10775 NL80211_EXT_FEATURE_VHT_IBSS))
10776 return -EINVAL;
10777 break;
10778 case NL80211_CHAN_WIDTH_320:
10779 return -EINVAL;
10780 default:
10781 return -EINVAL;
10782 }
10783
10784 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10785 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10786
10787 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10788 u8 *rates =
10789 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10790 int n_rates =
10791 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10792 struct ieee80211_supported_band *sband =
10793 wiphy->bands[ibss.chandef.chan->band];
10794
10795 err = ieee80211_get_ratemask(sband, rates, n_rates,
10796 &ibss.basic_rates);
10797 if (err)
10798 return err;
10799 }
10800
10801 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10802 memcpy(&ibss.ht_capa_mask,
10803 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10804 sizeof(ibss.ht_capa_mask));
10805
10806 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10807 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10808 return -EINVAL;
10809 memcpy(&ibss.ht_capa,
10810 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10811 sizeof(ibss.ht_capa));
10812 }
10813
10814 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10815 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10816 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10817 return -EINVAL;
10818
10819 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10820 bool no_ht = false;
10821
10822 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10823 if (IS_ERR(connkeys))
10824 return PTR_ERR(connkeys);
10825
10826 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10827 no_ht) {
10828 kfree_sensitive(connkeys);
10829 return -EINVAL;
10830 }
10831 }
10832
10833 ibss.control_port =
10834 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10835
10836 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10837 int r = validate_pae_over_nl80211(rdev, info);
10838
10839 if (r < 0) {
10840 kfree_sensitive(connkeys);
10841 return r;
10842 }
10843
10844 ibss.control_port_over_nl80211 = true;
10845 }
10846
10847 ibss.userspace_handles_dfs =
10848 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10849
10850 wdev_lock(dev->ieee80211_ptr);
10851 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10852 if (err)
10853 kfree_sensitive(connkeys);
10854 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10855 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10856 wdev_unlock(dev->ieee80211_ptr);
10857
10858 return err;
10859 }
10860
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)10861 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10862 {
10863 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10864 struct net_device *dev = info->user_ptr[1];
10865
10866 if (!rdev->ops->leave_ibss)
10867 return -EOPNOTSUPP;
10868
10869 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10870 return -EOPNOTSUPP;
10871
10872 return cfg80211_leave_ibss(rdev, dev, false);
10873 }
10874
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)10875 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10876 {
10877 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10878 struct net_device *dev = info->user_ptr[1];
10879 int mcast_rate[NUM_NL80211_BANDS];
10880 u32 nla_rate;
10881 int err;
10882
10883 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10884 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10885 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10886 return -EOPNOTSUPP;
10887
10888 if (!rdev->ops->set_mcast_rate)
10889 return -EOPNOTSUPP;
10890
10891 memset(mcast_rate, 0, sizeof(mcast_rate));
10892
10893 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10894 return -EINVAL;
10895
10896 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10897 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10898 return -EINVAL;
10899
10900 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10901
10902 return err;
10903 }
10904
10905 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)10906 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10907 struct wireless_dev *wdev, int approxlen,
10908 u32 portid, u32 seq, enum nl80211_commands cmd,
10909 enum nl80211_attrs attr,
10910 const struct nl80211_vendor_cmd_info *info,
10911 gfp_t gfp)
10912 {
10913 struct sk_buff *skb;
10914 void *hdr;
10915 struct nlattr *data;
10916
10917 skb = nlmsg_new(approxlen + 100, gfp);
10918 if (!skb)
10919 return NULL;
10920
10921 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10922 if (!hdr) {
10923 kfree_skb(skb);
10924 return NULL;
10925 }
10926
10927 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10928 goto nla_put_failure;
10929
10930 if (info) {
10931 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10932 info->vendor_id))
10933 goto nla_put_failure;
10934 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10935 info->subcmd))
10936 goto nla_put_failure;
10937 }
10938
10939 if (wdev) {
10940 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10941 wdev_id(wdev), NL80211_ATTR_PAD))
10942 goto nla_put_failure;
10943 if (wdev->netdev &&
10944 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10945 wdev->netdev->ifindex))
10946 goto nla_put_failure;
10947 }
10948
10949 data = nla_nest_start_noflag(skb, attr);
10950 if (!data)
10951 goto nla_put_failure;
10952
10953 ((void **)skb->cb)[0] = rdev;
10954 ((void **)skb->cb)[1] = hdr;
10955 ((void **)skb->cb)[2] = data;
10956
10957 return skb;
10958
10959 nla_put_failure:
10960 kfree_skb(skb);
10961 return NULL;
10962 }
10963
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)10964 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10965 struct wireless_dev *wdev,
10966 enum nl80211_commands cmd,
10967 enum nl80211_attrs attr,
10968 unsigned int portid,
10969 int vendor_event_idx,
10970 int approxlen, gfp_t gfp)
10971 {
10972 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10973 const struct nl80211_vendor_cmd_info *info;
10974
10975 switch (cmd) {
10976 case NL80211_CMD_TESTMODE:
10977 if (WARN_ON(vendor_event_idx != -1))
10978 return NULL;
10979 info = NULL;
10980 break;
10981 case NL80211_CMD_VENDOR:
10982 if (WARN_ON(vendor_event_idx < 0 ||
10983 vendor_event_idx >= wiphy->n_vendor_events))
10984 return NULL;
10985 info = &wiphy->vendor_events[vendor_event_idx];
10986 break;
10987 default:
10988 WARN_ON(1);
10989 return NULL;
10990 }
10991
10992 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10993 cmd, attr, info, gfp);
10994 }
10995 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10996
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)10997 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10998 {
10999 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11000 void *hdr = ((void **)skb->cb)[1];
11001 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11002 struct nlattr *data = ((void **)skb->cb)[2];
11003 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11004
11005 /* clear CB data for netlink core to own from now on */
11006 memset(skb->cb, 0, sizeof(skb->cb));
11007
11008 nla_nest_end(skb, data);
11009 genlmsg_end(skb, hdr);
11010
11011 if (nlhdr->nlmsg_pid) {
11012 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11013 nlhdr->nlmsg_pid);
11014 } else {
11015 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11016 mcgrp = NL80211_MCGRP_VENDOR;
11017
11018 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11019 skb, 0, mcgrp, gfp);
11020 }
11021 }
11022 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11023
11024 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)11025 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11026 {
11027 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11028 struct wireless_dev *wdev;
11029 int err;
11030
11031 lockdep_assert_held(&rdev->wiphy.mtx);
11032
11033 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11034 info->attrs);
11035
11036 if (!rdev->ops->testmode_cmd)
11037 return -EOPNOTSUPP;
11038
11039 if (IS_ERR(wdev)) {
11040 err = PTR_ERR(wdev);
11041 if (err != -EINVAL)
11042 return err;
11043 wdev = NULL;
11044 } else if (wdev->wiphy != &rdev->wiphy) {
11045 return -EINVAL;
11046 }
11047
11048 if (!info->attrs[NL80211_ATTR_TESTDATA])
11049 return -EINVAL;
11050
11051 rdev->cur_cmd_info = info;
11052 err = rdev_testmode_cmd(rdev, wdev,
11053 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11054 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11055 rdev->cur_cmd_info = NULL;
11056
11057 return err;
11058 }
11059
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)11060 static int nl80211_testmode_dump(struct sk_buff *skb,
11061 struct netlink_callback *cb)
11062 {
11063 struct cfg80211_registered_device *rdev;
11064 struct nlattr **attrbuf = NULL;
11065 int err;
11066 long phy_idx;
11067 void *data = NULL;
11068 int data_len = 0;
11069
11070 rtnl_lock();
11071
11072 if (cb->args[0]) {
11073 /*
11074 * 0 is a valid index, but not valid for args[0],
11075 * so we need to offset by 1.
11076 */
11077 phy_idx = cb->args[0] - 1;
11078
11079 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11080 if (!rdev) {
11081 err = -ENOENT;
11082 goto out_err;
11083 }
11084 } else {
11085 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11086 GFP_KERNEL);
11087 if (!attrbuf) {
11088 err = -ENOMEM;
11089 goto out_err;
11090 }
11091
11092 err = nlmsg_parse_deprecated(cb->nlh,
11093 GENL_HDRLEN + nl80211_fam.hdrsize,
11094 attrbuf, nl80211_fam.maxattr,
11095 nl80211_policy, NULL);
11096 if (err)
11097 goto out_err;
11098
11099 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11100 if (IS_ERR(rdev)) {
11101 err = PTR_ERR(rdev);
11102 goto out_err;
11103 }
11104 phy_idx = rdev->wiphy_idx;
11105
11106 if (attrbuf[NL80211_ATTR_TESTDATA])
11107 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11108 }
11109
11110 if (cb->args[1]) {
11111 data = nla_data((void *)cb->args[1]);
11112 data_len = nla_len((void *)cb->args[1]);
11113 }
11114
11115 if (!rdev->ops->testmode_dump) {
11116 err = -EOPNOTSUPP;
11117 goto out_err;
11118 }
11119
11120 while (1) {
11121 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11122 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11123 NL80211_CMD_TESTMODE);
11124 struct nlattr *tmdata;
11125
11126 if (!hdr)
11127 break;
11128
11129 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11130 genlmsg_cancel(skb, hdr);
11131 break;
11132 }
11133
11134 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11135 if (!tmdata) {
11136 genlmsg_cancel(skb, hdr);
11137 break;
11138 }
11139 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11140 nla_nest_end(skb, tmdata);
11141
11142 if (err == -ENOBUFS || err == -ENOENT) {
11143 genlmsg_cancel(skb, hdr);
11144 break;
11145 } else if (err) {
11146 genlmsg_cancel(skb, hdr);
11147 goto out_err;
11148 }
11149
11150 genlmsg_end(skb, hdr);
11151 }
11152
11153 err = skb->len;
11154 /* see above */
11155 cb->args[0] = phy_idx + 1;
11156 out_err:
11157 kfree(attrbuf);
11158 rtnl_unlock();
11159 return err;
11160 }
11161 #endif
11162
nl80211_connect(struct sk_buff * skb,struct genl_info * info)11163 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11164 {
11165 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11166 struct net_device *dev = info->user_ptr[1];
11167 struct cfg80211_connect_params connect;
11168 struct wiphy *wiphy;
11169 struct cfg80211_cached_keys *connkeys = NULL;
11170 u32 freq = 0;
11171 int err;
11172
11173 memset(&connect, 0, sizeof(connect));
11174
11175 if (!info->attrs[NL80211_ATTR_SSID] ||
11176 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11177 return -EINVAL;
11178
11179 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11180 connect.auth_type =
11181 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11182 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11183 NL80211_CMD_CONNECT))
11184 return -EINVAL;
11185 } else
11186 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11187
11188 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11189
11190 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11191 !wiphy_ext_feature_isset(&rdev->wiphy,
11192 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11193 return -EINVAL;
11194 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11195
11196 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11197 NL80211_MAX_NR_CIPHER_SUITES);
11198 if (err)
11199 return err;
11200
11201 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11202 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11203 return -EOPNOTSUPP;
11204
11205 wiphy = &rdev->wiphy;
11206
11207 connect.bg_scan_period = -1;
11208 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11209 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11210 connect.bg_scan_period =
11211 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11212 }
11213
11214 if (info->attrs[NL80211_ATTR_MAC])
11215 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11216 else if (info->attrs[NL80211_ATTR_MAC_HINT])
11217 connect.bssid_hint =
11218 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11219 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11220 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11221
11222 if (info->attrs[NL80211_ATTR_IE]) {
11223 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11224 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11225 }
11226
11227 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11228 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11229 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11230 !wiphy_ext_feature_isset(&rdev->wiphy,
11231 NL80211_EXT_FEATURE_MFP_OPTIONAL))
11232 return -EOPNOTSUPP;
11233 } else {
11234 connect.mfp = NL80211_MFP_NO;
11235 }
11236
11237 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11238 connect.prev_bssid =
11239 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11240
11241 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11242 freq = MHZ_TO_KHZ(nla_get_u32(
11243 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11244 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11245 freq +=
11246 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11247
11248 if (freq) {
11249 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11250 if (!connect.channel)
11251 return -EINVAL;
11252 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11253 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11254 freq = MHZ_TO_KHZ(freq);
11255 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11256 if (!connect.channel_hint)
11257 return -EINVAL;
11258 }
11259
11260 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11261 connect.edmg.channels =
11262 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11263
11264 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11265 connect.edmg.bw_config =
11266 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11267 }
11268
11269 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11270 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11271 if (IS_ERR(connkeys))
11272 return PTR_ERR(connkeys);
11273 }
11274
11275 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11276 connect.flags |= ASSOC_REQ_DISABLE_HT;
11277
11278 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11279 memcpy(&connect.ht_capa_mask,
11280 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11281 sizeof(connect.ht_capa_mask));
11282
11283 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11284 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11285 kfree_sensitive(connkeys);
11286 return -EINVAL;
11287 }
11288 memcpy(&connect.ht_capa,
11289 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11290 sizeof(connect.ht_capa));
11291 }
11292
11293 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11294 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11295
11296 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11297 connect.flags |= ASSOC_REQ_DISABLE_HE;
11298
11299 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11300 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11301
11302 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11303 memcpy(&connect.vht_capa_mask,
11304 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11305 sizeof(connect.vht_capa_mask));
11306
11307 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11308 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11309 kfree_sensitive(connkeys);
11310 return -EINVAL;
11311 }
11312 memcpy(&connect.vht_capa,
11313 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11314 sizeof(connect.vht_capa));
11315 }
11316
11317 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11318 if (!((rdev->wiphy.features &
11319 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11320 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11321 !wiphy_ext_feature_isset(&rdev->wiphy,
11322 NL80211_EXT_FEATURE_RRM)) {
11323 kfree_sensitive(connkeys);
11324 return -EINVAL;
11325 }
11326 connect.flags |= ASSOC_REQ_USE_RRM;
11327 }
11328
11329 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11330 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11331 kfree_sensitive(connkeys);
11332 return -EOPNOTSUPP;
11333 }
11334
11335 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11336 /* bss selection makes no sense if bssid is set */
11337 if (connect.bssid) {
11338 kfree_sensitive(connkeys);
11339 return -EINVAL;
11340 }
11341
11342 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11343 wiphy, &connect.bss_select);
11344 if (err) {
11345 kfree_sensitive(connkeys);
11346 return err;
11347 }
11348 }
11349
11350 if (wiphy_ext_feature_isset(&rdev->wiphy,
11351 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11352 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11353 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11354 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11355 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11356 connect.fils_erp_username =
11357 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11358 connect.fils_erp_username_len =
11359 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11360 connect.fils_erp_realm =
11361 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11362 connect.fils_erp_realm_len =
11363 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11364 connect.fils_erp_next_seq_num =
11365 nla_get_u16(
11366 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11367 connect.fils_erp_rrk =
11368 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11369 connect.fils_erp_rrk_len =
11370 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11371 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11372 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11373 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11374 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11375 kfree_sensitive(connkeys);
11376 return -EINVAL;
11377 }
11378
11379 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
11380 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11381 kfree_sensitive(connkeys);
11382 GENL_SET_ERR_MSG(info,
11383 "external auth requires connection ownership");
11384 return -EINVAL;
11385 }
11386 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
11387 }
11388
11389 wdev_lock(dev->ieee80211_ptr);
11390
11391 err = cfg80211_connect(rdev, dev, &connect, connkeys,
11392 connect.prev_bssid);
11393 if (err)
11394 kfree_sensitive(connkeys);
11395
11396 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11397 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11398 if (connect.bssid)
11399 memcpy(dev->ieee80211_ptr->disconnect_bssid,
11400 connect.bssid, ETH_ALEN);
11401 else
11402 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
11403 }
11404
11405 wdev_unlock(dev->ieee80211_ptr);
11406
11407 return err;
11408 }
11409
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)11410 static int nl80211_update_connect_params(struct sk_buff *skb,
11411 struct genl_info *info)
11412 {
11413 struct cfg80211_connect_params connect = {};
11414 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11415 struct net_device *dev = info->user_ptr[1];
11416 struct wireless_dev *wdev = dev->ieee80211_ptr;
11417 bool fils_sk_offload;
11418 u32 auth_type;
11419 u32 changed = 0;
11420 int ret;
11421
11422 if (!rdev->ops->update_connect_params)
11423 return -EOPNOTSUPP;
11424
11425 if (info->attrs[NL80211_ATTR_IE]) {
11426 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11427 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11428 changed |= UPDATE_ASSOC_IES;
11429 }
11430
11431 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
11432 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
11433
11434 /*
11435 * when driver supports fils-sk offload all attributes must be
11436 * provided. So the else covers "fils-sk-not-all" and
11437 * "no-fils-sk-any".
11438 */
11439 if (fils_sk_offload &&
11440 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11441 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11442 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11443 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11444 connect.fils_erp_username =
11445 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11446 connect.fils_erp_username_len =
11447 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11448 connect.fils_erp_realm =
11449 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11450 connect.fils_erp_realm_len =
11451 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11452 connect.fils_erp_next_seq_num =
11453 nla_get_u16(
11454 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11455 connect.fils_erp_rrk =
11456 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11457 connect.fils_erp_rrk_len =
11458 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11459 changed |= UPDATE_FILS_ERP_INFO;
11460 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11461 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11462 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11463 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11464 return -EINVAL;
11465 }
11466
11467 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11468 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11469 if (!nl80211_valid_auth_type(rdev, auth_type,
11470 NL80211_CMD_CONNECT))
11471 return -EINVAL;
11472
11473 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
11474 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
11475 return -EINVAL;
11476
11477 connect.auth_type = auth_type;
11478 changed |= UPDATE_AUTH_TYPE;
11479 }
11480
11481 wdev_lock(dev->ieee80211_ptr);
11482 if (!wdev->connected)
11483 ret = -ENOLINK;
11484 else
11485 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11486 wdev_unlock(dev->ieee80211_ptr);
11487
11488 return ret;
11489 }
11490
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)11491 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11492 {
11493 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11494 struct net_device *dev = info->user_ptr[1];
11495 u16 reason;
11496 int ret;
11497
11498 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11499 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11500 return -EPERM;
11501
11502 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11503 reason = WLAN_REASON_DEAUTH_LEAVING;
11504 else
11505 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11506
11507 if (reason == 0)
11508 return -EINVAL;
11509
11510 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11511 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11512 return -EOPNOTSUPP;
11513
11514 wdev_lock(dev->ieee80211_ptr);
11515 ret = cfg80211_disconnect(rdev, dev, reason, true);
11516 wdev_unlock(dev->ieee80211_ptr);
11517 return ret;
11518 }
11519
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)11520 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
11521 {
11522 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11523 struct net *net;
11524 int err;
11525
11526 if (info->attrs[NL80211_ATTR_PID]) {
11527 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
11528
11529 net = get_net_ns_by_pid(pid);
11530 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
11531 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
11532
11533 net = get_net_ns_by_fd(fd);
11534 } else {
11535 return -EINVAL;
11536 }
11537
11538 if (IS_ERR(net))
11539 return PTR_ERR(net);
11540
11541 err = 0;
11542
11543 /* check if anything to do */
11544 if (!net_eq(wiphy_net(&rdev->wiphy), net))
11545 err = cfg80211_switch_netns(rdev, net);
11546
11547 put_net(net);
11548 return err;
11549 }
11550
nl80211_setdel_pmksa(struct sk_buff * skb,struct genl_info * info)11551 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
11552 {
11553 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11554 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
11555 struct cfg80211_pmksa *pmksa) = NULL;
11556 struct net_device *dev = info->user_ptr[1];
11557 struct cfg80211_pmksa pmksa;
11558
11559 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
11560
11561 if (!info->attrs[NL80211_ATTR_PMKID])
11562 return -EINVAL;
11563
11564 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11565
11566 if (info->attrs[NL80211_ATTR_MAC]) {
11567 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11568 } else if (info->attrs[NL80211_ATTR_SSID] &&
11569 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
11570 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
11571 info->attrs[NL80211_ATTR_PMK])) {
11572 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11573 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11574 pmksa.cache_id =
11575 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
11576 } else {
11577 return -EINVAL;
11578 }
11579 if (info->attrs[NL80211_ATTR_PMK]) {
11580 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11581 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
11582 }
11583
11584 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
11585 pmksa.pmk_lifetime =
11586 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
11587
11588 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
11589 pmksa.pmk_reauth_threshold =
11590 nla_get_u8(
11591 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
11592
11593 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11594 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
11595 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
11596 wiphy_ext_feature_isset(&rdev->wiphy,
11597 NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
11598 return -EOPNOTSUPP;
11599
11600 switch (info->genlhdr->cmd) {
11601 case NL80211_CMD_SET_PMKSA:
11602 rdev_ops = rdev->ops->set_pmksa;
11603 break;
11604 case NL80211_CMD_DEL_PMKSA:
11605 rdev_ops = rdev->ops->del_pmksa;
11606 break;
11607 default:
11608 WARN_ON(1);
11609 break;
11610 }
11611
11612 if (!rdev_ops)
11613 return -EOPNOTSUPP;
11614
11615 return rdev_ops(&rdev->wiphy, dev, &pmksa);
11616 }
11617
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)11618 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
11619 {
11620 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11621 struct net_device *dev = info->user_ptr[1];
11622
11623 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11624 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11625 return -EOPNOTSUPP;
11626
11627 if (!rdev->ops->flush_pmksa)
11628 return -EOPNOTSUPP;
11629
11630 return rdev_flush_pmksa(rdev, dev);
11631 }
11632
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)11633 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
11634 {
11635 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11636 struct net_device *dev = info->user_ptr[1];
11637 u8 action_code, dialog_token;
11638 u32 peer_capability = 0;
11639 u16 status_code;
11640 u8 *peer;
11641 bool initiator;
11642
11643 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11644 !rdev->ops->tdls_mgmt)
11645 return -EOPNOTSUPP;
11646
11647 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
11648 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
11649 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
11650 !info->attrs[NL80211_ATTR_IE] ||
11651 !info->attrs[NL80211_ATTR_MAC])
11652 return -EINVAL;
11653
11654 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11655 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
11656 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11657 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
11658 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
11659 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
11660 peer_capability =
11661 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
11662
11663 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
11664 dialog_token, status_code, peer_capability,
11665 initiator,
11666 nla_data(info->attrs[NL80211_ATTR_IE]),
11667 nla_len(info->attrs[NL80211_ATTR_IE]));
11668 }
11669
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)11670 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
11671 {
11672 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11673 struct net_device *dev = info->user_ptr[1];
11674 enum nl80211_tdls_operation operation;
11675 u8 *peer;
11676
11677 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11678 !rdev->ops->tdls_oper)
11679 return -EOPNOTSUPP;
11680
11681 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
11682 !info->attrs[NL80211_ATTR_MAC])
11683 return -EINVAL;
11684
11685 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
11686 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11687
11688 return rdev_tdls_oper(rdev, dev, peer, operation);
11689 }
11690
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)11691 static int nl80211_remain_on_channel(struct sk_buff *skb,
11692 struct genl_info *info)
11693 {
11694 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11695 unsigned int link_id = nl80211_link_id(info->attrs);
11696 struct wireless_dev *wdev = info->user_ptr[1];
11697 struct cfg80211_chan_def chandef;
11698 struct sk_buff *msg;
11699 void *hdr;
11700 u64 cookie;
11701 u32 duration;
11702 int err;
11703
11704 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11705 !info->attrs[NL80211_ATTR_DURATION])
11706 return -EINVAL;
11707
11708 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11709
11710 if (!rdev->ops->remain_on_channel ||
11711 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11712 return -EOPNOTSUPP;
11713
11714 /*
11715 * We should be on that channel for at least a minimum amount of
11716 * time (10ms) but no longer than the driver supports.
11717 */
11718 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11719 duration > rdev->wiphy.max_remain_on_channel_duration)
11720 return -EINVAL;
11721
11722 err = nl80211_parse_chandef(rdev, info, &chandef);
11723 if (err)
11724 return err;
11725
11726 wdev_lock(wdev);
11727 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
11728 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
11729
11730 oper_chandef = wdev_chandef(wdev, link_id);
11731
11732 if (WARN_ON(!oper_chandef)) {
11733 /* cannot happen since we must beacon to get here */
11734 WARN_ON(1);
11735 wdev_unlock(wdev);
11736 return -EBUSY;
11737 }
11738
11739 /* note: returns first one if identical chandefs */
11740 compat_chandef = cfg80211_chandef_compatible(&chandef,
11741 oper_chandef);
11742
11743 if (compat_chandef != &chandef) {
11744 wdev_unlock(wdev);
11745 return -EBUSY;
11746 }
11747 }
11748 wdev_unlock(wdev);
11749
11750 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11751 if (!msg)
11752 return -ENOMEM;
11753
11754 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11755 NL80211_CMD_REMAIN_ON_CHANNEL);
11756 if (!hdr) {
11757 err = -ENOBUFS;
11758 goto free_msg;
11759 }
11760
11761 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11762 duration, &cookie);
11763
11764 if (err)
11765 goto free_msg;
11766
11767 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11768 NL80211_ATTR_PAD))
11769 goto nla_put_failure;
11770
11771 genlmsg_end(msg, hdr);
11772
11773 return genlmsg_reply(msg, info);
11774
11775 nla_put_failure:
11776 err = -ENOBUFS;
11777 free_msg:
11778 nlmsg_free(msg);
11779 return err;
11780 }
11781
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)11782 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11783 struct genl_info *info)
11784 {
11785 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11786 struct wireless_dev *wdev = info->user_ptr[1];
11787 u64 cookie;
11788
11789 if (!info->attrs[NL80211_ATTR_COOKIE])
11790 return -EINVAL;
11791
11792 if (!rdev->ops->cancel_remain_on_channel)
11793 return -EOPNOTSUPP;
11794
11795 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11796
11797 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11798 }
11799
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)11800 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11801 struct genl_info *info)
11802 {
11803 struct cfg80211_bitrate_mask mask;
11804 unsigned int link_id = nl80211_link_id(info->attrs);
11805 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11806 struct net_device *dev = info->user_ptr[1];
11807 struct wireless_dev *wdev = dev->ieee80211_ptr;
11808 int err;
11809
11810 if (!rdev->ops->set_bitrate_mask)
11811 return -EOPNOTSUPP;
11812
11813 wdev_lock(wdev);
11814 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11815 NL80211_ATTR_TX_RATES, &mask,
11816 dev, true, link_id);
11817 if (err)
11818 goto out;
11819
11820 err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
11821 out:
11822 wdev_unlock(wdev);
11823 return err;
11824 }
11825
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)11826 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11827 {
11828 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11829 struct wireless_dev *wdev = info->user_ptr[1];
11830 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11831
11832 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11833 return -EINVAL;
11834
11835 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11836 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11837
11838 switch (wdev->iftype) {
11839 case NL80211_IFTYPE_STATION:
11840 case NL80211_IFTYPE_ADHOC:
11841 case NL80211_IFTYPE_P2P_CLIENT:
11842 case NL80211_IFTYPE_AP:
11843 case NL80211_IFTYPE_AP_VLAN:
11844 case NL80211_IFTYPE_MESH_POINT:
11845 case NL80211_IFTYPE_P2P_GO:
11846 case NL80211_IFTYPE_P2P_DEVICE:
11847 break;
11848 case NL80211_IFTYPE_NAN:
11849 default:
11850 return -EOPNOTSUPP;
11851 }
11852
11853 /* not much point in registering if we can't reply */
11854 if (!rdev->ops->mgmt_tx)
11855 return -EOPNOTSUPP;
11856
11857 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11858 !wiphy_ext_feature_isset(&rdev->wiphy,
11859 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11860 GENL_SET_ERR_MSG(info,
11861 "multicast RX registrations are not supported");
11862 return -EOPNOTSUPP;
11863 }
11864
11865 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11866 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11867 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11868 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11869 info->extack);
11870 }
11871
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)11872 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11873 {
11874 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11875 struct wireless_dev *wdev = info->user_ptr[1];
11876 struct cfg80211_chan_def chandef;
11877 int err;
11878 void *hdr = NULL;
11879 u64 cookie;
11880 struct sk_buff *msg = NULL;
11881 struct cfg80211_mgmt_tx_params params = {
11882 .dont_wait_for_ack =
11883 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11884 };
11885
11886 if (!info->attrs[NL80211_ATTR_FRAME])
11887 return -EINVAL;
11888
11889 if (!rdev->ops->mgmt_tx)
11890 return -EOPNOTSUPP;
11891
11892 switch (wdev->iftype) {
11893 case NL80211_IFTYPE_P2P_DEVICE:
11894 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11895 return -EINVAL;
11896 break;
11897 case NL80211_IFTYPE_STATION:
11898 case NL80211_IFTYPE_ADHOC:
11899 case NL80211_IFTYPE_P2P_CLIENT:
11900 case NL80211_IFTYPE_AP:
11901 case NL80211_IFTYPE_AP_VLAN:
11902 case NL80211_IFTYPE_MESH_POINT:
11903 case NL80211_IFTYPE_P2P_GO:
11904 break;
11905 case NL80211_IFTYPE_NAN:
11906 default:
11907 return -EOPNOTSUPP;
11908 }
11909
11910 if (info->attrs[NL80211_ATTR_DURATION]) {
11911 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11912 return -EINVAL;
11913 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11914
11915 /*
11916 * We should wait on the channel for at least a minimum amount
11917 * of time (10ms) but no longer than the driver supports.
11918 */
11919 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11920 params.wait > rdev->wiphy.max_remain_on_channel_duration)
11921 return -EINVAL;
11922 }
11923
11924 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11925
11926 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11927 return -EINVAL;
11928
11929 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11930
11931 /* get the channel if any has been specified, otherwise pass NULL to
11932 * the driver. The latter will use the current one
11933 */
11934 chandef.chan = NULL;
11935 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11936 err = nl80211_parse_chandef(rdev, info, &chandef);
11937 if (err)
11938 return err;
11939 }
11940
11941 if (!chandef.chan && params.offchan)
11942 return -EINVAL;
11943
11944 wdev_lock(wdev);
11945 if (params.offchan &&
11946 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
11947 wdev_unlock(wdev);
11948 return -EBUSY;
11949 }
11950 wdev_unlock(wdev);
11951
11952 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11953 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11954
11955 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11956 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11957 int i;
11958
11959 if (len % sizeof(u16))
11960 return -EINVAL;
11961
11962 params.n_csa_offsets = len / sizeof(u16);
11963 params.csa_offsets =
11964 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11965
11966 /* check that all the offsets fit the frame */
11967 for (i = 0; i < params.n_csa_offsets; i++) {
11968 if (params.csa_offsets[i] >= params.len)
11969 return -EINVAL;
11970 }
11971 }
11972
11973 if (!params.dont_wait_for_ack) {
11974 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11975 if (!msg)
11976 return -ENOMEM;
11977
11978 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11979 NL80211_CMD_FRAME);
11980 if (!hdr) {
11981 err = -ENOBUFS;
11982 goto free_msg;
11983 }
11984 }
11985
11986 params.chan = chandef.chan;
11987 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
11988 if (err)
11989 goto free_msg;
11990
11991 if (msg) {
11992 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11993 NL80211_ATTR_PAD))
11994 goto nla_put_failure;
11995
11996 genlmsg_end(msg, hdr);
11997 return genlmsg_reply(msg, info);
11998 }
11999
12000 return 0;
12001
12002 nla_put_failure:
12003 err = -ENOBUFS;
12004 free_msg:
12005 nlmsg_free(msg);
12006 return err;
12007 }
12008
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)12009 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12010 {
12011 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12012 struct wireless_dev *wdev = info->user_ptr[1];
12013 u64 cookie;
12014
12015 if (!info->attrs[NL80211_ATTR_COOKIE])
12016 return -EINVAL;
12017
12018 if (!rdev->ops->mgmt_tx_cancel_wait)
12019 return -EOPNOTSUPP;
12020
12021 switch (wdev->iftype) {
12022 case NL80211_IFTYPE_STATION:
12023 case NL80211_IFTYPE_ADHOC:
12024 case NL80211_IFTYPE_P2P_CLIENT:
12025 case NL80211_IFTYPE_AP:
12026 case NL80211_IFTYPE_AP_VLAN:
12027 case NL80211_IFTYPE_P2P_GO:
12028 case NL80211_IFTYPE_P2P_DEVICE:
12029 break;
12030 case NL80211_IFTYPE_NAN:
12031 default:
12032 return -EOPNOTSUPP;
12033 }
12034
12035 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12036
12037 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12038 }
12039
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)12040 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12041 {
12042 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12043 struct wireless_dev *wdev;
12044 struct net_device *dev = info->user_ptr[1];
12045 u8 ps_state;
12046 bool state;
12047 int err;
12048
12049 if (!info->attrs[NL80211_ATTR_PS_STATE])
12050 return -EINVAL;
12051
12052 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12053
12054 wdev = dev->ieee80211_ptr;
12055
12056 if (!rdev->ops->set_power_mgmt)
12057 return -EOPNOTSUPP;
12058
12059 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12060
12061 if (state == wdev->ps)
12062 return 0;
12063
12064 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12065 if (!err)
12066 wdev->ps = state;
12067 return err;
12068 }
12069
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)12070 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12071 {
12072 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12073 enum nl80211_ps_state ps_state;
12074 struct wireless_dev *wdev;
12075 struct net_device *dev = info->user_ptr[1];
12076 struct sk_buff *msg;
12077 void *hdr;
12078 int err;
12079
12080 wdev = dev->ieee80211_ptr;
12081
12082 if (!rdev->ops->set_power_mgmt)
12083 return -EOPNOTSUPP;
12084
12085 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12086 if (!msg)
12087 return -ENOMEM;
12088
12089 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12090 NL80211_CMD_GET_POWER_SAVE);
12091 if (!hdr) {
12092 err = -ENOBUFS;
12093 goto free_msg;
12094 }
12095
12096 if (wdev->ps)
12097 ps_state = NL80211_PS_ENABLED;
12098 else
12099 ps_state = NL80211_PS_DISABLED;
12100
12101 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12102 goto nla_put_failure;
12103
12104 genlmsg_end(msg, hdr);
12105 return genlmsg_reply(msg, info);
12106
12107 nla_put_failure:
12108 err = -ENOBUFS;
12109 free_msg:
12110 nlmsg_free(msg);
12111 return err;
12112 }
12113
12114 static const struct nla_policy
12115 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12116 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12117 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12118 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12119 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12120 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12121 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12122 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12123 };
12124
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)12125 static int nl80211_set_cqm_txe(struct genl_info *info,
12126 u32 rate, u32 pkts, u32 intvl)
12127 {
12128 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12129 struct net_device *dev = info->user_ptr[1];
12130 struct wireless_dev *wdev = dev->ieee80211_ptr;
12131
12132 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12133 return -EINVAL;
12134
12135 if (!rdev->ops->set_cqm_txe_config)
12136 return -EOPNOTSUPP;
12137
12138 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12139 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12140 return -EOPNOTSUPP;
12141
12142 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12143 }
12144
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev)12145 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12146 struct net_device *dev)
12147 {
12148 struct wireless_dev *wdev = dev->ieee80211_ptr;
12149 s32 last, low, high;
12150 u32 hyst;
12151 int i, n, low_index;
12152 int err;
12153
12154 /* RSSI reporting disabled? */
12155 if (!wdev->cqm_config)
12156 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12157
12158 /*
12159 * Obtain current RSSI value if possible, if not and no RSSI threshold
12160 * event has been received yet, we should receive an event after a
12161 * connection is established and enough beacons received to calculate
12162 * the average.
12163 */
12164 if (!wdev->cqm_config->last_rssi_event_value &&
12165 wdev->links[0].client.current_bss &&
12166 rdev->ops->get_station) {
12167 struct station_info sinfo = {};
12168 u8 *mac_addr;
12169
12170 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12171
12172 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12173 if (err)
12174 return err;
12175
12176 cfg80211_sinfo_release_content(&sinfo);
12177 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12178 wdev->cqm_config->last_rssi_event_value =
12179 (s8) sinfo.rx_beacon_signal_avg;
12180 }
12181
12182 last = wdev->cqm_config->last_rssi_event_value;
12183 hyst = wdev->cqm_config->rssi_hyst;
12184 n = wdev->cqm_config->n_rssi_thresholds;
12185
12186 for (i = 0; i < n; i++) {
12187 i = array_index_nospec(i, n);
12188 if (last < wdev->cqm_config->rssi_thresholds[i])
12189 break;
12190 }
12191
12192 low_index = i - 1;
12193 if (low_index >= 0) {
12194 low_index = array_index_nospec(low_index, n);
12195 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
12196 } else {
12197 low = S32_MIN;
12198 }
12199 if (i < n) {
12200 i = array_index_nospec(i, n);
12201 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
12202 } else {
12203 high = S32_MAX;
12204 }
12205
12206 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12207 }
12208
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)12209 static int nl80211_set_cqm_rssi(struct genl_info *info,
12210 const s32 *thresholds, int n_thresholds,
12211 u32 hysteresis)
12212 {
12213 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12214 struct net_device *dev = info->user_ptr[1];
12215 struct wireless_dev *wdev = dev->ieee80211_ptr;
12216 int i, err;
12217 s32 prev = S32_MIN;
12218
12219 /* Check all values negative and sorted */
12220 for (i = 0; i < n_thresholds; i++) {
12221 if (thresholds[i] > 0 || thresholds[i] <= prev)
12222 return -EINVAL;
12223
12224 prev = thresholds[i];
12225 }
12226
12227 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12228 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12229 return -EOPNOTSUPP;
12230
12231 wdev_lock(wdev);
12232 cfg80211_cqm_config_free(wdev);
12233 wdev_unlock(wdev);
12234
12235 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12236 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12237 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12238
12239 return rdev_set_cqm_rssi_config(rdev, dev,
12240 thresholds[0], hysteresis);
12241 }
12242
12243 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12244 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12245 return -EOPNOTSUPP;
12246
12247 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12248 n_thresholds = 0;
12249
12250 wdev_lock(wdev);
12251 if (n_thresholds) {
12252 struct cfg80211_cqm_config *cqm_config;
12253
12254 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12255 n_thresholds),
12256 GFP_KERNEL);
12257 if (!cqm_config) {
12258 err = -ENOMEM;
12259 goto unlock;
12260 }
12261
12262 cqm_config->rssi_hyst = hysteresis;
12263 cqm_config->n_rssi_thresholds = n_thresholds;
12264 memcpy(cqm_config->rssi_thresholds, thresholds,
12265 flex_array_size(cqm_config, rssi_thresholds,
12266 n_thresholds));
12267
12268 wdev->cqm_config = cqm_config;
12269 }
12270
12271 err = cfg80211_cqm_rssi_update(rdev, dev);
12272
12273 unlock:
12274 wdev_unlock(wdev);
12275
12276 return err;
12277 }
12278
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)12279 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12280 {
12281 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12282 struct nlattr *cqm;
12283 int err;
12284
12285 cqm = info->attrs[NL80211_ATTR_CQM];
12286 if (!cqm)
12287 return -EINVAL;
12288
12289 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12290 nl80211_attr_cqm_policy,
12291 info->extack);
12292 if (err)
12293 return err;
12294
12295 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12296 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12297 const s32 *thresholds =
12298 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12299 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12300 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12301
12302 if (len % 4)
12303 return -EINVAL;
12304
12305 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12306 hysteresis);
12307 }
12308
12309 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12310 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12311 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12312 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12313 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12314 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12315
12316 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12317 }
12318
12319 return -EINVAL;
12320 }
12321
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)12322 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12323 {
12324 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12325 struct net_device *dev = info->user_ptr[1];
12326 struct ocb_setup setup = {};
12327 int err;
12328
12329 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12330 if (err)
12331 return err;
12332
12333 return cfg80211_join_ocb(rdev, dev, &setup);
12334 }
12335
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)12336 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12337 {
12338 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12339 struct net_device *dev = info->user_ptr[1];
12340
12341 return cfg80211_leave_ocb(rdev, dev);
12342 }
12343
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)12344 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12345 {
12346 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12347 struct net_device *dev = info->user_ptr[1];
12348 struct mesh_config cfg;
12349 struct mesh_setup setup;
12350 int err;
12351
12352 /* start with default */
12353 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
12354 memcpy(&setup, &default_mesh_setup, sizeof(setup));
12355
12356 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
12357 /* and parse parameters if given */
12358 err = nl80211_parse_mesh_config(info, &cfg, NULL);
12359 if (err)
12360 return err;
12361 }
12362
12363 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
12364 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
12365 return -EINVAL;
12366
12367 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
12368 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
12369
12370 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12371 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
12372 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12373 return -EINVAL;
12374
12375 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
12376 setup.beacon_interval =
12377 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12378
12379 err = cfg80211_validate_beacon_int(rdev,
12380 NL80211_IFTYPE_MESH_POINT,
12381 setup.beacon_interval);
12382 if (err)
12383 return err;
12384 }
12385
12386 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
12387 setup.dtim_period =
12388 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
12389 if (setup.dtim_period < 1 || setup.dtim_period > 100)
12390 return -EINVAL;
12391 }
12392
12393 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
12394 /* parse additional setup parameters if given */
12395 err = nl80211_parse_mesh_setup(info, &setup);
12396 if (err)
12397 return err;
12398 }
12399
12400 if (setup.user_mpm)
12401 cfg.auto_open_plinks = false;
12402
12403 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12404 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12405 if (err)
12406 return err;
12407 } else {
12408 /* __cfg80211_join_mesh() will sort it out */
12409 setup.chandef.chan = NULL;
12410 }
12411
12412 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12413 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12414 int n_rates =
12415 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12416 struct ieee80211_supported_band *sband;
12417
12418 if (!setup.chandef.chan)
12419 return -EINVAL;
12420
12421 sband = rdev->wiphy.bands[setup.chandef.chan->band];
12422
12423 err = ieee80211_get_ratemask(sband, rates, n_rates,
12424 &setup.basic_rates);
12425 if (err)
12426 return err;
12427 }
12428
12429 if (info->attrs[NL80211_ATTR_TX_RATES]) {
12430 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12431 NL80211_ATTR_TX_RATES,
12432 &setup.beacon_rate,
12433 dev, false, 0);
12434 if (err)
12435 return err;
12436
12437 if (!setup.chandef.chan)
12438 return -EINVAL;
12439
12440 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
12441 &setup.beacon_rate);
12442 if (err)
12443 return err;
12444 }
12445
12446 setup.userspace_handles_dfs =
12447 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12448
12449 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12450 int r = validate_pae_over_nl80211(rdev, info);
12451
12452 if (r < 0)
12453 return r;
12454
12455 setup.control_port_over_nl80211 = true;
12456 }
12457
12458 wdev_lock(dev->ieee80211_ptr);
12459 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
12460 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
12461 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12462 wdev_unlock(dev->ieee80211_ptr);
12463
12464 return err;
12465 }
12466
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)12467 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
12468 {
12469 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12470 struct net_device *dev = info->user_ptr[1];
12471
12472 return cfg80211_leave_mesh(rdev, dev);
12473 }
12474
12475 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)12476 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
12477 struct cfg80211_registered_device *rdev)
12478 {
12479 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
12480 struct nlattr *nl_pats, *nl_pat;
12481 int i, pat_len;
12482
12483 if (!wowlan->n_patterns)
12484 return 0;
12485
12486 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
12487 if (!nl_pats)
12488 return -ENOBUFS;
12489
12490 for (i = 0; i < wowlan->n_patterns; i++) {
12491 nl_pat = nla_nest_start_noflag(msg, i + 1);
12492 if (!nl_pat)
12493 return -ENOBUFS;
12494 pat_len = wowlan->patterns[i].pattern_len;
12495 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
12496 wowlan->patterns[i].mask) ||
12497 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12498 wowlan->patterns[i].pattern) ||
12499 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12500 wowlan->patterns[i].pkt_offset))
12501 return -ENOBUFS;
12502 nla_nest_end(msg, nl_pat);
12503 }
12504 nla_nest_end(msg, nl_pats);
12505
12506 return 0;
12507 }
12508
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)12509 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
12510 struct cfg80211_wowlan_tcp *tcp)
12511 {
12512 struct nlattr *nl_tcp;
12513
12514 if (!tcp)
12515 return 0;
12516
12517 nl_tcp = nla_nest_start_noflag(msg,
12518 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
12519 if (!nl_tcp)
12520 return -ENOBUFS;
12521
12522 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
12523 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
12524 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
12525 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
12526 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
12527 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
12528 tcp->payload_len, tcp->payload) ||
12529 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
12530 tcp->data_interval) ||
12531 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
12532 tcp->wake_len, tcp->wake_data) ||
12533 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
12534 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
12535 return -ENOBUFS;
12536
12537 if (tcp->payload_seq.len &&
12538 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
12539 sizeof(tcp->payload_seq), &tcp->payload_seq))
12540 return -ENOBUFS;
12541
12542 if (tcp->payload_tok.len &&
12543 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
12544 sizeof(tcp->payload_tok) + tcp->tokens_size,
12545 &tcp->payload_tok))
12546 return -ENOBUFS;
12547
12548 nla_nest_end(msg, nl_tcp);
12549
12550 return 0;
12551 }
12552
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)12553 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
12554 struct cfg80211_sched_scan_request *req)
12555 {
12556 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
12557 int i;
12558
12559 if (!req)
12560 return 0;
12561
12562 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
12563 if (!nd)
12564 return -ENOBUFS;
12565
12566 if (req->n_scan_plans == 1 &&
12567 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
12568 req->scan_plans[0].interval * 1000))
12569 return -ENOBUFS;
12570
12571 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
12572 return -ENOBUFS;
12573
12574 if (req->relative_rssi_set) {
12575 struct nl80211_bss_select_rssi_adjust rssi_adjust;
12576
12577 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
12578 req->relative_rssi))
12579 return -ENOBUFS;
12580
12581 rssi_adjust.band = req->rssi_adjust.band;
12582 rssi_adjust.delta = req->rssi_adjust.delta;
12583 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
12584 sizeof(rssi_adjust), &rssi_adjust))
12585 return -ENOBUFS;
12586 }
12587
12588 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12589 if (!freqs)
12590 return -ENOBUFS;
12591
12592 for (i = 0; i < req->n_channels; i++) {
12593 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12594 return -ENOBUFS;
12595 }
12596
12597 nla_nest_end(msg, freqs);
12598
12599 if (req->n_match_sets) {
12600 matches = nla_nest_start_noflag(msg,
12601 NL80211_ATTR_SCHED_SCAN_MATCH);
12602 if (!matches)
12603 return -ENOBUFS;
12604
12605 for (i = 0; i < req->n_match_sets; i++) {
12606 match = nla_nest_start_noflag(msg, i);
12607 if (!match)
12608 return -ENOBUFS;
12609
12610 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
12611 req->match_sets[i].ssid.ssid_len,
12612 req->match_sets[i].ssid.ssid))
12613 return -ENOBUFS;
12614 nla_nest_end(msg, match);
12615 }
12616 nla_nest_end(msg, matches);
12617 }
12618
12619 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
12620 if (!scan_plans)
12621 return -ENOBUFS;
12622
12623 for (i = 0; i < req->n_scan_plans; i++) {
12624 scan_plan = nla_nest_start_noflag(msg, i + 1);
12625 if (!scan_plan)
12626 return -ENOBUFS;
12627
12628 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
12629 req->scan_plans[i].interval) ||
12630 (req->scan_plans[i].iterations &&
12631 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
12632 req->scan_plans[i].iterations)))
12633 return -ENOBUFS;
12634 nla_nest_end(msg, scan_plan);
12635 }
12636 nla_nest_end(msg, scan_plans);
12637
12638 nla_nest_end(msg, nd);
12639
12640 return 0;
12641 }
12642
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)12643 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
12644 {
12645 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12646 struct sk_buff *msg;
12647 void *hdr;
12648 u32 size = NLMSG_DEFAULT_SIZE;
12649
12650 if (!rdev->wiphy.wowlan)
12651 return -EOPNOTSUPP;
12652
12653 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
12654 /* adjust size to have room for all the data */
12655 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
12656 rdev->wiphy.wowlan_config->tcp->payload_len +
12657 rdev->wiphy.wowlan_config->tcp->wake_len +
12658 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
12659 }
12660
12661 msg = nlmsg_new(size, GFP_KERNEL);
12662 if (!msg)
12663 return -ENOMEM;
12664
12665 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12666 NL80211_CMD_GET_WOWLAN);
12667 if (!hdr)
12668 goto nla_put_failure;
12669
12670 if (rdev->wiphy.wowlan_config) {
12671 struct nlattr *nl_wowlan;
12672
12673 nl_wowlan = nla_nest_start_noflag(msg,
12674 NL80211_ATTR_WOWLAN_TRIGGERS);
12675 if (!nl_wowlan)
12676 goto nla_put_failure;
12677
12678 if ((rdev->wiphy.wowlan_config->any &&
12679 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
12680 (rdev->wiphy.wowlan_config->disconnect &&
12681 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
12682 (rdev->wiphy.wowlan_config->magic_pkt &&
12683 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
12684 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
12685 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
12686 (rdev->wiphy.wowlan_config->eap_identity_req &&
12687 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
12688 (rdev->wiphy.wowlan_config->four_way_handshake &&
12689 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
12690 (rdev->wiphy.wowlan_config->rfkill_release &&
12691 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
12692 goto nla_put_failure;
12693
12694 if (nl80211_send_wowlan_patterns(msg, rdev))
12695 goto nla_put_failure;
12696
12697 if (nl80211_send_wowlan_tcp(msg,
12698 rdev->wiphy.wowlan_config->tcp))
12699 goto nla_put_failure;
12700
12701 if (nl80211_send_wowlan_nd(
12702 msg,
12703 rdev->wiphy.wowlan_config->nd_config))
12704 goto nla_put_failure;
12705
12706 nla_nest_end(msg, nl_wowlan);
12707 }
12708
12709 genlmsg_end(msg, hdr);
12710 return genlmsg_reply(msg, info);
12711
12712 nla_put_failure:
12713 nlmsg_free(msg);
12714 return -ENOBUFS;
12715 }
12716
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)12717 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
12718 struct nlattr *attr,
12719 struct cfg80211_wowlan *trig)
12720 {
12721 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
12722 struct cfg80211_wowlan_tcp *cfg;
12723 struct nl80211_wowlan_tcp_data_token *tok = NULL;
12724 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
12725 u32 size;
12726 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
12727 int err, port;
12728
12729 if (!rdev->wiphy.wowlan->tcp)
12730 return -EINVAL;
12731
12732 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12733 nl80211_wowlan_tcp_policy, NULL);
12734 if (err)
12735 return err;
12736
12737 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12738 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12739 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12740 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12741 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12742 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12743 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12744 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12745 return -EINVAL;
12746
12747 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12748 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12749 return -EINVAL;
12750
12751 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12752 rdev->wiphy.wowlan->tcp->data_interval_max ||
12753 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12754 return -EINVAL;
12755
12756 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12757 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12758 return -EINVAL;
12759
12760 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12761 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12762 return -EINVAL;
12763
12764 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12765 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12766
12767 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12768 tokens_size = tokln - sizeof(*tok);
12769
12770 if (!tok->len || tokens_size % tok->len)
12771 return -EINVAL;
12772 if (!rdev->wiphy.wowlan->tcp->tok)
12773 return -EINVAL;
12774 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12775 return -EINVAL;
12776 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12777 return -EINVAL;
12778 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12779 return -EINVAL;
12780 if (tok->offset + tok->len > data_size)
12781 return -EINVAL;
12782 }
12783
12784 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12785 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12786 if (!rdev->wiphy.wowlan->tcp->seq)
12787 return -EINVAL;
12788 if (seq->len == 0 || seq->len > 4)
12789 return -EINVAL;
12790 if (seq->len + seq->offset > data_size)
12791 return -EINVAL;
12792 }
12793
12794 size = sizeof(*cfg);
12795 size += data_size;
12796 size += wake_size + wake_mask_size;
12797 size += tokens_size;
12798
12799 cfg = kzalloc(size, GFP_KERNEL);
12800 if (!cfg)
12801 return -ENOMEM;
12802 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12803 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12804 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12805 ETH_ALEN);
12806 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12807 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12808 else
12809 port = 0;
12810 #ifdef CONFIG_INET
12811 /* allocate a socket and port for it and use it */
12812 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12813 IPPROTO_TCP, &cfg->sock, 1);
12814 if (err) {
12815 kfree(cfg);
12816 return err;
12817 }
12818 if (inet_csk_get_port(cfg->sock->sk, port)) {
12819 sock_release(cfg->sock);
12820 kfree(cfg);
12821 return -EADDRINUSE;
12822 }
12823 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12824 #else
12825 if (!port) {
12826 kfree(cfg);
12827 return -EINVAL;
12828 }
12829 cfg->src_port = port;
12830 #endif
12831
12832 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12833 cfg->payload_len = data_size;
12834 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12835 memcpy((void *)cfg->payload,
12836 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12837 data_size);
12838 if (seq)
12839 cfg->payload_seq = *seq;
12840 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12841 cfg->wake_len = wake_size;
12842 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12843 memcpy((void *)cfg->wake_data,
12844 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12845 wake_size);
12846 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12847 data_size + wake_size;
12848 memcpy((void *)cfg->wake_mask,
12849 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12850 wake_mask_size);
12851 if (tok) {
12852 cfg->tokens_size = tokens_size;
12853 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12854 }
12855
12856 trig->tcp = cfg;
12857
12858 return 0;
12859 }
12860
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)12861 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12862 const struct wiphy_wowlan_support *wowlan,
12863 struct nlattr *attr,
12864 struct cfg80211_wowlan *trig)
12865 {
12866 struct nlattr **tb;
12867 int err;
12868
12869 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12870 if (!tb)
12871 return -ENOMEM;
12872
12873 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12874 err = -EOPNOTSUPP;
12875 goto out;
12876 }
12877
12878 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12879 nl80211_policy, NULL);
12880 if (err)
12881 goto out;
12882
12883 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12884 wowlan->max_nd_match_sets);
12885 err = PTR_ERR_OR_ZERO(trig->nd_config);
12886 if (err)
12887 trig->nd_config = NULL;
12888
12889 out:
12890 kfree(tb);
12891 return err;
12892 }
12893
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)12894 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12895 {
12896 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12897 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12898 struct cfg80211_wowlan new_triggers = {};
12899 struct cfg80211_wowlan *ntrig;
12900 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12901 int err, i;
12902 bool prev_enabled = rdev->wiphy.wowlan_config;
12903 bool regular = false;
12904
12905 if (!wowlan)
12906 return -EOPNOTSUPP;
12907
12908 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12909 cfg80211_rdev_free_wowlan(rdev);
12910 rdev->wiphy.wowlan_config = NULL;
12911 goto set_wakeup;
12912 }
12913
12914 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12915 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12916 nl80211_wowlan_policy, info->extack);
12917 if (err)
12918 return err;
12919
12920 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12921 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12922 return -EINVAL;
12923 new_triggers.any = true;
12924 }
12925
12926 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12927 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12928 return -EINVAL;
12929 new_triggers.disconnect = true;
12930 regular = true;
12931 }
12932
12933 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12934 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12935 return -EINVAL;
12936 new_triggers.magic_pkt = true;
12937 regular = true;
12938 }
12939
12940 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12941 return -EINVAL;
12942
12943 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12944 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12945 return -EINVAL;
12946 new_triggers.gtk_rekey_failure = true;
12947 regular = true;
12948 }
12949
12950 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12951 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12952 return -EINVAL;
12953 new_triggers.eap_identity_req = true;
12954 regular = true;
12955 }
12956
12957 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12958 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12959 return -EINVAL;
12960 new_triggers.four_way_handshake = true;
12961 regular = true;
12962 }
12963
12964 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12965 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12966 return -EINVAL;
12967 new_triggers.rfkill_release = true;
12968 regular = true;
12969 }
12970
12971 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12972 struct nlattr *pat;
12973 int n_patterns = 0;
12974 int rem, pat_len, mask_len, pkt_offset;
12975 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12976
12977 regular = true;
12978
12979 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12980 rem)
12981 n_patterns++;
12982 if (n_patterns > wowlan->n_patterns)
12983 return -EINVAL;
12984
12985 new_triggers.patterns = kcalloc(n_patterns,
12986 sizeof(new_triggers.patterns[0]),
12987 GFP_KERNEL);
12988 if (!new_triggers.patterns)
12989 return -ENOMEM;
12990
12991 new_triggers.n_patterns = n_patterns;
12992 i = 0;
12993
12994 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12995 rem) {
12996 u8 *mask_pat;
12997
12998 err = nla_parse_nested_deprecated(pat_tb,
12999 MAX_NL80211_PKTPAT,
13000 pat,
13001 nl80211_packet_pattern_policy,
13002 info->extack);
13003 if (err)
13004 goto error;
13005
13006 err = -EINVAL;
13007 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13008 !pat_tb[NL80211_PKTPAT_PATTERN])
13009 goto error;
13010 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13011 mask_len = DIV_ROUND_UP(pat_len, 8);
13012 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13013 goto error;
13014 if (pat_len > wowlan->pattern_max_len ||
13015 pat_len < wowlan->pattern_min_len)
13016 goto error;
13017
13018 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13019 pkt_offset = 0;
13020 else
13021 pkt_offset = nla_get_u32(
13022 pat_tb[NL80211_PKTPAT_OFFSET]);
13023 if (pkt_offset > wowlan->max_pkt_offset)
13024 goto error;
13025 new_triggers.patterns[i].pkt_offset = pkt_offset;
13026
13027 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13028 if (!mask_pat) {
13029 err = -ENOMEM;
13030 goto error;
13031 }
13032 new_triggers.patterns[i].mask = mask_pat;
13033 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13034 mask_len);
13035 mask_pat += mask_len;
13036 new_triggers.patterns[i].pattern = mask_pat;
13037 new_triggers.patterns[i].pattern_len = pat_len;
13038 memcpy(mask_pat,
13039 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13040 pat_len);
13041 i++;
13042 }
13043 }
13044
13045 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13046 regular = true;
13047 err = nl80211_parse_wowlan_tcp(
13048 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13049 &new_triggers);
13050 if (err)
13051 goto error;
13052 }
13053
13054 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13055 regular = true;
13056 err = nl80211_parse_wowlan_nd(
13057 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13058 &new_triggers);
13059 if (err)
13060 goto error;
13061 }
13062
13063 /* The 'any' trigger means the device continues operating more or less
13064 * as in its normal operation mode and wakes up the host on most of the
13065 * normal interrupts (like packet RX, ...)
13066 * It therefore makes little sense to combine with the more constrained
13067 * wakeup trigger modes.
13068 */
13069 if (new_triggers.any && regular) {
13070 err = -EINVAL;
13071 goto error;
13072 }
13073
13074 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13075 if (!ntrig) {
13076 err = -ENOMEM;
13077 goto error;
13078 }
13079 cfg80211_rdev_free_wowlan(rdev);
13080 rdev->wiphy.wowlan_config = ntrig;
13081
13082 set_wakeup:
13083 if (rdev->ops->set_wakeup &&
13084 prev_enabled != !!rdev->wiphy.wowlan_config)
13085 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13086
13087 return 0;
13088 error:
13089 for (i = 0; i < new_triggers.n_patterns; i++)
13090 kfree(new_triggers.patterns[i].mask);
13091 kfree(new_triggers.patterns);
13092 if (new_triggers.tcp && new_triggers.tcp->sock)
13093 sock_release(new_triggers.tcp->sock);
13094 kfree(new_triggers.tcp);
13095 kfree(new_triggers.nd_config);
13096 return err;
13097 }
13098 #endif
13099
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13100 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13101 struct cfg80211_registered_device *rdev)
13102 {
13103 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13104 int i, j, pat_len;
13105 struct cfg80211_coalesce_rules *rule;
13106
13107 if (!rdev->coalesce->n_rules)
13108 return 0;
13109
13110 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13111 if (!nl_rules)
13112 return -ENOBUFS;
13113
13114 for (i = 0; i < rdev->coalesce->n_rules; i++) {
13115 nl_rule = nla_nest_start_noflag(msg, i + 1);
13116 if (!nl_rule)
13117 return -ENOBUFS;
13118
13119 rule = &rdev->coalesce->rules[i];
13120 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13121 rule->delay))
13122 return -ENOBUFS;
13123
13124 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13125 rule->condition))
13126 return -ENOBUFS;
13127
13128 nl_pats = nla_nest_start_noflag(msg,
13129 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13130 if (!nl_pats)
13131 return -ENOBUFS;
13132
13133 for (j = 0; j < rule->n_patterns; j++) {
13134 nl_pat = nla_nest_start_noflag(msg, j + 1);
13135 if (!nl_pat)
13136 return -ENOBUFS;
13137 pat_len = rule->patterns[j].pattern_len;
13138 if (nla_put(msg, NL80211_PKTPAT_MASK,
13139 DIV_ROUND_UP(pat_len, 8),
13140 rule->patterns[j].mask) ||
13141 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13142 rule->patterns[j].pattern) ||
13143 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13144 rule->patterns[j].pkt_offset))
13145 return -ENOBUFS;
13146 nla_nest_end(msg, nl_pat);
13147 }
13148 nla_nest_end(msg, nl_pats);
13149 nla_nest_end(msg, nl_rule);
13150 }
13151 nla_nest_end(msg, nl_rules);
13152
13153 return 0;
13154 }
13155
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)13156 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13157 {
13158 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13159 struct sk_buff *msg;
13160 void *hdr;
13161
13162 if (!rdev->wiphy.coalesce)
13163 return -EOPNOTSUPP;
13164
13165 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13166 if (!msg)
13167 return -ENOMEM;
13168
13169 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13170 NL80211_CMD_GET_COALESCE);
13171 if (!hdr)
13172 goto nla_put_failure;
13173
13174 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13175 goto nla_put_failure;
13176
13177 genlmsg_end(msg, hdr);
13178 return genlmsg_reply(msg, info);
13179
13180 nla_put_failure:
13181 nlmsg_free(msg);
13182 return -ENOBUFS;
13183 }
13184
cfg80211_rdev_free_coalesce(struct cfg80211_registered_device * rdev)13185 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13186 {
13187 struct cfg80211_coalesce *coalesce = rdev->coalesce;
13188 int i, j;
13189 struct cfg80211_coalesce_rules *rule;
13190
13191 if (!coalesce)
13192 return;
13193
13194 for (i = 0; i < coalesce->n_rules; i++) {
13195 rule = &coalesce->rules[i];
13196 for (j = 0; j < rule->n_patterns; j++)
13197 kfree(rule->patterns[j].mask);
13198 kfree(rule->patterns);
13199 }
13200 kfree(coalesce->rules);
13201 kfree(coalesce);
13202 rdev->coalesce = NULL;
13203 }
13204
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)13205 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13206 struct nlattr *rule,
13207 struct cfg80211_coalesce_rules *new_rule)
13208 {
13209 int err, i;
13210 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13211 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13212 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13213 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13214
13215 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13216 rule, nl80211_coalesce_policy, NULL);
13217 if (err)
13218 return err;
13219
13220 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13221 new_rule->delay =
13222 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13223 if (new_rule->delay > coalesce->max_delay)
13224 return -EINVAL;
13225
13226 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13227 new_rule->condition =
13228 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13229
13230 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13231 return -EINVAL;
13232
13233 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13234 rem)
13235 n_patterns++;
13236 if (n_patterns > coalesce->n_patterns)
13237 return -EINVAL;
13238
13239 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13240 GFP_KERNEL);
13241 if (!new_rule->patterns)
13242 return -ENOMEM;
13243
13244 new_rule->n_patterns = n_patterns;
13245 i = 0;
13246
13247 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13248 rem) {
13249 u8 *mask_pat;
13250
13251 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13252 pat,
13253 nl80211_packet_pattern_policy,
13254 NULL);
13255 if (err)
13256 return err;
13257
13258 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13259 !pat_tb[NL80211_PKTPAT_PATTERN])
13260 return -EINVAL;
13261 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13262 mask_len = DIV_ROUND_UP(pat_len, 8);
13263 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13264 return -EINVAL;
13265 if (pat_len > coalesce->pattern_max_len ||
13266 pat_len < coalesce->pattern_min_len)
13267 return -EINVAL;
13268
13269 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13270 pkt_offset = 0;
13271 else
13272 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13273 if (pkt_offset > coalesce->max_pkt_offset)
13274 return -EINVAL;
13275 new_rule->patterns[i].pkt_offset = pkt_offset;
13276
13277 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13278 if (!mask_pat)
13279 return -ENOMEM;
13280
13281 new_rule->patterns[i].mask = mask_pat;
13282 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13283 mask_len);
13284
13285 mask_pat += mask_len;
13286 new_rule->patterns[i].pattern = mask_pat;
13287 new_rule->patterns[i].pattern_len = pat_len;
13288 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13289 pat_len);
13290 i++;
13291 }
13292
13293 return 0;
13294 }
13295
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)13296 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13297 {
13298 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13299 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13300 struct cfg80211_coalesce new_coalesce = {};
13301 struct cfg80211_coalesce *n_coalesce;
13302 int err, rem_rule, n_rules = 0, i, j;
13303 struct nlattr *rule;
13304 struct cfg80211_coalesce_rules *tmp_rule;
13305
13306 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13307 return -EOPNOTSUPP;
13308
13309 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13310 cfg80211_rdev_free_coalesce(rdev);
13311 rdev_set_coalesce(rdev, NULL);
13312 return 0;
13313 }
13314
13315 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13316 rem_rule)
13317 n_rules++;
13318 if (n_rules > coalesce->n_rules)
13319 return -EINVAL;
13320
13321 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13322 GFP_KERNEL);
13323 if (!new_coalesce.rules)
13324 return -ENOMEM;
13325
13326 new_coalesce.n_rules = n_rules;
13327 i = 0;
13328
13329 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13330 rem_rule) {
13331 err = nl80211_parse_coalesce_rule(rdev, rule,
13332 &new_coalesce.rules[i]);
13333 if (err)
13334 goto error;
13335
13336 i++;
13337 }
13338
13339 err = rdev_set_coalesce(rdev, &new_coalesce);
13340 if (err)
13341 goto error;
13342
13343 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13344 if (!n_coalesce) {
13345 err = -ENOMEM;
13346 goto error;
13347 }
13348 cfg80211_rdev_free_coalesce(rdev);
13349 rdev->coalesce = n_coalesce;
13350
13351 return 0;
13352 error:
13353 for (i = 0; i < new_coalesce.n_rules; i++) {
13354 tmp_rule = &new_coalesce.rules[i];
13355 for (j = 0; j < tmp_rule->n_patterns; j++)
13356 kfree(tmp_rule->patterns[j].mask);
13357 kfree(tmp_rule->patterns);
13358 }
13359 kfree(new_coalesce.rules);
13360
13361 return err;
13362 }
13363
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)13364 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
13365 {
13366 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13367 struct net_device *dev = info->user_ptr[1];
13368 struct wireless_dev *wdev = dev->ieee80211_ptr;
13369 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
13370 struct cfg80211_gtk_rekey_data rekey_data = {};
13371 int err;
13372
13373 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
13374 return -EINVAL;
13375
13376 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
13377 info->attrs[NL80211_ATTR_REKEY_DATA],
13378 nl80211_rekey_policy, info->extack);
13379 if (err)
13380 return err;
13381
13382 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
13383 !tb[NL80211_REKEY_DATA_KCK])
13384 return -EINVAL;
13385 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
13386 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13387 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
13388 return -ERANGE;
13389 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
13390 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13391 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
13392 return -ERANGE;
13393
13394 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
13395 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
13396 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
13397 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
13398 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
13399 if (tb[NL80211_REKEY_DATA_AKM])
13400 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
13401
13402 wdev_lock(wdev);
13403 if (!wdev->connected) {
13404 err = -ENOTCONN;
13405 goto out;
13406 }
13407
13408 if (!rdev->ops->set_rekey_data) {
13409 err = -EOPNOTSUPP;
13410 goto out;
13411 }
13412
13413 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
13414 out:
13415 wdev_unlock(wdev);
13416 return err;
13417 }
13418
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)13419 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
13420 struct genl_info *info)
13421 {
13422 struct net_device *dev = info->user_ptr[1];
13423 struct wireless_dev *wdev = dev->ieee80211_ptr;
13424
13425 if (wdev->iftype != NL80211_IFTYPE_AP &&
13426 wdev->iftype != NL80211_IFTYPE_P2P_GO)
13427 return -EINVAL;
13428
13429 if (wdev->ap_unexpected_nlportid)
13430 return -EBUSY;
13431
13432 wdev->ap_unexpected_nlportid = info->snd_portid;
13433 return 0;
13434 }
13435
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)13436 static int nl80211_probe_client(struct sk_buff *skb,
13437 struct genl_info *info)
13438 {
13439 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13440 struct net_device *dev = info->user_ptr[1];
13441 struct wireless_dev *wdev = dev->ieee80211_ptr;
13442 struct sk_buff *msg;
13443 void *hdr;
13444 const u8 *addr;
13445 u64 cookie;
13446 int err;
13447
13448 if (wdev->iftype != NL80211_IFTYPE_AP &&
13449 wdev->iftype != NL80211_IFTYPE_P2P_GO)
13450 return -EOPNOTSUPP;
13451
13452 if (!info->attrs[NL80211_ATTR_MAC])
13453 return -EINVAL;
13454
13455 if (!rdev->ops->probe_client)
13456 return -EOPNOTSUPP;
13457
13458 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13459 if (!msg)
13460 return -ENOMEM;
13461
13462 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13463 NL80211_CMD_PROBE_CLIENT);
13464 if (!hdr) {
13465 err = -ENOBUFS;
13466 goto free_msg;
13467 }
13468
13469 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13470
13471 err = rdev_probe_client(rdev, dev, addr, &cookie);
13472 if (err)
13473 goto free_msg;
13474
13475 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13476 NL80211_ATTR_PAD))
13477 goto nla_put_failure;
13478
13479 genlmsg_end(msg, hdr);
13480
13481 return genlmsg_reply(msg, info);
13482
13483 nla_put_failure:
13484 err = -ENOBUFS;
13485 free_msg:
13486 nlmsg_free(msg);
13487 return err;
13488 }
13489
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)13490 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
13491 {
13492 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13493 struct cfg80211_beacon_registration *reg, *nreg;
13494 int rv;
13495
13496 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
13497 return -EOPNOTSUPP;
13498
13499 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
13500 if (!nreg)
13501 return -ENOMEM;
13502
13503 /* First, check if already registered. */
13504 spin_lock_bh(&rdev->beacon_registrations_lock);
13505 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13506 if (reg->nlportid == info->snd_portid) {
13507 rv = -EALREADY;
13508 goto out_err;
13509 }
13510 }
13511 /* Add it to the list */
13512 nreg->nlportid = info->snd_portid;
13513 list_add(&nreg->list, &rdev->beacon_registrations);
13514
13515 spin_unlock_bh(&rdev->beacon_registrations_lock);
13516
13517 return 0;
13518 out_err:
13519 spin_unlock_bh(&rdev->beacon_registrations_lock);
13520 kfree(nreg);
13521 return rv;
13522 }
13523
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)13524 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
13525 {
13526 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13527 struct wireless_dev *wdev = info->user_ptr[1];
13528 int err;
13529
13530 if (!rdev->ops->start_p2p_device)
13531 return -EOPNOTSUPP;
13532
13533 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13534 return -EOPNOTSUPP;
13535
13536 if (wdev_running(wdev))
13537 return 0;
13538
13539 if (rfkill_blocked(rdev->wiphy.rfkill))
13540 return -ERFKILL;
13541
13542 err = rdev_start_p2p_device(rdev, wdev);
13543 if (err)
13544 return err;
13545
13546 wdev->is_running = true;
13547 rdev->opencount++;
13548
13549 return 0;
13550 }
13551
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)13552 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
13553 {
13554 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13555 struct wireless_dev *wdev = info->user_ptr[1];
13556
13557 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13558 return -EOPNOTSUPP;
13559
13560 if (!rdev->ops->stop_p2p_device)
13561 return -EOPNOTSUPP;
13562
13563 cfg80211_stop_p2p_device(rdev, wdev);
13564
13565 return 0;
13566 }
13567
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)13568 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
13569 {
13570 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13571 struct wireless_dev *wdev = info->user_ptr[1];
13572 struct cfg80211_nan_conf conf = {};
13573 int err;
13574
13575 if (wdev->iftype != NL80211_IFTYPE_NAN)
13576 return -EOPNOTSUPP;
13577
13578 if (wdev_running(wdev))
13579 return -EEXIST;
13580
13581 if (rfkill_blocked(rdev->wiphy.rfkill))
13582 return -ERFKILL;
13583
13584 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
13585 return -EINVAL;
13586
13587 conf.master_pref =
13588 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13589
13590 if (info->attrs[NL80211_ATTR_BANDS]) {
13591 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13592
13593 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13594 return -EOPNOTSUPP;
13595
13596 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13597 return -EINVAL;
13598
13599 conf.bands = bands;
13600 }
13601
13602 err = rdev_start_nan(rdev, wdev, &conf);
13603 if (err)
13604 return err;
13605
13606 wdev->is_running = true;
13607 rdev->opencount++;
13608
13609 return 0;
13610 }
13611
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)13612 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
13613 {
13614 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13615 struct wireless_dev *wdev = info->user_ptr[1];
13616
13617 if (wdev->iftype != NL80211_IFTYPE_NAN)
13618 return -EOPNOTSUPP;
13619
13620 cfg80211_stop_nan(rdev, wdev);
13621
13622 return 0;
13623 }
13624
validate_nan_filter(struct nlattr * filter_attr)13625 static int validate_nan_filter(struct nlattr *filter_attr)
13626 {
13627 struct nlattr *attr;
13628 int len = 0, n_entries = 0, rem;
13629
13630 nla_for_each_nested(attr, filter_attr, rem) {
13631 len += nla_len(attr);
13632 n_entries++;
13633 }
13634
13635 if (len >= U8_MAX)
13636 return -EINVAL;
13637
13638 return n_entries;
13639 }
13640
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)13641 static int handle_nan_filter(struct nlattr *attr_filter,
13642 struct cfg80211_nan_func *func,
13643 bool tx)
13644 {
13645 struct nlattr *attr;
13646 int n_entries, rem, i;
13647 struct cfg80211_nan_func_filter *filter;
13648
13649 n_entries = validate_nan_filter(attr_filter);
13650 if (n_entries < 0)
13651 return n_entries;
13652
13653 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
13654
13655 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
13656 if (!filter)
13657 return -ENOMEM;
13658
13659 i = 0;
13660 nla_for_each_nested(attr, attr_filter, rem) {
13661 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
13662 if (!filter[i].filter)
13663 goto err;
13664
13665 filter[i].len = nla_len(attr);
13666 i++;
13667 }
13668 if (tx) {
13669 func->num_tx_filters = n_entries;
13670 func->tx_filters = filter;
13671 } else {
13672 func->num_rx_filters = n_entries;
13673 func->rx_filters = filter;
13674 }
13675
13676 return 0;
13677
13678 err:
13679 i = 0;
13680 nla_for_each_nested(attr, attr_filter, rem) {
13681 kfree(filter[i].filter);
13682 i++;
13683 }
13684 kfree(filter);
13685 return -ENOMEM;
13686 }
13687
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)13688 static int nl80211_nan_add_func(struct sk_buff *skb,
13689 struct genl_info *info)
13690 {
13691 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13692 struct wireless_dev *wdev = info->user_ptr[1];
13693 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
13694 struct cfg80211_nan_func *func;
13695 struct sk_buff *msg = NULL;
13696 void *hdr = NULL;
13697 int err = 0;
13698
13699 if (wdev->iftype != NL80211_IFTYPE_NAN)
13700 return -EOPNOTSUPP;
13701
13702 if (!wdev_running(wdev))
13703 return -ENOTCONN;
13704
13705 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
13706 return -EINVAL;
13707
13708 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
13709 info->attrs[NL80211_ATTR_NAN_FUNC],
13710 nl80211_nan_func_policy,
13711 info->extack);
13712 if (err)
13713 return err;
13714
13715 func = kzalloc(sizeof(*func), GFP_KERNEL);
13716 if (!func)
13717 return -ENOMEM;
13718
13719 func->cookie = cfg80211_assign_cookie(rdev);
13720
13721 if (!tb[NL80211_NAN_FUNC_TYPE]) {
13722 err = -EINVAL;
13723 goto out;
13724 }
13725
13726
13727 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
13728
13729 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
13730 err = -EINVAL;
13731 goto out;
13732 }
13733
13734 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
13735 sizeof(func->service_id));
13736
13737 func->close_range =
13738 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
13739
13740 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
13741 func->serv_spec_info_len =
13742 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
13743 func->serv_spec_info =
13744 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13745 func->serv_spec_info_len,
13746 GFP_KERNEL);
13747 if (!func->serv_spec_info) {
13748 err = -ENOMEM;
13749 goto out;
13750 }
13751 }
13752
13753 if (tb[NL80211_NAN_FUNC_TTL])
13754 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13755
13756 switch (func->type) {
13757 case NL80211_NAN_FUNC_PUBLISH:
13758 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13759 err = -EINVAL;
13760 goto out;
13761 }
13762
13763 func->publish_type =
13764 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13765 func->publish_bcast =
13766 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13767
13768 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13769 func->publish_bcast) {
13770 err = -EINVAL;
13771 goto out;
13772 }
13773 break;
13774 case NL80211_NAN_FUNC_SUBSCRIBE:
13775 func->subscribe_active =
13776 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13777 break;
13778 case NL80211_NAN_FUNC_FOLLOW_UP:
13779 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13780 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13781 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13782 err = -EINVAL;
13783 goto out;
13784 }
13785
13786 func->followup_id =
13787 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13788 func->followup_reqid =
13789 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13790 memcpy(func->followup_dest.addr,
13791 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13792 sizeof(func->followup_dest.addr));
13793 if (func->ttl) {
13794 err = -EINVAL;
13795 goto out;
13796 }
13797 break;
13798 default:
13799 err = -EINVAL;
13800 goto out;
13801 }
13802
13803 if (tb[NL80211_NAN_FUNC_SRF]) {
13804 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13805
13806 err = nla_parse_nested_deprecated(srf_tb,
13807 NL80211_NAN_SRF_ATTR_MAX,
13808 tb[NL80211_NAN_FUNC_SRF],
13809 nl80211_nan_srf_policy,
13810 info->extack);
13811 if (err)
13812 goto out;
13813
13814 func->srf_include =
13815 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13816
13817 if (srf_tb[NL80211_NAN_SRF_BF]) {
13818 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13819 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13820 err = -EINVAL;
13821 goto out;
13822 }
13823
13824 func->srf_bf_len =
13825 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13826 func->srf_bf =
13827 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13828 func->srf_bf_len, GFP_KERNEL);
13829 if (!func->srf_bf) {
13830 err = -ENOMEM;
13831 goto out;
13832 }
13833
13834 func->srf_bf_idx =
13835 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13836 } else {
13837 struct nlattr *attr, *mac_attr =
13838 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13839 int n_entries, rem, i = 0;
13840
13841 if (!mac_attr) {
13842 err = -EINVAL;
13843 goto out;
13844 }
13845
13846 n_entries = validate_acl_mac_addrs(mac_attr);
13847 if (n_entries <= 0) {
13848 err = -EINVAL;
13849 goto out;
13850 }
13851
13852 func->srf_num_macs = n_entries;
13853 func->srf_macs =
13854 kcalloc(n_entries, sizeof(*func->srf_macs),
13855 GFP_KERNEL);
13856 if (!func->srf_macs) {
13857 err = -ENOMEM;
13858 goto out;
13859 }
13860
13861 nla_for_each_nested(attr, mac_attr, rem)
13862 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13863 sizeof(*func->srf_macs));
13864 }
13865 }
13866
13867 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13868 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13869 func, true);
13870 if (err)
13871 goto out;
13872 }
13873
13874 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13875 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13876 func, false);
13877 if (err)
13878 goto out;
13879 }
13880
13881 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13882 if (!msg) {
13883 err = -ENOMEM;
13884 goto out;
13885 }
13886
13887 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13888 NL80211_CMD_ADD_NAN_FUNCTION);
13889 /* This can't really happen - we just allocated 4KB */
13890 if (WARN_ON(!hdr)) {
13891 err = -ENOMEM;
13892 goto out;
13893 }
13894
13895 err = rdev_add_nan_func(rdev, wdev, func);
13896 out:
13897 if (err < 0) {
13898 cfg80211_free_nan_func(func);
13899 nlmsg_free(msg);
13900 return err;
13901 }
13902
13903 /* propagate the instance id and cookie to userspace */
13904 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13905 NL80211_ATTR_PAD))
13906 goto nla_put_failure;
13907
13908 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13909 if (!func_attr)
13910 goto nla_put_failure;
13911
13912 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13913 func->instance_id))
13914 goto nla_put_failure;
13915
13916 nla_nest_end(msg, func_attr);
13917
13918 genlmsg_end(msg, hdr);
13919 return genlmsg_reply(msg, info);
13920
13921 nla_put_failure:
13922 nlmsg_free(msg);
13923 return -ENOBUFS;
13924 }
13925
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)13926 static int nl80211_nan_del_func(struct sk_buff *skb,
13927 struct genl_info *info)
13928 {
13929 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13930 struct wireless_dev *wdev = info->user_ptr[1];
13931 u64 cookie;
13932
13933 if (wdev->iftype != NL80211_IFTYPE_NAN)
13934 return -EOPNOTSUPP;
13935
13936 if (!wdev_running(wdev))
13937 return -ENOTCONN;
13938
13939 if (!info->attrs[NL80211_ATTR_COOKIE])
13940 return -EINVAL;
13941
13942 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13943
13944 rdev_del_nan_func(rdev, wdev, cookie);
13945
13946 return 0;
13947 }
13948
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)13949 static int nl80211_nan_change_config(struct sk_buff *skb,
13950 struct genl_info *info)
13951 {
13952 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13953 struct wireless_dev *wdev = info->user_ptr[1];
13954 struct cfg80211_nan_conf conf = {};
13955 u32 changed = 0;
13956
13957 if (wdev->iftype != NL80211_IFTYPE_NAN)
13958 return -EOPNOTSUPP;
13959
13960 if (!wdev_running(wdev))
13961 return -ENOTCONN;
13962
13963 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13964 conf.master_pref =
13965 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13966 if (conf.master_pref <= 1 || conf.master_pref == 255)
13967 return -EINVAL;
13968
13969 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13970 }
13971
13972 if (info->attrs[NL80211_ATTR_BANDS]) {
13973 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13974
13975 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13976 return -EOPNOTSUPP;
13977
13978 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13979 return -EINVAL;
13980
13981 conf.bands = bands;
13982 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13983 }
13984
13985 if (!changed)
13986 return -EINVAL;
13987
13988 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13989 }
13990
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)13991 void cfg80211_nan_match(struct wireless_dev *wdev,
13992 struct cfg80211_nan_match_params *match, gfp_t gfp)
13993 {
13994 struct wiphy *wiphy = wdev->wiphy;
13995 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13996 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13997 struct sk_buff *msg;
13998 void *hdr;
13999
14000 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14001 return;
14002
14003 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14004 if (!msg)
14005 return;
14006
14007 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14008 if (!hdr) {
14009 nlmsg_free(msg);
14010 return;
14011 }
14012
14013 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14014 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14015 wdev->netdev->ifindex)) ||
14016 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14017 NL80211_ATTR_PAD))
14018 goto nla_put_failure;
14019
14020 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14021 NL80211_ATTR_PAD) ||
14022 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14023 goto nla_put_failure;
14024
14025 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14026 if (!match_attr)
14027 goto nla_put_failure;
14028
14029 local_func_attr = nla_nest_start_noflag(msg,
14030 NL80211_NAN_MATCH_FUNC_LOCAL);
14031 if (!local_func_attr)
14032 goto nla_put_failure;
14033
14034 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14035 goto nla_put_failure;
14036
14037 nla_nest_end(msg, local_func_attr);
14038
14039 peer_func_attr = nla_nest_start_noflag(msg,
14040 NL80211_NAN_MATCH_FUNC_PEER);
14041 if (!peer_func_attr)
14042 goto nla_put_failure;
14043
14044 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14045 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14046 goto nla_put_failure;
14047
14048 if (match->info && match->info_len &&
14049 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14050 match->info))
14051 goto nla_put_failure;
14052
14053 nla_nest_end(msg, peer_func_attr);
14054 nla_nest_end(msg, match_attr);
14055 genlmsg_end(msg, hdr);
14056
14057 if (!wdev->owner_nlportid)
14058 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14059 msg, 0, NL80211_MCGRP_NAN, gfp);
14060 else
14061 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14062 wdev->owner_nlportid);
14063
14064 return;
14065
14066 nla_put_failure:
14067 nlmsg_free(msg);
14068 }
14069 EXPORT_SYMBOL(cfg80211_nan_match);
14070
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)14071 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14072 u8 inst_id,
14073 enum nl80211_nan_func_term_reason reason,
14074 u64 cookie, gfp_t gfp)
14075 {
14076 struct wiphy *wiphy = wdev->wiphy;
14077 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14078 struct sk_buff *msg;
14079 struct nlattr *func_attr;
14080 void *hdr;
14081
14082 if (WARN_ON(!inst_id))
14083 return;
14084
14085 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14086 if (!msg)
14087 return;
14088
14089 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14090 if (!hdr) {
14091 nlmsg_free(msg);
14092 return;
14093 }
14094
14095 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14096 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14097 wdev->netdev->ifindex)) ||
14098 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14099 NL80211_ATTR_PAD))
14100 goto nla_put_failure;
14101
14102 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14103 NL80211_ATTR_PAD))
14104 goto nla_put_failure;
14105
14106 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14107 if (!func_attr)
14108 goto nla_put_failure;
14109
14110 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14111 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14112 goto nla_put_failure;
14113
14114 nla_nest_end(msg, func_attr);
14115 genlmsg_end(msg, hdr);
14116
14117 if (!wdev->owner_nlportid)
14118 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14119 msg, 0, NL80211_MCGRP_NAN, gfp);
14120 else
14121 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14122 wdev->owner_nlportid);
14123
14124 return;
14125
14126 nla_put_failure:
14127 nlmsg_free(msg);
14128 }
14129 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14130
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)14131 static int nl80211_get_protocol_features(struct sk_buff *skb,
14132 struct genl_info *info)
14133 {
14134 void *hdr;
14135 struct sk_buff *msg;
14136
14137 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14138 if (!msg)
14139 return -ENOMEM;
14140
14141 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14142 NL80211_CMD_GET_PROTOCOL_FEATURES);
14143 if (!hdr)
14144 goto nla_put_failure;
14145
14146 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14147 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14148 goto nla_put_failure;
14149
14150 genlmsg_end(msg, hdr);
14151 return genlmsg_reply(msg, info);
14152
14153 nla_put_failure:
14154 kfree_skb(msg);
14155 return -ENOBUFS;
14156 }
14157
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)14158 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14159 {
14160 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14161 struct cfg80211_update_ft_ies_params ft_params;
14162 struct net_device *dev = info->user_ptr[1];
14163
14164 if (!rdev->ops->update_ft_ies)
14165 return -EOPNOTSUPP;
14166
14167 if (!info->attrs[NL80211_ATTR_MDID] ||
14168 !info->attrs[NL80211_ATTR_IE])
14169 return -EINVAL;
14170
14171 memset(&ft_params, 0, sizeof(ft_params));
14172 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14173 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14174 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14175
14176 return rdev_update_ft_ies(rdev, dev, &ft_params);
14177 }
14178
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)14179 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14180 struct genl_info *info)
14181 {
14182 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14183 struct wireless_dev *wdev = info->user_ptr[1];
14184 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14185 u16 duration;
14186 int ret;
14187
14188 if (!rdev->ops->crit_proto_start)
14189 return -EOPNOTSUPP;
14190
14191 if (WARN_ON(!rdev->ops->crit_proto_stop))
14192 return -EINVAL;
14193
14194 if (rdev->crit_proto_nlportid)
14195 return -EBUSY;
14196
14197 /* determine protocol if provided */
14198 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14199 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14200
14201 if (proto >= NUM_NL80211_CRIT_PROTO)
14202 return -EINVAL;
14203
14204 /* timeout must be provided */
14205 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14206 return -EINVAL;
14207
14208 duration =
14209 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14210
14211 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14212 if (!ret)
14213 rdev->crit_proto_nlportid = info->snd_portid;
14214
14215 return ret;
14216 }
14217
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)14218 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14219 struct genl_info *info)
14220 {
14221 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14222 struct wireless_dev *wdev = info->user_ptr[1];
14223
14224 if (!rdev->ops->crit_proto_stop)
14225 return -EOPNOTSUPP;
14226
14227 if (rdev->crit_proto_nlportid) {
14228 rdev->crit_proto_nlportid = 0;
14229 rdev_crit_proto_stop(rdev, wdev);
14230 }
14231 return 0;
14232 }
14233
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)14234 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14235 struct nlattr *attr,
14236 struct netlink_ext_ack *extack)
14237 {
14238 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14239 if (attr->nla_type & NLA_F_NESTED) {
14240 NL_SET_ERR_MSG_ATTR(extack, attr,
14241 "unexpected nested data");
14242 return -EINVAL;
14243 }
14244
14245 return 0;
14246 }
14247
14248 if (!(attr->nla_type & NLA_F_NESTED)) {
14249 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14250 return -EINVAL;
14251 }
14252
14253 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14254 }
14255
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)14256 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14257 {
14258 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14259 struct wireless_dev *wdev =
14260 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14261 info->attrs);
14262 int i, err;
14263 u32 vid, subcmd;
14264
14265 if (!rdev->wiphy.vendor_commands)
14266 return -EOPNOTSUPP;
14267
14268 if (IS_ERR(wdev)) {
14269 err = PTR_ERR(wdev);
14270 if (err != -EINVAL)
14271 return err;
14272 wdev = NULL;
14273 } else if (wdev->wiphy != &rdev->wiphy) {
14274 return -EINVAL;
14275 }
14276
14277 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14278 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14279 return -EINVAL;
14280
14281 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14282 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14283 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14284 const struct wiphy_vendor_command *vcmd;
14285 void *data = NULL;
14286 int len = 0;
14287
14288 vcmd = &rdev->wiphy.vendor_commands[i];
14289
14290 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14291 continue;
14292
14293 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14294 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14295 if (!wdev)
14296 return -EINVAL;
14297 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14298 !wdev->netdev)
14299 return -EINVAL;
14300
14301 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14302 if (!wdev_running(wdev))
14303 return -ENETDOWN;
14304 }
14305 } else {
14306 wdev = NULL;
14307 }
14308
14309 if (!vcmd->doit)
14310 return -EOPNOTSUPP;
14311
14312 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14313 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14314 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14315
14316 err = nl80211_vendor_check_policy(vcmd,
14317 info->attrs[NL80211_ATTR_VENDOR_DATA],
14318 info->extack);
14319 if (err)
14320 return err;
14321 }
14322
14323 rdev->cur_cmd_info = info;
14324 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14325 rdev->cur_cmd_info = NULL;
14326 return err;
14327 }
14328
14329 return -EOPNOTSUPP;
14330 }
14331
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)14332 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14333 struct netlink_callback *cb,
14334 struct cfg80211_registered_device **rdev,
14335 struct wireless_dev **wdev)
14336 {
14337 struct nlattr **attrbuf;
14338 u32 vid, subcmd;
14339 unsigned int i;
14340 int vcmd_idx = -1;
14341 int err;
14342 void *data = NULL;
14343 unsigned int data_len = 0;
14344
14345 if (cb->args[0]) {
14346 /* subtract the 1 again here */
14347 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14348 struct wireless_dev *tmp;
14349
14350 if (!wiphy)
14351 return -ENODEV;
14352 *rdev = wiphy_to_rdev(wiphy);
14353 *wdev = NULL;
14354
14355 if (cb->args[1]) {
14356 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
14357 if (tmp->identifier == cb->args[1] - 1) {
14358 *wdev = tmp;
14359 break;
14360 }
14361 }
14362 }
14363
14364 /* keep rtnl locked in successful case */
14365 return 0;
14366 }
14367
14368 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
14369 if (!attrbuf)
14370 return -ENOMEM;
14371
14372 err = nlmsg_parse_deprecated(cb->nlh,
14373 GENL_HDRLEN + nl80211_fam.hdrsize,
14374 attrbuf, nl80211_fam.maxattr,
14375 nl80211_policy, NULL);
14376 if (err)
14377 goto out;
14378
14379 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
14380 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
14381 err = -EINVAL;
14382 goto out;
14383 }
14384
14385 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
14386 if (IS_ERR(*wdev))
14387 *wdev = NULL;
14388
14389 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
14390 if (IS_ERR(*rdev)) {
14391 err = PTR_ERR(*rdev);
14392 goto out;
14393 }
14394
14395 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
14396 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
14397
14398 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
14399 const struct wiphy_vendor_command *vcmd;
14400
14401 vcmd = &(*rdev)->wiphy.vendor_commands[i];
14402
14403 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14404 continue;
14405
14406 if (!vcmd->dumpit) {
14407 err = -EOPNOTSUPP;
14408 goto out;
14409 }
14410
14411 vcmd_idx = i;
14412 break;
14413 }
14414
14415 if (vcmd_idx < 0) {
14416 err = -EOPNOTSUPP;
14417 goto out;
14418 }
14419
14420 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
14421 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14422 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14423
14424 err = nl80211_vendor_check_policy(
14425 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
14426 attrbuf[NL80211_ATTR_VENDOR_DATA],
14427 cb->extack);
14428 if (err)
14429 goto out;
14430 }
14431
14432 /* 0 is the first index - add 1 to parse only once */
14433 cb->args[0] = (*rdev)->wiphy_idx + 1;
14434 /* add 1 to know if it was NULL */
14435 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
14436 cb->args[2] = vcmd_idx;
14437 cb->args[3] = (unsigned long)data;
14438 cb->args[4] = data_len;
14439
14440 /* keep rtnl locked in successful case */
14441 err = 0;
14442 out:
14443 kfree(attrbuf);
14444 return err;
14445 }
14446
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)14447 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
14448 struct netlink_callback *cb)
14449 {
14450 struct cfg80211_registered_device *rdev;
14451 struct wireless_dev *wdev;
14452 unsigned int vcmd_idx;
14453 const struct wiphy_vendor_command *vcmd;
14454 void *data;
14455 int data_len;
14456 int err;
14457 struct nlattr *vendor_data;
14458
14459 rtnl_lock();
14460 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
14461 if (err)
14462 goto out;
14463
14464 vcmd_idx = cb->args[2];
14465 data = (void *)cb->args[3];
14466 data_len = cb->args[4];
14467 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
14468
14469 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14470 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14471 if (!wdev) {
14472 err = -EINVAL;
14473 goto out;
14474 }
14475 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14476 !wdev->netdev) {
14477 err = -EINVAL;
14478 goto out;
14479 }
14480
14481 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14482 if (!wdev_running(wdev)) {
14483 err = -ENETDOWN;
14484 goto out;
14485 }
14486 }
14487 }
14488
14489 while (1) {
14490 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
14491 cb->nlh->nlmsg_seq, NLM_F_MULTI,
14492 NL80211_CMD_VENDOR);
14493 if (!hdr)
14494 break;
14495
14496 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14497 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
14498 wdev_id(wdev),
14499 NL80211_ATTR_PAD))) {
14500 genlmsg_cancel(skb, hdr);
14501 break;
14502 }
14503
14504 vendor_data = nla_nest_start_noflag(skb,
14505 NL80211_ATTR_VENDOR_DATA);
14506 if (!vendor_data) {
14507 genlmsg_cancel(skb, hdr);
14508 break;
14509 }
14510
14511 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
14512 (unsigned long *)&cb->args[5]);
14513 nla_nest_end(skb, vendor_data);
14514
14515 if (err == -ENOBUFS || err == -ENOENT) {
14516 genlmsg_cancel(skb, hdr);
14517 break;
14518 } else if (err <= 0) {
14519 genlmsg_cancel(skb, hdr);
14520 goto out;
14521 }
14522
14523 genlmsg_end(skb, hdr);
14524 }
14525
14526 err = skb->len;
14527 out:
14528 rtnl_unlock();
14529 return err;
14530 }
14531
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)14532 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
14533 enum nl80211_commands cmd,
14534 enum nl80211_attrs attr,
14535 int approxlen)
14536 {
14537 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14538
14539 if (WARN_ON(!rdev->cur_cmd_info))
14540 return NULL;
14541
14542 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
14543 rdev->cur_cmd_info->snd_portid,
14544 rdev->cur_cmd_info->snd_seq,
14545 cmd, attr, NULL, GFP_KERNEL);
14546 }
14547 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
14548
cfg80211_vendor_cmd_reply(struct sk_buff * skb)14549 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
14550 {
14551 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
14552 void *hdr = ((void **)skb->cb)[1];
14553 struct nlattr *data = ((void **)skb->cb)[2];
14554
14555 /* clear CB data for netlink core to own from now on */
14556 memset(skb->cb, 0, sizeof(skb->cb));
14557
14558 if (WARN_ON(!rdev->cur_cmd_info)) {
14559 kfree_skb(skb);
14560 return -EINVAL;
14561 }
14562
14563 nla_nest_end(skb, data);
14564 genlmsg_end(skb, hdr);
14565 return genlmsg_reply(skb, rdev->cur_cmd_info);
14566 }
14567 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
14568
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)14569 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
14570 {
14571 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14572
14573 if (WARN_ON(!rdev->cur_cmd_info))
14574 return 0;
14575
14576 return rdev->cur_cmd_info->snd_portid;
14577 }
14578 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
14579
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)14580 static int nl80211_set_qos_map(struct sk_buff *skb,
14581 struct genl_info *info)
14582 {
14583 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14584 struct cfg80211_qos_map *qos_map = NULL;
14585 struct net_device *dev = info->user_ptr[1];
14586 u8 *pos, len, num_des, des_len, des;
14587 int ret;
14588
14589 if (!rdev->ops->set_qos_map)
14590 return -EOPNOTSUPP;
14591
14592 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
14593 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
14594 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
14595
14596 if (len % 2)
14597 return -EINVAL;
14598
14599 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
14600 if (!qos_map)
14601 return -ENOMEM;
14602
14603 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
14604 if (num_des) {
14605 des_len = num_des *
14606 sizeof(struct cfg80211_dscp_exception);
14607 memcpy(qos_map->dscp_exception, pos, des_len);
14608 qos_map->num_des = num_des;
14609 for (des = 0; des < num_des; des++) {
14610 if (qos_map->dscp_exception[des].up > 7) {
14611 kfree(qos_map);
14612 return -EINVAL;
14613 }
14614 }
14615 pos += des_len;
14616 }
14617 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
14618 }
14619
14620 wdev_lock(dev->ieee80211_ptr);
14621 ret = nl80211_key_allowed(dev->ieee80211_ptr);
14622 if (!ret)
14623 ret = rdev_set_qos_map(rdev, dev, qos_map);
14624 wdev_unlock(dev->ieee80211_ptr);
14625
14626 kfree(qos_map);
14627 return ret;
14628 }
14629
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)14630 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
14631 {
14632 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14633 struct net_device *dev = info->user_ptr[1];
14634 struct wireless_dev *wdev = dev->ieee80211_ptr;
14635 const u8 *peer;
14636 u8 tsid, up;
14637 u16 admitted_time = 0;
14638 int err;
14639
14640 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
14641 return -EOPNOTSUPP;
14642
14643 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
14644 !info->attrs[NL80211_ATTR_USER_PRIO])
14645 return -EINVAL;
14646
14647 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14648 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
14649
14650 /* WMM uses TIDs 0-7 even for TSPEC */
14651 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
14652 /* TODO: handle 802.11 TSPEC/admission control
14653 * need more attributes for that (e.g. BA session requirement);
14654 * change the WMM adminssion test above to allow both then
14655 */
14656 return -EINVAL;
14657 }
14658
14659 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14660
14661 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
14662 admitted_time =
14663 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
14664 if (!admitted_time)
14665 return -EINVAL;
14666 }
14667
14668 wdev_lock(wdev);
14669 switch (wdev->iftype) {
14670 case NL80211_IFTYPE_STATION:
14671 case NL80211_IFTYPE_P2P_CLIENT:
14672 if (wdev->connected)
14673 break;
14674 err = -ENOTCONN;
14675 goto out;
14676 default:
14677 err = -EOPNOTSUPP;
14678 goto out;
14679 }
14680
14681 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
14682
14683 out:
14684 wdev_unlock(wdev);
14685 return err;
14686 }
14687
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)14688 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
14689 {
14690 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14691 struct net_device *dev = info->user_ptr[1];
14692 struct wireless_dev *wdev = dev->ieee80211_ptr;
14693 const u8 *peer;
14694 u8 tsid;
14695 int err;
14696
14697 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
14698 return -EINVAL;
14699
14700 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14701 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14702
14703 wdev_lock(wdev);
14704 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
14705 wdev_unlock(wdev);
14706
14707 return err;
14708 }
14709
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)14710 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
14711 struct genl_info *info)
14712 {
14713 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14714 struct net_device *dev = info->user_ptr[1];
14715 struct wireless_dev *wdev = dev->ieee80211_ptr;
14716 struct cfg80211_chan_def chandef = {};
14717 const u8 *addr;
14718 u8 oper_class;
14719 int err;
14720
14721 if (!rdev->ops->tdls_channel_switch ||
14722 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14723 return -EOPNOTSUPP;
14724
14725 switch (dev->ieee80211_ptr->iftype) {
14726 case NL80211_IFTYPE_STATION:
14727 case NL80211_IFTYPE_P2P_CLIENT:
14728 break;
14729 default:
14730 return -EOPNOTSUPP;
14731 }
14732
14733 if (!info->attrs[NL80211_ATTR_MAC] ||
14734 !info->attrs[NL80211_ATTR_OPER_CLASS])
14735 return -EINVAL;
14736
14737 err = nl80211_parse_chandef(rdev, info, &chandef);
14738 if (err)
14739 return err;
14740
14741 /*
14742 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
14743 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
14744 * specification is not defined for them.
14745 */
14746 if (chandef.chan->band == NL80211_BAND_2GHZ &&
14747 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14748 chandef.width != NL80211_CHAN_WIDTH_20)
14749 return -EINVAL;
14750
14751 /* we will be active on the TDLS link */
14752 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14753 wdev->iftype))
14754 return -EINVAL;
14755
14756 /* don't allow switching to DFS channels */
14757 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14758 return -EINVAL;
14759
14760 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14761 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14762
14763 wdev_lock(wdev);
14764 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14765 wdev_unlock(wdev);
14766
14767 return err;
14768 }
14769
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)14770 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14771 struct genl_info *info)
14772 {
14773 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14774 struct net_device *dev = info->user_ptr[1];
14775 struct wireless_dev *wdev = dev->ieee80211_ptr;
14776 const u8 *addr;
14777
14778 if (!rdev->ops->tdls_channel_switch ||
14779 !rdev->ops->tdls_cancel_channel_switch ||
14780 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14781 return -EOPNOTSUPP;
14782
14783 switch (dev->ieee80211_ptr->iftype) {
14784 case NL80211_IFTYPE_STATION:
14785 case NL80211_IFTYPE_P2P_CLIENT:
14786 break;
14787 default:
14788 return -EOPNOTSUPP;
14789 }
14790
14791 if (!info->attrs[NL80211_ATTR_MAC])
14792 return -EINVAL;
14793
14794 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14795
14796 wdev_lock(wdev);
14797 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14798 wdev_unlock(wdev);
14799
14800 return 0;
14801 }
14802
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)14803 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14804 struct genl_info *info)
14805 {
14806 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14807 struct net_device *dev = info->user_ptr[1];
14808 struct wireless_dev *wdev = dev->ieee80211_ptr;
14809 const struct nlattr *nla;
14810 bool enabled;
14811
14812 if (!rdev->ops->set_multicast_to_unicast)
14813 return -EOPNOTSUPP;
14814
14815 if (wdev->iftype != NL80211_IFTYPE_AP &&
14816 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14817 return -EOPNOTSUPP;
14818
14819 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14820 enabled = nla_get_flag(nla);
14821
14822 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14823 }
14824
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)14825 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14826 {
14827 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14828 struct net_device *dev = info->user_ptr[1];
14829 struct wireless_dev *wdev = dev->ieee80211_ptr;
14830 struct cfg80211_pmk_conf pmk_conf = {};
14831 int ret;
14832
14833 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14834 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14835 return -EOPNOTSUPP;
14836
14837 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14838 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14839 return -EOPNOTSUPP;
14840
14841 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14842 return -EINVAL;
14843
14844 wdev_lock(wdev);
14845 if (!wdev->connected) {
14846 ret = -ENOTCONN;
14847 goto out;
14848 }
14849
14850 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14851 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
14852 ret = -EINVAL;
14853 goto out;
14854 }
14855
14856 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14857 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14858 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14859 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14860 ret = -EINVAL;
14861 goto out;
14862 }
14863
14864 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14865 pmk_conf.pmk_r0_name =
14866 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14867
14868 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14869 out:
14870 wdev_unlock(wdev);
14871 return ret;
14872 }
14873
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)14874 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14875 {
14876 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14877 struct net_device *dev = info->user_ptr[1];
14878 struct wireless_dev *wdev = dev->ieee80211_ptr;
14879 const u8 *aa;
14880 int ret;
14881
14882 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14883 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14884 return -EOPNOTSUPP;
14885
14886 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14887 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14888 return -EOPNOTSUPP;
14889
14890 if (!info->attrs[NL80211_ATTR_MAC])
14891 return -EINVAL;
14892
14893 wdev_lock(wdev);
14894 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14895 ret = rdev_del_pmk(rdev, dev, aa);
14896 wdev_unlock(wdev);
14897
14898 return ret;
14899 }
14900
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)14901 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14902 {
14903 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14904 struct net_device *dev = info->user_ptr[1];
14905 struct cfg80211_external_auth_params params;
14906
14907 if (!rdev->ops->external_auth)
14908 return -EOPNOTSUPP;
14909
14910 if (!info->attrs[NL80211_ATTR_SSID] &&
14911 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14912 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14913 return -EINVAL;
14914
14915 if (!info->attrs[NL80211_ATTR_BSSID])
14916 return -EINVAL;
14917
14918 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14919 return -EINVAL;
14920
14921 memset(¶ms, 0, sizeof(params));
14922
14923 if (info->attrs[NL80211_ATTR_SSID]) {
14924 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14925 if (params.ssid.ssid_len == 0)
14926 return -EINVAL;
14927 memcpy(params.ssid.ssid,
14928 nla_data(info->attrs[NL80211_ATTR_SSID]),
14929 params.ssid.ssid_len);
14930 }
14931
14932 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14933 ETH_ALEN);
14934
14935 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14936
14937 if (info->attrs[NL80211_ATTR_PMKID])
14938 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14939
14940 return rdev_external_auth(rdev, dev, ¶ms);
14941 }
14942
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)14943 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14944 {
14945 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14946 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14947 struct net_device *dev = info->user_ptr[1];
14948 struct wireless_dev *wdev = dev->ieee80211_ptr;
14949 const u8 *buf;
14950 size_t len;
14951 u8 *dest;
14952 u16 proto;
14953 bool noencrypt;
14954 u64 cookie = 0;
14955 int err;
14956
14957 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14958 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14959 return -EOPNOTSUPP;
14960
14961 if (!rdev->ops->tx_control_port)
14962 return -EOPNOTSUPP;
14963
14964 if (!info->attrs[NL80211_ATTR_FRAME] ||
14965 !info->attrs[NL80211_ATTR_MAC] ||
14966 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14967 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14968 return -EINVAL;
14969 }
14970
14971 wdev_lock(wdev);
14972
14973 switch (wdev->iftype) {
14974 case NL80211_IFTYPE_AP:
14975 case NL80211_IFTYPE_P2P_GO:
14976 case NL80211_IFTYPE_MESH_POINT:
14977 break;
14978 case NL80211_IFTYPE_ADHOC:
14979 if (wdev->u.ibss.current_bss)
14980 break;
14981 err = -ENOTCONN;
14982 goto out;
14983 case NL80211_IFTYPE_STATION:
14984 case NL80211_IFTYPE_P2P_CLIENT:
14985 if (wdev->connected)
14986 break;
14987 err = -ENOTCONN;
14988 goto out;
14989 default:
14990 err = -EOPNOTSUPP;
14991 goto out;
14992 }
14993
14994 wdev_unlock(wdev);
14995
14996 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14997 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14998 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14999 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15000 noencrypt =
15001 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15002
15003 err = rdev_tx_control_port(rdev, dev, buf, len,
15004 dest, cpu_to_be16(proto), noencrypt,
15005 dont_wait_for_ack ? NULL : &cookie);
15006 if (!err && !dont_wait_for_ack)
15007 nl_set_extack_cookie_u64(info->extack, cookie);
15008 return err;
15009 out:
15010 wdev_unlock(wdev);
15011 return err;
15012 }
15013
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)15014 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15015 struct genl_info *info)
15016 {
15017 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15018 struct net_device *dev = info->user_ptr[1];
15019 struct wireless_dev *wdev = dev->ieee80211_ptr;
15020 struct cfg80211_ftm_responder_stats ftm_stats = {};
15021 unsigned int link_id = nl80211_link_id(info->attrs);
15022 struct sk_buff *msg;
15023 void *hdr;
15024 struct nlattr *ftm_stats_attr;
15025 int err;
15026
15027 if (wdev->iftype != NL80211_IFTYPE_AP ||
15028 !wdev->links[link_id].ap.beacon_interval)
15029 return -EOPNOTSUPP;
15030
15031 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15032 if (err)
15033 return err;
15034
15035 if (!ftm_stats.filled)
15036 return -ENODATA;
15037
15038 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15039 if (!msg)
15040 return -ENOMEM;
15041
15042 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15043 NL80211_CMD_GET_FTM_RESPONDER_STATS);
15044 if (!hdr)
15045 goto nla_put_failure;
15046
15047 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15048 goto nla_put_failure;
15049
15050 ftm_stats_attr = nla_nest_start_noflag(msg,
15051 NL80211_ATTR_FTM_RESPONDER_STATS);
15052 if (!ftm_stats_attr)
15053 goto nla_put_failure;
15054
15055 #define SET_FTM(field, name, type) \
15056 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15057 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
15058 ftm_stats.field)) \
15059 goto nla_put_failure; } while (0)
15060 #define SET_FTM_U64(field, name) \
15061 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15062 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
15063 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
15064 goto nla_put_failure; } while (0)
15065
15066 SET_FTM(success_num, SUCCESS_NUM, u32);
15067 SET_FTM(partial_num, PARTIAL_NUM, u32);
15068 SET_FTM(failed_num, FAILED_NUM, u32);
15069 SET_FTM(asap_num, ASAP_NUM, u32);
15070 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15071 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15072 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15073 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15074 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15075 #undef SET_FTM
15076
15077 nla_nest_end(msg, ftm_stats_attr);
15078
15079 genlmsg_end(msg, hdr);
15080 return genlmsg_reply(msg, info);
15081
15082 nla_put_failure:
15083 nlmsg_free(msg);
15084 return -ENOBUFS;
15085 }
15086
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)15087 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15088 {
15089 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15090 struct cfg80211_update_owe_info owe_info;
15091 struct net_device *dev = info->user_ptr[1];
15092
15093 if (!rdev->ops->update_owe_info)
15094 return -EOPNOTSUPP;
15095
15096 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15097 !info->attrs[NL80211_ATTR_MAC])
15098 return -EINVAL;
15099
15100 memset(&owe_info, 0, sizeof(owe_info));
15101 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15102 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15103
15104 if (info->attrs[NL80211_ATTR_IE]) {
15105 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15106 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15107 }
15108
15109 return rdev_update_owe_info(rdev, dev, &owe_info);
15110 }
15111
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)15112 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15113 {
15114 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15115 struct net_device *dev = info->user_ptr[1];
15116 struct wireless_dev *wdev = dev->ieee80211_ptr;
15117 struct station_info sinfo = {};
15118 const u8 *buf;
15119 size_t len;
15120 u8 *dest;
15121 int err;
15122
15123 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15124 return -EOPNOTSUPP;
15125
15126 if (!info->attrs[NL80211_ATTR_MAC] ||
15127 !info->attrs[NL80211_ATTR_FRAME]) {
15128 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15129 return -EINVAL;
15130 }
15131
15132 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15133 return -EOPNOTSUPP;
15134
15135 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15136 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15137 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15138
15139 if (len < sizeof(struct ethhdr))
15140 return -EINVAL;
15141
15142 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15143 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15144 return -EINVAL;
15145
15146 err = rdev_get_station(rdev, dev, dest, &sinfo);
15147 if (err)
15148 return err;
15149
15150 cfg80211_sinfo_release_content(&sinfo);
15151
15152 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15153 }
15154
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)15155 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15156 struct nlattr *attrs[], struct net_device *dev,
15157 struct cfg80211_tid_cfg *tid_conf,
15158 struct genl_info *info, const u8 *peer,
15159 unsigned int link_id)
15160 {
15161 struct netlink_ext_ack *extack = info->extack;
15162 u64 mask;
15163 int err;
15164
15165 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15166 return -EINVAL;
15167
15168 tid_conf->config_override =
15169 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15170 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15171
15172 if (tid_conf->config_override) {
15173 if (rdev->ops->reset_tid_config) {
15174 err = rdev_reset_tid_config(rdev, dev, peer,
15175 tid_conf->tids);
15176 if (err)
15177 return err;
15178 } else {
15179 return -EINVAL;
15180 }
15181 }
15182
15183 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15184 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15185 tid_conf->noack =
15186 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15187 }
15188
15189 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15190 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15191 tid_conf->retry_short =
15192 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15193
15194 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15195 return -EINVAL;
15196 }
15197
15198 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15199 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15200 tid_conf->retry_long =
15201 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15202
15203 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15204 return -EINVAL;
15205 }
15206
15207 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15208 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15209 tid_conf->ampdu =
15210 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15211 }
15212
15213 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15214 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15215 tid_conf->rtscts =
15216 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15217 }
15218
15219 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15220 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15221 tid_conf->amsdu =
15222 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15223 }
15224
15225 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15226 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15227
15228 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15229
15230 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15231 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15232 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15233 &tid_conf->txrate_mask, dev,
15234 true, link_id);
15235 if (err)
15236 return err;
15237
15238 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15239 }
15240 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15241 }
15242
15243 if (peer)
15244 mask = rdev->wiphy.tid_config_support.peer;
15245 else
15246 mask = rdev->wiphy.tid_config_support.vif;
15247
15248 if (tid_conf->mask & ~mask) {
15249 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15250 return -ENOTSUPP;
15251 }
15252
15253 return 0;
15254 }
15255
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)15256 static int nl80211_set_tid_config(struct sk_buff *skb,
15257 struct genl_info *info)
15258 {
15259 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15260 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15261 unsigned int link_id = nl80211_link_id(info->attrs);
15262 struct net_device *dev = info->user_ptr[1];
15263 struct cfg80211_tid_config *tid_config;
15264 struct nlattr *tid;
15265 int conf_idx = 0, rem_conf;
15266 int ret = -EINVAL;
15267 u32 num_conf = 0;
15268
15269 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15270 return -EINVAL;
15271
15272 if (!rdev->ops->set_tid_config)
15273 return -EOPNOTSUPP;
15274
15275 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15276 rem_conf)
15277 num_conf++;
15278
15279 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15280 GFP_KERNEL);
15281 if (!tid_config)
15282 return -ENOMEM;
15283
15284 tid_config->n_tid_conf = num_conf;
15285
15286 if (info->attrs[NL80211_ATTR_MAC])
15287 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15288
15289 wdev_lock(dev->ieee80211_ptr);
15290
15291 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15292 rem_conf) {
15293 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15294 tid, NULL, NULL);
15295
15296 if (ret)
15297 goto bad_tid_conf;
15298
15299 ret = parse_tid_conf(rdev, attrs, dev,
15300 &tid_config->tid_conf[conf_idx],
15301 info, tid_config->peer, link_id);
15302 if (ret)
15303 goto bad_tid_conf;
15304
15305 conf_idx++;
15306 }
15307
15308 ret = rdev_set_tid_config(rdev, dev, tid_config);
15309
15310 bad_tid_conf:
15311 kfree(tid_config);
15312 wdev_unlock(dev->ieee80211_ptr);
15313 return ret;
15314 }
15315
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)15316 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15317 {
15318 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15319 struct cfg80211_color_change_settings params = {};
15320 struct net_device *dev = info->user_ptr[1];
15321 struct wireless_dev *wdev = dev->ieee80211_ptr;
15322 struct nlattr **tb;
15323 u16 offset;
15324 int err;
15325
15326 if (!rdev->ops->color_change)
15327 return -EOPNOTSUPP;
15328
15329 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15330 NL80211_EXT_FEATURE_BSS_COLOR))
15331 return -EOPNOTSUPP;
15332
15333 if (wdev->iftype != NL80211_IFTYPE_AP)
15334 return -EOPNOTSUPP;
15335
15336 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15337 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15338 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15339 return -EINVAL;
15340
15341 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15342 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15343
15344 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next);
15345 if (err)
15346 return err;
15347
15348 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15349 if (!tb)
15350 return -ENOMEM;
15351
15352 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15353 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15354 nl80211_policy, info->extack);
15355 if (err)
15356 goto out;
15357
15358 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change);
15359 if (err)
15360 goto out;
15361
15362 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15363 err = -EINVAL;
15364 goto out;
15365 }
15366
15367 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15368 err = -EINVAL;
15369 goto out;
15370 }
15371
15372 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15373 if (offset >= params.beacon_color_change.tail_len) {
15374 err = -EINVAL;
15375 goto out;
15376 }
15377
15378 if (params.beacon_color_change.tail[offset] != params.count) {
15379 err = -EINVAL;
15380 goto out;
15381 }
15382
15383 params.counter_offset_beacon = offset;
15384
15385 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
15386 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
15387 sizeof(u16)) {
15388 err = -EINVAL;
15389 goto out;
15390 }
15391
15392 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
15393 if (offset >= params.beacon_color_change.probe_resp_len) {
15394 err = -EINVAL;
15395 goto out;
15396 }
15397
15398 if (params.beacon_color_change.probe_resp[offset] !=
15399 params.count) {
15400 err = -EINVAL;
15401 goto out;
15402 }
15403
15404 params.counter_offset_presp = offset;
15405 }
15406
15407 wdev_lock(wdev);
15408 err = rdev_color_change(rdev, dev, ¶ms);
15409 wdev_unlock(wdev);
15410
15411 out:
15412 kfree(params.beacon_next.mbssid_ies);
15413 kfree(params.beacon_color_change.mbssid_ies);
15414 kfree(tb);
15415 return err;
15416 }
15417
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)15418 static int nl80211_set_fils_aad(struct sk_buff *skb,
15419 struct genl_info *info)
15420 {
15421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15422 struct net_device *dev = info->user_ptr[1];
15423 struct cfg80211_fils_aad fils_aad = {};
15424 u8 *nonces;
15425
15426 if (!info->attrs[NL80211_ATTR_MAC] ||
15427 !info->attrs[NL80211_ATTR_FILS_KEK] ||
15428 !info->attrs[NL80211_ATTR_FILS_NONCES])
15429 return -EINVAL;
15430
15431 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15432 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
15433 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
15434 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
15435 fils_aad.snonce = nonces;
15436 fils_aad.anonce = nonces + FILS_NONCE_LEN;
15437
15438 return rdev_set_fils_aad(rdev, dev, &fils_aad);
15439 }
15440
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)15441 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
15442 {
15443 unsigned int link_id = nl80211_link_id(info->attrs);
15444 struct net_device *dev = info->user_ptr[1];
15445 struct wireless_dev *wdev = dev->ieee80211_ptr;
15446
15447 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
15448 return -EINVAL;
15449
15450 switch (wdev->iftype) {
15451 case NL80211_IFTYPE_AP:
15452 break;
15453 default:
15454 return -EINVAL;
15455 }
15456
15457 if (!info->attrs[NL80211_ATTR_MAC] ||
15458 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
15459 return -EINVAL;
15460
15461 wdev_lock(wdev);
15462 wdev->valid_links |= BIT(link_id);
15463 ether_addr_copy(wdev->links[link_id].addr,
15464 nla_data(info->attrs[NL80211_ATTR_MAC]));
15465 wdev_unlock(wdev);
15466
15467 return 0;
15468 }
15469
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)15470 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
15471 {
15472 unsigned int link_id = nl80211_link_id(info->attrs);
15473 struct net_device *dev = info->user_ptr[1];
15474 struct wireless_dev *wdev = dev->ieee80211_ptr;
15475
15476 /* cannot remove if there's no link */
15477 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
15478 return -EINVAL;
15479
15480 switch (wdev->iftype) {
15481 case NL80211_IFTYPE_AP:
15482 break;
15483 default:
15484 return -EINVAL;
15485 }
15486
15487 /* FIXME: stop the link operations first */
15488
15489 wdev_lock(wdev);
15490 wdev->valid_links &= ~BIT(link_id);
15491 eth_zero_addr(wdev->links[link_id].addr);
15492 wdev_unlock(wdev);
15493
15494 return 0;
15495 }
15496
15497 #define NL80211_FLAG_NEED_WIPHY 0x01
15498 #define NL80211_FLAG_NEED_NETDEV 0x02
15499 #define NL80211_FLAG_NEED_RTNL 0x04
15500 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
15501 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
15502 NL80211_FLAG_CHECK_NETDEV_UP)
15503 #define NL80211_FLAG_NEED_WDEV 0x10
15504 /* If a netdev is associated, it must be UP, P2P must be started */
15505 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
15506 NL80211_FLAG_CHECK_NETDEV_UP)
15507 #define NL80211_FLAG_CLEAR_SKB 0x20
15508 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
15509 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
15510 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
15511
15512 #define INTERNAL_FLAG_SELECTORS(__sel) \
15513 SELECTOR(__sel, NONE, 0) /* must be first */ \
15514 SELECTOR(__sel, WIPHY, \
15515 NL80211_FLAG_NEED_WIPHY) \
15516 SELECTOR(__sel, WDEV, \
15517 NL80211_FLAG_NEED_WDEV) \
15518 SELECTOR(__sel, NETDEV, \
15519 NL80211_FLAG_NEED_NETDEV) \
15520 SELECTOR(__sel, NETDEV_LINK, \
15521 NL80211_FLAG_NEED_NETDEV | \
15522 NL80211_FLAG_MLO_VALID_LINK_ID) \
15523 SELECTOR(__sel, NETDEV_NO_MLO, \
15524 NL80211_FLAG_NEED_NETDEV | \
15525 NL80211_FLAG_MLO_UNSUPPORTED) \
15526 SELECTOR(__sel, WIPHY_RTNL, \
15527 NL80211_FLAG_NEED_WIPHY | \
15528 NL80211_FLAG_NEED_RTNL) \
15529 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
15530 NL80211_FLAG_NEED_WIPHY | \
15531 NL80211_FLAG_NEED_RTNL | \
15532 NL80211_FLAG_NO_WIPHY_MTX) \
15533 SELECTOR(__sel, WDEV_RTNL, \
15534 NL80211_FLAG_NEED_WDEV | \
15535 NL80211_FLAG_NEED_RTNL) \
15536 SELECTOR(__sel, NETDEV_RTNL, \
15537 NL80211_FLAG_NEED_NETDEV | \
15538 NL80211_FLAG_NEED_RTNL) \
15539 SELECTOR(__sel, NETDEV_UP, \
15540 NL80211_FLAG_NEED_NETDEV_UP) \
15541 SELECTOR(__sel, NETDEV_UP_LINK, \
15542 NL80211_FLAG_NEED_NETDEV_UP | \
15543 NL80211_FLAG_MLO_VALID_LINK_ID) \
15544 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
15545 NL80211_FLAG_NEED_NETDEV_UP | \
15546 NL80211_FLAG_MLO_UNSUPPORTED) \
15547 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
15548 NL80211_FLAG_NEED_NETDEV_UP | \
15549 NL80211_FLAG_CLEAR_SKB | \
15550 NL80211_FLAG_MLO_UNSUPPORTED) \
15551 SELECTOR(__sel, NETDEV_UP_NOTMX, \
15552 NL80211_FLAG_NEED_NETDEV_UP | \
15553 NL80211_FLAG_NO_WIPHY_MTX) \
15554 SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO, \
15555 NL80211_FLAG_NEED_NETDEV_UP | \
15556 NL80211_FLAG_NO_WIPHY_MTX | \
15557 NL80211_FLAG_MLO_UNSUPPORTED) \
15558 SELECTOR(__sel, NETDEV_UP_CLEAR, \
15559 NL80211_FLAG_NEED_NETDEV_UP | \
15560 NL80211_FLAG_CLEAR_SKB) \
15561 SELECTOR(__sel, WDEV_UP, \
15562 NL80211_FLAG_NEED_WDEV_UP) \
15563 SELECTOR(__sel, WDEV_UP_LINK, \
15564 NL80211_FLAG_NEED_WDEV_UP | \
15565 NL80211_FLAG_MLO_VALID_LINK_ID) \
15566 SELECTOR(__sel, WDEV_UP_RTNL, \
15567 NL80211_FLAG_NEED_WDEV_UP | \
15568 NL80211_FLAG_NEED_RTNL) \
15569 SELECTOR(__sel, WIPHY_CLEAR, \
15570 NL80211_FLAG_NEED_WIPHY | \
15571 NL80211_FLAG_CLEAR_SKB)
15572
15573 enum nl80211_internal_flags_selector {
15574 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
15575 INTERNAL_FLAG_SELECTORS(_)
15576 #undef SELECTOR
15577 };
15578
15579 static u32 nl80211_internal_flags[] = {
15580 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
15581 INTERNAL_FLAG_SELECTORS(_)
15582 #undef SELECTOR
15583 };
15584
nl80211_pre_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)15585 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
15586 struct genl_info *info)
15587 {
15588 struct cfg80211_registered_device *rdev = NULL;
15589 struct wireless_dev *wdev = NULL;
15590 struct net_device *dev = NULL;
15591 u32 internal_flags;
15592 int err;
15593
15594 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
15595 return -EINVAL;
15596
15597 internal_flags = nl80211_internal_flags[ops->internal_flags];
15598
15599 rtnl_lock();
15600 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
15601 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
15602 if (IS_ERR(rdev)) {
15603 err = PTR_ERR(rdev);
15604 goto out_unlock;
15605 }
15606 info->user_ptr[0] = rdev;
15607 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
15608 internal_flags & NL80211_FLAG_NEED_WDEV) {
15609 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
15610 info->attrs);
15611 if (IS_ERR(wdev)) {
15612 err = PTR_ERR(wdev);
15613 goto out_unlock;
15614 }
15615
15616 dev = wdev->netdev;
15617 dev_hold(dev);
15618 rdev = wiphy_to_rdev(wdev->wiphy);
15619
15620 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
15621 if (!dev) {
15622 err = -EINVAL;
15623 goto out_unlock;
15624 }
15625
15626 info->user_ptr[1] = dev;
15627 } else {
15628 info->user_ptr[1] = wdev;
15629 }
15630
15631 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
15632 !wdev_running(wdev)) {
15633 err = -ENETDOWN;
15634 goto out_unlock;
15635 }
15636
15637 info->user_ptr[0] = rdev;
15638 }
15639
15640 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
15641 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
15642
15643 if (!wdev) {
15644 err = -EINVAL;
15645 goto out_unlock;
15646 }
15647
15648 /* MLO -> require valid link ID */
15649 if (wdev->valid_links &&
15650 (!link_id ||
15651 !(wdev->valid_links & BIT(nla_get_u16(link_id))))) {
15652 err = -EINVAL;
15653 goto out_unlock;
15654 }
15655
15656 /* non-MLO -> no link ID attribute accepted */
15657 if (!wdev->valid_links && link_id) {
15658 err = -EINVAL;
15659 goto out_unlock;
15660 }
15661 }
15662
15663 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
15664 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
15665 (wdev && wdev->valid_links)) {
15666 err = -EINVAL;
15667 goto out_unlock;
15668 }
15669 }
15670
15671 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
15672 wiphy_lock(&rdev->wiphy);
15673 /* we keep the mutex locked until post_doit */
15674 __release(&rdev->wiphy.mtx);
15675 }
15676 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
15677 rtnl_unlock();
15678
15679 return 0;
15680 out_unlock:
15681 rtnl_unlock();
15682 dev_put(dev);
15683 return err;
15684 }
15685
nl80211_post_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)15686 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
15687 struct genl_info *info)
15688 {
15689 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
15690
15691 if (info->user_ptr[1]) {
15692 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
15693 struct wireless_dev *wdev = info->user_ptr[1];
15694
15695 dev_put(wdev->netdev);
15696 } else {
15697 dev_put(info->user_ptr[1]);
15698 }
15699 }
15700
15701 if (info->user_ptr[0] &&
15702 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
15703 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15704
15705 /* we kept the mutex locked since pre_doit */
15706 __acquire(&rdev->wiphy.mtx);
15707 wiphy_unlock(&rdev->wiphy);
15708 }
15709
15710 if (internal_flags & NL80211_FLAG_NEED_RTNL)
15711 rtnl_unlock();
15712
15713 /* If needed, clear the netlink message payload from the SKB
15714 * as it might contain key data that shouldn't stick around on
15715 * the heap after the SKB is freed. The netlink message header
15716 * is still needed for further processing, so leave it intact.
15717 */
15718 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
15719 struct nlmsghdr *nlh = nlmsg_hdr(skb);
15720
15721 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
15722 }
15723 }
15724
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)15725 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
15726 struct cfg80211_sar_specs *sar_specs,
15727 struct nlattr *spec[], int index)
15728 {
15729 u32 range_index, i;
15730
15731 if (!sar_specs || !spec)
15732 return -EINVAL;
15733
15734 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
15735 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
15736 return -EINVAL;
15737
15738 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
15739
15740 /* check if range_index exceeds num_freq_ranges */
15741 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
15742 return -EINVAL;
15743
15744 /* check if range_index duplicates */
15745 for (i = 0; i < index; i++) {
15746 if (sar_specs->sub_specs[i].freq_range_index == range_index)
15747 return -EINVAL;
15748 }
15749
15750 sar_specs->sub_specs[index].power =
15751 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
15752
15753 sar_specs->sub_specs[index].freq_range_index = range_index;
15754
15755 return 0;
15756 }
15757
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)15758 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
15759 {
15760 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15761 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
15762 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
15763 struct cfg80211_sar_specs *sar_spec;
15764 enum nl80211_sar_type type;
15765 struct nlattr *spec_list;
15766 u32 specs;
15767 int rem, err;
15768
15769 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
15770 return -EOPNOTSUPP;
15771
15772 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
15773 return -EINVAL;
15774
15775 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
15776 info->attrs[NL80211_ATTR_SAR_SPEC],
15777 NULL, NULL);
15778
15779 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
15780 return -EINVAL;
15781
15782 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
15783 if (type != rdev->wiphy.sar_capa->type)
15784 return -EINVAL;
15785
15786 specs = 0;
15787 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
15788 specs++;
15789
15790 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
15791 return -EINVAL;
15792
15793 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
15794 if (!sar_spec)
15795 return -ENOMEM;
15796
15797 sar_spec->type = type;
15798 specs = 0;
15799 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
15800 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
15801 spec_list, NULL, NULL);
15802
15803 switch (type) {
15804 case NL80211_SAR_TYPE_POWER:
15805 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
15806 spec, specs)) {
15807 err = -EINVAL;
15808 goto error;
15809 }
15810 break;
15811 default:
15812 err = -EINVAL;
15813 goto error;
15814 }
15815 specs++;
15816 }
15817
15818 sar_spec->num_sub_specs = specs;
15819
15820 rdev->cur_cmd_info = info;
15821 err = rdev_set_sar_specs(rdev, sar_spec);
15822 rdev->cur_cmd_info = NULL;
15823 error:
15824 kfree(sar_spec);
15825 return err;
15826 }
15827
15828 #define SELECTOR(__sel, name, value) \
15829 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
15830 int __missing_selector(void);
15831 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
15832
15833 static const struct genl_ops nl80211_ops[] = {
15834 {
15835 .cmd = NL80211_CMD_GET_WIPHY,
15836 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15837 .doit = nl80211_get_wiphy,
15838 .dumpit = nl80211_dump_wiphy,
15839 .done = nl80211_dump_wiphy_done,
15840 /* can be retrieved by unprivileged users */
15841 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
15842 },
15843 };
15844
15845 static const struct genl_small_ops nl80211_small_ops[] = {
15846 {
15847 .cmd = NL80211_CMD_SET_WIPHY,
15848 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15849 .doit = nl80211_set_wiphy,
15850 .flags = GENL_UNS_ADMIN_PERM,
15851 },
15852 {
15853 .cmd = NL80211_CMD_GET_INTERFACE,
15854 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15855 .doit = nl80211_get_interface,
15856 .dumpit = nl80211_dump_interface,
15857 /* can be retrieved by unprivileged users */
15858 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
15859 },
15860 {
15861 .cmd = NL80211_CMD_SET_INTERFACE,
15862 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15863 .doit = nl80211_set_interface,
15864 .flags = GENL_UNS_ADMIN_PERM,
15865 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
15866 NL80211_FLAG_NEED_RTNL),
15867 },
15868 {
15869 .cmd = NL80211_CMD_NEW_INTERFACE,
15870 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15871 .doit = nl80211_new_interface,
15872 .flags = GENL_UNS_ADMIN_PERM,
15873 .internal_flags =
15874 IFLAGS(NL80211_FLAG_NEED_WIPHY |
15875 NL80211_FLAG_NEED_RTNL |
15876 /* we take the wiphy mutex later ourselves */
15877 NL80211_FLAG_NO_WIPHY_MTX),
15878 },
15879 {
15880 .cmd = NL80211_CMD_DEL_INTERFACE,
15881 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15882 .doit = nl80211_del_interface,
15883 .flags = GENL_UNS_ADMIN_PERM,
15884 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
15885 NL80211_FLAG_NEED_RTNL),
15886 },
15887 {
15888 .cmd = NL80211_CMD_GET_KEY,
15889 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15890 .doit = nl80211_get_key,
15891 .flags = GENL_UNS_ADMIN_PERM,
15892 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15893 },
15894 {
15895 .cmd = NL80211_CMD_SET_KEY,
15896 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15897 .doit = nl80211_set_key,
15898 .flags = GENL_UNS_ADMIN_PERM,
15899 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
15900 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
15901 NL80211_FLAG_CLEAR_SKB),
15902 },
15903 {
15904 .cmd = NL80211_CMD_NEW_KEY,
15905 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15906 .doit = nl80211_new_key,
15907 .flags = GENL_UNS_ADMIN_PERM,
15908 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
15909 NL80211_FLAG_CLEAR_SKB),
15910 },
15911 {
15912 .cmd = NL80211_CMD_DEL_KEY,
15913 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15914 .doit = nl80211_del_key,
15915 .flags = GENL_UNS_ADMIN_PERM,
15916 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15917 },
15918 {
15919 .cmd = NL80211_CMD_SET_BEACON,
15920 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15921 .flags = GENL_UNS_ADMIN_PERM,
15922 .doit = nl80211_set_beacon,
15923 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
15924 NL80211_FLAG_MLO_VALID_LINK_ID),
15925 },
15926 {
15927 .cmd = NL80211_CMD_START_AP,
15928 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15929 .flags = GENL_UNS_ADMIN_PERM,
15930 .doit = nl80211_start_ap,
15931 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
15932 NL80211_FLAG_MLO_VALID_LINK_ID),
15933 },
15934 {
15935 .cmd = NL80211_CMD_STOP_AP,
15936 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15937 .flags = GENL_UNS_ADMIN_PERM,
15938 .doit = nl80211_stop_ap,
15939 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
15940 NL80211_FLAG_MLO_VALID_LINK_ID),
15941 },
15942 {
15943 .cmd = NL80211_CMD_GET_STATION,
15944 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15945 .doit = nl80211_get_station,
15946 .dumpit = nl80211_dump_station,
15947 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
15948 },
15949 {
15950 .cmd = NL80211_CMD_SET_STATION,
15951 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15952 .doit = nl80211_set_station,
15953 .flags = GENL_UNS_ADMIN_PERM,
15954 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15955 },
15956 {
15957 .cmd = NL80211_CMD_NEW_STATION,
15958 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15959 .doit = nl80211_new_station,
15960 .flags = GENL_UNS_ADMIN_PERM,
15961 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15962 },
15963 {
15964 .cmd = NL80211_CMD_DEL_STATION,
15965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15966 .doit = nl80211_del_station,
15967 .flags = GENL_UNS_ADMIN_PERM,
15968 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15969 },
15970 {
15971 .cmd = NL80211_CMD_GET_MPATH,
15972 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15973 .doit = nl80211_get_mpath,
15974 .dumpit = nl80211_dump_mpath,
15975 .flags = GENL_UNS_ADMIN_PERM,
15976 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15977 },
15978 {
15979 .cmd = NL80211_CMD_GET_MPP,
15980 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15981 .doit = nl80211_get_mpp,
15982 .dumpit = nl80211_dump_mpp,
15983 .flags = GENL_UNS_ADMIN_PERM,
15984 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15985 },
15986 {
15987 .cmd = NL80211_CMD_SET_MPATH,
15988 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15989 .doit = nl80211_set_mpath,
15990 .flags = GENL_UNS_ADMIN_PERM,
15991 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15992 },
15993 {
15994 .cmd = NL80211_CMD_NEW_MPATH,
15995 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15996 .doit = nl80211_new_mpath,
15997 .flags = GENL_UNS_ADMIN_PERM,
15998 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
15999 },
16000 {
16001 .cmd = NL80211_CMD_DEL_MPATH,
16002 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16003 .doit = nl80211_del_mpath,
16004 .flags = GENL_UNS_ADMIN_PERM,
16005 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16006 },
16007 {
16008 .cmd = NL80211_CMD_SET_BSS,
16009 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16010 .doit = nl80211_set_bss,
16011 .flags = GENL_UNS_ADMIN_PERM,
16012 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16013 },
16014 {
16015 .cmd = NL80211_CMD_GET_REG,
16016 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16017 .doit = nl80211_get_reg_do,
16018 .dumpit = nl80211_get_reg_dump,
16019 /* can be retrieved by unprivileged users */
16020 },
16021 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16022 {
16023 .cmd = NL80211_CMD_SET_REG,
16024 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16025 .doit = nl80211_set_reg,
16026 .flags = GENL_ADMIN_PERM,
16027 },
16028 #endif
16029 {
16030 .cmd = NL80211_CMD_REQ_SET_REG,
16031 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16032 .doit = nl80211_req_set_reg,
16033 .flags = GENL_ADMIN_PERM,
16034 },
16035 {
16036 .cmd = NL80211_CMD_RELOAD_REGDB,
16037 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16038 .doit = nl80211_reload_regdb,
16039 .flags = GENL_ADMIN_PERM,
16040 },
16041 {
16042 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16043 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16044 .doit = nl80211_get_mesh_config,
16045 /* can be retrieved by unprivileged users */
16046 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16047 },
16048 {
16049 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16050 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16051 .doit = nl80211_update_mesh_config,
16052 .flags = GENL_UNS_ADMIN_PERM,
16053 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16054 },
16055 {
16056 .cmd = NL80211_CMD_TRIGGER_SCAN,
16057 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16058 .doit = nl80211_trigger_scan,
16059 .flags = GENL_UNS_ADMIN_PERM,
16060 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16061 },
16062 {
16063 .cmd = NL80211_CMD_ABORT_SCAN,
16064 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16065 .doit = nl80211_abort_scan,
16066 .flags = GENL_UNS_ADMIN_PERM,
16067 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16068 },
16069 {
16070 .cmd = NL80211_CMD_GET_SCAN,
16071 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16072 .dumpit = nl80211_dump_scan,
16073 },
16074 {
16075 .cmd = NL80211_CMD_START_SCHED_SCAN,
16076 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16077 .doit = nl80211_start_sched_scan,
16078 .flags = GENL_UNS_ADMIN_PERM,
16079 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16080 },
16081 {
16082 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16083 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16084 .doit = nl80211_stop_sched_scan,
16085 .flags = GENL_UNS_ADMIN_PERM,
16086 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16087 },
16088 {
16089 .cmd = NL80211_CMD_AUTHENTICATE,
16090 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16091 .doit = nl80211_authenticate,
16092 .flags = GENL_UNS_ADMIN_PERM,
16093 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16094 NL80211_FLAG_CLEAR_SKB),
16095 },
16096 {
16097 .cmd = NL80211_CMD_ASSOCIATE,
16098 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16099 .doit = nl80211_associate,
16100 .flags = GENL_UNS_ADMIN_PERM,
16101 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16102 NL80211_FLAG_CLEAR_SKB),
16103 },
16104 {
16105 .cmd = NL80211_CMD_DEAUTHENTICATE,
16106 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16107 .doit = nl80211_deauthenticate,
16108 .flags = GENL_UNS_ADMIN_PERM,
16109 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16110 },
16111 {
16112 .cmd = NL80211_CMD_DISASSOCIATE,
16113 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16114 .doit = nl80211_disassociate,
16115 .flags = GENL_UNS_ADMIN_PERM,
16116 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16117 },
16118 {
16119 .cmd = NL80211_CMD_JOIN_IBSS,
16120 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16121 .doit = nl80211_join_ibss,
16122 .flags = GENL_UNS_ADMIN_PERM,
16123 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16124 },
16125 {
16126 .cmd = NL80211_CMD_LEAVE_IBSS,
16127 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16128 .doit = nl80211_leave_ibss,
16129 .flags = GENL_UNS_ADMIN_PERM,
16130 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16131 },
16132 #ifdef CONFIG_NL80211_TESTMODE
16133 {
16134 .cmd = NL80211_CMD_TESTMODE,
16135 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16136 .doit = nl80211_testmode_do,
16137 .dumpit = nl80211_testmode_dump,
16138 .flags = GENL_UNS_ADMIN_PERM,
16139 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16140 },
16141 #endif
16142 {
16143 .cmd = NL80211_CMD_CONNECT,
16144 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16145 .doit = nl80211_connect,
16146 .flags = GENL_UNS_ADMIN_PERM,
16147 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16148 NL80211_FLAG_CLEAR_SKB),
16149 },
16150 {
16151 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16152 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16153 .doit = nl80211_update_connect_params,
16154 .flags = GENL_ADMIN_PERM,
16155 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16156 NL80211_FLAG_CLEAR_SKB),
16157 },
16158 {
16159 .cmd = NL80211_CMD_DISCONNECT,
16160 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16161 .doit = nl80211_disconnect,
16162 .flags = GENL_UNS_ADMIN_PERM,
16163 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16164 },
16165 {
16166 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16167 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16168 .doit = nl80211_wiphy_netns,
16169 .flags = GENL_UNS_ADMIN_PERM,
16170 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16171 NL80211_FLAG_NEED_RTNL |
16172 NL80211_FLAG_NO_WIPHY_MTX),
16173 },
16174 {
16175 .cmd = NL80211_CMD_GET_SURVEY,
16176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16177 .dumpit = nl80211_dump_survey,
16178 },
16179 {
16180 .cmd = NL80211_CMD_SET_PMKSA,
16181 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16182 .doit = nl80211_setdel_pmksa,
16183 .flags = GENL_UNS_ADMIN_PERM,
16184 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16185 NL80211_FLAG_CLEAR_SKB),
16186 },
16187 {
16188 .cmd = NL80211_CMD_DEL_PMKSA,
16189 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16190 .doit = nl80211_setdel_pmksa,
16191 .flags = GENL_UNS_ADMIN_PERM,
16192 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16193 },
16194 {
16195 .cmd = NL80211_CMD_FLUSH_PMKSA,
16196 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16197 .doit = nl80211_flush_pmksa,
16198 .flags = GENL_UNS_ADMIN_PERM,
16199 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16200 },
16201 {
16202 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16203 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16204 .doit = nl80211_remain_on_channel,
16205 .flags = GENL_UNS_ADMIN_PERM,
16206 /* FIXME: requiring a link ID here is probably not good */
16207 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16208 NL80211_FLAG_MLO_VALID_LINK_ID),
16209 },
16210 {
16211 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16212 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16213 .doit = nl80211_cancel_remain_on_channel,
16214 .flags = GENL_UNS_ADMIN_PERM,
16215 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16216 },
16217 {
16218 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
16219 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16220 .doit = nl80211_set_tx_bitrate_mask,
16221 .flags = GENL_UNS_ADMIN_PERM,
16222 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16223 NL80211_FLAG_MLO_VALID_LINK_ID),
16224 },
16225 {
16226 .cmd = NL80211_CMD_REGISTER_FRAME,
16227 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16228 .doit = nl80211_register_mgmt,
16229 .flags = GENL_UNS_ADMIN_PERM,
16230 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16231 },
16232 {
16233 .cmd = NL80211_CMD_FRAME,
16234 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16235 .doit = nl80211_tx_mgmt,
16236 .flags = GENL_UNS_ADMIN_PERM,
16237 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16238 },
16239 {
16240 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
16241 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16242 .doit = nl80211_tx_mgmt_cancel_wait,
16243 .flags = GENL_UNS_ADMIN_PERM,
16244 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16245 },
16246 {
16247 .cmd = NL80211_CMD_SET_POWER_SAVE,
16248 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16249 .doit = nl80211_set_power_save,
16250 .flags = GENL_UNS_ADMIN_PERM,
16251 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16252 },
16253 {
16254 .cmd = NL80211_CMD_GET_POWER_SAVE,
16255 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16256 .doit = nl80211_get_power_save,
16257 /* can be retrieved by unprivileged users */
16258 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16259 },
16260 {
16261 .cmd = NL80211_CMD_SET_CQM,
16262 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16263 .doit = nl80211_set_cqm,
16264 .flags = GENL_UNS_ADMIN_PERM,
16265 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16266 },
16267 {
16268 .cmd = NL80211_CMD_SET_CHANNEL,
16269 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16270 .doit = nl80211_set_channel,
16271 .flags = GENL_UNS_ADMIN_PERM,
16272 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16273 NL80211_FLAG_MLO_VALID_LINK_ID),
16274 },
16275 {
16276 .cmd = NL80211_CMD_JOIN_MESH,
16277 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16278 .doit = nl80211_join_mesh,
16279 .flags = GENL_UNS_ADMIN_PERM,
16280 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16281 },
16282 {
16283 .cmd = NL80211_CMD_LEAVE_MESH,
16284 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16285 .doit = nl80211_leave_mesh,
16286 .flags = GENL_UNS_ADMIN_PERM,
16287 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16288 },
16289 {
16290 .cmd = NL80211_CMD_JOIN_OCB,
16291 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16292 .doit = nl80211_join_ocb,
16293 .flags = GENL_UNS_ADMIN_PERM,
16294 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16295 },
16296 {
16297 .cmd = NL80211_CMD_LEAVE_OCB,
16298 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16299 .doit = nl80211_leave_ocb,
16300 .flags = GENL_UNS_ADMIN_PERM,
16301 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16302 },
16303 #ifdef CONFIG_PM
16304 {
16305 .cmd = NL80211_CMD_GET_WOWLAN,
16306 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16307 .doit = nl80211_get_wowlan,
16308 /* can be retrieved by unprivileged users */
16309 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16310 },
16311 {
16312 .cmd = NL80211_CMD_SET_WOWLAN,
16313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16314 .doit = nl80211_set_wowlan,
16315 .flags = GENL_UNS_ADMIN_PERM,
16316 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16317 },
16318 #endif
16319 {
16320 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
16321 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16322 .doit = nl80211_set_rekey_data,
16323 .flags = GENL_UNS_ADMIN_PERM,
16324 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16325 NL80211_FLAG_CLEAR_SKB),
16326 },
16327 {
16328 .cmd = NL80211_CMD_TDLS_MGMT,
16329 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16330 .doit = nl80211_tdls_mgmt,
16331 .flags = GENL_UNS_ADMIN_PERM,
16332 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16333 },
16334 {
16335 .cmd = NL80211_CMD_TDLS_OPER,
16336 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16337 .doit = nl80211_tdls_oper,
16338 .flags = GENL_UNS_ADMIN_PERM,
16339 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16340 },
16341 {
16342 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
16343 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16344 .doit = nl80211_register_unexpected_frame,
16345 .flags = GENL_UNS_ADMIN_PERM,
16346 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16347 },
16348 {
16349 .cmd = NL80211_CMD_PROBE_CLIENT,
16350 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16351 .doit = nl80211_probe_client,
16352 .flags = GENL_UNS_ADMIN_PERM,
16353 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16354 },
16355 {
16356 .cmd = NL80211_CMD_REGISTER_BEACONS,
16357 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16358 .doit = nl80211_register_beacons,
16359 .flags = GENL_UNS_ADMIN_PERM,
16360 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16361 },
16362 {
16363 .cmd = NL80211_CMD_SET_NOACK_MAP,
16364 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16365 .doit = nl80211_set_noack_map,
16366 .flags = GENL_UNS_ADMIN_PERM,
16367 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16368 },
16369 {
16370 .cmd = NL80211_CMD_START_P2P_DEVICE,
16371 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16372 .doit = nl80211_start_p2p_device,
16373 .flags = GENL_UNS_ADMIN_PERM,
16374 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16375 NL80211_FLAG_NEED_RTNL),
16376 },
16377 {
16378 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
16379 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16380 .doit = nl80211_stop_p2p_device,
16381 .flags = GENL_UNS_ADMIN_PERM,
16382 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16383 NL80211_FLAG_NEED_RTNL),
16384 },
16385 {
16386 .cmd = NL80211_CMD_START_NAN,
16387 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16388 .doit = nl80211_start_nan,
16389 .flags = GENL_ADMIN_PERM,
16390 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16391 NL80211_FLAG_NEED_RTNL),
16392 },
16393 {
16394 .cmd = NL80211_CMD_STOP_NAN,
16395 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16396 .doit = nl80211_stop_nan,
16397 .flags = GENL_ADMIN_PERM,
16398 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16399 NL80211_FLAG_NEED_RTNL),
16400 },
16401 {
16402 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
16403 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16404 .doit = nl80211_nan_add_func,
16405 .flags = GENL_ADMIN_PERM,
16406 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16407 },
16408 {
16409 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
16410 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16411 .doit = nl80211_nan_del_func,
16412 .flags = GENL_ADMIN_PERM,
16413 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16414 },
16415 {
16416 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
16417 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16418 .doit = nl80211_nan_change_config,
16419 .flags = GENL_ADMIN_PERM,
16420 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16421 },
16422 {
16423 .cmd = NL80211_CMD_SET_MCAST_RATE,
16424 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16425 .doit = nl80211_set_mcast_rate,
16426 .flags = GENL_UNS_ADMIN_PERM,
16427 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16428 },
16429 {
16430 .cmd = NL80211_CMD_SET_MAC_ACL,
16431 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16432 .doit = nl80211_set_mac_acl,
16433 .flags = GENL_UNS_ADMIN_PERM,
16434 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16435 NL80211_FLAG_MLO_UNSUPPORTED),
16436 },
16437 {
16438 .cmd = NL80211_CMD_RADAR_DETECT,
16439 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16440 .doit = nl80211_start_radar_detection,
16441 .flags = GENL_UNS_ADMIN_PERM,
16442 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16443 NL80211_FLAG_NO_WIPHY_MTX |
16444 NL80211_FLAG_MLO_UNSUPPORTED),
16445 },
16446 {
16447 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
16448 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16449 .doit = nl80211_get_protocol_features,
16450 },
16451 {
16452 .cmd = NL80211_CMD_UPDATE_FT_IES,
16453 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16454 .doit = nl80211_update_ft_ies,
16455 .flags = GENL_UNS_ADMIN_PERM,
16456 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16457 },
16458 {
16459 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
16460 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16461 .doit = nl80211_crit_protocol_start,
16462 .flags = GENL_UNS_ADMIN_PERM,
16463 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16464 },
16465 {
16466 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
16467 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16468 .doit = nl80211_crit_protocol_stop,
16469 .flags = GENL_UNS_ADMIN_PERM,
16470 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16471 },
16472 {
16473 .cmd = NL80211_CMD_GET_COALESCE,
16474 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16475 .doit = nl80211_get_coalesce,
16476 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16477 },
16478 {
16479 .cmd = NL80211_CMD_SET_COALESCE,
16480 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16481 .doit = nl80211_set_coalesce,
16482 .flags = GENL_UNS_ADMIN_PERM,
16483 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16484 },
16485 {
16486 .cmd = NL80211_CMD_CHANNEL_SWITCH,
16487 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16488 .doit = nl80211_channel_switch,
16489 .flags = GENL_UNS_ADMIN_PERM,
16490 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16491 NL80211_FLAG_MLO_VALID_LINK_ID),
16492 },
16493 {
16494 .cmd = NL80211_CMD_VENDOR,
16495 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16496 .doit = nl80211_vendor_cmd,
16497 .dumpit = nl80211_vendor_cmd_dump,
16498 .flags = GENL_UNS_ADMIN_PERM,
16499 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16500 NL80211_FLAG_CLEAR_SKB),
16501 },
16502 {
16503 .cmd = NL80211_CMD_SET_QOS_MAP,
16504 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16505 .doit = nl80211_set_qos_map,
16506 .flags = GENL_UNS_ADMIN_PERM,
16507 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16508 },
16509 {
16510 .cmd = NL80211_CMD_ADD_TX_TS,
16511 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16512 .doit = nl80211_add_tx_ts,
16513 .flags = GENL_UNS_ADMIN_PERM,
16514 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16515 NL80211_FLAG_MLO_UNSUPPORTED),
16516 },
16517 {
16518 .cmd = NL80211_CMD_DEL_TX_TS,
16519 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16520 .doit = nl80211_del_tx_ts,
16521 .flags = GENL_UNS_ADMIN_PERM,
16522 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16523 },
16524 {
16525 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
16526 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16527 .doit = nl80211_tdls_channel_switch,
16528 .flags = GENL_UNS_ADMIN_PERM,
16529 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16530 },
16531 {
16532 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
16533 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16534 .doit = nl80211_tdls_cancel_channel_switch,
16535 .flags = GENL_UNS_ADMIN_PERM,
16536 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16537 },
16538 {
16539 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
16540 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16541 .doit = nl80211_set_multicast_to_unicast,
16542 .flags = GENL_UNS_ADMIN_PERM,
16543 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16544 },
16545 {
16546 .cmd = NL80211_CMD_SET_PMK,
16547 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16548 .doit = nl80211_set_pmk,
16549 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16550 NL80211_FLAG_CLEAR_SKB),
16551 },
16552 {
16553 .cmd = NL80211_CMD_DEL_PMK,
16554 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16555 .doit = nl80211_del_pmk,
16556 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16557 },
16558 {
16559 .cmd = NL80211_CMD_EXTERNAL_AUTH,
16560 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16561 .doit = nl80211_external_auth,
16562 .flags = GENL_ADMIN_PERM,
16563 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16564 },
16565 {
16566 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
16567 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16568 .doit = nl80211_tx_control_port,
16569 .flags = GENL_UNS_ADMIN_PERM,
16570 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16571 },
16572 {
16573 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
16574 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16575 .doit = nl80211_get_ftm_responder_stats,
16576 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16577 NL80211_FLAG_MLO_VALID_LINK_ID),
16578 },
16579 {
16580 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
16581 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16582 .doit = nl80211_pmsr_start,
16583 .flags = GENL_UNS_ADMIN_PERM,
16584 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16585 },
16586 {
16587 .cmd = NL80211_CMD_NOTIFY_RADAR,
16588 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16589 .doit = nl80211_notify_radar_detection,
16590 .flags = GENL_UNS_ADMIN_PERM,
16591 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16592 },
16593 {
16594 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
16595 .doit = nl80211_update_owe_info,
16596 .flags = GENL_ADMIN_PERM,
16597 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16598 },
16599 {
16600 .cmd = NL80211_CMD_PROBE_MESH_LINK,
16601 .doit = nl80211_probe_mesh_link,
16602 .flags = GENL_UNS_ADMIN_PERM,
16603 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16604 },
16605 {
16606 .cmd = NL80211_CMD_SET_TID_CONFIG,
16607 .doit = nl80211_set_tid_config,
16608 .flags = GENL_UNS_ADMIN_PERM,
16609 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16610 NL80211_FLAG_MLO_VALID_LINK_ID),
16611 },
16612 {
16613 .cmd = NL80211_CMD_SET_SAR_SPECS,
16614 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16615 .doit = nl80211_set_sar_specs,
16616 .flags = GENL_UNS_ADMIN_PERM,
16617 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16618 NL80211_FLAG_NEED_RTNL),
16619 },
16620 {
16621 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
16622 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16623 .doit = nl80211_color_change,
16624 .flags = GENL_UNS_ADMIN_PERM,
16625 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16626 },
16627 {
16628 .cmd = NL80211_CMD_SET_FILS_AAD,
16629 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16630 .doit = nl80211_set_fils_aad,
16631 .flags = GENL_UNS_ADMIN_PERM,
16632 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16633 },
16634 {
16635 .cmd = NL80211_CMD_ADD_LINK,
16636 .doit = nl80211_add_link,
16637 .flags = GENL_UNS_ADMIN_PERM,
16638 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16639 },
16640 {
16641 .cmd = NL80211_CMD_REMOVE_LINK,
16642 .doit = nl80211_remove_link,
16643 .flags = GENL_UNS_ADMIN_PERM,
16644 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16645 NL80211_FLAG_MLO_VALID_LINK_ID),
16646 },
16647 };
16648
16649 static struct genl_family nl80211_fam __ro_after_init = {
16650 .name = NL80211_GENL_NAME, /* have users key off the name instead */
16651 .hdrsize = 0, /* no private header */
16652 .version = 1, /* no particular meaning now */
16653 .maxattr = NL80211_ATTR_MAX,
16654 .policy = nl80211_policy,
16655 .netnsok = true,
16656 .pre_doit = nl80211_pre_doit,
16657 .post_doit = nl80211_post_doit,
16658 .module = THIS_MODULE,
16659 .ops = nl80211_ops,
16660 .n_ops = ARRAY_SIZE(nl80211_ops),
16661 .small_ops = nl80211_small_ops,
16662 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
16663 .mcgrps = nl80211_mcgrps,
16664 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
16665 .parallel_ops = true,
16666 };
16667
16668 /* notification functions */
16669
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)16670 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
16671 enum nl80211_commands cmd)
16672 {
16673 struct sk_buff *msg;
16674 struct nl80211_dump_wiphy_state state = {};
16675
16676 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
16677 cmd != NL80211_CMD_DEL_WIPHY);
16678
16679 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16680 if (!msg)
16681 return;
16682
16683 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
16684 nlmsg_free(msg);
16685 return;
16686 }
16687
16688 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16689 NL80211_MCGRP_CONFIG, GFP_KERNEL);
16690 }
16691
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)16692 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
16693 struct wireless_dev *wdev,
16694 enum nl80211_commands cmd)
16695 {
16696 struct sk_buff *msg;
16697
16698 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16699 if (!msg)
16700 return;
16701
16702 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
16703 nlmsg_free(msg);
16704 return;
16705 }
16706
16707 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16708 NL80211_MCGRP_CONFIG, GFP_KERNEL);
16709 }
16710
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)16711 static int nl80211_add_scan_req(struct sk_buff *msg,
16712 struct cfg80211_registered_device *rdev)
16713 {
16714 struct cfg80211_scan_request *req = rdev->scan_req;
16715 struct nlattr *nest;
16716 int i;
16717 struct cfg80211_scan_info *info;
16718
16719 if (WARN_ON(!req))
16720 return 0;
16721
16722 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
16723 if (!nest)
16724 goto nla_put_failure;
16725 for (i = 0; i < req->n_ssids; i++) {
16726 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
16727 goto nla_put_failure;
16728 }
16729 nla_nest_end(msg, nest);
16730
16731 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
16732 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
16733 if (!nest)
16734 goto nla_put_failure;
16735 for (i = 0; i < req->n_channels; i++) {
16736 if (nla_put_u32(msg, i,
16737 ieee80211_channel_to_khz(req->channels[i])))
16738 goto nla_put_failure;
16739 }
16740 nla_nest_end(msg, nest);
16741 } else {
16742 nest = nla_nest_start_noflag(msg,
16743 NL80211_ATTR_SCAN_FREQUENCIES);
16744 if (!nest)
16745 goto nla_put_failure;
16746 for (i = 0; i < req->n_channels; i++) {
16747 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
16748 goto nla_put_failure;
16749 }
16750 nla_nest_end(msg, nest);
16751 }
16752
16753 if (req->ie &&
16754 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
16755 goto nla_put_failure;
16756
16757 if (req->flags &&
16758 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
16759 goto nla_put_failure;
16760
16761 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
16762 &rdev->scan_req->info;
16763 if (info->scan_start_tsf &&
16764 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
16765 info->scan_start_tsf, NL80211_BSS_PAD) ||
16766 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
16767 info->tsf_bssid)))
16768 goto nla_put_failure;
16769
16770 return 0;
16771 nla_put_failure:
16772 return -ENOBUFS;
16773 }
16774
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)16775 static int nl80211_prep_scan_msg(struct sk_buff *msg,
16776 struct cfg80211_registered_device *rdev,
16777 struct wireless_dev *wdev,
16778 u32 portid, u32 seq, int flags,
16779 u32 cmd)
16780 {
16781 void *hdr;
16782
16783 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
16784 if (!hdr)
16785 return -1;
16786
16787 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16788 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16789 wdev->netdev->ifindex)) ||
16790 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16791 NL80211_ATTR_PAD))
16792 goto nla_put_failure;
16793
16794 /* ignore errors and send incomplete event anyway */
16795 nl80211_add_scan_req(msg, rdev);
16796
16797 genlmsg_end(msg, hdr);
16798 return 0;
16799
16800 nla_put_failure:
16801 genlmsg_cancel(msg, hdr);
16802 return -EMSGSIZE;
16803 }
16804
16805 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)16806 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
16807 struct cfg80211_sched_scan_request *req, u32 cmd)
16808 {
16809 void *hdr;
16810
16811 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16812 if (!hdr)
16813 return -1;
16814
16815 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
16816 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
16817 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
16818 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
16819 NL80211_ATTR_PAD))
16820 goto nla_put_failure;
16821
16822 genlmsg_end(msg, hdr);
16823 return 0;
16824
16825 nla_put_failure:
16826 genlmsg_cancel(msg, hdr);
16827 return -EMSGSIZE;
16828 }
16829
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)16830 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
16831 struct wireless_dev *wdev)
16832 {
16833 struct sk_buff *msg;
16834
16835 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16836 if (!msg)
16837 return;
16838
16839 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
16840 NL80211_CMD_TRIGGER_SCAN) < 0) {
16841 nlmsg_free(msg);
16842 return;
16843 }
16844
16845 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16846 NL80211_MCGRP_SCAN, GFP_KERNEL);
16847 }
16848
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)16849 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
16850 struct wireless_dev *wdev, bool aborted)
16851 {
16852 struct sk_buff *msg;
16853
16854 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16855 if (!msg)
16856 return NULL;
16857
16858 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
16859 aborted ? NL80211_CMD_SCAN_ABORTED :
16860 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
16861 nlmsg_free(msg);
16862 return NULL;
16863 }
16864
16865 return msg;
16866 }
16867
16868 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)16869 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
16870 struct sk_buff *msg)
16871 {
16872 if (!msg)
16873 return;
16874
16875 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16876 NL80211_MCGRP_SCAN, GFP_KERNEL);
16877 }
16878
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)16879 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
16880 {
16881 struct sk_buff *msg;
16882
16883 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16884 if (!msg)
16885 return;
16886
16887 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
16888 nlmsg_free(msg);
16889 return;
16890 }
16891
16892 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
16893 NL80211_MCGRP_SCAN, GFP_KERNEL);
16894 }
16895
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)16896 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
16897 struct regulatory_request *request)
16898 {
16899 /* Userspace can always count this one always being set */
16900 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
16901 goto nla_put_failure;
16902
16903 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
16904 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16905 NL80211_REGDOM_TYPE_WORLD))
16906 goto nla_put_failure;
16907 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
16908 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16909 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
16910 goto nla_put_failure;
16911 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
16912 request->intersect) {
16913 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16914 NL80211_REGDOM_TYPE_INTERSECTION))
16915 goto nla_put_failure;
16916 } else {
16917 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16918 NL80211_REGDOM_TYPE_COUNTRY) ||
16919 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
16920 request->alpha2))
16921 goto nla_put_failure;
16922 }
16923
16924 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
16925 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
16926
16927 if (wiphy &&
16928 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
16929 goto nla_put_failure;
16930
16931 if (wiphy &&
16932 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
16933 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
16934 goto nla_put_failure;
16935 }
16936
16937 return true;
16938
16939 nla_put_failure:
16940 return false;
16941 }
16942
16943 /*
16944 * This can happen on global regulatory changes or device specific settings
16945 * based on custom regulatory domains.
16946 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)16947 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
16948 struct regulatory_request *request)
16949 {
16950 struct sk_buff *msg;
16951 void *hdr;
16952
16953 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16954 if (!msg)
16955 return;
16956
16957 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
16958 if (!hdr)
16959 goto nla_put_failure;
16960
16961 if (!nl80211_reg_change_event_fill(msg, request))
16962 goto nla_put_failure;
16963
16964 genlmsg_end(msg, hdr);
16965
16966 rcu_read_lock();
16967 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16968 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16969 rcu_read_unlock();
16970
16971 return;
16972
16973 nla_put_failure:
16974 nlmsg_free(msg);
16975 }
16976
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,enum nl80211_commands cmd,gfp_t gfp,int uapsd_queues,const u8 * req_ies,size_t req_ies_len,bool reconnect)16977 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
16978 struct net_device *netdev,
16979 const u8 *buf, size_t len,
16980 enum nl80211_commands cmd, gfp_t gfp,
16981 int uapsd_queues, const u8 *req_ies,
16982 size_t req_ies_len, bool reconnect)
16983 {
16984 struct sk_buff *msg;
16985 void *hdr;
16986
16987 msg = nlmsg_new(100 + len + req_ies_len, gfp);
16988 if (!msg)
16989 return;
16990
16991 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16992 if (!hdr) {
16993 nlmsg_free(msg);
16994 return;
16995 }
16996
16997 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16998 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16999 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17000 (req_ies &&
17001 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17002 goto nla_put_failure;
17003
17004 if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17005 goto nla_put_failure;
17006
17007 if (uapsd_queues >= 0) {
17008 struct nlattr *nla_wmm =
17009 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17010 if (!nla_wmm)
17011 goto nla_put_failure;
17012
17013 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17014 uapsd_queues))
17015 goto nla_put_failure;
17016
17017 nla_nest_end(msg, nla_wmm);
17018 }
17019
17020 genlmsg_end(msg, hdr);
17021
17022 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17023 NL80211_MCGRP_MLME, gfp);
17024 return;
17025
17026 nla_put_failure:
17027 nlmsg_free(msg);
17028 }
17029
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)17030 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17031 struct net_device *netdev, const u8 *buf,
17032 size_t len, gfp_t gfp)
17033 {
17034 nl80211_send_mlme_event(rdev, netdev, buf, len,
17035 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17036 false);
17037 }
17038
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp,int uapsd_queues,const u8 * req_ies,size_t req_ies_len)17039 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17040 struct net_device *netdev, const u8 *buf,
17041 size_t len, gfp_t gfp, int uapsd_queues,
17042 const u8 *req_ies, size_t req_ies_len)
17043 {
17044 nl80211_send_mlme_event(rdev, netdev, buf, len,
17045 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
17046 req_ies, req_ies_len, false);
17047 }
17048
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)17049 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17050 struct net_device *netdev, const u8 *buf,
17051 size_t len, bool reconnect, gfp_t gfp)
17052 {
17053 nl80211_send_mlme_event(rdev, netdev, buf, len,
17054 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17055 reconnect);
17056 }
17057
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)17058 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17059 struct net_device *netdev, const u8 *buf,
17060 size_t len, bool reconnect, gfp_t gfp)
17061 {
17062 nl80211_send_mlme_event(rdev, netdev, buf, len,
17063 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17064 reconnect);
17065 }
17066
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)17067 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17068 size_t len)
17069 {
17070 struct wireless_dev *wdev = dev->ieee80211_ptr;
17071 struct wiphy *wiphy = wdev->wiphy;
17072 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17073 const struct ieee80211_mgmt *mgmt = (void *)buf;
17074 u32 cmd;
17075
17076 if (WARN_ON(len < 2))
17077 return;
17078
17079 if (ieee80211_is_deauth(mgmt->frame_control)) {
17080 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17081 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17082 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17083 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17084 if (wdev->unprot_beacon_reported &&
17085 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17086 return;
17087 cmd = NL80211_CMD_UNPROT_BEACON;
17088 wdev->unprot_beacon_reported = jiffies;
17089 } else {
17090 return;
17091 }
17092
17093 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17094 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17095 NULL, 0, false);
17096 }
17097 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17098
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)17099 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17100 struct net_device *netdev, int cmd,
17101 const u8 *addr, gfp_t gfp)
17102 {
17103 struct sk_buff *msg;
17104 void *hdr;
17105
17106 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17107 if (!msg)
17108 return;
17109
17110 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17111 if (!hdr) {
17112 nlmsg_free(msg);
17113 return;
17114 }
17115
17116 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17117 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17118 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17119 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17120 goto nla_put_failure;
17121
17122 genlmsg_end(msg, hdr);
17123
17124 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17125 NL80211_MCGRP_MLME, gfp);
17126 return;
17127
17128 nla_put_failure:
17129 nlmsg_free(msg);
17130 }
17131
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)17132 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17133 struct net_device *netdev, const u8 *addr,
17134 gfp_t gfp)
17135 {
17136 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17137 addr, gfp);
17138 }
17139
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)17140 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17141 struct net_device *netdev, const u8 *addr,
17142 gfp_t gfp)
17143 {
17144 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17145 addr, gfp);
17146 }
17147
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)17148 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17149 struct net_device *netdev,
17150 struct cfg80211_connect_resp_params *cr,
17151 gfp_t gfp)
17152 {
17153 struct sk_buff *msg;
17154 void *hdr;
17155
17156 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17157 cr->fils.kek_len + cr->fils.pmk_len +
17158 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
17159 if (!msg)
17160 return;
17161
17162 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17163 if (!hdr) {
17164 nlmsg_free(msg);
17165 return;
17166 }
17167
17168 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17169 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17170 (cr->bssid &&
17171 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
17172 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
17173 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
17174 cr->status) ||
17175 (cr->status < 0 &&
17176 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17177 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
17178 cr->timeout_reason))) ||
17179 (cr->req_ie &&
17180 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
17181 (cr->resp_ie &&
17182 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
17183 cr->resp_ie)) ||
17184 (cr->fils.update_erp_next_seq_num &&
17185 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17186 cr->fils.erp_next_seq_num)) ||
17187 (cr->status == WLAN_STATUS_SUCCESS &&
17188 ((cr->fils.kek &&
17189 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
17190 cr->fils.kek)) ||
17191 (cr->fils.pmk &&
17192 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
17193 (cr->fils.pmkid &&
17194 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
17195 goto nla_put_failure;
17196
17197 genlmsg_end(msg, hdr);
17198
17199 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17200 NL80211_MCGRP_MLME, gfp);
17201 return;
17202
17203 nla_put_failure:
17204 nlmsg_free(msg);
17205 }
17206
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)17207 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
17208 struct net_device *netdev,
17209 struct cfg80211_roam_info *info, gfp_t gfp)
17210 {
17211 struct sk_buff *msg;
17212 void *hdr;
17213 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
17214
17215 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
17216 info->fils.kek_len + info->fils.pmk_len +
17217 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
17218 if (!msg)
17219 return;
17220
17221 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
17222 if (!hdr) {
17223 nlmsg_free(msg);
17224 return;
17225 }
17226
17227 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17228 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17229 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
17230 (info->req_ie &&
17231 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
17232 info->req_ie)) ||
17233 (info->resp_ie &&
17234 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
17235 info->resp_ie)) ||
17236 (info->fils.update_erp_next_seq_num &&
17237 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17238 info->fils.erp_next_seq_num)) ||
17239 (info->fils.kek &&
17240 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
17241 info->fils.kek)) ||
17242 (info->fils.pmk &&
17243 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
17244 (info->fils.pmkid &&
17245 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
17246 goto nla_put_failure;
17247
17248 genlmsg_end(msg, hdr);
17249
17250 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17251 NL80211_MCGRP_MLME, gfp);
17252 return;
17253
17254 nla_put_failure:
17255 nlmsg_free(msg);
17256 }
17257
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid)17258 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
17259 struct net_device *netdev, const u8 *bssid)
17260 {
17261 struct sk_buff *msg;
17262 void *hdr;
17263
17264 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17265 if (!msg)
17266 return;
17267
17268 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
17269 if (!hdr) {
17270 nlmsg_free(msg);
17271 return;
17272 }
17273
17274 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17275 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17276 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17277 goto nla_put_failure;
17278
17279 genlmsg_end(msg, hdr);
17280
17281 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17282 NL80211_MCGRP_MLME, GFP_KERNEL);
17283 return;
17284
17285 nla_put_failure:
17286 nlmsg_free(msg);
17287 }
17288
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)17289 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
17290 struct net_device *netdev, u16 reason,
17291 const u8 *ie, size_t ie_len, bool from_ap)
17292 {
17293 struct sk_buff *msg;
17294 void *hdr;
17295
17296 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
17297 if (!msg)
17298 return;
17299
17300 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
17301 if (!hdr) {
17302 nlmsg_free(msg);
17303 return;
17304 }
17305
17306 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17307 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17308 (reason &&
17309 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
17310 (from_ap &&
17311 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
17312 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
17313 goto nla_put_failure;
17314
17315 genlmsg_end(msg, hdr);
17316
17317 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17318 NL80211_MCGRP_MLME, GFP_KERNEL);
17319 return;
17320
17321 nla_put_failure:
17322 nlmsg_free(msg);
17323 }
17324
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)17325 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
17326 struct net_device *netdev, const u8 *bssid,
17327 gfp_t gfp)
17328 {
17329 struct sk_buff *msg;
17330 void *hdr;
17331
17332 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17333 if (!msg)
17334 return;
17335
17336 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
17337 if (!hdr) {
17338 nlmsg_free(msg);
17339 return;
17340 }
17341
17342 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17343 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17344 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17345 goto nla_put_failure;
17346
17347 genlmsg_end(msg, hdr);
17348
17349 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17350 NL80211_MCGRP_MLME, gfp);
17351 return;
17352
17353 nla_put_failure:
17354 nlmsg_free(msg);
17355 }
17356
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)17357 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
17358 const u8 *ie, u8 ie_len,
17359 int sig_dbm, gfp_t gfp)
17360 {
17361 struct wireless_dev *wdev = dev->ieee80211_ptr;
17362 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17363 struct sk_buff *msg;
17364 void *hdr;
17365
17366 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
17367 return;
17368
17369 trace_cfg80211_notify_new_peer_candidate(dev, addr);
17370
17371 msg = nlmsg_new(100 + ie_len, gfp);
17372 if (!msg)
17373 return;
17374
17375 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
17376 if (!hdr) {
17377 nlmsg_free(msg);
17378 return;
17379 }
17380
17381 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17382 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17383 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17384 (ie_len && ie &&
17385 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
17386 (sig_dbm &&
17387 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
17388 goto nla_put_failure;
17389
17390 genlmsg_end(msg, hdr);
17391
17392 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17393 NL80211_MCGRP_MLME, gfp);
17394 return;
17395
17396 nla_put_failure:
17397 nlmsg_free(msg);
17398 }
17399 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
17400
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)17401 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
17402 struct net_device *netdev, const u8 *addr,
17403 enum nl80211_key_type key_type, int key_id,
17404 const u8 *tsc, gfp_t gfp)
17405 {
17406 struct sk_buff *msg;
17407 void *hdr;
17408
17409 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17410 if (!msg)
17411 return;
17412
17413 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
17414 if (!hdr) {
17415 nlmsg_free(msg);
17416 return;
17417 }
17418
17419 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17420 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17421 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
17422 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
17423 (key_id != -1 &&
17424 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
17425 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
17426 goto nla_put_failure;
17427
17428 genlmsg_end(msg, hdr);
17429
17430 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17431 NL80211_MCGRP_MLME, gfp);
17432 return;
17433
17434 nla_put_failure:
17435 nlmsg_free(msg);
17436 }
17437
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)17438 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
17439 struct ieee80211_channel *channel_before,
17440 struct ieee80211_channel *channel_after)
17441 {
17442 struct sk_buff *msg;
17443 void *hdr;
17444 struct nlattr *nl_freq;
17445
17446 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
17447 if (!msg)
17448 return;
17449
17450 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
17451 if (!hdr) {
17452 nlmsg_free(msg);
17453 return;
17454 }
17455
17456 /*
17457 * Since we are applying the beacon hint to a wiphy we know its
17458 * wiphy_idx is valid
17459 */
17460 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
17461 goto nla_put_failure;
17462
17463 /* Before */
17464 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
17465 if (!nl_freq)
17466 goto nla_put_failure;
17467
17468 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
17469 goto nla_put_failure;
17470 nla_nest_end(msg, nl_freq);
17471
17472 /* After */
17473 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
17474 if (!nl_freq)
17475 goto nla_put_failure;
17476
17477 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
17478 goto nla_put_failure;
17479 nla_nest_end(msg, nl_freq);
17480
17481 genlmsg_end(msg, hdr);
17482
17483 rcu_read_lock();
17484 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17485 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17486 rcu_read_unlock();
17487
17488 return;
17489
17490 nla_put_failure:
17491 nlmsg_free(msg);
17492 }
17493
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)17494 static void nl80211_send_remain_on_chan_event(
17495 int cmd, struct cfg80211_registered_device *rdev,
17496 struct wireless_dev *wdev, u64 cookie,
17497 struct ieee80211_channel *chan,
17498 unsigned int duration, gfp_t gfp)
17499 {
17500 struct sk_buff *msg;
17501 void *hdr;
17502
17503 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17504 if (!msg)
17505 return;
17506
17507 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17508 if (!hdr) {
17509 nlmsg_free(msg);
17510 return;
17511 }
17512
17513 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17514 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17515 wdev->netdev->ifindex)) ||
17516 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17517 NL80211_ATTR_PAD) ||
17518 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
17519 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
17520 NL80211_CHAN_NO_HT) ||
17521 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17522 NL80211_ATTR_PAD))
17523 goto nla_put_failure;
17524
17525 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
17526 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
17527 goto nla_put_failure;
17528
17529 genlmsg_end(msg, hdr);
17530
17531 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17532 NL80211_MCGRP_MLME, gfp);
17533 return;
17534
17535 nla_put_failure:
17536 nlmsg_free(msg);
17537 }
17538
cfg80211_assoc_comeback(struct net_device * netdev,struct cfg80211_bss * bss,u32 timeout)17539 void cfg80211_assoc_comeback(struct net_device *netdev,
17540 struct cfg80211_bss *bss, u32 timeout)
17541 {
17542 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17543 struct wiphy *wiphy = wdev->wiphy;
17544 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17545 struct sk_buff *msg;
17546 void *hdr;
17547
17548 trace_cfg80211_assoc_comeback(wdev, bss->bssid, timeout);
17549
17550 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17551 if (!msg)
17552 return;
17553
17554 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
17555 if (!hdr) {
17556 nlmsg_free(msg);
17557 return;
17558 }
17559
17560 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17561 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17562 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bss->bssid) ||
17563 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
17564 goto nla_put_failure;
17565
17566 genlmsg_end(msg, hdr);
17567
17568 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17569 NL80211_MCGRP_MLME, GFP_KERNEL);
17570 return;
17571
17572 nla_put_failure:
17573 nlmsg_free(msg);
17574 }
17575 EXPORT_SYMBOL(cfg80211_assoc_comeback);
17576
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)17577 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
17578 struct ieee80211_channel *chan,
17579 unsigned int duration, gfp_t gfp)
17580 {
17581 struct wiphy *wiphy = wdev->wiphy;
17582 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17583
17584 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
17585 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
17586 rdev, wdev, cookie, chan,
17587 duration, gfp);
17588 }
17589 EXPORT_SYMBOL(cfg80211_ready_on_channel);
17590
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)17591 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
17592 struct ieee80211_channel *chan,
17593 gfp_t gfp)
17594 {
17595 struct wiphy *wiphy = wdev->wiphy;
17596 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17597
17598 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
17599 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17600 rdev, wdev, cookie, chan, 0, gfp);
17601 }
17602 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
17603
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)17604 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
17605 struct ieee80211_channel *chan,
17606 gfp_t gfp)
17607 {
17608 struct wiphy *wiphy = wdev->wiphy;
17609 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17610
17611 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
17612 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
17613 rdev, wdev, cookie, chan, 0, gfp);
17614 }
17615 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
17616
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)17617 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
17618 struct station_info *sinfo, gfp_t gfp)
17619 {
17620 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
17621 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17622 struct sk_buff *msg;
17623
17624 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
17625
17626 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17627 if (!msg)
17628 return;
17629
17630 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
17631 rdev, dev, mac_addr, sinfo) < 0) {
17632 nlmsg_free(msg);
17633 return;
17634 }
17635
17636 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17637 NL80211_MCGRP_MLME, gfp);
17638 }
17639 EXPORT_SYMBOL(cfg80211_new_sta);
17640
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)17641 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
17642 struct station_info *sinfo, gfp_t gfp)
17643 {
17644 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
17645 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17646 struct sk_buff *msg;
17647 struct station_info empty_sinfo = {};
17648
17649 if (!sinfo)
17650 sinfo = &empty_sinfo;
17651
17652 trace_cfg80211_del_sta(dev, mac_addr);
17653
17654 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17655 if (!msg) {
17656 cfg80211_sinfo_release_content(sinfo);
17657 return;
17658 }
17659
17660 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
17661 rdev, dev, mac_addr, sinfo) < 0) {
17662 nlmsg_free(msg);
17663 return;
17664 }
17665
17666 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17667 NL80211_MCGRP_MLME, gfp);
17668 }
17669 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
17670
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)17671 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
17672 enum nl80211_connect_failed_reason reason,
17673 gfp_t gfp)
17674 {
17675 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
17676 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17677 struct sk_buff *msg;
17678 void *hdr;
17679
17680 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
17681 if (!msg)
17682 return;
17683
17684 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
17685 if (!hdr) {
17686 nlmsg_free(msg);
17687 return;
17688 }
17689
17690 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17691 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
17692 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
17693 goto nla_put_failure;
17694
17695 genlmsg_end(msg, hdr);
17696
17697 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17698 NL80211_MCGRP_MLME, gfp);
17699 return;
17700
17701 nla_put_failure:
17702 nlmsg_free(msg);
17703 }
17704 EXPORT_SYMBOL(cfg80211_conn_failed);
17705
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)17706 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
17707 const u8 *addr, gfp_t gfp)
17708 {
17709 struct wireless_dev *wdev = dev->ieee80211_ptr;
17710 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17711 struct sk_buff *msg;
17712 void *hdr;
17713 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
17714
17715 if (!nlportid)
17716 return false;
17717
17718 msg = nlmsg_new(100, gfp);
17719 if (!msg)
17720 return true;
17721
17722 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17723 if (!hdr) {
17724 nlmsg_free(msg);
17725 return true;
17726 }
17727
17728 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17729 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17730 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17731 goto nla_put_failure;
17732
17733 genlmsg_end(msg, hdr);
17734 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17735 return true;
17736
17737 nla_put_failure:
17738 nlmsg_free(msg);
17739 return true;
17740 }
17741
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)17742 bool cfg80211_rx_spurious_frame(struct net_device *dev,
17743 const u8 *addr, gfp_t gfp)
17744 {
17745 struct wireless_dev *wdev = dev->ieee80211_ptr;
17746 bool ret;
17747
17748 trace_cfg80211_rx_spurious_frame(dev, addr);
17749
17750 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
17751 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
17752 trace_cfg80211_return_bool(false);
17753 return false;
17754 }
17755 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
17756 addr, gfp);
17757 trace_cfg80211_return_bool(ret);
17758 return ret;
17759 }
17760 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
17761
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)17762 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
17763 const u8 *addr, gfp_t gfp)
17764 {
17765 struct wireless_dev *wdev = dev->ieee80211_ptr;
17766 bool ret;
17767
17768 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
17769
17770 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
17771 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
17772 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
17773 trace_cfg80211_return_bool(false);
17774 return false;
17775 }
17776 ret = __nl80211_unexpected_frame(dev,
17777 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
17778 addr, gfp);
17779 trace_cfg80211_return_bool(ret);
17780 return ret;
17781 }
17782 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
17783
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,int freq,int sig_dbm,const u8 * buf,size_t len,u32 flags,gfp_t gfp)17784 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
17785 struct wireless_dev *wdev, u32 nlportid,
17786 int freq, int sig_dbm,
17787 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
17788 {
17789 struct net_device *netdev = wdev->netdev;
17790 struct sk_buff *msg;
17791 void *hdr;
17792
17793 msg = nlmsg_new(100 + len, gfp);
17794 if (!msg)
17795 return -ENOMEM;
17796
17797 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17798 if (!hdr) {
17799 nlmsg_free(msg);
17800 return -ENOMEM;
17801 }
17802
17803 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17804 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17805 netdev->ifindex)) ||
17806 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17807 NL80211_ATTR_PAD) ||
17808 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
17809 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
17810 (sig_dbm &&
17811 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17812 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17813 (flags &&
17814 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
17815 goto nla_put_failure;
17816
17817 genlmsg_end(msg, hdr);
17818
17819 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17820
17821 nla_put_failure:
17822 nlmsg_free(msg);
17823 return -ENOBUFS;
17824 }
17825
nl80211_frame_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp,enum nl80211_commands command)17826 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
17827 const u8 *buf, size_t len, bool ack,
17828 gfp_t gfp, enum nl80211_commands command)
17829 {
17830 struct wiphy *wiphy = wdev->wiphy;
17831 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17832 struct net_device *netdev = wdev->netdev;
17833 struct sk_buff *msg;
17834 void *hdr;
17835
17836 if (command == NL80211_CMD_FRAME_TX_STATUS)
17837 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
17838 else
17839 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
17840
17841 msg = nlmsg_new(100 + len, gfp);
17842 if (!msg)
17843 return;
17844
17845 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
17846 if (!hdr) {
17847 nlmsg_free(msg);
17848 return;
17849 }
17850
17851 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17852 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17853 netdev->ifindex)) ||
17854 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17855 NL80211_ATTR_PAD) ||
17856 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17857 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17858 NL80211_ATTR_PAD) ||
17859 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
17860 goto nla_put_failure;
17861
17862 genlmsg_end(msg, hdr);
17863
17864 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17865 NL80211_MCGRP_MLME, gfp);
17866 return;
17867
17868 nla_put_failure:
17869 nlmsg_free(msg);
17870 }
17871
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)17872 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
17873 const u8 *buf, size_t len, bool ack,
17874 gfp_t gfp)
17875 {
17876 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
17877 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
17878 }
17879 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
17880
cfg80211_mgmt_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)17881 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
17882 const u8 *buf, size_t len, bool ack, gfp_t gfp)
17883 {
17884 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
17885 NL80211_CMD_FRAME_TX_STATUS);
17886 }
17887 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
17888
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,gfp_t gfp)17889 static int __nl80211_rx_control_port(struct net_device *dev,
17890 struct sk_buff *skb,
17891 bool unencrypted, gfp_t gfp)
17892 {
17893 struct wireless_dev *wdev = dev->ieee80211_ptr;
17894 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17895 struct ethhdr *ehdr = eth_hdr(skb);
17896 const u8 *addr = ehdr->h_source;
17897 u16 proto = be16_to_cpu(skb->protocol);
17898 struct sk_buff *msg;
17899 void *hdr;
17900 struct nlattr *frame;
17901
17902 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
17903
17904 if (!nlportid)
17905 return -ENOENT;
17906
17907 msg = nlmsg_new(100 + skb->len, gfp);
17908 if (!msg)
17909 return -ENOMEM;
17910
17911 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
17912 if (!hdr) {
17913 nlmsg_free(msg);
17914 return -ENOBUFS;
17915 }
17916
17917 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17918 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17919 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17920 NL80211_ATTR_PAD) ||
17921 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17922 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
17923 (unencrypted && nla_put_flag(msg,
17924 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
17925 goto nla_put_failure;
17926
17927 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
17928 if (!frame)
17929 goto nla_put_failure;
17930
17931 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
17932 genlmsg_end(msg, hdr);
17933
17934 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17935
17936 nla_put_failure:
17937 nlmsg_free(msg);
17938 return -ENOBUFS;
17939 }
17940
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted)17941 bool cfg80211_rx_control_port(struct net_device *dev,
17942 struct sk_buff *skb, bool unencrypted)
17943 {
17944 int ret;
17945
17946 trace_cfg80211_rx_control_port(dev, skb, unencrypted);
17947 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
17948 trace_cfg80211_return_bool(ret == 0);
17949 return ret == 0;
17950 }
17951 EXPORT_SYMBOL(cfg80211_rx_control_port);
17952
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)17953 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
17954 const char *mac, gfp_t gfp)
17955 {
17956 struct wireless_dev *wdev = dev->ieee80211_ptr;
17957 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17958 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17959 void **cb;
17960
17961 if (!msg)
17962 return NULL;
17963
17964 cb = (void **)msg->cb;
17965
17966 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
17967 if (!cb[0]) {
17968 nlmsg_free(msg);
17969 return NULL;
17970 }
17971
17972 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17973 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17974 goto nla_put_failure;
17975
17976 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17977 goto nla_put_failure;
17978
17979 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
17980 if (!cb[1])
17981 goto nla_put_failure;
17982
17983 cb[2] = rdev;
17984
17985 return msg;
17986 nla_put_failure:
17987 nlmsg_free(msg);
17988 return NULL;
17989 }
17990
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)17991 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
17992 {
17993 void **cb = (void **)msg->cb;
17994 struct cfg80211_registered_device *rdev = cb[2];
17995
17996 nla_nest_end(msg, cb[1]);
17997 genlmsg_end(msg, cb[0]);
17998
17999 memset(msg->cb, 0, sizeof(msg->cb));
18000
18001 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18002 NL80211_MCGRP_MLME, gfp);
18003 }
18004
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)18005 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18006 enum nl80211_cqm_rssi_threshold_event rssi_event,
18007 s32 rssi_level, gfp_t gfp)
18008 {
18009 struct sk_buff *msg;
18010 struct wireless_dev *wdev = dev->ieee80211_ptr;
18011 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18012
18013 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
18014
18015 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
18016 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
18017 return;
18018
18019 if (wdev->cqm_config) {
18020 wdev->cqm_config->last_rssi_event_value = rssi_level;
18021
18022 cfg80211_cqm_rssi_update(rdev, dev);
18023
18024 if (rssi_level == 0)
18025 rssi_level = wdev->cqm_config->last_rssi_event_value;
18026 }
18027
18028 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18029 if (!msg)
18030 return;
18031
18032 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
18033 rssi_event))
18034 goto nla_put_failure;
18035
18036 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
18037 rssi_level))
18038 goto nla_put_failure;
18039
18040 cfg80211_send_cqm(msg, gfp);
18041
18042 return;
18043
18044 nla_put_failure:
18045 nlmsg_free(msg);
18046 }
18047 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
18048
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)18049 void cfg80211_cqm_txe_notify(struct net_device *dev,
18050 const u8 *peer, u32 num_packets,
18051 u32 rate, u32 intvl, gfp_t gfp)
18052 {
18053 struct sk_buff *msg;
18054
18055 msg = cfg80211_prepare_cqm(dev, peer, gfp);
18056 if (!msg)
18057 return;
18058
18059 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
18060 goto nla_put_failure;
18061
18062 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
18063 goto nla_put_failure;
18064
18065 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
18066 goto nla_put_failure;
18067
18068 cfg80211_send_cqm(msg, gfp);
18069 return;
18070
18071 nla_put_failure:
18072 nlmsg_free(msg);
18073 }
18074 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
18075
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)18076 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
18077 const u8 *peer, u32 num_packets, gfp_t gfp)
18078 {
18079 struct sk_buff *msg;
18080
18081 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
18082
18083 msg = cfg80211_prepare_cqm(dev, peer, gfp);
18084 if (!msg)
18085 return;
18086
18087 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
18088 goto nla_put_failure;
18089
18090 cfg80211_send_cqm(msg, gfp);
18091 return;
18092
18093 nla_put_failure:
18094 nlmsg_free(msg);
18095 }
18096 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
18097
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)18098 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
18099 {
18100 struct sk_buff *msg;
18101
18102 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18103 if (!msg)
18104 return;
18105
18106 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
18107 goto nla_put_failure;
18108
18109 cfg80211_send_cqm(msg, gfp);
18110 return;
18111
18112 nla_put_failure:
18113 nlmsg_free(msg);
18114 }
18115 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
18116
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)18117 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
18118 struct net_device *netdev, const u8 *bssid,
18119 const u8 *replay_ctr, gfp_t gfp)
18120 {
18121 struct sk_buff *msg;
18122 struct nlattr *rekey_attr;
18123 void *hdr;
18124
18125 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18126 if (!msg)
18127 return;
18128
18129 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
18130 if (!hdr) {
18131 nlmsg_free(msg);
18132 return;
18133 }
18134
18135 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18136 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18137 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18138 goto nla_put_failure;
18139
18140 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
18141 if (!rekey_attr)
18142 goto nla_put_failure;
18143
18144 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
18145 NL80211_REPLAY_CTR_LEN, replay_ctr))
18146 goto nla_put_failure;
18147
18148 nla_nest_end(msg, rekey_attr);
18149
18150 genlmsg_end(msg, hdr);
18151
18152 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18153 NL80211_MCGRP_MLME, gfp);
18154 return;
18155
18156 nla_put_failure:
18157 nlmsg_free(msg);
18158 }
18159
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)18160 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
18161 const u8 *replay_ctr, gfp_t gfp)
18162 {
18163 struct wireless_dev *wdev = dev->ieee80211_ptr;
18164 struct wiphy *wiphy = wdev->wiphy;
18165 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18166
18167 trace_cfg80211_gtk_rekey_notify(dev, bssid);
18168 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
18169 }
18170 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
18171
18172 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)18173 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
18174 struct net_device *netdev, int index,
18175 const u8 *bssid, bool preauth, gfp_t gfp)
18176 {
18177 struct sk_buff *msg;
18178 struct nlattr *attr;
18179 void *hdr;
18180
18181 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18182 if (!msg)
18183 return;
18184
18185 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
18186 if (!hdr) {
18187 nlmsg_free(msg);
18188 return;
18189 }
18190
18191 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18192 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
18193 goto nla_put_failure;
18194
18195 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
18196 if (!attr)
18197 goto nla_put_failure;
18198
18199 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
18200 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
18201 (preauth &&
18202 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
18203 goto nla_put_failure;
18204
18205 nla_nest_end(msg, attr);
18206
18207 genlmsg_end(msg, hdr);
18208
18209 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18210 NL80211_MCGRP_MLME, gfp);
18211 return;
18212
18213 nla_put_failure:
18214 nlmsg_free(msg);
18215 }
18216
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)18217 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
18218 const u8 *bssid, bool preauth, gfp_t gfp)
18219 {
18220 struct wireless_dev *wdev = dev->ieee80211_ptr;
18221 struct wiphy *wiphy = wdev->wiphy;
18222 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18223
18224 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
18225 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
18226 }
18227 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
18228
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet)18229 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
18230 struct net_device *netdev,
18231 struct cfg80211_chan_def *chandef,
18232 gfp_t gfp,
18233 enum nl80211_commands notif,
18234 u8 count, bool quiet)
18235 {
18236 struct sk_buff *msg;
18237 void *hdr;
18238
18239 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18240 if (!msg)
18241 return;
18242
18243 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
18244 if (!hdr) {
18245 nlmsg_free(msg);
18246 return;
18247 }
18248
18249 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
18250 goto nla_put_failure;
18251
18252 if (nl80211_send_chandef(msg, chandef))
18253 goto nla_put_failure;
18254
18255 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
18256 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
18257 goto nla_put_failure;
18258 if (quiet &&
18259 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
18260 goto nla_put_failure;
18261 }
18262
18263 genlmsg_end(msg, hdr);
18264
18265 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18266 NL80211_MCGRP_MLME, gfp);
18267 return;
18268
18269 nla_put_failure:
18270 nlmsg_free(msg);
18271 }
18272
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id)18273 void cfg80211_ch_switch_notify(struct net_device *dev,
18274 struct cfg80211_chan_def *chandef,
18275 unsigned int link_id)
18276 {
18277 struct wireless_dev *wdev = dev->ieee80211_ptr;
18278 struct wiphy *wiphy = wdev->wiphy;
18279 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18280
18281 ASSERT_WDEV_LOCK(wdev);
18282 WARN_INVALID_LINK_ID(wdev, link_id);
18283
18284 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
18285
18286 switch (wdev->iftype) {
18287 case NL80211_IFTYPE_STATION:
18288 case NL80211_IFTYPE_P2P_CLIENT:
18289 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
18290 cfg80211_update_assoc_bss_entry(wdev, link_id,
18291 chandef->chan);
18292 break;
18293 case NL80211_IFTYPE_MESH_POINT:
18294 wdev->u.mesh.chandef = *chandef;
18295 wdev->u.mesh.preset_chandef = *chandef;
18296 break;
18297 case NL80211_IFTYPE_AP:
18298 case NL80211_IFTYPE_P2P_GO:
18299 wdev->links[link_id].ap.chandef = *chandef;
18300 break;
18301 case NL80211_IFTYPE_ADHOC:
18302 wdev->u.ibss.chandef = *chandef;
18303 break;
18304 default:
18305 WARN_ON(1);
18306 break;
18307 }
18308
18309 cfg80211_sched_dfs_chan_update(rdev);
18310
18311 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
18312 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
18313 }
18314 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
18315
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,u8 count,bool quiet)18316 void cfg80211_ch_switch_started_notify(struct net_device *dev,
18317 struct cfg80211_chan_def *chandef,
18318 u8 count, bool quiet)
18319 {
18320 struct wireless_dev *wdev = dev->ieee80211_ptr;
18321 struct wiphy *wiphy = wdev->wiphy;
18322 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18323
18324 trace_cfg80211_ch_switch_started_notify(dev, chandef);
18325
18326 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
18327 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
18328 count, quiet);
18329 }
18330 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
18331
cfg80211_bss_color_notify(struct net_device * dev,gfp_t gfp,enum nl80211_commands cmd,u8 count,u64 color_bitmap)18332 int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
18333 enum nl80211_commands cmd, u8 count,
18334 u64 color_bitmap)
18335 {
18336 struct wireless_dev *wdev = dev->ieee80211_ptr;
18337 struct wiphy *wiphy = wdev->wiphy;
18338 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18339 struct sk_buff *msg;
18340 void *hdr;
18341
18342 ASSERT_WDEV_LOCK(wdev);
18343
18344 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
18345
18346 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18347 if (!msg)
18348 return -ENOMEM;
18349
18350 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18351 if (!hdr)
18352 goto nla_put_failure;
18353
18354 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18355 goto nla_put_failure;
18356
18357 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
18358 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
18359 goto nla_put_failure;
18360
18361 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
18362 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
18363 color_bitmap, NL80211_ATTR_PAD))
18364 goto nla_put_failure;
18365
18366 genlmsg_end(msg, hdr);
18367
18368 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
18369 msg, 0, NL80211_MCGRP_MLME, gfp);
18370
18371 nla_put_failure:
18372 nlmsg_free(msg);
18373 return -EINVAL;
18374 }
18375 EXPORT_SYMBOL(cfg80211_bss_color_notify);
18376
18377 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)18378 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
18379 const struct cfg80211_chan_def *chandef,
18380 enum nl80211_radar_event event,
18381 struct net_device *netdev, gfp_t gfp)
18382 {
18383 struct sk_buff *msg;
18384 void *hdr;
18385
18386 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18387 if (!msg)
18388 return;
18389
18390 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
18391 if (!hdr) {
18392 nlmsg_free(msg);
18393 return;
18394 }
18395
18396 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
18397 goto nla_put_failure;
18398
18399 /* NOP and radar events don't need a netdev parameter */
18400 if (netdev) {
18401 struct wireless_dev *wdev = netdev->ieee80211_ptr;
18402
18403 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18404 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18405 NL80211_ATTR_PAD))
18406 goto nla_put_failure;
18407 }
18408
18409 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
18410 goto nla_put_failure;
18411
18412 if (nl80211_send_chandef(msg, chandef))
18413 goto nla_put_failure;
18414
18415 genlmsg_end(msg, hdr);
18416
18417 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18418 NL80211_MCGRP_MLME, gfp);
18419 return;
18420
18421 nla_put_failure:
18422 nlmsg_free(msg);
18423 }
18424
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)18425 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
18426 struct sta_opmode_info *sta_opmode,
18427 gfp_t gfp)
18428 {
18429 struct sk_buff *msg;
18430 struct wireless_dev *wdev = dev->ieee80211_ptr;
18431 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18432 void *hdr;
18433
18434 if (WARN_ON(!mac))
18435 return;
18436
18437 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18438 if (!msg)
18439 return;
18440
18441 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
18442 if (!hdr) {
18443 nlmsg_free(msg);
18444 return;
18445 }
18446
18447 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
18448 goto nla_put_failure;
18449
18450 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18451 goto nla_put_failure;
18452
18453 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18454 goto nla_put_failure;
18455
18456 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
18457 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
18458 goto nla_put_failure;
18459
18460 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
18461 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
18462 goto nla_put_failure;
18463
18464 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
18465 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
18466 goto nla_put_failure;
18467
18468 genlmsg_end(msg, hdr);
18469
18470 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18471 NL80211_MCGRP_MLME, gfp);
18472
18473 return;
18474
18475 nla_put_failure:
18476 nlmsg_free(msg);
18477 }
18478 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
18479
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)18480 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
18481 u64 cookie, bool acked, s32 ack_signal,
18482 bool is_valid_ack_signal, gfp_t gfp)
18483 {
18484 struct wireless_dev *wdev = dev->ieee80211_ptr;
18485 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18486 struct sk_buff *msg;
18487 void *hdr;
18488
18489 trace_cfg80211_probe_status(dev, addr, cookie, acked);
18490
18491 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18492
18493 if (!msg)
18494 return;
18495
18496 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
18497 if (!hdr) {
18498 nlmsg_free(msg);
18499 return;
18500 }
18501
18502 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18503 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18504 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18505 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18506 NL80211_ATTR_PAD) ||
18507 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18508 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
18509 ack_signal)))
18510 goto nla_put_failure;
18511
18512 genlmsg_end(msg, hdr);
18513
18514 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18515 NL80211_MCGRP_MLME, gfp);
18516 return;
18517
18518 nla_put_failure:
18519 nlmsg_free(msg);
18520 }
18521 EXPORT_SYMBOL(cfg80211_probe_status);
18522
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)18523 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
18524 size_t len, int freq, int sig_dbm)
18525 {
18526 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18527 struct sk_buff *msg;
18528 void *hdr;
18529 struct cfg80211_beacon_registration *reg;
18530
18531 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
18532
18533 spin_lock_bh(&rdev->beacon_registrations_lock);
18534 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
18535 msg = nlmsg_new(len + 100, GFP_ATOMIC);
18536 if (!msg) {
18537 spin_unlock_bh(&rdev->beacon_registrations_lock);
18538 return;
18539 }
18540
18541 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18542 if (!hdr)
18543 goto nla_put_failure;
18544
18545 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18546 (freq &&
18547 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
18548 KHZ_TO_MHZ(freq)) ||
18549 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
18550 freq % 1000))) ||
18551 (sig_dbm &&
18552 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
18553 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
18554 goto nla_put_failure;
18555
18556 genlmsg_end(msg, hdr);
18557
18558 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
18559 }
18560 spin_unlock_bh(&rdev->beacon_registrations_lock);
18561 return;
18562
18563 nla_put_failure:
18564 spin_unlock_bh(&rdev->beacon_registrations_lock);
18565 nlmsg_free(msg);
18566 }
18567 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
18568
18569 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)18570 static int cfg80211_net_detect_results(struct sk_buff *msg,
18571 struct cfg80211_wowlan_wakeup *wakeup)
18572 {
18573 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
18574 struct nlattr *nl_results, *nl_match, *nl_freqs;
18575 int i, j;
18576
18577 nl_results = nla_nest_start_noflag(msg,
18578 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
18579 if (!nl_results)
18580 return -EMSGSIZE;
18581
18582 for (i = 0; i < nd->n_matches; i++) {
18583 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
18584
18585 nl_match = nla_nest_start_noflag(msg, i);
18586 if (!nl_match)
18587 break;
18588
18589 /* The SSID attribute is optional in nl80211, but for
18590 * simplicity reasons it's always present in the
18591 * cfg80211 structure. If a driver can't pass the
18592 * SSID, that needs to be changed. A zero length SSID
18593 * is still a valid SSID (wildcard), so it cannot be
18594 * used for this purpose.
18595 */
18596 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
18597 match->ssid.ssid)) {
18598 nla_nest_cancel(msg, nl_match);
18599 goto out;
18600 }
18601
18602 if (match->n_channels) {
18603 nl_freqs = nla_nest_start_noflag(msg,
18604 NL80211_ATTR_SCAN_FREQUENCIES);
18605 if (!nl_freqs) {
18606 nla_nest_cancel(msg, nl_match);
18607 goto out;
18608 }
18609
18610 for (j = 0; j < match->n_channels; j++) {
18611 if (nla_put_u32(msg, j, match->channels[j])) {
18612 nla_nest_cancel(msg, nl_freqs);
18613 nla_nest_cancel(msg, nl_match);
18614 goto out;
18615 }
18616 }
18617
18618 nla_nest_end(msg, nl_freqs);
18619 }
18620
18621 nla_nest_end(msg, nl_match);
18622 }
18623
18624 out:
18625 nla_nest_end(msg, nl_results);
18626 return 0;
18627 }
18628
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)18629 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
18630 struct cfg80211_wowlan_wakeup *wakeup,
18631 gfp_t gfp)
18632 {
18633 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18634 struct sk_buff *msg;
18635 void *hdr;
18636 int size = 200;
18637
18638 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
18639
18640 if (wakeup)
18641 size += wakeup->packet_present_len;
18642
18643 msg = nlmsg_new(size, gfp);
18644 if (!msg)
18645 return;
18646
18647 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
18648 if (!hdr)
18649 goto free_msg;
18650
18651 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18652 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18653 NL80211_ATTR_PAD))
18654 goto free_msg;
18655
18656 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18657 wdev->netdev->ifindex))
18658 goto free_msg;
18659
18660 if (wakeup) {
18661 struct nlattr *reasons;
18662
18663 reasons = nla_nest_start_noflag(msg,
18664 NL80211_ATTR_WOWLAN_TRIGGERS);
18665 if (!reasons)
18666 goto free_msg;
18667
18668 if (wakeup->disconnect &&
18669 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
18670 goto free_msg;
18671 if (wakeup->magic_pkt &&
18672 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
18673 goto free_msg;
18674 if (wakeup->gtk_rekey_failure &&
18675 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
18676 goto free_msg;
18677 if (wakeup->eap_identity_req &&
18678 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
18679 goto free_msg;
18680 if (wakeup->four_way_handshake &&
18681 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
18682 goto free_msg;
18683 if (wakeup->rfkill_release &&
18684 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
18685 goto free_msg;
18686
18687 if (wakeup->pattern_idx >= 0 &&
18688 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
18689 wakeup->pattern_idx))
18690 goto free_msg;
18691
18692 if (wakeup->tcp_match &&
18693 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
18694 goto free_msg;
18695
18696 if (wakeup->tcp_connlost &&
18697 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
18698 goto free_msg;
18699
18700 if (wakeup->tcp_nomoretokens &&
18701 nla_put_flag(msg,
18702 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
18703 goto free_msg;
18704
18705 if (wakeup->packet) {
18706 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
18707 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
18708
18709 if (!wakeup->packet_80211) {
18710 pkt_attr =
18711 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
18712 len_attr =
18713 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
18714 }
18715
18716 if (wakeup->packet_len &&
18717 nla_put_u32(msg, len_attr, wakeup->packet_len))
18718 goto free_msg;
18719
18720 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
18721 wakeup->packet))
18722 goto free_msg;
18723 }
18724
18725 if (wakeup->net_detect &&
18726 cfg80211_net_detect_results(msg, wakeup))
18727 goto free_msg;
18728
18729 nla_nest_end(msg, reasons);
18730 }
18731
18732 genlmsg_end(msg, hdr);
18733
18734 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18735 NL80211_MCGRP_MLME, gfp);
18736 return;
18737
18738 free_msg:
18739 nlmsg_free(msg);
18740 }
18741 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
18742 #endif
18743
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)18744 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
18745 enum nl80211_tdls_operation oper,
18746 u16 reason_code, gfp_t gfp)
18747 {
18748 struct wireless_dev *wdev = dev->ieee80211_ptr;
18749 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18750 struct sk_buff *msg;
18751 void *hdr;
18752
18753 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
18754 reason_code);
18755
18756 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18757 if (!msg)
18758 return;
18759
18760 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
18761 if (!hdr) {
18762 nlmsg_free(msg);
18763 return;
18764 }
18765
18766 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18767 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18768 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
18769 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
18770 (reason_code > 0 &&
18771 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
18772 goto nla_put_failure;
18773
18774 genlmsg_end(msg, hdr);
18775
18776 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18777 NL80211_MCGRP_MLME, gfp);
18778 return;
18779
18780 nla_put_failure:
18781 nlmsg_free(msg);
18782 }
18783 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
18784
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)18785 static int nl80211_netlink_notify(struct notifier_block * nb,
18786 unsigned long state,
18787 void *_notify)
18788 {
18789 struct netlink_notify *notify = _notify;
18790 struct cfg80211_registered_device *rdev;
18791 struct wireless_dev *wdev;
18792 struct cfg80211_beacon_registration *reg, *tmp;
18793
18794 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
18795 return NOTIFY_DONE;
18796
18797 rcu_read_lock();
18798
18799 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
18800 struct cfg80211_sched_scan_request *sched_scan_req;
18801
18802 list_for_each_entry_rcu(sched_scan_req,
18803 &rdev->sched_scan_req_list,
18804 list) {
18805 if (sched_scan_req->owner_nlportid == notify->portid) {
18806 sched_scan_req->nl_owner_dead = true;
18807 schedule_work(&rdev->sched_scan_stop_wk);
18808 }
18809 }
18810
18811 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
18812 cfg80211_mlme_unregister_socket(wdev, notify->portid);
18813
18814 if (wdev->owner_nlportid == notify->portid) {
18815 wdev->nl_owner_dead = true;
18816 schedule_work(&rdev->destroy_work);
18817 } else if (wdev->conn_owner_nlportid == notify->portid) {
18818 schedule_work(&wdev->disconnect_wk);
18819 }
18820
18821 cfg80211_release_pmsr(wdev, notify->portid);
18822 }
18823
18824 spin_lock_bh(&rdev->beacon_registrations_lock);
18825 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
18826 list) {
18827 if (reg->nlportid == notify->portid) {
18828 list_del(®->list);
18829 kfree(reg);
18830 break;
18831 }
18832 }
18833 spin_unlock_bh(&rdev->beacon_registrations_lock);
18834 }
18835
18836 rcu_read_unlock();
18837
18838 /*
18839 * It is possible that the user space process that is controlling the
18840 * indoor setting disappeared, so notify the regulatory core.
18841 */
18842 regulatory_netlink_notify(notify->portid);
18843 return NOTIFY_OK;
18844 }
18845
18846 static struct notifier_block nl80211_netlink_notifier = {
18847 .notifier_call = nl80211_netlink_notify,
18848 };
18849
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)18850 void cfg80211_ft_event(struct net_device *netdev,
18851 struct cfg80211_ft_event_params *ft_event)
18852 {
18853 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
18854 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18855 struct sk_buff *msg;
18856 void *hdr;
18857
18858 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
18859
18860 if (!ft_event->target_ap)
18861 return;
18862
18863 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
18864 GFP_KERNEL);
18865 if (!msg)
18866 return;
18867
18868 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
18869 if (!hdr)
18870 goto out;
18871
18872 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18873 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18874 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
18875 goto out;
18876
18877 if (ft_event->ies &&
18878 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
18879 goto out;
18880 if (ft_event->ric_ies &&
18881 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
18882 ft_event->ric_ies))
18883 goto out;
18884
18885 genlmsg_end(msg, hdr);
18886
18887 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18888 NL80211_MCGRP_MLME, GFP_KERNEL);
18889 return;
18890 out:
18891 nlmsg_free(msg);
18892 }
18893 EXPORT_SYMBOL(cfg80211_ft_event);
18894
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)18895 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
18896 {
18897 struct cfg80211_registered_device *rdev;
18898 struct sk_buff *msg;
18899 void *hdr;
18900 u32 nlportid;
18901
18902 rdev = wiphy_to_rdev(wdev->wiphy);
18903 if (!rdev->crit_proto_nlportid)
18904 return;
18905
18906 nlportid = rdev->crit_proto_nlportid;
18907 rdev->crit_proto_nlportid = 0;
18908
18909 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18910 if (!msg)
18911 return;
18912
18913 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
18914 if (!hdr)
18915 goto nla_put_failure;
18916
18917 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18918 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18919 NL80211_ATTR_PAD))
18920 goto nla_put_failure;
18921
18922 genlmsg_end(msg, hdr);
18923
18924 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18925 return;
18926
18927 nla_put_failure:
18928 nlmsg_free(msg);
18929 }
18930 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
18931
nl80211_send_ap_stopped(struct wireless_dev * wdev)18932 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
18933 {
18934 struct wiphy *wiphy = wdev->wiphy;
18935 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18936 struct sk_buff *msg;
18937 void *hdr;
18938
18939 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18940 if (!msg)
18941 return;
18942
18943 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
18944 if (!hdr)
18945 goto out;
18946
18947 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18948 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
18949 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18950 NL80211_ATTR_PAD))
18951 goto out;
18952
18953 genlmsg_end(msg, hdr);
18954
18955 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
18956 NL80211_MCGRP_MLME, GFP_KERNEL);
18957 return;
18958 out:
18959 nlmsg_free(msg);
18960 }
18961
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)18962 int cfg80211_external_auth_request(struct net_device *dev,
18963 struct cfg80211_external_auth_params *params,
18964 gfp_t gfp)
18965 {
18966 struct wireless_dev *wdev = dev->ieee80211_ptr;
18967 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18968 struct sk_buff *msg;
18969 void *hdr;
18970
18971 if (!wdev->conn_owner_nlportid)
18972 return -EINVAL;
18973
18974 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18975 if (!msg)
18976 return -ENOMEM;
18977
18978 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
18979 if (!hdr)
18980 goto nla_put_failure;
18981
18982 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18983 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18984 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
18985 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
18986 params->action) ||
18987 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
18988 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
18989 params->ssid.ssid))
18990 goto nla_put_failure;
18991
18992 genlmsg_end(msg, hdr);
18993 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
18994 wdev->conn_owner_nlportid);
18995 return 0;
18996
18997 nla_put_failure:
18998 nlmsg_free(msg);
18999 return -ENOBUFS;
19000 }
19001 EXPORT_SYMBOL(cfg80211_external_auth_request);
19002
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)19003 void cfg80211_update_owe_info_event(struct net_device *netdev,
19004 struct cfg80211_update_owe_info *owe_info,
19005 gfp_t gfp)
19006 {
19007 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19008 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19009 struct sk_buff *msg;
19010 void *hdr;
19011
19012 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
19013
19014 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19015 if (!msg)
19016 return;
19017
19018 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
19019 if (!hdr)
19020 goto nla_put_failure;
19021
19022 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19023 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19024 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
19025 goto nla_put_failure;
19026
19027 if (!owe_info->ie_len ||
19028 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
19029 goto nla_put_failure;
19030
19031 genlmsg_end(msg, hdr);
19032
19033 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19034 NL80211_MCGRP_MLME, gfp);
19035 return;
19036
19037 nla_put_failure:
19038 genlmsg_cancel(msg, hdr);
19039 nlmsg_free(msg);
19040 }
19041 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
19042
19043 /* initialisation/exit functions */
19044
nl80211_init(void)19045 int __init nl80211_init(void)
19046 {
19047 int err;
19048
19049 err = genl_register_family(&nl80211_fam);
19050 if (err)
19051 return err;
19052
19053 err = netlink_register_notifier(&nl80211_netlink_notifier);
19054 if (err)
19055 goto err_out;
19056
19057 return 0;
19058 err_out:
19059 genl_unregister_family(&nl80211_fam);
19060 return err;
19061 }
19062
nl80211_exit(void)19063 void nl80211_exit(void)
19064 {
19065 netlink_unregister_notifier(&nl80211_netlink_notifier);
19066 genl_unregister_family(&nl80211_fam);
19067 }
19068