1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2020 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 68 { 69 struct cfg80211_registered_device *rdev; 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 ASSERT_RTNL(); 78 79 if (!have_ifidx && !have_wdev_id) 80 return ERR_PTR(-EINVAL); 81 82 if (have_ifidx) 83 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 84 if (have_wdev_id) { 85 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 86 wiphy_idx = wdev_id >> 32; 87 } 88 89 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 90 struct wireless_dev *wdev; 91 92 if (wiphy_net(&rdev->wiphy) != netns) 93 continue; 94 95 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 96 continue; 97 98 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 99 if (have_ifidx && wdev->netdev && 100 wdev->netdev->ifindex == ifidx) { 101 result = wdev; 102 break; 103 } 104 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 105 result = wdev; 106 break; 107 } 108 } 109 110 if (result) 111 break; 112 } 113 114 if (result) 115 return result; 116 return ERR_PTR(-ENODEV); 117 } 118 119 static struct cfg80211_registered_device * 120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 121 { 122 struct cfg80211_registered_device *rdev = NULL, *tmp; 123 struct net_device *netdev; 124 125 ASSERT_RTNL(); 126 127 if (!attrs[NL80211_ATTR_WIPHY] && 128 !attrs[NL80211_ATTR_IFINDEX] && 129 !attrs[NL80211_ATTR_WDEV]) 130 return ERR_PTR(-EINVAL); 131 132 if (attrs[NL80211_ATTR_WIPHY]) 133 rdev = cfg80211_rdev_by_wiphy_idx( 134 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 135 136 if (attrs[NL80211_ATTR_WDEV]) { 137 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 138 struct wireless_dev *wdev; 139 bool found = false; 140 141 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 142 if (tmp) { 143 /* make sure wdev exists */ 144 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 145 if (wdev->identifier != (u32)wdev_id) 146 continue; 147 found = true; 148 break; 149 } 150 151 if (!found) 152 tmp = NULL; 153 154 if (rdev && tmp != rdev) 155 return ERR_PTR(-EINVAL); 156 rdev = tmp; 157 } 158 } 159 160 if (attrs[NL80211_ATTR_IFINDEX]) { 161 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 162 163 netdev = __dev_get_by_index(netns, ifindex); 164 if (netdev) { 165 if (netdev->ieee80211_ptr) 166 tmp = wiphy_to_rdev( 167 netdev->ieee80211_ptr->wiphy); 168 else 169 tmp = NULL; 170 171 /* not wireless device -- return error */ 172 if (!tmp) 173 return ERR_PTR(-EINVAL); 174 175 /* mismatch -- return error */ 176 if (rdev && tmp != rdev) 177 return ERR_PTR(-EINVAL); 178 179 rdev = tmp; 180 } 181 } 182 183 if (!rdev) 184 return ERR_PTR(-ENODEV); 185 186 if (netns != wiphy_net(&rdev->wiphy)) 187 return ERR_PTR(-ENODEV); 188 189 return rdev; 190 } 191 192 /* 193 * This function returns a pointer to the driver 194 * that the genl_info item that is passed refers to. 195 * 196 * The result of this can be a PTR_ERR and hence must 197 * be checked with IS_ERR() for errors. 198 */ 199 static struct cfg80211_registered_device * 200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 201 { 202 return __cfg80211_rdev_from_attrs(netns, info->attrs); 203 } 204 205 static int validate_beacon_head(const struct nlattr *attr, 206 struct netlink_ext_ack *extack) 207 { 208 const u8 *data = nla_data(attr); 209 unsigned int len = nla_len(attr); 210 const struct element *elem; 211 const struct ieee80211_mgmt *mgmt = (void *)data; 212 bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 213 unsigned int fixedlen, hdrlen; 214 215 if (s1g_bcn) { 216 fixedlen = offsetof(struct ieee80211_ext, 217 u.s1g_beacon.variable); 218 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 219 } else { 220 fixedlen = offsetof(struct ieee80211_mgmt, 221 u.beacon.variable); 222 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 223 } 224 225 if (len < fixedlen) 226 goto err; 227 228 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 229 goto err; 230 231 data += fixedlen; 232 len -= fixedlen; 233 234 for_each_element(elem, data, len) { 235 /* nothing */ 236 } 237 238 if (for_each_element_completed(elem, data, len)) 239 return 0; 240 241 err: 242 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 243 return -EINVAL; 244 } 245 246 static int validate_ie_attr(const struct nlattr *attr, 247 struct netlink_ext_ack *extack) 248 { 249 const u8 *data = nla_data(attr); 250 unsigned int len = nla_len(attr); 251 const struct element *elem; 252 253 for_each_element(elem, data, len) { 254 /* nothing */ 255 } 256 257 if (for_each_element_completed(elem, data, len)) 258 return 0; 259 260 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 261 return -EINVAL; 262 } 263 264 /* policy for the attributes */ 265 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 266 267 static const struct nla_policy 268 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 269 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 270 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 271 .len = U8_MAX }, 272 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 273 .len = U8_MAX }, 274 }; 275 276 static const struct nla_policy 277 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 278 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 279 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 280 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 281 NLA_POLICY_MAX(NLA_U8, 15), 282 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 283 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 284 NLA_POLICY_MAX(NLA_U8, 15), 285 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 286 NLA_POLICY_MAX(NLA_U8, 31), 287 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 288 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 289 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 290 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 291 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 292 }; 293 294 static const struct nla_policy 295 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 296 [NL80211_PMSR_TYPE_FTM] = 297 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 298 }; 299 300 static const struct nla_policy 301 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 302 [NL80211_PMSR_REQ_ATTR_DATA] = 303 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 304 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 305 }; 306 307 static const struct nla_policy 308 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 309 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 310 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 311 [NL80211_PMSR_PEER_ATTR_REQ] = 312 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 313 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 314 }; 315 316 static const struct nla_policy 317 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 318 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 319 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 320 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 321 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 322 [NL80211_PMSR_ATTR_PEERS] = 323 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy), 324 }; 325 326 static const struct nla_policy 327 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 328 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 329 NLA_POLICY_RANGE(NLA_U8, 1, 20), 330 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 331 NLA_POLICY_RANGE(NLA_U8, 1, 20), 332 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 333 NLA_POLICY_RANGE(NLA_U8, 1, 20), 334 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 335 NLA_POLICY_EXACT_LEN(8), 336 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 337 NLA_POLICY_EXACT_LEN(8), 338 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 339 }; 340 341 static const struct nla_policy 342 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 343 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 344 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 345 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 346 }; 347 348 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 349 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 350 .len = NL80211_MAX_SUPP_RATES }, 351 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 352 .len = NL80211_MAX_SUPP_HT_RATES }, 353 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 354 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 355 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 356 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 357 NL80211_RATE_INFO_HE_GI_0_8, 358 NL80211_RATE_INFO_HE_GI_3_2), 359 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 360 NL80211_RATE_INFO_HE_1XLTF, 361 NL80211_RATE_INFO_HE_4XLTF), 362 }; 363 364 static const struct nla_policy 365 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 366 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 367 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 368 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 369 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 370 [NL80211_TID_CONFIG_ATTR_NOACK] = 371 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 372 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 373 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 374 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 375 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 376 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 377 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 378 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 379 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 380 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 381 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 382 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 383 NLA_POLICY_NESTED(nl80211_txattr_policy), 384 }; 385 386 static const struct nla_policy 387 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 388 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 389 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 390 NLA_POLICY_RANGE(NLA_BINARY, 391 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 392 IEEE80211_MAX_DATA_LEN), 393 }; 394 395 static const struct nla_policy 396 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 397 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 398 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 399 .len = IEEE80211_MAX_DATA_LEN } 400 }; 401 402 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 403 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 404 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 405 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 406 .len = 20-1 }, 407 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 408 409 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 410 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 411 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 412 NL80211_EDMG_CHANNELS_MIN, 413 NL80211_EDMG_CHANNELS_MAX), 414 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 415 NL80211_EDMG_BW_CONFIG_MIN, 416 NL80211_EDMG_BW_CONFIG_MAX), 417 418 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 419 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 420 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 421 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 422 423 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 424 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 425 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 426 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 427 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 428 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 429 430 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 431 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 432 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 433 434 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 435 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 436 437 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 438 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 439 .len = WLAN_MAX_KEY_LEN }, 440 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 441 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 442 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 443 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 444 [NL80211_ATTR_KEY_TYPE] = 445 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 446 447 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 448 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 449 [NL80211_ATTR_BEACON_HEAD] = 450 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 451 IEEE80211_MAX_DATA_LEN), 452 [NL80211_ATTR_BEACON_TAIL] = 453 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 454 IEEE80211_MAX_DATA_LEN), 455 [NL80211_ATTR_STA_AID] = 456 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 457 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 458 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 459 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 460 .len = NL80211_MAX_SUPP_RATES }, 461 [NL80211_ATTR_STA_PLINK_ACTION] = 462 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 463 [NL80211_ATTR_STA_TX_POWER_SETTING] = 464 NLA_POLICY_RANGE(NLA_U8, 465 NL80211_TX_POWER_AUTOMATIC, 466 NL80211_TX_POWER_FIXED), 467 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 468 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 469 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 470 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 471 .len = IEEE80211_MAX_MESH_ID_LEN }, 472 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 473 474 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 475 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 476 477 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 478 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 479 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 480 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 481 .len = NL80211_MAX_SUPP_RATES }, 482 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 483 484 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 485 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 486 487 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 488 489 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 490 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 491 validate_ie_attr, 492 IEEE80211_MAX_DATA_LEN), 493 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 494 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 495 496 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 497 .len = IEEE80211_MAX_SSID_LEN }, 498 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 499 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 500 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 501 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 502 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 503 NL80211_MFP_NO, 504 NL80211_MFP_OPTIONAL), 505 [NL80211_ATTR_STA_FLAGS2] = { 506 .len = sizeof(struct nl80211_sta_flag_update), 507 }, 508 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 509 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 510 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 512 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 513 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 514 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 515 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 516 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 517 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 518 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 519 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 520 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 521 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 522 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 523 .len = IEEE80211_MAX_DATA_LEN }, 524 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 525 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 526 NL80211_PS_DISABLED, 527 NL80211_PS_ENABLED), 528 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 529 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 530 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 531 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 532 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 533 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 534 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 535 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 536 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 537 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 538 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 539 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 540 [NL80211_ATTR_STA_PLINK_STATE] = 541 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 542 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 543 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 544 [NL80211_ATTR_MESH_PEER_AID] = 545 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 546 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 547 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 548 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 549 [NL80211_ATTR_HIDDEN_SSID] = 550 NLA_POLICY_RANGE(NLA_U32, 551 NL80211_HIDDEN_SSID_NOT_IN_USE, 552 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 553 [NL80211_ATTR_IE_PROBE_RESP] = 554 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 555 IEEE80211_MAX_DATA_LEN), 556 [NL80211_ATTR_IE_ASSOC_RESP] = 557 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 558 IEEE80211_MAX_DATA_LEN), 559 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 560 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 561 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 562 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 563 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 564 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 565 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 566 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 567 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 568 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 569 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 570 .len = IEEE80211_MAX_DATA_LEN }, 571 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 572 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 573 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 574 .len = NL80211_HT_CAPABILITY_LEN 575 }, 576 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 577 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 578 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 579 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 580 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 581 582 /* need to include at least Auth Transaction and Status Code */ 583 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 584 585 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 586 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 587 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 588 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 589 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 590 NLA_POLICY_RANGE(NLA_U32, 591 NL80211_MESH_POWER_UNKNOWN + 1, 592 NL80211_MESH_POWER_MAX), 593 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 594 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 595 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 596 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 597 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 598 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 599 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 600 .len = NL80211_VHT_CAPABILITY_LEN, 601 }, 602 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 603 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 604 .len = IEEE80211_MAX_DATA_LEN }, 605 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 606 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 607 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 608 [NL80211_ATTR_PEER_AID] = 609 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 610 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 611 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 612 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 613 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 614 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 615 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 616 /* 617 * The value of the Length field of the Supported Operating 618 * Classes element is between 2 and 253. 619 */ 620 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 621 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 622 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 623 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 624 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 625 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 626 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 627 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 628 IEEE80211_QOS_MAP_LEN_MIN, 629 IEEE80211_QOS_MAP_LEN_MAX), 630 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 631 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 632 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 633 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 634 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 635 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 636 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 637 [NL80211_ATTR_USER_PRIO] = 638 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 639 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 640 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 641 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 642 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 643 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 644 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 645 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 646 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 647 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 648 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 649 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 650 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 651 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 652 .len = VHT_MUMIMO_GROUPS_DATA_LEN 653 }, 654 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 655 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 656 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 657 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 658 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 659 .len = FILS_MAX_KEK_LEN }, 660 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 661 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 662 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 663 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 664 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 665 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 666 }, 667 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 668 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 669 .len = FILS_ERP_MAX_USERNAME_LEN }, 670 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 671 .len = FILS_ERP_MAX_REALM_LEN }, 672 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 673 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 674 .len = FILS_ERP_MAX_RRK_LEN }, 675 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 676 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 677 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 678 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 679 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 680 681 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 682 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 683 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 684 [NL80211_ATTR_HE_CAPABILITY] = 685 NLA_POLICY_RANGE(NLA_BINARY, 686 NL80211_HE_MIN_CAPABILITY_LEN, 687 NL80211_HE_MAX_CAPABILITY_LEN), 688 [NL80211_ATTR_FTM_RESPONDER] = 689 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 690 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 691 [NL80211_ATTR_PEER_MEASUREMENTS] = 692 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 693 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 694 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 695 .len = SAE_PASSWORD_MAX_LEN }, 696 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 697 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 698 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 699 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 700 [NL80211_ATTR_TID_CONFIG] = 701 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 702 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 703 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 704 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 705 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 707 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 708 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 709 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 710 [NL80211_ATTR_FILS_DISCOVERY] = 711 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 712 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 713 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 714 [NL80211_ATTR_S1G_CAPABILITY] = 715 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 716 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 717 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 718 [NL80211_ATTR_SAE_PWE] = 719 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK, 720 NL80211_SAE_PWE_BOTH), 721 }; 722 723 /* policy for the key attributes */ 724 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 725 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 726 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 727 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 728 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 729 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 730 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 731 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 732 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 733 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 734 }; 735 736 /* policy for the key default flags */ 737 static const struct nla_policy 738 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 739 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 740 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 741 }; 742 743 #ifdef CONFIG_PM 744 /* policy for WoWLAN attributes */ 745 static const struct nla_policy 746 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 747 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 748 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 749 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 750 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 751 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 752 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 753 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 754 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 755 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 756 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 757 }; 758 759 static const struct nla_policy 760 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 761 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 762 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 763 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 764 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 765 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 766 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 767 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 768 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 769 }, 770 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 771 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 772 }, 773 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 774 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 775 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 776 }; 777 #endif /* CONFIG_PM */ 778 779 /* policy for coalesce rule attributes */ 780 static const struct nla_policy 781 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 782 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 783 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 784 NLA_POLICY_RANGE(NLA_U32, 785 NL80211_COALESCE_CONDITION_MATCH, 786 NL80211_COALESCE_CONDITION_NO_MATCH), 787 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 788 }; 789 790 /* policy for GTK rekey offload attributes */ 791 static const struct nla_policy 792 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 793 [NL80211_REKEY_DATA_KEK] = { 794 .type = NLA_BINARY, 795 .len = NL80211_KEK_EXT_LEN 796 }, 797 [NL80211_REKEY_DATA_KCK] = { 798 .type = NLA_BINARY, 799 .len = NL80211_KCK_EXT_LEN 800 }, 801 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 802 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 803 }; 804 805 static const struct nla_policy 806 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 807 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 808 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 809 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 810 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 811 }; 812 813 static const struct nla_policy 814 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 815 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 816 .len = IEEE80211_MAX_SSID_LEN }, 817 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 818 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 819 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 820 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 821 }; 822 823 static const struct nla_policy 824 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 825 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 826 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 827 }; 828 829 static const struct nla_policy 830 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 831 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 832 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 833 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 834 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 835 }, 836 }; 837 838 /* policy for NAN function attributes */ 839 static const struct nla_policy 840 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 841 [NL80211_NAN_FUNC_TYPE] = 842 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 843 [NL80211_NAN_FUNC_SERVICE_ID] = { 844 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 845 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 846 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 847 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 848 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 849 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 850 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 851 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 852 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 853 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 854 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 855 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 856 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 857 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 858 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 859 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 860 }; 861 862 /* policy for Service Response Filter attributes */ 863 static const struct nla_policy 864 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 865 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 866 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 867 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 868 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 869 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 870 }; 871 872 /* policy for packet pattern attributes */ 873 static const struct nla_policy 874 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 875 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 876 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 877 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 878 }; 879 880 int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 881 struct cfg80211_registered_device **rdev, 882 struct wireless_dev **wdev) 883 { 884 int err; 885 886 if (!cb->args[0]) { 887 struct nlattr **attrbuf; 888 889 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 890 GFP_KERNEL); 891 if (!attrbuf) 892 return -ENOMEM; 893 894 err = nlmsg_parse_deprecated(cb->nlh, 895 GENL_HDRLEN + nl80211_fam.hdrsize, 896 attrbuf, nl80211_fam.maxattr, 897 nl80211_policy, NULL); 898 if (err) { 899 kfree(attrbuf); 900 return err; 901 } 902 903 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk), 904 attrbuf); 905 kfree(attrbuf); 906 if (IS_ERR(*wdev)) 907 return PTR_ERR(*wdev); 908 *rdev = wiphy_to_rdev((*wdev)->wiphy); 909 /* 0 is the first index - add 1 to parse only once */ 910 cb->args[0] = (*rdev)->wiphy_idx + 1; 911 cb->args[1] = (*wdev)->identifier; 912 } else { 913 /* subtract the 1 again here */ 914 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 915 struct wireless_dev *tmp; 916 917 if (!wiphy) 918 return -ENODEV; 919 *rdev = wiphy_to_rdev(wiphy); 920 *wdev = NULL; 921 922 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 923 if (tmp->identifier == cb->args[1]) { 924 *wdev = tmp; 925 break; 926 } 927 } 928 929 if (!*wdev) 930 return -ENODEV; 931 } 932 933 return 0; 934 } 935 936 /* message building helper */ 937 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 938 int flags, u8 cmd) 939 { 940 /* since there is no private header just add the generic one */ 941 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 942 } 943 944 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 945 const struct ieee80211_reg_rule *rule) 946 { 947 int j; 948 struct nlattr *nl_wmm_rules = 949 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 950 951 if (!nl_wmm_rules) 952 goto nla_put_failure; 953 954 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 955 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 956 957 if (!nl_wmm_rule) 958 goto nla_put_failure; 959 960 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 961 rule->wmm_rule.client[j].cw_min) || 962 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 963 rule->wmm_rule.client[j].cw_max) || 964 nla_put_u8(msg, NL80211_WMMR_AIFSN, 965 rule->wmm_rule.client[j].aifsn) || 966 nla_put_u16(msg, NL80211_WMMR_TXOP, 967 rule->wmm_rule.client[j].cot)) 968 goto nla_put_failure; 969 970 nla_nest_end(msg, nl_wmm_rule); 971 } 972 nla_nest_end(msg, nl_wmm_rules); 973 974 return 0; 975 976 nla_put_failure: 977 return -ENOBUFS; 978 } 979 980 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 981 struct ieee80211_channel *chan, 982 bool large) 983 { 984 /* Some channels must be completely excluded from the 985 * list to protect old user-space tools from breaking 986 */ 987 if (!large && chan->flags & 988 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 989 return 0; 990 if (!large && chan->freq_offset) 991 return 0; 992 993 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 994 chan->center_freq)) 995 goto nla_put_failure; 996 997 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 998 goto nla_put_failure; 999 1000 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1001 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1002 goto nla_put_failure; 1003 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1004 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1005 goto nla_put_failure; 1006 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1007 goto nla_put_failure; 1008 } 1009 if (chan->flags & IEEE80211_CHAN_RADAR) { 1010 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1011 goto nla_put_failure; 1012 if (large) { 1013 u32 time; 1014 1015 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1016 1017 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1018 chan->dfs_state)) 1019 goto nla_put_failure; 1020 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1021 time)) 1022 goto nla_put_failure; 1023 if (nla_put_u32(msg, 1024 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1025 chan->dfs_cac_ms)) 1026 goto nla_put_failure; 1027 } 1028 } 1029 1030 if (large) { 1031 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1032 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1033 goto nla_put_failure; 1034 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1035 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1036 goto nla_put_failure; 1037 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1038 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1039 goto nla_put_failure; 1040 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1041 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1042 goto nla_put_failure; 1043 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1044 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1045 goto nla_put_failure; 1046 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1047 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1048 goto nla_put_failure; 1049 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1050 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1051 goto nla_put_failure; 1052 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1053 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1054 goto nla_put_failure; 1055 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1056 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1057 goto nla_put_failure; 1058 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1059 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1060 goto nla_put_failure; 1061 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1062 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1063 goto nla_put_failure; 1064 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1065 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1066 goto nla_put_failure; 1067 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1068 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1069 goto nla_put_failure; 1070 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1071 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1072 goto nla_put_failure; 1073 } 1074 1075 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1076 DBM_TO_MBM(chan->max_power))) 1077 goto nla_put_failure; 1078 1079 if (large) { 1080 const struct ieee80211_reg_rule *rule = 1081 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1082 1083 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1084 if (nl80211_msg_put_wmm_rules(msg, rule)) 1085 goto nla_put_failure; 1086 } 1087 } 1088 1089 return 0; 1090 1091 nla_put_failure: 1092 return -ENOBUFS; 1093 } 1094 1095 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1096 struct cfg80211_txq_stats *txqstats, 1097 int attrtype) 1098 { 1099 struct nlattr *txqattr; 1100 1101 #define PUT_TXQVAL_U32(attr, memb) do { \ 1102 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1103 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1104 return false; \ 1105 } while (0) 1106 1107 txqattr = nla_nest_start_noflag(msg, attrtype); 1108 if (!txqattr) 1109 return false; 1110 1111 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1112 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1113 PUT_TXQVAL_U32(FLOWS, flows); 1114 PUT_TXQVAL_U32(DROPS, drops); 1115 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1116 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1117 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1118 PUT_TXQVAL_U32(COLLISIONS, collisions); 1119 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1120 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1121 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1122 nla_nest_end(msg, txqattr); 1123 1124 #undef PUT_TXQVAL_U32 1125 return true; 1126 } 1127 1128 /* netlink command implementations */ 1129 1130 struct key_parse { 1131 struct key_params p; 1132 int idx; 1133 int type; 1134 bool def, defmgmt, defbeacon; 1135 bool def_uni, def_multi; 1136 }; 1137 1138 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1139 struct key_parse *k) 1140 { 1141 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1142 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1143 nl80211_key_policy, 1144 info->extack); 1145 if (err) 1146 return err; 1147 1148 k->def = !!tb[NL80211_KEY_DEFAULT]; 1149 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1150 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1151 1152 if (k->def) { 1153 k->def_uni = true; 1154 k->def_multi = true; 1155 } 1156 if (k->defmgmt || k->defbeacon) 1157 k->def_multi = true; 1158 1159 if (tb[NL80211_KEY_IDX]) 1160 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1161 1162 if (tb[NL80211_KEY_DATA]) { 1163 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1164 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1165 } 1166 1167 if (tb[NL80211_KEY_SEQ]) { 1168 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1169 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1170 } 1171 1172 if (tb[NL80211_KEY_CIPHER]) 1173 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1174 1175 if (tb[NL80211_KEY_TYPE]) 1176 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1177 1178 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1179 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1180 1181 err = nla_parse_nested_deprecated(kdt, 1182 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1183 tb[NL80211_KEY_DEFAULT_TYPES], 1184 nl80211_key_default_policy, 1185 info->extack); 1186 if (err) 1187 return err; 1188 1189 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1190 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1191 } 1192 1193 if (tb[NL80211_KEY_MODE]) 1194 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1195 1196 return 0; 1197 } 1198 1199 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1200 { 1201 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1202 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1203 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1204 } 1205 1206 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1207 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1208 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1209 } 1210 1211 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1212 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1213 1214 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1215 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1216 1217 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1218 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1219 1220 if (k->def) { 1221 k->def_uni = true; 1222 k->def_multi = true; 1223 } 1224 if (k->defmgmt) 1225 k->def_multi = true; 1226 1227 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1228 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1229 1230 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1231 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1232 int err = nla_parse_nested_deprecated(kdt, 1233 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1234 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1235 nl80211_key_default_policy, 1236 info->extack); 1237 if (err) 1238 return err; 1239 1240 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1241 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1242 } 1243 1244 return 0; 1245 } 1246 1247 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1248 { 1249 int err; 1250 1251 memset(k, 0, sizeof(*k)); 1252 k->idx = -1; 1253 k->type = -1; 1254 1255 if (info->attrs[NL80211_ATTR_KEY]) 1256 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1257 else 1258 err = nl80211_parse_key_old(info, k); 1259 1260 if (err) 1261 return err; 1262 1263 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1264 (k->defbeacon ? 1 : 0) > 1) { 1265 GENL_SET_ERR_MSG(info, 1266 "key with multiple default flags is invalid"); 1267 return -EINVAL; 1268 } 1269 1270 if (k->defmgmt || k->defbeacon) { 1271 if (k->def_uni || !k->def_multi) { 1272 GENL_SET_ERR_MSG(info, 1273 "defmgmt/defbeacon key must be mcast"); 1274 return -EINVAL; 1275 } 1276 } 1277 1278 if (k->idx != -1) { 1279 if (k->defmgmt) { 1280 if (k->idx < 4 || k->idx > 5) { 1281 GENL_SET_ERR_MSG(info, 1282 "defmgmt key idx not 4 or 5"); 1283 return -EINVAL; 1284 } 1285 } else if (k->defbeacon) { 1286 if (k->idx < 6 || k->idx > 7) { 1287 GENL_SET_ERR_MSG(info, 1288 "defbeacon key idx not 6 or 7"); 1289 return -EINVAL; 1290 } 1291 } else if (k->def) { 1292 if (k->idx < 0 || k->idx > 3) { 1293 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1294 return -EINVAL; 1295 } 1296 } else { 1297 if (k->idx < 0 || k->idx > 7) { 1298 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1299 return -EINVAL; 1300 } 1301 } 1302 } 1303 1304 return 0; 1305 } 1306 1307 static struct cfg80211_cached_keys * 1308 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1309 struct genl_info *info, bool *no_ht) 1310 { 1311 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1312 struct key_parse parse; 1313 struct nlattr *key; 1314 struct cfg80211_cached_keys *result; 1315 int rem, err, def = 0; 1316 bool have_key = false; 1317 1318 nla_for_each_nested(key, keys, rem) { 1319 have_key = true; 1320 break; 1321 } 1322 1323 if (!have_key) 1324 return NULL; 1325 1326 result = kzalloc(sizeof(*result), GFP_KERNEL); 1327 if (!result) 1328 return ERR_PTR(-ENOMEM); 1329 1330 result->def = -1; 1331 1332 nla_for_each_nested(key, keys, rem) { 1333 memset(&parse, 0, sizeof(parse)); 1334 parse.idx = -1; 1335 1336 err = nl80211_parse_key_new(info, key, &parse); 1337 if (err) 1338 goto error; 1339 err = -EINVAL; 1340 if (!parse.p.key) 1341 goto error; 1342 if (parse.idx < 0 || parse.idx > 3) { 1343 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1344 goto error; 1345 } 1346 if (parse.def) { 1347 if (def) { 1348 GENL_SET_ERR_MSG(info, 1349 "only one key can be default"); 1350 goto error; 1351 } 1352 def = 1; 1353 result->def = parse.idx; 1354 if (!parse.def_uni || !parse.def_multi) 1355 goto error; 1356 } else if (parse.defmgmt) 1357 goto error; 1358 err = cfg80211_validate_key_settings(rdev, &parse.p, 1359 parse.idx, false, NULL); 1360 if (err) 1361 goto error; 1362 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1363 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1364 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1365 err = -EINVAL; 1366 goto error; 1367 } 1368 result->params[parse.idx].cipher = parse.p.cipher; 1369 result->params[parse.idx].key_len = parse.p.key_len; 1370 result->params[parse.idx].key = result->data[parse.idx]; 1371 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1372 1373 /* must be WEP key if we got here */ 1374 if (no_ht) 1375 *no_ht = true; 1376 } 1377 1378 if (result->def < 0) { 1379 err = -EINVAL; 1380 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1381 goto error; 1382 } 1383 1384 return result; 1385 error: 1386 kfree(result); 1387 return ERR_PTR(err); 1388 } 1389 1390 static int nl80211_key_allowed(struct wireless_dev *wdev) 1391 { 1392 ASSERT_WDEV_LOCK(wdev); 1393 1394 switch (wdev->iftype) { 1395 case NL80211_IFTYPE_AP: 1396 case NL80211_IFTYPE_AP_VLAN: 1397 case NL80211_IFTYPE_P2P_GO: 1398 case NL80211_IFTYPE_MESH_POINT: 1399 break; 1400 case NL80211_IFTYPE_ADHOC: 1401 case NL80211_IFTYPE_STATION: 1402 case NL80211_IFTYPE_P2P_CLIENT: 1403 if (!wdev->current_bss) 1404 return -ENOLINK; 1405 break; 1406 case NL80211_IFTYPE_UNSPECIFIED: 1407 case NL80211_IFTYPE_OCB: 1408 case NL80211_IFTYPE_MONITOR: 1409 case NL80211_IFTYPE_NAN: 1410 case NL80211_IFTYPE_P2P_DEVICE: 1411 case NL80211_IFTYPE_WDS: 1412 case NUM_NL80211_IFTYPES: 1413 return -EINVAL; 1414 } 1415 1416 return 0; 1417 } 1418 1419 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1420 u32 freq) 1421 { 1422 struct ieee80211_channel *chan; 1423 1424 chan = ieee80211_get_channel_khz(wiphy, freq); 1425 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1426 return NULL; 1427 return chan; 1428 } 1429 1430 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1431 { 1432 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1433 int i; 1434 1435 if (!nl_modes) 1436 goto nla_put_failure; 1437 1438 i = 0; 1439 while (ifmodes) { 1440 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1441 goto nla_put_failure; 1442 ifmodes >>= 1; 1443 i++; 1444 } 1445 1446 nla_nest_end(msg, nl_modes); 1447 return 0; 1448 1449 nla_put_failure: 1450 return -ENOBUFS; 1451 } 1452 1453 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1454 struct sk_buff *msg, 1455 bool large) 1456 { 1457 struct nlattr *nl_combis; 1458 int i, j; 1459 1460 nl_combis = nla_nest_start_noflag(msg, 1461 NL80211_ATTR_INTERFACE_COMBINATIONS); 1462 if (!nl_combis) 1463 goto nla_put_failure; 1464 1465 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1466 const struct ieee80211_iface_combination *c; 1467 struct nlattr *nl_combi, *nl_limits; 1468 1469 c = &wiphy->iface_combinations[i]; 1470 1471 nl_combi = nla_nest_start_noflag(msg, i + 1); 1472 if (!nl_combi) 1473 goto nla_put_failure; 1474 1475 nl_limits = nla_nest_start_noflag(msg, 1476 NL80211_IFACE_COMB_LIMITS); 1477 if (!nl_limits) 1478 goto nla_put_failure; 1479 1480 for (j = 0; j < c->n_limits; j++) { 1481 struct nlattr *nl_limit; 1482 1483 nl_limit = nla_nest_start_noflag(msg, j + 1); 1484 if (!nl_limit) 1485 goto nla_put_failure; 1486 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1487 c->limits[j].max)) 1488 goto nla_put_failure; 1489 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1490 c->limits[j].types)) 1491 goto nla_put_failure; 1492 nla_nest_end(msg, nl_limit); 1493 } 1494 1495 nla_nest_end(msg, nl_limits); 1496 1497 if (c->beacon_int_infra_match && 1498 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1499 goto nla_put_failure; 1500 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1501 c->num_different_channels) || 1502 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1503 c->max_interfaces)) 1504 goto nla_put_failure; 1505 if (large && 1506 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1507 c->radar_detect_widths) || 1508 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1509 c->radar_detect_regions))) 1510 goto nla_put_failure; 1511 if (c->beacon_int_min_gcd && 1512 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1513 c->beacon_int_min_gcd)) 1514 goto nla_put_failure; 1515 1516 nla_nest_end(msg, nl_combi); 1517 } 1518 1519 nla_nest_end(msg, nl_combis); 1520 1521 return 0; 1522 nla_put_failure: 1523 return -ENOBUFS; 1524 } 1525 1526 #ifdef CONFIG_PM 1527 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1528 struct sk_buff *msg) 1529 { 1530 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1531 struct nlattr *nl_tcp; 1532 1533 if (!tcp) 1534 return 0; 1535 1536 nl_tcp = nla_nest_start_noflag(msg, 1537 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1538 if (!nl_tcp) 1539 return -ENOBUFS; 1540 1541 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1542 tcp->data_payload_max)) 1543 return -ENOBUFS; 1544 1545 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1546 tcp->data_payload_max)) 1547 return -ENOBUFS; 1548 1549 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1550 return -ENOBUFS; 1551 1552 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1553 sizeof(*tcp->tok), tcp->tok)) 1554 return -ENOBUFS; 1555 1556 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1557 tcp->data_interval_max)) 1558 return -ENOBUFS; 1559 1560 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1561 tcp->wake_payload_max)) 1562 return -ENOBUFS; 1563 1564 nla_nest_end(msg, nl_tcp); 1565 return 0; 1566 } 1567 1568 static int nl80211_send_wowlan(struct sk_buff *msg, 1569 struct cfg80211_registered_device *rdev, 1570 bool large) 1571 { 1572 struct nlattr *nl_wowlan; 1573 1574 if (!rdev->wiphy.wowlan) 1575 return 0; 1576 1577 nl_wowlan = nla_nest_start_noflag(msg, 1578 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1579 if (!nl_wowlan) 1580 return -ENOBUFS; 1581 1582 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1583 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1584 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1585 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1586 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1587 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1588 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1589 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1590 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1591 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1592 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1593 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1594 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1595 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1596 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1597 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1598 return -ENOBUFS; 1599 1600 if (rdev->wiphy.wowlan->n_patterns) { 1601 struct nl80211_pattern_support pat = { 1602 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1603 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1604 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1605 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1606 }; 1607 1608 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1609 sizeof(pat), &pat)) 1610 return -ENOBUFS; 1611 } 1612 1613 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1614 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1615 rdev->wiphy.wowlan->max_nd_match_sets)) 1616 return -ENOBUFS; 1617 1618 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1619 return -ENOBUFS; 1620 1621 nla_nest_end(msg, nl_wowlan); 1622 1623 return 0; 1624 } 1625 #endif 1626 1627 static int nl80211_send_coalesce(struct sk_buff *msg, 1628 struct cfg80211_registered_device *rdev) 1629 { 1630 struct nl80211_coalesce_rule_support rule; 1631 1632 if (!rdev->wiphy.coalesce) 1633 return 0; 1634 1635 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1636 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1637 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1638 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1639 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1640 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1641 1642 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1643 return -ENOBUFS; 1644 1645 return 0; 1646 } 1647 1648 static int 1649 nl80211_send_iftype_data(struct sk_buff *msg, 1650 const struct ieee80211_supported_band *sband, 1651 const struct ieee80211_sband_iftype_data *iftdata) 1652 { 1653 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1654 1655 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1656 iftdata->types_mask)) 1657 return -ENOBUFS; 1658 1659 if (he_cap->has_he) { 1660 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1661 sizeof(he_cap->he_cap_elem.mac_cap_info), 1662 he_cap->he_cap_elem.mac_cap_info) || 1663 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1664 sizeof(he_cap->he_cap_elem.phy_cap_info), 1665 he_cap->he_cap_elem.phy_cap_info) || 1666 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1667 sizeof(he_cap->he_mcs_nss_supp), 1668 &he_cap->he_mcs_nss_supp) || 1669 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1670 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1671 return -ENOBUFS; 1672 } 1673 1674 if (sband->band == NL80211_BAND_6GHZ && 1675 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1676 sizeof(iftdata->he_6ghz_capa), 1677 &iftdata->he_6ghz_capa)) 1678 return -ENOBUFS; 1679 1680 return 0; 1681 } 1682 1683 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1684 struct ieee80211_supported_band *sband, 1685 bool large) 1686 { 1687 struct nlattr *nl_rates, *nl_rate; 1688 struct ieee80211_rate *rate; 1689 int i; 1690 1691 /* add HT info */ 1692 if (sband->ht_cap.ht_supported && 1693 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1694 sizeof(sband->ht_cap.mcs), 1695 &sband->ht_cap.mcs) || 1696 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1697 sband->ht_cap.cap) || 1698 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1699 sband->ht_cap.ampdu_factor) || 1700 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1701 sband->ht_cap.ampdu_density))) 1702 return -ENOBUFS; 1703 1704 /* add VHT info */ 1705 if (sband->vht_cap.vht_supported && 1706 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1707 sizeof(sband->vht_cap.vht_mcs), 1708 &sband->vht_cap.vht_mcs) || 1709 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1710 sband->vht_cap.cap))) 1711 return -ENOBUFS; 1712 1713 if (large && sband->n_iftype_data) { 1714 struct nlattr *nl_iftype_data = 1715 nla_nest_start_noflag(msg, 1716 NL80211_BAND_ATTR_IFTYPE_DATA); 1717 int err; 1718 1719 if (!nl_iftype_data) 1720 return -ENOBUFS; 1721 1722 for (i = 0; i < sband->n_iftype_data; i++) { 1723 struct nlattr *iftdata; 1724 1725 iftdata = nla_nest_start_noflag(msg, i + 1); 1726 if (!iftdata) 1727 return -ENOBUFS; 1728 1729 err = nl80211_send_iftype_data(msg, sband, 1730 &sband->iftype_data[i]); 1731 if (err) 1732 return err; 1733 1734 nla_nest_end(msg, iftdata); 1735 } 1736 1737 nla_nest_end(msg, nl_iftype_data); 1738 } 1739 1740 /* add EDMG info */ 1741 if (large && sband->edmg_cap.channels && 1742 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1743 sband->edmg_cap.channels) || 1744 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1745 sband->edmg_cap.bw_config))) 1746 1747 return -ENOBUFS; 1748 1749 /* add bitrates */ 1750 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1751 if (!nl_rates) 1752 return -ENOBUFS; 1753 1754 for (i = 0; i < sband->n_bitrates; i++) { 1755 nl_rate = nla_nest_start_noflag(msg, i); 1756 if (!nl_rate) 1757 return -ENOBUFS; 1758 1759 rate = &sband->bitrates[i]; 1760 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1761 rate->bitrate)) 1762 return -ENOBUFS; 1763 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1764 nla_put_flag(msg, 1765 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1766 return -ENOBUFS; 1767 1768 nla_nest_end(msg, nl_rate); 1769 } 1770 1771 nla_nest_end(msg, nl_rates); 1772 1773 return 0; 1774 } 1775 1776 static int 1777 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1778 const struct ieee80211_txrx_stypes *mgmt_stypes) 1779 { 1780 u16 stypes; 1781 struct nlattr *nl_ftypes, *nl_ifs; 1782 enum nl80211_iftype ift; 1783 int i; 1784 1785 if (!mgmt_stypes) 1786 return 0; 1787 1788 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 1789 if (!nl_ifs) 1790 return -ENOBUFS; 1791 1792 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1793 nl_ftypes = nla_nest_start_noflag(msg, ift); 1794 if (!nl_ftypes) 1795 return -ENOBUFS; 1796 i = 0; 1797 stypes = mgmt_stypes[ift].tx; 1798 while (stypes) { 1799 if ((stypes & 1) && 1800 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1801 (i << 4) | IEEE80211_FTYPE_MGMT)) 1802 return -ENOBUFS; 1803 stypes >>= 1; 1804 i++; 1805 } 1806 nla_nest_end(msg, nl_ftypes); 1807 } 1808 1809 nla_nest_end(msg, nl_ifs); 1810 1811 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 1812 if (!nl_ifs) 1813 return -ENOBUFS; 1814 1815 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1816 nl_ftypes = nla_nest_start_noflag(msg, ift); 1817 if (!nl_ftypes) 1818 return -ENOBUFS; 1819 i = 0; 1820 stypes = mgmt_stypes[ift].rx; 1821 while (stypes) { 1822 if ((stypes & 1) && 1823 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1824 (i << 4) | IEEE80211_FTYPE_MGMT)) 1825 return -ENOBUFS; 1826 stypes >>= 1; 1827 i++; 1828 } 1829 nla_nest_end(msg, nl_ftypes); 1830 } 1831 nla_nest_end(msg, nl_ifs); 1832 1833 return 0; 1834 } 1835 1836 #define CMD(op, n) \ 1837 do { \ 1838 if (rdev->ops->op) { \ 1839 i++; \ 1840 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1841 goto nla_put_failure; \ 1842 } \ 1843 } while (0) 1844 1845 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1846 struct sk_buff *msg) 1847 { 1848 int i = 0; 1849 1850 /* 1851 * do *NOT* add anything into this function, new things need to be 1852 * advertised only to new versions of userspace that can deal with 1853 * the split (and they can't possibly care about new features... 1854 */ 1855 CMD(add_virtual_intf, NEW_INTERFACE); 1856 CMD(change_virtual_intf, SET_INTERFACE); 1857 CMD(add_key, NEW_KEY); 1858 CMD(start_ap, START_AP); 1859 CMD(add_station, NEW_STATION); 1860 CMD(add_mpath, NEW_MPATH); 1861 CMD(update_mesh_config, SET_MESH_CONFIG); 1862 CMD(change_bss, SET_BSS); 1863 CMD(auth, AUTHENTICATE); 1864 CMD(assoc, ASSOCIATE); 1865 CMD(deauth, DEAUTHENTICATE); 1866 CMD(disassoc, DISASSOCIATE); 1867 CMD(join_ibss, JOIN_IBSS); 1868 CMD(join_mesh, JOIN_MESH); 1869 CMD(set_pmksa, SET_PMKSA); 1870 CMD(del_pmksa, DEL_PMKSA); 1871 CMD(flush_pmksa, FLUSH_PMKSA); 1872 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1873 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1874 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1875 CMD(mgmt_tx, FRAME); 1876 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1877 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1878 i++; 1879 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1880 goto nla_put_failure; 1881 } 1882 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1883 rdev->ops->join_mesh) { 1884 i++; 1885 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1886 goto nla_put_failure; 1887 } 1888 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1889 CMD(tdls_mgmt, TDLS_MGMT); 1890 CMD(tdls_oper, TDLS_OPER); 1891 } 1892 if (rdev->wiphy.max_sched_scan_reqs) 1893 CMD(sched_scan_start, START_SCHED_SCAN); 1894 CMD(probe_client, PROBE_CLIENT); 1895 CMD(set_noack_map, SET_NOACK_MAP); 1896 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1897 i++; 1898 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1899 goto nla_put_failure; 1900 } 1901 CMD(start_p2p_device, START_P2P_DEVICE); 1902 CMD(set_mcast_rate, SET_MCAST_RATE); 1903 #ifdef CONFIG_NL80211_TESTMODE 1904 CMD(testmode_cmd, TESTMODE); 1905 #endif 1906 1907 if (rdev->ops->connect || rdev->ops->auth) { 1908 i++; 1909 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1910 goto nla_put_failure; 1911 } 1912 1913 if (rdev->ops->disconnect || rdev->ops->deauth) { 1914 i++; 1915 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1916 goto nla_put_failure; 1917 } 1918 1919 return i; 1920 nla_put_failure: 1921 return -ENOBUFS; 1922 } 1923 1924 static int 1925 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 1926 struct sk_buff *msg) 1927 { 1928 struct nlattr *ftm; 1929 1930 if (!cap->ftm.supported) 1931 return 0; 1932 1933 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 1934 if (!ftm) 1935 return -ENOBUFS; 1936 1937 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 1938 return -ENOBUFS; 1939 if (cap->ftm.non_asap && 1940 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 1941 return -ENOBUFS; 1942 if (cap->ftm.request_lci && 1943 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 1944 return -ENOBUFS; 1945 if (cap->ftm.request_civicloc && 1946 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 1947 return -ENOBUFS; 1948 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 1949 cap->ftm.preambles)) 1950 return -ENOBUFS; 1951 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 1952 cap->ftm.bandwidths)) 1953 return -ENOBUFS; 1954 if (cap->ftm.max_bursts_exponent >= 0 && 1955 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 1956 cap->ftm.max_bursts_exponent)) 1957 return -ENOBUFS; 1958 if (cap->ftm.max_ftms_per_burst && 1959 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 1960 cap->ftm.max_ftms_per_burst)) 1961 return -ENOBUFS; 1962 if (cap->ftm.trigger_based && 1963 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 1964 return -ENOBUFS; 1965 if (cap->ftm.non_trigger_based && 1966 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 1967 return -ENOBUFS; 1968 1969 nla_nest_end(msg, ftm); 1970 return 0; 1971 } 1972 1973 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 1974 struct sk_buff *msg) 1975 { 1976 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 1977 struct nlattr *pmsr, *caps; 1978 1979 if (!cap) 1980 return 0; 1981 1982 /* 1983 * we don't need to clean up anything here since the caller 1984 * will genlmsg_cancel() if we fail 1985 */ 1986 1987 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 1988 if (!pmsr) 1989 return -ENOBUFS; 1990 1991 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 1992 return -ENOBUFS; 1993 1994 if (cap->report_ap_tsf && 1995 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 1996 return -ENOBUFS; 1997 1998 if (cap->randomize_mac_addr && 1999 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2000 return -ENOBUFS; 2001 2002 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2003 if (!caps) 2004 return -ENOBUFS; 2005 2006 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2007 return -ENOBUFS; 2008 2009 nla_nest_end(msg, caps); 2010 nla_nest_end(msg, pmsr); 2011 2012 return 0; 2013 } 2014 2015 static int 2016 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2017 struct sk_buff *msg) 2018 { 2019 int i; 2020 struct nlattr *nested, *nested_akms; 2021 const struct wiphy_iftype_akm_suites *iftype_akms; 2022 2023 if (!rdev->wiphy.num_iftype_akm_suites || 2024 !rdev->wiphy.iftype_akm_suites) 2025 return 0; 2026 2027 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2028 if (!nested) 2029 return -ENOBUFS; 2030 2031 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2032 nested_akms = nla_nest_start(msg, i + 1); 2033 if (!nested_akms) 2034 return -ENOBUFS; 2035 2036 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2037 2038 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2039 iftype_akms->iftypes_mask)) 2040 return -ENOBUFS; 2041 2042 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2043 sizeof(u32) * iftype_akms->n_akm_suites, 2044 iftype_akms->akm_suites)) { 2045 return -ENOBUFS; 2046 } 2047 nla_nest_end(msg, nested_akms); 2048 } 2049 2050 nla_nest_end(msg, nested); 2051 2052 return 0; 2053 } 2054 2055 static int 2056 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2057 struct sk_buff *msg) 2058 { 2059 struct nlattr *supp; 2060 2061 if (!rdev->wiphy.tid_config_support.vif && 2062 !rdev->wiphy.tid_config_support.peer) 2063 return 0; 2064 2065 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2066 if (!supp) 2067 return -ENOSPC; 2068 2069 if (rdev->wiphy.tid_config_support.vif && 2070 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2071 rdev->wiphy.tid_config_support.vif, 2072 NL80211_TID_CONFIG_ATTR_PAD)) 2073 goto fail; 2074 2075 if (rdev->wiphy.tid_config_support.peer && 2076 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2077 rdev->wiphy.tid_config_support.peer, 2078 NL80211_TID_CONFIG_ATTR_PAD)) 2079 goto fail; 2080 2081 /* for now we just use the same value ... makes more sense */ 2082 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2083 rdev->wiphy.tid_config_support.max_retry)) 2084 goto fail; 2085 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2086 rdev->wiphy.tid_config_support.max_retry)) 2087 goto fail; 2088 2089 nla_nest_end(msg, supp); 2090 2091 return 0; 2092 fail: 2093 nla_nest_cancel(msg, supp); 2094 return -ENOBUFS; 2095 } 2096 2097 struct nl80211_dump_wiphy_state { 2098 s64 filter_wiphy; 2099 long start; 2100 long split_start, band_start, chan_start, capa_start; 2101 bool split; 2102 }; 2103 2104 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2105 enum nl80211_commands cmd, 2106 struct sk_buff *msg, u32 portid, u32 seq, 2107 int flags, struct nl80211_dump_wiphy_state *state) 2108 { 2109 void *hdr; 2110 struct nlattr *nl_bands, *nl_band; 2111 struct nlattr *nl_freqs, *nl_freq; 2112 struct nlattr *nl_cmds; 2113 enum nl80211_band band; 2114 struct ieee80211_channel *chan; 2115 int i; 2116 const struct ieee80211_txrx_stypes *mgmt_stypes = 2117 rdev->wiphy.mgmt_stypes; 2118 u32 features; 2119 2120 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2121 if (!hdr) 2122 return -ENOBUFS; 2123 2124 if (WARN_ON(!state)) 2125 return -EINVAL; 2126 2127 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2128 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2129 wiphy_name(&rdev->wiphy)) || 2130 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2131 cfg80211_rdev_list_generation)) 2132 goto nla_put_failure; 2133 2134 if (cmd != NL80211_CMD_NEW_WIPHY) 2135 goto finish; 2136 2137 switch (state->split_start) { 2138 case 0: 2139 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2140 rdev->wiphy.retry_short) || 2141 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2142 rdev->wiphy.retry_long) || 2143 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2144 rdev->wiphy.frag_threshold) || 2145 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2146 rdev->wiphy.rts_threshold) || 2147 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2148 rdev->wiphy.coverage_class) || 2149 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2150 rdev->wiphy.max_scan_ssids) || 2151 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2152 rdev->wiphy.max_sched_scan_ssids) || 2153 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2154 rdev->wiphy.max_scan_ie_len) || 2155 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2156 rdev->wiphy.max_sched_scan_ie_len) || 2157 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2158 rdev->wiphy.max_match_sets)) 2159 goto nla_put_failure; 2160 2161 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2162 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2163 goto nla_put_failure; 2164 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2165 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2166 goto nla_put_failure; 2167 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2168 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2169 goto nla_put_failure; 2170 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2171 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2172 goto nla_put_failure; 2173 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2174 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2175 goto nla_put_failure; 2176 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2177 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2178 goto nla_put_failure; 2179 state->split_start++; 2180 if (state->split) 2181 break; 2182 fallthrough; 2183 case 1: 2184 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2185 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2186 rdev->wiphy.cipher_suites)) 2187 goto nla_put_failure; 2188 2189 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2190 rdev->wiphy.max_num_pmkids)) 2191 goto nla_put_failure; 2192 2193 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2194 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2195 goto nla_put_failure; 2196 2197 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2198 rdev->wiphy.available_antennas_tx) || 2199 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2200 rdev->wiphy.available_antennas_rx)) 2201 goto nla_put_failure; 2202 2203 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2204 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2205 rdev->wiphy.probe_resp_offload)) 2206 goto nla_put_failure; 2207 2208 if ((rdev->wiphy.available_antennas_tx || 2209 rdev->wiphy.available_antennas_rx) && 2210 rdev->ops->get_antenna) { 2211 u32 tx_ant = 0, rx_ant = 0; 2212 int res; 2213 2214 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2215 if (!res) { 2216 if (nla_put_u32(msg, 2217 NL80211_ATTR_WIPHY_ANTENNA_TX, 2218 tx_ant) || 2219 nla_put_u32(msg, 2220 NL80211_ATTR_WIPHY_ANTENNA_RX, 2221 rx_ant)) 2222 goto nla_put_failure; 2223 } 2224 } 2225 2226 state->split_start++; 2227 if (state->split) 2228 break; 2229 fallthrough; 2230 case 2: 2231 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2232 rdev->wiphy.interface_modes)) 2233 goto nla_put_failure; 2234 state->split_start++; 2235 if (state->split) 2236 break; 2237 fallthrough; 2238 case 3: 2239 nl_bands = nla_nest_start_noflag(msg, 2240 NL80211_ATTR_WIPHY_BANDS); 2241 if (!nl_bands) 2242 goto nla_put_failure; 2243 2244 for (band = state->band_start; 2245 band < NUM_NL80211_BANDS; band++) { 2246 struct ieee80211_supported_band *sband; 2247 2248 /* omit higher bands for ancient software */ 2249 if (band > NL80211_BAND_5GHZ && !state->split) 2250 break; 2251 2252 sband = rdev->wiphy.bands[band]; 2253 2254 if (!sband) 2255 continue; 2256 2257 nl_band = nla_nest_start_noflag(msg, band); 2258 if (!nl_band) 2259 goto nla_put_failure; 2260 2261 switch (state->chan_start) { 2262 case 0: 2263 if (nl80211_send_band_rateinfo(msg, sband, 2264 state->split)) 2265 goto nla_put_failure; 2266 state->chan_start++; 2267 if (state->split) 2268 break; 2269 fallthrough; 2270 default: 2271 /* add frequencies */ 2272 nl_freqs = nla_nest_start_noflag(msg, 2273 NL80211_BAND_ATTR_FREQS); 2274 if (!nl_freqs) 2275 goto nla_put_failure; 2276 2277 for (i = state->chan_start - 1; 2278 i < sband->n_channels; 2279 i++) { 2280 nl_freq = nla_nest_start_noflag(msg, 2281 i); 2282 if (!nl_freq) 2283 goto nla_put_failure; 2284 2285 chan = &sband->channels[i]; 2286 2287 if (nl80211_msg_put_channel( 2288 msg, &rdev->wiphy, chan, 2289 state->split)) 2290 goto nla_put_failure; 2291 2292 nla_nest_end(msg, nl_freq); 2293 if (state->split) 2294 break; 2295 } 2296 if (i < sband->n_channels) 2297 state->chan_start = i + 2; 2298 else 2299 state->chan_start = 0; 2300 nla_nest_end(msg, nl_freqs); 2301 } 2302 2303 nla_nest_end(msg, nl_band); 2304 2305 if (state->split) { 2306 /* start again here */ 2307 if (state->chan_start) 2308 band--; 2309 break; 2310 } 2311 } 2312 nla_nest_end(msg, nl_bands); 2313 2314 if (band < NUM_NL80211_BANDS) 2315 state->band_start = band + 1; 2316 else 2317 state->band_start = 0; 2318 2319 /* if bands & channels are done, continue outside */ 2320 if (state->band_start == 0 && state->chan_start == 0) 2321 state->split_start++; 2322 if (state->split) 2323 break; 2324 fallthrough; 2325 case 4: 2326 nl_cmds = nla_nest_start_noflag(msg, 2327 NL80211_ATTR_SUPPORTED_COMMANDS); 2328 if (!nl_cmds) 2329 goto nla_put_failure; 2330 2331 i = nl80211_add_commands_unsplit(rdev, msg); 2332 if (i < 0) 2333 goto nla_put_failure; 2334 if (state->split) { 2335 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2336 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2337 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2338 CMD(channel_switch, CHANNEL_SWITCH); 2339 CMD(set_qos_map, SET_QOS_MAP); 2340 if (rdev->wiphy.features & 2341 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2342 CMD(add_tx_ts, ADD_TX_TS); 2343 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2344 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2345 CMD(update_ft_ies, UPDATE_FT_IES); 2346 } 2347 #undef CMD 2348 2349 nla_nest_end(msg, nl_cmds); 2350 state->split_start++; 2351 if (state->split) 2352 break; 2353 fallthrough; 2354 case 5: 2355 if (rdev->ops->remain_on_channel && 2356 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2357 nla_put_u32(msg, 2358 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2359 rdev->wiphy.max_remain_on_channel_duration)) 2360 goto nla_put_failure; 2361 2362 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2363 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2364 goto nla_put_failure; 2365 2366 state->split_start++; 2367 if (state->split) 2368 break; 2369 fallthrough; 2370 case 6: 2371 #ifdef CONFIG_PM 2372 if (nl80211_send_wowlan(msg, rdev, state->split)) 2373 goto nla_put_failure; 2374 state->split_start++; 2375 if (state->split) 2376 break; 2377 #else 2378 state->split_start++; 2379 #endif 2380 fallthrough; 2381 case 7: 2382 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2383 rdev->wiphy.software_iftypes)) 2384 goto nla_put_failure; 2385 2386 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2387 state->split)) 2388 goto nla_put_failure; 2389 2390 state->split_start++; 2391 if (state->split) 2392 break; 2393 fallthrough; 2394 case 8: 2395 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2396 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2397 rdev->wiphy.ap_sme_capa)) 2398 goto nla_put_failure; 2399 2400 features = rdev->wiphy.features; 2401 /* 2402 * We can only add the per-channel limit information if the 2403 * dump is split, otherwise it makes it too big. Therefore 2404 * only advertise it in that case. 2405 */ 2406 if (state->split) 2407 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2408 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2409 goto nla_put_failure; 2410 2411 if (rdev->wiphy.ht_capa_mod_mask && 2412 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2413 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2414 rdev->wiphy.ht_capa_mod_mask)) 2415 goto nla_put_failure; 2416 2417 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2418 rdev->wiphy.max_acl_mac_addrs && 2419 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2420 rdev->wiphy.max_acl_mac_addrs)) 2421 goto nla_put_failure; 2422 2423 /* 2424 * Any information below this point is only available to 2425 * applications that can deal with it being split. This 2426 * helps ensure that newly added capabilities don't break 2427 * older tools by overrunning their buffers. 2428 * 2429 * We still increment split_start so that in the split 2430 * case we'll continue with more data in the next round, 2431 * but break unconditionally so unsplit data stops here. 2432 */ 2433 if (state->split) 2434 state->split_start++; 2435 else 2436 state->split_start = 0; 2437 break; 2438 case 9: 2439 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2440 goto nla_put_failure; 2441 2442 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2443 rdev->wiphy.max_sched_scan_plans) || 2444 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2445 rdev->wiphy.max_sched_scan_plan_interval) || 2446 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2447 rdev->wiphy.max_sched_scan_plan_iterations)) 2448 goto nla_put_failure; 2449 2450 if (rdev->wiphy.extended_capabilities && 2451 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2452 rdev->wiphy.extended_capabilities_len, 2453 rdev->wiphy.extended_capabilities) || 2454 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2455 rdev->wiphy.extended_capabilities_len, 2456 rdev->wiphy.extended_capabilities_mask))) 2457 goto nla_put_failure; 2458 2459 if (rdev->wiphy.vht_capa_mod_mask && 2460 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2461 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2462 rdev->wiphy.vht_capa_mod_mask)) 2463 goto nla_put_failure; 2464 2465 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2466 rdev->wiphy.perm_addr)) 2467 goto nla_put_failure; 2468 2469 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2470 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2471 rdev->wiphy.addr_mask)) 2472 goto nla_put_failure; 2473 2474 if (rdev->wiphy.n_addresses > 1) { 2475 void *attr; 2476 2477 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2478 if (!attr) 2479 goto nla_put_failure; 2480 2481 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2482 if (nla_put(msg, i + 1, ETH_ALEN, 2483 rdev->wiphy.addresses[i].addr)) 2484 goto nla_put_failure; 2485 2486 nla_nest_end(msg, attr); 2487 } 2488 2489 state->split_start++; 2490 break; 2491 case 10: 2492 if (nl80211_send_coalesce(msg, rdev)) 2493 goto nla_put_failure; 2494 2495 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2496 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2497 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2498 goto nla_put_failure; 2499 2500 if (rdev->wiphy.max_ap_assoc_sta && 2501 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2502 rdev->wiphy.max_ap_assoc_sta)) 2503 goto nla_put_failure; 2504 2505 state->split_start++; 2506 break; 2507 case 11: 2508 if (rdev->wiphy.n_vendor_commands) { 2509 const struct nl80211_vendor_cmd_info *info; 2510 struct nlattr *nested; 2511 2512 nested = nla_nest_start_noflag(msg, 2513 NL80211_ATTR_VENDOR_DATA); 2514 if (!nested) 2515 goto nla_put_failure; 2516 2517 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2518 info = &rdev->wiphy.vendor_commands[i].info; 2519 if (nla_put(msg, i + 1, sizeof(*info), info)) 2520 goto nla_put_failure; 2521 } 2522 nla_nest_end(msg, nested); 2523 } 2524 2525 if (rdev->wiphy.n_vendor_events) { 2526 const struct nl80211_vendor_cmd_info *info; 2527 struct nlattr *nested; 2528 2529 nested = nla_nest_start_noflag(msg, 2530 NL80211_ATTR_VENDOR_EVENTS); 2531 if (!nested) 2532 goto nla_put_failure; 2533 2534 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2535 info = &rdev->wiphy.vendor_events[i]; 2536 if (nla_put(msg, i + 1, sizeof(*info), info)) 2537 goto nla_put_failure; 2538 } 2539 nla_nest_end(msg, nested); 2540 } 2541 state->split_start++; 2542 break; 2543 case 12: 2544 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2545 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2546 rdev->wiphy.max_num_csa_counters)) 2547 goto nla_put_failure; 2548 2549 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2550 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2551 goto nla_put_failure; 2552 2553 if (rdev->wiphy.max_sched_scan_reqs && 2554 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2555 rdev->wiphy.max_sched_scan_reqs)) 2556 goto nla_put_failure; 2557 2558 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2559 sizeof(rdev->wiphy.ext_features), 2560 rdev->wiphy.ext_features)) 2561 goto nla_put_failure; 2562 2563 if (rdev->wiphy.bss_select_support) { 2564 struct nlattr *nested; 2565 u32 bss_select_support = rdev->wiphy.bss_select_support; 2566 2567 nested = nla_nest_start_noflag(msg, 2568 NL80211_ATTR_BSS_SELECT); 2569 if (!nested) 2570 goto nla_put_failure; 2571 2572 i = 0; 2573 while (bss_select_support) { 2574 if ((bss_select_support & 1) && 2575 nla_put_flag(msg, i)) 2576 goto nla_put_failure; 2577 i++; 2578 bss_select_support >>= 1; 2579 } 2580 nla_nest_end(msg, nested); 2581 } 2582 2583 state->split_start++; 2584 break; 2585 case 13: 2586 if (rdev->wiphy.num_iftype_ext_capab && 2587 rdev->wiphy.iftype_ext_capab) { 2588 struct nlattr *nested_ext_capab, *nested; 2589 2590 nested = nla_nest_start_noflag(msg, 2591 NL80211_ATTR_IFTYPE_EXT_CAPA); 2592 if (!nested) 2593 goto nla_put_failure; 2594 2595 for (i = state->capa_start; 2596 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2597 const struct wiphy_iftype_ext_capab *capab; 2598 2599 capab = &rdev->wiphy.iftype_ext_capab[i]; 2600 2601 nested_ext_capab = nla_nest_start_noflag(msg, 2602 i); 2603 if (!nested_ext_capab || 2604 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2605 capab->iftype) || 2606 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2607 capab->extended_capabilities_len, 2608 capab->extended_capabilities) || 2609 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2610 capab->extended_capabilities_len, 2611 capab->extended_capabilities_mask)) 2612 goto nla_put_failure; 2613 2614 nla_nest_end(msg, nested_ext_capab); 2615 if (state->split) 2616 break; 2617 } 2618 nla_nest_end(msg, nested); 2619 if (i < rdev->wiphy.num_iftype_ext_capab) { 2620 state->capa_start = i + 1; 2621 break; 2622 } 2623 } 2624 2625 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2626 rdev->wiphy.nan_supported_bands)) 2627 goto nla_put_failure; 2628 2629 if (wiphy_ext_feature_isset(&rdev->wiphy, 2630 NL80211_EXT_FEATURE_TXQS)) { 2631 struct cfg80211_txq_stats txqstats = {}; 2632 int res; 2633 2634 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2635 if (!res && 2636 !nl80211_put_txq_stats(msg, &txqstats, 2637 NL80211_ATTR_TXQ_STATS)) 2638 goto nla_put_failure; 2639 2640 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2641 rdev->wiphy.txq_limit)) 2642 goto nla_put_failure; 2643 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2644 rdev->wiphy.txq_memory_limit)) 2645 goto nla_put_failure; 2646 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2647 rdev->wiphy.txq_quantum)) 2648 goto nla_put_failure; 2649 } 2650 2651 state->split_start++; 2652 break; 2653 case 14: 2654 if (nl80211_send_pmsr_capa(rdev, msg)) 2655 goto nla_put_failure; 2656 2657 state->split_start++; 2658 break; 2659 case 15: 2660 if (rdev->wiphy.akm_suites && 2661 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2662 sizeof(u32) * rdev->wiphy.n_akm_suites, 2663 rdev->wiphy.akm_suites)) 2664 goto nla_put_failure; 2665 2666 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2667 goto nla_put_failure; 2668 2669 if (nl80211_put_tid_config_support(rdev, msg)) 2670 goto nla_put_failure; 2671 2672 /* done */ 2673 state->split_start = 0; 2674 break; 2675 } 2676 finish: 2677 genlmsg_end(msg, hdr); 2678 return 0; 2679 2680 nla_put_failure: 2681 genlmsg_cancel(msg, hdr); 2682 return -EMSGSIZE; 2683 } 2684 2685 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2686 struct netlink_callback *cb, 2687 struct nl80211_dump_wiphy_state *state) 2688 { 2689 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 2690 int ret; 2691 2692 if (!tb) 2693 return -ENOMEM; 2694 2695 ret = nlmsg_parse_deprecated(cb->nlh, 2696 GENL_HDRLEN + nl80211_fam.hdrsize, 2697 tb, nl80211_fam.maxattr, 2698 nl80211_policy, NULL); 2699 /* ignore parse errors for backward compatibility */ 2700 if (ret) { 2701 ret = 0; 2702 goto out; 2703 } 2704 2705 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 2706 if (tb[NL80211_ATTR_WIPHY]) 2707 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 2708 if (tb[NL80211_ATTR_WDEV]) 2709 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 2710 if (tb[NL80211_ATTR_IFINDEX]) { 2711 struct net_device *netdev; 2712 struct cfg80211_registered_device *rdev; 2713 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 2714 2715 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 2716 if (!netdev) { 2717 ret = -ENODEV; 2718 goto out; 2719 } 2720 if (netdev->ieee80211_ptr) { 2721 rdev = wiphy_to_rdev( 2722 netdev->ieee80211_ptr->wiphy); 2723 state->filter_wiphy = rdev->wiphy_idx; 2724 } 2725 } 2726 2727 ret = 0; 2728 out: 2729 kfree(tb); 2730 return ret; 2731 } 2732 2733 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 2734 { 2735 int idx = 0, ret; 2736 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 2737 struct cfg80211_registered_device *rdev; 2738 2739 rtnl_lock(); 2740 if (!state) { 2741 state = kzalloc(sizeof(*state), GFP_KERNEL); 2742 if (!state) { 2743 rtnl_unlock(); 2744 return -ENOMEM; 2745 } 2746 state->filter_wiphy = -1; 2747 ret = nl80211_dump_wiphy_parse(skb, cb, state); 2748 if (ret) { 2749 kfree(state); 2750 rtnl_unlock(); 2751 return ret; 2752 } 2753 cb->args[0] = (long)state; 2754 } 2755 2756 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2757 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2758 continue; 2759 if (++idx <= state->start) 2760 continue; 2761 if (state->filter_wiphy != -1 && 2762 state->filter_wiphy != rdev->wiphy_idx) 2763 continue; 2764 /* attempt to fit multiple wiphy data chunks into the skb */ 2765 do { 2766 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 2767 skb, 2768 NETLINK_CB(cb->skb).portid, 2769 cb->nlh->nlmsg_seq, 2770 NLM_F_MULTI, state); 2771 if (ret < 0) { 2772 /* 2773 * If sending the wiphy data didn't fit (ENOBUFS 2774 * or EMSGSIZE returned), this SKB is still 2775 * empty (so it's not too big because another 2776 * wiphy dataset is already in the skb) and 2777 * we've not tried to adjust the dump allocation 2778 * yet ... then adjust the alloc size to be 2779 * bigger, and return 1 but with the empty skb. 2780 * This results in an empty message being RX'ed 2781 * in userspace, but that is ignored. 2782 * 2783 * We can then retry with the larger buffer. 2784 */ 2785 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2786 !skb->len && !state->split && 2787 cb->min_dump_alloc < 4096) { 2788 cb->min_dump_alloc = 4096; 2789 state->split_start = 0; 2790 rtnl_unlock(); 2791 return 1; 2792 } 2793 idx--; 2794 break; 2795 } 2796 } while (state->split_start > 0); 2797 break; 2798 } 2799 rtnl_unlock(); 2800 2801 state->start = idx; 2802 2803 return skb->len; 2804 } 2805 2806 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2807 { 2808 kfree((void *)cb->args[0]); 2809 return 0; 2810 } 2811 2812 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2813 { 2814 struct sk_buff *msg; 2815 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2816 struct nl80211_dump_wiphy_state state = {}; 2817 2818 msg = nlmsg_new(4096, GFP_KERNEL); 2819 if (!msg) 2820 return -ENOMEM; 2821 2822 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2823 info->snd_portid, info->snd_seq, 0, 2824 &state) < 0) { 2825 nlmsg_free(msg); 2826 return -ENOBUFS; 2827 } 2828 2829 return genlmsg_reply(msg, info); 2830 } 2831 2832 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2833 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2834 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2835 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2836 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2837 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2838 }; 2839 2840 static int parse_txq_params(struct nlattr *tb[], 2841 struct ieee80211_txq_params *txq_params) 2842 { 2843 u8 ac; 2844 2845 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2846 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2847 !tb[NL80211_TXQ_ATTR_AIFS]) 2848 return -EINVAL; 2849 2850 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2851 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2852 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2853 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2854 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2855 2856 if (ac >= NL80211_NUM_ACS) 2857 return -EINVAL; 2858 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 2859 return 0; 2860 } 2861 2862 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2863 { 2864 /* 2865 * You can only set the channel explicitly for some interfaces, 2866 * most have their channel managed via their respective 2867 * "establish a connection" command (connect, join, ...) 2868 * 2869 * For AP/GO and mesh mode, the channel can be set with the 2870 * channel userspace API, but is only stored and passed to the 2871 * low-level driver when the AP starts or the mesh is joined. 2872 * This is for backward compatibility, userspace can also give 2873 * the channel in the start-ap or join-mesh commands instead. 2874 * 2875 * Monitors are special as they are normally slaved to 2876 * whatever else is going on, so they have their own special 2877 * operation to set the monitor channel if possible. 2878 */ 2879 return !wdev || 2880 wdev->iftype == NL80211_IFTYPE_AP || 2881 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2882 wdev->iftype == NL80211_IFTYPE_MONITOR || 2883 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2884 } 2885 2886 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2887 struct genl_info *info, 2888 struct cfg80211_chan_def *chandef) 2889 { 2890 struct netlink_ext_ack *extack = info->extack; 2891 struct nlattr **attrs = info->attrs; 2892 u32 control_freq; 2893 2894 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) 2895 return -EINVAL; 2896 2897 control_freq = MHZ_TO_KHZ( 2898 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 2899 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 2900 control_freq += 2901 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 2902 2903 memset(chandef, 0, sizeof(*chandef)); 2904 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 2905 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2906 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 2907 chandef->freq1_offset = control_freq % 1000; 2908 chandef->center_freq2 = 0; 2909 2910 /* Primary channel not allowed */ 2911 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 2912 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 2913 "Channel is disabled"); 2914 return -EINVAL; 2915 } 2916 2917 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2918 enum nl80211_channel_type chantype; 2919 2920 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2921 2922 switch (chantype) { 2923 case NL80211_CHAN_NO_HT: 2924 case NL80211_CHAN_HT20: 2925 case NL80211_CHAN_HT40PLUS: 2926 case NL80211_CHAN_HT40MINUS: 2927 cfg80211_chandef_create(chandef, chandef->chan, 2928 chantype); 2929 /* user input for center_freq is incorrect */ 2930 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 2931 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 2932 NL_SET_ERR_MSG_ATTR(extack, 2933 attrs[NL80211_ATTR_CENTER_FREQ1], 2934 "bad center frequency 1"); 2935 return -EINVAL; 2936 } 2937 /* center_freq2 must be zero */ 2938 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 2939 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 2940 NL_SET_ERR_MSG_ATTR(extack, 2941 attrs[NL80211_ATTR_CENTER_FREQ2], 2942 "center frequency 2 can't be used"); 2943 return -EINVAL; 2944 } 2945 break; 2946 default: 2947 NL_SET_ERR_MSG_ATTR(extack, 2948 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 2949 "invalid channel type"); 2950 return -EINVAL; 2951 } 2952 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2953 chandef->width = 2954 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2955 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 2956 chandef->center_freq1 = 2957 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 2958 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 2959 chandef->freq1_offset = nla_get_u32( 2960 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 2961 else 2962 chandef->freq1_offset = 0; 2963 } 2964 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 2965 chandef->center_freq2 = 2966 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 2967 } 2968 2969 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 2970 chandef->edmg.channels = 2971 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 2972 2973 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 2974 chandef->edmg.bw_config = 2975 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 2976 } else { 2977 chandef->edmg.bw_config = 0; 2978 chandef->edmg.channels = 0; 2979 } 2980 2981 if (!cfg80211_chandef_valid(chandef)) { 2982 NL_SET_ERR_MSG(extack, "invalid channel definition"); 2983 return -EINVAL; 2984 } 2985 2986 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2987 IEEE80211_CHAN_DISABLED)) { 2988 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 2989 return -EINVAL; 2990 } 2991 2992 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2993 chandef->width == NL80211_CHAN_WIDTH_10) && 2994 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 2995 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 2996 return -EINVAL; 2997 } 2998 2999 return 0; 3000 } 3001 3002 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3003 struct net_device *dev, 3004 struct genl_info *info) 3005 { 3006 struct cfg80211_chan_def chandef; 3007 int result; 3008 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3009 struct wireless_dev *wdev = NULL; 3010 3011 if (dev) 3012 wdev = dev->ieee80211_ptr; 3013 if (!nl80211_can_set_dev_channel(wdev)) 3014 return -EOPNOTSUPP; 3015 if (wdev) 3016 iftype = wdev->iftype; 3017 3018 result = nl80211_parse_chandef(rdev, info, &chandef); 3019 if (result) 3020 return result; 3021 3022 switch (iftype) { 3023 case NL80211_IFTYPE_AP: 3024 case NL80211_IFTYPE_P2P_GO: 3025 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3026 iftype)) { 3027 result = -EINVAL; 3028 break; 3029 } 3030 if (wdev->beacon_interval) { 3031 if (!dev || !rdev->ops->set_ap_chanwidth || 3032 !(rdev->wiphy.features & 3033 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 3034 result = -EBUSY; 3035 break; 3036 } 3037 3038 /* Only allow dynamic channel width changes */ 3039 if (chandef.chan != wdev->preset_chandef.chan) { 3040 result = -EBUSY; 3041 break; 3042 } 3043 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 3044 if (result) 3045 break; 3046 } 3047 wdev->preset_chandef = chandef; 3048 result = 0; 3049 break; 3050 case NL80211_IFTYPE_MESH_POINT: 3051 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3052 break; 3053 case NL80211_IFTYPE_MONITOR: 3054 result = cfg80211_set_monitor_channel(rdev, &chandef); 3055 break; 3056 default: 3057 result = -EINVAL; 3058 } 3059 3060 return result; 3061 } 3062 3063 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3064 { 3065 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3066 struct net_device *netdev = info->user_ptr[1]; 3067 3068 return __nl80211_set_channel(rdev, netdev, info); 3069 } 3070 3071 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3072 { 3073 struct cfg80211_registered_device *rdev; 3074 struct net_device *netdev = NULL; 3075 struct wireless_dev *wdev; 3076 int result = 0, rem_txq_params = 0; 3077 struct nlattr *nl_txq_params; 3078 u32 changed; 3079 u8 retry_short = 0, retry_long = 0; 3080 u32 frag_threshold = 0, rts_threshold = 0; 3081 u8 coverage_class = 0; 3082 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3083 3084 ASSERT_RTNL(); 3085 3086 /* 3087 * Try to find the wiphy and netdev. Normally this 3088 * function shouldn't need the netdev, but this is 3089 * done for backward compatibility -- previously 3090 * setting the channel was done per wiphy, but now 3091 * it is per netdev. Previous userland like hostapd 3092 * also passed a netdev to set_wiphy, so that it is 3093 * possible to let that go to the right netdev! 3094 */ 3095 3096 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3097 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3098 3099 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3100 if (netdev && netdev->ieee80211_ptr) 3101 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3102 else 3103 netdev = NULL; 3104 } 3105 3106 if (!netdev) { 3107 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3108 info->attrs); 3109 if (IS_ERR(rdev)) 3110 return PTR_ERR(rdev); 3111 wdev = NULL; 3112 netdev = NULL; 3113 result = 0; 3114 } else 3115 wdev = netdev->ieee80211_ptr; 3116 3117 /* 3118 * end workaround code, by now the rdev is available 3119 * and locked, and wdev may or may not be NULL. 3120 */ 3121 3122 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3123 result = cfg80211_dev_rename( 3124 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3125 3126 if (result) 3127 return result; 3128 3129 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3130 struct ieee80211_txq_params txq_params; 3131 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3132 3133 if (!rdev->ops->set_txq_params) 3134 return -EOPNOTSUPP; 3135 3136 if (!netdev) 3137 return -EINVAL; 3138 3139 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3140 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3141 return -EINVAL; 3142 3143 if (!netif_running(netdev)) 3144 return -ENETDOWN; 3145 3146 nla_for_each_nested(nl_txq_params, 3147 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3148 rem_txq_params) { 3149 result = nla_parse_nested_deprecated(tb, 3150 NL80211_TXQ_ATTR_MAX, 3151 nl_txq_params, 3152 txq_params_policy, 3153 info->extack); 3154 if (result) 3155 return result; 3156 result = parse_txq_params(tb, &txq_params); 3157 if (result) 3158 return result; 3159 3160 result = rdev_set_txq_params(rdev, netdev, 3161 &txq_params); 3162 if (result) 3163 return result; 3164 } 3165 } 3166 3167 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3168 result = __nl80211_set_channel( 3169 rdev, 3170 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3171 info); 3172 if (result) 3173 return result; 3174 } 3175 3176 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3177 struct wireless_dev *txp_wdev = wdev; 3178 enum nl80211_tx_power_setting type; 3179 int idx, mbm = 0; 3180 3181 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3182 txp_wdev = NULL; 3183 3184 if (!rdev->ops->set_tx_power) 3185 return -EOPNOTSUPP; 3186 3187 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3188 type = nla_get_u32(info->attrs[idx]); 3189 3190 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3191 (type != NL80211_TX_POWER_AUTOMATIC)) 3192 return -EINVAL; 3193 3194 if (type != NL80211_TX_POWER_AUTOMATIC) { 3195 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3196 mbm = nla_get_u32(info->attrs[idx]); 3197 } 3198 3199 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3200 if (result) 3201 return result; 3202 } 3203 3204 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3205 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3206 u32 tx_ant, rx_ant; 3207 3208 if ((!rdev->wiphy.available_antennas_tx && 3209 !rdev->wiphy.available_antennas_rx) || 3210 !rdev->ops->set_antenna) 3211 return -EOPNOTSUPP; 3212 3213 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3214 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3215 3216 /* reject antenna configurations which don't match the 3217 * available antenna masks, except for the "all" mask */ 3218 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3219 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 3220 return -EINVAL; 3221 3222 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3223 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3224 3225 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3226 if (result) 3227 return result; 3228 } 3229 3230 changed = 0; 3231 3232 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3233 retry_short = nla_get_u8( 3234 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3235 3236 changed |= WIPHY_PARAM_RETRY_SHORT; 3237 } 3238 3239 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3240 retry_long = nla_get_u8( 3241 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3242 3243 changed |= WIPHY_PARAM_RETRY_LONG; 3244 } 3245 3246 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3247 frag_threshold = nla_get_u32( 3248 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3249 if (frag_threshold < 256) 3250 return -EINVAL; 3251 3252 if (frag_threshold != (u32) -1) { 3253 /* 3254 * Fragments (apart from the last one) are required to 3255 * have even length. Make the fragmentation code 3256 * simpler by stripping LSB should someone try to use 3257 * odd threshold value. 3258 */ 3259 frag_threshold &= ~0x1; 3260 } 3261 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3262 } 3263 3264 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3265 rts_threshold = nla_get_u32( 3266 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3267 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3268 } 3269 3270 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3271 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 3272 return -EINVAL; 3273 3274 coverage_class = nla_get_u8( 3275 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3276 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3277 } 3278 3279 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3280 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 3281 return -EOPNOTSUPP; 3282 3283 changed |= WIPHY_PARAM_DYN_ACK; 3284 } 3285 3286 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3287 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3288 NL80211_EXT_FEATURE_TXQS)) 3289 return -EOPNOTSUPP; 3290 txq_limit = nla_get_u32( 3291 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3292 changed |= WIPHY_PARAM_TXQ_LIMIT; 3293 } 3294 3295 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3296 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3297 NL80211_EXT_FEATURE_TXQS)) 3298 return -EOPNOTSUPP; 3299 txq_memory_limit = nla_get_u32( 3300 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3301 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3302 } 3303 3304 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3305 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3306 NL80211_EXT_FEATURE_TXQS)) 3307 return -EOPNOTSUPP; 3308 txq_quantum = nla_get_u32( 3309 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3310 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3311 } 3312 3313 if (changed) { 3314 u8 old_retry_short, old_retry_long; 3315 u32 old_frag_threshold, old_rts_threshold; 3316 u8 old_coverage_class; 3317 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3318 3319 if (!rdev->ops->set_wiphy_params) 3320 return -EOPNOTSUPP; 3321 3322 old_retry_short = rdev->wiphy.retry_short; 3323 old_retry_long = rdev->wiphy.retry_long; 3324 old_frag_threshold = rdev->wiphy.frag_threshold; 3325 old_rts_threshold = rdev->wiphy.rts_threshold; 3326 old_coverage_class = rdev->wiphy.coverage_class; 3327 old_txq_limit = rdev->wiphy.txq_limit; 3328 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3329 old_txq_quantum = rdev->wiphy.txq_quantum; 3330 3331 if (changed & WIPHY_PARAM_RETRY_SHORT) 3332 rdev->wiphy.retry_short = retry_short; 3333 if (changed & WIPHY_PARAM_RETRY_LONG) 3334 rdev->wiphy.retry_long = retry_long; 3335 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3336 rdev->wiphy.frag_threshold = frag_threshold; 3337 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3338 rdev->wiphy.rts_threshold = rts_threshold; 3339 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3340 rdev->wiphy.coverage_class = coverage_class; 3341 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3342 rdev->wiphy.txq_limit = txq_limit; 3343 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3344 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3345 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3346 rdev->wiphy.txq_quantum = txq_quantum; 3347 3348 result = rdev_set_wiphy_params(rdev, changed); 3349 if (result) { 3350 rdev->wiphy.retry_short = old_retry_short; 3351 rdev->wiphy.retry_long = old_retry_long; 3352 rdev->wiphy.frag_threshold = old_frag_threshold; 3353 rdev->wiphy.rts_threshold = old_rts_threshold; 3354 rdev->wiphy.coverage_class = old_coverage_class; 3355 rdev->wiphy.txq_limit = old_txq_limit; 3356 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3357 rdev->wiphy.txq_quantum = old_txq_quantum; 3358 return result; 3359 } 3360 } 3361 return 0; 3362 } 3363 3364 static int nl80211_send_chandef(struct sk_buff *msg, 3365 const struct cfg80211_chan_def *chandef) 3366 { 3367 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3368 return -EINVAL; 3369 3370 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3371 chandef->chan->center_freq)) 3372 return -ENOBUFS; 3373 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3374 chandef->chan->freq_offset)) 3375 return -ENOBUFS; 3376 switch (chandef->width) { 3377 case NL80211_CHAN_WIDTH_20_NOHT: 3378 case NL80211_CHAN_WIDTH_20: 3379 case NL80211_CHAN_WIDTH_40: 3380 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3381 cfg80211_get_chandef_type(chandef))) 3382 return -ENOBUFS; 3383 break; 3384 default: 3385 break; 3386 } 3387 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3388 return -ENOBUFS; 3389 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3390 return -ENOBUFS; 3391 if (chandef->center_freq2 && 3392 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3393 return -ENOBUFS; 3394 return 0; 3395 } 3396 3397 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3398 struct cfg80211_registered_device *rdev, 3399 struct wireless_dev *wdev, 3400 enum nl80211_commands cmd) 3401 { 3402 struct net_device *dev = wdev->netdev; 3403 void *hdr; 3404 3405 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3406 cmd != NL80211_CMD_DEL_INTERFACE && 3407 cmd != NL80211_CMD_SET_INTERFACE); 3408 3409 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3410 if (!hdr) 3411 return -1; 3412 3413 if (dev && 3414 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3415 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3416 goto nla_put_failure; 3417 3418 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3419 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3420 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3421 NL80211_ATTR_PAD) || 3422 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3423 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3424 rdev->devlist_generation ^ 3425 (cfg80211_rdev_list_generation << 2)) || 3426 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3427 goto nla_put_failure; 3428 3429 if (rdev->ops->get_channel) { 3430 int ret; 3431 struct cfg80211_chan_def chandef = {}; 3432 3433 ret = rdev_get_channel(rdev, wdev, &chandef); 3434 if (ret == 0) { 3435 if (nl80211_send_chandef(msg, &chandef)) 3436 goto nla_put_failure; 3437 } 3438 } 3439 3440 if (rdev->ops->get_tx_power) { 3441 int dbm, ret; 3442 3443 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3444 if (ret == 0 && 3445 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3446 DBM_TO_MBM(dbm))) 3447 goto nla_put_failure; 3448 } 3449 3450 wdev_lock(wdev); 3451 switch (wdev->iftype) { 3452 case NL80211_IFTYPE_AP: 3453 if (wdev->ssid_len && 3454 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 3455 goto nla_put_failure_locked; 3456 break; 3457 case NL80211_IFTYPE_STATION: 3458 case NL80211_IFTYPE_P2P_CLIENT: 3459 case NL80211_IFTYPE_ADHOC: { 3460 const u8 *ssid_ie; 3461 if (!wdev->current_bss) 3462 break; 3463 rcu_read_lock(); 3464 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 3465 WLAN_EID_SSID); 3466 if (ssid_ie && 3467 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 3468 goto nla_put_failure_rcu_locked; 3469 rcu_read_unlock(); 3470 break; 3471 } 3472 default: 3473 /* nothing */ 3474 break; 3475 } 3476 wdev_unlock(wdev); 3477 3478 if (rdev->ops->get_txq_stats) { 3479 struct cfg80211_txq_stats txqstats = {}; 3480 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3481 3482 if (ret == 0 && 3483 !nl80211_put_txq_stats(msg, &txqstats, 3484 NL80211_ATTR_TXQ_STATS)) 3485 goto nla_put_failure; 3486 } 3487 3488 genlmsg_end(msg, hdr); 3489 return 0; 3490 3491 nla_put_failure_rcu_locked: 3492 rcu_read_unlock(); 3493 nla_put_failure_locked: 3494 wdev_unlock(wdev); 3495 nla_put_failure: 3496 genlmsg_cancel(msg, hdr); 3497 return -EMSGSIZE; 3498 } 3499 3500 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3501 { 3502 int wp_idx = 0; 3503 int if_idx = 0; 3504 int wp_start = cb->args[0]; 3505 int if_start = cb->args[1]; 3506 int filter_wiphy = -1; 3507 struct cfg80211_registered_device *rdev; 3508 struct wireless_dev *wdev; 3509 int ret; 3510 3511 rtnl_lock(); 3512 if (!cb->args[2]) { 3513 struct nl80211_dump_wiphy_state state = { 3514 .filter_wiphy = -1, 3515 }; 3516 3517 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3518 if (ret) 3519 goto out_unlock; 3520 3521 filter_wiphy = state.filter_wiphy; 3522 3523 /* 3524 * if filtering, set cb->args[2] to +1 since 0 is the default 3525 * value needed to determine that parsing is necessary. 3526 */ 3527 if (filter_wiphy >= 0) 3528 cb->args[2] = filter_wiphy + 1; 3529 else 3530 cb->args[2] = -1; 3531 } else if (cb->args[2] > 0) { 3532 filter_wiphy = cb->args[2] - 1; 3533 } 3534 3535 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 3536 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3537 continue; 3538 if (wp_idx < wp_start) { 3539 wp_idx++; 3540 continue; 3541 } 3542 3543 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 3544 continue; 3545 3546 if_idx = 0; 3547 3548 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3549 if (if_idx < if_start) { 3550 if_idx++; 3551 continue; 3552 } 3553 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 3554 cb->nlh->nlmsg_seq, NLM_F_MULTI, 3555 rdev, wdev, 3556 NL80211_CMD_NEW_INTERFACE) < 0) { 3557 goto out; 3558 } 3559 if_idx++; 3560 } 3561 3562 wp_idx++; 3563 } 3564 out: 3565 cb->args[0] = wp_idx; 3566 cb->args[1] = if_idx; 3567 3568 ret = skb->len; 3569 out_unlock: 3570 rtnl_unlock(); 3571 3572 return ret; 3573 } 3574 3575 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 3576 { 3577 struct sk_buff *msg; 3578 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3579 struct wireless_dev *wdev = info->user_ptr[1]; 3580 3581 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3582 if (!msg) 3583 return -ENOMEM; 3584 3585 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3586 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3587 nlmsg_free(msg); 3588 return -ENOBUFS; 3589 } 3590 3591 return genlmsg_reply(msg, info); 3592 } 3593 3594 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 3595 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 3596 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 3597 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 3598 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 3599 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 3600 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 3601 }; 3602 3603 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 3604 { 3605 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 3606 int flag; 3607 3608 *mntrflags = 0; 3609 3610 if (!nla) 3611 return -EINVAL; 3612 3613 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 3614 return -EINVAL; 3615 3616 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 3617 if (flags[flag]) 3618 *mntrflags |= (1<<flag); 3619 3620 *mntrflags |= MONITOR_FLAG_CHANGED; 3621 3622 return 0; 3623 } 3624 3625 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 3626 enum nl80211_iftype type, 3627 struct genl_info *info, 3628 struct vif_params *params) 3629 { 3630 bool change = false; 3631 int err; 3632 3633 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 3634 if (type != NL80211_IFTYPE_MONITOR) 3635 return -EINVAL; 3636 3637 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 3638 ¶ms->flags); 3639 if (err) 3640 return err; 3641 3642 change = true; 3643 } 3644 3645 if (params->flags & MONITOR_FLAG_ACTIVE && 3646 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 3647 return -EOPNOTSUPP; 3648 3649 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 3650 const u8 *mumimo_groups; 3651 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3652 3653 if (type != NL80211_IFTYPE_MONITOR) 3654 return -EINVAL; 3655 3656 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3657 return -EOPNOTSUPP; 3658 3659 mumimo_groups = 3660 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 3661 3662 /* bits 0 and 63 are reserved and must be zero */ 3663 if ((mumimo_groups[0] & BIT(0)) || 3664 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 3665 return -EINVAL; 3666 3667 params->vht_mumimo_groups = mumimo_groups; 3668 change = true; 3669 } 3670 3671 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 3672 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3673 3674 if (type != NL80211_IFTYPE_MONITOR) 3675 return -EINVAL; 3676 3677 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3678 return -EOPNOTSUPP; 3679 3680 params->vht_mumimo_follow_addr = 3681 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 3682 change = true; 3683 } 3684 3685 return change ? 1 : 0; 3686 } 3687 3688 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 3689 struct net_device *netdev, u8 use_4addr, 3690 enum nl80211_iftype iftype) 3691 { 3692 if (!use_4addr) { 3693 if (netdev && netif_is_bridge_port(netdev)) 3694 return -EBUSY; 3695 return 0; 3696 } 3697 3698 switch (iftype) { 3699 case NL80211_IFTYPE_AP_VLAN: 3700 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 3701 return 0; 3702 break; 3703 case NL80211_IFTYPE_STATION: 3704 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 3705 return 0; 3706 break; 3707 default: 3708 break; 3709 } 3710 3711 return -EOPNOTSUPP; 3712 } 3713 3714 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 3715 { 3716 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3717 struct vif_params params; 3718 int err; 3719 enum nl80211_iftype otype, ntype; 3720 struct net_device *dev = info->user_ptr[1]; 3721 bool change = false; 3722 3723 memset(¶ms, 0, sizeof(params)); 3724 3725 otype = ntype = dev->ieee80211_ptr->iftype; 3726 3727 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3728 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3729 if (otype != ntype) 3730 change = true; 3731 } 3732 3733 if (info->attrs[NL80211_ATTR_MESH_ID]) { 3734 struct wireless_dev *wdev = dev->ieee80211_ptr; 3735 3736 if (ntype != NL80211_IFTYPE_MESH_POINT) 3737 return -EINVAL; 3738 if (netif_running(dev)) 3739 return -EBUSY; 3740 3741 wdev_lock(wdev); 3742 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3743 IEEE80211_MAX_MESH_ID_LEN); 3744 wdev->mesh_id_up_len = 3745 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3746 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3747 wdev->mesh_id_up_len); 3748 wdev_unlock(wdev); 3749 } 3750 3751 if (info->attrs[NL80211_ATTR_4ADDR]) { 3752 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3753 change = true; 3754 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 3755 if (err) 3756 return err; 3757 } else { 3758 params.use_4addr = -1; 3759 } 3760 3761 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 3762 if (err < 0) 3763 return err; 3764 if (err > 0) 3765 change = true; 3766 3767 if (change) 3768 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 3769 else 3770 err = 0; 3771 3772 if (!err && params.use_4addr != -1) 3773 dev->ieee80211_ptr->use_4addr = params.use_4addr; 3774 3775 if (change && !err) { 3776 struct wireless_dev *wdev = dev->ieee80211_ptr; 3777 3778 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 3779 } 3780 3781 return err; 3782 } 3783 3784 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 3785 { 3786 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3787 struct vif_params params; 3788 struct wireless_dev *wdev; 3789 struct sk_buff *msg; 3790 int err; 3791 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 3792 3793 /* to avoid failing a new interface creation due to pending removal */ 3794 cfg80211_destroy_ifaces(rdev); 3795 3796 memset(¶ms, 0, sizeof(params)); 3797 3798 if (!info->attrs[NL80211_ATTR_IFNAME]) 3799 return -EINVAL; 3800 3801 if (info->attrs[NL80211_ATTR_IFTYPE]) 3802 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3803 3804 if (!rdev->ops->add_virtual_intf) 3805 return -EOPNOTSUPP; 3806 3807 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 3808 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 3809 info->attrs[NL80211_ATTR_MAC]) { 3810 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 3811 ETH_ALEN); 3812 if (!is_valid_ether_addr(params.macaddr)) 3813 return -EADDRNOTAVAIL; 3814 } 3815 3816 if (info->attrs[NL80211_ATTR_4ADDR]) { 3817 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3818 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 3819 if (err) 3820 return err; 3821 } 3822 3823 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 3824 return -EOPNOTSUPP; 3825 3826 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 3827 if (err < 0) 3828 return err; 3829 3830 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3831 if (!msg) 3832 return -ENOMEM; 3833 3834 wdev = rdev_add_virtual_intf(rdev, 3835 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 3836 NET_NAME_USER, type, ¶ms); 3837 if (WARN_ON(!wdev)) { 3838 nlmsg_free(msg); 3839 return -EPROTO; 3840 } else if (IS_ERR(wdev)) { 3841 nlmsg_free(msg); 3842 return PTR_ERR(wdev); 3843 } 3844 3845 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 3846 wdev->owner_nlportid = info->snd_portid; 3847 3848 switch (type) { 3849 case NL80211_IFTYPE_MESH_POINT: 3850 if (!info->attrs[NL80211_ATTR_MESH_ID]) 3851 break; 3852 wdev_lock(wdev); 3853 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3854 IEEE80211_MAX_MESH_ID_LEN); 3855 wdev->mesh_id_up_len = 3856 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3857 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3858 wdev->mesh_id_up_len); 3859 wdev_unlock(wdev); 3860 break; 3861 case NL80211_IFTYPE_NAN: 3862 case NL80211_IFTYPE_P2P_DEVICE: 3863 /* 3864 * P2P Device and NAN do not have a netdev, so don't go 3865 * through the netdev notifier and must be added here 3866 */ 3867 cfg80211_init_wdev(wdev); 3868 cfg80211_register_wdev(rdev, wdev); 3869 break; 3870 default: 3871 break; 3872 } 3873 3874 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3875 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3876 nlmsg_free(msg); 3877 return -ENOBUFS; 3878 } 3879 3880 return genlmsg_reply(msg, info); 3881 } 3882 3883 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3884 { 3885 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3886 struct wireless_dev *wdev = info->user_ptr[1]; 3887 3888 if (!rdev->ops->del_virtual_intf) 3889 return -EOPNOTSUPP; 3890 3891 /* 3892 * If we remove a wireless device without a netdev then clear 3893 * user_ptr[1] so that nl80211_post_doit won't dereference it 3894 * to check if it needs to do dev_put(). Otherwise it crashes 3895 * since the wdev has been freed, unlike with a netdev where 3896 * we need the dev_put() for the netdev to really be freed. 3897 */ 3898 if (!wdev->netdev) 3899 info->user_ptr[1] = NULL; 3900 3901 return rdev_del_virtual_intf(rdev, wdev); 3902 } 3903 3904 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3905 { 3906 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3907 struct net_device *dev = info->user_ptr[1]; 3908 u16 noack_map; 3909 3910 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3911 return -EINVAL; 3912 3913 if (!rdev->ops->set_noack_map) 3914 return -EOPNOTSUPP; 3915 3916 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3917 3918 return rdev_set_noack_map(rdev, dev, noack_map); 3919 } 3920 3921 struct get_key_cookie { 3922 struct sk_buff *msg; 3923 int error; 3924 int idx; 3925 }; 3926 3927 static void get_key_callback(void *c, struct key_params *params) 3928 { 3929 struct nlattr *key; 3930 struct get_key_cookie *cookie = c; 3931 3932 if ((params->key && 3933 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3934 params->key_len, params->key)) || 3935 (params->seq && 3936 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3937 params->seq_len, params->seq)) || 3938 (params->cipher && 3939 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3940 params->cipher))) 3941 goto nla_put_failure; 3942 3943 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 3944 if (!key) 3945 goto nla_put_failure; 3946 3947 if ((params->key && 3948 nla_put(cookie->msg, NL80211_KEY_DATA, 3949 params->key_len, params->key)) || 3950 (params->seq && 3951 nla_put(cookie->msg, NL80211_KEY_SEQ, 3952 params->seq_len, params->seq)) || 3953 (params->cipher && 3954 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3955 params->cipher))) 3956 goto nla_put_failure; 3957 3958 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 3959 goto nla_put_failure; 3960 3961 nla_nest_end(cookie->msg, key); 3962 3963 return; 3964 nla_put_failure: 3965 cookie->error = 1; 3966 } 3967 3968 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3969 { 3970 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3971 int err; 3972 struct net_device *dev = info->user_ptr[1]; 3973 u8 key_idx = 0; 3974 const u8 *mac_addr = NULL; 3975 bool pairwise; 3976 struct get_key_cookie cookie = { 3977 .error = 0, 3978 }; 3979 void *hdr; 3980 struct sk_buff *msg; 3981 bool bigtk_support = false; 3982 3983 if (wiphy_ext_feature_isset(&rdev->wiphy, 3984 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 3985 bigtk_support = true; 3986 3987 if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION || 3988 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) && 3989 wiphy_ext_feature_isset(&rdev->wiphy, 3990 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 3991 bigtk_support = true; 3992 3993 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 3994 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3995 3996 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 3997 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 3998 return -EINVAL; 3999 } 4000 } 4001 4002 if (info->attrs[NL80211_ATTR_MAC]) 4003 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4004 4005 pairwise = !!mac_addr; 4006 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4007 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4008 4009 if (kt != NL80211_KEYTYPE_GROUP && 4010 kt != NL80211_KEYTYPE_PAIRWISE) 4011 return -EINVAL; 4012 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4013 } 4014 4015 if (!rdev->ops->get_key) 4016 return -EOPNOTSUPP; 4017 4018 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4019 return -ENOENT; 4020 4021 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4022 if (!msg) 4023 return -ENOMEM; 4024 4025 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4026 NL80211_CMD_NEW_KEY); 4027 if (!hdr) 4028 goto nla_put_failure; 4029 4030 cookie.msg = msg; 4031 cookie.idx = key_idx; 4032 4033 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4034 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4035 goto nla_put_failure; 4036 if (mac_addr && 4037 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4038 goto nla_put_failure; 4039 4040 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 4041 get_key_callback); 4042 4043 if (err) 4044 goto free_msg; 4045 4046 if (cookie.error) 4047 goto nla_put_failure; 4048 4049 genlmsg_end(msg, hdr); 4050 return genlmsg_reply(msg, info); 4051 4052 nla_put_failure: 4053 err = -ENOBUFS; 4054 free_msg: 4055 nlmsg_free(msg); 4056 return err; 4057 } 4058 4059 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4060 { 4061 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4062 struct key_parse key; 4063 int err; 4064 struct net_device *dev = info->user_ptr[1]; 4065 4066 err = nl80211_parse_key(info, &key); 4067 if (err) 4068 return err; 4069 4070 if (key.idx < 0) 4071 return -EINVAL; 4072 4073 /* Only support setting default key and 4074 * Extended Key ID action NL80211_KEY_SET_TX. 4075 */ 4076 if (!key.def && !key.defmgmt && !key.defbeacon && 4077 !(key.p.mode == NL80211_KEY_SET_TX)) 4078 return -EINVAL; 4079 4080 wdev_lock(dev->ieee80211_ptr); 4081 4082 if (key.def) { 4083 if (!rdev->ops->set_default_key) { 4084 err = -EOPNOTSUPP; 4085 goto out; 4086 } 4087 4088 err = nl80211_key_allowed(dev->ieee80211_ptr); 4089 if (err) 4090 goto out; 4091 4092 err = rdev_set_default_key(rdev, dev, key.idx, 4093 key.def_uni, key.def_multi); 4094 4095 if (err) 4096 goto out; 4097 4098 #ifdef CONFIG_CFG80211_WEXT 4099 dev->ieee80211_ptr->wext.default_key = key.idx; 4100 #endif 4101 } else if (key.defmgmt) { 4102 if (key.def_uni || !key.def_multi) { 4103 err = -EINVAL; 4104 goto out; 4105 } 4106 4107 if (!rdev->ops->set_default_mgmt_key) { 4108 err = -EOPNOTSUPP; 4109 goto out; 4110 } 4111 4112 err = nl80211_key_allowed(dev->ieee80211_ptr); 4113 if (err) 4114 goto out; 4115 4116 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 4117 if (err) 4118 goto out; 4119 4120 #ifdef CONFIG_CFG80211_WEXT 4121 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 4122 #endif 4123 } else if (key.defbeacon) { 4124 if (key.def_uni || !key.def_multi) { 4125 err = -EINVAL; 4126 goto out; 4127 } 4128 4129 if (!rdev->ops->set_default_beacon_key) { 4130 err = -EOPNOTSUPP; 4131 goto out; 4132 } 4133 4134 err = nl80211_key_allowed(dev->ieee80211_ptr); 4135 if (err) 4136 goto out; 4137 4138 err = rdev_set_default_beacon_key(rdev, dev, key.idx); 4139 if (err) 4140 goto out; 4141 } else if (key.p.mode == NL80211_KEY_SET_TX && 4142 wiphy_ext_feature_isset(&rdev->wiphy, 4143 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4144 u8 *mac_addr = NULL; 4145 4146 if (info->attrs[NL80211_ATTR_MAC]) 4147 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4148 4149 if (!mac_addr || key.idx < 0 || key.idx > 1) { 4150 err = -EINVAL; 4151 goto out; 4152 } 4153 4154 err = rdev_add_key(rdev, dev, key.idx, 4155 NL80211_KEYTYPE_PAIRWISE, 4156 mac_addr, &key.p); 4157 } else { 4158 err = -EINVAL; 4159 } 4160 out: 4161 wdev_unlock(dev->ieee80211_ptr); 4162 4163 return err; 4164 } 4165 4166 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4167 { 4168 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4169 int err; 4170 struct net_device *dev = info->user_ptr[1]; 4171 struct key_parse key; 4172 const u8 *mac_addr = NULL; 4173 4174 err = nl80211_parse_key(info, &key); 4175 if (err) 4176 return err; 4177 4178 if (!key.p.key) { 4179 GENL_SET_ERR_MSG(info, "no key"); 4180 return -EINVAL; 4181 } 4182 4183 if (info->attrs[NL80211_ATTR_MAC]) 4184 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4185 4186 if (key.type == -1) { 4187 if (mac_addr) 4188 key.type = NL80211_KEYTYPE_PAIRWISE; 4189 else 4190 key.type = NL80211_KEYTYPE_GROUP; 4191 } 4192 4193 /* for now */ 4194 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4195 key.type != NL80211_KEYTYPE_GROUP) { 4196 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4197 return -EINVAL; 4198 } 4199 4200 if (key.type == NL80211_KEYTYPE_GROUP && 4201 info->attrs[NL80211_ATTR_VLAN_ID]) 4202 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4203 4204 if (!rdev->ops->add_key) 4205 return -EOPNOTSUPP; 4206 4207 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4208 key.type == NL80211_KEYTYPE_PAIRWISE, 4209 mac_addr)) { 4210 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4211 return -EINVAL; 4212 } 4213 4214 wdev_lock(dev->ieee80211_ptr); 4215 err = nl80211_key_allowed(dev->ieee80211_ptr); 4216 if (err) 4217 GENL_SET_ERR_MSG(info, "key not allowed"); 4218 if (!err) { 4219 err = rdev_add_key(rdev, dev, key.idx, 4220 key.type == NL80211_KEYTYPE_PAIRWISE, 4221 mac_addr, &key.p); 4222 if (err) 4223 GENL_SET_ERR_MSG(info, "key addition failed"); 4224 } 4225 wdev_unlock(dev->ieee80211_ptr); 4226 4227 return err; 4228 } 4229 4230 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4231 { 4232 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4233 int err; 4234 struct net_device *dev = info->user_ptr[1]; 4235 u8 *mac_addr = NULL; 4236 struct key_parse key; 4237 4238 err = nl80211_parse_key(info, &key); 4239 if (err) 4240 return err; 4241 4242 if (info->attrs[NL80211_ATTR_MAC]) 4243 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4244 4245 if (key.type == -1) { 4246 if (mac_addr) 4247 key.type = NL80211_KEYTYPE_PAIRWISE; 4248 else 4249 key.type = NL80211_KEYTYPE_GROUP; 4250 } 4251 4252 /* for now */ 4253 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4254 key.type != NL80211_KEYTYPE_GROUP) 4255 return -EINVAL; 4256 4257 if (!cfg80211_valid_key_idx(rdev, key.idx, 4258 key.type == NL80211_KEYTYPE_PAIRWISE)) 4259 return -EINVAL; 4260 4261 if (!rdev->ops->del_key) 4262 return -EOPNOTSUPP; 4263 4264 wdev_lock(dev->ieee80211_ptr); 4265 err = nl80211_key_allowed(dev->ieee80211_ptr); 4266 4267 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4268 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4269 err = -ENOENT; 4270 4271 if (!err) 4272 err = rdev_del_key(rdev, dev, key.idx, 4273 key.type == NL80211_KEYTYPE_PAIRWISE, 4274 mac_addr); 4275 4276 #ifdef CONFIG_CFG80211_WEXT 4277 if (!err) { 4278 if (key.idx == dev->ieee80211_ptr->wext.default_key) 4279 dev->ieee80211_ptr->wext.default_key = -1; 4280 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 4281 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 4282 } 4283 #endif 4284 wdev_unlock(dev->ieee80211_ptr); 4285 4286 return err; 4287 } 4288 4289 /* This function returns an error or the number of nested attributes */ 4290 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4291 { 4292 struct nlattr *attr; 4293 int n_entries = 0, tmp; 4294 4295 nla_for_each_nested(attr, nl_attr, tmp) { 4296 if (nla_len(attr) != ETH_ALEN) 4297 return -EINVAL; 4298 4299 n_entries++; 4300 } 4301 4302 return n_entries; 4303 } 4304 4305 /* 4306 * This function parses ACL information and allocates memory for ACL data. 4307 * On successful return, the calling function is responsible to free the 4308 * ACL buffer returned by this function. 4309 */ 4310 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4311 struct genl_info *info) 4312 { 4313 enum nl80211_acl_policy acl_policy; 4314 struct nlattr *attr; 4315 struct cfg80211_acl_data *acl; 4316 int i = 0, n_entries, tmp; 4317 4318 if (!wiphy->max_acl_mac_addrs) 4319 return ERR_PTR(-EOPNOTSUPP); 4320 4321 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4322 return ERR_PTR(-EINVAL); 4323 4324 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4325 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4326 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4327 return ERR_PTR(-EINVAL); 4328 4329 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4330 return ERR_PTR(-EINVAL); 4331 4332 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4333 if (n_entries < 0) 4334 return ERR_PTR(n_entries); 4335 4336 if (n_entries > wiphy->max_acl_mac_addrs) 4337 return ERR_PTR(-ENOTSUPP); 4338 4339 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4340 if (!acl) 4341 return ERR_PTR(-ENOMEM); 4342 4343 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4344 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4345 i++; 4346 } 4347 4348 acl->n_acl_entries = n_entries; 4349 acl->acl_policy = acl_policy; 4350 4351 return acl; 4352 } 4353 4354 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4355 { 4356 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4357 struct net_device *dev = info->user_ptr[1]; 4358 struct cfg80211_acl_data *acl; 4359 int err; 4360 4361 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4362 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4363 return -EOPNOTSUPP; 4364 4365 if (!dev->ieee80211_ptr->beacon_interval) 4366 return -EINVAL; 4367 4368 acl = parse_acl_data(&rdev->wiphy, info); 4369 if (IS_ERR(acl)) 4370 return PTR_ERR(acl); 4371 4372 err = rdev_set_mac_acl(rdev, dev, acl); 4373 4374 kfree(acl); 4375 4376 return err; 4377 } 4378 4379 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4380 u8 *rates, u8 rates_len) 4381 { 4382 u8 i; 4383 u32 mask = 0; 4384 4385 for (i = 0; i < rates_len; i++) { 4386 int rate = (rates[i] & 0x7f) * 5; 4387 int ridx; 4388 4389 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4390 struct ieee80211_rate *srate = 4391 &sband->bitrates[ridx]; 4392 if (rate == srate->bitrate) { 4393 mask |= 1 << ridx; 4394 break; 4395 } 4396 } 4397 if (ridx == sband->n_bitrates) 4398 return 0; /* rate not found */ 4399 } 4400 4401 return mask; 4402 } 4403 4404 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4405 u8 *rates, u8 rates_len, 4406 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4407 { 4408 u8 i; 4409 4410 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4411 4412 for (i = 0; i < rates_len; i++) { 4413 int ridx, rbit; 4414 4415 ridx = rates[i] / 8; 4416 rbit = BIT(rates[i] % 8); 4417 4418 /* check validity */ 4419 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4420 return false; 4421 4422 /* check availability */ 4423 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4424 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4425 mcs[ridx] |= rbit; 4426 else 4427 return false; 4428 } 4429 4430 return true; 4431 } 4432 4433 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4434 { 4435 u16 mcs_mask = 0; 4436 4437 switch (vht_mcs_map) { 4438 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4439 break; 4440 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4441 mcs_mask = 0x00FF; 4442 break; 4443 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4444 mcs_mask = 0x01FF; 4445 break; 4446 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4447 mcs_mask = 0x03FF; 4448 break; 4449 default: 4450 break; 4451 } 4452 4453 return mcs_mask; 4454 } 4455 4456 static void vht_build_mcs_mask(u16 vht_mcs_map, 4457 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4458 { 4459 u8 nss; 4460 4461 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4462 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4463 vht_mcs_map >>= 2; 4464 } 4465 } 4466 4467 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 4468 struct nl80211_txrate_vht *txrate, 4469 u16 mcs[NL80211_VHT_NSS_MAX]) 4470 { 4471 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4472 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 4473 u8 i; 4474 4475 if (!sband->vht_cap.vht_supported) 4476 return false; 4477 4478 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 4479 4480 /* Build vht_mcs_mask from VHT capabilities */ 4481 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4482 4483 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4484 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4485 mcs[i] = txrate->mcs[i]; 4486 else 4487 return false; 4488 } 4489 4490 return true; 4491 } 4492 4493 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 4494 { 4495 switch (he_mcs_map) { 4496 case IEEE80211_HE_MCS_NOT_SUPPORTED: 4497 return 0; 4498 case IEEE80211_HE_MCS_SUPPORT_0_7: 4499 return 0x00FF; 4500 case IEEE80211_HE_MCS_SUPPORT_0_9: 4501 return 0x03FF; 4502 case IEEE80211_HE_MCS_SUPPORT_0_11: 4503 return 0xFFF; 4504 default: 4505 break; 4506 } 4507 return 0; 4508 } 4509 4510 static void he_build_mcs_mask(u16 he_mcs_map, 4511 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 4512 { 4513 u8 nss; 4514 4515 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 4516 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 4517 he_mcs_map >>= 2; 4518 } 4519 } 4520 4521 static u16 he_get_txmcsmap(struct genl_info *info, 4522 const struct ieee80211_sta_he_cap *he_cap) 4523 { 4524 struct net_device *dev = info->user_ptr[1]; 4525 struct wireless_dev *wdev = dev->ieee80211_ptr; 4526 __le16 tx_mcs; 4527 4528 switch (wdev->chandef.width) { 4529 case NL80211_CHAN_WIDTH_80P80: 4530 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 4531 break; 4532 case NL80211_CHAN_WIDTH_160: 4533 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 4534 break; 4535 default: 4536 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 4537 break; 4538 } 4539 return le16_to_cpu(tx_mcs); 4540 } 4541 4542 static bool he_set_mcs_mask(struct genl_info *info, 4543 struct wireless_dev *wdev, 4544 struct ieee80211_supported_band *sband, 4545 struct nl80211_txrate_he *txrate, 4546 u16 mcs[NL80211_HE_NSS_MAX]) 4547 { 4548 const struct ieee80211_sta_he_cap *he_cap; 4549 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 4550 u16 tx_mcs_map = 0; 4551 u8 i; 4552 4553 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4554 if (!he_cap) 4555 return false; 4556 4557 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 4558 4559 tx_mcs_map = he_get_txmcsmap(info, he_cap); 4560 4561 /* Build he_mcs_mask from HE capabilities */ 4562 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4563 4564 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 4565 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4566 mcs[i] = txrate->mcs[i]; 4567 else 4568 return false; 4569 } 4570 4571 return true; 4572 } 4573 4574 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 4575 struct nlattr *attrs[], 4576 enum nl80211_attrs attr, 4577 struct cfg80211_bitrate_mask *mask, 4578 struct net_device *dev, 4579 bool default_all_enabled) 4580 { 4581 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 4582 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4583 struct wireless_dev *wdev = dev->ieee80211_ptr; 4584 int rem, i; 4585 struct nlattr *tx_rates; 4586 struct ieee80211_supported_band *sband; 4587 u16 vht_tx_mcs_map, he_tx_mcs_map; 4588 4589 memset(mask, 0, sizeof(*mask)); 4590 /* Default to all rates enabled */ 4591 for (i = 0; i < NUM_NL80211_BANDS; i++) { 4592 const struct ieee80211_sta_he_cap *he_cap; 4593 4594 if (!default_all_enabled) 4595 break; 4596 4597 sband = rdev->wiphy.bands[i]; 4598 4599 if (!sband) 4600 continue; 4601 4602 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 4603 memcpy(mask->control[i].ht_mcs, 4604 sband->ht_cap.mcs.rx_mask, 4605 sizeof(mask->control[i].ht_mcs)); 4606 4607 if (!sband->vht_cap.vht_supported) 4608 continue; 4609 4610 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4611 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 4612 4613 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4614 if (!he_cap) 4615 continue; 4616 4617 he_tx_mcs_map = he_get_txmcsmap(info, he_cap); 4618 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 4619 4620 mask->control[i].he_gi = 0xFF; 4621 mask->control[i].he_ltf = 0xFF; 4622 } 4623 4624 /* if no rates are given set it back to the defaults */ 4625 if (!attrs[attr]) 4626 goto out; 4627 4628 /* The nested attribute uses enum nl80211_band as the index. This maps 4629 * directly to the enum nl80211_band values used in cfg80211. 4630 */ 4631 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 4632 nla_for_each_nested(tx_rates, attrs[attr], rem) { 4633 enum nl80211_band band = nla_type(tx_rates); 4634 int err; 4635 4636 if (band < 0 || band >= NUM_NL80211_BANDS) 4637 return -EINVAL; 4638 sband = rdev->wiphy.bands[band]; 4639 if (sband == NULL) 4640 return -EINVAL; 4641 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 4642 tx_rates, 4643 nl80211_txattr_policy, 4644 info->extack); 4645 if (err) 4646 return err; 4647 if (tb[NL80211_TXRATE_LEGACY]) { 4648 mask->control[band].legacy = rateset_to_mask( 4649 sband, 4650 nla_data(tb[NL80211_TXRATE_LEGACY]), 4651 nla_len(tb[NL80211_TXRATE_LEGACY])); 4652 if ((mask->control[band].legacy == 0) && 4653 nla_len(tb[NL80211_TXRATE_LEGACY])) 4654 return -EINVAL; 4655 } 4656 if (tb[NL80211_TXRATE_HT]) { 4657 if (!ht_rateset_to_mask( 4658 sband, 4659 nla_data(tb[NL80211_TXRATE_HT]), 4660 nla_len(tb[NL80211_TXRATE_HT]), 4661 mask->control[band].ht_mcs)) 4662 return -EINVAL; 4663 } 4664 4665 if (tb[NL80211_TXRATE_VHT]) { 4666 if (!vht_set_mcs_mask( 4667 sband, 4668 nla_data(tb[NL80211_TXRATE_VHT]), 4669 mask->control[band].vht_mcs)) 4670 return -EINVAL; 4671 } 4672 4673 if (tb[NL80211_TXRATE_GI]) { 4674 mask->control[band].gi = 4675 nla_get_u8(tb[NL80211_TXRATE_GI]); 4676 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 4677 return -EINVAL; 4678 } 4679 if (tb[NL80211_TXRATE_HE] && 4680 !he_set_mcs_mask(info, wdev, sband, 4681 nla_data(tb[NL80211_TXRATE_HE]), 4682 mask->control[band].he_mcs)) 4683 return -EINVAL; 4684 4685 if (tb[NL80211_TXRATE_HE_GI]) 4686 mask->control[band].he_gi = 4687 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 4688 if (tb[NL80211_TXRATE_HE_LTF]) 4689 mask->control[band].he_ltf = 4690 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 4691 4692 if (mask->control[band].legacy == 0) { 4693 /* don't allow empty legacy rates if HT, VHT or HE 4694 * are not even supported. 4695 */ 4696 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 4697 rdev->wiphy.bands[band]->vht_cap.vht_supported || 4698 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 4699 return -EINVAL; 4700 4701 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 4702 if (mask->control[band].ht_mcs[i]) 4703 goto out; 4704 4705 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 4706 if (mask->control[band].vht_mcs[i]) 4707 goto out; 4708 4709 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 4710 if (mask->control[band].he_mcs[i]) 4711 goto out; 4712 4713 /* legacy and mcs rates may not be both empty */ 4714 return -EINVAL; 4715 } 4716 } 4717 4718 out: 4719 return 0; 4720 } 4721 4722 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 4723 enum nl80211_band band, 4724 struct cfg80211_bitrate_mask *beacon_rate) 4725 { 4726 u32 count_ht, count_vht, count_he, i; 4727 u32 rate = beacon_rate->control[band].legacy; 4728 4729 /* Allow only one rate */ 4730 if (hweight32(rate) > 1) 4731 return -EINVAL; 4732 4733 count_ht = 0; 4734 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 4735 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 4736 return -EINVAL; 4737 } else if (beacon_rate->control[band].ht_mcs[i]) { 4738 count_ht++; 4739 if (count_ht > 1) 4740 return -EINVAL; 4741 } 4742 if (count_ht && rate) 4743 return -EINVAL; 4744 } 4745 4746 count_vht = 0; 4747 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4748 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 4749 return -EINVAL; 4750 } else if (beacon_rate->control[band].vht_mcs[i]) { 4751 count_vht++; 4752 if (count_vht > 1) 4753 return -EINVAL; 4754 } 4755 if (count_vht && rate) 4756 return -EINVAL; 4757 } 4758 4759 count_he = 0; 4760 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 4761 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) { 4762 return -EINVAL; 4763 } else if (beacon_rate->control[band].he_mcs[i]) { 4764 count_he++; 4765 if (count_he > 1) 4766 return -EINVAL; 4767 } 4768 if (count_he && rate) 4769 return -EINVAL; 4770 } 4771 4772 if ((count_ht && count_vht && count_he) || 4773 (!rate && !count_ht && !count_vht && !count_he)) 4774 return -EINVAL; 4775 4776 if (rate && 4777 !wiphy_ext_feature_isset(&rdev->wiphy, 4778 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 4779 return -EINVAL; 4780 if (count_ht && 4781 !wiphy_ext_feature_isset(&rdev->wiphy, 4782 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 4783 return -EINVAL; 4784 if (count_vht && 4785 !wiphy_ext_feature_isset(&rdev->wiphy, 4786 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 4787 return -EINVAL; 4788 if (count_he && 4789 !wiphy_ext_feature_isset(&rdev->wiphy, 4790 NL80211_EXT_FEATURE_BEACON_RATE_HE)) 4791 return -EINVAL; 4792 4793 return 0; 4794 } 4795 4796 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 4797 struct nlattr *attrs[], 4798 struct cfg80211_beacon_data *bcn) 4799 { 4800 bool haveinfo = false; 4801 int err; 4802 4803 memset(bcn, 0, sizeof(*bcn)); 4804 4805 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 4806 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 4807 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 4808 if (!bcn->head_len) 4809 return -EINVAL; 4810 haveinfo = true; 4811 } 4812 4813 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 4814 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 4815 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 4816 haveinfo = true; 4817 } 4818 4819 if (!haveinfo) 4820 return -EINVAL; 4821 4822 if (attrs[NL80211_ATTR_IE]) { 4823 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 4824 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 4825 } 4826 4827 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 4828 bcn->proberesp_ies = 4829 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4830 bcn->proberesp_ies_len = 4831 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4832 } 4833 4834 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 4835 bcn->assocresp_ies = 4836 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4837 bcn->assocresp_ies_len = 4838 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4839 } 4840 4841 if (attrs[NL80211_ATTR_PROBE_RESP]) { 4842 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 4843 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 4844 } 4845 4846 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 4847 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 4848 4849 err = nla_parse_nested_deprecated(tb, 4850 NL80211_FTM_RESP_ATTR_MAX, 4851 attrs[NL80211_ATTR_FTM_RESPONDER], 4852 NULL, NULL); 4853 if (err) 4854 return err; 4855 4856 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 4857 wiphy_ext_feature_isset(&rdev->wiphy, 4858 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 4859 bcn->ftm_responder = 1; 4860 else 4861 return -EOPNOTSUPP; 4862 4863 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 4864 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 4865 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 4866 } 4867 4868 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 4869 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4870 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4871 } 4872 } else { 4873 bcn->ftm_responder = -1; 4874 } 4875 4876 return 0; 4877 } 4878 4879 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 4880 struct ieee80211_he_obss_pd *he_obss_pd) 4881 { 4882 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 4883 int err; 4884 4885 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 4886 he_obss_pd_policy, NULL); 4887 if (err) 4888 return err; 4889 4890 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 4891 return -EINVAL; 4892 4893 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 4894 4895 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 4896 he_obss_pd->min_offset = 4897 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 4898 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 4899 he_obss_pd->max_offset = 4900 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 4901 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 4902 he_obss_pd->non_srg_max_offset = 4903 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 4904 4905 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 4906 return -EINVAL; 4907 4908 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 4909 memcpy(he_obss_pd->bss_color_bitmap, 4910 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 4911 sizeof(he_obss_pd->bss_color_bitmap)); 4912 4913 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 4914 memcpy(he_obss_pd->partial_bssid_bitmap, 4915 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 4916 sizeof(he_obss_pd->partial_bssid_bitmap)); 4917 4918 he_obss_pd->enable = true; 4919 4920 return 0; 4921 } 4922 4923 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 4924 struct cfg80211_he_bss_color *he_bss_color) 4925 { 4926 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 4927 int err; 4928 4929 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 4930 he_bss_color_policy, NULL); 4931 if (err) 4932 return err; 4933 4934 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 4935 return -EINVAL; 4936 4937 he_bss_color->color = 4938 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 4939 he_bss_color->enabled = 4940 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 4941 he_bss_color->partial = 4942 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 4943 4944 return 0; 4945 } 4946 4947 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 4948 struct nlattr *attrs, 4949 struct cfg80211_ap_settings *params) 4950 { 4951 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 4952 int ret; 4953 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery; 4954 4955 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4956 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 4957 return -EINVAL; 4958 4959 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 4960 NULL, NULL); 4961 if (ret) 4962 return ret; 4963 4964 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 4965 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 4966 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 4967 return -EINVAL; 4968 4969 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4970 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4971 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 4972 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 4973 4974 return 0; 4975 } 4976 4977 static int 4978 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 4979 struct nlattr *attrs, 4980 struct cfg80211_ap_settings *params) 4981 { 4982 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 4983 int ret; 4984 struct cfg80211_unsol_bcast_probe_resp *presp = 4985 ¶ms->unsol_bcast_probe_resp; 4986 4987 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4988 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 4989 return -EINVAL; 4990 4991 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 4992 attrs, NULL, NULL); 4993 if (ret) 4994 return ret; 4995 4996 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 4997 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 4998 return -EINVAL; 4999 5000 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5001 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5002 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5003 return 0; 5004 } 5005 5006 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5007 const u8 *rates) 5008 { 5009 int i; 5010 5011 if (!rates) 5012 return; 5013 5014 for (i = 0; i < rates[1]; i++) { 5015 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5016 params->ht_required = true; 5017 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5018 params->vht_required = true; 5019 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5020 params->he_required = true; 5021 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E) 5022 params->sae_h2e_required = true; 5023 } 5024 } 5025 5026 /* 5027 * Since the nl80211 API didn't include, from the beginning, attributes about 5028 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5029 * benefit of drivers that rebuild IEs in the firmware. 5030 */ 5031 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5032 { 5033 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5034 size_t ies_len = bcn->tail_len; 5035 const u8 *ies = bcn->tail; 5036 const u8 *rates; 5037 const u8 *cap; 5038 5039 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 5040 nl80211_check_ap_rate_selectors(params, rates); 5041 5042 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5043 nl80211_check_ap_rate_selectors(params, rates); 5044 5045 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5046 if (cap && cap[1] >= sizeof(*params->ht_cap)) 5047 params->ht_cap = (void *)(cap + 2); 5048 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5049 if (cap && cap[1] >= sizeof(*params->vht_cap)) 5050 params->vht_cap = (void *)(cap + 2); 5051 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5052 if (cap && cap[1] >= sizeof(*params->he_cap) + 1) 5053 params->he_cap = (void *)(cap + 3); 5054 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5055 if (cap && cap[1] >= sizeof(*params->he_oper) + 1) 5056 params->he_oper = (void *)(cap + 3); 5057 } 5058 5059 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5060 struct cfg80211_ap_settings *params) 5061 { 5062 struct wireless_dev *wdev; 5063 bool ret = false; 5064 5065 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5066 if (wdev->iftype != NL80211_IFTYPE_AP && 5067 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5068 continue; 5069 5070 if (!wdev->preset_chandef.chan) 5071 continue; 5072 5073 params->chandef = wdev->preset_chandef; 5074 ret = true; 5075 break; 5076 } 5077 5078 return ret; 5079 } 5080 5081 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5082 enum nl80211_auth_type auth_type, 5083 enum nl80211_commands cmd) 5084 { 5085 if (auth_type > NL80211_AUTHTYPE_MAX) 5086 return false; 5087 5088 switch (cmd) { 5089 case NL80211_CMD_AUTHENTICATE: 5090 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5091 auth_type == NL80211_AUTHTYPE_SAE) 5092 return false; 5093 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5094 NL80211_EXT_FEATURE_FILS_STA) && 5095 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5096 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5097 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5098 return false; 5099 return true; 5100 case NL80211_CMD_CONNECT: 5101 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5102 !wiphy_ext_feature_isset(&rdev->wiphy, 5103 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5104 auth_type == NL80211_AUTHTYPE_SAE) 5105 return false; 5106 5107 /* FILS with SK PFS or PK not supported yet */ 5108 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5109 auth_type == NL80211_AUTHTYPE_FILS_PK) 5110 return false; 5111 if (!wiphy_ext_feature_isset( 5112 &rdev->wiphy, 5113 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5114 auth_type == NL80211_AUTHTYPE_FILS_SK) 5115 return false; 5116 return true; 5117 case NL80211_CMD_START_AP: 5118 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5119 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5120 auth_type == NL80211_AUTHTYPE_SAE) 5121 return false; 5122 /* FILS not supported yet */ 5123 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5124 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5125 auth_type == NL80211_AUTHTYPE_FILS_PK) 5126 return false; 5127 return true; 5128 default: 5129 return false; 5130 } 5131 } 5132 5133 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5134 { 5135 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5136 struct net_device *dev = info->user_ptr[1]; 5137 struct wireless_dev *wdev = dev->ieee80211_ptr; 5138 struct cfg80211_ap_settings params; 5139 int err; 5140 5141 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5142 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5143 return -EOPNOTSUPP; 5144 5145 if (!rdev->ops->start_ap) 5146 return -EOPNOTSUPP; 5147 5148 if (wdev->beacon_interval) 5149 return -EALREADY; 5150 5151 memset(¶ms, 0, sizeof(params)); 5152 5153 /* these are required for START_AP */ 5154 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5155 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5156 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5157 return -EINVAL; 5158 5159 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon); 5160 if (err) 5161 return err; 5162 5163 params.beacon_interval = 5164 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5165 params.dtim_period = 5166 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5167 5168 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5169 params.beacon_interval); 5170 if (err) 5171 return err; 5172 5173 /* 5174 * In theory, some of these attributes should be required here 5175 * but since they were not used when the command was originally 5176 * added, keep them optional for old user space programs to let 5177 * them continue to work with drivers that do not need the 5178 * additional information -- drivers must check! 5179 */ 5180 if (info->attrs[NL80211_ATTR_SSID]) { 5181 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5182 params.ssid_len = 5183 nla_len(info->attrs[NL80211_ATTR_SSID]); 5184 if (params.ssid_len == 0) 5185 return -EINVAL; 5186 } 5187 5188 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5189 params.hidden_ssid = nla_get_u32( 5190 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5191 5192 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5193 5194 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 5195 params.auth_type = nla_get_u32( 5196 info->attrs[NL80211_ATTR_AUTH_TYPE]); 5197 if (!nl80211_valid_auth_type(rdev, params.auth_type, 5198 NL80211_CMD_START_AP)) 5199 return -EINVAL; 5200 } else 5201 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 5202 5203 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 5204 NL80211_MAX_NR_CIPHER_SUITES); 5205 if (err) 5206 return err; 5207 5208 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 5209 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 5210 return -EOPNOTSUPP; 5211 params.inactivity_timeout = nla_get_u16( 5212 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 5213 } 5214 5215 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5216 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5217 return -EINVAL; 5218 params.p2p_ctwindow = 5219 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5220 if (params.p2p_ctwindow != 0 && 5221 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5222 return -EINVAL; 5223 } 5224 5225 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5226 u8 tmp; 5227 5228 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5229 return -EINVAL; 5230 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5231 params.p2p_opp_ps = tmp; 5232 if (params.p2p_opp_ps != 0 && 5233 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5234 return -EINVAL; 5235 } 5236 5237 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 5238 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 5239 if (err) 5240 return err; 5241 } else if (wdev->preset_chandef.chan) { 5242 params.chandef = wdev->preset_chandef; 5243 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 5244 return -EINVAL; 5245 5246 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 5247 wdev->iftype)) 5248 return -EINVAL; 5249 5250 if (info->attrs[NL80211_ATTR_TX_RATES]) { 5251 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 5252 NL80211_ATTR_TX_RATES, 5253 ¶ms.beacon_rate, 5254 dev, false); 5255 if (err) 5256 return err; 5257 5258 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 5259 ¶ms.beacon_rate); 5260 if (err) 5261 return err; 5262 } 5263 5264 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 5265 params.smps_mode = 5266 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 5267 switch (params.smps_mode) { 5268 case NL80211_SMPS_OFF: 5269 break; 5270 case NL80211_SMPS_STATIC: 5271 if (!(rdev->wiphy.features & 5272 NL80211_FEATURE_STATIC_SMPS)) 5273 return -EINVAL; 5274 break; 5275 case NL80211_SMPS_DYNAMIC: 5276 if (!(rdev->wiphy.features & 5277 NL80211_FEATURE_DYNAMIC_SMPS)) 5278 return -EINVAL; 5279 break; 5280 default: 5281 return -EINVAL; 5282 } 5283 } else { 5284 params.smps_mode = NL80211_SMPS_OFF; 5285 } 5286 5287 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 5288 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 5289 return -EOPNOTSUPP; 5290 5291 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 5292 params.acl = parse_acl_data(&rdev->wiphy, info); 5293 if (IS_ERR(params.acl)) 5294 return PTR_ERR(params.acl); 5295 } 5296 5297 params.twt_responder = 5298 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 5299 5300 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 5301 err = nl80211_parse_he_obss_pd( 5302 info->attrs[NL80211_ATTR_HE_OBSS_PD], 5303 ¶ms.he_obss_pd); 5304 if (err) 5305 goto out; 5306 } 5307 5308 if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5309 err = nl80211_parse_he_bss_color( 5310 info->attrs[NL80211_ATTR_HE_BSS_COLOR], 5311 ¶ms.he_bss_color); 5312 if (err) 5313 goto out; 5314 } 5315 5316 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 5317 err = nl80211_parse_fils_discovery(rdev, 5318 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 5319 ¶ms); 5320 if (err) 5321 goto out; 5322 } 5323 5324 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 5325 err = nl80211_parse_unsol_bcast_probe_resp( 5326 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 5327 ¶ms); 5328 if (err) 5329 return err; 5330 } 5331 5332 nl80211_calculate_ap_params(¶ms); 5333 5334 if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 5335 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 5336 5337 wdev_lock(wdev); 5338 err = rdev_start_ap(rdev, dev, ¶ms); 5339 if (!err) { 5340 wdev->preset_chandef = params.chandef; 5341 wdev->beacon_interval = params.beacon_interval; 5342 wdev->chandef = params.chandef; 5343 wdev->ssid_len = params.ssid_len; 5344 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 5345 5346 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 5347 wdev->conn_owner_nlportid = info->snd_portid; 5348 } 5349 wdev_unlock(wdev); 5350 5351 out: 5352 kfree(params.acl); 5353 5354 return err; 5355 } 5356 5357 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 5358 { 5359 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5360 struct net_device *dev = info->user_ptr[1]; 5361 struct wireless_dev *wdev = dev->ieee80211_ptr; 5362 struct cfg80211_beacon_data params; 5363 int err; 5364 5365 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5366 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5367 return -EOPNOTSUPP; 5368 5369 if (!rdev->ops->change_beacon) 5370 return -EOPNOTSUPP; 5371 5372 if (!wdev->beacon_interval) 5373 return -EINVAL; 5374 5375 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms); 5376 if (err) 5377 return err; 5378 5379 wdev_lock(wdev); 5380 err = rdev_change_beacon(rdev, dev, ¶ms); 5381 wdev_unlock(wdev); 5382 5383 return err; 5384 } 5385 5386 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 5387 { 5388 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5389 struct net_device *dev = info->user_ptr[1]; 5390 5391 return cfg80211_stop_ap(rdev, dev, false); 5392 } 5393 5394 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 5395 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 5396 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 5397 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 5398 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 5399 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 5400 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 5401 }; 5402 5403 static int parse_station_flags(struct genl_info *info, 5404 enum nl80211_iftype iftype, 5405 struct station_parameters *params) 5406 { 5407 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 5408 struct nlattr *nla; 5409 int flag; 5410 5411 /* 5412 * Try parsing the new attribute first so userspace 5413 * can specify both for older kernels. 5414 */ 5415 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 5416 if (nla) { 5417 struct nl80211_sta_flag_update *sta_flags; 5418 5419 sta_flags = nla_data(nla); 5420 params->sta_flags_mask = sta_flags->mask; 5421 params->sta_flags_set = sta_flags->set; 5422 params->sta_flags_set &= params->sta_flags_mask; 5423 if ((params->sta_flags_mask | 5424 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 5425 return -EINVAL; 5426 return 0; 5427 } 5428 5429 /* if present, parse the old attribute */ 5430 5431 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 5432 if (!nla) 5433 return 0; 5434 5435 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 5436 return -EINVAL; 5437 5438 /* 5439 * Only allow certain flags for interface types so that 5440 * other attributes are silently ignored. Remember that 5441 * this is backward compatibility code with old userspace 5442 * and shouldn't be hit in other cases anyway. 5443 */ 5444 switch (iftype) { 5445 case NL80211_IFTYPE_AP: 5446 case NL80211_IFTYPE_AP_VLAN: 5447 case NL80211_IFTYPE_P2P_GO: 5448 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5449 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5450 BIT(NL80211_STA_FLAG_WME) | 5451 BIT(NL80211_STA_FLAG_MFP); 5452 break; 5453 case NL80211_IFTYPE_P2P_CLIENT: 5454 case NL80211_IFTYPE_STATION: 5455 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5456 BIT(NL80211_STA_FLAG_TDLS_PEER); 5457 break; 5458 case NL80211_IFTYPE_MESH_POINT: 5459 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5460 BIT(NL80211_STA_FLAG_MFP) | 5461 BIT(NL80211_STA_FLAG_AUTHORIZED); 5462 break; 5463 default: 5464 return -EINVAL; 5465 } 5466 5467 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 5468 if (flags[flag]) { 5469 params->sta_flags_set |= (1<<flag); 5470 5471 /* no longer support new API additions in old API */ 5472 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 5473 return -EINVAL; 5474 } 5475 } 5476 5477 return 0; 5478 } 5479 5480 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 5481 { 5482 struct nlattr *rate; 5483 u32 bitrate; 5484 u16 bitrate_compat; 5485 enum nl80211_rate_info rate_flg; 5486 5487 rate = nla_nest_start_noflag(msg, attr); 5488 if (!rate) 5489 return false; 5490 5491 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 5492 bitrate = cfg80211_calculate_bitrate(info); 5493 /* report 16-bit bitrate only if we can */ 5494 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 5495 if (bitrate > 0 && 5496 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 5497 return false; 5498 if (bitrate_compat > 0 && 5499 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 5500 return false; 5501 5502 switch (info->bw) { 5503 case RATE_INFO_BW_5: 5504 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 5505 break; 5506 case RATE_INFO_BW_10: 5507 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 5508 break; 5509 default: 5510 WARN_ON(1); 5511 fallthrough; 5512 case RATE_INFO_BW_20: 5513 rate_flg = 0; 5514 break; 5515 case RATE_INFO_BW_40: 5516 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 5517 break; 5518 case RATE_INFO_BW_80: 5519 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 5520 break; 5521 case RATE_INFO_BW_160: 5522 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 5523 break; 5524 case RATE_INFO_BW_HE_RU: 5525 rate_flg = 0; 5526 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 5527 } 5528 5529 if (rate_flg && nla_put_flag(msg, rate_flg)) 5530 return false; 5531 5532 if (info->flags & RATE_INFO_FLAGS_MCS) { 5533 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 5534 return false; 5535 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5536 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5537 return false; 5538 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 5539 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 5540 return false; 5541 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 5542 return false; 5543 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5544 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5545 return false; 5546 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 5547 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 5548 return false; 5549 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 5550 return false; 5551 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 5552 return false; 5553 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 5554 return false; 5555 if (info->bw == RATE_INFO_BW_HE_RU && 5556 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 5557 info->he_ru_alloc)) 5558 return false; 5559 } 5560 5561 nla_nest_end(msg, rate); 5562 return true; 5563 } 5564 5565 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 5566 int id) 5567 { 5568 void *attr; 5569 int i = 0; 5570 5571 if (!mask) 5572 return true; 5573 5574 attr = nla_nest_start_noflag(msg, id); 5575 if (!attr) 5576 return false; 5577 5578 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 5579 if (!(mask & BIT(i))) 5580 continue; 5581 5582 if (nla_put_u8(msg, i, signal[i])) 5583 return false; 5584 } 5585 5586 nla_nest_end(msg, attr); 5587 5588 return true; 5589 } 5590 5591 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 5592 u32 seq, int flags, 5593 struct cfg80211_registered_device *rdev, 5594 struct net_device *dev, 5595 const u8 *mac_addr, struct station_info *sinfo) 5596 { 5597 void *hdr; 5598 struct nlattr *sinfoattr, *bss_param; 5599 5600 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 5601 if (!hdr) { 5602 cfg80211_sinfo_release_content(sinfo); 5603 return -1; 5604 } 5605 5606 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5607 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 5608 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 5609 goto nla_put_failure; 5610 5611 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 5612 if (!sinfoattr) 5613 goto nla_put_failure; 5614 5615 #define PUT_SINFO(attr, memb, type) do { \ 5616 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 5617 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5618 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 5619 sinfo->memb)) \ 5620 goto nla_put_failure; \ 5621 } while (0) 5622 #define PUT_SINFO_U64(attr, memb) do { \ 5623 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5624 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 5625 sinfo->memb, NL80211_STA_INFO_PAD)) \ 5626 goto nla_put_failure; \ 5627 } while (0) 5628 5629 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 5630 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 5631 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 5632 5633 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 5634 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 5635 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 5636 (u32)sinfo->rx_bytes)) 5637 goto nla_put_failure; 5638 5639 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 5640 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 5641 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 5642 (u32)sinfo->tx_bytes)) 5643 goto nla_put_failure; 5644 5645 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 5646 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 5647 PUT_SINFO(LLID, llid, u16); 5648 PUT_SINFO(PLID, plid, u16); 5649 PUT_SINFO(PLINK_STATE, plink_state, u8); 5650 PUT_SINFO_U64(RX_DURATION, rx_duration); 5651 PUT_SINFO_U64(TX_DURATION, tx_duration); 5652 5653 if (wiphy_ext_feature_isset(&rdev->wiphy, 5654 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 5655 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 5656 5657 switch (rdev->wiphy.signal_type) { 5658 case CFG80211_SIGNAL_TYPE_MBM: 5659 PUT_SINFO(SIGNAL, signal, u8); 5660 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 5661 break; 5662 default: 5663 break; 5664 } 5665 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 5666 if (!nl80211_put_signal(msg, sinfo->chains, 5667 sinfo->chain_signal, 5668 NL80211_STA_INFO_CHAIN_SIGNAL)) 5669 goto nla_put_failure; 5670 } 5671 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 5672 if (!nl80211_put_signal(msg, sinfo->chains, 5673 sinfo->chain_signal_avg, 5674 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 5675 goto nla_put_failure; 5676 } 5677 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 5678 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 5679 NL80211_STA_INFO_TX_BITRATE)) 5680 goto nla_put_failure; 5681 } 5682 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 5683 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 5684 NL80211_STA_INFO_RX_BITRATE)) 5685 goto nla_put_failure; 5686 } 5687 5688 PUT_SINFO(RX_PACKETS, rx_packets, u32); 5689 PUT_SINFO(TX_PACKETS, tx_packets, u32); 5690 PUT_SINFO(TX_RETRIES, tx_retries, u32); 5691 PUT_SINFO(TX_FAILED, tx_failed, u32); 5692 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 5693 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 5694 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 5695 PUT_SINFO(LOCAL_PM, local_pm, u32); 5696 PUT_SINFO(PEER_PM, peer_pm, u32); 5697 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 5698 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 5699 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 5700 5701 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 5702 bss_param = nla_nest_start_noflag(msg, 5703 NL80211_STA_INFO_BSS_PARAM); 5704 if (!bss_param) 5705 goto nla_put_failure; 5706 5707 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 5708 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 5709 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 5710 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 5711 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 5712 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 5713 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 5714 sinfo->bss_param.dtim_period) || 5715 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 5716 sinfo->bss_param.beacon_interval)) 5717 goto nla_put_failure; 5718 5719 nla_nest_end(msg, bss_param); 5720 } 5721 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 5722 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 5723 sizeof(struct nl80211_sta_flag_update), 5724 &sinfo->sta_flags)) 5725 goto nla_put_failure; 5726 5727 PUT_SINFO_U64(T_OFFSET, t_offset); 5728 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 5729 PUT_SINFO_U64(BEACON_RX, rx_beacon); 5730 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 5731 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 5732 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 5733 if (wiphy_ext_feature_isset(&rdev->wiphy, 5734 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 5735 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 5736 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 5737 } 5738 5739 #undef PUT_SINFO 5740 #undef PUT_SINFO_U64 5741 5742 if (sinfo->pertid) { 5743 struct nlattr *tidsattr; 5744 int tid; 5745 5746 tidsattr = nla_nest_start_noflag(msg, 5747 NL80211_STA_INFO_TID_STATS); 5748 if (!tidsattr) 5749 goto nla_put_failure; 5750 5751 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 5752 struct cfg80211_tid_stats *tidstats; 5753 struct nlattr *tidattr; 5754 5755 tidstats = &sinfo->pertid[tid]; 5756 5757 if (!tidstats->filled) 5758 continue; 5759 5760 tidattr = nla_nest_start_noflag(msg, tid + 1); 5761 if (!tidattr) 5762 goto nla_put_failure; 5763 5764 #define PUT_TIDVAL_U64(attr, memb) do { \ 5765 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 5766 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 5767 tidstats->memb, NL80211_TID_STATS_PAD)) \ 5768 goto nla_put_failure; \ 5769 } while (0) 5770 5771 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 5772 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 5773 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 5774 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 5775 5776 #undef PUT_TIDVAL_U64 5777 if ((tidstats->filled & 5778 BIT(NL80211_TID_STATS_TXQ_STATS)) && 5779 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 5780 NL80211_TID_STATS_TXQ_STATS)) 5781 goto nla_put_failure; 5782 5783 nla_nest_end(msg, tidattr); 5784 } 5785 5786 nla_nest_end(msg, tidsattr); 5787 } 5788 5789 nla_nest_end(msg, sinfoattr); 5790 5791 if (sinfo->assoc_req_ies_len && 5792 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 5793 sinfo->assoc_req_ies)) 5794 goto nla_put_failure; 5795 5796 cfg80211_sinfo_release_content(sinfo); 5797 genlmsg_end(msg, hdr); 5798 return 0; 5799 5800 nla_put_failure: 5801 cfg80211_sinfo_release_content(sinfo); 5802 genlmsg_cancel(msg, hdr); 5803 return -EMSGSIZE; 5804 } 5805 5806 static int nl80211_dump_station(struct sk_buff *skb, 5807 struct netlink_callback *cb) 5808 { 5809 struct station_info sinfo; 5810 struct cfg80211_registered_device *rdev; 5811 struct wireless_dev *wdev; 5812 u8 mac_addr[ETH_ALEN]; 5813 int sta_idx = cb->args[2]; 5814 int err; 5815 5816 rtnl_lock(); 5817 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 5818 if (err) 5819 goto out_err; 5820 5821 if (!wdev->netdev) { 5822 err = -EINVAL; 5823 goto out_err; 5824 } 5825 5826 if (!rdev->ops->dump_station) { 5827 err = -EOPNOTSUPP; 5828 goto out_err; 5829 } 5830 5831 while (1) { 5832 memset(&sinfo, 0, sizeof(sinfo)); 5833 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 5834 mac_addr, &sinfo); 5835 if (err == -ENOENT) 5836 break; 5837 if (err) 5838 goto out_err; 5839 5840 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 5841 NETLINK_CB(cb->skb).portid, 5842 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5843 rdev, wdev->netdev, mac_addr, 5844 &sinfo) < 0) 5845 goto out; 5846 5847 sta_idx++; 5848 } 5849 5850 out: 5851 cb->args[2] = sta_idx; 5852 err = skb->len; 5853 out_err: 5854 rtnl_unlock(); 5855 5856 return err; 5857 } 5858 5859 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 5860 { 5861 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5862 struct net_device *dev = info->user_ptr[1]; 5863 struct station_info sinfo; 5864 struct sk_buff *msg; 5865 u8 *mac_addr = NULL; 5866 int err; 5867 5868 memset(&sinfo, 0, sizeof(sinfo)); 5869 5870 if (!info->attrs[NL80211_ATTR_MAC]) 5871 return -EINVAL; 5872 5873 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5874 5875 if (!rdev->ops->get_station) 5876 return -EOPNOTSUPP; 5877 5878 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 5879 if (err) 5880 return err; 5881 5882 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5883 if (!msg) { 5884 cfg80211_sinfo_release_content(&sinfo); 5885 return -ENOMEM; 5886 } 5887 5888 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 5889 info->snd_portid, info->snd_seq, 0, 5890 rdev, dev, mac_addr, &sinfo) < 0) { 5891 nlmsg_free(msg); 5892 return -ENOBUFS; 5893 } 5894 5895 return genlmsg_reply(msg, info); 5896 } 5897 5898 int cfg80211_check_station_change(struct wiphy *wiphy, 5899 struct station_parameters *params, 5900 enum cfg80211_station_type statype) 5901 { 5902 if (params->listen_interval != -1 && 5903 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5904 return -EINVAL; 5905 5906 if (params->support_p2p_ps != -1 && 5907 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5908 return -EINVAL; 5909 5910 if (params->aid && 5911 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 5912 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5913 return -EINVAL; 5914 5915 /* When you run into this, adjust the code below for the new flag */ 5916 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5917 5918 switch (statype) { 5919 case CFG80211_STA_MESH_PEER_KERNEL: 5920 case CFG80211_STA_MESH_PEER_USER: 5921 /* 5922 * No ignoring the TDLS flag here -- the userspace mesh 5923 * code doesn't have the bug of including TDLS in the 5924 * mask everywhere. 5925 */ 5926 if (params->sta_flags_mask & 5927 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5928 BIT(NL80211_STA_FLAG_MFP) | 5929 BIT(NL80211_STA_FLAG_AUTHORIZED))) 5930 return -EINVAL; 5931 break; 5932 case CFG80211_STA_TDLS_PEER_SETUP: 5933 case CFG80211_STA_TDLS_PEER_ACTIVE: 5934 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5935 return -EINVAL; 5936 /* ignore since it can't change */ 5937 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5938 break; 5939 default: 5940 /* disallow mesh-specific things */ 5941 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 5942 return -EINVAL; 5943 if (params->local_pm) 5944 return -EINVAL; 5945 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 5946 return -EINVAL; 5947 } 5948 5949 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5950 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 5951 /* TDLS can't be set, ... */ 5952 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 5953 return -EINVAL; 5954 /* 5955 * ... but don't bother the driver with it. This works around 5956 * a hostapd/wpa_supplicant issue -- it always includes the 5957 * TLDS_PEER flag in the mask even for AP mode. 5958 */ 5959 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5960 } 5961 5962 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5963 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5964 /* reject other things that can't change */ 5965 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 5966 return -EINVAL; 5967 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 5968 return -EINVAL; 5969 if (params->supported_rates) 5970 return -EINVAL; 5971 if (params->ext_capab || params->ht_capa || params->vht_capa || 5972 params->he_capa) 5973 return -EINVAL; 5974 } 5975 5976 if (statype != CFG80211_STA_AP_CLIENT && 5977 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5978 if (params->vlan) 5979 return -EINVAL; 5980 } 5981 5982 switch (statype) { 5983 case CFG80211_STA_AP_MLME_CLIENT: 5984 /* Use this only for authorizing/unauthorizing a station */ 5985 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 5986 return -EOPNOTSUPP; 5987 break; 5988 case CFG80211_STA_AP_CLIENT: 5989 case CFG80211_STA_AP_CLIENT_UNASSOC: 5990 /* accept only the listed bits */ 5991 if (params->sta_flags_mask & 5992 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5993 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5994 BIT(NL80211_STA_FLAG_ASSOCIATED) | 5995 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5996 BIT(NL80211_STA_FLAG_WME) | 5997 BIT(NL80211_STA_FLAG_MFP))) 5998 return -EINVAL; 5999 6000 /* but authenticated/associated only if driver handles it */ 6001 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6002 params->sta_flags_mask & 6003 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6004 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6005 return -EINVAL; 6006 break; 6007 case CFG80211_STA_IBSS: 6008 case CFG80211_STA_AP_STA: 6009 /* reject any changes other than AUTHORIZED */ 6010 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6011 return -EINVAL; 6012 break; 6013 case CFG80211_STA_TDLS_PEER_SETUP: 6014 /* reject any changes other than AUTHORIZED or WME */ 6015 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6016 BIT(NL80211_STA_FLAG_WME))) 6017 return -EINVAL; 6018 /* force (at least) rates when authorizing */ 6019 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6020 !params->supported_rates) 6021 return -EINVAL; 6022 break; 6023 case CFG80211_STA_TDLS_PEER_ACTIVE: 6024 /* reject any changes */ 6025 return -EINVAL; 6026 case CFG80211_STA_MESH_PEER_KERNEL: 6027 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6028 return -EINVAL; 6029 break; 6030 case CFG80211_STA_MESH_PEER_USER: 6031 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6032 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6033 return -EINVAL; 6034 break; 6035 } 6036 6037 /* 6038 * Older kernel versions ignored this attribute entirely, so don't 6039 * reject attempts to update it but mark it as unused instead so the 6040 * driver won't look at the data. 6041 */ 6042 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 6043 statype != CFG80211_STA_TDLS_PEER_SETUP) 6044 params->opmode_notif_used = false; 6045 6046 return 0; 6047 } 6048 EXPORT_SYMBOL(cfg80211_check_station_change); 6049 6050 /* 6051 * Get vlan interface making sure it is running and on the right wiphy. 6052 */ 6053 static struct net_device *get_vlan(struct genl_info *info, 6054 struct cfg80211_registered_device *rdev) 6055 { 6056 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 6057 struct net_device *v; 6058 int ret; 6059 6060 if (!vlanattr) 6061 return NULL; 6062 6063 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 6064 if (!v) 6065 return ERR_PTR(-ENODEV); 6066 6067 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 6068 ret = -EINVAL; 6069 goto error; 6070 } 6071 6072 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 6073 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6074 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6075 ret = -EINVAL; 6076 goto error; 6077 } 6078 6079 if (!netif_running(v)) { 6080 ret = -ENETDOWN; 6081 goto error; 6082 } 6083 6084 return v; 6085 error: 6086 dev_put(v); 6087 return ERR_PTR(ret); 6088 } 6089 6090 static const struct nla_policy 6091 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 6092 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 6093 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 6094 }; 6095 6096 static int nl80211_parse_sta_wme(struct genl_info *info, 6097 struct station_parameters *params) 6098 { 6099 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 6100 struct nlattr *nla; 6101 int err; 6102 6103 /* parse WME attributes if present */ 6104 if (!info->attrs[NL80211_ATTR_STA_WME]) 6105 return 0; 6106 6107 nla = info->attrs[NL80211_ATTR_STA_WME]; 6108 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 6109 nl80211_sta_wme_policy, 6110 info->extack); 6111 if (err) 6112 return err; 6113 6114 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 6115 params->uapsd_queues = nla_get_u8( 6116 tb[NL80211_STA_WME_UAPSD_QUEUES]); 6117 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 6118 return -EINVAL; 6119 6120 if (tb[NL80211_STA_WME_MAX_SP]) 6121 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 6122 6123 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 6124 return -EINVAL; 6125 6126 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 6127 6128 return 0; 6129 } 6130 6131 static int nl80211_parse_sta_channel_info(struct genl_info *info, 6132 struct station_parameters *params) 6133 { 6134 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 6135 params->supported_channels = 6136 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6137 params->supported_channels_len = 6138 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6139 /* 6140 * Need to include at least one (first channel, number of 6141 * channels) tuple for each subband (checked in policy), 6142 * and must have proper tuples for the rest of the data as well. 6143 */ 6144 if (params->supported_channels_len % 2) 6145 return -EINVAL; 6146 } 6147 6148 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 6149 params->supported_oper_classes = 6150 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6151 params->supported_oper_classes_len = 6152 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6153 } 6154 return 0; 6155 } 6156 6157 static int nl80211_set_station_tdls(struct genl_info *info, 6158 struct station_parameters *params) 6159 { 6160 int err; 6161 /* Dummy STA entry gets updated once the peer capabilities are known */ 6162 if (info->attrs[NL80211_ATTR_PEER_AID]) 6163 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6164 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6165 params->ht_capa = 6166 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6167 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6168 params->vht_capa = 6169 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6170 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6171 params->he_capa = 6172 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6173 params->he_capa_len = 6174 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6175 } 6176 6177 err = nl80211_parse_sta_channel_info(info, params); 6178 if (err) 6179 return err; 6180 6181 return nl80211_parse_sta_wme(info, params); 6182 } 6183 6184 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 6185 struct station_parameters *params) 6186 { 6187 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6188 int idx; 6189 6190 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 6191 if (!rdev->ops->set_tx_power || 6192 !wiphy_ext_feature_isset(&rdev->wiphy, 6193 NL80211_EXT_FEATURE_STA_TX_PWR)) 6194 return -EOPNOTSUPP; 6195 6196 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 6197 params->txpwr.type = nla_get_u8(info->attrs[idx]); 6198 6199 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) { 6200 idx = NL80211_ATTR_STA_TX_POWER; 6201 6202 if (info->attrs[idx]) 6203 params->txpwr.power = 6204 nla_get_s16(info->attrs[idx]); 6205 else 6206 return -EINVAL; 6207 } 6208 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER; 6209 } 6210 6211 return 0; 6212 } 6213 6214 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 6215 { 6216 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6217 struct net_device *dev = info->user_ptr[1]; 6218 struct station_parameters params; 6219 u8 *mac_addr; 6220 int err; 6221 6222 memset(¶ms, 0, sizeof(params)); 6223 6224 if (!rdev->ops->change_station) 6225 return -EOPNOTSUPP; 6226 6227 /* 6228 * AID and listen_interval properties can be set only for unassociated 6229 * station. Include these parameters here and will check them in 6230 * cfg80211_check_station_change(). 6231 */ 6232 if (info->attrs[NL80211_ATTR_STA_AID]) 6233 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6234 6235 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6236 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6237 6238 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6239 params.listen_interval = 6240 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6241 else 6242 params.listen_interval = -1; 6243 6244 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 6245 params.support_p2p_ps = 6246 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6247 else 6248 params.support_p2p_ps = -1; 6249 6250 if (!info->attrs[NL80211_ATTR_MAC]) 6251 return -EINVAL; 6252 6253 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6254 6255 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 6256 params.supported_rates = 6257 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6258 params.supported_rates_len = 6259 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6260 } 6261 6262 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6263 params.capability = 6264 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6265 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6266 } 6267 6268 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6269 params.ext_capab = 6270 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6271 params.ext_capab_len = 6272 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6273 } 6274 6275 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6276 return -EINVAL; 6277 6278 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6279 params.plink_action = 6280 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6281 6282 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 6283 params.plink_state = 6284 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 6285 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 6286 params.peer_aid = nla_get_u16( 6287 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 6288 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 6289 } 6290 6291 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 6292 params.local_pm = nla_get_u32( 6293 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 6294 6295 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6296 params.opmode_notif_used = true; 6297 params.opmode_notif = 6298 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6299 } 6300 6301 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6302 params.he_6ghz_capa = 6303 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6304 6305 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6306 params.airtime_weight = 6307 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6308 6309 if (params.airtime_weight && 6310 !wiphy_ext_feature_isset(&rdev->wiphy, 6311 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6312 return -EOPNOTSUPP; 6313 6314 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6315 if (err) 6316 return err; 6317 6318 /* Include parameters for TDLS peer (will check later) */ 6319 err = nl80211_set_station_tdls(info, ¶ms); 6320 if (err) 6321 return err; 6322 6323 params.vlan = get_vlan(info, rdev); 6324 if (IS_ERR(params.vlan)) 6325 return PTR_ERR(params.vlan); 6326 6327 switch (dev->ieee80211_ptr->iftype) { 6328 case NL80211_IFTYPE_AP: 6329 case NL80211_IFTYPE_AP_VLAN: 6330 case NL80211_IFTYPE_P2P_GO: 6331 case NL80211_IFTYPE_P2P_CLIENT: 6332 case NL80211_IFTYPE_STATION: 6333 case NL80211_IFTYPE_ADHOC: 6334 case NL80211_IFTYPE_MESH_POINT: 6335 break; 6336 default: 6337 err = -EOPNOTSUPP; 6338 goto out_put_vlan; 6339 } 6340 6341 /* driver will call cfg80211_check_station_change() */ 6342 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 6343 6344 out_put_vlan: 6345 if (params.vlan) 6346 dev_put(params.vlan); 6347 6348 return err; 6349 } 6350 6351 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 6352 { 6353 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6354 int err; 6355 struct net_device *dev = info->user_ptr[1]; 6356 struct station_parameters params; 6357 u8 *mac_addr = NULL; 6358 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6359 BIT(NL80211_STA_FLAG_ASSOCIATED); 6360 6361 memset(¶ms, 0, sizeof(params)); 6362 6363 if (!rdev->ops->add_station) 6364 return -EOPNOTSUPP; 6365 6366 if (!info->attrs[NL80211_ATTR_MAC]) 6367 return -EINVAL; 6368 6369 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6370 return -EINVAL; 6371 6372 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 6373 return -EINVAL; 6374 6375 if (!info->attrs[NL80211_ATTR_STA_AID] && 6376 !info->attrs[NL80211_ATTR_PEER_AID]) 6377 return -EINVAL; 6378 6379 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6380 params.supported_rates = 6381 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6382 params.supported_rates_len = 6383 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6384 params.listen_interval = 6385 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6386 6387 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6388 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6389 6390 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 6391 params.support_p2p_ps = 6392 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6393 } else { 6394 /* 6395 * if not specified, assume it's supported for P2P GO interface, 6396 * and is NOT supported for AP interface 6397 */ 6398 params.support_p2p_ps = 6399 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 6400 } 6401 6402 if (info->attrs[NL80211_ATTR_PEER_AID]) 6403 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6404 else 6405 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6406 6407 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6408 params.capability = 6409 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6410 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6411 } 6412 6413 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6414 params.ext_capab = 6415 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6416 params.ext_capab_len = 6417 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6418 } 6419 6420 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6421 params.ht_capa = 6422 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6423 6424 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6425 params.vht_capa = 6426 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6427 6428 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6429 params.he_capa = 6430 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6431 params.he_capa_len = 6432 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6433 } 6434 6435 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6436 params.he_6ghz_capa = 6437 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6438 6439 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6440 params.opmode_notif_used = true; 6441 params.opmode_notif = 6442 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6443 } 6444 6445 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6446 params.plink_action = 6447 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6448 6449 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6450 params.airtime_weight = 6451 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6452 6453 if (params.airtime_weight && 6454 !wiphy_ext_feature_isset(&rdev->wiphy, 6455 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6456 return -EOPNOTSUPP; 6457 6458 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6459 if (err) 6460 return err; 6461 6462 err = nl80211_parse_sta_channel_info(info, ¶ms); 6463 if (err) 6464 return err; 6465 6466 err = nl80211_parse_sta_wme(info, ¶ms); 6467 if (err) 6468 return err; 6469 6470 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6471 return -EINVAL; 6472 6473 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 6474 * as userspace might just pass through the capabilities from the IEs 6475 * directly, rather than enforcing this restriction and returning an 6476 * error in this case. 6477 */ 6478 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 6479 params.ht_capa = NULL; 6480 params.vht_capa = NULL; 6481 6482 /* HE requires WME */ 6483 if (params.he_capa_len || params.he_6ghz_capa) 6484 return -EINVAL; 6485 } 6486 6487 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 6488 if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa)) 6489 return -EINVAL; 6490 6491 /* When you run into this, adjust the code below for the new flag */ 6492 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6493 6494 switch (dev->ieee80211_ptr->iftype) { 6495 case NL80211_IFTYPE_AP: 6496 case NL80211_IFTYPE_AP_VLAN: 6497 case NL80211_IFTYPE_P2P_GO: 6498 /* ignore WME attributes if iface/sta is not capable */ 6499 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 6500 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 6501 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6502 6503 /* TDLS peers cannot be added */ 6504 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6505 info->attrs[NL80211_ATTR_PEER_AID]) 6506 return -EINVAL; 6507 /* but don't bother the driver with it */ 6508 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6509 6510 /* allow authenticated/associated only if driver handles it */ 6511 if (!(rdev->wiphy.features & 6512 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6513 params.sta_flags_mask & auth_assoc) 6514 return -EINVAL; 6515 6516 /* Older userspace, or userspace wanting to be compatible with 6517 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 6518 * and assoc flags in the mask, but assumes the station will be 6519 * added as associated anyway since this was the required driver 6520 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 6521 * introduced. 6522 * In order to not bother drivers with this quirk in the API 6523 * set the flags in both the mask and set for new stations in 6524 * this case. 6525 */ 6526 if (!(params.sta_flags_mask & auth_assoc)) { 6527 params.sta_flags_mask |= auth_assoc; 6528 params.sta_flags_set |= auth_assoc; 6529 } 6530 6531 /* must be last in here for error handling */ 6532 params.vlan = get_vlan(info, rdev); 6533 if (IS_ERR(params.vlan)) 6534 return PTR_ERR(params.vlan); 6535 break; 6536 case NL80211_IFTYPE_MESH_POINT: 6537 /* ignore uAPSD data */ 6538 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6539 6540 /* associated is disallowed */ 6541 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 6542 return -EINVAL; 6543 /* TDLS peers cannot be added */ 6544 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6545 info->attrs[NL80211_ATTR_PEER_AID]) 6546 return -EINVAL; 6547 break; 6548 case NL80211_IFTYPE_STATION: 6549 case NL80211_IFTYPE_P2P_CLIENT: 6550 /* ignore uAPSD data */ 6551 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6552 6553 /* these are disallowed */ 6554 if (params.sta_flags_mask & 6555 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 6556 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 6557 return -EINVAL; 6558 /* Only TDLS peers can be added */ 6559 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6560 return -EINVAL; 6561 /* Can only add if TDLS ... */ 6562 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 6563 return -EOPNOTSUPP; 6564 /* ... with external setup is supported */ 6565 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 6566 return -EOPNOTSUPP; 6567 /* 6568 * Older wpa_supplicant versions always mark the TDLS peer 6569 * as authorized, but it shouldn't yet be. 6570 */ 6571 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 6572 break; 6573 default: 6574 return -EOPNOTSUPP; 6575 } 6576 6577 /* be aware of params.vlan when changing code here */ 6578 6579 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 6580 6581 if (params.vlan) 6582 dev_put(params.vlan); 6583 return err; 6584 } 6585 6586 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 6587 { 6588 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6589 struct net_device *dev = info->user_ptr[1]; 6590 struct station_del_parameters params; 6591 6592 memset(¶ms, 0, sizeof(params)); 6593 6594 if (info->attrs[NL80211_ATTR_MAC]) 6595 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 6596 6597 switch (dev->ieee80211_ptr->iftype) { 6598 case NL80211_IFTYPE_AP: 6599 case NL80211_IFTYPE_AP_VLAN: 6600 case NL80211_IFTYPE_MESH_POINT: 6601 case NL80211_IFTYPE_P2P_GO: 6602 /* always accept these */ 6603 break; 6604 case NL80211_IFTYPE_ADHOC: 6605 /* conditionally accept */ 6606 if (wiphy_ext_feature_isset(&rdev->wiphy, 6607 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 6608 break; 6609 return -EINVAL; 6610 default: 6611 return -EINVAL; 6612 } 6613 6614 if (!rdev->ops->del_station) 6615 return -EOPNOTSUPP; 6616 6617 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 6618 params.subtype = 6619 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 6620 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 6621 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 6622 return -EINVAL; 6623 } else { 6624 /* Default to Deauthentication frame */ 6625 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 6626 } 6627 6628 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 6629 params.reason_code = 6630 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 6631 if (params.reason_code == 0) 6632 return -EINVAL; /* 0 is reserved */ 6633 } else { 6634 /* Default to reason code 2 */ 6635 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 6636 } 6637 6638 return rdev_del_station(rdev, dev, ¶ms); 6639 } 6640 6641 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 6642 int flags, struct net_device *dev, 6643 u8 *dst, u8 *next_hop, 6644 struct mpath_info *pinfo) 6645 { 6646 void *hdr; 6647 struct nlattr *pinfoattr; 6648 6649 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 6650 if (!hdr) 6651 return -1; 6652 6653 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6654 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 6655 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 6656 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 6657 goto nla_put_failure; 6658 6659 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 6660 if (!pinfoattr) 6661 goto nla_put_failure; 6662 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 6663 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 6664 pinfo->frame_qlen)) 6665 goto nla_put_failure; 6666 if (((pinfo->filled & MPATH_INFO_SN) && 6667 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 6668 ((pinfo->filled & MPATH_INFO_METRIC) && 6669 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 6670 pinfo->metric)) || 6671 ((pinfo->filled & MPATH_INFO_EXPTIME) && 6672 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 6673 pinfo->exptime)) || 6674 ((pinfo->filled & MPATH_INFO_FLAGS) && 6675 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 6676 pinfo->flags)) || 6677 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 6678 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 6679 pinfo->discovery_timeout)) || 6680 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 6681 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 6682 pinfo->discovery_retries)) || 6683 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 6684 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 6685 pinfo->hop_count)) || 6686 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 6687 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 6688 pinfo->path_change_count))) 6689 goto nla_put_failure; 6690 6691 nla_nest_end(msg, pinfoattr); 6692 6693 genlmsg_end(msg, hdr); 6694 return 0; 6695 6696 nla_put_failure: 6697 genlmsg_cancel(msg, hdr); 6698 return -EMSGSIZE; 6699 } 6700 6701 static int nl80211_dump_mpath(struct sk_buff *skb, 6702 struct netlink_callback *cb) 6703 { 6704 struct mpath_info pinfo; 6705 struct cfg80211_registered_device *rdev; 6706 struct wireless_dev *wdev; 6707 u8 dst[ETH_ALEN]; 6708 u8 next_hop[ETH_ALEN]; 6709 int path_idx = cb->args[2]; 6710 int err; 6711 6712 rtnl_lock(); 6713 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6714 if (err) 6715 goto out_err; 6716 6717 if (!rdev->ops->dump_mpath) { 6718 err = -EOPNOTSUPP; 6719 goto out_err; 6720 } 6721 6722 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6723 err = -EOPNOTSUPP; 6724 goto out_err; 6725 } 6726 6727 while (1) { 6728 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 6729 next_hop, &pinfo); 6730 if (err == -ENOENT) 6731 break; 6732 if (err) 6733 goto out_err; 6734 6735 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6736 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6737 wdev->netdev, dst, next_hop, 6738 &pinfo) < 0) 6739 goto out; 6740 6741 path_idx++; 6742 } 6743 6744 out: 6745 cb->args[2] = path_idx; 6746 err = skb->len; 6747 out_err: 6748 rtnl_unlock(); 6749 return err; 6750 } 6751 6752 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 6753 { 6754 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6755 int err; 6756 struct net_device *dev = info->user_ptr[1]; 6757 struct mpath_info pinfo; 6758 struct sk_buff *msg; 6759 u8 *dst = NULL; 6760 u8 next_hop[ETH_ALEN]; 6761 6762 memset(&pinfo, 0, sizeof(pinfo)); 6763 6764 if (!info->attrs[NL80211_ATTR_MAC]) 6765 return -EINVAL; 6766 6767 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6768 6769 if (!rdev->ops->get_mpath) 6770 return -EOPNOTSUPP; 6771 6772 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6773 return -EOPNOTSUPP; 6774 6775 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 6776 if (err) 6777 return err; 6778 6779 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6780 if (!msg) 6781 return -ENOMEM; 6782 6783 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6784 dev, dst, next_hop, &pinfo) < 0) { 6785 nlmsg_free(msg); 6786 return -ENOBUFS; 6787 } 6788 6789 return genlmsg_reply(msg, info); 6790 } 6791 6792 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 6793 { 6794 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6795 struct net_device *dev = info->user_ptr[1]; 6796 u8 *dst = NULL; 6797 u8 *next_hop = NULL; 6798 6799 if (!info->attrs[NL80211_ATTR_MAC]) 6800 return -EINVAL; 6801 6802 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6803 return -EINVAL; 6804 6805 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6806 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6807 6808 if (!rdev->ops->change_mpath) 6809 return -EOPNOTSUPP; 6810 6811 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6812 return -EOPNOTSUPP; 6813 6814 return rdev_change_mpath(rdev, dev, dst, next_hop); 6815 } 6816 6817 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 6818 { 6819 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6820 struct net_device *dev = info->user_ptr[1]; 6821 u8 *dst = NULL; 6822 u8 *next_hop = NULL; 6823 6824 if (!info->attrs[NL80211_ATTR_MAC]) 6825 return -EINVAL; 6826 6827 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6828 return -EINVAL; 6829 6830 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6831 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6832 6833 if (!rdev->ops->add_mpath) 6834 return -EOPNOTSUPP; 6835 6836 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6837 return -EOPNOTSUPP; 6838 6839 return rdev_add_mpath(rdev, dev, dst, next_hop); 6840 } 6841 6842 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 6843 { 6844 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6845 struct net_device *dev = info->user_ptr[1]; 6846 u8 *dst = NULL; 6847 6848 if (info->attrs[NL80211_ATTR_MAC]) 6849 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6850 6851 if (!rdev->ops->del_mpath) 6852 return -EOPNOTSUPP; 6853 6854 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6855 return -EOPNOTSUPP; 6856 6857 return rdev_del_mpath(rdev, dev, dst); 6858 } 6859 6860 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 6861 { 6862 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6863 int err; 6864 struct net_device *dev = info->user_ptr[1]; 6865 struct mpath_info pinfo; 6866 struct sk_buff *msg; 6867 u8 *dst = NULL; 6868 u8 mpp[ETH_ALEN]; 6869 6870 memset(&pinfo, 0, sizeof(pinfo)); 6871 6872 if (!info->attrs[NL80211_ATTR_MAC]) 6873 return -EINVAL; 6874 6875 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6876 6877 if (!rdev->ops->get_mpp) 6878 return -EOPNOTSUPP; 6879 6880 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6881 return -EOPNOTSUPP; 6882 6883 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 6884 if (err) 6885 return err; 6886 6887 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6888 if (!msg) 6889 return -ENOMEM; 6890 6891 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6892 dev, dst, mpp, &pinfo) < 0) { 6893 nlmsg_free(msg); 6894 return -ENOBUFS; 6895 } 6896 6897 return genlmsg_reply(msg, info); 6898 } 6899 6900 static int nl80211_dump_mpp(struct sk_buff *skb, 6901 struct netlink_callback *cb) 6902 { 6903 struct mpath_info pinfo; 6904 struct cfg80211_registered_device *rdev; 6905 struct wireless_dev *wdev; 6906 u8 dst[ETH_ALEN]; 6907 u8 mpp[ETH_ALEN]; 6908 int path_idx = cb->args[2]; 6909 int err; 6910 6911 rtnl_lock(); 6912 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6913 if (err) 6914 goto out_err; 6915 6916 if (!rdev->ops->dump_mpp) { 6917 err = -EOPNOTSUPP; 6918 goto out_err; 6919 } 6920 6921 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6922 err = -EOPNOTSUPP; 6923 goto out_err; 6924 } 6925 6926 while (1) { 6927 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 6928 mpp, &pinfo); 6929 if (err == -ENOENT) 6930 break; 6931 if (err) 6932 goto out_err; 6933 6934 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6935 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6936 wdev->netdev, dst, mpp, 6937 &pinfo) < 0) 6938 goto out; 6939 6940 path_idx++; 6941 } 6942 6943 out: 6944 cb->args[2] = path_idx; 6945 err = skb->len; 6946 out_err: 6947 rtnl_unlock(); 6948 return err; 6949 } 6950 6951 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 6952 { 6953 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6954 struct net_device *dev = info->user_ptr[1]; 6955 struct wireless_dev *wdev = dev->ieee80211_ptr; 6956 struct bss_parameters params; 6957 int err; 6958 6959 memset(¶ms, 0, sizeof(params)); 6960 /* default to not changing parameters */ 6961 params.use_cts_prot = -1; 6962 params.use_short_preamble = -1; 6963 params.use_short_slot_time = -1; 6964 params.ap_isolate = -1; 6965 params.ht_opmode = -1; 6966 params.p2p_ctwindow = -1; 6967 params.p2p_opp_ps = -1; 6968 6969 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 6970 params.use_cts_prot = 6971 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 6972 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 6973 params.use_short_preamble = 6974 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 6975 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 6976 params.use_short_slot_time = 6977 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 6978 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 6979 params.basic_rates = 6980 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6981 params.basic_rates_len = 6982 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6983 } 6984 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 6985 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 6986 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 6987 params.ht_opmode = 6988 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 6989 6990 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 6991 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6992 return -EINVAL; 6993 params.p2p_ctwindow = 6994 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 6995 if (params.p2p_ctwindow != 0 && 6996 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 6997 return -EINVAL; 6998 } 6999 7000 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 7001 u8 tmp; 7002 7003 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7004 return -EINVAL; 7005 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 7006 params.p2p_opp_ps = tmp; 7007 if (params.p2p_opp_ps && 7008 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 7009 return -EINVAL; 7010 } 7011 7012 if (!rdev->ops->change_bss) 7013 return -EOPNOTSUPP; 7014 7015 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7016 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7017 return -EOPNOTSUPP; 7018 7019 wdev_lock(wdev); 7020 err = rdev_change_bss(rdev, dev, ¶ms); 7021 wdev_unlock(wdev); 7022 7023 return err; 7024 } 7025 7026 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 7027 { 7028 char *data = NULL; 7029 bool is_indoor; 7030 enum nl80211_user_reg_hint_type user_reg_hint_type; 7031 u32 owner_nlportid; 7032 7033 /* 7034 * You should only get this when cfg80211 hasn't yet initialized 7035 * completely when built-in to the kernel right between the time 7036 * window between nl80211_init() and regulatory_init(), if that is 7037 * even possible. 7038 */ 7039 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 7040 return -EINPROGRESS; 7041 7042 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 7043 user_reg_hint_type = 7044 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 7045 else 7046 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 7047 7048 switch (user_reg_hint_type) { 7049 case NL80211_USER_REG_HINT_USER: 7050 case NL80211_USER_REG_HINT_CELL_BASE: 7051 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7052 return -EINVAL; 7053 7054 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7055 return regulatory_hint_user(data, user_reg_hint_type); 7056 case NL80211_USER_REG_HINT_INDOOR: 7057 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 7058 owner_nlportid = info->snd_portid; 7059 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 7060 } else { 7061 owner_nlportid = 0; 7062 is_indoor = true; 7063 } 7064 7065 return regulatory_hint_indoor(is_indoor, owner_nlportid); 7066 default: 7067 return -EINVAL; 7068 } 7069 } 7070 7071 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 7072 { 7073 return reg_reload_regdb(); 7074 } 7075 7076 static int nl80211_get_mesh_config(struct sk_buff *skb, 7077 struct genl_info *info) 7078 { 7079 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7080 struct net_device *dev = info->user_ptr[1]; 7081 struct wireless_dev *wdev = dev->ieee80211_ptr; 7082 struct mesh_config cur_params; 7083 int err = 0; 7084 void *hdr; 7085 struct nlattr *pinfoattr; 7086 struct sk_buff *msg; 7087 7088 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7089 return -EOPNOTSUPP; 7090 7091 if (!rdev->ops->get_mesh_config) 7092 return -EOPNOTSUPP; 7093 7094 wdev_lock(wdev); 7095 /* If not connected, get default parameters */ 7096 if (!wdev->mesh_id_len) 7097 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 7098 else 7099 err = rdev_get_mesh_config(rdev, dev, &cur_params); 7100 wdev_unlock(wdev); 7101 7102 if (err) 7103 return err; 7104 7105 /* Draw up a netlink message to send back */ 7106 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7107 if (!msg) 7108 return -ENOMEM; 7109 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7110 NL80211_CMD_GET_MESH_CONFIG); 7111 if (!hdr) 7112 goto out; 7113 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 7114 if (!pinfoattr) 7115 goto nla_put_failure; 7116 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7117 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 7118 cur_params.dot11MeshRetryTimeout) || 7119 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 7120 cur_params.dot11MeshConfirmTimeout) || 7121 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 7122 cur_params.dot11MeshHoldingTimeout) || 7123 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 7124 cur_params.dot11MeshMaxPeerLinks) || 7125 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 7126 cur_params.dot11MeshMaxRetries) || 7127 nla_put_u8(msg, NL80211_MESHCONF_TTL, 7128 cur_params.dot11MeshTTL) || 7129 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 7130 cur_params.element_ttl) || 7131 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7132 cur_params.auto_open_plinks) || 7133 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7134 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 7135 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7136 cur_params.dot11MeshHWMPmaxPREQretries) || 7137 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 7138 cur_params.path_refresh_time) || 7139 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7140 cur_params.min_discovery_timeout) || 7141 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7142 cur_params.dot11MeshHWMPactivePathTimeout) || 7143 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7144 cur_params.dot11MeshHWMPpreqMinInterval) || 7145 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7146 cur_params.dot11MeshHWMPperrMinInterval) || 7147 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7148 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 7149 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 7150 cur_params.dot11MeshHWMPRootMode) || 7151 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7152 cur_params.dot11MeshHWMPRannInterval) || 7153 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7154 cur_params.dot11MeshGateAnnouncementProtocol) || 7155 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 7156 cur_params.dot11MeshForwarding) || 7157 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 7158 cur_params.rssi_threshold) || 7159 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 7160 cur_params.ht_opmode) || 7161 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7162 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 7163 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7164 cur_params.dot11MeshHWMProotInterval) || 7165 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7166 cur_params.dot11MeshHWMPconfirmationInterval) || 7167 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 7168 cur_params.power_mode) || 7169 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 7170 cur_params.dot11MeshAwakeWindowDuration) || 7171 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 7172 cur_params.plink_timeout) || 7173 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 7174 cur_params.dot11MeshConnectedToMeshGate) || 7175 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 7176 cur_params.dot11MeshNolearn) || 7177 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 7178 cur_params.dot11MeshConnectedToAuthServer)) 7179 goto nla_put_failure; 7180 nla_nest_end(msg, pinfoattr); 7181 genlmsg_end(msg, hdr); 7182 return genlmsg_reply(msg, info); 7183 7184 nla_put_failure: 7185 out: 7186 nlmsg_free(msg); 7187 return -ENOBUFS; 7188 } 7189 7190 static const struct nla_policy 7191 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 7192 [NL80211_MESHCONF_RETRY_TIMEOUT] = 7193 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7194 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 7195 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7196 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 7197 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7198 [NL80211_MESHCONF_MAX_PEER_LINKS] = 7199 NLA_POLICY_RANGE(NLA_U16, 0, 255), 7200 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 7201 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7202 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7203 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 7204 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 7205 NLA_POLICY_RANGE(NLA_U32, 1, 255), 7206 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 7207 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 7208 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 7209 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 7210 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 7211 NLA_POLICY_MIN(NLA_U16, 1), 7212 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 7213 NLA_POLICY_MIN(NLA_U16, 1), 7214 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 7215 NLA_POLICY_MIN(NLA_U16, 1), 7216 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 7217 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 7218 NLA_POLICY_MIN(NLA_U16, 1), 7219 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 7220 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 7221 [NL80211_MESHCONF_RSSI_THRESHOLD] = 7222 NLA_POLICY_RANGE(NLA_S32, -255, 0), 7223 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 7224 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 7225 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 7226 NLA_POLICY_MIN(NLA_U16, 1), 7227 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 7228 NLA_POLICY_MIN(NLA_U16, 1), 7229 [NL80211_MESHCONF_POWER_MODE] = 7230 NLA_POLICY_RANGE(NLA_U32, 7231 NL80211_MESH_POWER_ACTIVE, 7232 NL80211_MESH_POWER_MAX), 7233 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 7234 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 7235 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7236 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7237 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7238 }; 7239 7240 static const struct nla_policy 7241 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 7242 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 7243 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 7244 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 7245 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 7246 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 7247 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 7248 [NL80211_MESH_SETUP_IE] = 7249 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 7250 IEEE80211_MAX_DATA_LEN), 7251 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 7252 }; 7253 7254 static int nl80211_parse_mesh_config(struct genl_info *info, 7255 struct mesh_config *cfg, 7256 u32 *mask_out) 7257 { 7258 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 7259 u32 mask = 0; 7260 u16 ht_opmode; 7261 7262 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 7263 do { \ 7264 if (tb[attr]) { \ 7265 cfg->param = fn(tb[attr]); \ 7266 mask |= BIT((attr) - 1); \ 7267 } \ 7268 } while (0) 7269 7270 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 7271 return -EINVAL; 7272 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 7273 return -EINVAL; 7274 7275 /* This makes sure that there aren't more than 32 mesh config 7276 * parameters (otherwise our bitfield scheme would not work.) */ 7277 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 7278 7279 /* Fill in the params struct */ 7280 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 7281 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 7282 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 7283 NL80211_MESHCONF_CONFIRM_TIMEOUT, 7284 nla_get_u16); 7285 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 7286 NL80211_MESHCONF_HOLDING_TIMEOUT, 7287 nla_get_u16); 7288 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 7289 NL80211_MESHCONF_MAX_PEER_LINKS, 7290 nla_get_u16); 7291 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 7292 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 7293 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 7294 NL80211_MESHCONF_TTL, nla_get_u8); 7295 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 7296 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 7297 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 7298 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7299 nla_get_u8); 7300 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 7301 mask, 7302 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7303 nla_get_u32); 7304 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 7305 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7306 nla_get_u8); 7307 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 7308 NL80211_MESHCONF_PATH_REFRESH_TIME, 7309 nla_get_u32); 7310 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 7311 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 7312 return -EINVAL; 7313 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 7314 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7315 nla_get_u16); 7316 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 7317 mask, 7318 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7319 nla_get_u32); 7320 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 7321 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 7322 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 7323 return -EINVAL; 7324 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 7325 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7326 nla_get_u16); 7327 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 7328 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7329 nla_get_u16); 7330 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7331 dot11MeshHWMPnetDiameterTraversalTime, mask, 7332 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7333 nla_get_u16); 7334 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 7335 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 7336 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 7337 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7338 nla_get_u16); 7339 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 7340 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7341 nla_get_u8); 7342 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 7343 NL80211_MESHCONF_FORWARDING, nla_get_u8); 7344 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 7345 NL80211_MESHCONF_RSSI_THRESHOLD, 7346 nla_get_s32); 7347 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 7348 NL80211_MESHCONF_CONNECTED_TO_GATE, 7349 nla_get_u8); 7350 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 7351 NL80211_MESHCONF_CONNECTED_TO_AS, 7352 nla_get_u8); 7353 /* 7354 * Check HT operation mode based on 7355 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 7356 */ 7357 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 7358 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 7359 7360 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 7361 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 7362 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 7363 return -EINVAL; 7364 7365 /* NON_HT_STA bit is reserved, but some programs set it */ 7366 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 7367 7368 cfg->ht_opmode = ht_opmode; 7369 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 7370 } 7371 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7372 dot11MeshHWMPactivePathToRootTimeout, mask, 7373 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7374 nla_get_u32); 7375 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 7376 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 7377 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 7378 return -EINVAL; 7379 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 7380 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7381 nla_get_u16); 7382 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 7383 mask, 7384 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7385 nla_get_u16); 7386 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 7387 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 7388 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 7389 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 7390 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 7391 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 7392 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 7393 NL80211_MESHCONF_NOLEARN, nla_get_u8); 7394 if (mask_out) 7395 *mask_out = mask; 7396 7397 return 0; 7398 7399 #undef FILL_IN_MESH_PARAM_IF_SET 7400 } 7401 7402 static int nl80211_parse_mesh_setup(struct genl_info *info, 7403 struct mesh_setup *setup) 7404 { 7405 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7406 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 7407 7408 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 7409 return -EINVAL; 7410 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 7411 return -EINVAL; 7412 7413 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 7414 setup->sync_method = 7415 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 7416 IEEE80211_SYNC_METHOD_VENDOR : 7417 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 7418 7419 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 7420 setup->path_sel_proto = 7421 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 7422 IEEE80211_PATH_PROTOCOL_VENDOR : 7423 IEEE80211_PATH_PROTOCOL_HWMP; 7424 7425 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 7426 setup->path_metric = 7427 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 7428 IEEE80211_PATH_METRIC_VENDOR : 7429 IEEE80211_PATH_METRIC_AIRTIME; 7430 7431 if (tb[NL80211_MESH_SETUP_IE]) { 7432 struct nlattr *ieattr = 7433 tb[NL80211_MESH_SETUP_IE]; 7434 setup->ie = nla_data(ieattr); 7435 setup->ie_len = nla_len(ieattr); 7436 } 7437 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 7438 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 7439 return -EINVAL; 7440 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 7441 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 7442 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 7443 if (setup->is_secure) 7444 setup->user_mpm = true; 7445 7446 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 7447 if (!setup->user_mpm) 7448 return -EINVAL; 7449 setup->auth_id = 7450 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 7451 } 7452 7453 return 0; 7454 } 7455 7456 static int nl80211_update_mesh_config(struct sk_buff *skb, 7457 struct genl_info *info) 7458 { 7459 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7460 struct net_device *dev = info->user_ptr[1]; 7461 struct wireless_dev *wdev = dev->ieee80211_ptr; 7462 struct mesh_config cfg; 7463 u32 mask; 7464 int err; 7465 7466 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7467 return -EOPNOTSUPP; 7468 7469 if (!rdev->ops->update_mesh_config) 7470 return -EOPNOTSUPP; 7471 7472 err = nl80211_parse_mesh_config(info, &cfg, &mask); 7473 if (err) 7474 return err; 7475 7476 wdev_lock(wdev); 7477 if (!wdev->mesh_id_len) 7478 err = -ENOLINK; 7479 7480 if (!err) 7481 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 7482 7483 wdev_unlock(wdev); 7484 7485 return err; 7486 } 7487 7488 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 7489 struct sk_buff *msg) 7490 { 7491 struct nlattr *nl_reg_rules; 7492 unsigned int i; 7493 7494 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 7495 (regdom->dfs_region && 7496 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 7497 goto nla_put_failure; 7498 7499 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 7500 if (!nl_reg_rules) 7501 goto nla_put_failure; 7502 7503 for (i = 0; i < regdom->n_reg_rules; i++) { 7504 struct nlattr *nl_reg_rule; 7505 const struct ieee80211_reg_rule *reg_rule; 7506 const struct ieee80211_freq_range *freq_range; 7507 const struct ieee80211_power_rule *power_rule; 7508 unsigned int max_bandwidth_khz; 7509 7510 reg_rule = ®dom->reg_rules[i]; 7511 freq_range = ®_rule->freq_range; 7512 power_rule = ®_rule->power_rule; 7513 7514 nl_reg_rule = nla_nest_start_noflag(msg, i); 7515 if (!nl_reg_rule) 7516 goto nla_put_failure; 7517 7518 max_bandwidth_khz = freq_range->max_bandwidth_khz; 7519 if (!max_bandwidth_khz) 7520 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 7521 reg_rule); 7522 7523 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 7524 reg_rule->flags) || 7525 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 7526 freq_range->start_freq_khz) || 7527 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 7528 freq_range->end_freq_khz) || 7529 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 7530 max_bandwidth_khz) || 7531 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 7532 power_rule->max_antenna_gain) || 7533 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 7534 power_rule->max_eirp) || 7535 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 7536 reg_rule->dfs_cac_ms)) 7537 goto nla_put_failure; 7538 7539 nla_nest_end(msg, nl_reg_rule); 7540 } 7541 7542 nla_nest_end(msg, nl_reg_rules); 7543 return 0; 7544 7545 nla_put_failure: 7546 return -EMSGSIZE; 7547 } 7548 7549 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 7550 { 7551 const struct ieee80211_regdomain *regdom = NULL; 7552 struct cfg80211_registered_device *rdev; 7553 struct wiphy *wiphy = NULL; 7554 struct sk_buff *msg; 7555 void *hdr; 7556 7557 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7558 if (!msg) 7559 return -ENOBUFS; 7560 7561 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7562 NL80211_CMD_GET_REG); 7563 if (!hdr) 7564 goto put_failure; 7565 7566 if (info->attrs[NL80211_ATTR_WIPHY]) { 7567 bool self_managed; 7568 7569 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 7570 if (IS_ERR(rdev)) { 7571 nlmsg_free(msg); 7572 return PTR_ERR(rdev); 7573 } 7574 7575 wiphy = &rdev->wiphy; 7576 self_managed = wiphy->regulatory_flags & 7577 REGULATORY_WIPHY_SELF_MANAGED; 7578 regdom = get_wiphy_regdom(wiphy); 7579 7580 /* a self-managed-reg device must have a private regdom */ 7581 if (WARN_ON(!regdom && self_managed)) { 7582 nlmsg_free(msg); 7583 return -EINVAL; 7584 } 7585 7586 if (regdom && 7587 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7588 goto nla_put_failure; 7589 } 7590 7591 if (!wiphy && reg_last_request_cell_base() && 7592 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7593 NL80211_USER_REG_HINT_CELL_BASE)) 7594 goto nla_put_failure; 7595 7596 rcu_read_lock(); 7597 7598 if (!regdom) 7599 regdom = rcu_dereference(cfg80211_regdomain); 7600 7601 if (nl80211_put_regdom(regdom, msg)) 7602 goto nla_put_failure_rcu; 7603 7604 rcu_read_unlock(); 7605 7606 genlmsg_end(msg, hdr); 7607 return genlmsg_reply(msg, info); 7608 7609 nla_put_failure_rcu: 7610 rcu_read_unlock(); 7611 nla_put_failure: 7612 put_failure: 7613 nlmsg_free(msg); 7614 return -EMSGSIZE; 7615 } 7616 7617 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 7618 u32 seq, int flags, struct wiphy *wiphy, 7619 const struct ieee80211_regdomain *regdom) 7620 { 7621 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7622 NL80211_CMD_GET_REG); 7623 7624 if (!hdr) 7625 return -1; 7626 7627 genl_dump_check_consistent(cb, hdr); 7628 7629 if (nl80211_put_regdom(regdom, msg)) 7630 goto nla_put_failure; 7631 7632 if (!wiphy && reg_last_request_cell_base() && 7633 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7634 NL80211_USER_REG_HINT_CELL_BASE)) 7635 goto nla_put_failure; 7636 7637 if (wiphy && 7638 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7639 goto nla_put_failure; 7640 7641 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 7642 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 7643 goto nla_put_failure; 7644 7645 genlmsg_end(msg, hdr); 7646 return 0; 7647 7648 nla_put_failure: 7649 genlmsg_cancel(msg, hdr); 7650 return -EMSGSIZE; 7651 } 7652 7653 static int nl80211_get_reg_dump(struct sk_buff *skb, 7654 struct netlink_callback *cb) 7655 { 7656 const struct ieee80211_regdomain *regdom = NULL; 7657 struct cfg80211_registered_device *rdev; 7658 int err, reg_idx, start = cb->args[2]; 7659 7660 rtnl_lock(); 7661 7662 if (cfg80211_regdomain && start == 0) { 7663 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7664 NLM_F_MULTI, NULL, 7665 rtnl_dereference(cfg80211_regdomain)); 7666 if (err < 0) 7667 goto out_err; 7668 } 7669 7670 /* the global regdom is idx 0 */ 7671 reg_idx = 1; 7672 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 7673 regdom = get_wiphy_regdom(&rdev->wiphy); 7674 if (!regdom) 7675 continue; 7676 7677 if (++reg_idx <= start) 7678 continue; 7679 7680 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7681 NLM_F_MULTI, &rdev->wiphy, regdom); 7682 if (err < 0) { 7683 reg_idx--; 7684 break; 7685 } 7686 } 7687 7688 cb->args[2] = reg_idx; 7689 err = skb->len; 7690 out_err: 7691 rtnl_unlock(); 7692 return err; 7693 } 7694 7695 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 7696 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 7697 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 7698 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 7699 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 7700 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 7701 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 7702 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 7703 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 7704 }; 7705 7706 static int parse_reg_rule(struct nlattr *tb[], 7707 struct ieee80211_reg_rule *reg_rule) 7708 { 7709 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 7710 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 7711 7712 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 7713 return -EINVAL; 7714 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 7715 return -EINVAL; 7716 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 7717 return -EINVAL; 7718 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 7719 return -EINVAL; 7720 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 7721 return -EINVAL; 7722 7723 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 7724 7725 freq_range->start_freq_khz = 7726 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 7727 freq_range->end_freq_khz = 7728 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 7729 freq_range->max_bandwidth_khz = 7730 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 7731 7732 power_rule->max_eirp = 7733 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 7734 7735 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 7736 power_rule->max_antenna_gain = 7737 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 7738 7739 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 7740 reg_rule->dfs_cac_ms = 7741 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 7742 7743 return 0; 7744 } 7745 7746 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 7747 { 7748 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 7749 struct nlattr *nl_reg_rule; 7750 char *alpha2; 7751 int rem_reg_rules, r; 7752 u32 num_rules = 0, rule_idx = 0; 7753 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 7754 struct ieee80211_regdomain *rd; 7755 7756 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7757 return -EINVAL; 7758 7759 if (!info->attrs[NL80211_ATTR_REG_RULES]) 7760 return -EINVAL; 7761 7762 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7763 7764 if (info->attrs[NL80211_ATTR_DFS_REGION]) 7765 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 7766 7767 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7768 rem_reg_rules) { 7769 num_rules++; 7770 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 7771 return -EINVAL; 7772 } 7773 7774 if (!reg_is_valid_request(alpha2)) 7775 return -EINVAL; 7776 7777 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 7778 if (!rd) 7779 return -ENOMEM; 7780 7781 rd->n_reg_rules = num_rules; 7782 rd->alpha2[0] = alpha2[0]; 7783 rd->alpha2[1] = alpha2[1]; 7784 7785 /* 7786 * Disable DFS master mode if the DFS region was 7787 * not supported or known on this kernel. 7788 */ 7789 if (reg_supported_dfs_region(dfs_region)) 7790 rd->dfs_region = dfs_region; 7791 7792 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7793 rem_reg_rules) { 7794 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 7795 nl_reg_rule, reg_rule_policy, 7796 info->extack); 7797 if (r) 7798 goto bad_reg; 7799 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 7800 if (r) 7801 goto bad_reg; 7802 7803 rule_idx++; 7804 7805 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 7806 r = -EINVAL; 7807 goto bad_reg; 7808 } 7809 } 7810 7811 /* set_regdom takes ownership of rd */ 7812 return set_regdom(rd, REGD_SOURCE_CRDA); 7813 bad_reg: 7814 kfree(rd); 7815 return r; 7816 } 7817 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 7818 7819 static int validate_scan_freqs(struct nlattr *freqs) 7820 { 7821 struct nlattr *attr1, *attr2; 7822 int n_channels = 0, tmp1, tmp2; 7823 7824 nla_for_each_nested(attr1, freqs, tmp1) 7825 if (nla_len(attr1) != sizeof(u32)) 7826 return 0; 7827 7828 nla_for_each_nested(attr1, freqs, tmp1) { 7829 n_channels++; 7830 /* 7831 * Some hardware has a limited channel list for 7832 * scanning, and it is pretty much nonsensical 7833 * to scan for a channel twice, so disallow that 7834 * and don't require drivers to check that the 7835 * channel list they get isn't longer than what 7836 * they can scan, as long as they can scan all 7837 * the channels they registered at once. 7838 */ 7839 nla_for_each_nested(attr2, freqs, tmp2) 7840 if (attr1 != attr2 && 7841 nla_get_u32(attr1) == nla_get_u32(attr2)) 7842 return 0; 7843 } 7844 7845 return n_channels; 7846 } 7847 7848 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 7849 { 7850 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 7851 } 7852 7853 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 7854 struct cfg80211_bss_selection *bss_select) 7855 { 7856 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 7857 struct nlattr *nest; 7858 int err; 7859 bool found = false; 7860 int i; 7861 7862 /* only process one nested attribute */ 7863 nest = nla_data(nla); 7864 if (!nla_ok(nest, nla_len(nest))) 7865 return -EINVAL; 7866 7867 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 7868 nest, nl80211_bss_select_policy, 7869 NULL); 7870 if (err) 7871 return err; 7872 7873 /* only one attribute may be given */ 7874 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 7875 if (attr[i]) { 7876 if (found) 7877 return -EINVAL; 7878 found = true; 7879 } 7880 } 7881 7882 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 7883 7884 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 7885 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 7886 7887 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 7888 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 7889 bss_select->param.band_pref = 7890 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 7891 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 7892 return -EINVAL; 7893 } 7894 7895 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 7896 struct nl80211_bss_select_rssi_adjust *adj_param; 7897 7898 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 7899 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 7900 bss_select->param.adjust.band = adj_param->band; 7901 bss_select->param.adjust.delta = adj_param->delta; 7902 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 7903 return -EINVAL; 7904 } 7905 7906 /* user-space did not provide behaviour attribute */ 7907 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 7908 return -EINVAL; 7909 7910 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 7911 return -EINVAL; 7912 7913 return 0; 7914 } 7915 7916 int nl80211_parse_random_mac(struct nlattr **attrs, 7917 u8 *mac_addr, u8 *mac_addr_mask) 7918 { 7919 int i; 7920 7921 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 7922 eth_zero_addr(mac_addr); 7923 eth_zero_addr(mac_addr_mask); 7924 mac_addr[0] = 0x2; 7925 mac_addr_mask[0] = 0x3; 7926 7927 return 0; 7928 } 7929 7930 /* need both or none */ 7931 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 7932 return -EINVAL; 7933 7934 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 7935 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 7936 7937 /* don't allow or configure an mcast address */ 7938 if (!is_multicast_ether_addr(mac_addr_mask) || 7939 is_multicast_ether_addr(mac_addr)) 7940 return -EINVAL; 7941 7942 /* 7943 * allow users to pass a MAC address that has bits set outside 7944 * of the mask, but don't bother drivers with having to deal 7945 * with such bits 7946 */ 7947 for (i = 0; i < ETH_ALEN; i++) 7948 mac_addr[i] &= mac_addr_mask[i]; 7949 7950 return 0; 7951 } 7952 7953 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 7954 { 7955 ASSERT_WDEV_LOCK(wdev); 7956 7957 if (!cfg80211_beaconing_iface_active(wdev)) 7958 return true; 7959 7960 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 7961 return true; 7962 7963 return regulatory_pre_cac_allowed(wdev->wiphy); 7964 } 7965 7966 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 7967 enum nl80211_ext_feature_index feat) 7968 { 7969 if (!(flags & flag)) 7970 return true; 7971 if (wiphy_ext_feature_isset(wiphy, feat)) 7972 return true; 7973 return false; 7974 } 7975 7976 static int 7977 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 7978 void *request, struct nlattr **attrs, 7979 bool is_sched_scan) 7980 { 7981 u8 *mac_addr, *mac_addr_mask; 7982 u32 *flags; 7983 enum nl80211_feature_flags randomness_flag; 7984 7985 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 7986 return 0; 7987 7988 if (is_sched_scan) { 7989 struct cfg80211_sched_scan_request *req = request; 7990 7991 randomness_flag = wdev ? 7992 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 7993 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 7994 flags = &req->flags; 7995 mac_addr = req->mac_addr; 7996 mac_addr_mask = req->mac_addr_mask; 7997 } else { 7998 struct cfg80211_scan_request *req = request; 7999 8000 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 8001 flags = &req->flags; 8002 mac_addr = req->mac_addr; 8003 mac_addr_mask = req->mac_addr_mask; 8004 } 8005 8006 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 8007 8008 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 8009 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 8010 !nl80211_check_scan_feat(wiphy, *flags, 8011 NL80211_SCAN_FLAG_LOW_SPAN, 8012 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 8013 !nl80211_check_scan_feat(wiphy, *flags, 8014 NL80211_SCAN_FLAG_LOW_POWER, 8015 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 8016 !nl80211_check_scan_feat(wiphy, *flags, 8017 NL80211_SCAN_FLAG_HIGH_ACCURACY, 8018 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 8019 !nl80211_check_scan_feat(wiphy, *flags, 8020 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 8021 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 8022 !nl80211_check_scan_feat(wiphy, *flags, 8023 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 8024 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 8025 !nl80211_check_scan_feat(wiphy, *flags, 8026 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 8027 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 8028 !nl80211_check_scan_feat(wiphy, *flags, 8029 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 8030 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 8031 !nl80211_check_scan_feat(wiphy, *flags, 8032 NL80211_SCAN_FLAG_RANDOM_SN, 8033 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 8034 !nl80211_check_scan_feat(wiphy, *flags, 8035 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 8036 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 8037 return -EOPNOTSUPP; 8038 8039 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 8040 int err; 8041 8042 if (!(wiphy->features & randomness_flag) || 8043 (wdev && wdev->current_bss)) 8044 return -EOPNOTSUPP; 8045 8046 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 8047 if (err) 8048 return err; 8049 } 8050 8051 return 0; 8052 } 8053 8054 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 8055 { 8056 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8057 struct wireless_dev *wdev = info->user_ptr[1]; 8058 struct cfg80211_scan_request *request; 8059 struct nlattr *scan_freqs = NULL; 8060 bool scan_freqs_khz = false; 8061 struct nlattr *attr; 8062 struct wiphy *wiphy; 8063 int err, tmp, n_ssids = 0, n_channels, i; 8064 size_t ie_len; 8065 8066 wiphy = &rdev->wiphy; 8067 8068 if (wdev->iftype == NL80211_IFTYPE_NAN) 8069 return -EOPNOTSUPP; 8070 8071 if (!rdev->ops->scan) 8072 return -EOPNOTSUPP; 8073 8074 if (rdev->scan_req || rdev->scan_msg) 8075 return -EBUSY; 8076 8077 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 8078 if (!wiphy_ext_feature_isset(wiphy, 8079 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 8080 return -EOPNOTSUPP; 8081 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 8082 scan_freqs_khz = true; 8083 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 8084 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 8085 8086 if (scan_freqs) { 8087 n_channels = validate_scan_freqs(scan_freqs); 8088 if (!n_channels) 8089 return -EINVAL; 8090 } else { 8091 n_channels = ieee80211_get_num_supported_channels(wiphy); 8092 } 8093 8094 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 8095 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 8096 n_ssids++; 8097 8098 if (n_ssids > wiphy->max_scan_ssids) 8099 return -EINVAL; 8100 8101 if (info->attrs[NL80211_ATTR_IE]) 8102 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8103 else 8104 ie_len = 0; 8105 8106 if (ie_len > wiphy->max_scan_ie_len) 8107 return -EINVAL; 8108 8109 request = kzalloc(sizeof(*request) 8110 + sizeof(*request->ssids) * n_ssids 8111 + sizeof(*request->channels) * n_channels 8112 + ie_len, GFP_KERNEL); 8113 if (!request) 8114 return -ENOMEM; 8115 8116 if (n_ssids) 8117 request->ssids = (void *)&request->channels[n_channels]; 8118 request->n_ssids = n_ssids; 8119 if (ie_len) { 8120 if (n_ssids) 8121 request->ie = (void *)(request->ssids + n_ssids); 8122 else 8123 request->ie = (void *)(request->channels + n_channels); 8124 } 8125 8126 i = 0; 8127 if (scan_freqs) { 8128 /* user specified, bail out if channel not found */ 8129 nla_for_each_nested(attr, scan_freqs, tmp) { 8130 struct ieee80211_channel *chan; 8131 int freq = nla_get_u32(attr); 8132 8133 if (!scan_freqs_khz) 8134 freq = MHZ_TO_KHZ(freq); 8135 8136 chan = ieee80211_get_channel_khz(wiphy, freq); 8137 if (!chan) { 8138 err = -EINVAL; 8139 goto out_free; 8140 } 8141 8142 /* ignore disabled channels */ 8143 if (chan->flags & IEEE80211_CHAN_DISABLED) 8144 continue; 8145 8146 request->channels[i] = chan; 8147 i++; 8148 } 8149 } else { 8150 enum nl80211_band band; 8151 8152 /* all channels */ 8153 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8154 int j; 8155 8156 if (!wiphy->bands[band]) 8157 continue; 8158 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8159 struct ieee80211_channel *chan; 8160 8161 chan = &wiphy->bands[band]->channels[j]; 8162 8163 if (chan->flags & IEEE80211_CHAN_DISABLED) 8164 continue; 8165 8166 request->channels[i] = chan; 8167 i++; 8168 } 8169 } 8170 } 8171 8172 if (!i) { 8173 err = -EINVAL; 8174 goto out_free; 8175 } 8176 8177 request->n_channels = i; 8178 8179 wdev_lock(wdev); 8180 if (!cfg80211_off_channel_oper_allowed(wdev)) { 8181 struct ieee80211_channel *chan; 8182 8183 if (request->n_channels != 1) { 8184 wdev_unlock(wdev); 8185 err = -EBUSY; 8186 goto out_free; 8187 } 8188 8189 chan = request->channels[0]; 8190 if (chan->center_freq != wdev->chandef.chan->center_freq) { 8191 wdev_unlock(wdev); 8192 err = -EBUSY; 8193 goto out_free; 8194 } 8195 } 8196 wdev_unlock(wdev); 8197 8198 i = 0; 8199 if (n_ssids) { 8200 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 8201 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8202 err = -EINVAL; 8203 goto out_free; 8204 } 8205 request->ssids[i].ssid_len = nla_len(attr); 8206 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 8207 i++; 8208 } 8209 } 8210 8211 if (info->attrs[NL80211_ATTR_IE]) { 8212 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8213 memcpy((void *)request->ie, 8214 nla_data(info->attrs[NL80211_ATTR_IE]), 8215 request->ie_len); 8216 } 8217 8218 for (i = 0; i < NUM_NL80211_BANDS; i++) 8219 if (wiphy->bands[i]) 8220 request->rates[i] = 8221 (1 << wiphy->bands[i]->n_bitrates) - 1; 8222 8223 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 8224 nla_for_each_nested(attr, 8225 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 8226 tmp) { 8227 enum nl80211_band band = nla_type(attr); 8228 8229 if (band < 0 || band >= NUM_NL80211_BANDS) { 8230 err = -EINVAL; 8231 goto out_free; 8232 } 8233 8234 if (!wiphy->bands[band]) 8235 continue; 8236 8237 err = ieee80211_get_ratemask(wiphy->bands[band], 8238 nla_data(attr), 8239 nla_len(attr), 8240 &request->rates[band]); 8241 if (err) 8242 goto out_free; 8243 } 8244 } 8245 8246 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 8247 request->duration = 8248 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 8249 request->duration_mandatory = 8250 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 8251 } 8252 8253 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 8254 false); 8255 if (err) 8256 goto out_free; 8257 8258 request->no_cck = 8259 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 8260 8261 /* Initial implementation used NL80211_ATTR_MAC to set the specific 8262 * BSSID to scan for. This was problematic because that same attribute 8263 * was already used for another purpose (local random MAC address). The 8264 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 8265 * compatibility with older userspace components, also use the 8266 * NL80211_ATTR_MAC value here if it can be determined to be used for 8267 * the specific BSSID use case instead of the random MAC address 8268 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 8269 */ 8270 if (info->attrs[NL80211_ATTR_BSSID]) 8271 memcpy(request->bssid, 8272 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 8273 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 8274 info->attrs[NL80211_ATTR_MAC]) 8275 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 8276 ETH_ALEN); 8277 else 8278 eth_broadcast_addr(request->bssid); 8279 8280 request->wdev = wdev; 8281 request->wiphy = &rdev->wiphy; 8282 request->scan_start = jiffies; 8283 8284 rdev->scan_req = request; 8285 err = cfg80211_scan(rdev); 8286 8287 if (err) 8288 goto out_free; 8289 8290 nl80211_send_scan_start(rdev, wdev); 8291 if (wdev->netdev) 8292 dev_hold(wdev->netdev); 8293 8294 return 0; 8295 8296 out_free: 8297 rdev->scan_req = NULL; 8298 kfree(request); 8299 8300 return err; 8301 } 8302 8303 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 8304 { 8305 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8306 struct wireless_dev *wdev = info->user_ptr[1]; 8307 8308 if (!rdev->ops->abort_scan) 8309 return -EOPNOTSUPP; 8310 8311 if (rdev->scan_msg) 8312 return 0; 8313 8314 if (!rdev->scan_req) 8315 return -ENOENT; 8316 8317 rdev_abort_scan(rdev, wdev); 8318 return 0; 8319 } 8320 8321 static int 8322 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 8323 struct cfg80211_sched_scan_request *request, 8324 struct nlattr **attrs) 8325 { 8326 int tmp, err, i = 0; 8327 struct nlattr *attr; 8328 8329 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8330 u32 interval; 8331 8332 /* 8333 * If scan plans are not specified, 8334 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 8335 * case one scan plan will be set with the specified scan 8336 * interval and infinite number of iterations. 8337 */ 8338 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 8339 if (!interval) 8340 return -EINVAL; 8341 8342 request->scan_plans[0].interval = 8343 DIV_ROUND_UP(interval, MSEC_PER_SEC); 8344 if (!request->scan_plans[0].interval) 8345 return -EINVAL; 8346 8347 if (request->scan_plans[0].interval > 8348 wiphy->max_sched_scan_plan_interval) 8349 request->scan_plans[0].interval = 8350 wiphy->max_sched_scan_plan_interval; 8351 8352 return 0; 8353 } 8354 8355 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 8356 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 8357 8358 if (WARN_ON(i >= n_plans)) 8359 return -EINVAL; 8360 8361 err = nla_parse_nested_deprecated(plan, 8362 NL80211_SCHED_SCAN_PLAN_MAX, 8363 attr, nl80211_plan_policy, 8364 NULL); 8365 if (err) 8366 return err; 8367 8368 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 8369 return -EINVAL; 8370 8371 request->scan_plans[i].interval = 8372 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 8373 if (!request->scan_plans[i].interval || 8374 request->scan_plans[i].interval > 8375 wiphy->max_sched_scan_plan_interval) 8376 return -EINVAL; 8377 8378 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 8379 request->scan_plans[i].iterations = 8380 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 8381 if (!request->scan_plans[i].iterations || 8382 (request->scan_plans[i].iterations > 8383 wiphy->max_sched_scan_plan_iterations)) 8384 return -EINVAL; 8385 } else if (i < n_plans - 1) { 8386 /* 8387 * All scan plans but the last one must specify 8388 * a finite number of iterations 8389 */ 8390 return -EINVAL; 8391 } 8392 8393 i++; 8394 } 8395 8396 /* 8397 * The last scan plan must not specify the number of 8398 * iterations, it is supposed to run infinitely 8399 */ 8400 if (request->scan_plans[n_plans - 1].iterations) 8401 return -EINVAL; 8402 8403 return 0; 8404 } 8405 8406 static int 8407 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 8408 struct cfg80211_match_set *match_sets, 8409 struct nlattr *tb_band_rssi, 8410 s32 rssi_thold) 8411 { 8412 struct nlattr *attr; 8413 int i, tmp, ret = 0; 8414 8415 if (!wiphy_ext_feature_isset(wiphy, 8416 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 8417 if (tb_band_rssi) 8418 ret = -EOPNOTSUPP; 8419 else 8420 for (i = 0; i < NUM_NL80211_BANDS; i++) 8421 match_sets->per_band_rssi_thold[i] = 8422 NL80211_SCAN_RSSI_THOLD_OFF; 8423 return ret; 8424 } 8425 8426 for (i = 0; i < NUM_NL80211_BANDS; i++) 8427 match_sets->per_band_rssi_thold[i] = rssi_thold; 8428 8429 nla_for_each_nested(attr, tb_band_rssi, tmp) { 8430 enum nl80211_band band = nla_type(attr); 8431 8432 if (band < 0 || band >= NUM_NL80211_BANDS) 8433 return -EINVAL; 8434 8435 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 8436 } 8437 8438 return 0; 8439 } 8440 8441 static struct cfg80211_sched_scan_request * 8442 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 8443 struct nlattr **attrs, int max_match_sets) 8444 { 8445 struct cfg80211_sched_scan_request *request; 8446 struct nlattr *attr; 8447 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 8448 enum nl80211_band band; 8449 size_t ie_len; 8450 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 8451 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 8452 8453 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8454 n_channels = validate_scan_freqs( 8455 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 8456 if (!n_channels) 8457 return ERR_PTR(-EINVAL); 8458 } else { 8459 n_channels = ieee80211_get_num_supported_channels(wiphy); 8460 } 8461 8462 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 8463 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8464 tmp) 8465 n_ssids++; 8466 8467 if (n_ssids > wiphy->max_sched_scan_ssids) 8468 return ERR_PTR(-EINVAL); 8469 8470 /* 8471 * First, count the number of 'real' matchsets. Due to an issue with 8472 * the old implementation, matchsets containing only the RSSI attribute 8473 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 8474 * RSSI for all matchsets, rather than their own matchset for reporting 8475 * all APs with a strong RSSI. This is needed to be compatible with 8476 * older userspace that treated a matchset with only the RSSI as the 8477 * global RSSI for all other matchsets - if there are other matchsets. 8478 */ 8479 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8480 nla_for_each_nested(attr, 8481 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8482 tmp) { 8483 struct nlattr *rssi; 8484 8485 err = nla_parse_nested_deprecated(tb, 8486 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8487 attr, 8488 nl80211_match_policy, 8489 NULL); 8490 if (err) 8491 return ERR_PTR(err); 8492 8493 /* SSID and BSSID are mutually exclusive */ 8494 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 8495 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 8496 return ERR_PTR(-EINVAL); 8497 8498 /* add other standalone attributes here */ 8499 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 8500 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 8501 n_match_sets++; 8502 continue; 8503 } 8504 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8505 if (rssi) 8506 default_match_rssi = nla_get_s32(rssi); 8507 } 8508 } 8509 8510 /* However, if there's no other matchset, add the RSSI one */ 8511 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 8512 n_match_sets = 1; 8513 8514 if (n_match_sets > max_match_sets) 8515 return ERR_PTR(-EINVAL); 8516 8517 if (attrs[NL80211_ATTR_IE]) 8518 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 8519 else 8520 ie_len = 0; 8521 8522 if (ie_len > wiphy->max_sched_scan_ie_len) 8523 return ERR_PTR(-EINVAL); 8524 8525 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8526 /* 8527 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 8528 * each scan plan already specifies its own interval 8529 */ 8530 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8531 return ERR_PTR(-EINVAL); 8532 8533 nla_for_each_nested(attr, 8534 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 8535 n_plans++; 8536 } else { 8537 /* 8538 * The scan interval attribute is kept for backward 8539 * compatibility. If no scan plans are specified and sched scan 8540 * interval is specified, one scan plan will be set with this 8541 * scan interval and infinite number of iterations. 8542 */ 8543 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8544 return ERR_PTR(-EINVAL); 8545 8546 n_plans = 1; 8547 } 8548 8549 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 8550 return ERR_PTR(-EINVAL); 8551 8552 if (!wiphy_ext_feature_isset( 8553 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 8554 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 8555 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 8556 return ERR_PTR(-EINVAL); 8557 8558 request = kzalloc(sizeof(*request) 8559 + sizeof(*request->ssids) * n_ssids 8560 + sizeof(*request->match_sets) * n_match_sets 8561 + sizeof(*request->scan_plans) * n_plans 8562 + sizeof(*request->channels) * n_channels 8563 + ie_len, GFP_KERNEL); 8564 if (!request) 8565 return ERR_PTR(-ENOMEM); 8566 8567 if (n_ssids) 8568 request->ssids = (void *)&request->channels[n_channels]; 8569 request->n_ssids = n_ssids; 8570 if (ie_len) { 8571 if (n_ssids) 8572 request->ie = (void *)(request->ssids + n_ssids); 8573 else 8574 request->ie = (void *)(request->channels + n_channels); 8575 } 8576 8577 if (n_match_sets) { 8578 if (request->ie) 8579 request->match_sets = (void *)(request->ie + ie_len); 8580 else if (n_ssids) 8581 request->match_sets = 8582 (void *)(request->ssids + n_ssids); 8583 else 8584 request->match_sets = 8585 (void *)(request->channels + n_channels); 8586 } 8587 request->n_match_sets = n_match_sets; 8588 8589 if (n_match_sets) 8590 request->scan_plans = (void *)(request->match_sets + 8591 n_match_sets); 8592 else if (request->ie) 8593 request->scan_plans = (void *)(request->ie + ie_len); 8594 else if (n_ssids) 8595 request->scan_plans = (void *)(request->ssids + n_ssids); 8596 else 8597 request->scan_plans = (void *)(request->channels + n_channels); 8598 8599 request->n_scan_plans = n_plans; 8600 8601 i = 0; 8602 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8603 /* user specified, bail out if channel not found */ 8604 nla_for_each_nested(attr, 8605 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 8606 tmp) { 8607 struct ieee80211_channel *chan; 8608 8609 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 8610 8611 if (!chan) { 8612 err = -EINVAL; 8613 goto out_free; 8614 } 8615 8616 /* ignore disabled channels */ 8617 if (chan->flags & IEEE80211_CHAN_DISABLED) 8618 continue; 8619 8620 request->channels[i] = chan; 8621 i++; 8622 } 8623 } else { 8624 /* all channels */ 8625 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8626 int j; 8627 8628 if (!wiphy->bands[band]) 8629 continue; 8630 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8631 struct ieee80211_channel *chan; 8632 8633 chan = &wiphy->bands[band]->channels[j]; 8634 8635 if (chan->flags & IEEE80211_CHAN_DISABLED) 8636 continue; 8637 8638 request->channels[i] = chan; 8639 i++; 8640 } 8641 } 8642 } 8643 8644 if (!i) { 8645 err = -EINVAL; 8646 goto out_free; 8647 } 8648 8649 request->n_channels = i; 8650 8651 i = 0; 8652 if (n_ssids) { 8653 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8654 tmp) { 8655 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8656 err = -EINVAL; 8657 goto out_free; 8658 } 8659 request->ssids[i].ssid_len = nla_len(attr); 8660 memcpy(request->ssids[i].ssid, nla_data(attr), 8661 nla_len(attr)); 8662 i++; 8663 } 8664 } 8665 8666 i = 0; 8667 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8668 nla_for_each_nested(attr, 8669 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8670 tmp) { 8671 struct nlattr *ssid, *bssid, *rssi; 8672 8673 err = nla_parse_nested_deprecated(tb, 8674 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8675 attr, 8676 nl80211_match_policy, 8677 NULL); 8678 if (err) 8679 goto out_free; 8680 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 8681 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 8682 8683 if (!ssid && !bssid) { 8684 i++; 8685 continue; 8686 } 8687 8688 if (WARN_ON(i >= n_match_sets)) { 8689 /* this indicates a programming error, 8690 * the loop above should have verified 8691 * things properly 8692 */ 8693 err = -EINVAL; 8694 goto out_free; 8695 } 8696 8697 if (ssid) { 8698 memcpy(request->match_sets[i].ssid.ssid, 8699 nla_data(ssid), nla_len(ssid)); 8700 request->match_sets[i].ssid.ssid_len = 8701 nla_len(ssid); 8702 } 8703 if (bssid) 8704 memcpy(request->match_sets[i].bssid, 8705 nla_data(bssid), ETH_ALEN); 8706 8707 /* special attribute - old implementation w/a */ 8708 request->match_sets[i].rssi_thold = default_match_rssi; 8709 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8710 if (rssi) 8711 request->match_sets[i].rssi_thold = 8712 nla_get_s32(rssi); 8713 8714 /* Parse per band RSSI attribute */ 8715 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 8716 &request->match_sets[i], 8717 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 8718 request->match_sets[i].rssi_thold); 8719 if (err) 8720 goto out_free; 8721 8722 i++; 8723 } 8724 8725 /* there was no other matchset, so the RSSI one is alone */ 8726 if (i == 0 && n_match_sets) 8727 request->match_sets[0].rssi_thold = default_match_rssi; 8728 8729 request->min_rssi_thold = INT_MAX; 8730 for (i = 0; i < n_match_sets; i++) 8731 request->min_rssi_thold = 8732 min(request->match_sets[i].rssi_thold, 8733 request->min_rssi_thold); 8734 } else { 8735 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 8736 } 8737 8738 if (ie_len) { 8739 request->ie_len = ie_len; 8740 memcpy((void *)request->ie, 8741 nla_data(attrs[NL80211_ATTR_IE]), 8742 request->ie_len); 8743 } 8744 8745 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 8746 if (err) 8747 goto out_free; 8748 8749 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 8750 request->delay = 8751 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 8752 8753 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 8754 request->relative_rssi = nla_get_s8( 8755 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 8756 request->relative_rssi_set = true; 8757 } 8758 8759 if (request->relative_rssi_set && 8760 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 8761 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 8762 8763 rssi_adjust = nla_data( 8764 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 8765 request->rssi_adjust.band = rssi_adjust->band; 8766 request->rssi_adjust.delta = rssi_adjust->delta; 8767 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 8768 err = -EINVAL; 8769 goto out_free; 8770 } 8771 } 8772 8773 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 8774 if (err) 8775 goto out_free; 8776 8777 request->scan_start = jiffies; 8778 8779 return request; 8780 8781 out_free: 8782 kfree(request); 8783 return ERR_PTR(err); 8784 } 8785 8786 static int nl80211_start_sched_scan(struct sk_buff *skb, 8787 struct genl_info *info) 8788 { 8789 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8790 struct net_device *dev = info->user_ptr[1]; 8791 struct wireless_dev *wdev = dev->ieee80211_ptr; 8792 struct cfg80211_sched_scan_request *sched_scan_req; 8793 bool want_multi; 8794 int err; 8795 8796 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 8797 return -EOPNOTSUPP; 8798 8799 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 8800 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 8801 if (err) 8802 return err; 8803 8804 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 8805 info->attrs, 8806 rdev->wiphy.max_match_sets); 8807 8808 err = PTR_ERR_OR_ZERO(sched_scan_req); 8809 if (err) 8810 goto out_err; 8811 8812 /* leave request id zero for legacy request 8813 * or if driver does not support multi-scheduled scan 8814 */ 8815 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 8816 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 8817 8818 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 8819 if (err) 8820 goto out_free; 8821 8822 sched_scan_req->dev = dev; 8823 sched_scan_req->wiphy = &rdev->wiphy; 8824 8825 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 8826 sched_scan_req->owner_nlportid = info->snd_portid; 8827 8828 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 8829 8830 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 8831 return 0; 8832 8833 out_free: 8834 kfree(sched_scan_req); 8835 out_err: 8836 return err; 8837 } 8838 8839 static int nl80211_stop_sched_scan(struct sk_buff *skb, 8840 struct genl_info *info) 8841 { 8842 struct cfg80211_sched_scan_request *req; 8843 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8844 u64 cookie; 8845 8846 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 8847 return -EOPNOTSUPP; 8848 8849 if (info->attrs[NL80211_ATTR_COOKIE]) { 8850 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 8851 return __cfg80211_stop_sched_scan(rdev, cookie, false); 8852 } 8853 8854 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 8855 struct cfg80211_sched_scan_request, 8856 list); 8857 if (!req || req->reqid || 8858 (req->owner_nlportid && 8859 req->owner_nlportid != info->snd_portid)) 8860 return -ENOENT; 8861 8862 return cfg80211_stop_sched_scan_req(rdev, req, false); 8863 } 8864 8865 static int nl80211_start_radar_detection(struct sk_buff *skb, 8866 struct genl_info *info) 8867 { 8868 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8869 struct net_device *dev = info->user_ptr[1]; 8870 struct wireless_dev *wdev = dev->ieee80211_ptr; 8871 struct wiphy *wiphy = wdev->wiphy; 8872 struct cfg80211_chan_def chandef; 8873 enum nl80211_dfs_regions dfs_region; 8874 unsigned int cac_time_ms; 8875 int err; 8876 8877 dfs_region = reg_get_dfs_region(wiphy); 8878 if (dfs_region == NL80211_DFS_UNSET) 8879 return -EINVAL; 8880 8881 err = nl80211_parse_chandef(rdev, info, &chandef); 8882 if (err) 8883 return err; 8884 8885 if (netif_carrier_ok(dev)) 8886 return -EBUSY; 8887 8888 if (wdev->cac_started) 8889 return -EBUSY; 8890 8891 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8892 if (err < 0) 8893 return err; 8894 8895 if (err == 0) 8896 return -EINVAL; 8897 8898 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) 8899 return -EINVAL; 8900 8901 /* CAC start is offloaded to HW and can't be started manually */ 8902 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) 8903 return -EOPNOTSUPP; 8904 8905 if (!rdev->ops->start_radar_detection) 8906 return -EOPNOTSUPP; 8907 8908 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 8909 if (WARN_ON(!cac_time_ms)) 8910 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 8911 8912 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 8913 if (!err) { 8914 wdev->chandef = chandef; 8915 wdev->cac_started = true; 8916 wdev->cac_start_time = jiffies; 8917 wdev->cac_time_ms = cac_time_ms; 8918 } 8919 return err; 8920 } 8921 8922 static int nl80211_notify_radar_detection(struct sk_buff *skb, 8923 struct genl_info *info) 8924 { 8925 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8926 struct net_device *dev = info->user_ptr[1]; 8927 struct wireless_dev *wdev = dev->ieee80211_ptr; 8928 struct wiphy *wiphy = wdev->wiphy; 8929 struct cfg80211_chan_def chandef; 8930 enum nl80211_dfs_regions dfs_region; 8931 int err; 8932 8933 dfs_region = reg_get_dfs_region(wiphy); 8934 if (dfs_region == NL80211_DFS_UNSET) { 8935 GENL_SET_ERR_MSG(info, 8936 "DFS Region is not set. Unexpected Radar indication"); 8937 return -EINVAL; 8938 } 8939 8940 err = nl80211_parse_chandef(rdev, info, &chandef); 8941 if (err) { 8942 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 8943 return err; 8944 } 8945 8946 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8947 if (err < 0) { 8948 GENL_SET_ERR_MSG(info, "chandef is invalid"); 8949 return err; 8950 } 8951 8952 if (err == 0) { 8953 GENL_SET_ERR_MSG(info, 8954 "Unexpected Radar indication for chandef/iftype"); 8955 return -EINVAL; 8956 } 8957 8958 /* Do not process this notification if radar is already detected 8959 * by kernel on this channel, and return success. 8960 */ 8961 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 8962 return 0; 8963 8964 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 8965 8966 cfg80211_sched_dfs_chan_update(rdev); 8967 8968 rdev->radar_chandef = chandef; 8969 8970 /* Propagate this notification to other radios as well */ 8971 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 8972 8973 return 0; 8974 } 8975 8976 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 8977 { 8978 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8979 struct net_device *dev = info->user_ptr[1]; 8980 struct wireless_dev *wdev = dev->ieee80211_ptr; 8981 struct cfg80211_csa_settings params; 8982 /* csa_attrs is defined static to avoid waste of stack size - this 8983 * function is called under RTNL lock, so this should not be a problem. 8984 */ 8985 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 8986 int err; 8987 bool need_new_beacon = false; 8988 bool need_handle_dfs_flag = true; 8989 int len, i; 8990 u32 cs_count; 8991 8992 if (!rdev->ops->channel_switch || 8993 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 8994 return -EOPNOTSUPP; 8995 8996 switch (dev->ieee80211_ptr->iftype) { 8997 case NL80211_IFTYPE_AP: 8998 case NL80211_IFTYPE_P2P_GO: 8999 need_new_beacon = true; 9000 /* For all modes except AP the handle_dfs flag needs to be 9001 * supplied to tell the kernel that userspace will handle radar 9002 * events when they happen. Otherwise a switch to a channel 9003 * requiring DFS will be rejected. 9004 */ 9005 need_handle_dfs_flag = false; 9006 9007 /* useless if AP is not running */ 9008 if (!wdev->beacon_interval) 9009 return -ENOTCONN; 9010 break; 9011 case NL80211_IFTYPE_ADHOC: 9012 if (!wdev->ssid_len) 9013 return -ENOTCONN; 9014 break; 9015 case NL80211_IFTYPE_MESH_POINT: 9016 if (!wdev->mesh_id_len) 9017 return -ENOTCONN; 9018 break; 9019 default: 9020 return -EOPNOTSUPP; 9021 } 9022 9023 memset(¶ms, 0, sizeof(params)); 9024 params.beacon_csa.ftm_responder = -1; 9025 9026 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9027 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 9028 return -EINVAL; 9029 9030 /* only important for AP, IBSS and mesh create IEs internally */ 9031 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 9032 return -EINVAL; 9033 9034 /* Even though the attribute is u32, the specification says 9035 * u8, so let's make sure we don't overflow. 9036 */ 9037 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 9038 if (cs_count > 255) 9039 return -EINVAL; 9040 9041 params.count = cs_count; 9042 9043 if (!need_new_beacon) 9044 goto skip_beacons; 9045 9046 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after); 9047 if (err) 9048 return err; 9049 9050 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 9051 info->attrs[NL80211_ATTR_CSA_IES], 9052 nl80211_policy, info->extack); 9053 if (err) 9054 return err; 9055 9056 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa); 9057 if (err) 9058 return err; 9059 9060 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) 9061 return -EINVAL; 9062 9063 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9064 if (!len || (len % sizeof(u16))) 9065 return -EINVAL; 9066 9067 params.n_counter_offsets_beacon = len / sizeof(u16); 9068 if (rdev->wiphy.max_num_csa_counters && 9069 (params.n_counter_offsets_beacon > 9070 rdev->wiphy.max_num_csa_counters)) 9071 return -EINVAL; 9072 9073 params.counter_offsets_beacon = 9074 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9075 9076 /* sanity checks - counters should fit and be the same */ 9077 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 9078 u16 offset = params.counter_offsets_beacon[i]; 9079 9080 if (offset >= params.beacon_csa.tail_len) 9081 return -EINVAL; 9082 9083 if (params.beacon_csa.tail[offset] != params.count) 9084 return -EINVAL; 9085 } 9086 9087 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 9088 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9089 if (!len || (len % sizeof(u16))) 9090 return -EINVAL; 9091 9092 params.n_counter_offsets_presp = len / sizeof(u16); 9093 if (rdev->wiphy.max_num_csa_counters && 9094 (params.n_counter_offsets_presp > 9095 rdev->wiphy.max_num_csa_counters)) 9096 return -EINVAL; 9097 9098 params.counter_offsets_presp = 9099 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9100 9101 /* sanity checks - counters should fit and be the same */ 9102 for (i = 0; i < params.n_counter_offsets_presp; i++) { 9103 u16 offset = params.counter_offsets_presp[i]; 9104 9105 if (offset >= params.beacon_csa.probe_resp_len) 9106 return -EINVAL; 9107 9108 if (params.beacon_csa.probe_resp[offset] != 9109 params.count) 9110 return -EINVAL; 9111 } 9112 } 9113 9114 skip_beacons: 9115 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 9116 if (err) 9117 return err; 9118 9119 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 9120 wdev->iftype)) 9121 return -EINVAL; 9122 9123 err = cfg80211_chandef_dfs_required(wdev->wiphy, 9124 ¶ms.chandef, 9125 wdev->iftype); 9126 if (err < 0) 9127 return err; 9128 9129 if (err > 0) { 9130 params.radar_required = true; 9131 if (need_handle_dfs_flag && 9132 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 9133 return -EINVAL; 9134 } 9135 } 9136 9137 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 9138 params.block_tx = true; 9139 9140 wdev_lock(wdev); 9141 err = rdev_channel_switch(rdev, dev, ¶ms); 9142 wdev_unlock(wdev); 9143 9144 return err; 9145 } 9146 9147 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 9148 u32 seq, int flags, 9149 struct cfg80211_registered_device *rdev, 9150 struct wireless_dev *wdev, 9151 struct cfg80211_internal_bss *intbss) 9152 { 9153 struct cfg80211_bss *res = &intbss->pub; 9154 const struct cfg80211_bss_ies *ies; 9155 void *hdr; 9156 struct nlattr *bss; 9157 9158 ASSERT_WDEV_LOCK(wdev); 9159 9160 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 9161 NL80211_CMD_NEW_SCAN_RESULTS); 9162 if (!hdr) 9163 return -1; 9164 9165 genl_dump_check_consistent(cb, hdr); 9166 9167 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 9168 goto nla_put_failure; 9169 if (wdev->netdev && 9170 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 9171 goto nla_put_failure; 9172 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 9173 NL80211_ATTR_PAD)) 9174 goto nla_put_failure; 9175 9176 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 9177 if (!bss) 9178 goto nla_put_failure; 9179 if ((!is_zero_ether_addr(res->bssid) && 9180 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 9181 goto nla_put_failure; 9182 9183 rcu_read_lock(); 9184 /* indicate whether we have probe response data or not */ 9185 if (rcu_access_pointer(res->proberesp_ies) && 9186 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 9187 goto fail_unlock_rcu; 9188 9189 /* this pointer prefers to be pointed to probe response data 9190 * but is always valid 9191 */ 9192 ies = rcu_dereference(res->ies); 9193 if (ies) { 9194 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 9195 NL80211_BSS_PAD)) 9196 goto fail_unlock_rcu; 9197 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 9198 ies->len, ies->data)) 9199 goto fail_unlock_rcu; 9200 } 9201 9202 /* and this pointer is always (unless driver didn't know) beacon data */ 9203 ies = rcu_dereference(res->beacon_ies); 9204 if (ies && ies->from_beacon) { 9205 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 9206 NL80211_BSS_PAD)) 9207 goto fail_unlock_rcu; 9208 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 9209 ies->len, ies->data)) 9210 goto fail_unlock_rcu; 9211 } 9212 rcu_read_unlock(); 9213 9214 if (res->beacon_interval && 9215 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 9216 goto nla_put_failure; 9217 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 9218 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 9219 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 9220 res->channel->freq_offset) || 9221 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 9222 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 9223 jiffies_to_msecs(jiffies - intbss->ts))) 9224 goto nla_put_failure; 9225 9226 if (intbss->parent_tsf && 9227 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 9228 intbss->parent_tsf, NL80211_BSS_PAD) || 9229 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 9230 intbss->parent_bssid))) 9231 goto nla_put_failure; 9232 9233 if (intbss->ts_boottime && 9234 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 9235 intbss->ts_boottime, NL80211_BSS_PAD)) 9236 goto nla_put_failure; 9237 9238 if (!nl80211_put_signal(msg, intbss->pub.chains, 9239 intbss->pub.chain_signal, 9240 NL80211_BSS_CHAIN_SIGNAL)) 9241 goto nla_put_failure; 9242 9243 switch (rdev->wiphy.signal_type) { 9244 case CFG80211_SIGNAL_TYPE_MBM: 9245 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 9246 goto nla_put_failure; 9247 break; 9248 case CFG80211_SIGNAL_TYPE_UNSPEC: 9249 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 9250 goto nla_put_failure; 9251 break; 9252 default: 9253 break; 9254 } 9255 9256 switch (wdev->iftype) { 9257 case NL80211_IFTYPE_P2P_CLIENT: 9258 case NL80211_IFTYPE_STATION: 9259 if (intbss == wdev->current_bss && 9260 nla_put_u32(msg, NL80211_BSS_STATUS, 9261 NL80211_BSS_STATUS_ASSOCIATED)) 9262 goto nla_put_failure; 9263 break; 9264 case NL80211_IFTYPE_ADHOC: 9265 if (intbss == wdev->current_bss && 9266 nla_put_u32(msg, NL80211_BSS_STATUS, 9267 NL80211_BSS_STATUS_IBSS_JOINED)) 9268 goto nla_put_failure; 9269 break; 9270 default: 9271 break; 9272 } 9273 9274 nla_nest_end(msg, bss); 9275 9276 genlmsg_end(msg, hdr); 9277 return 0; 9278 9279 fail_unlock_rcu: 9280 rcu_read_unlock(); 9281 nla_put_failure: 9282 genlmsg_cancel(msg, hdr); 9283 return -EMSGSIZE; 9284 } 9285 9286 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 9287 { 9288 struct cfg80211_registered_device *rdev; 9289 struct cfg80211_internal_bss *scan; 9290 struct wireless_dev *wdev; 9291 int start = cb->args[2], idx = 0; 9292 int err; 9293 9294 rtnl_lock(); 9295 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9296 if (err) { 9297 rtnl_unlock(); 9298 return err; 9299 } 9300 9301 wdev_lock(wdev); 9302 spin_lock_bh(&rdev->bss_lock); 9303 9304 /* 9305 * dump_scan will be called multiple times to break up the scan results 9306 * into multiple messages. It is unlikely that any more bss-es will be 9307 * expired after the first call, so only call only call this on the 9308 * first dump_scan invocation. 9309 */ 9310 if (start == 0) 9311 cfg80211_bss_expire(rdev); 9312 9313 cb->seq = rdev->bss_generation; 9314 9315 list_for_each_entry(scan, &rdev->bss_list, list) { 9316 if (++idx <= start) 9317 continue; 9318 if (nl80211_send_bss(skb, cb, 9319 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9320 rdev, wdev, scan) < 0) { 9321 idx--; 9322 break; 9323 } 9324 } 9325 9326 spin_unlock_bh(&rdev->bss_lock); 9327 wdev_unlock(wdev); 9328 9329 cb->args[2] = idx; 9330 rtnl_unlock(); 9331 9332 return skb->len; 9333 } 9334 9335 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 9336 int flags, struct net_device *dev, 9337 bool allow_radio_stats, 9338 struct survey_info *survey) 9339 { 9340 void *hdr; 9341 struct nlattr *infoattr; 9342 9343 /* skip radio stats if userspace didn't request them */ 9344 if (!survey->channel && !allow_radio_stats) 9345 return 0; 9346 9347 hdr = nl80211hdr_put(msg, portid, seq, flags, 9348 NL80211_CMD_NEW_SURVEY_RESULTS); 9349 if (!hdr) 9350 return -ENOMEM; 9351 9352 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 9353 goto nla_put_failure; 9354 9355 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 9356 if (!infoattr) 9357 goto nla_put_failure; 9358 9359 if (survey->channel && 9360 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 9361 survey->channel->center_freq)) 9362 goto nla_put_failure; 9363 9364 if (survey->channel && survey->channel->freq_offset && 9365 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 9366 survey->channel->freq_offset)) 9367 goto nla_put_failure; 9368 9369 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 9370 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 9371 goto nla_put_failure; 9372 if ((survey->filled & SURVEY_INFO_IN_USE) && 9373 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 9374 goto nla_put_failure; 9375 if ((survey->filled & SURVEY_INFO_TIME) && 9376 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 9377 survey->time, NL80211_SURVEY_INFO_PAD)) 9378 goto nla_put_failure; 9379 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 9380 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 9381 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 9382 goto nla_put_failure; 9383 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 9384 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 9385 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 9386 goto nla_put_failure; 9387 if ((survey->filled & SURVEY_INFO_TIME_RX) && 9388 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 9389 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 9390 goto nla_put_failure; 9391 if ((survey->filled & SURVEY_INFO_TIME_TX) && 9392 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 9393 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 9394 goto nla_put_failure; 9395 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 9396 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 9397 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 9398 goto nla_put_failure; 9399 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 9400 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 9401 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 9402 goto nla_put_failure; 9403 9404 nla_nest_end(msg, infoattr); 9405 9406 genlmsg_end(msg, hdr); 9407 return 0; 9408 9409 nla_put_failure: 9410 genlmsg_cancel(msg, hdr); 9411 return -EMSGSIZE; 9412 } 9413 9414 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 9415 { 9416 struct nlattr **attrbuf; 9417 struct survey_info survey; 9418 struct cfg80211_registered_device *rdev; 9419 struct wireless_dev *wdev; 9420 int survey_idx = cb->args[2]; 9421 int res; 9422 bool radio_stats; 9423 9424 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 9425 if (!attrbuf) 9426 return -ENOMEM; 9427 9428 rtnl_lock(); 9429 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9430 if (res) 9431 goto out_err; 9432 9433 /* prepare_wdev_dump parsed the attributes */ 9434 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 9435 9436 if (!wdev->netdev) { 9437 res = -EINVAL; 9438 goto out_err; 9439 } 9440 9441 if (!rdev->ops->dump_survey) { 9442 res = -EOPNOTSUPP; 9443 goto out_err; 9444 } 9445 9446 while (1) { 9447 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 9448 if (res == -ENOENT) 9449 break; 9450 if (res) 9451 goto out_err; 9452 9453 /* don't send disabled channels, but do send non-channel data */ 9454 if (survey.channel && 9455 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 9456 survey_idx++; 9457 continue; 9458 } 9459 9460 if (nl80211_send_survey(skb, 9461 NETLINK_CB(cb->skb).portid, 9462 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9463 wdev->netdev, radio_stats, &survey) < 0) 9464 goto out; 9465 survey_idx++; 9466 } 9467 9468 out: 9469 cb->args[2] = survey_idx; 9470 res = skb->len; 9471 out_err: 9472 kfree(attrbuf); 9473 rtnl_unlock(); 9474 return res; 9475 } 9476 9477 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 9478 { 9479 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 9480 NL80211_WPA_VERSION_2 | 9481 NL80211_WPA_VERSION_3)); 9482 } 9483 9484 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 9485 { 9486 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9487 struct net_device *dev = info->user_ptr[1]; 9488 struct ieee80211_channel *chan; 9489 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 9490 int err, ssid_len, ie_len = 0, auth_data_len = 0; 9491 enum nl80211_auth_type auth_type; 9492 struct key_parse key; 9493 bool local_state_change; 9494 u32 freq; 9495 9496 if (!info->attrs[NL80211_ATTR_MAC]) 9497 return -EINVAL; 9498 9499 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 9500 return -EINVAL; 9501 9502 if (!info->attrs[NL80211_ATTR_SSID]) 9503 return -EINVAL; 9504 9505 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9506 return -EINVAL; 9507 9508 err = nl80211_parse_key(info, &key); 9509 if (err) 9510 return err; 9511 9512 if (key.idx >= 0) { 9513 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 9514 return -EINVAL; 9515 if (!key.p.key || !key.p.key_len) 9516 return -EINVAL; 9517 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 9518 key.p.key_len != WLAN_KEY_LEN_WEP40) && 9519 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 9520 key.p.key_len != WLAN_KEY_LEN_WEP104)) 9521 return -EINVAL; 9522 if (key.idx > 3) 9523 return -EINVAL; 9524 } else { 9525 key.p.key_len = 0; 9526 key.p.key = NULL; 9527 } 9528 9529 if (key.idx >= 0) { 9530 int i; 9531 bool ok = false; 9532 9533 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 9534 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 9535 ok = true; 9536 break; 9537 } 9538 } 9539 if (!ok) 9540 return -EINVAL; 9541 } 9542 9543 if (!rdev->ops->auth) 9544 return -EOPNOTSUPP; 9545 9546 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9547 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9548 return -EOPNOTSUPP; 9549 9550 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9551 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9552 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9553 freq += 9554 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9555 9556 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9557 if (!chan) 9558 return -EINVAL; 9559 9560 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9561 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9562 9563 if (info->attrs[NL80211_ATTR_IE]) { 9564 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9565 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9566 } 9567 9568 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9569 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 9570 return -EINVAL; 9571 9572 if ((auth_type == NL80211_AUTHTYPE_SAE || 9573 auth_type == NL80211_AUTHTYPE_FILS_SK || 9574 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 9575 auth_type == NL80211_AUTHTYPE_FILS_PK) && 9576 !info->attrs[NL80211_ATTR_AUTH_DATA]) 9577 return -EINVAL; 9578 9579 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 9580 if (auth_type != NL80211_AUTHTYPE_SAE && 9581 auth_type != NL80211_AUTHTYPE_FILS_SK && 9582 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 9583 auth_type != NL80211_AUTHTYPE_FILS_PK) 9584 return -EINVAL; 9585 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 9586 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 9587 } 9588 9589 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9590 9591 /* 9592 * Since we no longer track auth state, ignore 9593 * requests to only change local state. 9594 */ 9595 if (local_state_change) 9596 return 0; 9597 9598 wdev_lock(dev->ieee80211_ptr); 9599 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 9600 ssid, ssid_len, ie, ie_len, 9601 key.p.key, key.p.key_len, key.idx, 9602 auth_data, auth_data_len); 9603 wdev_unlock(dev->ieee80211_ptr); 9604 return err; 9605 } 9606 9607 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 9608 struct genl_info *info) 9609 { 9610 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9611 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 9612 return -EINVAL; 9613 } 9614 9615 if (!rdev->ops->tx_control_port || 9616 !wiphy_ext_feature_isset(&rdev->wiphy, 9617 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 9618 return -EOPNOTSUPP; 9619 9620 return 0; 9621 } 9622 9623 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 9624 struct genl_info *info, 9625 struct cfg80211_crypto_settings *settings, 9626 int cipher_limit) 9627 { 9628 memset(settings, 0, sizeof(*settings)); 9629 9630 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 9631 9632 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 9633 u16 proto; 9634 9635 proto = nla_get_u16( 9636 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 9637 settings->control_port_ethertype = cpu_to_be16(proto); 9638 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 9639 proto != ETH_P_PAE) 9640 return -EINVAL; 9641 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 9642 settings->control_port_no_encrypt = true; 9643 } else 9644 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 9645 9646 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 9647 int r = validate_pae_over_nl80211(rdev, info); 9648 9649 if (r < 0) 9650 return r; 9651 9652 settings->control_port_over_nl80211 = true; 9653 9654 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 9655 settings->control_port_no_preauth = true; 9656 } 9657 9658 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 9659 void *data; 9660 int len, i; 9661 9662 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9663 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9664 settings->n_ciphers_pairwise = len / sizeof(u32); 9665 9666 if (len % sizeof(u32)) 9667 return -EINVAL; 9668 9669 if (settings->n_ciphers_pairwise > cipher_limit) 9670 return -EINVAL; 9671 9672 memcpy(settings->ciphers_pairwise, data, len); 9673 9674 for (i = 0; i < settings->n_ciphers_pairwise; i++) 9675 if (!cfg80211_supported_cipher_suite( 9676 &rdev->wiphy, 9677 settings->ciphers_pairwise[i])) 9678 return -EINVAL; 9679 } 9680 9681 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 9682 settings->cipher_group = 9683 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 9684 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 9685 settings->cipher_group)) 9686 return -EINVAL; 9687 } 9688 9689 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 9690 settings->wpa_versions = 9691 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 9692 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 9693 return -EINVAL; 9694 } 9695 9696 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 9697 void *data; 9698 int len; 9699 9700 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 9701 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 9702 settings->n_akm_suites = len / sizeof(u32); 9703 9704 if (len % sizeof(u32)) 9705 return -EINVAL; 9706 9707 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 9708 return -EINVAL; 9709 9710 memcpy(settings->akm_suites, data, len); 9711 } 9712 9713 if (info->attrs[NL80211_ATTR_PMK]) { 9714 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 9715 return -EINVAL; 9716 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9717 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 9718 !wiphy_ext_feature_isset(&rdev->wiphy, 9719 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 9720 return -EINVAL; 9721 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9722 } 9723 9724 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 9725 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9726 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 9727 !wiphy_ext_feature_isset(&rdev->wiphy, 9728 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 9729 return -EINVAL; 9730 settings->sae_pwd = 9731 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9732 settings->sae_pwd_len = 9733 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9734 } 9735 9736 if (info->attrs[NL80211_ATTR_SAE_PWE]) 9737 settings->sae_pwe = 9738 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]); 9739 else 9740 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED; 9741 9742 return 0; 9743 } 9744 9745 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 9746 { 9747 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9748 struct net_device *dev = info->user_ptr[1]; 9749 struct ieee80211_channel *chan; 9750 struct cfg80211_assoc_request req = {}; 9751 const u8 *bssid, *ssid; 9752 int err, ssid_len = 0; 9753 u32 freq; 9754 9755 if (dev->ieee80211_ptr->conn_owner_nlportid && 9756 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9757 return -EPERM; 9758 9759 if (!info->attrs[NL80211_ATTR_MAC] || 9760 !info->attrs[NL80211_ATTR_SSID] || 9761 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9762 return -EINVAL; 9763 9764 if (!rdev->ops->assoc) 9765 return -EOPNOTSUPP; 9766 9767 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9768 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9769 return -EOPNOTSUPP; 9770 9771 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9772 9773 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9774 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9775 freq += 9776 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9777 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9778 if (!chan) 9779 return -EINVAL; 9780 9781 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9782 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9783 9784 if (info->attrs[NL80211_ATTR_IE]) { 9785 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9786 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9787 } 9788 9789 if (info->attrs[NL80211_ATTR_USE_MFP]) { 9790 enum nl80211_mfp mfp = 9791 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 9792 if (mfp == NL80211_MFP_REQUIRED) 9793 req.use_mfp = true; 9794 else if (mfp != NL80211_MFP_NO) 9795 return -EINVAL; 9796 } 9797 9798 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9799 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9800 9801 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9802 req.flags |= ASSOC_REQ_DISABLE_HT; 9803 9804 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9805 memcpy(&req.ht_capa_mask, 9806 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9807 sizeof(req.ht_capa_mask)); 9808 9809 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9810 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9811 return -EINVAL; 9812 memcpy(&req.ht_capa, 9813 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9814 sizeof(req.ht_capa)); 9815 } 9816 9817 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9818 req.flags |= ASSOC_REQ_DISABLE_VHT; 9819 9820 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9821 memcpy(&req.vht_capa_mask, 9822 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9823 sizeof(req.vht_capa_mask)); 9824 9825 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9826 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9827 return -EINVAL; 9828 memcpy(&req.vht_capa, 9829 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9830 sizeof(req.vht_capa)); 9831 } 9832 9833 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9834 if (!((rdev->wiphy.features & 9835 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9836 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9837 !wiphy_ext_feature_isset(&rdev->wiphy, 9838 NL80211_EXT_FEATURE_RRM)) 9839 return -EINVAL; 9840 req.flags |= ASSOC_REQ_USE_RRM; 9841 } 9842 9843 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 9844 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 9845 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 9846 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 9847 return -EINVAL; 9848 req.fils_nonces = 9849 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 9850 } 9851 9852 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 9853 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 9854 return -EINVAL; 9855 memcpy(&req.s1g_capa_mask, 9856 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 9857 sizeof(req.s1g_capa_mask)); 9858 } 9859 9860 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 9861 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 9862 return -EINVAL; 9863 memcpy(&req.s1g_capa, 9864 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 9865 sizeof(req.s1g_capa)); 9866 } 9867 9868 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 9869 if (!err) { 9870 wdev_lock(dev->ieee80211_ptr); 9871 9872 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 9873 ssid, ssid_len, &req); 9874 9875 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9876 dev->ieee80211_ptr->conn_owner_nlportid = 9877 info->snd_portid; 9878 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9879 bssid, ETH_ALEN); 9880 } 9881 9882 wdev_unlock(dev->ieee80211_ptr); 9883 } 9884 9885 return err; 9886 } 9887 9888 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 9889 { 9890 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9891 struct net_device *dev = info->user_ptr[1]; 9892 const u8 *ie = NULL, *bssid; 9893 int ie_len = 0, err; 9894 u16 reason_code; 9895 bool local_state_change; 9896 9897 if (dev->ieee80211_ptr->conn_owner_nlportid && 9898 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9899 return -EPERM; 9900 9901 if (!info->attrs[NL80211_ATTR_MAC]) 9902 return -EINVAL; 9903 9904 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9905 return -EINVAL; 9906 9907 if (!rdev->ops->deauth) 9908 return -EOPNOTSUPP; 9909 9910 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9911 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9912 return -EOPNOTSUPP; 9913 9914 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9915 9916 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9917 if (reason_code == 0) { 9918 /* Reason Code 0 is reserved */ 9919 return -EINVAL; 9920 } 9921 9922 if (info->attrs[NL80211_ATTR_IE]) { 9923 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9924 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9925 } 9926 9927 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9928 9929 wdev_lock(dev->ieee80211_ptr); 9930 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 9931 local_state_change); 9932 wdev_unlock(dev->ieee80211_ptr); 9933 return err; 9934 } 9935 9936 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 9937 { 9938 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9939 struct net_device *dev = info->user_ptr[1]; 9940 const u8 *ie = NULL, *bssid; 9941 int ie_len = 0, err; 9942 u16 reason_code; 9943 bool local_state_change; 9944 9945 if (dev->ieee80211_ptr->conn_owner_nlportid && 9946 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9947 return -EPERM; 9948 9949 if (!info->attrs[NL80211_ATTR_MAC]) 9950 return -EINVAL; 9951 9952 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9953 return -EINVAL; 9954 9955 if (!rdev->ops->disassoc) 9956 return -EOPNOTSUPP; 9957 9958 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9959 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9960 return -EOPNOTSUPP; 9961 9962 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9963 9964 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9965 if (reason_code == 0) { 9966 /* Reason Code 0 is reserved */ 9967 return -EINVAL; 9968 } 9969 9970 if (info->attrs[NL80211_ATTR_IE]) { 9971 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9972 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9973 } 9974 9975 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9976 9977 wdev_lock(dev->ieee80211_ptr); 9978 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 9979 local_state_change); 9980 wdev_unlock(dev->ieee80211_ptr); 9981 return err; 9982 } 9983 9984 static bool 9985 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 9986 int mcast_rate[NUM_NL80211_BANDS], 9987 int rateval) 9988 { 9989 struct wiphy *wiphy = &rdev->wiphy; 9990 bool found = false; 9991 int band, i; 9992 9993 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9994 struct ieee80211_supported_band *sband; 9995 9996 sband = wiphy->bands[band]; 9997 if (!sband) 9998 continue; 9999 10000 for (i = 0; i < sband->n_bitrates; i++) { 10001 if (sband->bitrates[i].bitrate == rateval) { 10002 mcast_rate[band] = i + 1; 10003 found = true; 10004 break; 10005 } 10006 } 10007 } 10008 10009 return found; 10010 } 10011 10012 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 10013 { 10014 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10015 struct net_device *dev = info->user_ptr[1]; 10016 struct cfg80211_ibss_params ibss; 10017 struct wiphy *wiphy; 10018 struct cfg80211_cached_keys *connkeys = NULL; 10019 int err; 10020 10021 memset(&ibss, 0, sizeof(ibss)); 10022 10023 if (!info->attrs[NL80211_ATTR_SSID] || 10024 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10025 return -EINVAL; 10026 10027 ibss.beacon_interval = 100; 10028 10029 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 10030 ibss.beacon_interval = 10031 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10032 10033 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 10034 ibss.beacon_interval); 10035 if (err) 10036 return err; 10037 10038 if (!rdev->ops->join_ibss) 10039 return -EOPNOTSUPP; 10040 10041 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10042 return -EOPNOTSUPP; 10043 10044 wiphy = &rdev->wiphy; 10045 10046 if (info->attrs[NL80211_ATTR_MAC]) { 10047 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10048 10049 if (!is_valid_ether_addr(ibss.bssid)) 10050 return -EINVAL; 10051 } 10052 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10053 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10054 10055 if (info->attrs[NL80211_ATTR_IE]) { 10056 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10057 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10058 } 10059 10060 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 10061 if (err) 10062 return err; 10063 10064 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 10065 NL80211_IFTYPE_ADHOC)) 10066 return -EINVAL; 10067 10068 switch (ibss.chandef.width) { 10069 case NL80211_CHAN_WIDTH_5: 10070 case NL80211_CHAN_WIDTH_10: 10071 case NL80211_CHAN_WIDTH_20_NOHT: 10072 break; 10073 case NL80211_CHAN_WIDTH_20: 10074 case NL80211_CHAN_WIDTH_40: 10075 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10076 return -EINVAL; 10077 break; 10078 case NL80211_CHAN_WIDTH_80: 10079 case NL80211_CHAN_WIDTH_80P80: 10080 case NL80211_CHAN_WIDTH_160: 10081 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10082 return -EINVAL; 10083 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10084 NL80211_EXT_FEATURE_VHT_IBSS)) 10085 return -EINVAL; 10086 break; 10087 default: 10088 return -EINVAL; 10089 } 10090 10091 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 10092 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 10093 10094 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10095 u8 *rates = 10096 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10097 int n_rates = 10098 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10099 struct ieee80211_supported_band *sband = 10100 wiphy->bands[ibss.chandef.chan->band]; 10101 10102 err = ieee80211_get_ratemask(sband, rates, n_rates, 10103 &ibss.basic_rates); 10104 if (err) 10105 return err; 10106 } 10107 10108 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10109 memcpy(&ibss.ht_capa_mask, 10110 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10111 sizeof(ibss.ht_capa_mask)); 10112 10113 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10114 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10115 return -EINVAL; 10116 memcpy(&ibss.ht_capa, 10117 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10118 sizeof(ibss.ht_capa)); 10119 } 10120 10121 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 10122 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 10123 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 10124 return -EINVAL; 10125 10126 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10127 bool no_ht = false; 10128 10129 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 10130 if (IS_ERR(connkeys)) 10131 return PTR_ERR(connkeys); 10132 10133 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 10134 no_ht) { 10135 kfree_sensitive(connkeys); 10136 return -EINVAL; 10137 } 10138 } 10139 10140 ibss.control_port = 10141 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 10142 10143 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10144 int r = validate_pae_over_nl80211(rdev, info); 10145 10146 if (r < 0) { 10147 kfree_sensitive(connkeys); 10148 return r; 10149 } 10150 10151 ibss.control_port_over_nl80211 = true; 10152 } 10153 10154 ibss.userspace_handles_dfs = 10155 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10156 10157 wdev_lock(dev->ieee80211_ptr); 10158 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 10159 if (err) 10160 kfree_sensitive(connkeys); 10161 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 10162 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10163 wdev_unlock(dev->ieee80211_ptr); 10164 10165 return err; 10166 } 10167 10168 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 10169 { 10170 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10171 struct net_device *dev = info->user_ptr[1]; 10172 10173 if (!rdev->ops->leave_ibss) 10174 return -EOPNOTSUPP; 10175 10176 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10177 return -EOPNOTSUPP; 10178 10179 return cfg80211_leave_ibss(rdev, dev, false); 10180 } 10181 10182 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 10183 { 10184 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10185 struct net_device *dev = info->user_ptr[1]; 10186 int mcast_rate[NUM_NL80211_BANDS]; 10187 u32 nla_rate; 10188 int err; 10189 10190 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 10191 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 10192 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 10193 return -EOPNOTSUPP; 10194 10195 if (!rdev->ops->set_mcast_rate) 10196 return -EOPNOTSUPP; 10197 10198 memset(mcast_rate, 0, sizeof(mcast_rate)); 10199 10200 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 10201 return -EINVAL; 10202 10203 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 10204 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 10205 return -EINVAL; 10206 10207 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 10208 10209 return err; 10210 } 10211 10212 static struct sk_buff * 10213 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 10214 struct wireless_dev *wdev, int approxlen, 10215 u32 portid, u32 seq, enum nl80211_commands cmd, 10216 enum nl80211_attrs attr, 10217 const struct nl80211_vendor_cmd_info *info, 10218 gfp_t gfp) 10219 { 10220 struct sk_buff *skb; 10221 void *hdr; 10222 struct nlattr *data; 10223 10224 skb = nlmsg_new(approxlen + 100, gfp); 10225 if (!skb) 10226 return NULL; 10227 10228 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 10229 if (!hdr) { 10230 kfree_skb(skb); 10231 return NULL; 10232 } 10233 10234 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 10235 goto nla_put_failure; 10236 10237 if (info) { 10238 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 10239 info->vendor_id)) 10240 goto nla_put_failure; 10241 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 10242 info->subcmd)) 10243 goto nla_put_failure; 10244 } 10245 10246 if (wdev) { 10247 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 10248 wdev_id(wdev), NL80211_ATTR_PAD)) 10249 goto nla_put_failure; 10250 if (wdev->netdev && 10251 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 10252 wdev->netdev->ifindex)) 10253 goto nla_put_failure; 10254 } 10255 10256 data = nla_nest_start_noflag(skb, attr); 10257 if (!data) 10258 goto nla_put_failure; 10259 10260 ((void **)skb->cb)[0] = rdev; 10261 ((void **)skb->cb)[1] = hdr; 10262 ((void **)skb->cb)[2] = data; 10263 10264 return skb; 10265 10266 nla_put_failure: 10267 kfree_skb(skb); 10268 return NULL; 10269 } 10270 10271 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 10272 struct wireless_dev *wdev, 10273 enum nl80211_commands cmd, 10274 enum nl80211_attrs attr, 10275 unsigned int portid, 10276 int vendor_event_idx, 10277 int approxlen, gfp_t gfp) 10278 { 10279 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 10280 const struct nl80211_vendor_cmd_info *info; 10281 10282 switch (cmd) { 10283 case NL80211_CMD_TESTMODE: 10284 if (WARN_ON(vendor_event_idx != -1)) 10285 return NULL; 10286 info = NULL; 10287 break; 10288 case NL80211_CMD_VENDOR: 10289 if (WARN_ON(vendor_event_idx < 0 || 10290 vendor_event_idx >= wiphy->n_vendor_events)) 10291 return NULL; 10292 info = &wiphy->vendor_events[vendor_event_idx]; 10293 break; 10294 default: 10295 WARN_ON(1); 10296 return NULL; 10297 } 10298 10299 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 10300 cmd, attr, info, gfp); 10301 } 10302 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 10303 10304 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 10305 { 10306 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 10307 void *hdr = ((void **)skb->cb)[1]; 10308 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 10309 struct nlattr *data = ((void **)skb->cb)[2]; 10310 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 10311 10312 /* clear CB data for netlink core to own from now on */ 10313 memset(skb->cb, 0, sizeof(skb->cb)); 10314 10315 nla_nest_end(skb, data); 10316 genlmsg_end(skb, hdr); 10317 10318 if (nlhdr->nlmsg_pid) { 10319 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 10320 nlhdr->nlmsg_pid); 10321 } else { 10322 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 10323 mcgrp = NL80211_MCGRP_VENDOR; 10324 10325 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 10326 skb, 0, mcgrp, gfp); 10327 } 10328 } 10329 EXPORT_SYMBOL(__cfg80211_send_event_skb); 10330 10331 #ifdef CONFIG_NL80211_TESTMODE 10332 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 10333 { 10334 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10335 struct wireless_dev *wdev = 10336 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 10337 int err; 10338 10339 if (!rdev->ops->testmode_cmd) 10340 return -EOPNOTSUPP; 10341 10342 if (IS_ERR(wdev)) { 10343 err = PTR_ERR(wdev); 10344 if (err != -EINVAL) 10345 return err; 10346 wdev = NULL; 10347 } else if (wdev->wiphy != &rdev->wiphy) { 10348 return -EINVAL; 10349 } 10350 10351 if (!info->attrs[NL80211_ATTR_TESTDATA]) 10352 return -EINVAL; 10353 10354 rdev->cur_cmd_info = info; 10355 err = rdev_testmode_cmd(rdev, wdev, 10356 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 10357 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 10358 rdev->cur_cmd_info = NULL; 10359 10360 return err; 10361 } 10362 10363 static int nl80211_testmode_dump(struct sk_buff *skb, 10364 struct netlink_callback *cb) 10365 { 10366 struct cfg80211_registered_device *rdev; 10367 struct nlattr **attrbuf = NULL; 10368 int err; 10369 long phy_idx; 10370 void *data = NULL; 10371 int data_len = 0; 10372 10373 rtnl_lock(); 10374 10375 if (cb->args[0]) { 10376 /* 10377 * 0 is a valid index, but not valid for args[0], 10378 * so we need to offset by 1. 10379 */ 10380 phy_idx = cb->args[0] - 1; 10381 10382 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 10383 if (!rdev) { 10384 err = -ENOENT; 10385 goto out_err; 10386 } 10387 } else { 10388 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 10389 GFP_KERNEL); 10390 if (!attrbuf) { 10391 err = -ENOMEM; 10392 goto out_err; 10393 } 10394 10395 err = nlmsg_parse_deprecated(cb->nlh, 10396 GENL_HDRLEN + nl80211_fam.hdrsize, 10397 attrbuf, nl80211_fam.maxattr, 10398 nl80211_policy, NULL); 10399 if (err) 10400 goto out_err; 10401 10402 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 10403 if (IS_ERR(rdev)) { 10404 err = PTR_ERR(rdev); 10405 goto out_err; 10406 } 10407 phy_idx = rdev->wiphy_idx; 10408 10409 if (attrbuf[NL80211_ATTR_TESTDATA]) 10410 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 10411 } 10412 10413 if (cb->args[1]) { 10414 data = nla_data((void *)cb->args[1]); 10415 data_len = nla_len((void *)cb->args[1]); 10416 } 10417 10418 if (!rdev->ops->testmode_dump) { 10419 err = -EOPNOTSUPP; 10420 goto out_err; 10421 } 10422 10423 while (1) { 10424 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 10425 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10426 NL80211_CMD_TESTMODE); 10427 struct nlattr *tmdata; 10428 10429 if (!hdr) 10430 break; 10431 10432 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 10433 genlmsg_cancel(skb, hdr); 10434 break; 10435 } 10436 10437 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 10438 if (!tmdata) { 10439 genlmsg_cancel(skb, hdr); 10440 break; 10441 } 10442 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 10443 nla_nest_end(skb, tmdata); 10444 10445 if (err == -ENOBUFS || err == -ENOENT) { 10446 genlmsg_cancel(skb, hdr); 10447 break; 10448 } else if (err) { 10449 genlmsg_cancel(skb, hdr); 10450 goto out_err; 10451 } 10452 10453 genlmsg_end(skb, hdr); 10454 } 10455 10456 err = skb->len; 10457 /* see above */ 10458 cb->args[0] = phy_idx + 1; 10459 out_err: 10460 kfree(attrbuf); 10461 rtnl_unlock(); 10462 return err; 10463 } 10464 #endif 10465 10466 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 10467 { 10468 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10469 struct net_device *dev = info->user_ptr[1]; 10470 struct cfg80211_connect_params connect; 10471 struct wiphy *wiphy; 10472 struct cfg80211_cached_keys *connkeys = NULL; 10473 u32 freq = 0; 10474 int err; 10475 10476 memset(&connect, 0, sizeof(connect)); 10477 10478 if (!info->attrs[NL80211_ATTR_SSID] || 10479 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10480 return -EINVAL; 10481 10482 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10483 connect.auth_type = 10484 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10485 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 10486 NL80211_CMD_CONNECT)) 10487 return -EINVAL; 10488 } else 10489 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 10490 10491 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 10492 10493 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 10494 !wiphy_ext_feature_isset(&rdev->wiphy, 10495 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 10496 return -EINVAL; 10497 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 10498 10499 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 10500 NL80211_MAX_NR_CIPHER_SUITES); 10501 if (err) 10502 return err; 10503 10504 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10505 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10506 return -EOPNOTSUPP; 10507 10508 wiphy = &rdev->wiphy; 10509 10510 connect.bg_scan_period = -1; 10511 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 10512 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 10513 connect.bg_scan_period = 10514 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 10515 } 10516 10517 if (info->attrs[NL80211_ATTR_MAC]) 10518 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10519 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 10520 connect.bssid_hint = 10521 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 10522 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10523 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10524 10525 if (info->attrs[NL80211_ATTR_IE]) { 10526 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10527 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10528 } 10529 10530 if (info->attrs[NL80211_ATTR_USE_MFP]) { 10531 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 10532 if (connect.mfp == NL80211_MFP_OPTIONAL && 10533 !wiphy_ext_feature_isset(&rdev->wiphy, 10534 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 10535 return -EOPNOTSUPP; 10536 } else { 10537 connect.mfp = NL80211_MFP_NO; 10538 } 10539 10540 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 10541 connect.prev_bssid = 10542 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 10543 10544 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10545 freq = MHZ_TO_KHZ(nla_get_u32( 10546 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10547 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10548 freq += 10549 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10550 10551 if (freq) { 10552 connect.channel = nl80211_get_valid_chan(wiphy, freq); 10553 if (!connect.channel) 10554 return -EINVAL; 10555 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 10556 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 10557 freq = MHZ_TO_KHZ(freq); 10558 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 10559 if (!connect.channel_hint) 10560 return -EINVAL; 10561 } 10562 10563 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 10564 connect.edmg.channels = 10565 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 10566 10567 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 10568 connect.edmg.bw_config = 10569 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 10570 } 10571 10572 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10573 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 10574 if (IS_ERR(connkeys)) 10575 return PTR_ERR(connkeys); 10576 } 10577 10578 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 10579 connect.flags |= ASSOC_REQ_DISABLE_HT; 10580 10581 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10582 memcpy(&connect.ht_capa_mask, 10583 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10584 sizeof(connect.ht_capa_mask)); 10585 10586 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10587 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 10588 kfree_sensitive(connkeys); 10589 return -EINVAL; 10590 } 10591 memcpy(&connect.ht_capa, 10592 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10593 sizeof(connect.ht_capa)); 10594 } 10595 10596 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 10597 connect.flags |= ASSOC_REQ_DISABLE_VHT; 10598 10599 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 10600 memcpy(&connect.vht_capa_mask, 10601 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 10602 sizeof(connect.vht_capa_mask)); 10603 10604 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 10605 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 10606 kfree_sensitive(connkeys); 10607 return -EINVAL; 10608 } 10609 memcpy(&connect.vht_capa, 10610 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 10611 sizeof(connect.vht_capa)); 10612 } 10613 10614 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 10615 if (!((rdev->wiphy.features & 10616 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 10617 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 10618 !wiphy_ext_feature_isset(&rdev->wiphy, 10619 NL80211_EXT_FEATURE_RRM)) { 10620 kfree_sensitive(connkeys); 10621 return -EINVAL; 10622 } 10623 connect.flags |= ASSOC_REQ_USE_RRM; 10624 } 10625 10626 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 10627 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 10628 kfree_sensitive(connkeys); 10629 return -EOPNOTSUPP; 10630 } 10631 10632 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 10633 /* bss selection makes no sense if bssid is set */ 10634 if (connect.bssid) { 10635 kfree_sensitive(connkeys); 10636 return -EINVAL; 10637 } 10638 10639 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 10640 wiphy, &connect.bss_select); 10641 if (err) { 10642 kfree_sensitive(connkeys); 10643 return err; 10644 } 10645 } 10646 10647 if (wiphy_ext_feature_isset(&rdev->wiphy, 10648 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 10649 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10650 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10651 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10652 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10653 connect.fils_erp_username = 10654 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10655 connect.fils_erp_username_len = 10656 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10657 connect.fils_erp_realm = 10658 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10659 connect.fils_erp_realm_len = 10660 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10661 connect.fils_erp_next_seq_num = 10662 nla_get_u16( 10663 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10664 connect.fils_erp_rrk = 10665 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10666 connect.fils_erp_rrk_len = 10667 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10668 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10669 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10670 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10671 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10672 kfree_sensitive(connkeys); 10673 return -EINVAL; 10674 } 10675 10676 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 10677 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10678 kfree_sensitive(connkeys); 10679 GENL_SET_ERR_MSG(info, 10680 "external auth requires connection ownership"); 10681 return -EINVAL; 10682 } 10683 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 10684 } 10685 10686 wdev_lock(dev->ieee80211_ptr); 10687 10688 err = cfg80211_connect(rdev, dev, &connect, connkeys, 10689 connect.prev_bssid); 10690 if (err) 10691 kfree_sensitive(connkeys); 10692 10693 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10694 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10695 if (connect.bssid) 10696 memcpy(dev->ieee80211_ptr->disconnect_bssid, 10697 connect.bssid, ETH_ALEN); 10698 else 10699 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 10700 } 10701 10702 wdev_unlock(dev->ieee80211_ptr); 10703 10704 return err; 10705 } 10706 10707 static int nl80211_update_connect_params(struct sk_buff *skb, 10708 struct genl_info *info) 10709 { 10710 struct cfg80211_connect_params connect = {}; 10711 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10712 struct net_device *dev = info->user_ptr[1]; 10713 struct wireless_dev *wdev = dev->ieee80211_ptr; 10714 bool fils_sk_offload; 10715 u32 auth_type; 10716 u32 changed = 0; 10717 int ret; 10718 10719 if (!rdev->ops->update_connect_params) 10720 return -EOPNOTSUPP; 10721 10722 if (info->attrs[NL80211_ATTR_IE]) { 10723 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10724 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10725 changed |= UPDATE_ASSOC_IES; 10726 } 10727 10728 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 10729 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 10730 10731 /* 10732 * when driver supports fils-sk offload all attributes must be 10733 * provided. So the else covers "fils-sk-not-all" and 10734 * "no-fils-sk-any". 10735 */ 10736 if (fils_sk_offload && 10737 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10738 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10739 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10740 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10741 connect.fils_erp_username = 10742 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10743 connect.fils_erp_username_len = 10744 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10745 connect.fils_erp_realm = 10746 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10747 connect.fils_erp_realm_len = 10748 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10749 connect.fils_erp_next_seq_num = 10750 nla_get_u16( 10751 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10752 connect.fils_erp_rrk = 10753 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10754 connect.fils_erp_rrk_len = 10755 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10756 changed |= UPDATE_FILS_ERP_INFO; 10757 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10758 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10759 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10760 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10761 return -EINVAL; 10762 } 10763 10764 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10765 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10766 if (!nl80211_valid_auth_type(rdev, auth_type, 10767 NL80211_CMD_CONNECT)) 10768 return -EINVAL; 10769 10770 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 10771 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 10772 return -EINVAL; 10773 10774 connect.auth_type = auth_type; 10775 changed |= UPDATE_AUTH_TYPE; 10776 } 10777 10778 wdev_lock(dev->ieee80211_ptr); 10779 if (!wdev->current_bss) 10780 ret = -ENOLINK; 10781 else 10782 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 10783 wdev_unlock(dev->ieee80211_ptr); 10784 10785 return ret; 10786 } 10787 10788 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 10789 { 10790 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10791 struct net_device *dev = info->user_ptr[1]; 10792 u16 reason; 10793 int ret; 10794 10795 if (dev->ieee80211_ptr->conn_owner_nlportid && 10796 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10797 return -EPERM; 10798 10799 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 10800 reason = WLAN_REASON_DEAUTH_LEAVING; 10801 else 10802 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 10803 10804 if (reason == 0) 10805 return -EINVAL; 10806 10807 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10808 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10809 return -EOPNOTSUPP; 10810 10811 wdev_lock(dev->ieee80211_ptr); 10812 ret = cfg80211_disconnect(rdev, dev, reason, true); 10813 wdev_unlock(dev->ieee80211_ptr); 10814 return ret; 10815 } 10816 10817 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 10818 { 10819 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10820 struct net *net; 10821 int err; 10822 10823 if (info->attrs[NL80211_ATTR_PID]) { 10824 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 10825 10826 net = get_net_ns_by_pid(pid); 10827 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 10828 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 10829 10830 net = get_net_ns_by_fd(fd); 10831 } else { 10832 return -EINVAL; 10833 } 10834 10835 if (IS_ERR(net)) 10836 return PTR_ERR(net); 10837 10838 err = 0; 10839 10840 /* check if anything to do */ 10841 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 10842 err = cfg80211_switch_netns(rdev, net); 10843 10844 put_net(net); 10845 return err; 10846 } 10847 10848 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 10849 { 10850 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10851 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 10852 struct cfg80211_pmksa *pmksa) = NULL; 10853 struct net_device *dev = info->user_ptr[1]; 10854 struct cfg80211_pmksa pmksa; 10855 10856 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 10857 10858 if (!info->attrs[NL80211_ATTR_PMKID]) 10859 return -EINVAL; 10860 10861 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 10862 10863 if (info->attrs[NL80211_ATTR_MAC]) { 10864 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10865 } else if (info->attrs[NL80211_ATTR_SSID] && 10866 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 10867 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 10868 info->attrs[NL80211_ATTR_PMK])) { 10869 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10870 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10871 pmksa.cache_id = 10872 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 10873 } else { 10874 return -EINVAL; 10875 } 10876 if (info->attrs[NL80211_ATTR_PMK]) { 10877 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10878 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 10879 } 10880 10881 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 10882 pmksa.pmk_lifetime = 10883 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 10884 10885 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 10886 pmksa.pmk_reauth_threshold = 10887 nla_get_u8( 10888 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 10889 10890 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10891 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 10892 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP && 10893 wiphy_ext_feature_isset(&rdev->wiphy, 10894 NL80211_EXT_FEATURE_AP_PMKSA_CACHING))) 10895 return -EOPNOTSUPP; 10896 10897 switch (info->genlhdr->cmd) { 10898 case NL80211_CMD_SET_PMKSA: 10899 rdev_ops = rdev->ops->set_pmksa; 10900 break; 10901 case NL80211_CMD_DEL_PMKSA: 10902 rdev_ops = rdev->ops->del_pmksa; 10903 break; 10904 default: 10905 WARN_ON(1); 10906 break; 10907 } 10908 10909 if (!rdev_ops) 10910 return -EOPNOTSUPP; 10911 10912 return rdev_ops(&rdev->wiphy, dev, &pmksa); 10913 } 10914 10915 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 10916 { 10917 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10918 struct net_device *dev = info->user_ptr[1]; 10919 10920 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10921 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10922 return -EOPNOTSUPP; 10923 10924 if (!rdev->ops->flush_pmksa) 10925 return -EOPNOTSUPP; 10926 10927 return rdev_flush_pmksa(rdev, dev); 10928 } 10929 10930 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 10931 { 10932 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10933 struct net_device *dev = info->user_ptr[1]; 10934 u8 action_code, dialog_token; 10935 u32 peer_capability = 0; 10936 u16 status_code; 10937 u8 *peer; 10938 bool initiator; 10939 10940 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10941 !rdev->ops->tdls_mgmt) 10942 return -EOPNOTSUPP; 10943 10944 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 10945 !info->attrs[NL80211_ATTR_STATUS_CODE] || 10946 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 10947 !info->attrs[NL80211_ATTR_IE] || 10948 !info->attrs[NL80211_ATTR_MAC]) 10949 return -EINVAL; 10950 10951 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10952 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 10953 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 10954 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 10955 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 10956 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 10957 peer_capability = 10958 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 10959 10960 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 10961 dialog_token, status_code, peer_capability, 10962 initiator, 10963 nla_data(info->attrs[NL80211_ATTR_IE]), 10964 nla_len(info->attrs[NL80211_ATTR_IE])); 10965 } 10966 10967 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 10968 { 10969 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10970 struct net_device *dev = info->user_ptr[1]; 10971 enum nl80211_tdls_operation operation; 10972 u8 *peer; 10973 10974 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10975 !rdev->ops->tdls_oper) 10976 return -EOPNOTSUPP; 10977 10978 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 10979 !info->attrs[NL80211_ATTR_MAC]) 10980 return -EINVAL; 10981 10982 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 10983 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10984 10985 return rdev_tdls_oper(rdev, dev, peer, operation); 10986 } 10987 10988 static int nl80211_remain_on_channel(struct sk_buff *skb, 10989 struct genl_info *info) 10990 { 10991 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10992 struct wireless_dev *wdev = info->user_ptr[1]; 10993 struct cfg80211_chan_def chandef; 10994 const struct cfg80211_chan_def *compat_chandef; 10995 struct sk_buff *msg; 10996 void *hdr; 10997 u64 cookie; 10998 u32 duration; 10999 int err; 11000 11001 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 11002 !info->attrs[NL80211_ATTR_DURATION]) 11003 return -EINVAL; 11004 11005 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11006 11007 if (!rdev->ops->remain_on_channel || 11008 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 11009 return -EOPNOTSUPP; 11010 11011 /* 11012 * We should be on that channel for at least a minimum amount of 11013 * time (10ms) but no longer than the driver supports. 11014 */ 11015 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11016 duration > rdev->wiphy.max_remain_on_channel_duration) 11017 return -EINVAL; 11018 11019 err = nl80211_parse_chandef(rdev, info, &chandef); 11020 if (err) 11021 return err; 11022 11023 wdev_lock(wdev); 11024 if (!cfg80211_off_channel_oper_allowed(wdev) && 11025 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 11026 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 11027 &chandef); 11028 if (compat_chandef != &chandef) { 11029 wdev_unlock(wdev); 11030 return -EBUSY; 11031 } 11032 } 11033 wdev_unlock(wdev); 11034 11035 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11036 if (!msg) 11037 return -ENOMEM; 11038 11039 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11040 NL80211_CMD_REMAIN_ON_CHANNEL); 11041 if (!hdr) { 11042 err = -ENOBUFS; 11043 goto free_msg; 11044 } 11045 11046 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 11047 duration, &cookie); 11048 11049 if (err) 11050 goto free_msg; 11051 11052 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11053 NL80211_ATTR_PAD)) 11054 goto nla_put_failure; 11055 11056 genlmsg_end(msg, hdr); 11057 11058 return genlmsg_reply(msg, info); 11059 11060 nla_put_failure: 11061 err = -ENOBUFS; 11062 free_msg: 11063 nlmsg_free(msg); 11064 return err; 11065 } 11066 11067 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 11068 struct genl_info *info) 11069 { 11070 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11071 struct wireless_dev *wdev = info->user_ptr[1]; 11072 u64 cookie; 11073 11074 if (!info->attrs[NL80211_ATTR_COOKIE]) 11075 return -EINVAL; 11076 11077 if (!rdev->ops->cancel_remain_on_channel) 11078 return -EOPNOTSUPP; 11079 11080 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11081 11082 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 11083 } 11084 11085 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 11086 struct genl_info *info) 11087 { 11088 struct cfg80211_bitrate_mask mask; 11089 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11090 struct net_device *dev = info->user_ptr[1]; 11091 int err; 11092 11093 if (!rdev->ops->set_bitrate_mask) 11094 return -EOPNOTSUPP; 11095 11096 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11097 NL80211_ATTR_TX_RATES, &mask, 11098 dev, true); 11099 if (err) 11100 return err; 11101 11102 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 11103 } 11104 11105 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 11106 { 11107 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11108 struct wireless_dev *wdev = info->user_ptr[1]; 11109 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 11110 11111 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 11112 return -EINVAL; 11113 11114 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 11115 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 11116 11117 switch (wdev->iftype) { 11118 case NL80211_IFTYPE_STATION: 11119 case NL80211_IFTYPE_ADHOC: 11120 case NL80211_IFTYPE_P2P_CLIENT: 11121 case NL80211_IFTYPE_AP: 11122 case NL80211_IFTYPE_AP_VLAN: 11123 case NL80211_IFTYPE_MESH_POINT: 11124 case NL80211_IFTYPE_P2P_GO: 11125 case NL80211_IFTYPE_P2P_DEVICE: 11126 break; 11127 case NL80211_IFTYPE_NAN: 11128 default: 11129 return -EOPNOTSUPP; 11130 } 11131 11132 /* not much point in registering if we can't reply */ 11133 if (!rdev->ops->mgmt_tx) 11134 return -EOPNOTSUPP; 11135 11136 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 11137 !wiphy_ext_feature_isset(&rdev->wiphy, 11138 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 11139 GENL_SET_ERR_MSG(info, 11140 "multicast RX registrations are not supported"); 11141 return -EOPNOTSUPP; 11142 } 11143 11144 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 11145 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11146 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11147 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 11148 info->extack); 11149 } 11150 11151 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 11152 { 11153 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11154 struct wireless_dev *wdev = info->user_ptr[1]; 11155 struct cfg80211_chan_def chandef; 11156 int err; 11157 void *hdr = NULL; 11158 u64 cookie; 11159 struct sk_buff *msg = NULL; 11160 struct cfg80211_mgmt_tx_params params = { 11161 .dont_wait_for_ack = 11162 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 11163 }; 11164 11165 if (!info->attrs[NL80211_ATTR_FRAME]) 11166 return -EINVAL; 11167 11168 if (!rdev->ops->mgmt_tx) 11169 return -EOPNOTSUPP; 11170 11171 switch (wdev->iftype) { 11172 case NL80211_IFTYPE_P2P_DEVICE: 11173 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11174 return -EINVAL; 11175 break; 11176 case NL80211_IFTYPE_STATION: 11177 case NL80211_IFTYPE_ADHOC: 11178 case NL80211_IFTYPE_P2P_CLIENT: 11179 case NL80211_IFTYPE_AP: 11180 case NL80211_IFTYPE_AP_VLAN: 11181 case NL80211_IFTYPE_MESH_POINT: 11182 case NL80211_IFTYPE_P2P_GO: 11183 break; 11184 case NL80211_IFTYPE_NAN: 11185 default: 11186 return -EOPNOTSUPP; 11187 } 11188 11189 if (info->attrs[NL80211_ATTR_DURATION]) { 11190 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11191 return -EINVAL; 11192 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11193 11194 /* 11195 * We should wait on the channel for at least a minimum amount 11196 * of time (10ms) but no longer than the driver supports. 11197 */ 11198 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11199 params.wait > rdev->wiphy.max_remain_on_channel_duration) 11200 return -EINVAL; 11201 } 11202 11203 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 11204 11205 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11206 return -EINVAL; 11207 11208 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 11209 11210 /* get the channel if any has been specified, otherwise pass NULL to 11211 * the driver. The latter will use the current one 11212 */ 11213 chandef.chan = NULL; 11214 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11215 err = nl80211_parse_chandef(rdev, info, &chandef); 11216 if (err) 11217 return err; 11218 } 11219 11220 if (!chandef.chan && params.offchan) 11221 return -EINVAL; 11222 11223 wdev_lock(wdev); 11224 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 11225 wdev_unlock(wdev); 11226 return -EBUSY; 11227 } 11228 wdev_unlock(wdev); 11229 11230 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 11231 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 11232 11233 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 11234 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11235 int i; 11236 11237 if (len % sizeof(u16)) 11238 return -EINVAL; 11239 11240 params.n_csa_offsets = len / sizeof(u16); 11241 params.csa_offsets = 11242 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11243 11244 /* check that all the offsets fit the frame */ 11245 for (i = 0; i < params.n_csa_offsets; i++) { 11246 if (params.csa_offsets[i] >= params.len) 11247 return -EINVAL; 11248 } 11249 } 11250 11251 if (!params.dont_wait_for_ack) { 11252 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11253 if (!msg) 11254 return -ENOMEM; 11255 11256 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11257 NL80211_CMD_FRAME); 11258 if (!hdr) { 11259 err = -ENOBUFS; 11260 goto free_msg; 11261 } 11262 } 11263 11264 params.chan = chandef.chan; 11265 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 11266 if (err) 11267 goto free_msg; 11268 11269 if (msg) { 11270 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11271 NL80211_ATTR_PAD)) 11272 goto nla_put_failure; 11273 11274 genlmsg_end(msg, hdr); 11275 return genlmsg_reply(msg, info); 11276 } 11277 11278 return 0; 11279 11280 nla_put_failure: 11281 err = -ENOBUFS; 11282 free_msg: 11283 nlmsg_free(msg); 11284 return err; 11285 } 11286 11287 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 11288 { 11289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11290 struct wireless_dev *wdev = info->user_ptr[1]; 11291 u64 cookie; 11292 11293 if (!info->attrs[NL80211_ATTR_COOKIE]) 11294 return -EINVAL; 11295 11296 if (!rdev->ops->mgmt_tx_cancel_wait) 11297 return -EOPNOTSUPP; 11298 11299 switch (wdev->iftype) { 11300 case NL80211_IFTYPE_STATION: 11301 case NL80211_IFTYPE_ADHOC: 11302 case NL80211_IFTYPE_P2P_CLIENT: 11303 case NL80211_IFTYPE_AP: 11304 case NL80211_IFTYPE_AP_VLAN: 11305 case NL80211_IFTYPE_P2P_GO: 11306 case NL80211_IFTYPE_P2P_DEVICE: 11307 break; 11308 case NL80211_IFTYPE_NAN: 11309 default: 11310 return -EOPNOTSUPP; 11311 } 11312 11313 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11314 11315 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 11316 } 11317 11318 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 11319 { 11320 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11321 struct wireless_dev *wdev; 11322 struct net_device *dev = info->user_ptr[1]; 11323 u8 ps_state; 11324 bool state; 11325 int err; 11326 11327 if (!info->attrs[NL80211_ATTR_PS_STATE]) 11328 return -EINVAL; 11329 11330 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 11331 11332 wdev = dev->ieee80211_ptr; 11333 11334 if (!rdev->ops->set_power_mgmt) 11335 return -EOPNOTSUPP; 11336 11337 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 11338 11339 if (state == wdev->ps) 11340 return 0; 11341 11342 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 11343 if (!err) 11344 wdev->ps = state; 11345 return err; 11346 } 11347 11348 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 11349 { 11350 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11351 enum nl80211_ps_state ps_state; 11352 struct wireless_dev *wdev; 11353 struct net_device *dev = info->user_ptr[1]; 11354 struct sk_buff *msg; 11355 void *hdr; 11356 int err; 11357 11358 wdev = dev->ieee80211_ptr; 11359 11360 if (!rdev->ops->set_power_mgmt) 11361 return -EOPNOTSUPP; 11362 11363 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11364 if (!msg) 11365 return -ENOMEM; 11366 11367 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11368 NL80211_CMD_GET_POWER_SAVE); 11369 if (!hdr) { 11370 err = -ENOBUFS; 11371 goto free_msg; 11372 } 11373 11374 if (wdev->ps) 11375 ps_state = NL80211_PS_ENABLED; 11376 else 11377 ps_state = NL80211_PS_DISABLED; 11378 11379 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 11380 goto nla_put_failure; 11381 11382 genlmsg_end(msg, hdr); 11383 return genlmsg_reply(msg, info); 11384 11385 nla_put_failure: 11386 err = -ENOBUFS; 11387 free_msg: 11388 nlmsg_free(msg); 11389 return err; 11390 } 11391 11392 static const struct nla_policy 11393 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 11394 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 11395 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 11396 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 11397 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 11398 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 11399 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 11400 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 11401 }; 11402 11403 static int nl80211_set_cqm_txe(struct genl_info *info, 11404 u32 rate, u32 pkts, u32 intvl) 11405 { 11406 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11407 struct net_device *dev = info->user_ptr[1]; 11408 struct wireless_dev *wdev = dev->ieee80211_ptr; 11409 11410 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 11411 return -EINVAL; 11412 11413 if (!rdev->ops->set_cqm_txe_config) 11414 return -EOPNOTSUPP; 11415 11416 if (wdev->iftype != NL80211_IFTYPE_STATION && 11417 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11418 return -EOPNOTSUPP; 11419 11420 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 11421 } 11422 11423 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 11424 struct net_device *dev) 11425 { 11426 struct wireless_dev *wdev = dev->ieee80211_ptr; 11427 s32 last, low, high; 11428 u32 hyst; 11429 int i, n, low_index; 11430 int err; 11431 11432 /* RSSI reporting disabled? */ 11433 if (!wdev->cqm_config) 11434 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 11435 11436 /* 11437 * Obtain current RSSI value if possible, if not and no RSSI threshold 11438 * event has been received yet, we should receive an event after a 11439 * connection is established and enough beacons received to calculate 11440 * the average. 11441 */ 11442 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 11443 rdev->ops->get_station) { 11444 struct station_info sinfo = {}; 11445 u8 *mac_addr; 11446 11447 mac_addr = wdev->current_bss->pub.bssid; 11448 11449 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 11450 if (err) 11451 return err; 11452 11453 cfg80211_sinfo_release_content(&sinfo); 11454 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 11455 wdev->cqm_config->last_rssi_event_value = 11456 (s8) sinfo.rx_beacon_signal_avg; 11457 } 11458 11459 last = wdev->cqm_config->last_rssi_event_value; 11460 hyst = wdev->cqm_config->rssi_hyst; 11461 n = wdev->cqm_config->n_rssi_thresholds; 11462 11463 for (i = 0; i < n; i++) { 11464 i = array_index_nospec(i, n); 11465 if (last < wdev->cqm_config->rssi_thresholds[i]) 11466 break; 11467 } 11468 11469 low_index = i - 1; 11470 if (low_index >= 0) { 11471 low_index = array_index_nospec(low_index, n); 11472 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 11473 } else { 11474 low = S32_MIN; 11475 } 11476 if (i < n) { 11477 i = array_index_nospec(i, n); 11478 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 11479 } else { 11480 high = S32_MAX; 11481 } 11482 11483 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 11484 } 11485 11486 static int nl80211_set_cqm_rssi(struct genl_info *info, 11487 const s32 *thresholds, int n_thresholds, 11488 u32 hysteresis) 11489 { 11490 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11491 struct net_device *dev = info->user_ptr[1]; 11492 struct wireless_dev *wdev = dev->ieee80211_ptr; 11493 int i, err; 11494 s32 prev = S32_MIN; 11495 11496 /* Check all values negative and sorted */ 11497 for (i = 0; i < n_thresholds; i++) { 11498 if (thresholds[i] > 0 || thresholds[i] <= prev) 11499 return -EINVAL; 11500 11501 prev = thresholds[i]; 11502 } 11503 11504 if (wdev->iftype != NL80211_IFTYPE_STATION && 11505 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11506 return -EOPNOTSUPP; 11507 11508 wdev_lock(wdev); 11509 cfg80211_cqm_config_free(wdev); 11510 wdev_unlock(wdev); 11511 11512 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 11513 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 11514 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 11515 11516 return rdev_set_cqm_rssi_config(rdev, dev, 11517 thresholds[0], hysteresis); 11518 } 11519 11520 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11521 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 11522 return -EOPNOTSUPP; 11523 11524 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 11525 n_thresholds = 0; 11526 11527 wdev_lock(wdev); 11528 if (n_thresholds) { 11529 struct cfg80211_cqm_config *cqm_config; 11530 11531 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 11532 n_thresholds * sizeof(s32), GFP_KERNEL); 11533 if (!cqm_config) { 11534 err = -ENOMEM; 11535 goto unlock; 11536 } 11537 11538 cqm_config->rssi_hyst = hysteresis; 11539 cqm_config->n_rssi_thresholds = n_thresholds; 11540 memcpy(cqm_config->rssi_thresholds, thresholds, 11541 n_thresholds * sizeof(s32)); 11542 11543 wdev->cqm_config = cqm_config; 11544 } 11545 11546 err = cfg80211_cqm_rssi_update(rdev, dev); 11547 11548 unlock: 11549 wdev_unlock(wdev); 11550 11551 return err; 11552 } 11553 11554 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 11555 { 11556 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 11557 struct nlattr *cqm; 11558 int err; 11559 11560 cqm = info->attrs[NL80211_ATTR_CQM]; 11561 if (!cqm) 11562 return -EINVAL; 11563 11564 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 11565 nl80211_attr_cqm_policy, 11566 info->extack); 11567 if (err) 11568 return err; 11569 11570 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 11571 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 11572 const s32 *thresholds = 11573 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11574 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11575 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 11576 11577 if (len % 4) 11578 return -EINVAL; 11579 11580 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 11581 hysteresis); 11582 } 11583 11584 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 11585 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 11586 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 11587 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 11588 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 11589 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 11590 11591 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 11592 } 11593 11594 return -EINVAL; 11595 } 11596 11597 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 11598 { 11599 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11600 struct net_device *dev = info->user_ptr[1]; 11601 struct ocb_setup setup = {}; 11602 int err; 11603 11604 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11605 if (err) 11606 return err; 11607 11608 return cfg80211_join_ocb(rdev, dev, &setup); 11609 } 11610 11611 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 11612 { 11613 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11614 struct net_device *dev = info->user_ptr[1]; 11615 11616 return cfg80211_leave_ocb(rdev, dev); 11617 } 11618 11619 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 11620 { 11621 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11622 struct net_device *dev = info->user_ptr[1]; 11623 struct mesh_config cfg; 11624 struct mesh_setup setup; 11625 int err; 11626 11627 /* start with default */ 11628 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 11629 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 11630 11631 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 11632 /* and parse parameters if given */ 11633 err = nl80211_parse_mesh_config(info, &cfg, NULL); 11634 if (err) 11635 return err; 11636 } 11637 11638 if (!info->attrs[NL80211_ATTR_MESH_ID] || 11639 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 11640 return -EINVAL; 11641 11642 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 11643 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 11644 11645 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11646 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 11647 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11648 return -EINVAL; 11649 11650 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 11651 setup.beacon_interval = 11652 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11653 11654 err = cfg80211_validate_beacon_int(rdev, 11655 NL80211_IFTYPE_MESH_POINT, 11656 setup.beacon_interval); 11657 if (err) 11658 return err; 11659 } 11660 11661 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 11662 setup.dtim_period = 11663 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 11664 if (setup.dtim_period < 1 || setup.dtim_period > 100) 11665 return -EINVAL; 11666 } 11667 11668 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 11669 /* parse additional setup parameters if given */ 11670 err = nl80211_parse_mesh_setup(info, &setup); 11671 if (err) 11672 return err; 11673 } 11674 11675 if (setup.user_mpm) 11676 cfg.auto_open_plinks = false; 11677 11678 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11679 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11680 if (err) 11681 return err; 11682 } else { 11683 /* __cfg80211_join_mesh() will sort it out */ 11684 setup.chandef.chan = NULL; 11685 } 11686 11687 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11688 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11689 int n_rates = 11690 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11691 struct ieee80211_supported_band *sband; 11692 11693 if (!setup.chandef.chan) 11694 return -EINVAL; 11695 11696 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 11697 11698 err = ieee80211_get_ratemask(sband, rates, n_rates, 11699 &setup.basic_rates); 11700 if (err) 11701 return err; 11702 } 11703 11704 if (info->attrs[NL80211_ATTR_TX_RATES]) { 11705 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11706 NL80211_ATTR_TX_RATES, 11707 &setup.beacon_rate, 11708 dev, false); 11709 if (err) 11710 return err; 11711 11712 if (!setup.chandef.chan) 11713 return -EINVAL; 11714 11715 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 11716 &setup.beacon_rate); 11717 if (err) 11718 return err; 11719 } 11720 11721 setup.userspace_handles_dfs = 11722 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11723 11724 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11725 int r = validate_pae_over_nl80211(rdev, info); 11726 11727 if (r < 0) 11728 return r; 11729 11730 setup.control_port_over_nl80211 = true; 11731 } 11732 11733 wdev_lock(dev->ieee80211_ptr); 11734 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 11735 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11736 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11737 wdev_unlock(dev->ieee80211_ptr); 11738 11739 return err; 11740 } 11741 11742 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 11743 { 11744 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11745 struct net_device *dev = info->user_ptr[1]; 11746 11747 return cfg80211_leave_mesh(rdev, dev); 11748 } 11749 11750 #ifdef CONFIG_PM 11751 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 11752 struct cfg80211_registered_device *rdev) 11753 { 11754 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 11755 struct nlattr *nl_pats, *nl_pat; 11756 int i, pat_len; 11757 11758 if (!wowlan->n_patterns) 11759 return 0; 11760 11761 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 11762 if (!nl_pats) 11763 return -ENOBUFS; 11764 11765 for (i = 0; i < wowlan->n_patterns; i++) { 11766 nl_pat = nla_nest_start_noflag(msg, i + 1); 11767 if (!nl_pat) 11768 return -ENOBUFS; 11769 pat_len = wowlan->patterns[i].pattern_len; 11770 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 11771 wowlan->patterns[i].mask) || 11772 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 11773 wowlan->patterns[i].pattern) || 11774 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 11775 wowlan->patterns[i].pkt_offset)) 11776 return -ENOBUFS; 11777 nla_nest_end(msg, nl_pat); 11778 } 11779 nla_nest_end(msg, nl_pats); 11780 11781 return 0; 11782 } 11783 11784 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 11785 struct cfg80211_wowlan_tcp *tcp) 11786 { 11787 struct nlattr *nl_tcp; 11788 11789 if (!tcp) 11790 return 0; 11791 11792 nl_tcp = nla_nest_start_noflag(msg, 11793 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 11794 if (!nl_tcp) 11795 return -ENOBUFS; 11796 11797 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 11798 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 11799 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 11800 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 11801 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 11802 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 11803 tcp->payload_len, tcp->payload) || 11804 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 11805 tcp->data_interval) || 11806 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 11807 tcp->wake_len, tcp->wake_data) || 11808 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 11809 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 11810 return -ENOBUFS; 11811 11812 if (tcp->payload_seq.len && 11813 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 11814 sizeof(tcp->payload_seq), &tcp->payload_seq)) 11815 return -ENOBUFS; 11816 11817 if (tcp->payload_tok.len && 11818 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 11819 sizeof(tcp->payload_tok) + tcp->tokens_size, 11820 &tcp->payload_tok)) 11821 return -ENOBUFS; 11822 11823 nla_nest_end(msg, nl_tcp); 11824 11825 return 0; 11826 } 11827 11828 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 11829 struct cfg80211_sched_scan_request *req) 11830 { 11831 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 11832 int i; 11833 11834 if (!req) 11835 return 0; 11836 11837 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 11838 if (!nd) 11839 return -ENOBUFS; 11840 11841 if (req->n_scan_plans == 1 && 11842 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 11843 req->scan_plans[0].interval * 1000)) 11844 return -ENOBUFS; 11845 11846 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 11847 return -ENOBUFS; 11848 11849 if (req->relative_rssi_set) { 11850 struct nl80211_bss_select_rssi_adjust rssi_adjust; 11851 11852 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 11853 req->relative_rssi)) 11854 return -ENOBUFS; 11855 11856 rssi_adjust.band = req->rssi_adjust.band; 11857 rssi_adjust.delta = req->rssi_adjust.delta; 11858 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 11859 sizeof(rssi_adjust), &rssi_adjust)) 11860 return -ENOBUFS; 11861 } 11862 11863 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 11864 if (!freqs) 11865 return -ENOBUFS; 11866 11867 for (i = 0; i < req->n_channels; i++) { 11868 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 11869 return -ENOBUFS; 11870 } 11871 11872 nla_nest_end(msg, freqs); 11873 11874 if (req->n_match_sets) { 11875 matches = nla_nest_start_noflag(msg, 11876 NL80211_ATTR_SCHED_SCAN_MATCH); 11877 if (!matches) 11878 return -ENOBUFS; 11879 11880 for (i = 0; i < req->n_match_sets; i++) { 11881 match = nla_nest_start_noflag(msg, i); 11882 if (!match) 11883 return -ENOBUFS; 11884 11885 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 11886 req->match_sets[i].ssid.ssid_len, 11887 req->match_sets[i].ssid.ssid)) 11888 return -ENOBUFS; 11889 nla_nest_end(msg, match); 11890 } 11891 nla_nest_end(msg, matches); 11892 } 11893 11894 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 11895 if (!scan_plans) 11896 return -ENOBUFS; 11897 11898 for (i = 0; i < req->n_scan_plans; i++) { 11899 scan_plan = nla_nest_start_noflag(msg, i + 1); 11900 if (!scan_plan) 11901 return -ENOBUFS; 11902 11903 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 11904 req->scan_plans[i].interval) || 11905 (req->scan_plans[i].iterations && 11906 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 11907 req->scan_plans[i].iterations))) 11908 return -ENOBUFS; 11909 nla_nest_end(msg, scan_plan); 11910 } 11911 nla_nest_end(msg, scan_plans); 11912 11913 nla_nest_end(msg, nd); 11914 11915 return 0; 11916 } 11917 11918 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 11919 { 11920 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11921 struct sk_buff *msg; 11922 void *hdr; 11923 u32 size = NLMSG_DEFAULT_SIZE; 11924 11925 if (!rdev->wiphy.wowlan) 11926 return -EOPNOTSUPP; 11927 11928 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 11929 /* adjust size to have room for all the data */ 11930 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 11931 rdev->wiphy.wowlan_config->tcp->payload_len + 11932 rdev->wiphy.wowlan_config->tcp->wake_len + 11933 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 11934 } 11935 11936 msg = nlmsg_new(size, GFP_KERNEL); 11937 if (!msg) 11938 return -ENOMEM; 11939 11940 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11941 NL80211_CMD_GET_WOWLAN); 11942 if (!hdr) 11943 goto nla_put_failure; 11944 11945 if (rdev->wiphy.wowlan_config) { 11946 struct nlattr *nl_wowlan; 11947 11948 nl_wowlan = nla_nest_start_noflag(msg, 11949 NL80211_ATTR_WOWLAN_TRIGGERS); 11950 if (!nl_wowlan) 11951 goto nla_put_failure; 11952 11953 if ((rdev->wiphy.wowlan_config->any && 11954 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 11955 (rdev->wiphy.wowlan_config->disconnect && 11956 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 11957 (rdev->wiphy.wowlan_config->magic_pkt && 11958 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 11959 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 11960 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 11961 (rdev->wiphy.wowlan_config->eap_identity_req && 11962 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 11963 (rdev->wiphy.wowlan_config->four_way_handshake && 11964 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 11965 (rdev->wiphy.wowlan_config->rfkill_release && 11966 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 11967 goto nla_put_failure; 11968 11969 if (nl80211_send_wowlan_patterns(msg, rdev)) 11970 goto nla_put_failure; 11971 11972 if (nl80211_send_wowlan_tcp(msg, 11973 rdev->wiphy.wowlan_config->tcp)) 11974 goto nla_put_failure; 11975 11976 if (nl80211_send_wowlan_nd( 11977 msg, 11978 rdev->wiphy.wowlan_config->nd_config)) 11979 goto nla_put_failure; 11980 11981 nla_nest_end(msg, nl_wowlan); 11982 } 11983 11984 genlmsg_end(msg, hdr); 11985 return genlmsg_reply(msg, info); 11986 11987 nla_put_failure: 11988 nlmsg_free(msg); 11989 return -ENOBUFS; 11990 } 11991 11992 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 11993 struct nlattr *attr, 11994 struct cfg80211_wowlan *trig) 11995 { 11996 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 11997 struct cfg80211_wowlan_tcp *cfg; 11998 struct nl80211_wowlan_tcp_data_token *tok = NULL; 11999 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 12000 u32 size; 12001 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 12002 int err, port; 12003 12004 if (!rdev->wiphy.wowlan->tcp) 12005 return -EINVAL; 12006 12007 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 12008 nl80211_wowlan_tcp_policy, NULL); 12009 if (err) 12010 return err; 12011 12012 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 12013 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 12014 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 12015 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 12016 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 12017 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 12018 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 12019 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 12020 return -EINVAL; 12021 12022 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 12023 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 12024 return -EINVAL; 12025 12026 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 12027 rdev->wiphy.wowlan->tcp->data_interval_max || 12028 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 12029 return -EINVAL; 12030 12031 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 12032 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 12033 return -EINVAL; 12034 12035 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 12036 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 12037 return -EINVAL; 12038 12039 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 12040 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12041 12042 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12043 tokens_size = tokln - sizeof(*tok); 12044 12045 if (!tok->len || tokens_size % tok->len) 12046 return -EINVAL; 12047 if (!rdev->wiphy.wowlan->tcp->tok) 12048 return -EINVAL; 12049 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 12050 return -EINVAL; 12051 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 12052 return -EINVAL; 12053 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 12054 return -EINVAL; 12055 if (tok->offset + tok->len > data_size) 12056 return -EINVAL; 12057 } 12058 12059 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 12060 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 12061 if (!rdev->wiphy.wowlan->tcp->seq) 12062 return -EINVAL; 12063 if (seq->len == 0 || seq->len > 4) 12064 return -EINVAL; 12065 if (seq->len + seq->offset > data_size) 12066 return -EINVAL; 12067 } 12068 12069 size = sizeof(*cfg); 12070 size += data_size; 12071 size += wake_size + wake_mask_size; 12072 size += tokens_size; 12073 12074 cfg = kzalloc(size, GFP_KERNEL); 12075 if (!cfg) 12076 return -ENOMEM; 12077 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 12078 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 12079 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 12080 ETH_ALEN); 12081 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 12082 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 12083 else 12084 port = 0; 12085 #ifdef CONFIG_INET 12086 /* allocate a socket and port for it and use it */ 12087 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 12088 IPPROTO_TCP, &cfg->sock, 1); 12089 if (err) { 12090 kfree(cfg); 12091 return err; 12092 } 12093 if (inet_csk_get_port(cfg->sock->sk, port)) { 12094 sock_release(cfg->sock); 12095 kfree(cfg); 12096 return -EADDRINUSE; 12097 } 12098 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 12099 #else 12100 if (!port) { 12101 kfree(cfg); 12102 return -EINVAL; 12103 } 12104 cfg->src_port = port; 12105 #endif 12106 12107 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 12108 cfg->payload_len = data_size; 12109 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 12110 memcpy((void *)cfg->payload, 12111 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 12112 data_size); 12113 if (seq) 12114 cfg->payload_seq = *seq; 12115 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 12116 cfg->wake_len = wake_size; 12117 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 12118 memcpy((void *)cfg->wake_data, 12119 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 12120 wake_size); 12121 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 12122 data_size + wake_size; 12123 memcpy((void *)cfg->wake_mask, 12124 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 12125 wake_mask_size); 12126 if (tok) { 12127 cfg->tokens_size = tokens_size; 12128 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 12129 } 12130 12131 trig->tcp = cfg; 12132 12133 return 0; 12134 } 12135 12136 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 12137 const struct wiphy_wowlan_support *wowlan, 12138 struct nlattr *attr, 12139 struct cfg80211_wowlan *trig) 12140 { 12141 struct nlattr **tb; 12142 int err; 12143 12144 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 12145 if (!tb) 12146 return -ENOMEM; 12147 12148 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 12149 err = -EOPNOTSUPP; 12150 goto out; 12151 } 12152 12153 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 12154 nl80211_policy, NULL); 12155 if (err) 12156 goto out; 12157 12158 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 12159 wowlan->max_nd_match_sets); 12160 err = PTR_ERR_OR_ZERO(trig->nd_config); 12161 if (err) 12162 trig->nd_config = NULL; 12163 12164 out: 12165 kfree(tb); 12166 return err; 12167 } 12168 12169 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 12170 { 12171 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12172 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 12173 struct cfg80211_wowlan new_triggers = {}; 12174 struct cfg80211_wowlan *ntrig; 12175 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 12176 int err, i; 12177 bool prev_enabled = rdev->wiphy.wowlan_config; 12178 bool regular = false; 12179 12180 if (!wowlan) 12181 return -EOPNOTSUPP; 12182 12183 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 12184 cfg80211_rdev_free_wowlan(rdev); 12185 rdev->wiphy.wowlan_config = NULL; 12186 goto set_wakeup; 12187 } 12188 12189 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 12190 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 12191 nl80211_wowlan_policy, info->extack); 12192 if (err) 12193 return err; 12194 12195 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 12196 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 12197 return -EINVAL; 12198 new_triggers.any = true; 12199 } 12200 12201 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 12202 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 12203 return -EINVAL; 12204 new_triggers.disconnect = true; 12205 regular = true; 12206 } 12207 12208 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 12209 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 12210 return -EINVAL; 12211 new_triggers.magic_pkt = true; 12212 regular = true; 12213 } 12214 12215 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 12216 return -EINVAL; 12217 12218 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 12219 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 12220 return -EINVAL; 12221 new_triggers.gtk_rekey_failure = true; 12222 regular = true; 12223 } 12224 12225 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 12226 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 12227 return -EINVAL; 12228 new_triggers.eap_identity_req = true; 12229 regular = true; 12230 } 12231 12232 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 12233 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 12234 return -EINVAL; 12235 new_triggers.four_way_handshake = true; 12236 regular = true; 12237 } 12238 12239 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 12240 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 12241 return -EINVAL; 12242 new_triggers.rfkill_release = true; 12243 regular = true; 12244 } 12245 12246 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 12247 struct nlattr *pat; 12248 int n_patterns = 0; 12249 int rem, pat_len, mask_len, pkt_offset; 12250 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12251 12252 regular = true; 12253 12254 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12255 rem) 12256 n_patterns++; 12257 if (n_patterns > wowlan->n_patterns) 12258 return -EINVAL; 12259 12260 new_triggers.patterns = kcalloc(n_patterns, 12261 sizeof(new_triggers.patterns[0]), 12262 GFP_KERNEL); 12263 if (!new_triggers.patterns) 12264 return -ENOMEM; 12265 12266 new_triggers.n_patterns = n_patterns; 12267 i = 0; 12268 12269 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12270 rem) { 12271 u8 *mask_pat; 12272 12273 err = nla_parse_nested_deprecated(pat_tb, 12274 MAX_NL80211_PKTPAT, 12275 pat, 12276 nl80211_packet_pattern_policy, 12277 info->extack); 12278 if (err) 12279 goto error; 12280 12281 err = -EINVAL; 12282 if (!pat_tb[NL80211_PKTPAT_MASK] || 12283 !pat_tb[NL80211_PKTPAT_PATTERN]) 12284 goto error; 12285 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12286 mask_len = DIV_ROUND_UP(pat_len, 8); 12287 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12288 goto error; 12289 if (pat_len > wowlan->pattern_max_len || 12290 pat_len < wowlan->pattern_min_len) 12291 goto error; 12292 12293 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12294 pkt_offset = 0; 12295 else 12296 pkt_offset = nla_get_u32( 12297 pat_tb[NL80211_PKTPAT_OFFSET]); 12298 if (pkt_offset > wowlan->max_pkt_offset) 12299 goto error; 12300 new_triggers.patterns[i].pkt_offset = pkt_offset; 12301 12302 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12303 if (!mask_pat) { 12304 err = -ENOMEM; 12305 goto error; 12306 } 12307 new_triggers.patterns[i].mask = mask_pat; 12308 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12309 mask_len); 12310 mask_pat += mask_len; 12311 new_triggers.patterns[i].pattern = mask_pat; 12312 new_triggers.patterns[i].pattern_len = pat_len; 12313 memcpy(mask_pat, 12314 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12315 pat_len); 12316 i++; 12317 } 12318 } 12319 12320 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 12321 regular = true; 12322 err = nl80211_parse_wowlan_tcp( 12323 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 12324 &new_triggers); 12325 if (err) 12326 goto error; 12327 } 12328 12329 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 12330 regular = true; 12331 err = nl80211_parse_wowlan_nd( 12332 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 12333 &new_triggers); 12334 if (err) 12335 goto error; 12336 } 12337 12338 /* The 'any' trigger means the device continues operating more or less 12339 * as in its normal operation mode and wakes up the host on most of the 12340 * normal interrupts (like packet RX, ...) 12341 * It therefore makes little sense to combine with the more constrained 12342 * wakeup trigger modes. 12343 */ 12344 if (new_triggers.any && regular) { 12345 err = -EINVAL; 12346 goto error; 12347 } 12348 12349 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 12350 if (!ntrig) { 12351 err = -ENOMEM; 12352 goto error; 12353 } 12354 cfg80211_rdev_free_wowlan(rdev); 12355 rdev->wiphy.wowlan_config = ntrig; 12356 12357 set_wakeup: 12358 if (rdev->ops->set_wakeup && 12359 prev_enabled != !!rdev->wiphy.wowlan_config) 12360 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 12361 12362 return 0; 12363 error: 12364 for (i = 0; i < new_triggers.n_patterns; i++) 12365 kfree(new_triggers.patterns[i].mask); 12366 kfree(new_triggers.patterns); 12367 if (new_triggers.tcp && new_triggers.tcp->sock) 12368 sock_release(new_triggers.tcp->sock); 12369 kfree(new_triggers.tcp); 12370 kfree(new_triggers.nd_config); 12371 return err; 12372 } 12373 #endif 12374 12375 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 12376 struct cfg80211_registered_device *rdev) 12377 { 12378 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 12379 int i, j, pat_len; 12380 struct cfg80211_coalesce_rules *rule; 12381 12382 if (!rdev->coalesce->n_rules) 12383 return 0; 12384 12385 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 12386 if (!nl_rules) 12387 return -ENOBUFS; 12388 12389 for (i = 0; i < rdev->coalesce->n_rules; i++) { 12390 nl_rule = nla_nest_start_noflag(msg, i + 1); 12391 if (!nl_rule) 12392 return -ENOBUFS; 12393 12394 rule = &rdev->coalesce->rules[i]; 12395 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 12396 rule->delay)) 12397 return -ENOBUFS; 12398 12399 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 12400 rule->condition)) 12401 return -ENOBUFS; 12402 12403 nl_pats = nla_nest_start_noflag(msg, 12404 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 12405 if (!nl_pats) 12406 return -ENOBUFS; 12407 12408 for (j = 0; j < rule->n_patterns; j++) { 12409 nl_pat = nla_nest_start_noflag(msg, j + 1); 12410 if (!nl_pat) 12411 return -ENOBUFS; 12412 pat_len = rule->patterns[j].pattern_len; 12413 if (nla_put(msg, NL80211_PKTPAT_MASK, 12414 DIV_ROUND_UP(pat_len, 8), 12415 rule->patterns[j].mask) || 12416 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 12417 rule->patterns[j].pattern) || 12418 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 12419 rule->patterns[j].pkt_offset)) 12420 return -ENOBUFS; 12421 nla_nest_end(msg, nl_pat); 12422 } 12423 nla_nest_end(msg, nl_pats); 12424 nla_nest_end(msg, nl_rule); 12425 } 12426 nla_nest_end(msg, nl_rules); 12427 12428 return 0; 12429 } 12430 12431 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 12432 { 12433 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12434 struct sk_buff *msg; 12435 void *hdr; 12436 12437 if (!rdev->wiphy.coalesce) 12438 return -EOPNOTSUPP; 12439 12440 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12441 if (!msg) 12442 return -ENOMEM; 12443 12444 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12445 NL80211_CMD_GET_COALESCE); 12446 if (!hdr) 12447 goto nla_put_failure; 12448 12449 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 12450 goto nla_put_failure; 12451 12452 genlmsg_end(msg, hdr); 12453 return genlmsg_reply(msg, info); 12454 12455 nla_put_failure: 12456 nlmsg_free(msg); 12457 return -ENOBUFS; 12458 } 12459 12460 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 12461 { 12462 struct cfg80211_coalesce *coalesce = rdev->coalesce; 12463 int i, j; 12464 struct cfg80211_coalesce_rules *rule; 12465 12466 if (!coalesce) 12467 return; 12468 12469 for (i = 0; i < coalesce->n_rules; i++) { 12470 rule = &coalesce->rules[i]; 12471 for (j = 0; j < rule->n_patterns; j++) 12472 kfree(rule->patterns[j].mask); 12473 kfree(rule->patterns); 12474 } 12475 kfree(coalesce->rules); 12476 kfree(coalesce); 12477 rdev->coalesce = NULL; 12478 } 12479 12480 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 12481 struct nlattr *rule, 12482 struct cfg80211_coalesce_rules *new_rule) 12483 { 12484 int err, i; 12485 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12486 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 12487 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 12488 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12489 12490 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 12491 rule, nl80211_coalesce_policy, NULL); 12492 if (err) 12493 return err; 12494 12495 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 12496 new_rule->delay = 12497 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 12498 if (new_rule->delay > coalesce->max_delay) 12499 return -EINVAL; 12500 12501 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 12502 new_rule->condition = 12503 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 12504 12505 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 12506 return -EINVAL; 12507 12508 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12509 rem) 12510 n_patterns++; 12511 if (n_patterns > coalesce->n_patterns) 12512 return -EINVAL; 12513 12514 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 12515 GFP_KERNEL); 12516 if (!new_rule->patterns) 12517 return -ENOMEM; 12518 12519 new_rule->n_patterns = n_patterns; 12520 i = 0; 12521 12522 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12523 rem) { 12524 u8 *mask_pat; 12525 12526 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 12527 pat, 12528 nl80211_packet_pattern_policy, 12529 NULL); 12530 if (err) 12531 return err; 12532 12533 if (!pat_tb[NL80211_PKTPAT_MASK] || 12534 !pat_tb[NL80211_PKTPAT_PATTERN]) 12535 return -EINVAL; 12536 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12537 mask_len = DIV_ROUND_UP(pat_len, 8); 12538 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12539 return -EINVAL; 12540 if (pat_len > coalesce->pattern_max_len || 12541 pat_len < coalesce->pattern_min_len) 12542 return -EINVAL; 12543 12544 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12545 pkt_offset = 0; 12546 else 12547 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 12548 if (pkt_offset > coalesce->max_pkt_offset) 12549 return -EINVAL; 12550 new_rule->patterns[i].pkt_offset = pkt_offset; 12551 12552 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12553 if (!mask_pat) 12554 return -ENOMEM; 12555 12556 new_rule->patterns[i].mask = mask_pat; 12557 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12558 mask_len); 12559 12560 mask_pat += mask_len; 12561 new_rule->patterns[i].pattern = mask_pat; 12562 new_rule->patterns[i].pattern_len = pat_len; 12563 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12564 pat_len); 12565 i++; 12566 } 12567 12568 return 0; 12569 } 12570 12571 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 12572 { 12573 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12574 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12575 struct cfg80211_coalesce new_coalesce = {}; 12576 struct cfg80211_coalesce *n_coalesce; 12577 int err, rem_rule, n_rules = 0, i, j; 12578 struct nlattr *rule; 12579 struct cfg80211_coalesce_rules *tmp_rule; 12580 12581 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 12582 return -EOPNOTSUPP; 12583 12584 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 12585 cfg80211_rdev_free_coalesce(rdev); 12586 rdev_set_coalesce(rdev, NULL); 12587 return 0; 12588 } 12589 12590 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12591 rem_rule) 12592 n_rules++; 12593 if (n_rules > coalesce->n_rules) 12594 return -EINVAL; 12595 12596 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 12597 GFP_KERNEL); 12598 if (!new_coalesce.rules) 12599 return -ENOMEM; 12600 12601 new_coalesce.n_rules = n_rules; 12602 i = 0; 12603 12604 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12605 rem_rule) { 12606 err = nl80211_parse_coalesce_rule(rdev, rule, 12607 &new_coalesce.rules[i]); 12608 if (err) 12609 goto error; 12610 12611 i++; 12612 } 12613 12614 err = rdev_set_coalesce(rdev, &new_coalesce); 12615 if (err) 12616 goto error; 12617 12618 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 12619 if (!n_coalesce) { 12620 err = -ENOMEM; 12621 goto error; 12622 } 12623 cfg80211_rdev_free_coalesce(rdev); 12624 rdev->coalesce = n_coalesce; 12625 12626 return 0; 12627 error: 12628 for (i = 0; i < new_coalesce.n_rules; i++) { 12629 tmp_rule = &new_coalesce.rules[i]; 12630 for (j = 0; j < tmp_rule->n_patterns; j++) 12631 kfree(tmp_rule->patterns[j].mask); 12632 kfree(tmp_rule->patterns); 12633 } 12634 kfree(new_coalesce.rules); 12635 12636 return err; 12637 } 12638 12639 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 12640 { 12641 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12642 struct net_device *dev = info->user_ptr[1]; 12643 struct wireless_dev *wdev = dev->ieee80211_ptr; 12644 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 12645 struct cfg80211_gtk_rekey_data rekey_data; 12646 int err; 12647 12648 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 12649 return -EINVAL; 12650 12651 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 12652 info->attrs[NL80211_ATTR_REKEY_DATA], 12653 nl80211_rekey_policy, info->extack); 12654 if (err) 12655 return err; 12656 12657 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 12658 !tb[NL80211_REKEY_DATA_KCK]) 12659 return -EINVAL; 12660 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 12661 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12662 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 12663 return -ERANGE; 12664 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 12665 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12666 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) 12667 return -ERANGE; 12668 12669 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 12670 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 12671 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 12672 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 12673 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 12674 if (tb[NL80211_REKEY_DATA_AKM]) 12675 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 12676 12677 wdev_lock(wdev); 12678 if (!wdev->current_bss) { 12679 err = -ENOTCONN; 12680 goto out; 12681 } 12682 12683 if (!rdev->ops->set_rekey_data) { 12684 err = -EOPNOTSUPP; 12685 goto out; 12686 } 12687 12688 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 12689 out: 12690 wdev_unlock(wdev); 12691 return err; 12692 } 12693 12694 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 12695 struct genl_info *info) 12696 { 12697 struct net_device *dev = info->user_ptr[1]; 12698 struct wireless_dev *wdev = dev->ieee80211_ptr; 12699 12700 if (wdev->iftype != NL80211_IFTYPE_AP && 12701 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12702 return -EINVAL; 12703 12704 if (wdev->ap_unexpected_nlportid) 12705 return -EBUSY; 12706 12707 wdev->ap_unexpected_nlportid = info->snd_portid; 12708 return 0; 12709 } 12710 12711 static int nl80211_probe_client(struct sk_buff *skb, 12712 struct genl_info *info) 12713 { 12714 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12715 struct net_device *dev = info->user_ptr[1]; 12716 struct wireless_dev *wdev = dev->ieee80211_ptr; 12717 struct sk_buff *msg; 12718 void *hdr; 12719 const u8 *addr; 12720 u64 cookie; 12721 int err; 12722 12723 if (wdev->iftype != NL80211_IFTYPE_AP && 12724 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12725 return -EOPNOTSUPP; 12726 12727 if (!info->attrs[NL80211_ATTR_MAC]) 12728 return -EINVAL; 12729 12730 if (!rdev->ops->probe_client) 12731 return -EOPNOTSUPP; 12732 12733 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12734 if (!msg) 12735 return -ENOMEM; 12736 12737 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12738 NL80211_CMD_PROBE_CLIENT); 12739 if (!hdr) { 12740 err = -ENOBUFS; 12741 goto free_msg; 12742 } 12743 12744 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12745 12746 err = rdev_probe_client(rdev, dev, addr, &cookie); 12747 if (err) 12748 goto free_msg; 12749 12750 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12751 NL80211_ATTR_PAD)) 12752 goto nla_put_failure; 12753 12754 genlmsg_end(msg, hdr); 12755 12756 return genlmsg_reply(msg, info); 12757 12758 nla_put_failure: 12759 err = -ENOBUFS; 12760 free_msg: 12761 nlmsg_free(msg); 12762 return err; 12763 } 12764 12765 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 12766 { 12767 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12768 struct cfg80211_beacon_registration *reg, *nreg; 12769 int rv; 12770 12771 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 12772 return -EOPNOTSUPP; 12773 12774 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 12775 if (!nreg) 12776 return -ENOMEM; 12777 12778 /* First, check if already registered. */ 12779 spin_lock_bh(&rdev->beacon_registrations_lock); 12780 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 12781 if (reg->nlportid == info->snd_portid) { 12782 rv = -EALREADY; 12783 goto out_err; 12784 } 12785 } 12786 /* Add it to the list */ 12787 nreg->nlportid = info->snd_portid; 12788 list_add(&nreg->list, &rdev->beacon_registrations); 12789 12790 spin_unlock_bh(&rdev->beacon_registrations_lock); 12791 12792 return 0; 12793 out_err: 12794 spin_unlock_bh(&rdev->beacon_registrations_lock); 12795 kfree(nreg); 12796 return rv; 12797 } 12798 12799 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 12800 { 12801 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12802 struct wireless_dev *wdev = info->user_ptr[1]; 12803 int err; 12804 12805 if (!rdev->ops->start_p2p_device) 12806 return -EOPNOTSUPP; 12807 12808 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12809 return -EOPNOTSUPP; 12810 12811 if (wdev_running(wdev)) 12812 return 0; 12813 12814 if (rfkill_blocked(rdev->rfkill)) 12815 return -ERFKILL; 12816 12817 err = rdev_start_p2p_device(rdev, wdev); 12818 if (err) 12819 return err; 12820 12821 wdev->is_running = true; 12822 rdev->opencount++; 12823 12824 return 0; 12825 } 12826 12827 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 12828 { 12829 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12830 struct wireless_dev *wdev = info->user_ptr[1]; 12831 12832 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12833 return -EOPNOTSUPP; 12834 12835 if (!rdev->ops->stop_p2p_device) 12836 return -EOPNOTSUPP; 12837 12838 cfg80211_stop_p2p_device(rdev, wdev); 12839 12840 return 0; 12841 } 12842 12843 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 12844 { 12845 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12846 struct wireless_dev *wdev = info->user_ptr[1]; 12847 struct cfg80211_nan_conf conf = {}; 12848 int err; 12849 12850 if (wdev->iftype != NL80211_IFTYPE_NAN) 12851 return -EOPNOTSUPP; 12852 12853 if (wdev_running(wdev)) 12854 return -EEXIST; 12855 12856 if (rfkill_blocked(rdev->rfkill)) 12857 return -ERFKILL; 12858 12859 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 12860 return -EINVAL; 12861 12862 conf.master_pref = 12863 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 12864 12865 if (info->attrs[NL80211_ATTR_BANDS]) { 12866 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 12867 12868 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 12869 return -EOPNOTSUPP; 12870 12871 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 12872 return -EINVAL; 12873 12874 conf.bands = bands; 12875 } 12876 12877 err = rdev_start_nan(rdev, wdev, &conf); 12878 if (err) 12879 return err; 12880 12881 wdev->is_running = true; 12882 rdev->opencount++; 12883 12884 return 0; 12885 } 12886 12887 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 12888 { 12889 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12890 struct wireless_dev *wdev = info->user_ptr[1]; 12891 12892 if (wdev->iftype != NL80211_IFTYPE_NAN) 12893 return -EOPNOTSUPP; 12894 12895 cfg80211_stop_nan(rdev, wdev); 12896 12897 return 0; 12898 } 12899 12900 static int validate_nan_filter(struct nlattr *filter_attr) 12901 { 12902 struct nlattr *attr; 12903 int len = 0, n_entries = 0, rem; 12904 12905 nla_for_each_nested(attr, filter_attr, rem) { 12906 len += nla_len(attr); 12907 n_entries++; 12908 } 12909 12910 if (len >= U8_MAX) 12911 return -EINVAL; 12912 12913 return n_entries; 12914 } 12915 12916 static int handle_nan_filter(struct nlattr *attr_filter, 12917 struct cfg80211_nan_func *func, 12918 bool tx) 12919 { 12920 struct nlattr *attr; 12921 int n_entries, rem, i; 12922 struct cfg80211_nan_func_filter *filter; 12923 12924 n_entries = validate_nan_filter(attr_filter); 12925 if (n_entries < 0) 12926 return n_entries; 12927 12928 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 12929 12930 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 12931 if (!filter) 12932 return -ENOMEM; 12933 12934 i = 0; 12935 nla_for_each_nested(attr, attr_filter, rem) { 12936 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 12937 filter[i].len = nla_len(attr); 12938 i++; 12939 } 12940 if (tx) { 12941 func->num_tx_filters = n_entries; 12942 func->tx_filters = filter; 12943 } else { 12944 func->num_rx_filters = n_entries; 12945 func->rx_filters = filter; 12946 } 12947 12948 return 0; 12949 } 12950 12951 static int nl80211_nan_add_func(struct sk_buff *skb, 12952 struct genl_info *info) 12953 { 12954 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12955 struct wireless_dev *wdev = info->user_ptr[1]; 12956 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 12957 struct cfg80211_nan_func *func; 12958 struct sk_buff *msg = NULL; 12959 void *hdr = NULL; 12960 int err = 0; 12961 12962 if (wdev->iftype != NL80211_IFTYPE_NAN) 12963 return -EOPNOTSUPP; 12964 12965 if (!wdev_running(wdev)) 12966 return -ENOTCONN; 12967 12968 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 12969 return -EINVAL; 12970 12971 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 12972 info->attrs[NL80211_ATTR_NAN_FUNC], 12973 nl80211_nan_func_policy, 12974 info->extack); 12975 if (err) 12976 return err; 12977 12978 func = kzalloc(sizeof(*func), GFP_KERNEL); 12979 if (!func) 12980 return -ENOMEM; 12981 12982 func->cookie = cfg80211_assign_cookie(rdev); 12983 12984 if (!tb[NL80211_NAN_FUNC_TYPE]) { 12985 err = -EINVAL; 12986 goto out; 12987 } 12988 12989 12990 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 12991 12992 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 12993 err = -EINVAL; 12994 goto out; 12995 } 12996 12997 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 12998 sizeof(func->service_id)); 12999 13000 func->close_range = 13001 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 13002 13003 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 13004 func->serv_spec_info_len = 13005 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 13006 func->serv_spec_info = 13007 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 13008 func->serv_spec_info_len, 13009 GFP_KERNEL); 13010 if (!func->serv_spec_info) { 13011 err = -ENOMEM; 13012 goto out; 13013 } 13014 } 13015 13016 if (tb[NL80211_NAN_FUNC_TTL]) 13017 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 13018 13019 switch (func->type) { 13020 case NL80211_NAN_FUNC_PUBLISH: 13021 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 13022 err = -EINVAL; 13023 goto out; 13024 } 13025 13026 func->publish_type = 13027 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 13028 func->publish_bcast = 13029 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 13030 13031 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 13032 func->publish_bcast) { 13033 err = -EINVAL; 13034 goto out; 13035 } 13036 break; 13037 case NL80211_NAN_FUNC_SUBSCRIBE: 13038 func->subscribe_active = 13039 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 13040 break; 13041 case NL80211_NAN_FUNC_FOLLOW_UP: 13042 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 13043 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 13044 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 13045 err = -EINVAL; 13046 goto out; 13047 } 13048 13049 func->followup_id = 13050 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 13051 func->followup_reqid = 13052 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 13053 memcpy(func->followup_dest.addr, 13054 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 13055 sizeof(func->followup_dest.addr)); 13056 if (func->ttl) { 13057 err = -EINVAL; 13058 goto out; 13059 } 13060 break; 13061 default: 13062 err = -EINVAL; 13063 goto out; 13064 } 13065 13066 if (tb[NL80211_NAN_FUNC_SRF]) { 13067 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 13068 13069 err = nla_parse_nested_deprecated(srf_tb, 13070 NL80211_NAN_SRF_ATTR_MAX, 13071 tb[NL80211_NAN_FUNC_SRF], 13072 nl80211_nan_srf_policy, 13073 info->extack); 13074 if (err) 13075 goto out; 13076 13077 func->srf_include = 13078 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 13079 13080 if (srf_tb[NL80211_NAN_SRF_BF]) { 13081 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 13082 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 13083 err = -EINVAL; 13084 goto out; 13085 } 13086 13087 func->srf_bf_len = 13088 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 13089 func->srf_bf = 13090 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 13091 func->srf_bf_len, GFP_KERNEL); 13092 if (!func->srf_bf) { 13093 err = -ENOMEM; 13094 goto out; 13095 } 13096 13097 func->srf_bf_idx = 13098 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 13099 } else { 13100 struct nlattr *attr, *mac_attr = 13101 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 13102 int n_entries, rem, i = 0; 13103 13104 if (!mac_attr) { 13105 err = -EINVAL; 13106 goto out; 13107 } 13108 13109 n_entries = validate_acl_mac_addrs(mac_attr); 13110 if (n_entries <= 0) { 13111 err = -EINVAL; 13112 goto out; 13113 } 13114 13115 func->srf_num_macs = n_entries; 13116 func->srf_macs = 13117 kcalloc(n_entries, sizeof(*func->srf_macs), 13118 GFP_KERNEL); 13119 if (!func->srf_macs) { 13120 err = -ENOMEM; 13121 goto out; 13122 } 13123 13124 nla_for_each_nested(attr, mac_attr, rem) 13125 memcpy(func->srf_macs[i++].addr, nla_data(attr), 13126 sizeof(*func->srf_macs)); 13127 } 13128 } 13129 13130 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 13131 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 13132 func, true); 13133 if (err) 13134 goto out; 13135 } 13136 13137 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 13138 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 13139 func, false); 13140 if (err) 13141 goto out; 13142 } 13143 13144 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13145 if (!msg) { 13146 err = -ENOMEM; 13147 goto out; 13148 } 13149 13150 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13151 NL80211_CMD_ADD_NAN_FUNCTION); 13152 /* This can't really happen - we just allocated 4KB */ 13153 if (WARN_ON(!hdr)) { 13154 err = -ENOMEM; 13155 goto out; 13156 } 13157 13158 err = rdev_add_nan_func(rdev, wdev, func); 13159 out: 13160 if (err < 0) { 13161 cfg80211_free_nan_func(func); 13162 nlmsg_free(msg); 13163 return err; 13164 } 13165 13166 /* propagate the instance id and cookie to userspace */ 13167 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 13168 NL80211_ATTR_PAD)) 13169 goto nla_put_failure; 13170 13171 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13172 if (!func_attr) 13173 goto nla_put_failure; 13174 13175 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 13176 func->instance_id)) 13177 goto nla_put_failure; 13178 13179 nla_nest_end(msg, func_attr); 13180 13181 genlmsg_end(msg, hdr); 13182 return genlmsg_reply(msg, info); 13183 13184 nla_put_failure: 13185 nlmsg_free(msg); 13186 return -ENOBUFS; 13187 } 13188 13189 static int nl80211_nan_del_func(struct sk_buff *skb, 13190 struct genl_info *info) 13191 { 13192 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13193 struct wireless_dev *wdev = info->user_ptr[1]; 13194 u64 cookie; 13195 13196 if (wdev->iftype != NL80211_IFTYPE_NAN) 13197 return -EOPNOTSUPP; 13198 13199 if (!wdev_running(wdev)) 13200 return -ENOTCONN; 13201 13202 if (!info->attrs[NL80211_ATTR_COOKIE]) 13203 return -EINVAL; 13204 13205 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 13206 13207 rdev_del_nan_func(rdev, wdev, cookie); 13208 13209 return 0; 13210 } 13211 13212 static int nl80211_nan_change_config(struct sk_buff *skb, 13213 struct genl_info *info) 13214 { 13215 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13216 struct wireless_dev *wdev = info->user_ptr[1]; 13217 struct cfg80211_nan_conf conf = {}; 13218 u32 changed = 0; 13219 13220 if (wdev->iftype != NL80211_IFTYPE_NAN) 13221 return -EOPNOTSUPP; 13222 13223 if (!wdev_running(wdev)) 13224 return -ENOTCONN; 13225 13226 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 13227 conf.master_pref = 13228 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 13229 if (conf.master_pref <= 1 || conf.master_pref == 255) 13230 return -EINVAL; 13231 13232 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 13233 } 13234 13235 if (info->attrs[NL80211_ATTR_BANDS]) { 13236 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 13237 13238 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 13239 return -EOPNOTSUPP; 13240 13241 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 13242 return -EINVAL; 13243 13244 conf.bands = bands; 13245 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 13246 } 13247 13248 if (!changed) 13249 return -EINVAL; 13250 13251 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 13252 } 13253 13254 void cfg80211_nan_match(struct wireless_dev *wdev, 13255 struct cfg80211_nan_match_params *match, gfp_t gfp) 13256 { 13257 struct wiphy *wiphy = wdev->wiphy; 13258 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13259 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 13260 struct sk_buff *msg; 13261 void *hdr; 13262 13263 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 13264 return; 13265 13266 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13267 if (!msg) 13268 return; 13269 13270 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 13271 if (!hdr) { 13272 nlmsg_free(msg); 13273 return; 13274 } 13275 13276 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13277 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13278 wdev->netdev->ifindex)) || 13279 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13280 NL80211_ATTR_PAD)) 13281 goto nla_put_failure; 13282 13283 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 13284 NL80211_ATTR_PAD) || 13285 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 13286 goto nla_put_failure; 13287 13288 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 13289 if (!match_attr) 13290 goto nla_put_failure; 13291 13292 local_func_attr = nla_nest_start_noflag(msg, 13293 NL80211_NAN_MATCH_FUNC_LOCAL); 13294 if (!local_func_attr) 13295 goto nla_put_failure; 13296 13297 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 13298 goto nla_put_failure; 13299 13300 nla_nest_end(msg, local_func_attr); 13301 13302 peer_func_attr = nla_nest_start_noflag(msg, 13303 NL80211_NAN_MATCH_FUNC_PEER); 13304 if (!peer_func_attr) 13305 goto nla_put_failure; 13306 13307 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 13308 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 13309 goto nla_put_failure; 13310 13311 if (match->info && match->info_len && 13312 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 13313 match->info)) 13314 goto nla_put_failure; 13315 13316 nla_nest_end(msg, peer_func_attr); 13317 nla_nest_end(msg, match_attr); 13318 genlmsg_end(msg, hdr); 13319 13320 if (!wdev->owner_nlportid) 13321 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13322 msg, 0, NL80211_MCGRP_NAN, gfp); 13323 else 13324 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13325 wdev->owner_nlportid); 13326 13327 return; 13328 13329 nla_put_failure: 13330 nlmsg_free(msg); 13331 } 13332 EXPORT_SYMBOL(cfg80211_nan_match); 13333 13334 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 13335 u8 inst_id, 13336 enum nl80211_nan_func_term_reason reason, 13337 u64 cookie, gfp_t gfp) 13338 { 13339 struct wiphy *wiphy = wdev->wiphy; 13340 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13341 struct sk_buff *msg; 13342 struct nlattr *func_attr; 13343 void *hdr; 13344 13345 if (WARN_ON(!inst_id)) 13346 return; 13347 13348 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13349 if (!msg) 13350 return; 13351 13352 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 13353 if (!hdr) { 13354 nlmsg_free(msg); 13355 return; 13356 } 13357 13358 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13359 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13360 wdev->netdev->ifindex)) || 13361 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13362 NL80211_ATTR_PAD)) 13363 goto nla_put_failure; 13364 13365 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 13366 NL80211_ATTR_PAD)) 13367 goto nla_put_failure; 13368 13369 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13370 if (!func_attr) 13371 goto nla_put_failure; 13372 13373 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 13374 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 13375 goto nla_put_failure; 13376 13377 nla_nest_end(msg, func_attr); 13378 genlmsg_end(msg, hdr); 13379 13380 if (!wdev->owner_nlportid) 13381 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13382 msg, 0, NL80211_MCGRP_NAN, gfp); 13383 else 13384 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13385 wdev->owner_nlportid); 13386 13387 return; 13388 13389 nla_put_failure: 13390 nlmsg_free(msg); 13391 } 13392 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 13393 13394 static int nl80211_get_protocol_features(struct sk_buff *skb, 13395 struct genl_info *info) 13396 { 13397 void *hdr; 13398 struct sk_buff *msg; 13399 13400 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13401 if (!msg) 13402 return -ENOMEM; 13403 13404 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13405 NL80211_CMD_GET_PROTOCOL_FEATURES); 13406 if (!hdr) 13407 goto nla_put_failure; 13408 13409 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 13410 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 13411 goto nla_put_failure; 13412 13413 genlmsg_end(msg, hdr); 13414 return genlmsg_reply(msg, info); 13415 13416 nla_put_failure: 13417 kfree_skb(msg); 13418 return -ENOBUFS; 13419 } 13420 13421 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 13422 { 13423 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13424 struct cfg80211_update_ft_ies_params ft_params; 13425 struct net_device *dev = info->user_ptr[1]; 13426 13427 if (!rdev->ops->update_ft_ies) 13428 return -EOPNOTSUPP; 13429 13430 if (!info->attrs[NL80211_ATTR_MDID] || 13431 !info->attrs[NL80211_ATTR_IE]) 13432 return -EINVAL; 13433 13434 memset(&ft_params, 0, sizeof(ft_params)); 13435 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 13436 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 13437 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 13438 13439 return rdev_update_ft_ies(rdev, dev, &ft_params); 13440 } 13441 13442 static int nl80211_crit_protocol_start(struct sk_buff *skb, 13443 struct genl_info *info) 13444 { 13445 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13446 struct wireless_dev *wdev = info->user_ptr[1]; 13447 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 13448 u16 duration; 13449 int ret; 13450 13451 if (!rdev->ops->crit_proto_start) 13452 return -EOPNOTSUPP; 13453 13454 if (WARN_ON(!rdev->ops->crit_proto_stop)) 13455 return -EINVAL; 13456 13457 if (rdev->crit_proto_nlportid) 13458 return -EBUSY; 13459 13460 /* determine protocol if provided */ 13461 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 13462 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 13463 13464 if (proto >= NUM_NL80211_CRIT_PROTO) 13465 return -EINVAL; 13466 13467 /* timeout must be provided */ 13468 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 13469 return -EINVAL; 13470 13471 duration = 13472 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 13473 13474 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 13475 if (!ret) 13476 rdev->crit_proto_nlportid = info->snd_portid; 13477 13478 return ret; 13479 } 13480 13481 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 13482 struct genl_info *info) 13483 { 13484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13485 struct wireless_dev *wdev = info->user_ptr[1]; 13486 13487 if (!rdev->ops->crit_proto_stop) 13488 return -EOPNOTSUPP; 13489 13490 if (rdev->crit_proto_nlportid) { 13491 rdev->crit_proto_nlportid = 0; 13492 rdev_crit_proto_stop(rdev, wdev); 13493 } 13494 return 0; 13495 } 13496 13497 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 13498 struct nlattr *attr, 13499 struct netlink_ext_ack *extack) 13500 { 13501 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 13502 if (attr->nla_type & NLA_F_NESTED) { 13503 NL_SET_ERR_MSG_ATTR(extack, attr, 13504 "unexpected nested data"); 13505 return -EINVAL; 13506 } 13507 13508 return 0; 13509 } 13510 13511 if (!(attr->nla_type & NLA_F_NESTED)) { 13512 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 13513 return -EINVAL; 13514 } 13515 13516 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 13517 } 13518 13519 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 13520 { 13521 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13522 struct wireless_dev *wdev = 13523 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 13524 int i, err; 13525 u32 vid, subcmd; 13526 13527 if (!rdev->wiphy.vendor_commands) 13528 return -EOPNOTSUPP; 13529 13530 if (IS_ERR(wdev)) { 13531 err = PTR_ERR(wdev); 13532 if (err != -EINVAL) 13533 return err; 13534 wdev = NULL; 13535 } else if (wdev->wiphy != &rdev->wiphy) { 13536 return -EINVAL; 13537 } 13538 13539 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 13540 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 13541 return -EINVAL; 13542 13543 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 13544 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 13545 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 13546 const struct wiphy_vendor_command *vcmd; 13547 void *data = NULL; 13548 int len = 0; 13549 13550 vcmd = &rdev->wiphy.vendor_commands[i]; 13551 13552 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13553 continue; 13554 13555 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13556 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13557 if (!wdev) 13558 return -EINVAL; 13559 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13560 !wdev->netdev) 13561 return -EINVAL; 13562 13563 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13564 if (!wdev_running(wdev)) 13565 return -ENETDOWN; 13566 } 13567 } else { 13568 wdev = NULL; 13569 } 13570 13571 if (!vcmd->doit) 13572 return -EOPNOTSUPP; 13573 13574 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 13575 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13576 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13577 13578 err = nl80211_vendor_check_policy(vcmd, 13579 info->attrs[NL80211_ATTR_VENDOR_DATA], 13580 info->extack); 13581 if (err) 13582 return err; 13583 } 13584 13585 rdev->cur_cmd_info = info; 13586 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 13587 rdev->cur_cmd_info = NULL; 13588 return err; 13589 } 13590 13591 return -EOPNOTSUPP; 13592 } 13593 13594 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 13595 struct netlink_callback *cb, 13596 struct cfg80211_registered_device **rdev, 13597 struct wireless_dev **wdev) 13598 { 13599 struct nlattr **attrbuf; 13600 u32 vid, subcmd; 13601 unsigned int i; 13602 int vcmd_idx = -1; 13603 int err; 13604 void *data = NULL; 13605 unsigned int data_len = 0; 13606 13607 if (cb->args[0]) { 13608 /* subtract the 1 again here */ 13609 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 13610 struct wireless_dev *tmp; 13611 13612 if (!wiphy) 13613 return -ENODEV; 13614 *rdev = wiphy_to_rdev(wiphy); 13615 *wdev = NULL; 13616 13617 if (cb->args[1]) { 13618 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 13619 if (tmp->identifier == cb->args[1] - 1) { 13620 *wdev = tmp; 13621 break; 13622 } 13623 } 13624 } 13625 13626 /* keep rtnl locked in successful case */ 13627 return 0; 13628 } 13629 13630 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 13631 if (!attrbuf) 13632 return -ENOMEM; 13633 13634 err = nlmsg_parse_deprecated(cb->nlh, 13635 GENL_HDRLEN + nl80211_fam.hdrsize, 13636 attrbuf, nl80211_fam.maxattr, 13637 nl80211_policy, NULL); 13638 if (err) 13639 goto out; 13640 13641 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 13642 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 13643 err = -EINVAL; 13644 goto out; 13645 } 13646 13647 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 13648 if (IS_ERR(*wdev)) 13649 *wdev = NULL; 13650 13651 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 13652 if (IS_ERR(*rdev)) { 13653 err = PTR_ERR(*rdev); 13654 goto out; 13655 } 13656 13657 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 13658 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 13659 13660 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 13661 const struct wiphy_vendor_command *vcmd; 13662 13663 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 13664 13665 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13666 continue; 13667 13668 if (!vcmd->dumpit) { 13669 err = -EOPNOTSUPP; 13670 goto out; 13671 } 13672 13673 vcmd_idx = i; 13674 break; 13675 } 13676 13677 if (vcmd_idx < 0) { 13678 err = -EOPNOTSUPP; 13679 goto out; 13680 } 13681 13682 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 13683 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13684 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13685 13686 err = nl80211_vendor_check_policy( 13687 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 13688 attrbuf[NL80211_ATTR_VENDOR_DATA], 13689 cb->extack); 13690 if (err) 13691 goto out; 13692 } 13693 13694 /* 0 is the first index - add 1 to parse only once */ 13695 cb->args[0] = (*rdev)->wiphy_idx + 1; 13696 /* add 1 to know if it was NULL */ 13697 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 13698 cb->args[2] = vcmd_idx; 13699 cb->args[3] = (unsigned long)data; 13700 cb->args[4] = data_len; 13701 13702 /* keep rtnl locked in successful case */ 13703 err = 0; 13704 out: 13705 kfree(attrbuf); 13706 return err; 13707 } 13708 13709 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 13710 struct netlink_callback *cb) 13711 { 13712 struct cfg80211_registered_device *rdev; 13713 struct wireless_dev *wdev; 13714 unsigned int vcmd_idx; 13715 const struct wiphy_vendor_command *vcmd; 13716 void *data; 13717 int data_len; 13718 int err; 13719 struct nlattr *vendor_data; 13720 13721 rtnl_lock(); 13722 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 13723 if (err) 13724 goto out; 13725 13726 vcmd_idx = cb->args[2]; 13727 data = (void *)cb->args[3]; 13728 data_len = cb->args[4]; 13729 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 13730 13731 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13732 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13733 if (!wdev) { 13734 err = -EINVAL; 13735 goto out; 13736 } 13737 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13738 !wdev->netdev) { 13739 err = -EINVAL; 13740 goto out; 13741 } 13742 13743 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13744 if (!wdev_running(wdev)) { 13745 err = -ENETDOWN; 13746 goto out; 13747 } 13748 } 13749 } 13750 13751 while (1) { 13752 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 13753 cb->nlh->nlmsg_seq, NLM_F_MULTI, 13754 NL80211_CMD_VENDOR); 13755 if (!hdr) 13756 break; 13757 13758 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13759 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 13760 wdev_id(wdev), 13761 NL80211_ATTR_PAD))) { 13762 genlmsg_cancel(skb, hdr); 13763 break; 13764 } 13765 13766 vendor_data = nla_nest_start_noflag(skb, 13767 NL80211_ATTR_VENDOR_DATA); 13768 if (!vendor_data) { 13769 genlmsg_cancel(skb, hdr); 13770 break; 13771 } 13772 13773 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 13774 (unsigned long *)&cb->args[5]); 13775 nla_nest_end(skb, vendor_data); 13776 13777 if (err == -ENOBUFS || err == -ENOENT) { 13778 genlmsg_cancel(skb, hdr); 13779 break; 13780 } else if (err <= 0) { 13781 genlmsg_cancel(skb, hdr); 13782 goto out; 13783 } 13784 13785 genlmsg_end(skb, hdr); 13786 } 13787 13788 err = skb->len; 13789 out: 13790 rtnl_unlock(); 13791 return err; 13792 } 13793 13794 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 13795 enum nl80211_commands cmd, 13796 enum nl80211_attrs attr, 13797 int approxlen) 13798 { 13799 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13800 13801 if (WARN_ON(!rdev->cur_cmd_info)) 13802 return NULL; 13803 13804 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 13805 rdev->cur_cmd_info->snd_portid, 13806 rdev->cur_cmd_info->snd_seq, 13807 cmd, attr, NULL, GFP_KERNEL); 13808 } 13809 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 13810 13811 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 13812 { 13813 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 13814 void *hdr = ((void **)skb->cb)[1]; 13815 struct nlattr *data = ((void **)skb->cb)[2]; 13816 13817 /* clear CB data for netlink core to own from now on */ 13818 memset(skb->cb, 0, sizeof(skb->cb)); 13819 13820 if (WARN_ON(!rdev->cur_cmd_info)) { 13821 kfree_skb(skb); 13822 return -EINVAL; 13823 } 13824 13825 nla_nest_end(skb, data); 13826 genlmsg_end(skb, hdr); 13827 return genlmsg_reply(skb, rdev->cur_cmd_info); 13828 } 13829 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 13830 13831 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 13832 { 13833 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13834 13835 if (WARN_ON(!rdev->cur_cmd_info)) 13836 return 0; 13837 13838 return rdev->cur_cmd_info->snd_portid; 13839 } 13840 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 13841 13842 static int nl80211_set_qos_map(struct sk_buff *skb, 13843 struct genl_info *info) 13844 { 13845 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13846 struct cfg80211_qos_map *qos_map = NULL; 13847 struct net_device *dev = info->user_ptr[1]; 13848 u8 *pos, len, num_des, des_len, des; 13849 int ret; 13850 13851 if (!rdev->ops->set_qos_map) 13852 return -EOPNOTSUPP; 13853 13854 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 13855 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 13856 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 13857 13858 if (len % 2) 13859 return -EINVAL; 13860 13861 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 13862 if (!qos_map) 13863 return -ENOMEM; 13864 13865 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 13866 if (num_des) { 13867 des_len = num_des * 13868 sizeof(struct cfg80211_dscp_exception); 13869 memcpy(qos_map->dscp_exception, pos, des_len); 13870 qos_map->num_des = num_des; 13871 for (des = 0; des < num_des; des++) { 13872 if (qos_map->dscp_exception[des].up > 7) { 13873 kfree(qos_map); 13874 return -EINVAL; 13875 } 13876 } 13877 pos += des_len; 13878 } 13879 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 13880 } 13881 13882 wdev_lock(dev->ieee80211_ptr); 13883 ret = nl80211_key_allowed(dev->ieee80211_ptr); 13884 if (!ret) 13885 ret = rdev_set_qos_map(rdev, dev, qos_map); 13886 wdev_unlock(dev->ieee80211_ptr); 13887 13888 kfree(qos_map); 13889 return ret; 13890 } 13891 13892 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 13893 { 13894 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13895 struct net_device *dev = info->user_ptr[1]; 13896 struct wireless_dev *wdev = dev->ieee80211_ptr; 13897 const u8 *peer; 13898 u8 tsid, up; 13899 u16 admitted_time = 0; 13900 int err; 13901 13902 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 13903 return -EOPNOTSUPP; 13904 13905 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 13906 !info->attrs[NL80211_ATTR_USER_PRIO]) 13907 return -EINVAL; 13908 13909 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13910 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 13911 13912 /* WMM uses TIDs 0-7 even for TSPEC */ 13913 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 13914 /* TODO: handle 802.11 TSPEC/admission control 13915 * need more attributes for that (e.g. BA session requirement); 13916 * change the WMM adminssion test above to allow both then 13917 */ 13918 return -EINVAL; 13919 } 13920 13921 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13922 13923 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 13924 admitted_time = 13925 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 13926 if (!admitted_time) 13927 return -EINVAL; 13928 } 13929 13930 wdev_lock(wdev); 13931 switch (wdev->iftype) { 13932 case NL80211_IFTYPE_STATION: 13933 case NL80211_IFTYPE_P2P_CLIENT: 13934 if (wdev->current_bss) 13935 break; 13936 err = -ENOTCONN; 13937 goto out; 13938 default: 13939 err = -EOPNOTSUPP; 13940 goto out; 13941 } 13942 13943 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 13944 13945 out: 13946 wdev_unlock(wdev); 13947 return err; 13948 } 13949 13950 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 13951 { 13952 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13953 struct net_device *dev = info->user_ptr[1]; 13954 struct wireless_dev *wdev = dev->ieee80211_ptr; 13955 const u8 *peer; 13956 u8 tsid; 13957 int err; 13958 13959 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 13960 return -EINVAL; 13961 13962 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13963 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13964 13965 wdev_lock(wdev); 13966 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 13967 wdev_unlock(wdev); 13968 13969 return err; 13970 } 13971 13972 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 13973 struct genl_info *info) 13974 { 13975 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13976 struct net_device *dev = info->user_ptr[1]; 13977 struct wireless_dev *wdev = dev->ieee80211_ptr; 13978 struct cfg80211_chan_def chandef = {}; 13979 const u8 *addr; 13980 u8 oper_class; 13981 int err; 13982 13983 if (!rdev->ops->tdls_channel_switch || 13984 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 13985 return -EOPNOTSUPP; 13986 13987 switch (dev->ieee80211_ptr->iftype) { 13988 case NL80211_IFTYPE_STATION: 13989 case NL80211_IFTYPE_P2P_CLIENT: 13990 break; 13991 default: 13992 return -EOPNOTSUPP; 13993 } 13994 13995 if (!info->attrs[NL80211_ATTR_MAC] || 13996 !info->attrs[NL80211_ATTR_OPER_CLASS]) 13997 return -EINVAL; 13998 13999 err = nl80211_parse_chandef(rdev, info, &chandef); 14000 if (err) 14001 return err; 14002 14003 /* 14004 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 14005 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 14006 * specification is not defined for them. 14007 */ 14008 if (chandef.chan->band == NL80211_BAND_2GHZ && 14009 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 14010 chandef.width != NL80211_CHAN_WIDTH_20) 14011 return -EINVAL; 14012 14013 /* we will be active on the TDLS link */ 14014 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 14015 wdev->iftype)) 14016 return -EINVAL; 14017 14018 /* don't allow switching to DFS channels */ 14019 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 14020 return -EINVAL; 14021 14022 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14023 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 14024 14025 wdev_lock(wdev); 14026 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 14027 wdev_unlock(wdev); 14028 14029 return err; 14030 } 14031 14032 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 14033 struct genl_info *info) 14034 { 14035 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14036 struct net_device *dev = info->user_ptr[1]; 14037 struct wireless_dev *wdev = dev->ieee80211_ptr; 14038 const u8 *addr; 14039 14040 if (!rdev->ops->tdls_channel_switch || 14041 !rdev->ops->tdls_cancel_channel_switch || 14042 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 14043 return -EOPNOTSUPP; 14044 14045 switch (dev->ieee80211_ptr->iftype) { 14046 case NL80211_IFTYPE_STATION: 14047 case NL80211_IFTYPE_P2P_CLIENT: 14048 break; 14049 default: 14050 return -EOPNOTSUPP; 14051 } 14052 14053 if (!info->attrs[NL80211_ATTR_MAC]) 14054 return -EINVAL; 14055 14056 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14057 14058 wdev_lock(wdev); 14059 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 14060 wdev_unlock(wdev); 14061 14062 return 0; 14063 } 14064 14065 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 14066 struct genl_info *info) 14067 { 14068 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14069 struct net_device *dev = info->user_ptr[1]; 14070 struct wireless_dev *wdev = dev->ieee80211_ptr; 14071 const struct nlattr *nla; 14072 bool enabled; 14073 14074 if (!rdev->ops->set_multicast_to_unicast) 14075 return -EOPNOTSUPP; 14076 14077 if (wdev->iftype != NL80211_IFTYPE_AP && 14078 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14079 return -EOPNOTSUPP; 14080 14081 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 14082 enabled = nla_get_flag(nla); 14083 14084 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 14085 } 14086 14087 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 14088 { 14089 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14090 struct net_device *dev = info->user_ptr[1]; 14091 struct wireless_dev *wdev = dev->ieee80211_ptr; 14092 struct cfg80211_pmk_conf pmk_conf = {}; 14093 int ret; 14094 14095 if (wdev->iftype != NL80211_IFTYPE_STATION && 14096 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14097 return -EOPNOTSUPP; 14098 14099 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14100 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14101 return -EOPNOTSUPP; 14102 14103 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 14104 return -EINVAL; 14105 14106 wdev_lock(wdev); 14107 if (!wdev->current_bss) { 14108 ret = -ENOTCONN; 14109 goto out; 14110 } 14111 14112 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14113 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 14114 ret = -EINVAL; 14115 goto out; 14116 } 14117 14118 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 14119 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 14120 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 14121 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 14122 ret = -EINVAL; 14123 goto out; 14124 } 14125 14126 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 14127 pmk_conf.pmk_r0_name = 14128 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 14129 14130 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 14131 out: 14132 wdev_unlock(wdev); 14133 return ret; 14134 } 14135 14136 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 14137 { 14138 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14139 struct net_device *dev = info->user_ptr[1]; 14140 struct wireless_dev *wdev = dev->ieee80211_ptr; 14141 const u8 *aa; 14142 int ret; 14143 14144 if (wdev->iftype != NL80211_IFTYPE_STATION && 14145 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14146 return -EOPNOTSUPP; 14147 14148 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14149 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14150 return -EOPNOTSUPP; 14151 14152 if (!info->attrs[NL80211_ATTR_MAC]) 14153 return -EINVAL; 14154 14155 wdev_lock(wdev); 14156 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14157 ret = rdev_del_pmk(rdev, dev, aa); 14158 wdev_unlock(wdev); 14159 14160 return ret; 14161 } 14162 14163 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 14164 { 14165 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14166 struct net_device *dev = info->user_ptr[1]; 14167 struct cfg80211_external_auth_params params; 14168 14169 if (!rdev->ops->external_auth) 14170 return -EOPNOTSUPP; 14171 14172 if (!info->attrs[NL80211_ATTR_SSID] && 14173 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 14174 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 14175 return -EINVAL; 14176 14177 if (!info->attrs[NL80211_ATTR_BSSID]) 14178 return -EINVAL; 14179 14180 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 14181 return -EINVAL; 14182 14183 memset(¶ms, 0, sizeof(params)); 14184 14185 if (info->attrs[NL80211_ATTR_SSID]) { 14186 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 14187 if (params.ssid.ssid_len == 0) 14188 return -EINVAL; 14189 memcpy(params.ssid.ssid, 14190 nla_data(info->attrs[NL80211_ATTR_SSID]), 14191 params.ssid.ssid_len); 14192 } 14193 14194 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 14195 ETH_ALEN); 14196 14197 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14198 14199 if (info->attrs[NL80211_ATTR_PMKID]) 14200 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 14201 14202 return rdev_external_auth(rdev, dev, ¶ms); 14203 } 14204 14205 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 14206 { 14207 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 14208 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14209 struct net_device *dev = info->user_ptr[1]; 14210 struct wireless_dev *wdev = dev->ieee80211_ptr; 14211 const u8 *buf; 14212 size_t len; 14213 u8 *dest; 14214 u16 proto; 14215 bool noencrypt; 14216 u64 cookie = 0; 14217 int err; 14218 14219 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14220 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 14221 return -EOPNOTSUPP; 14222 14223 if (!rdev->ops->tx_control_port) 14224 return -EOPNOTSUPP; 14225 14226 if (!info->attrs[NL80211_ATTR_FRAME] || 14227 !info->attrs[NL80211_ATTR_MAC] || 14228 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 14229 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 14230 return -EINVAL; 14231 } 14232 14233 wdev_lock(wdev); 14234 14235 switch (wdev->iftype) { 14236 case NL80211_IFTYPE_AP: 14237 case NL80211_IFTYPE_P2P_GO: 14238 case NL80211_IFTYPE_MESH_POINT: 14239 break; 14240 case NL80211_IFTYPE_ADHOC: 14241 case NL80211_IFTYPE_STATION: 14242 case NL80211_IFTYPE_P2P_CLIENT: 14243 if (wdev->current_bss) 14244 break; 14245 err = -ENOTCONN; 14246 goto out; 14247 default: 14248 err = -EOPNOTSUPP; 14249 goto out; 14250 } 14251 14252 wdev_unlock(wdev); 14253 14254 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14255 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14256 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14257 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 14258 noencrypt = 14259 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 14260 14261 err = rdev_tx_control_port(rdev, dev, buf, len, 14262 dest, cpu_to_be16(proto), noencrypt, 14263 dont_wait_for_ack ? NULL : &cookie); 14264 if (!err && !dont_wait_for_ack) 14265 nl_set_extack_cookie_u64(info->extack, cookie); 14266 return err; 14267 out: 14268 wdev_unlock(wdev); 14269 return err; 14270 } 14271 14272 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 14273 struct genl_info *info) 14274 { 14275 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14276 struct net_device *dev = info->user_ptr[1]; 14277 struct wireless_dev *wdev = dev->ieee80211_ptr; 14278 struct cfg80211_ftm_responder_stats ftm_stats = {}; 14279 struct sk_buff *msg; 14280 void *hdr; 14281 struct nlattr *ftm_stats_attr; 14282 int err; 14283 14284 if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval) 14285 return -EOPNOTSUPP; 14286 14287 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 14288 if (err) 14289 return err; 14290 14291 if (!ftm_stats.filled) 14292 return -ENODATA; 14293 14294 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14295 if (!msg) 14296 return -ENOMEM; 14297 14298 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14299 NL80211_CMD_GET_FTM_RESPONDER_STATS); 14300 if (!hdr) 14301 goto nla_put_failure; 14302 14303 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14304 goto nla_put_failure; 14305 14306 ftm_stats_attr = nla_nest_start_noflag(msg, 14307 NL80211_ATTR_FTM_RESPONDER_STATS); 14308 if (!ftm_stats_attr) 14309 goto nla_put_failure; 14310 14311 #define SET_FTM(field, name, type) \ 14312 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14313 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 14314 ftm_stats.field)) \ 14315 goto nla_put_failure; } while (0) 14316 #define SET_FTM_U64(field, name) \ 14317 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14318 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 14319 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 14320 goto nla_put_failure; } while (0) 14321 14322 SET_FTM(success_num, SUCCESS_NUM, u32); 14323 SET_FTM(partial_num, PARTIAL_NUM, u32); 14324 SET_FTM(failed_num, FAILED_NUM, u32); 14325 SET_FTM(asap_num, ASAP_NUM, u32); 14326 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 14327 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 14328 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 14329 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 14330 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 14331 #undef SET_FTM 14332 14333 nla_nest_end(msg, ftm_stats_attr); 14334 14335 genlmsg_end(msg, hdr); 14336 return genlmsg_reply(msg, info); 14337 14338 nla_put_failure: 14339 nlmsg_free(msg); 14340 return -ENOBUFS; 14341 } 14342 14343 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 14344 { 14345 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14346 struct cfg80211_update_owe_info owe_info; 14347 struct net_device *dev = info->user_ptr[1]; 14348 14349 if (!rdev->ops->update_owe_info) 14350 return -EOPNOTSUPP; 14351 14352 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 14353 !info->attrs[NL80211_ATTR_MAC]) 14354 return -EINVAL; 14355 14356 memset(&owe_info, 0, sizeof(owe_info)); 14357 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14358 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 14359 14360 if (info->attrs[NL80211_ATTR_IE]) { 14361 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14362 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14363 } 14364 14365 return rdev_update_owe_info(rdev, dev, &owe_info); 14366 } 14367 14368 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 14369 { 14370 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14371 struct net_device *dev = info->user_ptr[1]; 14372 struct wireless_dev *wdev = dev->ieee80211_ptr; 14373 struct station_info sinfo = {}; 14374 const u8 *buf; 14375 size_t len; 14376 u8 *dest; 14377 int err; 14378 14379 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 14380 return -EOPNOTSUPP; 14381 14382 if (!info->attrs[NL80211_ATTR_MAC] || 14383 !info->attrs[NL80211_ATTR_FRAME]) { 14384 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 14385 return -EINVAL; 14386 } 14387 14388 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 14389 return -EOPNOTSUPP; 14390 14391 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14392 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14393 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14394 14395 if (len < sizeof(struct ethhdr)) 14396 return -EINVAL; 14397 14398 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 14399 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 14400 return -EINVAL; 14401 14402 err = rdev_get_station(rdev, dev, dest, &sinfo); 14403 if (err) 14404 return err; 14405 14406 cfg80211_sinfo_release_content(&sinfo); 14407 14408 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 14409 } 14410 14411 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 14412 struct nlattr *attrs[], struct net_device *dev, 14413 struct cfg80211_tid_cfg *tid_conf, 14414 struct genl_info *info, const u8 *peer) 14415 { 14416 struct netlink_ext_ack *extack = info->extack; 14417 u64 mask; 14418 int err; 14419 14420 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 14421 return -EINVAL; 14422 14423 tid_conf->config_override = 14424 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 14425 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 14426 14427 if (tid_conf->config_override) { 14428 if (rdev->ops->reset_tid_config) { 14429 err = rdev_reset_tid_config(rdev, dev, peer, 14430 tid_conf->tids); 14431 if (err) 14432 return err; 14433 } else { 14434 return -EINVAL; 14435 } 14436 } 14437 14438 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 14439 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 14440 tid_conf->noack = 14441 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 14442 } 14443 14444 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 14445 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 14446 tid_conf->retry_short = 14447 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 14448 14449 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 14450 return -EINVAL; 14451 } 14452 14453 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 14454 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 14455 tid_conf->retry_long = 14456 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 14457 14458 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 14459 return -EINVAL; 14460 } 14461 14462 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 14463 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 14464 tid_conf->ampdu = 14465 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 14466 } 14467 14468 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 14469 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 14470 tid_conf->rtscts = 14471 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 14472 } 14473 14474 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 14475 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 14476 tid_conf->amsdu = 14477 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 14478 } 14479 14480 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 14481 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 14482 14483 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 14484 14485 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 14486 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 14487 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 14488 &tid_conf->txrate_mask, dev, 14489 true); 14490 if (err) 14491 return err; 14492 14493 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 14494 } 14495 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 14496 } 14497 14498 if (peer) 14499 mask = rdev->wiphy.tid_config_support.peer; 14500 else 14501 mask = rdev->wiphy.tid_config_support.vif; 14502 14503 if (tid_conf->mask & ~mask) { 14504 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 14505 return -ENOTSUPP; 14506 } 14507 14508 return 0; 14509 } 14510 14511 static int nl80211_set_tid_config(struct sk_buff *skb, 14512 struct genl_info *info) 14513 { 14514 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14515 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 14516 struct net_device *dev = info->user_ptr[1]; 14517 struct cfg80211_tid_config *tid_config; 14518 struct nlattr *tid; 14519 int conf_idx = 0, rem_conf; 14520 int ret = -EINVAL; 14521 u32 num_conf = 0; 14522 14523 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 14524 return -EINVAL; 14525 14526 if (!rdev->ops->set_tid_config) 14527 return -EOPNOTSUPP; 14528 14529 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14530 rem_conf) 14531 num_conf++; 14532 14533 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 14534 GFP_KERNEL); 14535 if (!tid_config) 14536 return -ENOMEM; 14537 14538 tid_config->n_tid_conf = num_conf; 14539 14540 if (info->attrs[NL80211_ATTR_MAC]) 14541 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 14542 14543 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14544 rem_conf) { 14545 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 14546 tid, NULL, NULL); 14547 14548 if (ret) 14549 goto bad_tid_conf; 14550 14551 ret = parse_tid_conf(rdev, attrs, dev, 14552 &tid_config->tid_conf[conf_idx], 14553 info, tid_config->peer); 14554 if (ret) 14555 goto bad_tid_conf; 14556 14557 conf_idx++; 14558 } 14559 14560 ret = rdev_set_tid_config(rdev, dev, tid_config); 14561 14562 bad_tid_conf: 14563 kfree(tid_config); 14564 return ret; 14565 } 14566 14567 #define NL80211_FLAG_NEED_WIPHY 0x01 14568 #define NL80211_FLAG_NEED_NETDEV 0x02 14569 #define NL80211_FLAG_NEED_RTNL 0x04 14570 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 14571 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 14572 NL80211_FLAG_CHECK_NETDEV_UP) 14573 #define NL80211_FLAG_NEED_WDEV 0x10 14574 /* If a netdev is associated, it must be UP, P2P must be started */ 14575 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 14576 NL80211_FLAG_CHECK_NETDEV_UP) 14577 #define NL80211_FLAG_CLEAR_SKB 0x20 14578 14579 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 14580 struct genl_info *info) 14581 { 14582 struct cfg80211_registered_device *rdev; 14583 struct wireless_dev *wdev; 14584 struct net_device *dev; 14585 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 14586 14587 if (rtnl) 14588 rtnl_lock(); 14589 14590 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 14591 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 14592 if (IS_ERR(rdev)) { 14593 if (rtnl) 14594 rtnl_unlock(); 14595 return PTR_ERR(rdev); 14596 } 14597 info->user_ptr[0] = rdev; 14598 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 14599 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14600 ASSERT_RTNL(); 14601 14602 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 14603 info->attrs); 14604 if (IS_ERR(wdev)) { 14605 if (rtnl) 14606 rtnl_unlock(); 14607 return PTR_ERR(wdev); 14608 } 14609 14610 dev = wdev->netdev; 14611 rdev = wiphy_to_rdev(wdev->wiphy); 14612 14613 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 14614 if (!dev) { 14615 if (rtnl) 14616 rtnl_unlock(); 14617 return -EINVAL; 14618 } 14619 14620 info->user_ptr[1] = dev; 14621 } else { 14622 info->user_ptr[1] = wdev; 14623 } 14624 14625 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 14626 !wdev_running(wdev)) { 14627 if (rtnl) 14628 rtnl_unlock(); 14629 return -ENETDOWN; 14630 } 14631 14632 if (dev) 14633 dev_hold(dev); 14634 14635 info->user_ptr[0] = rdev; 14636 } 14637 14638 return 0; 14639 } 14640 14641 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 14642 struct genl_info *info) 14643 { 14644 if (info->user_ptr[1]) { 14645 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14646 struct wireless_dev *wdev = info->user_ptr[1]; 14647 14648 if (wdev->netdev) 14649 dev_put(wdev->netdev); 14650 } else { 14651 dev_put(info->user_ptr[1]); 14652 } 14653 } 14654 14655 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 14656 rtnl_unlock(); 14657 14658 /* If needed, clear the netlink message payload from the SKB 14659 * as it might contain key data that shouldn't stick around on 14660 * the heap after the SKB is freed. The netlink message header 14661 * is still needed for further processing, so leave it intact. 14662 */ 14663 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 14664 struct nlmsghdr *nlh = nlmsg_hdr(skb); 14665 14666 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 14667 } 14668 } 14669 14670 static const struct genl_ops nl80211_ops[] = { 14671 { 14672 .cmd = NL80211_CMD_GET_WIPHY, 14673 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14674 .doit = nl80211_get_wiphy, 14675 .dumpit = nl80211_dump_wiphy, 14676 .done = nl80211_dump_wiphy_done, 14677 /* can be retrieved by unprivileged users */ 14678 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14679 NL80211_FLAG_NEED_RTNL, 14680 }, 14681 }; 14682 14683 static const struct genl_small_ops nl80211_small_ops[] = { 14684 { 14685 .cmd = NL80211_CMD_SET_WIPHY, 14686 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14687 .doit = nl80211_set_wiphy, 14688 .flags = GENL_UNS_ADMIN_PERM, 14689 .internal_flags = NL80211_FLAG_NEED_RTNL, 14690 }, 14691 { 14692 .cmd = NL80211_CMD_GET_INTERFACE, 14693 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14694 .doit = nl80211_get_interface, 14695 .dumpit = nl80211_dump_interface, 14696 /* can be retrieved by unprivileged users */ 14697 .internal_flags = NL80211_FLAG_NEED_WDEV | 14698 NL80211_FLAG_NEED_RTNL, 14699 }, 14700 { 14701 .cmd = NL80211_CMD_SET_INTERFACE, 14702 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14703 .doit = nl80211_set_interface, 14704 .flags = GENL_UNS_ADMIN_PERM, 14705 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14706 NL80211_FLAG_NEED_RTNL, 14707 }, 14708 { 14709 .cmd = NL80211_CMD_NEW_INTERFACE, 14710 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14711 .doit = nl80211_new_interface, 14712 .flags = GENL_UNS_ADMIN_PERM, 14713 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14714 NL80211_FLAG_NEED_RTNL, 14715 }, 14716 { 14717 .cmd = NL80211_CMD_DEL_INTERFACE, 14718 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14719 .doit = nl80211_del_interface, 14720 .flags = GENL_UNS_ADMIN_PERM, 14721 .internal_flags = NL80211_FLAG_NEED_WDEV | 14722 NL80211_FLAG_NEED_RTNL, 14723 }, 14724 { 14725 .cmd = NL80211_CMD_GET_KEY, 14726 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14727 .doit = nl80211_get_key, 14728 .flags = GENL_UNS_ADMIN_PERM, 14729 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14730 NL80211_FLAG_NEED_RTNL, 14731 }, 14732 { 14733 .cmd = NL80211_CMD_SET_KEY, 14734 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14735 .doit = nl80211_set_key, 14736 .flags = GENL_UNS_ADMIN_PERM, 14737 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14738 NL80211_FLAG_NEED_RTNL | 14739 NL80211_FLAG_CLEAR_SKB, 14740 }, 14741 { 14742 .cmd = NL80211_CMD_NEW_KEY, 14743 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14744 .doit = nl80211_new_key, 14745 .flags = GENL_UNS_ADMIN_PERM, 14746 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14747 NL80211_FLAG_NEED_RTNL | 14748 NL80211_FLAG_CLEAR_SKB, 14749 }, 14750 { 14751 .cmd = NL80211_CMD_DEL_KEY, 14752 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14753 .doit = nl80211_del_key, 14754 .flags = GENL_UNS_ADMIN_PERM, 14755 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14756 NL80211_FLAG_NEED_RTNL, 14757 }, 14758 { 14759 .cmd = NL80211_CMD_SET_BEACON, 14760 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14761 .flags = GENL_UNS_ADMIN_PERM, 14762 .doit = nl80211_set_beacon, 14763 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14764 NL80211_FLAG_NEED_RTNL, 14765 }, 14766 { 14767 .cmd = NL80211_CMD_START_AP, 14768 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14769 .flags = GENL_UNS_ADMIN_PERM, 14770 .doit = nl80211_start_ap, 14771 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14772 NL80211_FLAG_NEED_RTNL, 14773 }, 14774 { 14775 .cmd = NL80211_CMD_STOP_AP, 14776 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14777 .flags = GENL_UNS_ADMIN_PERM, 14778 .doit = nl80211_stop_ap, 14779 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14780 NL80211_FLAG_NEED_RTNL, 14781 }, 14782 { 14783 .cmd = NL80211_CMD_GET_STATION, 14784 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14785 .doit = nl80211_get_station, 14786 .dumpit = nl80211_dump_station, 14787 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14788 NL80211_FLAG_NEED_RTNL, 14789 }, 14790 { 14791 .cmd = NL80211_CMD_SET_STATION, 14792 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14793 .doit = nl80211_set_station, 14794 .flags = GENL_UNS_ADMIN_PERM, 14795 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14796 NL80211_FLAG_NEED_RTNL, 14797 }, 14798 { 14799 .cmd = NL80211_CMD_NEW_STATION, 14800 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14801 .doit = nl80211_new_station, 14802 .flags = GENL_UNS_ADMIN_PERM, 14803 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14804 NL80211_FLAG_NEED_RTNL, 14805 }, 14806 { 14807 .cmd = NL80211_CMD_DEL_STATION, 14808 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14809 .doit = nl80211_del_station, 14810 .flags = GENL_UNS_ADMIN_PERM, 14811 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14812 NL80211_FLAG_NEED_RTNL, 14813 }, 14814 { 14815 .cmd = NL80211_CMD_GET_MPATH, 14816 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14817 .doit = nl80211_get_mpath, 14818 .dumpit = nl80211_dump_mpath, 14819 .flags = GENL_UNS_ADMIN_PERM, 14820 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14821 NL80211_FLAG_NEED_RTNL, 14822 }, 14823 { 14824 .cmd = NL80211_CMD_GET_MPP, 14825 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14826 .doit = nl80211_get_mpp, 14827 .dumpit = nl80211_dump_mpp, 14828 .flags = GENL_UNS_ADMIN_PERM, 14829 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14830 NL80211_FLAG_NEED_RTNL, 14831 }, 14832 { 14833 .cmd = NL80211_CMD_SET_MPATH, 14834 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14835 .doit = nl80211_set_mpath, 14836 .flags = GENL_UNS_ADMIN_PERM, 14837 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14838 NL80211_FLAG_NEED_RTNL, 14839 }, 14840 { 14841 .cmd = NL80211_CMD_NEW_MPATH, 14842 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14843 .doit = nl80211_new_mpath, 14844 .flags = GENL_UNS_ADMIN_PERM, 14845 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14846 NL80211_FLAG_NEED_RTNL, 14847 }, 14848 { 14849 .cmd = NL80211_CMD_DEL_MPATH, 14850 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14851 .doit = nl80211_del_mpath, 14852 .flags = GENL_UNS_ADMIN_PERM, 14853 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14854 NL80211_FLAG_NEED_RTNL, 14855 }, 14856 { 14857 .cmd = NL80211_CMD_SET_BSS, 14858 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14859 .doit = nl80211_set_bss, 14860 .flags = GENL_UNS_ADMIN_PERM, 14861 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14862 NL80211_FLAG_NEED_RTNL, 14863 }, 14864 { 14865 .cmd = NL80211_CMD_GET_REG, 14866 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14867 .doit = nl80211_get_reg_do, 14868 .dumpit = nl80211_get_reg_dump, 14869 .internal_flags = NL80211_FLAG_NEED_RTNL, 14870 /* can be retrieved by unprivileged users */ 14871 }, 14872 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 14873 { 14874 .cmd = NL80211_CMD_SET_REG, 14875 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14876 .doit = nl80211_set_reg, 14877 .flags = GENL_ADMIN_PERM, 14878 .internal_flags = NL80211_FLAG_NEED_RTNL, 14879 }, 14880 #endif 14881 { 14882 .cmd = NL80211_CMD_REQ_SET_REG, 14883 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14884 .doit = nl80211_req_set_reg, 14885 .flags = GENL_ADMIN_PERM, 14886 }, 14887 { 14888 .cmd = NL80211_CMD_RELOAD_REGDB, 14889 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14890 .doit = nl80211_reload_regdb, 14891 .flags = GENL_ADMIN_PERM, 14892 }, 14893 { 14894 .cmd = NL80211_CMD_GET_MESH_CONFIG, 14895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14896 .doit = nl80211_get_mesh_config, 14897 /* can be retrieved by unprivileged users */ 14898 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14899 NL80211_FLAG_NEED_RTNL, 14900 }, 14901 { 14902 .cmd = NL80211_CMD_SET_MESH_CONFIG, 14903 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14904 .doit = nl80211_update_mesh_config, 14905 .flags = GENL_UNS_ADMIN_PERM, 14906 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14907 NL80211_FLAG_NEED_RTNL, 14908 }, 14909 { 14910 .cmd = NL80211_CMD_TRIGGER_SCAN, 14911 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14912 .doit = nl80211_trigger_scan, 14913 .flags = GENL_UNS_ADMIN_PERM, 14914 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14915 NL80211_FLAG_NEED_RTNL, 14916 }, 14917 { 14918 .cmd = NL80211_CMD_ABORT_SCAN, 14919 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14920 .doit = nl80211_abort_scan, 14921 .flags = GENL_UNS_ADMIN_PERM, 14922 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14923 NL80211_FLAG_NEED_RTNL, 14924 }, 14925 { 14926 .cmd = NL80211_CMD_GET_SCAN, 14927 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14928 .dumpit = nl80211_dump_scan, 14929 }, 14930 { 14931 .cmd = NL80211_CMD_START_SCHED_SCAN, 14932 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14933 .doit = nl80211_start_sched_scan, 14934 .flags = GENL_UNS_ADMIN_PERM, 14935 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14936 NL80211_FLAG_NEED_RTNL, 14937 }, 14938 { 14939 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 14940 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14941 .doit = nl80211_stop_sched_scan, 14942 .flags = GENL_UNS_ADMIN_PERM, 14943 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14944 NL80211_FLAG_NEED_RTNL, 14945 }, 14946 { 14947 .cmd = NL80211_CMD_AUTHENTICATE, 14948 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14949 .doit = nl80211_authenticate, 14950 .flags = GENL_UNS_ADMIN_PERM, 14951 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14952 NL80211_FLAG_NEED_RTNL | 14953 NL80211_FLAG_CLEAR_SKB, 14954 }, 14955 { 14956 .cmd = NL80211_CMD_ASSOCIATE, 14957 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14958 .doit = nl80211_associate, 14959 .flags = GENL_UNS_ADMIN_PERM, 14960 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14961 NL80211_FLAG_NEED_RTNL | 14962 NL80211_FLAG_CLEAR_SKB, 14963 }, 14964 { 14965 .cmd = NL80211_CMD_DEAUTHENTICATE, 14966 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14967 .doit = nl80211_deauthenticate, 14968 .flags = GENL_UNS_ADMIN_PERM, 14969 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14970 NL80211_FLAG_NEED_RTNL, 14971 }, 14972 { 14973 .cmd = NL80211_CMD_DISASSOCIATE, 14974 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14975 .doit = nl80211_disassociate, 14976 .flags = GENL_UNS_ADMIN_PERM, 14977 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14978 NL80211_FLAG_NEED_RTNL, 14979 }, 14980 { 14981 .cmd = NL80211_CMD_JOIN_IBSS, 14982 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14983 .doit = nl80211_join_ibss, 14984 .flags = GENL_UNS_ADMIN_PERM, 14985 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14986 NL80211_FLAG_NEED_RTNL, 14987 }, 14988 { 14989 .cmd = NL80211_CMD_LEAVE_IBSS, 14990 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14991 .doit = nl80211_leave_ibss, 14992 .flags = GENL_UNS_ADMIN_PERM, 14993 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14994 NL80211_FLAG_NEED_RTNL, 14995 }, 14996 #ifdef CONFIG_NL80211_TESTMODE 14997 { 14998 .cmd = NL80211_CMD_TESTMODE, 14999 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15000 .doit = nl80211_testmode_do, 15001 .dumpit = nl80211_testmode_dump, 15002 .flags = GENL_UNS_ADMIN_PERM, 15003 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15004 NL80211_FLAG_NEED_RTNL, 15005 }, 15006 #endif 15007 { 15008 .cmd = NL80211_CMD_CONNECT, 15009 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15010 .doit = nl80211_connect, 15011 .flags = GENL_UNS_ADMIN_PERM, 15012 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15013 NL80211_FLAG_NEED_RTNL | 15014 NL80211_FLAG_CLEAR_SKB, 15015 }, 15016 { 15017 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 15018 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15019 .doit = nl80211_update_connect_params, 15020 .flags = GENL_ADMIN_PERM, 15021 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15022 NL80211_FLAG_NEED_RTNL | 15023 NL80211_FLAG_CLEAR_SKB, 15024 }, 15025 { 15026 .cmd = NL80211_CMD_DISCONNECT, 15027 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15028 .doit = nl80211_disconnect, 15029 .flags = GENL_UNS_ADMIN_PERM, 15030 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15031 NL80211_FLAG_NEED_RTNL, 15032 }, 15033 { 15034 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 15035 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15036 .doit = nl80211_wiphy_netns, 15037 .flags = GENL_UNS_ADMIN_PERM, 15038 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15039 NL80211_FLAG_NEED_RTNL, 15040 }, 15041 { 15042 .cmd = NL80211_CMD_GET_SURVEY, 15043 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15044 .dumpit = nl80211_dump_survey, 15045 }, 15046 { 15047 .cmd = NL80211_CMD_SET_PMKSA, 15048 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15049 .doit = nl80211_setdel_pmksa, 15050 .flags = GENL_UNS_ADMIN_PERM, 15051 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15052 NL80211_FLAG_NEED_RTNL | 15053 NL80211_FLAG_CLEAR_SKB, 15054 }, 15055 { 15056 .cmd = NL80211_CMD_DEL_PMKSA, 15057 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15058 .doit = nl80211_setdel_pmksa, 15059 .flags = GENL_UNS_ADMIN_PERM, 15060 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15061 NL80211_FLAG_NEED_RTNL, 15062 }, 15063 { 15064 .cmd = NL80211_CMD_FLUSH_PMKSA, 15065 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15066 .doit = nl80211_flush_pmksa, 15067 .flags = GENL_UNS_ADMIN_PERM, 15068 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15069 NL80211_FLAG_NEED_RTNL, 15070 }, 15071 { 15072 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 15073 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15074 .doit = nl80211_remain_on_channel, 15075 .flags = GENL_UNS_ADMIN_PERM, 15076 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15077 NL80211_FLAG_NEED_RTNL, 15078 }, 15079 { 15080 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 15081 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15082 .doit = nl80211_cancel_remain_on_channel, 15083 .flags = GENL_UNS_ADMIN_PERM, 15084 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15085 NL80211_FLAG_NEED_RTNL, 15086 }, 15087 { 15088 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 15089 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15090 .doit = nl80211_set_tx_bitrate_mask, 15091 .flags = GENL_UNS_ADMIN_PERM, 15092 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15093 NL80211_FLAG_NEED_RTNL, 15094 }, 15095 { 15096 .cmd = NL80211_CMD_REGISTER_FRAME, 15097 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15098 .doit = nl80211_register_mgmt, 15099 .flags = GENL_UNS_ADMIN_PERM, 15100 .internal_flags = NL80211_FLAG_NEED_WDEV | 15101 NL80211_FLAG_NEED_RTNL, 15102 }, 15103 { 15104 .cmd = NL80211_CMD_FRAME, 15105 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15106 .doit = nl80211_tx_mgmt, 15107 .flags = GENL_UNS_ADMIN_PERM, 15108 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15109 NL80211_FLAG_NEED_RTNL, 15110 }, 15111 { 15112 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 15113 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15114 .doit = nl80211_tx_mgmt_cancel_wait, 15115 .flags = GENL_UNS_ADMIN_PERM, 15116 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15117 NL80211_FLAG_NEED_RTNL, 15118 }, 15119 { 15120 .cmd = NL80211_CMD_SET_POWER_SAVE, 15121 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15122 .doit = nl80211_set_power_save, 15123 .flags = GENL_UNS_ADMIN_PERM, 15124 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15125 NL80211_FLAG_NEED_RTNL, 15126 }, 15127 { 15128 .cmd = NL80211_CMD_GET_POWER_SAVE, 15129 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15130 .doit = nl80211_get_power_save, 15131 /* can be retrieved by unprivileged users */ 15132 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15133 NL80211_FLAG_NEED_RTNL, 15134 }, 15135 { 15136 .cmd = NL80211_CMD_SET_CQM, 15137 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15138 .doit = nl80211_set_cqm, 15139 .flags = GENL_UNS_ADMIN_PERM, 15140 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15141 NL80211_FLAG_NEED_RTNL, 15142 }, 15143 { 15144 .cmd = NL80211_CMD_SET_CHANNEL, 15145 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15146 .doit = nl80211_set_channel, 15147 .flags = GENL_UNS_ADMIN_PERM, 15148 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15149 NL80211_FLAG_NEED_RTNL, 15150 }, 15151 { 15152 .cmd = NL80211_CMD_JOIN_MESH, 15153 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15154 .doit = nl80211_join_mesh, 15155 .flags = GENL_UNS_ADMIN_PERM, 15156 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15157 NL80211_FLAG_NEED_RTNL, 15158 }, 15159 { 15160 .cmd = NL80211_CMD_LEAVE_MESH, 15161 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15162 .doit = nl80211_leave_mesh, 15163 .flags = GENL_UNS_ADMIN_PERM, 15164 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15165 NL80211_FLAG_NEED_RTNL, 15166 }, 15167 { 15168 .cmd = NL80211_CMD_JOIN_OCB, 15169 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15170 .doit = nl80211_join_ocb, 15171 .flags = GENL_UNS_ADMIN_PERM, 15172 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15173 NL80211_FLAG_NEED_RTNL, 15174 }, 15175 { 15176 .cmd = NL80211_CMD_LEAVE_OCB, 15177 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15178 .doit = nl80211_leave_ocb, 15179 .flags = GENL_UNS_ADMIN_PERM, 15180 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15181 NL80211_FLAG_NEED_RTNL, 15182 }, 15183 #ifdef CONFIG_PM 15184 { 15185 .cmd = NL80211_CMD_GET_WOWLAN, 15186 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15187 .doit = nl80211_get_wowlan, 15188 /* can be retrieved by unprivileged users */ 15189 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15190 NL80211_FLAG_NEED_RTNL, 15191 }, 15192 { 15193 .cmd = NL80211_CMD_SET_WOWLAN, 15194 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15195 .doit = nl80211_set_wowlan, 15196 .flags = GENL_UNS_ADMIN_PERM, 15197 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15198 NL80211_FLAG_NEED_RTNL, 15199 }, 15200 #endif 15201 { 15202 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 15203 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15204 .doit = nl80211_set_rekey_data, 15205 .flags = GENL_UNS_ADMIN_PERM, 15206 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15207 NL80211_FLAG_NEED_RTNL | 15208 NL80211_FLAG_CLEAR_SKB, 15209 }, 15210 { 15211 .cmd = NL80211_CMD_TDLS_MGMT, 15212 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15213 .doit = nl80211_tdls_mgmt, 15214 .flags = GENL_UNS_ADMIN_PERM, 15215 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15216 NL80211_FLAG_NEED_RTNL, 15217 }, 15218 { 15219 .cmd = NL80211_CMD_TDLS_OPER, 15220 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15221 .doit = nl80211_tdls_oper, 15222 .flags = GENL_UNS_ADMIN_PERM, 15223 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15224 NL80211_FLAG_NEED_RTNL, 15225 }, 15226 { 15227 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 15228 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15229 .doit = nl80211_register_unexpected_frame, 15230 .flags = GENL_UNS_ADMIN_PERM, 15231 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15232 NL80211_FLAG_NEED_RTNL, 15233 }, 15234 { 15235 .cmd = NL80211_CMD_PROBE_CLIENT, 15236 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15237 .doit = nl80211_probe_client, 15238 .flags = GENL_UNS_ADMIN_PERM, 15239 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15240 NL80211_FLAG_NEED_RTNL, 15241 }, 15242 { 15243 .cmd = NL80211_CMD_REGISTER_BEACONS, 15244 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15245 .doit = nl80211_register_beacons, 15246 .flags = GENL_UNS_ADMIN_PERM, 15247 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15248 NL80211_FLAG_NEED_RTNL, 15249 }, 15250 { 15251 .cmd = NL80211_CMD_SET_NOACK_MAP, 15252 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15253 .doit = nl80211_set_noack_map, 15254 .flags = GENL_UNS_ADMIN_PERM, 15255 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15256 NL80211_FLAG_NEED_RTNL, 15257 }, 15258 { 15259 .cmd = NL80211_CMD_START_P2P_DEVICE, 15260 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15261 .doit = nl80211_start_p2p_device, 15262 .flags = GENL_UNS_ADMIN_PERM, 15263 .internal_flags = NL80211_FLAG_NEED_WDEV | 15264 NL80211_FLAG_NEED_RTNL, 15265 }, 15266 { 15267 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 15268 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15269 .doit = nl80211_stop_p2p_device, 15270 .flags = GENL_UNS_ADMIN_PERM, 15271 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15272 NL80211_FLAG_NEED_RTNL, 15273 }, 15274 { 15275 .cmd = NL80211_CMD_START_NAN, 15276 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15277 .doit = nl80211_start_nan, 15278 .flags = GENL_ADMIN_PERM, 15279 .internal_flags = NL80211_FLAG_NEED_WDEV | 15280 NL80211_FLAG_NEED_RTNL, 15281 }, 15282 { 15283 .cmd = NL80211_CMD_STOP_NAN, 15284 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15285 .doit = nl80211_stop_nan, 15286 .flags = GENL_ADMIN_PERM, 15287 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15288 NL80211_FLAG_NEED_RTNL, 15289 }, 15290 { 15291 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 15292 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15293 .doit = nl80211_nan_add_func, 15294 .flags = GENL_ADMIN_PERM, 15295 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15296 NL80211_FLAG_NEED_RTNL, 15297 }, 15298 { 15299 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 15300 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15301 .doit = nl80211_nan_del_func, 15302 .flags = GENL_ADMIN_PERM, 15303 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15304 NL80211_FLAG_NEED_RTNL, 15305 }, 15306 { 15307 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 15308 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15309 .doit = nl80211_nan_change_config, 15310 .flags = GENL_ADMIN_PERM, 15311 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15312 NL80211_FLAG_NEED_RTNL, 15313 }, 15314 { 15315 .cmd = NL80211_CMD_SET_MCAST_RATE, 15316 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15317 .doit = nl80211_set_mcast_rate, 15318 .flags = GENL_UNS_ADMIN_PERM, 15319 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15320 NL80211_FLAG_NEED_RTNL, 15321 }, 15322 { 15323 .cmd = NL80211_CMD_SET_MAC_ACL, 15324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15325 .doit = nl80211_set_mac_acl, 15326 .flags = GENL_UNS_ADMIN_PERM, 15327 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15328 NL80211_FLAG_NEED_RTNL, 15329 }, 15330 { 15331 .cmd = NL80211_CMD_RADAR_DETECT, 15332 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15333 .doit = nl80211_start_radar_detection, 15334 .flags = GENL_UNS_ADMIN_PERM, 15335 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15336 NL80211_FLAG_NEED_RTNL, 15337 }, 15338 { 15339 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 15340 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15341 .doit = nl80211_get_protocol_features, 15342 }, 15343 { 15344 .cmd = NL80211_CMD_UPDATE_FT_IES, 15345 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15346 .doit = nl80211_update_ft_ies, 15347 .flags = GENL_UNS_ADMIN_PERM, 15348 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15349 NL80211_FLAG_NEED_RTNL, 15350 }, 15351 { 15352 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 15353 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15354 .doit = nl80211_crit_protocol_start, 15355 .flags = GENL_UNS_ADMIN_PERM, 15356 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15357 NL80211_FLAG_NEED_RTNL, 15358 }, 15359 { 15360 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 15361 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15362 .doit = nl80211_crit_protocol_stop, 15363 .flags = GENL_UNS_ADMIN_PERM, 15364 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15365 NL80211_FLAG_NEED_RTNL, 15366 }, 15367 { 15368 .cmd = NL80211_CMD_GET_COALESCE, 15369 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15370 .doit = nl80211_get_coalesce, 15371 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15372 NL80211_FLAG_NEED_RTNL, 15373 }, 15374 { 15375 .cmd = NL80211_CMD_SET_COALESCE, 15376 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15377 .doit = nl80211_set_coalesce, 15378 .flags = GENL_UNS_ADMIN_PERM, 15379 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15380 NL80211_FLAG_NEED_RTNL, 15381 }, 15382 { 15383 .cmd = NL80211_CMD_CHANNEL_SWITCH, 15384 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15385 .doit = nl80211_channel_switch, 15386 .flags = GENL_UNS_ADMIN_PERM, 15387 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15388 NL80211_FLAG_NEED_RTNL, 15389 }, 15390 { 15391 .cmd = NL80211_CMD_VENDOR, 15392 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15393 .doit = nl80211_vendor_cmd, 15394 .dumpit = nl80211_vendor_cmd_dump, 15395 .flags = GENL_UNS_ADMIN_PERM, 15396 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15397 NL80211_FLAG_NEED_RTNL | 15398 NL80211_FLAG_CLEAR_SKB, 15399 }, 15400 { 15401 .cmd = NL80211_CMD_SET_QOS_MAP, 15402 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15403 .doit = nl80211_set_qos_map, 15404 .flags = GENL_UNS_ADMIN_PERM, 15405 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15406 NL80211_FLAG_NEED_RTNL, 15407 }, 15408 { 15409 .cmd = NL80211_CMD_ADD_TX_TS, 15410 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15411 .doit = nl80211_add_tx_ts, 15412 .flags = GENL_UNS_ADMIN_PERM, 15413 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15414 NL80211_FLAG_NEED_RTNL, 15415 }, 15416 { 15417 .cmd = NL80211_CMD_DEL_TX_TS, 15418 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15419 .doit = nl80211_del_tx_ts, 15420 .flags = GENL_UNS_ADMIN_PERM, 15421 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15422 NL80211_FLAG_NEED_RTNL, 15423 }, 15424 { 15425 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 15426 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15427 .doit = nl80211_tdls_channel_switch, 15428 .flags = GENL_UNS_ADMIN_PERM, 15429 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15430 NL80211_FLAG_NEED_RTNL, 15431 }, 15432 { 15433 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 15434 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15435 .doit = nl80211_tdls_cancel_channel_switch, 15436 .flags = GENL_UNS_ADMIN_PERM, 15437 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15438 NL80211_FLAG_NEED_RTNL, 15439 }, 15440 { 15441 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 15442 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15443 .doit = nl80211_set_multicast_to_unicast, 15444 .flags = GENL_UNS_ADMIN_PERM, 15445 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15446 NL80211_FLAG_NEED_RTNL, 15447 }, 15448 { 15449 .cmd = NL80211_CMD_SET_PMK, 15450 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15451 .doit = nl80211_set_pmk, 15452 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15453 NL80211_FLAG_NEED_RTNL | 15454 NL80211_FLAG_CLEAR_SKB, 15455 }, 15456 { 15457 .cmd = NL80211_CMD_DEL_PMK, 15458 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15459 .doit = nl80211_del_pmk, 15460 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15461 NL80211_FLAG_NEED_RTNL, 15462 }, 15463 { 15464 .cmd = NL80211_CMD_EXTERNAL_AUTH, 15465 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15466 .doit = nl80211_external_auth, 15467 .flags = GENL_ADMIN_PERM, 15468 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15469 NL80211_FLAG_NEED_RTNL, 15470 }, 15471 { 15472 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 15473 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15474 .doit = nl80211_tx_control_port, 15475 .flags = GENL_UNS_ADMIN_PERM, 15476 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15477 NL80211_FLAG_NEED_RTNL, 15478 }, 15479 { 15480 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 15481 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15482 .doit = nl80211_get_ftm_responder_stats, 15483 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15484 NL80211_FLAG_NEED_RTNL, 15485 }, 15486 { 15487 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 15488 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15489 .doit = nl80211_pmsr_start, 15490 .flags = GENL_UNS_ADMIN_PERM, 15491 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15492 NL80211_FLAG_NEED_RTNL, 15493 }, 15494 { 15495 .cmd = NL80211_CMD_NOTIFY_RADAR, 15496 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15497 .doit = nl80211_notify_radar_detection, 15498 .flags = GENL_UNS_ADMIN_PERM, 15499 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15500 NL80211_FLAG_NEED_RTNL, 15501 }, 15502 { 15503 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 15504 .doit = nl80211_update_owe_info, 15505 .flags = GENL_ADMIN_PERM, 15506 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15507 NL80211_FLAG_NEED_RTNL, 15508 }, 15509 { 15510 .cmd = NL80211_CMD_PROBE_MESH_LINK, 15511 .doit = nl80211_probe_mesh_link, 15512 .flags = GENL_UNS_ADMIN_PERM, 15513 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15514 NL80211_FLAG_NEED_RTNL, 15515 }, 15516 { 15517 .cmd = NL80211_CMD_SET_TID_CONFIG, 15518 .doit = nl80211_set_tid_config, 15519 .flags = GENL_UNS_ADMIN_PERM, 15520 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15521 NL80211_FLAG_NEED_RTNL, 15522 }, 15523 }; 15524 15525 static struct genl_family nl80211_fam __ro_after_init = { 15526 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 15527 .hdrsize = 0, /* no private header */ 15528 .version = 1, /* no particular meaning now */ 15529 .maxattr = NL80211_ATTR_MAX, 15530 .policy = nl80211_policy, 15531 .netnsok = true, 15532 .pre_doit = nl80211_pre_doit, 15533 .post_doit = nl80211_post_doit, 15534 .module = THIS_MODULE, 15535 .ops = nl80211_ops, 15536 .n_ops = ARRAY_SIZE(nl80211_ops), 15537 .small_ops = nl80211_small_ops, 15538 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 15539 .mcgrps = nl80211_mcgrps, 15540 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 15541 .parallel_ops = true, 15542 }; 15543 15544 /* notification functions */ 15545 15546 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 15547 enum nl80211_commands cmd) 15548 { 15549 struct sk_buff *msg; 15550 struct nl80211_dump_wiphy_state state = {}; 15551 15552 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 15553 cmd != NL80211_CMD_DEL_WIPHY); 15554 15555 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15556 if (!msg) 15557 return; 15558 15559 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 15560 nlmsg_free(msg); 15561 return; 15562 } 15563 15564 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15565 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15566 } 15567 15568 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 15569 struct wireless_dev *wdev, 15570 enum nl80211_commands cmd) 15571 { 15572 struct sk_buff *msg; 15573 15574 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15575 if (!msg) 15576 return; 15577 15578 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 15579 nlmsg_free(msg); 15580 return; 15581 } 15582 15583 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15584 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15585 } 15586 15587 static int nl80211_add_scan_req(struct sk_buff *msg, 15588 struct cfg80211_registered_device *rdev) 15589 { 15590 struct cfg80211_scan_request *req = rdev->scan_req; 15591 struct nlattr *nest; 15592 int i; 15593 struct cfg80211_scan_info *info; 15594 15595 if (WARN_ON(!req)) 15596 return 0; 15597 15598 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 15599 if (!nest) 15600 goto nla_put_failure; 15601 for (i = 0; i < req->n_ssids; i++) { 15602 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 15603 goto nla_put_failure; 15604 } 15605 nla_nest_end(msg, nest); 15606 15607 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 15608 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 15609 if (!nest) 15610 goto nla_put_failure; 15611 for (i = 0; i < req->n_channels; i++) { 15612 if (nla_put_u32(msg, i, 15613 ieee80211_channel_to_khz(req->channels[i]))) 15614 goto nla_put_failure; 15615 } 15616 nla_nest_end(msg, nest); 15617 } else { 15618 nest = nla_nest_start_noflag(msg, 15619 NL80211_ATTR_SCAN_FREQUENCIES); 15620 if (!nest) 15621 goto nla_put_failure; 15622 for (i = 0; i < req->n_channels; i++) { 15623 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 15624 goto nla_put_failure; 15625 } 15626 nla_nest_end(msg, nest); 15627 } 15628 15629 if (req->ie && 15630 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 15631 goto nla_put_failure; 15632 15633 if (req->flags && 15634 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 15635 goto nla_put_failure; 15636 15637 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 15638 &rdev->scan_req->info; 15639 if (info->scan_start_tsf && 15640 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 15641 info->scan_start_tsf, NL80211_BSS_PAD) || 15642 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 15643 info->tsf_bssid))) 15644 goto nla_put_failure; 15645 15646 return 0; 15647 nla_put_failure: 15648 return -ENOBUFS; 15649 } 15650 15651 static int nl80211_prep_scan_msg(struct sk_buff *msg, 15652 struct cfg80211_registered_device *rdev, 15653 struct wireless_dev *wdev, 15654 u32 portid, u32 seq, int flags, 15655 u32 cmd) 15656 { 15657 void *hdr; 15658 15659 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 15660 if (!hdr) 15661 return -1; 15662 15663 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15664 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15665 wdev->netdev->ifindex)) || 15666 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15667 NL80211_ATTR_PAD)) 15668 goto nla_put_failure; 15669 15670 /* ignore errors and send incomplete event anyway */ 15671 nl80211_add_scan_req(msg, rdev); 15672 15673 genlmsg_end(msg, hdr); 15674 return 0; 15675 15676 nla_put_failure: 15677 genlmsg_cancel(msg, hdr); 15678 return -EMSGSIZE; 15679 } 15680 15681 static int 15682 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 15683 struct cfg80211_sched_scan_request *req, u32 cmd) 15684 { 15685 void *hdr; 15686 15687 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15688 if (!hdr) 15689 return -1; 15690 15691 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 15692 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 15693 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 15694 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 15695 NL80211_ATTR_PAD)) 15696 goto nla_put_failure; 15697 15698 genlmsg_end(msg, hdr); 15699 return 0; 15700 15701 nla_put_failure: 15702 genlmsg_cancel(msg, hdr); 15703 return -EMSGSIZE; 15704 } 15705 15706 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 15707 struct wireless_dev *wdev) 15708 { 15709 struct sk_buff *msg; 15710 15711 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15712 if (!msg) 15713 return; 15714 15715 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15716 NL80211_CMD_TRIGGER_SCAN) < 0) { 15717 nlmsg_free(msg); 15718 return; 15719 } 15720 15721 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15722 NL80211_MCGRP_SCAN, GFP_KERNEL); 15723 } 15724 15725 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 15726 struct wireless_dev *wdev, bool aborted) 15727 { 15728 struct sk_buff *msg; 15729 15730 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15731 if (!msg) 15732 return NULL; 15733 15734 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15735 aborted ? NL80211_CMD_SCAN_ABORTED : 15736 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 15737 nlmsg_free(msg); 15738 return NULL; 15739 } 15740 15741 return msg; 15742 } 15743 15744 /* send message created by nl80211_build_scan_msg() */ 15745 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 15746 struct sk_buff *msg) 15747 { 15748 if (!msg) 15749 return; 15750 15751 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15752 NL80211_MCGRP_SCAN, GFP_KERNEL); 15753 } 15754 15755 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 15756 { 15757 struct sk_buff *msg; 15758 15759 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15760 if (!msg) 15761 return; 15762 15763 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 15764 nlmsg_free(msg); 15765 return; 15766 } 15767 15768 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 15769 NL80211_MCGRP_SCAN, GFP_KERNEL); 15770 } 15771 15772 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 15773 struct regulatory_request *request) 15774 { 15775 /* Userspace can always count this one always being set */ 15776 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 15777 goto nla_put_failure; 15778 15779 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 15780 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15781 NL80211_REGDOM_TYPE_WORLD)) 15782 goto nla_put_failure; 15783 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 15784 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15785 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 15786 goto nla_put_failure; 15787 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 15788 request->intersect) { 15789 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15790 NL80211_REGDOM_TYPE_INTERSECTION)) 15791 goto nla_put_failure; 15792 } else { 15793 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15794 NL80211_REGDOM_TYPE_COUNTRY) || 15795 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 15796 request->alpha2)) 15797 goto nla_put_failure; 15798 } 15799 15800 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 15801 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 15802 15803 if (wiphy && 15804 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 15805 goto nla_put_failure; 15806 15807 if (wiphy && 15808 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 15809 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 15810 goto nla_put_failure; 15811 } 15812 15813 return true; 15814 15815 nla_put_failure: 15816 return false; 15817 } 15818 15819 /* 15820 * This can happen on global regulatory changes or device specific settings 15821 * based on custom regulatory domains. 15822 */ 15823 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 15824 struct regulatory_request *request) 15825 { 15826 struct sk_buff *msg; 15827 void *hdr; 15828 15829 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15830 if (!msg) 15831 return; 15832 15833 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 15834 if (!hdr) 15835 goto nla_put_failure; 15836 15837 if (!nl80211_reg_change_event_fill(msg, request)) 15838 goto nla_put_failure; 15839 15840 genlmsg_end(msg, hdr); 15841 15842 rcu_read_lock(); 15843 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 15844 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 15845 rcu_read_unlock(); 15846 15847 return; 15848 15849 nla_put_failure: 15850 nlmsg_free(msg); 15851 } 15852 15853 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 15854 struct net_device *netdev, 15855 const u8 *buf, size_t len, 15856 enum nl80211_commands cmd, gfp_t gfp, 15857 int uapsd_queues, const u8 *req_ies, 15858 size_t req_ies_len) 15859 { 15860 struct sk_buff *msg; 15861 void *hdr; 15862 15863 msg = nlmsg_new(100 + len + req_ies_len, gfp); 15864 if (!msg) 15865 return; 15866 15867 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15868 if (!hdr) { 15869 nlmsg_free(msg); 15870 return; 15871 } 15872 15873 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15874 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15875 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 15876 (req_ies && 15877 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies))) 15878 goto nla_put_failure; 15879 15880 if (uapsd_queues >= 0) { 15881 struct nlattr *nla_wmm = 15882 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 15883 if (!nla_wmm) 15884 goto nla_put_failure; 15885 15886 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 15887 uapsd_queues)) 15888 goto nla_put_failure; 15889 15890 nla_nest_end(msg, nla_wmm); 15891 } 15892 15893 genlmsg_end(msg, hdr); 15894 15895 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15896 NL80211_MCGRP_MLME, gfp); 15897 return; 15898 15899 nla_put_failure: 15900 nlmsg_free(msg); 15901 } 15902 15903 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 15904 struct net_device *netdev, const u8 *buf, 15905 size_t len, gfp_t gfp) 15906 { 15907 nl80211_send_mlme_event(rdev, netdev, buf, len, 15908 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0); 15909 } 15910 15911 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 15912 struct net_device *netdev, const u8 *buf, 15913 size_t len, gfp_t gfp, int uapsd_queues, 15914 const u8 *req_ies, size_t req_ies_len) 15915 { 15916 nl80211_send_mlme_event(rdev, netdev, buf, len, 15917 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues, 15918 req_ies, req_ies_len); 15919 } 15920 15921 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 15922 struct net_device *netdev, const u8 *buf, 15923 size_t len, gfp_t gfp) 15924 { 15925 nl80211_send_mlme_event(rdev, netdev, buf, len, 15926 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0); 15927 } 15928 15929 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 15930 struct net_device *netdev, const u8 *buf, 15931 size_t len, gfp_t gfp) 15932 { 15933 nl80211_send_mlme_event(rdev, netdev, buf, len, 15934 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0); 15935 } 15936 15937 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 15938 size_t len) 15939 { 15940 struct wireless_dev *wdev = dev->ieee80211_ptr; 15941 struct wiphy *wiphy = wdev->wiphy; 15942 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15943 const struct ieee80211_mgmt *mgmt = (void *)buf; 15944 u32 cmd; 15945 15946 if (WARN_ON(len < 2)) 15947 return; 15948 15949 if (ieee80211_is_deauth(mgmt->frame_control)) { 15950 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 15951 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 15952 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 15953 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 15954 if (wdev->unprot_beacon_reported && 15955 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 15956 return; 15957 cmd = NL80211_CMD_UNPROT_BEACON; 15958 wdev->unprot_beacon_reported = jiffies; 15959 } else { 15960 return; 15961 } 15962 15963 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 15964 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1, 15965 NULL, 0); 15966 } 15967 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 15968 15969 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 15970 struct net_device *netdev, int cmd, 15971 const u8 *addr, gfp_t gfp) 15972 { 15973 struct sk_buff *msg; 15974 void *hdr; 15975 15976 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15977 if (!msg) 15978 return; 15979 15980 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15981 if (!hdr) { 15982 nlmsg_free(msg); 15983 return; 15984 } 15985 15986 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15987 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15988 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 15989 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 15990 goto nla_put_failure; 15991 15992 genlmsg_end(msg, hdr); 15993 15994 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15995 NL80211_MCGRP_MLME, gfp); 15996 return; 15997 15998 nla_put_failure: 15999 nlmsg_free(msg); 16000 } 16001 16002 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 16003 struct net_device *netdev, const u8 *addr, 16004 gfp_t gfp) 16005 { 16006 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 16007 addr, gfp); 16008 } 16009 16010 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 16011 struct net_device *netdev, const u8 *addr, 16012 gfp_t gfp) 16013 { 16014 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 16015 addr, gfp); 16016 } 16017 16018 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 16019 struct net_device *netdev, 16020 struct cfg80211_connect_resp_params *cr, 16021 gfp_t gfp) 16022 { 16023 struct sk_buff *msg; 16024 void *hdr; 16025 16026 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 16027 cr->fils.kek_len + cr->fils.pmk_len + 16028 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16029 if (!msg) 16030 return; 16031 16032 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 16033 if (!hdr) { 16034 nlmsg_free(msg); 16035 return; 16036 } 16037 16038 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16039 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16040 (cr->bssid && 16041 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 16042 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 16043 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 16044 cr->status) || 16045 (cr->status < 0 && 16046 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 16047 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 16048 cr->timeout_reason))) || 16049 (cr->req_ie && 16050 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 16051 (cr->resp_ie && 16052 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 16053 cr->resp_ie)) || 16054 (cr->fils.update_erp_next_seq_num && 16055 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16056 cr->fils.erp_next_seq_num)) || 16057 (cr->status == WLAN_STATUS_SUCCESS && 16058 ((cr->fils.kek && 16059 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 16060 cr->fils.kek)) || 16061 (cr->fils.pmk && 16062 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 16063 (cr->fils.pmkid && 16064 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 16065 goto nla_put_failure; 16066 16067 genlmsg_end(msg, hdr); 16068 16069 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16070 NL80211_MCGRP_MLME, gfp); 16071 return; 16072 16073 nla_put_failure: 16074 nlmsg_free(msg); 16075 } 16076 16077 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 16078 struct net_device *netdev, 16079 struct cfg80211_roam_info *info, gfp_t gfp) 16080 { 16081 struct sk_buff *msg; 16082 void *hdr; 16083 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 16084 16085 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 16086 info->fils.kek_len + info->fils.pmk_len + 16087 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16088 if (!msg) 16089 return; 16090 16091 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 16092 if (!hdr) { 16093 nlmsg_free(msg); 16094 return; 16095 } 16096 16097 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16098 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16099 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 16100 (info->req_ie && 16101 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 16102 info->req_ie)) || 16103 (info->resp_ie && 16104 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 16105 info->resp_ie)) || 16106 (info->fils.update_erp_next_seq_num && 16107 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16108 info->fils.erp_next_seq_num)) || 16109 (info->fils.kek && 16110 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 16111 info->fils.kek)) || 16112 (info->fils.pmk && 16113 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 16114 (info->fils.pmkid && 16115 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 16116 goto nla_put_failure; 16117 16118 genlmsg_end(msg, hdr); 16119 16120 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16121 NL80211_MCGRP_MLME, gfp); 16122 return; 16123 16124 nla_put_failure: 16125 nlmsg_free(msg); 16126 } 16127 16128 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 16129 struct net_device *netdev, const u8 *bssid) 16130 { 16131 struct sk_buff *msg; 16132 void *hdr; 16133 16134 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16135 if (!msg) 16136 return; 16137 16138 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 16139 if (!hdr) { 16140 nlmsg_free(msg); 16141 return; 16142 } 16143 16144 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16145 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16146 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16147 goto nla_put_failure; 16148 16149 genlmsg_end(msg, hdr); 16150 16151 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16152 NL80211_MCGRP_MLME, GFP_KERNEL); 16153 return; 16154 16155 nla_put_failure: 16156 nlmsg_free(msg); 16157 } 16158 16159 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 16160 struct net_device *netdev, u16 reason, 16161 const u8 *ie, size_t ie_len, bool from_ap) 16162 { 16163 struct sk_buff *msg; 16164 void *hdr; 16165 16166 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 16167 if (!msg) 16168 return; 16169 16170 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 16171 if (!hdr) { 16172 nlmsg_free(msg); 16173 return; 16174 } 16175 16176 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16177 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16178 (reason && 16179 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 16180 (from_ap && 16181 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 16182 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 16183 goto nla_put_failure; 16184 16185 genlmsg_end(msg, hdr); 16186 16187 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16188 NL80211_MCGRP_MLME, GFP_KERNEL); 16189 return; 16190 16191 nla_put_failure: 16192 nlmsg_free(msg); 16193 } 16194 16195 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 16196 struct net_device *netdev, const u8 *bssid, 16197 gfp_t gfp) 16198 { 16199 struct sk_buff *msg; 16200 void *hdr; 16201 16202 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16203 if (!msg) 16204 return; 16205 16206 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 16207 if (!hdr) { 16208 nlmsg_free(msg); 16209 return; 16210 } 16211 16212 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16213 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16214 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16215 goto nla_put_failure; 16216 16217 genlmsg_end(msg, hdr); 16218 16219 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16220 NL80211_MCGRP_MLME, gfp); 16221 return; 16222 16223 nla_put_failure: 16224 nlmsg_free(msg); 16225 } 16226 16227 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 16228 const u8 *ie, u8 ie_len, 16229 int sig_dbm, gfp_t gfp) 16230 { 16231 struct wireless_dev *wdev = dev->ieee80211_ptr; 16232 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16233 struct sk_buff *msg; 16234 void *hdr; 16235 16236 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 16237 return; 16238 16239 trace_cfg80211_notify_new_peer_candidate(dev, addr); 16240 16241 msg = nlmsg_new(100 + ie_len, gfp); 16242 if (!msg) 16243 return; 16244 16245 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 16246 if (!hdr) { 16247 nlmsg_free(msg); 16248 return; 16249 } 16250 16251 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16252 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16253 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16254 (ie_len && ie && 16255 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 16256 (sig_dbm && 16257 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 16258 goto nla_put_failure; 16259 16260 genlmsg_end(msg, hdr); 16261 16262 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16263 NL80211_MCGRP_MLME, gfp); 16264 return; 16265 16266 nla_put_failure: 16267 nlmsg_free(msg); 16268 } 16269 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 16270 16271 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 16272 struct net_device *netdev, const u8 *addr, 16273 enum nl80211_key_type key_type, int key_id, 16274 const u8 *tsc, gfp_t gfp) 16275 { 16276 struct sk_buff *msg; 16277 void *hdr; 16278 16279 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16280 if (!msg) 16281 return; 16282 16283 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 16284 if (!hdr) { 16285 nlmsg_free(msg); 16286 return; 16287 } 16288 16289 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16290 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16291 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 16292 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 16293 (key_id != -1 && 16294 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 16295 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 16296 goto nla_put_failure; 16297 16298 genlmsg_end(msg, hdr); 16299 16300 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16301 NL80211_MCGRP_MLME, gfp); 16302 return; 16303 16304 nla_put_failure: 16305 nlmsg_free(msg); 16306 } 16307 16308 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 16309 struct ieee80211_channel *channel_before, 16310 struct ieee80211_channel *channel_after) 16311 { 16312 struct sk_buff *msg; 16313 void *hdr; 16314 struct nlattr *nl_freq; 16315 16316 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 16317 if (!msg) 16318 return; 16319 16320 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 16321 if (!hdr) { 16322 nlmsg_free(msg); 16323 return; 16324 } 16325 16326 /* 16327 * Since we are applying the beacon hint to a wiphy we know its 16328 * wiphy_idx is valid 16329 */ 16330 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 16331 goto nla_put_failure; 16332 16333 /* Before */ 16334 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 16335 if (!nl_freq) 16336 goto nla_put_failure; 16337 16338 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 16339 goto nla_put_failure; 16340 nla_nest_end(msg, nl_freq); 16341 16342 /* After */ 16343 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 16344 if (!nl_freq) 16345 goto nla_put_failure; 16346 16347 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 16348 goto nla_put_failure; 16349 nla_nest_end(msg, nl_freq); 16350 16351 genlmsg_end(msg, hdr); 16352 16353 rcu_read_lock(); 16354 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 16355 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 16356 rcu_read_unlock(); 16357 16358 return; 16359 16360 nla_put_failure: 16361 nlmsg_free(msg); 16362 } 16363 16364 static void nl80211_send_remain_on_chan_event( 16365 int cmd, struct cfg80211_registered_device *rdev, 16366 struct wireless_dev *wdev, u64 cookie, 16367 struct ieee80211_channel *chan, 16368 unsigned int duration, gfp_t gfp) 16369 { 16370 struct sk_buff *msg; 16371 void *hdr; 16372 16373 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16374 if (!msg) 16375 return; 16376 16377 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16378 if (!hdr) { 16379 nlmsg_free(msg); 16380 return; 16381 } 16382 16383 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16384 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16385 wdev->netdev->ifindex)) || 16386 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16387 NL80211_ATTR_PAD) || 16388 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 16389 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 16390 NL80211_CHAN_NO_HT) || 16391 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16392 NL80211_ATTR_PAD)) 16393 goto nla_put_failure; 16394 16395 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 16396 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 16397 goto nla_put_failure; 16398 16399 genlmsg_end(msg, hdr); 16400 16401 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16402 NL80211_MCGRP_MLME, gfp); 16403 return; 16404 16405 nla_put_failure: 16406 nlmsg_free(msg); 16407 } 16408 16409 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 16410 struct ieee80211_channel *chan, 16411 unsigned int duration, gfp_t gfp) 16412 { 16413 struct wiphy *wiphy = wdev->wiphy; 16414 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16415 16416 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 16417 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 16418 rdev, wdev, cookie, chan, 16419 duration, gfp); 16420 } 16421 EXPORT_SYMBOL(cfg80211_ready_on_channel); 16422 16423 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 16424 struct ieee80211_channel *chan, 16425 gfp_t gfp) 16426 { 16427 struct wiphy *wiphy = wdev->wiphy; 16428 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16429 16430 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 16431 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 16432 rdev, wdev, cookie, chan, 0, gfp); 16433 } 16434 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 16435 16436 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 16437 struct ieee80211_channel *chan, 16438 gfp_t gfp) 16439 { 16440 struct wiphy *wiphy = wdev->wiphy; 16441 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16442 16443 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 16444 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 16445 rdev, wdev, cookie, chan, 0, gfp); 16446 } 16447 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 16448 16449 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 16450 struct station_info *sinfo, gfp_t gfp) 16451 { 16452 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16453 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16454 struct sk_buff *msg; 16455 16456 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 16457 16458 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16459 if (!msg) 16460 return; 16461 16462 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 16463 rdev, dev, mac_addr, sinfo) < 0) { 16464 nlmsg_free(msg); 16465 return; 16466 } 16467 16468 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16469 NL80211_MCGRP_MLME, gfp); 16470 } 16471 EXPORT_SYMBOL(cfg80211_new_sta); 16472 16473 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 16474 struct station_info *sinfo, gfp_t gfp) 16475 { 16476 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16477 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16478 struct sk_buff *msg; 16479 struct station_info empty_sinfo = {}; 16480 16481 if (!sinfo) 16482 sinfo = &empty_sinfo; 16483 16484 trace_cfg80211_del_sta(dev, mac_addr); 16485 16486 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16487 if (!msg) { 16488 cfg80211_sinfo_release_content(sinfo); 16489 return; 16490 } 16491 16492 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 16493 rdev, dev, mac_addr, sinfo) < 0) { 16494 nlmsg_free(msg); 16495 return; 16496 } 16497 16498 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16499 NL80211_MCGRP_MLME, gfp); 16500 } 16501 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 16502 16503 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 16504 enum nl80211_connect_failed_reason reason, 16505 gfp_t gfp) 16506 { 16507 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16508 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16509 struct sk_buff *msg; 16510 void *hdr; 16511 16512 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 16513 if (!msg) 16514 return; 16515 16516 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 16517 if (!hdr) { 16518 nlmsg_free(msg); 16519 return; 16520 } 16521 16522 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16523 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 16524 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 16525 goto nla_put_failure; 16526 16527 genlmsg_end(msg, hdr); 16528 16529 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16530 NL80211_MCGRP_MLME, gfp); 16531 return; 16532 16533 nla_put_failure: 16534 nlmsg_free(msg); 16535 } 16536 EXPORT_SYMBOL(cfg80211_conn_failed); 16537 16538 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 16539 const u8 *addr, gfp_t gfp) 16540 { 16541 struct wireless_dev *wdev = dev->ieee80211_ptr; 16542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16543 struct sk_buff *msg; 16544 void *hdr; 16545 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 16546 16547 if (!nlportid) 16548 return false; 16549 16550 msg = nlmsg_new(100, gfp); 16551 if (!msg) 16552 return true; 16553 16554 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16555 if (!hdr) { 16556 nlmsg_free(msg); 16557 return true; 16558 } 16559 16560 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16561 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16562 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 16563 goto nla_put_failure; 16564 16565 genlmsg_end(msg, hdr); 16566 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16567 return true; 16568 16569 nla_put_failure: 16570 nlmsg_free(msg); 16571 return true; 16572 } 16573 16574 bool cfg80211_rx_spurious_frame(struct net_device *dev, 16575 const u8 *addr, gfp_t gfp) 16576 { 16577 struct wireless_dev *wdev = dev->ieee80211_ptr; 16578 bool ret; 16579 16580 trace_cfg80211_rx_spurious_frame(dev, addr); 16581 16582 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16583 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 16584 trace_cfg80211_return_bool(false); 16585 return false; 16586 } 16587 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 16588 addr, gfp); 16589 trace_cfg80211_return_bool(ret); 16590 return ret; 16591 } 16592 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 16593 16594 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 16595 const u8 *addr, gfp_t gfp) 16596 { 16597 struct wireless_dev *wdev = dev->ieee80211_ptr; 16598 bool ret; 16599 16600 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 16601 16602 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16603 wdev->iftype != NL80211_IFTYPE_P2P_GO && 16604 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 16605 trace_cfg80211_return_bool(false); 16606 return false; 16607 } 16608 ret = __nl80211_unexpected_frame(dev, 16609 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 16610 addr, gfp); 16611 trace_cfg80211_return_bool(ret); 16612 return ret; 16613 } 16614 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 16615 16616 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 16617 struct wireless_dev *wdev, u32 nlportid, 16618 int freq, int sig_dbm, 16619 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 16620 { 16621 struct net_device *netdev = wdev->netdev; 16622 struct sk_buff *msg; 16623 void *hdr; 16624 16625 msg = nlmsg_new(100 + len, gfp); 16626 if (!msg) 16627 return -ENOMEM; 16628 16629 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 16630 if (!hdr) { 16631 nlmsg_free(msg); 16632 return -ENOMEM; 16633 } 16634 16635 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16636 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16637 netdev->ifindex)) || 16638 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16639 NL80211_ATTR_PAD) || 16640 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) || 16641 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) || 16642 (sig_dbm && 16643 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 16644 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16645 (flags && 16646 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 16647 goto nla_put_failure; 16648 16649 genlmsg_end(msg, hdr); 16650 16651 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16652 16653 nla_put_failure: 16654 nlmsg_free(msg); 16655 return -ENOBUFS; 16656 } 16657 16658 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie, 16659 const u8 *buf, size_t len, bool ack, 16660 gfp_t gfp, enum nl80211_commands command) 16661 { 16662 struct wiphy *wiphy = wdev->wiphy; 16663 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16664 struct net_device *netdev = wdev->netdev; 16665 struct sk_buff *msg; 16666 void *hdr; 16667 16668 if (command == NL80211_CMD_FRAME_TX_STATUS) 16669 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 16670 else 16671 trace_cfg80211_control_port_tx_status(wdev, cookie, ack); 16672 16673 msg = nlmsg_new(100 + len, gfp); 16674 if (!msg) 16675 return; 16676 16677 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 16678 if (!hdr) { 16679 nlmsg_free(msg); 16680 return; 16681 } 16682 16683 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16684 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16685 netdev->ifindex)) || 16686 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16687 NL80211_ATTR_PAD) || 16688 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16689 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16690 NL80211_ATTR_PAD) || 16691 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 16692 goto nla_put_failure; 16693 16694 genlmsg_end(msg, hdr); 16695 16696 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16697 NL80211_MCGRP_MLME, gfp); 16698 return; 16699 16700 nla_put_failure: 16701 nlmsg_free(msg); 16702 } 16703 16704 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 16705 const u8 *buf, size_t len, bool ack, 16706 gfp_t gfp) 16707 { 16708 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16709 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 16710 } 16711 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 16712 16713 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 16714 const u8 *buf, size_t len, bool ack, gfp_t gfp) 16715 { 16716 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16717 NL80211_CMD_FRAME_TX_STATUS); 16718 } 16719 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 16720 16721 static int __nl80211_rx_control_port(struct net_device *dev, 16722 struct sk_buff *skb, 16723 bool unencrypted, gfp_t gfp) 16724 { 16725 struct wireless_dev *wdev = dev->ieee80211_ptr; 16726 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16727 struct ethhdr *ehdr = eth_hdr(skb); 16728 const u8 *addr = ehdr->h_source; 16729 u16 proto = be16_to_cpu(skb->protocol); 16730 struct sk_buff *msg; 16731 void *hdr; 16732 struct nlattr *frame; 16733 16734 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 16735 16736 if (!nlportid) 16737 return -ENOENT; 16738 16739 msg = nlmsg_new(100 + skb->len, gfp); 16740 if (!msg) 16741 return -ENOMEM; 16742 16743 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 16744 if (!hdr) { 16745 nlmsg_free(msg); 16746 return -ENOBUFS; 16747 } 16748 16749 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16750 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16751 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16752 NL80211_ATTR_PAD) || 16753 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16754 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 16755 (unencrypted && nla_put_flag(msg, 16756 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 16757 goto nla_put_failure; 16758 16759 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 16760 if (!frame) 16761 goto nla_put_failure; 16762 16763 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 16764 genlmsg_end(msg, hdr); 16765 16766 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16767 16768 nla_put_failure: 16769 nlmsg_free(msg); 16770 return -ENOBUFS; 16771 } 16772 16773 bool cfg80211_rx_control_port(struct net_device *dev, 16774 struct sk_buff *skb, bool unencrypted) 16775 { 16776 int ret; 16777 16778 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 16779 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 16780 trace_cfg80211_return_bool(ret == 0); 16781 return ret == 0; 16782 } 16783 EXPORT_SYMBOL(cfg80211_rx_control_port); 16784 16785 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 16786 const char *mac, gfp_t gfp) 16787 { 16788 struct wireless_dev *wdev = dev->ieee80211_ptr; 16789 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16790 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16791 void **cb; 16792 16793 if (!msg) 16794 return NULL; 16795 16796 cb = (void **)msg->cb; 16797 16798 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 16799 if (!cb[0]) { 16800 nlmsg_free(msg); 16801 return NULL; 16802 } 16803 16804 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16805 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 16806 goto nla_put_failure; 16807 16808 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 16809 goto nla_put_failure; 16810 16811 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 16812 if (!cb[1]) 16813 goto nla_put_failure; 16814 16815 cb[2] = rdev; 16816 16817 return msg; 16818 nla_put_failure: 16819 nlmsg_free(msg); 16820 return NULL; 16821 } 16822 16823 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 16824 { 16825 void **cb = (void **)msg->cb; 16826 struct cfg80211_registered_device *rdev = cb[2]; 16827 16828 nla_nest_end(msg, cb[1]); 16829 genlmsg_end(msg, cb[0]); 16830 16831 memset(msg->cb, 0, sizeof(msg->cb)); 16832 16833 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16834 NL80211_MCGRP_MLME, gfp); 16835 } 16836 16837 void cfg80211_cqm_rssi_notify(struct net_device *dev, 16838 enum nl80211_cqm_rssi_threshold_event rssi_event, 16839 s32 rssi_level, gfp_t gfp) 16840 { 16841 struct sk_buff *msg; 16842 struct wireless_dev *wdev = dev->ieee80211_ptr; 16843 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16844 16845 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 16846 16847 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 16848 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 16849 return; 16850 16851 if (wdev->cqm_config) { 16852 wdev->cqm_config->last_rssi_event_value = rssi_level; 16853 16854 cfg80211_cqm_rssi_update(rdev, dev); 16855 16856 if (rssi_level == 0) 16857 rssi_level = wdev->cqm_config->last_rssi_event_value; 16858 } 16859 16860 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16861 if (!msg) 16862 return; 16863 16864 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 16865 rssi_event)) 16866 goto nla_put_failure; 16867 16868 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 16869 rssi_level)) 16870 goto nla_put_failure; 16871 16872 cfg80211_send_cqm(msg, gfp); 16873 16874 return; 16875 16876 nla_put_failure: 16877 nlmsg_free(msg); 16878 } 16879 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 16880 16881 void cfg80211_cqm_txe_notify(struct net_device *dev, 16882 const u8 *peer, u32 num_packets, 16883 u32 rate, u32 intvl, gfp_t gfp) 16884 { 16885 struct sk_buff *msg; 16886 16887 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16888 if (!msg) 16889 return; 16890 16891 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 16892 goto nla_put_failure; 16893 16894 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 16895 goto nla_put_failure; 16896 16897 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 16898 goto nla_put_failure; 16899 16900 cfg80211_send_cqm(msg, gfp); 16901 return; 16902 16903 nla_put_failure: 16904 nlmsg_free(msg); 16905 } 16906 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 16907 16908 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 16909 const u8 *peer, u32 num_packets, gfp_t gfp) 16910 { 16911 struct sk_buff *msg; 16912 16913 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 16914 16915 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16916 if (!msg) 16917 return; 16918 16919 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 16920 goto nla_put_failure; 16921 16922 cfg80211_send_cqm(msg, gfp); 16923 return; 16924 16925 nla_put_failure: 16926 nlmsg_free(msg); 16927 } 16928 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 16929 16930 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 16931 { 16932 struct sk_buff *msg; 16933 16934 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16935 if (!msg) 16936 return; 16937 16938 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 16939 goto nla_put_failure; 16940 16941 cfg80211_send_cqm(msg, gfp); 16942 return; 16943 16944 nla_put_failure: 16945 nlmsg_free(msg); 16946 } 16947 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 16948 16949 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 16950 struct net_device *netdev, const u8 *bssid, 16951 const u8 *replay_ctr, gfp_t gfp) 16952 { 16953 struct sk_buff *msg; 16954 struct nlattr *rekey_attr; 16955 void *hdr; 16956 16957 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16958 if (!msg) 16959 return; 16960 16961 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 16962 if (!hdr) { 16963 nlmsg_free(msg); 16964 return; 16965 } 16966 16967 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16968 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16969 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16970 goto nla_put_failure; 16971 16972 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 16973 if (!rekey_attr) 16974 goto nla_put_failure; 16975 16976 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 16977 NL80211_REPLAY_CTR_LEN, replay_ctr)) 16978 goto nla_put_failure; 16979 16980 nla_nest_end(msg, rekey_attr); 16981 16982 genlmsg_end(msg, hdr); 16983 16984 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16985 NL80211_MCGRP_MLME, gfp); 16986 return; 16987 16988 nla_put_failure: 16989 nlmsg_free(msg); 16990 } 16991 16992 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 16993 const u8 *replay_ctr, gfp_t gfp) 16994 { 16995 struct wireless_dev *wdev = dev->ieee80211_ptr; 16996 struct wiphy *wiphy = wdev->wiphy; 16997 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16998 16999 trace_cfg80211_gtk_rekey_notify(dev, bssid); 17000 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 17001 } 17002 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 17003 17004 static void 17005 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 17006 struct net_device *netdev, int index, 17007 const u8 *bssid, bool preauth, gfp_t gfp) 17008 { 17009 struct sk_buff *msg; 17010 struct nlattr *attr; 17011 void *hdr; 17012 17013 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17014 if (!msg) 17015 return; 17016 17017 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 17018 if (!hdr) { 17019 nlmsg_free(msg); 17020 return; 17021 } 17022 17023 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17024 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17025 goto nla_put_failure; 17026 17027 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 17028 if (!attr) 17029 goto nla_put_failure; 17030 17031 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 17032 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 17033 (preauth && 17034 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 17035 goto nla_put_failure; 17036 17037 nla_nest_end(msg, attr); 17038 17039 genlmsg_end(msg, hdr); 17040 17041 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17042 NL80211_MCGRP_MLME, gfp); 17043 return; 17044 17045 nla_put_failure: 17046 nlmsg_free(msg); 17047 } 17048 17049 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 17050 const u8 *bssid, bool preauth, gfp_t gfp) 17051 { 17052 struct wireless_dev *wdev = dev->ieee80211_ptr; 17053 struct wiphy *wiphy = wdev->wiphy; 17054 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17055 17056 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 17057 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 17058 } 17059 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 17060 17061 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 17062 struct net_device *netdev, 17063 struct cfg80211_chan_def *chandef, 17064 gfp_t gfp, 17065 enum nl80211_commands notif, 17066 u8 count, bool quiet) 17067 { 17068 struct sk_buff *msg; 17069 void *hdr; 17070 17071 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17072 if (!msg) 17073 return; 17074 17075 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 17076 if (!hdr) { 17077 nlmsg_free(msg); 17078 return; 17079 } 17080 17081 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17082 goto nla_put_failure; 17083 17084 if (nl80211_send_chandef(msg, chandef)) 17085 goto nla_put_failure; 17086 17087 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) { 17088 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)) 17089 goto nla_put_failure; 17090 if (quiet && 17091 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)) 17092 goto nla_put_failure; 17093 } 17094 17095 genlmsg_end(msg, hdr); 17096 17097 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17098 NL80211_MCGRP_MLME, gfp); 17099 return; 17100 17101 nla_put_failure: 17102 nlmsg_free(msg); 17103 } 17104 17105 void cfg80211_ch_switch_notify(struct net_device *dev, 17106 struct cfg80211_chan_def *chandef) 17107 { 17108 struct wireless_dev *wdev = dev->ieee80211_ptr; 17109 struct wiphy *wiphy = wdev->wiphy; 17110 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17111 17112 ASSERT_WDEV_LOCK(wdev); 17113 17114 trace_cfg80211_ch_switch_notify(dev, chandef); 17115 17116 wdev->chandef = *chandef; 17117 wdev->preset_chandef = *chandef; 17118 17119 if (wdev->iftype == NL80211_IFTYPE_STATION && 17120 !WARN_ON(!wdev->current_bss)) 17121 cfg80211_update_assoc_bss_entry(wdev, chandef->chan); 17122 17123 cfg80211_sched_dfs_chan_update(rdev); 17124 17125 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17126 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false); 17127 } 17128 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 17129 17130 void cfg80211_ch_switch_started_notify(struct net_device *dev, 17131 struct cfg80211_chan_def *chandef, 17132 u8 count, bool quiet) 17133 { 17134 struct wireless_dev *wdev = dev->ieee80211_ptr; 17135 struct wiphy *wiphy = wdev->wiphy; 17136 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17137 17138 trace_cfg80211_ch_switch_started_notify(dev, chandef); 17139 17140 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17141 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, 17142 count, quiet); 17143 } 17144 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 17145 17146 void 17147 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 17148 const struct cfg80211_chan_def *chandef, 17149 enum nl80211_radar_event event, 17150 struct net_device *netdev, gfp_t gfp) 17151 { 17152 struct sk_buff *msg; 17153 void *hdr; 17154 17155 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17156 if (!msg) 17157 return; 17158 17159 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 17160 if (!hdr) { 17161 nlmsg_free(msg); 17162 return; 17163 } 17164 17165 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17166 goto nla_put_failure; 17167 17168 /* NOP and radar events don't need a netdev parameter */ 17169 if (netdev) { 17170 struct wireless_dev *wdev = netdev->ieee80211_ptr; 17171 17172 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17173 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17174 NL80211_ATTR_PAD)) 17175 goto nla_put_failure; 17176 } 17177 17178 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 17179 goto nla_put_failure; 17180 17181 if (nl80211_send_chandef(msg, chandef)) 17182 goto nla_put_failure; 17183 17184 genlmsg_end(msg, hdr); 17185 17186 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17187 NL80211_MCGRP_MLME, gfp); 17188 return; 17189 17190 nla_put_failure: 17191 nlmsg_free(msg); 17192 } 17193 17194 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 17195 struct sta_opmode_info *sta_opmode, 17196 gfp_t gfp) 17197 { 17198 struct sk_buff *msg; 17199 struct wireless_dev *wdev = dev->ieee80211_ptr; 17200 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17201 void *hdr; 17202 17203 if (WARN_ON(!mac)) 17204 return; 17205 17206 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17207 if (!msg) 17208 return; 17209 17210 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 17211 if (!hdr) { 17212 nlmsg_free(msg); 17213 return; 17214 } 17215 17216 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17217 goto nla_put_failure; 17218 17219 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 17220 goto nla_put_failure; 17221 17222 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 17223 goto nla_put_failure; 17224 17225 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 17226 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 17227 goto nla_put_failure; 17228 17229 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 17230 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 17231 goto nla_put_failure; 17232 17233 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 17234 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 17235 goto nla_put_failure; 17236 17237 genlmsg_end(msg, hdr); 17238 17239 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17240 NL80211_MCGRP_MLME, gfp); 17241 17242 return; 17243 17244 nla_put_failure: 17245 nlmsg_free(msg); 17246 } 17247 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 17248 17249 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 17250 u64 cookie, bool acked, s32 ack_signal, 17251 bool is_valid_ack_signal, gfp_t gfp) 17252 { 17253 struct wireless_dev *wdev = dev->ieee80211_ptr; 17254 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17255 struct sk_buff *msg; 17256 void *hdr; 17257 17258 trace_cfg80211_probe_status(dev, addr, cookie, acked); 17259 17260 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17261 17262 if (!msg) 17263 return; 17264 17265 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 17266 if (!hdr) { 17267 nlmsg_free(msg); 17268 return; 17269 } 17270 17271 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17272 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17273 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 17274 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 17275 NL80211_ATTR_PAD) || 17276 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 17277 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 17278 ack_signal))) 17279 goto nla_put_failure; 17280 17281 genlmsg_end(msg, hdr); 17282 17283 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17284 NL80211_MCGRP_MLME, gfp); 17285 return; 17286 17287 nla_put_failure: 17288 nlmsg_free(msg); 17289 } 17290 EXPORT_SYMBOL(cfg80211_probe_status); 17291 17292 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 17293 size_t len, int freq, int sig_dbm) 17294 { 17295 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17296 struct sk_buff *msg; 17297 void *hdr; 17298 struct cfg80211_beacon_registration *reg; 17299 17300 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 17301 17302 spin_lock_bh(&rdev->beacon_registrations_lock); 17303 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 17304 msg = nlmsg_new(len + 100, GFP_ATOMIC); 17305 if (!msg) { 17306 spin_unlock_bh(&rdev->beacon_registrations_lock); 17307 return; 17308 } 17309 17310 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 17311 if (!hdr) 17312 goto nla_put_failure; 17313 17314 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17315 (freq && 17316 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 17317 KHZ_TO_MHZ(freq)) || 17318 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 17319 freq % 1000))) || 17320 (sig_dbm && 17321 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 17322 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 17323 goto nla_put_failure; 17324 17325 genlmsg_end(msg, hdr); 17326 17327 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 17328 } 17329 spin_unlock_bh(&rdev->beacon_registrations_lock); 17330 return; 17331 17332 nla_put_failure: 17333 spin_unlock_bh(&rdev->beacon_registrations_lock); 17334 nlmsg_free(msg); 17335 } 17336 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 17337 17338 #ifdef CONFIG_PM 17339 static int cfg80211_net_detect_results(struct sk_buff *msg, 17340 struct cfg80211_wowlan_wakeup *wakeup) 17341 { 17342 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 17343 struct nlattr *nl_results, *nl_match, *nl_freqs; 17344 int i, j; 17345 17346 nl_results = nla_nest_start_noflag(msg, 17347 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 17348 if (!nl_results) 17349 return -EMSGSIZE; 17350 17351 for (i = 0; i < nd->n_matches; i++) { 17352 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 17353 17354 nl_match = nla_nest_start_noflag(msg, i); 17355 if (!nl_match) 17356 break; 17357 17358 /* The SSID attribute is optional in nl80211, but for 17359 * simplicity reasons it's always present in the 17360 * cfg80211 structure. If a driver can't pass the 17361 * SSID, that needs to be changed. A zero length SSID 17362 * is still a valid SSID (wildcard), so it cannot be 17363 * used for this purpose. 17364 */ 17365 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 17366 match->ssid.ssid)) { 17367 nla_nest_cancel(msg, nl_match); 17368 goto out; 17369 } 17370 17371 if (match->n_channels) { 17372 nl_freqs = nla_nest_start_noflag(msg, 17373 NL80211_ATTR_SCAN_FREQUENCIES); 17374 if (!nl_freqs) { 17375 nla_nest_cancel(msg, nl_match); 17376 goto out; 17377 } 17378 17379 for (j = 0; j < match->n_channels; j++) { 17380 if (nla_put_u32(msg, j, match->channels[j])) { 17381 nla_nest_cancel(msg, nl_freqs); 17382 nla_nest_cancel(msg, nl_match); 17383 goto out; 17384 } 17385 } 17386 17387 nla_nest_end(msg, nl_freqs); 17388 } 17389 17390 nla_nest_end(msg, nl_match); 17391 } 17392 17393 out: 17394 nla_nest_end(msg, nl_results); 17395 return 0; 17396 } 17397 17398 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 17399 struct cfg80211_wowlan_wakeup *wakeup, 17400 gfp_t gfp) 17401 { 17402 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17403 struct sk_buff *msg; 17404 void *hdr; 17405 int size = 200; 17406 17407 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 17408 17409 if (wakeup) 17410 size += wakeup->packet_present_len; 17411 17412 msg = nlmsg_new(size, gfp); 17413 if (!msg) 17414 return; 17415 17416 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 17417 if (!hdr) 17418 goto free_msg; 17419 17420 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17421 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17422 NL80211_ATTR_PAD)) 17423 goto free_msg; 17424 17425 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17426 wdev->netdev->ifindex)) 17427 goto free_msg; 17428 17429 if (wakeup) { 17430 struct nlattr *reasons; 17431 17432 reasons = nla_nest_start_noflag(msg, 17433 NL80211_ATTR_WOWLAN_TRIGGERS); 17434 if (!reasons) 17435 goto free_msg; 17436 17437 if (wakeup->disconnect && 17438 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 17439 goto free_msg; 17440 if (wakeup->magic_pkt && 17441 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 17442 goto free_msg; 17443 if (wakeup->gtk_rekey_failure && 17444 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 17445 goto free_msg; 17446 if (wakeup->eap_identity_req && 17447 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 17448 goto free_msg; 17449 if (wakeup->four_way_handshake && 17450 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 17451 goto free_msg; 17452 if (wakeup->rfkill_release && 17453 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 17454 goto free_msg; 17455 17456 if (wakeup->pattern_idx >= 0 && 17457 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 17458 wakeup->pattern_idx)) 17459 goto free_msg; 17460 17461 if (wakeup->tcp_match && 17462 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 17463 goto free_msg; 17464 17465 if (wakeup->tcp_connlost && 17466 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 17467 goto free_msg; 17468 17469 if (wakeup->tcp_nomoretokens && 17470 nla_put_flag(msg, 17471 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 17472 goto free_msg; 17473 17474 if (wakeup->packet) { 17475 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 17476 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 17477 17478 if (!wakeup->packet_80211) { 17479 pkt_attr = 17480 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 17481 len_attr = 17482 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 17483 } 17484 17485 if (wakeup->packet_len && 17486 nla_put_u32(msg, len_attr, wakeup->packet_len)) 17487 goto free_msg; 17488 17489 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 17490 wakeup->packet)) 17491 goto free_msg; 17492 } 17493 17494 if (wakeup->net_detect && 17495 cfg80211_net_detect_results(msg, wakeup)) 17496 goto free_msg; 17497 17498 nla_nest_end(msg, reasons); 17499 } 17500 17501 genlmsg_end(msg, hdr); 17502 17503 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17504 NL80211_MCGRP_MLME, gfp); 17505 return; 17506 17507 free_msg: 17508 nlmsg_free(msg); 17509 } 17510 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 17511 #endif 17512 17513 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 17514 enum nl80211_tdls_operation oper, 17515 u16 reason_code, gfp_t gfp) 17516 { 17517 struct wireless_dev *wdev = dev->ieee80211_ptr; 17518 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17519 struct sk_buff *msg; 17520 void *hdr; 17521 17522 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 17523 reason_code); 17524 17525 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17526 if (!msg) 17527 return; 17528 17529 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 17530 if (!hdr) { 17531 nlmsg_free(msg); 17532 return; 17533 } 17534 17535 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17536 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17537 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 17538 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 17539 (reason_code > 0 && 17540 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 17541 goto nla_put_failure; 17542 17543 genlmsg_end(msg, hdr); 17544 17545 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17546 NL80211_MCGRP_MLME, gfp); 17547 return; 17548 17549 nla_put_failure: 17550 nlmsg_free(msg); 17551 } 17552 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 17553 17554 static int nl80211_netlink_notify(struct notifier_block * nb, 17555 unsigned long state, 17556 void *_notify) 17557 { 17558 struct netlink_notify *notify = _notify; 17559 struct cfg80211_registered_device *rdev; 17560 struct wireless_dev *wdev; 17561 struct cfg80211_beacon_registration *reg, *tmp; 17562 17563 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 17564 return NOTIFY_DONE; 17565 17566 rcu_read_lock(); 17567 17568 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 17569 struct cfg80211_sched_scan_request *sched_scan_req; 17570 17571 list_for_each_entry_rcu(sched_scan_req, 17572 &rdev->sched_scan_req_list, 17573 list) { 17574 if (sched_scan_req->owner_nlportid == notify->portid) { 17575 sched_scan_req->nl_owner_dead = true; 17576 schedule_work(&rdev->sched_scan_stop_wk); 17577 } 17578 } 17579 17580 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 17581 cfg80211_mlme_unregister_socket(wdev, notify->portid); 17582 17583 if (wdev->owner_nlportid == notify->portid) { 17584 wdev->nl_owner_dead = true; 17585 schedule_work(&rdev->destroy_work); 17586 } else if (wdev->conn_owner_nlportid == notify->portid) { 17587 schedule_work(&wdev->disconnect_wk); 17588 } 17589 17590 cfg80211_release_pmsr(wdev, notify->portid); 17591 } 17592 17593 spin_lock_bh(&rdev->beacon_registrations_lock); 17594 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 17595 list) { 17596 if (reg->nlportid == notify->portid) { 17597 list_del(®->list); 17598 kfree(reg); 17599 break; 17600 } 17601 } 17602 spin_unlock_bh(&rdev->beacon_registrations_lock); 17603 } 17604 17605 rcu_read_unlock(); 17606 17607 /* 17608 * It is possible that the user space process that is controlling the 17609 * indoor setting disappeared, so notify the regulatory core. 17610 */ 17611 regulatory_netlink_notify(notify->portid); 17612 return NOTIFY_OK; 17613 } 17614 17615 static struct notifier_block nl80211_netlink_notifier = { 17616 .notifier_call = nl80211_netlink_notify, 17617 }; 17618 17619 void cfg80211_ft_event(struct net_device *netdev, 17620 struct cfg80211_ft_event_params *ft_event) 17621 { 17622 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17623 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17624 struct sk_buff *msg; 17625 void *hdr; 17626 17627 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 17628 17629 if (!ft_event->target_ap) 17630 return; 17631 17632 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 17633 GFP_KERNEL); 17634 if (!msg) 17635 return; 17636 17637 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 17638 if (!hdr) 17639 goto out; 17640 17641 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17642 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17643 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 17644 goto out; 17645 17646 if (ft_event->ies && 17647 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 17648 goto out; 17649 if (ft_event->ric_ies && 17650 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 17651 ft_event->ric_ies)) 17652 goto out; 17653 17654 genlmsg_end(msg, hdr); 17655 17656 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17657 NL80211_MCGRP_MLME, GFP_KERNEL); 17658 return; 17659 out: 17660 nlmsg_free(msg); 17661 } 17662 EXPORT_SYMBOL(cfg80211_ft_event); 17663 17664 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 17665 { 17666 struct cfg80211_registered_device *rdev; 17667 struct sk_buff *msg; 17668 void *hdr; 17669 u32 nlportid; 17670 17671 rdev = wiphy_to_rdev(wdev->wiphy); 17672 if (!rdev->crit_proto_nlportid) 17673 return; 17674 17675 nlportid = rdev->crit_proto_nlportid; 17676 rdev->crit_proto_nlportid = 0; 17677 17678 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17679 if (!msg) 17680 return; 17681 17682 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 17683 if (!hdr) 17684 goto nla_put_failure; 17685 17686 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17687 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17688 NL80211_ATTR_PAD)) 17689 goto nla_put_failure; 17690 17691 genlmsg_end(msg, hdr); 17692 17693 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 17694 return; 17695 17696 nla_put_failure: 17697 nlmsg_free(msg); 17698 } 17699 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 17700 17701 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 17702 { 17703 struct wiphy *wiphy = wdev->wiphy; 17704 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17705 struct sk_buff *msg; 17706 void *hdr; 17707 17708 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17709 if (!msg) 17710 return; 17711 17712 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 17713 if (!hdr) 17714 goto out; 17715 17716 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17717 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 17718 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17719 NL80211_ATTR_PAD)) 17720 goto out; 17721 17722 genlmsg_end(msg, hdr); 17723 17724 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 17725 NL80211_MCGRP_MLME, GFP_KERNEL); 17726 return; 17727 out: 17728 nlmsg_free(msg); 17729 } 17730 17731 int cfg80211_external_auth_request(struct net_device *dev, 17732 struct cfg80211_external_auth_params *params, 17733 gfp_t gfp) 17734 { 17735 struct wireless_dev *wdev = dev->ieee80211_ptr; 17736 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17737 struct sk_buff *msg; 17738 void *hdr; 17739 17740 if (!wdev->conn_owner_nlportid) 17741 return -EINVAL; 17742 17743 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17744 if (!msg) 17745 return -ENOMEM; 17746 17747 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 17748 if (!hdr) 17749 goto nla_put_failure; 17750 17751 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17752 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17753 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 17754 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 17755 params->action) || 17756 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 17757 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 17758 params->ssid.ssid)) 17759 goto nla_put_failure; 17760 17761 genlmsg_end(msg, hdr); 17762 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 17763 wdev->conn_owner_nlportid); 17764 return 0; 17765 17766 nla_put_failure: 17767 nlmsg_free(msg); 17768 return -ENOBUFS; 17769 } 17770 EXPORT_SYMBOL(cfg80211_external_auth_request); 17771 17772 void cfg80211_update_owe_info_event(struct net_device *netdev, 17773 struct cfg80211_update_owe_info *owe_info, 17774 gfp_t gfp) 17775 { 17776 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17777 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17778 struct sk_buff *msg; 17779 void *hdr; 17780 17781 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 17782 17783 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17784 if (!msg) 17785 return; 17786 17787 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 17788 if (!hdr) 17789 goto nla_put_failure; 17790 17791 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17792 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17793 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 17794 goto nla_put_failure; 17795 17796 if (!owe_info->ie_len || 17797 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 17798 goto nla_put_failure; 17799 17800 genlmsg_end(msg, hdr); 17801 17802 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17803 NL80211_MCGRP_MLME, gfp); 17804 return; 17805 17806 nla_put_failure: 17807 genlmsg_cancel(msg, hdr); 17808 nlmsg_free(msg); 17809 } 17810 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 17811 17812 /* initialisation/exit functions */ 17813 17814 int __init nl80211_init(void) 17815 { 17816 int err; 17817 17818 err = genl_register_family(&nl80211_fam); 17819 if (err) 17820 return err; 17821 17822 err = netlink_register_notifier(&nl80211_netlink_notifier); 17823 if (err) 17824 goto err_out; 17825 17826 return 0; 17827 err_out: 17828 genl_unregister_family(&nl80211_fam); 17829 return err; 17830 } 17831 17832 void nl80211_exit(void) 17833 { 17834 netlink_unregister_notifier(&nl80211_netlink_notifier); 17835 genl_unregister_family(&nl80211_fam); 17836 } 17837