1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2020 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 68 { 69 struct cfg80211_registered_device *rdev; 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 ASSERT_RTNL(); 78 79 if (!have_ifidx && !have_wdev_id) 80 return ERR_PTR(-EINVAL); 81 82 if (have_ifidx) 83 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 84 if (have_wdev_id) { 85 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 86 wiphy_idx = wdev_id >> 32; 87 } 88 89 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 90 struct wireless_dev *wdev; 91 92 if (wiphy_net(&rdev->wiphy) != netns) 93 continue; 94 95 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 96 continue; 97 98 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 99 if (have_ifidx && wdev->netdev && 100 wdev->netdev->ifindex == ifidx) { 101 result = wdev; 102 break; 103 } 104 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 105 result = wdev; 106 break; 107 } 108 } 109 110 if (result) 111 break; 112 } 113 114 if (result) 115 return result; 116 return ERR_PTR(-ENODEV); 117 } 118 119 static struct cfg80211_registered_device * 120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 121 { 122 struct cfg80211_registered_device *rdev = NULL, *tmp; 123 struct net_device *netdev; 124 125 ASSERT_RTNL(); 126 127 if (!attrs[NL80211_ATTR_WIPHY] && 128 !attrs[NL80211_ATTR_IFINDEX] && 129 !attrs[NL80211_ATTR_WDEV]) 130 return ERR_PTR(-EINVAL); 131 132 if (attrs[NL80211_ATTR_WIPHY]) 133 rdev = cfg80211_rdev_by_wiphy_idx( 134 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 135 136 if (attrs[NL80211_ATTR_WDEV]) { 137 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 138 struct wireless_dev *wdev; 139 bool found = false; 140 141 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 142 if (tmp) { 143 /* make sure wdev exists */ 144 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 145 if (wdev->identifier != (u32)wdev_id) 146 continue; 147 found = true; 148 break; 149 } 150 151 if (!found) 152 tmp = NULL; 153 154 if (rdev && tmp != rdev) 155 return ERR_PTR(-EINVAL); 156 rdev = tmp; 157 } 158 } 159 160 if (attrs[NL80211_ATTR_IFINDEX]) { 161 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 162 163 netdev = __dev_get_by_index(netns, ifindex); 164 if (netdev) { 165 if (netdev->ieee80211_ptr) 166 tmp = wiphy_to_rdev( 167 netdev->ieee80211_ptr->wiphy); 168 else 169 tmp = NULL; 170 171 /* not wireless device -- return error */ 172 if (!tmp) 173 return ERR_PTR(-EINVAL); 174 175 /* mismatch -- return error */ 176 if (rdev && tmp != rdev) 177 return ERR_PTR(-EINVAL); 178 179 rdev = tmp; 180 } 181 } 182 183 if (!rdev) 184 return ERR_PTR(-ENODEV); 185 186 if (netns != wiphy_net(&rdev->wiphy)) 187 return ERR_PTR(-ENODEV); 188 189 return rdev; 190 } 191 192 /* 193 * This function returns a pointer to the driver 194 * that the genl_info item that is passed refers to. 195 * 196 * The result of this can be a PTR_ERR and hence must 197 * be checked with IS_ERR() for errors. 198 */ 199 static struct cfg80211_registered_device * 200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 201 { 202 return __cfg80211_rdev_from_attrs(netns, info->attrs); 203 } 204 205 static int validate_beacon_head(const struct nlattr *attr, 206 struct netlink_ext_ack *extack) 207 { 208 const u8 *data = nla_data(attr); 209 unsigned int len = nla_len(attr); 210 const struct element *elem; 211 const struct ieee80211_mgmt *mgmt = (void *)data; 212 unsigned int fixedlen, hdrlen; 213 bool s1g_bcn; 214 215 if (len < offsetofend(typeof(*mgmt), frame_control)) 216 goto err; 217 218 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 219 if (s1g_bcn) { 220 fixedlen = offsetof(struct ieee80211_ext, 221 u.s1g_beacon.variable); 222 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 223 } else { 224 fixedlen = offsetof(struct ieee80211_mgmt, 225 u.beacon.variable); 226 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 227 } 228 229 if (len < fixedlen) 230 goto err; 231 232 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 233 goto err; 234 235 data += fixedlen; 236 len -= fixedlen; 237 238 for_each_element(elem, data, len) { 239 /* nothing */ 240 } 241 242 if (for_each_element_completed(elem, data, len)) 243 return 0; 244 245 err: 246 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 247 return -EINVAL; 248 } 249 250 static int validate_ie_attr(const struct nlattr *attr, 251 struct netlink_ext_ack *extack) 252 { 253 const u8 *data = nla_data(attr); 254 unsigned int len = nla_len(attr); 255 const struct element *elem; 256 257 for_each_element(elem, data, len) { 258 /* nothing */ 259 } 260 261 if (for_each_element_completed(elem, data, len)) 262 return 0; 263 264 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 265 return -EINVAL; 266 } 267 268 /* policy for the attributes */ 269 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 270 271 static const struct nla_policy 272 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 273 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 274 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 275 .len = U8_MAX }, 276 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 277 .len = U8_MAX }, 278 }; 279 280 static const struct nla_policy 281 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 282 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 283 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 284 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 285 NLA_POLICY_MAX(NLA_U8, 15), 286 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 287 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 288 NLA_POLICY_MAX(NLA_U8, 15), 289 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 290 NLA_POLICY_MAX(NLA_U8, 31), 291 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 292 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 293 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 294 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 295 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 296 }; 297 298 static const struct nla_policy 299 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 300 [NL80211_PMSR_TYPE_FTM] = 301 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 302 }; 303 304 static const struct nla_policy 305 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 306 [NL80211_PMSR_REQ_ATTR_DATA] = 307 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 308 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 309 }; 310 311 static const struct nla_policy 312 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 313 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 314 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 315 [NL80211_PMSR_PEER_ATTR_REQ] = 316 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 317 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 318 }; 319 320 static const struct nla_policy 321 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 322 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 323 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 324 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 325 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 326 [NL80211_PMSR_ATTR_PEERS] = 327 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy), 328 }; 329 330 static const struct nla_policy 331 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 332 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 333 NLA_POLICY_RANGE(NLA_U8, 1, 20), 334 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 335 NLA_POLICY_RANGE(NLA_U8, 1, 20), 336 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 337 NLA_POLICY_RANGE(NLA_U8, 1, 20), 338 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 339 NLA_POLICY_EXACT_LEN(8), 340 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 341 NLA_POLICY_EXACT_LEN(8), 342 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 343 }; 344 345 static const struct nla_policy 346 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 347 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 348 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 349 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 350 }; 351 352 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 353 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 354 .len = NL80211_MAX_SUPP_RATES }, 355 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 356 .len = NL80211_MAX_SUPP_HT_RATES }, 357 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 358 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 359 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 360 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 361 NL80211_RATE_INFO_HE_GI_0_8, 362 NL80211_RATE_INFO_HE_GI_3_2), 363 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 364 NL80211_RATE_INFO_HE_1XLTF, 365 NL80211_RATE_INFO_HE_4XLTF), 366 }; 367 368 static const struct nla_policy 369 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 370 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 371 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 372 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 373 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 374 [NL80211_TID_CONFIG_ATTR_NOACK] = 375 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 376 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 377 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 378 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 379 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 380 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 381 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 382 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 383 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 384 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 385 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 386 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 387 NLA_POLICY_NESTED(nl80211_txattr_policy), 388 }; 389 390 static const struct nla_policy 391 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 392 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 393 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 394 NLA_POLICY_RANGE(NLA_BINARY, 395 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 396 IEEE80211_MAX_DATA_LEN), 397 }; 398 399 static const struct nla_policy 400 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 401 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 402 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 403 .len = IEEE80211_MAX_DATA_LEN } 404 }; 405 406 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 407 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 408 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 409 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 410 .len = 20-1 }, 411 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 412 413 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 414 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 415 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 416 NL80211_EDMG_CHANNELS_MIN, 417 NL80211_EDMG_CHANNELS_MAX), 418 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 419 NL80211_EDMG_BW_CONFIG_MIN, 420 NL80211_EDMG_BW_CONFIG_MAX), 421 422 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 423 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 424 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 425 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 426 427 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 428 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 429 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 430 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 431 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 432 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 433 434 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 435 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 436 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 437 438 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 439 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 440 441 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 442 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 443 .len = WLAN_MAX_KEY_LEN }, 444 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 445 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 446 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 447 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 448 [NL80211_ATTR_KEY_TYPE] = 449 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 450 451 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 452 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 453 [NL80211_ATTR_BEACON_HEAD] = 454 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 455 IEEE80211_MAX_DATA_LEN), 456 [NL80211_ATTR_BEACON_TAIL] = 457 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 458 IEEE80211_MAX_DATA_LEN), 459 [NL80211_ATTR_STA_AID] = 460 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 461 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 462 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 463 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 464 .len = NL80211_MAX_SUPP_RATES }, 465 [NL80211_ATTR_STA_PLINK_ACTION] = 466 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 467 [NL80211_ATTR_STA_TX_POWER_SETTING] = 468 NLA_POLICY_RANGE(NLA_U8, 469 NL80211_TX_POWER_AUTOMATIC, 470 NL80211_TX_POWER_FIXED), 471 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 472 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 473 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 474 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 475 .len = IEEE80211_MAX_MESH_ID_LEN }, 476 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 477 478 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 479 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 480 481 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 482 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 483 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 484 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 485 .len = NL80211_MAX_SUPP_RATES }, 486 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 487 488 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 489 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 490 491 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 492 493 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 494 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 495 validate_ie_attr, 496 IEEE80211_MAX_DATA_LEN), 497 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 498 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 499 500 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 501 .len = IEEE80211_MAX_SSID_LEN }, 502 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 503 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 504 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 505 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 506 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 507 NL80211_MFP_NO, 508 NL80211_MFP_OPTIONAL), 509 [NL80211_ATTR_STA_FLAGS2] = { 510 .len = sizeof(struct nl80211_sta_flag_update), 511 }, 512 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 513 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 514 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 515 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 516 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 517 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 518 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 519 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 520 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 521 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 522 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 523 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 524 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 525 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 526 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 527 .len = IEEE80211_MAX_DATA_LEN }, 528 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 529 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 530 NL80211_PS_DISABLED, 531 NL80211_PS_ENABLED), 532 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 533 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 534 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 535 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 536 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 537 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 538 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 539 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 540 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 541 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 542 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 543 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 544 [NL80211_ATTR_STA_PLINK_STATE] = 545 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 546 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 547 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 548 [NL80211_ATTR_MESH_PEER_AID] = 549 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 550 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 551 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 552 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 553 [NL80211_ATTR_HIDDEN_SSID] = 554 NLA_POLICY_RANGE(NLA_U32, 555 NL80211_HIDDEN_SSID_NOT_IN_USE, 556 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 557 [NL80211_ATTR_IE_PROBE_RESP] = 558 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 559 IEEE80211_MAX_DATA_LEN), 560 [NL80211_ATTR_IE_ASSOC_RESP] = 561 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 562 IEEE80211_MAX_DATA_LEN), 563 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 564 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 565 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 566 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 567 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 568 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 569 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 570 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 572 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 573 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 574 .len = IEEE80211_MAX_DATA_LEN }, 575 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 576 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 577 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 578 .len = NL80211_HT_CAPABILITY_LEN 579 }, 580 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 581 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 582 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 583 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 584 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 585 586 /* need to include at least Auth Transaction and Status Code */ 587 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 588 589 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 590 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 591 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 592 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 593 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 594 NLA_POLICY_RANGE(NLA_U32, 595 NL80211_MESH_POWER_UNKNOWN + 1, 596 NL80211_MESH_POWER_MAX), 597 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 598 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 599 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 600 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 601 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 602 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 603 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 604 .len = NL80211_VHT_CAPABILITY_LEN, 605 }, 606 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 607 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 608 .len = IEEE80211_MAX_DATA_LEN }, 609 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 610 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 611 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 612 [NL80211_ATTR_PEER_AID] = 613 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 614 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 615 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 616 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 617 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 618 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 619 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 620 /* 621 * The value of the Length field of the Supported Operating 622 * Classes element is between 2 and 253. 623 */ 624 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 625 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 626 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 627 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 628 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 629 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 630 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 631 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 632 IEEE80211_QOS_MAP_LEN_MIN, 633 IEEE80211_QOS_MAP_LEN_MAX), 634 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 635 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 636 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 637 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 638 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 639 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 640 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 641 [NL80211_ATTR_USER_PRIO] = 642 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 643 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 644 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 645 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 646 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 647 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 648 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 649 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 650 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 651 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 652 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 653 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 654 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 655 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 656 .len = VHT_MUMIMO_GROUPS_DATA_LEN 657 }, 658 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 659 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 660 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 661 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 662 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 663 .len = FILS_MAX_KEK_LEN }, 664 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 665 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 666 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 667 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 668 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 669 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 670 }, 671 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 672 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 673 .len = FILS_ERP_MAX_USERNAME_LEN }, 674 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 675 .len = FILS_ERP_MAX_REALM_LEN }, 676 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 677 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 678 .len = FILS_ERP_MAX_RRK_LEN }, 679 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 680 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 681 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 682 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 683 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 684 685 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 686 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 687 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 688 [NL80211_ATTR_HE_CAPABILITY] = 689 NLA_POLICY_RANGE(NLA_BINARY, 690 NL80211_HE_MIN_CAPABILITY_LEN, 691 NL80211_HE_MAX_CAPABILITY_LEN), 692 [NL80211_ATTR_FTM_RESPONDER] = 693 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 694 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 695 [NL80211_ATTR_PEER_MEASUREMENTS] = 696 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 697 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 698 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 699 .len = SAE_PASSWORD_MAX_LEN }, 700 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 701 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 702 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 703 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 704 [NL80211_ATTR_TID_CONFIG] = 705 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 706 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 707 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 708 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 709 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 710 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 711 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 712 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 713 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 714 [NL80211_ATTR_FILS_DISCOVERY] = 715 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 716 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 717 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 718 [NL80211_ATTR_S1G_CAPABILITY] = 719 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 720 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 721 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 722 }; 723 724 /* policy for the key attributes */ 725 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 726 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 727 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 728 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 729 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 730 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 731 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 732 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 733 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 734 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 735 }; 736 737 /* policy for the key default flags */ 738 static const struct nla_policy 739 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 740 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 741 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 742 }; 743 744 #ifdef CONFIG_PM 745 /* policy for WoWLAN attributes */ 746 static const struct nla_policy 747 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 748 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 749 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 750 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 751 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 752 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 753 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 754 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 755 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 756 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 757 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 758 }; 759 760 static const struct nla_policy 761 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 762 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 763 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 764 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 765 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 766 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 767 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 768 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 769 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 770 }, 771 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 772 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 773 }, 774 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 775 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 776 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 777 }; 778 #endif /* CONFIG_PM */ 779 780 /* policy for coalesce rule attributes */ 781 static const struct nla_policy 782 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 783 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 784 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 785 NLA_POLICY_RANGE(NLA_U32, 786 NL80211_COALESCE_CONDITION_MATCH, 787 NL80211_COALESCE_CONDITION_NO_MATCH), 788 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 789 }; 790 791 /* policy for GTK rekey offload attributes */ 792 static const struct nla_policy 793 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 794 [NL80211_REKEY_DATA_KEK] = { 795 .type = NLA_BINARY, 796 .len = NL80211_KEK_EXT_LEN 797 }, 798 [NL80211_REKEY_DATA_KCK] = { 799 .type = NLA_BINARY, 800 .len = NL80211_KCK_EXT_LEN 801 }, 802 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 803 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 804 }; 805 806 static const struct nla_policy 807 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 808 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 809 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 810 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 811 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 812 }; 813 814 static const struct nla_policy 815 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 816 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 817 .len = IEEE80211_MAX_SSID_LEN }, 818 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 819 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 820 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 821 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 822 }; 823 824 static const struct nla_policy 825 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 826 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 827 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 828 }; 829 830 static const struct nla_policy 831 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 832 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 833 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 834 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 835 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 836 }, 837 }; 838 839 /* policy for NAN function attributes */ 840 static const struct nla_policy 841 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 842 [NL80211_NAN_FUNC_TYPE] = 843 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 844 [NL80211_NAN_FUNC_SERVICE_ID] = { 845 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 846 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 847 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 848 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 849 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 850 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 851 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 852 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 853 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 854 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 855 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 856 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 857 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 858 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 859 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 860 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 861 }; 862 863 /* policy for Service Response Filter attributes */ 864 static const struct nla_policy 865 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 866 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 867 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 868 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 869 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 870 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 871 }; 872 873 /* policy for packet pattern attributes */ 874 static const struct nla_policy 875 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 876 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 877 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 878 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 879 }; 880 881 int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 882 struct cfg80211_registered_device **rdev, 883 struct wireless_dev **wdev) 884 { 885 int err; 886 887 if (!cb->args[0]) { 888 struct nlattr **attrbuf; 889 890 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 891 GFP_KERNEL); 892 if (!attrbuf) 893 return -ENOMEM; 894 895 err = nlmsg_parse_deprecated(cb->nlh, 896 GENL_HDRLEN + nl80211_fam.hdrsize, 897 attrbuf, nl80211_fam.maxattr, 898 nl80211_policy, NULL); 899 if (err) { 900 kfree(attrbuf); 901 return err; 902 } 903 904 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk), 905 attrbuf); 906 kfree(attrbuf); 907 if (IS_ERR(*wdev)) 908 return PTR_ERR(*wdev); 909 *rdev = wiphy_to_rdev((*wdev)->wiphy); 910 /* 0 is the first index - add 1 to parse only once */ 911 cb->args[0] = (*rdev)->wiphy_idx + 1; 912 cb->args[1] = (*wdev)->identifier; 913 } else { 914 /* subtract the 1 again here */ 915 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 916 struct wireless_dev *tmp; 917 918 if (!wiphy) 919 return -ENODEV; 920 *rdev = wiphy_to_rdev(wiphy); 921 *wdev = NULL; 922 923 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 924 if (tmp->identifier == cb->args[1]) { 925 *wdev = tmp; 926 break; 927 } 928 } 929 930 if (!*wdev) 931 return -ENODEV; 932 } 933 934 return 0; 935 } 936 937 /* message building helper */ 938 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 939 int flags, u8 cmd) 940 { 941 /* since there is no private header just add the generic one */ 942 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 943 } 944 945 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 946 const struct ieee80211_reg_rule *rule) 947 { 948 int j; 949 struct nlattr *nl_wmm_rules = 950 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 951 952 if (!nl_wmm_rules) 953 goto nla_put_failure; 954 955 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 956 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 957 958 if (!nl_wmm_rule) 959 goto nla_put_failure; 960 961 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 962 rule->wmm_rule.client[j].cw_min) || 963 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 964 rule->wmm_rule.client[j].cw_max) || 965 nla_put_u8(msg, NL80211_WMMR_AIFSN, 966 rule->wmm_rule.client[j].aifsn) || 967 nla_put_u16(msg, NL80211_WMMR_TXOP, 968 rule->wmm_rule.client[j].cot)) 969 goto nla_put_failure; 970 971 nla_nest_end(msg, nl_wmm_rule); 972 } 973 nla_nest_end(msg, nl_wmm_rules); 974 975 return 0; 976 977 nla_put_failure: 978 return -ENOBUFS; 979 } 980 981 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 982 struct ieee80211_channel *chan, 983 bool large) 984 { 985 /* Some channels must be completely excluded from the 986 * list to protect old user-space tools from breaking 987 */ 988 if (!large && chan->flags & 989 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 990 return 0; 991 if (!large && chan->freq_offset) 992 return 0; 993 994 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 995 chan->center_freq)) 996 goto nla_put_failure; 997 998 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 999 goto nla_put_failure; 1000 1001 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1002 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1003 goto nla_put_failure; 1004 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1005 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1006 goto nla_put_failure; 1007 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1008 goto nla_put_failure; 1009 } 1010 if (chan->flags & IEEE80211_CHAN_RADAR) { 1011 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1012 goto nla_put_failure; 1013 if (large) { 1014 u32 time; 1015 1016 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1017 1018 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1019 chan->dfs_state)) 1020 goto nla_put_failure; 1021 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1022 time)) 1023 goto nla_put_failure; 1024 if (nla_put_u32(msg, 1025 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1026 chan->dfs_cac_ms)) 1027 goto nla_put_failure; 1028 } 1029 } 1030 1031 if (large) { 1032 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1033 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1034 goto nla_put_failure; 1035 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1036 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1037 goto nla_put_failure; 1038 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1039 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1040 goto nla_put_failure; 1041 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1042 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1043 goto nla_put_failure; 1044 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1045 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1046 goto nla_put_failure; 1047 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1048 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1049 goto nla_put_failure; 1050 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1051 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1052 goto nla_put_failure; 1053 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1054 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1055 goto nla_put_failure; 1056 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1057 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1058 goto nla_put_failure; 1059 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1060 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1061 goto nla_put_failure; 1062 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1063 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1064 goto nla_put_failure; 1065 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1066 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1067 goto nla_put_failure; 1068 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1069 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1070 goto nla_put_failure; 1071 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1072 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1073 goto nla_put_failure; 1074 } 1075 1076 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1077 DBM_TO_MBM(chan->max_power))) 1078 goto nla_put_failure; 1079 1080 if (large) { 1081 const struct ieee80211_reg_rule *rule = 1082 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1083 1084 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1085 if (nl80211_msg_put_wmm_rules(msg, rule)) 1086 goto nla_put_failure; 1087 } 1088 } 1089 1090 return 0; 1091 1092 nla_put_failure: 1093 return -ENOBUFS; 1094 } 1095 1096 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1097 struct cfg80211_txq_stats *txqstats, 1098 int attrtype) 1099 { 1100 struct nlattr *txqattr; 1101 1102 #define PUT_TXQVAL_U32(attr, memb) do { \ 1103 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1104 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1105 return false; \ 1106 } while (0) 1107 1108 txqattr = nla_nest_start_noflag(msg, attrtype); 1109 if (!txqattr) 1110 return false; 1111 1112 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1113 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1114 PUT_TXQVAL_U32(FLOWS, flows); 1115 PUT_TXQVAL_U32(DROPS, drops); 1116 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1117 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1118 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1119 PUT_TXQVAL_U32(COLLISIONS, collisions); 1120 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1121 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1122 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1123 nla_nest_end(msg, txqattr); 1124 1125 #undef PUT_TXQVAL_U32 1126 return true; 1127 } 1128 1129 /* netlink command implementations */ 1130 1131 struct key_parse { 1132 struct key_params p; 1133 int idx; 1134 int type; 1135 bool def, defmgmt, defbeacon; 1136 bool def_uni, def_multi; 1137 }; 1138 1139 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1140 struct key_parse *k) 1141 { 1142 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1143 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1144 nl80211_key_policy, 1145 info->extack); 1146 if (err) 1147 return err; 1148 1149 k->def = !!tb[NL80211_KEY_DEFAULT]; 1150 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1151 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1152 1153 if (k->def) { 1154 k->def_uni = true; 1155 k->def_multi = true; 1156 } 1157 if (k->defmgmt || k->defbeacon) 1158 k->def_multi = true; 1159 1160 if (tb[NL80211_KEY_IDX]) 1161 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1162 1163 if (tb[NL80211_KEY_DATA]) { 1164 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1165 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1166 } 1167 1168 if (tb[NL80211_KEY_SEQ]) { 1169 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1170 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1171 } 1172 1173 if (tb[NL80211_KEY_CIPHER]) 1174 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1175 1176 if (tb[NL80211_KEY_TYPE]) 1177 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1178 1179 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1180 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1181 1182 err = nla_parse_nested_deprecated(kdt, 1183 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1184 tb[NL80211_KEY_DEFAULT_TYPES], 1185 nl80211_key_default_policy, 1186 info->extack); 1187 if (err) 1188 return err; 1189 1190 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1191 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1192 } 1193 1194 if (tb[NL80211_KEY_MODE]) 1195 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1196 1197 return 0; 1198 } 1199 1200 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1201 { 1202 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1203 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1204 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1205 } 1206 1207 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1208 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1209 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1210 } 1211 1212 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1213 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1214 1215 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1216 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1217 1218 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1219 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1220 1221 if (k->def) { 1222 k->def_uni = true; 1223 k->def_multi = true; 1224 } 1225 if (k->defmgmt) 1226 k->def_multi = true; 1227 1228 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1229 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1230 1231 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1232 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1233 int err = nla_parse_nested_deprecated(kdt, 1234 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1235 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1236 nl80211_key_default_policy, 1237 info->extack); 1238 if (err) 1239 return err; 1240 1241 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1242 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1243 } 1244 1245 return 0; 1246 } 1247 1248 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1249 { 1250 int err; 1251 1252 memset(k, 0, sizeof(*k)); 1253 k->idx = -1; 1254 k->type = -1; 1255 1256 if (info->attrs[NL80211_ATTR_KEY]) 1257 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1258 else 1259 err = nl80211_parse_key_old(info, k); 1260 1261 if (err) 1262 return err; 1263 1264 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1265 (k->defbeacon ? 1 : 0) > 1) { 1266 GENL_SET_ERR_MSG(info, 1267 "key with multiple default flags is invalid"); 1268 return -EINVAL; 1269 } 1270 1271 if (k->defmgmt || k->defbeacon) { 1272 if (k->def_uni || !k->def_multi) { 1273 GENL_SET_ERR_MSG(info, 1274 "defmgmt/defbeacon key must be mcast"); 1275 return -EINVAL; 1276 } 1277 } 1278 1279 if (k->idx != -1) { 1280 if (k->defmgmt) { 1281 if (k->idx < 4 || k->idx > 5) { 1282 GENL_SET_ERR_MSG(info, 1283 "defmgmt key idx not 4 or 5"); 1284 return -EINVAL; 1285 } 1286 } else if (k->defbeacon) { 1287 if (k->idx < 6 || k->idx > 7) { 1288 GENL_SET_ERR_MSG(info, 1289 "defbeacon key idx not 6 or 7"); 1290 return -EINVAL; 1291 } 1292 } else if (k->def) { 1293 if (k->idx < 0 || k->idx > 3) { 1294 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1295 return -EINVAL; 1296 } 1297 } else { 1298 if (k->idx < 0 || k->idx > 7) { 1299 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1300 return -EINVAL; 1301 } 1302 } 1303 } 1304 1305 return 0; 1306 } 1307 1308 static struct cfg80211_cached_keys * 1309 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1310 struct genl_info *info, bool *no_ht) 1311 { 1312 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1313 struct key_parse parse; 1314 struct nlattr *key; 1315 struct cfg80211_cached_keys *result; 1316 int rem, err, def = 0; 1317 bool have_key = false; 1318 1319 nla_for_each_nested(key, keys, rem) { 1320 have_key = true; 1321 break; 1322 } 1323 1324 if (!have_key) 1325 return NULL; 1326 1327 result = kzalloc(sizeof(*result), GFP_KERNEL); 1328 if (!result) 1329 return ERR_PTR(-ENOMEM); 1330 1331 result->def = -1; 1332 1333 nla_for_each_nested(key, keys, rem) { 1334 memset(&parse, 0, sizeof(parse)); 1335 parse.idx = -1; 1336 1337 err = nl80211_parse_key_new(info, key, &parse); 1338 if (err) 1339 goto error; 1340 err = -EINVAL; 1341 if (!parse.p.key) 1342 goto error; 1343 if (parse.idx < 0 || parse.idx > 3) { 1344 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1345 goto error; 1346 } 1347 if (parse.def) { 1348 if (def) { 1349 GENL_SET_ERR_MSG(info, 1350 "only one key can be default"); 1351 goto error; 1352 } 1353 def = 1; 1354 result->def = parse.idx; 1355 if (!parse.def_uni || !parse.def_multi) 1356 goto error; 1357 } else if (parse.defmgmt) 1358 goto error; 1359 err = cfg80211_validate_key_settings(rdev, &parse.p, 1360 parse.idx, false, NULL); 1361 if (err) 1362 goto error; 1363 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1364 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1365 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1366 err = -EINVAL; 1367 goto error; 1368 } 1369 result->params[parse.idx].cipher = parse.p.cipher; 1370 result->params[parse.idx].key_len = parse.p.key_len; 1371 result->params[parse.idx].key = result->data[parse.idx]; 1372 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1373 1374 /* must be WEP key if we got here */ 1375 if (no_ht) 1376 *no_ht = true; 1377 } 1378 1379 if (result->def < 0) { 1380 err = -EINVAL; 1381 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1382 goto error; 1383 } 1384 1385 return result; 1386 error: 1387 kfree(result); 1388 return ERR_PTR(err); 1389 } 1390 1391 static int nl80211_key_allowed(struct wireless_dev *wdev) 1392 { 1393 ASSERT_WDEV_LOCK(wdev); 1394 1395 switch (wdev->iftype) { 1396 case NL80211_IFTYPE_AP: 1397 case NL80211_IFTYPE_AP_VLAN: 1398 case NL80211_IFTYPE_P2P_GO: 1399 case NL80211_IFTYPE_MESH_POINT: 1400 break; 1401 case NL80211_IFTYPE_ADHOC: 1402 case NL80211_IFTYPE_STATION: 1403 case NL80211_IFTYPE_P2P_CLIENT: 1404 if (!wdev->current_bss) 1405 return -ENOLINK; 1406 break; 1407 case NL80211_IFTYPE_UNSPECIFIED: 1408 case NL80211_IFTYPE_OCB: 1409 case NL80211_IFTYPE_MONITOR: 1410 case NL80211_IFTYPE_NAN: 1411 case NL80211_IFTYPE_P2P_DEVICE: 1412 case NL80211_IFTYPE_WDS: 1413 case NUM_NL80211_IFTYPES: 1414 return -EINVAL; 1415 } 1416 1417 return 0; 1418 } 1419 1420 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1421 u32 freq) 1422 { 1423 struct ieee80211_channel *chan; 1424 1425 chan = ieee80211_get_channel_khz(wiphy, freq); 1426 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1427 return NULL; 1428 return chan; 1429 } 1430 1431 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1432 { 1433 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1434 int i; 1435 1436 if (!nl_modes) 1437 goto nla_put_failure; 1438 1439 i = 0; 1440 while (ifmodes) { 1441 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1442 goto nla_put_failure; 1443 ifmodes >>= 1; 1444 i++; 1445 } 1446 1447 nla_nest_end(msg, nl_modes); 1448 return 0; 1449 1450 nla_put_failure: 1451 return -ENOBUFS; 1452 } 1453 1454 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1455 struct sk_buff *msg, 1456 bool large) 1457 { 1458 struct nlattr *nl_combis; 1459 int i, j; 1460 1461 nl_combis = nla_nest_start_noflag(msg, 1462 NL80211_ATTR_INTERFACE_COMBINATIONS); 1463 if (!nl_combis) 1464 goto nla_put_failure; 1465 1466 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1467 const struct ieee80211_iface_combination *c; 1468 struct nlattr *nl_combi, *nl_limits; 1469 1470 c = &wiphy->iface_combinations[i]; 1471 1472 nl_combi = nla_nest_start_noflag(msg, i + 1); 1473 if (!nl_combi) 1474 goto nla_put_failure; 1475 1476 nl_limits = nla_nest_start_noflag(msg, 1477 NL80211_IFACE_COMB_LIMITS); 1478 if (!nl_limits) 1479 goto nla_put_failure; 1480 1481 for (j = 0; j < c->n_limits; j++) { 1482 struct nlattr *nl_limit; 1483 1484 nl_limit = nla_nest_start_noflag(msg, j + 1); 1485 if (!nl_limit) 1486 goto nla_put_failure; 1487 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1488 c->limits[j].max)) 1489 goto nla_put_failure; 1490 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1491 c->limits[j].types)) 1492 goto nla_put_failure; 1493 nla_nest_end(msg, nl_limit); 1494 } 1495 1496 nla_nest_end(msg, nl_limits); 1497 1498 if (c->beacon_int_infra_match && 1499 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1500 goto nla_put_failure; 1501 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1502 c->num_different_channels) || 1503 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1504 c->max_interfaces)) 1505 goto nla_put_failure; 1506 if (large && 1507 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1508 c->radar_detect_widths) || 1509 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1510 c->radar_detect_regions))) 1511 goto nla_put_failure; 1512 if (c->beacon_int_min_gcd && 1513 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1514 c->beacon_int_min_gcd)) 1515 goto nla_put_failure; 1516 1517 nla_nest_end(msg, nl_combi); 1518 } 1519 1520 nla_nest_end(msg, nl_combis); 1521 1522 return 0; 1523 nla_put_failure: 1524 return -ENOBUFS; 1525 } 1526 1527 #ifdef CONFIG_PM 1528 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1529 struct sk_buff *msg) 1530 { 1531 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1532 struct nlattr *nl_tcp; 1533 1534 if (!tcp) 1535 return 0; 1536 1537 nl_tcp = nla_nest_start_noflag(msg, 1538 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1539 if (!nl_tcp) 1540 return -ENOBUFS; 1541 1542 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1543 tcp->data_payload_max)) 1544 return -ENOBUFS; 1545 1546 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1547 tcp->data_payload_max)) 1548 return -ENOBUFS; 1549 1550 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1551 return -ENOBUFS; 1552 1553 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1554 sizeof(*tcp->tok), tcp->tok)) 1555 return -ENOBUFS; 1556 1557 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1558 tcp->data_interval_max)) 1559 return -ENOBUFS; 1560 1561 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1562 tcp->wake_payload_max)) 1563 return -ENOBUFS; 1564 1565 nla_nest_end(msg, nl_tcp); 1566 return 0; 1567 } 1568 1569 static int nl80211_send_wowlan(struct sk_buff *msg, 1570 struct cfg80211_registered_device *rdev, 1571 bool large) 1572 { 1573 struct nlattr *nl_wowlan; 1574 1575 if (!rdev->wiphy.wowlan) 1576 return 0; 1577 1578 nl_wowlan = nla_nest_start_noflag(msg, 1579 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1580 if (!nl_wowlan) 1581 return -ENOBUFS; 1582 1583 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1584 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1585 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1586 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1587 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1588 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1589 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1590 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1591 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1592 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1593 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1594 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1595 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1596 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1597 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1598 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1599 return -ENOBUFS; 1600 1601 if (rdev->wiphy.wowlan->n_patterns) { 1602 struct nl80211_pattern_support pat = { 1603 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1604 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1605 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1606 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1607 }; 1608 1609 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1610 sizeof(pat), &pat)) 1611 return -ENOBUFS; 1612 } 1613 1614 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1615 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1616 rdev->wiphy.wowlan->max_nd_match_sets)) 1617 return -ENOBUFS; 1618 1619 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1620 return -ENOBUFS; 1621 1622 nla_nest_end(msg, nl_wowlan); 1623 1624 return 0; 1625 } 1626 #endif 1627 1628 static int nl80211_send_coalesce(struct sk_buff *msg, 1629 struct cfg80211_registered_device *rdev) 1630 { 1631 struct nl80211_coalesce_rule_support rule; 1632 1633 if (!rdev->wiphy.coalesce) 1634 return 0; 1635 1636 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1637 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1638 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1639 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1640 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1641 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1642 1643 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1644 return -ENOBUFS; 1645 1646 return 0; 1647 } 1648 1649 static int 1650 nl80211_send_iftype_data(struct sk_buff *msg, 1651 const struct ieee80211_supported_band *sband, 1652 const struct ieee80211_sband_iftype_data *iftdata) 1653 { 1654 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1655 1656 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1657 iftdata->types_mask)) 1658 return -ENOBUFS; 1659 1660 if (he_cap->has_he) { 1661 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1662 sizeof(he_cap->he_cap_elem.mac_cap_info), 1663 he_cap->he_cap_elem.mac_cap_info) || 1664 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1665 sizeof(he_cap->he_cap_elem.phy_cap_info), 1666 he_cap->he_cap_elem.phy_cap_info) || 1667 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1668 sizeof(he_cap->he_mcs_nss_supp), 1669 &he_cap->he_mcs_nss_supp) || 1670 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1671 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1672 return -ENOBUFS; 1673 } 1674 1675 if (sband->band == NL80211_BAND_6GHZ && 1676 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1677 sizeof(iftdata->he_6ghz_capa), 1678 &iftdata->he_6ghz_capa)) 1679 return -ENOBUFS; 1680 1681 return 0; 1682 } 1683 1684 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1685 struct ieee80211_supported_band *sband, 1686 bool large) 1687 { 1688 struct nlattr *nl_rates, *nl_rate; 1689 struct ieee80211_rate *rate; 1690 int i; 1691 1692 /* add HT info */ 1693 if (sband->ht_cap.ht_supported && 1694 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1695 sizeof(sband->ht_cap.mcs), 1696 &sband->ht_cap.mcs) || 1697 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1698 sband->ht_cap.cap) || 1699 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1700 sband->ht_cap.ampdu_factor) || 1701 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1702 sband->ht_cap.ampdu_density))) 1703 return -ENOBUFS; 1704 1705 /* add VHT info */ 1706 if (sband->vht_cap.vht_supported && 1707 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1708 sizeof(sband->vht_cap.vht_mcs), 1709 &sband->vht_cap.vht_mcs) || 1710 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1711 sband->vht_cap.cap))) 1712 return -ENOBUFS; 1713 1714 if (large && sband->n_iftype_data) { 1715 struct nlattr *nl_iftype_data = 1716 nla_nest_start_noflag(msg, 1717 NL80211_BAND_ATTR_IFTYPE_DATA); 1718 int err; 1719 1720 if (!nl_iftype_data) 1721 return -ENOBUFS; 1722 1723 for (i = 0; i < sband->n_iftype_data; i++) { 1724 struct nlattr *iftdata; 1725 1726 iftdata = nla_nest_start_noflag(msg, i + 1); 1727 if (!iftdata) 1728 return -ENOBUFS; 1729 1730 err = nl80211_send_iftype_data(msg, sband, 1731 &sband->iftype_data[i]); 1732 if (err) 1733 return err; 1734 1735 nla_nest_end(msg, iftdata); 1736 } 1737 1738 nla_nest_end(msg, nl_iftype_data); 1739 } 1740 1741 /* add EDMG info */ 1742 if (large && sband->edmg_cap.channels && 1743 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1744 sband->edmg_cap.channels) || 1745 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1746 sband->edmg_cap.bw_config))) 1747 1748 return -ENOBUFS; 1749 1750 /* add bitrates */ 1751 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1752 if (!nl_rates) 1753 return -ENOBUFS; 1754 1755 for (i = 0; i < sband->n_bitrates; i++) { 1756 nl_rate = nla_nest_start_noflag(msg, i); 1757 if (!nl_rate) 1758 return -ENOBUFS; 1759 1760 rate = &sband->bitrates[i]; 1761 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1762 rate->bitrate)) 1763 return -ENOBUFS; 1764 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1765 nla_put_flag(msg, 1766 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1767 return -ENOBUFS; 1768 1769 nla_nest_end(msg, nl_rate); 1770 } 1771 1772 nla_nest_end(msg, nl_rates); 1773 1774 return 0; 1775 } 1776 1777 static int 1778 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1779 const struct ieee80211_txrx_stypes *mgmt_stypes) 1780 { 1781 u16 stypes; 1782 struct nlattr *nl_ftypes, *nl_ifs; 1783 enum nl80211_iftype ift; 1784 int i; 1785 1786 if (!mgmt_stypes) 1787 return 0; 1788 1789 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 1790 if (!nl_ifs) 1791 return -ENOBUFS; 1792 1793 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1794 nl_ftypes = nla_nest_start_noflag(msg, ift); 1795 if (!nl_ftypes) 1796 return -ENOBUFS; 1797 i = 0; 1798 stypes = mgmt_stypes[ift].tx; 1799 while (stypes) { 1800 if ((stypes & 1) && 1801 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1802 (i << 4) | IEEE80211_FTYPE_MGMT)) 1803 return -ENOBUFS; 1804 stypes >>= 1; 1805 i++; 1806 } 1807 nla_nest_end(msg, nl_ftypes); 1808 } 1809 1810 nla_nest_end(msg, nl_ifs); 1811 1812 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 1813 if (!nl_ifs) 1814 return -ENOBUFS; 1815 1816 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1817 nl_ftypes = nla_nest_start_noflag(msg, ift); 1818 if (!nl_ftypes) 1819 return -ENOBUFS; 1820 i = 0; 1821 stypes = mgmt_stypes[ift].rx; 1822 while (stypes) { 1823 if ((stypes & 1) && 1824 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1825 (i << 4) | IEEE80211_FTYPE_MGMT)) 1826 return -ENOBUFS; 1827 stypes >>= 1; 1828 i++; 1829 } 1830 nla_nest_end(msg, nl_ftypes); 1831 } 1832 nla_nest_end(msg, nl_ifs); 1833 1834 return 0; 1835 } 1836 1837 #define CMD(op, n) \ 1838 do { \ 1839 if (rdev->ops->op) { \ 1840 i++; \ 1841 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1842 goto nla_put_failure; \ 1843 } \ 1844 } while (0) 1845 1846 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1847 struct sk_buff *msg) 1848 { 1849 int i = 0; 1850 1851 /* 1852 * do *NOT* add anything into this function, new things need to be 1853 * advertised only to new versions of userspace that can deal with 1854 * the split (and they can't possibly care about new features... 1855 */ 1856 CMD(add_virtual_intf, NEW_INTERFACE); 1857 CMD(change_virtual_intf, SET_INTERFACE); 1858 CMD(add_key, NEW_KEY); 1859 CMD(start_ap, START_AP); 1860 CMD(add_station, NEW_STATION); 1861 CMD(add_mpath, NEW_MPATH); 1862 CMD(update_mesh_config, SET_MESH_CONFIG); 1863 CMD(change_bss, SET_BSS); 1864 CMD(auth, AUTHENTICATE); 1865 CMD(assoc, ASSOCIATE); 1866 CMD(deauth, DEAUTHENTICATE); 1867 CMD(disassoc, DISASSOCIATE); 1868 CMD(join_ibss, JOIN_IBSS); 1869 CMD(join_mesh, JOIN_MESH); 1870 CMD(set_pmksa, SET_PMKSA); 1871 CMD(del_pmksa, DEL_PMKSA); 1872 CMD(flush_pmksa, FLUSH_PMKSA); 1873 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1874 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1875 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1876 CMD(mgmt_tx, FRAME); 1877 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1878 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1879 i++; 1880 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1881 goto nla_put_failure; 1882 } 1883 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1884 rdev->ops->join_mesh) { 1885 i++; 1886 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1887 goto nla_put_failure; 1888 } 1889 CMD(set_wds_peer, SET_WDS_PEER); 1890 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1891 CMD(tdls_mgmt, TDLS_MGMT); 1892 CMD(tdls_oper, TDLS_OPER); 1893 } 1894 if (rdev->wiphy.max_sched_scan_reqs) 1895 CMD(sched_scan_start, START_SCHED_SCAN); 1896 CMD(probe_client, PROBE_CLIENT); 1897 CMD(set_noack_map, SET_NOACK_MAP); 1898 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1899 i++; 1900 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1901 goto nla_put_failure; 1902 } 1903 CMD(start_p2p_device, START_P2P_DEVICE); 1904 CMD(set_mcast_rate, SET_MCAST_RATE); 1905 #ifdef CONFIG_NL80211_TESTMODE 1906 CMD(testmode_cmd, TESTMODE); 1907 #endif 1908 1909 if (rdev->ops->connect || rdev->ops->auth) { 1910 i++; 1911 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1912 goto nla_put_failure; 1913 } 1914 1915 if (rdev->ops->disconnect || rdev->ops->deauth) { 1916 i++; 1917 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1918 goto nla_put_failure; 1919 } 1920 1921 return i; 1922 nla_put_failure: 1923 return -ENOBUFS; 1924 } 1925 1926 static int 1927 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 1928 struct sk_buff *msg) 1929 { 1930 struct nlattr *ftm; 1931 1932 if (!cap->ftm.supported) 1933 return 0; 1934 1935 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 1936 if (!ftm) 1937 return -ENOBUFS; 1938 1939 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 1940 return -ENOBUFS; 1941 if (cap->ftm.non_asap && 1942 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 1943 return -ENOBUFS; 1944 if (cap->ftm.request_lci && 1945 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 1946 return -ENOBUFS; 1947 if (cap->ftm.request_civicloc && 1948 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 1949 return -ENOBUFS; 1950 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 1951 cap->ftm.preambles)) 1952 return -ENOBUFS; 1953 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 1954 cap->ftm.bandwidths)) 1955 return -ENOBUFS; 1956 if (cap->ftm.max_bursts_exponent >= 0 && 1957 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 1958 cap->ftm.max_bursts_exponent)) 1959 return -ENOBUFS; 1960 if (cap->ftm.max_ftms_per_burst && 1961 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 1962 cap->ftm.max_ftms_per_burst)) 1963 return -ENOBUFS; 1964 if (cap->ftm.trigger_based && 1965 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 1966 return -ENOBUFS; 1967 if (cap->ftm.non_trigger_based && 1968 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 1969 return -ENOBUFS; 1970 1971 nla_nest_end(msg, ftm); 1972 return 0; 1973 } 1974 1975 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 1976 struct sk_buff *msg) 1977 { 1978 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 1979 struct nlattr *pmsr, *caps; 1980 1981 if (!cap) 1982 return 0; 1983 1984 /* 1985 * we don't need to clean up anything here since the caller 1986 * will genlmsg_cancel() if we fail 1987 */ 1988 1989 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 1990 if (!pmsr) 1991 return -ENOBUFS; 1992 1993 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 1994 return -ENOBUFS; 1995 1996 if (cap->report_ap_tsf && 1997 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 1998 return -ENOBUFS; 1999 2000 if (cap->randomize_mac_addr && 2001 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2002 return -ENOBUFS; 2003 2004 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2005 if (!caps) 2006 return -ENOBUFS; 2007 2008 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2009 return -ENOBUFS; 2010 2011 nla_nest_end(msg, caps); 2012 nla_nest_end(msg, pmsr); 2013 2014 return 0; 2015 } 2016 2017 static int 2018 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2019 struct sk_buff *msg) 2020 { 2021 int i; 2022 struct nlattr *nested, *nested_akms; 2023 const struct wiphy_iftype_akm_suites *iftype_akms; 2024 2025 if (!rdev->wiphy.num_iftype_akm_suites || 2026 !rdev->wiphy.iftype_akm_suites) 2027 return 0; 2028 2029 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2030 if (!nested) 2031 return -ENOBUFS; 2032 2033 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2034 nested_akms = nla_nest_start(msg, i + 1); 2035 if (!nested_akms) 2036 return -ENOBUFS; 2037 2038 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2039 2040 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2041 iftype_akms->iftypes_mask)) 2042 return -ENOBUFS; 2043 2044 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2045 sizeof(u32) * iftype_akms->n_akm_suites, 2046 iftype_akms->akm_suites)) { 2047 return -ENOBUFS; 2048 } 2049 nla_nest_end(msg, nested_akms); 2050 } 2051 2052 nla_nest_end(msg, nested); 2053 2054 return 0; 2055 } 2056 2057 static int 2058 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2059 struct sk_buff *msg) 2060 { 2061 struct nlattr *supp; 2062 2063 if (!rdev->wiphy.tid_config_support.vif && 2064 !rdev->wiphy.tid_config_support.peer) 2065 return 0; 2066 2067 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2068 if (!supp) 2069 return -ENOSPC; 2070 2071 if (rdev->wiphy.tid_config_support.vif && 2072 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2073 rdev->wiphy.tid_config_support.vif, 2074 NL80211_TID_CONFIG_ATTR_PAD)) 2075 goto fail; 2076 2077 if (rdev->wiphy.tid_config_support.peer && 2078 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2079 rdev->wiphy.tid_config_support.peer, 2080 NL80211_TID_CONFIG_ATTR_PAD)) 2081 goto fail; 2082 2083 /* for now we just use the same value ... makes more sense */ 2084 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2085 rdev->wiphy.tid_config_support.max_retry)) 2086 goto fail; 2087 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2088 rdev->wiphy.tid_config_support.max_retry)) 2089 goto fail; 2090 2091 nla_nest_end(msg, supp); 2092 2093 return 0; 2094 fail: 2095 nla_nest_cancel(msg, supp); 2096 return -ENOBUFS; 2097 } 2098 2099 struct nl80211_dump_wiphy_state { 2100 s64 filter_wiphy; 2101 long start; 2102 long split_start, band_start, chan_start, capa_start; 2103 bool split; 2104 }; 2105 2106 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2107 enum nl80211_commands cmd, 2108 struct sk_buff *msg, u32 portid, u32 seq, 2109 int flags, struct nl80211_dump_wiphy_state *state) 2110 { 2111 void *hdr; 2112 struct nlattr *nl_bands, *nl_band; 2113 struct nlattr *nl_freqs, *nl_freq; 2114 struct nlattr *nl_cmds; 2115 enum nl80211_band band; 2116 struct ieee80211_channel *chan; 2117 int i; 2118 const struct ieee80211_txrx_stypes *mgmt_stypes = 2119 rdev->wiphy.mgmt_stypes; 2120 u32 features; 2121 2122 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2123 if (!hdr) 2124 return -ENOBUFS; 2125 2126 if (WARN_ON(!state)) 2127 return -EINVAL; 2128 2129 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2130 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2131 wiphy_name(&rdev->wiphy)) || 2132 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2133 cfg80211_rdev_list_generation)) 2134 goto nla_put_failure; 2135 2136 if (cmd != NL80211_CMD_NEW_WIPHY) 2137 goto finish; 2138 2139 switch (state->split_start) { 2140 case 0: 2141 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2142 rdev->wiphy.retry_short) || 2143 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2144 rdev->wiphy.retry_long) || 2145 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2146 rdev->wiphy.frag_threshold) || 2147 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2148 rdev->wiphy.rts_threshold) || 2149 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2150 rdev->wiphy.coverage_class) || 2151 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2152 rdev->wiphy.max_scan_ssids) || 2153 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2154 rdev->wiphy.max_sched_scan_ssids) || 2155 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2156 rdev->wiphy.max_scan_ie_len) || 2157 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2158 rdev->wiphy.max_sched_scan_ie_len) || 2159 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2160 rdev->wiphy.max_match_sets)) 2161 goto nla_put_failure; 2162 2163 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2164 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2165 goto nla_put_failure; 2166 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2167 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2168 goto nla_put_failure; 2169 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2170 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2171 goto nla_put_failure; 2172 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2173 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2174 goto nla_put_failure; 2175 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2176 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2177 goto nla_put_failure; 2178 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2179 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2180 goto nla_put_failure; 2181 state->split_start++; 2182 if (state->split) 2183 break; 2184 fallthrough; 2185 case 1: 2186 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2187 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2188 rdev->wiphy.cipher_suites)) 2189 goto nla_put_failure; 2190 2191 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2192 rdev->wiphy.max_num_pmkids)) 2193 goto nla_put_failure; 2194 2195 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2196 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2197 goto nla_put_failure; 2198 2199 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2200 rdev->wiphy.available_antennas_tx) || 2201 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2202 rdev->wiphy.available_antennas_rx)) 2203 goto nla_put_failure; 2204 2205 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2206 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2207 rdev->wiphy.probe_resp_offload)) 2208 goto nla_put_failure; 2209 2210 if ((rdev->wiphy.available_antennas_tx || 2211 rdev->wiphy.available_antennas_rx) && 2212 rdev->ops->get_antenna) { 2213 u32 tx_ant = 0, rx_ant = 0; 2214 int res; 2215 2216 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2217 if (!res) { 2218 if (nla_put_u32(msg, 2219 NL80211_ATTR_WIPHY_ANTENNA_TX, 2220 tx_ant) || 2221 nla_put_u32(msg, 2222 NL80211_ATTR_WIPHY_ANTENNA_RX, 2223 rx_ant)) 2224 goto nla_put_failure; 2225 } 2226 } 2227 2228 state->split_start++; 2229 if (state->split) 2230 break; 2231 fallthrough; 2232 case 2: 2233 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2234 rdev->wiphy.interface_modes)) 2235 goto nla_put_failure; 2236 state->split_start++; 2237 if (state->split) 2238 break; 2239 fallthrough; 2240 case 3: 2241 nl_bands = nla_nest_start_noflag(msg, 2242 NL80211_ATTR_WIPHY_BANDS); 2243 if (!nl_bands) 2244 goto nla_put_failure; 2245 2246 for (band = state->band_start; 2247 band < NUM_NL80211_BANDS; band++) { 2248 struct ieee80211_supported_band *sband; 2249 2250 /* omit higher bands for ancient software */ 2251 if (band > NL80211_BAND_5GHZ && !state->split) 2252 break; 2253 2254 sband = rdev->wiphy.bands[band]; 2255 2256 if (!sband) 2257 continue; 2258 2259 nl_band = nla_nest_start_noflag(msg, band); 2260 if (!nl_band) 2261 goto nla_put_failure; 2262 2263 switch (state->chan_start) { 2264 case 0: 2265 if (nl80211_send_band_rateinfo(msg, sband, 2266 state->split)) 2267 goto nla_put_failure; 2268 state->chan_start++; 2269 if (state->split) 2270 break; 2271 fallthrough; 2272 default: 2273 /* add frequencies */ 2274 nl_freqs = nla_nest_start_noflag(msg, 2275 NL80211_BAND_ATTR_FREQS); 2276 if (!nl_freqs) 2277 goto nla_put_failure; 2278 2279 for (i = state->chan_start - 1; 2280 i < sband->n_channels; 2281 i++) { 2282 nl_freq = nla_nest_start_noflag(msg, 2283 i); 2284 if (!nl_freq) 2285 goto nla_put_failure; 2286 2287 chan = &sband->channels[i]; 2288 2289 if (nl80211_msg_put_channel( 2290 msg, &rdev->wiphy, chan, 2291 state->split)) 2292 goto nla_put_failure; 2293 2294 nla_nest_end(msg, nl_freq); 2295 if (state->split) 2296 break; 2297 } 2298 if (i < sband->n_channels) 2299 state->chan_start = i + 2; 2300 else 2301 state->chan_start = 0; 2302 nla_nest_end(msg, nl_freqs); 2303 } 2304 2305 nla_nest_end(msg, nl_band); 2306 2307 if (state->split) { 2308 /* start again here */ 2309 if (state->chan_start) 2310 band--; 2311 break; 2312 } 2313 } 2314 nla_nest_end(msg, nl_bands); 2315 2316 if (band < NUM_NL80211_BANDS) 2317 state->band_start = band + 1; 2318 else 2319 state->band_start = 0; 2320 2321 /* if bands & channels are done, continue outside */ 2322 if (state->band_start == 0 && state->chan_start == 0) 2323 state->split_start++; 2324 if (state->split) 2325 break; 2326 fallthrough; 2327 case 4: 2328 nl_cmds = nla_nest_start_noflag(msg, 2329 NL80211_ATTR_SUPPORTED_COMMANDS); 2330 if (!nl_cmds) 2331 goto nla_put_failure; 2332 2333 i = nl80211_add_commands_unsplit(rdev, msg); 2334 if (i < 0) 2335 goto nla_put_failure; 2336 if (state->split) { 2337 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2338 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2339 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2340 CMD(channel_switch, CHANNEL_SWITCH); 2341 CMD(set_qos_map, SET_QOS_MAP); 2342 if (rdev->wiphy.features & 2343 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2344 CMD(add_tx_ts, ADD_TX_TS); 2345 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2346 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2347 CMD(update_ft_ies, UPDATE_FT_IES); 2348 } 2349 #undef CMD 2350 2351 nla_nest_end(msg, nl_cmds); 2352 state->split_start++; 2353 if (state->split) 2354 break; 2355 fallthrough; 2356 case 5: 2357 if (rdev->ops->remain_on_channel && 2358 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2359 nla_put_u32(msg, 2360 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2361 rdev->wiphy.max_remain_on_channel_duration)) 2362 goto nla_put_failure; 2363 2364 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2365 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2366 goto nla_put_failure; 2367 2368 state->split_start++; 2369 if (state->split) 2370 break; 2371 fallthrough; 2372 case 6: 2373 #ifdef CONFIG_PM 2374 if (nl80211_send_wowlan(msg, rdev, state->split)) 2375 goto nla_put_failure; 2376 state->split_start++; 2377 if (state->split) 2378 break; 2379 #else 2380 state->split_start++; 2381 #endif 2382 fallthrough; 2383 case 7: 2384 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2385 rdev->wiphy.software_iftypes)) 2386 goto nla_put_failure; 2387 2388 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2389 state->split)) 2390 goto nla_put_failure; 2391 2392 state->split_start++; 2393 if (state->split) 2394 break; 2395 fallthrough; 2396 case 8: 2397 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2398 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2399 rdev->wiphy.ap_sme_capa)) 2400 goto nla_put_failure; 2401 2402 features = rdev->wiphy.features; 2403 /* 2404 * We can only add the per-channel limit information if the 2405 * dump is split, otherwise it makes it too big. Therefore 2406 * only advertise it in that case. 2407 */ 2408 if (state->split) 2409 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2410 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2411 goto nla_put_failure; 2412 2413 if (rdev->wiphy.ht_capa_mod_mask && 2414 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2415 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2416 rdev->wiphy.ht_capa_mod_mask)) 2417 goto nla_put_failure; 2418 2419 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2420 rdev->wiphy.max_acl_mac_addrs && 2421 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2422 rdev->wiphy.max_acl_mac_addrs)) 2423 goto nla_put_failure; 2424 2425 /* 2426 * Any information below this point is only available to 2427 * applications that can deal with it being split. This 2428 * helps ensure that newly added capabilities don't break 2429 * older tools by overrunning their buffers. 2430 * 2431 * We still increment split_start so that in the split 2432 * case we'll continue with more data in the next round, 2433 * but break unconditionally so unsplit data stops here. 2434 */ 2435 if (state->split) 2436 state->split_start++; 2437 else 2438 state->split_start = 0; 2439 break; 2440 case 9: 2441 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2442 goto nla_put_failure; 2443 2444 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2445 rdev->wiphy.max_sched_scan_plans) || 2446 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2447 rdev->wiphy.max_sched_scan_plan_interval) || 2448 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2449 rdev->wiphy.max_sched_scan_plan_iterations)) 2450 goto nla_put_failure; 2451 2452 if (rdev->wiphy.extended_capabilities && 2453 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2454 rdev->wiphy.extended_capabilities_len, 2455 rdev->wiphy.extended_capabilities) || 2456 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2457 rdev->wiphy.extended_capabilities_len, 2458 rdev->wiphy.extended_capabilities_mask))) 2459 goto nla_put_failure; 2460 2461 if (rdev->wiphy.vht_capa_mod_mask && 2462 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2463 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2464 rdev->wiphy.vht_capa_mod_mask)) 2465 goto nla_put_failure; 2466 2467 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2468 rdev->wiphy.perm_addr)) 2469 goto nla_put_failure; 2470 2471 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2472 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2473 rdev->wiphy.addr_mask)) 2474 goto nla_put_failure; 2475 2476 if (rdev->wiphy.n_addresses > 1) { 2477 void *attr; 2478 2479 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2480 if (!attr) 2481 goto nla_put_failure; 2482 2483 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2484 if (nla_put(msg, i + 1, ETH_ALEN, 2485 rdev->wiphy.addresses[i].addr)) 2486 goto nla_put_failure; 2487 2488 nla_nest_end(msg, attr); 2489 } 2490 2491 state->split_start++; 2492 break; 2493 case 10: 2494 if (nl80211_send_coalesce(msg, rdev)) 2495 goto nla_put_failure; 2496 2497 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2498 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2499 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2500 goto nla_put_failure; 2501 2502 if (rdev->wiphy.max_ap_assoc_sta && 2503 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2504 rdev->wiphy.max_ap_assoc_sta)) 2505 goto nla_put_failure; 2506 2507 state->split_start++; 2508 break; 2509 case 11: 2510 if (rdev->wiphy.n_vendor_commands) { 2511 const struct nl80211_vendor_cmd_info *info; 2512 struct nlattr *nested; 2513 2514 nested = nla_nest_start_noflag(msg, 2515 NL80211_ATTR_VENDOR_DATA); 2516 if (!nested) 2517 goto nla_put_failure; 2518 2519 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2520 info = &rdev->wiphy.vendor_commands[i].info; 2521 if (nla_put(msg, i + 1, sizeof(*info), info)) 2522 goto nla_put_failure; 2523 } 2524 nla_nest_end(msg, nested); 2525 } 2526 2527 if (rdev->wiphy.n_vendor_events) { 2528 const struct nl80211_vendor_cmd_info *info; 2529 struct nlattr *nested; 2530 2531 nested = nla_nest_start_noflag(msg, 2532 NL80211_ATTR_VENDOR_EVENTS); 2533 if (!nested) 2534 goto nla_put_failure; 2535 2536 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2537 info = &rdev->wiphy.vendor_events[i]; 2538 if (nla_put(msg, i + 1, sizeof(*info), info)) 2539 goto nla_put_failure; 2540 } 2541 nla_nest_end(msg, nested); 2542 } 2543 state->split_start++; 2544 break; 2545 case 12: 2546 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2547 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2548 rdev->wiphy.max_num_csa_counters)) 2549 goto nla_put_failure; 2550 2551 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2552 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2553 goto nla_put_failure; 2554 2555 if (rdev->wiphy.max_sched_scan_reqs && 2556 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2557 rdev->wiphy.max_sched_scan_reqs)) 2558 goto nla_put_failure; 2559 2560 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2561 sizeof(rdev->wiphy.ext_features), 2562 rdev->wiphy.ext_features)) 2563 goto nla_put_failure; 2564 2565 if (rdev->wiphy.bss_select_support) { 2566 struct nlattr *nested; 2567 u32 bss_select_support = rdev->wiphy.bss_select_support; 2568 2569 nested = nla_nest_start_noflag(msg, 2570 NL80211_ATTR_BSS_SELECT); 2571 if (!nested) 2572 goto nla_put_failure; 2573 2574 i = 0; 2575 while (bss_select_support) { 2576 if ((bss_select_support & 1) && 2577 nla_put_flag(msg, i)) 2578 goto nla_put_failure; 2579 i++; 2580 bss_select_support >>= 1; 2581 } 2582 nla_nest_end(msg, nested); 2583 } 2584 2585 state->split_start++; 2586 break; 2587 case 13: 2588 if (rdev->wiphy.num_iftype_ext_capab && 2589 rdev->wiphy.iftype_ext_capab) { 2590 struct nlattr *nested_ext_capab, *nested; 2591 2592 nested = nla_nest_start_noflag(msg, 2593 NL80211_ATTR_IFTYPE_EXT_CAPA); 2594 if (!nested) 2595 goto nla_put_failure; 2596 2597 for (i = state->capa_start; 2598 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2599 const struct wiphy_iftype_ext_capab *capab; 2600 2601 capab = &rdev->wiphy.iftype_ext_capab[i]; 2602 2603 nested_ext_capab = nla_nest_start_noflag(msg, 2604 i); 2605 if (!nested_ext_capab || 2606 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2607 capab->iftype) || 2608 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2609 capab->extended_capabilities_len, 2610 capab->extended_capabilities) || 2611 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2612 capab->extended_capabilities_len, 2613 capab->extended_capabilities_mask)) 2614 goto nla_put_failure; 2615 2616 nla_nest_end(msg, nested_ext_capab); 2617 if (state->split) 2618 break; 2619 } 2620 nla_nest_end(msg, nested); 2621 if (i < rdev->wiphy.num_iftype_ext_capab) { 2622 state->capa_start = i + 1; 2623 break; 2624 } 2625 } 2626 2627 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2628 rdev->wiphy.nan_supported_bands)) 2629 goto nla_put_failure; 2630 2631 if (wiphy_ext_feature_isset(&rdev->wiphy, 2632 NL80211_EXT_FEATURE_TXQS)) { 2633 struct cfg80211_txq_stats txqstats = {}; 2634 int res; 2635 2636 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2637 if (!res && 2638 !nl80211_put_txq_stats(msg, &txqstats, 2639 NL80211_ATTR_TXQ_STATS)) 2640 goto nla_put_failure; 2641 2642 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2643 rdev->wiphy.txq_limit)) 2644 goto nla_put_failure; 2645 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2646 rdev->wiphy.txq_memory_limit)) 2647 goto nla_put_failure; 2648 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2649 rdev->wiphy.txq_quantum)) 2650 goto nla_put_failure; 2651 } 2652 2653 state->split_start++; 2654 break; 2655 case 14: 2656 if (nl80211_send_pmsr_capa(rdev, msg)) 2657 goto nla_put_failure; 2658 2659 state->split_start++; 2660 break; 2661 case 15: 2662 if (rdev->wiphy.akm_suites && 2663 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2664 sizeof(u32) * rdev->wiphy.n_akm_suites, 2665 rdev->wiphy.akm_suites)) 2666 goto nla_put_failure; 2667 2668 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2669 goto nla_put_failure; 2670 2671 if (nl80211_put_tid_config_support(rdev, msg)) 2672 goto nla_put_failure; 2673 2674 /* done */ 2675 state->split_start = 0; 2676 break; 2677 } 2678 finish: 2679 genlmsg_end(msg, hdr); 2680 return 0; 2681 2682 nla_put_failure: 2683 genlmsg_cancel(msg, hdr); 2684 return -EMSGSIZE; 2685 } 2686 2687 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2688 struct netlink_callback *cb, 2689 struct nl80211_dump_wiphy_state *state) 2690 { 2691 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 2692 int ret; 2693 2694 if (!tb) 2695 return -ENOMEM; 2696 2697 ret = nlmsg_parse_deprecated(cb->nlh, 2698 GENL_HDRLEN + nl80211_fam.hdrsize, 2699 tb, nl80211_fam.maxattr, 2700 nl80211_policy, NULL); 2701 /* ignore parse errors for backward compatibility */ 2702 if (ret) { 2703 ret = 0; 2704 goto out; 2705 } 2706 2707 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 2708 if (tb[NL80211_ATTR_WIPHY]) 2709 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 2710 if (tb[NL80211_ATTR_WDEV]) 2711 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 2712 if (tb[NL80211_ATTR_IFINDEX]) { 2713 struct net_device *netdev; 2714 struct cfg80211_registered_device *rdev; 2715 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 2716 2717 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 2718 if (!netdev) { 2719 ret = -ENODEV; 2720 goto out; 2721 } 2722 if (netdev->ieee80211_ptr) { 2723 rdev = wiphy_to_rdev( 2724 netdev->ieee80211_ptr->wiphy); 2725 state->filter_wiphy = rdev->wiphy_idx; 2726 } 2727 } 2728 2729 ret = 0; 2730 out: 2731 kfree(tb); 2732 return ret; 2733 } 2734 2735 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 2736 { 2737 int idx = 0, ret; 2738 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 2739 struct cfg80211_registered_device *rdev; 2740 2741 rtnl_lock(); 2742 if (!state) { 2743 state = kzalloc(sizeof(*state), GFP_KERNEL); 2744 if (!state) { 2745 rtnl_unlock(); 2746 return -ENOMEM; 2747 } 2748 state->filter_wiphy = -1; 2749 ret = nl80211_dump_wiphy_parse(skb, cb, state); 2750 if (ret) { 2751 kfree(state); 2752 rtnl_unlock(); 2753 return ret; 2754 } 2755 cb->args[0] = (long)state; 2756 } 2757 2758 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2759 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2760 continue; 2761 if (++idx <= state->start) 2762 continue; 2763 if (state->filter_wiphy != -1 && 2764 state->filter_wiphy != rdev->wiphy_idx) 2765 continue; 2766 /* attempt to fit multiple wiphy data chunks into the skb */ 2767 do { 2768 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 2769 skb, 2770 NETLINK_CB(cb->skb).portid, 2771 cb->nlh->nlmsg_seq, 2772 NLM_F_MULTI, state); 2773 if (ret < 0) { 2774 /* 2775 * If sending the wiphy data didn't fit (ENOBUFS 2776 * or EMSGSIZE returned), this SKB is still 2777 * empty (so it's not too big because another 2778 * wiphy dataset is already in the skb) and 2779 * we've not tried to adjust the dump allocation 2780 * yet ... then adjust the alloc size to be 2781 * bigger, and return 1 but with the empty skb. 2782 * This results in an empty message being RX'ed 2783 * in userspace, but that is ignored. 2784 * 2785 * We can then retry with the larger buffer. 2786 */ 2787 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2788 !skb->len && !state->split && 2789 cb->min_dump_alloc < 4096) { 2790 cb->min_dump_alloc = 4096; 2791 state->split_start = 0; 2792 rtnl_unlock(); 2793 return 1; 2794 } 2795 idx--; 2796 break; 2797 } 2798 } while (state->split_start > 0); 2799 break; 2800 } 2801 rtnl_unlock(); 2802 2803 state->start = idx; 2804 2805 return skb->len; 2806 } 2807 2808 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2809 { 2810 kfree((void *)cb->args[0]); 2811 return 0; 2812 } 2813 2814 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2815 { 2816 struct sk_buff *msg; 2817 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2818 struct nl80211_dump_wiphy_state state = {}; 2819 2820 msg = nlmsg_new(4096, GFP_KERNEL); 2821 if (!msg) 2822 return -ENOMEM; 2823 2824 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2825 info->snd_portid, info->snd_seq, 0, 2826 &state) < 0) { 2827 nlmsg_free(msg); 2828 return -ENOBUFS; 2829 } 2830 2831 return genlmsg_reply(msg, info); 2832 } 2833 2834 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2835 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2836 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2837 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2838 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2839 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2840 }; 2841 2842 static int parse_txq_params(struct nlattr *tb[], 2843 struct ieee80211_txq_params *txq_params) 2844 { 2845 u8 ac; 2846 2847 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2848 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2849 !tb[NL80211_TXQ_ATTR_AIFS]) 2850 return -EINVAL; 2851 2852 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2853 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2854 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2855 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2856 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2857 2858 if (ac >= NL80211_NUM_ACS) 2859 return -EINVAL; 2860 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 2861 return 0; 2862 } 2863 2864 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2865 { 2866 /* 2867 * You can only set the channel explicitly for WDS interfaces, 2868 * all others have their channel managed via their respective 2869 * "establish a connection" command (connect, join, ...) 2870 * 2871 * For AP/GO and mesh mode, the channel can be set with the 2872 * channel userspace API, but is only stored and passed to the 2873 * low-level driver when the AP starts or the mesh is joined. 2874 * This is for backward compatibility, userspace can also give 2875 * the channel in the start-ap or join-mesh commands instead. 2876 * 2877 * Monitors are special as they are normally slaved to 2878 * whatever else is going on, so they have their own special 2879 * operation to set the monitor channel if possible. 2880 */ 2881 return !wdev || 2882 wdev->iftype == NL80211_IFTYPE_AP || 2883 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2884 wdev->iftype == NL80211_IFTYPE_MONITOR || 2885 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2886 } 2887 2888 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2889 struct genl_info *info, 2890 struct cfg80211_chan_def *chandef) 2891 { 2892 struct netlink_ext_ack *extack = info->extack; 2893 struct nlattr **attrs = info->attrs; 2894 u32 control_freq; 2895 2896 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) 2897 return -EINVAL; 2898 2899 control_freq = MHZ_TO_KHZ( 2900 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 2901 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 2902 control_freq += 2903 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 2904 2905 memset(chandef, 0, sizeof(*chandef)); 2906 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 2907 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2908 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 2909 chandef->freq1_offset = control_freq % 1000; 2910 chandef->center_freq2 = 0; 2911 2912 /* Primary channel not allowed */ 2913 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 2914 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 2915 "Channel is disabled"); 2916 return -EINVAL; 2917 } 2918 2919 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2920 enum nl80211_channel_type chantype; 2921 2922 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2923 2924 switch (chantype) { 2925 case NL80211_CHAN_NO_HT: 2926 case NL80211_CHAN_HT20: 2927 case NL80211_CHAN_HT40PLUS: 2928 case NL80211_CHAN_HT40MINUS: 2929 cfg80211_chandef_create(chandef, chandef->chan, 2930 chantype); 2931 /* user input for center_freq is incorrect */ 2932 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 2933 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 2934 NL_SET_ERR_MSG_ATTR(extack, 2935 attrs[NL80211_ATTR_CENTER_FREQ1], 2936 "bad center frequency 1"); 2937 return -EINVAL; 2938 } 2939 /* center_freq2 must be zero */ 2940 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 2941 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 2942 NL_SET_ERR_MSG_ATTR(extack, 2943 attrs[NL80211_ATTR_CENTER_FREQ2], 2944 "center frequency 2 can't be used"); 2945 return -EINVAL; 2946 } 2947 break; 2948 default: 2949 NL_SET_ERR_MSG_ATTR(extack, 2950 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 2951 "invalid channel type"); 2952 return -EINVAL; 2953 } 2954 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2955 chandef->width = 2956 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2957 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 2958 chandef->center_freq1 = 2959 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 2960 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 2961 chandef->freq1_offset = nla_get_u32( 2962 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 2963 else 2964 chandef->freq1_offset = 0; 2965 } 2966 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 2967 chandef->center_freq2 = 2968 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 2969 } 2970 2971 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 2972 chandef->edmg.channels = 2973 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 2974 2975 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 2976 chandef->edmg.bw_config = 2977 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 2978 } else { 2979 chandef->edmg.bw_config = 0; 2980 chandef->edmg.channels = 0; 2981 } 2982 2983 if (!cfg80211_chandef_valid(chandef)) { 2984 NL_SET_ERR_MSG(extack, "invalid channel definition"); 2985 return -EINVAL; 2986 } 2987 2988 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2989 IEEE80211_CHAN_DISABLED)) { 2990 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 2991 return -EINVAL; 2992 } 2993 2994 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2995 chandef->width == NL80211_CHAN_WIDTH_10) && 2996 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 2997 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 2998 return -EINVAL; 2999 } 3000 3001 return 0; 3002 } 3003 3004 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3005 struct net_device *dev, 3006 struct genl_info *info) 3007 { 3008 struct cfg80211_chan_def chandef; 3009 int result; 3010 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3011 struct wireless_dev *wdev = NULL; 3012 3013 if (dev) 3014 wdev = dev->ieee80211_ptr; 3015 if (!nl80211_can_set_dev_channel(wdev)) 3016 return -EOPNOTSUPP; 3017 if (wdev) 3018 iftype = wdev->iftype; 3019 3020 result = nl80211_parse_chandef(rdev, info, &chandef); 3021 if (result) 3022 return result; 3023 3024 switch (iftype) { 3025 case NL80211_IFTYPE_AP: 3026 case NL80211_IFTYPE_P2P_GO: 3027 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3028 iftype)) { 3029 result = -EINVAL; 3030 break; 3031 } 3032 if (wdev->beacon_interval) { 3033 if (!dev || !rdev->ops->set_ap_chanwidth || 3034 !(rdev->wiphy.features & 3035 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 3036 result = -EBUSY; 3037 break; 3038 } 3039 3040 /* Only allow dynamic channel width changes */ 3041 if (chandef.chan != wdev->preset_chandef.chan) { 3042 result = -EBUSY; 3043 break; 3044 } 3045 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 3046 if (result) 3047 break; 3048 } 3049 wdev->preset_chandef = chandef; 3050 result = 0; 3051 break; 3052 case NL80211_IFTYPE_MESH_POINT: 3053 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3054 break; 3055 case NL80211_IFTYPE_MONITOR: 3056 result = cfg80211_set_monitor_channel(rdev, &chandef); 3057 break; 3058 default: 3059 result = -EINVAL; 3060 } 3061 3062 return result; 3063 } 3064 3065 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3066 { 3067 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3068 struct net_device *netdev = info->user_ptr[1]; 3069 3070 return __nl80211_set_channel(rdev, netdev, info); 3071 } 3072 3073 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 3074 { 3075 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3076 struct net_device *dev = info->user_ptr[1]; 3077 struct wireless_dev *wdev = dev->ieee80211_ptr; 3078 const u8 *bssid; 3079 3080 if (!info->attrs[NL80211_ATTR_MAC]) 3081 return -EINVAL; 3082 3083 if (netif_running(dev)) 3084 return -EBUSY; 3085 3086 if (!rdev->ops->set_wds_peer) 3087 return -EOPNOTSUPP; 3088 3089 if (wdev->iftype != NL80211_IFTYPE_WDS) 3090 return -EOPNOTSUPP; 3091 3092 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 3093 return rdev_set_wds_peer(rdev, dev, bssid); 3094 } 3095 3096 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3097 { 3098 struct cfg80211_registered_device *rdev; 3099 struct net_device *netdev = NULL; 3100 struct wireless_dev *wdev; 3101 int result = 0, rem_txq_params = 0; 3102 struct nlattr *nl_txq_params; 3103 u32 changed; 3104 u8 retry_short = 0, retry_long = 0; 3105 u32 frag_threshold = 0, rts_threshold = 0; 3106 u8 coverage_class = 0; 3107 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3108 3109 ASSERT_RTNL(); 3110 3111 /* 3112 * Try to find the wiphy and netdev. Normally this 3113 * function shouldn't need the netdev, but this is 3114 * done for backward compatibility -- previously 3115 * setting the channel was done per wiphy, but now 3116 * it is per netdev. Previous userland like hostapd 3117 * also passed a netdev to set_wiphy, so that it is 3118 * possible to let that go to the right netdev! 3119 */ 3120 3121 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3122 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3123 3124 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3125 if (netdev && netdev->ieee80211_ptr) 3126 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3127 else 3128 netdev = NULL; 3129 } 3130 3131 if (!netdev) { 3132 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3133 info->attrs); 3134 if (IS_ERR(rdev)) 3135 return PTR_ERR(rdev); 3136 wdev = NULL; 3137 netdev = NULL; 3138 result = 0; 3139 } else 3140 wdev = netdev->ieee80211_ptr; 3141 3142 /* 3143 * end workaround code, by now the rdev is available 3144 * and locked, and wdev may or may not be NULL. 3145 */ 3146 3147 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3148 result = cfg80211_dev_rename( 3149 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3150 3151 if (result) 3152 return result; 3153 3154 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3155 struct ieee80211_txq_params txq_params; 3156 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3157 3158 if (!rdev->ops->set_txq_params) 3159 return -EOPNOTSUPP; 3160 3161 if (!netdev) 3162 return -EINVAL; 3163 3164 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3165 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3166 return -EINVAL; 3167 3168 if (!netif_running(netdev)) 3169 return -ENETDOWN; 3170 3171 nla_for_each_nested(nl_txq_params, 3172 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3173 rem_txq_params) { 3174 result = nla_parse_nested_deprecated(tb, 3175 NL80211_TXQ_ATTR_MAX, 3176 nl_txq_params, 3177 txq_params_policy, 3178 info->extack); 3179 if (result) 3180 return result; 3181 result = parse_txq_params(tb, &txq_params); 3182 if (result) 3183 return result; 3184 3185 result = rdev_set_txq_params(rdev, netdev, 3186 &txq_params); 3187 if (result) 3188 return result; 3189 } 3190 } 3191 3192 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3193 result = __nl80211_set_channel( 3194 rdev, 3195 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3196 info); 3197 if (result) 3198 return result; 3199 } 3200 3201 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3202 struct wireless_dev *txp_wdev = wdev; 3203 enum nl80211_tx_power_setting type; 3204 int idx, mbm = 0; 3205 3206 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3207 txp_wdev = NULL; 3208 3209 if (!rdev->ops->set_tx_power) 3210 return -EOPNOTSUPP; 3211 3212 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3213 type = nla_get_u32(info->attrs[idx]); 3214 3215 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3216 (type != NL80211_TX_POWER_AUTOMATIC)) 3217 return -EINVAL; 3218 3219 if (type != NL80211_TX_POWER_AUTOMATIC) { 3220 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3221 mbm = nla_get_u32(info->attrs[idx]); 3222 } 3223 3224 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3225 if (result) 3226 return result; 3227 } 3228 3229 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3230 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3231 u32 tx_ant, rx_ant; 3232 3233 if ((!rdev->wiphy.available_antennas_tx && 3234 !rdev->wiphy.available_antennas_rx) || 3235 !rdev->ops->set_antenna) 3236 return -EOPNOTSUPP; 3237 3238 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3239 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3240 3241 /* reject antenna configurations which don't match the 3242 * available antenna masks, except for the "all" mask */ 3243 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3244 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 3245 return -EINVAL; 3246 3247 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3248 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3249 3250 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3251 if (result) 3252 return result; 3253 } 3254 3255 changed = 0; 3256 3257 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3258 retry_short = nla_get_u8( 3259 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3260 3261 changed |= WIPHY_PARAM_RETRY_SHORT; 3262 } 3263 3264 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3265 retry_long = nla_get_u8( 3266 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3267 3268 changed |= WIPHY_PARAM_RETRY_LONG; 3269 } 3270 3271 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3272 frag_threshold = nla_get_u32( 3273 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3274 if (frag_threshold < 256) 3275 return -EINVAL; 3276 3277 if (frag_threshold != (u32) -1) { 3278 /* 3279 * Fragments (apart from the last one) are required to 3280 * have even length. Make the fragmentation code 3281 * simpler by stripping LSB should someone try to use 3282 * odd threshold value. 3283 */ 3284 frag_threshold &= ~0x1; 3285 } 3286 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3287 } 3288 3289 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3290 rts_threshold = nla_get_u32( 3291 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3292 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3293 } 3294 3295 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3296 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 3297 return -EINVAL; 3298 3299 coverage_class = nla_get_u8( 3300 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3301 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3302 } 3303 3304 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3305 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 3306 return -EOPNOTSUPP; 3307 3308 changed |= WIPHY_PARAM_DYN_ACK; 3309 } 3310 3311 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3312 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3313 NL80211_EXT_FEATURE_TXQS)) 3314 return -EOPNOTSUPP; 3315 txq_limit = nla_get_u32( 3316 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3317 changed |= WIPHY_PARAM_TXQ_LIMIT; 3318 } 3319 3320 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3321 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3322 NL80211_EXT_FEATURE_TXQS)) 3323 return -EOPNOTSUPP; 3324 txq_memory_limit = nla_get_u32( 3325 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3326 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3327 } 3328 3329 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3330 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3331 NL80211_EXT_FEATURE_TXQS)) 3332 return -EOPNOTSUPP; 3333 txq_quantum = nla_get_u32( 3334 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3335 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3336 } 3337 3338 if (changed) { 3339 u8 old_retry_short, old_retry_long; 3340 u32 old_frag_threshold, old_rts_threshold; 3341 u8 old_coverage_class; 3342 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3343 3344 if (!rdev->ops->set_wiphy_params) 3345 return -EOPNOTSUPP; 3346 3347 old_retry_short = rdev->wiphy.retry_short; 3348 old_retry_long = rdev->wiphy.retry_long; 3349 old_frag_threshold = rdev->wiphy.frag_threshold; 3350 old_rts_threshold = rdev->wiphy.rts_threshold; 3351 old_coverage_class = rdev->wiphy.coverage_class; 3352 old_txq_limit = rdev->wiphy.txq_limit; 3353 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3354 old_txq_quantum = rdev->wiphy.txq_quantum; 3355 3356 if (changed & WIPHY_PARAM_RETRY_SHORT) 3357 rdev->wiphy.retry_short = retry_short; 3358 if (changed & WIPHY_PARAM_RETRY_LONG) 3359 rdev->wiphy.retry_long = retry_long; 3360 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3361 rdev->wiphy.frag_threshold = frag_threshold; 3362 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3363 rdev->wiphy.rts_threshold = rts_threshold; 3364 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3365 rdev->wiphy.coverage_class = coverage_class; 3366 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3367 rdev->wiphy.txq_limit = txq_limit; 3368 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3369 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3370 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3371 rdev->wiphy.txq_quantum = txq_quantum; 3372 3373 result = rdev_set_wiphy_params(rdev, changed); 3374 if (result) { 3375 rdev->wiphy.retry_short = old_retry_short; 3376 rdev->wiphy.retry_long = old_retry_long; 3377 rdev->wiphy.frag_threshold = old_frag_threshold; 3378 rdev->wiphy.rts_threshold = old_rts_threshold; 3379 rdev->wiphy.coverage_class = old_coverage_class; 3380 rdev->wiphy.txq_limit = old_txq_limit; 3381 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3382 rdev->wiphy.txq_quantum = old_txq_quantum; 3383 return result; 3384 } 3385 } 3386 return 0; 3387 } 3388 3389 static int nl80211_send_chandef(struct sk_buff *msg, 3390 const struct cfg80211_chan_def *chandef) 3391 { 3392 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3393 return -EINVAL; 3394 3395 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3396 chandef->chan->center_freq)) 3397 return -ENOBUFS; 3398 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3399 chandef->chan->freq_offset)) 3400 return -ENOBUFS; 3401 switch (chandef->width) { 3402 case NL80211_CHAN_WIDTH_20_NOHT: 3403 case NL80211_CHAN_WIDTH_20: 3404 case NL80211_CHAN_WIDTH_40: 3405 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3406 cfg80211_get_chandef_type(chandef))) 3407 return -ENOBUFS; 3408 break; 3409 default: 3410 break; 3411 } 3412 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3413 return -ENOBUFS; 3414 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3415 return -ENOBUFS; 3416 if (chandef->center_freq2 && 3417 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3418 return -ENOBUFS; 3419 return 0; 3420 } 3421 3422 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3423 struct cfg80211_registered_device *rdev, 3424 struct wireless_dev *wdev, 3425 enum nl80211_commands cmd) 3426 { 3427 struct net_device *dev = wdev->netdev; 3428 void *hdr; 3429 3430 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3431 cmd != NL80211_CMD_DEL_INTERFACE && 3432 cmd != NL80211_CMD_SET_INTERFACE); 3433 3434 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3435 if (!hdr) 3436 return -1; 3437 3438 if (dev && 3439 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3440 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3441 goto nla_put_failure; 3442 3443 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3444 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3445 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3446 NL80211_ATTR_PAD) || 3447 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3448 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3449 rdev->devlist_generation ^ 3450 (cfg80211_rdev_list_generation << 2)) || 3451 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3452 goto nla_put_failure; 3453 3454 if (rdev->ops->get_channel) { 3455 int ret; 3456 struct cfg80211_chan_def chandef = {}; 3457 3458 ret = rdev_get_channel(rdev, wdev, &chandef); 3459 if (ret == 0) { 3460 if (nl80211_send_chandef(msg, &chandef)) 3461 goto nla_put_failure; 3462 } 3463 } 3464 3465 if (rdev->ops->get_tx_power) { 3466 int dbm, ret; 3467 3468 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3469 if (ret == 0 && 3470 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3471 DBM_TO_MBM(dbm))) 3472 goto nla_put_failure; 3473 } 3474 3475 wdev_lock(wdev); 3476 switch (wdev->iftype) { 3477 case NL80211_IFTYPE_AP: 3478 if (wdev->ssid_len && 3479 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 3480 goto nla_put_failure_locked; 3481 break; 3482 case NL80211_IFTYPE_STATION: 3483 case NL80211_IFTYPE_P2P_CLIENT: 3484 case NL80211_IFTYPE_ADHOC: { 3485 const u8 *ssid_ie; 3486 if (!wdev->current_bss) 3487 break; 3488 rcu_read_lock(); 3489 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 3490 WLAN_EID_SSID); 3491 if (ssid_ie && 3492 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 3493 goto nla_put_failure_rcu_locked; 3494 rcu_read_unlock(); 3495 break; 3496 } 3497 default: 3498 /* nothing */ 3499 break; 3500 } 3501 wdev_unlock(wdev); 3502 3503 if (rdev->ops->get_txq_stats) { 3504 struct cfg80211_txq_stats txqstats = {}; 3505 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3506 3507 if (ret == 0 && 3508 !nl80211_put_txq_stats(msg, &txqstats, 3509 NL80211_ATTR_TXQ_STATS)) 3510 goto nla_put_failure; 3511 } 3512 3513 genlmsg_end(msg, hdr); 3514 return 0; 3515 3516 nla_put_failure_rcu_locked: 3517 rcu_read_unlock(); 3518 nla_put_failure_locked: 3519 wdev_unlock(wdev); 3520 nla_put_failure: 3521 genlmsg_cancel(msg, hdr); 3522 return -EMSGSIZE; 3523 } 3524 3525 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3526 { 3527 int wp_idx = 0; 3528 int if_idx = 0; 3529 int wp_start = cb->args[0]; 3530 int if_start = cb->args[1]; 3531 int filter_wiphy = -1; 3532 struct cfg80211_registered_device *rdev; 3533 struct wireless_dev *wdev; 3534 int ret; 3535 3536 rtnl_lock(); 3537 if (!cb->args[2]) { 3538 struct nl80211_dump_wiphy_state state = { 3539 .filter_wiphy = -1, 3540 }; 3541 3542 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3543 if (ret) 3544 goto out_unlock; 3545 3546 filter_wiphy = state.filter_wiphy; 3547 3548 /* 3549 * if filtering, set cb->args[2] to +1 since 0 is the default 3550 * value needed to determine that parsing is necessary. 3551 */ 3552 if (filter_wiphy >= 0) 3553 cb->args[2] = filter_wiphy + 1; 3554 else 3555 cb->args[2] = -1; 3556 } else if (cb->args[2] > 0) { 3557 filter_wiphy = cb->args[2] - 1; 3558 } 3559 3560 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 3561 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3562 continue; 3563 if (wp_idx < wp_start) { 3564 wp_idx++; 3565 continue; 3566 } 3567 3568 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 3569 continue; 3570 3571 if_idx = 0; 3572 3573 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3574 if (if_idx < if_start) { 3575 if_idx++; 3576 continue; 3577 } 3578 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 3579 cb->nlh->nlmsg_seq, NLM_F_MULTI, 3580 rdev, wdev, 3581 NL80211_CMD_NEW_INTERFACE) < 0) { 3582 goto out; 3583 } 3584 if_idx++; 3585 } 3586 3587 wp_idx++; 3588 } 3589 out: 3590 cb->args[0] = wp_idx; 3591 cb->args[1] = if_idx; 3592 3593 ret = skb->len; 3594 out_unlock: 3595 rtnl_unlock(); 3596 3597 return ret; 3598 } 3599 3600 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 3601 { 3602 struct sk_buff *msg; 3603 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3604 struct wireless_dev *wdev = info->user_ptr[1]; 3605 3606 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3607 if (!msg) 3608 return -ENOMEM; 3609 3610 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3611 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3612 nlmsg_free(msg); 3613 return -ENOBUFS; 3614 } 3615 3616 return genlmsg_reply(msg, info); 3617 } 3618 3619 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 3620 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 3621 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 3622 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 3623 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 3624 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 3625 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 3626 }; 3627 3628 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 3629 { 3630 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 3631 int flag; 3632 3633 *mntrflags = 0; 3634 3635 if (!nla) 3636 return -EINVAL; 3637 3638 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 3639 return -EINVAL; 3640 3641 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 3642 if (flags[flag]) 3643 *mntrflags |= (1<<flag); 3644 3645 *mntrflags |= MONITOR_FLAG_CHANGED; 3646 3647 return 0; 3648 } 3649 3650 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 3651 enum nl80211_iftype type, 3652 struct genl_info *info, 3653 struct vif_params *params) 3654 { 3655 bool change = false; 3656 int err; 3657 3658 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 3659 if (type != NL80211_IFTYPE_MONITOR) 3660 return -EINVAL; 3661 3662 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 3663 ¶ms->flags); 3664 if (err) 3665 return err; 3666 3667 change = true; 3668 } 3669 3670 if (params->flags & MONITOR_FLAG_ACTIVE && 3671 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 3672 return -EOPNOTSUPP; 3673 3674 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 3675 const u8 *mumimo_groups; 3676 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3677 3678 if (type != NL80211_IFTYPE_MONITOR) 3679 return -EINVAL; 3680 3681 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3682 return -EOPNOTSUPP; 3683 3684 mumimo_groups = 3685 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 3686 3687 /* bits 0 and 63 are reserved and must be zero */ 3688 if ((mumimo_groups[0] & BIT(0)) || 3689 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 3690 return -EINVAL; 3691 3692 params->vht_mumimo_groups = mumimo_groups; 3693 change = true; 3694 } 3695 3696 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 3697 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3698 3699 if (type != NL80211_IFTYPE_MONITOR) 3700 return -EINVAL; 3701 3702 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3703 return -EOPNOTSUPP; 3704 3705 params->vht_mumimo_follow_addr = 3706 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 3707 change = true; 3708 } 3709 3710 return change ? 1 : 0; 3711 } 3712 3713 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 3714 struct net_device *netdev, u8 use_4addr, 3715 enum nl80211_iftype iftype) 3716 { 3717 if (!use_4addr) { 3718 if (netdev && netif_is_bridge_port(netdev)) 3719 return -EBUSY; 3720 return 0; 3721 } 3722 3723 switch (iftype) { 3724 case NL80211_IFTYPE_AP_VLAN: 3725 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 3726 return 0; 3727 break; 3728 case NL80211_IFTYPE_STATION: 3729 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 3730 return 0; 3731 break; 3732 default: 3733 break; 3734 } 3735 3736 return -EOPNOTSUPP; 3737 } 3738 3739 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 3740 { 3741 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3742 struct vif_params params; 3743 int err; 3744 enum nl80211_iftype otype, ntype; 3745 struct net_device *dev = info->user_ptr[1]; 3746 bool change = false; 3747 3748 memset(¶ms, 0, sizeof(params)); 3749 3750 otype = ntype = dev->ieee80211_ptr->iftype; 3751 3752 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3753 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3754 if (otype != ntype) 3755 change = true; 3756 } 3757 3758 if (info->attrs[NL80211_ATTR_MESH_ID]) { 3759 struct wireless_dev *wdev = dev->ieee80211_ptr; 3760 3761 if (ntype != NL80211_IFTYPE_MESH_POINT) 3762 return -EINVAL; 3763 if (netif_running(dev)) 3764 return -EBUSY; 3765 3766 wdev_lock(wdev); 3767 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3768 IEEE80211_MAX_MESH_ID_LEN); 3769 wdev->mesh_id_up_len = 3770 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3771 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3772 wdev->mesh_id_up_len); 3773 wdev_unlock(wdev); 3774 } 3775 3776 if (info->attrs[NL80211_ATTR_4ADDR]) { 3777 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3778 change = true; 3779 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 3780 if (err) 3781 return err; 3782 } else { 3783 params.use_4addr = -1; 3784 } 3785 3786 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 3787 if (err < 0) 3788 return err; 3789 if (err > 0) 3790 change = true; 3791 3792 if (change) 3793 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 3794 else 3795 err = 0; 3796 3797 if (!err && params.use_4addr != -1) 3798 dev->ieee80211_ptr->use_4addr = params.use_4addr; 3799 3800 if (change && !err) { 3801 struct wireless_dev *wdev = dev->ieee80211_ptr; 3802 3803 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 3804 } 3805 3806 return err; 3807 } 3808 3809 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 3810 { 3811 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3812 struct vif_params params; 3813 struct wireless_dev *wdev; 3814 struct sk_buff *msg; 3815 int err; 3816 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 3817 3818 /* to avoid failing a new interface creation due to pending removal */ 3819 cfg80211_destroy_ifaces(rdev); 3820 3821 memset(¶ms, 0, sizeof(params)); 3822 3823 if (!info->attrs[NL80211_ATTR_IFNAME]) 3824 return -EINVAL; 3825 3826 if (info->attrs[NL80211_ATTR_IFTYPE]) 3827 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3828 3829 if (!rdev->ops->add_virtual_intf) 3830 return -EOPNOTSUPP; 3831 3832 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 3833 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 3834 info->attrs[NL80211_ATTR_MAC]) { 3835 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 3836 ETH_ALEN); 3837 if (!is_valid_ether_addr(params.macaddr)) 3838 return -EADDRNOTAVAIL; 3839 } 3840 3841 if (info->attrs[NL80211_ATTR_4ADDR]) { 3842 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3843 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 3844 if (err) 3845 return err; 3846 } 3847 3848 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 3849 return -EOPNOTSUPP; 3850 3851 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 3852 if (err < 0) 3853 return err; 3854 3855 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3856 if (!msg) 3857 return -ENOMEM; 3858 3859 wdev = rdev_add_virtual_intf(rdev, 3860 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 3861 NET_NAME_USER, type, ¶ms); 3862 if (WARN_ON(!wdev)) { 3863 nlmsg_free(msg); 3864 return -EPROTO; 3865 } else if (IS_ERR(wdev)) { 3866 nlmsg_free(msg); 3867 return PTR_ERR(wdev); 3868 } 3869 3870 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 3871 wdev->owner_nlportid = info->snd_portid; 3872 3873 switch (type) { 3874 case NL80211_IFTYPE_MESH_POINT: 3875 if (!info->attrs[NL80211_ATTR_MESH_ID]) 3876 break; 3877 wdev_lock(wdev); 3878 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3879 IEEE80211_MAX_MESH_ID_LEN); 3880 wdev->mesh_id_up_len = 3881 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3882 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3883 wdev->mesh_id_up_len); 3884 wdev_unlock(wdev); 3885 break; 3886 case NL80211_IFTYPE_NAN: 3887 case NL80211_IFTYPE_P2P_DEVICE: 3888 /* 3889 * P2P Device and NAN do not have a netdev, so don't go 3890 * through the netdev notifier and must be added here 3891 */ 3892 cfg80211_init_wdev(wdev); 3893 cfg80211_register_wdev(rdev, wdev); 3894 break; 3895 default: 3896 break; 3897 } 3898 3899 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3900 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3901 nlmsg_free(msg); 3902 return -ENOBUFS; 3903 } 3904 3905 return genlmsg_reply(msg, info); 3906 } 3907 3908 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3909 { 3910 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3911 struct wireless_dev *wdev = info->user_ptr[1]; 3912 3913 if (!rdev->ops->del_virtual_intf) 3914 return -EOPNOTSUPP; 3915 3916 /* 3917 * If we remove a wireless device without a netdev then clear 3918 * user_ptr[1] so that nl80211_post_doit won't dereference it 3919 * to check if it needs to do dev_put(). Otherwise it crashes 3920 * since the wdev has been freed, unlike with a netdev where 3921 * we need the dev_put() for the netdev to really be freed. 3922 */ 3923 if (!wdev->netdev) 3924 info->user_ptr[1] = NULL; 3925 3926 return rdev_del_virtual_intf(rdev, wdev); 3927 } 3928 3929 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3930 { 3931 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3932 struct net_device *dev = info->user_ptr[1]; 3933 u16 noack_map; 3934 3935 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3936 return -EINVAL; 3937 3938 if (!rdev->ops->set_noack_map) 3939 return -EOPNOTSUPP; 3940 3941 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3942 3943 return rdev_set_noack_map(rdev, dev, noack_map); 3944 } 3945 3946 struct get_key_cookie { 3947 struct sk_buff *msg; 3948 int error; 3949 int idx; 3950 }; 3951 3952 static void get_key_callback(void *c, struct key_params *params) 3953 { 3954 struct nlattr *key; 3955 struct get_key_cookie *cookie = c; 3956 3957 if ((params->key && 3958 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3959 params->key_len, params->key)) || 3960 (params->seq && 3961 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3962 params->seq_len, params->seq)) || 3963 (params->cipher && 3964 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3965 params->cipher))) 3966 goto nla_put_failure; 3967 3968 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 3969 if (!key) 3970 goto nla_put_failure; 3971 3972 if ((params->key && 3973 nla_put(cookie->msg, NL80211_KEY_DATA, 3974 params->key_len, params->key)) || 3975 (params->seq && 3976 nla_put(cookie->msg, NL80211_KEY_SEQ, 3977 params->seq_len, params->seq)) || 3978 (params->cipher && 3979 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3980 params->cipher))) 3981 goto nla_put_failure; 3982 3983 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 3984 goto nla_put_failure; 3985 3986 nla_nest_end(cookie->msg, key); 3987 3988 return; 3989 nla_put_failure: 3990 cookie->error = 1; 3991 } 3992 3993 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3994 { 3995 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3996 int err; 3997 struct net_device *dev = info->user_ptr[1]; 3998 u8 key_idx = 0; 3999 const u8 *mac_addr = NULL; 4000 bool pairwise; 4001 struct get_key_cookie cookie = { 4002 .error = 0, 4003 }; 4004 void *hdr; 4005 struct sk_buff *msg; 4006 bool bigtk_support = false; 4007 4008 if (wiphy_ext_feature_isset(&rdev->wiphy, 4009 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 4010 bigtk_support = true; 4011 4012 if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION || 4013 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) && 4014 wiphy_ext_feature_isset(&rdev->wiphy, 4015 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 4016 bigtk_support = true; 4017 4018 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 4019 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 4020 4021 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 4022 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 4023 return -EINVAL; 4024 } 4025 } 4026 4027 if (info->attrs[NL80211_ATTR_MAC]) 4028 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4029 4030 pairwise = !!mac_addr; 4031 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4032 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4033 4034 if (kt != NL80211_KEYTYPE_GROUP && 4035 kt != NL80211_KEYTYPE_PAIRWISE) 4036 return -EINVAL; 4037 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4038 } 4039 4040 if (!rdev->ops->get_key) 4041 return -EOPNOTSUPP; 4042 4043 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4044 return -ENOENT; 4045 4046 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4047 if (!msg) 4048 return -ENOMEM; 4049 4050 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4051 NL80211_CMD_NEW_KEY); 4052 if (!hdr) 4053 goto nla_put_failure; 4054 4055 cookie.msg = msg; 4056 cookie.idx = key_idx; 4057 4058 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4059 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4060 goto nla_put_failure; 4061 if (mac_addr && 4062 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4063 goto nla_put_failure; 4064 4065 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 4066 get_key_callback); 4067 4068 if (err) 4069 goto free_msg; 4070 4071 if (cookie.error) 4072 goto nla_put_failure; 4073 4074 genlmsg_end(msg, hdr); 4075 return genlmsg_reply(msg, info); 4076 4077 nla_put_failure: 4078 err = -ENOBUFS; 4079 free_msg: 4080 nlmsg_free(msg); 4081 return err; 4082 } 4083 4084 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4085 { 4086 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4087 struct key_parse key; 4088 int err; 4089 struct net_device *dev = info->user_ptr[1]; 4090 4091 err = nl80211_parse_key(info, &key); 4092 if (err) 4093 return err; 4094 4095 if (key.idx < 0) 4096 return -EINVAL; 4097 4098 /* Only support setting default key and 4099 * Extended Key ID action NL80211_KEY_SET_TX. 4100 */ 4101 if (!key.def && !key.defmgmt && !key.defbeacon && 4102 !(key.p.mode == NL80211_KEY_SET_TX)) 4103 return -EINVAL; 4104 4105 wdev_lock(dev->ieee80211_ptr); 4106 4107 if (key.def) { 4108 if (!rdev->ops->set_default_key) { 4109 err = -EOPNOTSUPP; 4110 goto out; 4111 } 4112 4113 err = nl80211_key_allowed(dev->ieee80211_ptr); 4114 if (err) 4115 goto out; 4116 4117 err = rdev_set_default_key(rdev, dev, key.idx, 4118 key.def_uni, key.def_multi); 4119 4120 if (err) 4121 goto out; 4122 4123 #ifdef CONFIG_CFG80211_WEXT 4124 dev->ieee80211_ptr->wext.default_key = key.idx; 4125 #endif 4126 } else if (key.defmgmt) { 4127 if (key.def_uni || !key.def_multi) { 4128 err = -EINVAL; 4129 goto out; 4130 } 4131 4132 if (!rdev->ops->set_default_mgmt_key) { 4133 err = -EOPNOTSUPP; 4134 goto out; 4135 } 4136 4137 err = nl80211_key_allowed(dev->ieee80211_ptr); 4138 if (err) 4139 goto out; 4140 4141 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 4142 if (err) 4143 goto out; 4144 4145 #ifdef CONFIG_CFG80211_WEXT 4146 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 4147 #endif 4148 } else if (key.defbeacon) { 4149 if (key.def_uni || !key.def_multi) { 4150 err = -EINVAL; 4151 goto out; 4152 } 4153 4154 if (!rdev->ops->set_default_beacon_key) { 4155 err = -EOPNOTSUPP; 4156 goto out; 4157 } 4158 4159 err = nl80211_key_allowed(dev->ieee80211_ptr); 4160 if (err) 4161 goto out; 4162 4163 err = rdev_set_default_beacon_key(rdev, dev, key.idx); 4164 if (err) 4165 goto out; 4166 } else if (key.p.mode == NL80211_KEY_SET_TX && 4167 wiphy_ext_feature_isset(&rdev->wiphy, 4168 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4169 u8 *mac_addr = NULL; 4170 4171 if (info->attrs[NL80211_ATTR_MAC]) 4172 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4173 4174 if (!mac_addr || key.idx < 0 || key.idx > 1) { 4175 err = -EINVAL; 4176 goto out; 4177 } 4178 4179 err = rdev_add_key(rdev, dev, key.idx, 4180 NL80211_KEYTYPE_PAIRWISE, 4181 mac_addr, &key.p); 4182 } else { 4183 err = -EINVAL; 4184 } 4185 out: 4186 wdev_unlock(dev->ieee80211_ptr); 4187 4188 return err; 4189 } 4190 4191 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4192 { 4193 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4194 int err; 4195 struct net_device *dev = info->user_ptr[1]; 4196 struct key_parse key; 4197 const u8 *mac_addr = NULL; 4198 4199 err = nl80211_parse_key(info, &key); 4200 if (err) 4201 return err; 4202 4203 if (!key.p.key) { 4204 GENL_SET_ERR_MSG(info, "no key"); 4205 return -EINVAL; 4206 } 4207 4208 if (info->attrs[NL80211_ATTR_MAC]) 4209 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4210 4211 if (key.type == -1) { 4212 if (mac_addr) 4213 key.type = NL80211_KEYTYPE_PAIRWISE; 4214 else 4215 key.type = NL80211_KEYTYPE_GROUP; 4216 } 4217 4218 /* for now */ 4219 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4220 key.type != NL80211_KEYTYPE_GROUP) { 4221 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4222 return -EINVAL; 4223 } 4224 4225 if (key.type == NL80211_KEYTYPE_GROUP && 4226 info->attrs[NL80211_ATTR_VLAN_ID]) 4227 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4228 4229 if (!rdev->ops->add_key) 4230 return -EOPNOTSUPP; 4231 4232 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4233 key.type == NL80211_KEYTYPE_PAIRWISE, 4234 mac_addr)) { 4235 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4236 return -EINVAL; 4237 } 4238 4239 wdev_lock(dev->ieee80211_ptr); 4240 err = nl80211_key_allowed(dev->ieee80211_ptr); 4241 if (err) 4242 GENL_SET_ERR_MSG(info, "key not allowed"); 4243 if (!err) { 4244 err = rdev_add_key(rdev, dev, key.idx, 4245 key.type == NL80211_KEYTYPE_PAIRWISE, 4246 mac_addr, &key.p); 4247 if (err) 4248 GENL_SET_ERR_MSG(info, "key addition failed"); 4249 } 4250 wdev_unlock(dev->ieee80211_ptr); 4251 4252 return err; 4253 } 4254 4255 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4256 { 4257 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4258 int err; 4259 struct net_device *dev = info->user_ptr[1]; 4260 u8 *mac_addr = NULL; 4261 struct key_parse key; 4262 4263 err = nl80211_parse_key(info, &key); 4264 if (err) 4265 return err; 4266 4267 if (info->attrs[NL80211_ATTR_MAC]) 4268 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4269 4270 if (key.type == -1) { 4271 if (mac_addr) 4272 key.type = NL80211_KEYTYPE_PAIRWISE; 4273 else 4274 key.type = NL80211_KEYTYPE_GROUP; 4275 } 4276 4277 /* for now */ 4278 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4279 key.type != NL80211_KEYTYPE_GROUP) 4280 return -EINVAL; 4281 4282 if (!cfg80211_valid_key_idx(rdev, key.idx, 4283 key.type == NL80211_KEYTYPE_PAIRWISE)) 4284 return -EINVAL; 4285 4286 if (!rdev->ops->del_key) 4287 return -EOPNOTSUPP; 4288 4289 wdev_lock(dev->ieee80211_ptr); 4290 err = nl80211_key_allowed(dev->ieee80211_ptr); 4291 4292 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4293 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4294 err = -ENOENT; 4295 4296 if (!err) 4297 err = rdev_del_key(rdev, dev, key.idx, 4298 key.type == NL80211_KEYTYPE_PAIRWISE, 4299 mac_addr); 4300 4301 #ifdef CONFIG_CFG80211_WEXT 4302 if (!err) { 4303 if (key.idx == dev->ieee80211_ptr->wext.default_key) 4304 dev->ieee80211_ptr->wext.default_key = -1; 4305 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 4306 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 4307 } 4308 #endif 4309 wdev_unlock(dev->ieee80211_ptr); 4310 4311 return err; 4312 } 4313 4314 /* This function returns an error or the number of nested attributes */ 4315 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4316 { 4317 struct nlattr *attr; 4318 int n_entries = 0, tmp; 4319 4320 nla_for_each_nested(attr, nl_attr, tmp) { 4321 if (nla_len(attr) != ETH_ALEN) 4322 return -EINVAL; 4323 4324 n_entries++; 4325 } 4326 4327 return n_entries; 4328 } 4329 4330 /* 4331 * This function parses ACL information and allocates memory for ACL data. 4332 * On successful return, the calling function is responsible to free the 4333 * ACL buffer returned by this function. 4334 */ 4335 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4336 struct genl_info *info) 4337 { 4338 enum nl80211_acl_policy acl_policy; 4339 struct nlattr *attr; 4340 struct cfg80211_acl_data *acl; 4341 int i = 0, n_entries, tmp; 4342 4343 if (!wiphy->max_acl_mac_addrs) 4344 return ERR_PTR(-EOPNOTSUPP); 4345 4346 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4347 return ERR_PTR(-EINVAL); 4348 4349 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4350 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4351 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4352 return ERR_PTR(-EINVAL); 4353 4354 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4355 return ERR_PTR(-EINVAL); 4356 4357 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4358 if (n_entries < 0) 4359 return ERR_PTR(n_entries); 4360 4361 if (n_entries > wiphy->max_acl_mac_addrs) 4362 return ERR_PTR(-ENOTSUPP); 4363 4364 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4365 if (!acl) 4366 return ERR_PTR(-ENOMEM); 4367 4368 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4369 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4370 i++; 4371 } 4372 4373 acl->n_acl_entries = n_entries; 4374 acl->acl_policy = acl_policy; 4375 4376 return acl; 4377 } 4378 4379 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4380 { 4381 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4382 struct net_device *dev = info->user_ptr[1]; 4383 struct cfg80211_acl_data *acl; 4384 int err; 4385 4386 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4387 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4388 return -EOPNOTSUPP; 4389 4390 if (!dev->ieee80211_ptr->beacon_interval) 4391 return -EINVAL; 4392 4393 acl = parse_acl_data(&rdev->wiphy, info); 4394 if (IS_ERR(acl)) 4395 return PTR_ERR(acl); 4396 4397 err = rdev_set_mac_acl(rdev, dev, acl); 4398 4399 kfree(acl); 4400 4401 return err; 4402 } 4403 4404 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4405 u8 *rates, u8 rates_len) 4406 { 4407 u8 i; 4408 u32 mask = 0; 4409 4410 for (i = 0; i < rates_len; i++) { 4411 int rate = (rates[i] & 0x7f) * 5; 4412 int ridx; 4413 4414 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4415 struct ieee80211_rate *srate = 4416 &sband->bitrates[ridx]; 4417 if (rate == srate->bitrate) { 4418 mask |= 1 << ridx; 4419 break; 4420 } 4421 } 4422 if (ridx == sband->n_bitrates) 4423 return 0; /* rate not found */ 4424 } 4425 4426 return mask; 4427 } 4428 4429 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4430 u8 *rates, u8 rates_len, 4431 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4432 { 4433 u8 i; 4434 4435 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4436 4437 for (i = 0; i < rates_len; i++) { 4438 int ridx, rbit; 4439 4440 ridx = rates[i] / 8; 4441 rbit = BIT(rates[i] % 8); 4442 4443 /* check validity */ 4444 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4445 return false; 4446 4447 /* check availability */ 4448 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4449 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4450 mcs[ridx] |= rbit; 4451 else 4452 return false; 4453 } 4454 4455 return true; 4456 } 4457 4458 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4459 { 4460 u16 mcs_mask = 0; 4461 4462 switch (vht_mcs_map) { 4463 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4464 break; 4465 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4466 mcs_mask = 0x00FF; 4467 break; 4468 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4469 mcs_mask = 0x01FF; 4470 break; 4471 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4472 mcs_mask = 0x03FF; 4473 break; 4474 default: 4475 break; 4476 } 4477 4478 return mcs_mask; 4479 } 4480 4481 static void vht_build_mcs_mask(u16 vht_mcs_map, 4482 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4483 { 4484 u8 nss; 4485 4486 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4487 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4488 vht_mcs_map >>= 2; 4489 } 4490 } 4491 4492 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 4493 struct nl80211_txrate_vht *txrate, 4494 u16 mcs[NL80211_VHT_NSS_MAX]) 4495 { 4496 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4497 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 4498 u8 i; 4499 4500 if (!sband->vht_cap.vht_supported) 4501 return false; 4502 4503 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 4504 4505 /* Build vht_mcs_mask from VHT capabilities */ 4506 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4507 4508 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4509 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4510 mcs[i] = txrate->mcs[i]; 4511 else 4512 return false; 4513 } 4514 4515 return true; 4516 } 4517 4518 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 4519 { 4520 switch (he_mcs_map) { 4521 case IEEE80211_HE_MCS_NOT_SUPPORTED: 4522 return 0; 4523 case IEEE80211_HE_MCS_SUPPORT_0_7: 4524 return 0x00FF; 4525 case IEEE80211_HE_MCS_SUPPORT_0_9: 4526 return 0x03FF; 4527 case IEEE80211_HE_MCS_SUPPORT_0_11: 4528 return 0xFFF; 4529 default: 4530 break; 4531 } 4532 return 0; 4533 } 4534 4535 static void he_build_mcs_mask(u16 he_mcs_map, 4536 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 4537 { 4538 u8 nss; 4539 4540 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 4541 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 4542 he_mcs_map >>= 2; 4543 } 4544 } 4545 4546 static u16 he_get_txmcsmap(struct genl_info *info, 4547 const struct ieee80211_sta_he_cap *he_cap) 4548 { 4549 struct net_device *dev = info->user_ptr[1]; 4550 struct wireless_dev *wdev = dev->ieee80211_ptr; 4551 __le16 tx_mcs; 4552 4553 switch (wdev->chandef.width) { 4554 case NL80211_CHAN_WIDTH_80P80: 4555 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 4556 break; 4557 case NL80211_CHAN_WIDTH_160: 4558 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 4559 break; 4560 default: 4561 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 4562 break; 4563 } 4564 return le16_to_cpu(tx_mcs); 4565 } 4566 4567 static bool he_set_mcs_mask(struct genl_info *info, 4568 struct wireless_dev *wdev, 4569 struct ieee80211_supported_band *sband, 4570 struct nl80211_txrate_he *txrate, 4571 u16 mcs[NL80211_HE_NSS_MAX]) 4572 { 4573 const struct ieee80211_sta_he_cap *he_cap; 4574 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 4575 u16 tx_mcs_map = 0; 4576 u8 i; 4577 4578 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4579 if (!he_cap) 4580 return false; 4581 4582 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 4583 4584 tx_mcs_map = he_get_txmcsmap(info, he_cap); 4585 4586 /* Build he_mcs_mask from HE capabilities */ 4587 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4588 4589 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 4590 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4591 mcs[i] = txrate->mcs[i]; 4592 else 4593 return false; 4594 } 4595 4596 return true; 4597 } 4598 4599 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 4600 struct nlattr *attrs[], 4601 enum nl80211_attrs attr, 4602 struct cfg80211_bitrate_mask *mask, 4603 struct net_device *dev) 4604 { 4605 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 4606 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4607 struct wireless_dev *wdev = dev->ieee80211_ptr; 4608 int rem, i; 4609 struct nlattr *tx_rates; 4610 struct ieee80211_supported_band *sband; 4611 u16 vht_tx_mcs_map, he_tx_mcs_map; 4612 4613 memset(mask, 0, sizeof(*mask)); 4614 /* Default to all rates enabled */ 4615 for (i = 0; i < NUM_NL80211_BANDS; i++) { 4616 const struct ieee80211_sta_he_cap *he_cap; 4617 4618 sband = rdev->wiphy.bands[i]; 4619 4620 if (!sband) 4621 continue; 4622 4623 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 4624 memcpy(mask->control[i].ht_mcs, 4625 sband->ht_cap.mcs.rx_mask, 4626 sizeof(mask->control[i].ht_mcs)); 4627 4628 if (!sband->vht_cap.vht_supported) 4629 continue; 4630 4631 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4632 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 4633 4634 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4635 if (!he_cap) 4636 continue; 4637 4638 he_tx_mcs_map = he_get_txmcsmap(info, he_cap); 4639 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 4640 4641 mask->control[i].he_gi = 0xFF; 4642 mask->control[i].he_ltf = 0xFF; 4643 } 4644 4645 /* if no rates are given set it back to the defaults */ 4646 if (!attrs[attr]) 4647 goto out; 4648 4649 /* The nested attribute uses enum nl80211_band as the index. This maps 4650 * directly to the enum nl80211_band values used in cfg80211. 4651 */ 4652 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 4653 nla_for_each_nested(tx_rates, attrs[attr], rem) { 4654 enum nl80211_band band = nla_type(tx_rates); 4655 int err; 4656 4657 if (band < 0 || band >= NUM_NL80211_BANDS) 4658 return -EINVAL; 4659 sband = rdev->wiphy.bands[band]; 4660 if (sband == NULL) 4661 return -EINVAL; 4662 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 4663 tx_rates, 4664 nl80211_txattr_policy, 4665 info->extack); 4666 if (err) 4667 return err; 4668 if (tb[NL80211_TXRATE_LEGACY]) { 4669 mask->control[band].legacy = rateset_to_mask( 4670 sband, 4671 nla_data(tb[NL80211_TXRATE_LEGACY]), 4672 nla_len(tb[NL80211_TXRATE_LEGACY])); 4673 if ((mask->control[band].legacy == 0) && 4674 nla_len(tb[NL80211_TXRATE_LEGACY])) 4675 return -EINVAL; 4676 } 4677 if (tb[NL80211_TXRATE_HT]) { 4678 if (!ht_rateset_to_mask( 4679 sband, 4680 nla_data(tb[NL80211_TXRATE_HT]), 4681 nla_len(tb[NL80211_TXRATE_HT]), 4682 mask->control[band].ht_mcs)) 4683 return -EINVAL; 4684 } 4685 if (tb[NL80211_TXRATE_VHT]) { 4686 if (!vht_set_mcs_mask( 4687 sband, 4688 nla_data(tb[NL80211_TXRATE_VHT]), 4689 mask->control[band].vht_mcs)) 4690 return -EINVAL; 4691 } 4692 if (tb[NL80211_TXRATE_GI]) { 4693 mask->control[band].gi = 4694 nla_get_u8(tb[NL80211_TXRATE_GI]); 4695 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 4696 return -EINVAL; 4697 } 4698 if (tb[NL80211_TXRATE_HE] && 4699 !he_set_mcs_mask(info, wdev, sband, 4700 nla_data(tb[NL80211_TXRATE_HE]), 4701 mask->control[band].he_mcs)) 4702 return -EINVAL; 4703 if (tb[NL80211_TXRATE_HE_GI]) 4704 mask->control[band].he_gi = 4705 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 4706 if (tb[NL80211_TXRATE_HE_LTF]) 4707 mask->control[band].he_ltf = 4708 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 4709 4710 if (mask->control[band].legacy == 0) { 4711 /* don't allow empty legacy rates if HT, VHT or HE 4712 * are not even supported. 4713 */ 4714 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 4715 rdev->wiphy.bands[band]->vht_cap.vht_supported || 4716 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 4717 return -EINVAL; 4718 4719 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 4720 if (mask->control[band].ht_mcs[i]) 4721 goto out; 4722 4723 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 4724 if (mask->control[band].vht_mcs[i]) 4725 goto out; 4726 4727 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 4728 if (mask->control[band].he_mcs[i]) 4729 goto out; 4730 4731 /* legacy and mcs rates may not be both empty */ 4732 return -EINVAL; 4733 } 4734 } 4735 4736 out: 4737 return 0; 4738 } 4739 4740 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 4741 enum nl80211_band band, 4742 struct cfg80211_bitrate_mask *beacon_rate) 4743 { 4744 u32 count_ht, count_vht, i; 4745 u32 rate = beacon_rate->control[band].legacy; 4746 4747 /* Allow only one rate */ 4748 if (hweight32(rate) > 1) 4749 return -EINVAL; 4750 4751 count_ht = 0; 4752 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 4753 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 4754 return -EINVAL; 4755 } else if (beacon_rate->control[band].ht_mcs[i]) { 4756 count_ht++; 4757 if (count_ht > 1) 4758 return -EINVAL; 4759 } 4760 if (count_ht && rate) 4761 return -EINVAL; 4762 } 4763 4764 count_vht = 0; 4765 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4766 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 4767 return -EINVAL; 4768 } else if (beacon_rate->control[band].vht_mcs[i]) { 4769 count_vht++; 4770 if (count_vht > 1) 4771 return -EINVAL; 4772 } 4773 if (count_vht && rate) 4774 return -EINVAL; 4775 } 4776 4777 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 4778 return -EINVAL; 4779 4780 if (rate && 4781 !wiphy_ext_feature_isset(&rdev->wiphy, 4782 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 4783 return -EINVAL; 4784 if (count_ht && 4785 !wiphy_ext_feature_isset(&rdev->wiphy, 4786 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 4787 return -EINVAL; 4788 if (count_vht && 4789 !wiphy_ext_feature_isset(&rdev->wiphy, 4790 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 4791 return -EINVAL; 4792 4793 return 0; 4794 } 4795 4796 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 4797 struct nlattr *attrs[], 4798 struct cfg80211_beacon_data *bcn) 4799 { 4800 bool haveinfo = false; 4801 int err; 4802 4803 memset(bcn, 0, sizeof(*bcn)); 4804 4805 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 4806 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 4807 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 4808 if (!bcn->head_len) 4809 return -EINVAL; 4810 haveinfo = true; 4811 } 4812 4813 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 4814 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 4815 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 4816 haveinfo = true; 4817 } 4818 4819 if (!haveinfo) 4820 return -EINVAL; 4821 4822 if (attrs[NL80211_ATTR_IE]) { 4823 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 4824 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 4825 } 4826 4827 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 4828 bcn->proberesp_ies = 4829 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4830 bcn->proberesp_ies_len = 4831 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4832 } 4833 4834 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 4835 bcn->assocresp_ies = 4836 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4837 bcn->assocresp_ies_len = 4838 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4839 } 4840 4841 if (attrs[NL80211_ATTR_PROBE_RESP]) { 4842 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 4843 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 4844 } 4845 4846 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 4847 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 4848 4849 err = nla_parse_nested_deprecated(tb, 4850 NL80211_FTM_RESP_ATTR_MAX, 4851 attrs[NL80211_ATTR_FTM_RESPONDER], 4852 NULL, NULL); 4853 if (err) 4854 return err; 4855 4856 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 4857 wiphy_ext_feature_isset(&rdev->wiphy, 4858 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 4859 bcn->ftm_responder = 1; 4860 else 4861 return -EOPNOTSUPP; 4862 4863 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 4864 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 4865 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 4866 } 4867 4868 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 4869 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4870 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4871 } 4872 } else { 4873 bcn->ftm_responder = -1; 4874 } 4875 4876 return 0; 4877 } 4878 4879 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 4880 struct ieee80211_he_obss_pd *he_obss_pd) 4881 { 4882 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 4883 int err; 4884 4885 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 4886 he_obss_pd_policy, NULL); 4887 if (err) 4888 return err; 4889 4890 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 4891 return -EINVAL; 4892 4893 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 4894 4895 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 4896 he_obss_pd->min_offset = 4897 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 4898 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 4899 he_obss_pd->max_offset = 4900 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 4901 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 4902 he_obss_pd->non_srg_max_offset = 4903 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 4904 4905 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 4906 return -EINVAL; 4907 4908 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 4909 memcpy(he_obss_pd->bss_color_bitmap, 4910 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 4911 sizeof(he_obss_pd->bss_color_bitmap)); 4912 4913 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 4914 memcpy(he_obss_pd->partial_bssid_bitmap, 4915 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 4916 sizeof(he_obss_pd->partial_bssid_bitmap)); 4917 4918 he_obss_pd->enable = true; 4919 4920 return 0; 4921 } 4922 4923 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 4924 struct cfg80211_he_bss_color *he_bss_color) 4925 { 4926 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 4927 int err; 4928 4929 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 4930 he_bss_color_policy, NULL); 4931 if (err) 4932 return err; 4933 4934 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 4935 return -EINVAL; 4936 4937 he_bss_color->color = 4938 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 4939 he_bss_color->enabled = 4940 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 4941 he_bss_color->partial = 4942 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 4943 4944 return 0; 4945 } 4946 4947 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 4948 struct nlattr *attrs, 4949 struct cfg80211_ap_settings *params) 4950 { 4951 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 4952 int ret; 4953 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery; 4954 4955 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4956 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 4957 return -EINVAL; 4958 4959 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 4960 NULL, NULL); 4961 if (ret) 4962 return ret; 4963 4964 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 4965 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 4966 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 4967 return -EINVAL; 4968 4969 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4970 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4971 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 4972 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 4973 4974 return 0; 4975 } 4976 4977 static int 4978 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 4979 struct nlattr *attrs, 4980 struct cfg80211_ap_settings *params) 4981 { 4982 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 4983 int ret; 4984 struct cfg80211_unsol_bcast_probe_resp *presp = 4985 ¶ms->unsol_bcast_probe_resp; 4986 4987 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4988 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 4989 return -EINVAL; 4990 4991 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 4992 attrs, NULL, NULL); 4993 if (ret) 4994 return ret; 4995 4996 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 4997 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 4998 return -EINVAL; 4999 5000 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5001 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5002 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5003 return 0; 5004 } 5005 5006 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5007 const u8 *rates) 5008 { 5009 int i; 5010 5011 if (!rates) 5012 return; 5013 5014 for (i = 0; i < rates[1]; i++) { 5015 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5016 params->ht_required = true; 5017 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5018 params->vht_required = true; 5019 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5020 params->he_required = true; 5021 } 5022 } 5023 5024 /* 5025 * Since the nl80211 API didn't include, from the beginning, attributes about 5026 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5027 * benefit of drivers that rebuild IEs in the firmware. 5028 */ 5029 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5030 { 5031 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5032 size_t ies_len = bcn->tail_len; 5033 const u8 *ies = bcn->tail; 5034 const u8 *rates; 5035 const u8 *cap; 5036 5037 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 5038 nl80211_check_ap_rate_selectors(params, rates); 5039 5040 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5041 nl80211_check_ap_rate_selectors(params, rates); 5042 5043 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5044 if (cap && cap[1] >= sizeof(*params->ht_cap)) 5045 params->ht_cap = (void *)(cap + 2); 5046 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5047 if (cap && cap[1] >= sizeof(*params->vht_cap)) 5048 params->vht_cap = (void *)(cap + 2); 5049 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5050 if (cap && cap[1] >= sizeof(*params->he_cap) + 1) 5051 params->he_cap = (void *)(cap + 3); 5052 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5053 if (cap && cap[1] >= sizeof(*params->he_oper) + 1) 5054 params->he_oper = (void *)(cap + 3); 5055 } 5056 5057 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5058 struct cfg80211_ap_settings *params) 5059 { 5060 struct wireless_dev *wdev; 5061 bool ret = false; 5062 5063 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5064 if (wdev->iftype != NL80211_IFTYPE_AP && 5065 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5066 continue; 5067 5068 if (!wdev->preset_chandef.chan) 5069 continue; 5070 5071 params->chandef = wdev->preset_chandef; 5072 ret = true; 5073 break; 5074 } 5075 5076 return ret; 5077 } 5078 5079 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5080 enum nl80211_auth_type auth_type, 5081 enum nl80211_commands cmd) 5082 { 5083 if (auth_type > NL80211_AUTHTYPE_MAX) 5084 return false; 5085 5086 switch (cmd) { 5087 case NL80211_CMD_AUTHENTICATE: 5088 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5089 auth_type == NL80211_AUTHTYPE_SAE) 5090 return false; 5091 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5092 NL80211_EXT_FEATURE_FILS_STA) && 5093 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5094 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5095 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5096 return false; 5097 return true; 5098 case NL80211_CMD_CONNECT: 5099 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5100 !wiphy_ext_feature_isset(&rdev->wiphy, 5101 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5102 auth_type == NL80211_AUTHTYPE_SAE) 5103 return false; 5104 5105 /* FILS with SK PFS or PK not supported yet */ 5106 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5107 auth_type == NL80211_AUTHTYPE_FILS_PK) 5108 return false; 5109 if (!wiphy_ext_feature_isset( 5110 &rdev->wiphy, 5111 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5112 auth_type == NL80211_AUTHTYPE_FILS_SK) 5113 return false; 5114 return true; 5115 case NL80211_CMD_START_AP: 5116 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5117 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5118 auth_type == NL80211_AUTHTYPE_SAE) 5119 return false; 5120 /* FILS not supported yet */ 5121 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5122 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5123 auth_type == NL80211_AUTHTYPE_FILS_PK) 5124 return false; 5125 return true; 5126 default: 5127 return false; 5128 } 5129 } 5130 5131 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5132 { 5133 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5134 struct net_device *dev = info->user_ptr[1]; 5135 struct wireless_dev *wdev = dev->ieee80211_ptr; 5136 struct cfg80211_ap_settings params; 5137 int err; 5138 5139 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5140 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5141 return -EOPNOTSUPP; 5142 5143 if (!rdev->ops->start_ap) 5144 return -EOPNOTSUPP; 5145 5146 if (wdev->beacon_interval) 5147 return -EALREADY; 5148 5149 memset(¶ms, 0, sizeof(params)); 5150 5151 /* these are required for START_AP */ 5152 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5153 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5154 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5155 return -EINVAL; 5156 5157 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon); 5158 if (err) 5159 return err; 5160 5161 params.beacon_interval = 5162 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5163 params.dtim_period = 5164 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5165 5166 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5167 params.beacon_interval); 5168 if (err) 5169 return err; 5170 5171 /* 5172 * In theory, some of these attributes should be required here 5173 * but since they were not used when the command was originally 5174 * added, keep them optional for old user space programs to let 5175 * them continue to work with drivers that do not need the 5176 * additional information -- drivers must check! 5177 */ 5178 if (info->attrs[NL80211_ATTR_SSID]) { 5179 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5180 params.ssid_len = 5181 nla_len(info->attrs[NL80211_ATTR_SSID]); 5182 if (params.ssid_len == 0) 5183 return -EINVAL; 5184 } 5185 5186 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5187 params.hidden_ssid = nla_get_u32( 5188 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5189 5190 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5191 5192 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 5193 params.auth_type = nla_get_u32( 5194 info->attrs[NL80211_ATTR_AUTH_TYPE]); 5195 if (!nl80211_valid_auth_type(rdev, params.auth_type, 5196 NL80211_CMD_START_AP)) 5197 return -EINVAL; 5198 } else 5199 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 5200 5201 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 5202 NL80211_MAX_NR_CIPHER_SUITES); 5203 if (err) 5204 return err; 5205 5206 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 5207 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 5208 return -EOPNOTSUPP; 5209 params.inactivity_timeout = nla_get_u16( 5210 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 5211 } 5212 5213 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5214 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5215 return -EINVAL; 5216 params.p2p_ctwindow = 5217 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5218 if (params.p2p_ctwindow != 0 && 5219 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5220 return -EINVAL; 5221 } 5222 5223 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5224 u8 tmp; 5225 5226 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5227 return -EINVAL; 5228 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5229 params.p2p_opp_ps = tmp; 5230 if (params.p2p_opp_ps != 0 && 5231 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5232 return -EINVAL; 5233 } 5234 5235 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 5236 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 5237 if (err) 5238 return err; 5239 } else if (wdev->preset_chandef.chan) { 5240 params.chandef = wdev->preset_chandef; 5241 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 5242 return -EINVAL; 5243 5244 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 5245 wdev->iftype)) 5246 return -EINVAL; 5247 5248 if (info->attrs[NL80211_ATTR_TX_RATES]) { 5249 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 5250 NL80211_ATTR_TX_RATES, 5251 ¶ms.beacon_rate, 5252 dev); 5253 if (err) 5254 return err; 5255 5256 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 5257 ¶ms.beacon_rate); 5258 if (err) 5259 return err; 5260 } 5261 5262 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 5263 params.smps_mode = 5264 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 5265 switch (params.smps_mode) { 5266 case NL80211_SMPS_OFF: 5267 break; 5268 case NL80211_SMPS_STATIC: 5269 if (!(rdev->wiphy.features & 5270 NL80211_FEATURE_STATIC_SMPS)) 5271 return -EINVAL; 5272 break; 5273 case NL80211_SMPS_DYNAMIC: 5274 if (!(rdev->wiphy.features & 5275 NL80211_FEATURE_DYNAMIC_SMPS)) 5276 return -EINVAL; 5277 break; 5278 default: 5279 return -EINVAL; 5280 } 5281 } else { 5282 params.smps_mode = NL80211_SMPS_OFF; 5283 } 5284 5285 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 5286 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 5287 return -EOPNOTSUPP; 5288 5289 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 5290 params.acl = parse_acl_data(&rdev->wiphy, info); 5291 if (IS_ERR(params.acl)) 5292 return PTR_ERR(params.acl); 5293 } 5294 5295 params.twt_responder = 5296 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 5297 5298 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 5299 err = nl80211_parse_he_obss_pd( 5300 info->attrs[NL80211_ATTR_HE_OBSS_PD], 5301 ¶ms.he_obss_pd); 5302 if (err) 5303 goto out; 5304 } 5305 5306 if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5307 err = nl80211_parse_he_bss_color( 5308 info->attrs[NL80211_ATTR_HE_BSS_COLOR], 5309 ¶ms.he_bss_color); 5310 if (err) 5311 goto out; 5312 } 5313 5314 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 5315 err = nl80211_parse_fils_discovery(rdev, 5316 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 5317 ¶ms); 5318 if (err) 5319 goto out; 5320 } 5321 5322 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 5323 err = nl80211_parse_unsol_bcast_probe_resp( 5324 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 5325 ¶ms); 5326 if (err) 5327 return err; 5328 } 5329 5330 nl80211_calculate_ap_params(¶ms); 5331 5332 if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 5333 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 5334 5335 wdev_lock(wdev); 5336 err = rdev_start_ap(rdev, dev, ¶ms); 5337 if (!err) { 5338 wdev->preset_chandef = params.chandef; 5339 wdev->beacon_interval = params.beacon_interval; 5340 wdev->chandef = params.chandef; 5341 wdev->ssid_len = params.ssid_len; 5342 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 5343 5344 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 5345 wdev->conn_owner_nlportid = info->snd_portid; 5346 } 5347 wdev_unlock(wdev); 5348 5349 out: 5350 kfree(params.acl); 5351 5352 return err; 5353 } 5354 5355 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 5356 { 5357 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5358 struct net_device *dev = info->user_ptr[1]; 5359 struct wireless_dev *wdev = dev->ieee80211_ptr; 5360 struct cfg80211_beacon_data params; 5361 int err; 5362 5363 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5364 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5365 return -EOPNOTSUPP; 5366 5367 if (!rdev->ops->change_beacon) 5368 return -EOPNOTSUPP; 5369 5370 if (!wdev->beacon_interval) 5371 return -EINVAL; 5372 5373 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms); 5374 if (err) 5375 return err; 5376 5377 wdev_lock(wdev); 5378 err = rdev_change_beacon(rdev, dev, ¶ms); 5379 wdev_unlock(wdev); 5380 5381 return err; 5382 } 5383 5384 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 5385 { 5386 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5387 struct net_device *dev = info->user_ptr[1]; 5388 5389 return cfg80211_stop_ap(rdev, dev, false); 5390 } 5391 5392 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 5393 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 5394 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 5395 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 5396 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 5397 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 5398 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 5399 }; 5400 5401 static int parse_station_flags(struct genl_info *info, 5402 enum nl80211_iftype iftype, 5403 struct station_parameters *params) 5404 { 5405 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 5406 struct nlattr *nla; 5407 int flag; 5408 5409 /* 5410 * Try parsing the new attribute first so userspace 5411 * can specify both for older kernels. 5412 */ 5413 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 5414 if (nla) { 5415 struct nl80211_sta_flag_update *sta_flags; 5416 5417 sta_flags = nla_data(nla); 5418 params->sta_flags_mask = sta_flags->mask; 5419 params->sta_flags_set = sta_flags->set; 5420 params->sta_flags_set &= params->sta_flags_mask; 5421 if ((params->sta_flags_mask | 5422 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 5423 return -EINVAL; 5424 return 0; 5425 } 5426 5427 /* if present, parse the old attribute */ 5428 5429 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 5430 if (!nla) 5431 return 0; 5432 5433 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 5434 return -EINVAL; 5435 5436 /* 5437 * Only allow certain flags for interface types so that 5438 * other attributes are silently ignored. Remember that 5439 * this is backward compatibility code with old userspace 5440 * and shouldn't be hit in other cases anyway. 5441 */ 5442 switch (iftype) { 5443 case NL80211_IFTYPE_AP: 5444 case NL80211_IFTYPE_AP_VLAN: 5445 case NL80211_IFTYPE_P2P_GO: 5446 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5447 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5448 BIT(NL80211_STA_FLAG_WME) | 5449 BIT(NL80211_STA_FLAG_MFP); 5450 break; 5451 case NL80211_IFTYPE_P2P_CLIENT: 5452 case NL80211_IFTYPE_STATION: 5453 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5454 BIT(NL80211_STA_FLAG_TDLS_PEER); 5455 break; 5456 case NL80211_IFTYPE_MESH_POINT: 5457 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5458 BIT(NL80211_STA_FLAG_MFP) | 5459 BIT(NL80211_STA_FLAG_AUTHORIZED); 5460 break; 5461 default: 5462 return -EINVAL; 5463 } 5464 5465 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 5466 if (flags[flag]) { 5467 params->sta_flags_set |= (1<<flag); 5468 5469 /* no longer support new API additions in old API */ 5470 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 5471 return -EINVAL; 5472 } 5473 } 5474 5475 return 0; 5476 } 5477 5478 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 5479 { 5480 struct nlattr *rate; 5481 u32 bitrate; 5482 u16 bitrate_compat; 5483 enum nl80211_rate_info rate_flg; 5484 5485 rate = nla_nest_start_noflag(msg, attr); 5486 if (!rate) 5487 return false; 5488 5489 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 5490 bitrate = cfg80211_calculate_bitrate(info); 5491 /* report 16-bit bitrate only if we can */ 5492 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 5493 if (bitrate > 0 && 5494 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 5495 return false; 5496 if (bitrate_compat > 0 && 5497 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 5498 return false; 5499 5500 switch (info->bw) { 5501 case RATE_INFO_BW_5: 5502 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 5503 break; 5504 case RATE_INFO_BW_10: 5505 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 5506 break; 5507 default: 5508 WARN_ON(1); 5509 fallthrough; 5510 case RATE_INFO_BW_20: 5511 rate_flg = 0; 5512 break; 5513 case RATE_INFO_BW_40: 5514 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 5515 break; 5516 case RATE_INFO_BW_80: 5517 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 5518 break; 5519 case RATE_INFO_BW_160: 5520 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 5521 break; 5522 case RATE_INFO_BW_HE_RU: 5523 rate_flg = 0; 5524 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 5525 } 5526 5527 if (rate_flg && nla_put_flag(msg, rate_flg)) 5528 return false; 5529 5530 if (info->flags & RATE_INFO_FLAGS_MCS) { 5531 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 5532 return false; 5533 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5534 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5535 return false; 5536 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 5537 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 5538 return false; 5539 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 5540 return false; 5541 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5542 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5543 return false; 5544 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 5545 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 5546 return false; 5547 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 5548 return false; 5549 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 5550 return false; 5551 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 5552 return false; 5553 if (info->bw == RATE_INFO_BW_HE_RU && 5554 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 5555 info->he_ru_alloc)) 5556 return false; 5557 } 5558 5559 nla_nest_end(msg, rate); 5560 return true; 5561 } 5562 5563 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 5564 int id) 5565 { 5566 void *attr; 5567 int i = 0; 5568 5569 if (!mask) 5570 return true; 5571 5572 attr = nla_nest_start_noflag(msg, id); 5573 if (!attr) 5574 return false; 5575 5576 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 5577 if (!(mask & BIT(i))) 5578 continue; 5579 5580 if (nla_put_u8(msg, i, signal[i])) 5581 return false; 5582 } 5583 5584 nla_nest_end(msg, attr); 5585 5586 return true; 5587 } 5588 5589 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 5590 u32 seq, int flags, 5591 struct cfg80211_registered_device *rdev, 5592 struct net_device *dev, 5593 const u8 *mac_addr, struct station_info *sinfo) 5594 { 5595 void *hdr; 5596 struct nlattr *sinfoattr, *bss_param; 5597 5598 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 5599 if (!hdr) { 5600 cfg80211_sinfo_release_content(sinfo); 5601 return -1; 5602 } 5603 5604 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5605 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 5606 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 5607 goto nla_put_failure; 5608 5609 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 5610 if (!sinfoattr) 5611 goto nla_put_failure; 5612 5613 #define PUT_SINFO(attr, memb, type) do { \ 5614 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 5615 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5616 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 5617 sinfo->memb)) \ 5618 goto nla_put_failure; \ 5619 } while (0) 5620 #define PUT_SINFO_U64(attr, memb) do { \ 5621 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5622 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 5623 sinfo->memb, NL80211_STA_INFO_PAD)) \ 5624 goto nla_put_failure; \ 5625 } while (0) 5626 5627 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 5628 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 5629 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 5630 5631 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 5632 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 5633 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 5634 (u32)sinfo->rx_bytes)) 5635 goto nla_put_failure; 5636 5637 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 5638 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 5639 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 5640 (u32)sinfo->tx_bytes)) 5641 goto nla_put_failure; 5642 5643 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 5644 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 5645 PUT_SINFO(LLID, llid, u16); 5646 PUT_SINFO(PLID, plid, u16); 5647 PUT_SINFO(PLINK_STATE, plink_state, u8); 5648 PUT_SINFO_U64(RX_DURATION, rx_duration); 5649 PUT_SINFO_U64(TX_DURATION, tx_duration); 5650 5651 if (wiphy_ext_feature_isset(&rdev->wiphy, 5652 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 5653 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 5654 5655 switch (rdev->wiphy.signal_type) { 5656 case CFG80211_SIGNAL_TYPE_MBM: 5657 PUT_SINFO(SIGNAL, signal, u8); 5658 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 5659 break; 5660 default: 5661 break; 5662 } 5663 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 5664 if (!nl80211_put_signal(msg, sinfo->chains, 5665 sinfo->chain_signal, 5666 NL80211_STA_INFO_CHAIN_SIGNAL)) 5667 goto nla_put_failure; 5668 } 5669 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 5670 if (!nl80211_put_signal(msg, sinfo->chains, 5671 sinfo->chain_signal_avg, 5672 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 5673 goto nla_put_failure; 5674 } 5675 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 5676 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 5677 NL80211_STA_INFO_TX_BITRATE)) 5678 goto nla_put_failure; 5679 } 5680 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 5681 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 5682 NL80211_STA_INFO_RX_BITRATE)) 5683 goto nla_put_failure; 5684 } 5685 5686 PUT_SINFO(RX_PACKETS, rx_packets, u32); 5687 PUT_SINFO(TX_PACKETS, tx_packets, u32); 5688 PUT_SINFO(TX_RETRIES, tx_retries, u32); 5689 PUT_SINFO(TX_FAILED, tx_failed, u32); 5690 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 5691 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 5692 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 5693 PUT_SINFO(LOCAL_PM, local_pm, u32); 5694 PUT_SINFO(PEER_PM, peer_pm, u32); 5695 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 5696 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 5697 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 5698 5699 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 5700 bss_param = nla_nest_start_noflag(msg, 5701 NL80211_STA_INFO_BSS_PARAM); 5702 if (!bss_param) 5703 goto nla_put_failure; 5704 5705 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 5706 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 5707 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 5708 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 5709 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 5710 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 5711 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 5712 sinfo->bss_param.dtim_period) || 5713 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 5714 sinfo->bss_param.beacon_interval)) 5715 goto nla_put_failure; 5716 5717 nla_nest_end(msg, bss_param); 5718 } 5719 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 5720 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 5721 sizeof(struct nl80211_sta_flag_update), 5722 &sinfo->sta_flags)) 5723 goto nla_put_failure; 5724 5725 PUT_SINFO_U64(T_OFFSET, t_offset); 5726 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 5727 PUT_SINFO_U64(BEACON_RX, rx_beacon); 5728 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 5729 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 5730 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 5731 if (wiphy_ext_feature_isset(&rdev->wiphy, 5732 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 5733 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 5734 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 5735 } 5736 5737 #undef PUT_SINFO 5738 #undef PUT_SINFO_U64 5739 5740 if (sinfo->pertid) { 5741 struct nlattr *tidsattr; 5742 int tid; 5743 5744 tidsattr = nla_nest_start_noflag(msg, 5745 NL80211_STA_INFO_TID_STATS); 5746 if (!tidsattr) 5747 goto nla_put_failure; 5748 5749 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 5750 struct cfg80211_tid_stats *tidstats; 5751 struct nlattr *tidattr; 5752 5753 tidstats = &sinfo->pertid[tid]; 5754 5755 if (!tidstats->filled) 5756 continue; 5757 5758 tidattr = nla_nest_start_noflag(msg, tid + 1); 5759 if (!tidattr) 5760 goto nla_put_failure; 5761 5762 #define PUT_TIDVAL_U64(attr, memb) do { \ 5763 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 5764 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 5765 tidstats->memb, NL80211_TID_STATS_PAD)) \ 5766 goto nla_put_failure; \ 5767 } while (0) 5768 5769 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 5770 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 5771 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 5772 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 5773 5774 #undef PUT_TIDVAL_U64 5775 if ((tidstats->filled & 5776 BIT(NL80211_TID_STATS_TXQ_STATS)) && 5777 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 5778 NL80211_TID_STATS_TXQ_STATS)) 5779 goto nla_put_failure; 5780 5781 nla_nest_end(msg, tidattr); 5782 } 5783 5784 nla_nest_end(msg, tidsattr); 5785 } 5786 5787 nla_nest_end(msg, sinfoattr); 5788 5789 if (sinfo->assoc_req_ies_len && 5790 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 5791 sinfo->assoc_req_ies)) 5792 goto nla_put_failure; 5793 5794 cfg80211_sinfo_release_content(sinfo); 5795 genlmsg_end(msg, hdr); 5796 return 0; 5797 5798 nla_put_failure: 5799 cfg80211_sinfo_release_content(sinfo); 5800 genlmsg_cancel(msg, hdr); 5801 return -EMSGSIZE; 5802 } 5803 5804 static int nl80211_dump_station(struct sk_buff *skb, 5805 struct netlink_callback *cb) 5806 { 5807 struct station_info sinfo; 5808 struct cfg80211_registered_device *rdev; 5809 struct wireless_dev *wdev; 5810 u8 mac_addr[ETH_ALEN]; 5811 int sta_idx = cb->args[2]; 5812 int err; 5813 5814 rtnl_lock(); 5815 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 5816 if (err) 5817 goto out_err; 5818 5819 if (!wdev->netdev) { 5820 err = -EINVAL; 5821 goto out_err; 5822 } 5823 5824 if (!rdev->ops->dump_station) { 5825 err = -EOPNOTSUPP; 5826 goto out_err; 5827 } 5828 5829 while (1) { 5830 memset(&sinfo, 0, sizeof(sinfo)); 5831 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 5832 mac_addr, &sinfo); 5833 if (err == -ENOENT) 5834 break; 5835 if (err) 5836 goto out_err; 5837 5838 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 5839 NETLINK_CB(cb->skb).portid, 5840 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5841 rdev, wdev->netdev, mac_addr, 5842 &sinfo) < 0) 5843 goto out; 5844 5845 sta_idx++; 5846 } 5847 5848 out: 5849 cb->args[2] = sta_idx; 5850 err = skb->len; 5851 out_err: 5852 rtnl_unlock(); 5853 5854 return err; 5855 } 5856 5857 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 5858 { 5859 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5860 struct net_device *dev = info->user_ptr[1]; 5861 struct station_info sinfo; 5862 struct sk_buff *msg; 5863 u8 *mac_addr = NULL; 5864 int err; 5865 5866 memset(&sinfo, 0, sizeof(sinfo)); 5867 5868 if (!info->attrs[NL80211_ATTR_MAC]) 5869 return -EINVAL; 5870 5871 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5872 5873 if (!rdev->ops->get_station) 5874 return -EOPNOTSUPP; 5875 5876 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 5877 if (err) 5878 return err; 5879 5880 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5881 if (!msg) { 5882 cfg80211_sinfo_release_content(&sinfo); 5883 return -ENOMEM; 5884 } 5885 5886 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 5887 info->snd_portid, info->snd_seq, 0, 5888 rdev, dev, mac_addr, &sinfo) < 0) { 5889 nlmsg_free(msg); 5890 return -ENOBUFS; 5891 } 5892 5893 return genlmsg_reply(msg, info); 5894 } 5895 5896 int cfg80211_check_station_change(struct wiphy *wiphy, 5897 struct station_parameters *params, 5898 enum cfg80211_station_type statype) 5899 { 5900 if (params->listen_interval != -1 && 5901 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5902 return -EINVAL; 5903 5904 if (params->support_p2p_ps != -1 && 5905 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5906 return -EINVAL; 5907 5908 if (params->aid && 5909 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 5910 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5911 return -EINVAL; 5912 5913 /* When you run into this, adjust the code below for the new flag */ 5914 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5915 5916 switch (statype) { 5917 case CFG80211_STA_MESH_PEER_KERNEL: 5918 case CFG80211_STA_MESH_PEER_USER: 5919 /* 5920 * No ignoring the TDLS flag here -- the userspace mesh 5921 * code doesn't have the bug of including TDLS in the 5922 * mask everywhere. 5923 */ 5924 if (params->sta_flags_mask & 5925 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5926 BIT(NL80211_STA_FLAG_MFP) | 5927 BIT(NL80211_STA_FLAG_AUTHORIZED))) 5928 return -EINVAL; 5929 break; 5930 case CFG80211_STA_TDLS_PEER_SETUP: 5931 case CFG80211_STA_TDLS_PEER_ACTIVE: 5932 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5933 return -EINVAL; 5934 /* ignore since it can't change */ 5935 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5936 break; 5937 default: 5938 /* disallow mesh-specific things */ 5939 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 5940 return -EINVAL; 5941 if (params->local_pm) 5942 return -EINVAL; 5943 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 5944 return -EINVAL; 5945 } 5946 5947 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5948 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 5949 /* TDLS can't be set, ... */ 5950 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 5951 return -EINVAL; 5952 /* 5953 * ... but don't bother the driver with it. This works around 5954 * a hostapd/wpa_supplicant issue -- it always includes the 5955 * TLDS_PEER flag in the mask even for AP mode. 5956 */ 5957 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5958 } 5959 5960 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5961 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5962 /* reject other things that can't change */ 5963 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 5964 return -EINVAL; 5965 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 5966 return -EINVAL; 5967 if (params->supported_rates) 5968 return -EINVAL; 5969 if (params->ext_capab || params->ht_capa || params->vht_capa || 5970 params->he_capa) 5971 return -EINVAL; 5972 } 5973 5974 if (statype != CFG80211_STA_AP_CLIENT && 5975 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5976 if (params->vlan) 5977 return -EINVAL; 5978 } 5979 5980 switch (statype) { 5981 case CFG80211_STA_AP_MLME_CLIENT: 5982 /* Use this only for authorizing/unauthorizing a station */ 5983 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 5984 return -EOPNOTSUPP; 5985 break; 5986 case CFG80211_STA_AP_CLIENT: 5987 case CFG80211_STA_AP_CLIENT_UNASSOC: 5988 /* accept only the listed bits */ 5989 if (params->sta_flags_mask & 5990 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5991 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5992 BIT(NL80211_STA_FLAG_ASSOCIATED) | 5993 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5994 BIT(NL80211_STA_FLAG_WME) | 5995 BIT(NL80211_STA_FLAG_MFP))) 5996 return -EINVAL; 5997 5998 /* but authenticated/associated only if driver handles it */ 5999 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6000 params->sta_flags_mask & 6001 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6002 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6003 return -EINVAL; 6004 break; 6005 case CFG80211_STA_IBSS: 6006 case CFG80211_STA_AP_STA: 6007 /* reject any changes other than AUTHORIZED */ 6008 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6009 return -EINVAL; 6010 break; 6011 case CFG80211_STA_TDLS_PEER_SETUP: 6012 /* reject any changes other than AUTHORIZED or WME */ 6013 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6014 BIT(NL80211_STA_FLAG_WME))) 6015 return -EINVAL; 6016 /* force (at least) rates when authorizing */ 6017 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6018 !params->supported_rates) 6019 return -EINVAL; 6020 break; 6021 case CFG80211_STA_TDLS_PEER_ACTIVE: 6022 /* reject any changes */ 6023 return -EINVAL; 6024 case CFG80211_STA_MESH_PEER_KERNEL: 6025 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6026 return -EINVAL; 6027 break; 6028 case CFG80211_STA_MESH_PEER_USER: 6029 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6030 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6031 return -EINVAL; 6032 break; 6033 } 6034 6035 /* 6036 * Older kernel versions ignored this attribute entirely, so don't 6037 * reject attempts to update it but mark it as unused instead so the 6038 * driver won't look at the data. 6039 */ 6040 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 6041 statype != CFG80211_STA_TDLS_PEER_SETUP) 6042 params->opmode_notif_used = false; 6043 6044 return 0; 6045 } 6046 EXPORT_SYMBOL(cfg80211_check_station_change); 6047 6048 /* 6049 * Get vlan interface making sure it is running and on the right wiphy. 6050 */ 6051 static struct net_device *get_vlan(struct genl_info *info, 6052 struct cfg80211_registered_device *rdev) 6053 { 6054 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 6055 struct net_device *v; 6056 int ret; 6057 6058 if (!vlanattr) 6059 return NULL; 6060 6061 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 6062 if (!v) 6063 return ERR_PTR(-ENODEV); 6064 6065 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 6066 ret = -EINVAL; 6067 goto error; 6068 } 6069 6070 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 6071 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6072 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6073 ret = -EINVAL; 6074 goto error; 6075 } 6076 6077 if (!netif_running(v)) { 6078 ret = -ENETDOWN; 6079 goto error; 6080 } 6081 6082 return v; 6083 error: 6084 dev_put(v); 6085 return ERR_PTR(ret); 6086 } 6087 6088 static const struct nla_policy 6089 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 6090 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 6091 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 6092 }; 6093 6094 static int nl80211_parse_sta_wme(struct genl_info *info, 6095 struct station_parameters *params) 6096 { 6097 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 6098 struct nlattr *nla; 6099 int err; 6100 6101 /* parse WME attributes if present */ 6102 if (!info->attrs[NL80211_ATTR_STA_WME]) 6103 return 0; 6104 6105 nla = info->attrs[NL80211_ATTR_STA_WME]; 6106 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 6107 nl80211_sta_wme_policy, 6108 info->extack); 6109 if (err) 6110 return err; 6111 6112 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 6113 params->uapsd_queues = nla_get_u8( 6114 tb[NL80211_STA_WME_UAPSD_QUEUES]); 6115 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 6116 return -EINVAL; 6117 6118 if (tb[NL80211_STA_WME_MAX_SP]) 6119 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 6120 6121 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 6122 return -EINVAL; 6123 6124 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 6125 6126 return 0; 6127 } 6128 6129 static int nl80211_parse_sta_channel_info(struct genl_info *info, 6130 struct station_parameters *params) 6131 { 6132 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 6133 params->supported_channels = 6134 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6135 params->supported_channels_len = 6136 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6137 /* 6138 * Need to include at least one (first channel, number of 6139 * channels) tuple for each subband (checked in policy), 6140 * and must have proper tuples for the rest of the data as well. 6141 */ 6142 if (params->supported_channels_len % 2) 6143 return -EINVAL; 6144 } 6145 6146 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 6147 params->supported_oper_classes = 6148 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6149 params->supported_oper_classes_len = 6150 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6151 } 6152 return 0; 6153 } 6154 6155 static int nl80211_set_station_tdls(struct genl_info *info, 6156 struct station_parameters *params) 6157 { 6158 int err; 6159 /* Dummy STA entry gets updated once the peer capabilities are known */ 6160 if (info->attrs[NL80211_ATTR_PEER_AID]) 6161 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6162 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6163 params->ht_capa = 6164 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6165 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6166 params->vht_capa = 6167 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6168 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6169 params->he_capa = 6170 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6171 params->he_capa_len = 6172 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6173 } 6174 6175 err = nl80211_parse_sta_channel_info(info, params); 6176 if (err) 6177 return err; 6178 6179 return nl80211_parse_sta_wme(info, params); 6180 } 6181 6182 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 6183 struct station_parameters *params) 6184 { 6185 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6186 int idx; 6187 6188 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 6189 if (!rdev->ops->set_tx_power || 6190 !wiphy_ext_feature_isset(&rdev->wiphy, 6191 NL80211_EXT_FEATURE_STA_TX_PWR)) 6192 return -EOPNOTSUPP; 6193 6194 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 6195 params->txpwr.type = nla_get_u8(info->attrs[idx]); 6196 6197 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) { 6198 idx = NL80211_ATTR_STA_TX_POWER; 6199 6200 if (info->attrs[idx]) 6201 params->txpwr.power = 6202 nla_get_s16(info->attrs[idx]); 6203 else 6204 return -EINVAL; 6205 } 6206 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER; 6207 } 6208 6209 return 0; 6210 } 6211 6212 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 6213 { 6214 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6215 struct net_device *dev = info->user_ptr[1]; 6216 struct station_parameters params; 6217 u8 *mac_addr; 6218 int err; 6219 6220 memset(¶ms, 0, sizeof(params)); 6221 6222 if (!rdev->ops->change_station) 6223 return -EOPNOTSUPP; 6224 6225 /* 6226 * AID and listen_interval properties can be set only for unassociated 6227 * station. Include these parameters here and will check them in 6228 * cfg80211_check_station_change(). 6229 */ 6230 if (info->attrs[NL80211_ATTR_STA_AID]) 6231 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6232 6233 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6234 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6235 6236 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6237 params.listen_interval = 6238 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6239 else 6240 params.listen_interval = -1; 6241 6242 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 6243 params.support_p2p_ps = 6244 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6245 else 6246 params.support_p2p_ps = -1; 6247 6248 if (!info->attrs[NL80211_ATTR_MAC]) 6249 return -EINVAL; 6250 6251 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6252 6253 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 6254 params.supported_rates = 6255 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6256 params.supported_rates_len = 6257 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6258 } 6259 6260 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6261 params.capability = 6262 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6263 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6264 } 6265 6266 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6267 params.ext_capab = 6268 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6269 params.ext_capab_len = 6270 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6271 } 6272 6273 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6274 return -EINVAL; 6275 6276 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6277 params.plink_action = 6278 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6279 6280 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 6281 params.plink_state = 6282 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 6283 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 6284 params.peer_aid = nla_get_u16( 6285 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 6286 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 6287 } 6288 6289 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 6290 params.local_pm = nla_get_u32( 6291 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 6292 6293 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6294 params.opmode_notif_used = true; 6295 params.opmode_notif = 6296 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6297 } 6298 6299 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6300 params.he_6ghz_capa = 6301 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6302 6303 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6304 params.airtime_weight = 6305 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6306 6307 if (params.airtime_weight && 6308 !wiphy_ext_feature_isset(&rdev->wiphy, 6309 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6310 return -EOPNOTSUPP; 6311 6312 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6313 if (err) 6314 return err; 6315 6316 /* Include parameters for TDLS peer (will check later) */ 6317 err = nl80211_set_station_tdls(info, ¶ms); 6318 if (err) 6319 return err; 6320 6321 params.vlan = get_vlan(info, rdev); 6322 if (IS_ERR(params.vlan)) 6323 return PTR_ERR(params.vlan); 6324 6325 switch (dev->ieee80211_ptr->iftype) { 6326 case NL80211_IFTYPE_AP: 6327 case NL80211_IFTYPE_AP_VLAN: 6328 case NL80211_IFTYPE_P2P_GO: 6329 case NL80211_IFTYPE_P2P_CLIENT: 6330 case NL80211_IFTYPE_STATION: 6331 case NL80211_IFTYPE_ADHOC: 6332 case NL80211_IFTYPE_MESH_POINT: 6333 break; 6334 default: 6335 err = -EOPNOTSUPP; 6336 goto out_put_vlan; 6337 } 6338 6339 /* driver will call cfg80211_check_station_change() */ 6340 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 6341 6342 out_put_vlan: 6343 if (params.vlan) 6344 dev_put(params.vlan); 6345 6346 return err; 6347 } 6348 6349 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 6350 { 6351 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6352 int err; 6353 struct net_device *dev = info->user_ptr[1]; 6354 struct station_parameters params; 6355 u8 *mac_addr = NULL; 6356 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6357 BIT(NL80211_STA_FLAG_ASSOCIATED); 6358 6359 memset(¶ms, 0, sizeof(params)); 6360 6361 if (!rdev->ops->add_station) 6362 return -EOPNOTSUPP; 6363 6364 if (!info->attrs[NL80211_ATTR_MAC]) 6365 return -EINVAL; 6366 6367 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6368 return -EINVAL; 6369 6370 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 6371 return -EINVAL; 6372 6373 if (!info->attrs[NL80211_ATTR_STA_AID] && 6374 !info->attrs[NL80211_ATTR_PEER_AID]) 6375 return -EINVAL; 6376 6377 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6378 params.supported_rates = 6379 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6380 params.supported_rates_len = 6381 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6382 params.listen_interval = 6383 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6384 6385 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6386 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6387 6388 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 6389 params.support_p2p_ps = 6390 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6391 } else { 6392 /* 6393 * if not specified, assume it's supported for P2P GO interface, 6394 * and is NOT supported for AP interface 6395 */ 6396 params.support_p2p_ps = 6397 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 6398 } 6399 6400 if (info->attrs[NL80211_ATTR_PEER_AID]) 6401 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6402 else 6403 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6404 6405 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6406 params.capability = 6407 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6408 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6409 } 6410 6411 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6412 params.ext_capab = 6413 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6414 params.ext_capab_len = 6415 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6416 } 6417 6418 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6419 params.ht_capa = 6420 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6421 6422 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6423 params.vht_capa = 6424 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6425 6426 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6427 params.he_capa = 6428 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6429 params.he_capa_len = 6430 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6431 } 6432 6433 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6434 params.he_6ghz_capa = 6435 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6436 6437 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6438 params.opmode_notif_used = true; 6439 params.opmode_notif = 6440 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6441 } 6442 6443 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6444 params.plink_action = 6445 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6446 6447 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6448 params.airtime_weight = 6449 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6450 6451 if (params.airtime_weight && 6452 !wiphy_ext_feature_isset(&rdev->wiphy, 6453 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6454 return -EOPNOTSUPP; 6455 6456 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6457 if (err) 6458 return err; 6459 6460 err = nl80211_parse_sta_channel_info(info, ¶ms); 6461 if (err) 6462 return err; 6463 6464 err = nl80211_parse_sta_wme(info, ¶ms); 6465 if (err) 6466 return err; 6467 6468 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6469 return -EINVAL; 6470 6471 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 6472 * as userspace might just pass through the capabilities from the IEs 6473 * directly, rather than enforcing this restriction and returning an 6474 * error in this case. 6475 */ 6476 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 6477 params.ht_capa = NULL; 6478 params.vht_capa = NULL; 6479 6480 /* HE requires WME */ 6481 if (params.he_capa_len || params.he_6ghz_capa) 6482 return -EINVAL; 6483 } 6484 6485 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 6486 if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa)) 6487 return -EINVAL; 6488 6489 /* When you run into this, adjust the code below for the new flag */ 6490 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6491 6492 switch (dev->ieee80211_ptr->iftype) { 6493 case NL80211_IFTYPE_AP: 6494 case NL80211_IFTYPE_AP_VLAN: 6495 case NL80211_IFTYPE_P2P_GO: 6496 /* ignore WME attributes if iface/sta is not capable */ 6497 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 6498 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 6499 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6500 6501 /* TDLS peers cannot be added */ 6502 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6503 info->attrs[NL80211_ATTR_PEER_AID]) 6504 return -EINVAL; 6505 /* but don't bother the driver with it */ 6506 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6507 6508 /* allow authenticated/associated only if driver handles it */ 6509 if (!(rdev->wiphy.features & 6510 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6511 params.sta_flags_mask & auth_assoc) 6512 return -EINVAL; 6513 6514 /* Older userspace, or userspace wanting to be compatible with 6515 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 6516 * and assoc flags in the mask, but assumes the station will be 6517 * added as associated anyway since this was the required driver 6518 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 6519 * introduced. 6520 * In order to not bother drivers with this quirk in the API 6521 * set the flags in both the mask and set for new stations in 6522 * this case. 6523 */ 6524 if (!(params.sta_flags_mask & auth_assoc)) { 6525 params.sta_flags_mask |= auth_assoc; 6526 params.sta_flags_set |= auth_assoc; 6527 } 6528 6529 /* must be last in here for error handling */ 6530 params.vlan = get_vlan(info, rdev); 6531 if (IS_ERR(params.vlan)) 6532 return PTR_ERR(params.vlan); 6533 break; 6534 case NL80211_IFTYPE_MESH_POINT: 6535 /* ignore uAPSD data */ 6536 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6537 6538 /* associated is disallowed */ 6539 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 6540 return -EINVAL; 6541 /* TDLS peers cannot be added */ 6542 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6543 info->attrs[NL80211_ATTR_PEER_AID]) 6544 return -EINVAL; 6545 break; 6546 case NL80211_IFTYPE_STATION: 6547 case NL80211_IFTYPE_P2P_CLIENT: 6548 /* ignore uAPSD data */ 6549 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6550 6551 /* these are disallowed */ 6552 if (params.sta_flags_mask & 6553 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 6554 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 6555 return -EINVAL; 6556 /* Only TDLS peers can be added */ 6557 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6558 return -EINVAL; 6559 /* Can only add if TDLS ... */ 6560 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 6561 return -EOPNOTSUPP; 6562 /* ... with external setup is supported */ 6563 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 6564 return -EOPNOTSUPP; 6565 /* 6566 * Older wpa_supplicant versions always mark the TDLS peer 6567 * as authorized, but it shouldn't yet be. 6568 */ 6569 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 6570 break; 6571 default: 6572 return -EOPNOTSUPP; 6573 } 6574 6575 /* be aware of params.vlan when changing code here */ 6576 6577 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 6578 6579 if (params.vlan) 6580 dev_put(params.vlan); 6581 return err; 6582 } 6583 6584 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 6585 { 6586 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6587 struct net_device *dev = info->user_ptr[1]; 6588 struct station_del_parameters params; 6589 6590 memset(¶ms, 0, sizeof(params)); 6591 6592 if (info->attrs[NL80211_ATTR_MAC]) 6593 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 6594 6595 switch (dev->ieee80211_ptr->iftype) { 6596 case NL80211_IFTYPE_AP: 6597 case NL80211_IFTYPE_AP_VLAN: 6598 case NL80211_IFTYPE_MESH_POINT: 6599 case NL80211_IFTYPE_P2P_GO: 6600 /* always accept these */ 6601 break; 6602 case NL80211_IFTYPE_ADHOC: 6603 /* conditionally accept */ 6604 if (wiphy_ext_feature_isset(&rdev->wiphy, 6605 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 6606 break; 6607 return -EINVAL; 6608 default: 6609 return -EINVAL; 6610 } 6611 6612 if (!rdev->ops->del_station) 6613 return -EOPNOTSUPP; 6614 6615 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 6616 params.subtype = 6617 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 6618 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 6619 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 6620 return -EINVAL; 6621 } else { 6622 /* Default to Deauthentication frame */ 6623 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 6624 } 6625 6626 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 6627 params.reason_code = 6628 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 6629 if (params.reason_code == 0) 6630 return -EINVAL; /* 0 is reserved */ 6631 } else { 6632 /* Default to reason code 2 */ 6633 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 6634 } 6635 6636 return rdev_del_station(rdev, dev, ¶ms); 6637 } 6638 6639 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 6640 int flags, struct net_device *dev, 6641 u8 *dst, u8 *next_hop, 6642 struct mpath_info *pinfo) 6643 { 6644 void *hdr; 6645 struct nlattr *pinfoattr; 6646 6647 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 6648 if (!hdr) 6649 return -1; 6650 6651 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6652 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 6653 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 6654 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 6655 goto nla_put_failure; 6656 6657 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 6658 if (!pinfoattr) 6659 goto nla_put_failure; 6660 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 6661 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 6662 pinfo->frame_qlen)) 6663 goto nla_put_failure; 6664 if (((pinfo->filled & MPATH_INFO_SN) && 6665 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 6666 ((pinfo->filled & MPATH_INFO_METRIC) && 6667 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 6668 pinfo->metric)) || 6669 ((pinfo->filled & MPATH_INFO_EXPTIME) && 6670 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 6671 pinfo->exptime)) || 6672 ((pinfo->filled & MPATH_INFO_FLAGS) && 6673 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 6674 pinfo->flags)) || 6675 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 6676 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 6677 pinfo->discovery_timeout)) || 6678 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 6679 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 6680 pinfo->discovery_retries)) || 6681 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 6682 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 6683 pinfo->hop_count)) || 6684 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 6685 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 6686 pinfo->path_change_count))) 6687 goto nla_put_failure; 6688 6689 nla_nest_end(msg, pinfoattr); 6690 6691 genlmsg_end(msg, hdr); 6692 return 0; 6693 6694 nla_put_failure: 6695 genlmsg_cancel(msg, hdr); 6696 return -EMSGSIZE; 6697 } 6698 6699 static int nl80211_dump_mpath(struct sk_buff *skb, 6700 struct netlink_callback *cb) 6701 { 6702 struct mpath_info pinfo; 6703 struct cfg80211_registered_device *rdev; 6704 struct wireless_dev *wdev; 6705 u8 dst[ETH_ALEN]; 6706 u8 next_hop[ETH_ALEN]; 6707 int path_idx = cb->args[2]; 6708 int err; 6709 6710 rtnl_lock(); 6711 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6712 if (err) 6713 goto out_err; 6714 6715 if (!rdev->ops->dump_mpath) { 6716 err = -EOPNOTSUPP; 6717 goto out_err; 6718 } 6719 6720 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6721 err = -EOPNOTSUPP; 6722 goto out_err; 6723 } 6724 6725 while (1) { 6726 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 6727 next_hop, &pinfo); 6728 if (err == -ENOENT) 6729 break; 6730 if (err) 6731 goto out_err; 6732 6733 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6734 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6735 wdev->netdev, dst, next_hop, 6736 &pinfo) < 0) 6737 goto out; 6738 6739 path_idx++; 6740 } 6741 6742 out: 6743 cb->args[2] = path_idx; 6744 err = skb->len; 6745 out_err: 6746 rtnl_unlock(); 6747 return err; 6748 } 6749 6750 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 6751 { 6752 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6753 int err; 6754 struct net_device *dev = info->user_ptr[1]; 6755 struct mpath_info pinfo; 6756 struct sk_buff *msg; 6757 u8 *dst = NULL; 6758 u8 next_hop[ETH_ALEN]; 6759 6760 memset(&pinfo, 0, sizeof(pinfo)); 6761 6762 if (!info->attrs[NL80211_ATTR_MAC]) 6763 return -EINVAL; 6764 6765 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6766 6767 if (!rdev->ops->get_mpath) 6768 return -EOPNOTSUPP; 6769 6770 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6771 return -EOPNOTSUPP; 6772 6773 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 6774 if (err) 6775 return err; 6776 6777 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6778 if (!msg) 6779 return -ENOMEM; 6780 6781 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6782 dev, dst, next_hop, &pinfo) < 0) { 6783 nlmsg_free(msg); 6784 return -ENOBUFS; 6785 } 6786 6787 return genlmsg_reply(msg, info); 6788 } 6789 6790 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 6791 { 6792 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6793 struct net_device *dev = info->user_ptr[1]; 6794 u8 *dst = NULL; 6795 u8 *next_hop = NULL; 6796 6797 if (!info->attrs[NL80211_ATTR_MAC]) 6798 return -EINVAL; 6799 6800 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6801 return -EINVAL; 6802 6803 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6804 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6805 6806 if (!rdev->ops->change_mpath) 6807 return -EOPNOTSUPP; 6808 6809 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6810 return -EOPNOTSUPP; 6811 6812 return rdev_change_mpath(rdev, dev, dst, next_hop); 6813 } 6814 6815 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 6816 { 6817 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6818 struct net_device *dev = info->user_ptr[1]; 6819 u8 *dst = NULL; 6820 u8 *next_hop = NULL; 6821 6822 if (!info->attrs[NL80211_ATTR_MAC]) 6823 return -EINVAL; 6824 6825 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6826 return -EINVAL; 6827 6828 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6829 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6830 6831 if (!rdev->ops->add_mpath) 6832 return -EOPNOTSUPP; 6833 6834 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6835 return -EOPNOTSUPP; 6836 6837 return rdev_add_mpath(rdev, dev, dst, next_hop); 6838 } 6839 6840 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 6841 { 6842 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6843 struct net_device *dev = info->user_ptr[1]; 6844 u8 *dst = NULL; 6845 6846 if (info->attrs[NL80211_ATTR_MAC]) 6847 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6848 6849 if (!rdev->ops->del_mpath) 6850 return -EOPNOTSUPP; 6851 6852 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6853 return -EOPNOTSUPP; 6854 6855 return rdev_del_mpath(rdev, dev, dst); 6856 } 6857 6858 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 6859 { 6860 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6861 int err; 6862 struct net_device *dev = info->user_ptr[1]; 6863 struct mpath_info pinfo; 6864 struct sk_buff *msg; 6865 u8 *dst = NULL; 6866 u8 mpp[ETH_ALEN]; 6867 6868 memset(&pinfo, 0, sizeof(pinfo)); 6869 6870 if (!info->attrs[NL80211_ATTR_MAC]) 6871 return -EINVAL; 6872 6873 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6874 6875 if (!rdev->ops->get_mpp) 6876 return -EOPNOTSUPP; 6877 6878 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6879 return -EOPNOTSUPP; 6880 6881 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 6882 if (err) 6883 return err; 6884 6885 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6886 if (!msg) 6887 return -ENOMEM; 6888 6889 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6890 dev, dst, mpp, &pinfo) < 0) { 6891 nlmsg_free(msg); 6892 return -ENOBUFS; 6893 } 6894 6895 return genlmsg_reply(msg, info); 6896 } 6897 6898 static int nl80211_dump_mpp(struct sk_buff *skb, 6899 struct netlink_callback *cb) 6900 { 6901 struct mpath_info pinfo; 6902 struct cfg80211_registered_device *rdev; 6903 struct wireless_dev *wdev; 6904 u8 dst[ETH_ALEN]; 6905 u8 mpp[ETH_ALEN]; 6906 int path_idx = cb->args[2]; 6907 int err; 6908 6909 rtnl_lock(); 6910 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6911 if (err) 6912 goto out_err; 6913 6914 if (!rdev->ops->dump_mpp) { 6915 err = -EOPNOTSUPP; 6916 goto out_err; 6917 } 6918 6919 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6920 err = -EOPNOTSUPP; 6921 goto out_err; 6922 } 6923 6924 while (1) { 6925 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 6926 mpp, &pinfo); 6927 if (err == -ENOENT) 6928 break; 6929 if (err) 6930 goto out_err; 6931 6932 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6933 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6934 wdev->netdev, dst, mpp, 6935 &pinfo) < 0) 6936 goto out; 6937 6938 path_idx++; 6939 } 6940 6941 out: 6942 cb->args[2] = path_idx; 6943 err = skb->len; 6944 out_err: 6945 rtnl_unlock(); 6946 return err; 6947 } 6948 6949 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 6950 { 6951 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6952 struct net_device *dev = info->user_ptr[1]; 6953 struct wireless_dev *wdev = dev->ieee80211_ptr; 6954 struct bss_parameters params; 6955 int err; 6956 6957 memset(¶ms, 0, sizeof(params)); 6958 /* default to not changing parameters */ 6959 params.use_cts_prot = -1; 6960 params.use_short_preamble = -1; 6961 params.use_short_slot_time = -1; 6962 params.ap_isolate = -1; 6963 params.ht_opmode = -1; 6964 params.p2p_ctwindow = -1; 6965 params.p2p_opp_ps = -1; 6966 6967 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 6968 params.use_cts_prot = 6969 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 6970 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 6971 params.use_short_preamble = 6972 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 6973 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 6974 params.use_short_slot_time = 6975 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 6976 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 6977 params.basic_rates = 6978 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6979 params.basic_rates_len = 6980 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6981 } 6982 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 6983 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 6984 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 6985 params.ht_opmode = 6986 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 6987 6988 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 6989 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6990 return -EINVAL; 6991 params.p2p_ctwindow = 6992 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 6993 if (params.p2p_ctwindow != 0 && 6994 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 6995 return -EINVAL; 6996 } 6997 6998 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 6999 u8 tmp; 7000 7001 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7002 return -EINVAL; 7003 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 7004 params.p2p_opp_ps = tmp; 7005 if (params.p2p_opp_ps && 7006 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 7007 return -EINVAL; 7008 } 7009 7010 if (!rdev->ops->change_bss) 7011 return -EOPNOTSUPP; 7012 7013 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7014 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7015 return -EOPNOTSUPP; 7016 7017 wdev_lock(wdev); 7018 err = rdev_change_bss(rdev, dev, ¶ms); 7019 wdev_unlock(wdev); 7020 7021 return err; 7022 } 7023 7024 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 7025 { 7026 char *data = NULL; 7027 bool is_indoor; 7028 enum nl80211_user_reg_hint_type user_reg_hint_type; 7029 u32 owner_nlportid; 7030 7031 /* 7032 * You should only get this when cfg80211 hasn't yet initialized 7033 * completely when built-in to the kernel right between the time 7034 * window between nl80211_init() and regulatory_init(), if that is 7035 * even possible. 7036 */ 7037 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 7038 return -EINPROGRESS; 7039 7040 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 7041 user_reg_hint_type = 7042 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 7043 else 7044 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 7045 7046 switch (user_reg_hint_type) { 7047 case NL80211_USER_REG_HINT_USER: 7048 case NL80211_USER_REG_HINT_CELL_BASE: 7049 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7050 return -EINVAL; 7051 7052 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7053 return regulatory_hint_user(data, user_reg_hint_type); 7054 case NL80211_USER_REG_HINT_INDOOR: 7055 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 7056 owner_nlportid = info->snd_portid; 7057 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 7058 } else { 7059 owner_nlportid = 0; 7060 is_indoor = true; 7061 } 7062 7063 return regulatory_hint_indoor(is_indoor, owner_nlportid); 7064 default: 7065 return -EINVAL; 7066 } 7067 } 7068 7069 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 7070 { 7071 return reg_reload_regdb(); 7072 } 7073 7074 static int nl80211_get_mesh_config(struct sk_buff *skb, 7075 struct genl_info *info) 7076 { 7077 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7078 struct net_device *dev = info->user_ptr[1]; 7079 struct wireless_dev *wdev = dev->ieee80211_ptr; 7080 struct mesh_config cur_params; 7081 int err = 0; 7082 void *hdr; 7083 struct nlattr *pinfoattr; 7084 struct sk_buff *msg; 7085 7086 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7087 return -EOPNOTSUPP; 7088 7089 if (!rdev->ops->get_mesh_config) 7090 return -EOPNOTSUPP; 7091 7092 wdev_lock(wdev); 7093 /* If not connected, get default parameters */ 7094 if (!wdev->mesh_id_len) 7095 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 7096 else 7097 err = rdev_get_mesh_config(rdev, dev, &cur_params); 7098 wdev_unlock(wdev); 7099 7100 if (err) 7101 return err; 7102 7103 /* Draw up a netlink message to send back */ 7104 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7105 if (!msg) 7106 return -ENOMEM; 7107 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7108 NL80211_CMD_GET_MESH_CONFIG); 7109 if (!hdr) 7110 goto out; 7111 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 7112 if (!pinfoattr) 7113 goto nla_put_failure; 7114 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7115 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 7116 cur_params.dot11MeshRetryTimeout) || 7117 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 7118 cur_params.dot11MeshConfirmTimeout) || 7119 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 7120 cur_params.dot11MeshHoldingTimeout) || 7121 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 7122 cur_params.dot11MeshMaxPeerLinks) || 7123 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 7124 cur_params.dot11MeshMaxRetries) || 7125 nla_put_u8(msg, NL80211_MESHCONF_TTL, 7126 cur_params.dot11MeshTTL) || 7127 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 7128 cur_params.element_ttl) || 7129 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7130 cur_params.auto_open_plinks) || 7131 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7132 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 7133 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7134 cur_params.dot11MeshHWMPmaxPREQretries) || 7135 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 7136 cur_params.path_refresh_time) || 7137 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7138 cur_params.min_discovery_timeout) || 7139 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7140 cur_params.dot11MeshHWMPactivePathTimeout) || 7141 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7142 cur_params.dot11MeshHWMPpreqMinInterval) || 7143 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7144 cur_params.dot11MeshHWMPperrMinInterval) || 7145 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7146 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 7147 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 7148 cur_params.dot11MeshHWMPRootMode) || 7149 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7150 cur_params.dot11MeshHWMPRannInterval) || 7151 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7152 cur_params.dot11MeshGateAnnouncementProtocol) || 7153 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 7154 cur_params.dot11MeshForwarding) || 7155 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 7156 cur_params.rssi_threshold) || 7157 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 7158 cur_params.ht_opmode) || 7159 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7160 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 7161 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7162 cur_params.dot11MeshHWMProotInterval) || 7163 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7164 cur_params.dot11MeshHWMPconfirmationInterval) || 7165 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 7166 cur_params.power_mode) || 7167 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 7168 cur_params.dot11MeshAwakeWindowDuration) || 7169 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 7170 cur_params.plink_timeout) || 7171 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 7172 cur_params.dot11MeshConnectedToMeshGate) || 7173 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 7174 cur_params.dot11MeshNolearn) || 7175 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 7176 cur_params.dot11MeshConnectedToAuthServer)) 7177 goto nla_put_failure; 7178 nla_nest_end(msg, pinfoattr); 7179 genlmsg_end(msg, hdr); 7180 return genlmsg_reply(msg, info); 7181 7182 nla_put_failure: 7183 out: 7184 nlmsg_free(msg); 7185 return -ENOBUFS; 7186 } 7187 7188 static const struct nla_policy 7189 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 7190 [NL80211_MESHCONF_RETRY_TIMEOUT] = 7191 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7192 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 7193 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7194 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 7195 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7196 [NL80211_MESHCONF_MAX_PEER_LINKS] = 7197 NLA_POLICY_RANGE(NLA_U16, 0, 255), 7198 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 7199 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7200 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7201 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 7202 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 7203 NLA_POLICY_RANGE(NLA_U32, 1, 255), 7204 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 7205 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 7206 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 7207 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 7208 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 7209 NLA_POLICY_MIN(NLA_U16, 1), 7210 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 7211 NLA_POLICY_MIN(NLA_U16, 1), 7212 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 7213 NLA_POLICY_MIN(NLA_U16, 1), 7214 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 7215 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 7216 NLA_POLICY_MIN(NLA_U16, 1), 7217 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 7218 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 7219 [NL80211_MESHCONF_RSSI_THRESHOLD] = 7220 NLA_POLICY_RANGE(NLA_S32, -255, 0), 7221 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 7222 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 7223 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 7224 NLA_POLICY_MIN(NLA_U16, 1), 7225 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 7226 NLA_POLICY_MIN(NLA_U16, 1), 7227 [NL80211_MESHCONF_POWER_MODE] = 7228 NLA_POLICY_RANGE(NLA_U32, 7229 NL80211_MESH_POWER_ACTIVE, 7230 NL80211_MESH_POWER_MAX), 7231 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 7232 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 7233 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7234 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7235 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7236 }; 7237 7238 static const struct nla_policy 7239 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 7240 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 7241 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 7242 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 7243 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 7244 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 7245 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 7246 [NL80211_MESH_SETUP_IE] = 7247 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 7248 IEEE80211_MAX_DATA_LEN), 7249 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 7250 }; 7251 7252 static int nl80211_parse_mesh_config(struct genl_info *info, 7253 struct mesh_config *cfg, 7254 u32 *mask_out) 7255 { 7256 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 7257 u32 mask = 0; 7258 u16 ht_opmode; 7259 7260 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 7261 do { \ 7262 if (tb[attr]) { \ 7263 cfg->param = fn(tb[attr]); \ 7264 mask |= BIT((attr) - 1); \ 7265 } \ 7266 } while (0) 7267 7268 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 7269 return -EINVAL; 7270 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 7271 return -EINVAL; 7272 7273 /* This makes sure that there aren't more than 32 mesh config 7274 * parameters (otherwise our bitfield scheme would not work.) */ 7275 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 7276 7277 /* Fill in the params struct */ 7278 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 7279 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 7280 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 7281 NL80211_MESHCONF_CONFIRM_TIMEOUT, 7282 nla_get_u16); 7283 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 7284 NL80211_MESHCONF_HOLDING_TIMEOUT, 7285 nla_get_u16); 7286 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 7287 NL80211_MESHCONF_MAX_PEER_LINKS, 7288 nla_get_u16); 7289 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 7290 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 7291 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 7292 NL80211_MESHCONF_TTL, nla_get_u8); 7293 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 7294 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 7295 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 7296 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7297 nla_get_u8); 7298 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 7299 mask, 7300 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7301 nla_get_u32); 7302 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 7303 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7304 nla_get_u8); 7305 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 7306 NL80211_MESHCONF_PATH_REFRESH_TIME, 7307 nla_get_u32); 7308 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 7309 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 7310 return -EINVAL; 7311 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 7312 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7313 nla_get_u16); 7314 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 7315 mask, 7316 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7317 nla_get_u32); 7318 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 7319 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 7320 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 7321 return -EINVAL; 7322 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 7323 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7324 nla_get_u16); 7325 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 7326 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7327 nla_get_u16); 7328 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7329 dot11MeshHWMPnetDiameterTraversalTime, mask, 7330 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7331 nla_get_u16); 7332 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 7333 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 7334 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 7335 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7336 nla_get_u16); 7337 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 7338 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7339 nla_get_u8); 7340 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 7341 NL80211_MESHCONF_FORWARDING, nla_get_u8); 7342 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 7343 NL80211_MESHCONF_RSSI_THRESHOLD, 7344 nla_get_s32); 7345 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 7346 NL80211_MESHCONF_CONNECTED_TO_GATE, 7347 nla_get_u8); 7348 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 7349 NL80211_MESHCONF_CONNECTED_TO_AS, 7350 nla_get_u8); 7351 /* 7352 * Check HT operation mode based on 7353 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 7354 */ 7355 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 7356 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 7357 7358 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 7359 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 7360 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 7361 return -EINVAL; 7362 7363 /* NON_HT_STA bit is reserved, but some programs set it */ 7364 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 7365 7366 cfg->ht_opmode = ht_opmode; 7367 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 7368 } 7369 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7370 dot11MeshHWMPactivePathToRootTimeout, mask, 7371 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7372 nla_get_u32); 7373 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 7374 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 7375 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 7376 return -EINVAL; 7377 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 7378 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7379 nla_get_u16); 7380 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 7381 mask, 7382 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7383 nla_get_u16); 7384 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 7385 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 7386 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 7387 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 7388 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 7389 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 7390 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 7391 NL80211_MESHCONF_NOLEARN, nla_get_u8); 7392 if (mask_out) 7393 *mask_out = mask; 7394 7395 return 0; 7396 7397 #undef FILL_IN_MESH_PARAM_IF_SET 7398 } 7399 7400 static int nl80211_parse_mesh_setup(struct genl_info *info, 7401 struct mesh_setup *setup) 7402 { 7403 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7404 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 7405 7406 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 7407 return -EINVAL; 7408 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 7409 return -EINVAL; 7410 7411 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 7412 setup->sync_method = 7413 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 7414 IEEE80211_SYNC_METHOD_VENDOR : 7415 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 7416 7417 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 7418 setup->path_sel_proto = 7419 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 7420 IEEE80211_PATH_PROTOCOL_VENDOR : 7421 IEEE80211_PATH_PROTOCOL_HWMP; 7422 7423 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 7424 setup->path_metric = 7425 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 7426 IEEE80211_PATH_METRIC_VENDOR : 7427 IEEE80211_PATH_METRIC_AIRTIME; 7428 7429 if (tb[NL80211_MESH_SETUP_IE]) { 7430 struct nlattr *ieattr = 7431 tb[NL80211_MESH_SETUP_IE]; 7432 setup->ie = nla_data(ieattr); 7433 setup->ie_len = nla_len(ieattr); 7434 } 7435 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 7436 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 7437 return -EINVAL; 7438 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 7439 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 7440 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 7441 if (setup->is_secure) 7442 setup->user_mpm = true; 7443 7444 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 7445 if (!setup->user_mpm) 7446 return -EINVAL; 7447 setup->auth_id = 7448 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 7449 } 7450 7451 return 0; 7452 } 7453 7454 static int nl80211_update_mesh_config(struct sk_buff *skb, 7455 struct genl_info *info) 7456 { 7457 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7458 struct net_device *dev = info->user_ptr[1]; 7459 struct wireless_dev *wdev = dev->ieee80211_ptr; 7460 struct mesh_config cfg; 7461 u32 mask; 7462 int err; 7463 7464 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7465 return -EOPNOTSUPP; 7466 7467 if (!rdev->ops->update_mesh_config) 7468 return -EOPNOTSUPP; 7469 7470 err = nl80211_parse_mesh_config(info, &cfg, &mask); 7471 if (err) 7472 return err; 7473 7474 wdev_lock(wdev); 7475 if (!wdev->mesh_id_len) 7476 err = -ENOLINK; 7477 7478 if (!err) 7479 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 7480 7481 wdev_unlock(wdev); 7482 7483 return err; 7484 } 7485 7486 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 7487 struct sk_buff *msg) 7488 { 7489 struct nlattr *nl_reg_rules; 7490 unsigned int i; 7491 7492 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 7493 (regdom->dfs_region && 7494 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 7495 goto nla_put_failure; 7496 7497 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 7498 if (!nl_reg_rules) 7499 goto nla_put_failure; 7500 7501 for (i = 0; i < regdom->n_reg_rules; i++) { 7502 struct nlattr *nl_reg_rule; 7503 const struct ieee80211_reg_rule *reg_rule; 7504 const struct ieee80211_freq_range *freq_range; 7505 const struct ieee80211_power_rule *power_rule; 7506 unsigned int max_bandwidth_khz; 7507 7508 reg_rule = ®dom->reg_rules[i]; 7509 freq_range = ®_rule->freq_range; 7510 power_rule = ®_rule->power_rule; 7511 7512 nl_reg_rule = nla_nest_start_noflag(msg, i); 7513 if (!nl_reg_rule) 7514 goto nla_put_failure; 7515 7516 max_bandwidth_khz = freq_range->max_bandwidth_khz; 7517 if (!max_bandwidth_khz) 7518 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 7519 reg_rule); 7520 7521 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 7522 reg_rule->flags) || 7523 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 7524 freq_range->start_freq_khz) || 7525 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 7526 freq_range->end_freq_khz) || 7527 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 7528 max_bandwidth_khz) || 7529 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 7530 power_rule->max_antenna_gain) || 7531 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 7532 power_rule->max_eirp) || 7533 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 7534 reg_rule->dfs_cac_ms)) 7535 goto nla_put_failure; 7536 7537 nla_nest_end(msg, nl_reg_rule); 7538 } 7539 7540 nla_nest_end(msg, nl_reg_rules); 7541 return 0; 7542 7543 nla_put_failure: 7544 return -EMSGSIZE; 7545 } 7546 7547 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 7548 { 7549 const struct ieee80211_regdomain *regdom = NULL; 7550 struct cfg80211_registered_device *rdev; 7551 struct wiphy *wiphy = NULL; 7552 struct sk_buff *msg; 7553 void *hdr; 7554 7555 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7556 if (!msg) 7557 return -ENOBUFS; 7558 7559 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7560 NL80211_CMD_GET_REG); 7561 if (!hdr) 7562 goto put_failure; 7563 7564 if (info->attrs[NL80211_ATTR_WIPHY]) { 7565 bool self_managed; 7566 7567 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 7568 if (IS_ERR(rdev)) { 7569 nlmsg_free(msg); 7570 return PTR_ERR(rdev); 7571 } 7572 7573 wiphy = &rdev->wiphy; 7574 self_managed = wiphy->regulatory_flags & 7575 REGULATORY_WIPHY_SELF_MANAGED; 7576 regdom = get_wiphy_regdom(wiphy); 7577 7578 /* a self-managed-reg device must have a private regdom */ 7579 if (WARN_ON(!regdom && self_managed)) { 7580 nlmsg_free(msg); 7581 return -EINVAL; 7582 } 7583 7584 if (regdom && 7585 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7586 goto nla_put_failure; 7587 } 7588 7589 if (!wiphy && reg_last_request_cell_base() && 7590 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7591 NL80211_USER_REG_HINT_CELL_BASE)) 7592 goto nla_put_failure; 7593 7594 rcu_read_lock(); 7595 7596 if (!regdom) 7597 regdom = rcu_dereference(cfg80211_regdomain); 7598 7599 if (nl80211_put_regdom(regdom, msg)) 7600 goto nla_put_failure_rcu; 7601 7602 rcu_read_unlock(); 7603 7604 genlmsg_end(msg, hdr); 7605 return genlmsg_reply(msg, info); 7606 7607 nla_put_failure_rcu: 7608 rcu_read_unlock(); 7609 nla_put_failure: 7610 put_failure: 7611 nlmsg_free(msg); 7612 return -EMSGSIZE; 7613 } 7614 7615 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 7616 u32 seq, int flags, struct wiphy *wiphy, 7617 const struct ieee80211_regdomain *regdom) 7618 { 7619 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7620 NL80211_CMD_GET_REG); 7621 7622 if (!hdr) 7623 return -1; 7624 7625 genl_dump_check_consistent(cb, hdr); 7626 7627 if (nl80211_put_regdom(regdom, msg)) 7628 goto nla_put_failure; 7629 7630 if (!wiphy && reg_last_request_cell_base() && 7631 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7632 NL80211_USER_REG_HINT_CELL_BASE)) 7633 goto nla_put_failure; 7634 7635 if (wiphy && 7636 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7637 goto nla_put_failure; 7638 7639 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 7640 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 7641 goto nla_put_failure; 7642 7643 genlmsg_end(msg, hdr); 7644 return 0; 7645 7646 nla_put_failure: 7647 genlmsg_cancel(msg, hdr); 7648 return -EMSGSIZE; 7649 } 7650 7651 static int nl80211_get_reg_dump(struct sk_buff *skb, 7652 struct netlink_callback *cb) 7653 { 7654 const struct ieee80211_regdomain *regdom = NULL; 7655 struct cfg80211_registered_device *rdev; 7656 int err, reg_idx, start = cb->args[2]; 7657 7658 rtnl_lock(); 7659 7660 if (cfg80211_regdomain && start == 0) { 7661 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7662 NLM_F_MULTI, NULL, 7663 rtnl_dereference(cfg80211_regdomain)); 7664 if (err < 0) 7665 goto out_err; 7666 } 7667 7668 /* the global regdom is idx 0 */ 7669 reg_idx = 1; 7670 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 7671 regdom = get_wiphy_regdom(&rdev->wiphy); 7672 if (!regdom) 7673 continue; 7674 7675 if (++reg_idx <= start) 7676 continue; 7677 7678 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7679 NLM_F_MULTI, &rdev->wiphy, regdom); 7680 if (err < 0) { 7681 reg_idx--; 7682 break; 7683 } 7684 } 7685 7686 cb->args[2] = reg_idx; 7687 err = skb->len; 7688 out_err: 7689 rtnl_unlock(); 7690 return err; 7691 } 7692 7693 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 7694 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 7695 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 7696 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 7697 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 7698 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 7699 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 7700 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 7701 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 7702 }; 7703 7704 static int parse_reg_rule(struct nlattr *tb[], 7705 struct ieee80211_reg_rule *reg_rule) 7706 { 7707 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 7708 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 7709 7710 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 7711 return -EINVAL; 7712 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 7713 return -EINVAL; 7714 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 7715 return -EINVAL; 7716 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 7717 return -EINVAL; 7718 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 7719 return -EINVAL; 7720 7721 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 7722 7723 freq_range->start_freq_khz = 7724 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 7725 freq_range->end_freq_khz = 7726 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 7727 freq_range->max_bandwidth_khz = 7728 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 7729 7730 power_rule->max_eirp = 7731 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 7732 7733 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 7734 power_rule->max_antenna_gain = 7735 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 7736 7737 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 7738 reg_rule->dfs_cac_ms = 7739 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 7740 7741 return 0; 7742 } 7743 7744 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 7745 { 7746 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 7747 struct nlattr *nl_reg_rule; 7748 char *alpha2; 7749 int rem_reg_rules, r; 7750 u32 num_rules = 0, rule_idx = 0; 7751 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 7752 struct ieee80211_regdomain *rd; 7753 7754 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7755 return -EINVAL; 7756 7757 if (!info->attrs[NL80211_ATTR_REG_RULES]) 7758 return -EINVAL; 7759 7760 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7761 7762 if (info->attrs[NL80211_ATTR_DFS_REGION]) 7763 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 7764 7765 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7766 rem_reg_rules) { 7767 num_rules++; 7768 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 7769 return -EINVAL; 7770 } 7771 7772 if (!reg_is_valid_request(alpha2)) 7773 return -EINVAL; 7774 7775 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 7776 if (!rd) 7777 return -ENOMEM; 7778 7779 rd->n_reg_rules = num_rules; 7780 rd->alpha2[0] = alpha2[0]; 7781 rd->alpha2[1] = alpha2[1]; 7782 7783 /* 7784 * Disable DFS master mode if the DFS region was 7785 * not supported or known on this kernel. 7786 */ 7787 if (reg_supported_dfs_region(dfs_region)) 7788 rd->dfs_region = dfs_region; 7789 7790 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7791 rem_reg_rules) { 7792 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 7793 nl_reg_rule, reg_rule_policy, 7794 info->extack); 7795 if (r) 7796 goto bad_reg; 7797 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 7798 if (r) 7799 goto bad_reg; 7800 7801 rule_idx++; 7802 7803 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 7804 r = -EINVAL; 7805 goto bad_reg; 7806 } 7807 } 7808 7809 /* set_regdom takes ownership of rd */ 7810 return set_regdom(rd, REGD_SOURCE_CRDA); 7811 bad_reg: 7812 kfree(rd); 7813 return r; 7814 } 7815 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 7816 7817 static int validate_scan_freqs(struct nlattr *freqs) 7818 { 7819 struct nlattr *attr1, *attr2; 7820 int n_channels = 0, tmp1, tmp2; 7821 7822 nla_for_each_nested(attr1, freqs, tmp1) 7823 if (nla_len(attr1) != sizeof(u32)) 7824 return 0; 7825 7826 nla_for_each_nested(attr1, freqs, tmp1) { 7827 n_channels++; 7828 /* 7829 * Some hardware has a limited channel list for 7830 * scanning, and it is pretty much nonsensical 7831 * to scan for a channel twice, so disallow that 7832 * and don't require drivers to check that the 7833 * channel list they get isn't longer than what 7834 * they can scan, as long as they can scan all 7835 * the channels they registered at once. 7836 */ 7837 nla_for_each_nested(attr2, freqs, tmp2) 7838 if (attr1 != attr2 && 7839 nla_get_u32(attr1) == nla_get_u32(attr2)) 7840 return 0; 7841 } 7842 7843 return n_channels; 7844 } 7845 7846 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 7847 { 7848 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 7849 } 7850 7851 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 7852 struct cfg80211_bss_selection *bss_select) 7853 { 7854 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 7855 struct nlattr *nest; 7856 int err; 7857 bool found = false; 7858 int i; 7859 7860 /* only process one nested attribute */ 7861 nest = nla_data(nla); 7862 if (!nla_ok(nest, nla_len(nest))) 7863 return -EINVAL; 7864 7865 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 7866 nest, nl80211_bss_select_policy, 7867 NULL); 7868 if (err) 7869 return err; 7870 7871 /* only one attribute may be given */ 7872 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 7873 if (attr[i]) { 7874 if (found) 7875 return -EINVAL; 7876 found = true; 7877 } 7878 } 7879 7880 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 7881 7882 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 7883 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 7884 7885 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 7886 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 7887 bss_select->param.band_pref = 7888 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 7889 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 7890 return -EINVAL; 7891 } 7892 7893 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 7894 struct nl80211_bss_select_rssi_adjust *adj_param; 7895 7896 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 7897 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 7898 bss_select->param.adjust.band = adj_param->band; 7899 bss_select->param.adjust.delta = adj_param->delta; 7900 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 7901 return -EINVAL; 7902 } 7903 7904 /* user-space did not provide behaviour attribute */ 7905 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 7906 return -EINVAL; 7907 7908 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 7909 return -EINVAL; 7910 7911 return 0; 7912 } 7913 7914 int nl80211_parse_random_mac(struct nlattr **attrs, 7915 u8 *mac_addr, u8 *mac_addr_mask) 7916 { 7917 int i; 7918 7919 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 7920 eth_zero_addr(mac_addr); 7921 eth_zero_addr(mac_addr_mask); 7922 mac_addr[0] = 0x2; 7923 mac_addr_mask[0] = 0x3; 7924 7925 return 0; 7926 } 7927 7928 /* need both or none */ 7929 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 7930 return -EINVAL; 7931 7932 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 7933 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 7934 7935 /* don't allow or configure an mcast address */ 7936 if (!is_multicast_ether_addr(mac_addr_mask) || 7937 is_multicast_ether_addr(mac_addr)) 7938 return -EINVAL; 7939 7940 /* 7941 * allow users to pass a MAC address that has bits set outside 7942 * of the mask, but don't bother drivers with having to deal 7943 * with such bits 7944 */ 7945 for (i = 0; i < ETH_ALEN; i++) 7946 mac_addr[i] &= mac_addr_mask[i]; 7947 7948 return 0; 7949 } 7950 7951 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 7952 { 7953 ASSERT_WDEV_LOCK(wdev); 7954 7955 if (!cfg80211_beaconing_iface_active(wdev)) 7956 return true; 7957 7958 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 7959 return true; 7960 7961 return regulatory_pre_cac_allowed(wdev->wiphy); 7962 } 7963 7964 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 7965 enum nl80211_ext_feature_index feat) 7966 { 7967 if (!(flags & flag)) 7968 return true; 7969 if (wiphy_ext_feature_isset(wiphy, feat)) 7970 return true; 7971 return false; 7972 } 7973 7974 static int 7975 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 7976 void *request, struct nlattr **attrs, 7977 bool is_sched_scan) 7978 { 7979 u8 *mac_addr, *mac_addr_mask; 7980 u32 *flags; 7981 enum nl80211_feature_flags randomness_flag; 7982 7983 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 7984 return 0; 7985 7986 if (is_sched_scan) { 7987 struct cfg80211_sched_scan_request *req = request; 7988 7989 randomness_flag = wdev ? 7990 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 7991 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 7992 flags = &req->flags; 7993 mac_addr = req->mac_addr; 7994 mac_addr_mask = req->mac_addr_mask; 7995 } else { 7996 struct cfg80211_scan_request *req = request; 7997 7998 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 7999 flags = &req->flags; 8000 mac_addr = req->mac_addr; 8001 mac_addr_mask = req->mac_addr_mask; 8002 } 8003 8004 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 8005 8006 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 8007 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 8008 !nl80211_check_scan_feat(wiphy, *flags, 8009 NL80211_SCAN_FLAG_LOW_SPAN, 8010 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 8011 !nl80211_check_scan_feat(wiphy, *flags, 8012 NL80211_SCAN_FLAG_LOW_POWER, 8013 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 8014 !nl80211_check_scan_feat(wiphy, *flags, 8015 NL80211_SCAN_FLAG_HIGH_ACCURACY, 8016 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 8017 !nl80211_check_scan_feat(wiphy, *flags, 8018 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 8019 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 8020 !nl80211_check_scan_feat(wiphy, *flags, 8021 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 8022 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 8023 !nl80211_check_scan_feat(wiphy, *flags, 8024 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 8025 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 8026 !nl80211_check_scan_feat(wiphy, *flags, 8027 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 8028 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 8029 !nl80211_check_scan_feat(wiphy, *flags, 8030 NL80211_SCAN_FLAG_RANDOM_SN, 8031 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 8032 !nl80211_check_scan_feat(wiphy, *flags, 8033 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 8034 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 8035 return -EOPNOTSUPP; 8036 8037 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 8038 int err; 8039 8040 if (!(wiphy->features & randomness_flag) || 8041 (wdev && wdev->current_bss)) 8042 return -EOPNOTSUPP; 8043 8044 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 8045 if (err) 8046 return err; 8047 } 8048 8049 return 0; 8050 } 8051 8052 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 8053 { 8054 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8055 struct wireless_dev *wdev = info->user_ptr[1]; 8056 struct cfg80211_scan_request *request; 8057 struct nlattr *scan_freqs = NULL; 8058 bool scan_freqs_khz = false; 8059 struct nlattr *attr; 8060 struct wiphy *wiphy; 8061 int err, tmp, n_ssids = 0, n_channels, i; 8062 size_t ie_len; 8063 8064 wiphy = &rdev->wiphy; 8065 8066 if (wdev->iftype == NL80211_IFTYPE_NAN) 8067 return -EOPNOTSUPP; 8068 8069 if (!rdev->ops->scan) 8070 return -EOPNOTSUPP; 8071 8072 if (rdev->scan_req || rdev->scan_msg) 8073 return -EBUSY; 8074 8075 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 8076 if (!wiphy_ext_feature_isset(wiphy, 8077 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 8078 return -EOPNOTSUPP; 8079 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 8080 scan_freqs_khz = true; 8081 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 8082 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 8083 8084 if (scan_freqs) { 8085 n_channels = validate_scan_freqs(scan_freqs); 8086 if (!n_channels) 8087 return -EINVAL; 8088 } else { 8089 n_channels = ieee80211_get_num_supported_channels(wiphy); 8090 } 8091 8092 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 8093 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 8094 n_ssids++; 8095 8096 if (n_ssids > wiphy->max_scan_ssids) 8097 return -EINVAL; 8098 8099 if (info->attrs[NL80211_ATTR_IE]) 8100 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8101 else 8102 ie_len = 0; 8103 8104 if (ie_len > wiphy->max_scan_ie_len) 8105 return -EINVAL; 8106 8107 request = kzalloc(sizeof(*request) 8108 + sizeof(*request->ssids) * n_ssids 8109 + sizeof(*request->channels) * n_channels 8110 + ie_len, GFP_KERNEL); 8111 if (!request) 8112 return -ENOMEM; 8113 8114 if (n_ssids) 8115 request->ssids = (void *)&request->channels[n_channels]; 8116 request->n_ssids = n_ssids; 8117 if (ie_len) { 8118 if (n_ssids) 8119 request->ie = (void *)(request->ssids + n_ssids); 8120 else 8121 request->ie = (void *)(request->channels + n_channels); 8122 } 8123 8124 i = 0; 8125 if (scan_freqs) { 8126 /* user specified, bail out if channel not found */ 8127 nla_for_each_nested(attr, scan_freqs, tmp) { 8128 struct ieee80211_channel *chan; 8129 int freq = nla_get_u32(attr); 8130 8131 if (!scan_freqs_khz) 8132 freq = MHZ_TO_KHZ(freq); 8133 8134 chan = ieee80211_get_channel_khz(wiphy, freq); 8135 if (!chan) { 8136 err = -EINVAL; 8137 goto out_free; 8138 } 8139 8140 /* ignore disabled channels */ 8141 if (chan->flags & IEEE80211_CHAN_DISABLED) 8142 continue; 8143 8144 request->channels[i] = chan; 8145 i++; 8146 } 8147 } else { 8148 enum nl80211_band band; 8149 8150 /* all channels */ 8151 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8152 int j; 8153 8154 if (!wiphy->bands[band]) 8155 continue; 8156 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8157 struct ieee80211_channel *chan; 8158 8159 chan = &wiphy->bands[band]->channels[j]; 8160 8161 if (chan->flags & IEEE80211_CHAN_DISABLED) 8162 continue; 8163 8164 request->channels[i] = chan; 8165 i++; 8166 } 8167 } 8168 } 8169 8170 if (!i) { 8171 err = -EINVAL; 8172 goto out_free; 8173 } 8174 8175 request->n_channels = i; 8176 8177 wdev_lock(wdev); 8178 if (!cfg80211_off_channel_oper_allowed(wdev)) { 8179 struct ieee80211_channel *chan; 8180 8181 if (request->n_channels != 1) { 8182 wdev_unlock(wdev); 8183 err = -EBUSY; 8184 goto out_free; 8185 } 8186 8187 chan = request->channels[0]; 8188 if (chan->center_freq != wdev->chandef.chan->center_freq) { 8189 wdev_unlock(wdev); 8190 err = -EBUSY; 8191 goto out_free; 8192 } 8193 } 8194 wdev_unlock(wdev); 8195 8196 i = 0; 8197 if (n_ssids) { 8198 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 8199 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8200 err = -EINVAL; 8201 goto out_free; 8202 } 8203 request->ssids[i].ssid_len = nla_len(attr); 8204 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 8205 i++; 8206 } 8207 } 8208 8209 if (info->attrs[NL80211_ATTR_IE]) { 8210 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8211 memcpy((void *)request->ie, 8212 nla_data(info->attrs[NL80211_ATTR_IE]), 8213 request->ie_len); 8214 } 8215 8216 for (i = 0; i < NUM_NL80211_BANDS; i++) 8217 if (wiphy->bands[i]) 8218 request->rates[i] = 8219 (1 << wiphy->bands[i]->n_bitrates) - 1; 8220 8221 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 8222 nla_for_each_nested(attr, 8223 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 8224 tmp) { 8225 enum nl80211_band band = nla_type(attr); 8226 8227 if (band < 0 || band >= NUM_NL80211_BANDS) { 8228 err = -EINVAL; 8229 goto out_free; 8230 } 8231 8232 if (!wiphy->bands[band]) 8233 continue; 8234 8235 err = ieee80211_get_ratemask(wiphy->bands[band], 8236 nla_data(attr), 8237 nla_len(attr), 8238 &request->rates[band]); 8239 if (err) 8240 goto out_free; 8241 } 8242 } 8243 8244 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 8245 if (!wiphy_ext_feature_isset(wiphy, 8246 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 8247 err = -EOPNOTSUPP; 8248 goto out_free; 8249 } 8250 8251 request->duration = 8252 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 8253 request->duration_mandatory = 8254 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 8255 } 8256 8257 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 8258 false); 8259 if (err) 8260 goto out_free; 8261 8262 request->no_cck = 8263 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 8264 8265 /* Initial implementation used NL80211_ATTR_MAC to set the specific 8266 * BSSID to scan for. This was problematic because that same attribute 8267 * was already used for another purpose (local random MAC address). The 8268 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 8269 * compatibility with older userspace components, also use the 8270 * NL80211_ATTR_MAC value here if it can be determined to be used for 8271 * the specific BSSID use case instead of the random MAC address 8272 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 8273 */ 8274 if (info->attrs[NL80211_ATTR_BSSID]) 8275 memcpy(request->bssid, 8276 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 8277 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 8278 info->attrs[NL80211_ATTR_MAC]) 8279 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 8280 ETH_ALEN); 8281 else 8282 eth_broadcast_addr(request->bssid); 8283 8284 request->wdev = wdev; 8285 request->wiphy = &rdev->wiphy; 8286 request->scan_start = jiffies; 8287 8288 rdev->scan_req = request; 8289 err = cfg80211_scan(rdev); 8290 8291 if (err) 8292 goto out_free; 8293 8294 nl80211_send_scan_start(rdev, wdev); 8295 if (wdev->netdev) 8296 dev_hold(wdev->netdev); 8297 8298 return 0; 8299 8300 out_free: 8301 rdev->scan_req = NULL; 8302 kfree(request); 8303 8304 return err; 8305 } 8306 8307 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 8308 { 8309 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8310 struct wireless_dev *wdev = info->user_ptr[1]; 8311 8312 if (!rdev->ops->abort_scan) 8313 return -EOPNOTSUPP; 8314 8315 if (rdev->scan_msg) 8316 return 0; 8317 8318 if (!rdev->scan_req) 8319 return -ENOENT; 8320 8321 rdev_abort_scan(rdev, wdev); 8322 return 0; 8323 } 8324 8325 static int 8326 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 8327 struct cfg80211_sched_scan_request *request, 8328 struct nlattr **attrs) 8329 { 8330 int tmp, err, i = 0; 8331 struct nlattr *attr; 8332 8333 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8334 u32 interval; 8335 8336 /* 8337 * If scan plans are not specified, 8338 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 8339 * case one scan plan will be set with the specified scan 8340 * interval and infinite number of iterations. 8341 */ 8342 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 8343 if (!interval) 8344 return -EINVAL; 8345 8346 request->scan_plans[0].interval = 8347 DIV_ROUND_UP(interval, MSEC_PER_SEC); 8348 if (!request->scan_plans[0].interval) 8349 return -EINVAL; 8350 8351 if (request->scan_plans[0].interval > 8352 wiphy->max_sched_scan_plan_interval) 8353 request->scan_plans[0].interval = 8354 wiphy->max_sched_scan_plan_interval; 8355 8356 return 0; 8357 } 8358 8359 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 8360 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 8361 8362 if (WARN_ON(i >= n_plans)) 8363 return -EINVAL; 8364 8365 err = nla_parse_nested_deprecated(plan, 8366 NL80211_SCHED_SCAN_PLAN_MAX, 8367 attr, nl80211_plan_policy, 8368 NULL); 8369 if (err) 8370 return err; 8371 8372 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 8373 return -EINVAL; 8374 8375 request->scan_plans[i].interval = 8376 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 8377 if (!request->scan_plans[i].interval || 8378 request->scan_plans[i].interval > 8379 wiphy->max_sched_scan_plan_interval) 8380 return -EINVAL; 8381 8382 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 8383 request->scan_plans[i].iterations = 8384 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 8385 if (!request->scan_plans[i].iterations || 8386 (request->scan_plans[i].iterations > 8387 wiphy->max_sched_scan_plan_iterations)) 8388 return -EINVAL; 8389 } else if (i < n_plans - 1) { 8390 /* 8391 * All scan plans but the last one must specify 8392 * a finite number of iterations 8393 */ 8394 return -EINVAL; 8395 } 8396 8397 i++; 8398 } 8399 8400 /* 8401 * The last scan plan must not specify the number of 8402 * iterations, it is supposed to run infinitely 8403 */ 8404 if (request->scan_plans[n_plans - 1].iterations) 8405 return -EINVAL; 8406 8407 return 0; 8408 } 8409 8410 static int 8411 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 8412 struct cfg80211_match_set *match_sets, 8413 struct nlattr *tb_band_rssi, 8414 s32 rssi_thold) 8415 { 8416 struct nlattr *attr; 8417 int i, tmp, ret = 0; 8418 8419 if (!wiphy_ext_feature_isset(wiphy, 8420 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 8421 if (tb_band_rssi) 8422 ret = -EOPNOTSUPP; 8423 else 8424 for (i = 0; i < NUM_NL80211_BANDS; i++) 8425 match_sets->per_band_rssi_thold[i] = 8426 NL80211_SCAN_RSSI_THOLD_OFF; 8427 return ret; 8428 } 8429 8430 for (i = 0; i < NUM_NL80211_BANDS; i++) 8431 match_sets->per_band_rssi_thold[i] = rssi_thold; 8432 8433 nla_for_each_nested(attr, tb_band_rssi, tmp) { 8434 enum nl80211_band band = nla_type(attr); 8435 8436 if (band < 0 || band >= NUM_NL80211_BANDS) 8437 return -EINVAL; 8438 8439 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 8440 } 8441 8442 return 0; 8443 } 8444 8445 static struct cfg80211_sched_scan_request * 8446 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 8447 struct nlattr **attrs, int max_match_sets) 8448 { 8449 struct cfg80211_sched_scan_request *request; 8450 struct nlattr *attr; 8451 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 8452 enum nl80211_band band; 8453 size_t ie_len; 8454 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 8455 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 8456 8457 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8458 n_channels = validate_scan_freqs( 8459 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 8460 if (!n_channels) 8461 return ERR_PTR(-EINVAL); 8462 } else { 8463 n_channels = ieee80211_get_num_supported_channels(wiphy); 8464 } 8465 8466 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 8467 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8468 tmp) 8469 n_ssids++; 8470 8471 if (n_ssids > wiphy->max_sched_scan_ssids) 8472 return ERR_PTR(-EINVAL); 8473 8474 /* 8475 * First, count the number of 'real' matchsets. Due to an issue with 8476 * the old implementation, matchsets containing only the RSSI attribute 8477 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 8478 * RSSI for all matchsets, rather than their own matchset for reporting 8479 * all APs with a strong RSSI. This is needed to be compatible with 8480 * older userspace that treated a matchset with only the RSSI as the 8481 * global RSSI for all other matchsets - if there are other matchsets. 8482 */ 8483 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8484 nla_for_each_nested(attr, 8485 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8486 tmp) { 8487 struct nlattr *rssi; 8488 8489 err = nla_parse_nested_deprecated(tb, 8490 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8491 attr, 8492 nl80211_match_policy, 8493 NULL); 8494 if (err) 8495 return ERR_PTR(err); 8496 8497 /* SSID and BSSID are mutually exclusive */ 8498 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 8499 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 8500 return ERR_PTR(-EINVAL); 8501 8502 /* add other standalone attributes here */ 8503 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 8504 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 8505 n_match_sets++; 8506 continue; 8507 } 8508 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8509 if (rssi) 8510 default_match_rssi = nla_get_s32(rssi); 8511 } 8512 } 8513 8514 /* However, if there's no other matchset, add the RSSI one */ 8515 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 8516 n_match_sets = 1; 8517 8518 if (n_match_sets > max_match_sets) 8519 return ERR_PTR(-EINVAL); 8520 8521 if (attrs[NL80211_ATTR_IE]) 8522 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 8523 else 8524 ie_len = 0; 8525 8526 if (ie_len > wiphy->max_sched_scan_ie_len) 8527 return ERR_PTR(-EINVAL); 8528 8529 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8530 /* 8531 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 8532 * each scan plan already specifies its own interval 8533 */ 8534 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8535 return ERR_PTR(-EINVAL); 8536 8537 nla_for_each_nested(attr, 8538 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 8539 n_plans++; 8540 } else { 8541 /* 8542 * The scan interval attribute is kept for backward 8543 * compatibility. If no scan plans are specified and sched scan 8544 * interval is specified, one scan plan will be set with this 8545 * scan interval and infinite number of iterations. 8546 */ 8547 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8548 return ERR_PTR(-EINVAL); 8549 8550 n_plans = 1; 8551 } 8552 8553 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 8554 return ERR_PTR(-EINVAL); 8555 8556 if (!wiphy_ext_feature_isset( 8557 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 8558 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 8559 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 8560 return ERR_PTR(-EINVAL); 8561 8562 request = kzalloc(sizeof(*request) 8563 + sizeof(*request->ssids) * n_ssids 8564 + sizeof(*request->match_sets) * n_match_sets 8565 + sizeof(*request->scan_plans) * n_plans 8566 + sizeof(*request->channels) * n_channels 8567 + ie_len, GFP_KERNEL); 8568 if (!request) 8569 return ERR_PTR(-ENOMEM); 8570 8571 if (n_ssids) 8572 request->ssids = (void *)&request->channels[n_channels]; 8573 request->n_ssids = n_ssids; 8574 if (ie_len) { 8575 if (n_ssids) 8576 request->ie = (void *)(request->ssids + n_ssids); 8577 else 8578 request->ie = (void *)(request->channels + n_channels); 8579 } 8580 8581 if (n_match_sets) { 8582 if (request->ie) 8583 request->match_sets = (void *)(request->ie + ie_len); 8584 else if (n_ssids) 8585 request->match_sets = 8586 (void *)(request->ssids + n_ssids); 8587 else 8588 request->match_sets = 8589 (void *)(request->channels + n_channels); 8590 } 8591 request->n_match_sets = n_match_sets; 8592 8593 if (n_match_sets) 8594 request->scan_plans = (void *)(request->match_sets + 8595 n_match_sets); 8596 else if (request->ie) 8597 request->scan_plans = (void *)(request->ie + ie_len); 8598 else if (n_ssids) 8599 request->scan_plans = (void *)(request->ssids + n_ssids); 8600 else 8601 request->scan_plans = (void *)(request->channels + n_channels); 8602 8603 request->n_scan_plans = n_plans; 8604 8605 i = 0; 8606 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8607 /* user specified, bail out if channel not found */ 8608 nla_for_each_nested(attr, 8609 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 8610 tmp) { 8611 struct ieee80211_channel *chan; 8612 8613 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 8614 8615 if (!chan) { 8616 err = -EINVAL; 8617 goto out_free; 8618 } 8619 8620 /* ignore disabled channels */ 8621 if (chan->flags & IEEE80211_CHAN_DISABLED) 8622 continue; 8623 8624 request->channels[i] = chan; 8625 i++; 8626 } 8627 } else { 8628 /* all channels */ 8629 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8630 int j; 8631 8632 if (!wiphy->bands[band]) 8633 continue; 8634 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8635 struct ieee80211_channel *chan; 8636 8637 chan = &wiphy->bands[band]->channels[j]; 8638 8639 if (chan->flags & IEEE80211_CHAN_DISABLED) 8640 continue; 8641 8642 request->channels[i] = chan; 8643 i++; 8644 } 8645 } 8646 } 8647 8648 if (!i) { 8649 err = -EINVAL; 8650 goto out_free; 8651 } 8652 8653 request->n_channels = i; 8654 8655 i = 0; 8656 if (n_ssids) { 8657 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8658 tmp) { 8659 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8660 err = -EINVAL; 8661 goto out_free; 8662 } 8663 request->ssids[i].ssid_len = nla_len(attr); 8664 memcpy(request->ssids[i].ssid, nla_data(attr), 8665 nla_len(attr)); 8666 i++; 8667 } 8668 } 8669 8670 i = 0; 8671 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8672 nla_for_each_nested(attr, 8673 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8674 tmp) { 8675 struct nlattr *ssid, *bssid, *rssi; 8676 8677 err = nla_parse_nested_deprecated(tb, 8678 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8679 attr, 8680 nl80211_match_policy, 8681 NULL); 8682 if (err) 8683 goto out_free; 8684 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 8685 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 8686 8687 if (!ssid && !bssid) { 8688 i++; 8689 continue; 8690 } 8691 8692 if (WARN_ON(i >= n_match_sets)) { 8693 /* this indicates a programming error, 8694 * the loop above should have verified 8695 * things properly 8696 */ 8697 err = -EINVAL; 8698 goto out_free; 8699 } 8700 8701 if (ssid) { 8702 memcpy(request->match_sets[i].ssid.ssid, 8703 nla_data(ssid), nla_len(ssid)); 8704 request->match_sets[i].ssid.ssid_len = 8705 nla_len(ssid); 8706 } 8707 if (bssid) 8708 memcpy(request->match_sets[i].bssid, 8709 nla_data(bssid), ETH_ALEN); 8710 8711 /* special attribute - old implementation w/a */ 8712 request->match_sets[i].rssi_thold = default_match_rssi; 8713 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8714 if (rssi) 8715 request->match_sets[i].rssi_thold = 8716 nla_get_s32(rssi); 8717 8718 /* Parse per band RSSI attribute */ 8719 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 8720 &request->match_sets[i], 8721 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 8722 request->match_sets[i].rssi_thold); 8723 if (err) 8724 goto out_free; 8725 8726 i++; 8727 } 8728 8729 /* there was no other matchset, so the RSSI one is alone */ 8730 if (i == 0 && n_match_sets) 8731 request->match_sets[0].rssi_thold = default_match_rssi; 8732 8733 request->min_rssi_thold = INT_MAX; 8734 for (i = 0; i < n_match_sets; i++) 8735 request->min_rssi_thold = 8736 min(request->match_sets[i].rssi_thold, 8737 request->min_rssi_thold); 8738 } else { 8739 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 8740 } 8741 8742 if (ie_len) { 8743 request->ie_len = ie_len; 8744 memcpy((void *)request->ie, 8745 nla_data(attrs[NL80211_ATTR_IE]), 8746 request->ie_len); 8747 } 8748 8749 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 8750 if (err) 8751 goto out_free; 8752 8753 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 8754 request->delay = 8755 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 8756 8757 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 8758 request->relative_rssi = nla_get_s8( 8759 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 8760 request->relative_rssi_set = true; 8761 } 8762 8763 if (request->relative_rssi_set && 8764 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 8765 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 8766 8767 rssi_adjust = nla_data( 8768 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 8769 request->rssi_adjust.band = rssi_adjust->band; 8770 request->rssi_adjust.delta = rssi_adjust->delta; 8771 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 8772 err = -EINVAL; 8773 goto out_free; 8774 } 8775 } 8776 8777 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 8778 if (err) 8779 goto out_free; 8780 8781 request->scan_start = jiffies; 8782 8783 return request; 8784 8785 out_free: 8786 kfree(request); 8787 return ERR_PTR(err); 8788 } 8789 8790 static int nl80211_start_sched_scan(struct sk_buff *skb, 8791 struct genl_info *info) 8792 { 8793 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8794 struct net_device *dev = info->user_ptr[1]; 8795 struct wireless_dev *wdev = dev->ieee80211_ptr; 8796 struct cfg80211_sched_scan_request *sched_scan_req; 8797 bool want_multi; 8798 int err; 8799 8800 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 8801 return -EOPNOTSUPP; 8802 8803 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 8804 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 8805 if (err) 8806 return err; 8807 8808 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 8809 info->attrs, 8810 rdev->wiphy.max_match_sets); 8811 8812 err = PTR_ERR_OR_ZERO(sched_scan_req); 8813 if (err) 8814 goto out_err; 8815 8816 /* leave request id zero for legacy request 8817 * or if driver does not support multi-scheduled scan 8818 */ 8819 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 8820 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 8821 8822 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 8823 if (err) 8824 goto out_free; 8825 8826 sched_scan_req->dev = dev; 8827 sched_scan_req->wiphy = &rdev->wiphy; 8828 8829 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 8830 sched_scan_req->owner_nlportid = info->snd_portid; 8831 8832 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 8833 8834 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 8835 return 0; 8836 8837 out_free: 8838 kfree(sched_scan_req); 8839 out_err: 8840 return err; 8841 } 8842 8843 static int nl80211_stop_sched_scan(struct sk_buff *skb, 8844 struct genl_info *info) 8845 { 8846 struct cfg80211_sched_scan_request *req; 8847 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8848 u64 cookie; 8849 8850 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 8851 return -EOPNOTSUPP; 8852 8853 if (info->attrs[NL80211_ATTR_COOKIE]) { 8854 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 8855 return __cfg80211_stop_sched_scan(rdev, cookie, false); 8856 } 8857 8858 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 8859 struct cfg80211_sched_scan_request, 8860 list); 8861 if (!req || req->reqid || 8862 (req->owner_nlportid && 8863 req->owner_nlportid != info->snd_portid)) 8864 return -ENOENT; 8865 8866 return cfg80211_stop_sched_scan_req(rdev, req, false); 8867 } 8868 8869 static int nl80211_start_radar_detection(struct sk_buff *skb, 8870 struct genl_info *info) 8871 { 8872 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8873 struct net_device *dev = info->user_ptr[1]; 8874 struct wireless_dev *wdev = dev->ieee80211_ptr; 8875 struct wiphy *wiphy = wdev->wiphy; 8876 struct cfg80211_chan_def chandef; 8877 enum nl80211_dfs_regions dfs_region; 8878 unsigned int cac_time_ms; 8879 int err; 8880 8881 dfs_region = reg_get_dfs_region(wiphy); 8882 if (dfs_region == NL80211_DFS_UNSET) 8883 return -EINVAL; 8884 8885 err = nl80211_parse_chandef(rdev, info, &chandef); 8886 if (err) 8887 return err; 8888 8889 if (netif_carrier_ok(dev)) 8890 return -EBUSY; 8891 8892 if (wdev->cac_started) 8893 return -EBUSY; 8894 8895 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8896 if (err < 0) 8897 return err; 8898 8899 if (err == 0) 8900 return -EINVAL; 8901 8902 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) 8903 return -EINVAL; 8904 8905 /* CAC start is offloaded to HW and can't be started manually */ 8906 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) 8907 return -EOPNOTSUPP; 8908 8909 if (!rdev->ops->start_radar_detection) 8910 return -EOPNOTSUPP; 8911 8912 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 8913 if (WARN_ON(!cac_time_ms)) 8914 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 8915 8916 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 8917 if (!err) { 8918 wdev->chandef = chandef; 8919 wdev->cac_started = true; 8920 wdev->cac_start_time = jiffies; 8921 wdev->cac_time_ms = cac_time_ms; 8922 } 8923 return err; 8924 } 8925 8926 static int nl80211_notify_radar_detection(struct sk_buff *skb, 8927 struct genl_info *info) 8928 { 8929 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8930 struct net_device *dev = info->user_ptr[1]; 8931 struct wireless_dev *wdev = dev->ieee80211_ptr; 8932 struct wiphy *wiphy = wdev->wiphy; 8933 struct cfg80211_chan_def chandef; 8934 enum nl80211_dfs_regions dfs_region; 8935 int err; 8936 8937 dfs_region = reg_get_dfs_region(wiphy); 8938 if (dfs_region == NL80211_DFS_UNSET) { 8939 GENL_SET_ERR_MSG(info, 8940 "DFS Region is not set. Unexpected Radar indication"); 8941 return -EINVAL; 8942 } 8943 8944 err = nl80211_parse_chandef(rdev, info, &chandef); 8945 if (err) { 8946 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 8947 return err; 8948 } 8949 8950 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8951 if (err < 0) { 8952 GENL_SET_ERR_MSG(info, "chandef is invalid"); 8953 return err; 8954 } 8955 8956 if (err == 0) { 8957 GENL_SET_ERR_MSG(info, 8958 "Unexpected Radar indication for chandef/iftype"); 8959 return -EINVAL; 8960 } 8961 8962 /* Do not process this notification if radar is already detected 8963 * by kernel on this channel, and return success. 8964 */ 8965 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 8966 return 0; 8967 8968 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 8969 8970 cfg80211_sched_dfs_chan_update(rdev); 8971 8972 rdev->radar_chandef = chandef; 8973 8974 /* Propagate this notification to other radios as well */ 8975 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 8976 8977 return 0; 8978 } 8979 8980 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 8981 { 8982 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8983 struct net_device *dev = info->user_ptr[1]; 8984 struct wireless_dev *wdev = dev->ieee80211_ptr; 8985 struct cfg80211_csa_settings params; 8986 /* csa_attrs is defined static to avoid waste of stack size - this 8987 * function is called under RTNL lock, so this should not be a problem. 8988 */ 8989 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 8990 int err; 8991 bool need_new_beacon = false; 8992 bool need_handle_dfs_flag = true; 8993 int len, i; 8994 u32 cs_count; 8995 8996 if (!rdev->ops->channel_switch || 8997 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 8998 return -EOPNOTSUPP; 8999 9000 switch (dev->ieee80211_ptr->iftype) { 9001 case NL80211_IFTYPE_AP: 9002 case NL80211_IFTYPE_P2P_GO: 9003 need_new_beacon = true; 9004 /* For all modes except AP the handle_dfs flag needs to be 9005 * supplied to tell the kernel that userspace will handle radar 9006 * events when they happen. Otherwise a switch to a channel 9007 * requiring DFS will be rejected. 9008 */ 9009 need_handle_dfs_flag = false; 9010 9011 /* useless if AP is not running */ 9012 if (!wdev->beacon_interval) 9013 return -ENOTCONN; 9014 break; 9015 case NL80211_IFTYPE_ADHOC: 9016 if (!wdev->ssid_len) 9017 return -ENOTCONN; 9018 break; 9019 case NL80211_IFTYPE_MESH_POINT: 9020 if (!wdev->mesh_id_len) 9021 return -ENOTCONN; 9022 break; 9023 default: 9024 return -EOPNOTSUPP; 9025 } 9026 9027 memset(¶ms, 0, sizeof(params)); 9028 params.beacon_csa.ftm_responder = -1; 9029 9030 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9031 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 9032 return -EINVAL; 9033 9034 /* only important for AP, IBSS and mesh create IEs internally */ 9035 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 9036 return -EINVAL; 9037 9038 /* Even though the attribute is u32, the specification says 9039 * u8, so let's make sure we don't overflow. 9040 */ 9041 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 9042 if (cs_count > 255) 9043 return -EINVAL; 9044 9045 params.count = cs_count; 9046 9047 if (!need_new_beacon) 9048 goto skip_beacons; 9049 9050 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after); 9051 if (err) 9052 return err; 9053 9054 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 9055 info->attrs[NL80211_ATTR_CSA_IES], 9056 nl80211_policy, info->extack); 9057 if (err) 9058 return err; 9059 9060 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa); 9061 if (err) 9062 return err; 9063 9064 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) 9065 return -EINVAL; 9066 9067 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9068 if (!len || (len % sizeof(u16))) 9069 return -EINVAL; 9070 9071 params.n_counter_offsets_beacon = len / sizeof(u16); 9072 if (rdev->wiphy.max_num_csa_counters && 9073 (params.n_counter_offsets_beacon > 9074 rdev->wiphy.max_num_csa_counters)) 9075 return -EINVAL; 9076 9077 params.counter_offsets_beacon = 9078 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9079 9080 /* sanity checks - counters should fit and be the same */ 9081 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 9082 u16 offset = params.counter_offsets_beacon[i]; 9083 9084 if (offset >= params.beacon_csa.tail_len) 9085 return -EINVAL; 9086 9087 if (params.beacon_csa.tail[offset] != params.count) 9088 return -EINVAL; 9089 } 9090 9091 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 9092 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9093 if (!len || (len % sizeof(u16))) 9094 return -EINVAL; 9095 9096 params.n_counter_offsets_presp = len / sizeof(u16); 9097 if (rdev->wiphy.max_num_csa_counters && 9098 (params.n_counter_offsets_presp > 9099 rdev->wiphy.max_num_csa_counters)) 9100 return -EINVAL; 9101 9102 params.counter_offsets_presp = 9103 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9104 9105 /* sanity checks - counters should fit and be the same */ 9106 for (i = 0; i < params.n_counter_offsets_presp; i++) { 9107 u16 offset = params.counter_offsets_presp[i]; 9108 9109 if (offset >= params.beacon_csa.probe_resp_len) 9110 return -EINVAL; 9111 9112 if (params.beacon_csa.probe_resp[offset] != 9113 params.count) 9114 return -EINVAL; 9115 } 9116 } 9117 9118 skip_beacons: 9119 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 9120 if (err) 9121 return err; 9122 9123 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 9124 wdev->iftype)) 9125 return -EINVAL; 9126 9127 err = cfg80211_chandef_dfs_required(wdev->wiphy, 9128 ¶ms.chandef, 9129 wdev->iftype); 9130 if (err < 0) 9131 return err; 9132 9133 if (err > 0) { 9134 params.radar_required = true; 9135 if (need_handle_dfs_flag && 9136 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 9137 return -EINVAL; 9138 } 9139 } 9140 9141 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 9142 params.block_tx = true; 9143 9144 wdev_lock(wdev); 9145 err = rdev_channel_switch(rdev, dev, ¶ms); 9146 wdev_unlock(wdev); 9147 9148 return err; 9149 } 9150 9151 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 9152 u32 seq, int flags, 9153 struct cfg80211_registered_device *rdev, 9154 struct wireless_dev *wdev, 9155 struct cfg80211_internal_bss *intbss) 9156 { 9157 struct cfg80211_bss *res = &intbss->pub; 9158 const struct cfg80211_bss_ies *ies; 9159 void *hdr; 9160 struct nlattr *bss; 9161 9162 ASSERT_WDEV_LOCK(wdev); 9163 9164 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 9165 NL80211_CMD_NEW_SCAN_RESULTS); 9166 if (!hdr) 9167 return -1; 9168 9169 genl_dump_check_consistent(cb, hdr); 9170 9171 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 9172 goto nla_put_failure; 9173 if (wdev->netdev && 9174 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 9175 goto nla_put_failure; 9176 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 9177 NL80211_ATTR_PAD)) 9178 goto nla_put_failure; 9179 9180 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 9181 if (!bss) 9182 goto nla_put_failure; 9183 if ((!is_zero_ether_addr(res->bssid) && 9184 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 9185 goto nla_put_failure; 9186 9187 rcu_read_lock(); 9188 /* indicate whether we have probe response data or not */ 9189 if (rcu_access_pointer(res->proberesp_ies) && 9190 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 9191 goto fail_unlock_rcu; 9192 9193 /* this pointer prefers to be pointed to probe response data 9194 * but is always valid 9195 */ 9196 ies = rcu_dereference(res->ies); 9197 if (ies) { 9198 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 9199 NL80211_BSS_PAD)) 9200 goto fail_unlock_rcu; 9201 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 9202 ies->len, ies->data)) 9203 goto fail_unlock_rcu; 9204 } 9205 9206 /* and this pointer is always (unless driver didn't know) beacon data */ 9207 ies = rcu_dereference(res->beacon_ies); 9208 if (ies && ies->from_beacon) { 9209 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 9210 NL80211_BSS_PAD)) 9211 goto fail_unlock_rcu; 9212 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 9213 ies->len, ies->data)) 9214 goto fail_unlock_rcu; 9215 } 9216 rcu_read_unlock(); 9217 9218 if (res->beacon_interval && 9219 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 9220 goto nla_put_failure; 9221 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 9222 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 9223 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 9224 res->channel->freq_offset) || 9225 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 9226 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 9227 jiffies_to_msecs(jiffies - intbss->ts))) 9228 goto nla_put_failure; 9229 9230 if (intbss->parent_tsf && 9231 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 9232 intbss->parent_tsf, NL80211_BSS_PAD) || 9233 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 9234 intbss->parent_bssid))) 9235 goto nla_put_failure; 9236 9237 if (intbss->ts_boottime && 9238 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 9239 intbss->ts_boottime, NL80211_BSS_PAD)) 9240 goto nla_put_failure; 9241 9242 if (!nl80211_put_signal(msg, intbss->pub.chains, 9243 intbss->pub.chain_signal, 9244 NL80211_BSS_CHAIN_SIGNAL)) 9245 goto nla_put_failure; 9246 9247 switch (rdev->wiphy.signal_type) { 9248 case CFG80211_SIGNAL_TYPE_MBM: 9249 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 9250 goto nla_put_failure; 9251 break; 9252 case CFG80211_SIGNAL_TYPE_UNSPEC: 9253 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 9254 goto nla_put_failure; 9255 break; 9256 default: 9257 break; 9258 } 9259 9260 switch (wdev->iftype) { 9261 case NL80211_IFTYPE_P2P_CLIENT: 9262 case NL80211_IFTYPE_STATION: 9263 if (intbss == wdev->current_bss && 9264 nla_put_u32(msg, NL80211_BSS_STATUS, 9265 NL80211_BSS_STATUS_ASSOCIATED)) 9266 goto nla_put_failure; 9267 break; 9268 case NL80211_IFTYPE_ADHOC: 9269 if (intbss == wdev->current_bss && 9270 nla_put_u32(msg, NL80211_BSS_STATUS, 9271 NL80211_BSS_STATUS_IBSS_JOINED)) 9272 goto nla_put_failure; 9273 break; 9274 default: 9275 break; 9276 } 9277 9278 nla_nest_end(msg, bss); 9279 9280 genlmsg_end(msg, hdr); 9281 return 0; 9282 9283 fail_unlock_rcu: 9284 rcu_read_unlock(); 9285 nla_put_failure: 9286 genlmsg_cancel(msg, hdr); 9287 return -EMSGSIZE; 9288 } 9289 9290 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 9291 { 9292 struct cfg80211_registered_device *rdev; 9293 struct cfg80211_internal_bss *scan; 9294 struct wireless_dev *wdev; 9295 int start = cb->args[2], idx = 0; 9296 int err; 9297 9298 rtnl_lock(); 9299 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9300 if (err) { 9301 rtnl_unlock(); 9302 return err; 9303 } 9304 9305 wdev_lock(wdev); 9306 spin_lock_bh(&rdev->bss_lock); 9307 9308 /* 9309 * dump_scan will be called multiple times to break up the scan results 9310 * into multiple messages. It is unlikely that any more bss-es will be 9311 * expired after the first call, so only call only call this on the 9312 * first dump_scan invocation. 9313 */ 9314 if (start == 0) 9315 cfg80211_bss_expire(rdev); 9316 9317 cb->seq = rdev->bss_generation; 9318 9319 list_for_each_entry(scan, &rdev->bss_list, list) { 9320 if (++idx <= start) 9321 continue; 9322 if (nl80211_send_bss(skb, cb, 9323 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9324 rdev, wdev, scan) < 0) { 9325 idx--; 9326 break; 9327 } 9328 } 9329 9330 spin_unlock_bh(&rdev->bss_lock); 9331 wdev_unlock(wdev); 9332 9333 cb->args[2] = idx; 9334 rtnl_unlock(); 9335 9336 return skb->len; 9337 } 9338 9339 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 9340 int flags, struct net_device *dev, 9341 bool allow_radio_stats, 9342 struct survey_info *survey) 9343 { 9344 void *hdr; 9345 struct nlattr *infoattr; 9346 9347 /* skip radio stats if userspace didn't request them */ 9348 if (!survey->channel && !allow_radio_stats) 9349 return 0; 9350 9351 hdr = nl80211hdr_put(msg, portid, seq, flags, 9352 NL80211_CMD_NEW_SURVEY_RESULTS); 9353 if (!hdr) 9354 return -ENOMEM; 9355 9356 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 9357 goto nla_put_failure; 9358 9359 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 9360 if (!infoattr) 9361 goto nla_put_failure; 9362 9363 if (survey->channel && 9364 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 9365 survey->channel->center_freq)) 9366 goto nla_put_failure; 9367 9368 if (survey->channel && survey->channel->freq_offset && 9369 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 9370 survey->channel->freq_offset)) 9371 goto nla_put_failure; 9372 9373 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 9374 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 9375 goto nla_put_failure; 9376 if ((survey->filled & SURVEY_INFO_IN_USE) && 9377 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 9378 goto nla_put_failure; 9379 if ((survey->filled & SURVEY_INFO_TIME) && 9380 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 9381 survey->time, NL80211_SURVEY_INFO_PAD)) 9382 goto nla_put_failure; 9383 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 9384 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 9385 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 9386 goto nla_put_failure; 9387 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 9388 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 9389 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 9390 goto nla_put_failure; 9391 if ((survey->filled & SURVEY_INFO_TIME_RX) && 9392 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 9393 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 9394 goto nla_put_failure; 9395 if ((survey->filled & SURVEY_INFO_TIME_TX) && 9396 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 9397 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 9398 goto nla_put_failure; 9399 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 9400 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 9401 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 9402 goto nla_put_failure; 9403 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 9404 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 9405 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 9406 goto nla_put_failure; 9407 9408 nla_nest_end(msg, infoattr); 9409 9410 genlmsg_end(msg, hdr); 9411 return 0; 9412 9413 nla_put_failure: 9414 genlmsg_cancel(msg, hdr); 9415 return -EMSGSIZE; 9416 } 9417 9418 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 9419 { 9420 struct nlattr **attrbuf; 9421 struct survey_info survey; 9422 struct cfg80211_registered_device *rdev; 9423 struct wireless_dev *wdev; 9424 int survey_idx = cb->args[2]; 9425 int res; 9426 bool radio_stats; 9427 9428 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 9429 if (!attrbuf) 9430 return -ENOMEM; 9431 9432 rtnl_lock(); 9433 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9434 if (res) 9435 goto out_err; 9436 9437 /* prepare_wdev_dump parsed the attributes */ 9438 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 9439 9440 if (!wdev->netdev) { 9441 res = -EINVAL; 9442 goto out_err; 9443 } 9444 9445 if (!rdev->ops->dump_survey) { 9446 res = -EOPNOTSUPP; 9447 goto out_err; 9448 } 9449 9450 while (1) { 9451 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 9452 if (res == -ENOENT) 9453 break; 9454 if (res) 9455 goto out_err; 9456 9457 /* don't send disabled channels, but do send non-channel data */ 9458 if (survey.channel && 9459 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 9460 survey_idx++; 9461 continue; 9462 } 9463 9464 if (nl80211_send_survey(skb, 9465 NETLINK_CB(cb->skb).portid, 9466 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9467 wdev->netdev, radio_stats, &survey) < 0) 9468 goto out; 9469 survey_idx++; 9470 } 9471 9472 out: 9473 cb->args[2] = survey_idx; 9474 res = skb->len; 9475 out_err: 9476 kfree(attrbuf); 9477 rtnl_unlock(); 9478 return res; 9479 } 9480 9481 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 9482 { 9483 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 9484 NL80211_WPA_VERSION_2 | 9485 NL80211_WPA_VERSION_3)); 9486 } 9487 9488 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 9489 { 9490 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9491 struct net_device *dev = info->user_ptr[1]; 9492 struct ieee80211_channel *chan; 9493 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 9494 int err, ssid_len, ie_len = 0, auth_data_len = 0; 9495 enum nl80211_auth_type auth_type; 9496 struct key_parse key; 9497 bool local_state_change; 9498 u32 freq; 9499 9500 if (!info->attrs[NL80211_ATTR_MAC]) 9501 return -EINVAL; 9502 9503 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 9504 return -EINVAL; 9505 9506 if (!info->attrs[NL80211_ATTR_SSID]) 9507 return -EINVAL; 9508 9509 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9510 return -EINVAL; 9511 9512 err = nl80211_parse_key(info, &key); 9513 if (err) 9514 return err; 9515 9516 if (key.idx >= 0) { 9517 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 9518 return -EINVAL; 9519 if (!key.p.key || !key.p.key_len) 9520 return -EINVAL; 9521 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 9522 key.p.key_len != WLAN_KEY_LEN_WEP40) && 9523 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 9524 key.p.key_len != WLAN_KEY_LEN_WEP104)) 9525 return -EINVAL; 9526 if (key.idx > 3) 9527 return -EINVAL; 9528 } else { 9529 key.p.key_len = 0; 9530 key.p.key = NULL; 9531 } 9532 9533 if (key.idx >= 0) { 9534 int i; 9535 bool ok = false; 9536 9537 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 9538 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 9539 ok = true; 9540 break; 9541 } 9542 } 9543 if (!ok) 9544 return -EINVAL; 9545 } 9546 9547 if (!rdev->ops->auth) 9548 return -EOPNOTSUPP; 9549 9550 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9551 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9552 return -EOPNOTSUPP; 9553 9554 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9555 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9556 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9557 freq += 9558 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9559 9560 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9561 if (!chan) 9562 return -EINVAL; 9563 9564 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9565 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9566 9567 if (info->attrs[NL80211_ATTR_IE]) { 9568 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9569 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9570 } 9571 9572 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9573 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 9574 return -EINVAL; 9575 9576 if ((auth_type == NL80211_AUTHTYPE_SAE || 9577 auth_type == NL80211_AUTHTYPE_FILS_SK || 9578 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 9579 auth_type == NL80211_AUTHTYPE_FILS_PK) && 9580 !info->attrs[NL80211_ATTR_AUTH_DATA]) 9581 return -EINVAL; 9582 9583 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 9584 if (auth_type != NL80211_AUTHTYPE_SAE && 9585 auth_type != NL80211_AUTHTYPE_FILS_SK && 9586 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 9587 auth_type != NL80211_AUTHTYPE_FILS_PK) 9588 return -EINVAL; 9589 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 9590 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 9591 } 9592 9593 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9594 9595 /* 9596 * Since we no longer track auth state, ignore 9597 * requests to only change local state. 9598 */ 9599 if (local_state_change) 9600 return 0; 9601 9602 wdev_lock(dev->ieee80211_ptr); 9603 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 9604 ssid, ssid_len, ie, ie_len, 9605 key.p.key, key.p.key_len, key.idx, 9606 auth_data, auth_data_len); 9607 wdev_unlock(dev->ieee80211_ptr); 9608 return err; 9609 } 9610 9611 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 9612 struct genl_info *info) 9613 { 9614 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9615 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 9616 return -EINVAL; 9617 } 9618 9619 if (!rdev->ops->tx_control_port || 9620 !wiphy_ext_feature_isset(&rdev->wiphy, 9621 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 9622 return -EOPNOTSUPP; 9623 9624 return 0; 9625 } 9626 9627 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 9628 struct genl_info *info, 9629 struct cfg80211_crypto_settings *settings, 9630 int cipher_limit) 9631 { 9632 memset(settings, 0, sizeof(*settings)); 9633 9634 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 9635 9636 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 9637 u16 proto; 9638 9639 proto = nla_get_u16( 9640 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 9641 settings->control_port_ethertype = cpu_to_be16(proto); 9642 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 9643 proto != ETH_P_PAE) 9644 return -EINVAL; 9645 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 9646 settings->control_port_no_encrypt = true; 9647 } else 9648 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 9649 9650 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 9651 int r = validate_pae_over_nl80211(rdev, info); 9652 9653 if (r < 0) 9654 return r; 9655 9656 settings->control_port_over_nl80211 = true; 9657 9658 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 9659 settings->control_port_no_preauth = true; 9660 } 9661 9662 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 9663 void *data; 9664 int len, i; 9665 9666 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9667 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9668 settings->n_ciphers_pairwise = len / sizeof(u32); 9669 9670 if (len % sizeof(u32)) 9671 return -EINVAL; 9672 9673 if (settings->n_ciphers_pairwise > cipher_limit) 9674 return -EINVAL; 9675 9676 memcpy(settings->ciphers_pairwise, data, len); 9677 9678 for (i = 0; i < settings->n_ciphers_pairwise; i++) 9679 if (!cfg80211_supported_cipher_suite( 9680 &rdev->wiphy, 9681 settings->ciphers_pairwise[i])) 9682 return -EINVAL; 9683 } 9684 9685 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 9686 settings->cipher_group = 9687 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 9688 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 9689 settings->cipher_group)) 9690 return -EINVAL; 9691 } 9692 9693 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 9694 settings->wpa_versions = 9695 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 9696 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 9697 return -EINVAL; 9698 } 9699 9700 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 9701 void *data; 9702 int len; 9703 9704 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 9705 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 9706 settings->n_akm_suites = len / sizeof(u32); 9707 9708 if (len % sizeof(u32)) 9709 return -EINVAL; 9710 9711 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 9712 return -EINVAL; 9713 9714 memcpy(settings->akm_suites, data, len); 9715 } 9716 9717 if (info->attrs[NL80211_ATTR_PMK]) { 9718 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 9719 return -EINVAL; 9720 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9721 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 9722 !wiphy_ext_feature_isset(&rdev->wiphy, 9723 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 9724 return -EINVAL; 9725 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9726 } 9727 9728 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 9729 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9730 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 9731 !wiphy_ext_feature_isset(&rdev->wiphy, 9732 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 9733 return -EINVAL; 9734 settings->sae_pwd = 9735 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9736 settings->sae_pwd_len = 9737 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9738 } 9739 9740 return 0; 9741 } 9742 9743 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 9744 { 9745 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9746 struct net_device *dev = info->user_ptr[1]; 9747 struct ieee80211_channel *chan; 9748 struct cfg80211_assoc_request req = {}; 9749 const u8 *bssid, *ssid; 9750 int err, ssid_len = 0; 9751 u32 freq; 9752 9753 if (dev->ieee80211_ptr->conn_owner_nlportid && 9754 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9755 return -EPERM; 9756 9757 if (!info->attrs[NL80211_ATTR_MAC] || 9758 !info->attrs[NL80211_ATTR_SSID] || 9759 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9760 return -EINVAL; 9761 9762 if (!rdev->ops->assoc) 9763 return -EOPNOTSUPP; 9764 9765 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9766 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9767 return -EOPNOTSUPP; 9768 9769 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9770 9771 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9772 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9773 freq += 9774 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9775 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9776 if (!chan) 9777 return -EINVAL; 9778 9779 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9780 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9781 9782 if (info->attrs[NL80211_ATTR_IE]) { 9783 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9784 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9785 } 9786 9787 if (info->attrs[NL80211_ATTR_USE_MFP]) { 9788 enum nl80211_mfp mfp = 9789 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 9790 if (mfp == NL80211_MFP_REQUIRED) 9791 req.use_mfp = true; 9792 else if (mfp != NL80211_MFP_NO) 9793 return -EINVAL; 9794 } 9795 9796 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9797 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9798 9799 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9800 req.flags |= ASSOC_REQ_DISABLE_HT; 9801 9802 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9803 memcpy(&req.ht_capa_mask, 9804 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9805 sizeof(req.ht_capa_mask)); 9806 9807 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9808 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9809 return -EINVAL; 9810 memcpy(&req.ht_capa, 9811 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9812 sizeof(req.ht_capa)); 9813 } 9814 9815 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9816 req.flags |= ASSOC_REQ_DISABLE_VHT; 9817 9818 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9819 memcpy(&req.vht_capa_mask, 9820 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9821 sizeof(req.vht_capa_mask)); 9822 9823 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9824 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9825 return -EINVAL; 9826 memcpy(&req.vht_capa, 9827 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9828 sizeof(req.vht_capa)); 9829 } 9830 9831 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9832 if (!((rdev->wiphy.features & 9833 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9834 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9835 !wiphy_ext_feature_isset(&rdev->wiphy, 9836 NL80211_EXT_FEATURE_RRM)) 9837 return -EINVAL; 9838 req.flags |= ASSOC_REQ_USE_RRM; 9839 } 9840 9841 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 9842 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 9843 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 9844 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 9845 return -EINVAL; 9846 req.fils_nonces = 9847 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 9848 } 9849 9850 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 9851 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 9852 return -EINVAL; 9853 memcpy(&req.s1g_capa_mask, 9854 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 9855 sizeof(req.s1g_capa_mask)); 9856 } 9857 9858 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 9859 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 9860 return -EINVAL; 9861 memcpy(&req.s1g_capa, 9862 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 9863 sizeof(req.s1g_capa)); 9864 } 9865 9866 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 9867 if (!err) { 9868 wdev_lock(dev->ieee80211_ptr); 9869 9870 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 9871 ssid, ssid_len, &req); 9872 9873 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9874 dev->ieee80211_ptr->conn_owner_nlportid = 9875 info->snd_portid; 9876 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9877 bssid, ETH_ALEN); 9878 } 9879 9880 wdev_unlock(dev->ieee80211_ptr); 9881 } 9882 9883 return err; 9884 } 9885 9886 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 9887 { 9888 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9889 struct net_device *dev = info->user_ptr[1]; 9890 const u8 *ie = NULL, *bssid; 9891 int ie_len = 0, err; 9892 u16 reason_code; 9893 bool local_state_change; 9894 9895 if (dev->ieee80211_ptr->conn_owner_nlportid && 9896 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9897 return -EPERM; 9898 9899 if (!info->attrs[NL80211_ATTR_MAC]) 9900 return -EINVAL; 9901 9902 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9903 return -EINVAL; 9904 9905 if (!rdev->ops->deauth) 9906 return -EOPNOTSUPP; 9907 9908 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9909 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9910 return -EOPNOTSUPP; 9911 9912 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9913 9914 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9915 if (reason_code == 0) { 9916 /* Reason Code 0 is reserved */ 9917 return -EINVAL; 9918 } 9919 9920 if (info->attrs[NL80211_ATTR_IE]) { 9921 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9922 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9923 } 9924 9925 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9926 9927 wdev_lock(dev->ieee80211_ptr); 9928 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 9929 local_state_change); 9930 wdev_unlock(dev->ieee80211_ptr); 9931 return err; 9932 } 9933 9934 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 9935 { 9936 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9937 struct net_device *dev = info->user_ptr[1]; 9938 const u8 *ie = NULL, *bssid; 9939 int ie_len = 0, err; 9940 u16 reason_code; 9941 bool local_state_change; 9942 9943 if (dev->ieee80211_ptr->conn_owner_nlportid && 9944 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9945 return -EPERM; 9946 9947 if (!info->attrs[NL80211_ATTR_MAC]) 9948 return -EINVAL; 9949 9950 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9951 return -EINVAL; 9952 9953 if (!rdev->ops->disassoc) 9954 return -EOPNOTSUPP; 9955 9956 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9957 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9958 return -EOPNOTSUPP; 9959 9960 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9961 9962 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9963 if (reason_code == 0) { 9964 /* Reason Code 0 is reserved */ 9965 return -EINVAL; 9966 } 9967 9968 if (info->attrs[NL80211_ATTR_IE]) { 9969 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9970 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9971 } 9972 9973 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9974 9975 wdev_lock(dev->ieee80211_ptr); 9976 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 9977 local_state_change); 9978 wdev_unlock(dev->ieee80211_ptr); 9979 return err; 9980 } 9981 9982 static bool 9983 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 9984 int mcast_rate[NUM_NL80211_BANDS], 9985 int rateval) 9986 { 9987 struct wiphy *wiphy = &rdev->wiphy; 9988 bool found = false; 9989 int band, i; 9990 9991 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9992 struct ieee80211_supported_band *sband; 9993 9994 sband = wiphy->bands[band]; 9995 if (!sband) 9996 continue; 9997 9998 for (i = 0; i < sband->n_bitrates; i++) { 9999 if (sband->bitrates[i].bitrate == rateval) { 10000 mcast_rate[band] = i + 1; 10001 found = true; 10002 break; 10003 } 10004 } 10005 } 10006 10007 return found; 10008 } 10009 10010 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 10011 { 10012 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10013 struct net_device *dev = info->user_ptr[1]; 10014 struct cfg80211_ibss_params ibss; 10015 struct wiphy *wiphy; 10016 struct cfg80211_cached_keys *connkeys = NULL; 10017 int err; 10018 10019 memset(&ibss, 0, sizeof(ibss)); 10020 10021 if (!info->attrs[NL80211_ATTR_SSID] || 10022 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10023 return -EINVAL; 10024 10025 ibss.beacon_interval = 100; 10026 10027 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 10028 ibss.beacon_interval = 10029 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10030 10031 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 10032 ibss.beacon_interval); 10033 if (err) 10034 return err; 10035 10036 if (!rdev->ops->join_ibss) 10037 return -EOPNOTSUPP; 10038 10039 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10040 return -EOPNOTSUPP; 10041 10042 wiphy = &rdev->wiphy; 10043 10044 if (info->attrs[NL80211_ATTR_MAC]) { 10045 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10046 10047 if (!is_valid_ether_addr(ibss.bssid)) 10048 return -EINVAL; 10049 } 10050 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10051 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10052 10053 if (info->attrs[NL80211_ATTR_IE]) { 10054 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10055 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10056 } 10057 10058 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 10059 if (err) 10060 return err; 10061 10062 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 10063 NL80211_IFTYPE_ADHOC)) 10064 return -EINVAL; 10065 10066 switch (ibss.chandef.width) { 10067 case NL80211_CHAN_WIDTH_5: 10068 case NL80211_CHAN_WIDTH_10: 10069 case NL80211_CHAN_WIDTH_20_NOHT: 10070 break; 10071 case NL80211_CHAN_WIDTH_20: 10072 case NL80211_CHAN_WIDTH_40: 10073 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10074 return -EINVAL; 10075 break; 10076 case NL80211_CHAN_WIDTH_80: 10077 case NL80211_CHAN_WIDTH_80P80: 10078 case NL80211_CHAN_WIDTH_160: 10079 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10080 return -EINVAL; 10081 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10082 NL80211_EXT_FEATURE_VHT_IBSS)) 10083 return -EINVAL; 10084 break; 10085 default: 10086 return -EINVAL; 10087 } 10088 10089 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 10090 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 10091 10092 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10093 u8 *rates = 10094 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10095 int n_rates = 10096 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10097 struct ieee80211_supported_band *sband = 10098 wiphy->bands[ibss.chandef.chan->band]; 10099 10100 err = ieee80211_get_ratemask(sband, rates, n_rates, 10101 &ibss.basic_rates); 10102 if (err) 10103 return err; 10104 } 10105 10106 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10107 memcpy(&ibss.ht_capa_mask, 10108 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10109 sizeof(ibss.ht_capa_mask)); 10110 10111 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10112 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10113 return -EINVAL; 10114 memcpy(&ibss.ht_capa, 10115 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10116 sizeof(ibss.ht_capa)); 10117 } 10118 10119 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 10120 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 10121 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 10122 return -EINVAL; 10123 10124 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10125 bool no_ht = false; 10126 10127 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 10128 if (IS_ERR(connkeys)) 10129 return PTR_ERR(connkeys); 10130 10131 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 10132 no_ht) { 10133 kfree_sensitive(connkeys); 10134 return -EINVAL; 10135 } 10136 } 10137 10138 ibss.control_port = 10139 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 10140 10141 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10142 int r = validate_pae_over_nl80211(rdev, info); 10143 10144 if (r < 0) { 10145 kfree_sensitive(connkeys); 10146 return r; 10147 } 10148 10149 ibss.control_port_over_nl80211 = true; 10150 } 10151 10152 ibss.userspace_handles_dfs = 10153 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10154 10155 wdev_lock(dev->ieee80211_ptr); 10156 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 10157 if (err) 10158 kfree_sensitive(connkeys); 10159 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 10160 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10161 wdev_unlock(dev->ieee80211_ptr); 10162 10163 return err; 10164 } 10165 10166 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 10167 { 10168 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10169 struct net_device *dev = info->user_ptr[1]; 10170 10171 if (!rdev->ops->leave_ibss) 10172 return -EOPNOTSUPP; 10173 10174 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10175 return -EOPNOTSUPP; 10176 10177 return cfg80211_leave_ibss(rdev, dev, false); 10178 } 10179 10180 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 10181 { 10182 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10183 struct net_device *dev = info->user_ptr[1]; 10184 int mcast_rate[NUM_NL80211_BANDS]; 10185 u32 nla_rate; 10186 int err; 10187 10188 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 10189 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 10190 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 10191 return -EOPNOTSUPP; 10192 10193 if (!rdev->ops->set_mcast_rate) 10194 return -EOPNOTSUPP; 10195 10196 memset(mcast_rate, 0, sizeof(mcast_rate)); 10197 10198 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 10199 return -EINVAL; 10200 10201 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 10202 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 10203 return -EINVAL; 10204 10205 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 10206 10207 return err; 10208 } 10209 10210 static struct sk_buff * 10211 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 10212 struct wireless_dev *wdev, int approxlen, 10213 u32 portid, u32 seq, enum nl80211_commands cmd, 10214 enum nl80211_attrs attr, 10215 const struct nl80211_vendor_cmd_info *info, 10216 gfp_t gfp) 10217 { 10218 struct sk_buff *skb; 10219 void *hdr; 10220 struct nlattr *data; 10221 10222 skb = nlmsg_new(approxlen + 100, gfp); 10223 if (!skb) 10224 return NULL; 10225 10226 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 10227 if (!hdr) { 10228 kfree_skb(skb); 10229 return NULL; 10230 } 10231 10232 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 10233 goto nla_put_failure; 10234 10235 if (info) { 10236 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 10237 info->vendor_id)) 10238 goto nla_put_failure; 10239 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 10240 info->subcmd)) 10241 goto nla_put_failure; 10242 } 10243 10244 if (wdev) { 10245 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 10246 wdev_id(wdev), NL80211_ATTR_PAD)) 10247 goto nla_put_failure; 10248 if (wdev->netdev && 10249 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 10250 wdev->netdev->ifindex)) 10251 goto nla_put_failure; 10252 } 10253 10254 data = nla_nest_start_noflag(skb, attr); 10255 if (!data) 10256 goto nla_put_failure; 10257 10258 ((void **)skb->cb)[0] = rdev; 10259 ((void **)skb->cb)[1] = hdr; 10260 ((void **)skb->cb)[2] = data; 10261 10262 return skb; 10263 10264 nla_put_failure: 10265 kfree_skb(skb); 10266 return NULL; 10267 } 10268 10269 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 10270 struct wireless_dev *wdev, 10271 enum nl80211_commands cmd, 10272 enum nl80211_attrs attr, 10273 unsigned int portid, 10274 int vendor_event_idx, 10275 int approxlen, gfp_t gfp) 10276 { 10277 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 10278 const struct nl80211_vendor_cmd_info *info; 10279 10280 switch (cmd) { 10281 case NL80211_CMD_TESTMODE: 10282 if (WARN_ON(vendor_event_idx != -1)) 10283 return NULL; 10284 info = NULL; 10285 break; 10286 case NL80211_CMD_VENDOR: 10287 if (WARN_ON(vendor_event_idx < 0 || 10288 vendor_event_idx >= wiphy->n_vendor_events)) 10289 return NULL; 10290 info = &wiphy->vendor_events[vendor_event_idx]; 10291 break; 10292 default: 10293 WARN_ON(1); 10294 return NULL; 10295 } 10296 10297 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 10298 cmd, attr, info, gfp); 10299 } 10300 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 10301 10302 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 10303 { 10304 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 10305 void *hdr = ((void **)skb->cb)[1]; 10306 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 10307 struct nlattr *data = ((void **)skb->cb)[2]; 10308 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 10309 10310 /* clear CB data for netlink core to own from now on */ 10311 memset(skb->cb, 0, sizeof(skb->cb)); 10312 10313 nla_nest_end(skb, data); 10314 genlmsg_end(skb, hdr); 10315 10316 if (nlhdr->nlmsg_pid) { 10317 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 10318 nlhdr->nlmsg_pid); 10319 } else { 10320 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 10321 mcgrp = NL80211_MCGRP_VENDOR; 10322 10323 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 10324 skb, 0, mcgrp, gfp); 10325 } 10326 } 10327 EXPORT_SYMBOL(__cfg80211_send_event_skb); 10328 10329 #ifdef CONFIG_NL80211_TESTMODE 10330 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 10331 { 10332 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10333 struct wireless_dev *wdev = 10334 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 10335 int err; 10336 10337 if (!rdev->ops->testmode_cmd) 10338 return -EOPNOTSUPP; 10339 10340 if (IS_ERR(wdev)) { 10341 err = PTR_ERR(wdev); 10342 if (err != -EINVAL) 10343 return err; 10344 wdev = NULL; 10345 } else if (wdev->wiphy != &rdev->wiphy) { 10346 return -EINVAL; 10347 } 10348 10349 if (!info->attrs[NL80211_ATTR_TESTDATA]) 10350 return -EINVAL; 10351 10352 rdev->cur_cmd_info = info; 10353 err = rdev_testmode_cmd(rdev, wdev, 10354 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 10355 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 10356 rdev->cur_cmd_info = NULL; 10357 10358 return err; 10359 } 10360 10361 static int nl80211_testmode_dump(struct sk_buff *skb, 10362 struct netlink_callback *cb) 10363 { 10364 struct cfg80211_registered_device *rdev; 10365 struct nlattr **attrbuf = NULL; 10366 int err; 10367 long phy_idx; 10368 void *data = NULL; 10369 int data_len = 0; 10370 10371 rtnl_lock(); 10372 10373 if (cb->args[0]) { 10374 /* 10375 * 0 is a valid index, but not valid for args[0], 10376 * so we need to offset by 1. 10377 */ 10378 phy_idx = cb->args[0] - 1; 10379 10380 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 10381 if (!rdev) { 10382 err = -ENOENT; 10383 goto out_err; 10384 } 10385 } else { 10386 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 10387 GFP_KERNEL); 10388 if (!attrbuf) { 10389 err = -ENOMEM; 10390 goto out_err; 10391 } 10392 10393 err = nlmsg_parse_deprecated(cb->nlh, 10394 GENL_HDRLEN + nl80211_fam.hdrsize, 10395 attrbuf, nl80211_fam.maxattr, 10396 nl80211_policy, NULL); 10397 if (err) 10398 goto out_err; 10399 10400 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 10401 if (IS_ERR(rdev)) { 10402 err = PTR_ERR(rdev); 10403 goto out_err; 10404 } 10405 phy_idx = rdev->wiphy_idx; 10406 10407 if (attrbuf[NL80211_ATTR_TESTDATA]) 10408 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 10409 } 10410 10411 if (cb->args[1]) { 10412 data = nla_data((void *)cb->args[1]); 10413 data_len = nla_len((void *)cb->args[1]); 10414 } 10415 10416 if (!rdev->ops->testmode_dump) { 10417 err = -EOPNOTSUPP; 10418 goto out_err; 10419 } 10420 10421 while (1) { 10422 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 10423 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10424 NL80211_CMD_TESTMODE); 10425 struct nlattr *tmdata; 10426 10427 if (!hdr) 10428 break; 10429 10430 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 10431 genlmsg_cancel(skb, hdr); 10432 break; 10433 } 10434 10435 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 10436 if (!tmdata) { 10437 genlmsg_cancel(skb, hdr); 10438 break; 10439 } 10440 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 10441 nla_nest_end(skb, tmdata); 10442 10443 if (err == -ENOBUFS || err == -ENOENT) { 10444 genlmsg_cancel(skb, hdr); 10445 break; 10446 } else if (err) { 10447 genlmsg_cancel(skb, hdr); 10448 goto out_err; 10449 } 10450 10451 genlmsg_end(skb, hdr); 10452 } 10453 10454 err = skb->len; 10455 /* see above */ 10456 cb->args[0] = phy_idx + 1; 10457 out_err: 10458 kfree(attrbuf); 10459 rtnl_unlock(); 10460 return err; 10461 } 10462 #endif 10463 10464 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 10465 { 10466 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10467 struct net_device *dev = info->user_ptr[1]; 10468 struct cfg80211_connect_params connect; 10469 struct wiphy *wiphy; 10470 struct cfg80211_cached_keys *connkeys = NULL; 10471 u32 freq = 0; 10472 int err; 10473 10474 memset(&connect, 0, sizeof(connect)); 10475 10476 if (!info->attrs[NL80211_ATTR_SSID] || 10477 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10478 return -EINVAL; 10479 10480 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10481 connect.auth_type = 10482 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10483 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 10484 NL80211_CMD_CONNECT)) 10485 return -EINVAL; 10486 } else 10487 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 10488 10489 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 10490 10491 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 10492 !wiphy_ext_feature_isset(&rdev->wiphy, 10493 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 10494 return -EINVAL; 10495 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 10496 10497 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 10498 NL80211_MAX_NR_CIPHER_SUITES); 10499 if (err) 10500 return err; 10501 10502 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10503 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10504 return -EOPNOTSUPP; 10505 10506 wiphy = &rdev->wiphy; 10507 10508 connect.bg_scan_period = -1; 10509 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 10510 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 10511 connect.bg_scan_period = 10512 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 10513 } 10514 10515 if (info->attrs[NL80211_ATTR_MAC]) 10516 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10517 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 10518 connect.bssid_hint = 10519 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 10520 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10521 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10522 10523 if (info->attrs[NL80211_ATTR_IE]) { 10524 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10525 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10526 } 10527 10528 if (info->attrs[NL80211_ATTR_USE_MFP]) { 10529 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 10530 if (connect.mfp == NL80211_MFP_OPTIONAL && 10531 !wiphy_ext_feature_isset(&rdev->wiphy, 10532 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 10533 return -EOPNOTSUPP; 10534 } else { 10535 connect.mfp = NL80211_MFP_NO; 10536 } 10537 10538 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 10539 connect.prev_bssid = 10540 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 10541 10542 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10543 freq = MHZ_TO_KHZ(nla_get_u32( 10544 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10545 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10546 freq += 10547 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10548 10549 if (freq) { 10550 connect.channel = nl80211_get_valid_chan(wiphy, freq); 10551 if (!connect.channel) 10552 return -EINVAL; 10553 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 10554 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 10555 freq = MHZ_TO_KHZ(freq); 10556 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 10557 if (!connect.channel_hint) 10558 return -EINVAL; 10559 } 10560 10561 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 10562 connect.edmg.channels = 10563 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 10564 10565 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 10566 connect.edmg.bw_config = 10567 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 10568 } 10569 10570 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10571 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 10572 if (IS_ERR(connkeys)) 10573 return PTR_ERR(connkeys); 10574 } 10575 10576 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 10577 connect.flags |= ASSOC_REQ_DISABLE_HT; 10578 10579 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10580 memcpy(&connect.ht_capa_mask, 10581 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10582 sizeof(connect.ht_capa_mask)); 10583 10584 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10585 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 10586 kfree_sensitive(connkeys); 10587 return -EINVAL; 10588 } 10589 memcpy(&connect.ht_capa, 10590 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10591 sizeof(connect.ht_capa)); 10592 } 10593 10594 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 10595 connect.flags |= ASSOC_REQ_DISABLE_VHT; 10596 10597 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 10598 memcpy(&connect.vht_capa_mask, 10599 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 10600 sizeof(connect.vht_capa_mask)); 10601 10602 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 10603 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 10604 kfree_sensitive(connkeys); 10605 return -EINVAL; 10606 } 10607 memcpy(&connect.vht_capa, 10608 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 10609 sizeof(connect.vht_capa)); 10610 } 10611 10612 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 10613 if (!((rdev->wiphy.features & 10614 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 10615 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 10616 !wiphy_ext_feature_isset(&rdev->wiphy, 10617 NL80211_EXT_FEATURE_RRM)) { 10618 kfree_sensitive(connkeys); 10619 return -EINVAL; 10620 } 10621 connect.flags |= ASSOC_REQ_USE_RRM; 10622 } 10623 10624 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 10625 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 10626 kfree_sensitive(connkeys); 10627 return -EOPNOTSUPP; 10628 } 10629 10630 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 10631 /* bss selection makes no sense if bssid is set */ 10632 if (connect.bssid) { 10633 kfree_sensitive(connkeys); 10634 return -EINVAL; 10635 } 10636 10637 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 10638 wiphy, &connect.bss_select); 10639 if (err) { 10640 kfree_sensitive(connkeys); 10641 return err; 10642 } 10643 } 10644 10645 if (wiphy_ext_feature_isset(&rdev->wiphy, 10646 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 10647 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10648 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10649 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10650 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10651 connect.fils_erp_username = 10652 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10653 connect.fils_erp_username_len = 10654 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10655 connect.fils_erp_realm = 10656 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10657 connect.fils_erp_realm_len = 10658 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10659 connect.fils_erp_next_seq_num = 10660 nla_get_u16( 10661 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10662 connect.fils_erp_rrk = 10663 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10664 connect.fils_erp_rrk_len = 10665 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10666 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10667 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10668 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10669 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10670 kfree_sensitive(connkeys); 10671 return -EINVAL; 10672 } 10673 10674 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 10675 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10676 kfree_sensitive(connkeys); 10677 GENL_SET_ERR_MSG(info, 10678 "external auth requires connection ownership"); 10679 return -EINVAL; 10680 } 10681 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 10682 } 10683 10684 wdev_lock(dev->ieee80211_ptr); 10685 10686 err = cfg80211_connect(rdev, dev, &connect, connkeys, 10687 connect.prev_bssid); 10688 if (err) 10689 kfree_sensitive(connkeys); 10690 10691 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10692 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10693 if (connect.bssid) 10694 memcpy(dev->ieee80211_ptr->disconnect_bssid, 10695 connect.bssid, ETH_ALEN); 10696 else 10697 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 10698 } 10699 10700 wdev_unlock(dev->ieee80211_ptr); 10701 10702 return err; 10703 } 10704 10705 static int nl80211_update_connect_params(struct sk_buff *skb, 10706 struct genl_info *info) 10707 { 10708 struct cfg80211_connect_params connect = {}; 10709 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10710 struct net_device *dev = info->user_ptr[1]; 10711 struct wireless_dev *wdev = dev->ieee80211_ptr; 10712 bool fils_sk_offload; 10713 u32 auth_type; 10714 u32 changed = 0; 10715 int ret; 10716 10717 if (!rdev->ops->update_connect_params) 10718 return -EOPNOTSUPP; 10719 10720 if (info->attrs[NL80211_ATTR_IE]) { 10721 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10722 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10723 changed |= UPDATE_ASSOC_IES; 10724 } 10725 10726 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 10727 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 10728 10729 /* 10730 * when driver supports fils-sk offload all attributes must be 10731 * provided. So the else covers "fils-sk-not-all" and 10732 * "no-fils-sk-any". 10733 */ 10734 if (fils_sk_offload && 10735 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10736 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10737 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10738 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10739 connect.fils_erp_username = 10740 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10741 connect.fils_erp_username_len = 10742 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10743 connect.fils_erp_realm = 10744 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10745 connect.fils_erp_realm_len = 10746 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10747 connect.fils_erp_next_seq_num = 10748 nla_get_u16( 10749 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10750 connect.fils_erp_rrk = 10751 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10752 connect.fils_erp_rrk_len = 10753 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10754 changed |= UPDATE_FILS_ERP_INFO; 10755 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10756 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10757 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10758 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10759 return -EINVAL; 10760 } 10761 10762 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10763 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10764 if (!nl80211_valid_auth_type(rdev, auth_type, 10765 NL80211_CMD_CONNECT)) 10766 return -EINVAL; 10767 10768 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 10769 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 10770 return -EINVAL; 10771 10772 connect.auth_type = auth_type; 10773 changed |= UPDATE_AUTH_TYPE; 10774 } 10775 10776 wdev_lock(dev->ieee80211_ptr); 10777 if (!wdev->current_bss) 10778 ret = -ENOLINK; 10779 else 10780 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 10781 wdev_unlock(dev->ieee80211_ptr); 10782 10783 return ret; 10784 } 10785 10786 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 10787 { 10788 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10789 struct net_device *dev = info->user_ptr[1]; 10790 u16 reason; 10791 int ret; 10792 10793 if (dev->ieee80211_ptr->conn_owner_nlportid && 10794 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10795 return -EPERM; 10796 10797 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 10798 reason = WLAN_REASON_DEAUTH_LEAVING; 10799 else 10800 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 10801 10802 if (reason == 0) 10803 return -EINVAL; 10804 10805 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10806 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10807 return -EOPNOTSUPP; 10808 10809 wdev_lock(dev->ieee80211_ptr); 10810 ret = cfg80211_disconnect(rdev, dev, reason, true); 10811 wdev_unlock(dev->ieee80211_ptr); 10812 return ret; 10813 } 10814 10815 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 10816 { 10817 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10818 struct net *net; 10819 int err; 10820 10821 if (info->attrs[NL80211_ATTR_PID]) { 10822 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 10823 10824 net = get_net_ns_by_pid(pid); 10825 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 10826 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 10827 10828 net = get_net_ns_by_fd(fd); 10829 } else { 10830 return -EINVAL; 10831 } 10832 10833 if (IS_ERR(net)) 10834 return PTR_ERR(net); 10835 10836 err = 0; 10837 10838 /* check if anything to do */ 10839 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 10840 err = cfg80211_switch_netns(rdev, net); 10841 10842 put_net(net); 10843 return err; 10844 } 10845 10846 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 10847 { 10848 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10849 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 10850 struct cfg80211_pmksa *pmksa) = NULL; 10851 struct net_device *dev = info->user_ptr[1]; 10852 struct cfg80211_pmksa pmksa; 10853 10854 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 10855 10856 if (!info->attrs[NL80211_ATTR_PMKID]) 10857 return -EINVAL; 10858 10859 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 10860 10861 if (info->attrs[NL80211_ATTR_MAC]) { 10862 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10863 } else if (info->attrs[NL80211_ATTR_SSID] && 10864 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 10865 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 10866 info->attrs[NL80211_ATTR_PMK])) { 10867 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10868 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10869 pmksa.cache_id = 10870 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 10871 } else { 10872 return -EINVAL; 10873 } 10874 if (info->attrs[NL80211_ATTR_PMK]) { 10875 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10876 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 10877 } 10878 10879 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 10880 pmksa.pmk_lifetime = 10881 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 10882 10883 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 10884 pmksa.pmk_reauth_threshold = 10885 nla_get_u8( 10886 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 10887 10888 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10889 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 10890 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP && 10891 wiphy_ext_feature_isset(&rdev->wiphy, 10892 NL80211_EXT_FEATURE_AP_PMKSA_CACHING))) 10893 return -EOPNOTSUPP; 10894 10895 switch (info->genlhdr->cmd) { 10896 case NL80211_CMD_SET_PMKSA: 10897 rdev_ops = rdev->ops->set_pmksa; 10898 break; 10899 case NL80211_CMD_DEL_PMKSA: 10900 rdev_ops = rdev->ops->del_pmksa; 10901 break; 10902 default: 10903 WARN_ON(1); 10904 break; 10905 } 10906 10907 if (!rdev_ops) 10908 return -EOPNOTSUPP; 10909 10910 return rdev_ops(&rdev->wiphy, dev, &pmksa); 10911 } 10912 10913 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 10914 { 10915 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10916 struct net_device *dev = info->user_ptr[1]; 10917 10918 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10919 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10920 return -EOPNOTSUPP; 10921 10922 if (!rdev->ops->flush_pmksa) 10923 return -EOPNOTSUPP; 10924 10925 return rdev_flush_pmksa(rdev, dev); 10926 } 10927 10928 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 10929 { 10930 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10931 struct net_device *dev = info->user_ptr[1]; 10932 u8 action_code, dialog_token; 10933 u32 peer_capability = 0; 10934 u16 status_code; 10935 u8 *peer; 10936 bool initiator; 10937 10938 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10939 !rdev->ops->tdls_mgmt) 10940 return -EOPNOTSUPP; 10941 10942 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 10943 !info->attrs[NL80211_ATTR_STATUS_CODE] || 10944 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 10945 !info->attrs[NL80211_ATTR_IE] || 10946 !info->attrs[NL80211_ATTR_MAC]) 10947 return -EINVAL; 10948 10949 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10950 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 10951 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 10952 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 10953 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 10954 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 10955 peer_capability = 10956 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 10957 10958 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 10959 dialog_token, status_code, peer_capability, 10960 initiator, 10961 nla_data(info->attrs[NL80211_ATTR_IE]), 10962 nla_len(info->attrs[NL80211_ATTR_IE])); 10963 } 10964 10965 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 10966 { 10967 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10968 struct net_device *dev = info->user_ptr[1]; 10969 enum nl80211_tdls_operation operation; 10970 u8 *peer; 10971 10972 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10973 !rdev->ops->tdls_oper) 10974 return -EOPNOTSUPP; 10975 10976 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 10977 !info->attrs[NL80211_ATTR_MAC]) 10978 return -EINVAL; 10979 10980 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 10981 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10982 10983 return rdev_tdls_oper(rdev, dev, peer, operation); 10984 } 10985 10986 static int nl80211_remain_on_channel(struct sk_buff *skb, 10987 struct genl_info *info) 10988 { 10989 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10990 struct wireless_dev *wdev = info->user_ptr[1]; 10991 struct cfg80211_chan_def chandef; 10992 const struct cfg80211_chan_def *compat_chandef; 10993 struct sk_buff *msg; 10994 void *hdr; 10995 u64 cookie; 10996 u32 duration; 10997 int err; 10998 10999 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 11000 !info->attrs[NL80211_ATTR_DURATION]) 11001 return -EINVAL; 11002 11003 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11004 11005 if (!rdev->ops->remain_on_channel || 11006 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 11007 return -EOPNOTSUPP; 11008 11009 /* 11010 * We should be on that channel for at least a minimum amount of 11011 * time (10ms) but no longer than the driver supports. 11012 */ 11013 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11014 duration > rdev->wiphy.max_remain_on_channel_duration) 11015 return -EINVAL; 11016 11017 err = nl80211_parse_chandef(rdev, info, &chandef); 11018 if (err) 11019 return err; 11020 11021 wdev_lock(wdev); 11022 if (!cfg80211_off_channel_oper_allowed(wdev) && 11023 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 11024 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 11025 &chandef); 11026 if (compat_chandef != &chandef) { 11027 wdev_unlock(wdev); 11028 return -EBUSY; 11029 } 11030 } 11031 wdev_unlock(wdev); 11032 11033 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11034 if (!msg) 11035 return -ENOMEM; 11036 11037 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11038 NL80211_CMD_REMAIN_ON_CHANNEL); 11039 if (!hdr) { 11040 err = -ENOBUFS; 11041 goto free_msg; 11042 } 11043 11044 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 11045 duration, &cookie); 11046 11047 if (err) 11048 goto free_msg; 11049 11050 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11051 NL80211_ATTR_PAD)) 11052 goto nla_put_failure; 11053 11054 genlmsg_end(msg, hdr); 11055 11056 return genlmsg_reply(msg, info); 11057 11058 nla_put_failure: 11059 err = -ENOBUFS; 11060 free_msg: 11061 nlmsg_free(msg); 11062 return err; 11063 } 11064 11065 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 11066 struct genl_info *info) 11067 { 11068 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11069 struct wireless_dev *wdev = info->user_ptr[1]; 11070 u64 cookie; 11071 11072 if (!info->attrs[NL80211_ATTR_COOKIE]) 11073 return -EINVAL; 11074 11075 if (!rdev->ops->cancel_remain_on_channel) 11076 return -EOPNOTSUPP; 11077 11078 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11079 11080 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 11081 } 11082 11083 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 11084 struct genl_info *info) 11085 { 11086 struct cfg80211_bitrate_mask mask; 11087 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11088 struct net_device *dev = info->user_ptr[1]; 11089 int err; 11090 11091 if (!rdev->ops->set_bitrate_mask) 11092 return -EOPNOTSUPP; 11093 11094 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11095 NL80211_ATTR_TX_RATES, &mask, 11096 dev); 11097 if (err) 11098 return err; 11099 11100 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 11101 } 11102 11103 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 11104 { 11105 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11106 struct wireless_dev *wdev = info->user_ptr[1]; 11107 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 11108 11109 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 11110 return -EINVAL; 11111 11112 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 11113 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 11114 11115 switch (wdev->iftype) { 11116 case NL80211_IFTYPE_STATION: 11117 case NL80211_IFTYPE_ADHOC: 11118 case NL80211_IFTYPE_P2P_CLIENT: 11119 case NL80211_IFTYPE_AP: 11120 case NL80211_IFTYPE_AP_VLAN: 11121 case NL80211_IFTYPE_MESH_POINT: 11122 case NL80211_IFTYPE_P2P_GO: 11123 case NL80211_IFTYPE_P2P_DEVICE: 11124 break; 11125 case NL80211_IFTYPE_NAN: 11126 default: 11127 return -EOPNOTSUPP; 11128 } 11129 11130 /* not much point in registering if we can't reply */ 11131 if (!rdev->ops->mgmt_tx) 11132 return -EOPNOTSUPP; 11133 11134 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 11135 !wiphy_ext_feature_isset(&rdev->wiphy, 11136 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 11137 GENL_SET_ERR_MSG(info, 11138 "multicast RX registrations are not supported"); 11139 return -EOPNOTSUPP; 11140 } 11141 11142 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 11143 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11144 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11145 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 11146 info->extack); 11147 } 11148 11149 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 11150 { 11151 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11152 struct wireless_dev *wdev = info->user_ptr[1]; 11153 struct cfg80211_chan_def chandef; 11154 int err; 11155 void *hdr = NULL; 11156 u64 cookie; 11157 struct sk_buff *msg = NULL; 11158 struct cfg80211_mgmt_tx_params params = { 11159 .dont_wait_for_ack = 11160 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 11161 }; 11162 11163 if (!info->attrs[NL80211_ATTR_FRAME]) 11164 return -EINVAL; 11165 11166 if (!rdev->ops->mgmt_tx) 11167 return -EOPNOTSUPP; 11168 11169 switch (wdev->iftype) { 11170 case NL80211_IFTYPE_P2P_DEVICE: 11171 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11172 return -EINVAL; 11173 case NL80211_IFTYPE_STATION: 11174 case NL80211_IFTYPE_ADHOC: 11175 case NL80211_IFTYPE_P2P_CLIENT: 11176 case NL80211_IFTYPE_AP: 11177 case NL80211_IFTYPE_AP_VLAN: 11178 case NL80211_IFTYPE_MESH_POINT: 11179 case NL80211_IFTYPE_P2P_GO: 11180 break; 11181 case NL80211_IFTYPE_NAN: 11182 default: 11183 return -EOPNOTSUPP; 11184 } 11185 11186 if (info->attrs[NL80211_ATTR_DURATION]) { 11187 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11188 return -EINVAL; 11189 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11190 11191 /* 11192 * We should wait on the channel for at least a minimum amount 11193 * of time (10ms) but no longer than the driver supports. 11194 */ 11195 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11196 params.wait > rdev->wiphy.max_remain_on_channel_duration) 11197 return -EINVAL; 11198 } 11199 11200 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 11201 11202 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11203 return -EINVAL; 11204 11205 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 11206 11207 /* get the channel if any has been specified, otherwise pass NULL to 11208 * the driver. The latter will use the current one 11209 */ 11210 chandef.chan = NULL; 11211 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11212 err = nl80211_parse_chandef(rdev, info, &chandef); 11213 if (err) 11214 return err; 11215 } 11216 11217 if (!chandef.chan && params.offchan) 11218 return -EINVAL; 11219 11220 wdev_lock(wdev); 11221 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 11222 wdev_unlock(wdev); 11223 return -EBUSY; 11224 } 11225 wdev_unlock(wdev); 11226 11227 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 11228 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 11229 11230 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 11231 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11232 int i; 11233 11234 if (len % sizeof(u16)) 11235 return -EINVAL; 11236 11237 params.n_csa_offsets = len / sizeof(u16); 11238 params.csa_offsets = 11239 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11240 11241 /* check that all the offsets fit the frame */ 11242 for (i = 0; i < params.n_csa_offsets; i++) { 11243 if (params.csa_offsets[i] >= params.len) 11244 return -EINVAL; 11245 } 11246 } 11247 11248 if (!params.dont_wait_for_ack) { 11249 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11250 if (!msg) 11251 return -ENOMEM; 11252 11253 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11254 NL80211_CMD_FRAME); 11255 if (!hdr) { 11256 err = -ENOBUFS; 11257 goto free_msg; 11258 } 11259 } 11260 11261 params.chan = chandef.chan; 11262 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 11263 if (err) 11264 goto free_msg; 11265 11266 if (msg) { 11267 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11268 NL80211_ATTR_PAD)) 11269 goto nla_put_failure; 11270 11271 genlmsg_end(msg, hdr); 11272 return genlmsg_reply(msg, info); 11273 } 11274 11275 return 0; 11276 11277 nla_put_failure: 11278 err = -ENOBUFS; 11279 free_msg: 11280 nlmsg_free(msg); 11281 return err; 11282 } 11283 11284 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 11285 { 11286 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11287 struct wireless_dev *wdev = info->user_ptr[1]; 11288 u64 cookie; 11289 11290 if (!info->attrs[NL80211_ATTR_COOKIE]) 11291 return -EINVAL; 11292 11293 if (!rdev->ops->mgmt_tx_cancel_wait) 11294 return -EOPNOTSUPP; 11295 11296 switch (wdev->iftype) { 11297 case NL80211_IFTYPE_STATION: 11298 case NL80211_IFTYPE_ADHOC: 11299 case NL80211_IFTYPE_P2P_CLIENT: 11300 case NL80211_IFTYPE_AP: 11301 case NL80211_IFTYPE_AP_VLAN: 11302 case NL80211_IFTYPE_P2P_GO: 11303 case NL80211_IFTYPE_P2P_DEVICE: 11304 break; 11305 case NL80211_IFTYPE_NAN: 11306 default: 11307 return -EOPNOTSUPP; 11308 } 11309 11310 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11311 11312 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 11313 } 11314 11315 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 11316 { 11317 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11318 struct wireless_dev *wdev; 11319 struct net_device *dev = info->user_ptr[1]; 11320 u8 ps_state; 11321 bool state; 11322 int err; 11323 11324 if (!info->attrs[NL80211_ATTR_PS_STATE]) 11325 return -EINVAL; 11326 11327 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 11328 11329 wdev = dev->ieee80211_ptr; 11330 11331 if (!rdev->ops->set_power_mgmt) 11332 return -EOPNOTSUPP; 11333 11334 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 11335 11336 if (state == wdev->ps) 11337 return 0; 11338 11339 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 11340 if (!err) 11341 wdev->ps = state; 11342 return err; 11343 } 11344 11345 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 11346 { 11347 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11348 enum nl80211_ps_state ps_state; 11349 struct wireless_dev *wdev; 11350 struct net_device *dev = info->user_ptr[1]; 11351 struct sk_buff *msg; 11352 void *hdr; 11353 int err; 11354 11355 wdev = dev->ieee80211_ptr; 11356 11357 if (!rdev->ops->set_power_mgmt) 11358 return -EOPNOTSUPP; 11359 11360 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11361 if (!msg) 11362 return -ENOMEM; 11363 11364 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11365 NL80211_CMD_GET_POWER_SAVE); 11366 if (!hdr) { 11367 err = -ENOBUFS; 11368 goto free_msg; 11369 } 11370 11371 if (wdev->ps) 11372 ps_state = NL80211_PS_ENABLED; 11373 else 11374 ps_state = NL80211_PS_DISABLED; 11375 11376 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 11377 goto nla_put_failure; 11378 11379 genlmsg_end(msg, hdr); 11380 return genlmsg_reply(msg, info); 11381 11382 nla_put_failure: 11383 err = -ENOBUFS; 11384 free_msg: 11385 nlmsg_free(msg); 11386 return err; 11387 } 11388 11389 static const struct nla_policy 11390 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 11391 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 11392 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 11393 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 11394 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 11395 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 11396 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 11397 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 11398 }; 11399 11400 static int nl80211_set_cqm_txe(struct genl_info *info, 11401 u32 rate, u32 pkts, u32 intvl) 11402 { 11403 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11404 struct net_device *dev = info->user_ptr[1]; 11405 struct wireless_dev *wdev = dev->ieee80211_ptr; 11406 11407 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 11408 return -EINVAL; 11409 11410 if (!rdev->ops->set_cqm_txe_config) 11411 return -EOPNOTSUPP; 11412 11413 if (wdev->iftype != NL80211_IFTYPE_STATION && 11414 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11415 return -EOPNOTSUPP; 11416 11417 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 11418 } 11419 11420 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 11421 struct net_device *dev) 11422 { 11423 struct wireless_dev *wdev = dev->ieee80211_ptr; 11424 s32 last, low, high; 11425 u32 hyst; 11426 int i, n, low_index; 11427 int err; 11428 11429 /* RSSI reporting disabled? */ 11430 if (!wdev->cqm_config) 11431 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 11432 11433 /* 11434 * Obtain current RSSI value if possible, if not and no RSSI threshold 11435 * event has been received yet, we should receive an event after a 11436 * connection is established and enough beacons received to calculate 11437 * the average. 11438 */ 11439 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 11440 rdev->ops->get_station) { 11441 struct station_info sinfo = {}; 11442 u8 *mac_addr; 11443 11444 mac_addr = wdev->current_bss->pub.bssid; 11445 11446 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 11447 if (err) 11448 return err; 11449 11450 cfg80211_sinfo_release_content(&sinfo); 11451 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 11452 wdev->cqm_config->last_rssi_event_value = 11453 (s8) sinfo.rx_beacon_signal_avg; 11454 } 11455 11456 last = wdev->cqm_config->last_rssi_event_value; 11457 hyst = wdev->cqm_config->rssi_hyst; 11458 n = wdev->cqm_config->n_rssi_thresholds; 11459 11460 for (i = 0; i < n; i++) { 11461 i = array_index_nospec(i, n); 11462 if (last < wdev->cqm_config->rssi_thresholds[i]) 11463 break; 11464 } 11465 11466 low_index = i - 1; 11467 if (low_index >= 0) { 11468 low_index = array_index_nospec(low_index, n); 11469 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 11470 } else { 11471 low = S32_MIN; 11472 } 11473 if (i < n) { 11474 i = array_index_nospec(i, n); 11475 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 11476 } else { 11477 high = S32_MAX; 11478 } 11479 11480 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 11481 } 11482 11483 static int nl80211_set_cqm_rssi(struct genl_info *info, 11484 const s32 *thresholds, int n_thresholds, 11485 u32 hysteresis) 11486 { 11487 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11488 struct net_device *dev = info->user_ptr[1]; 11489 struct wireless_dev *wdev = dev->ieee80211_ptr; 11490 int i, err; 11491 s32 prev = S32_MIN; 11492 11493 /* Check all values negative and sorted */ 11494 for (i = 0; i < n_thresholds; i++) { 11495 if (thresholds[i] > 0 || thresholds[i] <= prev) 11496 return -EINVAL; 11497 11498 prev = thresholds[i]; 11499 } 11500 11501 if (wdev->iftype != NL80211_IFTYPE_STATION && 11502 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11503 return -EOPNOTSUPP; 11504 11505 wdev_lock(wdev); 11506 cfg80211_cqm_config_free(wdev); 11507 wdev_unlock(wdev); 11508 11509 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 11510 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 11511 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 11512 11513 return rdev_set_cqm_rssi_config(rdev, dev, 11514 thresholds[0], hysteresis); 11515 } 11516 11517 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11518 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 11519 return -EOPNOTSUPP; 11520 11521 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 11522 n_thresholds = 0; 11523 11524 wdev_lock(wdev); 11525 if (n_thresholds) { 11526 struct cfg80211_cqm_config *cqm_config; 11527 11528 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 11529 n_thresholds * sizeof(s32), GFP_KERNEL); 11530 if (!cqm_config) { 11531 err = -ENOMEM; 11532 goto unlock; 11533 } 11534 11535 cqm_config->rssi_hyst = hysteresis; 11536 cqm_config->n_rssi_thresholds = n_thresholds; 11537 memcpy(cqm_config->rssi_thresholds, thresholds, 11538 n_thresholds * sizeof(s32)); 11539 11540 wdev->cqm_config = cqm_config; 11541 } 11542 11543 err = cfg80211_cqm_rssi_update(rdev, dev); 11544 11545 unlock: 11546 wdev_unlock(wdev); 11547 11548 return err; 11549 } 11550 11551 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 11552 { 11553 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 11554 struct nlattr *cqm; 11555 int err; 11556 11557 cqm = info->attrs[NL80211_ATTR_CQM]; 11558 if (!cqm) 11559 return -EINVAL; 11560 11561 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 11562 nl80211_attr_cqm_policy, 11563 info->extack); 11564 if (err) 11565 return err; 11566 11567 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 11568 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 11569 const s32 *thresholds = 11570 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11571 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11572 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 11573 11574 if (len % 4) 11575 return -EINVAL; 11576 11577 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 11578 hysteresis); 11579 } 11580 11581 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 11582 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 11583 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 11584 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 11585 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 11586 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 11587 11588 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 11589 } 11590 11591 return -EINVAL; 11592 } 11593 11594 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 11595 { 11596 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11597 struct net_device *dev = info->user_ptr[1]; 11598 struct ocb_setup setup = {}; 11599 int err; 11600 11601 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11602 if (err) 11603 return err; 11604 11605 return cfg80211_join_ocb(rdev, dev, &setup); 11606 } 11607 11608 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 11609 { 11610 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11611 struct net_device *dev = info->user_ptr[1]; 11612 11613 return cfg80211_leave_ocb(rdev, dev); 11614 } 11615 11616 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 11617 { 11618 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11619 struct net_device *dev = info->user_ptr[1]; 11620 struct mesh_config cfg; 11621 struct mesh_setup setup; 11622 int err; 11623 11624 /* start with default */ 11625 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 11626 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 11627 11628 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 11629 /* and parse parameters if given */ 11630 err = nl80211_parse_mesh_config(info, &cfg, NULL); 11631 if (err) 11632 return err; 11633 } 11634 11635 if (!info->attrs[NL80211_ATTR_MESH_ID] || 11636 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 11637 return -EINVAL; 11638 11639 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 11640 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 11641 11642 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11643 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 11644 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11645 return -EINVAL; 11646 11647 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 11648 setup.beacon_interval = 11649 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11650 11651 err = cfg80211_validate_beacon_int(rdev, 11652 NL80211_IFTYPE_MESH_POINT, 11653 setup.beacon_interval); 11654 if (err) 11655 return err; 11656 } 11657 11658 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 11659 setup.dtim_period = 11660 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 11661 if (setup.dtim_period < 1 || setup.dtim_period > 100) 11662 return -EINVAL; 11663 } 11664 11665 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 11666 /* parse additional setup parameters if given */ 11667 err = nl80211_parse_mesh_setup(info, &setup); 11668 if (err) 11669 return err; 11670 } 11671 11672 if (setup.user_mpm) 11673 cfg.auto_open_plinks = false; 11674 11675 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11676 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11677 if (err) 11678 return err; 11679 } else { 11680 /* __cfg80211_join_mesh() will sort it out */ 11681 setup.chandef.chan = NULL; 11682 } 11683 11684 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11685 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11686 int n_rates = 11687 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11688 struct ieee80211_supported_band *sband; 11689 11690 if (!setup.chandef.chan) 11691 return -EINVAL; 11692 11693 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 11694 11695 err = ieee80211_get_ratemask(sband, rates, n_rates, 11696 &setup.basic_rates); 11697 if (err) 11698 return err; 11699 } 11700 11701 if (info->attrs[NL80211_ATTR_TX_RATES]) { 11702 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11703 NL80211_ATTR_TX_RATES, 11704 &setup.beacon_rate, 11705 dev); 11706 if (err) 11707 return err; 11708 11709 if (!setup.chandef.chan) 11710 return -EINVAL; 11711 11712 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 11713 &setup.beacon_rate); 11714 if (err) 11715 return err; 11716 } 11717 11718 setup.userspace_handles_dfs = 11719 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11720 11721 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11722 int r = validate_pae_over_nl80211(rdev, info); 11723 11724 if (r < 0) 11725 return r; 11726 11727 setup.control_port_over_nl80211 = true; 11728 } 11729 11730 wdev_lock(dev->ieee80211_ptr); 11731 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 11732 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11733 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11734 wdev_unlock(dev->ieee80211_ptr); 11735 11736 return err; 11737 } 11738 11739 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 11740 { 11741 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11742 struct net_device *dev = info->user_ptr[1]; 11743 11744 return cfg80211_leave_mesh(rdev, dev); 11745 } 11746 11747 #ifdef CONFIG_PM 11748 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 11749 struct cfg80211_registered_device *rdev) 11750 { 11751 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 11752 struct nlattr *nl_pats, *nl_pat; 11753 int i, pat_len; 11754 11755 if (!wowlan->n_patterns) 11756 return 0; 11757 11758 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 11759 if (!nl_pats) 11760 return -ENOBUFS; 11761 11762 for (i = 0; i < wowlan->n_patterns; i++) { 11763 nl_pat = nla_nest_start_noflag(msg, i + 1); 11764 if (!nl_pat) 11765 return -ENOBUFS; 11766 pat_len = wowlan->patterns[i].pattern_len; 11767 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 11768 wowlan->patterns[i].mask) || 11769 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 11770 wowlan->patterns[i].pattern) || 11771 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 11772 wowlan->patterns[i].pkt_offset)) 11773 return -ENOBUFS; 11774 nla_nest_end(msg, nl_pat); 11775 } 11776 nla_nest_end(msg, nl_pats); 11777 11778 return 0; 11779 } 11780 11781 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 11782 struct cfg80211_wowlan_tcp *tcp) 11783 { 11784 struct nlattr *nl_tcp; 11785 11786 if (!tcp) 11787 return 0; 11788 11789 nl_tcp = nla_nest_start_noflag(msg, 11790 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 11791 if (!nl_tcp) 11792 return -ENOBUFS; 11793 11794 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 11795 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 11796 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 11797 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 11798 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 11799 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 11800 tcp->payload_len, tcp->payload) || 11801 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 11802 tcp->data_interval) || 11803 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 11804 tcp->wake_len, tcp->wake_data) || 11805 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 11806 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 11807 return -ENOBUFS; 11808 11809 if (tcp->payload_seq.len && 11810 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 11811 sizeof(tcp->payload_seq), &tcp->payload_seq)) 11812 return -ENOBUFS; 11813 11814 if (tcp->payload_tok.len && 11815 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 11816 sizeof(tcp->payload_tok) + tcp->tokens_size, 11817 &tcp->payload_tok)) 11818 return -ENOBUFS; 11819 11820 nla_nest_end(msg, nl_tcp); 11821 11822 return 0; 11823 } 11824 11825 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 11826 struct cfg80211_sched_scan_request *req) 11827 { 11828 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 11829 int i; 11830 11831 if (!req) 11832 return 0; 11833 11834 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 11835 if (!nd) 11836 return -ENOBUFS; 11837 11838 if (req->n_scan_plans == 1 && 11839 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 11840 req->scan_plans[0].interval * 1000)) 11841 return -ENOBUFS; 11842 11843 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 11844 return -ENOBUFS; 11845 11846 if (req->relative_rssi_set) { 11847 struct nl80211_bss_select_rssi_adjust rssi_adjust; 11848 11849 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 11850 req->relative_rssi)) 11851 return -ENOBUFS; 11852 11853 rssi_adjust.band = req->rssi_adjust.band; 11854 rssi_adjust.delta = req->rssi_adjust.delta; 11855 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 11856 sizeof(rssi_adjust), &rssi_adjust)) 11857 return -ENOBUFS; 11858 } 11859 11860 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 11861 if (!freqs) 11862 return -ENOBUFS; 11863 11864 for (i = 0; i < req->n_channels; i++) { 11865 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 11866 return -ENOBUFS; 11867 } 11868 11869 nla_nest_end(msg, freqs); 11870 11871 if (req->n_match_sets) { 11872 matches = nla_nest_start_noflag(msg, 11873 NL80211_ATTR_SCHED_SCAN_MATCH); 11874 if (!matches) 11875 return -ENOBUFS; 11876 11877 for (i = 0; i < req->n_match_sets; i++) { 11878 match = nla_nest_start_noflag(msg, i); 11879 if (!match) 11880 return -ENOBUFS; 11881 11882 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 11883 req->match_sets[i].ssid.ssid_len, 11884 req->match_sets[i].ssid.ssid)) 11885 return -ENOBUFS; 11886 nla_nest_end(msg, match); 11887 } 11888 nla_nest_end(msg, matches); 11889 } 11890 11891 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 11892 if (!scan_plans) 11893 return -ENOBUFS; 11894 11895 for (i = 0; i < req->n_scan_plans; i++) { 11896 scan_plan = nla_nest_start_noflag(msg, i + 1); 11897 if (!scan_plan) 11898 return -ENOBUFS; 11899 11900 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 11901 req->scan_plans[i].interval) || 11902 (req->scan_plans[i].iterations && 11903 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 11904 req->scan_plans[i].iterations))) 11905 return -ENOBUFS; 11906 nla_nest_end(msg, scan_plan); 11907 } 11908 nla_nest_end(msg, scan_plans); 11909 11910 nla_nest_end(msg, nd); 11911 11912 return 0; 11913 } 11914 11915 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 11916 { 11917 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11918 struct sk_buff *msg; 11919 void *hdr; 11920 u32 size = NLMSG_DEFAULT_SIZE; 11921 11922 if (!rdev->wiphy.wowlan) 11923 return -EOPNOTSUPP; 11924 11925 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 11926 /* adjust size to have room for all the data */ 11927 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 11928 rdev->wiphy.wowlan_config->tcp->payload_len + 11929 rdev->wiphy.wowlan_config->tcp->wake_len + 11930 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 11931 } 11932 11933 msg = nlmsg_new(size, GFP_KERNEL); 11934 if (!msg) 11935 return -ENOMEM; 11936 11937 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11938 NL80211_CMD_GET_WOWLAN); 11939 if (!hdr) 11940 goto nla_put_failure; 11941 11942 if (rdev->wiphy.wowlan_config) { 11943 struct nlattr *nl_wowlan; 11944 11945 nl_wowlan = nla_nest_start_noflag(msg, 11946 NL80211_ATTR_WOWLAN_TRIGGERS); 11947 if (!nl_wowlan) 11948 goto nla_put_failure; 11949 11950 if ((rdev->wiphy.wowlan_config->any && 11951 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 11952 (rdev->wiphy.wowlan_config->disconnect && 11953 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 11954 (rdev->wiphy.wowlan_config->magic_pkt && 11955 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 11956 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 11957 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 11958 (rdev->wiphy.wowlan_config->eap_identity_req && 11959 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 11960 (rdev->wiphy.wowlan_config->four_way_handshake && 11961 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 11962 (rdev->wiphy.wowlan_config->rfkill_release && 11963 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 11964 goto nla_put_failure; 11965 11966 if (nl80211_send_wowlan_patterns(msg, rdev)) 11967 goto nla_put_failure; 11968 11969 if (nl80211_send_wowlan_tcp(msg, 11970 rdev->wiphy.wowlan_config->tcp)) 11971 goto nla_put_failure; 11972 11973 if (nl80211_send_wowlan_nd( 11974 msg, 11975 rdev->wiphy.wowlan_config->nd_config)) 11976 goto nla_put_failure; 11977 11978 nla_nest_end(msg, nl_wowlan); 11979 } 11980 11981 genlmsg_end(msg, hdr); 11982 return genlmsg_reply(msg, info); 11983 11984 nla_put_failure: 11985 nlmsg_free(msg); 11986 return -ENOBUFS; 11987 } 11988 11989 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 11990 struct nlattr *attr, 11991 struct cfg80211_wowlan *trig) 11992 { 11993 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 11994 struct cfg80211_wowlan_tcp *cfg; 11995 struct nl80211_wowlan_tcp_data_token *tok = NULL; 11996 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 11997 u32 size; 11998 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 11999 int err, port; 12000 12001 if (!rdev->wiphy.wowlan->tcp) 12002 return -EINVAL; 12003 12004 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 12005 nl80211_wowlan_tcp_policy, NULL); 12006 if (err) 12007 return err; 12008 12009 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 12010 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 12011 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 12012 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 12013 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 12014 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 12015 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 12016 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 12017 return -EINVAL; 12018 12019 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 12020 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 12021 return -EINVAL; 12022 12023 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 12024 rdev->wiphy.wowlan->tcp->data_interval_max || 12025 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 12026 return -EINVAL; 12027 12028 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 12029 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 12030 return -EINVAL; 12031 12032 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 12033 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 12034 return -EINVAL; 12035 12036 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 12037 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12038 12039 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12040 tokens_size = tokln - sizeof(*tok); 12041 12042 if (!tok->len || tokens_size % tok->len) 12043 return -EINVAL; 12044 if (!rdev->wiphy.wowlan->tcp->tok) 12045 return -EINVAL; 12046 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 12047 return -EINVAL; 12048 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 12049 return -EINVAL; 12050 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 12051 return -EINVAL; 12052 if (tok->offset + tok->len > data_size) 12053 return -EINVAL; 12054 } 12055 12056 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 12057 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 12058 if (!rdev->wiphy.wowlan->tcp->seq) 12059 return -EINVAL; 12060 if (seq->len == 0 || seq->len > 4) 12061 return -EINVAL; 12062 if (seq->len + seq->offset > data_size) 12063 return -EINVAL; 12064 } 12065 12066 size = sizeof(*cfg); 12067 size += data_size; 12068 size += wake_size + wake_mask_size; 12069 size += tokens_size; 12070 12071 cfg = kzalloc(size, GFP_KERNEL); 12072 if (!cfg) 12073 return -ENOMEM; 12074 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 12075 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 12076 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 12077 ETH_ALEN); 12078 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 12079 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 12080 else 12081 port = 0; 12082 #ifdef CONFIG_INET 12083 /* allocate a socket and port for it and use it */ 12084 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 12085 IPPROTO_TCP, &cfg->sock, 1); 12086 if (err) { 12087 kfree(cfg); 12088 return err; 12089 } 12090 if (inet_csk_get_port(cfg->sock->sk, port)) { 12091 sock_release(cfg->sock); 12092 kfree(cfg); 12093 return -EADDRINUSE; 12094 } 12095 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 12096 #else 12097 if (!port) { 12098 kfree(cfg); 12099 return -EINVAL; 12100 } 12101 cfg->src_port = port; 12102 #endif 12103 12104 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 12105 cfg->payload_len = data_size; 12106 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 12107 memcpy((void *)cfg->payload, 12108 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 12109 data_size); 12110 if (seq) 12111 cfg->payload_seq = *seq; 12112 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 12113 cfg->wake_len = wake_size; 12114 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 12115 memcpy((void *)cfg->wake_data, 12116 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 12117 wake_size); 12118 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 12119 data_size + wake_size; 12120 memcpy((void *)cfg->wake_mask, 12121 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 12122 wake_mask_size); 12123 if (tok) { 12124 cfg->tokens_size = tokens_size; 12125 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 12126 } 12127 12128 trig->tcp = cfg; 12129 12130 return 0; 12131 } 12132 12133 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 12134 const struct wiphy_wowlan_support *wowlan, 12135 struct nlattr *attr, 12136 struct cfg80211_wowlan *trig) 12137 { 12138 struct nlattr **tb; 12139 int err; 12140 12141 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 12142 if (!tb) 12143 return -ENOMEM; 12144 12145 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 12146 err = -EOPNOTSUPP; 12147 goto out; 12148 } 12149 12150 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 12151 nl80211_policy, NULL); 12152 if (err) 12153 goto out; 12154 12155 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 12156 wowlan->max_nd_match_sets); 12157 err = PTR_ERR_OR_ZERO(trig->nd_config); 12158 if (err) 12159 trig->nd_config = NULL; 12160 12161 out: 12162 kfree(tb); 12163 return err; 12164 } 12165 12166 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 12167 { 12168 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12169 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 12170 struct cfg80211_wowlan new_triggers = {}; 12171 struct cfg80211_wowlan *ntrig; 12172 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 12173 int err, i; 12174 bool prev_enabled = rdev->wiphy.wowlan_config; 12175 bool regular = false; 12176 12177 if (!wowlan) 12178 return -EOPNOTSUPP; 12179 12180 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 12181 cfg80211_rdev_free_wowlan(rdev); 12182 rdev->wiphy.wowlan_config = NULL; 12183 goto set_wakeup; 12184 } 12185 12186 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 12187 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 12188 nl80211_wowlan_policy, info->extack); 12189 if (err) 12190 return err; 12191 12192 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 12193 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 12194 return -EINVAL; 12195 new_triggers.any = true; 12196 } 12197 12198 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 12199 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 12200 return -EINVAL; 12201 new_triggers.disconnect = true; 12202 regular = true; 12203 } 12204 12205 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 12206 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 12207 return -EINVAL; 12208 new_triggers.magic_pkt = true; 12209 regular = true; 12210 } 12211 12212 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 12213 return -EINVAL; 12214 12215 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 12216 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 12217 return -EINVAL; 12218 new_triggers.gtk_rekey_failure = true; 12219 regular = true; 12220 } 12221 12222 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 12223 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 12224 return -EINVAL; 12225 new_triggers.eap_identity_req = true; 12226 regular = true; 12227 } 12228 12229 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 12230 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 12231 return -EINVAL; 12232 new_triggers.four_way_handshake = true; 12233 regular = true; 12234 } 12235 12236 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 12237 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 12238 return -EINVAL; 12239 new_triggers.rfkill_release = true; 12240 regular = true; 12241 } 12242 12243 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 12244 struct nlattr *pat; 12245 int n_patterns = 0; 12246 int rem, pat_len, mask_len, pkt_offset; 12247 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12248 12249 regular = true; 12250 12251 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12252 rem) 12253 n_patterns++; 12254 if (n_patterns > wowlan->n_patterns) 12255 return -EINVAL; 12256 12257 new_triggers.patterns = kcalloc(n_patterns, 12258 sizeof(new_triggers.patterns[0]), 12259 GFP_KERNEL); 12260 if (!new_triggers.patterns) 12261 return -ENOMEM; 12262 12263 new_triggers.n_patterns = n_patterns; 12264 i = 0; 12265 12266 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12267 rem) { 12268 u8 *mask_pat; 12269 12270 err = nla_parse_nested_deprecated(pat_tb, 12271 MAX_NL80211_PKTPAT, 12272 pat, 12273 nl80211_packet_pattern_policy, 12274 info->extack); 12275 if (err) 12276 goto error; 12277 12278 err = -EINVAL; 12279 if (!pat_tb[NL80211_PKTPAT_MASK] || 12280 !pat_tb[NL80211_PKTPAT_PATTERN]) 12281 goto error; 12282 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12283 mask_len = DIV_ROUND_UP(pat_len, 8); 12284 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12285 goto error; 12286 if (pat_len > wowlan->pattern_max_len || 12287 pat_len < wowlan->pattern_min_len) 12288 goto error; 12289 12290 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12291 pkt_offset = 0; 12292 else 12293 pkt_offset = nla_get_u32( 12294 pat_tb[NL80211_PKTPAT_OFFSET]); 12295 if (pkt_offset > wowlan->max_pkt_offset) 12296 goto error; 12297 new_triggers.patterns[i].pkt_offset = pkt_offset; 12298 12299 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12300 if (!mask_pat) { 12301 err = -ENOMEM; 12302 goto error; 12303 } 12304 new_triggers.patterns[i].mask = mask_pat; 12305 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12306 mask_len); 12307 mask_pat += mask_len; 12308 new_triggers.patterns[i].pattern = mask_pat; 12309 new_triggers.patterns[i].pattern_len = pat_len; 12310 memcpy(mask_pat, 12311 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12312 pat_len); 12313 i++; 12314 } 12315 } 12316 12317 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 12318 regular = true; 12319 err = nl80211_parse_wowlan_tcp( 12320 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 12321 &new_triggers); 12322 if (err) 12323 goto error; 12324 } 12325 12326 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 12327 regular = true; 12328 err = nl80211_parse_wowlan_nd( 12329 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 12330 &new_triggers); 12331 if (err) 12332 goto error; 12333 } 12334 12335 /* The 'any' trigger means the device continues operating more or less 12336 * as in its normal operation mode and wakes up the host on most of the 12337 * normal interrupts (like packet RX, ...) 12338 * It therefore makes little sense to combine with the more constrained 12339 * wakeup trigger modes. 12340 */ 12341 if (new_triggers.any && regular) { 12342 err = -EINVAL; 12343 goto error; 12344 } 12345 12346 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 12347 if (!ntrig) { 12348 err = -ENOMEM; 12349 goto error; 12350 } 12351 cfg80211_rdev_free_wowlan(rdev); 12352 rdev->wiphy.wowlan_config = ntrig; 12353 12354 set_wakeup: 12355 if (rdev->ops->set_wakeup && 12356 prev_enabled != !!rdev->wiphy.wowlan_config) 12357 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 12358 12359 return 0; 12360 error: 12361 for (i = 0; i < new_triggers.n_patterns; i++) 12362 kfree(new_triggers.patterns[i].mask); 12363 kfree(new_triggers.patterns); 12364 if (new_triggers.tcp && new_triggers.tcp->sock) 12365 sock_release(new_triggers.tcp->sock); 12366 kfree(new_triggers.tcp); 12367 kfree(new_triggers.nd_config); 12368 return err; 12369 } 12370 #endif 12371 12372 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 12373 struct cfg80211_registered_device *rdev) 12374 { 12375 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 12376 int i, j, pat_len; 12377 struct cfg80211_coalesce_rules *rule; 12378 12379 if (!rdev->coalesce->n_rules) 12380 return 0; 12381 12382 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 12383 if (!nl_rules) 12384 return -ENOBUFS; 12385 12386 for (i = 0; i < rdev->coalesce->n_rules; i++) { 12387 nl_rule = nla_nest_start_noflag(msg, i + 1); 12388 if (!nl_rule) 12389 return -ENOBUFS; 12390 12391 rule = &rdev->coalesce->rules[i]; 12392 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 12393 rule->delay)) 12394 return -ENOBUFS; 12395 12396 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 12397 rule->condition)) 12398 return -ENOBUFS; 12399 12400 nl_pats = nla_nest_start_noflag(msg, 12401 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 12402 if (!nl_pats) 12403 return -ENOBUFS; 12404 12405 for (j = 0; j < rule->n_patterns; j++) { 12406 nl_pat = nla_nest_start_noflag(msg, j + 1); 12407 if (!nl_pat) 12408 return -ENOBUFS; 12409 pat_len = rule->patterns[j].pattern_len; 12410 if (nla_put(msg, NL80211_PKTPAT_MASK, 12411 DIV_ROUND_UP(pat_len, 8), 12412 rule->patterns[j].mask) || 12413 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 12414 rule->patterns[j].pattern) || 12415 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 12416 rule->patterns[j].pkt_offset)) 12417 return -ENOBUFS; 12418 nla_nest_end(msg, nl_pat); 12419 } 12420 nla_nest_end(msg, nl_pats); 12421 nla_nest_end(msg, nl_rule); 12422 } 12423 nla_nest_end(msg, nl_rules); 12424 12425 return 0; 12426 } 12427 12428 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 12429 { 12430 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12431 struct sk_buff *msg; 12432 void *hdr; 12433 12434 if (!rdev->wiphy.coalesce) 12435 return -EOPNOTSUPP; 12436 12437 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12438 if (!msg) 12439 return -ENOMEM; 12440 12441 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12442 NL80211_CMD_GET_COALESCE); 12443 if (!hdr) 12444 goto nla_put_failure; 12445 12446 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 12447 goto nla_put_failure; 12448 12449 genlmsg_end(msg, hdr); 12450 return genlmsg_reply(msg, info); 12451 12452 nla_put_failure: 12453 nlmsg_free(msg); 12454 return -ENOBUFS; 12455 } 12456 12457 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 12458 { 12459 struct cfg80211_coalesce *coalesce = rdev->coalesce; 12460 int i, j; 12461 struct cfg80211_coalesce_rules *rule; 12462 12463 if (!coalesce) 12464 return; 12465 12466 for (i = 0; i < coalesce->n_rules; i++) { 12467 rule = &coalesce->rules[i]; 12468 for (j = 0; j < rule->n_patterns; j++) 12469 kfree(rule->patterns[j].mask); 12470 kfree(rule->patterns); 12471 } 12472 kfree(coalesce->rules); 12473 kfree(coalesce); 12474 rdev->coalesce = NULL; 12475 } 12476 12477 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 12478 struct nlattr *rule, 12479 struct cfg80211_coalesce_rules *new_rule) 12480 { 12481 int err, i; 12482 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12483 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 12484 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 12485 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12486 12487 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 12488 rule, nl80211_coalesce_policy, NULL); 12489 if (err) 12490 return err; 12491 12492 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 12493 new_rule->delay = 12494 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 12495 if (new_rule->delay > coalesce->max_delay) 12496 return -EINVAL; 12497 12498 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 12499 new_rule->condition = 12500 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 12501 12502 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 12503 return -EINVAL; 12504 12505 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12506 rem) 12507 n_patterns++; 12508 if (n_patterns > coalesce->n_patterns) 12509 return -EINVAL; 12510 12511 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 12512 GFP_KERNEL); 12513 if (!new_rule->patterns) 12514 return -ENOMEM; 12515 12516 new_rule->n_patterns = n_patterns; 12517 i = 0; 12518 12519 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12520 rem) { 12521 u8 *mask_pat; 12522 12523 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 12524 pat, 12525 nl80211_packet_pattern_policy, 12526 NULL); 12527 if (err) 12528 return err; 12529 12530 if (!pat_tb[NL80211_PKTPAT_MASK] || 12531 !pat_tb[NL80211_PKTPAT_PATTERN]) 12532 return -EINVAL; 12533 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12534 mask_len = DIV_ROUND_UP(pat_len, 8); 12535 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12536 return -EINVAL; 12537 if (pat_len > coalesce->pattern_max_len || 12538 pat_len < coalesce->pattern_min_len) 12539 return -EINVAL; 12540 12541 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12542 pkt_offset = 0; 12543 else 12544 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 12545 if (pkt_offset > coalesce->max_pkt_offset) 12546 return -EINVAL; 12547 new_rule->patterns[i].pkt_offset = pkt_offset; 12548 12549 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12550 if (!mask_pat) 12551 return -ENOMEM; 12552 12553 new_rule->patterns[i].mask = mask_pat; 12554 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12555 mask_len); 12556 12557 mask_pat += mask_len; 12558 new_rule->patterns[i].pattern = mask_pat; 12559 new_rule->patterns[i].pattern_len = pat_len; 12560 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12561 pat_len); 12562 i++; 12563 } 12564 12565 return 0; 12566 } 12567 12568 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 12569 { 12570 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12571 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12572 struct cfg80211_coalesce new_coalesce = {}; 12573 struct cfg80211_coalesce *n_coalesce; 12574 int err, rem_rule, n_rules = 0, i, j; 12575 struct nlattr *rule; 12576 struct cfg80211_coalesce_rules *tmp_rule; 12577 12578 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 12579 return -EOPNOTSUPP; 12580 12581 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 12582 cfg80211_rdev_free_coalesce(rdev); 12583 rdev_set_coalesce(rdev, NULL); 12584 return 0; 12585 } 12586 12587 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12588 rem_rule) 12589 n_rules++; 12590 if (n_rules > coalesce->n_rules) 12591 return -EINVAL; 12592 12593 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 12594 GFP_KERNEL); 12595 if (!new_coalesce.rules) 12596 return -ENOMEM; 12597 12598 new_coalesce.n_rules = n_rules; 12599 i = 0; 12600 12601 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12602 rem_rule) { 12603 err = nl80211_parse_coalesce_rule(rdev, rule, 12604 &new_coalesce.rules[i]); 12605 if (err) 12606 goto error; 12607 12608 i++; 12609 } 12610 12611 err = rdev_set_coalesce(rdev, &new_coalesce); 12612 if (err) 12613 goto error; 12614 12615 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 12616 if (!n_coalesce) { 12617 err = -ENOMEM; 12618 goto error; 12619 } 12620 cfg80211_rdev_free_coalesce(rdev); 12621 rdev->coalesce = n_coalesce; 12622 12623 return 0; 12624 error: 12625 for (i = 0; i < new_coalesce.n_rules; i++) { 12626 tmp_rule = &new_coalesce.rules[i]; 12627 for (j = 0; j < tmp_rule->n_patterns; j++) 12628 kfree(tmp_rule->patterns[j].mask); 12629 kfree(tmp_rule->patterns); 12630 } 12631 kfree(new_coalesce.rules); 12632 12633 return err; 12634 } 12635 12636 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 12637 { 12638 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12639 struct net_device *dev = info->user_ptr[1]; 12640 struct wireless_dev *wdev = dev->ieee80211_ptr; 12641 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 12642 struct cfg80211_gtk_rekey_data rekey_data = {}; 12643 int err; 12644 12645 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 12646 return -EINVAL; 12647 12648 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 12649 info->attrs[NL80211_ATTR_REKEY_DATA], 12650 nl80211_rekey_policy, info->extack); 12651 if (err) 12652 return err; 12653 12654 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 12655 !tb[NL80211_REKEY_DATA_KCK]) 12656 return -EINVAL; 12657 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 12658 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12659 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 12660 return -ERANGE; 12661 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 12662 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12663 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) 12664 return -ERANGE; 12665 12666 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 12667 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 12668 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 12669 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 12670 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 12671 if (tb[NL80211_REKEY_DATA_AKM]) 12672 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 12673 12674 wdev_lock(wdev); 12675 if (!wdev->current_bss) { 12676 err = -ENOTCONN; 12677 goto out; 12678 } 12679 12680 if (!rdev->ops->set_rekey_data) { 12681 err = -EOPNOTSUPP; 12682 goto out; 12683 } 12684 12685 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 12686 out: 12687 wdev_unlock(wdev); 12688 return err; 12689 } 12690 12691 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 12692 struct genl_info *info) 12693 { 12694 struct net_device *dev = info->user_ptr[1]; 12695 struct wireless_dev *wdev = dev->ieee80211_ptr; 12696 12697 if (wdev->iftype != NL80211_IFTYPE_AP && 12698 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12699 return -EINVAL; 12700 12701 if (wdev->ap_unexpected_nlportid) 12702 return -EBUSY; 12703 12704 wdev->ap_unexpected_nlportid = info->snd_portid; 12705 return 0; 12706 } 12707 12708 static int nl80211_probe_client(struct sk_buff *skb, 12709 struct genl_info *info) 12710 { 12711 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12712 struct net_device *dev = info->user_ptr[1]; 12713 struct wireless_dev *wdev = dev->ieee80211_ptr; 12714 struct sk_buff *msg; 12715 void *hdr; 12716 const u8 *addr; 12717 u64 cookie; 12718 int err; 12719 12720 if (wdev->iftype != NL80211_IFTYPE_AP && 12721 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12722 return -EOPNOTSUPP; 12723 12724 if (!info->attrs[NL80211_ATTR_MAC]) 12725 return -EINVAL; 12726 12727 if (!rdev->ops->probe_client) 12728 return -EOPNOTSUPP; 12729 12730 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12731 if (!msg) 12732 return -ENOMEM; 12733 12734 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12735 NL80211_CMD_PROBE_CLIENT); 12736 if (!hdr) { 12737 err = -ENOBUFS; 12738 goto free_msg; 12739 } 12740 12741 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12742 12743 err = rdev_probe_client(rdev, dev, addr, &cookie); 12744 if (err) 12745 goto free_msg; 12746 12747 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12748 NL80211_ATTR_PAD)) 12749 goto nla_put_failure; 12750 12751 genlmsg_end(msg, hdr); 12752 12753 return genlmsg_reply(msg, info); 12754 12755 nla_put_failure: 12756 err = -ENOBUFS; 12757 free_msg: 12758 nlmsg_free(msg); 12759 return err; 12760 } 12761 12762 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 12763 { 12764 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12765 struct cfg80211_beacon_registration *reg, *nreg; 12766 int rv; 12767 12768 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 12769 return -EOPNOTSUPP; 12770 12771 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 12772 if (!nreg) 12773 return -ENOMEM; 12774 12775 /* First, check if already registered. */ 12776 spin_lock_bh(&rdev->beacon_registrations_lock); 12777 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 12778 if (reg->nlportid == info->snd_portid) { 12779 rv = -EALREADY; 12780 goto out_err; 12781 } 12782 } 12783 /* Add it to the list */ 12784 nreg->nlportid = info->snd_portid; 12785 list_add(&nreg->list, &rdev->beacon_registrations); 12786 12787 spin_unlock_bh(&rdev->beacon_registrations_lock); 12788 12789 return 0; 12790 out_err: 12791 spin_unlock_bh(&rdev->beacon_registrations_lock); 12792 kfree(nreg); 12793 return rv; 12794 } 12795 12796 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 12797 { 12798 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12799 struct wireless_dev *wdev = info->user_ptr[1]; 12800 int err; 12801 12802 if (!rdev->ops->start_p2p_device) 12803 return -EOPNOTSUPP; 12804 12805 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12806 return -EOPNOTSUPP; 12807 12808 if (wdev_running(wdev)) 12809 return 0; 12810 12811 if (rfkill_blocked(rdev->rfkill)) 12812 return -ERFKILL; 12813 12814 err = rdev_start_p2p_device(rdev, wdev); 12815 if (err) 12816 return err; 12817 12818 wdev->is_running = true; 12819 rdev->opencount++; 12820 12821 return 0; 12822 } 12823 12824 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 12825 { 12826 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12827 struct wireless_dev *wdev = info->user_ptr[1]; 12828 12829 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12830 return -EOPNOTSUPP; 12831 12832 if (!rdev->ops->stop_p2p_device) 12833 return -EOPNOTSUPP; 12834 12835 cfg80211_stop_p2p_device(rdev, wdev); 12836 12837 return 0; 12838 } 12839 12840 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 12841 { 12842 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12843 struct wireless_dev *wdev = info->user_ptr[1]; 12844 struct cfg80211_nan_conf conf = {}; 12845 int err; 12846 12847 if (wdev->iftype != NL80211_IFTYPE_NAN) 12848 return -EOPNOTSUPP; 12849 12850 if (wdev_running(wdev)) 12851 return -EEXIST; 12852 12853 if (rfkill_blocked(rdev->rfkill)) 12854 return -ERFKILL; 12855 12856 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 12857 return -EINVAL; 12858 12859 conf.master_pref = 12860 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 12861 12862 if (info->attrs[NL80211_ATTR_BANDS]) { 12863 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 12864 12865 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 12866 return -EOPNOTSUPP; 12867 12868 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 12869 return -EINVAL; 12870 12871 conf.bands = bands; 12872 } 12873 12874 err = rdev_start_nan(rdev, wdev, &conf); 12875 if (err) 12876 return err; 12877 12878 wdev->is_running = true; 12879 rdev->opencount++; 12880 12881 return 0; 12882 } 12883 12884 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 12885 { 12886 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12887 struct wireless_dev *wdev = info->user_ptr[1]; 12888 12889 if (wdev->iftype != NL80211_IFTYPE_NAN) 12890 return -EOPNOTSUPP; 12891 12892 cfg80211_stop_nan(rdev, wdev); 12893 12894 return 0; 12895 } 12896 12897 static int validate_nan_filter(struct nlattr *filter_attr) 12898 { 12899 struct nlattr *attr; 12900 int len = 0, n_entries = 0, rem; 12901 12902 nla_for_each_nested(attr, filter_attr, rem) { 12903 len += nla_len(attr); 12904 n_entries++; 12905 } 12906 12907 if (len >= U8_MAX) 12908 return -EINVAL; 12909 12910 return n_entries; 12911 } 12912 12913 static int handle_nan_filter(struct nlattr *attr_filter, 12914 struct cfg80211_nan_func *func, 12915 bool tx) 12916 { 12917 struct nlattr *attr; 12918 int n_entries, rem, i; 12919 struct cfg80211_nan_func_filter *filter; 12920 12921 n_entries = validate_nan_filter(attr_filter); 12922 if (n_entries < 0) 12923 return n_entries; 12924 12925 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 12926 12927 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 12928 if (!filter) 12929 return -ENOMEM; 12930 12931 i = 0; 12932 nla_for_each_nested(attr, attr_filter, rem) { 12933 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 12934 filter[i].len = nla_len(attr); 12935 i++; 12936 } 12937 if (tx) { 12938 func->num_tx_filters = n_entries; 12939 func->tx_filters = filter; 12940 } else { 12941 func->num_rx_filters = n_entries; 12942 func->rx_filters = filter; 12943 } 12944 12945 return 0; 12946 } 12947 12948 static int nl80211_nan_add_func(struct sk_buff *skb, 12949 struct genl_info *info) 12950 { 12951 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12952 struct wireless_dev *wdev = info->user_ptr[1]; 12953 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 12954 struct cfg80211_nan_func *func; 12955 struct sk_buff *msg = NULL; 12956 void *hdr = NULL; 12957 int err = 0; 12958 12959 if (wdev->iftype != NL80211_IFTYPE_NAN) 12960 return -EOPNOTSUPP; 12961 12962 if (!wdev_running(wdev)) 12963 return -ENOTCONN; 12964 12965 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 12966 return -EINVAL; 12967 12968 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 12969 info->attrs[NL80211_ATTR_NAN_FUNC], 12970 nl80211_nan_func_policy, 12971 info->extack); 12972 if (err) 12973 return err; 12974 12975 func = kzalloc(sizeof(*func), GFP_KERNEL); 12976 if (!func) 12977 return -ENOMEM; 12978 12979 func->cookie = cfg80211_assign_cookie(rdev); 12980 12981 if (!tb[NL80211_NAN_FUNC_TYPE]) { 12982 err = -EINVAL; 12983 goto out; 12984 } 12985 12986 12987 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 12988 12989 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 12990 err = -EINVAL; 12991 goto out; 12992 } 12993 12994 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 12995 sizeof(func->service_id)); 12996 12997 func->close_range = 12998 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 12999 13000 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 13001 func->serv_spec_info_len = 13002 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 13003 func->serv_spec_info = 13004 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 13005 func->serv_spec_info_len, 13006 GFP_KERNEL); 13007 if (!func->serv_spec_info) { 13008 err = -ENOMEM; 13009 goto out; 13010 } 13011 } 13012 13013 if (tb[NL80211_NAN_FUNC_TTL]) 13014 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 13015 13016 switch (func->type) { 13017 case NL80211_NAN_FUNC_PUBLISH: 13018 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 13019 err = -EINVAL; 13020 goto out; 13021 } 13022 13023 func->publish_type = 13024 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 13025 func->publish_bcast = 13026 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 13027 13028 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 13029 func->publish_bcast) { 13030 err = -EINVAL; 13031 goto out; 13032 } 13033 break; 13034 case NL80211_NAN_FUNC_SUBSCRIBE: 13035 func->subscribe_active = 13036 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 13037 break; 13038 case NL80211_NAN_FUNC_FOLLOW_UP: 13039 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 13040 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 13041 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 13042 err = -EINVAL; 13043 goto out; 13044 } 13045 13046 func->followup_id = 13047 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 13048 func->followup_reqid = 13049 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 13050 memcpy(func->followup_dest.addr, 13051 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 13052 sizeof(func->followup_dest.addr)); 13053 if (func->ttl) { 13054 err = -EINVAL; 13055 goto out; 13056 } 13057 break; 13058 default: 13059 err = -EINVAL; 13060 goto out; 13061 } 13062 13063 if (tb[NL80211_NAN_FUNC_SRF]) { 13064 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 13065 13066 err = nla_parse_nested_deprecated(srf_tb, 13067 NL80211_NAN_SRF_ATTR_MAX, 13068 tb[NL80211_NAN_FUNC_SRF], 13069 nl80211_nan_srf_policy, 13070 info->extack); 13071 if (err) 13072 goto out; 13073 13074 func->srf_include = 13075 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 13076 13077 if (srf_tb[NL80211_NAN_SRF_BF]) { 13078 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 13079 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 13080 err = -EINVAL; 13081 goto out; 13082 } 13083 13084 func->srf_bf_len = 13085 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 13086 func->srf_bf = 13087 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 13088 func->srf_bf_len, GFP_KERNEL); 13089 if (!func->srf_bf) { 13090 err = -ENOMEM; 13091 goto out; 13092 } 13093 13094 func->srf_bf_idx = 13095 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 13096 } else { 13097 struct nlattr *attr, *mac_attr = 13098 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 13099 int n_entries, rem, i = 0; 13100 13101 if (!mac_attr) { 13102 err = -EINVAL; 13103 goto out; 13104 } 13105 13106 n_entries = validate_acl_mac_addrs(mac_attr); 13107 if (n_entries <= 0) { 13108 err = -EINVAL; 13109 goto out; 13110 } 13111 13112 func->srf_num_macs = n_entries; 13113 func->srf_macs = 13114 kcalloc(n_entries, sizeof(*func->srf_macs), 13115 GFP_KERNEL); 13116 if (!func->srf_macs) { 13117 err = -ENOMEM; 13118 goto out; 13119 } 13120 13121 nla_for_each_nested(attr, mac_attr, rem) 13122 memcpy(func->srf_macs[i++].addr, nla_data(attr), 13123 sizeof(*func->srf_macs)); 13124 } 13125 } 13126 13127 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 13128 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 13129 func, true); 13130 if (err) 13131 goto out; 13132 } 13133 13134 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 13135 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 13136 func, false); 13137 if (err) 13138 goto out; 13139 } 13140 13141 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13142 if (!msg) { 13143 err = -ENOMEM; 13144 goto out; 13145 } 13146 13147 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13148 NL80211_CMD_ADD_NAN_FUNCTION); 13149 /* This can't really happen - we just allocated 4KB */ 13150 if (WARN_ON(!hdr)) { 13151 err = -ENOMEM; 13152 goto out; 13153 } 13154 13155 err = rdev_add_nan_func(rdev, wdev, func); 13156 out: 13157 if (err < 0) { 13158 cfg80211_free_nan_func(func); 13159 nlmsg_free(msg); 13160 return err; 13161 } 13162 13163 /* propagate the instance id and cookie to userspace */ 13164 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 13165 NL80211_ATTR_PAD)) 13166 goto nla_put_failure; 13167 13168 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13169 if (!func_attr) 13170 goto nla_put_failure; 13171 13172 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 13173 func->instance_id)) 13174 goto nla_put_failure; 13175 13176 nla_nest_end(msg, func_attr); 13177 13178 genlmsg_end(msg, hdr); 13179 return genlmsg_reply(msg, info); 13180 13181 nla_put_failure: 13182 nlmsg_free(msg); 13183 return -ENOBUFS; 13184 } 13185 13186 static int nl80211_nan_del_func(struct sk_buff *skb, 13187 struct genl_info *info) 13188 { 13189 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13190 struct wireless_dev *wdev = info->user_ptr[1]; 13191 u64 cookie; 13192 13193 if (wdev->iftype != NL80211_IFTYPE_NAN) 13194 return -EOPNOTSUPP; 13195 13196 if (!wdev_running(wdev)) 13197 return -ENOTCONN; 13198 13199 if (!info->attrs[NL80211_ATTR_COOKIE]) 13200 return -EINVAL; 13201 13202 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 13203 13204 rdev_del_nan_func(rdev, wdev, cookie); 13205 13206 return 0; 13207 } 13208 13209 static int nl80211_nan_change_config(struct sk_buff *skb, 13210 struct genl_info *info) 13211 { 13212 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13213 struct wireless_dev *wdev = info->user_ptr[1]; 13214 struct cfg80211_nan_conf conf = {}; 13215 u32 changed = 0; 13216 13217 if (wdev->iftype != NL80211_IFTYPE_NAN) 13218 return -EOPNOTSUPP; 13219 13220 if (!wdev_running(wdev)) 13221 return -ENOTCONN; 13222 13223 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 13224 conf.master_pref = 13225 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 13226 if (conf.master_pref <= 1 || conf.master_pref == 255) 13227 return -EINVAL; 13228 13229 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 13230 } 13231 13232 if (info->attrs[NL80211_ATTR_BANDS]) { 13233 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 13234 13235 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 13236 return -EOPNOTSUPP; 13237 13238 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 13239 return -EINVAL; 13240 13241 conf.bands = bands; 13242 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 13243 } 13244 13245 if (!changed) 13246 return -EINVAL; 13247 13248 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 13249 } 13250 13251 void cfg80211_nan_match(struct wireless_dev *wdev, 13252 struct cfg80211_nan_match_params *match, gfp_t gfp) 13253 { 13254 struct wiphy *wiphy = wdev->wiphy; 13255 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13256 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 13257 struct sk_buff *msg; 13258 void *hdr; 13259 13260 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 13261 return; 13262 13263 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13264 if (!msg) 13265 return; 13266 13267 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 13268 if (!hdr) { 13269 nlmsg_free(msg); 13270 return; 13271 } 13272 13273 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13274 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13275 wdev->netdev->ifindex)) || 13276 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13277 NL80211_ATTR_PAD)) 13278 goto nla_put_failure; 13279 13280 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 13281 NL80211_ATTR_PAD) || 13282 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 13283 goto nla_put_failure; 13284 13285 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 13286 if (!match_attr) 13287 goto nla_put_failure; 13288 13289 local_func_attr = nla_nest_start_noflag(msg, 13290 NL80211_NAN_MATCH_FUNC_LOCAL); 13291 if (!local_func_attr) 13292 goto nla_put_failure; 13293 13294 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 13295 goto nla_put_failure; 13296 13297 nla_nest_end(msg, local_func_attr); 13298 13299 peer_func_attr = nla_nest_start_noflag(msg, 13300 NL80211_NAN_MATCH_FUNC_PEER); 13301 if (!peer_func_attr) 13302 goto nla_put_failure; 13303 13304 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 13305 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 13306 goto nla_put_failure; 13307 13308 if (match->info && match->info_len && 13309 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 13310 match->info)) 13311 goto nla_put_failure; 13312 13313 nla_nest_end(msg, peer_func_attr); 13314 nla_nest_end(msg, match_attr); 13315 genlmsg_end(msg, hdr); 13316 13317 if (!wdev->owner_nlportid) 13318 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13319 msg, 0, NL80211_MCGRP_NAN, gfp); 13320 else 13321 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13322 wdev->owner_nlportid); 13323 13324 return; 13325 13326 nla_put_failure: 13327 nlmsg_free(msg); 13328 } 13329 EXPORT_SYMBOL(cfg80211_nan_match); 13330 13331 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 13332 u8 inst_id, 13333 enum nl80211_nan_func_term_reason reason, 13334 u64 cookie, gfp_t gfp) 13335 { 13336 struct wiphy *wiphy = wdev->wiphy; 13337 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13338 struct sk_buff *msg; 13339 struct nlattr *func_attr; 13340 void *hdr; 13341 13342 if (WARN_ON(!inst_id)) 13343 return; 13344 13345 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13346 if (!msg) 13347 return; 13348 13349 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 13350 if (!hdr) { 13351 nlmsg_free(msg); 13352 return; 13353 } 13354 13355 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13356 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13357 wdev->netdev->ifindex)) || 13358 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13359 NL80211_ATTR_PAD)) 13360 goto nla_put_failure; 13361 13362 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 13363 NL80211_ATTR_PAD)) 13364 goto nla_put_failure; 13365 13366 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13367 if (!func_attr) 13368 goto nla_put_failure; 13369 13370 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 13371 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 13372 goto nla_put_failure; 13373 13374 nla_nest_end(msg, func_attr); 13375 genlmsg_end(msg, hdr); 13376 13377 if (!wdev->owner_nlportid) 13378 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13379 msg, 0, NL80211_MCGRP_NAN, gfp); 13380 else 13381 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13382 wdev->owner_nlportid); 13383 13384 return; 13385 13386 nla_put_failure: 13387 nlmsg_free(msg); 13388 } 13389 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 13390 13391 static int nl80211_get_protocol_features(struct sk_buff *skb, 13392 struct genl_info *info) 13393 { 13394 void *hdr; 13395 struct sk_buff *msg; 13396 13397 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13398 if (!msg) 13399 return -ENOMEM; 13400 13401 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13402 NL80211_CMD_GET_PROTOCOL_FEATURES); 13403 if (!hdr) 13404 goto nla_put_failure; 13405 13406 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 13407 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 13408 goto nla_put_failure; 13409 13410 genlmsg_end(msg, hdr); 13411 return genlmsg_reply(msg, info); 13412 13413 nla_put_failure: 13414 kfree_skb(msg); 13415 return -ENOBUFS; 13416 } 13417 13418 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 13419 { 13420 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13421 struct cfg80211_update_ft_ies_params ft_params; 13422 struct net_device *dev = info->user_ptr[1]; 13423 13424 if (!rdev->ops->update_ft_ies) 13425 return -EOPNOTSUPP; 13426 13427 if (!info->attrs[NL80211_ATTR_MDID] || 13428 !info->attrs[NL80211_ATTR_IE]) 13429 return -EINVAL; 13430 13431 memset(&ft_params, 0, sizeof(ft_params)); 13432 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 13433 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 13434 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 13435 13436 return rdev_update_ft_ies(rdev, dev, &ft_params); 13437 } 13438 13439 static int nl80211_crit_protocol_start(struct sk_buff *skb, 13440 struct genl_info *info) 13441 { 13442 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13443 struct wireless_dev *wdev = info->user_ptr[1]; 13444 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 13445 u16 duration; 13446 int ret; 13447 13448 if (!rdev->ops->crit_proto_start) 13449 return -EOPNOTSUPP; 13450 13451 if (WARN_ON(!rdev->ops->crit_proto_stop)) 13452 return -EINVAL; 13453 13454 if (rdev->crit_proto_nlportid) 13455 return -EBUSY; 13456 13457 /* determine protocol if provided */ 13458 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 13459 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 13460 13461 if (proto >= NUM_NL80211_CRIT_PROTO) 13462 return -EINVAL; 13463 13464 /* timeout must be provided */ 13465 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 13466 return -EINVAL; 13467 13468 duration = 13469 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 13470 13471 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 13472 if (!ret) 13473 rdev->crit_proto_nlportid = info->snd_portid; 13474 13475 return ret; 13476 } 13477 13478 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 13479 struct genl_info *info) 13480 { 13481 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13482 struct wireless_dev *wdev = info->user_ptr[1]; 13483 13484 if (!rdev->ops->crit_proto_stop) 13485 return -EOPNOTSUPP; 13486 13487 if (rdev->crit_proto_nlportid) { 13488 rdev->crit_proto_nlportid = 0; 13489 rdev_crit_proto_stop(rdev, wdev); 13490 } 13491 return 0; 13492 } 13493 13494 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 13495 struct nlattr *attr, 13496 struct netlink_ext_ack *extack) 13497 { 13498 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 13499 if (attr->nla_type & NLA_F_NESTED) { 13500 NL_SET_ERR_MSG_ATTR(extack, attr, 13501 "unexpected nested data"); 13502 return -EINVAL; 13503 } 13504 13505 return 0; 13506 } 13507 13508 if (!(attr->nla_type & NLA_F_NESTED)) { 13509 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 13510 return -EINVAL; 13511 } 13512 13513 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 13514 } 13515 13516 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 13517 { 13518 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13519 struct wireless_dev *wdev = 13520 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 13521 int i, err; 13522 u32 vid, subcmd; 13523 13524 if (!rdev->wiphy.vendor_commands) 13525 return -EOPNOTSUPP; 13526 13527 if (IS_ERR(wdev)) { 13528 err = PTR_ERR(wdev); 13529 if (err != -EINVAL) 13530 return err; 13531 wdev = NULL; 13532 } else if (wdev->wiphy != &rdev->wiphy) { 13533 return -EINVAL; 13534 } 13535 13536 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 13537 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 13538 return -EINVAL; 13539 13540 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 13541 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 13542 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 13543 const struct wiphy_vendor_command *vcmd; 13544 void *data = NULL; 13545 int len = 0; 13546 13547 vcmd = &rdev->wiphy.vendor_commands[i]; 13548 13549 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13550 continue; 13551 13552 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13553 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13554 if (!wdev) 13555 return -EINVAL; 13556 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13557 !wdev->netdev) 13558 return -EINVAL; 13559 13560 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13561 if (!wdev_running(wdev)) 13562 return -ENETDOWN; 13563 } 13564 } else { 13565 wdev = NULL; 13566 } 13567 13568 if (!vcmd->doit) 13569 return -EOPNOTSUPP; 13570 13571 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 13572 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13573 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13574 13575 err = nl80211_vendor_check_policy(vcmd, 13576 info->attrs[NL80211_ATTR_VENDOR_DATA], 13577 info->extack); 13578 if (err) 13579 return err; 13580 } 13581 13582 rdev->cur_cmd_info = info; 13583 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 13584 rdev->cur_cmd_info = NULL; 13585 return err; 13586 } 13587 13588 return -EOPNOTSUPP; 13589 } 13590 13591 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 13592 struct netlink_callback *cb, 13593 struct cfg80211_registered_device **rdev, 13594 struct wireless_dev **wdev) 13595 { 13596 struct nlattr **attrbuf; 13597 u32 vid, subcmd; 13598 unsigned int i; 13599 int vcmd_idx = -1; 13600 int err; 13601 void *data = NULL; 13602 unsigned int data_len = 0; 13603 13604 if (cb->args[0]) { 13605 /* subtract the 1 again here */ 13606 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 13607 struct wireless_dev *tmp; 13608 13609 if (!wiphy) 13610 return -ENODEV; 13611 *rdev = wiphy_to_rdev(wiphy); 13612 *wdev = NULL; 13613 13614 if (cb->args[1]) { 13615 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 13616 if (tmp->identifier == cb->args[1] - 1) { 13617 *wdev = tmp; 13618 break; 13619 } 13620 } 13621 } 13622 13623 /* keep rtnl locked in successful case */ 13624 return 0; 13625 } 13626 13627 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 13628 if (!attrbuf) 13629 return -ENOMEM; 13630 13631 err = nlmsg_parse_deprecated(cb->nlh, 13632 GENL_HDRLEN + nl80211_fam.hdrsize, 13633 attrbuf, nl80211_fam.maxattr, 13634 nl80211_policy, NULL); 13635 if (err) 13636 goto out; 13637 13638 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 13639 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 13640 err = -EINVAL; 13641 goto out; 13642 } 13643 13644 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 13645 if (IS_ERR(*wdev)) 13646 *wdev = NULL; 13647 13648 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 13649 if (IS_ERR(*rdev)) { 13650 err = PTR_ERR(*rdev); 13651 goto out; 13652 } 13653 13654 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 13655 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 13656 13657 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 13658 const struct wiphy_vendor_command *vcmd; 13659 13660 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 13661 13662 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13663 continue; 13664 13665 if (!vcmd->dumpit) { 13666 err = -EOPNOTSUPP; 13667 goto out; 13668 } 13669 13670 vcmd_idx = i; 13671 break; 13672 } 13673 13674 if (vcmd_idx < 0) { 13675 err = -EOPNOTSUPP; 13676 goto out; 13677 } 13678 13679 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 13680 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13681 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13682 13683 err = nl80211_vendor_check_policy( 13684 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 13685 attrbuf[NL80211_ATTR_VENDOR_DATA], 13686 cb->extack); 13687 if (err) 13688 goto out; 13689 } 13690 13691 /* 0 is the first index - add 1 to parse only once */ 13692 cb->args[0] = (*rdev)->wiphy_idx + 1; 13693 /* add 1 to know if it was NULL */ 13694 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 13695 cb->args[2] = vcmd_idx; 13696 cb->args[3] = (unsigned long)data; 13697 cb->args[4] = data_len; 13698 13699 /* keep rtnl locked in successful case */ 13700 err = 0; 13701 out: 13702 kfree(attrbuf); 13703 return err; 13704 } 13705 13706 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 13707 struct netlink_callback *cb) 13708 { 13709 struct cfg80211_registered_device *rdev; 13710 struct wireless_dev *wdev; 13711 unsigned int vcmd_idx; 13712 const struct wiphy_vendor_command *vcmd; 13713 void *data; 13714 int data_len; 13715 int err; 13716 struct nlattr *vendor_data; 13717 13718 rtnl_lock(); 13719 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 13720 if (err) 13721 goto out; 13722 13723 vcmd_idx = cb->args[2]; 13724 data = (void *)cb->args[3]; 13725 data_len = cb->args[4]; 13726 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 13727 13728 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13729 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13730 if (!wdev) { 13731 err = -EINVAL; 13732 goto out; 13733 } 13734 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13735 !wdev->netdev) { 13736 err = -EINVAL; 13737 goto out; 13738 } 13739 13740 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13741 if (!wdev_running(wdev)) { 13742 err = -ENETDOWN; 13743 goto out; 13744 } 13745 } 13746 } 13747 13748 while (1) { 13749 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 13750 cb->nlh->nlmsg_seq, NLM_F_MULTI, 13751 NL80211_CMD_VENDOR); 13752 if (!hdr) 13753 break; 13754 13755 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13756 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 13757 wdev_id(wdev), 13758 NL80211_ATTR_PAD))) { 13759 genlmsg_cancel(skb, hdr); 13760 break; 13761 } 13762 13763 vendor_data = nla_nest_start_noflag(skb, 13764 NL80211_ATTR_VENDOR_DATA); 13765 if (!vendor_data) { 13766 genlmsg_cancel(skb, hdr); 13767 break; 13768 } 13769 13770 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 13771 (unsigned long *)&cb->args[5]); 13772 nla_nest_end(skb, vendor_data); 13773 13774 if (err == -ENOBUFS || err == -ENOENT) { 13775 genlmsg_cancel(skb, hdr); 13776 break; 13777 } else if (err <= 0) { 13778 genlmsg_cancel(skb, hdr); 13779 goto out; 13780 } 13781 13782 genlmsg_end(skb, hdr); 13783 } 13784 13785 err = skb->len; 13786 out: 13787 rtnl_unlock(); 13788 return err; 13789 } 13790 13791 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 13792 enum nl80211_commands cmd, 13793 enum nl80211_attrs attr, 13794 int approxlen) 13795 { 13796 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13797 13798 if (WARN_ON(!rdev->cur_cmd_info)) 13799 return NULL; 13800 13801 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 13802 rdev->cur_cmd_info->snd_portid, 13803 rdev->cur_cmd_info->snd_seq, 13804 cmd, attr, NULL, GFP_KERNEL); 13805 } 13806 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 13807 13808 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 13809 { 13810 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 13811 void *hdr = ((void **)skb->cb)[1]; 13812 struct nlattr *data = ((void **)skb->cb)[2]; 13813 13814 /* clear CB data for netlink core to own from now on */ 13815 memset(skb->cb, 0, sizeof(skb->cb)); 13816 13817 if (WARN_ON(!rdev->cur_cmd_info)) { 13818 kfree_skb(skb); 13819 return -EINVAL; 13820 } 13821 13822 nla_nest_end(skb, data); 13823 genlmsg_end(skb, hdr); 13824 return genlmsg_reply(skb, rdev->cur_cmd_info); 13825 } 13826 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 13827 13828 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 13829 { 13830 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13831 13832 if (WARN_ON(!rdev->cur_cmd_info)) 13833 return 0; 13834 13835 return rdev->cur_cmd_info->snd_portid; 13836 } 13837 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 13838 13839 static int nl80211_set_qos_map(struct sk_buff *skb, 13840 struct genl_info *info) 13841 { 13842 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13843 struct cfg80211_qos_map *qos_map = NULL; 13844 struct net_device *dev = info->user_ptr[1]; 13845 u8 *pos, len, num_des, des_len, des; 13846 int ret; 13847 13848 if (!rdev->ops->set_qos_map) 13849 return -EOPNOTSUPP; 13850 13851 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 13852 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 13853 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 13854 13855 if (len % 2) 13856 return -EINVAL; 13857 13858 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 13859 if (!qos_map) 13860 return -ENOMEM; 13861 13862 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 13863 if (num_des) { 13864 des_len = num_des * 13865 sizeof(struct cfg80211_dscp_exception); 13866 memcpy(qos_map->dscp_exception, pos, des_len); 13867 qos_map->num_des = num_des; 13868 for (des = 0; des < num_des; des++) { 13869 if (qos_map->dscp_exception[des].up > 7) { 13870 kfree(qos_map); 13871 return -EINVAL; 13872 } 13873 } 13874 pos += des_len; 13875 } 13876 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 13877 } 13878 13879 wdev_lock(dev->ieee80211_ptr); 13880 ret = nl80211_key_allowed(dev->ieee80211_ptr); 13881 if (!ret) 13882 ret = rdev_set_qos_map(rdev, dev, qos_map); 13883 wdev_unlock(dev->ieee80211_ptr); 13884 13885 kfree(qos_map); 13886 return ret; 13887 } 13888 13889 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 13890 { 13891 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13892 struct net_device *dev = info->user_ptr[1]; 13893 struct wireless_dev *wdev = dev->ieee80211_ptr; 13894 const u8 *peer; 13895 u8 tsid, up; 13896 u16 admitted_time = 0; 13897 int err; 13898 13899 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 13900 return -EOPNOTSUPP; 13901 13902 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 13903 !info->attrs[NL80211_ATTR_USER_PRIO]) 13904 return -EINVAL; 13905 13906 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13907 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 13908 13909 /* WMM uses TIDs 0-7 even for TSPEC */ 13910 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 13911 /* TODO: handle 802.11 TSPEC/admission control 13912 * need more attributes for that (e.g. BA session requirement); 13913 * change the WMM adminssion test above to allow both then 13914 */ 13915 return -EINVAL; 13916 } 13917 13918 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13919 13920 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 13921 admitted_time = 13922 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 13923 if (!admitted_time) 13924 return -EINVAL; 13925 } 13926 13927 wdev_lock(wdev); 13928 switch (wdev->iftype) { 13929 case NL80211_IFTYPE_STATION: 13930 case NL80211_IFTYPE_P2P_CLIENT: 13931 if (wdev->current_bss) 13932 break; 13933 err = -ENOTCONN; 13934 goto out; 13935 default: 13936 err = -EOPNOTSUPP; 13937 goto out; 13938 } 13939 13940 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 13941 13942 out: 13943 wdev_unlock(wdev); 13944 return err; 13945 } 13946 13947 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 13948 { 13949 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13950 struct net_device *dev = info->user_ptr[1]; 13951 struct wireless_dev *wdev = dev->ieee80211_ptr; 13952 const u8 *peer; 13953 u8 tsid; 13954 int err; 13955 13956 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 13957 return -EINVAL; 13958 13959 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13960 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13961 13962 wdev_lock(wdev); 13963 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 13964 wdev_unlock(wdev); 13965 13966 return err; 13967 } 13968 13969 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 13970 struct genl_info *info) 13971 { 13972 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13973 struct net_device *dev = info->user_ptr[1]; 13974 struct wireless_dev *wdev = dev->ieee80211_ptr; 13975 struct cfg80211_chan_def chandef = {}; 13976 const u8 *addr; 13977 u8 oper_class; 13978 int err; 13979 13980 if (!rdev->ops->tdls_channel_switch || 13981 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 13982 return -EOPNOTSUPP; 13983 13984 switch (dev->ieee80211_ptr->iftype) { 13985 case NL80211_IFTYPE_STATION: 13986 case NL80211_IFTYPE_P2P_CLIENT: 13987 break; 13988 default: 13989 return -EOPNOTSUPP; 13990 } 13991 13992 if (!info->attrs[NL80211_ATTR_MAC] || 13993 !info->attrs[NL80211_ATTR_OPER_CLASS]) 13994 return -EINVAL; 13995 13996 err = nl80211_parse_chandef(rdev, info, &chandef); 13997 if (err) 13998 return err; 13999 14000 /* 14001 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 14002 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 14003 * specification is not defined for them. 14004 */ 14005 if (chandef.chan->band == NL80211_BAND_2GHZ && 14006 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 14007 chandef.width != NL80211_CHAN_WIDTH_20) 14008 return -EINVAL; 14009 14010 /* we will be active on the TDLS link */ 14011 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 14012 wdev->iftype)) 14013 return -EINVAL; 14014 14015 /* don't allow switching to DFS channels */ 14016 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 14017 return -EINVAL; 14018 14019 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14020 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 14021 14022 wdev_lock(wdev); 14023 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 14024 wdev_unlock(wdev); 14025 14026 return err; 14027 } 14028 14029 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 14030 struct genl_info *info) 14031 { 14032 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14033 struct net_device *dev = info->user_ptr[1]; 14034 struct wireless_dev *wdev = dev->ieee80211_ptr; 14035 const u8 *addr; 14036 14037 if (!rdev->ops->tdls_channel_switch || 14038 !rdev->ops->tdls_cancel_channel_switch || 14039 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 14040 return -EOPNOTSUPP; 14041 14042 switch (dev->ieee80211_ptr->iftype) { 14043 case NL80211_IFTYPE_STATION: 14044 case NL80211_IFTYPE_P2P_CLIENT: 14045 break; 14046 default: 14047 return -EOPNOTSUPP; 14048 } 14049 14050 if (!info->attrs[NL80211_ATTR_MAC]) 14051 return -EINVAL; 14052 14053 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14054 14055 wdev_lock(wdev); 14056 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 14057 wdev_unlock(wdev); 14058 14059 return 0; 14060 } 14061 14062 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 14063 struct genl_info *info) 14064 { 14065 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14066 struct net_device *dev = info->user_ptr[1]; 14067 struct wireless_dev *wdev = dev->ieee80211_ptr; 14068 const struct nlattr *nla; 14069 bool enabled; 14070 14071 if (!rdev->ops->set_multicast_to_unicast) 14072 return -EOPNOTSUPP; 14073 14074 if (wdev->iftype != NL80211_IFTYPE_AP && 14075 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14076 return -EOPNOTSUPP; 14077 14078 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 14079 enabled = nla_get_flag(nla); 14080 14081 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 14082 } 14083 14084 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 14085 { 14086 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14087 struct net_device *dev = info->user_ptr[1]; 14088 struct wireless_dev *wdev = dev->ieee80211_ptr; 14089 struct cfg80211_pmk_conf pmk_conf = {}; 14090 int ret; 14091 14092 if (wdev->iftype != NL80211_IFTYPE_STATION && 14093 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14094 return -EOPNOTSUPP; 14095 14096 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14097 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14098 return -EOPNOTSUPP; 14099 14100 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 14101 return -EINVAL; 14102 14103 wdev_lock(wdev); 14104 if (!wdev->current_bss) { 14105 ret = -ENOTCONN; 14106 goto out; 14107 } 14108 14109 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14110 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 14111 ret = -EINVAL; 14112 goto out; 14113 } 14114 14115 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 14116 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 14117 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 14118 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 14119 ret = -EINVAL; 14120 goto out; 14121 } 14122 14123 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 14124 pmk_conf.pmk_r0_name = 14125 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 14126 14127 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 14128 out: 14129 wdev_unlock(wdev); 14130 return ret; 14131 } 14132 14133 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 14134 { 14135 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14136 struct net_device *dev = info->user_ptr[1]; 14137 struct wireless_dev *wdev = dev->ieee80211_ptr; 14138 const u8 *aa; 14139 int ret; 14140 14141 if (wdev->iftype != NL80211_IFTYPE_STATION && 14142 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14143 return -EOPNOTSUPP; 14144 14145 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14146 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14147 return -EOPNOTSUPP; 14148 14149 if (!info->attrs[NL80211_ATTR_MAC]) 14150 return -EINVAL; 14151 14152 wdev_lock(wdev); 14153 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14154 ret = rdev_del_pmk(rdev, dev, aa); 14155 wdev_unlock(wdev); 14156 14157 return ret; 14158 } 14159 14160 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 14161 { 14162 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14163 struct net_device *dev = info->user_ptr[1]; 14164 struct cfg80211_external_auth_params params; 14165 14166 if (!rdev->ops->external_auth) 14167 return -EOPNOTSUPP; 14168 14169 if (!info->attrs[NL80211_ATTR_SSID] && 14170 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 14171 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 14172 return -EINVAL; 14173 14174 if (!info->attrs[NL80211_ATTR_BSSID]) 14175 return -EINVAL; 14176 14177 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 14178 return -EINVAL; 14179 14180 memset(¶ms, 0, sizeof(params)); 14181 14182 if (info->attrs[NL80211_ATTR_SSID]) { 14183 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 14184 if (params.ssid.ssid_len == 0) 14185 return -EINVAL; 14186 memcpy(params.ssid.ssid, 14187 nla_data(info->attrs[NL80211_ATTR_SSID]), 14188 params.ssid.ssid_len); 14189 } 14190 14191 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 14192 ETH_ALEN); 14193 14194 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14195 14196 if (info->attrs[NL80211_ATTR_PMKID]) 14197 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 14198 14199 return rdev_external_auth(rdev, dev, ¶ms); 14200 } 14201 14202 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 14203 { 14204 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 14205 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14206 struct net_device *dev = info->user_ptr[1]; 14207 struct wireless_dev *wdev = dev->ieee80211_ptr; 14208 const u8 *buf; 14209 size_t len; 14210 u8 *dest; 14211 u16 proto; 14212 bool noencrypt; 14213 u64 cookie = 0; 14214 int err; 14215 14216 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14217 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 14218 return -EOPNOTSUPP; 14219 14220 if (!rdev->ops->tx_control_port) 14221 return -EOPNOTSUPP; 14222 14223 if (!info->attrs[NL80211_ATTR_FRAME] || 14224 !info->attrs[NL80211_ATTR_MAC] || 14225 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 14226 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 14227 return -EINVAL; 14228 } 14229 14230 wdev_lock(wdev); 14231 14232 switch (wdev->iftype) { 14233 case NL80211_IFTYPE_AP: 14234 case NL80211_IFTYPE_P2P_GO: 14235 case NL80211_IFTYPE_MESH_POINT: 14236 break; 14237 case NL80211_IFTYPE_ADHOC: 14238 case NL80211_IFTYPE_STATION: 14239 case NL80211_IFTYPE_P2P_CLIENT: 14240 if (wdev->current_bss) 14241 break; 14242 err = -ENOTCONN; 14243 goto out; 14244 default: 14245 err = -EOPNOTSUPP; 14246 goto out; 14247 } 14248 14249 wdev_unlock(wdev); 14250 14251 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14252 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14253 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14254 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 14255 noencrypt = 14256 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 14257 14258 err = rdev_tx_control_port(rdev, dev, buf, len, 14259 dest, cpu_to_be16(proto), noencrypt, 14260 dont_wait_for_ack ? NULL : &cookie); 14261 if (!err && !dont_wait_for_ack) 14262 nl_set_extack_cookie_u64(info->extack, cookie); 14263 return err; 14264 out: 14265 wdev_unlock(wdev); 14266 return err; 14267 } 14268 14269 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 14270 struct genl_info *info) 14271 { 14272 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14273 struct net_device *dev = info->user_ptr[1]; 14274 struct wireless_dev *wdev = dev->ieee80211_ptr; 14275 struct cfg80211_ftm_responder_stats ftm_stats = {}; 14276 struct sk_buff *msg; 14277 void *hdr; 14278 struct nlattr *ftm_stats_attr; 14279 int err; 14280 14281 if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval) 14282 return -EOPNOTSUPP; 14283 14284 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 14285 if (err) 14286 return err; 14287 14288 if (!ftm_stats.filled) 14289 return -ENODATA; 14290 14291 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14292 if (!msg) 14293 return -ENOMEM; 14294 14295 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14296 NL80211_CMD_GET_FTM_RESPONDER_STATS); 14297 if (!hdr) 14298 goto nla_put_failure; 14299 14300 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14301 goto nla_put_failure; 14302 14303 ftm_stats_attr = nla_nest_start_noflag(msg, 14304 NL80211_ATTR_FTM_RESPONDER_STATS); 14305 if (!ftm_stats_attr) 14306 goto nla_put_failure; 14307 14308 #define SET_FTM(field, name, type) \ 14309 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14310 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 14311 ftm_stats.field)) \ 14312 goto nla_put_failure; } while (0) 14313 #define SET_FTM_U64(field, name) \ 14314 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14315 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 14316 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 14317 goto nla_put_failure; } while (0) 14318 14319 SET_FTM(success_num, SUCCESS_NUM, u32); 14320 SET_FTM(partial_num, PARTIAL_NUM, u32); 14321 SET_FTM(failed_num, FAILED_NUM, u32); 14322 SET_FTM(asap_num, ASAP_NUM, u32); 14323 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 14324 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 14325 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 14326 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 14327 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 14328 #undef SET_FTM 14329 14330 nla_nest_end(msg, ftm_stats_attr); 14331 14332 genlmsg_end(msg, hdr); 14333 return genlmsg_reply(msg, info); 14334 14335 nla_put_failure: 14336 nlmsg_free(msg); 14337 return -ENOBUFS; 14338 } 14339 14340 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 14341 { 14342 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14343 struct cfg80211_update_owe_info owe_info; 14344 struct net_device *dev = info->user_ptr[1]; 14345 14346 if (!rdev->ops->update_owe_info) 14347 return -EOPNOTSUPP; 14348 14349 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 14350 !info->attrs[NL80211_ATTR_MAC]) 14351 return -EINVAL; 14352 14353 memset(&owe_info, 0, sizeof(owe_info)); 14354 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14355 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 14356 14357 if (info->attrs[NL80211_ATTR_IE]) { 14358 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14359 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14360 } 14361 14362 return rdev_update_owe_info(rdev, dev, &owe_info); 14363 } 14364 14365 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 14366 { 14367 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14368 struct net_device *dev = info->user_ptr[1]; 14369 struct wireless_dev *wdev = dev->ieee80211_ptr; 14370 struct station_info sinfo = {}; 14371 const u8 *buf; 14372 size_t len; 14373 u8 *dest; 14374 int err; 14375 14376 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 14377 return -EOPNOTSUPP; 14378 14379 if (!info->attrs[NL80211_ATTR_MAC] || 14380 !info->attrs[NL80211_ATTR_FRAME]) { 14381 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 14382 return -EINVAL; 14383 } 14384 14385 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 14386 return -EOPNOTSUPP; 14387 14388 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14389 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14390 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14391 14392 if (len < sizeof(struct ethhdr)) 14393 return -EINVAL; 14394 14395 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 14396 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 14397 return -EINVAL; 14398 14399 err = rdev_get_station(rdev, dev, dest, &sinfo); 14400 if (err) 14401 return err; 14402 14403 cfg80211_sinfo_release_content(&sinfo); 14404 14405 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 14406 } 14407 14408 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 14409 struct nlattr *attrs[], struct net_device *dev, 14410 struct cfg80211_tid_cfg *tid_conf, 14411 struct genl_info *info, const u8 *peer) 14412 { 14413 struct netlink_ext_ack *extack = info->extack; 14414 u64 mask; 14415 int err; 14416 14417 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 14418 return -EINVAL; 14419 14420 tid_conf->config_override = 14421 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 14422 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 14423 14424 if (tid_conf->config_override) { 14425 if (rdev->ops->reset_tid_config) { 14426 err = rdev_reset_tid_config(rdev, dev, peer, 14427 tid_conf->tids); 14428 if (err) 14429 return err; 14430 } else { 14431 return -EINVAL; 14432 } 14433 } 14434 14435 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 14436 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 14437 tid_conf->noack = 14438 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 14439 } 14440 14441 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 14442 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 14443 tid_conf->retry_short = 14444 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 14445 14446 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 14447 return -EINVAL; 14448 } 14449 14450 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 14451 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 14452 tid_conf->retry_long = 14453 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 14454 14455 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 14456 return -EINVAL; 14457 } 14458 14459 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 14460 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 14461 tid_conf->ampdu = 14462 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 14463 } 14464 14465 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 14466 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 14467 tid_conf->rtscts = 14468 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 14469 } 14470 14471 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 14472 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 14473 tid_conf->amsdu = 14474 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 14475 } 14476 14477 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 14478 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 14479 14480 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 14481 14482 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 14483 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 14484 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 14485 &tid_conf->txrate_mask, dev); 14486 if (err) 14487 return err; 14488 14489 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 14490 } 14491 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 14492 } 14493 14494 if (peer) 14495 mask = rdev->wiphy.tid_config_support.peer; 14496 else 14497 mask = rdev->wiphy.tid_config_support.vif; 14498 14499 if (tid_conf->mask & ~mask) { 14500 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 14501 return -ENOTSUPP; 14502 } 14503 14504 return 0; 14505 } 14506 14507 static int nl80211_set_tid_config(struct sk_buff *skb, 14508 struct genl_info *info) 14509 { 14510 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14511 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 14512 struct net_device *dev = info->user_ptr[1]; 14513 struct cfg80211_tid_config *tid_config; 14514 struct nlattr *tid; 14515 int conf_idx = 0, rem_conf; 14516 int ret = -EINVAL; 14517 u32 num_conf = 0; 14518 14519 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 14520 return -EINVAL; 14521 14522 if (!rdev->ops->set_tid_config) 14523 return -EOPNOTSUPP; 14524 14525 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14526 rem_conf) 14527 num_conf++; 14528 14529 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 14530 GFP_KERNEL); 14531 if (!tid_config) 14532 return -ENOMEM; 14533 14534 tid_config->n_tid_conf = num_conf; 14535 14536 if (info->attrs[NL80211_ATTR_MAC]) 14537 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 14538 14539 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14540 rem_conf) { 14541 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 14542 tid, NULL, NULL); 14543 14544 if (ret) 14545 goto bad_tid_conf; 14546 14547 ret = parse_tid_conf(rdev, attrs, dev, 14548 &tid_config->tid_conf[conf_idx], 14549 info, tid_config->peer); 14550 if (ret) 14551 goto bad_tid_conf; 14552 14553 conf_idx++; 14554 } 14555 14556 ret = rdev_set_tid_config(rdev, dev, tid_config); 14557 14558 bad_tid_conf: 14559 kfree(tid_config); 14560 return ret; 14561 } 14562 14563 #define NL80211_FLAG_NEED_WIPHY 0x01 14564 #define NL80211_FLAG_NEED_NETDEV 0x02 14565 #define NL80211_FLAG_NEED_RTNL 0x04 14566 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 14567 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 14568 NL80211_FLAG_CHECK_NETDEV_UP) 14569 #define NL80211_FLAG_NEED_WDEV 0x10 14570 /* If a netdev is associated, it must be UP, P2P must be started */ 14571 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 14572 NL80211_FLAG_CHECK_NETDEV_UP) 14573 #define NL80211_FLAG_CLEAR_SKB 0x20 14574 14575 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 14576 struct genl_info *info) 14577 { 14578 struct cfg80211_registered_device *rdev; 14579 struct wireless_dev *wdev; 14580 struct net_device *dev; 14581 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 14582 14583 if (rtnl) 14584 rtnl_lock(); 14585 14586 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 14587 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 14588 if (IS_ERR(rdev)) { 14589 if (rtnl) 14590 rtnl_unlock(); 14591 return PTR_ERR(rdev); 14592 } 14593 info->user_ptr[0] = rdev; 14594 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 14595 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14596 ASSERT_RTNL(); 14597 14598 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 14599 info->attrs); 14600 if (IS_ERR(wdev)) { 14601 if (rtnl) 14602 rtnl_unlock(); 14603 return PTR_ERR(wdev); 14604 } 14605 14606 dev = wdev->netdev; 14607 rdev = wiphy_to_rdev(wdev->wiphy); 14608 14609 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 14610 if (!dev) { 14611 if (rtnl) 14612 rtnl_unlock(); 14613 return -EINVAL; 14614 } 14615 14616 info->user_ptr[1] = dev; 14617 } else { 14618 info->user_ptr[1] = wdev; 14619 } 14620 14621 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 14622 !wdev_running(wdev)) { 14623 if (rtnl) 14624 rtnl_unlock(); 14625 return -ENETDOWN; 14626 } 14627 14628 if (dev) 14629 dev_hold(dev); 14630 14631 info->user_ptr[0] = rdev; 14632 } 14633 14634 return 0; 14635 } 14636 14637 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 14638 struct genl_info *info) 14639 { 14640 if (info->user_ptr[1]) { 14641 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14642 struct wireless_dev *wdev = info->user_ptr[1]; 14643 14644 if (wdev->netdev) 14645 dev_put(wdev->netdev); 14646 } else { 14647 dev_put(info->user_ptr[1]); 14648 } 14649 } 14650 14651 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 14652 rtnl_unlock(); 14653 14654 /* If needed, clear the netlink message payload from the SKB 14655 * as it might contain key data that shouldn't stick around on 14656 * the heap after the SKB is freed. The netlink message header 14657 * is still needed for further processing, so leave it intact. 14658 */ 14659 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 14660 struct nlmsghdr *nlh = nlmsg_hdr(skb); 14661 14662 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 14663 } 14664 } 14665 14666 static const struct genl_ops nl80211_ops[] = { 14667 { 14668 .cmd = NL80211_CMD_GET_WIPHY, 14669 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14670 .doit = nl80211_get_wiphy, 14671 .dumpit = nl80211_dump_wiphy, 14672 .done = nl80211_dump_wiphy_done, 14673 /* can be retrieved by unprivileged users */ 14674 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14675 NL80211_FLAG_NEED_RTNL, 14676 }, 14677 }; 14678 14679 static const struct genl_small_ops nl80211_small_ops[] = { 14680 { 14681 .cmd = NL80211_CMD_SET_WIPHY, 14682 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14683 .doit = nl80211_set_wiphy, 14684 .flags = GENL_UNS_ADMIN_PERM, 14685 .internal_flags = NL80211_FLAG_NEED_RTNL, 14686 }, 14687 { 14688 .cmd = NL80211_CMD_GET_INTERFACE, 14689 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14690 .doit = nl80211_get_interface, 14691 .dumpit = nl80211_dump_interface, 14692 /* can be retrieved by unprivileged users */ 14693 .internal_flags = NL80211_FLAG_NEED_WDEV | 14694 NL80211_FLAG_NEED_RTNL, 14695 }, 14696 { 14697 .cmd = NL80211_CMD_SET_INTERFACE, 14698 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14699 .doit = nl80211_set_interface, 14700 .flags = GENL_UNS_ADMIN_PERM, 14701 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14702 NL80211_FLAG_NEED_RTNL, 14703 }, 14704 { 14705 .cmd = NL80211_CMD_NEW_INTERFACE, 14706 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14707 .doit = nl80211_new_interface, 14708 .flags = GENL_UNS_ADMIN_PERM, 14709 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14710 NL80211_FLAG_NEED_RTNL, 14711 }, 14712 { 14713 .cmd = NL80211_CMD_DEL_INTERFACE, 14714 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14715 .doit = nl80211_del_interface, 14716 .flags = GENL_UNS_ADMIN_PERM, 14717 .internal_flags = NL80211_FLAG_NEED_WDEV | 14718 NL80211_FLAG_NEED_RTNL, 14719 }, 14720 { 14721 .cmd = NL80211_CMD_GET_KEY, 14722 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14723 .doit = nl80211_get_key, 14724 .flags = GENL_UNS_ADMIN_PERM, 14725 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14726 NL80211_FLAG_NEED_RTNL, 14727 }, 14728 { 14729 .cmd = NL80211_CMD_SET_KEY, 14730 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14731 .doit = nl80211_set_key, 14732 .flags = GENL_UNS_ADMIN_PERM, 14733 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14734 NL80211_FLAG_NEED_RTNL | 14735 NL80211_FLAG_CLEAR_SKB, 14736 }, 14737 { 14738 .cmd = NL80211_CMD_NEW_KEY, 14739 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14740 .doit = nl80211_new_key, 14741 .flags = GENL_UNS_ADMIN_PERM, 14742 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14743 NL80211_FLAG_NEED_RTNL | 14744 NL80211_FLAG_CLEAR_SKB, 14745 }, 14746 { 14747 .cmd = NL80211_CMD_DEL_KEY, 14748 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14749 .doit = nl80211_del_key, 14750 .flags = GENL_UNS_ADMIN_PERM, 14751 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14752 NL80211_FLAG_NEED_RTNL, 14753 }, 14754 { 14755 .cmd = NL80211_CMD_SET_BEACON, 14756 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14757 .flags = GENL_UNS_ADMIN_PERM, 14758 .doit = nl80211_set_beacon, 14759 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14760 NL80211_FLAG_NEED_RTNL, 14761 }, 14762 { 14763 .cmd = NL80211_CMD_START_AP, 14764 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14765 .flags = GENL_UNS_ADMIN_PERM, 14766 .doit = nl80211_start_ap, 14767 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14768 NL80211_FLAG_NEED_RTNL, 14769 }, 14770 { 14771 .cmd = NL80211_CMD_STOP_AP, 14772 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14773 .flags = GENL_UNS_ADMIN_PERM, 14774 .doit = nl80211_stop_ap, 14775 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14776 NL80211_FLAG_NEED_RTNL, 14777 }, 14778 { 14779 .cmd = NL80211_CMD_GET_STATION, 14780 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14781 .doit = nl80211_get_station, 14782 .dumpit = nl80211_dump_station, 14783 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14784 NL80211_FLAG_NEED_RTNL, 14785 }, 14786 { 14787 .cmd = NL80211_CMD_SET_STATION, 14788 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14789 .doit = nl80211_set_station, 14790 .flags = GENL_UNS_ADMIN_PERM, 14791 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14792 NL80211_FLAG_NEED_RTNL, 14793 }, 14794 { 14795 .cmd = NL80211_CMD_NEW_STATION, 14796 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14797 .doit = nl80211_new_station, 14798 .flags = GENL_UNS_ADMIN_PERM, 14799 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14800 NL80211_FLAG_NEED_RTNL, 14801 }, 14802 { 14803 .cmd = NL80211_CMD_DEL_STATION, 14804 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14805 .doit = nl80211_del_station, 14806 .flags = GENL_UNS_ADMIN_PERM, 14807 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14808 NL80211_FLAG_NEED_RTNL, 14809 }, 14810 { 14811 .cmd = NL80211_CMD_GET_MPATH, 14812 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14813 .doit = nl80211_get_mpath, 14814 .dumpit = nl80211_dump_mpath, 14815 .flags = GENL_UNS_ADMIN_PERM, 14816 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14817 NL80211_FLAG_NEED_RTNL, 14818 }, 14819 { 14820 .cmd = NL80211_CMD_GET_MPP, 14821 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14822 .doit = nl80211_get_mpp, 14823 .dumpit = nl80211_dump_mpp, 14824 .flags = GENL_UNS_ADMIN_PERM, 14825 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14826 NL80211_FLAG_NEED_RTNL, 14827 }, 14828 { 14829 .cmd = NL80211_CMD_SET_MPATH, 14830 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14831 .doit = nl80211_set_mpath, 14832 .flags = GENL_UNS_ADMIN_PERM, 14833 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14834 NL80211_FLAG_NEED_RTNL, 14835 }, 14836 { 14837 .cmd = NL80211_CMD_NEW_MPATH, 14838 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14839 .doit = nl80211_new_mpath, 14840 .flags = GENL_UNS_ADMIN_PERM, 14841 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14842 NL80211_FLAG_NEED_RTNL, 14843 }, 14844 { 14845 .cmd = NL80211_CMD_DEL_MPATH, 14846 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14847 .doit = nl80211_del_mpath, 14848 .flags = GENL_UNS_ADMIN_PERM, 14849 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14850 NL80211_FLAG_NEED_RTNL, 14851 }, 14852 { 14853 .cmd = NL80211_CMD_SET_BSS, 14854 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14855 .doit = nl80211_set_bss, 14856 .flags = GENL_UNS_ADMIN_PERM, 14857 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14858 NL80211_FLAG_NEED_RTNL, 14859 }, 14860 { 14861 .cmd = NL80211_CMD_GET_REG, 14862 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14863 .doit = nl80211_get_reg_do, 14864 .dumpit = nl80211_get_reg_dump, 14865 .internal_flags = NL80211_FLAG_NEED_RTNL, 14866 /* can be retrieved by unprivileged users */ 14867 }, 14868 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 14869 { 14870 .cmd = NL80211_CMD_SET_REG, 14871 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14872 .doit = nl80211_set_reg, 14873 .flags = GENL_ADMIN_PERM, 14874 .internal_flags = NL80211_FLAG_NEED_RTNL, 14875 }, 14876 #endif 14877 { 14878 .cmd = NL80211_CMD_REQ_SET_REG, 14879 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14880 .doit = nl80211_req_set_reg, 14881 .flags = GENL_ADMIN_PERM, 14882 }, 14883 { 14884 .cmd = NL80211_CMD_RELOAD_REGDB, 14885 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14886 .doit = nl80211_reload_regdb, 14887 .flags = GENL_ADMIN_PERM, 14888 }, 14889 { 14890 .cmd = NL80211_CMD_GET_MESH_CONFIG, 14891 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14892 .doit = nl80211_get_mesh_config, 14893 /* can be retrieved by unprivileged users */ 14894 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14895 NL80211_FLAG_NEED_RTNL, 14896 }, 14897 { 14898 .cmd = NL80211_CMD_SET_MESH_CONFIG, 14899 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14900 .doit = nl80211_update_mesh_config, 14901 .flags = GENL_UNS_ADMIN_PERM, 14902 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14903 NL80211_FLAG_NEED_RTNL, 14904 }, 14905 { 14906 .cmd = NL80211_CMD_TRIGGER_SCAN, 14907 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14908 .doit = nl80211_trigger_scan, 14909 .flags = GENL_UNS_ADMIN_PERM, 14910 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14911 NL80211_FLAG_NEED_RTNL, 14912 }, 14913 { 14914 .cmd = NL80211_CMD_ABORT_SCAN, 14915 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14916 .doit = nl80211_abort_scan, 14917 .flags = GENL_UNS_ADMIN_PERM, 14918 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14919 NL80211_FLAG_NEED_RTNL, 14920 }, 14921 { 14922 .cmd = NL80211_CMD_GET_SCAN, 14923 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14924 .dumpit = nl80211_dump_scan, 14925 }, 14926 { 14927 .cmd = NL80211_CMD_START_SCHED_SCAN, 14928 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14929 .doit = nl80211_start_sched_scan, 14930 .flags = GENL_UNS_ADMIN_PERM, 14931 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14932 NL80211_FLAG_NEED_RTNL, 14933 }, 14934 { 14935 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 14936 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14937 .doit = nl80211_stop_sched_scan, 14938 .flags = GENL_UNS_ADMIN_PERM, 14939 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14940 NL80211_FLAG_NEED_RTNL, 14941 }, 14942 { 14943 .cmd = NL80211_CMD_AUTHENTICATE, 14944 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14945 .doit = nl80211_authenticate, 14946 .flags = GENL_UNS_ADMIN_PERM, 14947 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14948 NL80211_FLAG_NEED_RTNL | 14949 NL80211_FLAG_CLEAR_SKB, 14950 }, 14951 { 14952 .cmd = NL80211_CMD_ASSOCIATE, 14953 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14954 .doit = nl80211_associate, 14955 .flags = GENL_UNS_ADMIN_PERM, 14956 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14957 NL80211_FLAG_NEED_RTNL | 14958 NL80211_FLAG_CLEAR_SKB, 14959 }, 14960 { 14961 .cmd = NL80211_CMD_DEAUTHENTICATE, 14962 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14963 .doit = nl80211_deauthenticate, 14964 .flags = GENL_UNS_ADMIN_PERM, 14965 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14966 NL80211_FLAG_NEED_RTNL, 14967 }, 14968 { 14969 .cmd = NL80211_CMD_DISASSOCIATE, 14970 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14971 .doit = nl80211_disassociate, 14972 .flags = GENL_UNS_ADMIN_PERM, 14973 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14974 NL80211_FLAG_NEED_RTNL, 14975 }, 14976 { 14977 .cmd = NL80211_CMD_JOIN_IBSS, 14978 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14979 .doit = nl80211_join_ibss, 14980 .flags = GENL_UNS_ADMIN_PERM, 14981 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14982 NL80211_FLAG_NEED_RTNL, 14983 }, 14984 { 14985 .cmd = NL80211_CMD_LEAVE_IBSS, 14986 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14987 .doit = nl80211_leave_ibss, 14988 .flags = GENL_UNS_ADMIN_PERM, 14989 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14990 NL80211_FLAG_NEED_RTNL, 14991 }, 14992 #ifdef CONFIG_NL80211_TESTMODE 14993 { 14994 .cmd = NL80211_CMD_TESTMODE, 14995 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14996 .doit = nl80211_testmode_do, 14997 .dumpit = nl80211_testmode_dump, 14998 .flags = GENL_UNS_ADMIN_PERM, 14999 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15000 NL80211_FLAG_NEED_RTNL, 15001 }, 15002 #endif 15003 { 15004 .cmd = NL80211_CMD_CONNECT, 15005 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15006 .doit = nl80211_connect, 15007 .flags = GENL_UNS_ADMIN_PERM, 15008 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15009 NL80211_FLAG_NEED_RTNL | 15010 NL80211_FLAG_CLEAR_SKB, 15011 }, 15012 { 15013 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 15014 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15015 .doit = nl80211_update_connect_params, 15016 .flags = GENL_ADMIN_PERM, 15017 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15018 NL80211_FLAG_NEED_RTNL | 15019 NL80211_FLAG_CLEAR_SKB, 15020 }, 15021 { 15022 .cmd = NL80211_CMD_DISCONNECT, 15023 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15024 .doit = nl80211_disconnect, 15025 .flags = GENL_UNS_ADMIN_PERM, 15026 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15027 NL80211_FLAG_NEED_RTNL, 15028 }, 15029 { 15030 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 15031 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15032 .doit = nl80211_wiphy_netns, 15033 .flags = GENL_UNS_ADMIN_PERM, 15034 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15035 NL80211_FLAG_NEED_RTNL, 15036 }, 15037 { 15038 .cmd = NL80211_CMD_GET_SURVEY, 15039 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15040 .dumpit = nl80211_dump_survey, 15041 }, 15042 { 15043 .cmd = NL80211_CMD_SET_PMKSA, 15044 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15045 .doit = nl80211_setdel_pmksa, 15046 .flags = GENL_UNS_ADMIN_PERM, 15047 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15048 NL80211_FLAG_NEED_RTNL | 15049 NL80211_FLAG_CLEAR_SKB, 15050 }, 15051 { 15052 .cmd = NL80211_CMD_DEL_PMKSA, 15053 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15054 .doit = nl80211_setdel_pmksa, 15055 .flags = GENL_UNS_ADMIN_PERM, 15056 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15057 NL80211_FLAG_NEED_RTNL, 15058 }, 15059 { 15060 .cmd = NL80211_CMD_FLUSH_PMKSA, 15061 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15062 .doit = nl80211_flush_pmksa, 15063 .flags = GENL_UNS_ADMIN_PERM, 15064 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15065 NL80211_FLAG_NEED_RTNL, 15066 }, 15067 { 15068 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 15069 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15070 .doit = nl80211_remain_on_channel, 15071 .flags = GENL_UNS_ADMIN_PERM, 15072 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15073 NL80211_FLAG_NEED_RTNL, 15074 }, 15075 { 15076 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 15077 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15078 .doit = nl80211_cancel_remain_on_channel, 15079 .flags = GENL_UNS_ADMIN_PERM, 15080 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15081 NL80211_FLAG_NEED_RTNL, 15082 }, 15083 { 15084 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 15085 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15086 .doit = nl80211_set_tx_bitrate_mask, 15087 .flags = GENL_UNS_ADMIN_PERM, 15088 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15089 NL80211_FLAG_NEED_RTNL, 15090 }, 15091 { 15092 .cmd = NL80211_CMD_REGISTER_FRAME, 15093 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15094 .doit = nl80211_register_mgmt, 15095 .flags = GENL_UNS_ADMIN_PERM, 15096 .internal_flags = NL80211_FLAG_NEED_WDEV | 15097 NL80211_FLAG_NEED_RTNL, 15098 }, 15099 { 15100 .cmd = NL80211_CMD_FRAME, 15101 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15102 .doit = nl80211_tx_mgmt, 15103 .flags = GENL_UNS_ADMIN_PERM, 15104 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15105 NL80211_FLAG_NEED_RTNL, 15106 }, 15107 { 15108 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 15109 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15110 .doit = nl80211_tx_mgmt_cancel_wait, 15111 .flags = GENL_UNS_ADMIN_PERM, 15112 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15113 NL80211_FLAG_NEED_RTNL, 15114 }, 15115 { 15116 .cmd = NL80211_CMD_SET_POWER_SAVE, 15117 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15118 .doit = nl80211_set_power_save, 15119 .flags = GENL_UNS_ADMIN_PERM, 15120 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15121 NL80211_FLAG_NEED_RTNL, 15122 }, 15123 { 15124 .cmd = NL80211_CMD_GET_POWER_SAVE, 15125 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15126 .doit = nl80211_get_power_save, 15127 /* can be retrieved by unprivileged users */ 15128 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15129 NL80211_FLAG_NEED_RTNL, 15130 }, 15131 { 15132 .cmd = NL80211_CMD_SET_CQM, 15133 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15134 .doit = nl80211_set_cqm, 15135 .flags = GENL_UNS_ADMIN_PERM, 15136 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15137 NL80211_FLAG_NEED_RTNL, 15138 }, 15139 { 15140 .cmd = NL80211_CMD_SET_CHANNEL, 15141 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15142 .doit = nl80211_set_channel, 15143 .flags = GENL_UNS_ADMIN_PERM, 15144 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15145 NL80211_FLAG_NEED_RTNL, 15146 }, 15147 { 15148 .cmd = NL80211_CMD_SET_WDS_PEER, 15149 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15150 .doit = nl80211_set_wds_peer, 15151 .flags = GENL_UNS_ADMIN_PERM, 15152 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15153 NL80211_FLAG_NEED_RTNL, 15154 }, 15155 { 15156 .cmd = NL80211_CMD_JOIN_MESH, 15157 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15158 .doit = nl80211_join_mesh, 15159 .flags = GENL_UNS_ADMIN_PERM, 15160 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15161 NL80211_FLAG_NEED_RTNL, 15162 }, 15163 { 15164 .cmd = NL80211_CMD_LEAVE_MESH, 15165 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15166 .doit = nl80211_leave_mesh, 15167 .flags = GENL_UNS_ADMIN_PERM, 15168 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15169 NL80211_FLAG_NEED_RTNL, 15170 }, 15171 { 15172 .cmd = NL80211_CMD_JOIN_OCB, 15173 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15174 .doit = nl80211_join_ocb, 15175 .flags = GENL_UNS_ADMIN_PERM, 15176 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15177 NL80211_FLAG_NEED_RTNL, 15178 }, 15179 { 15180 .cmd = NL80211_CMD_LEAVE_OCB, 15181 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15182 .doit = nl80211_leave_ocb, 15183 .flags = GENL_UNS_ADMIN_PERM, 15184 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15185 NL80211_FLAG_NEED_RTNL, 15186 }, 15187 #ifdef CONFIG_PM 15188 { 15189 .cmd = NL80211_CMD_GET_WOWLAN, 15190 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15191 .doit = nl80211_get_wowlan, 15192 /* can be retrieved by unprivileged users */ 15193 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15194 NL80211_FLAG_NEED_RTNL, 15195 }, 15196 { 15197 .cmd = NL80211_CMD_SET_WOWLAN, 15198 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15199 .doit = nl80211_set_wowlan, 15200 .flags = GENL_UNS_ADMIN_PERM, 15201 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15202 NL80211_FLAG_NEED_RTNL, 15203 }, 15204 #endif 15205 { 15206 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 15207 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15208 .doit = nl80211_set_rekey_data, 15209 .flags = GENL_UNS_ADMIN_PERM, 15210 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15211 NL80211_FLAG_NEED_RTNL | 15212 NL80211_FLAG_CLEAR_SKB, 15213 }, 15214 { 15215 .cmd = NL80211_CMD_TDLS_MGMT, 15216 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15217 .doit = nl80211_tdls_mgmt, 15218 .flags = GENL_UNS_ADMIN_PERM, 15219 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15220 NL80211_FLAG_NEED_RTNL, 15221 }, 15222 { 15223 .cmd = NL80211_CMD_TDLS_OPER, 15224 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15225 .doit = nl80211_tdls_oper, 15226 .flags = GENL_UNS_ADMIN_PERM, 15227 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15228 NL80211_FLAG_NEED_RTNL, 15229 }, 15230 { 15231 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 15232 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15233 .doit = nl80211_register_unexpected_frame, 15234 .flags = GENL_UNS_ADMIN_PERM, 15235 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15236 NL80211_FLAG_NEED_RTNL, 15237 }, 15238 { 15239 .cmd = NL80211_CMD_PROBE_CLIENT, 15240 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15241 .doit = nl80211_probe_client, 15242 .flags = GENL_UNS_ADMIN_PERM, 15243 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15244 NL80211_FLAG_NEED_RTNL, 15245 }, 15246 { 15247 .cmd = NL80211_CMD_REGISTER_BEACONS, 15248 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15249 .doit = nl80211_register_beacons, 15250 .flags = GENL_UNS_ADMIN_PERM, 15251 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15252 NL80211_FLAG_NEED_RTNL, 15253 }, 15254 { 15255 .cmd = NL80211_CMD_SET_NOACK_MAP, 15256 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15257 .doit = nl80211_set_noack_map, 15258 .flags = GENL_UNS_ADMIN_PERM, 15259 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15260 NL80211_FLAG_NEED_RTNL, 15261 }, 15262 { 15263 .cmd = NL80211_CMD_START_P2P_DEVICE, 15264 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15265 .doit = nl80211_start_p2p_device, 15266 .flags = GENL_UNS_ADMIN_PERM, 15267 .internal_flags = NL80211_FLAG_NEED_WDEV | 15268 NL80211_FLAG_NEED_RTNL, 15269 }, 15270 { 15271 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 15272 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15273 .doit = nl80211_stop_p2p_device, 15274 .flags = GENL_UNS_ADMIN_PERM, 15275 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15276 NL80211_FLAG_NEED_RTNL, 15277 }, 15278 { 15279 .cmd = NL80211_CMD_START_NAN, 15280 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15281 .doit = nl80211_start_nan, 15282 .flags = GENL_ADMIN_PERM, 15283 .internal_flags = NL80211_FLAG_NEED_WDEV | 15284 NL80211_FLAG_NEED_RTNL, 15285 }, 15286 { 15287 .cmd = NL80211_CMD_STOP_NAN, 15288 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15289 .doit = nl80211_stop_nan, 15290 .flags = GENL_ADMIN_PERM, 15291 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15292 NL80211_FLAG_NEED_RTNL, 15293 }, 15294 { 15295 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 15296 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15297 .doit = nl80211_nan_add_func, 15298 .flags = GENL_ADMIN_PERM, 15299 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15300 NL80211_FLAG_NEED_RTNL, 15301 }, 15302 { 15303 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 15304 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15305 .doit = nl80211_nan_del_func, 15306 .flags = GENL_ADMIN_PERM, 15307 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15308 NL80211_FLAG_NEED_RTNL, 15309 }, 15310 { 15311 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 15312 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15313 .doit = nl80211_nan_change_config, 15314 .flags = GENL_ADMIN_PERM, 15315 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15316 NL80211_FLAG_NEED_RTNL, 15317 }, 15318 { 15319 .cmd = NL80211_CMD_SET_MCAST_RATE, 15320 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15321 .doit = nl80211_set_mcast_rate, 15322 .flags = GENL_UNS_ADMIN_PERM, 15323 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15324 NL80211_FLAG_NEED_RTNL, 15325 }, 15326 { 15327 .cmd = NL80211_CMD_SET_MAC_ACL, 15328 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15329 .doit = nl80211_set_mac_acl, 15330 .flags = GENL_UNS_ADMIN_PERM, 15331 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15332 NL80211_FLAG_NEED_RTNL, 15333 }, 15334 { 15335 .cmd = NL80211_CMD_RADAR_DETECT, 15336 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15337 .doit = nl80211_start_radar_detection, 15338 .flags = GENL_UNS_ADMIN_PERM, 15339 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15340 NL80211_FLAG_NEED_RTNL, 15341 }, 15342 { 15343 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 15344 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15345 .doit = nl80211_get_protocol_features, 15346 }, 15347 { 15348 .cmd = NL80211_CMD_UPDATE_FT_IES, 15349 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15350 .doit = nl80211_update_ft_ies, 15351 .flags = GENL_UNS_ADMIN_PERM, 15352 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15353 NL80211_FLAG_NEED_RTNL, 15354 }, 15355 { 15356 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 15357 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15358 .doit = nl80211_crit_protocol_start, 15359 .flags = GENL_UNS_ADMIN_PERM, 15360 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15361 NL80211_FLAG_NEED_RTNL, 15362 }, 15363 { 15364 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 15365 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15366 .doit = nl80211_crit_protocol_stop, 15367 .flags = GENL_UNS_ADMIN_PERM, 15368 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15369 NL80211_FLAG_NEED_RTNL, 15370 }, 15371 { 15372 .cmd = NL80211_CMD_GET_COALESCE, 15373 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15374 .doit = nl80211_get_coalesce, 15375 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15376 NL80211_FLAG_NEED_RTNL, 15377 }, 15378 { 15379 .cmd = NL80211_CMD_SET_COALESCE, 15380 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15381 .doit = nl80211_set_coalesce, 15382 .flags = GENL_UNS_ADMIN_PERM, 15383 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15384 NL80211_FLAG_NEED_RTNL, 15385 }, 15386 { 15387 .cmd = NL80211_CMD_CHANNEL_SWITCH, 15388 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15389 .doit = nl80211_channel_switch, 15390 .flags = GENL_UNS_ADMIN_PERM, 15391 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15392 NL80211_FLAG_NEED_RTNL, 15393 }, 15394 { 15395 .cmd = NL80211_CMD_VENDOR, 15396 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15397 .doit = nl80211_vendor_cmd, 15398 .dumpit = nl80211_vendor_cmd_dump, 15399 .flags = GENL_UNS_ADMIN_PERM, 15400 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15401 NL80211_FLAG_NEED_RTNL | 15402 NL80211_FLAG_CLEAR_SKB, 15403 }, 15404 { 15405 .cmd = NL80211_CMD_SET_QOS_MAP, 15406 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15407 .doit = nl80211_set_qos_map, 15408 .flags = GENL_UNS_ADMIN_PERM, 15409 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15410 NL80211_FLAG_NEED_RTNL, 15411 }, 15412 { 15413 .cmd = NL80211_CMD_ADD_TX_TS, 15414 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15415 .doit = nl80211_add_tx_ts, 15416 .flags = GENL_UNS_ADMIN_PERM, 15417 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15418 NL80211_FLAG_NEED_RTNL, 15419 }, 15420 { 15421 .cmd = NL80211_CMD_DEL_TX_TS, 15422 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15423 .doit = nl80211_del_tx_ts, 15424 .flags = GENL_UNS_ADMIN_PERM, 15425 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15426 NL80211_FLAG_NEED_RTNL, 15427 }, 15428 { 15429 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 15430 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15431 .doit = nl80211_tdls_channel_switch, 15432 .flags = GENL_UNS_ADMIN_PERM, 15433 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15434 NL80211_FLAG_NEED_RTNL, 15435 }, 15436 { 15437 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 15438 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15439 .doit = nl80211_tdls_cancel_channel_switch, 15440 .flags = GENL_UNS_ADMIN_PERM, 15441 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15442 NL80211_FLAG_NEED_RTNL, 15443 }, 15444 { 15445 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 15446 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15447 .doit = nl80211_set_multicast_to_unicast, 15448 .flags = GENL_UNS_ADMIN_PERM, 15449 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15450 NL80211_FLAG_NEED_RTNL, 15451 }, 15452 { 15453 .cmd = NL80211_CMD_SET_PMK, 15454 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15455 .doit = nl80211_set_pmk, 15456 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15457 NL80211_FLAG_NEED_RTNL | 15458 NL80211_FLAG_CLEAR_SKB, 15459 }, 15460 { 15461 .cmd = NL80211_CMD_DEL_PMK, 15462 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15463 .doit = nl80211_del_pmk, 15464 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15465 NL80211_FLAG_NEED_RTNL, 15466 }, 15467 { 15468 .cmd = NL80211_CMD_EXTERNAL_AUTH, 15469 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15470 .doit = nl80211_external_auth, 15471 .flags = GENL_ADMIN_PERM, 15472 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15473 NL80211_FLAG_NEED_RTNL, 15474 }, 15475 { 15476 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 15477 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15478 .doit = nl80211_tx_control_port, 15479 .flags = GENL_UNS_ADMIN_PERM, 15480 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15481 NL80211_FLAG_NEED_RTNL, 15482 }, 15483 { 15484 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 15485 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15486 .doit = nl80211_get_ftm_responder_stats, 15487 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15488 NL80211_FLAG_NEED_RTNL, 15489 }, 15490 { 15491 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 15492 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15493 .doit = nl80211_pmsr_start, 15494 .flags = GENL_UNS_ADMIN_PERM, 15495 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15496 NL80211_FLAG_NEED_RTNL, 15497 }, 15498 { 15499 .cmd = NL80211_CMD_NOTIFY_RADAR, 15500 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15501 .doit = nl80211_notify_radar_detection, 15502 .flags = GENL_UNS_ADMIN_PERM, 15503 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15504 NL80211_FLAG_NEED_RTNL, 15505 }, 15506 { 15507 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 15508 .doit = nl80211_update_owe_info, 15509 .flags = GENL_ADMIN_PERM, 15510 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15511 NL80211_FLAG_NEED_RTNL, 15512 }, 15513 { 15514 .cmd = NL80211_CMD_PROBE_MESH_LINK, 15515 .doit = nl80211_probe_mesh_link, 15516 .flags = GENL_UNS_ADMIN_PERM, 15517 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15518 NL80211_FLAG_NEED_RTNL, 15519 }, 15520 { 15521 .cmd = NL80211_CMD_SET_TID_CONFIG, 15522 .doit = nl80211_set_tid_config, 15523 .flags = GENL_UNS_ADMIN_PERM, 15524 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15525 NL80211_FLAG_NEED_RTNL, 15526 }, 15527 }; 15528 15529 static struct genl_family nl80211_fam __ro_after_init = { 15530 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 15531 .hdrsize = 0, /* no private header */ 15532 .version = 1, /* no particular meaning now */ 15533 .maxattr = NL80211_ATTR_MAX, 15534 .policy = nl80211_policy, 15535 .netnsok = true, 15536 .pre_doit = nl80211_pre_doit, 15537 .post_doit = nl80211_post_doit, 15538 .module = THIS_MODULE, 15539 .ops = nl80211_ops, 15540 .n_ops = ARRAY_SIZE(nl80211_ops), 15541 .small_ops = nl80211_small_ops, 15542 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 15543 .mcgrps = nl80211_mcgrps, 15544 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 15545 .parallel_ops = true, 15546 }; 15547 15548 /* notification functions */ 15549 15550 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 15551 enum nl80211_commands cmd) 15552 { 15553 struct sk_buff *msg; 15554 struct nl80211_dump_wiphy_state state = {}; 15555 15556 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 15557 cmd != NL80211_CMD_DEL_WIPHY); 15558 15559 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15560 if (!msg) 15561 return; 15562 15563 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 15564 nlmsg_free(msg); 15565 return; 15566 } 15567 15568 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15569 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15570 } 15571 15572 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 15573 struct wireless_dev *wdev, 15574 enum nl80211_commands cmd) 15575 { 15576 struct sk_buff *msg; 15577 15578 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15579 if (!msg) 15580 return; 15581 15582 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 15583 nlmsg_free(msg); 15584 return; 15585 } 15586 15587 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15588 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15589 } 15590 15591 static int nl80211_add_scan_req(struct sk_buff *msg, 15592 struct cfg80211_registered_device *rdev) 15593 { 15594 struct cfg80211_scan_request *req = rdev->scan_req; 15595 struct nlattr *nest; 15596 int i; 15597 struct cfg80211_scan_info *info; 15598 15599 if (WARN_ON(!req)) 15600 return 0; 15601 15602 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 15603 if (!nest) 15604 goto nla_put_failure; 15605 for (i = 0; i < req->n_ssids; i++) { 15606 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 15607 goto nla_put_failure; 15608 } 15609 nla_nest_end(msg, nest); 15610 15611 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 15612 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 15613 if (!nest) 15614 goto nla_put_failure; 15615 for (i = 0; i < req->n_channels; i++) { 15616 if (nla_put_u32(msg, i, 15617 ieee80211_channel_to_khz(req->channels[i]))) 15618 goto nla_put_failure; 15619 } 15620 nla_nest_end(msg, nest); 15621 } else { 15622 nest = nla_nest_start_noflag(msg, 15623 NL80211_ATTR_SCAN_FREQUENCIES); 15624 if (!nest) 15625 goto nla_put_failure; 15626 for (i = 0; i < req->n_channels; i++) { 15627 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 15628 goto nla_put_failure; 15629 } 15630 nla_nest_end(msg, nest); 15631 } 15632 15633 if (req->ie && 15634 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 15635 goto nla_put_failure; 15636 15637 if (req->flags && 15638 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 15639 goto nla_put_failure; 15640 15641 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 15642 &rdev->scan_req->info; 15643 if (info->scan_start_tsf && 15644 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 15645 info->scan_start_tsf, NL80211_BSS_PAD) || 15646 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 15647 info->tsf_bssid))) 15648 goto nla_put_failure; 15649 15650 return 0; 15651 nla_put_failure: 15652 return -ENOBUFS; 15653 } 15654 15655 static int nl80211_prep_scan_msg(struct sk_buff *msg, 15656 struct cfg80211_registered_device *rdev, 15657 struct wireless_dev *wdev, 15658 u32 portid, u32 seq, int flags, 15659 u32 cmd) 15660 { 15661 void *hdr; 15662 15663 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 15664 if (!hdr) 15665 return -1; 15666 15667 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15668 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15669 wdev->netdev->ifindex)) || 15670 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15671 NL80211_ATTR_PAD)) 15672 goto nla_put_failure; 15673 15674 /* ignore errors and send incomplete event anyway */ 15675 nl80211_add_scan_req(msg, rdev); 15676 15677 genlmsg_end(msg, hdr); 15678 return 0; 15679 15680 nla_put_failure: 15681 genlmsg_cancel(msg, hdr); 15682 return -EMSGSIZE; 15683 } 15684 15685 static int 15686 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 15687 struct cfg80211_sched_scan_request *req, u32 cmd) 15688 { 15689 void *hdr; 15690 15691 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15692 if (!hdr) 15693 return -1; 15694 15695 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 15696 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 15697 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 15698 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 15699 NL80211_ATTR_PAD)) 15700 goto nla_put_failure; 15701 15702 genlmsg_end(msg, hdr); 15703 return 0; 15704 15705 nla_put_failure: 15706 genlmsg_cancel(msg, hdr); 15707 return -EMSGSIZE; 15708 } 15709 15710 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 15711 struct wireless_dev *wdev) 15712 { 15713 struct sk_buff *msg; 15714 15715 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15716 if (!msg) 15717 return; 15718 15719 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15720 NL80211_CMD_TRIGGER_SCAN) < 0) { 15721 nlmsg_free(msg); 15722 return; 15723 } 15724 15725 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15726 NL80211_MCGRP_SCAN, GFP_KERNEL); 15727 } 15728 15729 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 15730 struct wireless_dev *wdev, bool aborted) 15731 { 15732 struct sk_buff *msg; 15733 15734 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15735 if (!msg) 15736 return NULL; 15737 15738 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15739 aborted ? NL80211_CMD_SCAN_ABORTED : 15740 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 15741 nlmsg_free(msg); 15742 return NULL; 15743 } 15744 15745 return msg; 15746 } 15747 15748 /* send message created by nl80211_build_scan_msg() */ 15749 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 15750 struct sk_buff *msg) 15751 { 15752 if (!msg) 15753 return; 15754 15755 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15756 NL80211_MCGRP_SCAN, GFP_KERNEL); 15757 } 15758 15759 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 15760 { 15761 struct sk_buff *msg; 15762 15763 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15764 if (!msg) 15765 return; 15766 15767 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 15768 nlmsg_free(msg); 15769 return; 15770 } 15771 15772 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 15773 NL80211_MCGRP_SCAN, GFP_KERNEL); 15774 } 15775 15776 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 15777 struct regulatory_request *request) 15778 { 15779 /* Userspace can always count this one always being set */ 15780 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 15781 goto nla_put_failure; 15782 15783 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 15784 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15785 NL80211_REGDOM_TYPE_WORLD)) 15786 goto nla_put_failure; 15787 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 15788 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15789 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 15790 goto nla_put_failure; 15791 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 15792 request->intersect) { 15793 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15794 NL80211_REGDOM_TYPE_INTERSECTION)) 15795 goto nla_put_failure; 15796 } else { 15797 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15798 NL80211_REGDOM_TYPE_COUNTRY) || 15799 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 15800 request->alpha2)) 15801 goto nla_put_failure; 15802 } 15803 15804 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 15805 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 15806 15807 if (wiphy && 15808 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 15809 goto nla_put_failure; 15810 15811 if (wiphy && 15812 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 15813 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 15814 goto nla_put_failure; 15815 } 15816 15817 return true; 15818 15819 nla_put_failure: 15820 return false; 15821 } 15822 15823 /* 15824 * This can happen on global regulatory changes or device specific settings 15825 * based on custom regulatory domains. 15826 */ 15827 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 15828 struct regulatory_request *request) 15829 { 15830 struct sk_buff *msg; 15831 void *hdr; 15832 15833 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15834 if (!msg) 15835 return; 15836 15837 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 15838 if (!hdr) 15839 goto nla_put_failure; 15840 15841 if (!nl80211_reg_change_event_fill(msg, request)) 15842 goto nla_put_failure; 15843 15844 genlmsg_end(msg, hdr); 15845 15846 rcu_read_lock(); 15847 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 15848 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 15849 rcu_read_unlock(); 15850 15851 return; 15852 15853 nla_put_failure: 15854 nlmsg_free(msg); 15855 } 15856 15857 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 15858 struct net_device *netdev, 15859 const u8 *buf, size_t len, 15860 enum nl80211_commands cmd, gfp_t gfp, 15861 int uapsd_queues, const u8 *req_ies, 15862 size_t req_ies_len) 15863 { 15864 struct sk_buff *msg; 15865 void *hdr; 15866 15867 msg = nlmsg_new(100 + len + req_ies_len, gfp); 15868 if (!msg) 15869 return; 15870 15871 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15872 if (!hdr) { 15873 nlmsg_free(msg); 15874 return; 15875 } 15876 15877 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15878 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15879 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 15880 (req_ies && 15881 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies))) 15882 goto nla_put_failure; 15883 15884 if (uapsd_queues >= 0) { 15885 struct nlattr *nla_wmm = 15886 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 15887 if (!nla_wmm) 15888 goto nla_put_failure; 15889 15890 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 15891 uapsd_queues)) 15892 goto nla_put_failure; 15893 15894 nla_nest_end(msg, nla_wmm); 15895 } 15896 15897 genlmsg_end(msg, hdr); 15898 15899 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15900 NL80211_MCGRP_MLME, gfp); 15901 return; 15902 15903 nla_put_failure: 15904 nlmsg_free(msg); 15905 } 15906 15907 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 15908 struct net_device *netdev, const u8 *buf, 15909 size_t len, gfp_t gfp) 15910 { 15911 nl80211_send_mlme_event(rdev, netdev, buf, len, 15912 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0); 15913 } 15914 15915 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 15916 struct net_device *netdev, const u8 *buf, 15917 size_t len, gfp_t gfp, int uapsd_queues, 15918 const u8 *req_ies, size_t req_ies_len) 15919 { 15920 nl80211_send_mlme_event(rdev, netdev, buf, len, 15921 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues, 15922 req_ies, req_ies_len); 15923 } 15924 15925 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 15926 struct net_device *netdev, const u8 *buf, 15927 size_t len, gfp_t gfp) 15928 { 15929 nl80211_send_mlme_event(rdev, netdev, buf, len, 15930 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0); 15931 } 15932 15933 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 15934 struct net_device *netdev, const u8 *buf, 15935 size_t len, gfp_t gfp) 15936 { 15937 nl80211_send_mlme_event(rdev, netdev, buf, len, 15938 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0); 15939 } 15940 15941 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 15942 size_t len) 15943 { 15944 struct wireless_dev *wdev = dev->ieee80211_ptr; 15945 struct wiphy *wiphy = wdev->wiphy; 15946 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15947 const struct ieee80211_mgmt *mgmt = (void *)buf; 15948 u32 cmd; 15949 15950 if (WARN_ON(len < 2)) 15951 return; 15952 15953 if (ieee80211_is_deauth(mgmt->frame_control)) { 15954 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 15955 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 15956 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 15957 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 15958 if (wdev->unprot_beacon_reported && 15959 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 15960 return; 15961 cmd = NL80211_CMD_UNPROT_BEACON; 15962 wdev->unprot_beacon_reported = jiffies; 15963 } else { 15964 return; 15965 } 15966 15967 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 15968 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1, 15969 NULL, 0); 15970 } 15971 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 15972 15973 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 15974 struct net_device *netdev, int cmd, 15975 const u8 *addr, gfp_t gfp) 15976 { 15977 struct sk_buff *msg; 15978 void *hdr; 15979 15980 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15981 if (!msg) 15982 return; 15983 15984 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15985 if (!hdr) { 15986 nlmsg_free(msg); 15987 return; 15988 } 15989 15990 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15991 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15992 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 15993 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 15994 goto nla_put_failure; 15995 15996 genlmsg_end(msg, hdr); 15997 15998 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15999 NL80211_MCGRP_MLME, gfp); 16000 return; 16001 16002 nla_put_failure: 16003 nlmsg_free(msg); 16004 } 16005 16006 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 16007 struct net_device *netdev, const u8 *addr, 16008 gfp_t gfp) 16009 { 16010 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 16011 addr, gfp); 16012 } 16013 16014 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 16015 struct net_device *netdev, const u8 *addr, 16016 gfp_t gfp) 16017 { 16018 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 16019 addr, gfp); 16020 } 16021 16022 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 16023 struct net_device *netdev, 16024 struct cfg80211_connect_resp_params *cr, 16025 gfp_t gfp) 16026 { 16027 struct sk_buff *msg; 16028 void *hdr; 16029 16030 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 16031 cr->fils.kek_len + cr->fils.pmk_len + 16032 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16033 if (!msg) 16034 return; 16035 16036 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 16037 if (!hdr) { 16038 nlmsg_free(msg); 16039 return; 16040 } 16041 16042 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16043 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16044 (cr->bssid && 16045 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 16046 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 16047 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 16048 cr->status) || 16049 (cr->status < 0 && 16050 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 16051 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 16052 cr->timeout_reason))) || 16053 (cr->req_ie && 16054 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 16055 (cr->resp_ie && 16056 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 16057 cr->resp_ie)) || 16058 (cr->fils.update_erp_next_seq_num && 16059 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16060 cr->fils.erp_next_seq_num)) || 16061 (cr->status == WLAN_STATUS_SUCCESS && 16062 ((cr->fils.kek && 16063 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 16064 cr->fils.kek)) || 16065 (cr->fils.pmk && 16066 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 16067 (cr->fils.pmkid && 16068 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 16069 goto nla_put_failure; 16070 16071 genlmsg_end(msg, hdr); 16072 16073 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16074 NL80211_MCGRP_MLME, gfp); 16075 return; 16076 16077 nla_put_failure: 16078 nlmsg_free(msg); 16079 } 16080 16081 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 16082 struct net_device *netdev, 16083 struct cfg80211_roam_info *info, gfp_t gfp) 16084 { 16085 struct sk_buff *msg; 16086 void *hdr; 16087 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 16088 16089 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 16090 info->fils.kek_len + info->fils.pmk_len + 16091 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16092 if (!msg) 16093 return; 16094 16095 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 16096 if (!hdr) { 16097 nlmsg_free(msg); 16098 return; 16099 } 16100 16101 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16102 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16103 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 16104 (info->req_ie && 16105 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 16106 info->req_ie)) || 16107 (info->resp_ie && 16108 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 16109 info->resp_ie)) || 16110 (info->fils.update_erp_next_seq_num && 16111 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16112 info->fils.erp_next_seq_num)) || 16113 (info->fils.kek && 16114 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 16115 info->fils.kek)) || 16116 (info->fils.pmk && 16117 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 16118 (info->fils.pmkid && 16119 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 16120 goto nla_put_failure; 16121 16122 genlmsg_end(msg, hdr); 16123 16124 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16125 NL80211_MCGRP_MLME, gfp); 16126 return; 16127 16128 nla_put_failure: 16129 nlmsg_free(msg); 16130 } 16131 16132 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 16133 struct net_device *netdev, const u8 *bssid) 16134 { 16135 struct sk_buff *msg; 16136 void *hdr; 16137 16138 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16139 if (!msg) 16140 return; 16141 16142 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 16143 if (!hdr) { 16144 nlmsg_free(msg); 16145 return; 16146 } 16147 16148 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16149 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16150 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16151 goto nla_put_failure; 16152 16153 genlmsg_end(msg, hdr); 16154 16155 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16156 NL80211_MCGRP_MLME, GFP_KERNEL); 16157 return; 16158 16159 nla_put_failure: 16160 nlmsg_free(msg); 16161 } 16162 16163 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 16164 struct net_device *netdev, u16 reason, 16165 const u8 *ie, size_t ie_len, bool from_ap) 16166 { 16167 struct sk_buff *msg; 16168 void *hdr; 16169 16170 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 16171 if (!msg) 16172 return; 16173 16174 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 16175 if (!hdr) { 16176 nlmsg_free(msg); 16177 return; 16178 } 16179 16180 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16181 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16182 (reason && 16183 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 16184 (from_ap && 16185 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 16186 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 16187 goto nla_put_failure; 16188 16189 genlmsg_end(msg, hdr); 16190 16191 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16192 NL80211_MCGRP_MLME, GFP_KERNEL); 16193 return; 16194 16195 nla_put_failure: 16196 nlmsg_free(msg); 16197 } 16198 16199 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 16200 struct net_device *netdev, const u8 *bssid, 16201 gfp_t gfp) 16202 { 16203 struct sk_buff *msg; 16204 void *hdr; 16205 16206 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16207 if (!msg) 16208 return; 16209 16210 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 16211 if (!hdr) { 16212 nlmsg_free(msg); 16213 return; 16214 } 16215 16216 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16217 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16218 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16219 goto nla_put_failure; 16220 16221 genlmsg_end(msg, hdr); 16222 16223 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16224 NL80211_MCGRP_MLME, gfp); 16225 return; 16226 16227 nla_put_failure: 16228 nlmsg_free(msg); 16229 } 16230 16231 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 16232 const u8 *ie, u8 ie_len, 16233 int sig_dbm, gfp_t gfp) 16234 { 16235 struct wireless_dev *wdev = dev->ieee80211_ptr; 16236 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16237 struct sk_buff *msg; 16238 void *hdr; 16239 16240 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 16241 return; 16242 16243 trace_cfg80211_notify_new_peer_candidate(dev, addr); 16244 16245 msg = nlmsg_new(100 + ie_len, gfp); 16246 if (!msg) 16247 return; 16248 16249 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 16250 if (!hdr) { 16251 nlmsg_free(msg); 16252 return; 16253 } 16254 16255 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16256 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16257 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16258 (ie_len && ie && 16259 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 16260 (sig_dbm && 16261 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 16262 goto nla_put_failure; 16263 16264 genlmsg_end(msg, hdr); 16265 16266 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16267 NL80211_MCGRP_MLME, gfp); 16268 return; 16269 16270 nla_put_failure: 16271 nlmsg_free(msg); 16272 } 16273 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 16274 16275 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 16276 struct net_device *netdev, const u8 *addr, 16277 enum nl80211_key_type key_type, int key_id, 16278 const u8 *tsc, gfp_t gfp) 16279 { 16280 struct sk_buff *msg; 16281 void *hdr; 16282 16283 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16284 if (!msg) 16285 return; 16286 16287 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 16288 if (!hdr) { 16289 nlmsg_free(msg); 16290 return; 16291 } 16292 16293 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16294 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16295 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 16296 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 16297 (key_id != -1 && 16298 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 16299 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 16300 goto nla_put_failure; 16301 16302 genlmsg_end(msg, hdr); 16303 16304 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16305 NL80211_MCGRP_MLME, gfp); 16306 return; 16307 16308 nla_put_failure: 16309 nlmsg_free(msg); 16310 } 16311 16312 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 16313 struct ieee80211_channel *channel_before, 16314 struct ieee80211_channel *channel_after) 16315 { 16316 struct sk_buff *msg; 16317 void *hdr; 16318 struct nlattr *nl_freq; 16319 16320 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 16321 if (!msg) 16322 return; 16323 16324 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 16325 if (!hdr) { 16326 nlmsg_free(msg); 16327 return; 16328 } 16329 16330 /* 16331 * Since we are applying the beacon hint to a wiphy we know its 16332 * wiphy_idx is valid 16333 */ 16334 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 16335 goto nla_put_failure; 16336 16337 /* Before */ 16338 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 16339 if (!nl_freq) 16340 goto nla_put_failure; 16341 16342 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 16343 goto nla_put_failure; 16344 nla_nest_end(msg, nl_freq); 16345 16346 /* After */ 16347 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 16348 if (!nl_freq) 16349 goto nla_put_failure; 16350 16351 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 16352 goto nla_put_failure; 16353 nla_nest_end(msg, nl_freq); 16354 16355 genlmsg_end(msg, hdr); 16356 16357 rcu_read_lock(); 16358 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 16359 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 16360 rcu_read_unlock(); 16361 16362 return; 16363 16364 nla_put_failure: 16365 nlmsg_free(msg); 16366 } 16367 16368 static void nl80211_send_remain_on_chan_event( 16369 int cmd, struct cfg80211_registered_device *rdev, 16370 struct wireless_dev *wdev, u64 cookie, 16371 struct ieee80211_channel *chan, 16372 unsigned int duration, gfp_t gfp) 16373 { 16374 struct sk_buff *msg; 16375 void *hdr; 16376 16377 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16378 if (!msg) 16379 return; 16380 16381 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16382 if (!hdr) { 16383 nlmsg_free(msg); 16384 return; 16385 } 16386 16387 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16388 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16389 wdev->netdev->ifindex)) || 16390 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16391 NL80211_ATTR_PAD) || 16392 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 16393 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 16394 NL80211_CHAN_NO_HT) || 16395 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16396 NL80211_ATTR_PAD)) 16397 goto nla_put_failure; 16398 16399 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 16400 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 16401 goto nla_put_failure; 16402 16403 genlmsg_end(msg, hdr); 16404 16405 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16406 NL80211_MCGRP_MLME, gfp); 16407 return; 16408 16409 nla_put_failure: 16410 nlmsg_free(msg); 16411 } 16412 16413 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 16414 struct ieee80211_channel *chan, 16415 unsigned int duration, gfp_t gfp) 16416 { 16417 struct wiphy *wiphy = wdev->wiphy; 16418 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16419 16420 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 16421 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 16422 rdev, wdev, cookie, chan, 16423 duration, gfp); 16424 } 16425 EXPORT_SYMBOL(cfg80211_ready_on_channel); 16426 16427 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 16428 struct ieee80211_channel *chan, 16429 gfp_t gfp) 16430 { 16431 struct wiphy *wiphy = wdev->wiphy; 16432 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16433 16434 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 16435 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 16436 rdev, wdev, cookie, chan, 0, gfp); 16437 } 16438 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 16439 16440 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 16441 struct ieee80211_channel *chan, 16442 gfp_t gfp) 16443 { 16444 struct wiphy *wiphy = wdev->wiphy; 16445 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16446 16447 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 16448 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 16449 rdev, wdev, cookie, chan, 0, gfp); 16450 } 16451 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 16452 16453 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 16454 struct station_info *sinfo, gfp_t gfp) 16455 { 16456 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16457 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16458 struct sk_buff *msg; 16459 16460 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 16461 16462 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16463 if (!msg) 16464 return; 16465 16466 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 16467 rdev, dev, mac_addr, sinfo) < 0) { 16468 nlmsg_free(msg); 16469 return; 16470 } 16471 16472 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16473 NL80211_MCGRP_MLME, gfp); 16474 } 16475 EXPORT_SYMBOL(cfg80211_new_sta); 16476 16477 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 16478 struct station_info *sinfo, gfp_t gfp) 16479 { 16480 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16481 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16482 struct sk_buff *msg; 16483 struct station_info empty_sinfo = {}; 16484 16485 if (!sinfo) 16486 sinfo = &empty_sinfo; 16487 16488 trace_cfg80211_del_sta(dev, mac_addr); 16489 16490 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16491 if (!msg) { 16492 cfg80211_sinfo_release_content(sinfo); 16493 return; 16494 } 16495 16496 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 16497 rdev, dev, mac_addr, sinfo) < 0) { 16498 nlmsg_free(msg); 16499 return; 16500 } 16501 16502 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16503 NL80211_MCGRP_MLME, gfp); 16504 } 16505 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 16506 16507 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 16508 enum nl80211_connect_failed_reason reason, 16509 gfp_t gfp) 16510 { 16511 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16512 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16513 struct sk_buff *msg; 16514 void *hdr; 16515 16516 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 16517 if (!msg) 16518 return; 16519 16520 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 16521 if (!hdr) { 16522 nlmsg_free(msg); 16523 return; 16524 } 16525 16526 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16527 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 16528 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 16529 goto nla_put_failure; 16530 16531 genlmsg_end(msg, hdr); 16532 16533 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16534 NL80211_MCGRP_MLME, gfp); 16535 return; 16536 16537 nla_put_failure: 16538 nlmsg_free(msg); 16539 } 16540 EXPORT_SYMBOL(cfg80211_conn_failed); 16541 16542 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 16543 const u8 *addr, gfp_t gfp) 16544 { 16545 struct wireless_dev *wdev = dev->ieee80211_ptr; 16546 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16547 struct sk_buff *msg; 16548 void *hdr; 16549 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 16550 16551 if (!nlportid) 16552 return false; 16553 16554 msg = nlmsg_new(100, gfp); 16555 if (!msg) 16556 return true; 16557 16558 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16559 if (!hdr) { 16560 nlmsg_free(msg); 16561 return true; 16562 } 16563 16564 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16565 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16566 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 16567 goto nla_put_failure; 16568 16569 genlmsg_end(msg, hdr); 16570 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16571 return true; 16572 16573 nla_put_failure: 16574 nlmsg_free(msg); 16575 return true; 16576 } 16577 16578 bool cfg80211_rx_spurious_frame(struct net_device *dev, 16579 const u8 *addr, gfp_t gfp) 16580 { 16581 struct wireless_dev *wdev = dev->ieee80211_ptr; 16582 bool ret; 16583 16584 trace_cfg80211_rx_spurious_frame(dev, addr); 16585 16586 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16587 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 16588 trace_cfg80211_return_bool(false); 16589 return false; 16590 } 16591 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 16592 addr, gfp); 16593 trace_cfg80211_return_bool(ret); 16594 return ret; 16595 } 16596 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 16597 16598 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 16599 const u8 *addr, gfp_t gfp) 16600 { 16601 struct wireless_dev *wdev = dev->ieee80211_ptr; 16602 bool ret; 16603 16604 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 16605 16606 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16607 wdev->iftype != NL80211_IFTYPE_P2P_GO && 16608 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 16609 trace_cfg80211_return_bool(false); 16610 return false; 16611 } 16612 ret = __nl80211_unexpected_frame(dev, 16613 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 16614 addr, gfp); 16615 trace_cfg80211_return_bool(ret); 16616 return ret; 16617 } 16618 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 16619 16620 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 16621 struct wireless_dev *wdev, u32 nlportid, 16622 int freq, int sig_dbm, 16623 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 16624 { 16625 struct net_device *netdev = wdev->netdev; 16626 struct sk_buff *msg; 16627 void *hdr; 16628 16629 msg = nlmsg_new(100 + len, gfp); 16630 if (!msg) 16631 return -ENOMEM; 16632 16633 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 16634 if (!hdr) { 16635 nlmsg_free(msg); 16636 return -ENOMEM; 16637 } 16638 16639 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16640 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16641 netdev->ifindex)) || 16642 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16643 NL80211_ATTR_PAD) || 16644 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) || 16645 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) || 16646 (sig_dbm && 16647 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 16648 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16649 (flags && 16650 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 16651 goto nla_put_failure; 16652 16653 genlmsg_end(msg, hdr); 16654 16655 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16656 16657 nla_put_failure: 16658 nlmsg_free(msg); 16659 return -ENOBUFS; 16660 } 16661 16662 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie, 16663 const u8 *buf, size_t len, bool ack, 16664 gfp_t gfp, enum nl80211_commands command) 16665 { 16666 struct wiphy *wiphy = wdev->wiphy; 16667 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16668 struct net_device *netdev = wdev->netdev; 16669 struct sk_buff *msg; 16670 void *hdr; 16671 16672 if (command == NL80211_CMD_FRAME_TX_STATUS) 16673 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 16674 else 16675 trace_cfg80211_control_port_tx_status(wdev, cookie, ack); 16676 16677 msg = nlmsg_new(100 + len, gfp); 16678 if (!msg) 16679 return; 16680 16681 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 16682 if (!hdr) { 16683 nlmsg_free(msg); 16684 return; 16685 } 16686 16687 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16688 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16689 netdev->ifindex)) || 16690 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16691 NL80211_ATTR_PAD) || 16692 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16693 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16694 NL80211_ATTR_PAD) || 16695 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 16696 goto nla_put_failure; 16697 16698 genlmsg_end(msg, hdr); 16699 16700 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16701 NL80211_MCGRP_MLME, gfp); 16702 return; 16703 16704 nla_put_failure: 16705 nlmsg_free(msg); 16706 } 16707 16708 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 16709 const u8 *buf, size_t len, bool ack, 16710 gfp_t gfp) 16711 { 16712 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16713 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 16714 } 16715 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 16716 16717 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 16718 const u8 *buf, size_t len, bool ack, gfp_t gfp) 16719 { 16720 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16721 NL80211_CMD_FRAME_TX_STATUS); 16722 } 16723 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 16724 16725 static int __nl80211_rx_control_port(struct net_device *dev, 16726 struct sk_buff *skb, 16727 bool unencrypted, gfp_t gfp) 16728 { 16729 struct wireless_dev *wdev = dev->ieee80211_ptr; 16730 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16731 struct ethhdr *ehdr = eth_hdr(skb); 16732 const u8 *addr = ehdr->h_source; 16733 u16 proto = be16_to_cpu(skb->protocol); 16734 struct sk_buff *msg; 16735 void *hdr; 16736 struct nlattr *frame; 16737 16738 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 16739 16740 if (!nlportid) 16741 return -ENOENT; 16742 16743 msg = nlmsg_new(100 + skb->len, gfp); 16744 if (!msg) 16745 return -ENOMEM; 16746 16747 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 16748 if (!hdr) { 16749 nlmsg_free(msg); 16750 return -ENOBUFS; 16751 } 16752 16753 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16754 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16755 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16756 NL80211_ATTR_PAD) || 16757 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16758 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 16759 (unencrypted && nla_put_flag(msg, 16760 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 16761 goto nla_put_failure; 16762 16763 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 16764 if (!frame) 16765 goto nla_put_failure; 16766 16767 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 16768 genlmsg_end(msg, hdr); 16769 16770 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16771 16772 nla_put_failure: 16773 nlmsg_free(msg); 16774 return -ENOBUFS; 16775 } 16776 16777 bool cfg80211_rx_control_port(struct net_device *dev, 16778 struct sk_buff *skb, bool unencrypted) 16779 { 16780 int ret; 16781 16782 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 16783 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 16784 trace_cfg80211_return_bool(ret == 0); 16785 return ret == 0; 16786 } 16787 EXPORT_SYMBOL(cfg80211_rx_control_port); 16788 16789 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 16790 const char *mac, gfp_t gfp) 16791 { 16792 struct wireless_dev *wdev = dev->ieee80211_ptr; 16793 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16794 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16795 void **cb; 16796 16797 if (!msg) 16798 return NULL; 16799 16800 cb = (void **)msg->cb; 16801 16802 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 16803 if (!cb[0]) { 16804 nlmsg_free(msg); 16805 return NULL; 16806 } 16807 16808 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16809 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 16810 goto nla_put_failure; 16811 16812 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 16813 goto nla_put_failure; 16814 16815 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 16816 if (!cb[1]) 16817 goto nla_put_failure; 16818 16819 cb[2] = rdev; 16820 16821 return msg; 16822 nla_put_failure: 16823 nlmsg_free(msg); 16824 return NULL; 16825 } 16826 16827 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 16828 { 16829 void **cb = (void **)msg->cb; 16830 struct cfg80211_registered_device *rdev = cb[2]; 16831 16832 nla_nest_end(msg, cb[1]); 16833 genlmsg_end(msg, cb[0]); 16834 16835 memset(msg->cb, 0, sizeof(msg->cb)); 16836 16837 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16838 NL80211_MCGRP_MLME, gfp); 16839 } 16840 16841 void cfg80211_cqm_rssi_notify(struct net_device *dev, 16842 enum nl80211_cqm_rssi_threshold_event rssi_event, 16843 s32 rssi_level, gfp_t gfp) 16844 { 16845 struct sk_buff *msg; 16846 struct wireless_dev *wdev = dev->ieee80211_ptr; 16847 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16848 16849 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 16850 16851 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 16852 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 16853 return; 16854 16855 if (wdev->cqm_config) { 16856 wdev->cqm_config->last_rssi_event_value = rssi_level; 16857 16858 cfg80211_cqm_rssi_update(rdev, dev); 16859 16860 if (rssi_level == 0) 16861 rssi_level = wdev->cqm_config->last_rssi_event_value; 16862 } 16863 16864 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16865 if (!msg) 16866 return; 16867 16868 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 16869 rssi_event)) 16870 goto nla_put_failure; 16871 16872 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 16873 rssi_level)) 16874 goto nla_put_failure; 16875 16876 cfg80211_send_cqm(msg, gfp); 16877 16878 return; 16879 16880 nla_put_failure: 16881 nlmsg_free(msg); 16882 } 16883 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 16884 16885 void cfg80211_cqm_txe_notify(struct net_device *dev, 16886 const u8 *peer, u32 num_packets, 16887 u32 rate, u32 intvl, gfp_t gfp) 16888 { 16889 struct sk_buff *msg; 16890 16891 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16892 if (!msg) 16893 return; 16894 16895 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 16896 goto nla_put_failure; 16897 16898 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 16899 goto nla_put_failure; 16900 16901 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 16902 goto nla_put_failure; 16903 16904 cfg80211_send_cqm(msg, gfp); 16905 return; 16906 16907 nla_put_failure: 16908 nlmsg_free(msg); 16909 } 16910 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 16911 16912 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 16913 const u8 *peer, u32 num_packets, gfp_t gfp) 16914 { 16915 struct sk_buff *msg; 16916 16917 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 16918 16919 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16920 if (!msg) 16921 return; 16922 16923 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 16924 goto nla_put_failure; 16925 16926 cfg80211_send_cqm(msg, gfp); 16927 return; 16928 16929 nla_put_failure: 16930 nlmsg_free(msg); 16931 } 16932 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 16933 16934 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 16935 { 16936 struct sk_buff *msg; 16937 16938 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16939 if (!msg) 16940 return; 16941 16942 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 16943 goto nla_put_failure; 16944 16945 cfg80211_send_cqm(msg, gfp); 16946 return; 16947 16948 nla_put_failure: 16949 nlmsg_free(msg); 16950 } 16951 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 16952 16953 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 16954 struct net_device *netdev, const u8 *bssid, 16955 const u8 *replay_ctr, gfp_t gfp) 16956 { 16957 struct sk_buff *msg; 16958 struct nlattr *rekey_attr; 16959 void *hdr; 16960 16961 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16962 if (!msg) 16963 return; 16964 16965 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 16966 if (!hdr) { 16967 nlmsg_free(msg); 16968 return; 16969 } 16970 16971 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16972 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16973 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16974 goto nla_put_failure; 16975 16976 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 16977 if (!rekey_attr) 16978 goto nla_put_failure; 16979 16980 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 16981 NL80211_REPLAY_CTR_LEN, replay_ctr)) 16982 goto nla_put_failure; 16983 16984 nla_nest_end(msg, rekey_attr); 16985 16986 genlmsg_end(msg, hdr); 16987 16988 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16989 NL80211_MCGRP_MLME, gfp); 16990 return; 16991 16992 nla_put_failure: 16993 nlmsg_free(msg); 16994 } 16995 16996 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 16997 const u8 *replay_ctr, gfp_t gfp) 16998 { 16999 struct wireless_dev *wdev = dev->ieee80211_ptr; 17000 struct wiphy *wiphy = wdev->wiphy; 17001 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17002 17003 trace_cfg80211_gtk_rekey_notify(dev, bssid); 17004 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 17005 } 17006 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 17007 17008 static void 17009 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 17010 struct net_device *netdev, int index, 17011 const u8 *bssid, bool preauth, gfp_t gfp) 17012 { 17013 struct sk_buff *msg; 17014 struct nlattr *attr; 17015 void *hdr; 17016 17017 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17018 if (!msg) 17019 return; 17020 17021 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 17022 if (!hdr) { 17023 nlmsg_free(msg); 17024 return; 17025 } 17026 17027 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17028 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17029 goto nla_put_failure; 17030 17031 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 17032 if (!attr) 17033 goto nla_put_failure; 17034 17035 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 17036 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 17037 (preauth && 17038 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 17039 goto nla_put_failure; 17040 17041 nla_nest_end(msg, attr); 17042 17043 genlmsg_end(msg, hdr); 17044 17045 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17046 NL80211_MCGRP_MLME, gfp); 17047 return; 17048 17049 nla_put_failure: 17050 nlmsg_free(msg); 17051 } 17052 17053 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 17054 const u8 *bssid, bool preauth, gfp_t gfp) 17055 { 17056 struct wireless_dev *wdev = dev->ieee80211_ptr; 17057 struct wiphy *wiphy = wdev->wiphy; 17058 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17059 17060 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 17061 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 17062 } 17063 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 17064 17065 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 17066 struct net_device *netdev, 17067 struct cfg80211_chan_def *chandef, 17068 gfp_t gfp, 17069 enum nl80211_commands notif, 17070 u8 count) 17071 { 17072 struct sk_buff *msg; 17073 void *hdr; 17074 17075 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17076 if (!msg) 17077 return; 17078 17079 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 17080 if (!hdr) { 17081 nlmsg_free(msg); 17082 return; 17083 } 17084 17085 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17086 goto nla_put_failure; 17087 17088 if (nl80211_send_chandef(msg, chandef)) 17089 goto nla_put_failure; 17090 17091 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 17092 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 17093 goto nla_put_failure; 17094 17095 genlmsg_end(msg, hdr); 17096 17097 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17098 NL80211_MCGRP_MLME, gfp); 17099 return; 17100 17101 nla_put_failure: 17102 nlmsg_free(msg); 17103 } 17104 17105 void cfg80211_ch_switch_notify(struct net_device *dev, 17106 struct cfg80211_chan_def *chandef) 17107 { 17108 struct wireless_dev *wdev = dev->ieee80211_ptr; 17109 struct wiphy *wiphy = wdev->wiphy; 17110 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17111 17112 ASSERT_WDEV_LOCK(wdev); 17113 17114 trace_cfg80211_ch_switch_notify(dev, chandef); 17115 17116 wdev->chandef = *chandef; 17117 wdev->preset_chandef = *chandef; 17118 17119 if (wdev->iftype == NL80211_IFTYPE_STATION && 17120 !WARN_ON(!wdev->current_bss)) 17121 cfg80211_update_assoc_bss_entry(wdev, chandef->chan); 17122 17123 cfg80211_sched_dfs_chan_update(rdev); 17124 17125 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17126 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 17127 } 17128 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 17129 17130 void cfg80211_ch_switch_started_notify(struct net_device *dev, 17131 struct cfg80211_chan_def *chandef, 17132 u8 count) 17133 { 17134 struct wireless_dev *wdev = dev->ieee80211_ptr; 17135 struct wiphy *wiphy = wdev->wiphy; 17136 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17137 17138 trace_cfg80211_ch_switch_started_notify(dev, chandef); 17139 17140 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17141 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 17142 } 17143 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 17144 17145 void 17146 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 17147 const struct cfg80211_chan_def *chandef, 17148 enum nl80211_radar_event event, 17149 struct net_device *netdev, gfp_t gfp) 17150 { 17151 struct sk_buff *msg; 17152 void *hdr; 17153 17154 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17155 if (!msg) 17156 return; 17157 17158 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 17159 if (!hdr) { 17160 nlmsg_free(msg); 17161 return; 17162 } 17163 17164 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17165 goto nla_put_failure; 17166 17167 /* NOP and radar events don't need a netdev parameter */ 17168 if (netdev) { 17169 struct wireless_dev *wdev = netdev->ieee80211_ptr; 17170 17171 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17172 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17173 NL80211_ATTR_PAD)) 17174 goto nla_put_failure; 17175 } 17176 17177 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 17178 goto nla_put_failure; 17179 17180 if (nl80211_send_chandef(msg, chandef)) 17181 goto nla_put_failure; 17182 17183 genlmsg_end(msg, hdr); 17184 17185 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17186 NL80211_MCGRP_MLME, gfp); 17187 return; 17188 17189 nla_put_failure: 17190 nlmsg_free(msg); 17191 } 17192 17193 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 17194 struct sta_opmode_info *sta_opmode, 17195 gfp_t gfp) 17196 { 17197 struct sk_buff *msg; 17198 struct wireless_dev *wdev = dev->ieee80211_ptr; 17199 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17200 void *hdr; 17201 17202 if (WARN_ON(!mac)) 17203 return; 17204 17205 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17206 if (!msg) 17207 return; 17208 17209 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 17210 if (!hdr) { 17211 nlmsg_free(msg); 17212 return; 17213 } 17214 17215 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17216 goto nla_put_failure; 17217 17218 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 17219 goto nla_put_failure; 17220 17221 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 17222 goto nla_put_failure; 17223 17224 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 17225 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 17226 goto nla_put_failure; 17227 17228 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 17229 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 17230 goto nla_put_failure; 17231 17232 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 17233 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 17234 goto nla_put_failure; 17235 17236 genlmsg_end(msg, hdr); 17237 17238 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17239 NL80211_MCGRP_MLME, gfp); 17240 17241 return; 17242 17243 nla_put_failure: 17244 nlmsg_free(msg); 17245 } 17246 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 17247 17248 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 17249 u64 cookie, bool acked, s32 ack_signal, 17250 bool is_valid_ack_signal, gfp_t gfp) 17251 { 17252 struct wireless_dev *wdev = dev->ieee80211_ptr; 17253 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17254 struct sk_buff *msg; 17255 void *hdr; 17256 17257 trace_cfg80211_probe_status(dev, addr, cookie, acked); 17258 17259 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17260 17261 if (!msg) 17262 return; 17263 17264 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 17265 if (!hdr) { 17266 nlmsg_free(msg); 17267 return; 17268 } 17269 17270 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17271 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17272 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 17273 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 17274 NL80211_ATTR_PAD) || 17275 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 17276 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 17277 ack_signal))) 17278 goto nla_put_failure; 17279 17280 genlmsg_end(msg, hdr); 17281 17282 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17283 NL80211_MCGRP_MLME, gfp); 17284 return; 17285 17286 nla_put_failure: 17287 nlmsg_free(msg); 17288 } 17289 EXPORT_SYMBOL(cfg80211_probe_status); 17290 17291 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 17292 size_t len, int freq, int sig_dbm) 17293 { 17294 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17295 struct sk_buff *msg; 17296 void *hdr; 17297 struct cfg80211_beacon_registration *reg; 17298 17299 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 17300 17301 spin_lock_bh(&rdev->beacon_registrations_lock); 17302 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 17303 msg = nlmsg_new(len + 100, GFP_ATOMIC); 17304 if (!msg) { 17305 spin_unlock_bh(&rdev->beacon_registrations_lock); 17306 return; 17307 } 17308 17309 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 17310 if (!hdr) 17311 goto nla_put_failure; 17312 17313 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17314 (freq && 17315 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 17316 KHZ_TO_MHZ(freq)) || 17317 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 17318 freq % 1000))) || 17319 (sig_dbm && 17320 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 17321 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 17322 goto nla_put_failure; 17323 17324 genlmsg_end(msg, hdr); 17325 17326 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 17327 } 17328 spin_unlock_bh(&rdev->beacon_registrations_lock); 17329 return; 17330 17331 nla_put_failure: 17332 spin_unlock_bh(&rdev->beacon_registrations_lock); 17333 nlmsg_free(msg); 17334 } 17335 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 17336 17337 #ifdef CONFIG_PM 17338 static int cfg80211_net_detect_results(struct sk_buff *msg, 17339 struct cfg80211_wowlan_wakeup *wakeup) 17340 { 17341 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 17342 struct nlattr *nl_results, *nl_match, *nl_freqs; 17343 int i, j; 17344 17345 nl_results = nla_nest_start_noflag(msg, 17346 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 17347 if (!nl_results) 17348 return -EMSGSIZE; 17349 17350 for (i = 0; i < nd->n_matches; i++) { 17351 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 17352 17353 nl_match = nla_nest_start_noflag(msg, i); 17354 if (!nl_match) 17355 break; 17356 17357 /* The SSID attribute is optional in nl80211, but for 17358 * simplicity reasons it's always present in the 17359 * cfg80211 structure. If a driver can't pass the 17360 * SSID, that needs to be changed. A zero length SSID 17361 * is still a valid SSID (wildcard), so it cannot be 17362 * used for this purpose. 17363 */ 17364 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 17365 match->ssid.ssid)) { 17366 nla_nest_cancel(msg, nl_match); 17367 goto out; 17368 } 17369 17370 if (match->n_channels) { 17371 nl_freqs = nla_nest_start_noflag(msg, 17372 NL80211_ATTR_SCAN_FREQUENCIES); 17373 if (!nl_freqs) { 17374 nla_nest_cancel(msg, nl_match); 17375 goto out; 17376 } 17377 17378 for (j = 0; j < match->n_channels; j++) { 17379 if (nla_put_u32(msg, j, match->channels[j])) { 17380 nla_nest_cancel(msg, nl_freqs); 17381 nla_nest_cancel(msg, nl_match); 17382 goto out; 17383 } 17384 } 17385 17386 nla_nest_end(msg, nl_freqs); 17387 } 17388 17389 nla_nest_end(msg, nl_match); 17390 } 17391 17392 out: 17393 nla_nest_end(msg, nl_results); 17394 return 0; 17395 } 17396 17397 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 17398 struct cfg80211_wowlan_wakeup *wakeup, 17399 gfp_t gfp) 17400 { 17401 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17402 struct sk_buff *msg; 17403 void *hdr; 17404 int size = 200; 17405 17406 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 17407 17408 if (wakeup) 17409 size += wakeup->packet_present_len; 17410 17411 msg = nlmsg_new(size, gfp); 17412 if (!msg) 17413 return; 17414 17415 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 17416 if (!hdr) 17417 goto free_msg; 17418 17419 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17420 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17421 NL80211_ATTR_PAD)) 17422 goto free_msg; 17423 17424 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17425 wdev->netdev->ifindex)) 17426 goto free_msg; 17427 17428 if (wakeup) { 17429 struct nlattr *reasons; 17430 17431 reasons = nla_nest_start_noflag(msg, 17432 NL80211_ATTR_WOWLAN_TRIGGERS); 17433 if (!reasons) 17434 goto free_msg; 17435 17436 if (wakeup->disconnect && 17437 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 17438 goto free_msg; 17439 if (wakeup->magic_pkt && 17440 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 17441 goto free_msg; 17442 if (wakeup->gtk_rekey_failure && 17443 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 17444 goto free_msg; 17445 if (wakeup->eap_identity_req && 17446 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 17447 goto free_msg; 17448 if (wakeup->four_way_handshake && 17449 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 17450 goto free_msg; 17451 if (wakeup->rfkill_release && 17452 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 17453 goto free_msg; 17454 17455 if (wakeup->pattern_idx >= 0 && 17456 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 17457 wakeup->pattern_idx)) 17458 goto free_msg; 17459 17460 if (wakeup->tcp_match && 17461 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 17462 goto free_msg; 17463 17464 if (wakeup->tcp_connlost && 17465 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 17466 goto free_msg; 17467 17468 if (wakeup->tcp_nomoretokens && 17469 nla_put_flag(msg, 17470 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 17471 goto free_msg; 17472 17473 if (wakeup->packet) { 17474 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 17475 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 17476 17477 if (!wakeup->packet_80211) { 17478 pkt_attr = 17479 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 17480 len_attr = 17481 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 17482 } 17483 17484 if (wakeup->packet_len && 17485 nla_put_u32(msg, len_attr, wakeup->packet_len)) 17486 goto free_msg; 17487 17488 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 17489 wakeup->packet)) 17490 goto free_msg; 17491 } 17492 17493 if (wakeup->net_detect && 17494 cfg80211_net_detect_results(msg, wakeup)) 17495 goto free_msg; 17496 17497 nla_nest_end(msg, reasons); 17498 } 17499 17500 genlmsg_end(msg, hdr); 17501 17502 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17503 NL80211_MCGRP_MLME, gfp); 17504 return; 17505 17506 free_msg: 17507 nlmsg_free(msg); 17508 } 17509 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 17510 #endif 17511 17512 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 17513 enum nl80211_tdls_operation oper, 17514 u16 reason_code, gfp_t gfp) 17515 { 17516 struct wireless_dev *wdev = dev->ieee80211_ptr; 17517 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17518 struct sk_buff *msg; 17519 void *hdr; 17520 17521 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 17522 reason_code); 17523 17524 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17525 if (!msg) 17526 return; 17527 17528 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 17529 if (!hdr) { 17530 nlmsg_free(msg); 17531 return; 17532 } 17533 17534 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17535 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17536 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 17537 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 17538 (reason_code > 0 && 17539 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 17540 goto nla_put_failure; 17541 17542 genlmsg_end(msg, hdr); 17543 17544 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17545 NL80211_MCGRP_MLME, gfp); 17546 return; 17547 17548 nla_put_failure: 17549 nlmsg_free(msg); 17550 } 17551 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 17552 17553 static int nl80211_netlink_notify(struct notifier_block * nb, 17554 unsigned long state, 17555 void *_notify) 17556 { 17557 struct netlink_notify *notify = _notify; 17558 struct cfg80211_registered_device *rdev; 17559 struct wireless_dev *wdev; 17560 struct cfg80211_beacon_registration *reg, *tmp; 17561 17562 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 17563 return NOTIFY_DONE; 17564 17565 rcu_read_lock(); 17566 17567 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 17568 struct cfg80211_sched_scan_request *sched_scan_req; 17569 17570 list_for_each_entry_rcu(sched_scan_req, 17571 &rdev->sched_scan_req_list, 17572 list) { 17573 if (sched_scan_req->owner_nlportid == notify->portid) { 17574 sched_scan_req->nl_owner_dead = true; 17575 schedule_work(&rdev->sched_scan_stop_wk); 17576 } 17577 } 17578 17579 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 17580 cfg80211_mlme_unregister_socket(wdev, notify->portid); 17581 17582 if (wdev->owner_nlportid == notify->portid) { 17583 wdev->nl_owner_dead = true; 17584 schedule_work(&rdev->destroy_work); 17585 } else if (wdev->conn_owner_nlportid == notify->portid) { 17586 schedule_work(&wdev->disconnect_wk); 17587 } 17588 17589 cfg80211_release_pmsr(wdev, notify->portid); 17590 } 17591 17592 spin_lock_bh(&rdev->beacon_registrations_lock); 17593 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 17594 list) { 17595 if (reg->nlportid == notify->portid) { 17596 list_del(®->list); 17597 kfree(reg); 17598 break; 17599 } 17600 } 17601 spin_unlock_bh(&rdev->beacon_registrations_lock); 17602 } 17603 17604 rcu_read_unlock(); 17605 17606 /* 17607 * It is possible that the user space process that is controlling the 17608 * indoor setting disappeared, so notify the regulatory core. 17609 */ 17610 regulatory_netlink_notify(notify->portid); 17611 return NOTIFY_OK; 17612 } 17613 17614 static struct notifier_block nl80211_netlink_notifier = { 17615 .notifier_call = nl80211_netlink_notify, 17616 }; 17617 17618 void cfg80211_ft_event(struct net_device *netdev, 17619 struct cfg80211_ft_event_params *ft_event) 17620 { 17621 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17622 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17623 struct sk_buff *msg; 17624 void *hdr; 17625 17626 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 17627 17628 if (!ft_event->target_ap) 17629 return; 17630 17631 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 17632 GFP_KERNEL); 17633 if (!msg) 17634 return; 17635 17636 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 17637 if (!hdr) 17638 goto out; 17639 17640 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17641 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17642 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 17643 goto out; 17644 17645 if (ft_event->ies && 17646 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 17647 goto out; 17648 if (ft_event->ric_ies && 17649 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 17650 ft_event->ric_ies)) 17651 goto out; 17652 17653 genlmsg_end(msg, hdr); 17654 17655 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17656 NL80211_MCGRP_MLME, GFP_KERNEL); 17657 return; 17658 out: 17659 nlmsg_free(msg); 17660 } 17661 EXPORT_SYMBOL(cfg80211_ft_event); 17662 17663 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 17664 { 17665 struct cfg80211_registered_device *rdev; 17666 struct sk_buff *msg; 17667 void *hdr; 17668 u32 nlportid; 17669 17670 rdev = wiphy_to_rdev(wdev->wiphy); 17671 if (!rdev->crit_proto_nlportid) 17672 return; 17673 17674 nlportid = rdev->crit_proto_nlportid; 17675 rdev->crit_proto_nlportid = 0; 17676 17677 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17678 if (!msg) 17679 return; 17680 17681 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 17682 if (!hdr) 17683 goto nla_put_failure; 17684 17685 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17686 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17687 NL80211_ATTR_PAD)) 17688 goto nla_put_failure; 17689 17690 genlmsg_end(msg, hdr); 17691 17692 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 17693 return; 17694 17695 nla_put_failure: 17696 nlmsg_free(msg); 17697 } 17698 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 17699 17700 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 17701 { 17702 struct wiphy *wiphy = wdev->wiphy; 17703 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17704 struct sk_buff *msg; 17705 void *hdr; 17706 17707 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17708 if (!msg) 17709 return; 17710 17711 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 17712 if (!hdr) 17713 goto out; 17714 17715 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17716 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 17717 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17718 NL80211_ATTR_PAD)) 17719 goto out; 17720 17721 genlmsg_end(msg, hdr); 17722 17723 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 17724 NL80211_MCGRP_MLME, GFP_KERNEL); 17725 return; 17726 out: 17727 nlmsg_free(msg); 17728 } 17729 17730 int cfg80211_external_auth_request(struct net_device *dev, 17731 struct cfg80211_external_auth_params *params, 17732 gfp_t gfp) 17733 { 17734 struct wireless_dev *wdev = dev->ieee80211_ptr; 17735 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17736 struct sk_buff *msg; 17737 void *hdr; 17738 17739 if (!wdev->conn_owner_nlportid) 17740 return -EINVAL; 17741 17742 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17743 if (!msg) 17744 return -ENOMEM; 17745 17746 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 17747 if (!hdr) 17748 goto nla_put_failure; 17749 17750 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17751 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17752 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 17753 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 17754 params->action) || 17755 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 17756 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 17757 params->ssid.ssid)) 17758 goto nla_put_failure; 17759 17760 genlmsg_end(msg, hdr); 17761 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 17762 wdev->conn_owner_nlportid); 17763 return 0; 17764 17765 nla_put_failure: 17766 nlmsg_free(msg); 17767 return -ENOBUFS; 17768 } 17769 EXPORT_SYMBOL(cfg80211_external_auth_request); 17770 17771 void cfg80211_update_owe_info_event(struct net_device *netdev, 17772 struct cfg80211_update_owe_info *owe_info, 17773 gfp_t gfp) 17774 { 17775 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17776 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17777 struct sk_buff *msg; 17778 void *hdr; 17779 17780 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 17781 17782 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17783 if (!msg) 17784 return; 17785 17786 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 17787 if (!hdr) 17788 goto nla_put_failure; 17789 17790 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17791 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17792 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 17793 goto nla_put_failure; 17794 17795 if (!owe_info->ie_len || 17796 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 17797 goto nla_put_failure; 17798 17799 genlmsg_end(msg, hdr); 17800 17801 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17802 NL80211_MCGRP_MLME, gfp); 17803 return; 17804 17805 nla_put_failure: 17806 genlmsg_cancel(msg, hdr); 17807 nlmsg_free(msg); 17808 } 17809 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 17810 17811 /* initialisation/exit functions */ 17812 17813 int __init nl80211_init(void) 17814 { 17815 int err; 17816 17817 err = genl_register_family(&nl80211_fam); 17818 if (err) 17819 return err; 17820 17821 err = netlink_register_notifier(&nl80211_netlink_notifier); 17822 if (err) 17823 goto err_out; 17824 17825 return 0; 17826 err_out: 17827 genl_unregister_family(&nl80211_fam); 17828 return err; 17829 } 17830 17831 void nl80211_exit(void) 17832 { 17833 netlink_unregister_notifier(&nl80211_netlink_notifier); 17834 genl_unregister_family(&nl80211_fam); 17835 } 17836