1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2022 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev, 68 struct net *netns, struct nlattr **attrs) 69 { 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id = 0; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 if (!have_ifidx && !have_wdev_id) 78 return ERR_PTR(-EINVAL); 79 80 if (have_ifidx) 81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 82 if (have_wdev_id) { 83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 84 wiphy_idx = wdev_id >> 32; 85 } 86 87 if (rdev) { 88 struct wireless_dev *wdev; 89 90 lockdep_assert_held(&rdev->wiphy.mtx); 91 92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 93 if (have_ifidx && wdev->netdev && 94 wdev->netdev->ifindex == ifidx) { 95 result = wdev; 96 break; 97 } 98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 99 result = wdev; 100 break; 101 } 102 } 103 104 return result ?: ERR_PTR(-ENODEV); 105 } 106 107 ASSERT_RTNL(); 108 109 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 110 struct wireless_dev *wdev; 111 112 if (wiphy_net(&rdev->wiphy) != netns) 113 continue; 114 115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 116 continue; 117 118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 119 if (have_ifidx && wdev->netdev && 120 wdev->netdev->ifindex == ifidx) { 121 result = wdev; 122 break; 123 } 124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 125 result = wdev; 126 break; 127 } 128 } 129 130 if (result) 131 break; 132 } 133 134 if (result) 135 return result; 136 return ERR_PTR(-ENODEV); 137 } 138 139 static struct cfg80211_registered_device * 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 141 { 142 struct cfg80211_registered_device *rdev = NULL, *tmp; 143 struct net_device *netdev; 144 145 ASSERT_RTNL(); 146 147 if (!attrs[NL80211_ATTR_WIPHY] && 148 !attrs[NL80211_ATTR_IFINDEX] && 149 !attrs[NL80211_ATTR_WDEV]) 150 return ERR_PTR(-EINVAL); 151 152 if (attrs[NL80211_ATTR_WIPHY]) 153 rdev = cfg80211_rdev_by_wiphy_idx( 154 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 155 156 if (attrs[NL80211_ATTR_WDEV]) { 157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 158 struct wireless_dev *wdev; 159 bool found = false; 160 161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 162 if (tmp) { 163 /* make sure wdev exists */ 164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 165 if (wdev->identifier != (u32)wdev_id) 166 continue; 167 found = true; 168 break; 169 } 170 171 if (!found) 172 tmp = NULL; 173 174 if (rdev && tmp != rdev) 175 return ERR_PTR(-EINVAL); 176 rdev = tmp; 177 } 178 } 179 180 if (attrs[NL80211_ATTR_IFINDEX]) { 181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 182 183 netdev = __dev_get_by_index(netns, ifindex); 184 if (netdev) { 185 if (netdev->ieee80211_ptr) 186 tmp = wiphy_to_rdev( 187 netdev->ieee80211_ptr->wiphy); 188 else 189 tmp = NULL; 190 191 /* not wireless device -- return error */ 192 if (!tmp) 193 return ERR_PTR(-EINVAL); 194 195 /* mismatch -- return error */ 196 if (rdev && tmp != rdev) 197 return ERR_PTR(-EINVAL); 198 199 rdev = tmp; 200 } 201 } 202 203 if (!rdev) 204 return ERR_PTR(-ENODEV); 205 206 if (netns != wiphy_net(&rdev->wiphy)) 207 return ERR_PTR(-ENODEV); 208 209 return rdev; 210 } 211 212 /* 213 * This function returns a pointer to the driver 214 * that the genl_info item that is passed refers to. 215 * 216 * The result of this can be a PTR_ERR and hence must 217 * be checked with IS_ERR() for errors. 218 */ 219 static struct cfg80211_registered_device * 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 221 { 222 return __cfg80211_rdev_from_attrs(netns, info->attrs); 223 } 224 225 static int validate_beacon_head(const struct nlattr *attr, 226 struct netlink_ext_ack *extack) 227 { 228 const u8 *data = nla_data(attr); 229 unsigned int len = nla_len(attr); 230 const struct element *elem; 231 const struct ieee80211_mgmt *mgmt = (void *)data; 232 unsigned int fixedlen, hdrlen; 233 bool s1g_bcn; 234 235 if (len < offsetofend(typeof(*mgmt), frame_control)) 236 goto err; 237 238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 239 if (s1g_bcn) { 240 fixedlen = offsetof(struct ieee80211_ext, 241 u.s1g_beacon.variable); 242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 243 } else { 244 fixedlen = offsetof(struct ieee80211_mgmt, 245 u.beacon.variable); 246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 247 } 248 249 if (len < fixedlen) 250 goto err; 251 252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 253 goto err; 254 255 data += fixedlen; 256 len -= fixedlen; 257 258 for_each_element(elem, data, len) { 259 /* nothing */ 260 } 261 262 if (for_each_element_completed(elem, data, len)) 263 return 0; 264 265 err: 266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 267 return -EINVAL; 268 } 269 270 static int validate_ie_attr(const struct nlattr *attr, 271 struct netlink_ext_ack *extack) 272 { 273 const u8 *data = nla_data(attr); 274 unsigned int len = nla_len(attr); 275 const struct element *elem; 276 277 for_each_element(elem, data, len) { 278 /* nothing */ 279 } 280 281 if (for_each_element_completed(elem, data, len)) 282 return 0; 283 284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 285 return -EINVAL; 286 } 287 288 static int validate_he_capa(const struct nlattr *attr, 289 struct netlink_ext_ack *extack) 290 { 291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr))) 292 return -EINVAL; 293 294 return 0; 295 } 296 297 /* policy for the attributes */ 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 299 300 static const struct nla_policy 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 304 .len = U8_MAX }, 305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 306 .len = U8_MAX }, 307 }; 308 309 static const struct nla_policy 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 314 NLA_POLICY_MAX(NLA_U8, 15), 315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 317 NLA_POLICY_MAX(NLA_U8, 15), 318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 319 NLA_POLICY_MAX(NLA_U8, 31), 320 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 322 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 323 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 324 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 325 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG }, 326 }; 327 328 static const struct nla_policy 329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 330 [NL80211_PMSR_TYPE_FTM] = 331 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 332 }; 333 334 static const struct nla_policy 335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 336 [NL80211_PMSR_REQ_ATTR_DATA] = 337 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 338 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 339 }; 340 341 static const struct nla_policy 342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 343 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 344 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 345 [NL80211_PMSR_PEER_ATTR_REQ] = 346 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 347 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 348 }; 349 350 static const struct nla_policy 351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 352 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 353 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 354 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 355 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 356 [NL80211_PMSR_ATTR_PEERS] = 357 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy), 358 }; 359 360 static const struct nla_policy 361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 362 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 363 NLA_POLICY_RANGE(NLA_U8, 1, 20), 364 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 365 NLA_POLICY_RANGE(NLA_U8, 1, 20), 366 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 367 NLA_POLICY_RANGE(NLA_U8, 1, 20), 368 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 369 NLA_POLICY_EXACT_LEN(8), 370 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 371 NLA_POLICY_EXACT_LEN(8), 372 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 373 }; 374 375 static const struct nla_policy 376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 377 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 378 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 379 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 380 }; 381 382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 383 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 384 .len = NL80211_MAX_SUPP_RATES }, 385 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 386 .len = NL80211_MAX_SUPP_HT_RATES }, 387 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 388 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 389 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 390 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 391 NL80211_RATE_INFO_HE_GI_0_8, 392 NL80211_RATE_INFO_HE_GI_3_2), 393 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 394 NL80211_RATE_INFO_HE_1XLTF, 395 NL80211_RATE_INFO_HE_4XLTF), 396 }; 397 398 static const struct nla_policy 399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 400 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 401 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 402 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 403 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 404 [NL80211_TID_CONFIG_ATTR_NOACK] = 405 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 406 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 407 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 408 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 409 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 410 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 411 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 412 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 413 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 414 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 415 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 416 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 417 NLA_POLICY_NESTED(nl80211_txattr_policy), 418 }; 419 420 static const struct nla_policy 421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 422 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 423 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 424 [NL80211_FILS_DISCOVERY_ATTR_TMPL] = 425 NLA_POLICY_RANGE(NLA_BINARY, 426 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 427 IEEE80211_MAX_DATA_LEN), 428 }; 429 430 static const struct nla_policy 431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 432 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 434 .len = IEEE80211_MAX_DATA_LEN } 435 }; 436 437 static const struct nla_policy 438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = { 439 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 }, 440 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 }, 441 }; 442 443 static const struct nla_policy 444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = { 445 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE), 446 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy), 447 }; 448 449 static const struct nla_policy 450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = { 451 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2), 452 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] = 453 NLA_POLICY_MIN(NLA_U8, 1), 454 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 }, 455 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 }, 456 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG }, 457 }; 458 459 static const struct nla_policy 460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 461 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 462 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 463 }; 464 465 static struct netlink_range_validation nl80211_punct_bitmap_range = { 466 .min = 0, 467 .max = 0xffff, 468 }; 469 470 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 471 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 472 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 473 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 474 .len = 20-1 }, 475 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 476 477 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 478 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 479 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 480 NL80211_EDMG_CHANNELS_MIN, 481 NL80211_EDMG_CHANNELS_MAX), 482 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 483 NL80211_EDMG_BW_CONFIG_MIN, 484 NL80211_EDMG_BW_CONFIG_MAX), 485 486 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 487 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 488 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 489 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 490 491 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 492 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 493 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 494 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 495 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 496 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 497 498 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 499 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 500 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 501 502 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 503 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 504 505 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 506 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 507 .len = WLAN_MAX_KEY_LEN }, 508 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 509 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 510 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 512 [NL80211_ATTR_KEY_TYPE] = 513 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 514 515 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 516 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 517 [NL80211_ATTR_BEACON_HEAD] = 518 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 519 IEEE80211_MAX_DATA_LEN), 520 [NL80211_ATTR_BEACON_TAIL] = 521 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 522 IEEE80211_MAX_DATA_LEN), 523 [NL80211_ATTR_STA_AID] = 524 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 525 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 526 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 527 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 528 .len = NL80211_MAX_SUPP_RATES }, 529 [NL80211_ATTR_STA_PLINK_ACTION] = 530 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 531 [NL80211_ATTR_STA_TX_POWER_SETTING] = 532 NLA_POLICY_RANGE(NLA_U8, 533 NL80211_TX_POWER_AUTOMATIC, 534 NL80211_TX_POWER_FIXED), 535 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 536 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 537 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 538 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 539 .len = IEEE80211_MAX_MESH_ID_LEN }, 540 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 541 542 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 543 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 544 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 545 546 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 547 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 548 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 549 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 550 .len = NL80211_MAX_SUPP_RATES }, 551 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 552 553 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 554 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 555 556 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 557 558 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 559 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 560 validate_ie_attr, 561 IEEE80211_MAX_DATA_LEN), 562 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 563 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 564 565 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 566 .len = IEEE80211_MAX_SSID_LEN }, 567 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 568 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 569 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 570 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 572 NL80211_MFP_NO, 573 NL80211_MFP_OPTIONAL), 574 [NL80211_ATTR_STA_FLAGS2] = 575 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)), 576 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 577 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 578 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 579 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 580 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 581 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 582 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 583 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 584 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 585 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 586 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 587 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 588 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 589 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 590 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 591 .len = IEEE80211_MAX_DATA_LEN }, 592 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 593 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 594 NL80211_PS_DISABLED, 595 NL80211_PS_ENABLED), 596 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 597 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 598 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 599 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 600 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 601 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 602 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 603 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 604 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 605 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 606 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 607 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 608 [NL80211_ATTR_STA_PLINK_STATE] = 609 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 610 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 611 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 612 [NL80211_ATTR_MESH_PEER_AID] = 613 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 614 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 615 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 616 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 617 [NL80211_ATTR_HIDDEN_SSID] = 618 NLA_POLICY_RANGE(NLA_U32, 619 NL80211_HIDDEN_SSID_NOT_IN_USE, 620 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 621 [NL80211_ATTR_IE_PROBE_RESP] = 622 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 623 IEEE80211_MAX_DATA_LEN), 624 [NL80211_ATTR_IE_ASSOC_RESP] = 625 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 626 IEEE80211_MAX_DATA_LEN), 627 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 628 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy), 629 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 630 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 631 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 632 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 633 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 634 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 635 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 636 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 637 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 638 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 639 .len = IEEE80211_MAX_DATA_LEN }, 640 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 641 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 642 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 643 .len = NL80211_HT_CAPABILITY_LEN 644 }, 645 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 646 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 647 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 648 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 649 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 650 651 /* need to include at least Auth Transaction and Status Code */ 652 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 653 654 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 655 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 656 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 657 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 658 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 659 NLA_POLICY_RANGE(NLA_U32, 660 NL80211_MESH_POWER_UNKNOWN + 1, 661 NL80211_MESH_POWER_MAX), 662 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 663 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 664 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 665 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 666 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 667 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 668 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 669 .len = NL80211_VHT_CAPABILITY_LEN, 670 }, 671 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 672 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 673 .len = IEEE80211_MAX_DATA_LEN }, 674 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 675 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 676 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 677 [NL80211_ATTR_PEER_AID] = 678 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 679 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 680 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 681 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 682 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 683 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 684 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 685 /* 686 * The value of the Length field of the Supported Operating 687 * Classes element is between 2 and 253. 688 */ 689 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 690 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 691 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 692 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 693 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 694 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 695 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 696 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 697 IEEE80211_QOS_MAP_LEN_MIN, 698 IEEE80211_QOS_MAP_LEN_MAX), 699 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 700 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 701 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 702 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 703 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 704 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 705 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 706 [NL80211_ATTR_USER_PRIO] = 707 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 708 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 709 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 710 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 711 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 712 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 713 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 714 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 715 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 716 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 717 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 718 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 719 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 720 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 721 .len = VHT_MUMIMO_GROUPS_DATA_LEN 722 }, 723 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 724 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 725 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 726 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 727 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 728 .len = FILS_MAX_KEK_LEN }, 729 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 730 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 731 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 732 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 733 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 734 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 735 }, 736 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 737 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 738 .len = FILS_ERP_MAX_USERNAME_LEN }, 739 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 740 .len = FILS_ERP_MAX_REALM_LEN }, 741 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 742 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 743 .len = FILS_ERP_MAX_RRK_LEN }, 744 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 745 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 746 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 747 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 748 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 749 750 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 751 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 752 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 753 [NL80211_ATTR_HE_CAPABILITY] = 754 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, 755 NL80211_HE_MAX_CAPABILITY_LEN), 756 [NL80211_ATTR_FTM_RESPONDER] = 757 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 758 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 759 [NL80211_ATTR_PEER_MEASUREMENTS] = 760 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 761 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 762 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 763 .len = SAE_PASSWORD_MAX_LEN }, 764 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 765 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 766 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 767 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 768 [NL80211_ATTR_TID_CONFIG] = 769 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 770 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 771 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 772 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 773 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 774 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 775 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 776 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 777 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 778 [NL80211_ATTR_FILS_DISCOVERY] = 779 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 780 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 781 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 782 [NL80211_ATTR_S1G_CAPABILITY] = 783 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 784 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 785 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 786 [NL80211_ATTR_SAE_PWE] = 787 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK, 788 NL80211_SAE_PWE_BOTH), 789 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT }, 790 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy), 791 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG }, 792 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 }, 793 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 }, 794 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 }, 795 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy), 796 [NL80211_ATTR_MBSSID_CONFIG] = 797 NLA_POLICY_NESTED(nl80211_mbssid_config_policy), 798 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED }, 799 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG }, 800 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 }, 801 [NL80211_ATTR_EHT_CAPABILITY] = 802 NLA_POLICY_RANGE(NLA_BINARY, 803 NL80211_EHT_MIN_CAPABILITY_LEN, 804 NL80211_EHT_MAX_CAPABILITY_LEN), 805 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG }, 806 [NL80211_ATTR_MLO_LINKS] = 807 NLA_POLICY_NESTED_ARRAY(nl80211_policy), 808 [NL80211_ATTR_MLO_LINK_ID] = 809 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS), 810 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN), 811 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG }, 812 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT }, 813 [NL80211_ATTR_PUNCT_BITMAP] = 814 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range), 815 }; 816 817 /* policy for the key attributes */ 818 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 819 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 820 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 821 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 822 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 823 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 824 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 825 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 826 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 827 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 828 }; 829 830 /* policy for the key default flags */ 831 static const struct nla_policy 832 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 833 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 834 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 835 }; 836 837 #ifdef CONFIG_PM 838 /* policy for WoWLAN attributes */ 839 static const struct nla_policy 840 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 841 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 842 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 843 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 844 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 845 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 846 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 847 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 848 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 849 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 850 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 851 }; 852 853 static const struct nla_policy 854 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 855 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 856 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 857 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 858 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 859 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 860 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 861 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 862 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 863 }, 864 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 865 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 866 }, 867 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 868 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 869 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 870 }; 871 #endif /* CONFIG_PM */ 872 873 /* policy for coalesce rule attributes */ 874 static const struct nla_policy 875 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 876 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 877 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 878 NLA_POLICY_RANGE(NLA_U32, 879 NL80211_COALESCE_CONDITION_MATCH, 880 NL80211_COALESCE_CONDITION_NO_MATCH), 881 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 882 }; 883 884 /* policy for GTK rekey offload attributes */ 885 static const struct nla_policy 886 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 887 [NL80211_REKEY_DATA_KEK] = { 888 .type = NLA_BINARY, 889 .len = NL80211_KEK_EXT_LEN 890 }, 891 [NL80211_REKEY_DATA_KCK] = { 892 .type = NLA_BINARY, 893 .len = NL80211_KCK_EXT_LEN_32 894 }, 895 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 896 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 897 }; 898 899 static const struct nla_policy 900 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 901 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 902 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 903 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 904 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 905 [NL80211_BAND_LC] = { .type = NLA_S32 }, 906 }; 907 908 static const struct nla_policy 909 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 910 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 911 .len = IEEE80211_MAX_SSID_LEN }, 912 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 913 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 914 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 915 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 916 }; 917 918 static const struct nla_policy 919 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 920 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 921 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 922 }; 923 924 static const struct nla_policy 925 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 926 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 927 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 928 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 929 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 930 }, 931 }; 932 933 /* policy for NAN function attributes */ 934 static const struct nla_policy 935 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 936 [NL80211_NAN_FUNC_TYPE] = 937 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 938 [NL80211_NAN_FUNC_SERVICE_ID] = { 939 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 940 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 941 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 942 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 943 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 944 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 945 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 946 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 947 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 948 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 949 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 950 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 951 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 952 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 953 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 954 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 955 }; 956 957 /* policy for Service Response Filter attributes */ 958 static const struct nla_policy 959 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 960 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 961 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 962 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 963 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 964 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 965 }; 966 967 /* policy for packet pattern attributes */ 968 static const struct nla_policy 969 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 970 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 971 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 972 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 973 }; 974 975 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 976 struct cfg80211_registered_device **rdev, 977 struct wireless_dev **wdev, 978 struct nlattr **attrbuf) 979 { 980 int err; 981 982 if (!cb->args[0]) { 983 struct nlattr **attrbuf_free = NULL; 984 985 if (!attrbuf) { 986 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 987 GFP_KERNEL); 988 if (!attrbuf) 989 return -ENOMEM; 990 attrbuf_free = attrbuf; 991 } 992 993 err = nlmsg_parse_deprecated(cb->nlh, 994 GENL_HDRLEN + nl80211_fam.hdrsize, 995 attrbuf, nl80211_fam.maxattr, 996 nl80211_policy, NULL); 997 if (err) { 998 kfree(attrbuf_free); 999 return err; 1000 } 1001 1002 rtnl_lock(); 1003 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk), 1004 attrbuf); 1005 kfree(attrbuf_free); 1006 if (IS_ERR(*wdev)) { 1007 rtnl_unlock(); 1008 return PTR_ERR(*wdev); 1009 } 1010 *rdev = wiphy_to_rdev((*wdev)->wiphy); 1011 mutex_lock(&(*rdev)->wiphy.mtx); 1012 rtnl_unlock(); 1013 /* 0 is the first index - add 1 to parse only once */ 1014 cb->args[0] = (*rdev)->wiphy_idx + 1; 1015 cb->args[1] = (*wdev)->identifier; 1016 } else { 1017 /* subtract the 1 again here */ 1018 struct wiphy *wiphy; 1019 struct wireless_dev *tmp; 1020 1021 rtnl_lock(); 1022 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 1023 if (!wiphy) { 1024 rtnl_unlock(); 1025 return -ENODEV; 1026 } 1027 *rdev = wiphy_to_rdev(wiphy); 1028 *wdev = NULL; 1029 1030 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 1031 if (tmp->identifier == cb->args[1]) { 1032 *wdev = tmp; 1033 break; 1034 } 1035 } 1036 1037 if (!*wdev) { 1038 rtnl_unlock(); 1039 return -ENODEV; 1040 } 1041 mutex_lock(&(*rdev)->wiphy.mtx); 1042 rtnl_unlock(); 1043 } 1044 1045 return 0; 1046 } 1047 1048 /* message building helper */ 1049 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 1050 int flags, u8 cmd) 1051 { 1052 /* since there is no private header just add the generic one */ 1053 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 1054 } 1055 1056 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 1057 const struct ieee80211_reg_rule *rule) 1058 { 1059 int j; 1060 struct nlattr *nl_wmm_rules = 1061 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 1062 1063 if (!nl_wmm_rules) 1064 goto nla_put_failure; 1065 1066 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 1067 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 1068 1069 if (!nl_wmm_rule) 1070 goto nla_put_failure; 1071 1072 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 1073 rule->wmm_rule.client[j].cw_min) || 1074 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 1075 rule->wmm_rule.client[j].cw_max) || 1076 nla_put_u8(msg, NL80211_WMMR_AIFSN, 1077 rule->wmm_rule.client[j].aifsn) || 1078 nla_put_u16(msg, NL80211_WMMR_TXOP, 1079 rule->wmm_rule.client[j].cot)) 1080 goto nla_put_failure; 1081 1082 nla_nest_end(msg, nl_wmm_rule); 1083 } 1084 nla_nest_end(msg, nl_wmm_rules); 1085 1086 return 0; 1087 1088 nla_put_failure: 1089 return -ENOBUFS; 1090 } 1091 1092 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 1093 struct ieee80211_channel *chan, 1094 bool large) 1095 { 1096 /* Some channels must be completely excluded from the 1097 * list to protect old user-space tools from breaking 1098 */ 1099 if (!large && chan->flags & 1100 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 1101 return 0; 1102 if (!large && chan->freq_offset) 1103 return 0; 1104 1105 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 1106 chan->center_freq)) 1107 goto nla_put_failure; 1108 1109 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 1110 goto nla_put_failure; 1111 1112 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1113 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1114 goto nla_put_failure; 1115 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1116 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1117 goto nla_put_failure; 1118 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1119 goto nla_put_failure; 1120 } 1121 if (chan->flags & IEEE80211_CHAN_RADAR) { 1122 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1123 goto nla_put_failure; 1124 if (large) { 1125 u32 time; 1126 1127 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1128 1129 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1130 chan->dfs_state)) 1131 goto nla_put_failure; 1132 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1133 time)) 1134 goto nla_put_failure; 1135 if (nla_put_u32(msg, 1136 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1137 chan->dfs_cac_ms)) 1138 goto nla_put_failure; 1139 } 1140 } 1141 1142 if (large) { 1143 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1144 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1145 goto nla_put_failure; 1146 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1147 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1148 goto nla_put_failure; 1149 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1150 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1151 goto nla_put_failure; 1152 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1153 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1154 goto nla_put_failure; 1155 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1156 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1157 goto nla_put_failure; 1158 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1159 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1160 goto nla_put_failure; 1161 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1162 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1163 goto nla_put_failure; 1164 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1165 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1166 goto nla_put_failure; 1167 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1168 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1169 goto nla_put_failure; 1170 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1171 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1172 goto nla_put_failure; 1173 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1174 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1175 goto nla_put_failure; 1176 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1177 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1178 goto nla_put_failure; 1179 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1180 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1181 goto nla_put_failure; 1182 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1183 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1184 goto nla_put_failure; 1185 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) && 1186 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ)) 1187 goto nla_put_failure; 1188 if ((chan->flags & IEEE80211_CHAN_NO_EHT) && 1189 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT)) 1190 goto nla_put_failure; 1191 } 1192 1193 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1194 DBM_TO_MBM(chan->max_power))) 1195 goto nla_put_failure; 1196 1197 if (large) { 1198 const struct ieee80211_reg_rule *rule = 1199 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1200 1201 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1202 if (nl80211_msg_put_wmm_rules(msg, rule)) 1203 goto nla_put_failure; 1204 } 1205 } 1206 1207 return 0; 1208 1209 nla_put_failure: 1210 return -ENOBUFS; 1211 } 1212 1213 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1214 struct cfg80211_txq_stats *txqstats, 1215 int attrtype) 1216 { 1217 struct nlattr *txqattr; 1218 1219 #define PUT_TXQVAL_U32(attr, memb) do { \ 1220 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1221 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1222 return false; \ 1223 } while (0) 1224 1225 txqattr = nla_nest_start_noflag(msg, attrtype); 1226 if (!txqattr) 1227 return false; 1228 1229 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1230 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1231 PUT_TXQVAL_U32(FLOWS, flows); 1232 PUT_TXQVAL_U32(DROPS, drops); 1233 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1234 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1235 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1236 PUT_TXQVAL_U32(COLLISIONS, collisions); 1237 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1238 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1239 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1240 nla_nest_end(msg, txqattr); 1241 1242 #undef PUT_TXQVAL_U32 1243 return true; 1244 } 1245 1246 /* netlink command implementations */ 1247 1248 /** 1249 * nl80211_link_id - return link ID 1250 * @attrs: attributes to look at 1251 * 1252 * Returns: the link ID or 0 if not given 1253 * 1254 * Note this function doesn't do any validation of the link 1255 * ID validity wrt. links that were actually added, so it must 1256 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID 1257 * or if additional validation is done. 1258 */ 1259 static unsigned int nl80211_link_id(struct nlattr **attrs) 1260 { 1261 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1262 1263 if (!linkid) 1264 return 0; 1265 1266 return nla_get_u8(linkid); 1267 } 1268 1269 static int nl80211_link_id_or_invalid(struct nlattr **attrs) 1270 { 1271 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1272 1273 if (!linkid) 1274 return -1; 1275 1276 return nla_get_u8(linkid); 1277 } 1278 1279 struct key_parse { 1280 struct key_params p; 1281 int idx; 1282 int type; 1283 bool def, defmgmt, defbeacon; 1284 bool def_uni, def_multi; 1285 }; 1286 1287 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1288 struct key_parse *k) 1289 { 1290 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1291 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1292 nl80211_key_policy, 1293 info->extack); 1294 if (err) 1295 return err; 1296 1297 k->def = !!tb[NL80211_KEY_DEFAULT]; 1298 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1299 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1300 1301 if (k->def) { 1302 k->def_uni = true; 1303 k->def_multi = true; 1304 } 1305 if (k->defmgmt || k->defbeacon) 1306 k->def_multi = true; 1307 1308 if (tb[NL80211_KEY_IDX]) 1309 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1310 1311 if (tb[NL80211_KEY_DATA]) { 1312 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1313 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1314 } 1315 1316 if (tb[NL80211_KEY_SEQ]) { 1317 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1318 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1319 } 1320 1321 if (tb[NL80211_KEY_CIPHER]) 1322 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1323 1324 if (tb[NL80211_KEY_TYPE]) 1325 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1326 1327 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1328 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1329 1330 err = nla_parse_nested_deprecated(kdt, 1331 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1332 tb[NL80211_KEY_DEFAULT_TYPES], 1333 nl80211_key_default_policy, 1334 info->extack); 1335 if (err) 1336 return err; 1337 1338 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1339 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1340 } 1341 1342 if (tb[NL80211_KEY_MODE]) 1343 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1344 1345 return 0; 1346 } 1347 1348 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1349 { 1350 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1351 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1352 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1353 } 1354 1355 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1356 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1357 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1358 } 1359 1360 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1361 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1362 1363 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1364 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1365 1366 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1367 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1368 1369 if (k->def) { 1370 k->def_uni = true; 1371 k->def_multi = true; 1372 } 1373 if (k->defmgmt) 1374 k->def_multi = true; 1375 1376 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1377 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1378 1379 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1380 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1381 int err = nla_parse_nested_deprecated(kdt, 1382 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1383 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1384 nl80211_key_default_policy, 1385 info->extack); 1386 if (err) 1387 return err; 1388 1389 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1390 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1391 } 1392 1393 return 0; 1394 } 1395 1396 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1397 { 1398 int err; 1399 1400 memset(k, 0, sizeof(*k)); 1401 k->idx = -1; 1402 k->type = -1; 1403 1404 if (info->attrs[NL80211_ATTR_KEY]) 1405 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1406 else 1407 err = nl80211_parse_key_old(info, k); 1408 1409 if (err) 1410 return err; 1411 1412 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1413 (k->defbeacon ? 1 : 0) > 1) { 1414 GENL_SET_ERR_MSG(info, 1415 "key with multiple default flags is invalid"); 1416 return -EINVAL; 1417 } 1418 1419 if (k->defmgmt || k->defbeacon) { 1420 if (k->def_uni || !k->def_multi) { 1421 GENL_SET_ERR_MSG(info, 1422 "defmgmt/defbeacon key must be mcast"); 1423 return -EINVAL; 1424 } 1425 } 1426 1427 if (k->idx != -1) { 1428 if (k->defmgmt) { 1429 if (k->idx < 4 || k->idx > 5) { 1430 GENL_SET_ERR_MSG(info, 1431 "defmgmt key idx not 4 or 5"); 1432 return -EINVAL; 1433 } 1434 } else if (k->defbeacon) { 1435 if (k->idx < 6 || k->idx > 7) { 1436 GENL_SET_ERR_MSG(info, 1437 "defbeacon key idx not 6 or 7"); 1438 return -EINVAL; 1439 } 1440 } else if (k->def) { 1441 if (k->idx < 0 || k->idx > 3) { 1442 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1443 return -EINVAL; 1444 } 1445 } else { 1446 if (k->idx < 0 || k->idx > 7) { 1447 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1448 return -EINVAL; 1449 } 1450 } 1451 } 1452 1453 return 0; 1454 } 1455 1456 static struct cfg80211_cached_keys * 1457 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1458 struct genl_info *info, bool *no_ht) 1459 { 1460 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1461 struct key_parse parse; 1462 struct nlattr *key; 1463 struct cfg80211_cached_keys *result; 1464 int rem, err, def = 0; 1465 bool have_key = false; 1466 1467 nla_for_each_nested(key, keys, rem) { 1468 have_key = true; 1469 break; 1470 } 1471 1472 if (!have_key) 1473 return NULL; 1474 1475 result = kzalloc(sizeof(*result), GFP_KERNEL); 1476 if (!result) 1477 return ERR_PTR(-ENOMEM); 1478 1479 result->def = -1; 1480 1481 nla_for_each_nested(key, keys, rem) { 1482 memset(&parse, 0, sizeof(parse)); 1483 parse.idx = -1; 1484 1485 err = nl80211_parse_key_new(info, key, &parse); 1486 if (err) 1487 goto error; 1488 err = -EINVAL; 1489 if (!parse.p.key) 1490 goto error; 1491 if (parse.idx < 0 || parse.idx > 3) { 1492 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1493 goto error; 1494 } 1495 if (parse.def) { 1496 if (def) { 1497 GENL_SET_ERR_MSG(info, 1498 "only one key can be default"); 1499 goto error; 1500 } 1501 def = 1; 1502 result->def = parse.idx; 1503 if (!parse.def_uni || !parse.def_multi) 1504 goto error; 1505 } else if (parse.defmgmt) 1506 goto error; 1507 err = cfg80211_validate_key_settings(rdev, &parse.p, 1508 parse.idx, false, NULL); 1509 if (err) 1510 goto error; 1511 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1512 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1513 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1514 err = -EINVAL; 1515 goto error; 1516 } 1517 result->params[parse.idx].cipher = parse.p.cipher; 1518 result->params[parse.idx].key_len = parse.p.key_len; 1519 result->params[parse.idx].key = result->data[parse.idx]; 1520 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1521 1522 /* must be WEP key if we got here */ 1523 if (no_ht) 1524 *no_ht = true; 1525 } 1526 1527 if (result->def < 0) { 1528 err = -EINVAL; 1529 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1530 goto error; 1531 } 1532 1533 return result; 1534 error: 1535 kfree(result); 1536 return ERR_PTR(err); 1537 } 1538 1539 static int nl80211_key_allowed(struct wireless_dev *wdev) 1540 { 1541 ASSERT_WDEV_LOCK(wdev); 1542 1543 switch (wdev->iftype) { 1544 case NL80211_IFTYPE_AP: 1545 case NL80211_IFTYPE_AP_VLAN: 1546 case NL80211_IFTYPE_P2P_GO: 1547 case NL80211_IFTYPE_MESH_POINT: 1548 break; 1549 case NL80211_IFTYPE_ADHOC: 1550 if (wdev->u.ibss.current_bss) 1551 return 0; 1552 return -ENOLINK; 1553 case NL80211_IFTYPE_STATION: 1554 case NL80211_IFTYPE_P2P_CLIENT: 1555 if (wdev->connected) 1556 return 0; 1557 return -ENOLINK; 1558 case NL80211_IFTYPE_NAN: 1559 if (wiphy_ext_feature_isset(wdev->wiphy, 1560 NL80211_EXT_FEATURE_SECURE_NAN)) 1561 return 0; 1562 return -EINVAL; 1563 case NL80211_IFTYPE_UNSPECIFIED: 1564 case NL80211_IFTYPE_OCB: 1565 case NL80211_IFTYPE_MONITOR: 1566 case NL80211_IFTYPE_P2P_DEVICE: 1567 case NL80211_IFTYPE_WDS: 1568 case NUM_NL80211_IFTYPES: 1569 return -EINVAL; 1570 } 1571 1572 return 0; 1573 } 1574 1575 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1576 u32 freq) 1577 { 1578 struct ieee80211_channel *chan; 1579 1580 chan = ieee80211_get_channel_khz(wiphy, freq); 1581 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1582 return NULL; 1583 return chan; 1584 } 1585 1586 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1587 { 1588 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1589 int i; 1590 1591 if (!nl_modes) 1592 goto nla_put_failure; 1593 1594 i = 0; 1595 while (ifmodes) { 1596 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1597 goto nla_put_failure; 1598 ifmodes >>= 1; 1599 i++; 1600 } 1601 1602 nla_nest_end(msg, nl_modes); 1603 return 0; 1604 1605 nla_put_failure: 1606 return -ENOBUFS; 1607 } 1608 1609 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1610 struct sk_buff *msg, 1611 bool large) 1612 { 1613 struct nlattr *nl_combis; 1614 int i, j; 1615 1616 nl_combis = nla_nest_start_noflag(msg, 1617 NL80211_ATTR_INTERFACE_COMBINATIONS); 1618 if (!nl_combis) 1619 goto nla_put_failure; 1620 1621 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1622 const struct ieee80211_iface_combination *c; 1623 struct nlattr *nl_combi, *nl_limits; 1624 1625 c = &wiphy->iface_combinations[i]; 1626 1627 nl_combi = nla_nest_start_noflag(msg, i + 1); 1628 if (!nl_combi) 1629 goto nla_put_failure; 1630 1631 nl_limits = nla_nest_start_noflag(msg, 1632 NL80211_IFACE_COMB_LIMITS); 1633 if (!nl_limits) 1634 goto nla_put_failure; 1635 1636 for (j = 0; j < c->n_limits; j++) { 1637 struct nlattr *nl_limit; 1638 1639 nl_limit = nla_nest_start_noflag(msg, j + 1); 1640 if (!nl_limit) 1641 goto nla_put_failure; 1642 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1643 c->limits[j].max)) 1644 goto nla_put_failure; 1645 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1646 c->limits[j].types)) 1647 goto nla_put_failure; 1648 nla_nest_end(msg, nl_limit); 1649 } 1650 1651 nla_nest_end(msg, nl_limits); 1652 1653 if (c->beacon_int_infra_match && 1654 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1655 goto nla_put_failure; 1656 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1657 c->num_different_channels) || 1658 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1659 c->max_interfaces)) 1660 goto nla_put_failure; 1661 if (large && 1662 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1663 c->radar_detect_widths) || 1664 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1665 c->radar_detect_regions))) 1666 goto nla_put_failure; 1667 if (c->beacon_int_min_gcd && 1668 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1669 c->beacon_int_min_gcd)) 1670 goto nla_put_failure; 1671 1672 nla_nest_end(msg, nl_combi); 1673 } 1674 1675 nla_nest_end(msg, nl_combis); 1676 1677 return 0; 1678 nla_put_failure: 1679 return -ENOBUFS; 1680 } 1681 1682 #ifdef CONFIG_PM 1683 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1684 struct sk_buff *msg) 1685 { 1686 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1687 struct nlattr *nl_tcp; 1688 1689 if (!tcp) 1690 return 0; 1691 1692 nl_tcp = nla_nest_start_noflag(msg, 1693 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1694 if (!nl_tcp) 1695 return -ENOBUFS; 1696 1697 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1698 tcp->data_payload_max)) 1699 return -ENOBUFS; 1700 1701 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1702 tcp->data_payload_max)) 1703 return -ENOBUFS; 1704 1705 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1706 return -ENOBUFS; 1707 1708 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1709 sizeof(*tcp->tok), tcp->tok)) 1710 return -ENOBUFS; 1711 1712 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1713 tcp->data_interval_max)) 1714 return -ENOBUFS; 1715 1716 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1717 tcp->wake_payload_max)) 1718 return -ENOBUFS; 1719 1720 nla_nest_end(msg, nl_tcp); 1721 return 0; 1722 } 1723 1724 static int nl80211_send_wowlan(struct sk_buff *msg, 1725 struct cfg80211_registered_device *rdev, 1726 bool large) 1727 { 1728 struct nlattr *nl_wowlan; 1729 1730 if (!rdev->wiphy.wowlan) 1731 return 0; 1732 1733 nl_wowlan = nla_nest_start_noflag(msg, 1734 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1735 if (!nl_wowlan) 1736 return -ENOBUFS; 1737 1738 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1739 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1740 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1741 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1742 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1743 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1744 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1745 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1746 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1747 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1748 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1749 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1750 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1751 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1752 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1753 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1754 return -ENOBUFS; 1755 1756 if (rdev->wiphy.wowlan->n_patterns) { 1757 struct nl80211_pattern_support pat = { 1758 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1759 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1760 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1761 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1762 }; 1763 1764 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1765 sizeof(pat), &pat)) 1766 return -ENOBUFS; 1767 } 1768 1769 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1770 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1771 rdev->wiphy.wowlan->max_nd_match_sets)) 1772 return -ENOBUFS; 1773 1774 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1775 return -ENOBUFS; 1776 1777 nla_nest_end(msg, nl_wowlan); 1778 1779 return 0; 1780 } 1781 #endif 1782 1783 static int nl80211_send_coalesce(struct sk_buff *msg, 1784 struct cfg80211_registered_device *rdev) 1785 { 1786 struct nl80211_coalesce_rule_support rule; 1787 1788 if (!rdev->wiphy.coalesce) 1789 return 0; 1790 1791 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1792 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1793 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1794 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1795 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1796 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1797 1798 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1799 return -ENOBUFS; 1800 1801 return 0; 1802 } 1803 1804 static int 1805 nl80211_send_iftype_data(struct sk_buff *msg, 1806 const struct ieee80211_supported_band *sband, 1807 const struct ieee80211_sband_iftype_data *iftdata) 1808 { 1809 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1810 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap; 1811 1812 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1813 iftdata->types_mask)) 1814 return -ENOBUFS; 1815 1816 if (he_cap->has_he) { 1817 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1818 sizeof(he_cap->he_cap_elem.mac_cap_info), 1819 he_cap->he_cap_elem.mac_cap_info) || 1820 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1821 sizeof(he_cap->he_cap_elem.phy_cap_info), 1822 he_cap->he_cap_elem.phy_cap_info) || 1823 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1824 sizeof(he_cap->he_mcs_nss_supp), 1825 &he_cap->he_mcs_nss_supp) || 1826 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1827 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1828 return -ENOBUFS; 1829 } 1830 1831 if (eht_cap->has_eht && he_cap->has_he) { 1832 u8 mcs_nss_size, ppe_thresh_size; 1833 u16 ppe_thres_hdr; 1834 bool is_ap; 1835 1836 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) || 1837 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO); 1838 1839 mcs_nss_size = 1840 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem, 1841 &eht_cap->eht_cap_elem, 1842 is_ap); 1843 1844 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]); 1845 ppe_thresh_size = 1846 ieee80211_eht_ppe_size(ppe_thres_hdr, 1847 eht_cap->eht_cap_elem.phy_cap_info); 1848 1849 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC, 1850 sizeof(eht_cap->eht_cap_elem.mac_cap_info), 1851 eht_cap->eht_cap_elem.mac_cap_info) || 1852 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY, 1853 sizeof(eht_cap->eht_cap_elem.phy_cap_info), 1854 eht_cap->eht_cap_elem.phy_cap_info) || 1855 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET, 1856 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) || 1857 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE, 1858 ppe_thresh_size, eht_cap->eht_ppe_thres)) 1859 return -ENOBUFS; 1860 } 1861 1862 if (sband->band == NL80211_BAND_6GHZ && 1863 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1864 sizeof(iftdata->he_6ghz_capa), 1865 &iftdata->he_6ghz_capa)) 1866 return -ENOBUFS; 1867 1868 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len && 1869 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS, 1870 iftdata->vendor_elems.len, iftdata->vendor_elems.data)) 1871 return -ENOBUFS; 1872 1873 return 0; 1874 } 1875 1876 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1877 struct ieee80211_supported_band *sband, 1878 bool large) 1879 { 1880 struct nlattr *nl_rates, *nl_rate; 1881 struct ieee80211_rate *rate; 1882 int i; 1883 1884 /* add HT info */ 1885 if (sband->ht_cap.ht_supported && 1886 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1887 sizeof(sband->ht_cap.mcs), 1888 &sband->ht_cap.mcs) || 1889 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1890 sband->ht_cap.cap) || 1891 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1892 sband->ht_cap.ampdu_factor) || 1893 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1894 sband->ht_cap.ampdu_density))) 1895 return -ENOBUFS; 1896 1897 /* add VHT info */ 1898 if (sband->vht_cap.vht_supported && 1899 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1900 sizeof(sband->vht_cap.vht_mcs), 1901 &sband->vht_cap.vht_mcs) || 1902 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1903 sband->vht_cap.cap))) 1904 return -ENOBUFS; 1905 1906 if (large && sband->n_iftype_data) { 1907 struct nlattr *nl_iftype_data = 1908 nla_nest_start_noflag(msg, 1909 NL80211_BAND_ATTR_IFTYPE_DATA); 1910 int err; 1911 1912 if (!nl_iftype_data) 1913 return -ENOBUFS; 1914 1915 for (i = 0; i < sband->n_iftype_data; i++) { 1916 struct nlattr *iftdata; 1917 1918 iftdata = nla_nest_start_noflag(msg, i + 1); 1919 if (!iftdata) 1920 return -ENOBUFS; 1921 1922 err = nl80211_send_iftype_data(msg, sband, 1923 &sband->iftype_data[i]); 1924 if (err) 1925 return err; 1926 1927 nla_nest_end(msg, iftdata); 1928 } 1929 1930 nla_nest_end(msg, nl_iftype_data); 1931 } 1932 1933 /* add EDMG info */ 1934 if (large && sband->edmg_cap.channels && 1935 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1936 sband->edmg_cap.channels) || 1937 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1938 sband->edmg_cap.bw_config))) 1939 1940 return -ENOBUFS; 1941 1942 /* add bitrates */ 1943 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1944 if (!nl_rates) 1945 return -ENOBUFS; 1946 1947 for (i = 0; i < sband->n_bitrates; i++) { 1948 nl_rate = nla_nest_start_noflag(msg, i); 1949 if (!nl_rate) 1950 return -ENOBUFS; 1951 1952 rate = &sband->bitrates[i]; 1953 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1954 rate->bitrate)) 1955 return -ENOBUFS; 1956 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1957 nla_put_flag(msg, 1958 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1959 return -ENOBUFS; 1960 1961 nla_nest_end(msg, nl_rate); 1962 } 1963 1964 nla_nest_end(msg, nl_rates); 1965 1966 return 0; 1967 } 1968 1969 static int 1970 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1971 const struct ieee80211_txrx_stypes *mgmt_stypes) 1972 { 1973 u16 stypes; 1974 struct nlattr *nl_ftypes, *nl_ifs; 1975 enum nl80211_iftype ift; 1976 int i; 1977 1978 if (!mgmt_stypes) 1979 return 0; 1980 1981 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 1982 if (!nl_ifs) 1983 return -ENOBUFS; 1984 1985 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1986 nl_ftypes = nla_nest_start_noflag(msg, ift); 1987 if (!nl_ftypes) 1988 return -ENOBUFS; 1989 i = 0; 1990 stypes = mgmt_stypes[ift].tx; 1991 while (stypes) { 1992 if ((stypes & 1) && 1993 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1994 (i << 4) | IEEE80211_FTYPE_MGMT)) 1995 return -ENOBUFS; 1996 stypes >>= 1; 1997 i++; 1998 } 1999 nla_nest_end(msg, nl_ftypes); 2000 } 2001 2002 nla_nest_end(msg, nl_ifs); 2003 2004 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 2005 if (!nl_ifs) 2006 return -ENOBUFS; 2007 2008 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 2009 nl_ftypes = nla_nest_start_noflag(msg, ift); 2010 if (!nl_ftypes) 2011 return -ENOBUFS; 2012 i = 0; 2013 stypes = mgmt_stypes[ift].rx; 2014 while (stypes) { 2015 if ((stypes & 1) && 2016 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 2017 (i << 4) | IEEE80211_FTYPE_MGMT)) 2018 return -ENOBUFS; 2019 stypes >>= 1; 2020 i++; 2021 } 2022 nla_nest_end(msg, nl_ftypes); 2023 } 2024 nla_nest_end(msg, nl_ifs); 2025 2026 return 0; 2027 } 2028 2029 #define CMD(op, n) \ 2030 do { \ 2031 if (rdev->ops->op) { \ 2032 i++; \ 2033 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 2034 goto nla_put_failure; \ 2035 } \ 2036 } while (0) 2037 2038 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 2039 struct sk_buff *msg) 2040 { 2041 int i = 0; 2042 2043 /* 2044 * do *NOT* add anything into this function, new things need to be 2045 * advertised only to new versions of userspace that can deal with 2046 * the split (and they can't possibly care about new features... 2047 */ 2048 CMD(add_virtual_intf, NEW_INTERFACE); 2049 CMD(change_virtual_intf, SET_INTERFACE); 2050 CMD(add_key, NEW_KEY); 2051 CMD(start_ap, START_AP); 2052 CMD(add_station, NEW_STATION); 2053 CMD(add_mpath, NEW_MPATH); 2054 CMD(update_mesh_config, SET_MESH_CONFIG); 2055 CMD(change_bss, SET_BSS); 2056 CMD(auth, AUTHENTICATE); 2057 CMD(assoc, ASSOCIATE); 2058 CMD(deauth, DEAUTHENTICATE); 2059 CMD(disassoc, DISASSOCIATE); 2060 CMD(join_ibss, JOIN_IBSS); 2061 CMD(join_mesh, JOIN_MESH); 2062 CMD(set_pmksa, SET_PMKSA); 2063 CMD(del_pmksa, DEL_PMKSA); 2064 CMD(flush_pmksa, FLUSH_PMKSA); 2065 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 2066 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 2067 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 2068 CMD(mgmt_tx, FRAME); 2069 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 2070 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 2071 i++; 2072 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 2073 goto nla_put_failure; 2074 } 2075 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 2076 rdev->ops->join_mesh) { 2077 i++; 2078 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 2079 goto nla_put_failure; 2080 } 2081 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 2082 CMD(tdls_mgmt, TDLS_MGMT); 2083 CMD(tdls_oper, TDLS_OPER); 2084 } 2085 if (rdev->wiphy.max_sched_scan_reqs) 2086 CMD(sched_scan_start, START_SCHED_SCAN); 2087 CMD(probe_client, PROBE_CLIENT); 2088 CMD(set_noack_map, SET_NOACK_MAP); 2089 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 2090 i++; 2091 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 2092 goto nla_put_failure; 2093 } 2094 CMD(start_p2p_device, START_P2P_DEVICE); 2095 CMD(set_mcast_rate, SET_MCAST_RATE); 2096 #ifdef CONFIG_NL80211_TESTMODE 2097 CMD(testmode_cmd, TESTMODE); 2098 #endif 2099 2100 if (rdev->ops->connect || rdev->ops->auth) { 2101 i++; 2102 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 2103 goto nla_put_failure; 2104 } 2105 2106 if (rdev->ops->disconnect || rdev->ops->deauth) { 2107 i++; 2108 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 2109 goto nla_put_failure; 2110 } 2111 2112 return i; 2113 nla_put_failure: 2114 return -ENOBUFS; 2115 } 2116 2117 static int 2118 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 2119 struct sk_buff *msg) 2120 { 2121 struct nlattr *ftm; 2122 2123 if (!cap->ftm.supported) 2124 return 0; 2125 2126 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 2127 if (!ftm) 2128 return -ENOBUFS; 2129 2130 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 2131 return -ENOBUFS; 2132 if (cap->ftm.non_asap && 2133 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 2134 return -ENOBUFS; 2135 if (cap->ftm.request_lci && 2136 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 2137 return -ENOBUFS; 2138 if (cap->ftm.request_civicloc && 2139 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 2140 return -ENOBUFS; 2141 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 2142 cap->ftm.preambles)) 2143 return -ENOBUFS; 2144 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 2145 cap->ftm.bandwidths)) 2146 return -ENOBUFS; 2147 if (cap->ftm.max_bursts_exponent >= 0 && 2148 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 2149 cap->ftm.max_bursts_exponent)) 2150 return -ENOBUFS; 2151 if (cap->ftm.max_ftms_per_burst && 2152 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 2153 cap->ftm.max_ftms_per_burst)) 2154 return -ENOBUFS; 2155 if (cap->ftm.trigger_based && 2156 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 2157 return -ENOBUFS; 2158 if (cap->ftm.non_trigger_based && 2159 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 2160 return -ENOBUFS; 2161 2162 nla_nest_end(msg, ftm); 2163 return 0; 2164 } 2165 2166 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 2167 struct sk_buff *msg) 2168 { 2169 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 2170 struct nlattr *pmsr, *caps; 2171 2172 if (!cap) 2173 return 0; 2174 2175 /* 2176 * we don't need to clean up anything here since the caller 2177 * will genlmsg_cancel() if we fail 2178 */ 2179 2180 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 2181 if (!pmsr) 2182 return -ENOBUFS; 2183 2184 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 2185 return -ENOBUFS; 2186 2187 if (cap->report_ap_tsf && 2188 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 2189 return -ENOBUFS; 2190 2191 if (cap->randomize_mac_addr && 2192 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2193 return -ENOBUFS; 2194 2195 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2196 if (!caps) 2197 return -ENOBUFS; 2198 2199 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2200 return -ENOBUFS; 2201 2202 nla_nest_end(msg, caps); 2203 nla_nest_end(msg, pmsr); 2204 2205 return 0; 2206 } 2207 2208 static int 2209 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2210 struct sk_buff *msg) 2211 { 2212 int i; 2213 struct nlattr *nested, *nested_akms; 2214 const struct wiphy_iftype_akm_suites *iftype_akms; 2215 2216 if (!rdev->wiphy.num_iftype_akm_suites || 2217 !rdev->wiphy.iftype_akm_suites) 2218 return 0; 2219 2220 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2221 if (!nested) 2222 return -ENOBUFS; 2223 2224 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2225 nested_akms = nla_nest_start(msg, i + 1); 2226 if (!nested_akms) 2227 return -ENOBUFS; 2228 2229 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2230 2231 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2232 iftype_akms->iftypes_mask)) 2233 return -ENOBUFS; 2234 2235 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2236 sizeof(u32) * iftype_akms->n_akm_suites, 2237 iftype_akms->akm_suites)) { 2238 return -ENOBUFS; 2239 } 2240 nla_nest_end(msg, nested_akms); 2241 } 2242 2243 nla_nest_end(msg, nested); 2244 2245 return 0; 2246 } 2247 2248 static int 2249 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2250 struct sk_buff *msg) 2251 { 2252 struct nlattr *supp; 2253 2254 if (!rdev->wiphy.tid_config_support.vif && 2255 !rdev->wiphy.tid_config_support.peer) 2256 return 0; 2257 2258 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2259 if (!supp) 2260 return -ENOSPC; 2261 2262 if (rdev->wiphy.tid_config_support.vif && 2263 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2264 rdev->wiphy.tid_config_support.vif, 2265 NL80211_TID_CONFIG_ATTR_PAD)) 2266 goto fail; 2267 2268 if (rdev->wiphy.tid_config_support.peer && 2269 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2270 rdev->wiphy.tid_config_support.peer, 2271 NL80211_TID_CONFIG_ATTR_PAD)) 2272 goto fail; 2273 2274 /* for now we just use the same value ... makes more sense */ 2275 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2276 rdev->wiphy.tid_config_support.max_retry)) 2277 goto fail; 2278 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2279 rdev->wiphy.tid_config_support.max_retry)) 2280 goto fail; 2281 2282 nla_nest_end(msg, supp); 2283 2284 return 0; 2285 fail: 2286 nla_nest_cancel(msg, supp); 2287 return -ENOBUFS; 2288 } 2289 2290 static int 2291 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev, 2292 struct sk_buff *msg) 2293 { 2294 struct nlattr *sar_capa, *specs, *sub_freq_range; 2295 u8 num_freq_ranges; 2296 int i; 2297 2298 if (!rdev->wiphy.sar_capa) 2299 return 0; 2300 2301 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges; 2302 2303 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC); 2304 if (!sar_capa) 2305 return -ENOSPC; 2306 2307 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type)) 2308 goto fail; 2309 2310 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS); 2311 if (!specs) 2312 goto fail; 2313 2314 /* report supported freq_ranges */ 2315 for (i = 0; i < num_freq_ranges; i++) { 2316 sub_freq_range = nla_nest_start(msg, i + 1); 2317 if (!sub_freq_range) 2318 goto fail; 2319 2320 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ, 2321 rdev->wiphy.sar_capa->freq_ranges[i].start_freq)) 2322 goto fail; 2323 2324 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ, 2325 rdev->wiphy.sar_capa->freq_ranges[i].end_freq)) 2326 goto fail; 2327 2328 nla_nest_end(msg, sub_freq_range); 2329 } 2330 2331 nla_nest_end(msg, specs); 2332 nla_nest_end(msg, sar_capa); 2333 2334 return 0; 2335 fail: 2336 nla_nest_cancel(msg, sar_capa); 2337 return -ENOBUFS; 2338 } 2339 2340 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg) 2341 { 2342 struct nlattr *config; 2343 2344 if (!wiphy->mbssid_max_interfaces) 2345 return 0; 2346 2347 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG); 2348 if (!config) 2349 return -ENOBUFS; 2350 2351 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES, 2352 wiphy->mbssid_max_interfaces)) 2353 goto fail; 2354 2355 if (wiphy->ema_max_profile_periodicity && 2356 nla_put_u8(msg, 2357 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY, 2358 wiphy->ema_max_profile_periodicity)) 2359 goto fail; 2360 2361 nla_nest_end(msg, config); 2362 return 0; 2363 2364 fail: 2365 nla_nest_cancel(msg, config); 2366 return -ENOBUFS; 2367 } 2368 2369 struct nl80211_dump_wiphy_state { 2370 s64 filter_wiphy; 2371 long start; 2372 long split_start, band_start, chan_start, capa_start; 2373 bool split; 2374 }; 2375 2376 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2377 enum nl80211_commands cmd, 2378 struct sk_buff *msg, u32 portid, u32 seq, 2379 int flags, struct nl80211_dump_wiphy_state *state) 2380 { 2381 void *hdr; 2382 struct nlattr *nl_bands, *nl_band; 2383 struct nlattr *nl_freqs, *nl_freq; 2384 struct nlattr *nl_cmds; 2385 enum nl80211_band band; 2386 struct ieee80211_channel *chan; 2387 int i; 2388 const struct ieee80211_txrx_stypes *mgmt_stypes = 2389 rdev->wiphy.mgmt_stypes; 2390 u32 features; 2391 2392 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2393 if (!hdr) 2394 return -ENOBUFS; 2395 2396 if (WARN_ON(!state)) 2397 return -EINVAL; 2398 2399 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2400 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2401 wiphy_name(&rdev->wiphy)) || 2402 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2403 cfg80211_rdev_list_generation)) 2404 goto nla_put_failure; 2405 2406 if (cmd != NL80211_CMD_NEW_WIPHY) 2407 goto finish; 2408 2409 switch (state->split_start) { 2410 case 0: 2411 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2412 rdev->wiphy.retry_short) || 2413 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2414 rdev->wiphy.retry_long) || 2415 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2416 rdev->wiphy.frag_threshold) || 2417 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2418 rdev->wiphy.rts_threshold) || 2419 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2420 rdev->wiphy.coverage_class) || 2421 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2422 rdev->wiphy.max_scan_ssids) || 2423 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2424 rdev->wiphy.max_sched_scan_ssids) || 2425 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2426 rdev->wiphy.max_scan_ie_len) || 2427 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2428 rdev->wiphy.max_sched_scan_ie_len) || 2429 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2430 rdev->wiphy.max_match_sets)) 2431 goto nla_put_failure; 2432 2433 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2434 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2435 goto nla_put_failure; 2436 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2437 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2438 goto nla_put_failure; 2439 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2440 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2441 goto nla_put_failure; 2442 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2443 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2444 goto nla_put_failure; 2445 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2446 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2447 goto nla_put_failure; 2448 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2449 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2450 goto nla_put_failure; 2451 state->split_start++; 2452 if (state->split) 2453 break; 2454 fallthrough; 2455 case 1: 2456 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2457 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2458 rdev->wiphy.cipher_suites)) 2459 goto nla_put_failure; 2460 2461 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2462 rdev->wiphy.max_num_pmkids)) 2463 goto nla_put_failure; 2464 2465 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2466 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2467 goto nla_put_failure; 2468 2469 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2470 rdev->wiphy.available_antennas_tx) || 2471 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2472 rdev->wiphy.available_antennas_rx)) 2473 goto nla_put_failure; 2474 2475 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2476 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2477 rdev->wiphy.probe_resp_offload)) 2478 goto nla_put_failure; 2479 2480 if ((rdev->wiphy.available_antennas_tx || 2481 rdev->wiphy.available_antennas_rx) && 2482 rdev->ops->get_antenna) { 2483 u32 tx_ant = 0, rx_ant = 0; 2484 int res; 2485 2486 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2487 if (!res) { 2488 if (nla_put_u32(msg, 2489 NL80211_ATTR_WIPHY_ANTENNA_TX, 2490 tx_ant) || 2491 nla_put_u32(msg, 2492 NL80211_ATTR_WIPHY_ANTENNA_RX, 2493 rx_ant)) 2494 goto nla_put_failure; 2495 } 2496 } 2497 2498 state->split_start++; 2499 if (state->split) 2500 break; 2501 fallthrough; 2502 case 2: 2503 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2504 rdev->wiphy.interface_modes)) 2505 goto nla_put_failure; 2506 state->split_start++; 2507 if (state->split) 2508 break; 2509 fallthrough; 2510 case 3: 2511 nl_bands = nla_nest_start_noflag(msg, 2512 NL80211_ATTR_WIPHY_BANDS); 2513 if (!nl_bands) 2514 goto nla_put_failure; 2515 2516 for (band = state->band_start; 2517 band < (state->split ? 2518 NUM_NL80211_BANDS : 2519 NL80211_BAND_60GHZ + 1); 2520 band++) { 2521 struct ieee80211_supported_band *sband; 2522 2523 /* omit higher bands for ancient software */ 2524 if (band > NL80211_BAND_5GHZ && !state->split) 2525 break; 2526 2527 sband = rdev->wiphy.bands[band]; 2528 2529 if (!sband) 2530 continue; 2531 2532 nl_band = nla_nest_start_noflag(msg, band); 2533 if (!nl_band) 2534 goto nla_put_failure; 2535 2536 switch (state->chan_start) { 2537 case 0: 2538 if (nl80211_send_band_rateinfo(msg, sband, 2539 state->split)) 2540 goto nla_put_failure; 2541 state->chan_start++; 2542 if (state->split) 2543 break; 2544 fallthrough; 2545 default: 2546 /* add frequencies */ 2547 nl_freqs = nla_nest_start_noflag(msg, 2548 NL80211_BAND_ATTR_FREQS); 2549 if (!nl_freqs) 2550 goto nla_put_failure; 2551 2552 for (i = state->chan_start - 1; 2553 i < sband->n_channels; 2554 i++) { 2555 nl_freq = nla_nest_start_noflag(msg, 2556 i); 2557 if (!nl_freq) 2558 goto nla_put_failure; 2559 2560 chan = &sband->channels[i]; 2561 2562 if (nl80211_msg_put_channel( 2563 msg, &rdev->wiphy, chan, 2564 state->split)) 2565 goto nla_put_failure; 2566 2567 nla_nest_end(msg, nl_freq); 2568 if (state->split) 2569 break; 2570 } 2571 if (i < sband->n_channels) 2572 state->chan_start = i + 2; 2573 else 2574 state->chan_start = 0; 2575 nla_nest_end(msg, nl_freqs); 2576 } 2577 2578 nla_nest_end(msg, nl_band); 2579 2580 if (state->split) { 2581 /* start again here */ 2582 if (state->chan_start) 2583 band--; 2584 break; 2585 } 2586 } 2587 nla_nest_end(msg, nl_bands); 2588 2589 if (band < NUM_NL80211_BANDS) 2590 state->band_start = band + 1; 2591 else 2592 state->band_start = 0; 2593 2594 /* if bands & channels are done, continue outside */ 2595 if (state->band_start == 0 && state->chan_start == 0) 2596 state->split_start++; 2597 if (state->split) 2598 break; 2599 fallthrough; 2600 case 4: 2601 nl_cmds = nla_nest_start_noflag(msg, 2602 NL80211_ATTR_SUPPORTED_COMMANDS); 2603 if (!nl_cmds) 2604 goto nla_put_failure; 2605 2606 i = nl80211_add_commands_unsplit(rdev, msg); 2607 if (i < 0) 2608 goto nla_put_failure; 2609 if (state->split) { 2610 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2611 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2612 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2613 CMD(channel_switch, CHANNEL_SWITCH); 2614 CMD(set_qos_map, SET_QOS_MAP); 2615 if (rdev->wiphy.features & 2616 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2617 CMD(add_tx_ts, ADD_TX_TS); 2618 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2619 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2620 CMD(update_ft_ies, UPDATE_FT_IES); 2621 if (rdev->wiphy.sar_capa) 2622 CMD(set_sar_specs, SET_SAR_SPECS); 2623 } 2624 #undef CMD 2625 2626 nla_nest_end(msg, nl_cmds); 2627 state->split_start++; 2628 if (state->split) 2629 break; 2630 fallthrough; 2631 case 5: 2632 if (rdev->ops->remain_on_channel && 2633 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2634 nla_put_u32(msg, 2635 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2636 rdev->wiphy.max_remain_on_channel_duration)) 2637 goto nla_put_failure; 2638 2639 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2640 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2641 goto nla_put_failure; 2642 2643 state->split_start++; 2644 if (state->split) 2645 break; 2646 fallthrough; 2647 case 6: 2648 #ifdef CONFIG_PM 2649 if (nl80211_send_wowlan(msg, rdev, state->split)) 2650 goto nla_put_failure; 2651 state->split_start++; 2652 if (state->split) 2653 break; 2654 #else 2655 state->split_start++; 2656 #endif 2657 fallthrough; 2658 case 7: 2659 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2660 rdev->wiphy.software_iftypes)) 2661 goto nla_put_failure; 2662 2663 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2664 state->split)) 2665 goto nla_put_failure; 2666 2667 state->split_start++; 2668 if (state->split) 2669 break; 2670 fallthrough; 2671 case 8: 2672 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2673 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2674 rdev->wiphy.ap_sme_capa)) 2675 goto nla_put_failure; 2676 2677 features = rdev->wiphy.features; 2678 /* 2679 * We can only add the per-channel limit information if the 2680 * dump is split, otherwise it makes it too big. Therefore 2681 * only advertise it in that case. 2682 */ 2683 if (state->split) 2684 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2685 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2686 goto nla_put_failure; 2687 2688 if (rdev->wiphy.ht_capa_mod_mask && 2689 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2690 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2691 rdev->wiphy.ht_capa_mod_mask)) 2692 goto nla_put_failure; 2693 2694 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2695 rdev->wiphy.max_acl_mac_addrs && 2696 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2697 rdev->wiphy.max_acl_mac_addrs)) 2698 goto nla_put_failure; 2699 2700 /* 2701 * Any information below this point is only available to 2702 * applications that can deal with it being split. This 2703 * helps ensure that newly added capabilities don't break 2704 * older tools by overrunning their buffers. 2705 * 2706 * We still increment split_start so that in the split 2707 * case we'll continue with more data in the next round, 2708 * but break unconditionally so unsplit data stops here. 2709 */ 2710 if (state->split) 2711 state->split_start++; 2712 else 2713 state->split_start = 0; 2714 break; 2715 case 9: 2716 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2717 goto nla_put_failure; 2718 2719 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2720 rdev->wiphy.max_sched_scan_plans) || 2721 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2722 rdev->wiphy.max_sched_scan_plan_interval) || 2723 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2724 rdev->wiphy.max_sched_scan_plan_iterations)) 2725 goto nla_put_failure; 2726 2727 if (rdev->wiphy.extended_capabilities && 2728 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2729 rdev->wiphy.extended_capabilities_len, 2730 rdev->wiphy.extended_capabilities) || 2731 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2732 rdev->wiphy.extended_capabilities_len, 2733 rdev->wiphy.extended_capabilities_mask))) 2734 goto nla_put_failure; 2735 2736 if (rdev->wiphy.vht_capa_mod_mask && 2737 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2738 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2739 rdev->wiphy.vht_capa_mod_mask)) 2740 goto nla_put_failure; 2741 2742 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2743 rdev->wiphy.perm_addr)) 2744 goto nla_put_failure; 2745 2746 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2747 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2748 rdev->wiphy.addr_mask)) 2749 goto nla_put_failure; 2750 2751 if (rdev->wiphy.n_addresses > 1) { 2752 void *attr; 2753 2754 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2755 if (!attr) 2756 goto nla_put_failure; 2757 2758 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2759 if (nla_put(msg, i + 1, ETH_ALEN, 2760 rdev->wiphy.addresses[i].addr)) 2761 goto nla_put_failure; 2762 2763 nla_nest_end(msg, attr); 2764 } 2765 2766 state->split_start++; 2767 break; 2768 case 10: 2769 if (nl80211_send_coalesce(msg, rdev)) 2770 goto nla_put_failure; 2771 2772 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2773 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2774 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2775 goto nla_put_failure; 2776 2777 if (rdev->wiphy.max_ap_assoc_sta && 2778 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2779 rdev->wiphy.max_ap_assoc_sta)) 2780 goto nla_put_failure; 2781 2782 state->split_start++; 2783 break; 2784 case 11: 2785 if (rdev->wiphy.n_vendor_commands) { 2786 const struct nl80211_vendor_cmd_info *info; 2787 struct nlattr *nested; 2788 2789 nested = nla_nest_start_noflag(msg, 2790 NL80211_ATTR_VENDOR_DATA); 2791 if (!nested) 2792 goto nla_put_failure; 2793 2794 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2795 info = &rdev->wiphy.vendor_commands[i].info; 2796 if (nla_put(msg, i + 1, sizeof(*info), info)) 2797 goto nla_put_failure; 2798 } 2799 nla_nest_end(msg, nested); 2800 } 2801 2802 if (rdev->wiphy.n_vendor_events) { 2803 const struct nl80211_vendor_cmd_info *info; 2804 struct nlattr *nested; 2805 2806 nested = nla_nest_start_noflag(msg, 2807 NL80211_ATTR_VENDOR_EVENTS); 2808 if (!nested) 2809 goto nla_put_failure; 2810 2811 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2812 info = &rdev->wiphy.vendor_events[i]; 2813 if (nla_put(msg, i + 1, sizeof(*info), info)) 2814 goto nla_put_failure; 2815 } 2816 nla_nest_end(msg, nested); 2817 } 2818 state->split_start++; 2819 break; 2820 case 12: 2821 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2822 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2823 rdev->wiphy.max_num_csa_counters)) 2824 goto nla_put_failure; 2825 2826 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2827 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2828 goto nla_put_failure; 2829 2830 if (rdev->wiphy.max_sched_scan_reqs && 2831 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2832 rdev->wiphy.max_sched_scan_reqs)) 2833 goto nla_put_failure; 2834 2835 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2836 sizeof(rdev->wiphy.ext_features), 2837 rdev->wiphy.ext_features)) 2838 goto nla_put_failure; 2839 2840 if (rdev->wiphy.bss_select_support) { 2841 struct nlattr *nested; 2842 u32 bss_select_support = rdev->wiphy.bss_select_support; 2843 2844 nested = nla_nest_start_noflag(msg, 2845 NL80211_ATTR_BSS_SELECT); 2846 if (!nested) 2847 goto nla_put_failure; 2848 2849 i = 0; 2850 while (bss_select_support) { 2851 if ((bss_select_support & 1) && 2852 nla_put_flag(msg, i)) 2853 goto nla_put_failure; 2854 i++; 2855 bss_select_support >>= 1; 2856 } 2857 nla_nest_end(msg, nested); 2858 } 2859 2860 state->split_start++; 2861 break; 2862 case 13: 2863 if (rdev->wiphy.num_iftype_ext_capab && 2864 rdev->wiphy.iftype_ext_capab) { 2865 struct nlattr *nested_ext_capab, *nested; 2866 2867 nested = nla_nest_start_noflag(msg, 2868 NL80211_ATTR_IFTYPE_EXT_CAPA); 2869 if (!nested) 2870 goto nla_put_failure; 2871 2872 for (i = state->capa_start; 2873 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2874 const struct wiphy_iftype_ext_capab *capab; 2875 2876 capab = &rdev->wiphy.iftype_ext_capab[i]; 2877 2878 nested_ext_capab = nla_nest_start_noflag(msg, 2879 i); 2880 if (!nested_ext_capab || 2881 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2882 capab->iftype) || 2883 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2884 capab->extended_capabilities_len, 2885 capab->extended_capabilities) || 2886 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2887 capab->extended_capabilities_len, 2888 capab->extended_capabilities_mask)) 2889 goto nla_put_failure; 2890 2891 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO && 2892 (nla_put_u16(msg, 2893 NL80211_ATTR_EML_CAPABILITY, 2894 capab->eml_capabilities) || 2895 nla_put_u16(msg, 2896 NL80211_ATTR_MLD_CAPA_AND_OPS, 2897 capab->mld_capa_and_ops))) 2898 goto nla_put_failure; 2899 2900 nla_nest_end(msg, nested_ext_capab); 2901 if (state->split) 2902 break; 2903 } 2904 nla_nest_end(msg, nested); 2905 if (i < rdev->wiphy.num_iftype_ext_capab) { 2906 state->capa_start = i + 1; 2907 break; 2908 } 2909 } 2910 2911 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2912 rdev->wiphy.nan_supported_bands)) 2913 goto nla_put_failure; 2914 2915 if (wiphy_ext_feature_isset(&rdev->wiphy, 2916 NL80211_EXT_FEATURE_TXQS)) { 2917 struct cfg80211_txq_stats txqstats = {}; 2918 int res; 2919 2920 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2921 if (!res && 2922 !nl80211_put_txq_stats(msg, &txqstats, 2923 NL80211_ATTR_TXQ_STATS)) 2924 goto nla_put_failure; 2925 2926 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2927 rdev->wiphy.txq_limit)) 2928 goto nla_put_failure; 2929 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2930 rdev->wiphy.txq_memory_limit)) 2931 goto nla_put_failure; 2932 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2933 rdev->wiphy.txq_quantum)) 2934 goto nla_put_failure; 2935 } 2936 2937 state->split_start++; 2938 break; 2939 case 14: 2940 if (nl80211_send_pmsr_capa(rdev, msg)) 2941 goto nla_put_failure; 2942 2943 state->split_start++; 2944 break; 2945 case 15: 2946 if (rdev->wiphy.akm_suites && 2947 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2948 sizeof(u32) * rdev->wiphy.n_akm_suites, 2949 rdev->wiphy.akm_suites)) 2950 goto nla_put_failure; 2951 2952 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2953 goto nla_put_failure; 2954 2955 if (nl80211_put_tid_config_support(rdev, msg)) 2956 goto nla_put_failure; 2957 state->split_start++; 2958 break; 2959 case 16: 2960 if (nl80211_put_sar_specs(rdev, msg)) 2961 goto nla_put_failure; 2962 2963 if (nl80211_put_mbssid_support(&rdev->wiphy, msg)) 2964 goto nla_put_failure; 2965 2966 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES, 2967 rdev->wiphy.max_num_akm_suites)) 2968 goto nla_put_failure; 2969 2970 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO) 2971 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT); 2972 2973 /* done */ 2974 state->split_start = 0; 2975 break; 2976 } 2977 finish: 2978 genlmsg_end(msg, hdr); 2979 return 0; 2980 2981 nla_put_failure: 2982 genlmsg_cancel(msg, hdr); 2983 return -EMSGSIZE; 2984 } 2985 2986 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2987 struct netlink_callback *cb, 2988 struct nl80211_dump_wiphy_state *state) 2989 { 2990 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 2991 int ret; 2992 2993 if (!tb) 2994 return -ENOMEM; 2995 2996 ret = nlmsg_parse_deprecated(cb->nlh, 2997 GENL_HDRLEN + nl80211_fam.hdrsize, 2998 tb, nl80211_fam.maxattr, 2999 nl80211_policy, NULL); 3000 /* ignore parse errors for backward compatibility */ 3001 if (ret) { 3002 ret = 0; 3003 goto out; 3004 } 3005 3006 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 3007 if (tb[NL80211_ATTR_WIPHY]) 3008 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 3009 if (tb[NL80211_ATTR_WDEV]) 3010 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 3011 if (tb[NL80211_ATTR_IFINDEX]) { 3012 struct net_device *netdev; 3013 struct cfg80211_registered_device *rdev; 3014 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 3015 3016 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 3017 if (!netdev) { 3018 ret = -ENODEV; 3019 goto out; 3020 } 3021 if (netdev->ieee80211_ptr) { 3022 rdev = wiphy_to_rdev( 3023 netdev->ieee80211_ptr->wiphy); 3024 state->filter_wiphy = rdev->wiphy_idx; 3025 } 3026 } 3027 3028 ret = 0; 3029 out: 3030 kfree(tb); 3031 return ret; 3032 } 3033 3034 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 3035 { 3036 int idx = 0, ret; 3037 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 3038 struct cfg80211_registered_device *rdev; 3039 3040 rtnl_lock(); 3041 if (!state) { 3042 state = kzalloc(sizeof(*state), GFP_KERNEL); 3043 if (!state) { 3044 rtnl_unlock(); 3045 return -ENOMEM; 3046 } 3047 state->filter_wiphy = -1; 3048 ret = nl80211_dump_wiphy_parse(skb, cb, state); 3049 if (ret) { 3050 kfree(state); 3051 rtnl_unlock(); 3052 return ret; 3053 } 3054 cb->args[0] = (long)state; 3055 } 3056 3057 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 3058 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3059 continue; 3060 if (++idx <= state->start) 3061 continue; 3062 if (state->filter_wiphy != -1 && 3063 state->filter_wiphy != rdev->wiphy_idx) 3064 continue; 3065 /* attempt to fit multiple wiphy data chunks into the skb */ 3066 do { 3067 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 3068 skb, 3069 NETLINK_CB(cb->skb).portid, 3070 cb->nlh->nlmsg_seq, 3071 NLM_F_MULTI, state); 3072 if (ret < 0) { 3073 /* 3074 * If sending the wiphy data didn't fit (ENOBUFS 3075 * or EMSGSIZE returned), this SKB is still 3076 * empty (so it's not too big because another 3077 * wiphy dataset is already in the skb) and 3078 * we've not tried to adjust the dump allocation 3079 * yet ... then adjust the alloc size to be 3080 * bigger, and return 1 but with the empty skb. 3081 * This results in an empty message being RX'ed 3082 * in userspace, but that is ignored. 3083 * 3084 * We can then retry with the larger buffer. 3085 */ 3086 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 3087 !skb->len && !state->split && 3088 cb->min_dump_alloc < 4096) { 3089 cb->min_dump_alloc = 4096; 3090 state->split_start = 0; 3091 rtnl_unlock(); 3092 return 1; 3093 } 3094 idx--; 3095 break; 3096 } 3097 } while (state->split_start > 0); 3098 break; 3099 } 3100 rtnl_unlock(); 3101 3102 state->start = idx; 3103 3104 return skb->len; 3105 } 3106 3107 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 3108 { 3109 kfree((void *)cb->args[0]); 3110 return 0; 3111 } 3112 3113 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 3114 { 3115 struct sk_buff *msg; 3116 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3117 struct nl80211_dump_wiphy_state state = {}; 3118 3119 msg = nlmsg_new(4096, GFP_KERNEL); 3120 if (!msg) 3121 return -ENOMEM; 3122 3123 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 3124 info->snd_portid, info->snd_seq, 0, 3125 &state) < 0) { 3126 nlmsg_free(msg); 3127 return -ENOBUFS; 3128 } 3129 3130 return genlmsg_reply(msg, info); 3131 } 3132 3133 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 3134 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 3135 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 3136 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 3137 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 3138 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 3139 }; 3140 3141 static int parse_txq_params(struct nlattr *tb[], 3142 struct ieee80211_txq_params *txq_params) 3143 { 3144 u8 ac; 3145 3146 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 3147 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 3148 !tb[NL80211_TXQ_ATTR_AIFS]) 3149 return -EINVAL; 3150 3151 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 3152 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 3153 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 3154 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 3155 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 3156 3157 if (ac >= NL80211_NUM_ACS) 3158 return -EINVAL; 3159 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 3160 return 0; 3161 } 3162 3163 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 3164 { 3165 /* 3166 * You can only set the channel explicitly for some interfaces, 3167 * most have their channel managed via their respective 3168 * "establish a connection" command (connect, join, ...) 3169 * 3170 * For AP/GO and mesh mode, the channel can be set with the 3171 * channel userspace API, but is only stored and passed to the 3172 * low-level driver when the AP starts or the mesh is joined. 3173 * This is for backward compatibility, userspace can also give 3174 * the channel in the start-ap or join-mesh commands instead. 3175 * 3176 * Monitors are special as they are normally slaved to 3177 * whatever else is going on, so they have their own special 3178 * operation to set the monitor channel if possible. 3179 */ 3180 return !wdev || 3181 wdev->iftype == NL80211_IFTYPE_AP || 3182 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 3183 wdev->iftype == NL80211_IFTYPE_MONITOR || 3184 wdev->iftype == NL80211_IFTYPE_P2P_GO; 3185 } 3186 3187 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev, 3188 struct genl_info *info, 3189 const struct cfg80211_chan_def *chandef, 3190 u16 *punct_bitmap) 3191 { 3192 if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT)) 3193 return -EINVAL; 3194 3195 *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]); 3196 if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef)) 3197 return -EINVAL; 3198 3199 return 0; 3200 } 3201 3202 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 3203 struct genl_info *info, 3204 struct cfg80211_chan_def *chandef) 3205 { 3206 struct netlink_ext_ack *extack = info->extack; 3207 struct nlattr **attrs = info->attrs; 3208 u32 control_freq; 3209 3210 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) { 3211 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3212 "Frequency is missing"); 3213 return -EINVAL; 3214 } 3215 3216 control_freq = MHZ_TO_KHZ( 3217 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 3218 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 3219 control_freq += 3220 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 3221 3222 memset(chandef, 0, sizeof(*chandef)); 3223 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 3224 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 3225 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 3226 chandef->freq1_offset = control_freq % 1000; 3227 chandef->center_freq2 = 0; 3228 3229 /* Primary channel not allowed */ 3230 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 3231 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3232 "Channel is disabled"); 3233 return -EINVAL; 3234 } 3235 3236 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 3237 enum nl80211_channel_type chantype; 3238 3239 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 3240 3241 switch (chantype) { 3242 case NL80211_CHAN_NO_HT: 3243 case NL80211_CHAN_HT20: 3244 case NL80211_CHAN_HT40PLUS: 3245 case NL80211_CHAN_HT40MINUS: 3246 cfg80211_chandef_create(chandef, chandef->chan, 3247 chantype); 3248 /* user input for center_freq is incorrect */ 3249 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 3250 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 3251 NL_SET_ERR_MSG_ATTR(extack, 3252 attrs[NL80211_ATTR_CENTER_FREQ1], 3253 "bad center frequency 1"); 3254 return -EINVAL; 3255 } 3256 /* center_freq2 must be zero */ 3257 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 3258 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 3259 NL_SET_ERR_MSG_ATTR(extack, 3260 attrs[NL80211_ATTR_CENTER_FREQ2], 3261 "center frequency 2 can't be used"); 3262 return -EINVAL; 3263 } 3264 break; 3265 default: 3266 NL_SET_ERR_MSG_ATTR(extack, 3267 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 3268 "invalid channel type"); 3269 return -EINVAL; 3270 } 3271 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 3272 chandef->width = 3273 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 3274 if (chandef->chan->band == NL80211_BAND_S1GHZ) { 3275 /* User input error for channel width doesn't match channel */ 3276 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) { 3277 NL_SET_ERR_MSG_ATTR(extack, 3278 attrs[NL80211_ATTR_CHANNEL_WIDTH], 3279 "bad channel width"); 3280 return -EINVAL; 3281 } 3282 } 3283 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 3284 chandef->center_freq1 = 3285 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 3286 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 3287 chandef->freq1_offset = nla_get_u32( 3288 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 3289 else 3290 chandef->freq1_offset = 0; 3291 } 3292 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 3293 chandef->center_freq2 = 3294 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 3295 } 3296 3297 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 3298 chandef->edmg.channels = 3299 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 3300 3301 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 3302 chandef->edmg.bw_config = 3303 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 3304 } else { 3305 chandef->edmg.bw_config = 0; 3306 chandef->edmg.channels = 0; 3307 } 3308 3309 if (!cfg80211_chandef_valid(chandef)) { 3310 NL_SET_ERR_MSG(extack, "invalid channel definition"); 3311 return -EINVAL; 3312 } 3313 3314 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 3315 IEEE80211_CHAN_DISABLED)) { 3316 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 3317 return -EINVAL; 3318 } 3319 3320 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 3321 chandef->width == NL80211_CHAN_WIDTH_10) && 3322 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 3323 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 3324 return -EINVAL; 3325 } 3326 3327 return 0; 3328 } 3329 3330 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3331 struct net_device *dev, 3332 struct genl_info *info, 3333 int _link_id) 3334 { 3335 struct cfg80211_chan_def chandef; 3336 int result; 3337 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3338 struct wireless_dev *wdev = NULL; 3339 int link_id = _link_id; 3340 3341 if (dev) 3342 wdev = dev->ieee80211_ptr; 3343 if (!nl80211_can_set_dev_channel(wdev)) 3344 return -EOPNOTSUPP; 3345 if (wdev) 3346 iftype = wdev->iftype; 3347 3348 if (link_id < 0) { 3349 if (wdev && wdev->valid_links) 3350 return -EINVAL; 3351 link_id = 0; 3352 } 3353 3354 result = nl80211_parse_chandef(rdev, info, &chandef); 3355 if (result) 3356 return result; 3357 3358 switch (iftype) { 3359 case NL80211_IFTYPE_AP: 3360 case NL80211_IFTYPE_P2P_GO: 3361 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3362 iftype)) 3363 return -EINVAL; 3364 if (wdev->links[link_id].ap.beacon_interval) { 3365 struct ieee80211_channel *cur_chan; 3366 3367 if (!dev || !rdev->ops->set_ap_chanwidth || 3368 !(rdev->wiphy.features & 3369 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) 3370 return -EBUSY; 3371 3372 /* Only allow dynamic channel width changes */ 3373 cur_chan = wdev->links[link_id].ap.chandef.chan; 3374 if (chandef.chan != cur_chan) 3375 return -EBUSY; 3376 3377 result = rdev_set_ap_chanwidth(rdev, dev, link_id, 3378 &chandef); 3379 if (result) 3380 return result; 3381 wdev->links[link_id].ap.chandef = chandef; 3382 } else { 3383 wdev->u.ap.preset_chandef = chandef; 3384 } 3385 return 0; 3386 case NL80211_IFTYPE_MESH_POINT: 3387 return cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3388 case NL80211_IFTYPE_MONITOR: 3389 return cfg80211_set_monitor_channel(rdev, &chandef); 3390 default: 3391 break; 3392 } 3393 3394 return -EINVAL; 3395 } 3396 3397 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3398 { 3399 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3400 int link_id = nl80211_link_id_or_invalid(info->attrs); 3401 struct net_device *netdev = info->user_ptr[1]; 3402 int ret; 3403 3404 wdev_lock(netdev->ieee80211_ptr); 3405 ret = __nl80211_set_channel(rdev, netdev, info, link_id); 3406 wdev_unlock(netdev->ieee80211_ptr); 3407 3408 return ret; 3409 } 3410 3411 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3412 { 3413 struct cfg80211_registered_device *rdev = NULL; 3414 struct net_device *netdev = NULL; 3415 struct wireless_dev *wdev; 3416 int result = 0, rem_txq_params = 0; 3417 struct nlattr *nl_txq_params; 3418 u32 changed; 3419 u8 retry_short = 0, retry_long = 0; 3420 u32 frag_threshold = 0, rts_threshold = 0; 3421 u8 coverage_class = 0; 3422 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3423 3424 rtnl_lock(); 3425 /* 3426 * Try to find the wiphy and netdev. Normally this 3427 * function shouldn't need the netdev, but this is 3428 * done for backward compatibility -- previously 3429 * setting the channel was done per wiphy, but now 3430 * it is per netdev. Previous userland like hostapd 3431 * also passed a netdev to set_wiphy, so that it is 3432 * possible to let that go to the right netdev! 3433 */ 3434 3435 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3436 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3437 3438 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3439 if (netdev && netdev->ieee80211_ptr) 3440 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3441 else 3442 netdev = NULL; 3443 } 3444 3445 if (!netdev) { 3446 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3447 info->attrs); 3448 if (IS_ERR(rdev)) { 3449 rtnl_unlock(); 3450 return PTR_ERR(rdev); 3451 } 3452 wdev = NULL; 3453 netdev = NULL; 3454 result = 0; 3455 } else 3456 wdev = netdev->ieee80211_ptr; 3457 3458 wiphy_lock(&rdev->wiphy); 3459 3460 /* 3461 * end workaround code, by now the rdev is available 3462 * and locked, and wdev may or may not be NULL. 3463 */ 3464 3465 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3466 result = cfg80211_dev_rename( 3467 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3468 rtnl_unlock(); 3469 3470 if (result) 3471 goto out; 3472 3473 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3474 struct ieee80211_txq_params txq_params; 3475 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3476 3477 if (!rdev->ops->set_txq_params) { 3478 result = -EOPNOTSUPP; 3479 goto out; 3480 } 3481 3482 if (!netdev) { 3483 result = -EINVAL; 3484 goto out; 3485 } 3486 3487 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3488 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 3489 result = -EINVAL; 3490 goto out; 3491 } 3492 3493 if (!netif_running(netdev)) { 3494 result = -ENETDOWN; 3495 goto out; 3496 } 3497 3498 nla_for_each_nested(nl_txq_params, 3499 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3500 rem_txq_params) { 3501 result = nla_parse_nested_deprecated(tb, 3502 NL80211_TXQ_ATTR_MAX, 3503 nl_txq_params, 3504 txq_params_policy, 3505 info->extack); 3506 if (result) 3507 goto out; 3508 result = parse_txq_params(tb, &txq_params); 3509 if (result) 3510 goto out; 3511 3512 txq_params.link_id = 3513 nl80211_link_id_or_invalid(info->attrs); 3514 3515 wdev_lock(netdev->ieee80211_ptr); 3516 if (txq_params.link_id >= 0 && 3517 !(netdev->ieee80211_ptr->valid_links & 3518 BIT(txq_params.link_id))) 3519 result = -ENOLINK; 3520 else if (txq_params.link_id >= 0 && 3521 !netdev->ieee80211_ptr->valid_links) 3522 result = -EINVAL; 3523 else 3524 result = rdev_set_txq_params(rdev, netdev, 3525 &txq_params); 3526 wdev_unlock(netdev->ieee80211_ptr); 3527 if (result) 3528 goto out; 3529 } 3530 } 3531 3532 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3533 int link_id = nl80211_link_id_or_invalid(info->attrs); 3534 3535 if (wdev) { 3536 wdev_lock(wdev); 3537 result = __nl80211_set_channel( 3538 rdev, 3539 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3540 info, link_id); 3541 wdev_unlock(wdev); 3542 } else { 3543 result = __nl80211_set_channel(rdev, netdev, info, link_id); 3544 } 3545 3546 if (result) 3547 goto out; 3548 } 3549 3550 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3551 struct wireless_dev *txp_wdev = wdev; 3552 enum nl80211_tx_power_setting type; 3553 int idx, mbm = 0; 3554 3555 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3556 txp_wdev = NULL; 3557 3558 if (!rdev->ops->set_tx_power) { 3559 result = -EOPNOTSUPP; 3560 goto out; 3561 } 3562 3563 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3564 type = nla_get_u32(info->attrs[idx]); 3565 3566 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3567 (type != NL80211_TX_POWER_AUTOMATIC)) { 3568 result = -EINVAL; 3569 goto out; 3570 } 3571 3572 if (type != NL80211_TX_POWER_AUTOMATIC) { 3573 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3574 mbm = nla_get_u32(info->attrs[idx]); 3575 } 3576 3577 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3578 if (result) 3579 goto out; 3580 } 3581 3582 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3583 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3584 u32 tx_ant, rx_ant; 3585 3586 if ((!rdev->wiphy.available_antennas_tx && 3587 !rdev->wiphy.available_antennas_rx) || 3588 !rdev->ops->set_antenna) { 3589 result = -EOPNOTSUPP; 3590 goto out; 3591 } 3592 3593 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3594 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3595 3596 /* reject antenna configurations which don't match the 3597 * available antenna masks, except for the "all" mask */ 3598 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3599 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) { 3600 result = -EINVAL; 3601 goto out; 3602 } 3603 3604 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3605 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3606 3607 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3608 if (result) 3609 goto out; 3610 } 3611 3612 changed = 0; 3613 3614 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3615 retry_short = nla_get_u8( 3616 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3617 3618 changed |= WIPHY_PARAM_RETRY_SHORT; 3619 } 3620 3621 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3622 retry_long = nla_get_u8( 3623 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3624 3625 changed |= WIPHY_PARAM_RETRY_LONG; 3626 } 3627 3628 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3629 frag_threshold = nla_get_u32( 3630 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3631 if (frag_threshold < 256) { 3632 result = -EINVAL; 3633 goto out; 3634 } 3635 3636 if (frag_threshold != (u32) -1) { 3637 /* 3638 * Fragments (apart from the last one) are required to 3639 * have even length. Make the fragmentation code 3640 * simpler by stripping LSB should someone try to use 3641 * odd threshold value. 3642 */ 3643 frag_threshold &= ~0x1; 3644 } 3645 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3646 } 3647 3648 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3649 rts_threshold = nla_get_u32( 3650 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3651 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3652 } 3653 3654 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3655 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3656 result = -EINVAL; 3657 goto out; 3658 } 3659 3660 coverage_class = nla_get_u8( 3661 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3662 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3663 } 3664 3665 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3666 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) { 3667 result = -EOPNOTSUPP; 3668 goto out; 3669 } 3670 3671 changed |= WIPHY_PARAM_DYN_ACK; 3672 } 3673 3674 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3675 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3676 NL80211_EXT_FEATURE_TXQS)) { 3677 result = -EOPNOTSUPP; 3678 goto out; 3679 } 3680 txq_limit = nla_get_u32( 3681 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3682 changed |= WIPHY_PARAM_TXQ_LIMIT; 3683 } 3684 3685 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3686 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3687 NL80211_EXT_FEATURE_TXQS)) { 3688 result = -EOPNOTSUPP; 3689 goto out; 3690 } 3691 txq_memory_limit = nla_get_u32( 3692 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3693 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3694 } 3695 3696 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3697 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3698 NL80211_EXT_FEATURE_TXQS)) { 3699 result = -EOPNOTSUPP; 3700 goto out; 3701 } 3702 txq_quantum = nla_get_u32( 3703 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3704 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3705 } 3706 3707 if (changed) { 3708 u8 old_retry_short, old_retry_long; 3709 u32 old_frag_threshold, old_rts_threshold; 3710 u8 old_coverage_class; 3711 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3712 3713 if (!rdev->ops->set_wiphy_params) { 3714 result = -EOPNOTSUPP; 3715 goto out; 3716 } 3717 3718 old_retry_short = rdev->wiphy.retry_short; 3719 old_retry_long = rdev->wiphy.retry_long; 3720 old_frag_threshold = rdev->wiphy.frag_threshold; 3721 old_rts_threshold = rdev->wiphy.rts_threshold; 3722 old_coverage_class = rdev->wiphy.coverage_class; 3723 old_txq_limit = rdev->wiphy.txq_limit; 3724 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3725 old_txq_quantum = rdev->wiphy.txq_quantum; 3726 3727 if (changed & WIPHY_PARAM_RETRY_SHORT) 3728 rdev->wiphy.retry_short = retry_short; 3729 if (changed & WIPHY_PARAM_RETRY_LONG) 3730 rdev->wiphy.retry_long = retry_long; 3731 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3732 rdev->wiphy.frag_threshold = frag_threshold; 3733 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3734 rdev->wiphy.rts_threshold = rts_threshold; 3735 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3736 rdev->wiphy.coverage_class = coverage_class; 3737 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3738 rdev->wiphy.txq_limit = txq_limit; 3739 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3740 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3741 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3742 rdev->wiphy.txq_quantum = txq_quantum; 3743 3744 result = rdev_set_wiphy_params(rdev, changed); 3745 if (result) { 3746 rdev->wiphy.retry_short = old_retry_short; 3747 rdev->wiphy.retry_long = old_retry_long; 3748 rdev->wiphy.frag_threshold = old_frag_threshold; 3749 rdev->wiphy.rts_threshold = old_rts_threshold; 3750 rdev->wiphy.coverage_class = old_coverage_class; 3751 rdev->wiphy.txq_limit = old_txq_limit; 3752 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3753 rdev->wiphy.txq_quantum = old_txq_quantum; 3754 goto out; 3755 } 3756 } 3757 3758 result = 0; 3759 3760 out: 3761 wiphy_unlock(&rdev->wiphy); 3762 return result; 3763 } 3764 3765 static int nl80211_send_chandef(struct sk_buff *msg, 3766 const struct cfg80211_chan_def *chandef) 3767 { 3768 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3769 return -EINVAL; 3770 3771 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3772 chandef->chan->center_freq)) 3773 return -ENOBUFS; 3774 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3775 chandef->chan->freq_offset)) 3776 return -ENOBUFS; 3777 switch (chandef->width) { 3778 case NL80211_CHAN_WIDTH_20_NOHT: 3779 case NL80211_CHAN_WIDTH_20: 3780 case NL80211_CHAN_WIDTH_40: 3781 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3782 cfg80211_get_chandef_type(chandef))) 3783 return -ENOBUFS; 3784 break; 3785 default: 3786 break; 3787 } 3788 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3789 return -ENOBUFS; 3790 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3791 return -ENOBUFS; 3792 if (chandef->center_freq2 && 3793 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3794 return -ENOBUFS; 3795 return 0; 3796 } 3797 3798 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3799 struct cfg80211_registered_device *rdev, 3800 struct wireless_dev *wdev, 3801 enum nl80211_commands cmd) 3802 { 3803 struct net_device *dev = wdev->netdev; 3804 void *hdr; 3805 3806 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3807 cmd != NL80211_CMD_DEL_INTERFACE && 3808 cmd != NL80211_CMD_SET_INTERFACE); 3809 3810 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3811 if (!hdr) 3812 return -1; 3813 3814 if (dev && 3815 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3816 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3817 goto nla_put_failure; 3818 3819 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3820 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3821 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3822 NL80211_ATTR_PAD) || 3823 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3824 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3825 rdev->devlist_generation ^ 3826 (cfg80211_rdev_list_generation << 2)) || 3827 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3828 goto nla_put_failure; 3829 3830 if (rdev->ops->get_channel && !wdev->valid_links) { 3831 struct cfg80211_chan_def chandef = {}; 3832 int ret; 3833 3834 ret = rdev_get_channel(rdev, wdev, 0, &chandef); 3835 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3836 goto nla_put_failure; 3837 } 3838 3839 if (rdev->ops->get_tx_power) { 3840 int dbm, ret; 3841 3842 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3843 if (ret == 0 && 3844 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3845 DBM_TO_MBM(dbm))) 3846 goto nla_put_failure; 3847 } 3848 3849 wdev_lock(wdev); 3850 switch (wdev->iftype) { 3851 case NL80211_IFTYPE_AP: 3852 case NL80211_IFTYPE_P2P_GO: 3853 if (wdev->u.ap.ssid_len && 3854 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 3855 wdev->u.ap.ssid)) 3856 goto nla_put_failure_locked; 3857 break; 3858 case NL80211_IFTYPE_STATION: 3859 case NL80211_IFTYPE_P2P_CLIENT: 3860 if (wdev->u.client.ssid_len && 3861 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len, 3862 wdev->u.client.ssid)) 3863 goto nla_put_failure_locked; 3864 break; 3865 case NL80211_IFTYPE_ADHOC: 3866 if (wdev->u.ibss.ssid_len && 3867 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len, 3868 wdev->u.ibss.ssid)) 3869 goto nla_put_failure_locked; 3870 break; 3871 default: 3872 /* nothing */ 3873 break; 3874 } 3875 wdev_unlock(wdev); 3876 3877 if (rdev->ops->get_txq_stats) { 3878 struct cfg80211_txq_stats txqstats = {}; 3879 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3880 3881 if (ret == 0 && 3882 !nl80211_put_txq_stats(msg, &txqstats, 3883 NL80211_ATTR_TXQ_STATS)) 3884 goto nla_put_failure; 3885 } 3886 3887 if (wdev->valid_links) { 3888 unsigned int link_id; 3889 struct nlattr *links = nla_nest_start(msg, 3890 NL80211_ATTR_MLO_LINKS); 3891 3892 if (!links) 3893 goto nla_put_failure; 3894 3895 for_each_valid_link(wdev, link_id) { 3896 struct nlattr *link = nla_nest_start(msg, link_id + 1); 3897 struct cfg80211_chan_def chandef = {}; 3898 int ret; 3899 3900 if (!link) 3901 goto nla_put_failure; 3902 3903 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 3904 goto nla_put_failure; 3905 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 3906 wdev->links[link_id].addr)) 3907 goto nla_put_failure; 3908 3909 ret = rdev_get_channel(rdev, wdev, link_id, &chandef); 3910 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3911 goto nla_put_failure; 3912 3913 nla_nest_end(msg, link); 3914 } 3915 3916 nla_nest_end(msg, links); 3917 } 3918 3919 genlmsg_end(msg, hdr); 3920 return 0; 3921 3922 nla_put_failure_locked: 3923 wdev_unlock(wdev); 3924 nla_put_failure: 3925 genlmsg_cancel(msg, hdr); 3926 return -EMSGSIZE; 3927 } 3928 3929 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3930 { 3931 int wp_idx = 0; 3932 int if_idx = 0; 3933 int wp_start = cb->args[0]; 3934 int if_start = cb->args[1]; 3935 int filter_wiphy = -1; 3936 struct cfg80211_registered_device *rdev; 3937 struct wireless_dev *wdev; 3938 int ret; 3939 3940 rtnl_lock(); 3941 if (!cb->args[2]) { 3942 struct nl80211_dump_wiphy_state state = { 3943 .filter_wiphy = -1, 3944 }; 3945 3946 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3947 if (ret) 3948 goto out_unlock; 3949 3950 filter_wiphy = state.filter_wiphy; 3951 3952 /* 3953 * if filtering, set cb->args[2] to +1 since 0 is the default 3954 * value needed to determine that parsing is necessary. 3955 */ 3956 if (filter_wiphy >= 0) 3957 cb->args[2] = filter_wiphy + 1; 3958 else 3959 cb->args[2] = -1; 3960 } else if (cb->args[2] > 0) { 3961 filter_wiphy = cb->args[2] - 1; 3962 } 3963 3964 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 3965 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3966 continue; 3967 if (wp_idx < wp_start) { 3968 wp_idx++; 3969 continue; 3970 } 3971 3972 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 3973 continue; 3974 3975 if_idx = 0; 3976 3977 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3978 if (if_idx < if_start) { 3979 if_idx++; 3980 continue; 3981 } 3982 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 3983 cb->nlh->nlmsg_seq, NLM_F_MULTI, 3984 rdev, wdev, 3985 NL80211_CMD_NEW_INTERFACE) < 0) { 3986 goto out; 3987 } 3988 if_idx++; 3989 } 3990 3991 wp_idx++; 3992 } 3993 out: 3994 cb->args[0] = wp_idx; 3995 cb->args[1] = if_idx; 3996 3997 ret = skb->len; 3998 out_unlock: 3999 rtnl_unlock(); 4000 4001 return ret; 4002 } 4003 4004 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 4005 { 4006 struct sk_buff *msg; 4007 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4008 struct wireless_dev *wdev = info->user_ptr[1]; 4009 4010 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4011 if (!msg) 4012 return -ENOMEM; 4013 4014 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4015 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4016 nlmsg_free(msg); 4017 return -ENOBUFS; 4018 } 4019 4020 return genlmsg_reply(msg, info); 4021 } 4022 4023 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 4024 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 4025 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 4026 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 4027 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 4028 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 4029 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 4030 }; 4031 4032 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 4033 { 4034 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 4035 int flag; 4036 4037 *mntrflags = 0; 4038 4039 if (!nla) 4040 return -EINVAL; 4041 4042 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 4043 return -EINVAL; 4044 4045 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 4046 if (flags[flag]) 4047 *mntrflags |= (1<<flag); 4048 4049 *mntrflags |= MONITOR_FLAG_CHANGED; 4050 4051 return 0; 4052 } 4053 4054 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 4055 enum nl80211_iftype type, 4056 struct genl_info *info, 4057 struct vif_params *params) 4058 { 4059 bool change = false; 4060 int err; 4061 4062 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 4063 if (type != NL80211_IFTYPE_MONITOR) 4064 return -EINVAL; 4065 4066 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 4067 ¶ms->flags); 4068 if (err) 4069 return err; 4070 4071 change = true; 4072 } 4073 4074 if (params->flags & MONITOR_FLAG_ACTIVE && 4075 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 4076 return -EOPNOTSUPP; 4077 4078 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 4079 const u8 *mumimo_groups; 4080 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4081 4082 if (type != NL80211_IFTYPE_MONITOR) 4083 return -EINVAL; 4084 4085 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4086 return -EOPNOTSUPP; 4087 4088 mumimo_groups = 4089 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 4090 4091 /* bits 0 and 63 are reserved and must be zero */ 4092 if ((mumimo_groups[0] & BIT(0)) || 4093 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 4094 return -EINVAL; 4095 4096 params->vht_mumimo_groups = mumimo_groups; 4097 change = true; 4098 } 4099 4100 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 4101 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4102 4103 if (type != NL80211_IFTYPE_MONITOR) 4104 return -EINVAL; 4105 4106 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4107 return -EOPNOTSUPP; 4108 4109 params->vht_mumimo_follow_addr = 4110 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 4111 change = true; 4112 } 4113 4114 return change ? 1 : 0; 4115 } 4116 4117 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 4118 struct net_device *netdev, u8 use_4addr, 4119 enum nl80211_iftype iftype) 4120 { 4121 if (!use_4addr) { 4122 if (netdev && netif_is_bridge_port(netdev)) 4123 return -EBUSY; 4124 return 0; 4125 } 4126 4127 switch (iftype) { 4128 case NL80211_IFTYPE_AP_VLAN: 4129 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 4130 return 0; 4131 break; 4132 case NL80211_IFTYPE_STATION: 4133 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 4134 return 0; 4135 break; 4136 default: 4137 break; 4138 } 4139 4140 return -EOPNOTSUPP; 4141 } 4142 4143 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 4144 { 4145 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4146 struct vif_params params; 4147 int err; 4148 enum nl80211_iftype otype, ntype; 4149 struct net_device *dev = info->user_ptr[1]; 4150 bool change = false; 4151 4152 memset(¶ms, 0, sizeof(params)); 4153 4154 otype = ntype = dev->ieee80211_ptr->iftype; 4155 4156 if (info->attrs[NL80211_ATTR_IFTYPE]) { 4157 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4158 if (otype != ntype) 4159 change = true; 4160 } 4161 4162 if (info->attrs[NL80211_ATTR_MESH_ID]) { 4163 struct wireless_dev *wdev = dev->ieee80211_ptr; 4164 4165 if (ntype != NL80211_IFTYPE_MESH_POINT) 4166 return -EINVAL; 4167 if (netif_running(dev)) 4168 return -EBUSY; 4169 4170 wdev_lock(wdev); 4171 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4172 IEEE80211_MAX_MESH_ID_LEN); 4173 wdev->u.mesh.id_up_len = 4174 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4175 memcpy(wdev->u.mesh.id, 4176 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4177 wdev->u.mesh.id_up_len); 4178 wdev_unlock(wdev); 4179 } 4180 4181 if (info->attrs[NL80211_ATTR_4ADDR]) { 4182 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4183 change = true; 4184 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 4185 if (err) 4186 return err; 4187 } else { 4188 params.use_4addr = -1; 4189 } 4190 4191 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 4192 if (err < 0) 4193 return err; 4194 if (err > 0) 4195 change = true; 4196 4197 if (change) 4198 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 4199 else 4200 err = 0; 4201 4202 if (!err && params.use_4addr != -1) 4203 dev->ieee80211_ptr->use_4addr = params.use_4addr; 4204 4205 if (change && !err) { 4206 struct wireless_dev *wdev = dev->ieee80211_ptr; 4207 4208 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 4209 } 4210 4211 return err; 4212 } 4213 4214 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4215 { 4216 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4217 struct vif_params params; 4218 struct wireless_dev *wdev; 4219 struct sk_buff *msg; 4220 int err; 4221 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 4222 4223 memset(¶ms, 0, sizeof(params)); 4224 4225 if (!info->attrs[NL80211_ATTR_IFNAME]) 4226 return -EINVAL; 4227 4228 if (info->attrs[NL80211_ATTR_IFTYPE]) 4229 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4230 4231 if (!rdev->ops->add_virtual_intf) 4232 return -EOPNOTSUPP; 4233 4234 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 4235 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 4236 info->attrs[NL80211_ATTR_MAC]) { 4237 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 4238 ETH_ALEN); 4239 if (!is_valid_ether_addr(params.macaddr)) 4240 return -EADDRNOTAVAIL; 4241 } 4242 4243 if (info->attrs[NL80211_ATTR_4ADDR]) { 4244 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4245 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 4246 if (err) 4247 return err; 4248 } 4249 4250 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 4251 return -EOPNOTSUPP; 4252 4253 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 4254 if (err < 0) 4255 return err; 4256 4257 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4258 if (!msg) 4259 return -ENOMEM; 4260 4261 wdev = rdev_add_virtual_intf(rdev, 4262 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 4263 NET_NAME_USER, type, ¶ms); 4264 if (WARN_ON(!wdev)) { 4265 nlmsg_free(msg); 4266 return -EPROTO; 4267 } else if (IS_ERR(wdev)) { 4268 nlmsg_free(msg); 4269 return PTR_ERR(wdev); 4270 } 4271 4272 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 4273 wdev->owner_nlportid = info->snd_portid; 4274 4275 switch (type) { 4276 case NL80211_IFTYPE_MESH_POINT: 4277 if (!info->attrs[NL80211_ATTR_MESH_ID]) 4278 break; 4279 wdev_lock(wdev); 4280 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4281 IEEE80211_MAX_MESH_ID_LEN); 4282 wdev->u.mesh.id_up_len = 4283 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4284 memcpy(wdev->u.mesh.id, 4285 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4286 wdev->u.mesh.id_up_len); 4287 wdev_unlock(wdev); 4288 break; 4289 case NL80211_IFTYPE_NAN: 4290 case NL80211_IFTYPE_P2P_DEVICE: 4291 /* 4292 * P2P Device and NAN do not have a netdev, so don't go 4293 * through the netdev notifier and must be added here 4294 */ 4295 cfg80211_init_wdev(wdev); 4296 cfg80211_register_wdev(rdev, wdev); 4297 break; 4298 default: 4299 break; 4300 } 4301 4302 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4303 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4304 nlmsg_free(msg); 4305 return -ENOBUFS; 4306 } 4307 4308 return genlmsg_reply(msg, info); 4309 } 4310 4311 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4312 { 4313 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4314 int ret; 4315 4316 /* to avoid failing a new interface creation due to pending removal */ 4317 cfg80211_destroy_ifaces(rdev); 4318 4319 wiphy_lock(&rdev->wiphy); 4320 ret = _nl80211_new_interface(skb, info); 4321 wiphy_unlock(&rdev->wiphy); 4322 4323 return ret; 4324 } 4325 4326 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 4327 { 4328 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4329 struct wireless_dev *wdev = info->user_ptr[1]; 4330 4331 if (!rdev->ops->del_virtual_intf) 4332 return -EOPNOTSUPP; 4333 4334 /* 4335 * We hold RTNL, so this is safe, without RTNL opencount cannot 4336 * reach 0, and thus the rdev cannot be deleted. 4337 * 4338 * We need to do it for the dev_close(), since that will call 4339 * the netdev notifiers, and we need to acquire the mutex there 4340 * but don't know if we get there from here or from some other 4341 * place (e.g. "ip link set ... down"). 4342 */ 4343 mutex_unlock(&rdev->wiphy.mtx); 4344 4345 /* 4346 * If we remove a wireless device without a netdev then clear 4347 * user_ptr[1] so that nl80211_post_doit won't dereference it 4348 * to check if it needs to do dev_put(). Otherwise it crashes 4349 * since the wdev has been freed, unlike with a netdev where 4350 * we need the dev_put() for the netdev to really be freed. 4351 */ 4352 if (!wdev->netdev) 4353 info->user_ptr[1] = NULL; 4354 else 4355 dev_close(wdev->netdev); 4356 4357 mutex_lock(&rdev->wiphy.mtx); 4358 4359 return cfg80211_remove_virtual_intf(rdev, wdev); 4360 } 4361 4362 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 4363 { 4364 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4365 struct net_device *dev = info->user_ptr[1]; 4366 u16 noack_map; 4367 4368 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 4369 return -EINVAL; 4370 4371 if (!rdev->ops->set_noack_map) 4372 return -EOPNOTSUPP; 4373 4374 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 4375 4376 return rdev_set_noack_map(rdev, dev, noack_map); 4377 } 4378 4379 static int nl80211_validate_key_link_id(struct genl_info *info, 4380 struct wireless_dev *wdev, 4381 int link_id, bool pairwise) 4382 { 4383 if (pairwise) { 4384 if (link_id != -1) { 4385 GENL_SET_ERR_MSG(info, 4386 "link ID not allowed for pairwise key"); 4387 return -EINVAL; 4388 } 4389 4390 return 0; 4391 } 4392 4393 if (wdev->valid_links) { 4394 if (link_id == -1) { 4395 GENL_SET_ERR_MSG(info, 4396 "link ID must for MLO group key"); 4397 return -EINVAL; 4398 } 4399 if (!(wdev->valid_links & BIT(link_id))) { 4400 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key"); 4401 return -EINVAL; 4402 } 4403 } else if (link_id != -1) { 4404 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key"); 4405 return -EINVAL; 4406 } 4407 4408 return 0; 4409 } 4410 4411 struct get_key_cookie { 4412 struct sk_buff *msg; 4413 int error; 4414 int idx; 4415 }; 4416 4417 static void get_key_callback(void *c, struct key_params *params) 4418 { 4419 struct nlattr *key; 4420 struct get_key_cookie *cookie = c; 4421 4422 if ((params->key && 4423 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 4424 params->key_len, params->key)) || 4425 (params->seq && 4426 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 4427 params->seq_len, params->seq)) || 4428 (params->cipher && 4429 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 4430 params->cipher))) 4431 goto nla_put_failure; 4432 4433 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 4434 if (!key) 4435 goto nla_put_failure; 4436 4437 if ((params->key && 4438 nla_put(cookie->msg, NL80211_KEY_DATA, 4439 params->key_len, params->key)) || 4440 (params->seq && 4441 nla_put(cookie->msg, NL80211_KEY_SEQ, 4442 params->seq_len, params->seq)) || 4443 (params->cipher && 4444 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 4445 params->cipher))) 4446 goto nla_put_failure; 4447 4448 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 4449 goto nla_put_failure; 4450 4451 nla_nest_end(cookie->msg, key); 4452 4453 return; 4454 nla_put_failure: 4455 cookie->error = 1; 4456 } 4457 4458 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 4459 { 4460 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4461 int err; 4462 struct net_device *dev = info->user_ptr[1]; 4463 u8 key_idx = 0; 4464 const u8 *mac_addr = NULL; 4465 bool pairwise; 4466 struct get_key_cookie cookie = { 4467 .error = 0, 4468 }; 4469 void *hdr; 4470 struct sk_buff *msg; 4471 bool bigtk_support = false; 4472 int link_id = nl80211_link_id_or_invalid(info->attrs); 4473 struct wireless_dev *wdev = dev->ieee80211_ptr; 4474 4475 if (wiphy_ext_feature_isset(&rdev->wiphy, 4476 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 4477 bigtk_support = true; 4478 4479 if ((wdev->iftype == NL80211_IFTYPE_STATION || 4480 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && 4481 wiphy_ext_feature_isset(&rdev->wiphy, 4482 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 4483 bigtk_support = true; 4484 4485 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 4486 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 4487 4488 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 4489 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 4490 return -EINVAL; 4491 } 4492 } 4493 4494 if (info->attrs[NL80211_ATTR_MAC]) 4495 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4496 4497 pairwise = !!mac_addr; 4498 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4499 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4500 4501 if (kt != NL80211_KEYTYPE_GROUP && 4502 kt != NL80211_KEYTYPE_PAIRWISE) 4503 return -EINVAL; 4504 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4505 } 4506 4507 if (!rdev->ops->get_key) 4508 return -EOPNOTSUPP; 4509 4510 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4511 return -ENOENT; 4512 4513 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4514 if (!msg) 4515 return -ENOMEM; 4516 4517 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4518 NL80211_CMD_NEW_KEY); 4519 if (!hdr) 4520 goto nla_put_failure; 4521 4522 cookie.msg = msg; 4523 cookie.idx = key_idx; 4524 4525 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4526 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4527 goto nla_put_failure; 4528 if (mac_addr && 4529 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4530 goto nla_put_failure; 4531 4532 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise); 4533 if (err) 4534 goto free_msg; 4535 4536 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr, 4537 &cookie, get_key_callback); 4538 4539 if (err) 4540 goto free_msg; 4541 4542 if (cookie.error) 4543 goto nla_put_failure; 4544 4545 genlmsg_end(msg, hdr); 4546 return genlmsg_reply(msg, info); 4547 4548 nla_put_failure: 4549 err = -ENOBUFS; 4550 free_msg: 4551 nlmsg_free(msg); 4552 return err; 4553 } 4554 4555 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4556 { 4557 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4558 struct key_parse key; 4559 int err; 4560 struct net_device *dev = info->user_ptr[1]; 4561 int link_id = nl80211_link_id_or_invalid(info->attrs); 4562 struct wireless_dev *wdev = dev->ieee80211_ptr; 4563 4564 err = nl80211_parse_key(info, &key); 4565 if (err) 4566 return err; 4567 4568 if (key.idx < 0) 4569 return -EINVAL; 4570 4571 /* Only support setting default key and 4572 * Extended Key ID action NL80211_KEY_SET_TX. 4573 */ 4574 if (!key.def && !key.defmgmt && !key.defbeacon && 4575 !(key.p.mode == NL80211_KEY_SET_TX)) 4576 return -EINVAL; 4577 4578 wdev_lock(wdev); 4579 4580 if (key.def) { 4581 if (!rdev->ops->set_default_key) { 4582 err = -EOPNOTSUPP; 4583 goto out; 4584 } 4585 4586 err = nl80211_key_allowed(wdev); 4587 if (err) 4588 goto out; 4589 4590 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4591 if (err) 4592 goto out; 4593 4594 err = rdev_set_default_key(rdev, dev, link_id, key.idx, 4595 key.def_uni, key.def_multi); 4596 4597 if (err) 4598 goto out; 4599 4600 #ifdef CONFIG_CFG80211_WEXT 4601 wdev->wext.default_key = key.idx; 4602 #endif 4603 } else if (key.defmgmt) { 4604 if (key.def_uni || !key.def_multi) { 4605 err = -EINVAL; 4606 goto out; 4607 } 4608 4609 if (!rdev->ops->set_default_mgmt_key) { 4610 err = -EOPNOTSUPP; 4611 goto out; 4612 } 4613 4614 err = nl80211_key_allowed(wdev); 4615 if (err) 4616 goto out; 4617 4618 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4619 if (err) 4620 goto out; 4621 4622 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx); 4623 if (err) 4624 goto out; 4625 4626 #ifdef CONFIG_CFG80211_WEXT 4627 wdev->wext.default_mgmt_key = key.idx; 4628 #endif 4629 } else if (key.defbeacon) { 4630 if (key.def_uni || !key.def_multi) { 4631 err = -EINVAL; 4632 goto out; 4633 } 4634 4635 if (!rdev->ops->set_default_beacon_key) { 4636 err = -EOPNOTSUPP; 4637 goto out; 4638 } 4639 4640 err = nl80211_key_allowed(wdev); 4641 if (err) 4642 goto out; 4643 4644 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4645 if (err) 4646 goto out; 4647 4648 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx); 4649 if (err) 4650 goto out; 4651 } else if (key.p.mode == NL80211_KEY_SET_TX && 4652 wiphy_ext_feature_isset(&rdev->wiphy, 4653 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4654 u8 *mac_addr = NULL; 4655 4656 if (info->attrs[NL80211_ATTR_MAC]) 4657 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4658 4659 if (!mac_addr || key.idx < 0 || key.idx > 1) { 4660 err = -EINVAL; 4661 goto out; 4662 } 4663 4664 err = nl80211_validate_key_link_id(info, wdev, link_id, true); 4665 if (err) 4666 goto out; 4667 4668 err = rdev_add_key(rdev, dev, link_id, key.idx, 4669 NL80211_KEYTYPE_PAIRWISE, 4670 mac_addr, &key.p); 4671 } else { 4672 err = -EINVAL; 4673 } 4674 out: 4675 wdev_unlock(wdev); 4676 4677 return err; 4678 } 4679 4680 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4681 { 4682 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4683 int err; 4684 struct net_device *dev = info->user_ptr[1]; 4685 struct key_parse key; 4686 const u8 *mac_addr = NULL; 4687 int link_id = nl80211_link_id_or_invalid(info->attrs); 4688 struct wireless_dev *wdev = dev->ieee80211_ptr; 4689 4690 err = nl80211_parse_key(info, &key); 4691 if (err) 4692 return err; 4693 4694 if (!key.p.key) { 4695 GENL_SET_ERR_MSG(info, "no key"); 4696 return -EINVAL; 4697 } 4698 4699 if (info->attrs[NL80211_ATTR_MAC]) 4700 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4701 4702 if (key.type == -1) { 4703 if (mac_addr) 4704 key.type = NL80211_KEYTYPE_PAIRWISE; 4705 else 4706 key.type = NL80211_KEYTYPE_GROUP; 4707 } 4708 4709 /* for now */ 4710 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4711 key.type != NL80211_KEYTYPE_GROUP) { 4712 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4713 return -EINVAL; 4714 } 4715 4716 if (key.type == NL80211_KEYTYPE_GROUP && 4717 info->attrs[NL80211_ATTR_VLAN_ID]) 4718 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4719 4720 if (!rdev->ops->add_key) 4721 return -EOPNOTSUPP; 4722 4723 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4724 key.type == NL80211_KEYTYPE_PAIRWISE, 4725 mac_addr)) { 4726 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4727 return -EINVAL; 4728 } 4729 4730 wdev_lock(wdev); 4731 err = nl80211_key_allowed(wdev); 4732 if (err) 4733 GENL_SET_ERR_MSG(info, "key not allowed"); 4734 4735 if (!err) 4736 err = nl80211_validate_key_link_id(info, wdev, link_id, 4737 key.type == NL80211_KEYTYPE_PAIRWISE); 4738 4739 if (!err) { 4740 err = rdev_add_key(rdev, dev, link_id, key.idx, 4741 key.type == NL80211_KEYTYPE_PAIRWISE, 4742 mac_addr, &key.p); 4743 if (err) 4744 GENL_SET_ERR_MSG(info, "key addition failed"); 4745 } 4746 wdev_unlock(wdev); 4747 4748 return err; 4749 } 4750 4751 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4752 { 4753 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4754 int err; 4755 struct net_device *dev = info->user_ptr[1]; 4756 u8 *mac_addr = NULL; 4757 struct key_parse key; 4758 int link_id = nl80211_link_id_or_invalid(info->attrs); 4759 struct wireless_dev *wdev = dev->ieee80211_ptr; 4760 4761 err = nl80211_parse_key(info, &key); 4762 if (err) 4763 return err; 4764 4765 if (info->attrs[NL80211_ATTR_MAC]) 4766 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4767 4768 if (key.type == -1) { 4769 if (mac_addr) 4770 key.type = NL80211_KEYTYPE_PAIRWISE; 4771 else 4772 key.type = NL80211_KEYTYPE_GROUP; 4773 } 4774 4775 /* for now */ 4776 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4777 key.type != NL80211_KEYTYPE_GROUP) 4778 return -EINVAL; 4779 4780 if (!cfg80211_valid_key_idx(rdev, key.idx, 4781 key.type == NL80211_KEYTYPE_PAIRWISE)) 4782 return -EINVAL; 4783 4784 if (!rdev->ops->del_key) 4785 return -EOPNOTSUPP; 4786 4787 wdev_lock(wdev); 4788 err = nl80211_key_allowed(wdev); 4789 4790 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4791 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4792 err = -ENOENT; 4793 4794 if (!err) 4795 err = nl80211_validate_key_link_id(info, wdev, link_id, 4796 key.type == NL80211_KEYTYPE_PAIRWISE); 4797 4798 if (!err) 4799 err = rdev_del_key(rdev, dev, link_id, key.idx, 4800 key.type == NL80211_KEYTYPE_PAIRWISE, 4801 mac_addr); 4802 4803 #ifdef CONFIG_CFG80211_WEXT 4804 if (!err) { 4805 if (key.idx == wdev->wext.default_key) 4806 wdev->wext.default_key = -1; 4807 else if (key.idx == wdev->wext.default_mgmt_key) 4808 wdev->wext.default_mgmt_key = -1; 4809 } 4810 #endif 4811 wdev_unlock(wdev); 4812 4813 return err; 4814 } 4815 4816 /* This function returns an error or the number of nested attributes */ 4817 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4818 { 4819 struct nlattr *attr; 4820 int n_entries = 0, tmp; 4821 4822 nla_for_each_nested(attr, nl_attr, tmp) { 4823 if (nla_len(attr) != ETH_ALEN) 4824 return -EINVAL; 4825 4826 n_entries++; 4827 } 4828 4829 return n_entries; 4830 } 4831 4832 /* 4833 * This function parses ACL information and allocates memory for ACL data. 4834 * On successful return, the calling function is responsible to free the 4835 * ACL buffer returned by this function. 4836 */ 4837 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4838 struct genl_info *info) 4839 { 4840 enum nl80211_acl_policy acl_policy; 4841 struct nlattr *attr; 4842 struct cfg80211_acl_data *acl; 4843 int i = 0, n_entries, tmp; 4844 4845 if (!wiphy->max_acl_mac_addrs) 4846 return ERR_PTR(-EOPNOTSUPP); 4847 4848 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4849 return ERR_PTR(-EINVAL); 4850 4851 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4852 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4853 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4854 return ERR_PTR(-EINVAL); 4855 4856 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4857 return ERR_PTR(-EINVAL); 4858 4859 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4860 if (n_entries < 0) 4861 return ERR_PTR(n_entries); 4862 4863 if (n_entries > wiphy->max_acl_mac_addrs) 4864 return ERR_PTR(-ENOTSUPP); 4865 4866 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4867 if (!acl) 4868 return ERR_PTR(-ENOMEM); 4869 4870 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4871 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4872 i++; 4873 } 4874 4875 acl->n_acl_entries = n_entries; 4876 acl->acl_policy = acl_policy; 4877 4878 return acl; 4879 } 4880 4881 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4882 { 4883 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4884 struct net_device *dev = info->user_ptr[1]; 4885 struct cfg80211_acl_data *acl; 4886 int err; 4887 4888 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4889 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4890 return -EOPNOTSUPP; 4891 4892 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval) 4893 return -EINVAL; 4894 4895 acl = parse_acl_data(&rdev->wiphy, info); 4896 if (IS_ERR(acl)) 4897 return PTR_ERR(acl); 4898 4899 err = rdev_set_mac_acl(rdev, dev, acl); 4900 4901 kfree(acl); 4902 4903 return err; 4904 } 4905 4906 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4907 u8 *rates, u8 rates_len) 4908 { 4909 u8 i; 4910 u32 mask = 0; 4911 4912 for (i = 0; i < rates_len; i++) { 4913 int rate = (rates[i] & 0x7f) * 5; 4914 int ridx; 4915 4916 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4917 struct ieee80211_rate *srate = 4918 &sband->bitrates[ridx]; 4919 if (rate == srate->bitrate) { 4920 mask |= 1 << ridx; 4921 break; 4922 } 4923 } 4924 if (ridx == sband->n_bitrates) 4925 return 0; /* rate not found */ 4926 } 4927 4928 return mask; 4929 } 4930 4931 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4932 u8 *rates, u8 rates_len, 4933 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4934 { 4935 u8 i; 4936 4937 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4938 4939 for (i = 0; i < rates_len; i++) { 4940 int ridx, rbit; 4941 4942 ridx = rates[i] / 8; 4943 rbit = BIT(rates[i] % 8); 4944 4945 /* check validity */ 4946 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4947 return false; 4948 4949 /* check availability */ 4950 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4951 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4952 mcs[ridx] |= rbit; 4953 else 4954 return false; 4955 } 4956 4957 return true; 4958 } 4959 4960 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4961 { 4962 u16 mcs_mask = 0; 4963 4964 switch (vht_mcs_map) { 4965 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4966 break; 4967 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4968 mcs_mask = 0x00FF; 4969 break; 4970 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4971 mcs_mask = 0x01FF; 4972 break; 4973 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4974 mcs_mask = 0x03FF; 4975 break; 4976 default: 4977 break; 4978 } 4979 4980 return mcs_mask; 4981 } 4982 4983 static void vht_build_mcs_mask(u16 vht_mcs_map, 4984 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4985 { 4986 u8 nss; 4987 4988 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4989 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4990 vht_mcs_map >>= 2; 4991 } 4992 } 4993 4994 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 4995 struct nl80211_txrate_vht *txrate, 4996 u16 mcs[NL80211_VHT_NSS_MAX]) 4997 { 4998 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4999 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 5000 u8 i; 5001 5002 if (!sband->vht_cap.vht_supported) 5003 return false; 5004 5005 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 5006 5007 /* Build vht_mcs_mask from VHT capabilities */ 5008 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5009 5010 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5011 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5012 mcs[i] = txrate->mcs[i]; 5013 else 5014 return false; 5015 } 5016 5017 return true; 5018 } 5019 5020 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 5021 { 5022 switch (he_mcs_map) { 5023 case IEEE80211_HE_MCS_NOT_SUPPORTED: 5024 return 0; 5025 case IEEE80211_HE_MCS_SUPPORT_0_7: 5026 return 0x00FF; 5027 case IEEE80211_HE_MCS_SUPPORT_0_9: 5028 return 0x03FF; 5029 case IEEE80211_HE_MCS_SUPPORT_0_11: 5030 return 0xFFF; 5031 default: 5032 break; 5033 } 5034 return 0; 5035 } 5036 5037 static void he_build_mcs_mask(u16 he_mcs_map, 5038 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 5039 { 5040 u8 nss; 5041 5042 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 5043 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 5044 he_mcs_map >>= 2; 5045 } 5046 } 5047 5048 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id, 5049 const struct ieee80211_sta_he_cap *he_cap) 5050 { 5051 struct net_device *dev = info->user_ptr[1]; 5052 struct wireless_dev *wdev = dev->ieee80211_ptr; 5053 struct cfg80211_chan_def *chandef; 5054 __le16 tx_mcs; 5055 5056 chandef = wdev_chandef(wdev, link_id); 5057 if (!chandef) { 5058 /* 5059 * This is probably broken, but we never maintained 5060 * a chandef in these cases, so it always was. 5061 */ 5062 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80); 5063 } 5064 5065 switch (chandef->width) { 5066 case NL80211_CHAN_WIDTH_80P80: 5067 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 5068 break; 5069 case NL80211_CHAN_WIDTH_160: 5070 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 5071 break; 5072 default: 5073 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 5074 break; 5075 } 5076 5077 return le16_to_cpu(tx_mcs); 5078 } 5079 5080 static bool he_set_mcs_mask(struct genl_info *info, 5081 struct wireless_dev *wdev, 5082 struct ieee80211_supported_band *sband, 5083 struct nl80211_txrate_he *txrate, 5084 u16 mcs[NL80211_HE_NSS_MAX], 5085 unsigned int link_id) 5086 { 5087 const struct ieee80211_sta_he_cap *he_cap; 5088 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 5089 u16 tx_mcs_map = 0; 5090 u8 i; 5091 5092 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5093 if (!he_cap) 5094 return false; 5095 5096 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 5097 5098 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5099 5100 /* Build he_mcs_mask from HE capabilities */ 5101 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5102 5103 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5104 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5105 mcs[i] = txrate->mcs[i]; 5106 else 5107 return false; 5108 } 5109 5110 return true; 5111 } 5112 5113 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 5114 struct nlattr *attrs[], 5115 enum nl80211_attrs attr, 5116 struct cfg80211_bitrate_mask *mask, 5117 struct net_device *dev, 5118 bool default_all_enabled, 5119 unsigned int link_id) 5120 { 5121 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 5122 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5123 struct wireless_dev *wdev = dev->ieee80211_ptr; 5124 int rem, i; 5125 struct nlattr *tx_rates; 5126 struct ieee80211_supported_band *sband; 5127 u16 vht_tx_mcs_map, he_tx_mcs_map; 5128 5129 memset(mask, 0, sizeof(*mask)); 5130 /* Default to all rates enabled */ 5131 for (i = 0; i < NUM_NL80211_BANDS; i++) { 5132 const struct ieee80211_sta_he_cap *he_cap; 5133 5134 if (!default_all_enabled) 5135 break; 5136 5137 sband = rdev->wiphy.bands[i]; 5138 5139 if (!sband) 5140 continue; 5141 5142 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 5143 memcpy(mask->control[i].ht_mcs, 5144 sband->ht_cap.mcs.rx_mask, 5145 sizeof(mask->control[i].ht_mcs)); 5146 5147 if (sband->vht_cap.vht_supported) { 5148 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 5149 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 5150 } 5151 5152 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5153 if (!he_cap) 5154 continue; 5155 5156 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5157 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 5158 5159 mask->control[i].he_gi = 0xFF; 5160 mask->control[i].he_ltf = 0xFF; 5161 } 5162 5163 /* if no rates are given set it back to the defaults */ 5164 if (!attrs[attr]) 5165 goto out; 5166 5167 /* The nested attribute uses enum nl80211_band as the index. This maps 5168 * directly to the enum nl80211_band values used in cfg80211. 5169 */ 5170 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 5171 nla_for_each_nested(tx_rates, attrs[attr], rem) { 5172 enum nl80211_band band = nla_type(tx_rates); 5173 int err; 5174 5175 if (band < 0 || band >= NUM_NL80211_BANDS) 5176 return -EINVAL; 5177 sband = rdev->wiphy.bands[band]; 5178 if (sband == NULL) 5179 return -EINVAL; 5180 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 5181 tx_rates, 5182 nl80211_txattr_policy, 5183 info->extack); 5184 if (err) 5185 return err; 5186 if (tb[NL80211_TXRATE_LEGACY]) { 5187 mask->control[band].legacy = rateset_to_mask( 5188 sband, 5189 nla_data(tb[NL80211_TXRATE_LEGACY]), 5190 nla_len(tb[NL80211_TXRATE_LEGACY])); 5191 if ((mask->control[band].legacy == 0) && 5192 nla_len(tb[NL80211_TXRATE_LEGACY])) 5193 return -EINVAL; 5194 } 5195 if (tb[NL80211_TXRATE_HT]) { 5196 if (!ht_rateset_to_mask( 5197 sband, 5198 nla_data(tb[NL80211_TXRATE_HT]), 5199 nla_len(tb[NL80211_TXRATE_HT]), 5200 mask->control[band].ht_mcs)) 5201 return -EINVAL; 5202 } 5203 5204 if (tb[NL80211_TXRATE_VHT]) { 5205 if (!vht_set_mcs_mask( 5206 sband, 5207 nla_data(tb[NL80211_TXRATE_VHT]), 5208 mask->control[band].vht_mcs)) 5209 return -EINVAL; 5210 } 5211 5212 if (tb[NL80211_TXRATE_GI]) { 5213 mask->control[band].gi = 5214 nla_get_u8(tb[NL80211_TXRATE_GI]); 5215 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 5216 return -EINVAL; 5217 } 5218 if (tb[NL80211_TXRATE_HE] && 5219 !he_set_mcs_mask(info, wdev, sband, 5220 nla_data(tb[NL80211_TXRATE_HE]), 5221 mask->control[band].he_mcs, 5222 link_id)) 5223 return -EINVAL; 5224 5225 if (tb[NL80211_TXRATE_HE_GI]) 5226 mask->control[band].he_gi = 5227 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 5228 if (tb[NL80211_TXRATE_HE_LTF]) 5229 mask->control[band].he_ltf = 5230 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 5231 5232 if (mask->control[band].legacy == 0) { 5233 /* don't allow empty legacy rates if HT, VHT or HE 5234 * are not even supported. 5235 */ 5236 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 5237 rdev->wiphy.bands[band]->vht_cap.vht_supported || 5238 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 5239 return -EINVAL; 5240 5241 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 5242 if (mask->control[band].ht_mcs[i]) 5243 goto out; 5244 5245 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 5246 if (mask->control[band].vht_mcs[i]) 5247 goto out; 5248 5249 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 5250 if (mask->control[band].he_mcs[i]) 5251 goto out; 5252 5253 /* legacy and mcs rates may not be both empty */ 5254 return -EINVAL; 5255 } 5256 } 5257 5258 out: 5259 return 0; 5260 } 5261 5262 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 5263 enum nl80211_band band, 5264 struct cfg80211_bitrate_mask *beacon_rate) 5265 { 5266 u32 count_ht, count_vht, count_he, i; 5267 u32 rate = beacon_rate->control[band].legacy; 5268 5269 /* Allow only one rate */ 5270 if (hweight32(rate) > 1) 5271 return -EINVAL; 5272 5273 count_ht = 0; 5274 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 5275 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 5276 return -EINVAL; 5277 } else if (beacon_rate->control[band].ht_mcs[i]) { 5278 count_ht++; 5279 if (count_ht > 1) 5280 return -EINVAL; 5281 } 5282 if (count_ht && rate) 5283 return -EINVAL; 5284 } 5285 5286 count_vht = 0; 5287 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5288 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 5289 return -EINVAL; 5290 } else if (beacon_rate->control[band].vht_mcs[i]) { 5291 count_vht++; 5292 if (count_vht > 1) 5293 return -EINVAL; 5294 } 5295 if (count_vht && rate) 5296 return -EINVAL; 5297 } 5298 5299 count_he = 0; 5300 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5301 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) { 5302 return -EINVAL; 5303 } else if (beacon_rate->control[band].he_mcs[i]) { 5304 count_he++; 5305 if (count_he > 1) 5306 return -EINVAL; 5307 } 5308 if (count_he && rate) 5309 return -EINVAL; 5310 } 5311 5312 if ((count_ht && count_vht && count_he) || 5313 (!rate && !count_ht && !count_vht && !count_he)) 5314 return -EINVAL; 5315 5316 if (rate && 5317 !wiphy_ext_feature_isset(&rdev->wiphy, 5318 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 5319 return -EINVAL; 5320 if (count_ht && 5321 !wiphy_ext_feature_isset(&rdev->wiphy, 5322 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 5323 return -EINVAL; 5324 if (count_vht && 5325 !wiphy_ext_feature_isset(&rdev->wiphy, 5326 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 5327 return -EINVAL; 5328 if (count_he && 5329 !wiphy_ext_feature_isset(&rdev->wiphy, 5330 NL80211_EXT_FEATURE_BEACON_RATE_HE)) 5331 return -EINVAL; 5332 5333 return 0; 5334 } 5335 5336 static int nl80211_parse_mbssid_config(struct wiphy *wiphy, 5337 struct net_device *dev, 5338 struct nlattr *attrs, 5339 struct cfg80211_mbssid_config *config, 5340 u8 num_elems) 5341 { 5342 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1]; 5343 5344 if (!wiphy->mbssid_max_interfaces) 5345 return -EOPNOTSUPP; 5346 5347 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL, 5348 NULL) || 5349 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]) 5350 return -EINVAL; 5351 5352 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]); 5353 if (config->ema) { 5354 if (!wiphy->ema_max_profile_periodicity) 5355 return -EOPNOTSUPP; 5356 5357 if (num_elems > wiphy->ema_max_profile_periodicity) 5358 return -EINVAL; 5359 } 5360 5361 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]); 5362 if (config->index >= wiphy->mbssid_max_interfaces || 5363 (!config->index && !num_elems)) 5364 return -EINVAL; 5365 5366 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) { 5367 u32 tx_ifindex = 5368 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]); 5369 5370 if ((!config->index && tx_ifindex != dev->ifindex) || 5371 (config->index && tx_ifindex == dev->ifindex)) 5372 return -EINVAL; 5373 5374 if (tx_ifindex != dev->ifindex) { 5375 struct net_device *tx_netdev = 5376 dev_get_by_index(wiphy_net(wiphy), tx_ifindex); 5377 5378 if (!tx_netdev || !tx_netdev->ieee80211_ptr || 5379 tx_netdev->ieee80211_ptr->wiphy != wiphy || 5380 tx_netdev->ieee80211_ptr->iftype != 5381 NL80211_IFTYPE_AP) { 5382 dev_put(tx_netdev); 5383 return -EINVAL; 5384 } 5385 5386 config->tx_wdev = tx_netdev->ieee80211_ptr; 5387 } else { 5388 config->tx_wdev = dev->ieee80211_ptr; 5389 } 5390 } else if (!config->index) { 5391 config->tx_wdev = dev->ieee80211_ptr; 5392 } else { 5393 return -EINVAL; 5394 } 5395 5396 return 0; 5397 } 5398 5399 static struct cfg80211_mbssid_elems * 5400 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs) 5401 { 5402 struct nlattr *nl_elems; 5403 struct cfg80211_mbssid_elems *elems; 5404 int rem_elems; 5405 u8 i = 0, num_elems = 0; 5406 5407 if (!wiphy->mbssid_max_interfaces) 5408 return ERR_PTR(-EINVAL); 5409 5410 nla_for_each_nested(nl_elems, attrs, rem_elems) 5411 num_elems++; 5412 5413 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL); 5414 if (!elems) 5415 return ERR_PTR(-ENOMEM); 5416 5417 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5418 elems->elem[i].data = nla_data(nl_elems); 5419 elems->elem[i].len = nla_len(nl_elems); 5420 i++; 5421 } 5422 elems->cnt = num_elems; 5423 return elems; 5424 } 5425 5426 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 5427 struct cfg80211_he_bss_color *he_bss_color) 5428 { 5429 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 5430 int err; 5431 5432 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 5433 he_bss_color_policy, NULL); 5434 if (err) 5435 return err; 5436 5437 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 5438 return -EINVAL; 5439 5440 he_bss_color->color = 5441 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 5442 he_bss_color->enabled = 5443 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 5444 he_bss_color->partial = 5445 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 5446 5447 return 0; 5448 } 5449 5450 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 5451 struct nlattr *attrs[], 5452 struct cfg80211_beacon_data *bcn) 5453 { 5454 bool haveinfo = false; 5455 int err; 5456 5457 memset(bcn, 0, sizeof(*bcn)); 5458 5459 bcn->link_id = nl80211_link_id(attrs); 5460 5461 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 5462 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 5463 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 5464 if (!bcn->head_len) 5465 return -EINVAL; 5466 haveinfo = true; 5467 } 5468 5469 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 5470 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 5471 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 5472 haveinfo = true; 5473 } 5474 5475 if (!haveinfo) 5476 return -EINVAL; 5477 5478 if (attrs[NL80211_ATTR_IE]) { 5479 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 5480 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 5481 } 5482 5483 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 5484 bcn->proberesp_ies = 5485 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5486 bcn->proberesp_ies_len = 5487 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5488 } 5489 5490 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 5491 bcn->assocresp_ies = 5492 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5493 bcn->assocresp_ies_len = 5494 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5495 } 5496 5497 if (attrs[NL80211_ATTR_PROBE_RESP]) { 5498 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 5499 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 5500 } 5501 5502 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 5503 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 5504 5505 err = nla_parse_nested_deprecated(tb, 5506 NL80211_FTM_RESP_ATTR_MAX, 5507 attrs[NL80211_ATTR_FTM_RESPONDER], 5508 NULL, NULL); 5509 if (err) 5510 return err; 5511 5512 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 5513 wiphy_ext_feature_isset(&rdev->wiphy, 5514 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 5515 bcn->ftm_responder = 1; 5516 else 5517 return -EOPNOTSUPP; 5518 5519 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 5520 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 5521 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 5522 } 5523 5524 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 5525 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5526 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5527 } 5528 } else { 5529 bcn->ftm_responder = -1; 5530 } 5531 5532 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5533 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR], 5534 &bcn->he_bss_color); 5535 if (err) 5536 return err; 5537 bcn->he_bss_color_valid = true; 5538 } 5539 5540 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) { 5541 struct cfg80211_mbssid_elems *mbssid = 5542 nl80211_parse_mbssid_elems(&rdev->wiphy, 5543 attrs[NL80211_ATTR_MBSSID_ELEMS]); 5544 5545 if (IS_ERR(mbssid)) 5546 return PTR_ERR(mbssid); 5547 5548 bcn->mbssid_ies = mbssid; 5549 } 5550 5551 return 0; 5552 } 5553 5554 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 5555 struct ieee80211_he_obss_pd *he_obss_pd) 5556 { 5557 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 5558 int err; 5559 5560 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 5561 he_obss_pd_policy, NULL); 5562 if (err) 5563 return err; 5564 5565 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 5566 return -EINVAL; 5567 5568 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 5569 5570 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 5571 he_obss_pd->min_offset = 5572 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 5573 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 5574 he_obss_pd->max_offset = 5575 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 5576 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 5577 he_obss_pd->non_srg_max_offset = 5578 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 5579 5580 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 5581 return -EINVAL; 5582 5583 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 5584 memcpy(he_obss_pd->bss_color_bitmap, 5585 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 5586 sizeof(he_obss_pd->bss_color_bitmap)); 5587 5588 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 5589 memcpy(he_obss_pd->partial_bssid_bitmap, 5590 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 5591 sizeof(he_obss_pd->partial_bssid_bitmap)); 5592 5593 he_obss_pd->enable = true; 5594 5595 return 0; 5596 } 5597 5598 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 5599 struct nlattr *attrs, 5600 struct cfg80211_ap_settings *params) 5601 { 5602 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 5603 int ret; 5604 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery; 5605 5606 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5607 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 5608 return -EINVAL; 5609 5610 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 5611 NULL, NULL); 5612 if (ret) 5613 return ret; 5614 5615 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 5616 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 5617 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 5618 return -EINVAL; 5619 5620 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5621 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5622 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 5623 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 5624 5625 return 0; 5626 } 5627 5628 static int 5629 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 5630 struct nlattr *attrs, 5631 struct cfg80211_ap_settings *params) 5632 { 5633 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 5634 int ret; 5635 struct cfg80211_unsol_bcast_probe_resp *presp = 5636 ¶ms->unsol_bcast_probe_resp; 5637 5638 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5639 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 5640 return -EINVAL; 5641 5642 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 5643 attrs, NULL, NULL); 5644 if (ret) 5645 return ret; 5646 5647 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 5648 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 5649 return -EINVAL; 5650 5651 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5652 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5653 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5654 return 0; 5655 } 5656 5657 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5658 const struct element *rates) 5659 { 5660 int i; 5661 5662 if (!rates) 5663 return; 5664 5665 for (i = 0; i < rates->datalen; i++) { 5666 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5667 params->ht_required = true; 5668 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5669 params->vht_required = true; 5670 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5671 params->he_required = true; 5672 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E) 5673 params->sae_h2e_required = true; 5674 } 5675 } 5676 5677 /* 5678 * Since the nl80211 API didn't include, from the beginning, attributes about 5679 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5680 * benefit of drivers that rebuild IEs in the firmware. 5681 */ 5682 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5683 { 5684 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5685 size_t ies_len = bcn->tail_len; 5686 const u8 *ies = bcn->tail; 5687 const struct element *rates; 5688 const struct element *cap; 5689 5690 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len); 5691 nl80211_check_ap_rate_selectors(params, rates); 5692 5693 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5694 nl80211_check_ap_rate_selectors(params, rates); 5695 5696 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5697 if (cap && cap->datalen >= sizeof(*params->ht_cap)) 5698 params->ht_cap = (void *)cap->data; 5699 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5700 if (cap && cap->datalen >= sizeof(*params->vht_cap)) 5701 params->vht_cap = (void *)cap->data; 5702 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5703 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1) 5704 params->he_cap = (void *)(cap->data + 1); 5705 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5706 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) 5707 params->he_oper = (void *)(cap->data + 1); 5708 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len); 5709 if (cap) { 5710 if (!cap->datalen) 5711 return -EINVAL; 5712 params->eht_cap = (void *)(cap->data + 1); 5713 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap, 5714 (const u8 *)params->eht_cap, 5715 cap->datalen - 1, true)) 5716 return -EINVAL; 5717 } 5718 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len); 5719 if (cap) { 5720 if (!cap->datalen) 5721 return -EINVAL; 5722 params->eht_oper = (void *)(cap->data + 1); 5723 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper, 5724 cap->datalen - 1)) 5725 return -EINVAL; 5726 } 5727 return 0; 5728 } 5729 5730 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5731 struct cfg80211_ap_settings *params) 5732 { 5733 struct wireless_dev *wdev; 5734 5735 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5736 if (wdev->iftype != NL80211_IFTYPE_AP && 5737 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5738 continue; 5739 5740 if (!wdev->u.ap.preset_chandef.chan) 5741 continue; 5742 5743 params->chandef = wdev->u.ap.preset_chandef; 5744 return true; 5745 } 5746 5747 return false; 5748 } 5749 5750 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5751 enum nl80211_auth_type auth_type, 5752 enum nl80211_commands cmd) 5753 { 5754 if (auth_type > NL80211_AUTHTYPE_MAX) 5755 return false; 5756 5757 switch (cmd) { 5758 case NL80211_CMD_AUTHENTICATE: 5759 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5760 auth_type == NL80211_AUTHTYPE_SAE) 5761 return false; 5762 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5763 NL80211_EXT_FEATURE_FILS_STA) && 5764 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5765 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5766 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5767 return false; 5768 return true; 5769 case NL80211_CMD_CONNECT: 5770 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5771 !wiphy_ext_feature_isset(&rdev->wiphy, 5772 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5773 auth_type == NL80211_AUTHTYPE_SAE) 5774 return false; 5775 5776 /* FILS with SK PFS or PK not supported yet */ 5777 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5778 auth_type == NL80211_AUTHTYPE_FILS_PK) 5779 return false; 5780 if (!wiphy_ext_feature_isset( 5781 &rdev->wiphy, 5782 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5783 auth_type == NL80211_AUTHTYPE_FILS_SK) 5784 return false; 5785 return true; 5786 case NL80211_CMD_START_AP: 5787 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5788 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5789 auth_type == NL80211_AUTHTYPE_SAE) 5790 return false; 5791 /* FILS not supported yet */ 5792 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5793 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5794 auth_type == NL80211_AUTHTYPE_FILS_PK) 5795 return false; 5796 return true; 5797 default: 5798 return false; 5799 } 5800 } 5801 5802 static void nl80211_send_ap_started(struct wireless_dev *wdev, 5803 unsigned int link_id) 5804 { 5805 struct wiphy *wiphy = wdev->wiphy; 5806 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 5807 struct sk_buff *msg; 5808 void *hdr; 5809 5810 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5811 if (!msg) 5812 return; 5813 5814 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP); 5815 if (!hdr) 5816 goto out; 5817 5818 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 5819 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 5820 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 5821 NL80211_ATTR_PAD) || 5822 (wdev->u.ap.ssid_len && 5823 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 5824 wdev->u.ap.ssid)) || 5825 (wdev->valid_links && 5826 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 5827 goto out; 5828 5829 genlmsg_end(msg, hdr); 5830 5831 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 5832 NL80211_MCGRP_MLME, GFP_KERNEL); 5833 return; 5834 out: 5835 nlmsg_free(msg); 5836 } 5837 5838 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5839 { 5840 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5841 unsigned int link_id = nl80211_link_id(info->attrs); 5842 struct net_device *dev = info->user_ptr[1]; 5843 struct wireless_dev *wdev = dev->ieee80211_ptr; 5844 struct cfg80211_ap_settings *params; 5845 int err; 5846 5847 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5848 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5849 return -EOPNOTSUPP; 5850 5851 if (!rdev->ops->start_ap) 5852 return -EOPNOTSUPP; 5853 5854 if (wdev->links[link_id].ap.beacon_interval) 5855 return -EALREADY; 5856 5857 /* these are required for START_AP */ 5858 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5859 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5860 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5861 return -EINVAL; 5862 5863 params = kzalloc(sizeof(*params), GFP_KERNEL); 5864 if (!params) 5865 return -ENOMEM; 5866 5867 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon); 5868 if (err) 5869 goto out; 5870 5871 params->beacon_interval = 5872 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5873 params->dtim_period = 5874 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5875 5876 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5877 params->beacon_interval); 5878 if (err) 5879 goto out; 5880 5881 /* 5882 * In theory, some of these attributes should be required here 5883 * but since they were not used when the command was originally 5884 * added, keep them optional for old user space programs to let 5885 * them continue to work with drivers that do not need the 5886 * additional information -- drivers must check! 5887 */ 5888 if (info->attrs[NL80211_ATTR_SSID]) { 5889 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5890 params->ssid_len = 5891 nla_len(info->attrs[NL80211_ATTR_SSID]); 5892 if (params->ssid_len == 0) { 5893 err = -EINVAL; 5894 goto out; 5895 } 5896 5897 if (wdev->u.ap.ssid_len && 5898 (wdev->u.ap.ssid_len != params->ssid_len || 5899 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) { 5900 /* require identical SSID for MLO */ 5901 err = -EINVAL; 5902 goto out; 5903 } 5904 } else if (wdev->valid_links) { 5905 /* require SSID for MLO */ 5906 err = -EINVAL; 5907 goto out; 5908 } 5909 5910 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5911 params->hidden_ssid = nla_get_u32( 5912 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5913 5914 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5915 5916 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 5917 params->auth_type = nla_get_u32( 5918 info->attrs[NL80211_ATTR_AUTH_TYPE]); 5919 if (!nl80211_valid_auth_type(rdev, params->auth_type, 5920 NL80211_CMD_START_AP)) { 5921 err = -EINVAL; 5922 goto out; 5923 } 5924 } else 5925 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC; 5926 5927 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto, 5928 NL80211_MAX_NR_CIPHER_SUITES); 5929 if (err) 5930 goto out; 5931 5932 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 5933 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) { 5934 err = -EOPNOTSUPP; 5935 goto out; 5936 } 5937 params->inactivity_timeout = nla_get_u16( 5938 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 5939 } 5940 5941 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5942 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 5943 err = -EINVAL; 5944 goto out; 5945 } 5946 params->p2p_ctwindow = 5947 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5948 if (params->p2p_ctwindow != 0 && 5949 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) { 5950 err = -EINVAL; 5951 goto out; 5952 } 5953 } 5954 5955 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5956 u8 tmp; 5957 5958 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 5959 err = -EINVAL; 5960 goto out; 5961 } 5962 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5963 params->p2p_opp_ps = tmp; 5964 if (params->p2p_opp_ps != 0 && 5965 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) { 5966 err = -EINVAL; 5967 goto out; 5968 } 5969 } 5970 5971 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 5972 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef); 5973 if (err) 5974 goto out; 5975 } else if (wdev->valid_links) { 5976 /* with MLD need to specify the channel configuration */ 5977 err = -EINVAL; 5978 goto out; 5979 } else if (wdev->u.ap.preset_chandef.chan) { 5980 params->chandef = wdev->u.ap.preset_chandef; 5981 } else if (!nl80211_get_ap_channel(rdev, params)) { 5982 err = -EINVAL; 5983 goto out; 5984 } 5985 5986 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 5987 err = nl80211_parse_punct_bitmap(rdev, info, 5988 ¶ms->chandef, 5989 ¶ms->punct_bitmap); 5990 if (err) 5991 goto out; 5992 } 5993 5994 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms->chandef, 5995 wdev->iftype)) { 5996 err = -EINVAL; 5997 goto out; 5998 } 5999 6000 wdev_lock(wdev); 6001 6002 if (info->attrs[NL80211_ATTR_TX_RATES]) { 6003 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 6004 NL80211_ATTR_TX_RATES, 6005 ¶ms->beacon_rate, 6006 dev, false, link_id); 6007 if (err) 6008 goto out_unlock; 6009 6010 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band, 6011 ¶ms->beacon_rate); 6012 if (err) 6013 goto out_unlock; 6014 } 6015 6016 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 6017 params->smps_mode = 6018 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 6019 switch (params->smps_mode) { 6020 case NL80211_SMPS_OFF: 6021 break; 6022 case NL80211_SMPS_STATIC: 6023 if (!(rdev->wiphy.features & 6024 NL80211_FEATURE_STATIC_SMPS)) { 6025 err = -EINVAL; 6026 goto out_unlock; 6027 } 6028 break; 6029 case NL80211_SMPS_DYNAMIC: 6030 if (!(rdev->wiphy.features & 6031 NL80211_FEATURE_DYNAMIC_SMPS)) { 6032 err = -EINVAL; 6033 goto out_unlock; 6034 } 6035 break; 6036 default: 6037 err = -EINVAL; 6038 goto out_unlock; 6039 } 6040 } else { 6041 params->smps_mode = NL80211_SMPS_OFF; 6042 } 6043 6044 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 6045 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 6046 err = -EOPNOTSUPP; 6047 goto out_unlock; 6048 } 6049 6050 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 6051 params->acl = parse_acl_data(&rdev->wiphy, info); 6052 if (IS_ERR(params->acl)) { 6053 err = PTR_ERR(params->acl); 6054 params->acl = NULL; 6055 goto out_unlock; 6056 } 6057 } 6058 6059 params->twt_responder = 6060 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 6061 6062 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 6063 err = nl80211_parse_he_obss_pd( 6064 info->attrs[NL80211_ATTR_HE_OBSS_PD], 6065 ¶ms->he_obss_pd); 6066 if (err) 6067 goto out_unlock; 6068 } 6069 6070 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 6071 err = nl80211_parse_fils_discovery(rdev, 6072 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 6073 params); 6074 if (err) 6075 goto out_unlock; 6076 } 6077 6078 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 6079 err = nl80211_parse_unsol_bcast_probe_resp( 6080 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 6081 params); 6082 if (err) 6083 goto out_unlock; 6084 } 6085 6086 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) { 6087 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, 6088 info->attrs[NL80211_ATTR_MBSSID_CONFIG], 6089 ¶ms->mbssid_config, 6090 params->beacon.mbssid_ies ? 6091 params->beacon.mbssid_ies->cnt : 6092 0); 6093 if (err) 6094 goto out_unlock; 6095 } 6096 6097 err = nl80211_calculate_ap_params(params); 6098 if (err) 6099 goto out_unlock; 6100 6101 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]) 6102 params->flags = nla_get_u32( 6103 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]); 6104 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 6105 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 6106 6107 if (wdev->conn_owner_nlportid && 6108 info->attrs[NL80211_ATTR_SOCKET_OWNER] && 6109 wdev->conn_owner_nlportid != info->snd_portid) { 6110 err = -EINVAL; 6111 goto out_unlock; 6112 } 6113 6114 /* FIXME: validate MLO/link-id against driver capabilities */ 6115 6116 err = rdev_start_ap(rdev, dev, params); 6117 if (!err) { 6118 wdev->links[link_id].ap.beacon_interval = params->beacon_interval; 6119 wdev->links[link_id].ap.chandef = params->chandef; 6120 wdev->u.ap.ssid_len = params->ssid_len; 6121 memcpy(wdev->u.ap.ssid, params->ssid, 6122 params->ssid_len); 6123 6124 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 6125 wdev->conn_owner_nlportid = info->snd_portid; 6126 6127 nl80211_send_ap_started(wdev, link_id); 6128 } 6129 out_unlock: 6130 wdev_unlock(wdev); 6131 out: 6132 kfree(params->acl); 6133 kfree(params->beacon.mbssid_ies); 6134 if (params->mbssid_config.tx_wdev && 6135 params->mbssid_config.tx_wdev->netdev && 6136 params->mbssid_config.tx_wdev->netdev != dev) 6137 dev_put(params->mbssid_config.tx_wdev->netdev); 6138 kfree(params); 6139 6140 return err; 6141 } 6142 6143 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 6144 { 6145 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6146 unsigned int link_id = nl80211_link_id(info->attrs); 6147 struct net_device *dev = info->user_ptr[1]; 6148 struct wireless_dev *wdev = dev->ieee80211_ptr; 6149 struct cfg80211_beacon_data params; 6150 int err; 6151 6152 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6153 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6154 return -EOPNOTSUPP; 6155 6156 if (!rdev->ops->change_beacon) 6157 return -EOPNOTSUPP; 6158 6159 if (!wdev->links[link_id].ap.beacon_interval) 6160 return -EINVAL; 6161 6162 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms); 6163 if (err) 6164 goto out; 6165 6166 wdev_lock(wdev); 6167 err = rdev_change_beacon(rdev, dev, ¶ms); 6168 wdev_unlock(wdev); 6169 6170 out: 6171 kfree(params.mbssid_ies); 6172 return err; 6173 } 6174 6175 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 6176 { 6177 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6178 unsigned int link_id = nl80211_link_id(info->attrs); 6179 struct net_device *dev = info->user_ptr[1]; 6180 6181 return cfg80211_stop_ap(rdev, dev, link_id, false); 6182 } 6183 6184 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 6185 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 6186 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 6187 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 6188 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 6189 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 6190 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 6191 }; 6192 6193 static int parse_station_flags(struct genl_info *info, 6194 enum nl80211_iftype iftype, 6195 struct station_parameters *params) 6196 { 6197 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 6198 struct nlattr *nla; 6199 int flag; 6200 6201 /* 6202 * Try parsing the new attribute first so userspace 6203 * can specify both for older kernels. 6204 */ 6205 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 6206 if (nla) { 6207 struct nl80211_sta_flag_update *sta_flags; 6208 6209 sta_flags = nla_data(nla); 6210 params->sta_flags_mask = sta_flags->mask; 6211 params->sta_flags_set = sta_flags->set; 6212 params->sta_flags_set &= params->sta_flags_mask; 6213 if ((params->sta_flags_mask | 6214 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 6215 return -EINVAL; 6216 return 0; 6217 } 6218 6219 /* if present, parse the old attribute */ 6220 6221 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 6222 if (!nla) 6223 return 0; 6224 6225 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 6226 return -EINVAL; 6227 6228 /* 6229 * Only allow certain flags for interface types so that 6230 * other attributes are silently ignored. Remember that 6231 * this is backward compatibility code with old userspace 6232 * and shouldn't be hit in other cases anyway. 6233 */ 6234 switch (iftype) { 6235 case NL80211_IFTYPE_AP: 6236 case NL80211_IFTYPE_AP_VLAN: 6237 case NL80211_IFTYPE_P2P_GO: 6238 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6239 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6240 BIT(NL80211_STA_FLAG_WME) | 6241 BIT(NL80211_STA_FLAG_MFP); 6242 break; 6243 case NL80211_IFTYPE_P2P_CLIENT: 6244 case NL80211_IFTYPE_STATION: 6245 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6246 BIT(NL80211_STA_FLAG_TDLS_PEER); 6247 break; 6248 case NL80211_IFTYPE_MESH_POINT: 6249 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6250 BIT(NL80211_STA_FLAG_MFP) | 6251 BIT(NL80211_STA_FLAG_AUTHORIZED); 6252 break; 6253 default: 6254 return -EINVAL; 6255 } 6256 6257 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 6258 if (flags[flag]) { 6259 params->sta_flags_set |= (1<<flag); 6260 6261 /* no longer support new API additions in old API */ 6262 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 6263 return -EINVAL; 6264 } 6265 } 6266 6267 return 0; 6268 } 6269 6270 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 6271 { 6272 struct nlattr *rate; 6273 u32 bitrate; 6274 u16 bitrate_compat; 6275 enum nl80211_rate_info rate_flg; 6276 6277 rate = nla_nest_start_noflag(msg, attr); 6278 if (!rate) 6279 return false; 6280 6281 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 6282 bitrate = cfg80211_calculate_bitrate(info); 6283 /* report 16-bit bitrate only if we can */ 6284 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 6285 if (bitrate > 0 && 6286 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 6287 return false; 6288 if (bitrate_compat > 0 && 6289 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 6290 return false; 6291 6292 switch (info->bw) { 6293 case RATE_INFO_BW_5: 6294 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 6295 break; 6296 case RATE_INFO_BW_10: 6297 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 6298 break; 6299 default: 6300 WARN_ON(1); 6301 fallthrough; 6302 case RATE_INFO_BW_20: 6303 rate_flg = 0; 6304 break; 6305 case RATE_INFO_BW_40: 6306 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 6307 break; 6308 case RATE_INFO_BW_80: 6309 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 6310 break; 6311 case RATE_INFO_BW_160: 6312 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 6313 break; 6314 case RATE_INFO_BW_HE_RU: 6315 rate_flg = 0; 6316 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 6317 break; 6318 case RATE_INFO_BW_320: 6319 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH; 6320 break; 6321 case RATE_INFO_BW_EHT_RU: 6322 rate_flg = 0; 6323 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS)); 6324 break; 6325 } 6326 6327 if (rate_flg && nla_put_flag(msg, rate_flg)) 6328 return false; 6329 6330 if (info->flags & RATE_INFO_FLAGS_MCS) { 6331 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 6332 return false; 6333 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6334 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6335 return false; 6336 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 6337 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 6338 return false; 6339 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 6340 return false; 6341 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6342 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6343 return false; 6344 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 6345 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 6346 return false; 6347 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 6348 return false; 6349 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 6350 return false; 6351 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 6352 return false; 6353 if (info->bw == RATE_INFO_BW_HE_RU && 6354 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 6355 info->he_ru_alloc)) 6356 return false; 6357 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) { 6358 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs)) 6359 return false; 6360 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss)) 6361 return false; 6362 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi)) 6363 return false; 6364 if (info->bw == RATE_INFO_BW_EHT_RU && 6365 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC, 6366 info->eht_ru_alloc)) 6367 return false; 6368 } 6369 6370 nla_nest_end(msg, rate); 6371 return true; 6372 } 6373 6374 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 6375 int id) 6376 { 6377 void *attr; 6378 int i = 0; 6379 6380 if (!mask) 6381 return true; 6382 6383 attr = nla_nest_start_noflag(msg, id); 6384 if (!attr) 6385 return false; 6386 6387 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 6388 if (!(mask & BIT(i))) 6389 continue; 6390 6391 if (nla_put_u8(msg, i, signal[i])) 6392 return false; 6393 } 6394 6395 nla_nest_end(msg, attr); 6396 6397 return true; 6398 } 6399 6400 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 6401 u32 seq, int flags, 6402 struct cfg80211_registered_device *rdev, 6403 struct net_device *dev, 6404 const u8 *mac_addr, struct station_info *sinfo) 6405 { 6406 void *hdr; 6407 struct nlattr *sinfoattr, *bss_param; 6408 6409 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 6410 if (!hdr) { 6411 cfg80211_sinfo_release_content(sinfo); 6412 return -1; 6413 } 6414 6415 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6416 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 6417 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 6418 goto nla_put_failure; 6419 6420 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 6421 if (!sinfoattr) 6422 goto nla_put_failure; 6423 6424 #define PUT_SINFO(attr, memb, type) do { \ 6425 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 6426 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6427 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 6428 sinfo->memb)) \ 6429 goto nla_put_failure; \ 6430 } while (0) 6431 #define PUT_SINFO_U64(attr, memb) do { \ 6432 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6433 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 6434 sinfo->memb, NL80211_STA_INFO_PAD)) \ 6435 goto nla_put_failure; \ 6436 } while (0) 6437 6438 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 6439 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 6440 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 6441 6442 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 6443 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 6444 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 6445 (u32)sinfo->rx_bytes)) 6446 goto nla_put_failure; 6447 6448 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 6449 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 6450 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 6451 (u32)sinfo->tx_bytes)) 6452 goto nla_put_failure; 6453 6454 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 6455 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 6456 PUT_SINFO(LLID, llid, u16); 6457 PUT_SINFO(PLID, plid, u16); 6458 PUT_SINFO(PLINK_STATE, plink_state, u8); 6459 PUT_SINFO_U64(RX_DURATION, rx_duration); 6460 PUT_SINFO_U64(TX_DURATION, tx_duration); 6461 6462 if (wiphy_ext_feature_isset(&rdev->wiphy, 6463 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6464 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 6465 6466 switch (rdev->wiphy.signal_type) { 6467 case CFG80211_SIGNAL_TYPE_MBM: 6468 PUT_SINFO(SIGNAL, signal, u8); 6469 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 6470 break; 6471 default: 6472 break; 6473 } 6474 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 6475 if (!nl80211_put_signal(msg, sinfo->chains, 6476 sinfo->chain_signal, 6477 NL80211_STA_INFO_CHAIN_SIGNAL)) 6478 goto nla_put_failure; 6479 } 6480 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 6481 if (!nl80211_put_signal(msg, sinfo->chains, 6482 sinfo->chain_signal_avg, 6483 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 6484 goto nla_put_failure; 6485 } 6486 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 6487 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 6488 NL80211_STA_INFO_TX_BITRATE)) 6489 goto nla_put_failure; 6490 } 6491 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 6492 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 6493 NL80211_STA_INFO_RX_BITRATE)) 6494 goto nla_put_failure; 6495 } 6496 6497 PUT_SINFO(RX_PACKETS, rx_packets, u32); 6498 PUT_SINFO(TX_PACKETS, tx_packets, u32); 6499 PUT_SINFO(TX_RETRIES, tx_retries, u32); 6500 PUT_SINFO(TX_FAILED, tx_failed, u32); 6501 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 6502 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 6503 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 6504 PUT_SINFO(LOCAL_PM, local_pm, u32); 6505 PUT_SINFO(PEER_PM, peer_pm, u32); 6506 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 6507 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 6508 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 6509 6510 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 6511 bss_param = nla_nest_start_noflag(msg, 6512 NL80211_STA_INFO_BSS_PARAM); 6513 if (!bss_param) 6514 goto nla_put_failure; 6515 6516 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 6517 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 6518 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 6519 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 6520 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 6521 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 6522 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 6523 sinfo->bss_param.dtim_period) || 6524 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 6525 sinfo->bss_param.beacon_interval)) 6526 goto nla_put_failure; 6527 6528 nla_nest_end(msg, bss_param); 6529 } 6530 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 6531 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 6532 sizeof(struct nl80211_sta_flag_update), 6533 &sinfo->sta_flags)) 6534 goto nla_put_failure; 6535 6536 PUT_SINFO_U64(T_OFFSET, t_offset); 6537 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 6538 PUT_SINFO_U64(BEACON_RX, rx_beacon); 6539 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 6540 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 6541 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 6542 if (wiphy_ext_feature_isset(&rdev->wiphy, 6543 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 6544 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 6545 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 6546 } 6547 6548 #undef PUT_SINFO 6549 #undef PUT_SINFO_U64 6550 6551 if (sinfo->pertid) { 6552 struct nlattr *tidsattr; 6553 int tid; 6554 6555 tidsattr = nla_nest_start_noflag(msg, 6556 NL80211_STA_INFO_TID_STATS); 6557 if (!tidsattr) 6558 goto nla_put_failure; 6559 6560 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 6561 struct cfg80211_tid_stats *tidstats; 6562 struct nlattr *tidattr; 6563 6564 tidstats = &sinfo->pertid[tid]; 6565 6566 if (!tidstats->filled) 6567 continue; 6568 6569 tidattr = nla_nest_start_noflag(msg, tid + 1); 6570 if (!tidattr) 6571 goto nla_put_failure; 6572 6573 #define PUT_TIDVAL_U64(attr, memb) do { \ 6574 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 6575 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 6576 tidstats->memb, NL80211_TID_STATS_PAD)) \ 6577 goto nla_put_failure; \ 6578 } while (0) 6579 6580 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 6581 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 6582 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 6583 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 6584 6585 #undef PUT_TIDVAL_U64 6586 if ((tidstats->filled & 6587 BIT(NL80211_TID_STATS_TXQ_STATS)) && 6588 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 6589 NL80211_TID_STATS_TXQ_STATS)) 6590 goto nla_put_failure; 6591 6592 nla_nest_end(msg, tidattr); 6593 } 6594 6595 nla_nest_end(msg, tidsattr); 6596 } 6597 6598 nla_nest_end(msg, sinfoattr); 6599 6600 if (sinfo->assoc_req_ies_len && 6601 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 6602 sinfo->assoc_req_ies)) 6603 goto nla_put_failure; 6604 6605 if (sinfo->assoc_resp_ies_len && 6606 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len, 6607 sinfo->assoc_resp_ies)) 6608 goto nla_put_failure; 6609 6610 if (sinfo->mlo_params_valid) { 6611 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 6612 sinfo->assoc_link_id)) 6613 goto nla_put_failure; 6614 6615 if (!is_zero_ether_addr(sinfo->mld_addr) && 6616 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 6617 sinfo->mld_addr)) 6618 goto nla_put_failure; 6619 } 6620 6621 cfg80211_sinfo_release_content(sinfo); 6622 genlmsg_end(msg, hdr); 6623 return 0; 6624 6625 nla_put_failure: 6626 cfg80211_sinfo_release_content(sinfo); 6627 genlmsg_cancel(msg, hdr); 6628 return -EMSGSIZE; 6629 } 6630 6631 static int nl80211_dump_station(struct sk_buff *skb, 6632 struct netlink_callback *cb) 6633 { 6634 struct station_info sinfo; 6635 struct cfg80211_registered_device *rdev; 6636 struct wireless_dev *wdev; 6637 u8 mac_addr[ETH_ALEN]; 6638 int sta_idx = cb->args[2]; 6639 int err; 6640 6641 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 6642 if (err) 6643 return err; 6644 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 6645 __acquire(&rdev->wiphy.mtx); 6646 6647 if (!wdev->netdev) { 6648 err = -EINVAL; 6649 goto out_err; 6650 } 6651 6652 if (!rdev->ops->dump_station) { 6653 err = -EOPNOTSUPP; 6654 goto out_err; 6655 } 6656 6657 while (1) { 6658 memset(&sinfo, 0, sizeof(sinfo)); 6659 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 6660 mac_addr, &sinfo); 6661 if (err == -ENOENT) 6662 break; 6663 if (err) 6664 goto out_err; 6665 6666 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 6667 NETLINK_CB(cb->skb).portid, 6668 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6669 rdev, wdev->netdev, mac_addr, 6670 &sinfo) < 0) 6671 goto out; 6672 6673 sta_idx++; 6674 } 6675 6676 out: 6677 cb->args[2] = sta_idx; 6678 err = skb->len; 6679 out_err: 6680 wiphy_unlock(&rdev->wiphy); 6681 6682 return err; 6683 } 6684 6685 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 6686 { 6687 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6688 struct net_device *dev = info->user_ptr[1]; 6689 struct station_info sinfo; 6690 struct sk_buff *msg; 6691 u8 *mac_addr = NULL; 6692 int err; 6693 6694 memset(&sinfo, 0, sizeof(sinfo)); 6695 6696 if (!info->attrs[NL80211_ATTR_MAC]) 6697 return -EINVAL; 6698 6699 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6700 6701 if (!rdev->ops->get_station) 6702 return -EOPNOTSUPP; 6703 6704 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 6705 if (err) 6706 return err; 6707 6708 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6709 if (!msg) { 6710 cfg80211_sinfo_release_content(&sinfo); 6711 return -ENOMEM; 6712 } 6713 6714 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 6715 info->snd_portid, info->snd_seq, 0, 6716 rdev, dev, mac_addr, &sinfo) < 0) { 6717 nlmsg_free(msg); 6718 return -ENOBUFS; 6719 } 6720 6721 return genlmsg_reply(msg, info); 6722 } 6723 6724 int cfg80211_check_station_change(struct wiphy *wiphy, 6725 struct station_parameters *params, 6726 enum cfg80211_station_type statype) 6727 { 6728 if (params->listen_interval != -1 && 6729 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6730 return -EINVAL; 6731 6732 if (params->support_p2p_ps != -1 && 6733 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6734 return -EINVAL; 6735 6736 if (params->aid && 6737 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 6738 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6739 return -EINVAL; 6740 6741 /* When you run into this, adjust the code below for the new flag */ 6742 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6743 6744 switch (statype) { 6745 case CFG80211_STA_MESH_PEER_KERNEL: 6746 case CFG80211_STA_MESH_PEER_USER: 6747 /* 6748 * No ignoring the TDLS flag here -- the userspace mesh 6749 * code doesn't have the bug of including TDLS in the 6750 * mask everywhere. 6751 */ 6752 if (params->sta_flags_mask & 6753 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6754 BIT(NL80211_STA_FLAG_MFP) | 6755 BIT(NL80211_STA_FLAG_AUTHORIZED))) 6756 return -EINVAL; 6757 break; 6758 case CFG80211_STA_TDLS_PEER_SETUP: 6759 case CFG80211_STA_TDLS_PEER_ACTIVE: 6760 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6761 return -EINVAL; 6762 /* ignore since it can't change */ 6763 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6764 break; 6765 default: 6766 /* disallow mesh-specific things */ 6767 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 6768 return -EINVAL; 6769 if (params->local_pm) 6770 return -EINVAL; 6771 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6772 return -EINVAL; 6773 } 6774 6775 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6776 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 6777 /* TDLS can't be set, ... */ 6778 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 6779 return -EINVAL; 6780 /* 6781 * ... but don't bother the driver with it. This works around 6782 * a hostapd/wpa_supplicant issue -- it always includes the 6783 * TLDS_PEER flag in the mask even for AP mode. 6784 */ 6785 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6786 } 6787 6788 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6789 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6790 /* reject other things that can't change */ 6791 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 6792 return -EINVAL; 6793 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 6794 return -EINVAL; 6795 if (params->link_sta_params.supported_rates) 6796 return -EINVAL; 6797 if (params->ext_capab || params->link_sta_params.ht_capa || 6798 params->link_sta_params.vht_capa || 6799 params->link_sta_params.he_capa || 6800 params->link_sta_params.eht_capa) 6801 return -EINVAL; 6802 } 6803 6804 if (statype != CFG80211_STA_AP_CLIENT && 6805 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6806 if (params->vlan) 6807 return -EINVAL; 6808 } 6809 6810 switch (statype) { 6811 case CFG80211_STA_AP_MLME_CLIENT: 6812 /* Use this only for authorizing/unauthorizing a station */ 6813 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 6814 return -EOPNOTSUPP; 6815 break; 6816 case CFG80211_STA_AP_CLIENT: 6817 case CFG80211_STA_AP_CLIENT_UNASSOC: 6818 /* accept only the listed bits */ 6819 if (params->sta_flags_mask & 6820 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6821 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6822 BIT(NL80211_STA_FLAG_ASSOCIATED) | 6823 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6824 BIT(NL80211_STA_FLAG_WME) | 6825 BIT(NL80211_STA_FLAG_MFP))) 6826 return -EINVAL; 6827 6828 /* but authenticated/associated only if driver handles it */ 6829 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6830 params->sta_flags_mask & 6831 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6832 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6833 return -EINVAL; 6834 break; 6835 case CFG80211_STA_IBSS: 6836 case CFG80211_STA_AP_STA: 6837 /* reject any changes other than AUTHORIZED */ 6838 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6839 return -EINVAL; 6840 break; 6841 case CFG80211_STA_TDLS_PEER_SETUP: 6842 /* reject any changes other than AUTHORIZED or WME */ 6843 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6844 BIT(NL80211_STA_FLAG_WME))) 6845 return -EINVAL; 6846 /* force (at least) rates when authorizing */ 6847 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6848 !params->link_sta_params.supported_rates) 6849 return -EINVAL; 6850 break; 6851 case CFG80211_STA_TDLS_PEER_ACTIVE: 6852 /* reject any changes */ 6853 return -EINVAL; 6854 case CFG80211_STA_MESH_PEER_KERNEL: 6855 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6856 return -EINVAL; 6857 break; 6858 case CFG80211_STA_MESH_PEER_USER: 6859 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6860 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6861 return -EINVAL; 6862 break; 6863 } 6864 6865 /* 6866 * Older kernel versions ignored this attribute entirely, so don't 6867 * reject attempts to update it but mark it as unused instead so the 6868 * driver won't look at the data. 6869 */ 6870 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 6871 statype != CFG80211_STA_TDLS_PEER_SETUP) 6872 params->link_sta_params.opmode_notif_used = false; 6873 6874 return 0; 6875 } 6876 EXPORT_SYMBOL(cfg80211_check_station_change); 6877 6878 /* 6879 * Get vlan interface making sure it is running and on the right wiphy. 6880 */ 6881 static struct net_device *get_vlan(struct genl_info *info, 6882 struct cfg80211_registered_device *rdev) 6883 { 6884 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 6885 struct net_device *v; 6886 int ret; 6887 6888 if (!vlanattr) 6889 return NULL; 6890 6891 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 6892 if (!v) 6893 return ERR_PTR(-ENODEV); 6894 6895 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 6896 ret = -EINVAL; 6897 goto error; 6898 } 6899 6900 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 6901 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6902 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6903 ret = -EINVAL; 6904 goto error; 6905 } 6906 6907 if (!netif_running(v)) { 6908 ret = -ENETDOWN; 6909 goto error; 6910 } 6911 6912 return v; 6913 error: 6914 dev_put(v); 6915 return ERR_PTR(ret); 6916 } 6917 6918 static int nl80211_parse_sta_wme(struct genl_info *info, 6919 struct station_parameters *params) 6920 { 6921 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 6922 struct nlattr *nla; 6923 int err; 6924 6925 /* parse WME attributes if present */ 6926 if (!info->attrs[NL80211_ATTR_STA_WME]) 6927 return 0; 6928 6929 nla = info->attrs[NL80211_ATTR_STA_WME]; 6930 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 6931 nl80211_sta_wme_policy, 6932 info->extack); 6933 if (err) 6934 return err; 6935 6936 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 6937 params->uapsd_queues = nla_get_u8( 6938 tb[NL80211_STA_WME_UAPSD_QUEUES]); 6939 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 6940 return -EINVAL; 6941 6942 if (tb[NL80211_STA_WME_MAX_SP]) 6943 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 6944 6945 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 6946 return -EINVAL; 6947 6948 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 6949 6950 return 0; 6951 } 6952 6953 static int nl80211_parse_sta_channel_info(struct genl_info *info, 6954 struct station_parameters *params) 6955 { 6956 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 6957 params->supported_channels = 6958 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6959 params->supported_channels_len = 6960 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6961 /* 6962 * Need to include at least one (first channel, number of 6963 * channels) tuple for each subband (checked in policy), 6964 * and must have proper tuples for the rest of the data as well. 6965 */ 6966 if (params->supported_channels_len % 2) 6967 return -EINVAL; 6968 } 6969 6970 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 6971 params->supported_oper_classes = 6972 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6973 params->supported_oper_classes_len = 6974 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6975 } 6976 return 0; 6977 } 6978 6979 static int nl80211_set_station_tdls(struct genl_info *info, 6980 struct station_parameters *params) 6981 { 6982 int err; 6983 /* Dummy STA entry gets updated once the peer capabilities are known */ 6984 if (info->attrs[NL80211_ATTR_PEER_AID]) 6985 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6986 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6987 params->link_sta_params.ht_capa = 6988 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6989 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6990 params->link_sta_params.vht_capa = 6991 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6992 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6993 params->link_sta_params.he_capa = 6994 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6995 params->link_sta_params.he_capa_len = 6996 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6997 6998 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 6999 params->link_sta_params.eht_capa = 7000 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7001 params->link_sta_params.eht_capa_len = 7002 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7003 7004 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa, 7005 (const u8 *)params->link_sta_params.eht_capa, 7006 params->link_sta_params.eht_capa_len, 7007 false)) 7008 return -EINVAL; 7009 } 7010 } 7011 7012 err = nl80211_parse_sta_channel_info(info, params); 7013 if (err) 7014 return err; 7015 7016 return nl80211_parse_sta_wme(info, params); 7017 } 7018 7019 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 7020 struct sta_txpwr *txpwr, 7021 bool *txpwr_set) 7022 { 7023 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7024 int idx; 7025 7026 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 7027 if (!rdev->ops->set_tx_power || 7028 !wiphy_ext_feature_isset(&rdev->wiphy, 7029 NL80211_EXT_FEATURE_STA_TX_PWR)) 7030 return -EOPNOTSUPP; 7031 7032 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 7033 txpwr->type = nla_get_u8(info->attrs[idx]); 7034 7035 if (txpwr->type == NL80211_TX_POWER_LIMITED) { 7036 idx = NL80211_ATTR_STA_TX_POWER; 7037 7038 if (info->attrs[idx]) 7039 txpwr->power = nla_get_s16(info->attrs[idx]); 7040 else 7041 return -EINVAL; 7042 } 7043 7044 *txpwr_set = true; 7045 } else { 7046 *txpwr_set = false; 7047 } 7048 7049 return 0; 7050 } 7051 7052 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 7053 { 7054 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7055 struct net_device *dev = info->user_ptr[1]; 7056 struct station_parameters params; 7057 u8 *mac_addr; 7058 int err; 7059 7060 memset(¶ms, 0, sizeof(params)); 7061 7062 if (!rdev->ops->change_station) 7063 return -EOPNOTSUPP; 7064 7065 /* 7066 * AID and listen_interval properties can be set only for unassociated 7067 * station. Include these parameters here and will check them in 7068 * cfg80211_check_station_change(). 7069 */ 7070 if (info->attrs[NL80211_ATTR_STA_AID]) 7071 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7072 7073 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7074 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7075 7076 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7077 params.listen_interval = 7078 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7079 else 7080 params.listen_interval = -1; 7081 7082 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 7083 params.support_p2p_ps = 7084 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7085 else 7086 params.support_p2p_ps = -1; 7087 7088 if (!info->attrs[NL80211_ATTR_MAC]) 7089 return -EINVAL; 7090 7091 params.link_sta_params.link_id = 7092 nl80211_link_id_or_invalid(info->attrs); 7093 7094 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7095 /* If MLD_ADDR attribute is set then this is an MLD station 7096 * and the MLD_ADDR attribute holds the MLD address and the 7097 * MAC attribute holds for the LINK address. 7098 * In that case, the link_id is also expected to be valid. 7099 */ 7100 if (params.link_sta_params.link_id < 0) 7101 return -EINVAL; 7102 7103 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7104 params.link_sta_params.mld_mac = mac_addr; 7105 params.link_sta_params.link_mac = 7106 nla_data(info->attrs[NL80211_ATTR_MAC]); 7107 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7108 return -EINVAL; 7109 } else { 7110 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7111 } 7112 7113 7114 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 7115 params.link_sta_params.supported_rates = 7116 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7117 params.link_sta_params.supported_rates_len = 7118 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7119 } 7120 7121 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7122 params.capability = 7123 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7124 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7125 } 7126 7127 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7128 params.ext_capab = 7129 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7130 params.ext_capab_len = 7131 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7132 } 7133 7134 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7135 return -EINVAL; 7136 7137 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7138 params.plink_action = 7139 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7140 7141 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 7142 params.plink_state = 7143 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 7144 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 7145 params.peer_aid = nla_get_u16( 7146 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 7147 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 7148 } 7149 7150 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 7151 params.local_pm = nla_get_u32( 7152 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 7153 7154 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7155 params.link_sta_params.opmode_notif_used = true; 7156 params.link_sta_params.opmode_notif = 7157 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7158 } 7159 7160 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7161 params.link_sta_params.he_6ghz_capa = 7162 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7163 7164 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7165 params.airtime_weight = 7166 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7167 7168 if (params.airtime_weight && 7169 !wiphy_ext_feature_isset(&rdev->wiphy, 7170 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7171 return -EOPNOTSUPP; 7172 7173 err = nl80211_parse_sta_txpower_setting(info, 7174 ¶ms.link_sta_params.txpwr, 7175 ¶ms.link_sta_params.txpwr_set); 7176 if (err) 7177 return err; 7178 7179 /* Include parameters for TDLS peer (will check later) */ 7180 err = nl80211_set_station_tdls(info, ¶ms); 7181 if (err) 7182 return err; 7183 7184 params.vlan = get_vlan(info, rdev); 7185 if (IS_ERR(params.vlan)) 7186 return PTR_ERR(params.vlan); 7187 7188 switch (dev->ieee80211_ptr->iftype) { 7189 case NL80211_IFTYPE_AP: 7190 case NL80211_IFTYPE_AP_VLAN: 7191 case NL80211_IFTYPE_P2P_GO: 7192 case NL80211_IFTYPE_P2P_CLIENT: 7193 case NL80211_IFTYPE_STATION: 7194 case NL80211_IFTYPE_ADHOC: 7195 case NL80211_IFTYPE_MESH_POINT: 7196 break; 7197 default: 7198 err = -EOPNOTSUPP; 7199 goto out_put_vlan; 7200 } 7201 7202 /* driver will call cfg80211_check_station_change() */ 7203 wdev_lock(dev->ieee80211_ptr); 7204 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 7205 wdev_unlock(dev->ieee80211_ptr); 7206 7207 out_put_vlan: 7208 dev_put(params.vlan); 7209 7210 return err; 7211 } 7212 7213 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 7214 { 7215 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7216 int err; 7217 struct net_device *dev = info->user_ptr[1]; 7218 struct wireless_dev *wdev = dev->ieee80211_ptr; 7219 struct station_parameters params; 7220 u8 *mac_addr = NULL; 7221 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 7222 BIT(NL80211_STA_FLAG_ASSOCIATED); 7223 7224 memset(¶ms, 0, sizeof(params)); 7225 7226 if (!rdev->ops->add_station) 7227 return -EOPNOTSUPP; 7228 7229 if (!info->attrs[NL80211_ATTR_MAC]) 7230 return -EINVAL; 7231 7232 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7233 return -EINVAL; 7234 7235 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 7236 return -EINVAL; 7237 7238 if (!info->attrs[NL80211_ATTR_STA_AID] && 7239 !info->attrs[NL80211_ATTR_PEER_AID]) 7240 return -EINVAL; 7241 7242 params.link_sta_params.link_id = 7243 nl80211_link_id_or_invalid(info->attrs); 7244 7245 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7246 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7247 params.link_sta_params.mld_mac = mac_addr; 7248 params.link_sta_params.link_mac = 7249 nla_data(info->attrs[NL80211_ATTR_MAC]); 7250 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7251 return -EINVAL; 7252 } else { 7253 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7254 } 7255 7256 params.link_sta_params.supported_rates = 7257 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7258 params.link_sta_params.supported_rates_len = 7259 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7260 params.listen_interval = 7261 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7262 7263 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7264 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7265 7266 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 7267 params.support_p2p_ps = 7268 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7269 } else { 7270 /* 7271 * if not specified, assume it's supported for P2P GO interface, 7272 * and is NOT supported for AP interface 7273 */ 7274 params.support_p2p_ps = 7275 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 7276 } 7277 7278 if (info->attrs[NL80211_ATTR_PEER_AID]) 7279 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 7280 else 7281 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7282 7283 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7284 params.capability = 7285 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7286 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7287 } 7288 7289 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7290 params.ext_capab = 7291 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7292 params.ext_capab_len = 7293 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7294 } 7295 7296 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 7297 params.link_sta_params.ht_capa = 7298 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 7299 7300 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 7301 params.link_sta_params.vht_capa = 7302 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 7303 7304 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 7305 params.link_sta_params.he_capa = 7306 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7307 params.link_sta_params.he_capa_len = 7308 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7309 7310 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 7311 params.link_sta_params.eht_capa = 7312 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7313 params.link_sta_params.eht_capa_len = 7314 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7315 7316 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa, 7317 (const u8 *)params.link_sta_params.eht_capa, 7318 params.link_sta_params.eht_capa_len, 7319 false)) 7320 return -EINVAL; 7321 } 7322 } 7323 7324 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7325 params.link_sta_params.he_6ghz_capa = 7326 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7327 7328 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7329 params.link_sta_params.opmode_notif_used = true; 7330 params.link_sta_params.opmode_notif = 7331 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7332 } 7333 7334 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7335 params.plink_action = 7336 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7337 7338 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7339 params.airtime_weight = 7340 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7341 7342 if (params.airtime_weight && 7343 !wiphy_ext_feature_isset(&rdev->wiphy, 7344 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7345 return -EOPNOTSUPP; 7346 7347 err = nl80211_parse_sta_txpower_setting(info, 7348 ¶ms.link_sta_params.txpwr, 7349 ¶ms.link_sta_params.txpwr_set); 7350 if (err) 7351 return err; 7352 7353 err = nl80211_parse_sta_channel_info(info, ¶ms); 7354 if (err) 7355 return err; 7356 7357 err = nl80211_parse_sta_wme(info, ¶ms); 7358 if (err) 7359 return err; 7360 7361 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7362 return -EINVAL; 7363 7364 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 7365 * as userspace might just pass through the capabilities from the IEs 7366 * directly, rather than enforcing this restriction and returning an 7367 * error in this case. 7368 */ 7369 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 7370 params.link_sta_params.ht_capa = NULL; 7371 params.link_sta_params.vht_capa = NULL; 7372 7373 /* HE and EHT require WME */ 7374 if (params.link_sta_params.he_capa_len || 7375 params.link_sta_params.he_6ghz_capa || 7376 params.link_sta_params.eht_capa_len) 7377 return -EINVAL; 7378 } 7379 7380 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 7381 if (params.link_sta_params.he_6ghz_capa && 7382 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa)) 7383 return -EINVAL; 7384 7385 /* When you run into this, adjust the code below for the new flag */ 7386 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 7387 7388 switch (dev->ieee80211_ptr->iftype) { 7389 case NL80211_IFTYPE_AP: 7390 case NL80211_IFTYPE_AP_VLAN: 7391 case NL80211_IFTYPE_P2P_GO: 7392 /* ignore WME attributes if iface/sta is not capable */ 7393 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 7394 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 7395 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7396 7397 /* TDLS peers cannot be added */ 7398 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7399 info->attrs[NL80211_ATTR_PEER_AID]) 7400 return -EINVAL; 7401 /* but don't bother the driver with it */ 7402 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 7403 7404 /* allow authenticated/associated only if driver handles it */ 7405 if (!(rdev->wiphy.features & 7406 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 7407 params.sta_flags_mask & auth_assoc) 7408 return -EINVAL; 7409 7410 /* Older userspace, or userspace wanting to be compatible with 7411 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 7412 * and assoc flags in the mask, but assumes the station will be 7413 * added as associated anyway since this was the required driver 7414 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 7415 * introduced. 7416 * In order to not bother drivers with this quirk in the API 7417 * set the flags in both the mask and set for new stations in 7418 * this case. 7419 */ 7420 if (!(params.sta_flags_mask & auth_assoc)) { 7421 params.sta_flags_mask |= auth_assoc; 7422 params.sta_flags_set |= auth_assoc; 7423 } 7424 7425 /* must be last in here for error handling */ 7426 params.vlan = get_vlan(info, rdev); 7427 if (IS_ERR(params.vlan)) 7428 return PTR_ERR(params.vlan); 7429 break; 7430 case NL80211_IFTYPE_MESH_POINT: 7431 /* ignore uAPSD data */ 7432 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7433 7434 /* associated is disallowed */ 7435 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 7436 return -EINVAL; 7437 /* TDLS peers cannot be added */ 7438 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7439 info->attrs[NL80211_ATTR_PEER_AID]) 7440 return -EINVAL; 7441 break; 7442 case NL80211_IFTYPE_STATION: 7443 case NL80211_IFTYPE_P2P_CLIENT: 7444 /* ignore uAPSD data */ 7445 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7446 7447 /* these are disallowed */ 7448 if (params.sta_flags_mask & 7449 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 7450 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 7451 return -EINVAL; 7452 /* Only TDLS peers can be added */ 7453 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 7454 return -EINVAL; 7455 /* Can only add if TDLS ... */ 7456 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 7457 return -EOPNOTSUPP; 7458 /* ... with external setup is supported */ 7459 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 7460 return -EOPNOTSUPP; 7461 /* 7462 * Older wpa_supplicant versions always mark the TDLS peer 7463 * as authorized, but it shouldn't yet be. 7464 */ 7465 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 7466 break; 7467 default: 7468 return -EOPNOTSUPP; 7469 } 7470 7471 /* be aware of params.vlan when changing code here */ 7472 7473 wdev_lock(dev->ieee80211_ptr); 7474 if (wdev->valid_links) { 7475 if (params.link_sta_params.link_id < 0) { 7476 err = -EINVAL; 7477 goto out; 7478 } 7479 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) { 7480 err = -ENOLINK; 7481 goto out; 7482 } 7483 } else { 7484 if (params.link_sta_params.link_id >= 0) { 7485 err = -EINVAL; 7486 goto out; 7487 } 7488 } 7489 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 7490 out: 7491 wdev_unlock(dev->ieee80211_ptr); 7492 dev_put(params.vlan); 7493 return err; 7494 } 7495 7496 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 7497 { 7498 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7499 struct net_device *dev = info->user_ptr[1]; 7500 struct station_del_parameters params; 7501 int ret; 7502 7503 memset(¶ms, 0, sizeof(params)); 7504 7505 if (info->attrs[NL80211_ATTR_MAC]) 7506 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 7507 7508 switch (dev->ieee80211_ptr->iftype) { 7509 case NL80211_IFTYPE_AP: 7510 case NL80211_IFTYPE_AP_VLAN: 7511 case NL80211_IFTYPE_MESH_POINT: 7512 case NL80211_IFTYPE_P2P_GO: 7513 /* always accept these */ 7514 break; 7515 case NL80211_IFTYPE_ADHOC: 7516 /* conditionally accept */ 7517 if (wiphy_ext_feature_isset(&rdev->wiphy, 7518 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 7519 break; 7520 return -EINVAL; 7521 default: 7522 return -EINVAL; 7523 } 7524 7525 if (!rdev->ops->del_station) 7526 return -EOPNOTSUPP; 7527 7528 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 7529 params.subtype = 7530 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 7531 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 7532 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 7533 return -EINVAL; 7534 } else { 7535 /* Default to Deauthentication frame */ 7536 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 7537 } 7538 7539 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 7540 params.reason_code = 7541 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 7542 if (params.reason_code == 0) 7543 return -EINVAL; /* 0 is reserved */ 7544 } else { 7545 /* Default to reason code 2 */ 7546 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 7547 } 7548 7549 wdev_lock(dev->ieee80211_ptr); 7550 ret = rdev_del_station(rdev, dev, ¶ms); 7551 wdev_unlock(dev->ieee80211_ptr); 7552 7553 return ret; 7554 } 7555 7556 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 7557 int flags, struct net_device *dev, 7558 u8 *dst, u8 *next_hop, 7559 struct mpath_info *pinfo) 7560 { 7561 void *hdr; 7562 struct nlattr *pinfoattr; 7563 7564 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 7565 if (!hdr) 7566 return -1; 7567 7568 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7569 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 7570 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 7571 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 7572 goto nla_put_failure; 7573 7574 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 7575 if (!pinfoattr) 7576 goto nla_put_failure; 7577 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 7578 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 7579 pinfo->frame_qlen)) 7580 goto nla_put_failure; 7581 if (((pinfo->filled & MPATH_INFO_SN) && 7582 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 7583 ((pinfo->filled & MPATH_INFO_METRIC) && 7584 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 7585 pinfo->metric)) || 7586 ((pinfo->filled & MPATH_INFO_EXPTIME) && 7587 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 7588 pinfo->exptime)) || 7589 ((pinfo->filled & MPATH_INFO_FLAGS) && 7590 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 7591 pinfo->flags)) || 7592 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 7593 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 7594 pinfo->discovery_timeout)) || 7595 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 7596 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 7597 pinfo->discovery_retries)) || 7598 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 7599 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 7600 pinfo->hop_count)) || 7601 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 7602 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 7603 pinfo->path_change_count))) 7604 goto nla_put_failure; 7605 7606 nla_nest_end(msg, pinfoattr); 7607 7608 genlmsg_end(msg, hdr); 7609 return 0; 7610 7611 nla_put_failure: 7612 genlmsg_cancel(msg, hdr); 7613 return -EMSGSIZE; 7614 } 7615 7616 static int nl80211_dump_mpath(struct sk_buff *skb, 7617 struct netlink_callback *cb) 7618 { 7619 struct mpath_info pinfo; 7620 struct cfg80211_registered_device *rdev; 7621 struct wireless_dev *wdev; 7622 u8 dst[ETH_ALEN]; 7623 u8 next_hop[ETH_ALEN]; 7624 int path_idx = cb->args[2]; 7625 int err; 7626 7627 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7628 if (err) 7629 return err; 7630 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7631 __acquire(&rdev->wiphy.mtx); 7632 7633 if (!rdev->ops->dump_mpath) { 7634 err = -EOPNOTSUPP; 7635 goto out_err; 7636 } 7637 7638 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7639 err = -EOPNOTSUPP; 7640 goto out_err; 7641 } 7642 7643 while (1) { 7644 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 7645 next_hop, &pinfo); 7646 if (err == -ENOENT) 7647 break; 7648 if (err) 7649 goto out_err; 7650 7651 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7652 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7653 wdev->netdev, dst, next_hop, 7654 &pinfo) < 0) 7655 goto out; 7656 7657 path_idx++; 7658 } 7659 7660 out: 7661 cb->args[2] = path_idx; 7662 err = skb->len; 7663 out_err: 7664 wiphy_unlock(&rdev->wiphy); 7665 return err; 7666 } 7667 7668 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 7669 { 7670 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7671 int err; 7672 struct net_device *dev = info->user_ptr[1]; 7673 struct mpath_info pinfo; 7674 struct sk_buff *msg; 7675 u8 *dst = NULL; 7676 u8 next_hop[ETH_ALEN]; 7677 7678 memset(&pinfo, 0, sizeof(pinfo)); 7679 7680 if (!info->attrs[NL80211_ATTR_MAC]) 7681 return -EINVAL; 7682 7683 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7684 7685 if (!rdev->ops->get_mpath) 7686 return -EOPNOTSUPP; 7687 7688 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7689 return -EOPNOTSUPP; 7690 7691 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 7692 if (err) 7693 return err; 7694 7695 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7696 if (!msg) 7697 return -ENOMEM; 7698 7699 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7700 dev, dst, next_hop, &pinfo) < 0) { 7701 nlmsg_free(msg); 7702 return -ENOBUFS; 7703 } 7704 7705 return genlmsg_reply(msg, info); 7706 } 7707 7708 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 7709 { 7710 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7711 struct net_device *dev = info->user_ptr[1]; 7712 u8 *dst = NULL; 7713 u8 *next_hop = NULL; 7714 7715 if (!info->attrs[NL80211_ATTR_MAC]) 7716 return -EINVAL; 7717 7718 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7719 return -EINVAL; 7720 7721 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7722 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7723 7724 if (!rdev->ops->change_mpath) 7725 return -EOPNOTSUPP; 7726 7727 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7728 return -EOPNOTSUPP; 7729 7730 return rdev_change_mpath(rdev, dev, dst, next_hop); 7731 } 7732 7733 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 7734 { 7735 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7736 struct net_device *dev = info->user_ptr[1]; 7737 u8 *dst = NULL; 7738 u8 *next_hop = NULL; 7739 7740 if (!info->attrs[NL80211_ATTR_MAC]) 7741 return -EINVAL; 7742 7743 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7744 return -EINVAL; 7745 7746 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7747 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7748 7749 if (!rdev->ops->add_mpath) 7750 return -EOPNOTSUPP; 7751 7752 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7753 return -EOPNOTSUPP; 7754 7755 return rdev_add_mpath(rdev, dev, dst, next_hop); 7756 } 7757 7758 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 7759 { 7760 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7761 struct net_device *dev = info->user_ptr[1]; 7762 u8 *dst = NULL; 7763 7764 if (info->attrs[NL80211_ATTR_MAC]) 7765 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7766 7767 if (!rdev->ops->del_mpath) 7768 return -EOPNOTSUPP; 7769 7770 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7771 return -EOPNOTSUPP; 7772 7773 return rdev_del_mpath(rdev, dev, dst); 7774 } 7775 7776 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 7777 { 7778 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7779 int err; 7780 struct net_device *dev = info->user_ptr[1]; 7781 struct mpath_info pinfo; 7782 struct sk_buff *msg; 7783 u8 *dst = NULL; 7784 u8 mpp[ETH_ALEN]; 7785 7786 memset(&pinfo, 0, sizeof(pinfo)); 7787 7788 if (!info->attrs[NL80211_ATTR_MAC]) 7789 return -EINVAL; 7790 7791 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7792 7793 if (!rdev->ops->get_mpp) 7794 return -EOPNOTSUPP; 7795 7796 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7797 return -EOPNOTSUPP; 7798 7799 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 7800 if (err) 7801 return err; 7802 7803 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7804 if (!msg) 7805 return -ENOMEM; 7806 7807 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7808 dev, dst, mpp, &pinfo) < 0) { 7809 nlmsg_free(msg); 7810 return -ENOBUFS; 7811 } 7812 7813 return genlmsg_reply(msg, info); 7814 } 7815 7816 static int nl80211_dump_mpp(struct sk_buff *skb, 7817 struct netlink_callback *cb) 7818 { 7819 struct mpath_info pinfo; 7820 struct cfg80211_registered_device *rdev; 7821 struct wireless_dev *wdev; 7822 u8 dst[ETH_ALEN]; 7823 u8 mpp[ETH_ALEN]; 7824 int path_idx = cb->args[2]; 7825 int err; 7826 7827 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7828 if (err) 7829 return err; 7830 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7831 __acquire(&rdev->wiphy.mtx); 7832 7833 if (!rdev->ops->dump_mpp) { 7834 err = -EOPNOTSUPP; 7835 goto out_err; 7836 } 7837 7838 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7839 err = -EOPNOTSUPP; 7840 goto out_err; 7841 } 7842 7843 while (1) { 7844 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 7845 mpp, &pinfo); 7846 if (err == -ENOENT) 7847 break; 7848 if (err) 7849 goto out_err; 7850 7851 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7852 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7853 wdev->netdev, dst, mpp, 7854 &pinfo) < 0) 7855 goto out; 7856 7857 path_idx++; 7858 } 7859 7860 out: 7861 cb->args[2] = path_idx; 7862 err = skb->len; 7863 out_err: 7864 wiphy_unlock(&rdev->wiphy); 7865 return err; 7866 } 7867 7868 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 7869 { 7870 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7871 struct net_device *dev = info->user_ptr[1]; 7872 struct wireless_dev *wdev = dev->ieee80211_ptr; 7873 struct bss_parameters params; 7874 int err; 7875 7876 memset(¶ms, 0, sizeof(params)); 7877 params.link_id = nl80211_link_id_or_invalid(info->attrs); 7878 /* default to not changing parameters */ 7879 params.use_cts_prot = -1; 7880 params.use_short_preamble = -1; 7881 params.use_short_slot_time = -1; 7882 params.ap_isolate = -1; 7883 params.ht_opmode = -1; 7884 params.p2p_ctwindow = -1; 7885 params.p2p_opp_ps = -1; 7886 7887 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 7888 params.use_cts_prot = 7889 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 7890 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 7891 params.use_short_preamble = 7892 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 7893 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 7894 params.use_short_slot_time = 7895 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 7896 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 7897 params.basic_rates = 7898 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 7899 params.basic_rates_len = 7900 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 7901 } 7902 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 7903 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 7904 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 7905 params.ht_opmode = 7906 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 7907 7908 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 7909 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7910 return -EINVAL; 7911 params.p2p_ctwindow = 7912 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 7913 if (params.p2p_ctwindow != 0 && 7914 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 7915 return -EINVAL; 7916 } 7917 7918 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 7919 u8 tmp; 7920 7921 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7922 return -EINVAL; 7923 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 7924 params.p2p_opp_ps = tmp; 7925 if (params.p2p_opp_ps && 7926 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 7927 return -EINVAL; 7928 } 7929 7930 if (!rdev->ops->change_bss) 7931 return -EOPNOTSUPP; 7932 7933 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7934 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7935 return -EOPNOTSUPP; 7936 7937 wdev_lock(wdev); 7938 err = rdev_change_bss(rdev, dev, ¶ms); 7939 wdev_unlock(wdev); 7940 7941 return err; 7942 } 7943 7944 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 7945 { 7946 char *data = NULL; 7947 bool is_indoor; 7948 enum nl80211_user_reg_hint_type user_reg_hint_type; 7949 u32 owner_nlportid; 7950 7951 /* 7952 * You should only get this when cfg80211 hasn't yet initialized 7953 * completely when built-in to the kernel right between the time 7954 * window between nl80211_init() and regulatory_init(), if that is 7955 * even possible. 7956 */ 7957 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 7958 return -EINPROGRESS; 7959 7960 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 7961 user_reg_hint_type = 7962 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 7963 else 7964 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 7965 7966 switch (user_reg_hint_type) { 7967 case NL80211_USER_REG_HINT_USER: 7968 case NL80211_USER_REG_HINT_CELL_BASE: 7969 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7970 return -EINVAL; 7971 7972 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7973 return regulatory_hint_user(data, user_reg_hint_type); 7974 case NL80211_USER_REG_HINT_INDOOR: 7975 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 7976 owner_nlportid = info->snd_portid; 7977 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 7978 } else { 7979 owner_nlportid = 0; 7980 is_indoor = true; 7981 } 7982 7983 return regulatory_hint_indoor(is_indoor, owner_nlportid); 7984 default: 7985 return -EINVAL; 7986 } 7987 } 7988 7989 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 7990 { 7991 return reg_reload_regdb(); 7992 } 7993 7994 static int nl80211_get_mesh_config(struct sk_buff *skb, 7995 struct genl_info *info) 7996 { 7997 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7998 struct net_device *dev = info->user_ptr[1]; 7999 struct wireless_dev *wdev = dev->ieee80211_ptr; 8000 struct mesh_config cur_params; 8001 int err = 0; 8002 void *hdr; 8003 struct nlattr *pinfoattr; 8004 struct sk_buff *msg; 8005 8006 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8007 return -EOPNOTSUPP; 8008 8009 if (!rdev->ops->get_mesh_config) 8010 return -EOPNOTSUPP; 8011 8012 wdev_lock(wdev); 8013 /* If not connected, get default parameters */ 8014 if (!wdev->u.mesh.id_len) 8015 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 8016 else 8017 err = rdev_get_mesh_config(rdev, dev, &cur_params); 8018 wdev_unlock(wdev); 8019 8020 if (err) 8021 return err; 8022 8023 /* Draw up a netlink message to send back */ 8024 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8025 if (!msg) 8026 return -ENOMEM; 8027 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8028 NL80211_CMD_GET_MESH_CONFIG); 8029 if (!hdr) 8030 goto out; 8031 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 8032 if (!pinfoattr) 8033 goto nla_put_failure; 8034 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 8035 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 8036 cur_params.dot11MeshRetryTimeout) || 8037 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 8038 cur_params.dot11MeshConfirmTimeout) || 8039 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 8040 cur_params.dot11MeshHoldingTimeout) || 8041 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 8042 cur_params.dot11MeshMaxPeerLinks) || 8043 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 8044 cur_params.dot11MeshMaxRetries) || 8045 nla_put_u8(msg, NL80211_MESHCONF_TTL, 8046 cur_params.dot11MeshTTL) || 8047 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 8048 cur_params.element_ttl) || 8049 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8050 cur_params.auto_open_plinks) || 8051 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8052 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 8053 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8054 cur_params.dot11MeshHWMPmaxPREQretries) || 8055 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 8056 cur_params.path_refresh_time) || 8057 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8058 cur_params.min_discovery_timeout) || 8059 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8060 cur_params.dot11MeshHWMPactivePathTimeout) || 8061 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8062 cur_params.dot11MeshHWMPpreqMinInterval) || 8063 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8064 cur_params.dot11MeshHWMPperrMinInterval) || 8065 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8066 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 8067 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 8068 cur_params.dot11MeshHWMPRootMode) || 8069 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8070 cur_params.dot11MeshHWMPRannInterval) || 8071 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8072 cur_params.dot11MeshGateAnnouncementProtocol) || 8073 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 8074 cur_params.dot11MeshForwarding) || 8075 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 8076 cur_params.rssi_threshold) || 8077 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 8078 cur_params.ht_opmode) || 8079 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8080 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 8081 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8082 cur_params.dot11MeshHWMProotInterval) || 8083 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8084 cur_params.dot11MeshHWMPconfirmationInterval) || 8085 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 8086 cur_params.power_mode) || 8087 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 8088 cur_params.dot11MeshAwakeWindowDuration) || 8089 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 8090 cur_params.plink_timeout) || 8091 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 8092 cur_params.dot11MeshConnectedToMeshGate) || 8093 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 8094 cur_params.dot11MeshNolearn) || 8095 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 8096 cur_params.dot11MeshConnectedToAuthServer)) 8097 goto nla_put_failure; 8098 nla_nest_end(msg, pinfoattr); 8099 genlmsg_end(msg, hdr); 8100 return genlmsg_reply(msg, info); 8101 8102 nla_put_failure: 8103 out: 8104 nlmsg_free(msg); 8105 return -ENOBUFS; 8106 } 8107 8108 static const struct nla_policy 8109 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 8110 [NL80211_MESHCONF_RETRY_TIMEOUT] = 8111 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8112 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 8113 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8114 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 8115 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8116 [NL80211_MESHCONF_MAX_PEER_LINKS] = 8117 NLA_POLICY_RANGE(NLA_U16, 0, 255), 8118 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 8119 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8120 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8121 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 8122 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 8123 NLA_POLICY_RANGE(NLA_U32, 1, 255), 8124 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 8125 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 8126 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 8127 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 8128 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 8129 NLA_POLICY_MIN(NLA_U16, 1), 8130 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 8131 NLA_POLICY_MIN(NLA_U16, 1), 8132 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 8133 NLA_POLICY_MIN(NLA_U16, 1), 8134 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 8135 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 8136 NLA_POLICY_MIN(NLA_U16, 1), 8137 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 8138 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 8139 [NL80211_MESHCONF_RSSI_THRESHOLD] = 8140 NLA_POLICY_RANGE(NLA_S32, -255, 0), 8141 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 8142 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 8143 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 8144 NLA_POLICY_MIN(NLA_U16, 1), 8145 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 8146 NLA_POLICY_MIN(NLA_U16, 1), 8147 [NL80211_MESHCONF_POWER_MODE] = 8148 NLA_POLICY_RANGE(NLA_U32, 8149 NL80211_MESH_POWER_ACTIVE, 8150 NL80211_MESH_POWER_MAX), 8151 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 8152 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 8153 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8154 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8155 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8156 }; 8157 8158 static const struct nla_policy 8159 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 8160 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 8161 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 8162 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 8163 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 8164 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 8165 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 8166 [NL80211_MESH_SETUP_IE] = 8167 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 8168 IEEE80211_MAX_DATA_LEN), 8169 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 8170 }; 8171 8172 static int nl80211_parse_mesh_config(struct genl_info *info, 8173 struct mesh_config *cfg, 8174 u32 *mask_out) 8175 { 8176 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 8177 u32 mask = 0; 8178 u16 ht_opmode; 8179 8180 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 8181 do { \ 8182 if (tb[attr]) { \ 8183 cfg->param = fn(tb[attr]); \ 8184 mask |= BIT((attr) - 1); \ 8185 } \ 8186 } while (0) 8187 8188 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 8189 return -EINVAL; 8190 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 8191 return -EINVAL; 8192 8193 /* This makes sure that there aren't more than 32 mesh config 8194 * parameters (otherwise our bitfield scheme would not work.) */ 8195 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 8196 8197 /* Fill in the params struct */ 8198 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 8199 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 8200 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 8201 NL80211_MESHCONF_CONFIRM_TIMEOUT, 8202 nla_get_u16); 8203 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 8204 NL80211_MESHCONF_HOLDING_TIMEOUT, 8205 nla_get_u16); 8206 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 8207 NL80211_MESHCONF_MAX_PEER_LINKS, 8208 nla_get_u16); 8209 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 8210 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 8211 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 8212 NL80211_MESHCONF_TTL, nla_get_u8); 8213 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 8214 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 8215 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 8216 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8217 nla_get_u8); 8218 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 8219 mask, 8220 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8221 nla_get_u32); 8222 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 8223 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8224 nla_get_u8); 8225 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 8226 NL80211_MESHCONF_PATH_REFRESH_TIME, 8227 nla_get_u32); 8228 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 8229 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 8230 return -EINVAL; 8231 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 8232 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8233 nla_get_u16); 8234 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 8235 mask, 8236 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8237 nla_get_u32); 8238 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 8239 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 8240 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 8241 return -EINVAL; 8242 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 8243 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8244 nla_get_u16); 8245 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 8246 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8247 nla_get_u16); 8248 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8249 dot11MeshHWMPnetDiameterTraversalTime, mask, 8250 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8251 nla_get_u16); 8252 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 8253 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 8254 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 8255 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8256 nla_get_u16); 8257 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 8258 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8259 nla_get_u8); 8260 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 8261 NL80211_MESHCONF_FORWARDING, nla_get_u8); 8262 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 8263 NL80211_MESHCONF_RSSI_THRESHOLD, 8264 nla_get_s32); 8265 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 8266 NL80211_MESHCONF_CONNECTED_TO_GATE, 8267 nla_get_u8); 8268 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 8269 NL80211_MESHCONF_CONNECTED_TO_AS, 8270 nla_get_u8); 8271 /* 8272 * Check HT operation mode based on 8273 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 8274 */ 8275 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 8276 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 8277 8278 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 8279 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 8280 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 8281 return -EINVAL; 8282 8283 /* NON_HT_STA bit is reserved, but some programs set it */ 8284 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 8285 8286 cfg->ht_opmode = ht_opmode; 8287 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 8288 } 8289 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8290 dot11MeshHWMPactivePathToRootTimeout, mask, 8291 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8292 nla_get_u32); 8293 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 8294 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 8295 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 8296 return -EINVAL; 8297 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 8298 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8299 nla_get_u16); 8300 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 8301 mask, 8302 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8303 nla_get_u16); 8304 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 8305 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 8306 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 8307 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 8308 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 8309 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 8310 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 8311 NL80211_MESHCONF_NOLEARN, nla_get_u8); 8312 if (mask_out) 8313 *mask_out = mask; 8314 8315 return 0; 8316 8317 #undef FILL_IN_MESH_PARAM_IF_SET 8318 } 8319 8320 static int nl80211_parse_mesh_setup(struct genl_info *info, 8321 struct mesh_setup *setup) 8322 { 8323 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8324 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 8325 8326 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 8327 return -EINVAL; 8328 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 8329 return -EINVAL; 8330 8331 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 8332 setup->sync_method = 8333 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 8334 IEEE80211_SYNC_METHOD_VENDOR : 8335 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 8336 8337 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 8338 setup->path_sel_proto = 8339 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 8340 IEEE80211_PATH_PROTOCOL_VENDOR : 8341 IEEE80211_PATH_PROTOCOL_HWMP; 8342 8343 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 8344 setup->path_metric = 8345 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 8346 IEEE80211_PATH_METRIC_VENDOR : 8347 IEEE80211_PATH_METRIC_AIRTIME; 8348 8349 if (tb[NL80211_MESH_SETUP_IE]) { 8350 struct nlattr *ieattr = 8351 tb[NL80211_MESH_SETUP_IE]; 8352 setup->ie = nla_data(ieattr); 8353 setup->ie_len = nla_len(ieattr); 8354 } 8355 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 8356 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 8357 return -EINVAL; 8358 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 8359 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 8360 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 8361 if (setup->is_secure) 8362 setup->user_mpm = true; 8363 8364 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 8365 if (!setup->user_mpm) 8366 return -EINVAL; 8367 setup->auth_id = 8368 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 8369 } 8370 8371 return 0; 8372 } 8373 8374 static int nl80211_update_mesh_config(struct sk_buff *skb, 8375 struct genl_info *info) 8376 { 8377 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8378 struct net_device *dev = info->user_ptr[1]; 8379 struct wireless_dev *wdev = dev->ieee80211_ptr; 8380 struct mesh_config cfg; 8381 u32 mask; 8382 int err; 8383 8384 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8385 return -EOPNOTSUPP; 8386 8387 if (!rdev->ops->update_mesh_config) 8388 return -EOPNOTSUPP; 8389 8390 err = nl80211_parse_mesh_config(info, &cfg, &mask); 8391 if (err) 8392 return err; 8393 8394 wdev_lock(wdev); 8395 if (!wdev->u.mesh.id_len) 8396 err = -ENOLINK; 8397 8398 if (!err) 8399 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 8400 8401 wdev_unlock(wdev); 8402 8403 return err; 8404 } 8405 8406 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 8407 struct sk_buff *msg) 8408 { 8409 struct nlattr *nl_reg_rules; 8410 unsigned int i; 8411 8412 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 8413 (regdom->dfs_region && 8414 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 8415 goto nla_put_failure; 8416 8417 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 8418 if (!nl_reg_rules) 8419 goto nla_put_failure; 8420 8421 for (i = 0; i < regdom->n_reg_rules; i++) { 8422 struct nlattr *nl_reg_rule; 8423 const struct ieee80211_reg_rule *reg_rule; 8424 const struct ieee80211_freq_range *freq_range; 8425 const struct ieee80211_power_rule *power_rule; 8426 unsigned int max_bandwidth_khz; 8427 8428 reg_rule = ®dom->reg_rules[i]; 8429 freq_range = ®_rule->freq_range; 8430 power_rule = ®_rule->power_rule; 8431 8432 nl_reg_rule = nla_nest_start_noflag(msg, i); 8433 if (!nl_reg_rule) 8434 goto nla_put_failure; 8435 8436 max_bandwidth_khz = freq_range->max_bandwidth_khz; 8437 if (!max_bandwidth_khz) 8438 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 8439 reg_rule); 8440 8441 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 8442 reg_rule->flags) || 8443 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 8444 freq_range->start_freq_khz) || 8445 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 8446 freq_range->end_freq_khz) || 8447 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 8448 max_bandwidth_khz) || 8449 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 8450 power_rule->max_antenna_gain) || 8451 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 8452 power_rule->max_eirp) || 8453 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 8454 reg_rule->dfs_cac_ms)) 8455 goto nla_put_failure; 8456 8457 nla_nest_end(msg, nl_reg_rule); 8458 } 8459 8460 nla_nest_end(msg, nl_reg_rules); 8461 return 0; 8462 8463 nla_put_failure: 8464 return -EMSGSIZE; 8465 } 8466 8467 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 8468 { 8469 const struct ieee80211_regdomain *regdom = NULL; 8470 struct cfg80211_registered_device *rdev; 8471 struct wiphy *wiphy = NULL; 8472 struct sk_buff *msg; 8473 int err = -EMSGSIZE; 8474 void *hdr; 8475 8476 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8477 if (!msg) 8478 return -ENOBUFS; 8479 8480 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8481 NL80211_CMD_GET_REG); 8482 if (!hdr) 8483 goto put_failure; 8484 8485 rtnl_lock(); 8486 8487 if (info->attrs[NL80211_ATTR_WIPHY]) { 8488 bool self_managed; 8489 8490 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 8491 if (IS_ERR(rdev)) { 8492 err = PTR_ERR(rdev); 8493 goto nla_put_failure; 8494 } 8495 8496 wiphy = &rdev->wiphy; 8497 self_managed = wiphy->regulatory_flags & 8498 REGULATORY_WIPHY_SELF_MANAGED; 8499 8500 rcu_read_lock(); 8501 8502 regdom = get_wiphy_regdom(wiphy); 8503 8504 /* a self-managed-reg device must have a private regdom */ 8505 if (WARN_ON(!regdom && self_managed)) { 8506 err = -EINVAL; 8507 goto nla_put_failure_rcu; 8508 } 8509 8510 if (regdom && 8511 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8512 goto nla_put_failure_rcu; 8513 } else { 8514 rcu_read_lock(); 8515 } 8516 8517 if (!wiphy && reg_last_request_cell_base() && 8518 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8519 NL80211_USER_REG_HINT_CELL_BASE)) 8520 goto nla_put_failure_rcu; 8521 8522 if (!regdom) 8523 regdom = rcu_dereference(cfg80211_regdomain); 8524 8525 if (nl80211_put_regdom(regdom, msg)) 8526 goto nla_put_failure_rcu; 8527 8528 rcu_read_unlock(); 8529 8530 genlmsg_end(msg, hdr); 8531 rtnl_unlock(); 8532 return genlmsg_reply(msg, info); 8533 8534 nla_put_failure_rcu: 8535 rcu_read_unlock(); 8536 nla_put_failure: 8537 rtnl_unlock(); 8538 put_failure: 8539 nlmsg_free(msg); 8540 return err; 8541 } 8542 8543 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 8544 u32 seq, int flags, struct wiphy *wiphy, 8545 const struct ieee80211_regdomain *regdom) 8546 { 8547 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 8548 NL80211_CMD_GET_REG); 8549 8550 if (!hdr) 8551 return -1; 8552 8553 genl_dump_check_consistent(cb, hdr); 8554 8555 if (nl80211_put_regdom(regdom, msg)) 8556 goto nla_put_failure; 8557 8558 if (!wiphy && reg_last_request_cell_base() && 8559 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8560 NL80211_USER_REG_HINT_CELL_BASE)) 8561 goto nla_put_failure; 8562 8563 if (wiphy && 8564 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8565 goto nla_put_failure; 8566 8567 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 8568 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 8569 goto nla_put_failure; 8570 8571 genlmsg_end(msg, hdr); 8572 return 0; 8573 8574 nla_put_failure: 8575 genlmsg_cancel(msg, hdr); 8576 return -EMSGSIZE; 8577 } 8578 8579 static int nl80211_get_reg_dump(struct sk_buff *skb, 8580 struct netlink_callback *cb) 8581 { 8582 const struct ieee80211_regdomain *regdom = NULL; 8583 struct cfg80211_registered_device *rdev; 8584 int err, reg_idx, start = cb->args[2]; 8585 8586 rcu_read_lock(); 8587 8588 if (cfg80211_regdomain && start == 0) { 8589 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8590 NLM_F_MULTI, NULL, 8591 rcu_dereference(cfg80211_regdomain)); 8592 if (err < 0) 8593 goto out_err; 8594 } 8595 8596 /* the global regdom is idx 0 */ 8597 reg_idx = 1; 8598 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 8599 regdom = get_wiphy_regdom(&rdev->wiphy); 8600 if (!regdom) 8601 continue; 8602 8603 if (++reg_idx <= start) 8604 continue; 8605 8606 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8607 NLM_F_MULTI, &rdev->wiphy, regdom); 8608 if (err < 0) { 8609 reg_idx--; 8610 break; 8611 } 8612 } 8613 8614 cb->args[2] = reg_idx; 8615 err = skb->len; 8616 out_err: 8617 rcu_read_unlock(); 8618 return err; 8619 } 8620 8621 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 8622 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 8623 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 8624 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 8625 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 8626 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 8627 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 8628 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 8629 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 8630 }; 8631 8632 static int parse_reg_rule(struct nlattr *tb[], 8633 struct ieee80211_reg_rule *reg_rule) 8634 { 8635 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 8636 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 8637 8638 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 8639 return -EINVAL; 8640 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 8641 return -EINVAL; 8642 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 8643 return -EINVAL; 8644 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 8645 return -EINVAL; 8646 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 8647 return -EINVAL; 8648 8649 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 8650 8651 freq_range->start_freq_khz = 8652 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 8653 freq_range->end_freq_khz = 8654 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 8655 freq_range->max_bandwidth_khz = 8656 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 8657 8658 power_rule->max_eirp = 8659 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 8660 8661 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 8662 power_rule->max_antenna_gain = 8663 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 8664 8665 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 8666 reg_rule->dfs_cac_ms = 8667 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 8668 8669 return 0; 8670 } 8671 8672 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 8673 { 8674 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 8675 struct nlattr *nl_reg_rule; 8676 char *alpha2; 8677 int rem_reg_rules, r; 8678 u32 num_rules = 0, rule_idx = 0; 8679 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 8680 struct ieee80211_regdomain *rd; 8681 8682 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 8683 return -EINVAL; 8684 8685 if (!info->attrs[NL80211_ATTR_REG_RULES]) 8686 return -EINVAL; 8687 8688 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 8689 8690 if (info->attrs[NL80211_ATTR_DFS_REGION]) 8691 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 8692 8693 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8694 rem_reg_rules) { 8695 num_rules++; 8696 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 8697 return -EINVAL; 8698 } 8699 8700 rtnl_lock(); 8701 if (!reg_is_valid_request(alpha2)) { 8702 r = -EINVAL; 8703 goto out; 8704 } 8705 8706 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 8707 if (!rd) { 8708 r = -ENOMEM; 8709 goto out; 8710 } 8711 8712 rd->n_reg_rules = num_rules; 8713 rd->alpha2[0] = alpha2[0]; 8714 rd->alpha2[1] = alpha2[1]; 8715 8716 /* 8717 * Disable DFS master mode if the DFS region was 8718 * not supported or known on this kernel. 8719 */ 8720 if (reg_supported_dfs_region(dfs_region)) 8721 rd->dfs_region = dfs_region; 8722 8723 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8724 rem_reg_rules) { 8725 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 8726 nl_reg_rule, reg_rule_policy, 8727 info->extack); 8728 if (r) 8729 goto bad_reg; 8730 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 8731 if (r) 8732 goto bad_reg; 8733 8734 rule_idx++; 8735 8736 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 8737 r = -EINVAL; 8738 goto bad_reg; 8739 } 8740 } 8741 8742 r = set_regdom(rd, REGD_SOURCE_CRDA); 8743 /* set_regdom takes ownership of rd */ 8744 rd = NULL; 8745 bad_reg: 8746 kfree(rd); 8747 out: 8748 rtnl_unlock(); 8749 return r; 8750 } 8751 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 8752 8753 static int validate_scan_freqs(struct nlattr *freqs) 8754 { 8755 struct nlattr *attr1, *attr2; 8756 int n_channels = 0, tmp1, tmp2; 8757 8758 nla_for_each_nested(attr1, freqs, tmp1) 8759 if (nla_len(attr1) != sizeof(u32)) 8760 return 0; 8761 8762 nla_for_each_nested(attr1, freqs, tmp1) { 8763 n_channels++; 8764 /* 8765 * Some hardware has a limited channel list for 8766 * scanning, and it is pretty much nonsensical 8767 * to scan for a channel twice, so disallow that 8768 * and don't require drivers to check that the 8769 * channel list they get isn't longer than what 8770 * they can scan, as long as they can scan all 8771 * the channels they registered at once. 8772 */ 8773 nla_for_each_nested(attr2, freqs, tmp2) 8774 if (attr1 != attr2 && 8775 nla_get_u32(attr1) == nla_get_u32(attr2)) 8776 return 0; 8777 } 8778 8779 return n_channels; 8780 } 8781 8782 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 8783 { 8784 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 8785 } 8786 8787 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 8788 struct cfg80211_bss_selection *bss_select) 8789 { 8790 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 8791 struct nlattr *nest; 8792 int err; 8793 bool found = false; 8794 int i; 8795 8796 /* only process one nested attribute */ 8797 nest = nla_data(nla); 8798 if (!nla_ok(nest, nla_len(nest))) 8799 return -EINVAL; 8800 8801 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 8802 nest, nl80211_bss_select_policy, 8803 NULL); 8804 if (err) 8805 return err; 8806 8807 /* only one attribute may be given */ 8808 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 8809 if (attr[i]) { 8810 if (found) 8811 return -EINVAL; 8812 found = true; 8813 } 8814 } 8815 8816 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 8817 8818 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 8819 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 8820 8821 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 8822 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 8823 bss_select->param.band_pref = 8824 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 8825 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 8826 return -EINVAL; 8827 } 8828 8829 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 8830 struct nl80211_bss_select_rssi_adjust *adj_param; 8831 8832 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 8833 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 8834 bss_select->param.adjust.band = adj_param->band; 8835 bss_select->param.adjust.delta = adj_param->delta; 8836 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 8837 return -EINVAL; 8838 } 8839 8840 /* user-space did not provide behaviour attribute */ 8841 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 8842 return -EINVAL; 8843 8844 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 8845 return -EINVAL; 8846 8847 return 0; 8848 } 8849 8850 int nl80211_parse_random_mac(struct nlattr **attrs, 8851 u8 *mac_addr, u8 *mac_addr_mask) 8852 { 8853 int i; 8854 8855 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 8856 eth_zero_addr(mac_addr); 8857 eth_zero_addr(mac_addr_mask); 8858 mac_addr[0] = 0x2; 8859 mac_addr_mask[0] = 0x3; 8860 8861 return 0; 8862 } 8863 8864 /* need both or none */ 8865 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 8866 return -EINVAL; 8867 8868 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 8869 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 8870 8871 /* don't allow or configure an mcast address */ 8872 if (!is_multicast_ether_addr(mac_addr_mask) || 8873 is_multicast_ether_addr(mac_addr)) 8874 return -EINVAL; 8875 8876 /* 8877 * allow users to pass a MAC address that has bits set outside 8878 * of the mask, but don't bother drivers with having to deal 8879 * with such bits 8880 */ 8881 for (i = 0; i < ETH_ALEN; i++) 8882 mac_addr[i] &= mac_addr_mask[i]; 8883 8884 return 0; 8885 } 8886 8887 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev, 8888 struct ieee80211_channel *chan) 8889 { 8890 unsigned int link_id; 8891 bool all_ok = true; 8892 8893 ASSERT_WDEV_LOCK(wdev); 8894 8895 if (!cfg80211_beaconing_iface_active(wdev)) 8896 return true; 8897 8898 /* 8899 * FIXME: check if we have a free HW resource/link for chan 8900 * 8901 * This, as well as the FIXME below, requires knowing the link 8902 * capabilities of the hardware. 8903 */ 8904 8905 /* we cannot leave radar channels */ 8906 for_each_valid_link(wdev, link_id) { 8907 struct cfg80211_chan_def *chandef; 8908 8909 chandef = wdev_chandef(wdev, link_id); 8910 if (!chandef || !chandef->chan) 8911 continue; 8912 8913 /* 8914 * FIXME: don't require all_ok, but rather check only the 8915 * correct HW resource/link onto which 'chan' falls, 8916 * as only that link leaves the channel for doing 8917 * the off-channel operation. 8918 */ 8919 8920 if (chandef->chan->flags & IEEE80211_CHAN_RADAR) 8921 all_ok = false; 8922 } 8923 8924 if (all_ok) 8925 return true; 8926 8927 return regulatory_pre_cac_allowed(wdev->wiphy); 8928 } 8929 8930 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 8931 enum nl80211_ext_feature_index feat) 8932 { 8933 if (!(flags & flag)) 8934 return true; 8935 if (wiphy_ext_feature_isset(wiphy, feat)) 8936 return true; 8937 return false; 8938 } 8939 8940 static int 8941 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 8942 void *request, struct nlattr **attrs, 8943 bool is_sched_scan) 8944 { 8945 u8 *mac_addr, *mac_addr_mask; 8946 u32 *flags; 8947 enum nl80211_feature_flags randomness_flag; 8948 8949 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 8950 return 0; 8951 8952 if (is_sched_scan) { 8953 struct cfg80211_sched_scan_request *req = request; 8954 8955 randomness_flag = wdev ? 8956 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 8957 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 8958 flags = &req->flags; 8959 mac_addr = req->mac_addr; 8960 mac_addr_mask = req->mac_addr_mask; 8961 } else { 8962 struct cfg80211_scan_request *req = request; 8963 8964 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 8965 flags = &req->flags; 8966 mac_addr = req->mac_addr; 8967 mac_addr_mask = req->mac_addr_mask; 8968 } 8969 8970 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 8971 8972 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 8973 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 8974 !nl80211_check_scan_feat(wiphy, *flags, 8975 NL80211_SCAN_FLAG_LOW_SPAN, 8976 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 8977 !nl80211_check_scan_feat(wiphy, *flags, 8978 NL80211_SCAN_FLAG_LOW_POWER, 8979 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 8980 !nl80211_check_scan_feat(wiphy, *flags, 8981 NL80211_SCAN_FLAG_HIGH_ACCURACY, 8982 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 8983 !nl80211_check_scan_feat(wiphy, *flags, 8984 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 8985 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 8986 !nl80211_check_scan_feat(wiphy, *flags, 8987 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 8988 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 8989 !nl80211_check_scan_feat(wiphy, *flags, 8990 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 8991 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 8992 !nl80211_check_scan_feat(wiphy, *flags, 8993 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 8994 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 8995 !nl80211_check_scan_feat(wiphy, *flags, 8996 NL80211_SCAN_FLAG_RANDOM_SN, 8997 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 8998 !nl80211_check_scan_feat(wiphy, *flags, 8999 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 9000 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 9001 return -EOPNOTSUPP; 9002 9003 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 9004 int err; 9005 9006 if (!(wiphy->features & randomness_flag) || 9007 (wdev && wdev->connected)) 9008 return -EOPNOTSUPP; 9009 9010 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 9011 if (err) 9012 return err; 9013 } 9014 9015 return 0; 9016 } 9017 9018 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 9019 { 9020 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9021 struct wireless_dev *wdev = info->user_ptr[1]; 9022 struct cfg80211_scan_request *request; 9023 struct nlattr *scan_freqs = NULL; 9024 bool scan_freqs_khz = false; 9025 struct nlattr *attr; 9026 struct wiphy *wiphy; 9027 int err, tmp, n_ssids = 0, n_channels, i; 9028 size_t ie_len; 9029 9030 wiphy = &rdev->wiphy; 9031 9032 if (wdev->iftype == NL80211_IFTYPE_NAN) 9033 return -EOPNOTSUPP; 9034 9035 if (!rdev->ops->scan) 9036 return -EOPNOTSUPP; 9037 9038 if (rdev->scan_req || rdev->scan_msg) 9039 return -EBUSY; 9040 9041 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 9042 if (!wiphy_ext_feature_isset(wiphy, 9043 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 9044 return -EOPNOTSUPP; 9045 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 9046 scan_freqs_khz = true; 9047 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 9048 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 9049 9050 if (scan_freqs) { 9051 n_channels = validate_scan_freqs(scan_freqs); 9052 if (!n_channels) 9053 return -EINVAL; 9054 } else { 9055 n_channels = ieee80211_get_num_supported_channels(wiphy); 9056 } 9057 9058 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 9059 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 9060 n_ssids++; 9061 9062 if (n_ssids > wiphy->max_scan_ssids) 9063 return -EINVAL; 9064 9065 if (info->attrs[NL80211_ATTR_IE]) 9066 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9067 else 9068 ie_len = 0; 9069 9070 if (ie_len > wiphy->max_scan_ie_len) 9071 return -EINVAL; 9072 9073 request = kzalloc(sizeof(*request) 9074 + sizeof(*request->ssids) * n_ssids 9075 + sizeof(*request->channels) * n_channels 9076 + ie_len, GFP_KERNEL); 9077 if (!request) 9078 return -ENOMEM; 9079 9080 if (n_ssids) 9081 request->ssids = (void *)&request->channels[n_channels]; 9082 request->n_ssids = n_ssids; 9083 if (ie_len) { 9084 if (n_ssids) 9085 request->ie = (void *)(request->ssids + n_ssids); 9086 else 9087 request->ie = (void *)(request->channels + n_channels); 9088 } 9089 9090 i = 0; 9091 if (scan_freqs) { 9092 /* user specified, bail out if channel not found */ 9093 nla_for_each_nested(attr, scan_freqs, tmp) { 9094 struct ieee80211_channel *chan; 9095 int freq = nla_get_u32(attr); 9096 9097 if (!scan_freqs_khz) 9098 freq = MHZ_TO_KHZ(freq); 9099 9100 chan = ieee80211_get_channel_khz(wiphy, freq); 9101 if (!chan) { 9102 err = -EINVAL; 9103 goto out_free; 9104 } 9105 9106 /* ignore disabled channels */ 9107 if (chan->flags & IEEE80211_CHAN_DISABLED) 9108 continue; 9109 9110 request->channels[i] = chan; 9111 i++; 9112 } 9113 } else { 9114 enum nl80211_band band; 9115 9116 /* all channels */ 9117 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9118 int j; 9119 9120 if (!wiphy->bands[band]) 9121 continue; 9122 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9123 struct ieee80211_channel *chan; 9124 9125 chan = &wiphy->bands[band]->channels[j]; 9126 9127 if (chan->flags & IEEE80211_CHAN_DISABLED) 9128 continue; 9129 9130 request->channels[i] = chan; 9131 i++; 9132 } 9133 } 9134 } 9135 9136 if (!i) { 9137 err = -EINVAL; 9138 goto out_free; 9139 } 9140 9141 request->n_channels = i; 9142 9143 wdev_lock(wdev); 9144 for (i = 0; i < request->n_channels; i++) { 9145 struct ieee80211_channel *chan = request->channels[i]; 9146 9147 /* if we can go off-channel to the target channel we're good */ 9148 if (cfg80211_off_channel_oper_allowed(wdev, chan)) 9149 continue; 9150 9151 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) { 9152 wdev_unlock(wdev); 9153 err = -EBUSY; 9154 goto out_free; 9155 } 9156 } 9157 wdev_unlock(wdev); 9158 9159 i = 0; 9160 if (n_ssids) { 9161 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 9162 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9163 err = -EINVAL; 9164 goto out_free; 9165 } 9166 request->ssids[i].ssid_len = nla_len(attr); 9167 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 9168 i++; 9169 } 9170 } 9171 9172 if (info->attrs[NL80211_ATTR_IE]) { 9173 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9174 memcpy((void *)request->ie, 9175 nla_data(info->attrs[NL80211_ATTR_IE]), 9176 request->ie_len); 9177 } 9178 9179 for (i = 0; i < NUM_NL80211_BANDS; i++) 9180 if (wiphy->bands[i]) 9181 request->rates[i] = 9182 (1 << wiphy->bands[i]->n_bitrates) - 1; 9183 9184 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 9185 nla_for_each_nested(attr, 9186 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 9187 tmp) { 9188 enum nl80211_band band = nla_type(attr); 9189 9190 if (band < 0 || band >= NUM_NL80211_BANDS) { 9191 err = -EINVAL; 9192 goto out_free; 9193 } 9194 9195 if (!wiphy->bands[band]) 9196 continue; 9197 9198 err = ieee80211_get_ratemask(wiphy->bands[band], 9199 nla_data(attr), 9200 nla_len(attr), 9201 &request->rates[band]); 9202 if (err) 9203 goto out_free; 9204 } 9205 } 9206 9207 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 9208 request->duration = 9209 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 9210 request->duration_mandatory = 9211 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 9212 } 9213 9214 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 9215 false); 9216 if (err) 9217 goto out_free; 9218 9219 request->no_cck = 9220 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9221 9222 /* Initial implementation used NL80211_ATTR_MAC to set the specific 9223 * BSSID to scan for. This was problematic because that same attribute 9224 * was already used for another purpose (local random MAC address). The 9225 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 9226 * compatibility with older userspace components, also use the 9227 * NL80211_ATTR_MAC value here if it can be determined to be used for 9228 * the specific BSSID use case instead of the random MAC address 9229 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 9230 */ 9231 if (info->attrs[NL80211_ATTR_BSSID]) 9232 memcpy(request->bssid, 9233 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 9234 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 9235 info->attrs[NL80211_ATTR_MAC]) 9236 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 9237 ETH_ALEN); 9238 else 9239 eth_broadcast_addr(request->bssid); 9240 9241 request->wdev = wdev; 9242 request->wiphy = &rdev->wiphy; 9243 request->scan_start = jiffies; 9244 9245 rdev->scan_req = request; 9246 err = cfg80211_scan(rdev); 9247 9248 if (err) 9249 goto out_free; 9250 9251 nl80211_send_scan_start(rdev, wdev); 9252 dev_hold(wdev->netdev); 9253 9254 return 0; 9255 9256 out_free: 9257 rdev->scan_req = NULL; 9258 kfree(request); 9259 9260 return err; 9261 } 9262 9263 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 9264 { 9265 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9266 struct wireless_dev *wdev = info->user_ptr[1]; 9267 9268 if (!rdev->ops->abort_scan) 9269 return -EOPNOTSUPP; 9270 9271 if (rdev->scan_msg) 9272 return 0; 9273 9274 if (!rdev->scan_req) 9275 return -ENOENT; 9276 9277 rdev_abort_scan(rdev, wdev); 9278 return 0; 9279 } 9280 9281 static int 9282 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 9283 struct cfg80211_sched_scan_request *request, 9284 struct nlattr **attrs) 9285 { 9286 int tmp, err, i = 0; 9287 struct nlattr *attr; 9288 9289 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9290 u32 interval; 9291 9292 /* 9293 * If scan plans are not specified, 9294 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 9295 * case one scan plan will be set with the specified scan 9296 * interval and infinite number of iterations. 9297 */ 9298 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 9299 if (!interval) 9300 return -EINVAL; 9301 9302 request->scan_plans[0].interval = 9303 DIV_ROUND_UP(interval, MSEC_PER_SEC); 9304 if (!request->scan_plans[0].interval) 9305 return -EINVAL; 9306 9307 if (request->scan_plans[0].interval > 9308 wiphy->max_sched_scan_plan_interval) 9309 request->scan_plans[0].interval = 9310 wiphy->max_sched_scan_plan_interval; 9311 9312 return 0; 9313 } 9314 9315 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 9316 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 9317 9318 if (WARN_ON(i >= n_plans)) 9319 return -EINVAL; 9320 9321 err = nla_parse_nested_deprecated(plan, 9322 NL80211_SCHED_SCAN_PLAN_MAX, 9323 attr, nl80211_plan_policy, 9324 NULL); 9325 if (err) 9326 return err; 9327 9328 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 9329 return -EINVAL; 9330 9331 request->scan_plans[i].interval = 9332 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 9333 if (!request->scan_plans[i].interval || 9334 request->scan_plans[i].interval > 9335 wiphy->max_sched_scan_plan_interval) 9336 return -EINVAL; 9337 9338 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 9339 request->scan_plans[i].iterations = 9340 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 9341 if (!request->scan_plans[i].iterations || 9342 (request->scan_plans[i].iterations > 9343 wiphy->max_sched_scan_plan_iterations)) 9344 return -EINVAL; 9345 } else if (i < n_plans - 1) { 9346 /* 9347 * All scan plans but the last one must specify 9348 * a finite number of iterations 9349 */ 9350 return -EINVAL; 9351 } 9352 9353 i++; 9354 } 9355 9356 /* 9357 * The last scan plan must not specify the number of 9358 * iterations, it is supposed to run infinitely 9359 */ 9360 if (request->scan_plans[n_plans - 1].iterations) 9361 return -EINVAL; 9362 9363 return 0; 9364 } 9365 9366 static int 9367 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 9368 struct cfg80211_match_set *match_sets, 9369 struct nlattr *tb_band_rssi, 9370 s32 rssi_thold) 9371 { 9372 struct nlattr *attr; 9373 int i, tmp, ret = 0; 9374 9375 if (!wiphy_ext_feature_isset(wiphy, 9376 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 9377 if (tb_band_rssi) 9378 ret = -EOPNOTSUPP; 9379 else 9380 for (i = 0; i < NUM_NL80211_BANDS; i++) 9381 match_sets->per_band_rssi_thold[i] = 9382 NL80211_SCAN_RSSI_THOLD_OFF; 9383 return ret; 9384 } 9385 9386 for (i = 0; i < NUM_NL80211_BANDS; i++) 9387 match_sets->per_band_rssi_thold[i] = rssi_thold; 9388 9389 nla_for_each_nested(attr, tb_band_rssi, tmp) { 9390 enum nl80211_band band = nla_type(attr); 9391 9392 if (band < 0 || band >= NUM_NL80211_BANDS) 9393 return -EINVAL; 9394 9395 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 9396 } 9397 9398 return 0; 9399 } 9400 9401 static struct cfg80211_sched_scan_request * 9402 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 9403 struct nlattr **attrs, int max_match_sets) 9404 { 9405 struct cfg80211_sched_scan_request *request; 9406 struct nlattr *attr; 9407 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 9408 enum nl80211_band band; 9409 size_t ie_len; 9410 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 9411 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 9412 9413 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9414 n_channels = validate_scan_freqs( 9415 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 9416 if (!n_channels) 9417 return ERR_PTR(-EINVAL); 9418 } else { 9419 n_channels = ieee80211_get_num_supported_channels(wiphy); 9420 } 9421 9422 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 9423 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9424 tmp) 9425 n_ssids++; 9426 9427 if (n_ssids > wiphy->max_sched_scan_ssids) 9428 return ERR_PTR(-EINVAL); 9429 9430 /* 9431 * First, count the number of 'real' matchsets. Due to an issue with 9432 * the old implementation, matchsets containing only the RSSI attribute 9433 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 9434 * RSSI for all matchsets, rather than their own matchset for reporting 9435 * all APs with a strong RSSI. This is needed to be compatible with 9436 * older userspace that treated a matchset with only the RSSI as the 9437 * global RSSI for all other matchsets - if there are other matchsets. 9438 */ 9439 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9440 nla_for_each_nested(attr, 9441 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9442 tmp) { 9443 struct nlattr *rssi; 9444 9445 err = nla_parse_nested_deprecated(tb, 9446 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9447 attr, 9448 nl80211_match_policy, 9449 NULL); 9450 if (err) 9451 return ERR_PTR(err); 9452 9453 /* SSID and BSSID are mutually exclusive */ 9454 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 9455 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 9456 return ERR_PTR(-EINVAL); 9457 9458 /* add other standalone attributes here */ 9459 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 9460 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 9461 n_match_sets++; 9462 continue; 9463 } 9464 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9465 if (rssi) 9466 default_match_rssi = nla_get_s32(rssi); 9467 } 9468 } 9469 9470 /* However, if there's no other matchset, add the RSSI one */ 9471 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 9472 n_match_sets = 1; 9473 9474 if (n_match_sets > max_match_sets) 9475 return ERR_PTR(-EINVAL); 9476 9477 if (attrs[NL80211_ATTR_IE]) 9478 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 9479 else 9480 ie_len = 0; 9481 9482 if (ie_len > wiphy->max_sched_scan_ie_len) 9483 return ERR_PTR(-EINVAL); 9484 9485 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9486 /* 9487 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 9488 * each scan plan already specifies its own interval 9489 */ 9490 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9491 return ERR_PTR(-EINVAL); 9492 9493 nla_for_each_nested(attr, 9494 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 9495 n_plans++; 9496 } else { 9497 /* 9498 * The scan interval attribute is kept for backward 9499 * compatibility. If no scan plans are specified and sched scan 9500 * interval is specified, one scan plan will be set with this 9501 * scan interval and infinite number of iterations. 9502 */ 9503 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9504 return ERR_PTR(-EINVAL); 9505 9506 n_plans = 1; 9507 } 9508 9509 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 9510 return ERR_PTR(-EINVAL); 9511 9512 if (!wiphy_ext_feature_isset( 9513 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 9514 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 9515 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 9516 return ERR_PTR(-EINVAL); 9517 9518 request = kzalloc(sizeof(*request) 9519 + sizeof(*request->ssids) * n_ssids 9520 + sizeof(*request->match_sets) * n_match_sets 9521 + sizeof(*request->scan_plans) * n_plans 9522 + sizeof(*request->channels) * n_channels 9523 + ie_len, GFP_KERNEL); 9524 if (!request) 9525 return ERR_PTR(-ENOMEM); 9526 9527 if (n_ssids) 9528 request->ssids = (void *)&request->channels[n_channels]; 9529 request->n_ssids = n_ssids; 9530 if (ie_len) { 9531 if (n_ssids) 9532 request->ie = (void *)(request->ssids + n_ssids); 9533 else 9534 request->ie = (void *)(request->channels + n_channels); 9535 } 9536 9537 if (n_match_sets) { 9538 if (request->ie) 9539 request->match_sets = (void *)(request->ie + ie_len); 9540 else if (n_ssids) 9541 request->match_sets = 9542 (void *)(request->ssids + n_ssids); 9543 else 9544 request->match_sets = 9545 (void *)(request->channels + n_channels); 9546 } 9547 request->n_match_sets = n_match_sets; 9548 9549 if (n_match_sets) 9550 request->scan_plans = (void *)(request->match_sets + 9551 n_match_sets); 9552 else if (request->ie) 9553 request->scan_plans = (void *)(request->ie + ie_len); 9554 else if (n_ssids) 9555 request->scan_plans = (void *)(request->ssids + n_ssids); 9556 else 9557 request->scan_plans = (void *)(request->channels + n_channels); 9558 9559 request->n_scan_plans = n_plans; 9560 9561 i = 0; 9562 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9563 /* user specified, bail out if channel not found */ 9564 nla_for_each_nested(attr, 9565 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 9566 tmp) { 9567 struct ieee80211_channel *chan; 9568 9569 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 9570 9571 if (!chan) { 9572 err = -EINVAL; 9573 goto out_free; 9574 } 9575 9576 /* ignore disabled channels */ 9577 if (chan->flags & IEEE80211_CHAN_DISABLED) 9578 continue; 9579 9580 request->channels[i] = chan; 9581 i++; 9582 } 9583 } else { 9584 /* all channels */ 9585 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9586 int j; 9587 9588 if (!wiphy->bands[band]) 9589 continue; 9590 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9591 struct ieee80211_channel *chan; 9592 9593 chan = &wiphy->bands[band]->channels[j]; 9594 9595 if (chan->flags & IEEE80211_CHAN_DISABLED) 9596 continue; 9597 9598 request->channels[i] = chan; 9599 i++; 9600 } 9601 } 9602 } 9603 9604 if (!i) { 9605 err = -EINVAL; 9606 goto out_free; 9607 } 9608 9609 request->n_channels = i; 9610 9611 i = 0; 9612 if (n_ssids) { 9613 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9614 tmp) { 9615 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9616 err = -EINVAL; 9617 goto out_free; 9618 } 9619 request->ssids[i].ssid_len = nla_len(attr); 9620 memcpy(request->ssids[i].ssid, nla_data(attr), 9621 nla_len(attr)); 9622 i++; 9623 } 9624 } 9625 9626 i = 0; 9627 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9628 nla_for_each_nested(attr, 9629 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9630 tmp) { 9631 struct nlattr *ssid, *bssid, *rssi; 9632 9633 err = nla_parse_nested_deprecated(tb, 9634 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9635 attr, 9636 nl80211_match_policy, 9637 NULL); 9638 if (err) 9639 goto out_free; 9640 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 9641 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 9642 9643 if (!ssid && !bssid) { 9644 i++; 9645 continue; 9646 } 9647 9648 if (WARN_ON(i >= n_match_sets)) { 9649 /* this indicates a programming error, 9650 * the loop above should have verified 9651 * things properly 9652 */ 9653 err = -EINVAL; 9654 goto out_free; 9655 } 9656 9657 if (ssid) { 9658 memcpy(request->match_sets[i].ssid.ssid, 9659 nla_data(ssid), nla_len(ssid)); 9660 request->match_sets[i].ssid.ssid_len = 9661 nla_len(ssid); 9662 } 9663 if (bssid) 9664 memcpy(request->match_sets[i].bssid, 9665 nla_data(bssid), ETH_ALEN); 9666 9667 /* special attribute - old implementation w/a */ 9668 request->match_sets[i].rssi_thold = default_match_rssi; 9669 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9670 if (rssi) 9671 request->match_sets[i].rssi_thold = 9672 nla_get_s32(rssi); 9673 9674 /* Parse per band RSSI attribute */ 9675 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 9676 &request->match_sets[i], 9677 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 9678 request->match_sets[i].rssi_thold); 9679 if (err) 9680 goto out_free; 9681 9682 i++; 9683 } 9684 9685 /* there was no other matchset, so the RSSI one is alone */ 9686 if (i == 0 && n_match_sets) 9687 request->match_sets[0].rssi_thold = default_match_rssi; 9688 9689 request->min_rssi_thold = INT_MAX; 9690 for (i = 0; i < n_match_sets; i++) 9691 request->min_rssi_thold = 9692 min(request->match_sets[i].rssi_thold, 9693 request->min_rssi_thold); 9694 } else { 9695 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 9696 } 9697 9698 if (ie_len) { 9699 request->ie_len = ie_len; 9700 memcpy((void *)request->ie, 9701 nla_data(attrs[NL80211_ATTR_IE]), 9702 request->ie_len); 9703 } 9704 9705 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 9706 if (err) 9707 goto out_free; 9708 9709 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 9710 request->delay = 9711 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 9712 9713 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 9714 request->relative_rssi = nla_get_s8( 9715 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 9716 request->relative_rssi_set = true; 9717 } 9718 9719 if (request->relative_rssi_set && 9720 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 9721 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 9722 9723 rssi_adjust = nla_data( 9724 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 9725 request->rssi_adjust.band = rssi_adjust->band; 9726 request->rssi_adjust.delta = rssi_adjust->delta; 9727 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 9728 err = -EINVAL; 9729 goto out_free; 9730 } 9731 } 9732 9733 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 9734 if (err) 9735 goto out_free; 9736 9737 request->scan_start = jiffies; 9738 9739 return request; 9740 9741 out_free: 9742 kfree(request); 9743 return ERR_PTR(err); 9744 } 9745 9746 static int nl80211_start_sched_scan(struct sk_buff *skb, 9747 struct genl_info *info) 9748 { 9749 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9750 struct net_device *dev = info->user_ptr[1]; 9751 struct wireless_dev *wdev = dev->ieee80211_ptr; 9752 struct cfg80211_sched_scan_request *sched_scan_req; 9753 bool want_multi; 9754 int err; 9755 9756 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 9757 return -EOPNOTSUPP; 9758 9759 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 9760 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 9761 if (err) 9762 return err; 9763 9764 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 9765 info->attrs, 9766 rdev->wiphy.max_match_sets); 9767 9768 err = PTR_ERR_OR_ZERO(sched_scan_req); 9769 if (err) 9770 goto out_err; 9771 9772 /* leave request id zero for legacy request 9773 * or if driver does not support multi-scheduled scan 9774 */ 9775 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 9776 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 9777 9778 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 9779 if (err) 9780 goto out_free; 9781 9782 sched_scan_req->dev = dev; 9783 sched_scan_req->wiphy = &rdev->wiphy; 9784 9785 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 9786 sched_scan_req->owner_nlportid = info->snd_portid; 9787 9788 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 9789 9790 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 9791 return 0; 9792 9793 out_free: 9794 kfree(sched_scan_req); 9795 out_err: 9796 return err; 9797 } 9798 9799 static int nl80211_stop_sched_scan(struct sk_buff *skb, 9800 struct genl_info *info) 9801 { 9802 struct cfg80211_sched_scan_request *req; 9803 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9804 u64 cookie; 9805 9806 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 9807 return -EOPNOTSUPP; 9808 9809 if (info->attrs[NL80211_ATTR_COOKIE]) { 9810 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9811 return __cfg80211_stop_sched_scan(rdev, cookie, false); 9812 } 9813 9814 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 9815 struct cfg80211_sched_scan_request, 9816 list); 9817 if (!req || req->reqid || 9818 (req->owner_nlportid && 9819 req->owner_nlportid != info->snd_portid)) 9820 return -ENOENT; 9821 9822 return cfg80211_stop_sched_scan_req(rdev, req, false); 9823 } 9824 9825 static int nl80211_start_radar_detection(struct sk_buff *skb, 9826 struct genl_info *info) 9827 { 9828 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9829 struct net_device *dev = info->user_ptr[1]; 9830 struct wireless_dev *wdev = dev->ieee80211_ptr; 9831 struct wiphy *wiphy = wdev->wiphy; 9832 struct cfg80211_chan_def chandef; 9833 enum nl80211_dfs_regions dfs_region; 9834 unsigned int cac_time_ms; 9835 int err = -EINVAL; 9836 9837 flush_delayed_work(&rdev->dfs_update_channels_wk); 9838 9839 wiphy_lock(wiphy); 9840 9841 dfs_region = reg_get_dfs_region(wiphy); 9842 if (dfs_region == NL80211_DFS_UNSET) 9843 goto unlock; 9844 9845 err = nl80211_parse_chandef(rdev, info, &chandef); 9846 if (err) 9847 goto unlock; 9848 9849 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 9850 if (err < 0) 9851 goto unlock; 9852 9853 if (err == 0) { 9854 err = -EINVAL; 9855 goto unlock; 9856 } 9857 9858 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) { 9859 err = -EINVAL; 9860 goto unlock; 9861 } 9862 9863 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) { 9864 err = cfg80211_start_background_radar_detection(rdev, wdev, 9865 &chandef); 9866 goto unlock; 9867 } 9868 9869 if (netif_carrier_ok(dev)) { 9870 err = -EBUSY; 9871 goto unlock; 9872 } 9873 9874 if (wdev->cac_started) { 9875 err = -EBUSY; 9876 goto unlock; 9877 } 9878 9879 /* CAC start is offloaded to HW and can't be started manually */ 9880 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) { 9881 err = -EOPNOTSUPP; 9882 goto unlock; 9883 } 9884 9885 if (!rdev->ops->start_radar_detection) { 9886 err = -EOPNOTSUPP; 9887 goto unlock; 9888 } 9889 9890 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 9891 if (WARN_ON(!cac_time_ms)) 9892 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 9893 9894 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 9895 if (!err) { 9896 wdev->links[0].ap.chandef = chandef; 9897 wdev->cac_started = true; 9898 wdev->cac_start_time = jiffies; 9899 wdev->cac_time_ms = cac_time_ms; 9900 } 9901 unlock: 9902 wiphy_unlock(wiphy); 9903 9904 return err; 9905 } 9906 9907 static int nl80211_notify_radar_detection(struct sk_buff *skb, 9908 struct genl_info *info) 9909 { 9910 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9911 struct net_device *dev = info->user_ptr[1]; 9912 struct wireless_dev *wdev = dev->ieee80211_ptr; 9913 struct wiphy *wiphy = wdev->wiphy; 9914 struct cfg80211_chan_def chandef; 9915 enum nl80211_dfs_regions dfs_region; 9916 int err; 9917 9918 dfs_region = reg_get_dfs_region(wiphy); 9919 if (dfs_region == NL80211_DFS_UNSET) { 9920 GENL_SET_ERR_MSG(info, 9921 "DFS Region is not set. Unexpected Radar indication"); 9922 return -EINVAL; 9923 } 9924 9925 err = nl80211_parse_chandef(rdev, info, &chandef); 9926 if (err) { 9927 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 9928 return err; 9929 } 9930 9931 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 9932 if (err < 0) { 9933 GENL_SET_ERR_MSG(info, "chandef is invalid"); 9934 return err; 9935 } 9936 9937 if (err == 0) { 9938 GENL_SET_ERR_MSG(info, 9939 "Unexpected Radar indication for chandef/iftype"); 9940 return -EINVAL; 9941 } 9942 9943 /* Do not process this notification if radar is already detected 9944 * by kernel on this channel, and return success. 9945 */ 9946 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 9947 return 0; 9948 9949 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 9950 9951 cfg80211_sched_dfs_chan_update(rdev); 9952 9953 rdev->radar_chandef = chandef; 9954 9955 /* Propagate this notification to other radios as well */ 9956 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 9957 9958 return 0; 9959 } 9960 9961 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 9962 { 9963 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9964 unsigned int link_id = nl80211_link_id(info->attrs); 9965 struct net_device *dev = info->user_ptr[1]; 9966 struct wireless_dev *wdev = dev->ieee80211_ptr; 9967 struct cfg80211_csa_settings params; 9968 struct nlattr **csa_attrs = NULL; 9969 int err; 9970 bool need_new_beacon = false; 9971 bool need_handle_dfs_flag = true; 9972 int len, i; 9973 u32 cs_count; 9974 9975 if (!rdev->ops->channel_switch || 9976 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 9977 return -EOPNOTSUPP; 9978 9979 switch (dev->ieee80211_ptr->iftype) { 9980 case NL80211_IFTYPE_AP: 9981 case NL80211_IFTYPE_P2P_GO: 9982 need_new_beacon = true; 9983 /* For all modes except AP the handle_dfs flag needs to be 9984 * supplied to tell the kernel that userspace will handle radar 9985 * events when they happen. Otherwise a switch to a channel 9986 * requiring DFS will be rejected. 9987 */ 9988 need_handle_dfs_flag = false; 9989 9990 /* useless if AP is not running */ 9991 if (!wdev->links[link_id].ap.beacon_interval) 9992 return -ENOTCONN; 9993 break; 9994 case NL80211_IFTYPE_ADHOC: 9995 if (!wdev->u.ibss.ssid_len) 9996 return -ENOTCONN; 9997 break; 9998 case NL80211_IFTYPE_MESH_POINT: 9999 if (!wdev->u.mesh.id_len) 10000 return -ENOTCONN; 10001 break; 10002 default: 10003 return -EOPNOTSUPP; 10004 } 10005 10006 memset(¶ms, 0, sizeof(params)); 10007 params.beacon_csa.ftm_responder = -1; 10008 10009 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 10010 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 10011 return -EINVAL; 10012 10013 /* only important for AP, IBSS and mesh create IEs internally */ 10014 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 10015 return -EINVAL; 10016 10017 /* Even though the attribute is u32, the specification says 10018 * u8, so let's make sure we don't overflow. 10019 */ 10020 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 10021 if (cs_count > 255) 10022 return -EINVAL; 10023 10024 params.count = cs_count; 10025 10026 if (!need_new_beacon) 10027 goto skip_beacons; 10028 10029 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after); 10030 if (err) 10031 goto free; 10032 10033 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs), 10034 GFP_KERNEL); 10035 if (!csa_attrs) { 10036 err = -ENOMEM; 10037 goto free; 10038 } 10039 10040 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 10041 info->attrs[NL80211_ATTR_CSA_IES], 10042 nl80211_policy, info->extack); 10043 if (err) 10044 goto free; 10045 10046 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa); 10047 if (err) 10048 goto free; 10049 10050 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 10051 err = -EINVAL; 10052 goto free; 10053 } 10054 10055 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10056 if (!len || (len % sizeof(u16))) { 10057 err = -EINVAL; 10058 goto free; 10059 } 10060 10061 params.n_counter_offsets_beacon = len / sizeof(u16); 10062 if (rdev->wiphy.max_num_csa_counters && 10063 (params.n_counter_offsets_beacon > 10064 rdev->wiphy.max_num_csa_counters)) { 10065 err = -EINVAL; 10066 goto free; 10067 } 10068 10069 params.counter_offsets_beacon = 10070 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10071 10072 /* sanity checks - counters should fit and be the same */ 10073 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 10074 u16 offset = params.counter_offsets_beacon[i]; 10075 10076 if (offset >= params.beacon_csa.tail_len) { 10077 err = -EINVAL; 10078 goto free; 10079 } 10080 10081 if (params.beacon_csa.tail[offset] != params.count) { 10082 err = -EINVAL; 10083 goto free; 10084 } 10085 } 10086 10087 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 10088 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10089 if (!len || (len % sizeof(u16))) { 10090 err = -EINVAL; 10091 goto free; 10092 } 10093 10094 params.n_counter_offsets_presp = len / sizeof(u16); 10095 if (rdev->wiphy.max_num_csa_counters && 10096 (params.n_counter_offsets_presp > 10097 rdev->wiphy.max_num_csa_counters)) { 10098 err = -EINVAL; 10099 goto free; 10100 } 10101 10102 params.counter_offsets_presp = 10103 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10104 10105 /* sanity checks - counters should fit and be the same */ 10106 for (i = 0; i < params.n_counter_offsets_presp; i++) { 10107 u16 offset = params.counter_offsets_presp[i]; 10108 10109 if (offset >= params.beacon_csa.probe_resp_len) { 10110 err = -EINVAL; 10111 goto free; 10112 } 10113 10114 if (params.beacon_csa.probe_resp[offset] != 10115 params.count) { 10116 err = -EINVAL; 10117 goto free; 10118 } 10119 } 10120 } 10121 10122 skip_beacons: 10123 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 10124 if (err) 10125 goto free; 10126 10127 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 10128 wdev->iftype)) { 10129 err = -EINVAL; 10130 goto free; 10131 } 10132 10133 err = cfg80211_chandef_dfs_required(wdev->wiphy, 10134 ¶ms.chandef, 10135 wdev->iftype); 10136 if (err < 0) 10137 goto free; 10138 10139 if (err > 0) { 10140 params.radar_required = true; 10141 if (need_handle_dfs_flag && 10142 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 10143 err = -EINVAL; 10144 goto free; 10145 } 10146 } 10147 10148 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 10149 params.block_tx = true; 10150 10151 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 10152 err = nl80211_parse_punct_bitmap(rdev, info, 10153 ¶ms.chandef, 10154 ¶ms.punct_bitmap); 10155 if (err) 10156 goto free; 10157 } 10158 10159 wdev_lock(wdev); 10160 err = rdev_channel_switch(rdev, dev, ¶ms); 10161 wdev_unlock(wdev); 10162 10163 free: 10164 kfree(params.beacon_after.mbssid_ies); 10165 kfree(params.beacon_csa.mbssid_ies); 10166 kfree(csa_attrs); 10167 return err; 10168 } 10169 10170 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 10171 u32 seq, int flags, 10172 struct cfg80211_registered_device *rdev, 10173 struct wireless_dev *wdev, 10174 struct cfg80211_internal_bss *intbss) 10175 { 10176 struct cfg80211_bss *res = &intbss->pub; 10177 const struct cfg80211_bss_ies *ies; 10178 unsigned int link_id; 10179 void *hdr; 10180 struct nlattr *bss; 10181 10182 ASSERT_WDEV_LOCK(wdev); 10183 10184 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 10185 NL80211_CMD_NEW_SCAN_RESULTS); 10186 if (!hdr) 10187 return -1; 10188 10189 genl_dump_check_consistent(cb, hdr); 10190 10191 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 10192 goto nla_put_failure; 10193 if (wdev->netdev && 10194 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 10195 goto nla_put_failure; 10196 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 10197 NL80211_ATTR_PAD)) 10198 goto nla_put_failure; 10199 10200 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 10201 if (!bss) 10202 goto nla_put_failure; 10203 if ((!is_zero_ether_addr(res->bssid) && 10204 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 10205 goto nla_put_failure; 10206 10207 rcu_read_lock(); 10208 /* indicate whether we have probe response data or not */ 10209 if (rcu_access_pointer(res->proberesp_ies) && 10210 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 10211 goto fail_unlock_rcu; 10212 10213 /* this pointer prefers to be pointed to probe response data 10214 * but is always valid 10215 */ 10216 ies = rcu_dereference(res->ies); 10217 if (ies) { 10218 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 10219 NL80211_BSS_PAD)) 10220 goto fail_unlock_rcu; 10221 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 10222 ies->len, ies->data)) 10223 goto fail_unlock_rcu; 10224 } 10225 10226 /* and this pointer is always (unless driver didn't know) beacon data */ 10227 ies = rcu_dereference(res->beacon_ies); 10228 if (ies && ies->from_beacon) { 10229 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 10230 NL80211_BSS_PAD)) 10231 goto fail_unlock_rcu; 10232 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 10233 ies->len, ies->data)) 10234 goto fail_unlock_rcu; 10235 } 10236 rcu_read_unlock(); 10237 10238 if (res->beacon_interval && 10239 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 10240 goto nla_put_failure; 10241 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 10242 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 10243 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 10244 res->channel->freq_offset) || 10245 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 10246 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 10247 jiffies_to_msecs(jiffies - intbss->ts))) 10248 goto nla_put_failure; 10249 10250 if (intbss->parent_tsf && 10251 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 10252 intbss->parent_tsf, NL80211_BSS_PAD) || 10253 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 10254 intbss->parent_bssid))) 10255 goto nla_put_failure; 10256 10257 if (intbss->ts_boottime && 10258 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 10259 intbss->ts_boottime, NL80211_BSS_PAD)) 10260 goto nla_put_failure; 10261 10262 if (!nl80211_put_signal(msg, intbss->pub.chains, 10263 intbss->pub.chain_signal, 10264 NL80211_BSS_CHAIN_SIGNAL)) 10265 goto nla_put_failure; 10266 10267 switch (rdev->wiphy.signal_type) { 10268 case CFG80211_SIGNAL_TYPE_MBM: 10269 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 10270 goto nla_put_failure; 10271 break; 10272 case CFG80211_SIGNAL_TYPE_UNSPEC: 10273 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 10274 goto nla_put_failure; 10275 break; 10276 default: 10277 break; 10278 } 10279 10280 switch (wdev->iftype) { 10281 case NL80211_IFTYPE_P2P_CLIENT: 10282 case NL80211_IFTYPE_STATION: 10283 for_each_valid_link(wdev, link_id) { 10284 if (intbss == wdev->links[link_id].client.current_bss && 10285 (nla_put_u32(msg, NL80211_BSS_STATUS, 10286 NL80211_BSS_STATUS_ASSOCIATED) || 10287 (wdev->valid_links && 10288 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID, 10289 link_id) || 10290 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN, 10291 wdev->u.client.connected_addr))))) 10292 goto nla_put_failure; 10293 } 10294 break; 10295 case NL80211_IFTYPE_ADHOC: 10296 if (intbss == wdev->u.ibss.current_bss && 10297 nla_put_u32(msg, NL80211_BSS_STATUS, 10298 NL80211_BSS_STATUS_IBSS_JOINED)) 10299 goto nla_put_failure; 10300 break; 10301 default: 10302 break; 10303 } 10304 10305 nla_nest_end(msg, bss); 10306 10307 genlmsg_end(msg, hdr); 10308 return 0; 10309 10310 fail_unlock_rcu: 10311 rcu_read_unlock(); 10312 nla_put_failure: 10313 genlmsg_cancel(msg, hdr); 10314 return -EMSGSIZE; 10315 } 10316 10317 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 10318 { 10319 struct cfg80211_registered_device *rdev; 10320 struct cfg80211_internal_bss *scan; 10321 struct wireless_dev *wdev; 10322 int start = cb->args[2], idx = 0; 10323 int err; 10324 10325 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 10326 if (err) 10327 return err; 10328 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10329 __acquire(&rdev->wiphy.mtx); 10330 10331 wdev_lock(wdev); 10332 spin_lock_bh(&rdev->bss_lock); 10333 10334 /* 10335 * dump_scan will be called multiple times to break up the scan results 10336 * into multiple messages. It is unlikely that any more bss-es will be 10337 * expired after the first call, so only call only call this on the 10338 * first dump_scan invocation. 10339 */ 10340 if (start == 0) 10341 cfg80211_bss_expire(rdev); 10342 10343 cb->seq = rdev->bss_generation; 10344 10345 list_for_each_entry(scan, &rdev->bss_list, list) { 10346 if (++idx <= start) 10347 continue; 10348 if (nl80211_send_bss(skb, cb, 10349 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10350 rdev, wdev, scan) < 0) { 10351 idx--; 10352 break; 10353 } 10354 } 10355 10356 spin_unlock_bh(&rdev->bss_lock); 10357 wdev_unlock(wdev); 10358 10359 cb->args[2] = idx; 10360 wiphy_unlock(&rdev->wiphy); 10361 10362 return skb->len; 10363 } 10364 10365 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 10366 int flags, struct net_device *dev, 10367 bool allow_radio_stats, 10368 struct survey_info *survey) 10369 { 10370 void *hdr; 10371 struct nlattr *infoattr; 10372 10373 /* skip radio stats if userspace didn't request them */ 10374 if (!survey->channel && !allow_radio_stats) 10375 return 0; 10376 10377 hdr = nl80211hdr_put(msg, portid, seq, flags, 10378 NL80211_CMD_NEW_SURVEY_RESULTS); 10379 if (!hdr) 10380 return -ENOMEM; 10381 10382 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 10383 goto nla_put_failure; 10384 10385 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 10386 if (!infoattr) 10387 goto nla_put_failure; 10388 10389 if (survey->channel && 10390 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 10391 survey->channel->center_freq)) 10392 goto nla_put_failure; 10393 10394 if (survey->channel && survey->channel->freq_offset && 10395 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 10396 survey->channel->freq_offset)) 10397 goto nla_put_failure; 10398 10399 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 10400 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 10401 goto nla_put_failure; 10402 if ((survey->filled & SURVEY_INFO_IN_USE) && 10403 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 10404 goto nla_put_failure; 10405 if ((survey->filled & SURVEY_INFO_TIME) && 10406 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 10407 survey->time, NL80211_SURVEY_INFO_PAD)) 10408 goto nla_put_failure; 10409 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 10410 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 10411 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 10412 goto nla_put_failure; 10413 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 10414 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 10415 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 10416 goto nla_put_failure; 10417 if ((survey->filled & SURVEY_INFO_TIME_RX) && 10418 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 10419 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 10420 goto nla_put_failure; 10421 if ((survey->filled & SURVEY_INFO_TIME_TX) && 10422 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 10423 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 10424 goto nla_put_failure; 10425 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 10426 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 10427 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 10428 goto nla_put_failure; 10429 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 10430 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 10431 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 10432 goto nla_put_failure; 10433 10434 nla_nest_end(msg, infoattr); 10435 10436 genlmsg_end(msg, hdr); 10437 return 0; 10438 10439 nla_put_failure: 10440 genlmsg_cancel(msg, hdr); 10441 return -EMSGSIZE; 10442 } 10443 10444 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 10445 { 10446 struct nlattr **attrbuf; 10447 struct survey_info survey; 10448 struct cfg80211_registered_device *rdev; 10449 struct wireless_dev *wdev; 10450 int survey_idx = cb->args[2]; 10451 int res; 10452 bool radio_stats; 10453 10454 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 10455 if (!attrbuf) 10456 return -ENOMEM; 10457 10458 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf); 10459 if (res) { 10460 kfree(attrbuf); 10461 return res; 10462 } 10463 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10464 __acquire(&rdev->wiphy.mtx); 10465 10466 /* prepare_wdev_dump parsed the attributes */ 10467 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 10468 10469 if (!wdev->netdev) { 10470 res = -EINVAL; 10471 goto out_err; 10472 } 10473 10474 if (!rdev->ops->dump_survey) { 10475 res = -EOPNOTSUPP; 10476 goto out_err; 10477 } 10478 10479 while (1) { 10480 wdev_lock(wdev); 10481 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 10482 wdev_unlock(wdev); 10483 if (res == -ENOENT) 10484 break; 10485 if (res) 10486 goto out_err; 10487 10488 /* don't send disabled channels, but do send non-channel data */ 10489 if (survey.channel && 10490 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 10491 survey_idx++; 10492 continue; 10493 } 10494 10495 if (nl80211_send_survey(skb, 10496 NETLINK_CB(cb->skb).portid, 10497 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10498 wdev->netdev, radio_stats, &survey) < 0) 10499 goto out; 10500 survey_idx++; 10501 } 10502 10503 out: 10504 cb->args[2] = survey_idx; 10505 res = skb->len; 10506 out_err: 10507 kfree(attrbuf); 10508 wiphy_unlock(&rdev->wiphy); 10509 return res; 10510 } 10511 10512 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 10513 { 10514 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 10515 NL80211_WPA_VERSION_2 | 10516 NL80211_WPA_VERSION_3)); 10517 } 10518 10519 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 10520 { 10521 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10522 struct net_device *dev = info->user_ptr[1]; 10523 struct ieee80211_channel *chan; 10524 const u8 *bssid, *ssid; 10525 int err, ssid_len; 10526 enum nl80211_auth_type auth_type; 10527 struct key_parse key; 10528 bool local_state_change; 10529 struct cfg80211_auth_request req = {}; 10530 u32 freq; 10531 10532 if (!info->attrs[NL80211_ATTR_MAC]) 10533 return -EINVAL; 10534 10535 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 10536 return -EINVAL; 10537 10538 if (!info->attrs[NL80211_ATTR_SSID]) 10539 return -EINVAL; 10540 10541 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10542 return -EINVAL; 10543 10544 err = nl80211_parse_key(info, &key); 10545 if (err) 10546 return err; 10547 10548 if (key.idx >= 0) { 10549 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 10550 return -EINVAL; 10551 if (!key.p.key || !key.p.key_len) 10552 return -EINVAL; 10553 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 10554 key.p.key_len != WLAN_KEY_LEN_WEP40) && 10555 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 10556 key.p.key_len != WLAN_KEY_LEN_WEP104)) 10557 return -EINVAL; 10558 if (key.idx > 3) 10559 return -EINVAL; 10560 } else { 10561 key.p.key_len = 0; 10562 key.p.key = NULL; 10563 } 10564 10565 if (key.idx >= 0) { 10566 int i; 10567 bool ok = false; 10568 10569 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 10570 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 10571 ok = true; 10572 break; 10573 } 10574 } 10575 if (!ok) 10576 return -EINVAL; 10577 } 10578 10579 if (!rdev->ops->auth) 10580 return -EOPNOTSUPP; 10581 10582 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10583 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10584 return -EOPNOTSUPP; 10585 10586 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10587 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10588 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10589 freq += 10590 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10591 10592 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10593 if (!chan) 10594 return -EINVAL; 10595 10596 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10597 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10598 10599 if (info->attrs[NL80211_ATTR_IE]) { 10600 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10601 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10602 } 10603 10604 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10605 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 10606 return -EINVAL; 10607 10608 if ((auth_type == NL80211_AUTHTYPE_SAE || 10609 auth_type == NL80211_AUTHTYPE_FILS_SK || 10610 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 10611 auth_type == NL80211_AUTHTYPE_FILS_PK) && 10612 !info->attrs[NL80211_ATTR_AUTH_DATA]) 10613 return -EINVAL; 10614 10615 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 10616 if (auth_type != NL80211_AUTHTYPE_SAE && 10617 auth_type != NL80211_AUTHTYPE_FILS_SK && 10618 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 10619 auth_type != NL80211_AUTHTYPE_FILS_PK) 10620 return -EINVAL; 10621 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 10622 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 10623 } 10624 10625 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 10626 10627 /* 10628 * Since we no longer track auth state, ignore 10629 * requests to only change local state. 10630 */ 10631 if (local_state_change) 10632 return 0; 10633 10634 req.auth_type = auth_type; 10635 req.key = key.p.key; 10636 req.key_len = key.p.key_len; 10637 req.key_idx = key.idx; 10638 req.link_id = nl80211_link_id_or_invalid(info->attrs); 10639 if (req.link_id >= 0) { 10640 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 10641 return -EINVAL; 10642 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 10643 return -EINVAL; 10644 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 10645 } 10646 10647 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 10648 IEEE80211_BSS_TYPE_ESS, 10649 IEEE80211_PRIVACY_ANY); 10650 if (!req.bss) 10651 return -ENOENT; 10652 10653 wdev_lock(dev->ieee80211_ptr); 10654 err = cfg80211_mlme_auth(rdev, dev, &req); 10655 wdev_unlock(dev->ieee80211_ptr); 10656 10657 cfg80211_put_bss(&rdev->wiphy, req.bss); 10658 10659 return err; 10660 } 10661 10662 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 10663 struct genl_info *info) 10664 { 10665 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10666 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 10667 return -EINVAL; 10668 } 10669 10670 if (!rdev->ops->tx_control_port || 10671 !wiphy_ext_feature_isset(&rdev->wiphy, 10672 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 10673 return -EOPNOTSUPP; 10674 10675 return 0; 10676 } 10677 10678 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 10679 struct genl_info *info, 10680 struct cfg80211_crypto_settings *settings, 10681 int cipher_limit) 10682 { 10683 memset(settings, 0, sizeof(*settings)); 10684 10685 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 10686 10687 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 10688 u16 proto; 10689 10690 proto = nla_get_u16( 10691 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 10692 settings->control_port_ethertype = cpu_to_be16(proto); 10693 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 10694 proto != ETH_P_PAE) 10695 return -EINVAL; 10696 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 10697 settings->control_port_no_encrypt = true; 10698 } else 10699 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 10700 10701 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10702 int r = validate_pae_over_nl80211(rdev, info); 10703 10704 if (r < 0) 10705 return r; 10706 10707 settings->control_port_over_nl80211 = true; 10708 10709 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 10710 settings->control_port_no_preauth = true; 10711 } 10712 10713 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 10714 void *data; 10715 int len, i; 10716 10717 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10718 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10719 settings->n_ciphers_pairwise = len / sizeof(u32); 10720 10721 if (len % sizeof(u32)) 10722 return -EINVAL; 10723 10724 if (settings->n_ciphers_pairwise > cipher_limit) 10725 return -EINVAL; 10726 10727 memcpy(settings->ciphers_pairwise, data, len); 10728 10729 for (i = 0; i < settings->n_ciphers_pairwise; i++) 10730 if (!cfg80211_supported_cipher_suite( 10731 &rdev->wiphy, 10732 settings->ciphers_pairwise[i])) 10733 return -EINVAL; 10734 } 10735 10736 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 10737 settings->cipher_group = 10738 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 10739 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 10740 settings->cipher_group)) 10741 return -EINVAL; 10742 } 10743 10744 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 10745 settings->wpa_versions = 10746 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 10747 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 10748 return -EINVAL; 10749 } 10750 10751 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 10752 void *data; 10753 int len; 10754 10755 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 10756 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 10757 settings->n_akm_suites = len / sizeof(u32); 10758 10759 if (len % sizeof(u32)) 10760 return -EINVAL; 10761 10762 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites) 10763 return -EINVAL; 10764 10765 memcpy(settings->akm_suites, data, len); 10766 } 10767 10768 if (info->attrs[NL80211_ATTR_PMK]) { 10769 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 10770 return -EINVAL; 10771 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10772 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 10773 !wiphy_ext_feature_isset(&rdev->wiphy, 10774 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 10775 return -EINVAL; 10776 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10777 } 10778 10779 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 10780 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10781 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 10782 !wiphy_ext_feature_isset(&rdev->wiphy, 10783 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 10784 return -EINVAL; 10785 settings->sae_pwd = 10786 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10787 settings->sae_pwd_len = 10788 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10789 } 10790 10791 if (info->attrs[NL80211_ATTR_SAE_PWE]) 10792 settings->sae_pwe = 10793 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]); 10794 else 10795 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED; 10796 10797 return 0; 10798 } 10799 10800 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev, 10801 const u8 *ssid, int ssid_len, 10802 struct nlattr **attrs) 10803 { 10804 struct ieee80211_channel *chan; 10805 struct cfg80211_bss *bss; 10806 const u8 *bssid; 10807 u32 freq; 10808 10809 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ]) 10810 return ERR_PTR(-EINVAL); 10811 10812 bssid = nla_data(attrs[NL80211_ATTR_MAC]); 10813 10814 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ])); 10815 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10816 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10817 10818 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10819 if (!chan) 10820 return ERR_PTR(-EINVAL); 10821 10822 bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, 10823 ssid, ssid_len, 10824 IEEE80211_BSS_TYPE_ESS, 10825 IEEE80211_PRIVACY_ANY); 10826 if (!bss) 10827 return ERR_PTR(-ENOENT); 10828 10829 return bss; 10830 } 10831 10832 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 10833 { 10834 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10835 struct net_device *dev = info->user_ptr[1]; 10836 struct cfg80211_assoc_request req = {}; 10837 struct nlattr **attrs = NULL; 10838 const u8 *ap_addr, *ssid; 10839 unsigned int link_id; 10840 int err, ssid_len; 10841 10842 if (dev->ieee80211_ptr->conn_owner_nlportid && 10843 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10844 return -EPERM; 10845 10846 if (!info->attrs[NL80211_ATTR_SSID]) 10847 return -EINVAL; 10848 10849 if (!rdev->ops->assoc) 10850 return -EOPNOTSUPP; 10851 10852 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10853 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10854 return -EOPNOTSUPP; 10855 10856 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10857 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10858 10859 if (info->attrs[NL80211_ATTR_IE]) { 10860 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10861 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10862 10863 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 10864 req.ie, req.ie_len)) { 10865 GENL_SET_ERR_MSG(info, 10866 "non-inheritance makes no sense"); 10867 return -EINVAL; 10868 } 10869 } 10870 10871 if (info->attrs[NL80211_ATTR_USE_MFP]) { 10872 enum nl80211_mfp mfp = 10873 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 10874 if (mfp == NL80211_MFP_REQUIRED) 10875 req.use_mfp = true; 10876 else if (mfp != NL80211_MFP_NO) 10877 return -EINVAL; 10878 } 10879 10880 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 10881 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 10882 10883 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 10884 req.flags |= ASSOC_REQ_DISABLE_HT; 10885 10886 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10887 memcpy(&req.ht_capa_mask, 10888 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10889 sizeof(req.ht_capa_mask)); 10890 10891 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10892 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10893 return -EINVAL; 10894 memcpy(&req.ht_capa, 10895 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10896 sizeof(req.ht_capa)); 10897 } 10898 10899 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 10900 req.flags |= ASSOC_REQ_DISABLE_VHT; 10901 10902 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 10903 req.flags |= ASSOC_REQ_DISABLE_HE; 10904 10905 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 10906 req.flags |= ASSOC_REQ_DISABLE_EHT; 10907 10908 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 10909 memcpy(&req.vht_capa_mask, 10910 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 10911 sizeof(req.vht_capa_mask)); 10912 10913 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 10914 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 10915 return -EINVAL; 10916 memcpy(&req.vht_capa, 10917 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 10918 sizeof(req.vht_capa)); 10919 } 10920 10921 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 10922 if (!((rdev->wiphy.features & 10923 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 10924 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 10925 !wiphy_ext_feature_isset(&rdev->wiphy, 10926 NL80211_EXT_FEATURE_RRM)) 10927 return -EINVAL; 10928 req.flags |= ASSOC_REQ_USE_RRM; 10929 } 10930 10931 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 10932 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 10933 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 10934 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 10935 return -EINVAL; 10936 req.fils_nonces = 10937 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 10938 } 10939 10940 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 10941 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 10942 return -EINVAL; 10943 memcpy(&req.s1g_capa_mask, 10944 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 10945 sizeof(req.s1g_capa_mask)); 10946 } 10947 10948 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 10949 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 10950 return -EINVAL; 10951 memcpy(&req.s1g_capa, 10952 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 10953 sizeof(req.s1g_capa)); 10954 } 10955 10956 req.link_id = nl80211_link_id_or_invalid(info->attrs); 10957 10958 if (info->attrs[NL80211_ATTR_MLO_LINKS]) { 10959 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs); 10960 struct nlattr *link; 10961 int rem = 0; 10962 10963 if (req.link_id < 0) 10964 return -EINVAL; 10965 10966 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 10967 return -EINVAL; 10968 10969 if (info->attrs[NL80211_ATTR_MAC] || 10970 info->attrs[NL80211_ATTR_WIPHY_FREQ] || 10971 !info->attrs[NL80211_ATTR_MLD_ADDR]) 10972 return -EINVAL; 10973 10974 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 10975 ap_addr = req.ap_mld_addr; 10976 10977 attrs = kzalloc(attrsize, GFP_KERNEL); 10978 if (!attrs) 10979 return -ENOMEM; 10980 10981 nla_for_each_nested(link, 10982 info->attrs[NL80211_ATTR_MLO_LINKS], 10983 rem) { 10984 memset(attrs, 0, attrsize); 10985 10986 nla_parse_nested(attrs, NL80211_ATTR_MAX, 10987 link, NULL, NULL); 10988 10989 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) { 10990 err = -EINVAL; 10991 goto free; 10992 } 10993 10994 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]); 10995 /* cannot use the same link ID again */ 10996 if (req.links[link_id].bss) { 10997 err = -EINVAL; 10998 goto free; 10999 } 11000 req.links[link_id].bss = 11001 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs); 11002 if (IS_ERR(req.links[link_id].bss)) { 11003 err = PTR_ERR(req.links[link_id].bss); 11004 req.links[link_id].bss = NULL; 11005 goto free; 11006 } 11007 11008 if (attrs[NL80211_ATTR_IE]) { 11009 req.links[link_id].elems = 11010 nla_data(attrs[NL80211_ATTR_IE]); 11011 req.links[link_id].elems_len = 11012 nla_len(attrs[NL80211_ATTR_IE]); 11013 11014 if (cfg80211_find_elem(WLAN_EID_FRAGMENT, 11015 req.links[link_id].elems, 11016 req.links[link_id].elems_len)) { 11017 GENL_SET_ERR_MSG(info, 11018 "cannot deal with fragmentation"); 11019 err = -EINVAL; 11020 goto free; 11021 } 11022 11023 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 11024 req.links[link_id].elems, 11025 req.links[link_id].elems_len)) { 11026 GENL_SET_ERR_MSG(info, 11027 "cannot deal with non-inheritance"); 11028 err = -EINVAL; 11029 goto free; 11030 } 11031 } 11032 } 11033 11034 if (!req.links[req.link_id].bss) { 11035 err = -EINVAL; 11036 goto free; 11037 } 11038 11039 if (req.links[req.link_id].elems_len) { 11040 GENL_SET_ERR_MSG(info, 11041 "cannot have per-link elems on assoc link"); 11042 err = -EINVAL; 11043 goto free; 11044 } 11045 11046 kfree(attrs); 11047 attrs = NULL; 11048 } else { 11049 if (req.link_id >= 0) 11050 return -EINVAL; 11051 11052 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs); 11053 if (IS_ERR(req.bss)) 11054 return PTR_ERR(req.bss); 11055 ap_addr = req.bss->bssid; 11056 } 11057 11058 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 11059 if (!err) { 11060 wdev_lock(dev->ieee80211_ptr); 11061 11062 err = cfg80211_mlme_assoc(rdev, dev, &req); 11063 11064 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 11065 dev->ieee80211_ptr->conn_owner_nlportid = 11066 info->snd_portid; 11067 memcpy(dev->ieee80211_ptr->disconnect_bssid, 11068 ap_addr, ETH_ALEN); 11069 } 11070 11071 wdev_unlock(dev->ieee80211_ptr); 11072 } 11073 11074 free: 11075 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++) 11076 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss); 11077 cfg80211_put_bss(&rdev->wiphy, req.bss); 11078 kfree(attrs); 11079 11080 return err; 11081 } 11082 11083 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 11084 { 11085 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11086 struct net_device *dev = info->user_ptr[1]; 11087 const u8 *ie = NULL, *bssid; 11088 int ie_len = 0, err; 11089 u16 reason_code; 11090 bool local_state_change; 11091 11092 if (dev->ieee80211_ptr->conn_owner_nlportid && 11093 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11094 return -EPERM; 11095 11096 if (!info->attrs[NL80211_ATTR_MAC]) 11097 return -EINVAL; 11098 11099 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11100 return -EINVAL; 11101 11102 if (!rdev->ops->deauth) 11103 return -EOPNOTSUPP; 11104 11105 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11106 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11107 return -EOPNOTSUPP; 11108 11109 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11110 11111 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11112 if (reason_code == 0) { 11113 /* Reason Code 0 is reserved */ 11114 return -EINVAL; 11115 } 11116 11117 if (info->attrs[NL80211_ATTR_IE]) { 11118 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11119 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11120 } 11121 11122 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11123 11124 wdev_lock(dev->ieee80211_ptr); 11125 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 11126 local_state_change); 11127 wdev_unlock(dev->ieee80211_ptr); 11128 return err; 11129 } 11130 11131 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 11132 { 11133 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11134 struct net_device *dev = info->user_ptr[1]; 11135 const u8 *ie = NULL, *bssid; 11136 int ie_len = 0, err; 11137 u16 reason_code; 11138 bool local_state_change; 11139 11140 if (dev->ieee80211_ptr->conn_owner_nlportid && 11141 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11142 return -EPERM; 11143 11144 if (!info->attrs[NL80211_ATTR_MAC]) 11145 return -EINVAL; 11146 11147 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11148 return -EINVAL; 11149 11150 if (!rdev->ops->disassoc) 11151 return -EOPNOTSUPP; 11152 11153 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11154 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11155 return -EOPNOTSUPP; 11156 11157 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11158 11159 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11160 if (reason_code == 0) { 11161 /* Reason Code 0 is reserved */ 11162 return -EINVAL; 11163 } 11164 11165 if (info->attrs[NL80211_ATTR_IE]) { 11166 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11167 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11168 } 11169 11170 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11171 11172 wdev_lock(dev->ieee80211_ptr); 11173 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 11174 local_state_change); 11175 wdev_unlock(dev->ieee80211_ptr); 11176 return err; 11177 } 11178 11179 static bool 11180 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 11181 int mcast_rate[NUM_NL80211_BANDS], 11182 int rateval) 11183 { 11184 struct wiphy *wiphy = &rdev->wiphy; 11185 bool found = false; 11186 int band, i; 11187 11188 for (band = 0; band < NUM_NL80211_BANDS; band++) { 11189 struct ieee80211_supported_band *sband; 11190 11191 sband = wiphy->bands[band]; 11192 if (!sband) 11193 continue; 11194 11195 for (i = 0; i < sband->n_bitrates; i++) { 11196 if (sband->bitrates[i].bitrate == rateval) { 11197 mcast_rate[band] = i + 1; 11198 found = true; 11199 break; 11200 } 11201 } 11202 } 11203 11204 return found; 11205 } 11206 11207 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 11208 { 11209 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11210 struct net_device *dev = info->user_ptr[1]; 11211 struct cfg80211_ibss_params ibss; 11212 struct wiphy *wiphy; 11213 struct cfg80211_cached_keys *connkeys = NULL; 11214 int err; 11215 11216 memset(&ibss, 0, sizeof(ibss)); 11217 11218 if (!info->attrs[NL80211_ATTR_SSID] || 11219 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11220 return -EINVAL; 11221 11222 ibss.beacon_interval = 100; 11223 11224 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 11225 ibss.beacon_interval = 11226 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11227 11228 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 11229 ibss.beacon_interval); 11230 if (err) 11231 return err; 11232 11233 if (!rdev->ops->join_ibss) 11234 return -EOPNOTSUPP; 11235 11236 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11237 return -EOPNOTSUPP; 11238 11239 wiphy = &rdev->wiphy; 11240 11241 if (info->attrs[NL80211_ATTR_MAC]) { 11242 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11243 11244 if (!is_valid_ether_addr(ibss.bssid)) 11245 return -EINVAL; 11246 } 11247 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11248 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11249 11250 if (info->attrs[NL80211_ATTR_IE]) { 11251 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11252 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11253 } 11254 11255 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 11256 if (err) 11257 return err; 11258 11259 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 11260 NL80211_IFTYPE_ADHOC)) 11261 return -EINVAL; 11262 11263 switch (ibss.chandef.width) { 11264 case NL80211_CHAN_WIDTH_5: 11265 case NL80211_CHAN_WIDTH_10: 11266 case NL80211_CHAN_WIDTH_20_NOHT: 11267 break; 11268 case NL80211_CHAN_WIDTH_20: 11269 case NL80211_CHAN_WIDTH_40: 11270 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11271 return -EINVAL; 11272 break; 11273 case NL80211_CHAN_WIDTH_80: 11274 case NL80211_CHAN_WIDTH_80P80: 11275 case NL80211_CHAN_WIDTH_160: 11276 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11277 return -EINVAL; 11278 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11279 NL80211_EXT_FEATURE_VHT_IBSS)) 11280 return -EINVAL; 11281 break; 11282 case NL80211_CHAN_WIDTH_320: 11283 return -EINVAL; 11284 default: 11285 return -EINVAL; 11286 } 11287 11288 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 11289 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 11290 11291 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11292 u8 *rates = 11293 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11294 int n_rates = 11295 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11296 struct ieee80211_supported_band *sband = 11297 wiphy->bands[ibss.chandef.chan->band]; 11298 11299 err = ieee80211_get_ratemask(sband, rates, n_rates, 11300 &ibss.basic_rates); 11301 if (err) 11302 return err; 11303 } 11304 11305 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11306 memcpy(&ibss.ht_capa_mask, 11307 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11308 sizeof(ibss.ht_capa_mask)); 11309 11310 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11311 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11312 return -EINVAL; 11313 memcpy(&ibss.ht_capa, 11314 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11315 sizeof(ibss.ht_capa)); 11316 } 11317 11318 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11319 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 11320 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11321 return -EINVAL; 11322 11323 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11324 bool no_ht = false; 11325 11326 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 11327 if (IS_ERR(connkeys)) 11328 return PTR_ERR(connkeys); 11329 11330 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 11331 no_ht) { 11332 kfree_sensitive(connkeys); 11333 return -EINVAL; 11334 } 11335 } 11336 11337 ibss.control_port = 11338 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 11339 11340 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11341 int r = validate_pae_over_nl80211(rdev, info); 11342 11343 if (r < 0) { 11344 kfree_sensitive(connkeys); 11345 return r; 11346 } 11347 11348 ibss.control_port_over_nl80211 = true; 11349 } 11350 11351 ibss.userspace_handles_dfs = 11352 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11353 11354 wdev_lock(dev->ieee80211_ptr); 11355 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 11356 if (err) 11357 kfree_sensitive(connkeys); 11358 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11359 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11360 wdev_unlock(dev->ieee80211_ptr); 11361 11362 return err; 11363 } 11364 11365 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 11366 { 11367 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11368 struct net_device *dev = info->user_ptr[1]; 11369 11370 if (!rdev->ops->leave_ibss) 11371 return -EOPNOTSUPP; 11372 11373 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11374 return -EOPNOTSUPP; 11375 11376 return cfg80211_leave_ibss(rdev, dev, false); 11377 } 11378 11379 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 11380 { 11381 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11382 struct net_device *dev = info->user_ptr[1]; 11383 int mcast_rate[NUM_NL80211_BANDS]; 11384 u32 nla_rate; 11385 11386 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 11387 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 11388 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 11389 return -EOPNOTSUPP; 11390 11391 if (!rdev->ops->set_mcast_rate) 11392 return -EOPNOTSUPP; 11393 11394 memset(mcast_rate, 0, sizeof(mcast_rate)); 11395 11396 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 11397 return -EINVAL; 11398 11399 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 11400 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 11401 return -EINVAL; 11402 11403 return rdev_set_mcast_rate(rdev, dev, mcast_rate); 11404 } 11405 11406 static struct sk_buff * 11407 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 11408 struct wireless_dev *wdev, int approxlen, 11409 u32 portid, u32 seq, enum nl80211_commands cmd, 11410 enum nl80211_attrs attr, 11411 const struct nl80211_vendor_cmd_info *info, 11412 gfp_t gfp) 11413 { 11414 struct sk_buff *skb; 11415 void *hdr; 11416 struct nlattr *data; 11417 11418 skb = nlmsg_new(approxlen + 100, gfp); 11419 if (!skb) 11420 return NULL; 11421 11422 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 11423 if (!hdr) { 11424 kfree_skb(skb); 11425 return NULL; 11426 } 11427 11428 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 11429 goto nla_put_failure; 11430 11431 if (info) { 11432 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 11433 info->vendor_id)) 11434 goto nla_put_failure; 11435 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 11436 info->subcmd)) 11437 goto nla_put_failure; 11438 } 11439 11440 if (wdev) { 11441 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 11442 wdev_id(wdev), NL80211_ATTR_PAD)) 11443 goto nla_put_failure; 11444 if (wdev->netdev && 11445 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 11446 wdev->netdev->ifindex)) 11447 goto nla_put_failure; 11448 } 11449 11450 data = nla_nest_start_noflag(skb, attr); 11451 if (!data) 11452 goto nla_put_failure; 11453 11454 ((void **)skb->cb)[0] = rdev; 11455 ((void **)skb->cb)[1] = hdr; 11456 ((void **)skb->cb)[2] = data; 11457 11458 return skb; 11459 11460 nla_put_failure: 11461 kfree_skb(skb); 11462 return NULL; 11463 } 11464 11465 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 11466 struct wireless_dev *wdev, 11467 enum nl80211_commands cmd, 11468 enum nl80211_attrs attr, 11469 unsigned int portid, 11470 int vendor_event_idx, 11471 int approxlen, gfp_t gfp) 11472 { 11473 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11474 const struct nl80211_vendor_cmd_info *info; 11475 11476 switch (cmd) { 11477 case NL80211_CMD_TESTMODE: 11478 if (WARN_ON(vendor_event_idx != -1)) 11479 return NULL; 11480 info = NULL; 11481 break; 11482 case NL80211_CMD_VENDOR: 11483 if (WARN_ON(vendor_event_idx < 0 || 11484 vendor_event_idx >= wiphy->n_vendor_events)) 11485 return NULL; 11486 info = &wiphy->vendor_events[vendor_event_idx]; 11487 break; 11488 default: 11489 WARN_ON(1); 11490 return NULL; 11491 } 11492 11493 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 11494 cmd, attr, info, gfp); 11495 } 11496 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 11497 11498 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 11499 { 11500 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 11501 void *hdr = ((void **)skb->cb)[1]; 11502 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 11503 struct nlattr *data = ((void **)skb->cb)[2]; 11504 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 11505 11506 /* clear CB data for netlink core to own from now on */ 11507 memset(skb->cb, 0, sizeof(skb->cb)); 11508 11509 nla_nest_end(skb, data); 11510 genlmsg_end(skb, hdr); 11511 11512 if (nlhdr->nlmsg_pid) { 11513 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 11514 nlhdr->nlmsg_pid); 11515 } else { 11516 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 11517 mcgrp = NL80211_MCGRP_VENDOR; 11518 11519 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11520 skb, 0, mcgrp, gfp); 11521 } 11522 } 11523 EXPORT_SYMBOL(__cfg80211_send_event_skb); 11524 11525 #ifdef CONFIG_NL80211_TESTMODE 11526 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 11527 { 11528 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11529 struct wireless_dev *wdev; 11530 int err; 11531 11532 lockdep_assert_held(&rdev->wiphy.mtx); 11533 11534 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 11535 info->attrs); 11536 11537 if (!rdev->ops->testmode_cmd) 11538 return -EOPNOTSUPP; 11539 11540 if (IS_ERR(wdev)) { 11541 err = PTR_ERR(wdev); 11542 if (err != -EINVAL) 11543 return err; 11544 wdev = NULL; 11545 } else if (wdev->wiphy != &rdev->wiphy) { 11546 return -EINVAL; 11547 } 11548 11549 if (!info->attrs[NL80211_ATTR_TESTDATA]) 11550 return -EINVAL; 11551 11552 rdev->cur_cmd_info = info; 11553 err = rdev_testmode_cmd(rdev, wdev, 11554 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 11555 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 11556 rdev->cur_cmd_info = NULL; 11557 11558 return err; 11559 } 11560 11561 static int nl80211_testmode_dump(struct sk_buff *skb, 11562 struct netlink_callback *cb) 11563 { 11564 struct cfg80211_registered_device *rdev; 11565 struct nlattr **attrbuf = NULL; 11566 int err; 11567 long phy_idx; 11568 void *data = NULL; 11569 int data_len = 0; 11570 11571 rtnl_lock(); 11572 11573 if (cb->args[0]) { 11574 /* 11575 * 0 is a valid index, but not valid for args[0], 11576 * so we need to offset by 1. 11577 */ 11578 phy_idx = cb->args[0] - 1; 11579 11580 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 11581 if (!rdev) { 11582 err = -ENOENT; 11583 goto out_err; 11584 } 11585 } else { 11586 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 11587 GFP_KERNEL); 11588 if (!attrbuf) { 11589 err = -ENOMEM; 11590 goto out_err; 11591 } 11592 11593 err = nlmsg_parse_deprecated(cb->nlh, 11594 GENL_HDRLEN + nl80211_fam.hdrsize, 11595 attrbuf, nl80211_fam.maxattr, 11596 nl80211_policy, NULL); 11597 if (err) 11598 goto out_err; 11599 11600 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11601 if (IS_ERR(rdev)) { 11602 err = PTR_ERR(rdev); 11603 goto out_err; 11604 } 11605 phy_idx = rdev->wiphy_idx; 11606 11607 if (attrbuf[NL80211_ATTR_TESTDATA]) 11608 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 11609 } 11610 11611 if (cb->args[1]) { 11612 data = nla_data((void *)cb->args[1]); 11613 data_len = nla_len((void *)cb->args[1]); 11614 } 11615 11616 if (!rdev->ops->testmode_dump) { 11617 err = -EOPNOTSUPP; 11618 goto out_err; 11619 } 11620 11621 while (1) { 11622 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 11623 cb->nlh->nlmsg_seq, NLM_F_MULTI, 11624 NL80211_CMD_TESTMODE); 11625 struct nlattr *tmdata; 11626 11627 if (!hdr) 11628 break; 11629 11630 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 11631 genlmsg_cancel(skb, hdr); 11632 break; 11633 } 11634 11635 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 11636 if (!tmdata) { 11637 genlmsg_cancel(skb, hdr); 11638 break; 11639 } 11640 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 11641 nla_nest_end(skb, tmdata); 11642 11643 if (err == -ENOBUFS || err == -ENOENT) { 11644 genlmsg_cancel(skb, hdr); 11645 break; 11646 } else if (err) { 11647 genlmsg_cancel(skb, hdr); 11648 goto out_err; 11649 } 11650 11651 genlmsg_end(skb, hdr); 11652 } 11653 11654 err = skb->len; 11655 /* see above */ 11656 cb->args[0] = phy_idx + 1; 11657 out_err: 11658 kfree(attrbuf); 11659 rtnl_unlock(); 11660 return err; 11661 } 11662 #endif 11663 11664 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 11665 { 11666 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11667 struct net_device *dev = info->user_ptr[1]; 11668 struct cfg80211_connect_params connect; 11669 struct wiphy *wiphy; 11670 struct cfg80211_cached_keys *connkeys = NULL; 11671 u32 freq = 0; 11672 int err; 11673 11674 memset(&connect, 0, sizeof(connect)); 11675 11676 if (!info->attrs[NL80211_ATTR_SSID] || 11677 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11678 return -EINVAL; 11679 11680 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 11681 connect.auth_type = 11682 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 11683 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 11684 NL80211_CMD_CONNECT)) 11685 return -EINVAL; 11686 } else 11687 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 11688 11689 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 11690 11691 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 11692 !wiphy_ext_feature_isset(&rdev->wiphy, 11693 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 11694 return -EINVAL; 11695 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 11696 11697 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 11698 NL80211_MAX_NR_CIPHER_SUITES); 11699 if (err) 11700 return err; 11701 11702 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11703 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11704 return -EOPNOTSUPP; 11705 11706 wiphy = &rdev->wiphy; 11707 11708 connect.bg_scan_period = -1; 11709 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 11710 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 11711 connect.bg_scan_period = 11712 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 11713 } 11714 11715 if (info->attrs[NL80211_ATTR_MAC]) 11716 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11717 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 11718 connect.bssid_hint = 11719 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 11720 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11721 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11722 11723 if (info->attrs[NL80211_ATTR_IE]) { 11724 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11725 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11726 } 11727 11728 if (info->attrs[NL80211_ATTR_USE_MFP]) { 11729 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 11730 if (connect.mfp == NL80211_MFP_OPTIONAL && 11731 !wiphy_ext_feature_isset(&rdev->wiphy, 11732 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 11733 return -EOPNOTSUPP; 11734 } else { 11735 connect.mfp = NL80211_MFP_NO; 11736 } 11737 11738 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 11739 connect.prev_bssid = 11740 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 11741 11742 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11743 freq = MHZ_TO_KHZ(nla_get_u32( 11744 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 11745 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 11746 freq += 11747 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 11748 11749 if (freq) { 11750 connect.channel = nl80211_get_valid_chan(wiphy, freq); 11751 if (!connect.channel) 11752 return -EINVAL; 11753 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 11754 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 11755 freq = MHZ_TO_KHZ(freq); 11756 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 11757 if (!connect.channel_hint) 11758 return -EINVAL; 11759 } 11760 11761 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 11762 connect.edmg.channels = 11763 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 11764 11765 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 11766 connect.edmg.bw_config = 11767 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 11768 } 11769 11770 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11771 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 11772 if (IS_ERR(connkeys)) 11773 return PTR_ERR(connkeys); 11774 } 11775 11776 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 11777 connect.flags |= ASSOC_REQ_DISABLE_HT; 11778 11779 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11780 memcpy(&connect.ht_capa_mask, 11781 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11782 sizeof(connect.ht_capa_mask)); 11783 11784 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11785 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 11786 kfree_sensitive(connkeys); 11787 return -EINVAL; 11788 } 11789 memcpy(&connect.ht_capa, 11790 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11791 sizeof(connect.ht_capa)); 11792 } 11793 11794 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 11795 connect.flags |= ASSOC_REQ_DISABLE_VHT; 11796 11797 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 11798 connect.flags |= ASSOC_REQ_DISABLE_HE; 11799 11800 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 11801 connect.flags |= ASSOC_REQ_DISABLE_EHT; 11802 11803 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11804 memcpy(&connect.vht_capa_mask, 11805 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 11806 sizeof(connect.vht_capa_mask)); 11807 11808 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 11809 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 11810 kfree_sensitive(connkeys); 11811 return -EINVAL; 11812 } 11813 memcpy(&connect.vht_capa, 11814 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 11815 sizeof(connect.vht_capa)); 11816 } 11817 11818 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 11819 if (!((rdev->wiphy.features & 11820 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 11821 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 11822 !wiphy_ext_feature_isset(&rdev->wiphy, 11823 NL80211_EXT_FEATURE_RRM)) { 11824 kfree_sensitive(connkeys); 11825 return -EINVAL; 11826 } 11827 connect.flags |= ASSOC_REQ_USE_RRM; 11828 } 11829 11830 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 11831 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 11832 kfree_sensitive(connkeys); 11833 return -EOPNOTSUPP; 11834 } 11835 11836 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 11837 /* bss selection makes no sense if bssid is set */ 11838 if (connect.bssid) { 11839 kfree_sensitive(connkeys); 11840 return -EINVAL; 11841 } 11842 11843 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 11844 wiphy, &connect.bss_select); 11845 if (err) { 11846 kfree_sensitive(connkeys); 11847 return err; 11848 } 11849 } 11850 11851 if (wiphy_ext_feature_isset(&rdev->wiphy, 11852 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 11853 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 11854 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 11855 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 11856 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 11857 connect.fils_erp_username = 11858 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 11859 connect.fils_erp_username_len = 11860 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 11861 connect.fils_erp_realm = 11862 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 11863 connect.fils_erp_realm_len = 11864 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 11865 connect.fils_erp_next_seq_num = 11866 nla_get_u16( 11867 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 11868 connect.fils_erp_rrk = 11869 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 11870 connect.fils_erp_rrk_len = 11871 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 11872 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 11873 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 11874 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 11875 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 11876 kfree_sensitive(connkeys); 11877 return -EINVAL; 11878 } 11879 11880 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 11881 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 11882 kfree_sensitive(connkeys); 11883 GENL_SET_ERR_MSG(info, 11884 "external auth requires connection ownership"); 11885 return -EINVAL; 11886 } 11887 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 11888 } 11889 11890 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT])) 11891 connect.flags |= CONNECT_REQ_MLO_SUPPORT; 11892 11893 wdev_lock(dev->ieee80211_ptr); 11894 11895 err = cfg80211_connect(rdev, dev, &connect, connkeys, 11896 connect.prev_bssid); 11897 if (err) 11898 kfree_sensitive(connkeys); 11899 11900 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 11901 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11902 if (connect.bssid) 11903 memcpy(dev->ieee80211_ptr->disconnect_bssid, 11904 connect.bssid, ETH_ALEN); 11905 else 11906 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 11907 } 11908 11909 wdev_unlock(dev->ieee80211_ptr); 11910 11911 return err; 11912 } 11913 11914 static int nl80211_update_connect_params(struct sk_buff *skb, 11915 struct genl_info *info) 11916 { 11917 struct cfg80211_connect_params connect = {}; 11918 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11919 struct net_device *dev = info->user_ptr[1]; 11920 struct wireless_dev *wdev = dev->ieee80211_ptr; 11921 bool fils_sk_offload; 11922 u32 auth_type; 11923 u32 changed = 0; 11924 int ret; 11925 11926 if (!rdev->ops->update_connect_params) 11927 return -EOPNOTSUPP; 11928 11929 if (info->attrs[NL80211_ATTR_IE]) { 11930 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11931 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11932 changed |= UPDATE_ASSOC_IES; 11933 } 11934 11935 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 11936 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 11937 11938 /* 11939 * when driver supports fils-sk offload all attributes must be 11940 * provided. So the else covers "fils-sk-not-all" and 11941 * "no-fils-sk-any". 11942 */ 11943 if (fils_sk_offload && 11944 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 11945 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 11946 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 11947 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 11948 connect.fils_erp_username = 11949 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 11950 connect.fils_erp_username_len = 11951 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 11952 connect.fils_erp_realm = 11953 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 11954 connect.fils_erp_realm_len = 11955 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 11956 connect.fils_erp_next_seq_num = 11957 nla_get_u16( 11958 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 11959 connect.fils_erp_rrk = 11960 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 11961 connect.fils_erp_rrk_len = 11962 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 11963 changed |= UPDATE_FILS_ERP_INFO; 11964 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 11965 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 11966 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 11967 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 11968 return -EINVAL; 11969 } 11970 11971 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 11972 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 11973 if (!nl80211_valid_auth_type(rdev, auth_type, 11974 NL80211_CMD_CONNECT)) 11975 return -EINVAL; 11976 11977 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 11978 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 11979 return -EINVAL; 11980 11981 connect.auth_type = auth_type; 11982 changed |= UPDATE_AUTH_TYPE; 11983 } 11984 11985 wdev_lock(dev->ieee80211_ptr); 11986 if (!wdev->connected) 11987 ret = -ENOLINK; 11988 else 11989 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 11990 wdev_unlock(dev->ieee80211_ptr); 11991 11992 return ret; 11993 } 11994 11995 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 11996 { 11997 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11998 struct net_device *dev = info->user_ptr[1]; 11999 u16 reason; 12000 int ret; 12001 12002 if (dev->ieee80211_ptr->conn_owner_nlportid && 12003 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 12004 return -EPERM; 12005 12006 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 12007 reason = WLAN_REASON_DEAUTH_LEAVING; 12008 else 12009 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 12010 12011 if (reason == 0) 12012 return -EINVAL; 12013 12014 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12015 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12016 return -EOPNOTSUPP; 12017 12018 wdev_lock(dev->ieee80211_ptr); 12019 ret = cfg80211_disconnect(rdev, dev, reason, true); 12020 wdev_unlock(dev->ieee80211_ptr); 12021 return ret; 12022 } 12023 12024 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 12025 { 12026 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12027 struct net *net; 12028 int err; 12029 12030 if (info->attrs[NL80211_ATTR_PID]) { 12031 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 12032 12033 net = get_net_ns_by_pid(pid); 12034 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 12035 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 12036 12037 net = get_net_ns_by_fd(fd); 12038 } else { 12039 return -EINVAL; 12040 } 12041 12042 if (IS_ERR(net)) 12043 return PTR_ERR(net); 12044 12045 err = 0; 12046 12047 /* check if anything to do */ 12048 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 12049 err = cfg80211_switch_netns(rdev, net); 12050 12051 put_net(net); 12052 return err; 12053 } 12054 12055 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 12056 { 12057 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12058 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 12059 struct cfg80211_pmksa *pmksa) = NULL; 12060 struct net_device *dev = info->user_ptr[1]; 12061 struct cfg80211_pmksa pmksa; 12062 12063 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 12064 12065 if (!info->attrs[NL80211_ATTR_PMKID]) 12066 return -EINVAL; 12067 12068 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 12069 12070 if (info->attrs[NL80211_ATTR_MAC]) { 12071 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 12072 } else if (info->attrs[NL80211_ATTR_SSID] && 12073 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 12074 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 12075 info->attrs[NL80211_ATTR_PMK])) { 12076 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 12077 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12078 pmksa.cache_id = 12079 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 12080 } else { 12081 return -EINVAL; 12082 } 12083 if (info->attrs[NL80211_ATTR_PMK]) { 12084 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12085 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12086 } 12087 12088 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 12089 pmksa.pmk_lifetime = 12090 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 12091 12092 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 12093 pmksa.pmk_reauth_threshold = 12094 nla_get_u8( 12095 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 12096 12097 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12098 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 12099 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP && 12100 wiphy_ext_feature_isset(&rdev->wiphy, 12101 NL80211_EXT_FEATURE_AP_PMKSA_CACHING))) 12102 return -EOPNOTSUPP; 12103 12104 switch (info->genlhdr->cmd) { 12105 case NL80211_CMD_SET_PMKSA: 12106 rdev_ops = rdev->ops->set_pmksa; 12107 break; 12108 case NL80211_CMD_DEL_PMKSA: 12109 rdev_ops = rdev->ops->del_pmksa; 12110 break; 12111 default: 12112 WARN_ON(1); 12113 break; 12114 } 12115 12116 if (!rdev_ops) 12117 return -EOPNOTSUPP; 12118 12119 return rdev_ops(&rdev->wiphy, dev, &pmksa); 12120 } 12121 12122 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 12123 { 12124 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12125 struct net_device *dev = info->user_ptr[1]; 12126 12127 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12128 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12129 return -EOPNOTSUPP; 12130 12131 if (!rdev->ops->flush_pmksa) 12132 return -EOPNOTSUPP; 12133 12134 return rdev_flush_pmksa(rdev, dev); 12135 } 12136 12137 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 12138 { 12139 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12140 struct net_device *dev = info->user_ptr[1]; 12141 u8 action_code, dialog_token; 12142 u32 peer_capability = 0; 12143 u16 status_code; 12144 u8 *peer; 12145 bool initiator; 12146 12147 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12148 !rdev->ops->tdls_mgmt) 12149 return -EOPNOTSUPP; 12150 12151 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 12152 !info->attrs[NL80211_ATTR_STATUS_CODE] || 12153 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 12154 !info->attrs[NL80211_ATTR_IE] || 12155 !info->attrs[NL80211_ATTR_MAC]) 12156 return -EINVAL; 12157 12158 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12159 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 12160 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 12161 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 12162 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 12163 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 12164 peer_capability = 12165 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 12166 12167 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 12168 dialog_token, status_code, peer_capability, 12169 initiator, 12170 nla_data(info->attrs[NL80211_ATTR_IE]), 12171 nla_len(info->attrs[NL80211_ATTR_IE])); 12172 } 12173 12174 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 12175 { 12176 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12177 struct net_device *dev = info->user_ptr[1]; 12178 enum nl80211_tdls_operation operation; 12179 u8 *peer; 12180 12181 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12182 !rdev->ops->tdls_oper) 12183 return -EOPNOTSUPP; 12184 12185 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 12186 !info->attrs[NL80211_ATTR_MAC]) 12187 return -EINVAL; 12188 12189 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 12190 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12191 12192 return rdev_tdls_oper(rdev, dev, peer, operation); 12193 } 12194 12195 static int nl80211_remain_on_channel(struct sk_buff *skb, 12196 struct genl_info *info) 12197 { 12198 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12199 unsigned int link_id = nl80211_link_id(info->attrs); 12200 struct wireless_dev *wdev = info->user_ptr[1]; 12201 struct cfg80211_chan_def chandef; 12202 struct sk_buff *msg; 12203 void *hdr; 12204 u64 cookie; 12205 u32 duration; 12206 int err; 12207 12208 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 12209 !info->attrs[NL80211_ATTR_DURATION]) 12210 return -EINVAL; 12211 12212 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12213 12214 if (!rdev->ops->remain_on_channel || 12215 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 12216 return -EOPNOTSUPP; 12217 12218 /* 12219 * We should be on that channel for at least a minimum amount of 12220 * time (10ms) but no longer than the driver supports. 12221 */ 12222 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12223 duration > rdev->wiphy.max_remain_on_channel_duration) 12224 return -EINVAL; 12225 12226 err = nl80211_parse_chandef(rdev, info, &chandef); 12227 if (err) 12228 return err; 12229 12230 wdev_lock(wdev); 12231 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) { 12232 const struct cfg80211_chan_def *oper_chandef, *compat_chandef; 12233 12234 oper_chandef = wdev_chandef(wdev, link_id); 12235 12236 if (WARN_ON(!oper_chandef)) { 12237 /* cannot happen since we must beacon to get here */ 12238 WARN_ON(1); 12239 wdev_unlock(wdev); 12240 return -EBUSY; 12241 } 12242 12243 /* note: returns first one if identical chandefs */ 12244 compat_chandef = cfg80211_chandef_compatible(&chandef, 12245 oper_chandef); 12246 12247 if (compat_chandef != &chandef) { 12248 wdev_unlock(wdev); 12249 return -EBUSY; 12250 } 12251 } 12252 wdev_unlock(wdev); 12253 12254 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12255 if (!msg) 12256 return -ENOMEM; 12257 12258 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12259 NL80211_CMD_REMAIN_ON_CHANNEL); 12260 if (!hdr) { 12261 err = -ENOBUFS; 12262 goto free_msg; 12263 } 12264 12265 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 12266 duration, &cookie); 12267 12268 if (err) 12269 goto free_msg; 12270 12271 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12272 NL80211_ATTR_PAD)) 12273 goto nla_put_failure; 12274 12275 genlmsg_end(msg, hdr); 12276 12277 return genlmsg_reply(msg, info); 12278 12279 nla_put_failure: 12280 err = -ENOBUFS; 12281 free_msg: 12282 nlmsg_free(msg); 12283 return err; 12284 } 12285 12286 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 12287 struct genl_info *info) 12288 { 12289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12290 struct wireless_dev *wdev = info->user_ptr[1]; 12291 u64 cookie; 12292 12293 if (!info->attrs[NL80211_ATTR_COOKIE]) 12294 return -EINVAL; 12295 12296 if (!rdev->ops->cancel_remain_on_channel) 12297 return -EOPNOTSUPP; 12298 12299 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12300 12301 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 12302 } 12303 12304 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 12305 struct genl_info *info) 12306 { 12307 struct cfg80211_bitrate_mask mask; 12308 unsigned int link_id = nl80211_link_id(info->attrs); 12309 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12310 struct net_device *dev = info->user_ptr[1]; 12311 struct wireless_dev *wdev = dev->ieee80211_ptr; 12312 int err; 12313 12314 if (!rdev->ops->set_bitrate_mask) 12315 return -EOPNOTSUPP; 12316 12317 wdev_lock(wdev); 12318 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 12319 NL80211_ATTR_TX_RATES, &mask, 12320 dev, true, link_id); 12321 if (err) 12322 goto out; 12323 12324 err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask); 12325 out: 12326 wdev_unlock(wdev); 12327 return err; 12328 } 12329 12330 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 12331 { 12332 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12333 struct wireless_dev *wdev = info->user_ptr[1]; 12334 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 12335 12336 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 12337 return -EINVAL; 12338 12339 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 12340 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 12341 12342 switch (wdev->iftype) { 12343 case NL80211_IFTYPE_STATION: 12344 case NL80211_IFTYPE_ADHOC: 12345 case NL80211_IFTYPE_P2P_CLIENT: 12346 case NL80211_IFTYPE_AP: 12347 case NL80211_IFTYPE_AP_VLAN: 12348 case NL80211_IFTYPE_MESH_POINT: 12349 case NL80211_IFTYPE_P2P_GO: 12350 case NL80211_IFTYPE_P2P_DEVICE: 12351 break; 12352 case NL80211_IFTYPE_NAN: 12353 if (!wiphy_ext_feature_isset(wdev->wiphy, 12354 NL80211_EXT_FEATURE_SECURE_NAN)) 12355 return -EOPNOTSUPP; 12356 break; 12357 default: 12358 return -EOPNOTSUPP; 12359 } 12360 12361 /* not much point in registering if we can't reply */ 12362 if (!rdev->ops->mgmt_tx) 12363 return -EOPNOTSUPP; 12364 12365 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 12366 !wiphy_ext_feature_isset(&rdev->wiphy, 12367 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 12368 GENL_SET_ERR_MSG(info, 12369 "multicast RX registrations are not supported"); 12370 return -EOPNOTSUPP; 12371 } 12372 12373 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 12374 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12375 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12376 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 12377 info->extack); 12378 } 12379 12380 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 12381 { 12382 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12383 struct wireless_dev *wdev = info->user_ptr[1]; 12384 struct cfg80211_chan_def chandef; 12385 int err; 12386 void *hdr = NULL; 12387 u64 cookie; 12388 struct sk_buff *msg = NULL; 12389 struct cfg80211_mgmt_tx_params params = { 12390 .dont_wait_for_ack = 12391 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 12392 }; 12393 12394 if (!info->attrs[NL80211_ATTR_FRAME]) 12395 return -EINVAL; 12396 12397 if (!rdev->ops->mgmt_tx) 12398 return -EOPNOTSUPP; 12399 12400 switch (wdev->iftype) { 12401 case NL80211_IFTYPE_P2P_DEVICE: 12402 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 12403 return -EINVAL; 12404 break; 12405 case NL80211_IFTYPE_STATION: 12406 case NL80211_IFTYPE_ADHOC: 12407 case NL80211_IFTYPE_P2P_CLIENT: 12408 case NL80211_IFTYPE_AP: 12409 case NL80211_IFTYPE_AP_VLAN: 12410 case NL80211_IFTYPE_MESH_POINT: 12411 case NL80211_IFTYPE_P2P_GO: 12412 break; 12413 case NL80211_IFTYPE_NAN: 12414 if (!wiphy_ext_feature_isset(wdev->wiphy, 12415 NL80211_EXT_FEATURE_SECURE_NAN)) 12416 return -EOPNOTSUPP; 12417 break; 12418 default: 12419 return -EOPNOTSUPP; 12420 } 12421 12422 if (info->attrs[NL80211_ATTR_DURATION]) { 12423 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12424 return -EINVAL; 12425 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12426 12427 /* 12428 * We should wait on the channel for at least a minimum amount 12429 * of time (10ms) but no longer than the driver supports. 12430 */ 12431 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12432 params.wait > rdev->wiphy.max_remain_on_channel_duration) 12433 return -EINVAL; 12434 } 12435 12436 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 12437 12438 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12439 return -EINVAL; 12440 12441 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 12442 12443 /* get the channel if any has been specified, otherwise pass NULL to 12444 * the driver. The latter will use the current one 12445 */ 12446 chandef.chan = NULL; 12447 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 12448 err = nl80211_parse_chandef(rdev, info, &chandef); 12449 if (err) 12450 return err; 12451 } 12452 12453 if (!chandef.chan && params.offchan) 12454 return -EINVAL; 12455 12456 wdev_lock(wdev); 12457 if (params.offchan && 12458 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) { 12459 wdev_unlock(wdev); 12460 return -EBUSY; 12461 } 12462 12463 params.link_id = nl80211_link_id_or_invalid(info->attrs); 12464 /* 12465 * This now races due to the unlock, but we cannot check 12466 * the valid links for the _station_ anyway, so that's up 12467 * to the driver. 12468 */ 12469 if (params.link_id >= 0 && 12470 !(wdev->valid_links & BIT(params.link_id))) { 12471 wdev_unlock(wdev); 12472 return -EINVAL; 12473 } 12474 wdev_unlock(wdev); 12475 12476 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 12477 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 12478 12479 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 12480 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12481 int i; 12482 12483 if (len % sizeof(u16)) 12484 return -EINVAL; 12485 12486 params.n_csa_offsets = len / sizeof(u16); 12487 params.csa_offsets = 12488 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12489 12490 /* check that all the offsets fit the frame */ 12491 for (i = 0; i < params.n_csa_offsets; i++) { 12492 if (params.csa_offsets[i] >= params.len) 12493 return -EINVAL; 12494 } 12495 } 12496 12497 if (!params.dont_wait_for_ack) { 12498 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12499 if (!msg) 12500 return -ENOMEM; 12501 12502 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12503 NL80211_CMD_FRAME); 12504 if (!hdr) { 12505 err = -ENOBUFS; 12506 goto free_msg; 12507 } 12508 } 12509 12510 params.chan = chandef.chan; 12511 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 12512 if (err) 12513 goto free_msg; 12514 12515 if (msg) { 12516 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12517 NL80211_ATTR_PAD)) 12518 goto nla_put_failure; 12519 12520 genlmsg_end(msg, hdr); 12521 return genlmsg_reply(msg, info); 12522 } 12523 12524 return 0; 12525 12526 nla_put_failure: 12527 err = -ENOBUFS; 12528 free_msg: 12529 nlmsg_free(msg); 12530 return err; 12531 } 12532 12533 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 12534 { 12535 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12536 struct wireless_dev *wdev = info->user_ptr[1]; 12537 u64 cookie; 12538 12539 if (!info->attrs[NL80211_ATTR_COOKIE]) 12540 return -EINVAL; 12541 12542 if (!rdev->ops->mgmt_tx_cancel_wait) 12543 return -EOPNOTSUPP; 12544 12545 switch (wdev->iftype) { 12546 case NL80211_IFTYPE_STATION: 12547 case NL80211_IFTYPE_ADHOC: 12548 case NL80211_IFTYPE_P2P_CLIENT: 12549 case NL80211_IFTYPE_AP: 12550 case NL80211_IFTYPE_AP_VLAN: 12551 case NL80211_IFTYPE_P2P_GO: 12552 case NL80211_IFTYPE_P2P_DEVICE: 12553 break; 12554 case NL80211_IFTYPE_NAN: 12555 if (!wiphy_ext_feature_isset(wdev->wiphy, 12556 NL80211_EXT_FEATURE_SECURE_NAN)) 12557 return -EOPNOTSUPP; 12558 break; 12559 default: 12560 return -EOPNOTSUPP; 12561 } 12562 12563 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12564 12565 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 12566 } 12567 12568 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 12569 { 12570 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12571 struct wireless_dev *wdev; 12572 struct net_device *dev = info->user_ptr[1]; 12573 u8 ps_state; 12574 bool state; 12575 int err; 12576 12577 if (!info->attrs[NL80211_ATTR_PS_STATE]) 12578 return -EINVAL; 12579 12580 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 12581 12582 wdev = dev->ieee80211_ptr; 12583 12584 if (!rdev->ops->set_power_mgmt) 12585 return -EOPNOTSUPP; 12586 12587 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 12588 12589 if (state == wdev->ps) 12590 return 0; 12591 12592 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 12593 if (!err) 12594 wdev->ps = state; 12595 return err; 12596 } 12597 12598 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 12599 { 12600 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12601 enum nl80211_ps_state ps_state; 12602 struct wireless_dev *wdev; 12603 struct net_device *dev = info->user_ptr[1]; 12604 struct sk_buff *msg; 12605 void *hdr; 12606 int err; 12607 12608 wdev = dev->ieee80211_ptr; 12609 12610 if (!rdev->ops->set_power_mgmt) 12611 return -EOPNOTSUPP; 12612 12613 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12614 if (!msg) 12615 return -ENOMEM; 12616 12617 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12618 NL80211_CMD_GET_POWER_SAVE); 12619 if (!hdr) { 12620 err = -ENOBUFS; 12621 goto free_msg; 12622 } 12623 12624 if (wdev->ps) 12625 ps_state = NL80211_PS_ENABLED; 12626 else 12627 ps_state = NL80211_PS_DISABLED; 12628 12629 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 12630 goto nla_put_failure; 12631 12632 genlmsg_end(msg, hdr); 12633 return genlmsg_reply(msg, info); 12634 12635 nla_put_failure: 12636 err = -ENOBUFS; 12637 free_msg: 12638 nlmsg_free(msg); 12639 return err; 12640 } 12641 12642 static const struct nla_policy 12643 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 12644 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 12645 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 12646 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 12647 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 12648 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 12649 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 12650 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 12651 }; 12652 12653 static int nl80211_set_cqm_txe(struct genl_info *info, 12654 u32 rate, u32 pkts, u32 intvl) 12655 { 12656 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12657 struct net_device *dev = info->user_ptr[1]; 12658 struct wireless_dev *wdev = dev->ieee80211_ptr; 12659 12660 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 12661 return -EINVAL; 12662 12663 if (!rdev->ops->set_cqm_txe_config) 12664 return -EOPNOTSUPP; 12665 12666 if (wdev->iftype != NL80211_IFTYPE_STATION && 12667 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12668 return -EOPNOTSUPP; 12669 12670 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 12671 } 12672 12673 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 12674 struct net_device *dev) 12675 { 12676 struct wireless_dev *wdev = dev->ieee80211_ptr; 12677 s32 last, low, high; 12678 u32 hyst; 12679 int i, n, low_index; 12680 int err; 12681 12682 /* RSSI reporting disabled? */ 12683 if (!wdev->cqm_config) 12684 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 12685 12686 /* 12687 * Obtain current RSSI value if possible, if not and no RSSI threshold 12688 * event has been received yet, we should receive an event after a 12689 * connection is established and enough beacons received to calculate 12690 * the average. 12691 */ 12692 if (!wdev->cqm_config->last_rssi_event_value && 12693 wdev->links[0].client.current_bss && 12694 rdev->ops->get_station) { 12695 struct station_info sinfo = {}; 12696 u8 *mac_addr; 12697 12698 mac_addr = wdev->links[0].client.current_bss->pub.bssid; 12699 12700 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 12701 if (err) 12702 return err; 12703 12704 cfg80211_sinfo_release_content(&sinfo); 12705 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 12706 wdev->cqm_config->last_rssi_event_value = 12707 (s8) sinfo.rx_beacon_signal_avg; 12708 } 12709 12710 last = wdev->cqm_config->last_rssi_event_value; 12711 hyst = wdev->cqm_config->rssi_hyst; 12712 n = wdev->cqm_config->n_rssi_thresholds; 12713 12714 for (i = 0; i < n; i++) { 12715 i = array_index_nospec(i, n); 12716 if (last < wdev->cqm_config->rssi_thresholds[i]) 12717 break; 12718 } 12719 12720 low_index = i - 1; 12721 if (low_index >= 0) { 12722 low_index = array_index_nospec(low_index, n); 12723 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 12724 } else { 12725 low = S32_MIN; 12726 } 12727 if (i < n) { 12728 i = array_index_nospec(i, n); 12729 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 12730 } else { 12731 high = S32_MAX; 12732 } 12733 12734 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 12735 } 12736 12737 static int nl80211_set_cqm_rssi(struct genl_info *info, 12738 const s32 *thresholds, int n_thresholds, 12739 u32 hysteresis) 12740 { 12741 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12742 struct net_device *dev = info->user_ptr[1]; 12743 struct wireless_dev *wdev = dev->ieee80211_ptr; 12744 int i, err; 12745 s32 prev = S32_MIN; 12746 12747 /* Check all values negative and sorted */ 12748 for (i = 0; i < n_thresholds; i++) { 12749 if (thresholds[i] > 0 || thresholds[i] <= prev) 12750 return -EINVAL; 12751 12752 prev = thresholds[i]; 12753 } 12754 12755 if (wdev->iftype != NL80211_IFTYPE_STATION && 12756 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12757 return -EOPNOTSUPP; 12758 12759 wdev_lock(wdev); 12760 cfg80211_cqm_config_free(wdev); 12761 wdev_unlock(wdev); 12762 12763 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 12764 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 12765 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 12766 12767 return rdev_set_cqm_rssi_config(rdev, dev, 12768 thresholds[0], hysteresis); 12769 } 12770 12771 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12772 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 12773 return -EOPNOTSUPP; 12774 12775 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 12776 n_thresholds = 0; 12777 12778 wdev_lock(wdev); 12779 if (n_thresholds) { 12780 struct cfg80211_cqm_config *cqm_config; 12781 12782 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds, 12783 n_thresholds), 12784 GFP_KERNEL); 12785 if (!cqm_config) { 12786 err = -ENOMEM; 12787 goto unlock; 12788 } 12789 12790 cqm_config->rssi_hyst = hysteresis; 12791 cqm_config->n_rssi_thresholds = n_thresholds; 12792 memcpy(cqm_config->rssi_thresholds, thresholds, 12793 flex_array_size(cqm_config, rssi_thresholds, 12794 n_thresholds)); 12795 12796 wdev->cqm_config = cqm_config; 12797 } 12798 12799 err = cfg80211_cqm_rssi_update(rdev, dev); 12800 12801 unlock: 12802 wdev_unlock(wdev); 12803 12804 return err; 12805 } 12806 12807 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 12808 { 12809 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 12810 struct nlattr *cqm; 12811 int err; 12812 12813 cqm = info->attrs[NL80211_ATTR_CQM]; 12814 if (!cqm) 12815 return -EINVAL; 12816 12817 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 12818 nl80211_attr_cqm_policy, 12819 info->extack); 12820 if (err) 12821 return err; 12822 12823 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 12824 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 12825 const s32 *thresholds = 12826 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 12827 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 12828 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 12829 12830 if (len % 4) 12831 return -EINVAL; 12832 12833 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 12834 hysteresis); 12835 } 12836 12837 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 12838 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 12839 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 12840 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 12841 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 12842 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 12843 12844 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 12845 } 12846 12847 return -EINVAL; 12848 } 12849 12850 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 12851 { 12852 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12853 struct net_device *dev = info->user_ptr[1]; 12854 struct ocb_setup setup = {}; 12855 int err; 12856 12857 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 12858 if (err) 12859 return err; 12860 12861 return cfg80211_join_ocb(rdev, dev, &setup); 12862 } 12863 12864 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 12865 { 12866 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12867 struct net_device *dev = info->user_ptr[1]; 12868 12869 return cfg80211_leave_ocb(rdev, dev); 12870 } 12871 12872 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 12873 { 12874 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12875 struct net_device *dev = info->user_ptr[1]; 12876 struct mesh_config cfg; 12877 struct mesh_setup setup; 12878 int err; 12879 12880 /* start with default */ 12881 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 12882 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 12883 12884 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 12885 /* and parse parameters if given */ 12886 err = nl80211_parse_mesh_config(info, &cfg, NULL); 12887 if (err) 12888 return err; 12889 } 12890 12891 if (!info->attrs[NL80211_ATTR_MESH_ID] || 12892 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 12893 return -EINVAL; 12894 12895 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 12896 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 12897 12898 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 12899 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 12900 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 12901 return -EINVAL; 12902 12903 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 12904 setup.beacon_interval = 12905 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 12906 12907 err = cfg80211_validate_beacon_int(rdev, 12908 NL80211_IFTYPE_MESH_POINT, 12909 setup.beacon_interval); 12910 if (err) 12911 return err; 12912 } 12913 12914 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 12915 setup.dtim_period = 12916 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 12917 if (setup.dtim_period < 1 || setup.dtim_period > 100) 12918 return -EINVAL; 12919 } 12920 12921 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 12922 /* parse additional setup parameters if given */ 12923 err = nl80211_parse_mesh_setup(info, &setup); 12924 if (err) 12925 return err; 12926 } 12927 12928 if (setup.user_mpm) 12929 cfg.auto_open_plinks = false; 12930 12931 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 12932 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 12933 if (err) 12934 return err; 12935 } else { 12936 /* __cfg80211_join_mesh() will sort it out */ 12937 setup.chandef.chan = NULL; 12938 } 12939 12940 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 12941 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 12942 int n_rates = 12943 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 12944 struct ieee80211_supported_band *sband; 12945 12946 if (!setup.chandef.chan) 12947 return -EINVAL; 12948 12949 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 12950 12951 err = ieee80211_get_ratemask(sband, rates, n_rates, 12952 &setup.basic_rates); 12953 if (err) 12954 return err; 12955 } 12956 12957 if (info->attrs[NL80211_ATTR_TX_RATES]) { 12958 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 12959 NL80211_ATTR_TX_RATES, 12960 &setup.beacon_rate, 12961 dev, false, 0); 12962 if (err) 12963 return err; 12964 12965 if (!setup.chandef.chan) 12966 return -EINVAL; 12967 12968 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 12969 &setup.beacon_rate); 12970 if (err) 12971 return err; 12972 } 12973 12974 setup.userspace_handles_dfs = 12975 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 12976 12977 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 12978 int r = validate_pae_over_nl80211(rdev, info); 12979 12980 if (r < 0) 12981 return r; 12982 12983 setup.control_port_over_nl80211 = true; 12984 } 12985 12986 wdev_lock(dev->ieee80211_ptr); 12987 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 12988 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 12989 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 12990 wdev_unlock(dev->ieee80211_ptr); 12991 12992 return err; 12993 } 12994 12995 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 12996 { 12997 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12998 struct net_device *dev = info->user_ptr[1]; 12999 13000 return cfg80211_leave_mesh(rdev, dev); 13001 } 13002 13003 #ifdef CONFIG_PM 13004 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 13005 struct cfg80211_registered_device *rdev) 13006 { 13007 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 13008 struct nlattr *nl_pats, *nl_pat; 13009 int i, pat_len; 13010 13011 if (!wowlan->n_patterns) 13012 return 0; 13013 13014 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 13015 if (!nl_pats) 13016 return -ENOBUFS; 13017 13018 for (i = 0; i < wowlan->n_patterns; i++) { 13019 nl_pat = nla_nest_start_noflag(msg, i + 1); 13020 if (!nl_pat) 13021 return -ENOBUFS; 13022 pat_len = wowlan->patterns[i].pattern_len; 13023 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 13024 wowlan->patterns[i].mask) || 13025 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13026 wowlan->patterns[i].pattern) || 13027 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13028 wowlan->patterns[i].pkt_offset)) 13029 return -ENOBUFS; 13030 nla_nest_end(msg, nl_pat); 13031 } 13032 nla_nest_end(msg, nl_pats); 13033 13034 return 0; 13035 } 13036 13037 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 13038 struct cfg80211_wowlan_tcp *tcp) 13039 { 13040 struct nlattr *nl_tcp; 13041 13042 if (!tcp) 13043 return 0; 13044 13045 nl_tcp = nla_nest_start_noflag(msg, 13046 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 13047 if (!nl_tcp) 13048 return -ENOBUFS; 13049 13050 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 13051 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 13052 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 13053 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 13054 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 13055 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 13056 tcp->payload_len, tcp->payload) || 13057 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 13058 tcp->data_interval) || 13059 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 13060 tcp->wake_len, tcp->wake_data) || 13061 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 13062 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 13063 return -ENOBUFS; 13064 13065 if (tcp->payload_seq.len && 13066 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 13067 sizeof(tcp->payload_seq), &tcp->payload_seq)) 13068 return -ENOBUFS; 13069 13070 if (tcp->payload_tok.len && 13071 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 13072 sizeof(tcp->payload_tok) + tcp->tokens_size, 13073 &tcp->payload_tok)) 13074 return -ENOBUFS; 13075 13076 nla_nest_end(msg, nl_tcp); 13077 13078 return 0; 13079 } 13080 13081 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 13082 struct cfg80211_sched_scan_request *req) 13083 { 13084 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 13085 int i; 13086 13087 if (!req) 13088 return 0; 13089 13090 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 13091 if (!nd) 13092 return -ENOBUFS; 13093 13094 if (req->n_scan_plans == 1 && 13095 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 13096 req->scan_plans[0].interval * 1000)) 13097 return -ENOBUFS; 13098 13099 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 13100 return -ENOBUFS; 13101 13102 if (req->relative_rssi_set) { 13103 struct nl80211_bss_select_rssi_adjust rssi_adjust; 13104 13105 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 13106 req->relative_rssi)) 13107 return -ENOBUFS; 13108 13109 rssi_adjust.band = req->rssi_adjust.band; 13110 rssi_adjust.delta = req->rssi_adjust.delta; 13111 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 13112 sizeof(rssi_adjust), &rssi_adjust)) 13113 return -ENOBUFS; 13114 } 13115 13116 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13117 if (!freqs) 13118 return -ENOBUFS; 13119 13120 for (i = 0; i < req->n_channels; i++) { 13121 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13122 return -ENOBUFS; 13123 } 13124 13125 nla_nest_end(msg, freqs); 13126 13127 if (req->n_match_sets) { 13128 matches = nla_nest_start_noflag(msg, 13129 NL80211_ATTR_SCHED_SCAN_MATCH); 13130 if (!matches) 13131 return -ENOBUFS; 13132 13133 for (i = 0; i < req->n_match_sets; i++) { 13134 match = nla_nest_start_noflag(msg, i); 13135 if (!match) 13136 return -ENOBUFS; 13137 13138 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 13139 req->match_sets[i].ssid.ssid_len, 13140 req->match_sets[i].ssid.ssid)) 13141 return -ENOBUFS; 13142 nla_nest_end(msg, match); 13143 } 13144 nla_nest_end(msg, matches); 13145 } 13146 13147 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 13148 if (!scan_plans) 13149 return -ENOBUFS; 13150 13151 for (i = 0; i < req->n_scan_plans; i++) { 13152 scan_plan = nla_nest_start_noflag(msg, i + 1); 13153 if (!scan_plan) 13154 return -ENOBUFS; 13155 13156 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 13157 req->scan_plans[i].interval) || 13158 (req->scan_plans[i].iterations && 13159 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 13160 req->scan_plans[i].iterations))) 13161 return -ENOBUFS; 13162 nla_nest_end(msg, scan_plan); 13163 } 13164 nla_nest_end(msg, scan_plans); 13165 13166 nla_nest_end(msg, nd); 13167 13168 return 0; 13169 } 13170 13171 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 13172 { 13173 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13174 struct sk_buff *msg; 13175 void *hdr; 13176 u32 size = NLMSG_DEFAULT_SIZE; 13177 13178 if (!rdev->wiphy.wowlan) 13179 return -EOPNOTSUPP; 13180 13181 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 13182 /* adjust size to have room for all the data */ 13183 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 13184 rdev->wiphy.wowlan_config->tcp->payload_len + 13185 rdev->wiphy.wowlan_config->tcp->wake_len + 13186 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 13187 } 13188 13189 msg = nlmsg_new(size, GFP_KERNEL); 13190 if (!msg) 13191 return -ENOMEM; 13192 13193 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13194 NL80211_CMD_GET_WOWLAN); 13195 if (!hdr) 13196 goto nla_put_failure; 13197 13198 if (rdev->wiphy.wowlan_config) { 13199 struct nlattr *nl_wowlan; 13200 13201 nl_wowlan = nla_nest_start_noflag(msg, 13202 NL80211_ATTR_WOWLAN_TRIGGERS); 13203 if (!nl_wowlan) 13204 goto nla_put_failure; 13205 13206 if ((rdev->wiphy.wowlan_config->any && 13207 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 13208 (rdev->wiphy.wowlan_config->disconnect && 13209 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 13210 (rdev->wiphy.wowlan_config->magic_pkt && 13211 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 13212 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 13213 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 13214 (rdev->wiphy.wowlan_config->eap_identity_req && 13215 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 13216 (rdev->wiphy.wowlan_config->four_way_handshake && 13217 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 13218 (rdev->wiphy.wowlan_config->rfkill_release && 13219 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 13220 goto nla_put_failure; 13221 13222 if (nl80211_send_wowlan_patterns(msg, rdev)) 13223 goto nla_put_failure; 13224 13225 if (nl80211_send_wowlan_tcp(msg, 13226 rdev->wiphy.wowlan_config->tcp)) 13227 goto nla_put_failure; 13228 13229 if (nl80211_send_wowlan_nd( 13230 msg, 13231 rdev->wiphy.wowlan_config->nd_config)) 13232 goto nla_put_failure; 13233 13234 nla_nest_end(msg, nl_wowlan); 13235 } 13236 13237 genlmsg_end(msg, hdr); 13238 return genlmsg_reply(msg, info); 13239 13240 nla_put_failure: 13241 nlmsg_free(msg); 13242 return -ENOBUFS; 13243 } 13244 13245 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 13246 struct nlattr *attr, 13247 struct cfg80211_wowlan *trig) 13248 { 13249 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 13250 struct cfg80211_wowlan_tcp *cfg; 13251 struct nl80211_wowlan_tcp_data_token *tok = NULL; 13252 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 13253 u32 size; 13254 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 13255 int err, port; 13256 13257 if (!rdev->wiphy.wowlan->tcp) 13258 return -EINVAL; 13259 13260 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 13261 nl80211_wowlan_tcp_policy, NULL); 13262 if (err) 13263 return err; 13264 13265 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 13266 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 13267 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 13268 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 13269 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 13270 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 13271 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 13272 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 13273 return -EINVAL; 13274 13275 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 13276 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 13277 return -EINVAL; 13278 13279 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 13280 rdev->wiphy.wowlan->tcp->data_interval_max || 13281 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 13282 return -EINVAL; 13283 13284 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 13285 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 13286 return -EINVAL; 13287 13288 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 13289 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 13290 return -EINVAL; 13291 13292 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 13293 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13294 13295 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13296 tokens_size = tokln - sizeof(*tok); 13297 13298 if (!tok->len || tokens_size % tok->len) 13299 return -EINVAL; 13300 if (!rdev->wiphy.wowlan->tcp->tok) 13301 return -EINVAL; 13302 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 13303 return -EINVAL; 13304 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 13305 return -EINVAL; 13306 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 13307 return -EINVAL; 13308 if (tok->offset + tok->len > data_size) 13309 return -EINVAL; 13310 } 13311 13312 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 13313 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 13314 if (!rdev->wiphy.wowlan->tcp->seq) 13315 return -EINVAL; 13316 if (seq->len == 0 || seq->len > 4) 13317 return -EINVAL; 13318 if (seq->len + seq->offset > data_size) 13319 return -EINVAL; 13320 } 13321 13322 size = sizeof(*cfg); 13323 size += data_size; 13324 size += wake_size + wake_mask_size; 13325 size += tokens_size; 13326 13327 cfg = kzalloc(size, GFP_KERNEL); 13328 if (!cfg) 13329 return -ENOMEM; 13330 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 13331 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 13332 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 13333 ETH_ALEN); 13334 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 13335 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 13336 else 13337 port = 0; 13338 #ifdef CONFIG_INET 13339 /* allocate a socket and port for it and use it */ 13340 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 13341 IPPROTO_TCP, &cfg->sock, 1); 13342 if (err) { 13343 kfree(cfg); 13344 return err; 13345 } 13346 if (inet_csk_get_port(cfg->sock->sk, port)) { 13347 sock_release(cfg->sock); 13348 kfree(cfg); 13349 return -EADDRINUSE; 13350 } 13351 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 13352 #else 13353 if (!port) { 13354 kfree(cfg); 13355 return -EINVAL; 13356 } 13357 cfg->src_port = port; 13358 #endif 13359 13360 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 13361 cfg->payload_len = data_size; 13362 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 13363 memcpy((void *)cfg->payload, 13364 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 13365 data_size); 13366 if (seq) 13367 cfg->payload_seq = *seq; 13368 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 13369 cfg->wake_len = wake_size; 13370 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 13371 memcpy((void *)cfg->wake_data, 13372 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 13373 wake_size); 13374 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 13375 data_size + wake_size; 13376 memcpy((void *)cfg->wake_mask, 13377 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 13378 wake_mask_size); 13379 if (tok) { 13380 cfg->tokens_size = tokens_size; 13381 cfg->payload_tok = *tok; 13382 memcpy(cfg->payload_tok.token_stream, tok->token_stream, 13383 tokens_size); 13384 } 13385 13386 trig->tcp = cfg; 13387 13388 return 0; 13389 } 13390 13391 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 13392 const struct wiphy_wowlan_support *wowlan, 13393 struct nlattr *attr, 13394 struct cfg80211_wowlan *trig) 13395 { 13396 struct nlattr **tb; 13397 int err; 13398 13399 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 13400 if (!tb) 13401 return -ENOMEM; 13402 13403 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 13404 err = -EOPNOTSUPP; 13405 goto out; 13406 } 13407 13408 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 13409 nl80211_policy, NULL); 13410 if (err) 13411 goto out; 13412 13413 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 13414 wowlan->max_nd_match_sets); 13415 err = PTR_ERR_OR_ZERO(trig->nd_config); 13416 if (err) 13417 trig->nd_config = NULL; 13418 13419 out: 13420 kfree(tb); 13421 return err; 13422 } 13423 13424 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 13425 { 13426 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13427 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 13428 struct cfg80211_wowlan new_triggers = {}; 13429 struct cfg80211_wowlan *ntrig; 13430 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 13431 int err, i; 13432 bool prev_enabled = rdev->wiphy.wowlan_config; 13433 bool regular = false; 13434 13435 if (!wowlan) 13436 return -EOPNOTSUPP; 13437 13438 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 13439 cfg80211_rdev_free_wowlan(rdev); 13440 rdev->wiphy.wowlan_config = NULL; 13441 goto set_wakeup; 13442 } 13443 13444 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 13445 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 13446 nl80211_wowlan_policy, info->extack); 13447 if (err) 13448 return err; 13449 13450 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 13451 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 13452 return -EINVAL; 13453 new_triggers.any = true; 13454 } 13455 13456 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 13457 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 13458 return -EINVAL; 13459 new_triggers.disconnect = true; 13460 regular = true; 13461 } 13462 13463 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 13464 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 13465 return -EINVAL; 13466 new_triggers.magic_pkt = true; 13467 regular = true; 13468 } 13469 13470 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 13471 return -EINVAL; 13472 13473 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 13474 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 13475 return -EINVAL; 13476 new_triggers.gtk_rekey_failure = true; 13477 regular = true; 13478 } 13479 13480 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 13481 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 13482 return -EINVAL; 13483 new_triggers.eap_identity_req = true; 13484 regular = true; 13485 } 13486 13487 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 13488 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 13489 return -EINVAL; 13490 new_triggers.four_way_handshake = true; 13491 regular = true; 13492 } 13493 13494 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 13495 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 13496 return -EINVAL; 13497 new_triggers.rfkill_release = true; 13498 regular = true; 13499 } 13500 13501 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 13502 struct nlattr *pat; 13503 int n_patterns = 0; 13504 int rem, pat_len, mask_len, pkt_offset; 13505 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13506 13507 regular = true; 13508 13509 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13510 rem) 13511 n_patterns++; 13512 if (n_patterns > wowlan->n_patterns) 13513 return -EINVAL; 13514 13515 new_triggers.patterns = kcalloc(n_patterns, 13516 sizeof(new_triggers.patterns[0]), 13517 GFP_KERNEL); 13518 if (!new_triggers.patterns) 13519 return -ENOMEM; 13520 13521 new_triggers.n_patterns = n_patterns; 13522 i = 0; 13523 13524 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13525 rem) { 13526 u8 *mask_pat; 13527 13528 err = nla_parse_nested_deprecated(pat_tb, 13529 MAX_NL80211_PKTPAT, 13530 pat, 13531 nl80211_packet_pattern_policy, 13532 info->extack); 13533 if (err) 13534 goto error; 13535 13536 err = -EINVAL; 13537 if (!pat_tb[NL80211_PKTPAT_MASK] || 13538 !pat_tb[NL80211_PKTPAT_PATTERN]) 13539 goto error; 13540 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 13541 mask_len = DIV_ROUND_UP(pat_len, 8); 13542 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 13543 goto error; 13544 if (pat_len > wowlan->pattern_max_len || 13545 pat_len < wowlan->pattern_min_len) 13546 goto error; 13547 13548 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 13549 pkt_offset = 0; 13550 else 13551 pkt_offset = nla_get_u32( 13552 pat_tb[NL80211_PKTPAT_OFFSET]); 13553 if (pkt_offset > wowlan->max_pkt_offset) 13554 goto error; 13555 new_triggers.patterns[i].pkt_offset = pkt_offset; 13556 13557 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 13558 if (!mask_pat) { 13559 err = -ENOMEM; 13560 goto error; 13561 } 13562 new_triggers.patterns[i].mask = mask_pat; 13563 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 13564 mask_len); 13565 mask_pat += mask_len; 13566 new_triggers.patterns[i].pattern = mask_pat; 13567 new_triggers.patterns[i].pattern_len = pat_len; 13568 memcpy(mask_pat, 13569 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 13570 pat_len); 13571 i++; 13572 } 13573 } 13574 13575 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 13576 regular = true; 13577 err = nl80211_parse_wowlan_tcp( 13578 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 13579 &new_triggers); 13580 if (err) 13581 goto error; 13582 } 13583 13584 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 13585 regular = true; 13586 err = nl80211_parse_wowlan_nd( 13587 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 13588 &new_triggers); 13589 if (err) 13590 goto error; 13591 } 13592 13593 /* The 'any' trigger means the device continues operating more or less 13594 * as in its normal operation mode and wakes up the host on most of the 13595 * normal interrupts (like packet RX, ...) 13596 * It therefore makes little sense to combine with the more constrained 13597 * wakeup trigger modes. 13598 */ 13599 if (new_triggers.any && regular) { 13600 err = -EINVAL; 13601 goto error; 13602 } 13603 13604 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 13605 if (!ntrig) { 13606 err = -ENOMEM; 13607 goto error; 13608 } 13609 cfg80211_rdev_free_wowlan(rdev); 13610 rdev->wiphy.wowlan_config = ntrig; 13611 13612 set_wakeup: 13613 if (rdev->ops->set_wakeup && 13614 prev_enabled != !!rdev->wiphy.wowlan_config) 13615 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 13616 13617 return 0; 13618 error: 13619 for (i = 0; i < new_triggers.n_patterns; i++) 13620 kfree(new_triggers.patterns[i].mask); 13621 kfree(new_triggers.patterns); 13622 if (new_triggers.tcp && new_triggers.tcp->sock) 13623 sock_release(new_triggers.tcp->sock); 13624 kfree(new_triggers.tcp); 13625 kfree(new_triggers.nd_config); 13626 return err; 13627 } 13628 #endif 13629 13630 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 13631 struct cfg80211_registered_device *rdev) 13632 { 13633 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 13634 int i, j, pat_len; 13635 struct cfg80211_coalesce_rules *rule; 13636 13637 if (!rdev->coalesce->n_rules) 13638 return 0; 13639 13640 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 13641 if (!nl_rules) 13642 return -ENOBUFS; 13643 13644 for (i = 0; i < rdev->coalesce->n_rules; i++) { 13645 nl_rule = nla_nest_start_noflag(msg, i + 1); 13646 if (!nl_rule) 13647 return -ENOBUFS; 13648 13649 rule = &rdev->coalesce->rules[i]; 13650 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 13651 rule->delay)) 13652 return -ENOBUFS; 13653 13654 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 13655 rule->condition)) 13656 return -ENOBUFS; 13657 13658 nl_pats = nla_nest_start_noflag(msg, 13659 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 13660 if (!nl_pats) 13661 return -ENOBUFS; 13662 13663 for (j = 0; j < rule->n_patterns; j++) { 13664 nl_pat = nla_nest_start_noflag(msg, j + 1); 13665 if (!nl_pat) 13666 return -ENOBUFS; 13667 pat_len = rule->patterns[j].pattern_len; 13668 if (nla_put(msg, NL80211_PKTPAT_MASK, 13669 DIV_ROUND_UP(pat_len, 8), 13670 rule->patterns[j].mask) || 13671 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13672 rule->patterns[j].pattern) || 13673 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13674 rule->patterns[j].pkt_offset)) 13675 return -ENOBUFS; 13676 nla_nest_end(msg, nl_pat); 13677 } 13678 nla_nest_end(msg, nl_pats); 13679 nla_nest_end(msg, nl_rule); 13680 } 13681 nla_nest_end(msg, nl_rules); 13682 13683 return 0; 13684 } 13685 13686 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 13687 { 13688 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13689 struct sk_buff *msg; 13690 void *hdr; 13691 13692 if (!rdev->wiphy.coalesce) 13693 return -EOPNOTSUPP; 13694 13695 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13696 if (!msg) 13697 return -ENOMEM; 13698 13699 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13700 NL80211_CMD_GET_COALESCE); 13701 if (!hdr) 13702 goto nla_put_failure; 13703 13704 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 13705 goto nla_put_failure; 13706 13707 genlmsg_end(msg, hdr); 13708 return genlmsg_reply(msg, info); 13709 13710 nla_put_failure: 13711 nlmsg_free(msg); 13712 return -ENOBUFS; 13713 } 13714 13715 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 13716 { 13717 struct cfg80211_coalesce *coalesce = rdev->coalesce; 13718 int i, j; 13719 struct cfg80211_coalesce_rules *rule; 13720 13721 if (!coalesce) 13722 return; 13723 13724 for (i = 0; i < coalesce->n_rules; i++) { 13725 rule = &coalesce->rules[i]; 13726 for (j = 0; j < rule->n_patterns; j++) 13727 kfree(rule->patterns[j].mask); 13728 kfree(rule->patterns); 13729 } 13730 kfree(coalesce->rules); 13731 kfree(coalesce); 13732 rdev->coalesce = NULL; 13733 } 13734 13735 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 13736 struct nlattr *rule, 13737 struct cfg80211_coalesce_rules *new_rule) 13738 { 13739 int err, i; 13740 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 13741 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 13742 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 13743 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13744 13745 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 13746 rule, nl80211_coalesce_policy, NULL); 13747 if (err) 13748 return err; 13749 13750 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 13751 new_rule->delay = 13752 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 13753 if (new_rule->delay > coalesce->max_delay) 13754 return -EINVAL; 13755 13756 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 13757 new_rule->condition = 13758 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 13759 13760 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 13761 return -EINVAL; 13762 13763 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13764 rem) 13765 n_patterns++; 13766 if (n_patterns > coalesce->n_patterns) 13767 return -EINVAL; 13768 13769 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 13770 GFP_KERNEL); 13771 if (!new_rule->patterns) 13772 return -ENOMEM; 13773 13774 new_rule->n_patterns = n_patterns; 13775 i = 0; 13776 13777 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13778 rem) { 13779 u8 *mask_pat; 13780 13781 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 13782 pat, 13783 nl80211_packet_pattern_policy, 13784 NULL); 13785 if (err) 13786 return err; 13787 13788 if (!pat_tb[NL80211_PKTPAT_MASK] || 13789 !pat_tb[NL80211_PKTPAT_PATTERN]) 13790 return -EINVAL; 13791 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 13792 mask_len = DIV_ROUND_UP(pat_len, 8); 13793 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 13794 return -EINVAL; 13795 if (pat_len > coalesce->pattern_max_len || 13796 pat_len < coalesce->pattern_min_len) 13797 return -EINVAL; 13798 13799 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 13800 pkt_offset = 0; 13801 else 13802 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 13803 if (pkt_offset > coalesce->max_pkt_offset) 13804 return -EINVAL; 13805 new_rule->patterns[i].pkt_offset = pkt_offset; 13806 13807 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 13808 if (!mask_pat) 13809 return -ENOMEM; 13810 13811 new_rule->patterns[i].mask = mask_pat; 13812 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 13813 mask_len); 13814 13815 mask_pat += mask_len; 13816 new_rule->patterns[i].pattern = mask_pat; 13817 new_rule->patterns[i].pattern_len = pat_len; 13818 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 13819 pat_len); 13820 i++; 13821 } 13822 13823 return 0; 13824 } 13825 13826 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 13827 { 13828 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13829 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 13830 struct cfg80211_coalesce new_coalesce = {}; 13831 struct cfg80211_coalesce *n_coalesce; 13832 int err, rem_rule, n_rules = 0, i, j; 13833 struct nlattr *rule; 13834 struct cfg80211_coalesce_rules *tmp_rule; 13835 13836 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 13837 return -EOPNOTSUPP; 13838 13839 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 13840 cfg80211_rdev_free_coalesce(rdev); 13841 rdev_set_coalesce(rdev, NULL); 13842 return 0; 13843 } 13844 13845 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 13846 rem_rule) 13847 n_rules++; 13848 if (n_rules > coalesce->n_rules) 13849 return -EINVAL; 13850 13851 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 13852 GFP_KERNEL); 13853 if (!new_coalesce.rules) 13854 return -ENOMEM; 13855 13856 new_coalesce.n_rules = n_rules; 13857 i = 0; 13858 13859 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 13860 rem_rule) { 13861 err = nl80211_parse_coalesce_rule(rdev, rule, 13862 &new_coalesce.rules[i]); 13863 if (err) 13864 goto error; 13865 13866 i++; 13867 } 13868 13869 err = rdev_set_coalesce(rdev, &new_coalesce); 13870 if (err) 13871 goto error; 13872 13873 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 13874 if (!n_coalesce) { 13875 err = -ENOMEM; 13876 goto error; 13877 } 13878 cfg80211_rdev_free_coalesce(rdev); 13879 rdev->coalesce = n_coalesce; 13880 13881 return 0; 13882 error: 13883 for (i = 0; i < new_coalesce.n_rules; i++) { 13884 tmp_rule = &new_coalesce.rules[i]; 13885 for (j = 0; j < tmp_rule->n_patterns; j++) 13886 kfree(tmp_rule->patterns[j].mask); 13887 kfree(tmp_rule->patterns); 13888 } 13889 kfree(new_coalesce.rules); 13890 13891 return err; 13892 } 13893 13894 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 13895 { 13896 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13897 struct net_device *dev = info->user_ptr[1]; 13898 struct wireless_dev *wdev = dev->ieee80211_ptr; 13899 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 13900 struct cfg80211_gtk_rekey_data rekey_data = {}; 13901 int err; 13902 13903 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 13904 return -EINVAL; 13905 13906 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 13907 info->attrs[NL80211_ATTR_REKEY_DATA], 13908 nl80211_rekey_policy, info->extack); 13909 if (err) 13910 return err; 13911 13912 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 13913 !tb[NL80211_REKEY_DATA_KCK]) 13914 return -EINVAL; 13915 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 13916 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 13917 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 13918 return -ERANGE; 13919 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 13920 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 13921 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) && 13922 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 && 13923 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32)) 13924 return -ERANGE; 13925 13926 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 13927 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 13928 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 13929 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 13930 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 13931 if (tb[NL80211_REKEY_DATA_AKM]) 13932 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 13933 13934 wdev_lock(wdev); 13935 if (!wdev->connected) { 13936 err = -ENOTCONN; 13937 goto out; 13938 } 13939 13940 if (!rdev->ops->set_rekey_data) { 13941 err = -EOPNOTSUPP; 13942 goto out; 13943 } 13944 13945 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 13946 out: 13947 wdev_unlock(wdev); 13948 return err; 13949 } 13950 13951 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 13952 struct genl_info *info) 13953 { 13954 struct net_device *dev = info->user_ptr[1]; 13955 struct wireless_dev *wdev = dev->ieee80211_ptr; 13956 13957 if (wdev->iftype != NL80211_IFTYPE_AP && 13958 wdev->iftype != NL80211_IFTYPE_P2P_GO) 13959 return -EINVAL; 13960 13961 if (wdev->ap_unexpected_nlportid) 13962 return -EBUSY; 13963 13964 wdev->ap_unexpected_nlportid = info->snd_portid; 13965 return 0; 13966 } 13967 13968 static int nl80211_probe_client(struct sk_buff *skb, 13969 struct genl_info *info) 13970 { 13971 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13972 struct net_device *dev = info->user_ptr[1]; 13973 struct wireless_dev *wdev = dev->ieee80211_ptr; 13974 struct sk_buff *msg; 13975 void *hdr; 13976 const u8 *addr; 13977 u64 cookie; 13978 int err; 13979 13980 if (wdev->iftype != NL80211_IFTYPE_AP && 13981 wdev->iftype != NL80211_IFTYPE_P2P_GO) 13982 return -EOPNOTSUPP; 13983 13984 if (!info->attrs[NL80211_ATTR_MAC]) 13985 return -EINVAL; 13986 13987 if (!rdev->ops->probe_client) 13988 return -EOPNOTSUPP; 13989 13990 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13991 if (!msg) 13992 return -ENOMEM; 13993 13994 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13995 NL80211_CMD_PROBE_CLIENT); 13996 if (!hdr) { 13997 err = -ENOBUFS; 13998 goto free_msg; 13999 } 14000 14001 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14002 14003 err = rdev_probe_client(rdev, dev, addr, &cookie); 14004 if (err) 14005 goto free_msg; 14006 14007 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14008 NL80211_ATTR_PAD)) 14009 goto nla_put_failure; 14010 14011 genlmsg_end(msg, hdr); 14012 14013 return genlmsg_reply(msg, info); 14014 14015 nla_put_failure: 14016 err = -ENOBUFS; 14017 free_msg: 14018 nlmsg_free(msg); 14019 return err; 14020 } 14021 14022 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 14023 { 14024 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14025 struct cfg80211_beacon_registration *reg, *nreg; 14026 int rv; 14027 14028 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 14029 return -EOPNOTSUPP; 14030 14031 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 14032 if (!nreg) 14033 return -ENOMEM; 14034 14035 /* First, check if already registered. */ 14036 spin_lock_bh(&rdev->beacon_registrations_lock); 14037 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14038 if (reg->nlportid == info->snd_portid) { 14039 rv = -EALREADY; 14040 goto out_err; 14041 } 14042 } 14043 /* Add it to the list */ 14044 nreg->nlportid = info->snd_portid; 14045 list_add(&nreg->list, &rdev->beacon_registrations); 14046 14047 spin_unlock_bh(&rdev->beacon_registrations_lock); 14048 14049 return 0; 14050 out_err: 14051 spin_unlock_bh(&rdev->beacon_registrations_lock); 14052 kfree(nreg); 14053 return rv; 14054 } 14055 14056 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 14057 { 14058 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14059 struct wireless_dev *wdev = info->user_ptr[1]; 14060 int err; 14061 14062 if (!rdev->ops->start_p2p_device) 14063 return -EOPNOTSUPP; 14064 14065 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14066 return -EOPNOTSUPP; 14067 14068 if (wdev_running(wdev)) 14069 return 0; 14070 14071 if (rfkill_blocked(rdev->wiphy.rfkill)) 14072 return -ERFKILL; 14073 14074 err = rdev_start_p2p_device(rdev, wdev); 14075 if (err) 14076 return err; 14077 14078 wdev->is_running = true; 14079 rdev->opencount++; 14080 14081 return 0; 14082 } 14083 14084 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 14085 { 14086 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14087 struct wireless_dev *wdev = info->user_ptr[1]; 14088 14089 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14090 return -EOPNOTSUPP; 14091 14092 if (!rdev->ops->stop_p2p_device) 14093 return -EOPNOTSUPP; 14094 14095 cfg80211_stop_p2p_device(rdev, wdev); 14096 14097 return 0; 14098 } 14099 14100 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 14101 { 14102 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14103 struct wireless_dev *wdev = info->user_ptr[1]; 14104 struct cfg80211_nan_conf conf = {}; 14105 int err; 14106 14107 if (wdev->iftype != NL80211_IFTYPE_NAN) 14108 return -EOPNOTSUPP; 14109 14110 if (wdev_running(wdev)) 14111 return -EEXIST; 14112 14113 if (rfkill_blocked(rdev->wiphy.rfkill)) 14114 return -ERFKILL; 14115 14116 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 14117 return -EINVAL; 14118 14119 conf.master_pref = 14120 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14121 14122 if (info->attrs[NL80211_ATTR_BANDS]) { 14123 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14124 14125 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14126 return -EOPNOTSUPP; 14127 14128 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14129 return -EINVAL; 14130 14131 conf.bands = bands; 14132 } 14133 14134 err = rdev_start_nan(rdev, wdev, &conf); 14135 if (err) 14136 return err; 14137 14138 wdev->is_running = true; 14139 rdev->opencount++; 14140 14141 return 0; 14142 } 14143 14144 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 14145 { 14146 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14147 struct wireless_dev *wdev = info->user_ptr[1]; 14148 14149 if (wdev->iftype != NL80211_IFTYPE_NAN) 14150 return -EOPNOTSUPP; 14151 14152 cfg80211_stop_nan(rdev, wdev); 14153 14154 return 0; 14155 } 14156 14157 static int validate_nan_filter(struct nlattr *filter_attr) 14158 { 14159 struct nlattr *attr; 14160 int len = 0, n_entries = 0, rem; 14161 14162 nla_for_each_nested(attr, filter_attr, rem) { 14163 len += nla_len(attr); 14164 n_entries++; 14165 } 14166 14167 if (len >= U8_MAX) 14168 return -EINVAL; 14169 14170 return n_entries; 14171 } 14172 14173 static int handle_nan_filter(struct nlattr *attr_filter, 14174 struct cfg80211_nan_func *func, 14175 bool tx) 14176 { 14177 struct nlattr *attr; 14178 int n_entries, rem, i; 14179 struct cfg80211_nan_func_filter *filter; 14180 14181 n_entries = validate_nan_filter(attr_filter); 14182 if (n_entries < 0) 14183 return n_entries; 14184 14185 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 14186 14187 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 14188 if (!filter) 14189 return -ENOMEM; 14190 14191 i = 0; 14192 nla_for_each_nested(attr, attr_filter, rem) { 14193 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 14194 if (!filter[i].filter) 14195 goto err; 14196 14197 filter[i].len = nla_len(attr); 14198 i++; 14199 } 14200 if (tx) { 14201 func->num_tx_filters = n_entries; 14202 func->tx_filters = filter; 14203 } else { 14204 func->num_rx_filters = n_entries; 14205 func->rx_filters = filter; 14206 } 14207 14208 return 0; 14209 14210 err: 14211 i = 0; 14212 nla_for_each_nested(attr, attr_filter, rem) { 14213 kfree(filter[i].filter); 14214 i++; 14215 } 14216 kfree(filter); 14217 return -ENOMEM; 14218 } 14219 14220 static int nl80211_nan_add_func(struct sk_buff *skb, 14221 struct genl_info *info) 14222 { 14223 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14224 struct wireless_dev *wdev = info->user_ptr[1]; 14225 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 14226 struct cfg80211_nan_func *func; 14227 struct sk_buff *msg = NULL; 14228 void *hdr = NULL; 14229 int err = 0; 14230 14231 if (wdev->iftype != NL80211_IFTYPE_NAN) 14232 return -EOPNOTSUPP; 14233 14234 if (!wdev_running(wdev)) 14235 return -ENOTCONN; 14236 14237 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 14238 return -EINVAL; 14239 14240 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 14241 info->attrs[NL80211_ATTR_NAN_FUNC], 14242 nl80211_nan_func_policy, 14243 info->extack); 14244 if (err) 14245 return err; 14246 14247 func = kzalloc(sizeof(*func), GFP_KERNEL); 14248 if (!func) 14249 return -ENOMEM; 14250 14251 func->cookie = cfg80211_assign_cookie(rdev); 14252 14253 if (!tb[NL80211_NAN_FUNC_TYPE]) { 14254 err = -EINVAL; 14255 goto out; 14256 } 14257 14258 14259 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 14260 14261 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 14262 err = -EINVAL; 14263 goto out; 14264 } 14265 14266 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 14267 sizeof(func->service_id)); 14268 14269 func->close_range = 14270 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 14271 14272 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 14273 func->serv_spec_info_len = 14274 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 14275 func->serv_spec_info = 14276 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 14277 func->serv_spec_info_len, 14278 GFP_KERNEL); 14279 if (!func->serv_spec_info) { 14280 err = -ENOMEM; 14281 goto out; 14282 } 14283 } 14284 14285 if (tb[NL80211_NAN_FUNC_TTL]) 14286 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 14287 14288 switch (func->type) { 14289 case NL80211_NAN_FUNC_PUBLISH: 14290 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 14291 err = -EINVAL; 14292 goto out; 14293 } 14294 14295 func->publish_type = 14296 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 14297 func->publish_bcast = 14298 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 14299 14300 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 14301 func->publish_bcast) { 14302 err = -EINVAL; 14303 goto out; 14304 } 14305 break; 14306 case NL80211_NAN_FUNC_SUBSCRIBE: 14307 func->subscribe_active = 14308 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 14309 break; 14310 case NL80211_NAN_FUNC_FOLLOW_UP: 14311 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 14312 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 14313 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 14314 err = -EINVAL; 14315 goto out; 14316 } 14317 14318 func->followup_id = 14319 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 14320 func->followup_reqid = 14321 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 14322 memcpy(func->followup_dest.addr, 14323 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 14324 sizeof(func->followup_dest.addr)); 14325 if (func->ttl) { 14326 err = -EINVAL; 14327 goto out; 14328 } 14329 break; 14330 default: 14331 err = -EINVAL; 14332 goto out; 14333 } 14334 14335 if (tb[NL80211_NAN_FUNC_SRF]) { 14336 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 14337 14338 err = nla_parse_nested_deprecated(srf_tb, 14339 NL80211_NAN_SRF_ATTR_MAX, 14340 tb[NL80211_NAN_FUNC_SRF], 14341 nl80211_nan_srf_policy, 14342 info->extack); 14343 if (err) 14344 goto out; 14345 14346 func->srf_include = 14347 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 14348 14349 if (srf_tb[NL80211_NAN_SRF_BF]) { 14350 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 14351 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 14352 err = -EINVAL; 14353 goto out; 14354 } 14355 14356 func->srf_bf_len = 14357 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 14358 func->srf_bf = 14359 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 14360 func->srf_bf_len, GFP_KERNEL); 14361 if (!func->srf_bf) { 14362 err = -ENOMEM; 14363 goto out; 14364 } 14365 14366 func->srf_bf_idx = 14367 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 14368 } else { 14369 struct nlattr *attr, *mac_attr = 14370 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 14371 int n_entries, rem, i = 0; 14372 14373 if (!mac_attr) { 14374 err = -EINVAL; 14375 goto out; 14376 } 14377 14378 n_entries = validate_acl_mac_addrs(mac_attr); 14379 if (n_entries <= 0) { 14380 err = -EINVAL; 14381 goto out; 14382 } 14383 14384 func->srf_num_macs = n_entries; 14385 func->srf_macs = 14386 kcalloc(n_entries, sizeof(*func->srf_macs), 14387 GFP_KERNEL); 14388 if (!func->srf_macs) { 14389 err = -ENOMEM; 14390 goto out; 14391 } 14392 14393 nla_for_each_nested(attr, mac_attr, rem) 14394 memcpy(func->srf_macs[i++].addr, nla_data(attr), 14395 sizeof(*func->srf_macs)); 14396 } 14397 } 14398 14399 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 14400 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 14401 func, true); 14402 if (err) 14403 goto out; 14404 } 14405 14406 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 14407 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 14408 func, false); 14409 if (err) 14410 goto out; 14411 } 14412 14413 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14414 if (!msg) { 14415 err = -ENOMEM; 14416 goto out; 14417 } 14418 14419 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14420 NL80211_CMD_ADD_NAN_FUNCTION); 14421 /* This can't really happen - we just allocated 4KB */ 14422 if (WARN_ON(!hdr)) { 14423 err = -ENOMEM; 14424 goto out; 14425 } 14426 14427 err = rdev_add_nan_func(rdev, wdev, func); 14428 out: 14429 if (err < 0) { 14430 cfg80211_free_nan_func(func); 14431 nlmsg_free(msg); 14432 return err; 14433 } 14434 14435 /* propagate the instance id and cookie to userspace */ 14436 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 14437 NL80211_ATTR_PAD)) 14438 goto nla_put_failure; 14439 14440 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14441 if (!func_attr) 14442 goto nla_put_failure; 14443 14444 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 14445 func->instance_id)) 14446 goto nla_put_failure; 14447 14448 nla_nest_end(msg, func_attr); 14449 14450 genlmsg_end(msg, hdr); 14451 return genlmsg_reply(msg, info); 14452 14453 nla_put_failure: 14454 nlmsg_free(msg); 14455 return -ENOBUFS; 14456 } 14457 14458 static int nl80211_nan_del_func(struct sk_buff *skb, 14459 struct genl_info *info) 14460 { 14461 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14462 struct wireless_dev *wdev = info->user_ptr[1]; 14463 u64 cookie; 14464 14465 if (wdev->iftype != NL80211_IFTYPE_NAN) 14466 return -EOPNOTSUPP; 14467 14468 if (!wdev_running(wdev)) 14469 return -ENOTCONN; 14470 14471 if (!info->attrs[NL80211_ATTR_COOKIE]) 14472 return -EINVAL; 14473 14474 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 14475 14476 rdev_del_nan_func(rdev, wdev, cookie); 14477 14478 return 0; 14479 } 14480 14481 static int nl80211_nan_change_config(struct sk_buff *skb, 14482 struct genl_info *info) 14483 { 14484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14485 struct wireless_dev *wdev = info->user_ptr[1]; 14486 struct cfg80211_nan_conf conf = {}; 14487 u32 changed = 0; 14488 14489 if (wdev->iftype != NL80211_IFTYPE_NAN) 14490 return -EOPNOTSUPP; 14491 14492 if (!wdev_running(wdev)) 14493 return -ENOTCONN; 14494 14495 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 14496 conf.master_pref = 14497 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14498 if (conf.master_pref <= 1 || conf.master_pref == 255) 14499 return -EINVAL; 14500 14501 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 14502 } 14503 14504 if (info->attrs[NL80211_ATTR_BANDS]) { 14505 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14506 14507 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14508 return -EOPNOTSUPP; 14509 14510 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14511 return -EINVAL; 14512 14513 conf.bands = bands; 14514 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 14515 } 14516 14517 if (!changed) 14518 return -EINVAL; 14519 14520 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 14521 } 14522 14523 void cfg80211_nan_match(struct wireless_dev *wdev, 14524 struct cfg80211_nan_match_params *match, gfp_t gfp) 14525 { 14526 struct wiphy *wiphy = wdev->wiphy; 14527 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14528 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 14529 struct sk_buff *msg; 14530 void *hdr; 14531 14532 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 14533 return; 14534 14535 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14536 if (!msg) 14537 return; 14538 14539 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 14540 if (!hdr) { 14541 nlmsg_free(msg); 14542 return; 14543 } 14544 14545 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14546 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14547 wdev->netdev->ifindex)) || 14548 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14549 NL80211_ATTR_PAD)) 14550 goto nla_put_failure; 14551 14552 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 14553 NL80211_ATTR_PAD) || 14554 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 14555 goto nla_put_failure; 14556 14557 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 14558 if (!match_attr) 14559 goto nla_put_failure; 14560 14561 local_func_attr = nla_nest_start_noflag(msg, 14562 NL80211_NAN_MATCH_FUNC_LOCAL); 14563 if (!local_func_attr) 14564 goto nla_put_failure; 14565 14566 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 14567 goto nla_put_failure; 14568 14569 nla_nest_end(msg, local_func_attr); 14570 14571 peer_func_attr = nla_nest_start_noflag(msg, 14572 NL80211_NAN_MATCH_FUNC_PEER); 14573 if (!peer_func_attr) 14574 goto nla_put_failure; 14575 14576 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 14577 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 14578 goto nla_put_failure; 14579 14580 if (match->info && match->info_len && 14581 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 14582 match->info)) 14583 goto nla_put_failure; 14584 14585 nla_nest_end(msg, peer_func_attr); 14586 nla_nest_end(msg, match_attr); 14587 genlmsg_end(msg, hdr); 14588 14589 if (!wdev->owner_nlportid) 14590 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14591 msg, 0, NL80211_MCGRP_NAN, gfp); 14592 else 14593 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14594 wdev->owner_nlportid); 14595 14596 return; 14597 14598 nla_put_failure: 14599 nlmsg_free(msg); 14600 } 14601 EXPORT_SYMBOL(cfg80211_nan_match); 14602 14603 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 14604 u8 inst_id, 14605 enum nl80211_nan_func_term_reason reason, 14606 u64 cookie, gfp_t gfp) 14607 { 14608 struct wiphy *wiphy = wdev->wiphy; 14609 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14610 struct sk_buff *msg; 14611 struct nlattr *func_attr; 14612 void *hdr; 14613 14614 if (WARN_ON(!inst_id)) 14615 return; 14616 14617 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14618 if (!msg) 14619 return; 14620 14621 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 14622 if (!hdr) { 14623 nlmsg_free(msg); 14624 return; 14625 } 14626 14627 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14628 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14629 wdev->netdev->ifindex)) || 14630 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14631 NL80211_ATTR_PAD)) 14632 goto nla_put_failure; 14633 14634 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14635 NL80211_ATTR_PAD)) 14636 goto nla_put_failure; 14637 14638 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14639 if (!func_attr) 14640 goto nla_put_failure; 14641 14642 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 14643 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 14644 goto nla_put_failure; 14645 14646 nla_nest_end(msg, func_attr); 14647 genlmsg_end(msg, hdr); 14648 14649 if (!wdev->owner_nlportid) 14650 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14651 msg, 0, NL80211_MCGRP_NAN, gfp); 14652 else 14653 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14654 wdev->owner_nlportid); 14655 14656 return; 14657 14658 nla_put_failure: 14659 nlmsg_free(msg); 14660 } 14661 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 14662 14663 static int nl80211_get_protocol_features(struct sk_buff *skb, 14664 struct genl_info *info) 14665 { 14666 void *hdr; 14667 struct sk_buff *msg; 14668 14669 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14670 if (!msg) 14671 return -ENOMEM; 14672 14673 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14674 NL80211_CMD_GET_PROTOCOL_FEATURES); 14675 if (!hdr) 14676 goto nla_put_failure; 14677 14678 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 14679 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 14680 goto nla_put_failure; 14681 14682 genlmsg_end(msg, hdr); 14683 return genlmsg_reply(msg, info); 14684 14685 nla_put_failure: 14686 kfree_skb(msg); 14687 return -ENOBUFS; 14688 } 14689 14690 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 14691 { 14692 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14693 struct cfg80211_update_ft_ies_params ft_params; 14694 struct net_device *dev = info->user_ptr[1]; 14695 14696 if (!rdev->ops->update_ft_ies) 14697 return -EOPNOTSUPP; 14698 14699 if (!info->attrs[NL80211_ATTR_MDID] || 14700 !info->attrs[NL80211_ATTR_IE]) 14701 return -EINVAL; 14702 14703 memset(&ft_params, 0, sizeof(ft_params)); 14704 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 14705 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14706 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14707 14708 return rdev_update_ft_ies(rdev, dev, &ft_params); 14709 } 14710 14711 static int nl80211_crit_protocol_start(struct sk_buff *skb, 14712 struct genl_info *info) 14713 { 14714 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14715 struct wireless_dev *wdev = info->user_ptr[1]; 14716 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 14717 u16 duration; 14718 int ret; 14719 14720 if (!rdev->ops->crit_proto_start) 14721 return -EOPNOTSUPP; 14722 14723 if (WARN_ON(!rdev->ops->crit_proto_stop)) 14724 return -EINVAL; 14725 14726 if (rdev->crit_proto_nlportid) 14727 return -EBUSY; 14728 14729 /* determine protocol if provided */ 14730 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 14731 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 14732 14733 if (proto >= NUM_NL80211_CRIT_PROTO) 14734 return -EINVAL; 14735 14736 /* timeout must be provided */ 14737 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 14738 return -EINVAL; 14739 14740 duration = 14741 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 14742 14743 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 14744 if (!ret) 14745 rdev->crit_proto_nlportid = info->snd_portid; 14746 14747 return ret; 14748 } 14749 14750 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 14751 struct genl_info *info) 14752 { 14753 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14754 struct wireless_dev *wdev = info->user_ptr[1]; 14755 14756 if (!rdev->ops->crit_proto_stop) 14757 return -EOPNOTSUPP; 14758 14759 if (rdev->crit_proto_nlportid) { 14760 rdev->crit_proto_nlportid = 0; 14761 rdev_crit_proto_stop(rdev, wdev); 14762 } 14763 return 0; 14764 } 14765 14766 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 14767 struct nlattr *attr, 14768 struct netlink_ext_ack *extack) 14769 { 14770 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 14771 if (attr->nla_type & NLA_F_NESTED) { 14772 NL_SET_ERR_MSG_ATTR(extack, attr, 14773 "unexpected nested data"); 14774 return -EINVAL; 14775 } 14776 14777 return 0; 14778 } 14779 14780 if (!(attr->nla_type & NLA_F_NESTED)) { 14781 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 14782 return -EINVAL; 14783 } 14784 14785 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 14786 } 14787 14788 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 14789 { 14790 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14791 struct wireless_dev *wdev = 14792 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 14793 info->attrs); 14794 int i, err; 14795 u32 vid, subcmd; 14796 14797 if (!rdev->wiphy.vendor_commands) 14798 return -EOPNOTSUPP; 14799 14800 if (IS_ERR(wdev)) { 14801 err = PTR_ERR(wdev); 14802 if (err != -EINVAL) 14803 return err; 14804 wdev = NULL; 14805 } else if (wdev->wiphy != &rdev->wiphy) { 14806 return -EINVAL; 14807 } 14808 14809 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 14810 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 14811 return -EINVAL; 14812 14813 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 14814 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 14815 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 14816 const struct wiphy_vendor_command *vcmd; 14817 void *data = NULL; 14818 int len = 0; 14819 14820 vcmd = &rdev->wiphy.vendor_commands[i]; 14821 14822 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 14823 continue; 14824 14825 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 14826 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 14827 if (!wdev) 14828 return -EINVAL; 14829 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 14830 !wdev->netdev) 14831 return -EINVAL; 14832 14833 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 14834 if (!wdev_running(wdev)) 14835 return -ENETDOWN; 14836 } 14837 } else { 14838 wdev = NULL; 14839 } 14840 14841 if (!vcmd->doit) 14842 return -EOPNOTSUPP; 14843 14844 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 14845 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 14846 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 14847 14848 err = nl80211_vendor_check_policy(vcmd, 14849 info->attrs[NL80211_ATTR_VENDOR_DATA], 14850 info->extack); 14851 if (err) 14852 return err; 14853 } 14854 14855 rdev->cur_cmd_info = info; 14856 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 14857 rdev->cur_cmd_info = NULL; 14858 return err; 14859 } 14860 14861 return -EOPNOTSUPP; 14862 } 14863 14864 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 14865 struct netlink_callback *cb, 14866 struct cfg80211_registered_device **rdev, 14867 struct wireless_dev **wdev) 14868 { 14869 struct nlattr **attrbuf; 14870 u32 vid, subcmd; 14871 unsigned int i; 14872 int vcmd_idx = -1; 14873 int err; 14874 void *data = NULL; 14875 unsigned int data_len = 0; 14876 14877 if (cb->args[0]) { 14878 /* subtract the 1 again here */ 14879 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 14880 struct wireless_dev *tmp; 14881 14882 if (!wiphy) 14883 return -ENODEV; 14884 *rdev = wiphy_to_rdev(wiphy); 14885 *wdev = NULL; 14886 14887 if (cb->args[1]) { 14888 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 14889 if (tmp->identifier == cb->args[1] - 1) { 14890 *wdev = tmp; 14891 break; 14892 } 14893 } 14894 } 14895 14896 /* keep rtnl locked in successful case */ 14897 return 0; 14898 } 14899 14900 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 14901 if (!attrbuf) 14902 return -ENOMEM; 14903 14904 err = nlmsg_parse_deprecated(cb->nlh, 14905 GENL_HDRLEN + nl80211_fam.hdrsize, 14906 attrbuf, nl80211_fam.maxattr, 14907 nl80211_policy, NULL); 14908 if (err) 14909 goto out; 14910 14911 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 14912 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 14913 err = -EINVAL; 14914 goto out; 14915 } 14916 14917 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf); 14918 if (IS_ERR(*wdev)) 14919 *wdev = NULL; 14920 14921 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 14922 if (IS_ERR(*rdev)) { 14923 err = PTR_ERR(*rdev); 14924 goto out; 14925 } 14926 14927 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 14928 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 14929 14930 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 14931 const struct wiphy_vendor_command *vcmd; 14932 14933 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 14934 14935 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 14936 continue; 14937 14938 if (!vcmd->dumpit) { 14939 err = -EOPNOTSUPP; 14940 goto out; 14941 } 14942 14943 vcmd_idx = i; 14944 break; 14945 } 14946 14947 if (vcmd_idx < 0) { 14948 err = -EOPNOTSUPP; 14949 goto out; 14950 } 14951 14952 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 14953 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 14954 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 14955 14956 err = nl80211_vendor_check_policy( 14957 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 14958 attrbuf[NL80211_ATTR_VENDOR_DATA], 14959 cb->extack); 14960 if (err) 14961 goto out; 14962 } 14963 14964 /* 0 is the first index - add 1 to parse only once */ 14965 cb->args[0] = (*rdev)->wiphy_idx + 1; 14966 /* add 1 to know if it was NULL */ 14967 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 14968 cb->args[2] = vcmd_idx; 14969 cb->args[3] = (unsigned long)data; 14970 cb->args[4] = data_len; 14971 14972 /* keep rtnl locked in successful case */ 14973 err = 0; 14974 out: 14975 kfree(attrbuf); 14976 return err; 14977 } 14978 14979 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 14980 struct netlink_callback *cb) 14981 { 14982 struct cfg80211_registered_device *rdev; 14983 struct wireless_dev *wdev; 14984 unsigned int vcmd_idx; 14985 const struct wiphy_vendor_command *vcmd; 14986 void *data; 14987 int data_len; 14988 int err; 14989 struct nlattr *vendor_data; 14990 14991 rtnl_lock(); 14992 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 14993 if (err) 14994 goto out; 14995 14996 vcmd_idx = cb->args[2]; 14997 data = (void *)cb->args[3]; 14998 data_len = cb->args[4]; 14999 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 15000 15001 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 15002 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 15003 if (!wdev) { 15004 err = -EINVAL; 15005 goto out; 15006 } 15007 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 15008 !wdev->netdev) { 15009 err = -EINVAL; 15010 goto out; 15011 } 15012 15013 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 15014 if (!wdev_running(wdev)) { 15015 err = -ENETDOWN; 15016 goto out; 15017 } 15018 } 15019 } 15020 15021 while (1) { 15022 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 15023 cb->nlh->nlmsg_seq, NLM_F_MULTI, 15024 NL80211_CMD_VENDOR); 15025 if (!hdr) 15026 break; 15027 15028 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15029 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 15030 wdev_id(wdev), 15031 NL80211_ATTR_PAD))) { 15032 genlmsg_cancel(skb, hdr); 15033 break; 15034 } 15035 15036 vendor_data = nla_nest_start_noflag(skb, 15037 NL80211_ATTR_VENDOR_DATA); 15038 if (!vendor_data) { 15039 genlmsg_cancel(skb, hdr); 15040 break; 15041 } 15042 15043 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 15044 (unsigned long *)&cb->args[5]); 15045 nla_nest_end(skb, vendor_data); 15046 15047 if (err == -ENOBUFS || err == -ENOENT) { 15048 genlmsg_cancel(skb, hdr); 15049 break; 15050 } else if (err <= 0) { 15051 genlmsg_cancel(skb, hdr); 15052 goto out; 15053 } 15054 15055 genlmsg_end(skb, hdr); 15056 } 15057 15058 err = skb->len; 15059 out: 15060 rtnl_unlock(); 15061 return err; 15062 } 15063 15064 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 15065 enum nl80211_commands cmd, 15066 enum nl80211_attrs attr, 15067 int approxlen) 15068 { 15069 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15070 15071 if (WARN_ON(!rdev->cur_cmd_info)) 15072 return NULL; 15073 15074 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 15075 rdev->cur_cmd_info->snd_portid, 15076 rdev->cur_cmd_info->snd_seq, 15077 cmd, attr, NULL, GFP_KERNEL); 15078 } 15079 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 15080 15081 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 15082 { 15083 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 15084 void *hdr = ((void **)skb->cb)[1]; 15085 struct nlattr *data = ((void **)skb->cb)[2]; 15086 15087 /* clear CB data for netlink core to own from now on */ 15088 memset(skb->cb, 0, sizeof(skb->cb)); 15089 15090 if (WARN_ON(!rdev->cur_cmd_info)) { 15091 kfree_skb(skb); 15092 return -EINVAL; 15093 } 15094 15095 nla_nest_end(skb, data); 15096 genlmsg_end(skb, hdr); 15097 return genlmsg_reply(skb, rdev->cur_cmd_info); 15098 } 15099 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 15100 15101 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 15102 { 15103 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15104 15105 if (WARN_ON(!rdev->cur_cmd_info)) 15106 return 0; 15107 15108 return rdev->cur_cmd_info->snd_portid; 15109 } 15110 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 15111 15112 static int nl80211_set_qos_map(struct sk_buff *skb, 15113 struct genl_info *info) 15114 { 15115 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15116 struct cfg80211_qos_map *qos_map = NULL; 15117 struct net_device *dev = info->user_ptr[1]; 15118 u8 *pos, len, num_des, des_len, des; 15119 int ret; 15120 15121 if (!rdev->ops->set_qos_map) 15122 return -EOPNOTSUPP; 15123 15124 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 15125 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 15126 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 15127 15128 if (len % 2) 15129 return -EINVAL; 15130 15131 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 15132 if (!qos_map) 15133 return -ENOMEM; 15134 15135 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 15136 if (num_des) { 15137 des_len = num_des * 15138 sizeof(struct cfg80211_dscp_exception); 15139 memcpy(qos_map->dscp_exception, pos, des_len); 15140 qos_map->num_des = num_des; 15141 for (des = 0; des < num_des; des++) { 15142 if (qos_map->dscp_exception[des].up > 7) { 15143 kfree(qos_map); 15144 return -EINVAL; 15145 } 15146 } 15147 pos += des_len; 15148 } 15149 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 15150 } 15151 15152 wdev_lock(dev->ieee80211_ptr); 15153 ret = nl80211_key_allowed(dev->ieee80211_ptr); 15154 if (!ret) 15155 ret = rdev_set_qos_map(rdev, dev, qos_map); 15156 wdev_unlock(dev->ieee80211_ptr); 15157 15158 kfree(qos_map); 15159 return ret; 15160 } 15161 15162 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 15163 { 15164 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15165 struct net_device *dev = info->user_ptr[1]; 15166 struct wireless_dev *wdev = dev->ieee80211_ptr; 15167 const u8 *peer; 15168 u8 tsid, up; 15169 u16 admitted_time = 0; 15170 int err; 15171 15172 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 15173 return -EOPNOTSUPP; 15174 15175 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 15176 !info->attrs[NL80211_ATTR_USER_PRIO]) 15177 return -EINVAL; 15178 15179 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15180 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 15181 15182 /* WMM uses TIDs 0-7 even for TSPEC */ 15183 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 15184 /* TODO: handle 802.11 TSPEC/admission control 15185 * need more attributes for that (e.g. BA session requirement); 15186 * change the WMM adminssion test above to allow both then 15187 */ 15188 return -EINVAL; 15189 } 15190 15191 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15192 15193 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 15194 admitted_time = 15195 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 15196 if (!admitted_time) 15197 return -EINVAL; 15198 } 15199 15200 wdev_lock(wdev); 15201 switch (wdev->iftype) { 15202 case NL80211_IFTYPE_STATION: 15203 case NL80211_IFTYPE_P2P_CLIENT: 15204 if (wdev->connected) 15205 break; 15206 err = -ENOTCONN; 15207 goto out; 15208 default: 15209 err = -EOPNOTSUPP; 15210 goto out; 15211 } 15212 15213 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 15214 15215 out: 15216 wdev_unlock(wdev); 15217 return err; 15218 } 15219 15220 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 15221 { 15222 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15223 struct net_device *dev = info->user_ptr[1]; 15224 struct wireless_dev *wdev = dev->ieee80211_ptr; 15225 const u8 *peer; 15226 u8 tsid; 15227 int err; 15228 15229 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 15230 return -EINVAL; 15231 15232 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15233 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15234 15235 wdev_lock(wdev); 15236 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 15237 wdev_unlock(wdev); 15238 15239 return err; 15240 } 15241 15242 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 15243 struct genl_info *info) 15244 { 15245 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15246 struct net_device *dev = info->user_ptr[1]; 15247 struct wireless_dev *wdev = dev->ieee80211_ptr; 15248 struct cfg80211_chan_def chandef = {}; 15249 const u8 *addr; 15250 u8 oper_class; 15251 int err; 15252 15253 if (!rdev->ops->tdls_channel_switch || 15254 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15255 return -EOPNOTSUPP; 15256 15257 switch (dev->ieee80211_ptr->iftype) { 15258 case NL80211_IFTYPE_STATION: 15259 case NL80211_IFTYPE_P2P_CLIENT: 15260 break; 15261 default: 15262 return -EOPNOTSUPP; 15263 } 15264 15265 if (!info->attrs[NL80211_ATTR_MAC] || 15266 !info->attrs[NL80211_ATTR_OPER_CLASS]) 15267 return -EINVAL; 15268 15269 err = nl80211_parse_chandef(rdev, info, &chandef); 15270 if (err) 15271 return err; 15272 15273 /* 15274 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 15275 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 15276 * specification is not defined for them. 15277 */ 15278 if (chandef.chan->band == NL80211_BAND_2GHZ && 15279 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 15280 chandef.width != NL80211_CHAN_WIDTH_20) 15281 return -EINVAL; 15282 15283 /* we will be active on the TDLS link */ 15284 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 15285 wdev->iftype)) 15286 return -EINVAL; 15287 15288 /* don't allow switching to DFS channels */ 15289 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 15290 return -EINVAL; 15291 15292 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15293 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 15294 15295 wdev_lock(wdev); 15296 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 15297 wdev_unlock(wdev); 15298 15299 return err; 15300 } 15301 15302 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 15303 struct genl_info *info) 15304 { 15305 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15306 struct net_device *dev = info->user_ptr[1]; 15307 struct wireless_dev *wdev = dev->ieee80211_ptr; 15308 const u8 *addr; 15309 15310 if (!rdev->ops->tdls_channel_switch || 15311 !rdev->ops->tdls_cancel_channel_switch || 15312 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15313 return -EOPNOTSUPP; 15314 15315 switch (dev->ieee80211_ptr->iftype) { 15316 case NL80211_IFTYPE_STATION: 15317 case NL80211_IFTYPE_P2P_CLIENT: 15318 break; 15319 default: 15320 return -EOPNOTSUPP; 15321 } 15322 15323 if (!info->attrs[NL80211_ATTR_MAC]) 15324 return -EINVAL; 15325 15326 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15327 15328 wdev_lock(wdev); 15329 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 15330 wdev_unlock(wdev); 15331 15332 return 0; 15333 } 15334 15335 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 15336 struct genl_info *info) 15337 { 15338 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15339 struct net_device *dev = info->user_ptr[1]; 15340 struct wireless_dev *wdev = dev->ieee80211_ptr; 15341 const struct nlattr *nla; 15342 bool enabled; 15343 15344 if (!rdev->ops->set_multicast_to_unicast) 15345 return -EOPNOTSUPP; 15346 15347 if (wdev->iftype != NL80211_IFTYPE_AP && 15348 wdev->iftype != NL80211_IFTYPE_P2P_GO) 15349 return -EOPNOTSUPP; 15350 15351 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 15352 enabled = nla_get_flag(nla); 15353 15354 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 15355 } 15356 15357 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 15358 { 15359 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15360 struct net_device *dev = info->user_ptr[1]; 15361 struct wireless_dev *wdev = dev->ieee80211_ptr; 15362 struct cfg80211_pmk_conf pmk_conf = {}; 15363 int ret; 15364 15365 if (wdev->iftype != NL80211_IFTYPE_STATION && 15366 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15367 return -EOPNOTSUPP; 15368 15369 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15370 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15371 return -EOPNOTSUPP; 15372 15373 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 15374 return -EINVAL; 15375 15376 wdev_lock(wdev); 15377 if (!wdev->connected) { 15378 ret = -ENOTCONN; 15379 goto out; 15380 } 15381 15382 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15383 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) { 15384 ret = -EINVAL; 15385 goto out; 15386 } 15387 15388 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 15389 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 15390 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 15391 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 15392 ret = -EINVAL; 15393 goto out; 15394 } 15395 15396 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 15397 pmk_conf.pmk_r0_name = 15398 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 15399 15400 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 15401 out: 15402 wdev_unlock(wdev); 15403 return ret; 15404 } 15405 15406 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 15407 { 15408 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15409 struct net_device *dev = info->user_ptr[1]; 15410 struct wireless_dev *wdev = dev->ieee80211_ptr; 15411 const u8 *aa; 15412 int ret; 15413 15414 if (wdev->iftype != NL80211_IFTYPE_STATION && 15415 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15416 return -EOPNOTSUPP; 15417 15418 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15419 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15420 return -EOPNOTSUPP; 15421 15422 if (!info->attrs[NL80211_ATTR_MAC]) 15423 return -EINVAL; 15424 15425 wdev_lock(wdev); 15426 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15427 ret = rdev_del_pmk(rdev, dev, aa); 15428 wdev_unlock(wdev); 15429 15430 return ret; 15431 } 15432 15433 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 15434 { 15435 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15436 struct net_device *dev = info->user_ptr[1]; 15437 struct cfg80211_external_auth_params params; 15438 15439 if (!rdev->ops->external_auth) 15440 return -EOPNOTSUPP; 15441 15442 if (!info->attrs[NL80211_ATTR_SSID] && 15443 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 15444 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 15445 return -EINVAL; 15446 15447 if (!info->attrs[NL80211_ATTR_BSSID]) 15448 return -EINVAL; 15449 15450 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 15451 return -EINVAL; 15452 15453 memset(¶ms, 0, sizeof(params)); 15454 15455 if (info->attrs[NL80211_ATTR_SSID]) { 15456 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 15457 if (params.ssid.ssid_len == 0) 15458 return -EINVAL; 15459 memcpy(params.ssid.ssid, 15460 nla_data(info->attrs[NL80211_ATTR_SSID]), 15461 params.ssid.ssid_len); 15462 } 15463 15464 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 15465 ETH_ALEN); 15466 15467 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15468 15469 if (info->attrs[NL80211_ATTR_PMKID]) 15470 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 15471 15472 return rdev_external_auth(rdev, dev, ¶ms); 15473 } 15474 15475 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 15476 { 15477 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 15478 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15479 struct net_device *dev = info->user_ptr[1]; 15480 struct wireless_dev *wdev = dev->ieee80211_ptr; 15481 const u8 *buf; 15482 size_t len; 15483 u8 *dest; 15484 u16 proto; 15485 bool noencrypt; 15486 u64 cookie = 0; 15487 int link_id; 15488 int err; 15489 15490 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15491 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 15492 return -EOPNOTSUPP; 15493 15494 if (!rdev->ops->tx_control_port) 15495 return -EOPNOTSUPP; 15496 15497 if (!info->attrs[NL80211_ATTR_FRAME] || 15498 !info->attrs[NL80211_ATTR_MAC] || 15499 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 15500 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 15501 return -EINVAL; 15502 } 15503 15504 wdev_lock(wdev); 15505 15506 switch (wdev->iftype) { 15507 case NL80211_IFTYPE_AP: 15508 case NL80211_IFTYPE_P2P_GO: 15509 case NL80211_IFTYPE_MESH_POINT: 15510 break; 15511 case NL80211_IFTYPE_ADHOC: 15512 if (wdev->u.ibss.current_bss) 15513 break; 15514 err = -ENOTCONN; 15515 goto out; 15516 case NL80211_IFTYPE_STATION: 15517 case NL80211_IFTYPE_P2P_CLIENT: 15518 if (wdev->connected) 15519 break; 15520 err = -ENOTCONN; 15521 goto out; 15522 default: 15523 err = -EOPNOTSUPP; 15524 goto out; 15525 } 15526 15527 wdev_unlock(wdev); 15528 15529 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15530 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15531 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15532 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 15533 noencrypt = 15534 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 15535 15536 link_id = nl80211_link_id_or_invalid(info->attrs); 15537 15538 err = rdev_tx_control_port(rdev, dev, buf, len, 15539 dest, cpu_to_be16(proto), noencrypt, link_id, 15540 dont_wait_for_ack ? NULL : &cookie); 15541 if (!err && !dont_wait_for_ack) 15542 nl_set_extack_cookie_u64(info->extack, cookie); 15543 return err; 15544 out: 15545 wdev_unlock(wdev); 15546 return err; 15547 } 15548 15549 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 15550 struct genl_info *info) 15551 { 15552 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15553 struct net_device *dev = info->user_ptr[1]; 15554 struct wireless_dev *wdev = dev->ieee80211_ptr; 15555 struct cfg80211_ftm_responder_stats ftm_stats = {}; 15556 unsigned int link_id = nl80211_link_id(info->attrs); 15557 struct sk_buff *msg; 15558 void *hdr; 15559 struct nlattr *ftm_stats_attr; 15560 int err; 15561 15562 if (wdev->iftype != NL80211_IFTYPE_AP || 15563 !wdev->links[link_id].ap.beacon_interval) 15564 return -EOPNOTSUPP; 15565 15566 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 15567 if (err) 15568 return err; 15569 15570 if (!ftm_stats.filled) 15571 return -ENODATA; 15572 15573 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15574 if (!msg) 15575 return -ENOMEM; 15576 15577 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 15578 NL80211_CMD_GET_FTM_RESPONDER_STATS); 15579 if (!hdr) 15580 goto nla_put_failure; 15581 15582 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15583 goto nla_put_failure; 15584 15585 ftm_stats_attr = nla_nest_start_noflag(msg, 15586 NL80211_ATTR_FTM_RESPONDER_STATS); 15587 if (!ftm_stats_attr) 15588 goto nla_put_failure; 15589 15590 #define SET_FTM(field, name, type) \ 15591 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15592 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 15593 ftm_stats.field)) \ 15594 goto nla_put_failure; } while (0) 15595 #define SET_FTM_U64(field, name) \ 15596 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15597 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 15598 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 15599 goto nla_put_failure; } while (0) 15600 15601 SET_FTM(success_num, SUCCESS_NUM, u32); 15602 SET_FTM(partial_num, PARTIAL_NUM, u32); 15603 SET_FTM(failed_num, FAILED_NUM, u32); 15604 SET_FTM(asap_num, ASAP_NUM, u32); 15605 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 15606 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 15607 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 15608 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 15609 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 15610 #undef SET_FTM 15611 15612 nla_nest_end(msg, ftm_stats_attr); 15613 15614 genlmsg_end(msg, hdr); 15615 return genlmsg_reply(msg, info); 15616 15617 nla_put_failure: 15618 nlmsg_free(msg); 15619 return -ENOBUFS; 15620 } 15621 15622 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 15623 { 15624 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15625 struct cfg80211_update_owe_info owe_info; 15626 struct net_device *dev = info->user_ptr[1]; 15627 15628 if (!rdev->ops->update_owe_info) 15629 return -EOPNOTSUPP; 15630 15631 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 15632 !info->attrs[NL80211_ATTR_MAC]) 15633 return -EINVAL; 15634 15635 memset(&owe_info, 0, sizeof(owe_info)); 15636 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15637 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 15638 15639 if (info->attrs[NL80211_ATTR_IE]) { 15640 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 15641 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 15642 } 15643 15644 return rdev_update_owe_info(rdev, dev, &owe_info); 15645 } 15646 15647 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 15648 { 15649 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15650 struct net_device *dev = info->user_ptr[1]; 15651 struct wireless_dev *wdev = dev->ieee80211_ptr; 15652 struct station_info sinfo = {}; 15653 const u8 *buf; 15654 size_t len; 15655 u8 *dest; 15656 int err; 15657 15658 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 15659 return -EOPNOTSUPP; 15660 15661 if (!info->attrs[NL80211_ATTR_MAC] || 15662 !info->attrs[NL80211_ATTR_FRAME]) { 15663 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 15664 return -EINVAL; 15665 } 15666 15667 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 15668 return -EOPNOTSUPP; 15669 15670 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15671 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15672 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15673 15674 if (len < sizeof(struct ethhdr)) 15675 return -EINVAL; 15676 15677 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 15678 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 15679 return -EINVAL; 15680 15681 err = rdev_get_station(rdev, dev, dest, &sinfo); 15682 if (err) 15683 return err; 15684 15685 cfg80211_sinfo_release_content(&sinfo); 15686 15687 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 15688 } 15689 15690 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 15691 struct nlattr *attrs[], struct net_device *dev, 15692 struct cfg80211_tid_cfg *tid_conf, 15693 struct genl_info *info, const u8 *peer, 15694 unsigned int link_id) 15695 { 15696 struct netlink_ext_ack *extack = info->extack; 15697 u64 mask; 15698 int err; 15699 15700 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 15701 return -EINVAL; 15702 15703 tid_conf->config_override = 15704 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 15705 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 15706 15707 if (tid_conf->config_override) { 15708 if (rdev->ops->reset_tid_config) { 15709 err = rdev_reset_tid_config(rdev, dev, peer, 15710 tid_conf->tids); 15711 if (err) 15712 return err; 15713 } else { 15714 return -EINVAL; 15715 } 15716 } 15717 15718 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 15719 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 15720 tid_conf->noack = 15721 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 15722 } 15723 15724 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 15725 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 15726 tid_conf->retry_short = 15727 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 15728 15729 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 15730 return -EINVAL; 15731 } 15732 15733 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 15734 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 15735 tid_conf->retry_long = 15736 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 15737 15738 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 15739 return -EINVAL; 15740 } 15741 15742 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 15743 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 15744 tid_conf->ampdu = 15745 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 15746 } 15747 15748 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 15749 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 15750 tid_conf->rtscts = 15751 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 15752 } 15753 15754 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 15755 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 15756 tid_conf->amsdu = 15757 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 15758 } 15759 15760 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 15761 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 15762 15763 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 15764 15765 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 15766 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 15767 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 15768 &tid_conf->txrate_mask, dev, 15769 true, link_id); 15770 if (err) 15771 return err; 15772 15773 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 15774 } 15775 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 15776 } 15777 15778 if (peer) 15779 mask = rdev->wiphy.tid_config_support.peer; 15780 else 15781 mask = rdev->wiphy.tid_config_support.vif; 15782 15783 if (tid_conf->mask & ~mask) { 15784 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 15785 return -ENOTSUPP; 15786 } 15787 15788 return 0; 15789 } 15790 15791 static int nl80211_set_tid_config(struct sk_buff *skb, 15792 struct genl_info *info) 15793 { 15794 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15795 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 15796 unsigned int link_id = nl80211_link_id(info->attrs); 15797 struct net_device *dev = info->user_ptr[1]; 15798 struct cfg80211_tid_config *tid_config; 15799 struct nlattr *tid; 15800 int conf_idx = 0, rem_conf; 15801 int ret = -EINVAL; 15802 u32 num_conf = 0; 15803 15804 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 15805 return -EINVAL; 15806 15807 if (!rdev->ops->set_tid_config) 15808 return -EOPNOTSUPP; 15809 15810 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15811 rem_conf) 15812 num_conf++; 15813 15814 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 15815 GFP_KERNEL); 15816 if (!tid_config) 15817 return -ENOMEM; 15818 15819 tid_config->n_tid_conf = num_conf; 15820 15821 if (info->attrs[NL80211_ATTR_MAC]) 15822 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15823 15824 wdev_lock(dev->ieee80211_ptr); 15825 15826 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15827 rem_conf) { 15828 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 15829 tid, NULL, NULL); 15830 15831 if (ret) 15832 goto bad_tid_conf; 15833 15834 ret = parse_tid_conf(rdev, attrs, dev, 15835 &tid_config->tid_conf[conf_idx], 15836 info, tid_config->peer, link_id); 15837 if (ret) 15838 goto bad_tid_conf; 15839 15840 conf_idx++; 15841 } 15842 15843 ret = rdev_set_tid_config(rdev, dev, tid_config); 15844 15845 bad_tid_conf: 15846 kfree(tid_config); 15847 wdev_unlock(dev->ieee80211_ptr); 15848 return ret; 15849 } 15850 15851 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info) 15852 { 15853 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15854 struct cfg80211_color_change_settings params = {}; 15855 struct net_device *dev = info->user_ptr[1]; 15856 struct wireless_dev *wdev = dev->ieee80211_ptr; 15857 struct nlattr **tb; 15858 u16 offset; 15859 int err; 15860 15861 if (!rdev->ops->color_change) 15862 return -EOPNOTSUPP; 15863 15864 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15865 NL80211_EXT_FEATURE_BSS_COLOR)) 15866 return -EOPNOTSUPP; 15867 15868 if (wdev->iftype != NL80211_IFTYPE_AP) 15869 return -EOPNOTSUPP; 15870 15871 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] || 15872 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] || 15873 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS]) 15874 return -EINVAL; 15875 15876 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]); 15877 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]); 15878 15879 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next); 15880 if (err) 15881 return err; 15882 15883 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL); 15884 if (!tb) 15885 return -ENOMEM; 15886 15887 err = nla_parse_nested(tb, NL80211_ATTR_MAX, 15888 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS], 15889 nl80211_policy, info->extack); 15890 if (err) 15891 goto out; 15892 15893 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change); 15894 if (err) 15895 goto out; 15896 15897 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 15898 err = -EINVAL; 15899 goto out; 15900 } 15901 15902 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) { 15903 err = -EINVAL; 15904 goto out; 15905 } 15906 15907 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 15908 if (offset >= params.beacon_color_change.tail_len) { 15909 err = -EINVAL; 15910 goto out; 15911 } 15912 15913 if (params.beacon_color_change.tail[offset] != params.count) { 15914 err = -EINVAL; 15915 goto out; 15916 } 15917 15918 params.counter_offset_beacon = offset; 15919 15920 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 15921 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) != 15922 sizeof(u16)) { 15923 err = -EINVAL; 15924 goto out; 15925 } 15926 15927 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 15928 if (offset >= params.beacon_color_change.probe_resp_len) { 15929 err = -EINVAL; 15930 goto out; 15931 } 15932 15933 if (params.beacon_color_change.probe_resp[offset] != 15934 params.count) { 15935 err = -EINVAL; 15936 goto out; 15937 } 15938 15939 params.counter_offset_presp = offset; 15940 } 15941 15942 wdev_lock(wdev); 15943 err = rdev_color_change(rdev, dev, ¶ms); 15944 wdev_unlock(wdev); 15945 15946 out: 15947 kfree(params.beacon_next.mbssid_ies); 15948 kfree(params.beacon_color_change.mbssid_ies); 15949 kfree(tb); 15950 return err; 15951 } 15952 15953 static int nl80211_set_fils_aad(struct sk_buff *skb, 15954 struct genl_info *info) 15955 { 15956 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15957 struct net_device *dev = info->user_ptr[1]; 15958 struct cfg80211_fils_aad fils_aad = {}; 15959 u8 *nonces; 15960 15961 if (!info->attrs[NL80211_ATTR_MAC] || 15962 !info->attrs[NL80211_ATTR_FILS_KEK] || 15963 !info->attrs[NL80211_ATTR_FILS_NONCES]) 15964 return -EINVAL; 15965 15966 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15967 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 15968 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 15969 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 15970 fils_aad.snonce = nonces; 15971 fils_aad.anonce = nonces + FILS_NONCE_LEN; 15972 15973 return rdev_set_fils_aad(rdev, dev, &fils_aad); 15974 } 15975 15976 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info) 15977 { 15978 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15979 unsigned int link_id = nl80211_link_id(info->attrs); 15980 struct net_device *dev = info->user_ptr[1]; 15981 struct wireless_dev *wdev = dev->ieee80211_ptr; 15982 int ret; 15983 15984 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)) 15985 return -EINVAL; 15986 15987 switch (wdev->iftype) { 15988 case NL80211_IFTYPE_AP: 15989 break; 15990 default: 15991 return -EINVAL; 15992 } 15993 15994 if (!info->attrs[NL80211_ATTR_MAC] || 15995 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC]))) 15996 return -EINVAL; 15997 15998 wdev_lock(wdev); 15999 wdev->valid_links |= BIT(link_id); 16000 ether_addr_copy(wdev->links[link_id].addr, 16001 nla_data(info->attrs[NL80211_ATTR_MAC])); 16002 16003 ret = rdev_add_intf_link(rdev, wdev, link_id); 16004 if (ret) { 16005 wdev->valid_links &= ~BIT(link_id); 16006 eth_zero_addr(wdev->links[link_id].addr); 16007 } 16008 wdev_unlock(wdev); 16009 16010 return ret; 16011 } 16012 16013 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info) 16014 { 16015 unsigned int link_id = nl80211_link_id(info->attrs); 16016 struct net_device *dev = info->user_ptr[1]; 16017 struct wireless_dev *wdev = dev->ieee80211_ptr; 16018 16019 /* cannot remove if there's no link */ 16020 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16021 return -EINVAL; 16022 16023 switch (wdev->iftype) { 16024 case NL80211_IFTYPE_AP: 16025 break; 16026 default: 16027 return -EINVAL; 16028 } 16029 16030 wdev_lock(wdev); 16031 cfg80211_remove_link(wdev, link_id); 16032 wdev_unlock(wdev); 16033 16034 return 0; 16035 } 16036 16037 static int 16038 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info, 16039 bool add) 16040 { 16041 struct link_station_parameters params = {}; 16042 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16043 struct net_device *dev = info->user_ptr[1]; 16044 int err; 16045 16046 if ((add && !rdev->ops->add_link_station) || 16047 (!add && !rdev->ops->mod_link_station)) 16048 return -EOPNOTSUPP; 16049 16050 if (add && !info->attrs[NL80211_ATTR_MAC]) 16051 return -EINVAL; 16052 16053 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 16054 return -EINVAL; 16055 16056 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 16057 return -EINVAL; 16058 16059 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16060 16061 if (info->attrs[NL80211_ATTR_MAC]) { 16062 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 16063 if (!is_valid_ether_addr(params.link_mac)) 16064 return -EINVAL; 16065 } 16066 16067 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16068 return -EINVAL; 16069 16070 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16071 16072 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 16073 params.supported_rates = 16074 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16075 params.supported_rates_len = 16076 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16077 } 16078 16079 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 16080 params.ht_capa = 16081 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 16082 16083 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 16084 params.vht_capa = 16085 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 16086 16087 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 16088 params.he_capa = 16089 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16090 params.he_capa_len = 16091 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16092 16093 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 16094 params.eht_capa = 16095 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16096 params.eht_capa_len = 16097 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16098 16099 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa, 16100 (const u8 *)params.eht_capa, 16101 params.eht_capa_len, 16102 false)) 16103 return -EINVAL; 16104 } 16105 } 16106 16107 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 16108 params.he_6ghz_capa = 16109 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 16110 16111 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 16112 params.opmode_notif_used = true; 16113 params.opmode_notif = 16114 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 16115 } 16116 16117 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr, 16118 ¶ms.txpwr_set); 16119 if (err) 16120 return err; 16121 16122 wdev_lock(dev->ieee80211_ptr); 16123 if (add) 16124 err = rdev_add_link_station(rdev, dev, ¶ms); 16125 else 16126 err = rdev_mod_link_station(rdev, dev, ¶ms); 16127 wdev_unlock(dev->ieee80211_ptr); 16128 16129 return err; 16130 } 16131 16132 static int 16133 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info) 16134 { 16135 return nl80211_add_mod_link_station(skb, info, true); 16136 } 16137 16138 static int 16139 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info) 16140 { 16141 return nl80211_add_mod_link_station(skb, info, false); 16142 } 16143 16144 static int 16145 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info) 16146 { 16147 struct link_station_del_parameters params = {}; 16148 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16149 struct net_device *dev = info->user_ptr[1]; 16150 int ret; 16151 16152 if (!rdev->ops->del_link_station) 16153 return -EOPNOTSUPP; 16154 16155 if (!info->attrs[NL80211_ATTR_MLD_ADDR] || 16156 !info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16157 return -EINVAL; 16158 16159 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16160 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16161 16162 wdev_lock(dev->ieee80211_ptr); 16163 ret = rdev_del_link_station(rdev, dev, ¶ms); 16164 wdev_unlock(dev->ieee80211_ptr); 16165 16166 return ret; 16167 } 16168 16169 #define NL80211_FLAG_NEED_WIPHY 0x01 16170 #define NL80211_FLAG_NEED_NETDEV 0x02 16171 #define NL80211_FLAG_NEED_RTNL 0x04 16172 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 16173 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 16174 NL80211_FLAG_CHECK_NETDEV_UP) 16175 #define NL80211_FLAG_NEED_WDEV 0x10 16176 /* If a netdev is associated, it must be UP, P2P must be started */ 16177 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 16178 NL80211_FLAG_CHECK_NETDEV_UP) 16179 #define NL80211_FLAG_CLEAR_SKB 0x20 16180 #define NL80211_FLAG_NO_WIPHY_MTX 0x40 16181 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80 16182 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100 16183 16184 #define INTERNAL_FLAG_SELECTORS(__sel) \ 16185 SELECTOR(__sel, NONE, 0) /* must be first */ \ 16186 SELECTOR(__sel, WIPHY, \ 16187 NL80211_FLAG_NEED_WIPHY) \ 16188 SELECTOR(__sel, WDEV, \ 16189 NL80211_FLAG_NEED_WDEV) \ 16190 SELECTOR(__sel, NETDEV, \ 16191 NL80211_FLAG_NEED_NETDEV) \ 16192 SELECTOR(__sel, NETDEV_LINK, \ 16193 NL80211_FLAG_NEED_NETDEV | \ 16194 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16195 SELECTOR(__sel, NETDEV_NO_MLO, \ 16196 NL80211_FLAG_NEED_NETDEV | \ 16197 NL80211_FLAG_MLO_UNSUPPORTED) \ 16198 SELECTOR(__sel, WIPHY_RTNL, \ 16199 NL80211_FLAG_NEED_WIPHY | \ 16200 NL80211_FLAG_NEED_RTNL) \ 16201 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \ 16202 NL80211_FLAG_NEED_WIPHY | \ 16203 NL80211_FLAG_NEED_RTNL | \ 16204 NL80211_FLAG_NO_WIPHY_MTX) \ 16205 SELECTOR(__sel, WDEV_RTNL, \ 16206 NL80211_FLAG_NEED_WDEV | \ 16207 NL80211_FLAG_NEED_RTNL) \ 16208 SELECTOR(__sel, NETDEV_RTNL, \ 16209 NL80211_FLAG_NEED_NETDEV | \ 16210 NL80211_FLAG_NEED_RTNL) \ 16211 SELECTOR(__sel, NETDEV_UP, \ 16212 NL80211_FLAG_NEED_NETDEV_UP) \ 16213 SELECTOR(__sel, NETDEV_UP_LINK, \ 16214 NL80211_FLAG_NEED_NETDEV_UP | \ 16215 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16216 SELECTOR(__sel, NETDEV_UP_NO_MLO, \ 16217 NL80211_FLAG_NEED_NETDEV_UP | \ 16218 NL80211_FLAG_MLO_UNSUPPORTED) \ 16219 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \ 16220 NL80211_FLAG_NEED_NETDEV_UP | \ 16221 NL80211_FLAG_CLEAR_SKB | \ 16222 NL80211_FLAG_MLO_UNSUPPORTED) \ 16223 SELECTOR(__sel, NETDEV_UP_NOTMX, \ 16224 NL80211_FLAG_NEED_NETDEV_UP | \ 16225 NL80211_FLAG_NO_WIPHY_MTX) \ 16226 SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO, \ 16227 NL80211_FLAG_NEED_NETDEV_UP | \ 16228 NL80211_FLAG_NO_WIPHY_MTX | \ 16229 NL80211_FLAG_MLO_UNSUPPORTED) \ 16230 SELECTOR(__sel, NETDEV_UP_CLEAR, \ 16231 NL80211_FLAG_NEED_NETDEV_UP | \ 16232 NL80211_FLAG_CLEAR_SKB) \ 16233 SELECTOR(__sel, WDEV_UP, \ 16234 NL80211_FLAG_NEED_WDEV_UP) \ 16235 SELECTOR(__sel, WDEV_UP_LINK, \ 16236 NL80211_FLAG_NEED_WDEV_UP | \ 16237 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16238 SELECTOR(__sel, WDEV_UP_RTNL, \ 16239 NL80211_FLAG_NEED_WDEV_UP | \ 16240 NL80211_FLAG_NEED_RTNL) \ 16241 SELECTOR(__sel, WIPHY_CLEAR, \ 16242 NL80211_FLAG_NEED_WIPHY | \ 16243 NL80211_FLAG_CLEAR_SKB) 16244 16245 enum nl80211_internal_flags_selector { 16246 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name, 16247 INTERNAL_FLAG_SELECTORS(_) 16248 #undef SELECTOR 16249 }; 16250 16251 static u32 nl80211_internal_flags[] = { 16252 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value, 16253 INTERNAL_FLAG_SELECTORS(_) 16254 #undef SELECTOR 16255 }; 16256 16257 static int nl80211_pre_doit(const struct genl_split_ops *ops, 16258 struct sk_buff *skb, 16259 struct genl_info *info) 16260 { 16261 struct cfg80211_registered_device *rdev = NULL; 16262 struct wireless_dev *wdev = NULL; 16263 struct net_device *dev = NULL; 16264 u32 internal_flags; 16265 int err; 16266 16267 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags))) 16268 return -EINVAL; 16269 16270 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16271 16272 rtnl_lock(); 16273 if (internal_flags & NL80211_FLAG_NEED_WIPHY) { 16274 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 16275 if (IS_ERR(rdev)) { 16276 err = PTR_ERR(rdev); 16277 goto out_unlock; 16278 } 16279 info->user_ptr[0] = rdev; 16280 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV || 16281 internal_flags & NL80211_FLAG_NEED_WDEV) { 16282 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info), 16283 info->attrs); 16284 if (IS_ERR(wdev)) { 16285 err = PTR_ERR(wdev); 16286 goto out_unlock; 16287 } 16288 16289 dev = wdev->netdev; 16290 dev_hold(dev); 16291 rdev = wiphy_to_rdev(wdev->wiphy); 16292 16293 if (internal_flags & NL80211_FLAG_NEED_NETDEV) { 16294 if (!dev) { 16295 err = -EINVAL; 16296 goto out_unlock; 16297 } 16298 16299 info->user_ptr[1] = dev; 16300 } else { 16301 info->user_ptr[1] = wdev; 16302 } 16303 16304 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 16305 !wdev_running(wdev)) { 16306 err = -ENETDOWN; 16307 goto out_unlock; 16308 } 16309 16310 info->user_ptr[0] = rdev; 16311 } 16312 16313 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) { 16314 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID]; 16315 16316 if (!wdev) { 16317 err = -EINVAL; 16318 goto out_unlock; 16319 } 16320 16321 /* MLO -> require valid link ID */ 16322 if (wdev->valid_links && 16323 (!link_id || 16324 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) { 16325 err = -EINVAL; 16326 goto out_unlock; 16327 } 16328 16329 /* non-MLO -> no link ID attribute accepted */ 16330 if (!wdev->valid_links && link_id) { 16331 err = -EINVAL; 16332 goto out_unlock; 16333 } 16334 } 16335 16336 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) { 16337 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] || 16338 (wdev && wdev->valid_links)) { 16339 err = -EINVAL; 16340 goto out_unlock; 16341 } 16342 } 16343 16344 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16345 wiphy_lock(&rdev->wiphy); 16346 /* we keep the mutex locked until post_doit */ 16347 __release(&rdev->wiphy.mtx); 16348 } 16349 if (!(internal_flags & NL80211_FLAG_NEED_RTNL)) 16350 rtnl_unlock(); 16351 16352 return 0; 16353 out_unlock: 16354 rtnl_unlock(); 16355 dev_put(dev); 16356 return err; 16357 } 16358 16359 static void nl80211_post_doit(const struct genl_split_ops *ops, 16360 struct sk_buff *skb, 16361 struct genl_info *info) 16362 { 16363 u32 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16364 16365 if (info->user_ptr[1]) { 16366 if (internal_flags & NL80211_FLAG_NEED_WDEV) { 16367 struct wireless_dev *wdev = info->user_ptr[1]; 16368 16369 dev_put(wdev->netdev); 16370 } else { 16371 dev_put(info->user_ptr[1]); 16372 } 16373 } 16374 16375 if (info->user_ptr[0] && 16376 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16377 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16378 16379 /* we kept the mutex locked since pre_doit */ 16380 __acquire(&rdev->wiphy.mtx); 16381 wiphy_unlock(&rdev->wiphy); 16382 } 16383 16384 if (internal_flags & NL80211_FLAG_NEED_RTNL) 16385 rtnl_unlock(); 16386 16387 /* If needed, clear the netlink message payload from the SKB 16388 * as it might contain key data that shouldn't stick around on 16389 * the heap after the SKB is freed. The netlink message header 16390 * is still needed for further processing, so leave it intact. 16391 */ 16392 if (internal_flags & NL80211_FLAG_CLEAR_SKB) { 16393 struct nlmsghdr *nlh = nlmsg_hdr(skb); 16394 16395 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 16396 } 16397 } 16398 16399 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev, 16400 struct cfg80211_sar_specs *sar_specs, 16401 struct nlattr *spec[], int index) 16402 { 16403 u32 range_index, i; 16404 16405 if (!sar_specs || !spec) 16406 return -EINVAL; 16407 16408 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] || 16409 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]) 16410 return -EINVAL; 16411 16412 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]); 16413 16414 /* check if range_index exceeds num_freq_ranges */ 16415 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges) 16416 return -EINVAL; 16417 16418 /* check if range_index duplicates */ 16419 for (i = 0; i < index; i++) { 16420 if (sar_specs->sub_specs[i].freq_range_index == range_index) 16421 return -EINVAL; 16422 } 16423 16424 sar_specs->sub_specs[index].power = 16425 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]); 16426 16427 sar_specs->sub_specs[index].freq_range_index = range_index; 16428 16429 return 0; 16430 } 16431 16432 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) 16433 { 16434 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16435 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1]; 16436 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1]; 16437 struct cfg80211_sar_specs *sar_spec; 16438 enum nl80211_sar_type type; 16439 struct nlattr *spec_list; 16440 u32 specs; 16441 int rem, err; 16442 16443 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs) 16444 return -EOPNOTSUPP; 16445 16446 if (!info->attrs[NL80211_ATTR_SAR_SPEC]) 16447 return -EINVAL; 16448 16449 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX, 16450 info->attrs[NL80211_ATTR_SAR_SPEC], 16451 NULL, NULL); 16452 16453 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS]) 16454 return -EINVAL; 16455 16456 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]); 16457 if (type != rdev->wiphy.sar_capa->type) 16458 return -EINVAL; 16459 16460 specs = 0; 16461 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) 16462 specs++; 16463 16464 if (specs > rdev->wiphy.sar_capa->num_freq_ranges) 16465 return -EINVAL; 16466 16467 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL); 16468 if (!sar_spec) 16469 return -ENOMEM; 16470 16471 sar_spec->type = type; 16472 specs = 0; 16473 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) { 16474 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX, 16475 spec_list, NULL, NULL); 16476 16477 switch (type) { 16478 case NL80211_SAR_TYPE_POWER: 16479 if (nl80211_set_sar_sub_specs(rdev, sar_spec, 16480 spec, specs)) { 16481 err = -EINVAL; 16482 goto error; 16483 } 16484 break; 16485 default: 16486 err = -EINVAL; 16487 goto error; 16488 } 16489 specs++; 16490 } 16491 16492 sar_spec->num_sub_specs = specs; 16493 16494 rdev->cur_cmd_info = info; 16495 err = rdev_set_sar_specs(rdev, sar_spec); 16496 rdev->cur_cmd_info = NULL; 16497 error: 16498 kfree(sar_spec); 16499 return err; 16500 } 16501 16502 #define SELECTOR(__sel, name, value) \ 16503 ((__sel) == (value)) ? NL80211_IFL_SEL_##name : 16504 int __missing_selector(void); 16505 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector() 16506 16507 static const struct genl_ops nl80211_ops[] = { 16508 { 16509 .cmd = NL80211_CMD_GET_WIPHY, 16510 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16511 .doit = nl80211_get_wiphy, 16512 .dumpit = nl80211_dump_wiphy, 16513 .done = nl80211_dump_wiphy_done, 16514 /* can be retrieved by unprivileged users */ 16515 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16516 }, 16517 }; 16518 16519 static const struct genl_small_ops nl80211_small_ops[] = { 16520 { 16521 .cmd = NL80211_CMD_SET_WIPHY, 16522 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16523 .doit = nl80211_set_wiphy, 16524 .flags = GENL_UNS_ADMIN_PERM, 16525 }, 16526 { 16527 .cmd = NL80211_CMD_GET_INTERFACE, 16528 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16529 .doit = nl80211_get_interface, 16530 .dumpit = nl80211_dump_interface, 16531 /* can be retrieved by unprivileged users */ 16532 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 16533 }, 16534 { 16535 .cmd = NL80211_CMD_SET_INTERFACE, 16536 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16537 .doit = nl80211_set_interface, 16538 .flags = GENL_UNS_ADMIN_PERM, 16539 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 16540 NL80211_FLAG_NEED_RTNL), 16541 }, 16542 { 16543 .cmd = NL80211_CMD_NEW_INTERFACE, 16544 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16545 .doit = nl80211_new_interface, 16546 .flags = GENL_UNS_ADMIN_PERM, 16547 .internal_flags = 16548 IFLAGS(NL80211_FLAG_NEED_WIPHY | 16549 NL80211_FLAG_NEED_RTNL | 16550 /* we take the wiphy mutex later ourselves */ 16551 NL80211_FLAG_NO_WIPHY_MTX), 16552 }, 16553 { 16554 .cmd = NL80211_CMD_DEL_INTERFACE, 16555 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16556 .doit = nl80211_del_interface, 16557 .flags = GENL_UNS_ADMIN_PERM, 16558 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 16559 NL80211_FLAG_NEED_RTNL), 16560 }, 16561 { 16562 .cmd = NL80211_CMD_GET_KEY, 16563 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16564 .doit = nl80211_get_key, 16565 .flags = GENL_UNS_ADMIN_PERM, 16566 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16567 }, 16568 { 16569 .cmd = NL80211_CMD_SET_KEY, 16570 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16571 .doit = nl80211_set_key, 16572 .flags = GENL_UNS_ADMIN_PERM, 16573 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */ 16574 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16575 NL80211_FLAG_CLEAR_SKB), 16576 }, 16577 { 16578 .cmd = NL80211_CMD_NEW_KEY, 16579 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16580 .doit = nl80211_new_key, 16581 .flags = GENL_UNS_ADMIN_PERM, 16582 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16583 NL80211_FLAG_CLEAR_SKB), 16584 }, 16585 { 16586 .cmd = NL80211_CMD_DEL_KEY, 16587 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16588 .doit = nl80211_del_key, 16589 .flags = GENL_UNS_ADMIN_PERM, 16590 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16591 }, 16592 { 16593 .cmd = NL80211_CMD_SET_BEACON, 16594 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16595 .flags = GENL_UNS_ADMIN_PERM, 16596 .doit = nl80211_set_beacon, 16597 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16598 NL80211_FLAG_MLO_VALID_LINK_ID), 16599 }, 16600 { 16601 .cmd = NL80211_CMD_START_AP, 16602 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16603 .flags = GENL_UNS_ADMIN_PERM, 16604 .doit = nl80211_start_ap, 16605 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16606 NL80211_FLAG_MLO_VALID_LINK_ID), 16607 }, 16608 { 16609 .cmd = NL80211_CMD_STOP_AP, 16610 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16611 .flags = GENL_UNS_ADMIN_PERM, 16612 .doit = nl80211_stop_ap, 16613 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16614 NL80211_FLAG_MLO_VALID_LINK_ID), 16615 }, 16616 { 16617 .cmd = NL80211_CMD_GET_STATION, 16618 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16619 .doit = nl80211_get_station, 16620 .dumpit = nl80211_dump_station, 16621 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16622 }, 16623 { 16624 .cmd = NL80211_CMD_SET_STATION, 16625 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16626 .doit = nl80211_set_station, 16627 .flags = GENL_UNS_ADMIN_PERM, 16628 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16629 }, 16630 { 16631 .cmd = NL80211_CMD_NEW_STATION, 16632 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16633 .doit = nl80211_new_station, 16634 .flags = GENL_UNS_ADMIN_PERM, 16635 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16636 }, 16637 { 16638 .cmd = NL80211_CMD_DEL_STATION, 16639 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16640 .doit = nl80211_del_station, 16641 .flags = GENL_UNS_ADMIN_PERM, 16642 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16643 }, 16644 { 16645 .cmd = NL80211_CMD_GET_MPATH, 16646 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16647 .doit = nl80211_get_mpath, 16648 .dumpit = nl80211_dump_mpath, 16649 .flags = GENL_UNS_ADMIN_PERM, 16650 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16651 }, 16652 { 16653 .cmd = NL80211_CMD_GET_MPP, 16654 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16655 .doit = nl80211_get_mpp, 16656 .dumpit = nl80211_dump_mpp, 16657 .flags = GENL_UNS_ADMIN_PERM, 16658 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16659 }, 16660 { 16661 .cmd = NL80211_CMD_SET_MPATH, 16662 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16663 .doit = nl80211_set_mpath, 16664 .flags = GENL_UNS_ADMIN_PERM, 16665 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16666 }, 16667 { 16668 .cmd = NL80211_CMD_NEW_MPATH, 16669 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16670 .doit = nl80211_new_mpath, 16671 .flags = GENL_UNS_ADMIN_PERM, 16672 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16673 }, 16674 { 16675 .cmd = NL80211_CMD_DEL_MPATH, 16676 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16677 .doit = nl80211_del_mpath, 16678 .flags = GENL_UNS_ADMIN_PERM, 16679 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16680 }, 16681 { 16682 .cmd = NL80211_CMD_SET_BSS, 16683 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16684 .doit = nl80211_set_bss, 16685 .flags = GENL_UNS_ADMIN_PERM, 16686 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16687 NL80211_FLAG_MLO_VALID_LINK_ID), 16688 }, 16689 { 16690 .cmd = NL80211_CMD_GET_REG, 16691 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16692 .doit = nl80211_get_reg_do, 16693 .dumpit = nl80211_get_reg_dump, 16694 /* can be retrieved by unprivileged users */ 16695 }, 16696 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 16697 { 16698 .cmd = NL80211_CMD_SET_REG, 16699 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16700 .doit = nl80211_set_reg, 16701 .flags = GENL_ADMIN_PERM, 16702 }, 16703 #endif 16704 { 16705 .cmd = NL80211_CMD_REQ_SET_REG, 16706 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16707 .doit = nl80211_req_set_reg, 16708 .flags = GENL_ADMIN_PERM, 16709 }, 16710 { 16711 .cmd = NL80211_CMD_RELOAD_REGDB, 16712 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16713 .doit = nl80211_reload_regdb, 16714 .flags = GENL_ADMIN_PERM, 16715 }, 16716 { 16717 .cmd = NL80211_CMD_GET_MESH_CONFIG, 16718 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16719 .doit = nl80211_get_mesh_config, 16720 /* can be retrieved by unprivileged users */ 16721 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16722 }, 16723 { 16724 .cmd = NL80211_CMD_SET_MESH_CONFIG, 16725 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16726 .doit = nl80211_update_mesh_config, 16727 .flags = GENL_UNS_ADMIN_PERM, 16728 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16729 }, 16730 { 16731 .cmd = NL80211_CMD_TRIGGER_SCAN, 16732 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16733 .doit = nl80211_trigger_scan, 16734 .flags = GENL_UNS_ADMIN_PERM, 16735 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16736 }, 16737 { 16738 .cmd = NL80211_CMD_ABORT_SCAN, 16739 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16740 .doit = nl80211_abort_scan, 16741 .flags = GENL_UNS_ADMIN_PERM, 16742 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16743 }, 16744 { 16745 .cmd = NL80211_CMD_GET_SCAN, 16746 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16747 .dumpit = nl80211_dump_scan, 16748 }, 16749 { 16750 .cmd = NL80211_CMD_START_SCHED_SCAN, 16751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16752 .doit = nl80211_start_sched_scan, 16753 .flags = GENL_UNS_ADMIN_PERM, 16754 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16755 }, 16756 { 16757 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 16758 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16759 .doit = nl80211_stop_sched_scan, 16760 .flags = GENL_UNS_ADMIN_PERM, 16761 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16762 }, 16763 { 16764 .cmd = NL80211_CMD_AUTHENTICATE, 16765 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16766 .doit = nl80211_authenticate, 16767 .flags = GENL_UNS_ADMIN_PERM, 16768 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16769 NL80211_FLAG_CLEAR_SKB), 16770 }, 16771 { 16772 .cmd = NL80211_CMD_ASSOCIATE, 16773 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16774 .doit = nl80211_associate, 16775 .flags = GENL_UNS_ADMIN_PERM, 16776 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16777 NL80211_FLAG_CLEAR_SKB), 16778 }, 16779 { 16780 .cmd = NL80211_CMD_DEAUTHENTICATE, 16781 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16782 .doit = nl80211_deauthenticate, 16783 .flags = GENL_UNS_ADMIN_PERM, 16784 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16785 }, 16786 { 16787 .cmd = NL80211_CMD_DISASSOCIATE, 16788 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16789 .doit = nl80211_disassociate, 16790 .flags = GENL_UNS_ADMIN_PERM, 16791 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16792 }, 16793 { 16794 .cmd = NL80211_CMD_JOIN_IBSS, 16795 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16796 .doit = nl80211_join_ibss, 16797 .flags = GENL_UNS_ADMIN_PERM, 16798 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16799 }, 16800 { 16801 .cmd = NL80211_CMD_LEAVE_IBSS, 16802 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16803 .doit = nl80211_leave_ibss, 16804 .flags = GENL_UNS_ADMIN_PERM, 16805 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16806 }, 16807 #ifdef CONFIG_NL80211_TESTMODE 16808 { 16809 .cmd = NL80211_CMD_TESTMODE, 16810 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16811 .doit = nl80211_testmode_do, 16812 .dumpit = nl80211_testmode_dump, 16813 .flags = GENL_UNS_ADMIN_PERM, 16814 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16815 }, 16816 #endif 16817 { 16818 .cmd = NL80211_CMD_CONNECT, 16819 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16820 .doit = nl80211_connect, 16821 .flags = GENL_UNS_ADMIN_PERM, 16822 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16823 NL80211_FLAG_CLEAR_SKB), 16824 }, 16825 { 16826 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 16827 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16828 .doit = nl80211_update_connect_params, 16829 .flags = GENL_ADMIN_PERM, 16830 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16831 NL80211_FLAG_CLEAR_SKB), 16832 }, 16833 { 16834 .cmd = NL80211_CMD_DISCONNECT, 16835 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16836 .doit = nl80211_disconnect, 16837 .flags = GENL_UNS_ADMIN_PERM, 16838 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16839 }, 16840 { 16841 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 16842 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16843 .doit = nl80211_wiphy_netns, 16844 .flags = GENL_UNS_ADMIN_PERM, 16845 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 16846 NL80211_FLAG_NEED_RTNL | 16847 NL80211_FLAG_NO_WIPHY_MTX), 16848 }, 16849 { 16850 .cmd = NL80211_CMD_GET_SURVEY, 16851 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16852 .dumpit = nl80211_dump_survey, 16853 }, 16854 { 16855 .cmd = NL80211_CMD_SET_PMKSA, 16856 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16857 .doit = nl80211_setdel_pmksa, 16858 .flags = GENL_UNS_ADMIN_PERM, 16859 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16860 NL80211_FLAG_CLEAR_SKB), 16861 }, 16862 { 16863 .cmd = NL80211_CMD_DEL_PMKSA, 16864 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16865 .doit = nl80211_setdel_pmksa, 16866 .flags = GENL_UNS_ADMIN_PERM, 16867 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16868 }, 16869 { 16870 .cmd = NL80211_CMD_FLUSH_PMKSA, 16871 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16872 .doit = nl80211_flush_pmksa, 16873 .flags = GENL_UNS_ADMIN_PERM, 16874 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16875 }, 16876 { 16877 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 16878 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16879 .doit = nl80211_remain_on_channel, 16880 .flags = GENL_UNS_ADMIN_PERM, 16881 /* FIXME: requiring a link ID here is probably not good */ 16882 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 16883 NL80211_FLAG_MLO_VALID_LINK_ID), 16884 }, 16885 { 16886 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 16887 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16888 .doit = nl80211_cancel_remain_on_channel, 16889 .flags = GENL_UNS_ADMIN_PERM, 16890 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16891 }, 16892 { 16893 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 16894 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16895 .doit = nl80211_set_tx_bitrate_mask, 16896 .flags = GENL_UNS_ADMIN_PERM, 16897 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 16898 NL80211_FLAG_MLO_VALID_LINK_ID), 16899 }, 16900 { 16901 .cmd = NL80211_CMD_REGISTER_FRAME, 16902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16903 .doit = nl80211_register_mgmt, 16904 .flags = GENL_UNS_ADMIN_PERM, 16905 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 16906 }, 16907 { 16908 .cmd = NL80211_CMD_FRAME, 16909 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16910 .doit = nl80211_tx_mgmt, 16911 .flags = GENL_UNS_ADMIN_PERM, 16912 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16913 }, 16914 { 16915 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 16916 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16917 .doit = nl80211_tx_mgmt_cancel_wait, 16918 .flags = GENL_UNS_ADMIN_PERM, 16919 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16920 }, 16921 { 16922 .cmd = NL80211_CMD_SET_POWER_SAVE, 16923 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16924 .doit = nl80211_set_power_save, 16925 .flags = GENL_UNS_ADMIN_PERM, 16926 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16927 }, 16928 { 16929 .cmd = NL80211_CMD_GET_POWER_SAVE, 16930 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16931 .doit = nl80211_get_power_save, 16932 /* can be retrieved by unprivileged users */ 16933 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16934 }, 16935 { 16936 .cmd = NL80211_CMD_SET_CQM, 16937 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16938 .doit = nl80211_set_cqm, 16939 .flags = GENL_UNS_ADMIN_PERM, 16940 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16941 }, 16942 { 16943 .cmd = NL80211_CMD_SET_CHANNEL, 16944 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16945 .doit = nl80211_set_channel, 16946 .flags = GENL_UNS_ADMIN_PERM, 16947 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 16948 NL80211_FLAG_MLO_VALID_LINK_ID), 16949 }, 16950 { 16951 .cmd = NL80211_CMD_JOIN_MESH, 16952 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16953 .doit = nl80211_join_mesh, 16954 .flags = GENL_UNS_ADMIN_PERM, 16955 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16956 }, 16957 { 16958 .cmd = NL80211_CMD_LEAVE_MESH, 16959 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16960 .doit = nl80211_leave_mesh, 16961 .flags = GENL_UNS_ADMIN_PERM, 16962 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16963 }, 16964 { 16965 .cmd = NL80211_CMD_JOIN_OCB, 16966 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16967 .doit = nl80211_join_ocb, 16968 .flags = GENL_UNS_ADMIN_PERM, 16969 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16970 }, 16971 { 16972 .cmd = NL80211_CMD_LEAVE_OCB, 16973 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16974 .doit = nl80211_leave_ocb, 16975 .flags = GENL_UNS_ADMIN_PERM, 16976 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16977 }, 16978 #ifdef CONFIG_PM 16979 { 16980 .cmd = NL80211_CMD_GET_WOWLAN, 16981 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16982 .doit = nl80211_get_wowlan, 16983 /* can be retrieved by unprivileged users */ 16984 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16985 }, 16986 { 16987 .cmd = NL80211_CMD_SET_WOWLAN, 16988 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16989 .doit = nl80211_set_wowlan, 16990 .flags = GENL_UNS_ADMIN_PERM, 16991 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16992 }, 16993 #endif 16994 { 16995 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 16996 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16997 .doit = nl80211_set_rekey_data, 16998 .flags = GENL_UNS_ADMIN_PERM, 16999 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17000 NL80211_FLAG_CLEAR_SKB), 17001 }, 17002 { 17003 .cmd = NL80211_CMD_TDLS_MGMT, 17004 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17005 .doit = nl80211_tdls_mgmt, 17006 .flags = GENL_UNS_ADMIN_PERM, 17007 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17008 }, 17009 { 17010 .cmd = NL80211_CMD_TDLS_OPER, 17011 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17012 .doit = nl80211_tdls_oper, 17013 .flags = GENL_UNS_ADMIN_PERM, 17014 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17015 }, 17016 { 17017 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 17018 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17019 .doit = nl80211_register_unexpected_frame, 17020 .flags = GENL_UNS_ADMIN_PERM, 17021 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17022 }, 17023 { 17024 .cmd = NL80211_CMD_PROBE_CLIENT, 17025 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17026 .doit = nl80211_probe_client, 17027 .flags = GENL_UNS_ADMIN_PERM, 17028 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17029 }, 17030 { 17031 .cmd = NL80211_CMD_REGISTER_BEACONS, 17032 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17033 .doit = nl80211_register_beacons, 17034 .flags = GENL_UNS_ADMIN_PERM, 17035 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17036 }, 17037 { 17038 .cmd = NL80211_CMD_SET_NOACK_MAP, 17039 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17040 .doit = nl80211_set_noack_map, 17041 .flags = GENL_UNS_ADMIN_PERM, 17042 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17043 }, 17044 { 17045 .cmd = NL80211_CMD_START_P2P_DEVICE, 17046 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17047 .doit = nl80211_start_p2p_device, 17048 .flags = GENL_UNS_ADMIN_PERM, 17049 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17050 NL80211_FLAG_NEED_RTNL), 17051 }, 17052 { 17053 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 17054 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17055 .doit = nl80211_stop_p2p_device, 17056 .flags = GENL_UNS_ADMIN_PERM, 17057 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17058 NL80211_FLAG_NEED_RTNL), 17059 }, 17060 { 17061 .cmd = NL80211_CMD_START_NAN, 17062 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17063 .doit = nl80211_start_nan, 17064 .flags = GENL_ADMIN_PERM, 17065 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17066 NL80211_FLAG_NEED_RTNL), 17067 }, 17068 { 17069 .cmd = NL80211_CMD_STOP_NAN, 17070 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17071 .doit = nl80211_stop_nan, 17072 .flags = GENL_ADMIN_PERM, 17073 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17074 NL80211_FLAG_NEED_RTNL), 17075 }, 17076 { 17077 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 17078 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17079 .doit = nl80211_nan_add_func, 17080 .flags = GENL_ADMIN_PERM, 17081 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17082 }, 17083 { 17084 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 17085 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17086 .doit = nl80211_nan_del_func, 17087 .flags = GENL_ADMIN_PERM, 17088 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17089 }, 17090 { 17091 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 17092 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17093 .doit = nl80211_nan_change_config, 17094 .flags = GENL_ADMIN_PERM, 17095 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17096 }, 17097 { 17098 .cmd = NL80211_CMD_SET_MCAST_RATE, 17099 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17100 .doit = nl80211_set_mcast_rate, 17101 .flags = GENL_UNS_ADMIN_PERM, 17102 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17103 }, 17104 { 17105 .cmd = NL80211_CMD_SET_MAC_ACL, 17106 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17107 .doit = nl80211_set_mac_acl, 17108 .flags = GENL_UNS_ADMIN_PERM, 17109 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17110 NL80211_FLAG_MLO_UNSUPPORTED), 17111 }, 17112 { 17113 .cmd = NL80211_CMD_RADAR_DETECT, 17114 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17115 .doit = nl80211_start_radar_detection, 17116 .flags = GENL_UNS_ADMIN_PERM, 17117 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17118 NL80211_FLAG_NO_WIPHY_MTX | 17119 NL80211_FLAG_MLO_UNSUPPORTED), 17120 }, 17121 { 17122 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 17123 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17124 .doit = nl80211_get_protocol_features, 17125 }, 17126 { 17127 .cmd = NL80211_CMD_UPDATE_FT_IES, 17128 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17129 .doit = nl80211_update_ft_ies, 17130 .flags = GENL_UNS_ADMIN_PERM, 17131 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17132 }, 17133 { 17134 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 17135 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17136 .doit = nl80211_crit_protocol_start, 17137 .flags = GENL_UNS_ADMIN_PERM, 17138 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17139 }, 17140 { 17141 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 17142 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17143 .doit = nl80211_crit_protocol_stop, 17144 .flags = GENL_UNS_ADMIN_PERM, 17145 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17146 }, 17147 { 17148 .cmd = NL80211_CMD_GET_COALESCE, 17149 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17150 .doit = nl80211_get_coalesce, 17151 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17152 }, 17153 { 17154 .cmd = NL80211_CMD_SET_COALESCE, 17155 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17156 .doit = nl80211_set_coalesce, 17157 .flags = GENL_UNS_ADMIN_PERM, 17158 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17159 }, 17160 { 17161 .cmd = NL80211_CMD_CHANNEL_SWITCH, 17162 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17163 .doit = nl80211_channel_switch, 17164 .flags = GENL_UNS_ADMIN_PERM, 17165 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17166 NL80211_FLAG_MLO_VALID_LINK_ID), 17167 }, 17168 { 17169 .cmd = NL80211_CMD_VENDOR, 17170 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17171 .doit = nl80211_vendor_cmd, 17172 .dumpit = nl80211_vendor_cmd_dump, 17173 .flags = GENL_UNS_ADMIN_PERM, 17174 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17175 NL80211_FLAG_CLEAR_SKB), 17176 }, 17177 { 17178 .cmd = NL80211_CMD_SET_QOS_MAP, 17179 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17180 .doit = nl80211_set_qos_map, 17181 .flags = GENL_UNS_ADMIN_PERM, 17182 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17183 }, 17184 { 17185 .cmd = NL80211_CMD_ADD_TX_TS, 17186 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17187 .doit = nl80211_add_tx_ts, 17188 .flags = GENL_UNS_ADMIN_PERM, 17189 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17190 NL80211_FLAG_MLO_UNSUPPORTED), 17191 }, 17192 { 17193 .cmd = NL80211_CMD_DEL_TX_TS, 17194 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17195 .doit = nl80211_del_tx_ts, 17196 .flags = GENL_UNS_ADMIN_PERM, 17197 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17198 }, 17199 { 17200 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 17201 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17202 .doit = nl80211_tdls_channel_switch, 17203 .flags = GENL_UNS_ADMIN_PERM, 17204 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17205 }, 17206 { 17207 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 17208 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17209 .doit = nl80211_tdls_cancel_channel_switch, 17210 .flags = GENL_UNS_ADMIN_PERM, 17211 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17212 }, 17213 { 17214 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 17215 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17216 .doit = nl80211_set_multicast_to_unicast, 17217 .flags = GENL_UNS_ADMIN_PERM, 17218 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17219 }, 17220 { 17221 .cmd = NL80211_CMD_SET_PMK, 17222 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17223 .doit = nl80211_set_pmk, 17224 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17225 NL80211_FLAG_CLEAR_SKB), 17226 }, 17227 { 17228 .cmd = NL80211_CMD_DEL_PMK, 17229 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17230 .doit = nl80211_del_pmk, 17231 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17232 }, 17233 { 17234 .cmd = NL80211_CMD_EXTERNAL_AUTH, 17235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17236 .doit = nl80211_external_auth, 17237 .flags = GENL_ADMIN_PERM, 17238 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17239 }, 17240 { 17241 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 17242 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17243 .doit = nl80211_tx_control_port, 17244 .flags = GENL_UNS_ADMIN_PERM, 17245 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17246 }, 17247 { 17248 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 17249 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17250 .doit = nl80211_get_ftm_responder_stats, 17251 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17252 NL80211_FLAG_MLO_VALID_LINK_ID), 17253 }, 17254 { 17255 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 17256 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17257 .doit = nl80211_pmsr_start, 17258 .flags = GENL_UNS_ADMIN_PERM, 17259 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17260 }, 17261 { 17262 .cmd = NL80211_CMD_NOTIFY_RADAR, 17263 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17264 .doit = nl80211_notify_radar_detection, 17265 .flags = GENL_UNS_ADMIN_PERM, 17266 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17267 }, 17268 { 17269 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 17270 .doit = nl80211_update_owe_info, 17271 .flags = GENL_ADMIN_PERM, 17272 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17273 }, 17274 { 17275 .cmd = NL80211_CMD_PROBE_MESH_LINK, 17276 .doit = nl80211_probe_mesh_link, 17277 .flags = GENL_UNS_ADMIN_PERM, 17278 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17279 }, 17280 { 17281 .cmd = NL80211_CMD_SET_TID_CONFIG, 17282 .doit = nl80211_set_tid_config, 17283 .flags = GENL_UNS_ADMIN_PERM, 17284 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17285 NL80211_FLAG_MLO_VALID_LINK_ID), 17286 }, 17287 { 17288 .cmd = NL80211_CMD_SET_SAR_SPECS, 17289 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17290 .doit = nl80211_set_sar_specs, 17291 .flags = GENL_UNS_ADMIN_PERM, 17292 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17293 NL80211_FLAG_NEED_RTNL), 17294 }, 17295 { 17296 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST, 17297 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17298 .doit = nl80211_color_change, 17299 .flags = GENL_UNS_ADMIN_PERM, 17300 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17301 }, 17302 { 17303 .cmd = NL80211_CMD_SET_FILS_AAD, 17304 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17305 .doit = nl80211_set_fils_aad, 17306 .flags = GENL_UNS_ADMIN_PERM, 17307 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17308 }, 17309 { 17310 .cmd = NL80211_CMD_ADD_LINK, 17311 .doit = nl80211_add_link, 17312 .flags = GENL_UNS_ADMIN_PERM, 17313 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17314 }, 17315 { 17316 .cmd = NL80211_CMD_REMOVE_LINK, 17317 .doit = nl80211_remove_link, 17318 .flags = GENL_UNS_ADMIN_PERM, 17319 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17320 NL80211_FLAG_MLO_VALID_LINK_ID), 17321 }, 17322 { 17323 .cmd = NL80211_CMD_ADD_LINK_STA, 17324 .doit = nl80211_add_link_station, 17325 .flags = GENL_UNS_ADMIN_PERM, 17326 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17327 NL80211_FLAG_MLO_VALID_LINK_ID), 17328 }, 17329 { 17330 .cmd = NL80211_CMD_MODIFY_LINK_STA, 17331 .doit = nl80211_modify_link_station, 17332 .flags = GENL_UNS_ADMIN_PERM, 17333 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17334 NL80211_FLAG_MLO_VALID_LINK_ID), 17335 }, 17336 { 17337 .cmd = NL80211_CMD_REMOVE_LINK_STA, 17338 .doit = nl80211_remove_link_station, 17339 .flags = GENL_UNS_ADMIN_PERM, 17340 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17341 NL80211_FLAG_MLO_VALID_LINK_ID), 17342 }, 17343 }; 17344 17345 static struct genl_family nl80211_fam __ro_after_init = { 17346 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 17347 .hdrsize = 0, /* no private header */ 17348 .version = 1, /* no particular meaning now */ 17349 .maxattr = NL80211_ATTR_MAX, 17350 .policy = nl80211_policy, 17351 .netnsok = true, 17352 .pre_doit = nl80211_pre_doit, 17353 .post_doit = nl80211_post_doit, 17354 .module = THIS_MODULE, 17355 .ops = nl80211_ops, 17356 .n_ops = ARRAY_SIZE(nl80211_ops), 17357 .small_ops = nl80211_small_ops, 17358 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 17359 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1, 17360 .mcgrps = nl80211_mcgrps, 17361 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 17362 .parallel_ops = true, 17363 }; 17364 17365 /* notification functions */ 17366 17367 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 17368 enum nl80211_commands cmd) 17369 { 17370 struct sk_buff *msg; 17371 struct nl80211_dump_wiphy_state state = {}; 17372 17373 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 17374 cmd != NL80211_CMD_DEL_WIPHY); 17375 17376 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17377 if (!msg) 17378 return; 17379 17380 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 17381 nlmsg_free(msg); 17382 return; 17383 } 17384 17385 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17386 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17387 } 17388 17389 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 17390 struct wireless_dev *wdev, 17391 enum nl80211_commands cmd) 17392 { 17393 struct sk_buff *msg; 17394 17395 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17396 if (!msg) 17397 return; 17398 17399 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 17400 nlmsg_free(msg); 17401 return; 17402 } 17403 17404 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17405 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17406 } 17407 17408 static int nl80211_add_scan_req(struct sk_buff *msg, 17409 struct cfg80211_registered_device *rdev) 17410 { 17411 struct cfg80211_scan_request *req = rdev->scan_req; 17412 struct nlattr *nest; 17413 int i; 17414 struct cfg80211_scan_info *info; 17415 17416 if (WARN_ON(!req)) 17417 return 0; 17418 17419 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 17420 if (!nest) 17421 goto nla_put_failure; 17422 for (i = 0; i < req->n_ssids; i++) { 17423 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 17424 goto nla_put_failure; 17425 } 17426 nla_nest_end(msg, nest); 17427 17428 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 17429 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 17430 if (!nest) 17431 goto nla_put_failure; 17432 for (i = 0; i < req->n_channels; i++) { 17433 if (nla_put_u32(msg, i, 17434 ieee80211_channel_to_khz(req->channels[i]))) 17435 goto nla_put_failure; 17436 } 17437 nla_nest_end(msg, nest); 17438 } else { 17439 nest = nla_nest_start_noflag(msg, 17440 NL80211_ATTR_SCAN_FREQUENCIES); 17441 if (!nest) 17442 goto nla_put_failure; 17443 for (i = 0; i < req->n_channels; i++) { 17444 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 17445 goto nla_put_failure; 17446 } 17447 nla_nest_end(msg, nest); 17448 } 17449 17450 if (req->ie && 17451 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 17452 goto nla_put_failure; 17453 17454 if (req->flags && 17455 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 17456 goto nla_put_failure; 17457 17458 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 17459 &rdev->scan_req->info; 17460 if (info->scan_start_tsf && 17461 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 17462 info->scan_start_tsf, NL80211_BSS_PAD) || 17463 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 17464 info->tsf_bssid))) 17465 goto nla_put_failure; 17466 17467 return 0; 17468 nla_put_failure: 17469 return -ENOBUFS; 17470 } 17471 17472 static int nl80211_prep_scan_msg(struct sk_buff *msg, 17473 struct cfg80211_registered_device *rdev, 17474 struct wireless_dev *wdev, 17475 u32 portid, u32 seq, int flags, 17476 u32 cmd) 17477 { 17478 void *hdr; 17479 17480 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 17481 if (!hdr) 17482 return -1; 17483 17484 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17485 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17486 wdev->netdev->ifindex)) || 17487 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17488 NL80211_ATTR_PAD)) 17489 goto nla_put_failure; 17490 17491 /* ignore errors and send incomplete event anyway */ 17492 nl80211_add_scan_req(msg, rdev); 17493 17494 genlmsg_end(msg, hdr); 17495 return 0; 17496 17497 nla_put_failure: 17498 genlmsg_cancel(msg, hdr); 17499 return -EMSGSIZE; 17500 } 17501 17502 static int 17503 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 17504 struct cfg80211_sched_scan_request *req, u32 cmd) 17505 { 17506 void *hdr; 17507 17508 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 17509 if (!hdr) 17510 return -1; 17511 17512 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 17513 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 17514 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 17515 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 17516 NL80211_ATTR_PAD)) 17517 goto nla_put_failure; 17518 17519 genlmsg_end(msg, hdr); 17520 return 0; 17521 17522 nla_put_failure: 17523 genlmsg_cancel(msg, hdr); 17524 return -EMSGSIZE; 17525 } 17526 17527 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 17528 struct wireless_dev *wdev) 17529 { 17530 struct sk_buff *msg; 17531 17532 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17533 if (!msg) 17534 return; 17535 17536 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17537 NL80211_CMD_TRIGGER_SCAN) < 0) { 17538 nlmsg_free(msg); 17539 return; 17540 } 17541 17542 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17543 NL80211_MCGRP_SCAN, GFP_KERNEL); 17544 } 17545 17546 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 17547 struct wireless_dev *wdev, bool aborted) 17548 { 17549 struct sk_buff *msg; 17550 17551 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17552 if (!msg) 17553 return NULL; 17554 17555 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17556 aborted ? NL80211_CMD_SCAN_ABORTED : 17557 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 17558 nlmsg_free(msg); 17559 return NULL; 17560 } 17561 17562 return msg; 17563 } 17564 17565 /* send message created by nl80211_build_scan_msg() */ 17566 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 17567 struct sk_buff *msg) 17568 { 17569 if (!msg) 17570 return; 17571 17572 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17573 NL80211_MCGRP_SCAN, GFP_KERNEL); 17574 } 17575 17576 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 17577 { 17578 struct sk_buff *msg; 17579 17580 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17581 if (!msg) 17582 return; 17583 17584 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 17585 nlmsg_free(msg); 17586 return; 17587 } 17588 17589 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 17590 NL80211_MCGRP_SCAN, GFP_KERNEL); 17591 } 17592 17593 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 17594 struct regulatory_request *request) 17595 { 17596 /* Userspace can always count this one always being set */ 17597 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 17598 goto nla_put_failure; 17599 17600 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 17601 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17602 NL80211_REGDOM_TYPE_WORLD)) 17603 goto nla_put_failure; 17604 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 17605 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17606 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 17607 goto nla_put_failure; 17608 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 17609 request->intersect) { 17610 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17611 NL80211_REGDOM_TYPE_INTERSECTION)) 17612 goto nla_put_failure; 17613 } else { 17614 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17615 NL80211_REGDOM_TYPE_COUNTRY) || 17616 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 17617 request->alpha2)) 17618 goto nla_put_failure; 17619 } 17620 17621 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 17622 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 17623 17624 if (wiphy && 17625 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 17626 goto nla_put_failure; 17627 17628 if (wiphy && 17629 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 17630 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 17631 goto nla_put_failure; 17632 } 17633 17634 return true; 17635 17636 nla_put_failure: 17637 return false; 17638 } 17639 17640 /* 17641 * This can happen on global regulatory changes or device specific settings 17642 * based on custom regulatory domains. 17643 */ 17644 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 17645 struct regulatory_request *request) 17646 { 17647 struct sk_buff *msg; 17648 void *hdr; 17649 17650 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17651 if (!msg) 17652 return; 17653 17654 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 17655 if (!hdr) 17656 goto nla_put_failure; 17657 17658 if (!nl80211_reg_change_event_fill(msg, request)) 17659 goto nla_put_failure; 17660 17661 genlmsg_end(msg, hdr); 17662 17663 rcu_read_lock(); 17664 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 17665 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 17666 rcu_read_unlock(); 17667 17668 return; 17669 17670 nla_put_failure: 17671 nlmsg_free(msg); 17672 } 17673 17674 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 17675 struct net_device *netdev, 17676 const u8 *buf, size_t len, 17677 enum nl80211_commands cmd, gfp_t gfp, 17678 int uapsd_queues, const u8 *req_ies, 17679 size_t req_ies_len, bool reconnect) 17680 { 17681 struct sk_buff *msg; 17682 void *hdr; 17683 17684 msg = nlmsg_new(100 + len + req_ies_len, gfp); 17685 if (!msg) 17686 return; 17687 17688 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 17689 if (!hdr) { 17690 nlmsg_free(msg); 17691 return; 17692 } 17693 17694 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17695 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17696 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 17697 (req_ies && 17698 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies))) 17699 goto nla_put_failure; 17700 17701 if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED)) 17702 goto nla_put_failure; 17703 17704 if (uapsd_queues >= 0) { 17705 struct nlattr *nla_wmm = 17706 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 17707 if (!nla_wmm) 17708 goto nla_put_failure; 17709 17710 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 17711 uapsd_queues)) 17712 goto nla_put_failure; 17713 17714 nla_nest_end(msg, nla_wmm); 17715 } 17716 17717 genlmsg_end(msg, hdr); 17718 17719 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17720 NL80211_MCGRP_MLME, gfp); 17721 return; 17722 17723 nla_put_failure: 17724 nlmsg_free(msg); 17725 } 17726 17727 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 17728 struct net_device *netdev, const u8 *buf, 17729 size_t len, gfp_t gfp) 17730 { 17731 nl80211_send_mlme_event(rdev, netdev, buf, len, 17732 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0, 17733 false); 17734 } 17735 17736 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 17737 struct net_device *netdev, 17738 struct cfg80211_rx_assoc_resp *data) 17739 { 17740 nl80211_send_mlme_event(rdev, netdev, data->buf, data->len, 17741 NL80211_CMD_ASSOCIATE, GFP_KERNEL, 17742 data->uapsd_queues, 17743 data->req_ies, data->req_ies_len, false); 17744 } 17745 17746 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 17747 struct net_device *netdev, const u8 *buf, 17748 size_t len, bool reconnect, gfp_t gfp) 17749 { 17750 nl80211_send_mlme_event(rdev, netdev, buf, len, 17751 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0, 17752 reconnect); 17753 } 17754 17755 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 17756 struct net_device *netdev, const u8 *buf, 17757 size_t len, bool reconnect, gfp_t gfp) 17758 { 17759 nl80211_send_mlme_event(rdev, netdev, buf, len, 17760 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0, 17761 reconnect); 17762 } 17763 17764 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 17765 size_t len) 17766 { 17767 struct wireless_dev *wdev = dev->ieee80211_ptr; 17768 struct wiphy *wiphy = wdev->wiphy; 17769 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17770 const struct ieee80211_mgmt *mgmt = (void *)buf; 17771 u32 cmd; 17772 17773 if (WARN_ON(len < 2)) 17774 return; 17775 17776 if (ieee80211_is_deauth(mgmt->frame_control)) { 17777 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 17778 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 17779 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 17780 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 17781 if (wdev->unprot_beacon_reported && 17782 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 17783 return; 17784 cmd = NL80211_CMD_UNPROT_BEACON; 17785 wdev->unprot_beacon_reported = jiffies; 17786 } else { 17787 return; 17788 } 17789 17790 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 17791 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1, 17792 NULL, 0, false); 17793 } 17794 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 17795 17796 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 17797 struct net_device *netdev, int cmd, 17798 const u8 *addr, gfp_t gfp) 17799 { 17800 struct sk_buff *msg; 17801 void *hdr; 17802 17803 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17804 if (!msg) 17805 return; 17806 17807 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 17808 if (!hdr) { 17809 nlmsg_free(msg); 17810 return; 17811 } 17812 17813 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17814 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17815 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 17816 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 17817 goto nla_put_failure; 17818 17819 genlmsg_end(msg, hdr); 17820 17821 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17822 NL80211_MCGRP_MLME, gfp); 17823 return; 17824 17825 nla_put_failure: 17826 nlmsg_free(msg); 17827 } 17828 17829 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 17830 struct net_device *netdev, const u8 *addr, 17831 gfp_t gfp) 17832 { 17833 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 17834 addr, gfp); 17835 } 17836 17837 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 17838 struct net_device *netdev, const u8 *addr, 17839 gfp_t gfp) 17840 { 17841 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 17842 addr, gfp); 17843 } 17844 17845 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 17846 struct net_device *netdev, 17847 struct cfg80211_connect_resp_params *cr, 17848 gfp_t gfp) 17849 { 17850 struct sk_buff *msg; 17851 void *hdr; 17852 unsigned int link; 17853 size_t link_info_size = 0; 17854 const u8 *connected_addr = cr->valid_links ? 17855 cr->ap_mld_addr : cr->links[0].bssid; 17856 17857 if (cr->valid_links) { 17858 for_each_valid_link(cr, link) { 17859 /* Nested attribute header */ 17860 link_info_size += NLA_HDRLEN; 17861 /* Link ID */ 17862 link_info_size += nla_total_size(sizeof(u8)); 17863 link_info_size += cr->links[link].addr ? 17864 nla_total_size(ETH_ALEN) : 0; 17865 link_info_size += (cr->links[link].bssid || 17866 cr->links[link].bss) ? 17867 nla_total_size(ETH_ALEN) : 0; 17868 link_info_size += nla_total_size(sizeof(u16)); 17869 } 17870 } 17871 17872 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 17873 cr->fils.kek_len + cr->fils.pmk_len + 17874 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size, 17875 gfp); 17876 if (!msg) 17877 return; 17878 17879 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 17880 if (!hdr) { 17881 nlmsg_free(msg); 17882 return; 17883 } 17884 17885 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17886 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17887 (connected_addr && 17888 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) || 17889 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 17890 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 17891 cr->status) || 17892 (cr->status < 0 && 17893 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 17894 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 17895 cr->timeout_reason))) || 17896 (cr->req_ie && 17897 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 17898 (cr->resp_ie && 17899 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 17900 cr->resp_ie)) || 17901 (cr->fils.update_erp_next_seq_num && 17902 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 17903 cr->fils.erp_next_seq_num)) || 17904 (cr->status == WLAN_STATUS_SUCCESS && 17905 ((cr->fils.kek && 17906 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 17907 cr->fils.kek)) || 17908 (cr->fils.pmk && 17909 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 17910 (cr->fils.pmkid && 17911 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 17912 goto nla_put_failure; 17913 17914 if (cr->valid_links) { 17915 int i = 1; 17916 struct nlattr *nested; 17917 17918 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 17919 if (!nested) 17920 goto nla_put_failure; 17921 17922 for_each_valid_link(cr, link) { 17923 struct nlattr *nested_mlo_links; 17924 const u8 *bssid = cr->links[link].bss ? 17925 cr->links[link].bss->bssid : 17926 cr->links[link].bssid; 17927 17928 nested_mlo_links = nla_nest_start(msg, i); 17929 if (!nested_mlo_links) 17930 goto nla_put_failure; 17931 17932 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 17933 (bssid && 17934 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 17935 (cr->links[link].addr && 17936 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 17937 cr->links[link].addr)) || 17938 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 17939 cr->links[link].status)) 17940 goto nla_put_failure; 17941 17942 nla_nest_end(msg, nested_mlo_links); 17943 i++; 17944 } 17945 nla_nest_end(msg, nested); 17946 } 17947 17948 genlmsg_end(msg, hdr); 17949 17950 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17951 NL80211_MCGRP_MLME, gfp); 17952 return; 17953 17954 nla_put_failure: 17955 nlmsg_free(msg); 17956 } 17957 17958 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 17959 struct net_device *netdev, 17960 struct cfg80211_roam_info *info, gfp_t gfp) 17961 { 17962 struct sk_buff *msg; 17963 void *hdr; 17964 size_t link_info_size = 0; 17965 unsigned int link; 17966 const u8 *connected_addr = info->ap_mld_addr ? 17967 info->ap_mld_addr : 17968 (info->links[0].bss ? 17969 info->links[0].bss->bssid : 17970 info->links[0].bssid); 17971 17972 if (info->valid_links) { 17973 for_each_valid_link(info, link) { 17974 /* Nested attribute header */ 17975 link_info_size += NLA_HDRLEN; 17976 /* Link ID */ 17977 link_info_size += nla_total_size(sizeof(u8)); 17978 link_info_size += info->links[link].addr ? 17979 nla_total_size(ETH_ALEN) : 0; 17980 link_info_size += (info->links[link].bssid || 17981 info->links[link].bss) ? 17982 nla_total_size(ETH_ALEN) : 0; 17983 } 17984 } 17985 17986 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 17987 info->fils.kek_len + info->fils.pmk_len + 17988 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) + 17989 link_info_size, gfp); 17990 if (!msg) 17991 return; 17992 17993 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 17994 if (!hdr) { 17995 nlmsg_free(msg); 17996 return; 17997 } 17998 17999 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18000 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18001 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) || 18002 (info->req_ie && 18003 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 18004 info->req_ie)) || 18005 (info->resp_ie && 18006 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 18007 info->resp_ie)) || 18008 (info->fils.update_erp_next_seq_num && 18009 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 18010 info->fils.erp_next_seq_num)) || 18011 (info->fils.kek && 18012 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 18013 info->fils.kek)) || 18014 (info->fils.pmk && 18015 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 18016 (info->fils.pmkid && 18017 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 18018 goto nla_put_failure; 18019 18020 if (info->valid_links) { 18021 int i = 1; 18022 struct nlattr *nested; 18023 18024 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18025 if (!nested) 18026 goto nla_put_failure; 18027 18028 for_each_valid_link(info, link) { 18029 struct nlattr *nested_mlo_links; 18030 const u8 *bssid = info->links[link].bss ? 18031 info->links[link].bss->bssid : 18032 info->links[link].bssid; 18033 18034 nested_mlo_links = nla_nest_start(msg, i); 18035 if (!nested_mlo_links) 18036 goto nla_put_failure; 18037 18038 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 18039 (bssid && 18040 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 18041 (info->links[link].addr && 18042 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 18043 info->links[link].addr))) 18044 goto nla_put_failure; 18045 18046 nla_nest_end(msg, nested_mlo_links); 18047 i++; 18048 } 18049 nla_nest_end(msg, nested); 18050 } 18051 18052 genlmsg_end(msg, hdr); 18053 18054 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18055 NL80211_MCGRP_MLME, gfp); 18056 return; 18057 18058 nla_put_failure: 18059 nlmsg_free(msg); 18060 } 18061 18062 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 18063 struct net_device *netdev, const u8 *bssid, 18064 const u8 *td_bitmap, u8 td_bitmap_len) 18065 { 18066 struct sk_buff *msg; 18067 void *hdr; 18068 18069 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18070 if (!msg) 18071 return; 18072 18073 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 18074 if (!hdr) { 18075 nlmsg_free(msg); 18076 return; 18077 } 18078 18079 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18080 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18081 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 18082 goto nla_put_failure; 18083 18084 if ((td_bitmap_len > 0) && td_bitmap) 18085 if (nla_put(msg, NL80211_ATTR_TD_BITMAP, 18086 td_bitmap_len, td_bitmap)) 18087 goto nla_put_failure; 18088 18089 genlmsg_end(msg, hdr); 18090 18091 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18092 NL80211_MCGRP_MLME, GFP_KERNEL); 18093 return; 18094 18095 nla_put_failure: 18096 nlmsg_free(msg); 18097 } 18098 18099 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 18100 struct net_device *netdev, u16 reason, 18101 const u8 *ie, size_t ie_len, bool from_ap) 18102 { 18103 struct sk_buff *msg; 18104 void *hdr; 18105 18106 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 18107 if (!msg) 18108 return; 18109 18110 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 18111 if (!hdr) { 18112 nlmsg_free(msg); 18113 return; 18114 } 18115 18116 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18117 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18118 (reason && 18119 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 18120 (from_ap && 18121 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 18122 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 18123 goto nla_put_failure; 18124 18125 genlmsg_end(msg, hdr); 18126 18127 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18128 NL80211_MCGRP_MLME, GFP_KERNEL); 18129 return; 18130 18131 nla_put_failure: 18132 nlmsg_free(msg); 18133 } 18134 18135 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 18136 struct net_device *netdev, const u8 *bssid, 18137 gfp_t gfp) 18138 { 18139 struct sk_buff *msg; 18140 void *hdr; 18141 18142 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18143 if (!msg) 18144 return; 18145 18146 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 18147 if (!hdr) { 18148 nlmsg_free(msg); 18149 return; 18150 } 18151 18152 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18153 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18154 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 18155 goto nla_put_failure; 18156 18157 genlmsg_end(msg, hdr); 18158 18159 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18160 NL80211_MCGRP_MLME, gfp); 18161 return; 18162 18163 nla_put_failure: 18164 nlmsg_free(msg); 18165 } 18166 18167 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 18168 const u8 *ie, u8 ie_len, 18169 int sig_dbm, gfp_t gfp) 18170 { 18171 struct wireless_dev *wdev = dev->ieee80211_ptr; 18172 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18173 struct sk_buff *msg; 18174 void *hdr; 18175 18176 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 18177 return; 18178 18179 trace_cfg80211_notify_new_peer_candidate(dev, addr); 18180 18181 msg = nlmsg_new(100 + ie_len, gfp); 18182 if (!msg) 18183 return; 18184 18185 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 18186 if (!hdr) { 18187 nlmsg_free(msg); 18188 return; 18189 } 18190 18191 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18192 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18193 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 18194 (ie_len && ie && 18195 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 18196 (sig_dbm && 18197 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 18198 goto nla_put_failure; 18199 18200 genlmsg_end(msg, hdr); 18201 18202 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18203 NL80211_MCGRP_MLME, gfp); 18204 return; 18205 18206 nla_put_failure: 18207 nlmsg_free(msg); 18208 } 18209 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 18210 18211 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 18212 struct net_device *netdev, const u8 *addr, 18213 enum nl80211_key_type key_type, int key_id, 18214 const u8 *tsc, gfp_t gfp) 18215 { 18216 struct sk_buff *msg; 18217 void *hdr; 18218 18219 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18220 if (!msg) 18221 return; 18222 18223 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 18224 if (!hdr) { 18225 nlmsg_free(msg); 18226 return; 18227 } 18228 18229 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18230 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18231 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 18232 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 18233 (key_id != -1 && 18234 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 18235 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 18236 goto nla_put_failure; 18237 18238 genlmsg_end(msg, hdr); 18239 18240 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18241 NL80211_MCGRP_MLME, gfp); 18242 return; 18243 18244 nla_put_failure: 18245 nlmsg_free(msg); 18246 } 18247 18248 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 18249 struct ieee80211_channel *channel_before, 18250 struct ieee80211_channel *channel_after) 18251 { 18252 struct sk_buff *msg; 18253 void *hdr; 18254 struct nlattr *nl_freq; 18255 18256 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 18257 if (!msg) 18258 return; 18259 18260 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 18261 if (!hdr) { 18262 nlmsg_free(msg); 18263 return; 18264 } 18265 18266 /* 18267 * Since we are applying the beacon hint to a wiphy we know its 18268 * wiphy_idx is valid 18269 */ 18270 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 18271 goto nla_put_failure; 18272 18273 /* Before */ 18274 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 18275 if (!nl_freq) 18276 goto nla_put_failure; 18277 18278 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 18279 goto nla_put_failure; 18280 nla_nest_end(msg, nl_freq); 18281 18282 /* After */ 18283 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 18284 if (!nl_freq) 18285 goto nla_put_failure; 18286 18287 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 18288 goto nla_put_failure; 18289 nla_nest_end(msg, nl_freq); 18290 18291 genlmsg_end(msg, hdr); 18292 18293 rcu_read_lock(); 18294 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 18295 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 18296 rcu_read_unlock(); 18297 18298 return; 18299 18300 nla_put_failure: 18301 nlmsg_free(msg); 18302 } 18303 18304 static void nl80211_send_remain_on_chan_event( 18305 int cmd, struct cfg80211_registered_device *rdev, 18306 struct wireless_dev *wdev, u64 cookie, 18307 struct ieee80211_channel *chan, 18308 unsigned int duration, gfp_t gfp) 18309 { 18310 struct sk_buff *msg; 18311 void *hdr; 18312 18313 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18314 if (!msg) 18315 return; 18316 18317 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18318 if (!hdr) { 18319 nlmsg_free(msg); 18320 return; 18321 } 18322 18323 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18324 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18325 wdev->netdev->ifindex)) || 18326 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18327 NL80211_ATTR_PAD) || 18328 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 18329 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 18330 NL80211_CHAN_NO_HT) || 18331 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 18332 NL80211_ATTR_PAD)) 18333 goto nla_put_failure; 18334 18335 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 18336 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 18337 goto nla_put_failure; 18338 18339 genlmsg_end(msg, hdr); 18340 18341 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18342 NL80211_MCGRP_MLME, gfp); 18343 return; 18344 18345 nla_put_failure: 18346 nlmsg_free(msg); 18347 } 18348 18349 void cfg80211_assoc_comeback(struct net_device *netdev, 18350 const u8 *ap_addr, u32 timeout) 18351 { 18352 struct wireless_dev *wdev = netdev->ieee80211_ptr; 18353 struct wiphy *wiphy = wdev->wiphy; 18354 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18355 struct sk_buff *msg; 18356 void *hdr; 18357 18358 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout); 18359 18360 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18361 if (!msg) 18362 return; 18363 18364 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK); 18365 if (!hdr) { 18366 nlmsg_free(msg); 18367 return; 18368 } 18369 18370 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18371 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18372 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) || 18373 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout)) 18374 goto nla_put_failure; 18375 18376 genlmsg_end(msg, hdr); 18377 18378 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18379 NL80211_MCGRP_MLME, GFP_KERNEL); 18380 return; 18381 18382 nla_put_failure: 18383 nlmsg_free(msg); 18384 } 18385 EXPORT_SYMBOL(cfg80211_assoc_comeback); 18386 18387 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 18388 struct ieee80211_channel *chan, 18389 unsigned int duration, gfp_t gfp) 18390 { 18391 struct wiphy *wiphy = wdev->wiphy; 18392 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18393 18394 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 18395 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 18396 rdev, wdev, cookie, chan, 18397 duration, gfp); 18398 } 18399 EXPORT_SYMBOL(cfg80211_ready_on_channel); 18400 18401 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 18402 struct ieee80211_channel *chan, 18403 gfp_t gfp) 18404 { 18405 struct wiphy *wiphy = wdev->wiphy; 18406 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18407 18408 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 18409 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 18410 rdev, wdev, cookie, chan, 0, gfp); 18411 } 18412 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 18413 18414 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 18415 struct ieee80211_channel *chan, 18416 gfp_t gfp) 18417 { 18418 struct wiphy *wiphy = wdev->wiphy; 18419 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18420 18421 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 18422 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 18423 rdev, wdev, cookie, chan, 0, gfp); 18424 } 18425 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 18426 18427 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 18428 struct station_info *sinfo, gfp_t gfp) 18429 { 18430 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18431 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18432 struct sk_buff *msg; 18433 18434 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 18435 18436 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18437 if (!msg) 18438 return; 18439 18440 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 18441 rdev, dev, mac_addr, sinfo) < 0) { 18442 nlmsg_free(msg); 18443 return; 18444 } 18445 18446 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18447 NL80211_MCGRP_MLME, gfp); 18448 } 18449 EXPORT_SYMBOL(cfg80211_new_sta); 18450 18451 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 18452 struct station_info *sinfo, gfp_t gfp) 18453 { 18454 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18455 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18456 struct sk_buff *msg; 18457 struct station_info empty_sinfo = {}; 18458 18459 if (!sinfo) 18460 sinfo = &empty_sinfo; 18461 18462 trace_cfg80211_del_sta(dev, mac_addr); 18463 18464 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18465 if (!msg) { 18466 cfg80211_sinfo_release_content(sinfo); 18467 return; 18468 } 18469 18470 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 18471 rdev, dev, mac_addr, sinfo) < 0) { 18472 nlmsg_free(msg); 18473 return; 18474 } 18475 18476 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18477 NL80211_MCGRP_MLME, gfp); 18478 } 18479 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 18480 18481 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 18482 enum nl80211_connect_failed_reason reason, 18483 gfp_t gfp) 18484 { 18485 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18486 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18487 struct sk_buff *msg; 18488 void *hdr; 18489 18490 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 18491 if (!msg) 18492 return; 18493 18494 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 18495 if (!hdr) { 18496 nlmsg_free(msg); 18497 return; 18498 } 18499 18500 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18501 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 18502 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 18503 goto nla_put_failure; 18504 18505 genlmsg_end(msg, hdr); 18506 18507 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18508 NL80211_MCGRP_MLME, gfp); 18509 return; 18510 18511 nla_put_failure: 18512 nlmsg_free(msg); 18513 } 18514 EXPORT_SYMBOL(cfg80211_conn_failed); 18515 18516 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 18517 const u8 *addr, gfp_t gfp) 18518 { 18519 struct wireless_dev *wdev = dev->ieee80211_ptr; 18520 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18521 struct sk_buff *msg; 18522 void *hdr; 18523 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 18524 18525 if (!nlportid) 18526 return false; 18527 18528 msg = nlmsg_new(100, gfp); 18529 if (!msg) 18530 return true; 18531 18532 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18533 if (!hdr) { 18534 nlmsg_free(msg); 18535 return true; 18536 } 18537 18538 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18539 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18540 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 18541 goto nla_put_failure; 18542 18543 genlmsg_end(msg, hdr); 18544 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18545 return true; 18546 18547 nla_put_failure: 18548 nlmsg_free(msg); 18549 return true; 18550 } 18551 18552 bool cfg80211_rx_spurious_frame(struct net_device *dev, 18553 const u8 *addr, gfp_t gfp) 18554 { 18555 struct wireless_dev *wdev = dev->ieee80211_ptr; 18556 bool ret; 18557 18558 trace_cfg80211_rx_spurious_frame(dev, addr); 18559 18560 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18561 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 18562 trace_cfg80211_return_bool(false); 18563 return false; 18564 } 18565 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 18566 addr, gfp); 18567 trace_cfg80211_return_bool(ret); 18568 return ret; 18569 } 18570 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 18571 18572 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 18573 const u8 *addr, gfp_t gfp) 18574 { 18575 struct wireless_dev *wdev = dev->ieee80211_ptr; 18576 bool ret; 18577 18578 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 18579 18580 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18581 wdev->iftype != NL80211_IFTYPE_P2P_GO && 18582 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 18583 trace_cfg80211_return_bool(false); 18584 return false; 18585 } 18586 ret = __nl80211_unexpected_frame(dev, 18587 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 18588 addr, gfp); 18589 trace_cfg80211_return_bool(ret); 18590 return ret; 18591 } 18592 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 18593 18594 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 18595 struct wireless_dev *wdev, u32 nlportid, 18596 struct cfg80211_rx_info *info, gfp_t gfp) 18597 { 18598 struct net_device *netdev = wdev->netdev; 18599 struct sk_buff *msg; 18600 void *hdr; 18601 18602 msg = nlmsg_new(100 + info->len, gfp); 18603 if (!msg) 18604 return -ENOMEM; 18605 18606 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 18607 if (!hdr) { 18608 nlmsg_free(msg); 18609 return -ENOMEM; 18610 } 18611 18612 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18613 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18614 netdev->ifindex)) || 18615 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18616 NL80211_ATTR_PAD) || 18617 (info->have_link_id && 18618 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) || 18619 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) || 18620 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) || 18621 (info->sig_dbm && 18622 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) || 18623 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) || 18624 (info->flags && 18625 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) || 18626 (info->rx_tstamp && nla_put_u64_64bit(msg, 18627 NL80211_ATTR_RX_HW_TIMESTAMP, 18628 info->rx_tstamp, 18629 NL80211_ATTR_PAD)) || 18630 (info->ack_tstamp && nla_put_u64_64bit(msg, 18631 NL80211_ATTR_TX_HW_TIMESTAMP, 18632 info->ack_tstamp, 18633 NL80211_ATTR_PAD))) 18634 goto nla_put_failure; 18635 18636 genlmsg_end(msg, hdr); 18637 18638 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18639 18640 nla_put_failure: 18641 nlmsg_free(msg); 18642 return -ENOBUFS; 18643 } 18644 18645 static void nl80211_frame_tx_status(struct wireless_dev *wdev, 18646 struct cfg80211_tx_status *status, 18647 gfp_t gfp, enum nl80211_commands command) 18648 { 18649 struct wiphy *wiphy = wdev->wiphy; 18650 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18651 struct net_device *netdev = wdev->netdev; 18652 struct sk_buff *msg; 18653 void *hdr; 18654 18655 if (command == NL80211_CMD_FRAME_TX_STATUS) 18656 trace_cfg80211_mgmt_tx_status(wdev, status->cookie, 18657 status->ack); 18658 else 18659 trace_cfg80211_control_port_tx_status(wdev, status->cookie, 18660 status->ack); 18661 18662 msg = nlmsg_new(100 + status->len, gfp); 18663 if (!msg) 18664 return; 18665 18666 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 18667 if (!hdr) { 18668 nlmsg_free(msg); 18669 return; 18670 } 18671 18672 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18673 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18674 netdev->ifindex)) || 18675 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18676 NL80211_ATTR_PAD) || 18677 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) || 18678 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie, 18679 NL80211_ATTR_PAD) || 18680 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) || 18681 (status->tx_tstamp && 18682 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP, 18683 status->tx_tstamp, NL80211_ATTR_PAD)) || 18684 (status->ack_tstamp && 18685 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP, 18686 status->ack_tstamp, NL80211_ATTR_PAD))) 18687 goto nla_put_failure; 18688 18689 genlmsg_end(msg, hdr); 18690 18691 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18692 NL80211_MCGRP_MLME, gfp); 18693 return; 18694 18695 nla_put_failure: 18696 nlmsg_free(msg); 18697 } 18698 18699 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 18700 const u8 *buf, size_t len, bool ack, 18701 gfp_t gfp) 18702 { 18703 struct cfg80211_tx_status status = { 18704 .cookie = cookie, 18705 .buf = buf, 18706 .len = len, 18707 .ack = ack 18708 }; 18709 18710 nl80211_frame_tx_status(wdev, &status, gfp, 18711 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 18712 } 18713 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 18714 18715 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev, 18716 struct cfg80211_tx_status *status, gfp_t gfp) 18717 { 18718 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS); 18719 } 18720 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext); 18721 18722 static int __nl80211_rx_control_port(struct net_device *dev, 18723 struct sk_buff *skb, 18724 bool unencrypted, gfp_t gfp) 18725 { 18726 struct wireless_dev *wdev = dev->ieee80211_ptr; 18727 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18728 struct ethhdr *ehdr = eth_hdr(skb); 18729 const u8 *addr = ehdr->h_source; 18730 u16 proto = be16_to_cpu(skb->protocol); 18731 struct sk_buff *msg; 18732 void *hdr; 18733 struct nlattr *frame; 18734 18735 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 18736 18737 if (!nlportid) 18738 return -ENOENT; 18739 18740 msg = nlmsg_new(100 + skb->len, gfp); 18741 if (!msg) 18742 return -ENOMEM; 18743 18744 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 18745 if (!hdr) { 18746 nlmsg_free(msg); 18747 return -ENOBUFS; 18748 } 18749 18750 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18751 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18752 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18753 NL80211_ATTR_PAD) || 18754 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 18755 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 18756 (unencrypted && nla_put_flag(msg, 18757 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 18758 goto nla_put_failure; 18759 18760 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 18761 if (!frame) 18762 goto nla_put_failure; 18763 18764 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 18765 genlmsg_end(msg, hdr); 18766 18767 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18768 18769 nla_put_failure: 18770 nlmsg_free(msg); 18771 return -ENOBUFS; 18772 } 18773 18774 bool cfg80211_rx_control_port(struct net_device *dev, 18775 struct sk_buff *skb, bool unencrypted) 18776 { 18777 int ret; 18778 18779 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 18780 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 18781 trace_cfg80211_return_bool(ret == 0); 18782 return ret == 0; 18783 } 18784 EXPORT_SYMBOL(cfg80211_rx_control_port); 18785 18786 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 18787 const char *mac, gfp_t gfp) 18788 { 18789 struct wireless_dev *wdev = dev->ieee80211_ptr; 18790 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18791 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18792 void **cb; 18793 18794 if (!msg) 18795 return NULL; 18796 18797 cb = (void **)msg->cb; 18798 18799 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 18800 if (!cb[0]) { 18801 nlmsg_free(msg); 18802 return NULL; 18803 } 18804 18805 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18806 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 18807 goto nla_put_failure; 18808 18809 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 18810 goto nla_put_failure; 18811 18812 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 18813 if (!cb[1]) 18814 goto nla_put_failure; 18815 18816 cb[2] = rdev; 18817 18818 return msg; 18819 nla_put_failure: 18820 nlmsg_free(msg); 18821 return NULL; 18822 } 18823 18824 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 18825 { 18826 void **cb = (void **)msg->cb; 18827 struct cfg80211_registered_device *rdev = cb[2]; 18828 18829 nla_nest_end(msg, cb[1]); 18830 genlmsg_end(msg, cb[0]); 18831 18832 memset(msg->cb, 0, sizeof(msg->cb)); 18833 18834 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18835 NL80211_MCGRP_MLME, gfp); 18836 } 18837 18838 void cfg80211_cqm_rssi_notify(struct net_device *dev, 18839 enum nl80211_cqm_rssi_threshold_event rssi_event, 18840 s32 rssi_level, gfp_t gfp) 18841 { 18842 struct sk_buff *msg; 18843 struct wireless_dev *wdev = dev->ieee80211_ptr; 18844 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18845 18846 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 18847 18848 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 18849 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 18850 return; 18851 18852 if (wdev->cqm_config) { 18853 wdev->cqm_config->last_rssi_event_value = rssi_level; 18854 18855 cfg80211_cqm_rssi_update(rdev, dev); 18856 18857 if (rssi_level == 0) 18858 rssi_level = wdev->cqm_config->last_rssi_event_value; 18859 } 18860 18861 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 18862 if (!msg) 18863 return; 18864 18865 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 18866 rssi_event)) 18867 goto nla_put_failure; 18868 18869 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 18870 rssi_level)) 18871 goto nla_put_failure; 18872 18873 cfg80211_send_cqm(msg, gfp); 18874 18875 return; 18876 18877 nla_put_failure: 18878 nlmsg_free(msg); 18879 } 18880 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 18881 18882 void cfg80211_cqm_txe_notify(struct net_device *dev, 18883 const u8 *peer, u32 num_packets, 18884 u32 rate, u32 intvl, gfp_t gfp) 18885 { 18886 struct sk_buff *msg; 18887 18888 msg = cfg80211_prepare_cqm(dev, peer, gfp); 18889 if (!msg) 18890 return; 18891 18892 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 18893 goto nla_put_failure; 18894 18895 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 18896 goto nla_put_failure; 18897 18898 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 18899 goto nla_put_failure; 18900 18901 cfg80211_send_cqm(msg, gfp); 18902 return; 18903 18904 nla_put_failure: 18905 nlmsg_free(msg); 18906 } 18907 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 18908 18909 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 18910 const u8 *peer, u32 num_packets, gfp_t gfp) 18911 { 18912 struct sk_buff *msg; 18913 18914 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 18915 18916 msg = cfg80211_prepare_cqm(dev, peer, gfp); 18917 if (!msg) 18918 return; 18919 18920 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 18921 goto nla_put_failure; 18922 18923 cfg80211_send_cqm(msg, gfp); 18924 return; 18925 18926 nla_put_failure: 18927 nlmsg_free(msg); 18928 } 18929 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 18930 18931 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 18932 { 18933 struct sk_buff *msg; 18934 18935 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 18936 if (!msg) 18937 return; 18938 18939 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 18940 goto nla_put_failure; 18941 18942 cfg80211_send_cqm(msg, gfp); 18943 return; 18944 18945 nla_put_failure: 18946 nlmsg_free(msg); 18947 } 18948 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 18949 18950 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 18951 struct net_device *netdev, const u8 *bssid, 18952 const u8 *replay_ctr, gfp_t gfp) 18953 { 18954 struct sk_buff *msg; 18955 struct nlattr *rekey_attr; 18956 void *hdr; 18957 18958 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18959 if (!msg) 18960 return; 18961 18962 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 18963 if (!hdr) { 18964 nlmsg_free(msg); 18965 return; 18966 } 18967 18968 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18969 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18970 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 18971 goto nla_put_failure; 18972 18973 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 18974 if (!rekey_attr) 18975 goto nla_put_failure; 18976 18977 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 18978 NL80211_REPLAY_CTR_LEN, replay_ctr)) 18979 goto nla_put_failure; 18980 18981 nla_nest_end(msg, rekey_attr); 18982 18983 genlmsg_end(msg, hdr); 18984 18985 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18986 NL80211_MCGRP_MLME, gfp); 18987 return; 18988 18989 nla_put_failure: 18990 nlmsg_free(msg); 18991 } 18992 18993 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 18994 const u8 *replay_ctr, gfp_t gfp) 18995 { 18996 struct wireless_dev *wdev = dev->ieee80211_ptr; 18997 struct wiphy *wiphy = wdev->wiphy; 18998 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18999 19000 trace_cfg80211_gtk_rekey_notify(dev, bssid); 19001 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 19002 } 19003 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 19004 19005 static void 19006 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 19007 struct net_device *netdev, int index, 19008 const u8 *bssid, bool preauth, gfp_t gfp) 19009 { 19010 struct sk_buff *msg; 19011 struct nlattr *attr; 19012 void *hdr; 19013 19014 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19015 if (!msg) 19016 return; 19017 19018 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 19019 if (!hdr) { 19020 nlmsg_free(msg); 19021 return; 19022 } 19023 19024 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19025 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19026 goto nla_put_failure; 19027 19028 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 19029 if (!attr) 19030 goto nla_put_failure; 19031 19032 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 19033 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 19034 (preauth && 19035 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 19036 goto nla_put_failure; 19037 19038 nla_nest_end(msg, attr); 19039 19040 genlmsg_end(msg, hdr); 19041 19042 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19043 NL80211_MCGRP_MLME, gfp); 19044 return; 19045 19046 nla_put_failure: 19047 nlmsg_free(msg); 19048 } 19049 19050 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 19051 const u8 *bssid, bool preauth, gfp_t gfp) 19052 { 19053 struct wireless_dev *wdev = dev->ieee80211_ptr; 19054 struct wiphy *wiphy = wdev->wiphy; 19055 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19056 19057 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 19058 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 19059 } 19060 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 19061 19062 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 19063 struct net_device *netdev, 19064 unsigned int link_id, 19065 struct cfg80211_chan_def *chandef, 19066 gfp_t gfp, 19067 enum nl80211_commands notif, 19068 u8 count, bool quiet, u16 punct_bitmap) 19069 { 19070 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19071 struct sk_buff *msg; 19072 void *hdr; 19073 19074 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19075 if (!msg) 19076 return; 19077 19078 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 19079 if (!hdr) { 19080 nlmsg_free(msg); 19081 return; 19082 } 19083 19084 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19085 goto nla_put_failure; 19086 19087 if (wdev->valid_links && 19088 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 19089 goto nla_put_failure; 19090 19091 if (nl80211_send_chandef(msg, chandef)) 19092 goto nla_put_failure; 19093 19094 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) { 19095 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)) 19096 goto nla_put_failure; 19097 if (quiet && 19098 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)) 19099 goto nla_put_failure; 19100 } 19101 19102 if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap)) 19103 goto nla_put_failure; 19104 19105 genlmsg_end(msg, hdr); 19106 19107 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19108 NL80211_MCGRP_MLME, gfp); 19109 return; 19110 19111 nla_put_failure: 19112 nlmsg_free(msg); 19113 } 19114 19115 void cfg80211_ch_switch_notify(struct net_device *dev, 19116 struct cfg80211_chan_def *chandef, 19117 unsigned int link_id, u16 punct_bitmap) 19118 { 19119 struct wireless_dev *wdev = dev->ieee80211_ptr; 19120 struct wiphy *wiphy = wdev->wiphy; 19121 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19122 19123 ASSERT_WDEV_LOCK(wdev); 19124 WARN_INVALID_LINK_ID(wdev, link_id); 19125 19126 trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap); 19127 19128 switch (wdev->iftype) { 19129 case NL80211_IFTYPE_STATION: 19130 case NL80211_IFTYPE_P2P_CLIENT: 19131 if (!WARN_ON(!wdev->links[link_id].client.current_bss)) 19132 cfg80211_update_assoc_bss_entry(wdev, link_id, 19133 chandef->chan); 19134 break; 19135 case NL80211_IFTYPE_MESH_POINT: 19136 wdev->u.mesh.chandef = *chandef; 19137 wdev->u.mesh.preset_chandef = *chandef; 19138 break; 19139 case NL80211_IFTYPE_AP: 19140 case NL80211_IFTYPE_P2P_GO: 19141 wdev->links[link_id].ap.chandef = *chandef; 19142 break; 19143 case NL80211_IFTYPE_ADHOC: 19144 wdev->u.ibss.chandef = *chandef; 19145 break; 19146 default: 19147 WARN_ON(1); 19148 break; 19149 } 19150 19151 cfg80211_sched_dfs_chan_update(rdev); 19152 19153 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19154 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false, 19155 punct_bitmap); 19156 } 19157 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 19158 19159 void cfg80211_ch_switch_started_notify(struct net_device *dev, 19160 struct cfg80211_chan_def *chandef, 19161 unsigned int link_id, u8 count, 19162 bool quiet, u16 punct_bitmap) 19163 { 19164 struct wireless_dev *wdev = dev->ieee80211_ptr; 19165 struct wiphy *wiphy = wdev->wiphy; 19166 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19167 19168 ASSERT_WDEV_LOCK(wdev); 19169 WARN_INVALID_LINK_ID(wdev, link_id); 19170 19171 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id, 19172 punct_bitmap); 19173 19174 19175 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19176 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, 19177 count, quiet, punct_bitmap); 19178 } 19179 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 19180 19181 int cfg80211_bss_color_notify(struct net_device *dev, 19182 enum nl80211_commands cmd, u8 count, 19183 u64 color_bitmap) 19184 { 19185 struct wireless_dev *wdev = dev->ieee80211_ptr; 19186 struct wiphy *wiphy = wdev->wiphy; 19187 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19188 struct sk_buff *msg; 19189 void *hdr; 19190 19191 ASSERT_WDEV_LOCK(wdev); 19192 19193 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap); 19194 19195 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 19196 if (!msg) 19197 return -ENOMEM; 19198 19199 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 19200 if (!hdr) 19201 goto nla_put_failure; 19202 19203 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19204 goto nla_put_failure; 19205 19206 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED && 19207 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count)) 19208 goto nla_put_failure; 19209 19210 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION && 19211 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP, 19212 color_bitmap, NL80211_ATTR_PAD)) 19213 goto nla_put_failure; 19214 19215 genlmsg_end(msg, hdr); 19216 19217 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 19218 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL); 19219 19220 nla_put_failure: 19221 nlmsg_free(msg); 19222 return -EINVAL; 19223 } 19224 EXPORT_SYMBOL(cfg80211_bss_color_notify); 19225 19226 void 19227 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 19228 const struct cfg80211_chan_def *chandef, 19229 enum nl80211_radar_event event, 19230 struct net_device *netdev, gfp_t gfp) 19231 { 19232 struct sk_buff *msg; 19233 void *hdr; 19234 19235 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19236 if (!msg) 19237 return; 19238 19239 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 19240 if (!hdr) { 19241 nlmsg_free(msg); 19242 return; 19243 } 19244 19245 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19246 goto nla_put_failure; 19247 19248 /* NOP and radar events don't need a netdev parameter */ 19249 if (netdev) { 19250 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19251 19252 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19253 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19254 NL80211_ATTR_PAD)) 19255 goto nla_put_failure; 19256 } 19257 19258 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 19259 goto nla_put_failure; 19260 19261 if (nl80211_send_chandef(msg, chandef)) 19262 goto nla_put_failure; 19263 19264 genlmsg_end(msg, hdr); 19265 19266 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19267 NL80211_MCGRP_MLME, gfp); 19268 return; 19269 19270 nla_put_failure: 19271 nlmsg_free(msg); 19272 } 19273 19274 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 19275 struct sta_opmode_info *sta_opmode, 19276 gfp_t gfp) 19277 { 19278 struct sk_buff *msg; 19279 struct wireless_dev *wdev = dev->ieee80211_ptr; 19280 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19281 void *hdr; 19282 19283 if (WARN_ON(!mac)) 19284 return; 19285 19286 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19287 if (!msg) 19288 return; 19289 19290 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 19291 if (!hdr) { 19292 nlmsg_free(msg); 19293 return; 19294 } 19295 19296 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19297 goto nla_put_failure; 19298 19299 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19300 goto nla_put_failure; 19301 19302 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 19303 goto nla_put_failure; 19304 19305 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 19306 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 19307 goto nla_put_failure; 19308 19309 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 19310 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 19311 goto nla_put_failure; 19312 19313 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 19314 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 19315 goto nla_put_failure; 19316 19317 genlmsg_end(msg, hdr); 19318 19319 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19320 NL80211_MCGRP_MLME, gfp); 19321 19322 return; 19323 19324 nla_put_failure: 19325 nlmsg_free(msg); 19326 } 19327 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 19328 19329 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 19330 u64 cookie, bool acked, s32 ack_signal, 19331 bool is_valid_ack_signal, gfp_t gfp) 19332 { 19333 struct wireless_dev *wdev = dev->ieee80211_ptr; 19334 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19335 struct sk_buff *msg; 19336 void *hdr; 19337 19338 trace_cfg80211_probe_status(dev, addr, cookie, acked); 19339 19340 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19341 19342 if (!msg) 19343 return; 19344 19345 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 19346 if (!hdr) { 19347 nlmsg_free(msg); 19348 return; 19349 } 19350 19351 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19352 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19353 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 19354 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 19355 NL80211_ATTR_PAD) || 19356 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 19357 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 19358 ack_signal))) 19359 goto nla_put_failure; 19360 19361 genlmsg_end(msg, hdr); 19362 19363 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19364 NL80211_MCGRP_MLME, gfp); 19365 return; 19366 19367 nla_put_failure: 19368 nlmsg_free(msg); 19369 } 19370 EXPORT_SYMBOL(cfg80211_probe_status); 19371 19372 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 19373 size_t len, int freq, int sig_dbm) 19374 { 19375 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19376 struct sk_buff *msg; 19377 void *hdr; 19378 struct cfg80211_beacon_registration *reg; 19379 19380 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 19381 19382 spin_lock_bh(&rdev->beacon_registrations_lock); 19383 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 19384 msg = nlmsg_new(len + 100, GFP_ATOMIC); 19385 if (!msg) { 19386 spin_unlock_bh(&rdev->beacon_registrations_lock); 19387 return; 19388 } 19389 19390 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 19391 if (!hdr) 19392 goto nla_put_failure; 19393 19394 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19395 (freq && 19396 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 19397 KHZ_TO_MHZ(freq)) || 19398 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 19399 freq % 1000))) || 19400 (sig_dbm && 19401 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 19402 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 19403 goto nla_put_failure; 19404 19405 genlmsg_end(msg, hdr); 19406 19407 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 19408 } 19409 spin_unlock_bh(&rdev->beacon_registrations_lock); 19410 return; 19411 19412 nla_put_failure: 19413 spin_unlock_bh(&rdev->beacon_registrations_lock); 19414 nlmsg_free(msg); 19415 } 19416 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 19417 19418 #ifdef CONFIG_PM 19419 static int cfg80211_net_detect_results(struct sk_buff *msg, 19420 struct cfg80211_wowlan_wakeup *wakeup) 19421 { 19422 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 19423 struct nlattr *nl_results, *nl_match, *nl_freqs; 19424 int i, j; 19425 19426 nl_results = nla_nest_start_noflag(msg, 19427 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 19428 if (!nl_results) 19429 return -EMSGSIZE; 19430 19431 for (i = 0; i < nd->n_matches; i++) { 19432 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 19433 19434 nl_match = nla_nest_start_noflag(msg, i); 19435 if (!nl_match) 19436 break; 19437 19438 /* The SSID attribute is optional in nl80211, but for 19439 * simplicity reasons it's always present in the 19440 * cfg80211 structure. If a driver can't pass the 19441 * SSID, that needs to be changed. A zero length SSID 19442 * is still a valid SSID (wildcard), so it cannot be 19443 * used for this purpose. 19444 */ 19445 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 19446 match->ssid.ssid)) { 19447 nla_nest_cancel(msg, nl_match); 19448 goto out; 19449 } 19450 19451 if (match->n_channels) { 19452 nl_freqs = nla_nest_start_noflag(msg, 19453 NL80211_ATTR_SCAN_FREQUENCIES); 19454 if (!nl_freqs) { 19455 nla_nest_cancel(msg, nl_match); 19456 goto out; 19457 } 19458 19459 for (j = 0; j < match->n_channels; j++) { 19460 if (nla_put_u32(msg, j, match->channels[j])) { 19461 nla_nest_cancel(msg, nl_freqs); 19462 nla_nest_cancel(msg, nl_match); 19463 goto out; 19464 } 19465 } 19466 19467 nla_nest_end(msg, nl_freqs); 19468 } 19469 19470 nla_nest_end(msg, nl_match); 19471 } 19472 19473 out: 19474 nla_nest_end(msg, nl_results); 19475 return 0; 19476 } 19477 19478 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 19479 struct cfg80211_wowlan_wakeup *wakeup, 19480 gfp_t gfp) 19481 { 19482 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19483 struct sk_buff *msg; 19484 void *hdr; 19485 int size = 200; 19486 19487 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 19488 19489 if (wakeup) 19490 size += wakeup->packet_present_len; 19491 19492 msg = nlmsg_new(size, gfp); 19493 if (!msg) 19494 return; 19495 19496 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 19497 if (!hdr) 19498 goto free_msg; 19499 19500 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19501 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19502 NL80211_ATTR_PAD)) 19503 goto free_msg; 19504 19505 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 19506 wdev->netdev->ifindex)) 19507 goto free_msg; 19508 19509 if (wakeup) { 19510 struct nlattr *reasons; 19511 19512 reasons = nla_nest_start_noflag(msg, 19513 NL80211_ATTR_WOWLAN_TRIGGERS); 19514 if (!reasons) 19515 goto free_msg; 19516 19517 if (wakeup->disconnect && 19518 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 19519 goto free_msg; 19520 if (wakeup->magic_pkt && 19521 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 19522 goto free_msg; 19523 if (wakeup->gtk_rekey_failure && 19524 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 19525 goto free_msg; 19526 if (wakeup->eap_identity_req && 19527 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 19528 goto free_msg; 19529 if (wakeup->four_way_handshake && 19530 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 19531 goto free_msg; 19532 if (wakeup->rfkill_release && 19533 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 19534 goto free_msg; 19535 19536 if (wakeup->pattern_idx >= 0 && 19537 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 19538 wakeup->pattern_idx)) 19539 goto free_msg; 19540 19541 if (wakeup->tcp_match && 19542 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 19543 goto free_msg; 19544 19545 if (wakeup->tcp_connlost && 19546 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 19547 goto free_msg; 19548 19549 if (wakeup->tcp_nomoretokens && 19550 nla_put_flag(msg, 19551 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 19552 goto free_msg; 19553 19554 if (wakeup->packet) { 19555 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 19556 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 19557 19558 if (!wakeup->packet_80211) { 19559 pkt_attr = 19560 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 19561 len_attr = 19562 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 19563 } 19564 19565 if (wakeup->packet_len && 19566 nla_put_u32(msg, len_attr, wakeup->packet_len)) 19567 goto free_msg; 19568 19569 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 19570 wakeup->packet)) 19571 goto free_msg; 19572 } 19573 19574 if (wakeup->net_detect && 19575 cfg80211_net_detect_results(msg, wakeup)) 19576 goto free_msg; 19577 19578 nla_nest_end(msg, reasons); 19579 } 19580 19581 genlmsg_end(msg, hdr); 19582 19583 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19584 NL80211_MCGRP_MLME, gfp); 19585 return; 19586 19587 free_msg: 19588 nlmsg_free(msg); 19589 } 19590 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 19591 #endif 19592 19593 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 19594 enum nl80211_tdls_operation oper, 19595 u16 reason_code, gfp_t gfp) 19596 { 19597 struct wireless_dev *wdev = dev->ieee80211_ptr; 19598 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19599 struct sk_buff *msg; 19600 void *hdr; 19601 19602 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 19603 reason_code); 19604 19605 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19606 if (!msg) 19607 return; 19608 19609 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 19610 if (!hdr) { 19611 nlmsg_free(msg); 19612 return; 19613 } 19614 19615 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19616 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19617 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 19618 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 19619 (reason_code > 0 && 19620 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 19621 goto nla_put_failure; 19622 19623 genlmsg_end(msg, hdr); 19624 19625 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19626 NL80211_MCGRP_MLME, gfp); 19627 return; 19628 19629 nla_put_failure: 19630 nlmsg_free(msg); 19631 } 19632 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 19633 19634 static int nl80211_netlink_notify(struct notifier_block * nb, 19635 unsigned long state, 19636 void *_notify) 19637 { 19638 struct netlink_notify *notify = _notify; 19639 struct cfg80211_registered_device *rdev; 19640 struct wireless_dev *wdev; 19641 struct cfg80211_beacon_registration *reg, *tmp; 19642 19643 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 19644 return NOTIFY_DONE; 19645 19646 rcu_read_lock(); 19647 19648 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 19649 struct cfg80211_sched_scan_request *sched_scan_req; 19650 19651 list_for_each_entry_rcu(sched_scan_req, 19652 &rdev->sched_scan_req_list, 19653 list) { 19654 if (sched_scan_req->owner_nlportid == notify->portid) { 19655 sched_scan_req->nl_owner_dead = true; 19656 schedule_work(&rdev->sched_scan_stop_wk); 19657 } 19658 } 19659 19660 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 19661 cfg80211_mlme_unregister_socket(wdev, notify->portid); 19662 19663 if (wdev->owner_nlportid == notify->portid) { 19664 wdev->nl_owner_dead = true; 19665 schedule_work(&rdev->destroy_work); 19666 } else if (wdev->conn_owner_nlportid == notify->portid) { 19667 schedule_work(&wdev->disconnect_wk); 19668 } 19669 19670 cfg80211_release_pmsr(wdev, notify->portid); 19671 } 19672 19673 spin_lock_bh(&rdev->beacon_registrations_lock); 19674 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 19675 list) { 19676 if (reg->nlportid == notify->portid) { 19677 list_del(®->list); 19678 kfree(reg); 19679 break; 19680 } 19681 } 19682 spin_unlock_bh(&rdev->beacon_registrations_lock); 19683 } 19684 19685 rcu_read_unlock(); 19686 19687 /* 19688 * It is possible that the user space process that is controlling the 19689 * indoor setting disappeared, so notify the regulatory core. 19690 */ 19691 regulatory_netlink_notify(notify->portid); 19692 return NOTIFY_OK; 19693 } 19694 19695 static struct notifier_block nl80211_netlink_notifier = { 19696 .notifier_call = nl80211_netlink_notify, 19697 }; 19698 19699 void cfg80211_ft_event(struct net_device *netdev, 19700 struct cfg80211_ft_event_params *ft_event) 19701 { 19702 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 19703 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19704 struct sk_buff *msg; 19705 void *hdr; 19706 19707 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 19708 19709 if (!ft_event->target_ap) 19710 return; 19711 19712 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 19713 GFP_KERNEL); 19714 if (!msg) 19715 return; 19716 19717 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 19718 if (!hdr) 19719 goto out; 19720 19721 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19722 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19723 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 19724 goto out; 19725 19726 if (ft_event->ies && 19727 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 19728 goto out; 19729 if (ft_event->ric_ies && 19730 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 19731 ft_event->ric_ies)) 19732 goto out; 19733 19734 genlmsg_end(msg, hdr); 19735 19736 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19737 NL80211_MCGRP_MLME, GFP_KERNEL); 19738 return; 19739 out: 19740 nlmsg_free(msg); 19741 } 19742 EXPORT_SYMBOL(cfg80211_ft_event); 19743 19744 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 19745 { 19746 struct cfg80211_registered_device *rdev; 19747 struct sk_buff *msg; 19748 void *hdr; 19749 u32 nlportid; 19750 19751 rdev = wiphy_to_rdev(wdev->wiphy); 19752 if (!rdev->crit_proto_nlportid) 19753 return; 19754 19755 nlportid = rdev->crit_proto_nlportid; 19756 rdev->crit_proto_nlportid = 0; 19757 19758 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19759 if (!msg) 19760 return; 19761 19762 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 19763 if (!hdr) 19764 goto nla_put_failure; 19765 19766 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19767 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19768 NL80211_ATTR_PAD)) 19769 goto nla_put_failure; 19770 19771 genlmsg_end(msg, hdr); 19772 19773 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 19774 return; 19775 19776 nla_put_failure: 19777 nlmsg_free(msg); 19778 } 19779 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 19780 19781 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id) 19782 { 19783 struct wiphy *wiphy = wdev->wiphy; 19784 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19785 struct sk_buff *msg; 19786 void *hdr; 19787 19788 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 19789 if (!msg) 19790 return; 19791 19792 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 19793 if (!hdr) 19794 goto out; 19795 19796 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19797 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 19798 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19799 NL80211_ATTR_PAD) || 19800 (wdev->valid_links && 19801 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 19802 goto out; 19803 19804 genlmsg_end(msg, hdr); 19805 19806 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 19807 NL80211_MCGRP_MLME, GFP_KERNEL); 19808 return; 19809 out: 19810 nlmsg_free(msg); 19811 } 19812 19813 int cfg80211_external_auth_request(struct net_device *dev, 19814 struct cfg80211_external_auth_params *params, 19815 gfp_t gfp) 19816 { 19817 struct wireless_dev *wdev = dev->ieee80211_ptr; 19818 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19819 struct sk_buff *msg; 19820 void *hdr; 19821 19822 if (!wdev->conn_owner_nlportid) 19823 return -EINVAL; 19824 19825 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19826 if (!msg) 19827 return -ENOMEM; 19828 19829 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 19830 if (!hdr) 19831 goto nla_put_failure; 19832 19833 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19834 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19835 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 19836 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 19837 params->action) || 19838 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 19839 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 19840 params->ssid.ssid) || 19841 (!is_zero_ether_addr(params->mld_addr) && 19842 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr))) 19843 goto nla_put_failure; 19844 19845 genlmsg_end(msg, hdr); 19846 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 19847 wdev->conn_owner_nlportid); 19848 return 0; 19849 19850 nla_put_failure: 19851 nlmsg_free(msg); 19852 return -ENOBUFS; 19853 } 19854 EXPORT_SYMBOL(cfg80211_external_auth_request); 19855 19856 void cfg80211_update_owe_info_event(struct net_device *netdev, 19857 struct cfg80211_update_owe_info *owe_info, 19858 gfp_t gfp) 19859 { 19860 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 19861 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19862 struct sk_buff *msg; 19863 void *hdr; 19864 19865 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 19866 19867 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19868 if (!msg) 19869 return; 19870 19871 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 19872 if (!hdr) 19873 goto nla_put_failure; 19874 19875 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19876 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19877 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 19878 goto nla_put_failure; 19879 19880 if (!owe_info->ie_len || 19881 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 19882 goto nla_put_failure; 19883 19884 if (owe_info->assoc_link_id != -1) { 19885 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 19886 owe_info->assoc_link_id)) 19887 goto nla_put_failure; 19888 19889 if (!is_zero_ether_addr(owe_info->peer_mld_addr) && 19890 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 19891 owe_info->peer_mld_addr)) 19892 goto nla_put_failure; 19893 } 19894 19895 genlmsg_end(msg, hdr); 19896 19897 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19898 NL80211_MCGRP_MLME, gfp); 19899 return; 19900 19901 nla_put_failure: 19902 genlmsg_cancel(msg, hdr); 19903 nlmsg_free(msg); 19904 } 19905 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 19906 19907 /* initialisation/exit functions */ 19908 19909 int __init nl80211_init(void) 19910 { 19911 int err; 19912 19913 err = genl_register_family(&nl80211_fam); 19914 if (err) 19915 return err; 19916 19917 err = netlink_register_notifier(&nl80211_netlink_notifier); 19918 if (err) 19919 goto err_out; 19920 19921 return 0; 19922 err_out: 19923 genl_unregister_family(&nl80211_fam); 19924 return err; 19925 } 19926 19927 void nl80211_exit(void) 19928 { 19929 netlink_unregister_notifier(&nl80211_netlink_notifier); 19930 genl_unregister_family(&nl80211_fam); 19931 } 19932