1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2020 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 68 { 69 struct cfg80211_registered_device *rdev; 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 ASSERT_RTNL(); 78 79 if (!have_ifidx && !have_wdev_id) 80 return ERR_PTR(-EINVAL); 81 82 if (have_ifidx) 83 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 84 if (have_wdev_id) { 85 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 86 wiphy_idx = wdev_id >> 32; 87 } 88 89 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 90 struct wireless_dev *wdev; 91 92 if (wiphy_net(&rdev->wiphy) != netns) 93 continue; 94 95 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 96 continue; 97 98 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 99 if (have_ifidx && wdev->netdev && 100 wdev->netdev->ifindex == ifidx) { 101 result = wdev; 102 break; 103 } 104 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 105 result = wdev; 106 break; 107 } 108 } 109 110 if (result) 111 break; 112 } 113 114 if (result) 115 return result; 116 return ERR_PTR(-ENODEV); 117 } 118 119 static struct cfg80211_registered_device * 120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 121 { 122 struct cfg80211_registered_device *rdev = NULL, *tmp; 123 struct net_device *netdev; 124 125 ASSERT_RTNL(); 126 127 if (!attrs[NL80211_ATTR_WIPHY] && 128 !attrs[NL80211_ATTR_IFINDEX] && 129 !attrs[NL80211_ATTR_WDEV]) 130 return ERR_PTR(-EINVAL); 131 132 if (attrs[NL80211_ATTR_WIPHY]) 133 rdev = cfg80211_rdev_by_wiphy_idx( 134 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 135 136 if (attrs[NL80211_ATTR_WDEV]) { 137 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 138 struct wireless_dev *wdev; 139 bool found = false; 140 141 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 142 if (tmp) { 143 /* make sure wdev exists */ 144 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 145 if (wdev->identifier != (u32)wdev_id) 146 continue; 147 found = true; 148 break; 149 } 150 151 if (!found) 152 tmp = NULL; 153 154 if (rdev && tmp != rdev) 155 return ERR_PTR(-EINVAL); 156 rdev = tmp; 157 } 158 } 159 160 if (attrs[NL80211_ATTR_IFINDEX]) { 161 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 162 163 netdev = __dev_get_by_index(netns, ifindex); 164 if (netdev) { 165 if (netdev->ieee80211_ptr) 166 tmp = wiphy_to_rdev( 167 netdev->ieee80211_ptr->wiphy); 168 else 169 tmp = NULL; 170 171 /* not wireless device -- return error */ 172 if (!tmp) 173 return ERR_PTR(-EINVAL); 174 175 /* mismatch -- return error */ 176 if (rdev && tmp != rdev) 177 return ERR_PTR(-EINVAL); 178 179 rdev = tmp; 180 } 181 } 182 183 if (!rdev) 184 return ERR_PTR(-ENODEV); 185 186 if (netns != wiphy_net(&rdev->wiphy)) 187 return ERR_PTR(-ENODEV); 188 189 return rdev; 190 } 191 192 /* 193 * This function returns a pointer to the driver 194 * that the genl_info item that is passed refers to. 195 * 196 * The result of this can be a PTR_ERR and hence must 197 * be checked with IS_ERR() for errors. 198 */ 199 static struct cfg80211_registered_device * 200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 201 { 202 return __cfg80211_rdev_from_attrs(netns, info->attrs); 203 } 204 205 static int validate_beacon_head(const struct nlattr *attr, 206 struct netlink_ext_ack *extack) 207 { 208 const u8 *data = nla_data(attr); 209 unsigned int len = nla_len(attr); 210 const struct element *elem; 211 const struct ieee80211_mgmt *mgmt = (void *)data; 212 bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 213 unsigned int fixedlen, hdrlen; 214 215 if (s1g_bcn) { 216 fixedlen = offsetof(struct ieee80211_ext, 217 u.s1g_beacon.variable); 218 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 219 } else { 220 fixedlen = offsetof(struct ieee80211_mgmt, 221 u.beacon.variable); 222 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 223 } 224 225 if (len < fixedlen) 226 goto err; 227 228 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 229 goto err; 230 231 data += fixedlen; 232 len -= fixedlen; 233 234 for_each_element(elem, data, len) { 235 /* nothing */ 236 } 237 238 if (for_each_element_completed(elem, data, len)) 239 return 0; 240 241 err: 242 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 243 return -EINVAL; 244 } 245 246 static int validate_ie_attr(const struct nlattr *attr, 247 struct netlink_ext_ack *extack) 248 { 249 const u8 *data = nla_data(attr); 250 unsigned int len = nla_len(attr); 251 const struct element *elem; 252 253 for_each_element(elem, data, len) { 254 /* nothing */ 255 } 256 257 if (for_each_element_completed(elem, data, len)) 258 return 0; 259 260 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 261 return -EINVAL; 262 } 263 264 /* policy for the attributes */ 265 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 266 267 static const struct nla_policy 268 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 269 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 270 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 271 .len = U8_MAX }, 272 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 273 .len = U8_MAX }, 274 }; 275 276 static const struct nla_policy 277 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 278 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 279 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 280 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 281 NLA_POLICY_MAX(NLA_U8, 15), 282 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 283 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 284 NLA_POLICY_MAX(NLA_U8, 15), 285 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 286 NLA_POLICY_MAX(NLA_U8, 31), 287 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 288 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 289 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 290 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 291 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 292 }; 293 294 static const struct nla_policy 295 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 296 [NL80211_PMSR_TYPE_FTM] = 297 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 298 }; 299 300 static const struct nla_policy 301 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 302 [NL80211_PMSR_REQ_ATTR_DATA] = 303 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 304 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 305 }; 306 307 static const struct nla_policy 308 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 309 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 310 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 311 [NL80211_PMSR_PEER_ATTR_REQ] = 312 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 313 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 314 }; 315 316 static const struct nla_policy 317 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 318 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 319 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 320 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 321 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 322 [NL80211_PMSR_ATTR_PEERS] = 323 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy), 324 }; 325 326 static const struct nla_policy 327 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 328 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 329 NLA_POLICY_RANGE(NLA_U8, 1, 20), 330 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 331 NLA_POLICY_RANGE(NLA_U8, 1, 20), 332 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 333 NLA_POLICY_RANGE(NLA_U8, 1, 20), 334 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 335 NLA_POLICY_EXACT_LEN(8), 336 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 337 NLA_POLICY_EXACT_LEN(8), 338 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 339 }; 340 341 static const struct nla_policy 342 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 343 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 344 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 345 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 346 }; 347 348 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 349 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 350 .len = NL80211_MAX_SUPP_RATES }, 351 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 352 .len = NL80211_MAX_SUPP_HT_RATES }, 353 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 354 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 355 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 356 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 357 NL80211_RATE_INFO_HE_GI_0_8, 358 NL80211_RATE_INFO_HE_GI_3_2), 359 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 360 NL80211_RATE_INFO_HE_1XLTF, 361 NL80211_RATE_INFO_HE_4XLTF), 362 }; 363 364 static const struct nla_policy 365 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 366 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 367 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 368 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 369 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 370 [NL80211_TID_CONFIG_ATTR_NOACK] = 371 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 372 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 373 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 374 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 375 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 376 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 377 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 378 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 379 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 380 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 381 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 382 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 383 NLA_POLICY_NESTED(nl80211_txattr_policy), 384 }; 385 386 static const struct nla_policy 387 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 388 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 389 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 390 NLA_POLICY_RANGE(NLA_BINARY, 391 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 392 IEEE80211_MAX_DATA_LEN), 393 }; 394 395 static const struct nla_policy 396 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 397 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 398 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 399 .len = IEEE80211_MAX_DATA_LEN } 400 }; 401 402 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 403 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 404 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 405 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 406 .len = 20-1 }, 407 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 408 409 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 410 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 411 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 412 NL80211_EDMG_CHANNELS_MIN, 413 NL80211_EDMG_CHANNELS_MAX), 414 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 415 NL80211_EDMG_BW_CONFIG_MIN, 416 NL80211_EDMG_BW_CONFIG_MAX), 417 418 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 419 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 420 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 421 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 422 423 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 424 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 425 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 426 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 427 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 428 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 429 430 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 431 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 432 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 433 434 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 435 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 436 437 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 438 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 439 .len = WLAN_MAX_KEY_LEN }, 440 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 441 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 442 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 443 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 444 [NL80211_ATTR_KEY_TYPE] = 445 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 446 447 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 448 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 449 [NL80211_ATTR_BEACON_HEAD] = 450 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 451 IEEE80211_MAX_DATA_LEN), 452 [NL80211_ATTR_BEACON_TAIL] = 453 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 454 IEEE80211_MAX_DATA_LEN), 455 [NL80211_ATTR_STA_AID] = 456 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 457 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 458 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 459 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 460 .len = NL80211_MAX_SUPP_RATES }, 461 [NL80211_ATTR_STA_PLINK_ACTION] = 462 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 463 [NL80211_ATTR_STA_TX_POWER_SETTING] = 464 NLA_POLICY_RANGE(NLA_U8, 465 NL80211_TX_POWER_AUTOMATIC, 466 NL80211_TX_POWER_FIXED), 467 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 468 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 469 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 470 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 471 .len = IEEE80211_MAX_MESH_ID_LEN }, 472 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 473 474 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 475 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 476 477 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 478 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 479 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 480 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 481 .len = NL80211_MAX_SUPP_RATES }, 482 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 483 484 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 485 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 486 487 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 488 489 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 490 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 491 validate_ie_attr, 492 IEEE80211_MAX_DATA_LEN), 493 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 494 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 495 496 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 497 .len = IEEE80211_MAX_SSID_LEN }, 498 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 499 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 500 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 501 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 502 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 503 NL80211_MFP_NO, 504 NL80211_MFP_OPTIONAL), 505 [NL80211_ATTR_STA_FLAGS2] = { 506 .len = sizeof(struct nl80211_sta_flag_update), 507 }, 508 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 509 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 510 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 512 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 513 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 514 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 515 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 516 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 517 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 518 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 519 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 520 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 521 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 522 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 523 .len = IEEE80211_MAX_DATA_LEN }, 524 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 525 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 526 NL80211_PS_DISABLED, 527 NL80211_PS_ENABLED), 528 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 529 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 530 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 531 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 532 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 533 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 534 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 535 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 536 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 537 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 538 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 539 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 540 [NL80211_ATTR_STA_PLINK_STATE] = 541 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 542 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 543 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 544 [NL80211_ATTR_MESH_PEER_AID] = 545 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 546 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 547 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 548 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 549 [NL80211_ATTR_HIDDEN_SSID] = 550 NLA_POLICY_RANGE(NLA_U32, 551 NL80211_HIDDEN_SSID_NOT_IN_USE, 552 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 553 [NL80211_ATTR_IE_PROBE_RESP] = 554 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 555 IEEE80211_MAX_DATA_LEN), 556 [NL80211_ATTR_IE_ASSOC_RESP] = 557 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 558 IEEE80211_MAX_DATA_LEN), 559 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 560 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 561 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 562 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 563 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 564 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 565 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 566 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 567 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 568 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 569 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 570 .len = IEEE80211_MAX_DATA_LEN }, 571 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 572 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 573 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 574 .len = NL80211_HT_CAPABILITY_LEN 575 }, 576 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 577 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 578 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 579 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 580 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 581 582 /* need to include at least Auth Transaction and Status Code */ 583 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 584 585 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 586 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 587 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 588 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 589 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 590 NLA_POLICY_RANGE(NLA_U32, 591 NL80211_MESH_POWER_UNKNOWN + 1, 592 NL80211_MESH_POWER_MAX), 593 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 594 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 595 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 596 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 597 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 598 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 599 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 600 .len = NL80211_VHT_CAPABILITY_LEN, 601 }, 602 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 603 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 604 .len = IEEE80211_MAX_DATA_LEN }, 605 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 606 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 607 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 608 [NL80211_ATTR_PEER_AID] = 609 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 610 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 611 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 612 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 613 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 614 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 615 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 616 /* 617 * The value of the Length field of the Supported Operating 618 * Classes element is between 2 and 253. 619 */ 620 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 621 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 622 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 623 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 624 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 625 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 626 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 627 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 628 IEEE80211_QOS_MAP_LEN_MIN, 629 IEEE80211_QOS_MAP_LEN_MAX), 630 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 631 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 632 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 633 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 634 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 635 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 636 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 637 [NL80211_ATTR_USER_PRIO] = 638 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 639 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 640 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 641 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 642 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 643 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 644 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 645 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 646 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 647 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 648 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 649 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 650 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 651 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 652 .len = VHT_MUMIMO_GROUPS_DATA_LEN 653 }, 654 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 655 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 656 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 657 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 658 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 659 .len = FILS_MAX_KEK_LEN }, 660 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 661 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 662 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 663 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 664 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 665 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 666 }, 667 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 668 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 669 .len = FILS_ERP_MAX_USERNAME_LEN }, 670 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 671 .len = FILS_ERP_MAX_REALM_LEN }, 672 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 673 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 674 .len = FILS_ERP_MAX_RRK_LEN }, 675 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 676 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 677 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 678 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 679 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 680 681 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 682 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 683 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 684 [NL80211_ATTR_HE_CAPABILITY] = 685 NLA_POLICY_RANGE(NLA_BINARY, 686 NL80211_HE_MIN_CAPABILITY_LEN, 687 NL80211_HE_MAX_CAPABILITY_LEN), 688 [NL80211_ATTR_FTM_RESPONDER] = 689 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 690 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 691 [NL80211_ATTR_PEER_MEASUREMENTS] = 692 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 693 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 694 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 695 .len = SAE_PASSWORD_MAX_LEN }, 696 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 697 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 698 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 699 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 700 [NL80211_ATTR_TID_CONFIG] = 701 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 702 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 703 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 704 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 705 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 707 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 708 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 709 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 710 [NL80211_ATTR_FILS_DISCOVERY] = 711 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 712 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 713 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 714 [NL80211_ATTR_S1G_CAPABILITY] = 715 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 716 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 717 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 718 [NL80211_ATTR_SAE_PWE] = 719 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK, 720 NL80211_SAE_PWE_BOTH), 721 }; 722 723 /* policy for the key attributes */ 724 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 725 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 726 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 727 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 728 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 729 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 730 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 731 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 732 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 733 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 734 }; 735 736 /* policy for the key default flags */ 737 static const struct nla_policy 738 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 739 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 740 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 741 }; 742 743 #ifdef CONFIG_PM 744 /* policy for WoWLAN attributes */ 745 static const struct nla_policy 746 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 747 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 748 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 749 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 750 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 751 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 752 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 753 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 754 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 755 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 756 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 757 }; 758 759 static const struct nla_policy 760 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 761 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 762 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 763 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 764 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 765 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 766 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 767 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 768 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 769 }, 770 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 771 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 772 }, 773 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 774 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 775 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 776 }; 777 #endif /* CONFIG_PM */ 778 779 /* policy for coalesce rule attributes */ 780 static const struct nla_policy 781 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 782 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 783 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 784 NLA_POLICY_RANGE(NLA_U32, 785 NL80211_COALESCE_CONDITION_MATCH, 786 NL80211_COALESCE_CONDITION_NO_MATCH), 787 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 788 }; 789 790 /* policy for GTK rekey offload attributes */ 791 static const struct nla_policy 792 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 793 [NL80211_REKEY_DATA_KEK] = { 794 .type = NLA_BINARY, 795 .len = NL80211_KEK_EXT_LEN 796 }, 797 [NL80211_REKEY_DATA_KCK] = { 798 .type = NLA_BINARY, 799 .len = NL80211_KCK_EXT_LEN 800 }, 801 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 802 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 803 }; 804 805 static const struct nla_policy 806 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 807 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 808 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 809 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 810 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 811 }; 812 813 static const struct nla_policy 814 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 815 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 816 .len = IEEE80211_MAX_SSID_LEN }, 817 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 818 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 819 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 820 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 821 }; 822 823 static const struct nla_policy 824 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 825 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 826 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 827 }; 828 829 static const struct nla_policy 830 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 831 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 832 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 833 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 834 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 835 }, 836 }; 837 838 /* policy for NAN function attributes */ 839 static const struct nla_policy 840 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 841 [NL80211_NAN_FUNC_TYPE] = 842 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 843 [NL80211_NAN_FUNC_SERVICE_ID] = { 844 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 845 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 846 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 847 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 848 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 849 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 850 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 851 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 852 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 853 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 854 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 855 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 856 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 857 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 858 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 859 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 860 }; 861 862 /* policy for Service Response Filter attributes */ 863 static const struct nla_policy 864 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 865 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 866 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 867 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 868 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 869 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 870 }; 871 872 /* policy for packet pattern attributes */ 873 static const struct nla_policy 874 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 875 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 876 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 877 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 878 }; 879 880 int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 881 struct cfg80211_registered_device **rdev, 882 struct wireless_dev **wdev) 883 { 884 int err; 885 886 if (!cb->args[0]) { 887 struct nlattr **attrbuf; 888 889 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 890 GFP_KERNEL); 891 if (!attrbuf) 892 return -ENOMEM; 893 894 err = nlmsg_parse_deprecated(cb->nlh, 895 GENL_HDRLEN + nl80211_fam.hdrsize, 896 attrbuf, nl80211_fam.maxattr, 897 nl80211_policy, NULL); 898 if (err) { 899 kfree(attrbuf); 900 return err; 901 } 902 903 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk), 904 attrbuf); 905 kfree(attrbuf); 906 if (IS_ERR(*wdev)) 907 return PTR_ERR(*wdev); 908 *rdev = wiphy_to_rdev((*wdev)->wiphy); 909 /* 0 is the first index - add 1 to parse only once */ 910 cb->args[0] = (*rdev)->wiphy_idx + 1; 911 cb->args[1] = (*wdev)->identifier; 912 } else { 913 /* subtract the 1 again here */ 914 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 915 struct wireless_dev *tmp; 916 917 if (!wiphy) 918 return -ENODEV; 919 *rdev = wiphy_to_rdev(wiphy); 920 *wdev = NULL; 921 922 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 923 if (tmp->identifier == cb->args[1]) { 924 *wdev = tmp; 925 break; 926 } 927 } 928 929 if (!*wdev) 930 return -ENODEV; 931 } 932 933 return 0; 934 } 935 936 /* message building helper */ 937 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 938 int flags, u8 cmd) 939 { 940 /* since there is no private header just add the generic one */ 941 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 942 } 943 944 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 945 const struct ieee80211_reg_rule *rule) 946 { 947 int j; 948 struct nlattr *nl_wmm_rules = 949 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 950 951 if (!nl_wmm_rules) 952 goto nla_put_failure; 953 954 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 955 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 956 957 if (!nl_wmm_rule) 958 goto nla_put_failure; 959 960 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 961 rule->wmm_rule.client[j].cw_min) || 962 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 963 rule->wmm_rule.client[j].cw_max) || 964 nla_put_u8(msg, NL80211_WMMR_AIFSN, 965 rule->wmm_rule.client[j].aifsn) || 966 nla_put_u16(msg, NL80211_WMMR_TXOP, 967 rule->wmm_rule.client[j].cot)) 968 goto nla_put_failure; 969 970 nla_nest_end(msg, nl_wmm_rule); 971 } 972 nla_nest_end(msg, nl_wmm_rules); 973 974 return 0; 975 976 nla_put_failure: 977 return -ENOBUFS; 978 } 979 980 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 981 struct ieee80211_channel *chan, 982 bool large) 983 { 984 /* Some channels must be completely excluded from the 985 * list to protect old user-space tools from breaking 986 */ 987 if (!large && chan->flags & 988 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 989 return 0; 990 if (!large && chan->freq_offset) 991 return 0; 992 993 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 994 chan->center_freq)) 995 goto nla_put_failure; 996 997 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 998 goto nla_put_failure; 999 1000 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1001 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1002 goto nla_put_failure; 1003 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1004 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1005 goto nla_put_failure; 1006 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1007 goto nla_put_failure; 1008 } 1009 if (chan->flags & IEEE80211_CHAN_RADAR) { 1010 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1011 goto nla_put_failure; 1012 if (large) { 1013 u32 time; 1014 1015 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1016 1017 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1018 chan->dfs_state)) 1019 goto nla_put_failure; 1020 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1021 time)) 1022 goto nla_put_failure; 1023 if (nla_put_u32(msg, 1024 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1025 chan->dfs_cac_ms)) 1026 goto nla_put_failure; 1027 } 1028 } 1029 1030 if (large) { 1031 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1032 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1033 goto nla_put_failure; 1034 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1035 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1036 goto nla_put_failure; 1037 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1038 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1039 goto nla_put_failure; 1040 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1041 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1042 goto nla_put_failure; 1043 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1044 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1045 goto nla_put_failure; 1046 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1047 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1048 goto nla_put_failure; 1049 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1050 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1051 goto nla_put_failure; 1052 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1053 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1054 goto nla_put_failure; 1055 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1056 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1057 goto nla_put_failure; 1058 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1059 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1060 goto nla_put_failure; 1061 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1062 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1063 goto nla_put_failure; 1064 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1065 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1066 goto nla_put_failure; 1067 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1068 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1069 goto nla_put_failure; 1070 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1071 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1072 goto nla_put_failure; 1073 } 1074 1075 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1076 DBM_TO_MBM(chan->max_power))) 1077 goto nla_put_failure; 1078 1079 if (large) { 1080 const struct ieee80211_reg_rule *rule = 1081 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1082 1083 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1084 if (nl80211_msg_put_wmm_rules(msg, rule)) 1085 goto nla_put_failure; 1086 } 1087 } 1088 1089 return 0; 1090 1091 nla_put_failure: 1092 return -ENOBUFS; 1093 } 1094 1095 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1096 struct cfg80211_txq_stats *txqstats, 1097 int attrtype) 1098 { 1099 struct nlattr *txqattr; 1100 1101 #define PUT_TXQVAL_U32(attr, memb) do { \ 1102 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1103 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1104 return false; \ 1105 } while (0) 1106 1107 txqattr = nla_nest_start_noflag(msg, attrtype); 1108 if (!txqattr) 1109 return false; 1110 1111 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1112 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1113 PUT_TXQVAL_U32(FLOWS, flows); 1114 PUT_TXQVAL_U32(DROPS, drops); 1115 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1116 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1117 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1118 PUT_TXQVAL_U32(COLLISIONS, collisions); 1119 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1120 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1121 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1122 nla_nest_end(msg, txqattr); 1123 1124 #undef PUT_TXQVAL_U32 1125 return true; 1126 } 1127 1128 /* netlink command implementations */ 1129 1130 struct key_parse { 1131 struct key_params p; 1132 int idx; 1133 int type; 1134 bool def, defmgmt, defbeacon; 1135 bool def_uni, def_multi; 1136 }; 1137 1138 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1139 struct key_parse *k) 1140 { 1141 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1142 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1143 nl80211_key_policy, 1144 info->extack); 1145 if (err) 1146 return err; 1147 1148 k->def = !!tb[NL80211_KEY_DEFAULT]; 1149 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1150 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1151 1152 if (k->def) { 1153 k->def_uni = true; 1154 k->def_multi = true; 1155 } 1156 if (k->defmgmt || k->defbeacon) 1157 k->def_multi = true; 1158 1159 if (tb[NL80211_KEY_IDX]) 1160 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1161 1162 if (tb[NL80211_KEY_DATA]) { 1163 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1164 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1165 } 1166 1167 if (tb[NL80211_KEY_SEQ]) { 1168 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1169 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1170 } 1171 1172 if (tb[NL80211_KEY_CIPHER]) 1173 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1174 1175 if (tb[NL80211_KEY_TYPE]) 1176 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1177 1178 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1179 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1180 1181 err = nla_parse_nested_deprecated(kdt, 1182 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1183 tb[NL80211_KEY_DEFAULT_TYPES], 1184 nl80211_key_default_policy, 1185 info->extack); 1186 if (err) 1187 return err; 1188 1189 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1190 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1191 } 1192 1193 if (tb[NL80211_KEY_MODE]) 1194 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1195 1196 return 0; 1197 } 1198 1199 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1200 { 1201 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1202 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1203 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1204 } 1205 1206 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1207 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1208 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1209 } 1210 1211 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1212 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1213 1214 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1215 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1216 1217 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1218 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1219 1220 if (k->def) { 1221 k->def_uni = true; 1222 k->def_multi = true; 1223 } 1224 if (k->defmgmt) 1225 k->def_multi = true; 1226 1227 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1228 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1229 1230 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1231 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1232 int err = nla_parse_nested_deprecated(kdt, 1233 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1234 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1235 nl80211_key_default_policy, 1236 info->extack); 1237 if (err) 1238 return err; 1239 1240 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1241 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1242 } 1243 1244 return 0; 1245 } 1246 1247 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1248 { 1249 int err; 1250 1251 memset(k, 0, sizeof(*k)); 1252 k->idx = -1; 1253 k->type = -1; 1254 1255 if (info->attrs[NL80211_ATTR_KEY]) 1256 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1257 else 1258 err = nl80211_parse_key_old(info, k); 1259 1260 if (err) 1261 return err; 1262 1263 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1264 (k->defbeacon ? 1 : 0) > 1) { 1265 GENL_SET_ERR_MSG(info, 1266 "key with multiple default flags is invalid"); 1267 return -EINVAL; 1268 } 1269 1270 if (k->defmgmt || k->defbeacon) { 1271 if (k->def_uni || !k->def_multi) { 1272 GENL_SET_ERR_MSG(info, 1273 "defmgmt/defbeacon key must be mcast"); 1274 return -EINVAL; 1275 } 1276 } 1277 1278 if (k->idx != -1) { 1279 if (k->defmgmt) { 1280 if (k->idx < 4 || k->idx > 5) { 1281 GENL_SET_ERR_MSG(info, 1282 "defmgmt key idx not 4 or 5"); 1283 return -EINVAL; 1284 } 1285 } else if (k->defbeacon) { 1286 if (k->idx < 6 || k->idx > 7) { 1287 GENL_SET_ERR_MSG(info, 1288 "defbeacon key idx not 6 or 7"); 1289 return -EINVAL; 1290 } 1291 } else if (k->def) { 1292 if (k->idx < 0 || k->idx > 3) { 1293 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1294 return -EINVAL; 1295 } 1296 } else { 1297 if (k->idx < 0 || k->idx > 7) { 1298 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1299 return -EINVAL; 1300 } 1301 } 1302 } 1303 1304 return 0; 1305 } 1306 1307 static struct cfg80211_cached_keys * 1308 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1309 struct genl_info *info, bool *no_ht) 1310 { 1311 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1312 struct key_parse parse; 1313 struct nlattr *key; 1314 struct cfg80211_cached_keys *result; 1315 int rem, err, def = 0; 1316 bool have_key = false; 1317 1318 nla_for_each_nested(key, keys, rem) { 1319 have_key = true; 1320 break; 1321 } 1322 1323 if (!have_key) 1324 return NULL; 1325 1326 result = kzalloc(sizeof(*result), GFP_KERNEL); 1327 if (!result) 1328 return ERR_PTR(-ENOMEM); 1329 1330 result->def = -1; 1331 1332 nla_for_each_nested(key, keys, rem) { 1333 memset(&parse, 0, sizeof(parse)); 1334 parse.idx = -1; 1335 1336 err = nl80211_parse_key_new(info, key, &parse); 1337 if (err) 1338 goto error; 1339 err = -EINVAL; 1340 if (!parse.p.key) 1341 goto error; 1342 if (parse.idx < 0 || parse.idx > 3) { 1343 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1344 goto error; 1345 } 1346 if (parse.def) { 1347 if (def) { 1348 GENL_SET_ERR_MSG(info, 1349 "only one key can be default"); 1350 goto error; 1351 } 1352 def = 1; 1353 result->def = parse.idx; 1354 if (!parse.def_uni || !parse.def_multi) 1355 goto error; 1356 } else if (parse.defmgmt) 1357 goto error; 1358 err = cfg80211_validate_key_settings(rdev, &parse.p, 1359 parse.idx, false, NULL); 1360 if (err) 1361 goto error; 1362 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1363 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1364 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1365 err = -EINVAL; 1366 goto error; 1367 } 1368 result->params[parse.idx].cipher = parse.p.cipher; 1369 result->params[parse.idx].key_len = parse.p.key_len; 1370 result->params[parse.idx].key = result->data[parse.idx]; 1371 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1372 1373 /* must be WEP key if we got here */ 1374 if (no_ht) 1375 *no_ht = true; 1376 } 1377 1378 if (result->def < 0) { 1379 err = -EINVAL; 1380 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1381 goto error; 1382 } 1383 1384 return result; 1385 error: 1386 kfree(result); 1387 return ERR_PTR(err); 1388 } 1389 1390 static int nl80211_key_allowed(struct wireless_dev *wdev) 1391 { 1392 ASSERT_WDEV_LOCK(wdev); 1393 1394 switch (wdev->iftype) { 1395 case NL80211_IFTYPE_AP: 1396 case NL80211_IFTYPE_AP_VLAN: 1397 case NL80211_IFTYPE_P2P_GO: 1398 case NL80211_IFTYPE_MESH_POINT: 1399 break; 1400 case NL80211_IFTYPE_ADHOC: 1401 case NL80211_IFTYPE_STATION: 1402 case NL80211_IFTYPE_P2P_CLIENT: 1403 if (!wdev->current_bss) 1404 return -ENOLINK; 1405 break; 1406 case NL80211_IFTYPE_UNSPECIFIED: 1407 case NL80211_IFTYPE_OCB: 1408 case NL80211_IFTYPE_MONITOR: 1409 case NL80211_IFTYPE_NAN: 1410 case NL80211_IFTYPE_P2P_DEVICE: 1411 case NL80211_IFTYPE_WDS: 1412 case NUM_NL80211_IFTYPES: 1413 return -EINVAL; 1414 } 1415 1416 return 0; 1417 } 1418 1419 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1420 u32 freq) 1421 { 1422 struct ieee80211_channel *chan; 1423 1424 chan = ieee80211_get_channel_khz(wiphy, freq); 1425 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1426 return NULL; 1427 return chan; 1428 } 1429 1430 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1431 { 1432 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1433 int i; 1434 1435 if (!nl_modes) 1436 goto nla_put_failure; 1437 1438 i = 0; 1439 while (ifmodes) { 1440 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1441 goto nla_put_failure; 1442 ifmodes >>= 1; 1443 i++; 1444 } 1445 1446 nla_nest_end(msg, nl_modes); 1447 return 0; 1448 1449 nla_put_failure: 1450 return -ENOBUFS; 1451 } 1452 1453 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1454 struct sk_buff *msg, 1455 bool large) 1456 { 1457 struct nlattr *nl_combis; 1458 int i, j; 1459 1460 nl_combis = nla_nest_start_noflag(msg, 1461 NL80211_ATTR_INTERFACE_COMBINATIONS); 1462 if (!nl_combis) 1463 goto nla_put_failure; 1464 1465 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1466 const struct ieee80211_iface_combination *c; 1467 struct nlattr *nl_combi, *nl_limits; 1468 1469 c = &wiphy->iface_combinations[i]; 1470 1471 nl_combi = nla_nest_start_noflag(msg, i + 1); 1472 if (!nl_combi) 1473 goto nla_put_failure; 1474 1475 nl_limits = nla_nest_start_noflag(msg, 1476 NL80211_IFACE_COMB_LIMITS); 1477 if (!nl_limits) 1478 goto nla_put_failure; 1479 1480 for (j = 0; j < c->n_limits; j++) { 1481 struct nlattr *nl_limit; 1482 1483 nl_limit = nla_nest_start_noflag(msg, j + 1); 1484 if (!nl_limit) 1485 goto nla_put_failure; 1486 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1487 c->limits[j].max)) 1488 goto nla_put_failure; 1489 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1490 c->limits[j].types)) 1491 goto nla_put_failure; 1492 nla_nest_end(msg, nl_limit); 1493 } 1494 1495 nla_nest_end(msg, nl_limits); 1496 1497 if (c->beacon_int_infra_match && 1498 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1499 goto nla_put_failure; 1500 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1501 c->num_different_channels) || 1502 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1503 c->max_interfaces)) 1504 goto nla_put_failure; 1505 if (large && 1506 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1507 c->radar_detect_widths) || 1508 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1509 c->radar_detect_regions))) 1510 goto nla_put_failure; 1511 if (c->beacon_int_min_gcd && 1512 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1513 c->beacon_int_min_gcd)) 1514 goto nla_put_failure; 1515 1516 nla_nest_end(msg, nl_combi); 1517 } 1518 1519 nla_nest_end(msg, nl_combis); 1520 1521 return 0; 1522 nla_put_failure: 1523 return -ENOBUFS; 1524 } 1525 1526 #ifdef CONFIG_PM 1527 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1528 struct sk_buff *msg) 1529 { 1530 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1531 struct nlattr *nl_tcp; 1532 1533 if (!tcp) 1534 return 0; 1535 1536 nl_tcp = nla_nest_start_noflag(msg, 1537 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1538 if (!nl_tcp) 1539 return -ENOBUFS; 1540 1541 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1542 tcp->data_payload_max)) 1543 return -ENOBUFS; 1544 1545 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1546 tcp->data_payload_max)) 1547 return -ENOBUFS; 1548 1549 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1550 return -ENOBUFS; 1551 1552 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1553 sizeof(*tcp->tok), tcp->tok)) 1554 return -ENOBUFS; 1555 1556 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1557 tcp->data_interval_max)) 1558 return -ENOBUFS; 1559 1560 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1561 tcp->wake_payload_max)) 1562 return -ENOBUFS; 1563 1564 nla_nest_end(msg, nl_tcp); 1565 return 0; 1566 } 1567 1568 static int nl80211_send_wowlan(struct sk_buff *msg, 1569 struct cfg80211_registered_device *rdev, 1570 bool large) 1571 { 1572 struct nlattr *nl_wowlan; 1573 1574 if (!rdev->wiphy.wowlan) 1575 return 0; 1576 1577 nl_wowlan = nla_nest_start_noflag(msg, 1578 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1579 if (!nl_wowlan) 1580 return -ENOBUFS; 1581 1582 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1583 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1584 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1585 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1586 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1587 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1588 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1589 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1590 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1591 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1592 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1593 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1594 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1595 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1596 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1597 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1598 return -ENOBUFS; 1599 1600 if (rdev->wiphy.wowlan->n_patterns) { 1601 struct nl80211_pattern_support pat = { 1602 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1603 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1604 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1605 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1606 }; 1607 1608 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1609 sizeof(pat), &pat)) 1610 return -ENOBUFS; 1611 } 1612 1613 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1614 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1615 rdev->wiphy.wowlan->max_nd_match_sets)) 1616 return -ENOBUFS; 1617 1618 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1619 return -ENOBUFS; 1620 1621 nla_nest_end(msg, nl_wowlan); 1622 1623 return 0; 1624 } 1625 #endif 1626 1627 static int nl80211_send_coalesce(struct sk_buff *msg, 1628 struct cfg80211_registered_device *rdev) 1629 { 1630 struct nl80211_coalesce_rule_support rule; 1631 1632 if (!rdev->wiphy.coalesce) 1633 return 0; 1634 1635 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1636 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1637 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1638 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1639 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1640 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1641 1642 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1643 return -ENOBUFS; 1644 1645 return 0; 1646 } 1647 1648 static int 1649 nl80211_send_iftype_data(struct sk_buff *msg, 1650 const struct ieee80211_supported_band *sband, 1651 const struct ieee80211_sband_iftype_data *iftdata) 1652 { 1653 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1654 1655 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1656 iftdata->types_mask)) 1657 return -ENOBUFS; 1658 1659 if (he_cap->has_he) { 1660 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1661 sizeof(he_cap->he_cap_elem.mac_cap_info), 1662 he_cap->he_cap_elem.mac_cap_info) || 1663 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1664 sizeof(he_cap->he_cap_elem.phy_cap_info), 1665 he_cap->he_cap_elem.phy_cap_info) || 1666 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1667 sizeof(he_cap->he_mcs_nss_supp), 1668 &he_cap->he_mcs_nss_supp) || 1669 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1670 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1671 return -ENOBUFS; 1672 } 1673 1674 if (sband->band == NL80211_BAND_6GHZ && 1675 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1676 sizeof(iftdata->he_6ghz_capa), 1677 &iftdata->he_6ghz_capa)) 1678 return -ENOBUFS; 1679 1680 return 0; 1681 } 1682 1683 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1684 struct ieee80211_supported_band *sband, 1685 bool large) 1686 { 1687 struct nlattr *nl_rates, *nl_rate; 1688 struct ieee80211_rate *rate; 1689 int i; 1690 1691 /* add HT info */ 1692 if (sband->ht_cap.ht_supported && 1693 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1694 sizeof(sband->ht_cap.mcs), 1695 &sband->ht_cap.mcs) || 1696 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1697 sband->ht_cap.cap) || 1698 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1699 sband->ht_cap.ampdu_factor) || 1700 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1701 sband->ht_cap.ampdu_density))) 1702 return -ENOBUFS; 1703 1704 /* add VHT info */ 1705 if (sband->vht_cap.vht_supported && 1706 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1707 sizeof(sband->vht_cap.vht_mcs), 1708 &sband->vht_cap.vht_mcs) || 1709 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1710 sband->vht_cap.cap))) 1711 return -ENOBUFS; 1712 1713 if (large && sband->n_iftype_data) { 1714 struct nlattr *nl_iftype_data = 1715 nla_nest_start_noflag(msg, 1716 NL80211_BAND_ATTR_IFTYPE_DATA); 1717 int err; 1718 1719 if (!nl_iftype_data) 1720 return -ENOBUFS; 1721 1722 for (i = 0; i < sband->n_iftype_data; i++) { 1723 struct nlattr *iftdata; 1724 1725 iftdata = nla_nest_start_noflag(msg, i + 1); 1726 if (!iftdata) 1727 return -ENOBUFS; 1728 1729 err = nl80211_send_iftype_data(msg, sband, 1730 &sband->iftype_data[i]); 1731 if (err) 1732 return err; 1733 1734 nla_nest_end(msg, iftdata); 1735 } 1736 1737 nla_nest_end(msg, nl_iftype_data); 1738 } 1739 1740 /* add EDMG info */ 1741 if (large && sband->edmg_cap.channels && 1742 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1743 sband->edmg_cap.channels) || 1744 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1745 sband->edmg_cap.bw_config))) 1746 1747 return -ENOBUFS; 1748 1749 /* add bitrates */ 1750 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1751 if (!nl_rates) 1752 return -ENOBUFS; 1753 1754 for (i = 0; i < sband->n_bitrates; i++) { 1755 nl_rate = nla_nest_start_noflag(msg, i); 1756 if (!nl_rate) 1757 return -ENOBUFS; 1758 1759 rate = &sband->bitrates[i]; 1760 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1761 rate->bitrate)) 1762 return -ENOBUFS; 1763 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1764 nla_put_flag(msg, 1765 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1766 return -ENOBUFS; 1767 1768 nla_nest_end(msg, nl_rate); 1769 } 1770 1771 nla_nest_end(msg, nl_rates); 1772 1773 return 0; 1774 } 1775 1776 static int 1777 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1778 const struct ieee80211_txrx_stypes *mgmt_stypes) 1779 { 1780 u16 stypes; 1781 struct nlattr *nl_ftypes, *nl_ifs; 1782 enum nl80211_iftype ift; 1783 int i; 1784 1785 if (!mgmt_stypes) 1786 return 0; 1787 1788 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 1789 if (!nl_ifs) 1790 return -ENOBUFS; 1791 1792 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1793 nl_ftypes = nla_nest_start_noflag(msg, ift); 1794 if (!nl_ftypes) 1795 return -ENOBUFS; 1796 i = 0; 1797 stypes = mgmt_stypes[ift].tx; 1798 while (stypes) { 1799 if ((stypes & 1) && 1800 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1801 (i << 4) | IEEE80211_FTYPE_MGMT)) 1802 return -ENOBUFS; 1803 stypes >>= 1; 1804 i++; 1805 } 1806 nla_nest_end(msg, nl_ftypes); 1807 } 1808 1809 nla_nest_end(msg, nl_ifs); 1810 1811 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 1812 if (!nl_ifs) 1813 return -ENOBUFS; 1814 1815 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1816 nl_ftypes = nla_nest_start_noflag(msg, ift); 1817 if (!nl_ftypes) 1818 return -ENOBUFS; 1819 i = 0; 1820 stypes = mgmt_stypes[ift].rx; 1821 while (stypes) { 1822 if ((stypes & 1) && 1823 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1824 (i << 4) | IEEE80211_FTYPE_MGMT)) 1825 return -ENOBUFS; 1826 stypes >>= 1; 1827 i++; 1828 } 1829 nla_nest_end(msg, nl_ftypes); 1830 } 1831 nla_nest_end(msg, nl_ifs); 1832 1833 return 0; 1834 } 1835 1836 #define CMD(op, n) \ 1837 do { \ 1838 if (rdev->ops->op) { \ 1839 i++; \ 1840 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1841 goto nla_put_failure; \ 1842 } \ 1843 } while (0) 1844 1845 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1846 struct sk_buff *msg) 1847 { 1848 int i = 0; 1849 1850 /* 1851 * do *NOT* add anything into this function, new things need to be 1852 * advertised only to new versions of userspace that can deal with 1853 * the split (and they can't possibly care about new features... 1854 */ 1855 CMD(add_virtual_intf, NEW_INTERFACE); 1856 CMD(change_virtual_intf, SET_INTERFACE); 1857 CMD(add_key, NEW_KEY); 1858 CMD(start_ap, START_AP); 1859 CMD(add_station, NEW_STATION); 1860 CMD(add_mpath, NEW_MPATH); 1861 CMD(update_mesh_config, SET_MESH_CONFIG); 1862 CMD(change_bss, SET_BSS); 1863 CMD(auth, AUTHENTICATE); 1864 CMD(assoc, ASSOCIATE); 1865 CMD(deauth, DEAUTHENTICATE); 1866 CMD(disassoc, DISASSOCIATE); 1867 CMD(join_ibss, JOIN_IBSS); 1868 CMD(join_mesh, JOIN_MESH); 1869 CMD(set_pmksa, SET_PMKSA); 1870 CMD(del_pmksa, DEL_PMKSA); 1871 CMD(flush_pmksa, FLUSH_PMKSA); 1872 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1873 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1874 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1875 CMD(mgmt_tx, FRAME); 1876 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1877 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1878 i++; 1879 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1880 goto nla_put_failure; 1881 } 1882 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1883 rdev->ops->join_mesh) { 1884 i++; 1885 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1886 goto nla_put_failure; 1887 } 1888 CMD(set_wds_peer, SET_WDS_PEER); 1889 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1890 CMD(tdls_mgmt, TDLS_MGMT); 1891 CMD(tdls_oper, TDLS_OPER); 1892 } 1893 if (rdev->wiphy.max_sched_scan_reqs) 1894 CMD(sched_scan_start, START_SCHED_SCAN); 1895 CMD(probe_client, PROBE_CLIENT); 1896 CMD(set_noack_map, SET_NOACK_MAP); 1897 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1898 i++; 1899 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1900 goto nla_put_failure; 1901 } 1902 CMD(start_p2p_device, START_P2P_DEVICE); 1903 CMD(set_mcast_rate, SET_MCAST_RATE); 1904 #ifdef CONFIG_NL80211_TESTMODE 1905 CMD(testmode_cmd, TESTMODE); 1906 #endif 1907 1908 if (rdev->ops->connect || rdev->ops->auth) { 1909 i++; 1910 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1911 goto nla_put_failure; 1912 } 1913 1914 if (rdev->ops->disconnect || rdev->ops->deauth) { 1915 i++; 1916 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1917 goto nla_put_failure; 1918 } 1919 1920 return i; 1921 nla_put_failure: 1922 return -ENOBUFS; 1923 } 1924 1925 static int 1926 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 1927 struct sk_buff *msg) 1928 { 1929 struct nlattr *ftm; 1930 1931 if (!cap->ftm.supported) 1932 return 0; 1933 1934 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 1935 if (!ftm) 1936 return -ENOBUFS; 1937 1938 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 1939 return -ENOBUFS; 1940 if (cap->ftm.non_asap && 1941 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 1942 return -ENOBUFS; 1943 if (cap->ftm.request_lci && 1944 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 1945 return -ENOBUFS; 1946 if (cap->ftm.request_civicloc && 1947 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 1948 return -ENOBUFS; 1949 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 1950 cap->ftm.preambles)) 1951 return -ENOBUFS; 1952 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 1953 cap->ftm.bandwidths)) 1954 return -ENOBUFS; 1955 if (cap->ftm.max_bursts_exponent >= 0 && 1956 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 1957 cap->ftm.max_bursts_exponent)) 1958 return -ENOBUFS; 1959 if (cap->ftm.max_ftms_per_burst && 1960 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 1961 cap->ftm.max_ftms_per_burst)) 1962 return -ENOBUFS; 1963 if (cap->ftm.trigger_based && 1964 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 1965 return -ENOBUFS; 1966 if (cap->ftm.non_trigger_based && 1967 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 1968 return -ENOBUFS; 1969 1970 nla_nest_end(msg, ftm); 1971 return 0; 1972 } 1973 1974 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 1975 struct sk_buff *msg) 1976 { 1977 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 1978 struct nlattr *pmsr, *caps; 1979 1980 if (!cap) 1981 return 0; 1982 1983 /* 1984 * we don't need to clean up anything here since the caller 1985 * will genlmsg_cancel() if we fail 1986 */ 1987 1988 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 1989 if (!pmsr) 1990 return -ENOBUFS; 1991 1992 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 1993 return -ENOBUFS; 1994 1995 if (cap->report_ap_tsf && 1996 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 1997 return -ENOBUFS; 1998 1999 if (cap->randomize_mac_addr && 2000 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2001 return -ENOBUFS; 2002 2003 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2004 if (!caps) 2005 return -ENOBUFS; 2006 2007 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2008 return -ENOBUFS; 2009 2010 nla_nest_end(msg, caps); 2011 nla_nest_end(msg, pmsr); 2012 2013 return 0; 2014 } 2015 2016 static int 2017 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2018 struct sk_buff *msg) 2019 { 2020 int i; 2021 struct nlattr *nested, *nested_akms; 2022 const struct wiphy_iftype_akm_suites *iftype_akms; 2023 2024 if (!rdev->wiphy.num_iftype_akm_suites || 2025 !rdev->wiphy.iftype_akm_suites) 2026 return 0; 2027 2028 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2029 if (!nested) 2030 return -ENOBUFS; 2031 2032 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2033 nested_akms = nla_nest_start(msg, i + 1); 2034 if (!nested_akms) 2035 return -ENOBUFS; 2036 2037 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2038 2039 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2040 iftype_akms->iftypes_mask)) 2041 return -ENOBUFS; 2042 2043 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2044 sizeof(u32) * iftype_akms->n_akm_suites, 2045 iftype_akms->akm_suites)) { 2046 return -ENOBUFS; 2047 } 2048 nla_nest_end(msg, nested_akms); 2049 } 2050 2051 nla_nest_end(msg, nested); 2052 2053 return 0; 2054 } 2055 2056 static int 2057 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2058 struct sk_buff *msg) 2059 { 2060 struct nlattr *supp; 2061 2062 if (!rdev->wiphy.tid_config_support.vif && 2063 !rdev->wiphy.tid_config_support.peer) 2064 return 0; 2065 2066 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2067 if (!supp) 2068 return -ENOSPC; 2069 2070 if (rdev->wiphy.tid_config_support.vif && 2071 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2072 rdev->wiphy.tid_config_support.vif, 2073 NL80211_TID_CONFIG_ATTR_PAD)) 2074 goto fail; 2075 2076 if (rdev->wiphy.tid_config_support.peer && 2077 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2078 rdev->wiphy.tid_config_support.peer, 2079 NL80211_TID_CONFIG_ATTR_PAD)) 2080 goto fail; 2081 2082 /* for now we just use the same value ... makes more sense */ 2083 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2084 rdev->wiphy.tid_config_support.max_retry)) 2085 goto fail; 2086 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2087 rdev->wiphy.tid_config_support.max_retry)) 2088 goto fail; 2089 2090 nla_nest_end(msg, supp); 2091 2092 return 0; 2093 fail: 2094 nla_nest_cancel(msg, supp); 2095 return -ENOBUFS; 2096 } 2097 2098 struct nl80211_dump_wiphy_state { 2099 s64 filter_wiphy; 2100 long start; 2101 long split_start, band_start, chan_start, capa_start; 2102 bool split; 2103 }; 2104 2105 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2106 enum nl80211_commands cmd, 2107 struct sk_buff *msg, u32 portid, u32 seq, 2108 int flags, struct nl80211_dump_wiphy_state *state) 2109 { 2110 void *hdr; 2111 struct nlattr *nl_bands, *nl_band; 2112 struct nlattr *nl_freqs, *nl_freq; 2113 struct nlattr *nl_cmds; 2114 enum nl80211_band band; 2115 struct ieee80211_channel *chan; 2116 int i; 2117 const struct ieee80211_txrx_stypes *mgmt_stypes = 2118 rdev->wiphy.mgmt_stypes; 2119 u32 features; 2120 2121 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2122 if (!hdr) 2123 return -ENOBUFS; 2124 2125 if (WARN_ON(!state)) 2126 return -EINVAL; 2127 2128 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2129 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2130 wiphy_name(&rdev->wiphy)) || 2131 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2132 cfg80211_rdev_list_generation)) 2133 goto nla_put_failure; 2134 2135 if (cmd != NL80211_CMD_NEW_WIPHY) 2136 goto finish; 2137 2138 switch (state->split_start) { 2139 case 0: 2140 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2141 rdev->wiphy.retry_short) || 2142 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2143 rdev->wiphy.retry_long) || 2144 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2145 rdev->wiphy.frag_threshold) || 2146 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2147 rdev->wiphy.rts_threshold) || 2148 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2149 rdev->wiphy.coverage_class) || 2150 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2151 rdev->wiphy.max_scan_ssids) || 2152 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2153 rdev->wiphy.max_sched_scan_ssids) || 2154 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2155 rdev->wiphy.max_scan_ie_len) || 2156 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2157 rdev->wiphy.max_sched_scan_ie_len) || 2158 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2159 rdev->wiphy.max_match_sets)) 2160 goto nla_put_failure; 2161 2162 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2163 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2164 goto nla_put_failure; 2165 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2166 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2167 goto nla_put_failure; 2168 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2169 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2170 goto nla_put_failure; 2171 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2172 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2173 goto nla_put_failure; 2174 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2175 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2176 goto nla_put_failure; 2177 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2178 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2179 goto nla_put_failure; 2180 state->split_start++; 2181 if (state->split) 2182 break; 2183 fallthrough; 2184 case 1: 2185 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2186 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2187 rdev->wiphy.cipher_suites)) 2188 goto nla_put_failure; 2189 2190 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2191 rdev->wiphy.max_num_pmkids)) 2192 goto nla_put_failure; 2193 2194 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2195 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2196 goto nla_put_failure; 2197 2198 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2199 rdev->wiphy.available_antennas_tx) || 2200 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2201 rdev->wiphy.available_antennas_rx)) 2202 goto nla_put_failure; 2203 2204 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2205 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2206 rdev->wiphy.probe_resp_offload)) 2207 goto nla_put_failure; 2208 2209 if ((rdev->wiphy.available_antennas_tx || 2210 rdev->wiphy.available_antennas_rx) && 2211 rdev->ops->get_antenna) { 2212 u32 tx_ant = 0, rx_ant = 0; 2213 int res; 2214 2215 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2216 if (!res) { 2217 if (nla_put_u32(msg, 2218 NL80211_ATTR_WIPHY_ANTENNA_TX, 2219 tx_ant) || 2220 nla_put_u32(msg, 2221 NL80211_ATTR_WIPHY_ANTENNA_RX, 2222 rx_ant)) 2223 goto nla_put_failure; 2224 } 2225 } 2226 2227 state->split_start++; 2228 if (state->split) 2229 break; 2230 fallthrough; 2231 case 2: 2232 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2233 rdev->wiphy.interface_modes)) 2234 goto nla_put_failure; 2235 state->split_start++; 2236 if (state->split) 2237 break; 2238 fallthrough; 2239 case 3: 2240 nl_bands = nla_nest_start_noflag(msg, 2241 NL80211_ATTR_WIPHY_BANDS); 2242 if (!nl_bands) 2243 goto nla_put_failure; 2244 2245 for (band = state->band_start; 2246 band < NUM_NL80211_BANDS; band++) { 2247 struct ieee80211_supported_band *sband; 2248 2249 /* omit higher bands for ancient software */ 2250 if (band > NL80211_BAND_5GHZ && !state->split) 2251 break; 2252 2253 sband = rdev->wiphy.bands[band]; 2254 2255 if (!sband) 2256 continue; 2257 2258 nl_band = nla_nest_start_noflag(msg, band); 2259 if (!nl_band) 2260 goto nla_put_failure; 2261 2262 switch (state->chan_start) { 2263 case 0: 2264 if (nl80211_send_band_rateinfo(msg, sband, 2265 state->split)) 2266 goto nla_put_failure; 2267 state->chan_start++; 2268 if (state->split) 2269 break; 2270 fallthrough; 2271 default: 2272 /* add frequencies */ 2273 nl_freqs = nla_nest_start_noflag(msg, 2274 NL80211_BAND_ATTR_FREQS); 2275 if (!nl_freqs) 2276 goto nla_put_failure; 2277 2278 for (i = state->chan_start - 1; 2279 i < sband->n_channels; 2280 i++) { 2281 nl_freq = nla_nest_start_noflag(msg, 2282 i); 2283 if (!nl_freq) 2284 goto nla_put_failure; 2285 2286 chan = &sband->channels[i]; 2287 2288 if (nl80211_msg_put_channel( 2289 msg, &rdev->wiphy, chan, 2290 state->split)) 2291 goto nla_put_failure; 2292 2293 nla_nest_end(msg, nl_freq); 2294 if (state->split) 2295 break; 2296 } 2297 if (i < sband->n_channels) 2298 state->chan_start = i + 2; 2299 else 2300 state->chan_start = 0; 2301 nla_nest_end(msg, nl_freqs); 2302 } 2303 2304 nla_nest_end(msg, nl_band); 2305 2306 if (state->split) { 2307 /* start again here */ 2308 if (state->chan_start) 2309 band--; 2310 break; 2311 } 2312 } 2313 nla_nest_end(msg, nl_bands); 2314 2315 if (band < NUM_NL80211_BANDS) 2316 state->band_start = band + 1; 2317 else 2318 state->band_start = 0; 2319 2320 /* if bands & channels are done, continue outside */ 2321 if (state->band_start == 0 && state->chan_start == 0) 2322 state->split_start++; 2323 if (state->split) 2324 break; 2325 fallthrough; 2326 case 4: 2327 nl_cmds = nla_nest_start_noflag(msg, 2328 NL80211_ATTR_SUPPORTED_COMMANDS); 2329 if (!nl_cmds) 2330 goto nla_put_failure; 2331 2332 i = nl80211_add_commands_unsplit(rdev, msg); 2333 if (i < 0) 2334 goto nla_put_failure; 2335 if (state->split) { 2336 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2337 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2338 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2339 CMD(channel_switch, CHANNEL_SWITCH); 2340 CMD(set_qos_map, SET_QOS_MAP); 2341 if (rdev->wiphy.features & 2342 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2343 CMD(add_tx_ts, ADD_TX_TS); 2344 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2345 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2346 CMD(update_ft_ies, UPDATE_FT_IES); 2347 } 2348 #undef CMD 2349 2350 nla_nest_end(msg, nl_cmds); 2351 state->split_start++; 2352 if (state->split) 2353 break; 2354 fallthrough; 2355 case 5: 2356 if (rdev->ops->remain_on_channel && 2357 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2358 nla_put_u32(msg, 2359 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2360 rdev->wiphy.max_remain_on_channel_duration)) 2361 goto nla_put_failure; 2362 2363 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2364 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2365 goto nla_put_failure; 2366 2367 state->split_start++; 2368 if (state->split) 2369 break; 2370 fallthrough; 2371 case 6: 2372 #ifdef CONFIG_PM 2373 if (nl80211_send_wowlan(msg, rdev, state->split)) 2374 goto nla_put_failure; 2375 state->split_start++; 2376 if (state->split) 2377 break; 2378 #else 2379 state->split_start++; 2380 #endif 2381 fallthrough; 2382 case 7: 2383 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2384 rdev->wiphy.software_iftypes)) 2385 goto nla_put_failure; 2386 2387 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2388 state->split)) 2389 goto nla_put_failure; 2390 2391 state->split_start++; 2392 if (state->split) 2393 break; 2394 fallthrough; 2395 case 8: 2396 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2397 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2398 rdev->wiphy.ap_sme_capa)) 2399 goto nla_put_failure; 2400 2401 features = rdev->wiphy.features; 2402 /* 2403 * We can only add the per-channel limit information if the 2404 * dump is split, otherwise it makes it too big. Therefore 2405 * only advertise it in that case. 2406 */ 2407 if (state->split) 2408 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2409 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2410 goto nla_put_failure; 2411 2412 if (rdev->wiphy.ht_capa_mod_mask && 2413 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2414 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2415 rdev->wiphy.ht_capa_mod_mask)) 2416 goto nla_put_failure; 2417 2418 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2419 rdev->wiphy.max_acl_mac_addrs && 2420 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2421 rdev->wiphy.max_acl_mac_addrs)) 2422 goto nla_put_failure; 2423 2424 /* 2425 * Any information below this point is only available to 2426 * applications that can deal with it being split. This 2427 * helps ensure that newly added capabilities don't break 2428 * older tools by overrunning their buffers. 2429 * 2430 * We still increment split_start so that in the split 2431 * case we'll continue with more data in the next round, 2432 * but break unconditionally so unsplit data stops here. 2433 */ 2434 if (state->split) 2435 state->split_start++; 2436 else 2437 state->split_start = 0; 2438 break; 2439 case 9: 2440 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2441 goto nla_put_failure; 2442 2443 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2444 rdev->wiphy.max_sched_scan_plans) || 2445 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2446 rdev->wiphy.max_sched_scan_plan_interval) || 2447 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2448 rdev->wiphy.max_sched_scan_plan_iterations)) 2449 goto nla_put_failure; 2450 2451 if (rdev->wiphy.extended_capabilities && 2452 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2453 rdev->wiphy.extended_capabilities_len, 2454 rdev->wiphy.extended_capabilities) || 2455 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2456 rdev->wiphy.extended_capabilities_len, 2457 rdev->wiphy.extended_capabilities_mask))) 2458 goto nla_put_failure; 2459 2460 if (rdev->wiphy.vht_capa_mod_mask && 2461 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2462 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2463 rdev->wiphy.vht_capa_mod_mask)) 2464 goto nla_put_failure; 2465 2466 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2467 rdev->wiphy.perm_addr)) 2468 goto nla_put_failure; 2469 2470 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2471 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2472 rdev->wiphy.addr_mask)) 2473 goto nla_put_failure; 2474 2475 if (rdev->wiphy.n_addresses > 1) { 2476 void *attr; 2477 2478 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2479 if (!attr) 2480 goto nla_put_failure; 2481 2482 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2483 if (nla_put(msg, i + 1, ETH_ALEN, 2484 rdev->wiphy.addresses[i].addr)) 2485 goto nla_put_failure; 2486 2487 nla_nest_end(msg, attr); 2488 } 2489 2490 state->split_start++; 2491 break; 2492 case 10: 2493 if (nl80211_send_coalesce(msg, rdev)) 2494 goto nla_put_failure; 2495 2496 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2497 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2498 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2499 goto nla_put_failure; 2500 2501 if (rdev->wiphy.max_ap_assoc_sta && 2502 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2503 rdev->wiphy.max_ap_assoc_sta)) 2504 goto nla_put_failure; 2505 2506 state->split_start++; 2507 break; 2508 case 11: 2509 if (rdev->wiphy.n_vendor_commands) { 2510 const struct nl80211_vendor_cmd_info *info; 2511 struct nlattr *nested; 2512 2513 nested = nla_nest_start_noflag(msg, 2514 NL80211_ATTR_VENDOR_DATA); 2515 if (!nested) 2516 goto nla_put_failure; 2517 2518 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2519 info = &rdev->wiphy.vendor_commands[i].info; 2520 if (nla_put(msg, i + 1, sizeof(*info), info)) 2521 goto nla_put_failure; 2522 } 2523 nla_nest_end(msg, nested); 2524 } 2525 2526 if (rdev->wiphy.n_vendor_events) { 2527 const struct nl80211_vendor_cmd_info *info; 2528 struct nlattr *nested; 2529 2530 nested = nla_nest_start_noflag(msg, 2531 NL80211_ATTR_VENDOR_EVENTS); 2532 if (!nested) 2533 goto nla_put_failure; 2534 2535 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2536 info = &rdev->wiphy.vendor_events[i]; 2537 if (nla_put(msg, i + 1, sizeof(*info), info)) 2538 goto nla_put_failure; 2539 } 2540 nla_nest_end(msg, nested); 2541 } 2542 state->split_start++; 2543 break; 2544 case 12: 2545 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2546 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2547 rdev->wiphy.max_num_csa_counters)) 2548 goto nla_put_failure; 2549 2550 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2551 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2552 goto nla_put_failure; 2553 2554 if (rdev->wiphy.max_sched_scan_reqs && 2555 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2556 rdev->wiphy.max_sched_scan_reqs)) 2557 goto nla_put_failure; 2558 2559 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2560 sizeof(rdev->wiphy.ext_features), 2561 rdev->wiphy.ext_features)) 2562 goto nla_put_failure; 2563 2564 if (rdev->wiphy.bss_select_support) { 2565 struct nlattr *nested; 2566 u32 bss_select_support = rdev->wiphy.bss_select_support; 2567 2568 nested = nla_nest_start_noflag(msg, 2569 NL80211_ATTR_BSS_SELECT); 2570 if (!nested) 2571 goto nla_put_failure; 2572 2573 i = 0; 2574 while (bss_select_support) { 2575 if ((bss_select_support & 1) && 2576 nla_put_flag(msg, i)) 2577 goto nla_put_failure; 2578 i++; 2579 bss_select_support >>= 1; 2580 } 2581 nla_nest_end(msg, nested); 2582 } 2583 2584 state->split_start++; 2585 break; 2586 case 13: 2587 if (rdev->wiphy.num_iftype_ext_capab && 2588 rdev->wiphy.iftype_ext_capab) { 2589 struct nlattr *nested_ext_capab, *nested; 2590 2591 nested = nla_nest_start_noflag(msg, 2592 NL80211_ATTR_IFTYPE_EXT_CAPA); 2593 if (!nested) 2594 goto nla_put_failure; 2595 2596 for (i = state->capa_start; 2597 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2598 const struct wiphy_iftype_ext_capab *capab; 2599 2600 capab = &rdev->wiphy.iftype_ext_capab[i]; 2601 2602 nested_ext_capab = nla_nest_start_noflag(msg, 2603 i); 2604 if (!nested_ext_capab || 2605 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2606 capab->iftype) || 2607 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2608 capab->extended_capabilities_len, 2609 capab->extended_capabilities) || 2610 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2611 capab->extended_capabilities_len, 2612 capab->extended_capabilities_mask)) 2613 goto nla_put_failure; 2614 2615 nla_nest_end(msg, nested_ext_capab); 2616 if (state->split) 2617 break; 2618 } 2619 nla_nest_end(msg, nested); 2620 if (i < rdev->wiphy.num_iftype_ext_capab) { 2621 state->capa_start = i + 1; 2622 break; 2623 } 2624 } 2625 2626 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2627 rdev->wiphy.nan_supported_bands)) 2628 goto nla_put_failure; 2629 2630 if (wiphy_ext_feature_isset(&rdev->wiphy, 2631 NL80211_EXT_FEATURE_TXQS)) { 2632 struct cfg80211_txq_stats txqstats = {}; 2633 int res; 2634 2635 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2636 if (!res && 2637 !nl80211_put_txq_stats(msg, &txqstats, 2638 NL80211_ATTR_TXQ_STATS)) 2639 goto nla_put_failure; 2640 2641 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2642 rdev->wiphy.txq_limit)) 2643 goto nla_put_failure; 2644 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2645 rdev->wiphy.txq_memory_limit)) 2646 goto nla_put_failure; 2647 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2648 rdev->wiphy.txq_quantum)) 2649 goto nla_put_failure; 2650 } 2651 2652 state->split_start++; 2653 break; 2654 case 14: 2655 if (nl80211_send_pmsr_capa(rdev, msg)) 2656 goto nla_put_failure; 2657 2658 state->split_start++; 2659 break; 2660 case 15: 2661 if (rdev->wiphy.akm_suites && 2662 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2663 sizeof(u32) * rdev->wiphy.n_akm_suites, 2664 rdev->wiphy.akm_suites)) 2665 goto nla_put_failure; 2666 2667 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2668 goto nla_put_failure; 2669 2670 if (nl80211_put_tid_config_support(rdev, msg)) 2671 goto nla_put_failure; 2672 2673 /* done */ 2674 state->split_start = 0; 2675 break; 2676 } 2677 finish: 2678 genlmsg_end(msg, hdr); 2679 return 0; 2680 2681 nla_put_failure: 2682 genlmsg_cancel(msg, hdr); 2683 return -EMSGSIZE; 2684 } 2685 2686 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2687 struct netlink_callback *cb, 2688 struct nl80211_dump_wiphy_state *state) 2689 { 2690 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 2691 int ret; 2692 2693 if (!tb) 2694 return -ENOMEM; 2695 2696 ret = nlmsg_parse_deprecated(cb->nlh, 2697 GENL_HDRLEN + nl80211_fam.hdrsize, 2698 tb, nl80211_fam.maxattr, 2699 nl80211_policy, NULL); 2700 /* ignore parse errors for backward compatibility */ 2701 if (ret) { 2702 ret = 0; 2703 goto out; 2704 } 2705 2706 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 2707 if (tb[NL80211_ATTR_WIPHY]) 2708 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 2709 if (tb[NL80211_ATTR_WDEV]) 2710 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 2711 if (tb[NL80211_ATTR_IFINDEX]) { 2712 struct net_device *netdev; 2713 struct cfg80211_registered_device *rdev; 2714 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 2715 2716 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 2717 if (!netdev) { 2718 ret = -ENODEV; 2719 goto out; 2720 } 2721 if (netdev->ieee80211_ptr) { 2722 rdev = wiphy_to_rdev( 2723 netdev->ieee80211_ptr->wiphy); 2724 state->filter_wiphy = rdev->wiphy_idx; 2725 } 2726 } 2727 2728 ret = 0; 2729 out: 2730 kfree(tb); 2731 return ret; 2732 } 2733 2734 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 2735 { 2736 int idx = 0, ret; 2737 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 2738 struct cfg80211_registered_device *rdev; 2739 2740 rtnl_lock(); 2741 if (!state) { 2742 state = kzalloc(sizeof(*state), GFP_KERNEL); 2743 if (!state) { 2744 rtnl_unlock(); 2745 return -ENOMEM; 2746 } 2747 state->filter_wiphy = -1; 2748 ret = nl80211_dump_wiphy_parse(skb, cb, state); 2749 if (ret) { 2750 kfree(state); 2751 rtnl_unlock(); 2752 return ret; 2753 } 2754 cb->args[0] = (long)state; 2755 } 2756 2757 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2758 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2759 continue; 2760 if (++idx <= state->start) 2761 continue; 2762 if (state->filter_wiphy != -1 && 2763 state->filter_wiphy != rdev->wiphy_idx) 2764 continue; 2765 /* attempt to fit multiple wiphy data chunks into the skb */ 2766 do { 2767 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 2768 skb, 2769 NETLINK_CB(cb->skb).portid, 2770 cb->nlh->nlmsg_seq, 2771 NLM_F_MULTI, state); 2772 if (ret < 0) { 2773 /* 2774 * If sending the wiphy data didn't fit (ENOBUFS 2775 * or EMSGSIZE returned), this SKB is still 2776 * empty (so it's not too big because another 2777 * wiphy dataset is already in the skb) and 2778 * we've not tried to adjust the dump allocation 2779 * yet ... then adjust the alloc size to be 2780 * bigger, and return 1 but with the empty skb. 2781 * This results in an empty message being RX'ed 2782 * in userspace, but that is ignored. 2783 * 2784 * We can then retry with the larger buffer. 2785 */ 2786 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2787 !skb->len && !state->split && 2788 cb->min_dump_alloc < 4096) { 2789 cb->min_dump_alloc = 4096; 2790 state->split_start = 0; 2791 rtnl_unlock(); 2792 return 1; 2793 } 2794 idx--; 2795 break; 2796 } 2797 } while (state->split_start > 0); 2798 break; 2799 } 2800 rtnl_unlock(); 2801 2802 state->start = idx; 2803 2804 return skb->len; 2805 } 2806 2807 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2808 { 2809 kfree((void *)cb->args[0]); 2810 return 0; 2811 } 2812 2813 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2814 { 2815 struct sk_buff *msg; 2816 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2817 struct nl80211_dump_wiphy_state state = {}; 2818 2819 msg = nlmsg_new(4096, GFP_KERNEL); 2820 if (!msg) 2821 return -ENOMEM; 2822 2823 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2824 info->snd_portid, info->snd_seq, 0, 2825 &state) < 0) { 2826 nlmsg_free(msg); 2827 return -ENOBUFS; 2828 } 2829 2830 return genlmsg_reply(msg, info); 2831 } 2832 2833 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2834 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2835 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2836 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2837 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2838 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2839 }; 2840 2841 static int parse_txq_params(struct nlattr *tb[], 2842 struct ieee80211_txq_params *txq_params) 2843 { 2844 u8 ac; 2845 2846 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2847 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2848 !tb[NL80211_TXQ_ATTR_AIFS]) 2849 return -EINVAL; 2850 2851 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2852 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2853 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2854 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2855 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2856 2857 if (ac >= NL80211_NUM_ACS) 2858 return -EINVAL; 2859 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 2860 return 0; 2861 } 2862 2863 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2864 { 2865 /* 2866 * You can only set the channel explicitly for WDS interfaces, 2867 * all others have their channel managed via their respective 2868 * "establish a connection" command (connect, join, ...) 2869 * 2870 * For AP/GO and mesh mode, the channel can be set with the 2871 * channel userspace API, but is only stored and passed to the 2872 * low-level driver when the AP starts or the mesh is joined. 2873 * This is for backward compatibility, userspace can also give 2874 * the channel in the start-ap or join-mesh commands instead. 2875 * 2876 * Monitors are special as they are normally slaved to 2877 * whatever else is going on, so they have their own special 2878 * operation to set the monitor channel if possible. 2879 */ 2880 return !wdev || 2881 wdev->iftype == NL80211_IFTYPE_AP || 2882 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2883 wdev->iftype == NL80211_IFTYPE_MONITOR || 2884 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2885 } 2886 2887 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2888 struct genl_info *info, 2889 struct cfg80211_chan_def *chandef) 2890 { 2891 struct netlink_ext_ack *extack = info->extack; 2892 struct nlattr **attrs = info->attrs; 2893 u32 control_freq; 2894 2895 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) 2896 return -EINVAL; 2897 2898 control_freq = MHZ_TO_KHZ( 2899 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 2900 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 2901 control_freq += 2902 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 2903 2904 memset(chandef, 0, sizeof(*chandef)); 2905 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 2906 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2907 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 2908 chandef->freq1_offset = control_freq % 1000; 2909 chandef->center_freq2 = 0; 2910 2911 /* Primary channel not allowed */ 2912 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 2913 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 2914 "Channel is disabled"); 2915 return -EINVAL; 2916 } 2917 2918 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2919 enum nl80211_channel_type chantype; 2920 2921 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2922 2923 switch (chantype) { 2924 case NL80211_CHAN_NO_HT: 2925 case NL80211_CHAN_HT20: 2926 case NL80211_CHAN_HT40PLUS: 2927 case NL80211_CHAN_HT40MINUS: 2928 cfg80211_chandef_create(chandef, chandef->chan, 2929 chantype); 2930 /* user input for center_freq is incorrect */ 2931 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 2932 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 2933 NL_SET_ERR_MSG_ATTR(extack, 2934 attrs[NL80211_ATTR_CENTER_FREQ1], 2935 "bad center frequency 1"); 2936 return -EINVAL; 2937 } 2938 /* center_freq2 must be zero */ 2939 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 2940 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 2941 NL_SET_ERR_MSG_ATTR(extack, 2942 attrs[NL80211_ATTR_CENTER_FREQ2], 2943 "center frequency 2 can't be used"); 2944 return -EINVAL; 2945 } 2946 break; 2947 default: 2948 NL_SET_ERR_MSG_ATTR(extack, 2949 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 2950 "invalid channel type"); 2951 return -EINVAL; 2952 } 2953 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2954 chandef->width = 2955 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2956 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 2957 chandef->center_freq1 = 2958 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 2959 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 2960 chandef->freq1_offset = nla_get_u32( 2961 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 2962 else 2963 chandef->freq1_offset = 0; 2964 } 2965 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 2966 chandef->center_freq2 = 2967 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 2968 } 2969 2970 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 2971 chandef->edmg.channels = 2972 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 2973 2974 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 2975 chandef->edmg.bw_config = 2976 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 2977 } else { 2978 chandef->edmg.bw_config = 0; 2979 chandef->edmg.channels = 0; 2980 } 2981 2982 if (!cfg80211_chandef_valid(chandef)) { 2983 NL_SET_ERR_MSG(extack, "invalid channel definition"); 2984 return -EINVAL; 2985 } 2986 2987 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2988 IEEE80211_CHAN_DISABLED)) { 2989 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 2990 return -EINVAL; 2991 } 2992 2993 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2994 chandef->width == NL80211_CHAN_WIDTH_10) && 2995 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 2996 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 2997 return -EINVAL; 2998 } 2999 3000 return 0; 3001 } 3002 3003 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3004 struct net_device *dev, 3005 struct genl_info *info) 3006 { 3007 struct cfg80211_chan_def chandef; 3008 int result; 3009 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3010 struct wireless_dev *wdev = NULL; 3011 3012 if (dev) 3013 wdev = dev->ieee80211_ptr; 3014 if (!nl80211_can_set_dev_channel(wdev)) 3015 return -EOPNOTSUPP; 3016 if (wdev) 3017 iftype = wdev->iftype; 3018 3019 result = nl80211_parse_chandef(rdev, info, &chandef); 3020 if (result) 3021 return result; 3022 3023 switch (iftype) { 3024 case NL80211_IFTYPE_AP: 3025 case NL80211_IFTYPE_P2P_GO: 3026 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3027 iftype)) { 3028 result = -EINVAL; 3029 break; 3030 } 3031 if (wdev->beacon_interval) { 3032 if (!dev || !rdev->ops->set_ap_chanwidth || 3033 !(rdev->wiphy.features & 3034 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 3035 result = -EBUSY; 3036 break; 3037 } 3038 3039 /* Only allow dynamic channel width changes */ 3040 if (chandef.chan != wdev->preset_chandef.chan) { 3041 result = -EBUSY; 3042 break; 3043 } 3044 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 3045 if (result) 3046 break; 3047 } 3048 wdev->preset_chandef = chandef; 3049 result = 0; 3050 break; 3051 case NL80211_IFTYPE_MESH_POINT: 3052 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3053 break; 3054 case NL80211_IFTYPE_MONITOR: 3055 result = cfg80211_set_monitor_channel(rdev, &chandef); 3056 break; 3057 default: 3058 result = -EINVAL; 3059 } 3060 3061 return result; 3062 } 3063 3064 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3065 { 3066 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3067 struct net_device *netdev = info->user_ptr[1]; 3068 3069 return __nl80211_set_channel(rdev, netdev, info); 3070 } 3071 3072 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 3073 { 3074 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3075 struct net_device *dev = info->user_ptr[1]; 3076 struct wireless_dev *wdev = dev->ieee80211_ptr; 3077 const u8 *bssid; 3078 3079 if (!info->attrs[NL80211_ATTR_MAC]) 3080 return -EINVAL; 3081 3082 if (netif_running(dev)) 3083 return -EBUSY; 3084 3085 if (!rdev->ops->set_wds_peer) 3086 return -EOPNOTSUPP; 3087 3088 if (wdev->iftype != NL80211_IFTYPE_WDS) 3089 return -EOPNOTSUPP; 3090 3091 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 3092 return rdev_set_wds_peer(rdev, dev, bssid); 3093 } 3094 3095 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3096 { 3097 struct cfg80211_registered_device *rdev; 3098 struct net_device *netdev = NULL; 3099 struct wireless_dev *wdev; 3100 int result = 0, rem_txq_params = 0; 3101 struct nlattr *nl_txq_params; 3102 u32 changed; 3103 u8 retry_short = 0, retry_long = 0; 3104 u32 frag_threshold = 0, rts_threshold = 0; 3105 u8 coverage_class = 0; 3106 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3107 3108 ASSERT_RTNL(); 3109 3110 /* 3111 * Try to find the wiphy and netdev. Normally this 3112 * function shouldn't need the netdev, but this is 3113 * done for backward compatibility -- previously 3114 * setting the channel was done per wiphy, but now 3115 * it is per netdev. Previous userland like hostapd 3116 * also passed a netdev to set_wiphy, so that it is 3117 * possible to let that go to the right netdev! 3118 */ 3119 3120 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3121 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3122 3123 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3124 if (netdev && netdev->ieee80211_ptr) 3125 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3126 else 3127 netdev = NULL; 3128 } 3129 3130 if (!netdev) { 3131 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3132 info->attrs); 3133 if (IS_ERR(rdev)) 3134 return PTR_ERR(rdev); 3135 wdev = NULL; 3136 netdev = NULL; 3137 result = 0; 3138 } else 3139 wdev = netdev->ieee80211_ptr; 3140 3141 /* 3142 * end workaround code, by now the rdev is available 3143 * and locked, and wdev may or may not be NULL. 3144 */ 3145 3146 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3147 result = cfg80211_dev_rename( 3148 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3149 3150 if (result) 3151 return result; 3152 3153 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3154 struct ieee80211_txq_params txq_params; 3155 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3156 3157 if (!rdev->ops->set_txq_params) 3158 return -EOPNOTSUPP; 3159 3160 if (!netdev) 3161 return -EINVAL; 3162 3163 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3164 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3165 return -EINVAL; 3166 3167 if (!netif_running(netdev)) 3168 return -ENETDOWN; 3169 3170 nla_for_each_nested(nl_txq_params, 3171 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3172 rem_txq_params) { 3173 result = nla_parse_nested_deprecated(tb, 3174 NL80211_TXQ_ATTR_MAX, 3175 nl_txq_params, 3176 txq_params_policy, 3177 info->extack); 3178 if (result) 3179 return result; 3180 result = parse_txq_params(tb, &txq_params); 3181 if (result) 3182 return result; 3183 3184 result = rdev_set_txq_params(rdev, netdev, 3185 &txq_params); 3186 if (result) 3187 return result; 3188 } 3189 } 3190 3191 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3192 result = __nl80211_set_channel( 3193 rdev, 3194 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3195 info); 3196 if (result) 3197 return result; 3198 } 3199 3200 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3201 struct wireless_dev *txp_wdev = wdev; 3202 enum nl80211_tx_power_setting type; 3203 int idx, mbm = 0; 3204 3205 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3206 txp_wdev = NULL; 3207 3208 if (!rdev->ops->set_tx_power) 3209 return -EOPNOTSUPP; 3210 3211 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3212 type = nla_get_u32(info->attrs[idx]); 3213 3214 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3215 (type != NL80211_TX_POWER_AUTOMATIC)) 3216 return -EINVAL; 3217 3218 if (type != NL80211_TX_POWER_AUTOMATIC) { 3219 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3220 mbm = nla_get_u32(info->attrs[idx]); 3221 } 3222 3223 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3224 if (result) 3225 return result; 3226 } 3227 3228 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3229 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3230 u32 tx_ant, rx_ant; 3231 3232 if ((!rdev->wiphy.available_antennas_tx && 3233 !rdev->wiphy.available_antennas_rx) || 3234 !rdev->ops->set_antenna) 3235 return -EOPNOTSUPP; 3236 3237 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3238 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3239 3240 /* reject antenna configurations which don't match the 3241 * available antenna masks, except for the "all" mask */ 3242 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3243 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 3244 return -EINVAL; 3245 3246 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3247 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3248 3249 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3250 if (result) 3251 return result; 3252 } 3253 3254 changed = 0; 3255 3256 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3257 retry_short = nla_get_u8( 3258 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3259 3260 changed |= WIPHY_PARAM_RETRY_SHORT; 3261 } 3262 3263 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3264 retry_long = nla_get_u8( 3265 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3266 3267 changed |= WIPHY_PARAM_RETRY_LONG; 3268 } 3269 3270 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3271 frag_threshold = nla_get_u32( 3272 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3273 if (frag_threshold < 256) 3274 return -EINVAL; 3275 3276 if (frag_threshold != (u32) -1) { 3277 /* 3278 * Fragments (apart from the last one) are required to 3279 * have even length. Make the fragmentation code 3280 * simpler by stripping LSB should someone try to use 3281 * odd threshold value. 3282 */ 3283 frag_threshold &= ~0x1; 3284 } 3285 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3286 } 3287 3288 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3289 rts_threshold = nla_get_u32( 3290 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3291 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3292 } 3293 3294 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3295 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 3296 return -EINVAL; 3297 3298 coverage_class = nla_get_u8( 3299 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3300 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3301 } 3302 3303 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3304 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 3305 return -EOPNOTSUPP; 3306 3307 changed |= WIPHY_PARAM_DYN_ACK; 3308 } 3309 3310 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3311 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3312 NL80211_EXT_FEATURE_TXQS)) 3313 return -EOPNOTSUPP; 3314 txq_limit = nla_get_u32( 3315 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3316 changed |= WIPHY_PARAM_TXQ_LIMIT; 3317 } 3318 3319 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3320 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3321 NL80211_EXT_FEATURE_TXQS)) 3322 return -EOPNOTSUPP; 3323 txq_memory_limit = nla_get_u32( 3324 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3325 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3326 } 3327 3328 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3329 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3330 NL80211_EXT_FEATURE_TXQS)) 3331 return -EOPNOTSUPP; 3332 txq_quantum = nla_get_u32( 3333 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3334 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3335 } 3336 3337 if (changed) { 3338 u8 old_retry_short, old_retry_long; 3339 u32 old_frag_threshold, old_rts_threshold; 3340 u8 old_coverage_class; 3341 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3342 3343 if (!rdev->ops->set_wiphy_params) 3344 return -EOPNOTSUPP; 3345 3346 old_retry_short = rdev->wiphy.retry_short; 3347 old_retry_long = rdev->wiphy.retry_long; 3348 old_frag_threshold = rdev->wiphy.frag_threshold; 3349 old_rts_threshold = rdev->wiphy.rts_threshold; 3350 old_coverage_class = rdev->wiphy.coverage_class; 3351 old_txq_limit = rdev->wiphy.txq_limit; 3352 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3353 old_txq_quantum = rdev->wiphy.txq_quantum; 3354 3355 if (changed & WIPHY_PARAM_RETRY_SHORT) 3356 rdev->wiphy.retry_short = retry_short; 3357 if (changed & WIPHY_PARAM_RETRY_LONG) 3358 rdev->wiphy.retry_long = retry_long; 3359 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3360 rdev->wiphy.frag_threshold = frag_threshold; 3361 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3362 rdev->wiphy.rts_threshold = rts_threshold; 3363 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3364 rdev->wiphy.coverage_class = coverage_class; 3365 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3366 rdev->wiphy.txq_limit = txq_limit; 3367 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3368 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3369 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3370 rdev->wiphy.txq_quantum = txq_quantum; 3371 3372 result = rdev_set_wiphy_params(rdev, changed); 3373 if (result) { 3374 rdev->wiphy.retry_short = old_retry_short; 3375 rdev->wiphy.retry_long = old_retry_long; 3376 rdev->wiphy.frag_threshold = old_frag_threshold; 3377 rdev->wiphy.rts_threshold = old_rts_threshold; 3378 rdev->wiphy.coverage_class = old_coverage_class; 3379 rdev->wiphy.txq_limit = old_txq_limit; 3380 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3381 rdev->wiphy.txq_quantum = old_txq_quantum; 3382 return result; 3383 } 3384 } 3385 return 0; 3386 } 3387 3388 static int nl80211_send_chandef(struct sk_buff *msg, 3389 const struct cfg80211_chan_def *chandef) 3390 { 3391 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3392 return -EINVAL; 3393 3394 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3395 chandef->chan->center_freq)) 3396 return -ENOBUFS; 3397 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3398 chandef->chan->freq_offset)) 3399 return -ENOBUFS; 3400 switch (chandef->width) { 3401 case NL80211_CHAN_WIDTH_20_NOHT: 3402 case NL80211_CHAN_WIDTH_20: 3403 case NL80211_CHAN_WIDTH_40: 3404 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3405 cfg80211_get_chandef_type(chandef))) 3406 return -ENOBUFS; 3407 break; 3408 default: 3409 break; 3410 } 3411 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3412 return -ENOBUFS; 3413 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3414 return -ENOBUFS; 3415 if (chandef->center_freq2 && 3416 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3417 return -ENOBUFS; 3418 return 0; 3419 } 3420 3421 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3422 struct cfg80211_registered_device *rdev, 3423 struct wireless_dev *wdev, 3424 enum nl80211_commands cmd) 3425 { 3426 struct net_device *dev = wdev->netdev; 3427 void *hdr; 3428 3429 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3430 cmd != NL80211_CMD_DEL_INTERFACE && 3431 cmd != NL80211_CMD_SET_INTERFACE); 3432 3433 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3434 if (!hdr) 3435 return -1; 3436 3437 if (dev && 3438 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3439 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3440 goto nla_put_failure; 3441 3442 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3443 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3444 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3445 NL80211_ATTR_PAD) || 3446 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3447 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3448 rdev->devlist_generation ^ 3449 (cfg80211_rdev_list_generation << 2)) || 3450 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3451 goto nla_put_failure; 3452 3453 if (rdev->ops->get_channel) { 3454 int ret; 3455 struct cfg80211_chan_def chandef = {}; 3456 3457 ret = rdev_get_channel(rdev, wdev, &chandef); 3458 if (ret == 0) { 3459 if (nl80211_send_chandef(msg, &chandef)) 3460 goto nla_put_failure; 3461 } 3462 } 3463 3464 if (rdev->ops->get_tx_power) { 3465 int dbm, ret; 3466 3467 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3468 if (ret == 0 && 3469 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3470 DBM_TO_MBM(dbm))) 3471 goto nla_put_failure; 3472 } 3473 3474 wdev_lock(wdev); 3475 switch (wdev->iftype) { 3476 case NL80211_IFTYPE_AP: 3477 if (wdev->ssid_len && 3478 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 3479 goto nla_put_failure_locked; 3480 break; 3481 case NL80211_IFTYPE_STATION: 3482 case NL80211_IFTYPE_P2P_CLIENT: 3483 case NL80211_IFTYPE_ADHOC: { 3484 const u8 *ssid_ie; 3485 if (!wdev->current_bss) 3486 break; 3487 rcu_read_lock(); 3488 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 3489 WLAN_EID_SSID); 3490 if (ssid_ie && 3491 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 3492 goto nla_put_failure_rcu_locked; 3493 rcu_read_unlock(); 3494 break; 3495 } 3496 default: 3497 /* nothing */ 3498 break; 3499 } 3500 wdev_unlock(wdev); 3501 3502 if (rdev->ops->get_txq_stats) { 3503 struct cfg80211_txq_stats txqstats = {}; 3504 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3505 3506 if (ret == 0 && 3507 !nl80211_put_txq_stats(msg, &txqstats, 3508 NL80211_ATTR_TXQ_STATS)) 3509 goto nla_put_failure; 3510 } 3511 3512 genlmsg_end(msg, hdr); 3513 return 0; 3514 3515 nla_put_failure_rcu_locked: 3516 rcu_read_unlock(); 3517 nla_put_failure_locked: 3518 wdev_unlock(wdev); 3519 nla_put_failure: 3520 genlmsg_cancel(msg, hdr); 3521 return -EMSGSIZE; 3522 } 3523 3524 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3525 { 3526 int wp_idx = 0; 3527 int if_idx = 0; 3528 int wp_start = cb->args[0]; 3529 int if_start = cb->args[1]; 3530 int filter_wiphy = -1; 3531 struct cfg80211_registered_device *rdev; 3532 struct wireless_dev *wdev; 3533 int ret; 3534 3535 rtnl_lock(); 3536 if (!cb->args[2]) { 3537 struct nl80211_dump_wiphy_state state = { 3538 .filter_wiphy = -1, 3539 }; 3540 3541 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3542 if (ret) 3543 goto out_unlock; 3544 3545 filter_wiphy = state.filter_wiphy; 3546 3547 /* 3548 * if filtering, set cb->args[2] to +1 since 0 is the default 3549 * value needed to determine that parsing is necessary. 3550 */ 3551 if (filter_wiphy >= 0) 3552 cb->args[2] = filter_wiphy + 1; 3553 else 3554 cb->args[2] = -1; 3555 } else if (cb->args[2] > 0) { 3556 filter_wiphy = cb->args[2] - 1; 3557 } 3558 3559 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 3560 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3561 continue; 3562 if (wp_idx < wp_start) { 3563 wp_idx++; 3564 continue; 3565 } 3566 3567 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 3568 continue; 3569 3570 if_idx = 0; 3571 3572 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3573 if (if_idx < if_start) { 3574 if_idx++; 3575 continue; 3576 } 3577 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 3578 cb->nlh->nlmsg_seq, NLM_F_MULTI, 3579 rdev, wdev, 3580 NL80211_CMD_NEW_INTERFACE) < 0) { 3581 goto out; 3582 } 3583 if_idx++; 3584 } 3585 3586 wp_idx++; 3587 } 3588 out: 3589 cb->args[0] = wp_idx; 3590 cb->args[1] = if_idx; 3591 3592 ret = skb->len; 3593 out_unlock: 3594 rtnl_unlock(); 3595 3596 return ret; 3597 } 3598 3599 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 3600 { 3601 struct sk_buff *msg; 3602 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3603 struct wireless_dev *wdev = info->user_ptr[1]; 3604 3605 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3606 if (!msg) 3607 return -ENOMEM; 3608 3609 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3610 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3611 nlmsg_free(msg); 3612 return -ENOBUFS; 3613 } 3614 3615 return genlmsg_reply(msg, info); 3616 } 3617 3618 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 3619 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 3620 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 3621 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 3622 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 3623 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 3624 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 3625 }; 3626 3627 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 3628 { 3629 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 3630 int flag; 3631 3632 *mntrflags = 0; 3633 3634 if (!nla) 3635 return -EINVAL; 3636 3637 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 3638 return -EINVAL; 3639 3640 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 3641 if (flags[flag]) 3642 *mntrflags |= (1<<flag); 3643 3644 *mntrflags |= MONITOR_FLAG_CHANGED; 3645 3646 return 0; 3647 } 3648 3649 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 3650 enum nl80211_iftype type, 3651 struct genl_info *info, 3652 struct vif_params *params) 3653 { 3654 bool change = false; 3655 int err; 3656 3657 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 3658 if (type != NL80211_IFTYPE_MONITOR) 3659 return -EINVAL; 3660 3661 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 3662 ¶ms->flags); 3663 if (err) 3664 return err; 3665 3666 change = true; 3667 } 3668 3669 if (params->flags & MONITOR_FLAG_ACTIVE && 3670 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 3671 return -EOPNOTSUPP; 3672 3673 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 3674 const u8 *mumimo_groups; 3675 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3676 3677 if (type != NL80211_IFTYPE_MONITOR) 3678 return -EINVAL; 3679 3680 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3681 return -EOPNOTSUPP; 3682 3683 mumimo_groups = 3684 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 3685 3686 /* bits 0 and 63 are reserved and must be zero */ 3687 if ((mumimo_groups[0] & BIT(0)) || 3688 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 3689 return -EINVAL; 3690 3691 params->vht_mumimo_groups = mumimo_groups; 3692 change = true; 3693 } 3694 3695 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 3696 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3697 3698 if (type != NL80211_IFTYPE_MONITOR) 3699 return -EINVAL; 3700 3701 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3702 return -EOPNOTSUPP; 3703 3704 params->vht_mumimo_follow_addr = 3705 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 3706 change = true; 3707 } 3708 3709 return change ? 1 : 0; 3710 } 3711 3712 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 3713 struct net_device *netdev, u8 use_4addr, 3714 enum nl80211_iftype iftype) 3715 { 3716 if (!use_4addr) { 3717 if (netdev && netif_is_bridge_port(netdev)) 3718 return -EBUSY; 3719 return 0; 3720 } 3721 3722 switch (iftype) { 3723 case NL80211_IFTYPE_AP_VLAN: 3724 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 3725 return 0; 3726 break; 3727 case NL80211_IFTYPE_STATION: 3728 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 3729 return 0; 3730 break; 3731 default: 3732 break; 3733 } 3734 3735 return -EOPNOTSUPP; 3736 } 3737 3738 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 3739 { 3740 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3741 struct vif_params params; 3742 int err; 3743 enum nl80211_iftype otype, ntype; 3744 struct net_device *dev = info->user_ptr[1]; 3745 bool change = false; 3746 3747 memset(¶ms, 0, sizeof(params)); 3748 3749 otype = ntype = dev->ieee80211_ptr->iftype; 3750 3751 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3752 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3753 if (otype != ntype) 3754 change = true; 3755 } 3756 3757 if (info->attrs[NL80211_ATTR_MESH_ID]) { 3758 struct wireless_dev *wdev = dev->ieee80211_ptr; 3759 3760 if (ntype != NL80211_IFTYPE_MESH_POINT) 3761 return -EINVAL; 3762 if (netif_running(dev)) 3763 return -EBUSY; 3764 3765 wdev_lock(wdev); 3766 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3767 IEEE80211_MAX_MESH_ID_LEN); 3768 wdev->mesh_id_up_len = 3769 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3770 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3771 wdev->mesh_id_up_len); 3772 wdev_unlock(wdev); 3773 } 3774 3775 if (info->attrs[NL80211_ATTR_4ADDR]) { 3776 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3777 change = true; 3778 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 3779 if (err) 3780 return err; 3781 } else { 3782 params.use_4addr = -1; 3783 } 3784 3785 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 3786 if (err < 0) 3787 return err; 3788 if (err > 0) 3789 change = true; 3790 3791 if (change) 3792 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 3793 else 3794 err = 0; 3795 3796 if (!err && params.use_4addr != -1) 3797 dev->ieee80211_ptr->use_4addr = params.use_4addr; 3798 3799 if (change && !err) { 3800 struct wireless_dev *wdev = dev->ieee80211_ptr; 3801 3802 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 3803 } 3804 3805 return err; 3806 } 3807 3808 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 3809 { 3810 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3811 struct vif_params params; 3812 struct wireless_dev *wdev; 3813 struct sk_buff *msg; 3814 int err; 3815 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 3816 3817 /* to avoid failing a new interface creation due to pending removal */ 3818 cfg80211_destroy_ifaces(rdev); 3819 3820 memset(¶ms, 0, sizeof(params)); 3821 3822 if (!info->attrs[NL80211_ATTR_IFNAME]) 3823 return -EINVAL; 3824 3825 if (info->attrs[NL80211_ATTR_IFTYPE]) 3826 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3827 3828 if (!rdev->ops->add_virtual_intf) 3829 return -EOPNOTSUPP; 3830 3831 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 3832 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 3833 info->attrs[NL80211_ATTR_MAC]) { 3834 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 3835 ETH_ALEN); 3836 if (!is_valid_ether_addr(params.macaddr)) 3837 return -EADDRNOTAVAIL; 3838 } 3839 3840 if (info->attrs[NL80211_ATTR_4ADDR]) { 3841 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3842 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 3843 if (err) 3844 return err; 3845 } 3846 3847 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 3848 return -EOPNOTSUPP; 3849 3850 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 3851 if (err < 0) 3852 return err; 3853 3854 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3855 if (!msg) 3856 return -ENOMEM; 3857 3858 wdev = rdev_add_virtual_intf(rdev, 3859 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 3860 NET_NAME_USER, type, ¶ms); 3861 if (WARN_ON(!wdev)) { 3862 nlmsg_free(msg); 3863 return -EPROTO; 3864 } else if (IS_ERR(wdev)) { 3865 nlmsg_free(msg); 3866 return PTR_ERR(wdev); 3867 } 3868 3869 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 3870 wdev->owner_nlportid = info->snd_portid; 3871 3872 switch (type) { 3873 case NL80211_IFTYPE_MESH_POINT: 3874 if (!info->attrs[NL80211_ATTR_MESH_ID]) 3875 break; 3876 wdev_lock(wdev); 3877 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3878 IEEE80211_MAX_MESH_ID_LEN); 3879 wdev->mesh_id_up_len = 3880 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3881 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3882 wdev->mesh_id_up_len); 3883 wdev_unlock(wdev); 3884 break; 3885 case NL80211_IFTYPE_NAN: 3886 case NL80211_IFTYPE_P2P_DEVICE: 3887 /* 3888 * P2P Device and NAN do not have a netdev, so don't go 3889 * through the netdev notifier and must be added here 3890 */ 3891 cfg80211_init_wdev(rdev, wdev); 3892 break; 3893 default: 3894 break; 3895 } 3896 3897 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3898 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 3899 nlmsg_free(msg); 3900 return -ENOBUFS; 3901 } 3902 3903 return genlmsg_reply(msg, info); 3904 } 3905 3906 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3907 { 3908 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3909 struct wireless_dev *wdev = info->user_ptr[1]; 3910 3911 if (!rdev->ops->del_virtual_intf) 3912 return -EOPNOTSUPP; 3913 3914 /* 3915 * If we remove a wireless device without a netdev then clear 3916 * user_ptr[1] so that nl80211_post_doit won't dereference it 3917 * to check if it needs to do dev_put(). Otherwise it crashes 3918 * since the wdev has been freed, unlike with a netdev where 3919 * we need the dev_put() for the netdev to really be freed. 3920 */ 3921 if (!wdev->netdev) 3922 info->user_ptr[1] = NULL; 3923 3924 return rdev_del_virtual_intf(rdev, wdev); 3925 } 3926 3927 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3928 { 3929 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3930 struct net_device *dev = info->user_ptr[1]; 3931 u16 noack_map; 3932 3933 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3934 return -EINVAL; 3935 3936 if (!rdev->ops->set_noack_map) 3937 return -EOPNOTSUPP; 3938 3939 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3940 3941 return rdev_set_noack_map(rdev, dev, noack_map); 3942 } 3943 3944 struct get_key_cookie { 3945 struct sk_buff *msg; 3946 int error; 3947 int idx; 3948 }; 3949 3950 static void get_key_callback(void *c, struct key_params *params) 3951 { 3952 struct nlattr *key; 3953 struct get_key_cookie *cookie = c; 3954 3955 if ((params->key && 3956 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3957 params->key_len, params->key)) || 3958 (params->seq && 3959 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3960 params->seq_len, params->seq)) || 3961 (params->cipher && 3962 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3963 params->cipher))) 3964 goto nla_put_failure; 3965 3966 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 3967 if (!key) 3968 goto nla_put_failure; 3969 3970 if ((params->key && 3971 nla_put(cookie->msg, NL80211_KEY_DATA, 3972 params->key_len, params->key)) || 3973 (params->seq && 3974 nla_put(cookie->msg, NL80211_KEY_SEQ, 3975 params->seq_len, params->seq)) || 3976 (params->cipher && 3977 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3978 params->cipher))) 3979 goto nla_put_failure; 3980 3981 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 3982 goto nla_put_failure; 3983 3984 nla_nest_end(cookie->msg, key); 3985 3986 return; 3987 nla_put_failure: 3988 cookie->error = 1; 3989 } 3990 3991 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3992 { 3993 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3994 int err; 3995 struct net_device *dev = info->user_ptr[1]; 3996 u8 key_idx = 0; 3997 const u8 *mac_addr = NULL; 3998 bool pairwise; 3999 struct get_key_cookie cookie = { 4000 .error = 0, 4001 }; 4002 void *hdr; 4003 struct sk_buff *msg; 4004 bool bigtk_support = false; 4005 4006 if (wiphy_ext_feature_isset(&rdev->wiphy, 4007 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 4008 bigtk_support = true; 4009 4010 if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION || 4011 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) && 4012 wiphy_ext_feature_isset(&rdev->wiphy, 4013 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 4014 bigtk_support = true; 4015 4016 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 4017 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 4018 4019 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 4020 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 4021 return -EINVAL; 4022 } 4023 } 4024 4025 if (info->attrs[NL80211_ATTR_MAC]) 4026 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4027 4028 pairwise = !!mac_addr; 4029 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4030 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4031 4032 if (kt != NL80211_KEYTYPE_GROUP && 4033 kt != NL80211_KEYTYPE_PAIRWISE) 4034 return -EINVAL; 4035 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4036 } 4037 4038 if (!rdev->ops->get_key) 4039 return -EOPNOTSUPP; 4040 4041 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4042 return -ENOENT; 4043 4044 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4045 if (!msg) 4046 return -ENOMEM; 4047 4048 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4049 NL80211_CMD_NEW_KEY); 4050 if (!hdr) 4051 goto nla_put_failure; 4052 4053 cookie.msg = msg; 4054 cookie.idx = key_idx; 4055 4056 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4057 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4058 goto nla_put_failure; 4059 if (mac_addr && 4060 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4061 goto nla_put_failure; 4062 4063 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 4064 get_key_callback); 4065 4066 if (err) 4067 goto free_msg; 4068 4069 if (cookie.error) 4070 goto nla_put_failure; 4071 4072 genlmsg_end(msg, hdr); 4073 return genlmsg_reply(msg, info); 4074 4075 nla_put_failure: 4076 err = -ENOBUFS; 4077 free_msg: 4078 nlmsg_free(msg); 4079 return err; 4080 } 4081 4082 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4083 { 4084 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4085 struct key_parse key; 4086 int err; 4087 struct net_device *dev = info->user_ptr[1]; 4088 4089 err = nl80211_parse_key(info, &key); 4090 if (err) 4091 return err; 4092 4093 if (key.idx < 0) 4094 return -EINVAL; 4095 4096 /* Only support setting default key and 4097 * Extended Key ID action NL80211_KEY_SET_TX. 4098 */ 4099 if (!key.def && !key.defmgmt && !key.defbeacon && 4100 !(key.p.mode == NL80211_KEY_SET_TX)) 4101 return -EINVAL; 4102 4103 wdev_lock(dev->ieee80211_ptr); 4104 4105 if (key.def) { 4106 if (!rdev->ops->set_default_key) { 4107 err = -EOPNOTSUPP; 4108 goto out; 4109 } 4110 4111 err = nl80211_key_allowed(dev->ieee80211_ptr); 4112 if (err) 4113 goto out; 4114 4115 err = rdev_set_default_key(rdev, dev, key.idx, 4116 key.def_uni, key.def_multi); 4117 4118 if (err) 4119 goto out; 4120 4121 #ifdef CONFIG_CFG80211_WEXT 4122 dev->ieee80211_ptr->wext.default_key = key.idx; 4123 #endif 4124 } else if (key.defmgmt) { 4125 if (key.def_uni || !key.def_multi) { 4126 err = -EINVAL; 4127 goto out; 4128 } 4129 4130 if (!rdev->ops->set_default_mgmt_key) { 4131 err = -EOPNOTSUPP; 4132 goto out; 4133 } 4134 4135 err = nl80211_key_allowed(dev->ieee80211_ptr); 4136 if (err) 4137 goto out; 4138 4139 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 4140 if (err) 4141 goto out; 4142 4143 #ifdef CONFIG_CFG80211_WEXT 4144 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 4145 #endif 4146 } else if (key.defbeacon) { 4147 if (key.def_uni || !key.def_multi) { 4148 err = -EINVAL; 4149 goto out; 4150 } 4151 4152 if (!rdev->ops->set_default_beacon_key) { 4153 err = -EOPNOTSUPP; 4154 goto out; 4155 } 4156 4157 err = nl80211_key_allowed(dev->ieee80211_ptr); 4158 if (err) 4159 goto out; 4160 4161 err = rdev_set_default_beacon_key(rdev, dev, key.idx); 4162 if (err) 4163 goto out; 4164 } else if (key.p.mode == NL80211_KEY_SET_TX && 4165 wiphy_ext_feature_isset(&rdev->wiphy, 4166 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4167 u8 *mac_addr = NULL; 4168 4169 if (info->attrs[NL80211_ATTR_MAC]) 4170 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4171 4172 if (!mac_addr || key.idx < 0 || key.idx > 1) { 4173 err = -EINVAL; 4174 goto out; 4175 } 4176 4177 err = rdev_add_key(rdev, dev, key.idx, 4178 NL80211_KEYTYPE_PAIRWISE, 4179 mac_addr, &key.p); 4180 } else { 4181 err = -EINVAL; 4182 } 4183 out: 4184 wdev_unlock(dev->ieee80211_ptr); 4185 4186 return err; 4187 } 4188 4189 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4190 { 4191 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4192 int err; 4193 struct net_device *dev = info->user_ptr[1]; 4194 struct key_parse key; 4195 const u8 *mac_addr = NULL; 4196 4197 err = nl80211_parse_key(info, &key); 4198 if (err) 4199 return err; 4200 4201 if (!key.p.key) { 4202 GENL_SET_ERR_MSG(info, "no key"); 4203 return -EINVAL; 4204 } 4205 4206 if (info->attrs[NL80211_ATTR_MAC]) 4207 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4208 4209 if (key.type == -1) { 4210 if (mac_addr) 4211 key.type = NL80211_KEYTYPE_PAIRWISE; 4212 else 4213 key.type = NL80211_KEYTYPE_GROUP; 4214 } 4215 4216 /* for now */ 4217 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4218 key.type != NL80211_KEYTYPE_GROUP) { 4219 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4220 return -EINVAL; 4221 } 4222 4223 if (key.type == NL80211_KEYTYPE_GROUP && 4224 info->attrs[NL80211_ATTR_VLAN_ID]) 4225 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4226 4227 if (!rdev->ops->add_key) 4228 return -EOPNOTSUPP; 4229 4230 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4231 key.type == NL80211_KEYTYPE_PAIRWISE, 4232 mac_addr)) { 4233 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4234 return -EINVAL; 4235 } 4236 4237 wdev_lock(dev->ieee80211_ptr); 4238 err = nl80211_key_allowed(dev->ieee80211_ptr); 4239 if (err) 4240 GENL_SET_ERR_MSG(info, "key not allowed"); 4241 if (!err) { 4242 err = rdev_add_key(rdev, dev, key.idx, 4243 key.type == NL80211_KEYTYPE_PAIRWISE, 4244 mac_addr, &key.p); 4245 if (err) 4246 GENL_SET_ERR_MSG(info, "key addition failed"); 4247 } 4248 wdev_unlock(dev->ieee80211_ptr); 4249 4250 return err; 4251 } 4252 4253 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4254 { 4255 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4256 int err; 4257 struct net_device *dev = info->user_ptr[1]; 4258 u8 *mac_addr = NULL; 4259 struct key_parse key; 4260 4261 err = nl80211_parse_key(info, &key); 4262 if (err) 4263 return err; 4264 4265 if (key.idx < 0) 4266 return -EINVAL; 4267 4268 if (info->attrs[NL80211_ATTR_MAC]) 4269 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4270 4271 if (key.type == -1) { 4272 if (mac_addr) 4273 key.type = NL80211_KEYTYPE_PAIRWISE; 4274 else 4275 key.type = NL80211_KEYTYPE_GROUP; 4276 } 4277 4278 /* for now */ 4279 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4280 key.type != NL80211_KEYTYPE_GROUP) 4281 return -EINVAL; 4282 4283 if (!rdev->ops->del_key) 4284 return -EOPNOTSUPP; 4285 4286 wdev_lock(dev->ieee80211_ptr); 4287 err = nl80211_key_allowed(dev->ieee80211_ptr); 4288 4289 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4290 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4291 err = -ENOENT; 4292 4293 if (!err) 4294 err = rdev_del_key(rdev, dev, key.idx, 4295 key.type == NL80211_KEYTYPE_PAIRWISE, 4296 mac_addr); 4297 4298 #ifdef CONFIG_CFG80211_WEXT 4299 if (!err) { 4300 if (key.idx == dev->ieee80211_ptr->wext.default_key) 4301 dev->ieee80211_ptr->wext.default_key = -1; 4302 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 4303 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 4304 } 4305 #endif 4306 wdev_unlock(dev->ieee80211_ptr); 4307 4308 return err; 4309 } 4310 4311 /* This function returns an error or the number of nested attributes */ 4312 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4313 { 4314 struct nlattr *attr; 4315 int n_entries = 0, tmp; 4316 4317 nla_for_each_nested(attr, nl_attr, tmp) { 4318 if (nla_len(attr) != ETH_ALEN) 4319 return -EINVAL; 4320 4321 n_entries++; 4322 } 4323 4324 return n_entries; 4325 } 4326 4327 /* 4328 * This function parses ACL information and allocates memory for ACL data. 4329 * On successful return, the calling function is responsible to free the 4330 * ACL buffer returned by this function. 4331 */ 4332 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4333 struct genl_info *info) 4334 { 4335 enum nl80211_acl_policy acl_policy; 4336 struct nlattr *attr; 4337 struct cfg80211_acl_data *acl; 4338 int i = 0, n_entries, tmp; 4339 4340 if (!wiphy->max_acl_mac_addrs) 4341 return ERR_PTR(-EOPNOTSUPP); 4342 4343 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4344 return ERR_PTR(-EINVAL); 4345 4346 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4347 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4348 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4349 return ERR_PTR(-EINVAL); 4350 4351 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4352 return ERR_PTR(-EINVAL); 4353 4354 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4355 if (n_entries < 0) 4356 return ERR_PTR(n_entries); 4357 4358 if (n_entries > wiphy->max_acl_mac_addrs) 4359 return ERR_PTR(-ENOTSUPP); 4360 4361 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4362 if (!acl) 4363 return ERR_PTR(-ENOMEM); 4364 4365 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4366 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4367 i++; 4368 } 4369 4370 acl->n_acl_entries = n_entries; 4371 acl->acl_policy = acl_policy; 4372 4373 return acl; 4374 } 4375 4376 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4377 { 4378 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4379 struct net_device *dev = info->user_ptr[1]; 4380 struct cfg80211_acl_data *acl; 4381 int err; 4382 4383 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4384 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4385 return -EOPNOTSUPP; 4386 4387 if (!dev->ieee80211_ptr->beacon_interval) 4388 return -EINVAL; 4389 4390 acl = parse_acl_data(&rdev->wiphy, info); 4391 if (IS_ERR(acl)) 4392 return PTR_ERR(acl); 4393 4394 err = rdev_set_mac_acl(rdev, dev, acl); 4395 4396 kfree(acl); 4397 4398 return err; 4399 } 4400 4401 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4402 u8 *rates, u8 rates_len) 4403 { 4404 u8 i; 4405 u32 mask = 0; 4406 4407 for (i = 0; i < rates_len; i++) { 4408 int rate = (rates[i] & 0x7f) * 5; 4409 int ridx; 4410 4411 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4412 struct ieee80211_rate *srate = 4413 &sband->bitrates[ridx]; 4414 if (rate == srate->bitrate) { 4415 mask |= 1 << ridx; 4416 break; 4417 } 4418 } 4419 if (ridx == sband->n_bitrates) 4420 return 0; /* rate not found */ 4421 } 4422 4423 return mask; 4424 } 4425 4426 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4427 u8 *rates, u8 rates_len, 4428 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4429 { 4430 u8 i; 4431 4432 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4433 4434 for (i = 0; i < rates_len; i++) { 4435 int ridx, rbit; 4436 4437 ridx = rates[i] / 8; 4438 rbit = BIT(rates[i] % 8); 4439 4440 /* check validity */ 4441 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4442 return false; 4443 4444 /* check availability */ 4445 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4446 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4447 mcs[ridx] |= rbit; 4448 else 4449 return false; 4450 } 4451 4452 return true; 4453 } 4454 4455 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4456 { 4457 u16 mcs_mask = 0; 4458 4459 switch (vht_mcs_map) { 4460 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4461 break; 4462 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4463 mcs_mask = 0x00FF; 4464 break; 4465 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4466 mcs_mask = 0x01FF; 4467 break; 4468 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4469 mcs_mask = 0x03FF; 4470 break; 4471 default: 4472 break; 4473 } 4474 4475 return mcs_mask; 4476 } 4477 4478 static void vht_build_mcs_mask(u16 vht_mcs_map, 4479 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4480 { 4481 u8 nss; 4482 4483 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4484 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4485 vht_mcs_map >>= 2; 4486 } 4487 } 4488 4489 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 4490 struct nl80211_txrate_vht *txrate, 4491 u16 mcs[NL80211_VHT_NSS_MAX]) 4492 { 4493 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4494 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 4495 u8 i; 4496 4497 if (!sband->vht_cap.vht_supported) 4498 return false; 4499 4500 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 4501 4502 /* Build vht_mcs_mask from VHT capabilities */ 4503 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4504 4505 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4506 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4507 mcs[i] = txrate->mcs[i]; 4508 else 4509 return false; 4510 } 4511 4512 return true; 4513 } 4514 4515 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 4516 { 4517 switch (he_mcs_map) { 4518 case IEEE80211_HE_MCS_NOT_SUPPORTED: 4519 return 0; 4520 case IEEE80211_HE_MCS_SUPPORT_0_7: 4521 return 0x00FF; 4522 case IEEE80211_HE_MCS_SUPPORT_0_9: 4523 return 0x03FF; 4524 case IEEE80211_HE_MCS_SUPPORT_0_11: 4525 return 0xFFF; 4526 default: 4527 break; 4528 } 4529 return 0; 4530 } 4531 4532 static void he_build_mcs_mask(u16 he_mcs_map, 4533 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 4534 { 4535 u8 nss; 4536 4537 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 4538 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 4539 he_mcs_map >>= 2; 4540 } 4541 } 4542 4543 static u16 he_get_txmcsmap(struct genl_info *info, 4544 const struct ieee80211_sta_he_cap *he_cap) 4545 { 4546 struct net_device *dev = info->user_ptr[1]; 4547 struct wireless_dev *wdev = dev->ieee80211_ptr; 4548 __le16 tx_mcs; 4549 4550 switch (wdev->chandef.width) { 4551 case NL80211_CHAN_WIDTH_80P80: 4552 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 4553 break; 4554 case NL80211_CHAN_WIDTH_160: 4555 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 4556 break; 4557 default: 4558 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 4559 break; 4560 } 4561 return le16_to_cpu(tx_mcs); 4562 } 4563 4564 static bool he_set_mcs_mask(struct genl_info *info, 4565 struct wireless_dev *wdev, 4566 struct ieee80211_supported_band *sband, 4567 struct nl80211_txrate_he *txrate, 4568 u16 mcs[NL80211_HE_NSS_MAX]) 4569 { 4570 const struct ieee80211_sta_he_cap *he_cap; 4571 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 4572 u16 tx_mcs_map = 0; 4573 u8 i; 4574 4575 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4576 if (!he_cap) 4577 return false; 4578 4579 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 4580 4581 tx_mcs_map = he_get_txmcsmap(info, he_cap); 4582 4583 /* Build he_mcs_mask from HE capabilities */ 4584 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 4585 4586 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 4587 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 4588 mcs[i] = txrate->mcs[i]; 4589 else 4590 return false; 4591 } 4592 4593 return true; 4594 } 4595 4596 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 4597 struct nlattr *attrs[], 4598 enum nl80211_attrs attr, 4599 struct cfg80211_bitrate_mask *mask, 4600 struct net_device *dev) 4601 { 4602 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 4603 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4604 struct wireless_dev *wdev = dev->ieee80211_ptr; 4605 int rem, i; 4606 struct nlattr *tx_rates; 4607 struct ieee80211_supported_band *sband; 4608 u16 vht_tx_mcs_map, he_tx_mcs_map; 4609 4610 memset(mask, 0, sizeof(*mask)); 4611 /* Default to all rates enabled */ 4612 for (i = 0; i < NUM_NL80211_BANDS; i++) { 4613 const struct ieee80211_sta_he_cap *he_cap; 4614 4615 sband = rdev->wiphy.bands[i]; 4616 4617 if (!sband) 4618 continue; 4619 4620 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 4621 memcpy(mask->control[i].ht_mcs, 4622 sband->ht_cap.mcs.rx_mask, 4623 sizeof(mask->control[i].ht_mcs)); 4624 4625 if (!sband->vht_cap.vht_supported) 4626 continue; 4627 4628 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 4629 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 4630 4631 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 4632 if (!he_cap) 4633 continue; 4634 4635 he_tx_mcs_map = he_get_txmcsmap(info, he_cap); 4636 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 4637 4638 mask->control[i].he_gi = 0xFF; 4639 mask->control[i].he_ltf = 0xFF; 4640 } 4641 4642 /* if no rates are given set it back to the defaults */ 4643 if (!attrs[attr]) 4644 goto out; 4645 4646 /* The nested attribute uses enum nl80211_band as the index. This maps 4647 * directly to the enum nl80211_band values used in cfg80211. 4648 */ 4649 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 4650 nla_for_each_nested(tx_rates, attrs[attr], rem) { 4651 enum nl80211_band band = nla_type(tx_rates); 4652 int err; 4653 4654 if (band < 0 || band >= NUM_NL80211_BANDS) 4655 return -EINVAL; 4656 sband = rdev->wiphy.bands[band]; 4657 if (sband == NULL) 4658 return -EINVAL; 4659 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 4660 tx_rates, 4661 nl80211_txattr_policy, 4662 info->extack); 4663 if (err) 4664 return err; 4665 if (tb[NL80211_TXRATE_LEGACY]) { 4666 mask->control[band].legacy = rateset_to_mask( 4667 sband, 4668 nla_data(tb[NL80211_TXRATE_LEGACY]), 4669 nla_len(tb[NL80211_TXRATE_LEGACY])); 4670 if ((mask->control[band].legacy == 0) && 4671 nla_len(tb[NL80211_TXRATE_LEGACY])) 4672 return -EINVAL; 4673 } 4674 if (tb[NL80211_TXRATE_HT]) { 4675 if (!ht_rateset_to_mask( 4676 sband, 4677 nla_data(tb[NL80211_TXRATE_HT]), 4678 nla_len(tb[NL80211_TXRATE_HT]), 4679 mask->control[band].ht_mcs)) 4680 return -EINVAL; 4681 } 4682 if (tb[NL80211_TXRATE_VHT]) { 4683 if (!vht_set_mcs_mask( 4684 sband, 4685 nla_data(tb[NL80211_TXRATE_VHT]), 4686 mask->control[band].vht_mcs)) 4687 return -EINVAL; 4688 } 4689 if (tb[NL80211_TXRATE_GI]) { 4690 mask->control[band].gi = 4691 nla_get_u8(tb[NL80211_TXRATE_GI]); 4692 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 4693 return -EINVAL; 4694 } 4695 if (tb[NL80211_TXRATE_HE] && 4696 !he_set_mcs_mask(info, wdev, sband, 4697 nla_data(tb[NL80211_TXRATE_HE]), 4698 mask->control[band].he_mcs)) 4699 return -EINVAL; 4700 if (tb[NL80211_TXRATE_HE_GI]) 4701 mask->control[band].he_gi = 4702 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 4703 if (tb[NL80211_TXRATE_HE_LTF]) 4704 mask->control[band].he_ltf = 4705 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 4706 4707 if (mask->control[band].legacy == 0) { 4708 /* don't allow empty legacy rates if HT, VHT or HE 4709 * are not even supported. 4710 */ 4711 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 4712 rdev->wiphy.bands[band]->vht_cap.vht_supported || 4713 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 4714 return -EINVAL; 4715 4716 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 4717 if (mask->control[band].ht_mcs[i]) 4718 goto out; 4719 4720 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 4721 if (mask->control[band].vht_mcs[i]) 4722 goto out; 4723 4724 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 4725 if (mask->control[band].he_mcs[i]) 4726 goto out; 4727 4728 /* legacy and mcs rates may not be both empty */ 4729 return -EINVAL; 4730 } 4731 } 4732 4733 out: 4734 return 0; 4735 } 4736 4737 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 4738 enum nl80211_band band, 4739 struct cfg80211_bitrate_mask *beacon_rate) 4740 { 4741 u32 count_ht, count_vht, i; 4742 u32 rate = beacon_rate->control[band].legacy; 4743 4744 /* Allow only one rate */ 4745 if (hweight32(rate) > 1) 4746 return -EINVAL; 4747 4748 count_ht = 0; 4749 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 4750 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 4751 return -EINVAL; 4752 } else if (beacon_rate->control[band].ht_mcs[i]) { 4753 count_ht++; 4754 if (count_ht > 1) 4755 return -EINVAL; 4756 } 4757 if (count_ht && rate) 4758 return -EINVAL; 4759 } 4760 4761 count_vht = 0; 4762 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 4763 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 4764 return -EINVAL; 4765 } else if (beacon_rate->control[band].vht_mcs[i]) { 4766 count_vht++; 4767 if (count_vht > 1) 4768 return -EINVAL; 4769 } 4770 if (count_vht && rate) 4771 return -EINVAL; 4772 } 4773 4774 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 4775 return -EINVAL; 4776 4777 if (rate && 4778 !wiphy_ext_feature_isset(&rdev->wiphy, 4779 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 4780 return -EINVAL; 4781 if (count_ht && 4782 !wiphy_ext_feature_isset(&rdev->wiphy, 4783 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 4784 return -EINVAL; 4785 if (count_vht && 4786 !wiphy_ext_feature_isset(&rdev->wiphy, 4787 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 4788 return -EINVAL; 4789 4790 return 0; 4791 } 4792 4793 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 4794 struct nlattr *attrs[], 4795 struct cfg80211_beacon_data *bcn) 4796 { 4797 bool haveinfo = false; 4798 int err; 4799 4800 memset(bcn, 0, sizeof(*bcn)); 4801 4802 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 4803 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 4804 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 4805 if (!bcn->head_len) 4806 return -EINVAL; 4807 haveinfo = true; 4808 } 4809 4810 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 4811 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 4812 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 4813 haveinfo = true; 4814 } 4815 4816 if (!haveinfo) 4817 return -EINVAL; 4818 4819 if (attrs[NL80211_ATTR_IE]) { 4820 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 4821 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 4822 } 4823 4824 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 4825 bcn->proberesp_ies = 4826 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4827 bcn->proberesp_ies_len = 4828 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4829 } 4830 4831 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 4832 bcn->assocresp_ies = 4833 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4834 bcn->assocresp_ies_len = 4835 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4836 } 4837 4838 if (attrs[NL80211_ATTR_PROBE_RESP]) { 4839 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 4840 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 4841 } 4842 4843 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 4844 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 4845 4846 err = nla_parse_nested_deprecated(tb, 4847 NL80211_FTM_RESP_ATTR_MAX, 4848 attrs[NL80211_ATTR_FTM_RESPONDER], 4849 NULL, NULL); 4850 if (err) 4851 return err; 4852 4853 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 4854 wiphy_ext_feature_isset(&rdev->wiphy, 4855 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 4856 bcn->ftm_responder = 1; 4857 else 4858 return -EOPNOTSUPP; 4859 4860 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 4861 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 4862 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 4863 } 4864 4865 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 4866 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4867 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4868 } 4869 } else { 4870 bcn->ftm_responder = -1; 4871 } 4872 4873 return 0; 4874 } 4875 4876 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 4877 struct ieee80211_he_obss_pd *he_obss_pd) 4878 { 4879 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 4880 int err; 4881 4882 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 4883 he_obss_pd_policy, NULL); 4884 if (err) 4885 return err; 4886 4887 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 4888 return -EINVAL; 4889 4890 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 4891 4892 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 4893 he_obss_pd->min_offset = 4894 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 4895 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 4896 he_obss_pd->max_offset = 4897 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 4898 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 4899 he_obss_pd->non_srg_max_offset = 4900 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 4901 4902 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 4903 return -EINVAL; 4904 4905 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 4906 memcpy(he_obss_pd->bss_color_bitmap, 4907 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 4908 sizeof(he_obss_pd->bss_color_bitmap)); 4909 4910 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 4911 memcpy(he_obss_pd->partial_bssid_bitmap, 4912 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 4913 sizeof(he_obss_pd->partial_bssid_bitmap)); 4914 4915 he_obss_pd->enable = true; 4916 4917 return 0; 4918 } 4919 4920 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 4921 struct cfg80211_he_bss_color *he_bss_color) 4922 { 4923 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 4924 int err; 4925 4926 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 4927 he_bss_color_policy, NULL); 4928 if (err) 4929 return err; 4930 4931 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 4932 return -EINVAL; 4933 4934 he_bss_color->color = 4935 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 4936 he_bss_color->enabled = 4937 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 4938 he_bss_color->partial = 4939 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 4940 4941 return 0; 4942 } 4943 4944 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 4945 struct nlattr *attrs, 4946 struct cfg80211_ap_settings *params) 4947 { 4948 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 4949 int ret; 4950 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery; 4951 4952 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4953 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 4954 return -EINVAL; 4955 4956 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 4957 NULL, NULL); 4958 if (ret) 4959 return ret; 4960 4961 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 4962 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 4963 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 4964 return -EINVAL; 4965 4966 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4967 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 4968 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 4969 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 4970 4971 return 0; 4972 } 4973 4974 static int 4975 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 4976 struct nlattr *attrs, 4977 struct cfg80211_ap_settings *params) 4978 { 4979 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 4980 int ret; 4981 struct cfg80211_unsol_bcast_probe_resp *presp = 4982 ¶ms->unsol_bcast_probe_resp; 4983 4984 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4985 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 4986 return -EINVAL; 4987 4988 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 4989 attrs, NULL, NULL); 4990 if (ret) 4991 return ret; 4992 4993 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 4994 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 4995 return -EINVAL; 4996 4997 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 4998 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 4999 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5000 return 0; 5001 } 5002 5003 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5004 const u8 *rates) 5005 { 5006 int i; 5007 5008 if (!rates) 5009 return; 5010 5011 for (i = 0; i < rates[1]; i++) { 5012 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5013 params->ht_required = true; 5014 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5015 params->vht_required = true; 5016 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5017 params->he_required = true; 5018 } 5019 } 5020 5021 /* 5022 * Since the nl80211 API didn't include, from the beginning, attributes about 5023 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5024 * benefit of drivers that rebuild IEs in the firmware. 5025 */ 5026 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5027 { 5028 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5029 size_t ies_len = bcn->tail_len; 5030 const u8 *ies = bcn->tail; 5031 const u8 *rates; 5032 const u8 *cap; 5033 5034 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 5035 nl80211_check_ap_rate_selectors(params, rates); 5036 5037 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5038 nl80211_check_ap_rate_selectors(params, rates); 5039 5040 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5041 if (cap && cap[1] >= sizeof(*params->ht_cap)) 5042 params->ht_cap = (void *)(cap + 2); 5043 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5044 if (cap && cap[1] >= sizeof(*params->vht_cap)) 5045 params->vht_cap = (void *)(cap + 2); 5046 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5047 if (cap && cap[1] >= sizeof(*params->he_cap) + 1) 5048 params->he_cap = (void *)(cap + 3); 5049 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5050 if (cap && cap[1] >= sizeof(*params->he_oper) + 1) 5051 params->he_oper = (void *)(cap + 3); 5052 } 5053 5054 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5055 struct cfg80211_ap_settings *params) 5056 { 5057 struct wireless_dev *wdev; 5058 bool ret = false; 5059 5060 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5061 if (wdev->iftype != NL80211_IFTYPE_AP && 5062 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5063 continue; 5064 5065 if (!wdev->preset_chandef.chan) 5066 continue; 5067 5068 params->chandef = wdev->preset_chandef; 5069 ret = true; 5070 break; 5071 } 5072 5073 return ret; 5074 } 5075 5076 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5077 enum nl80211_auth_type auth_type, 5078 enum nl80211_commands cmd) 5079 { 5080 if (auth_type > NL80211_AUTHTYPE_MAX) 5081 return false; 5082 5083 switch (cmd) { 5084 case NL80211_CMD_AUTHENTICATE: 5085 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5086 auth_type == NL80211_AUTHTYPE_SAE) 5087 return false; 5088 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5089 NL80211_EXT_FEATURE_FILS_STA) && 5090 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5091 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5092 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5093 return false; 5094 return true; 5095 case NL80211_CMD_CONNECT: 5096 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5097 !wiphy_ext_feature_isset(&rdev->wiphy, 5098 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5099 auth_type == NL80211_AUTHTYPE_SAE) 5100 return false; 5101 5102 /* FILS with SK PFS or PK not supported yet */ 5103 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5104 auth_type == NL80211_AUTHTYPE_FILS_PK) 5105 return false; 5106 if (!wiphy_ext_feature_isset( 5107 &rdev->wiphy, 5108 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5109 auth_type == NL80211_AUTHTYPE_FILS_SK) 5110 return false; 5111 return true; 5112 case NL80211_CMD_START_AP: 5113 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5114 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5115 auth_type == NL80211_AUTHTYPE_SAE) 5116 return false; 5117 /* FILS not supported yet */ 5118 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5119 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5120 auth_type == NL80211_AUTHTYPE_FILS_PK) 5121 return false; 5122 return true; 5123 default: 5124 return false; 5125 } 5126 } 5127 5128 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5129 { 5130 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5131 struct net_device *dev = info->user_ptr[1]; 5132 struct wireless_dev *wdev = dev->ieee80211_ptr; 5133 struct cfg80211_ap_settings params; 5134 int err; 5135 5136 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5137 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5138 return -EOPNOTSUPP; 5139 5140 if (!rdev->ops->start_ap) 5141 return -EOPNOTSUPP; 5142 5143 if (wdev->beacon_interval) 5144 return -EALREADY; 5145 5146 memset(¶ms, 0, sizeof(params)); 5147 5148 /* these are required for START_AP */ 5149 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5150 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5151 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5152 return -EINVAL; 5153 5154 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon); 5155 if (err) 5156 return err; 5157 5158 params.beacon_interval = 5159 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5160 params.dtim_period = 5161 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5162 5163 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5164 params.beacon_interval); 5165 if (err) 5166 return err; 5167 5168 /* 5169 * In theory, some of these attributes should be required here 5170 * but since they were not used when the command was originally 5171 * added, keep them optional for old user space programs to let 5172 * them continue to work with drivers that do not need the 5173 * additional information -- drivers must check! 5174 */ 5175 if (info->attrs[NL80211_ATTR_SSID]) { 5176 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5177 params.ssid_len = 5178 nla_len(info->attrs[NL80211_ATTR_SSID]); 5179 if (params.ssid_len == 0) 5180 return -EINVAL; 5181 } 5182 5183 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5184 params.hidden_ssid = nla_get_u32( 5185 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5186 5187 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5188 5189 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 5190 params.auth_type = nla_get_u32( 5191 info->attrs[NL80211_ATTR_AUTH_TYPE]); 5192 if (!nl80211_valid_auth_type(rdev, params.auth_type, 5193 NL80211_CMD_START_AP)) 5194 return -EINVAL; 5195 } else 5196 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 5197 5198 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 5199 NL80211_MAX_NR_CIPHER_SUITES); 5200 if (err) 5201 return err; 5202 5203 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 5204 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 5205 return -EOPNOTSUPP; 5206 params.inactivity_timeout = nla_get_u16( 5207 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 5208 } 5209 5210 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5211 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5212 return -EINVAL; 5213 params.p2p_ctwindow = 5214 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5215 if (params.p2p_ctwindow != 0 && 5216 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5217 return -EINVAL; 5218 } 5219 5220 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5221 u8 tmp; 5222 5223 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5224 return -EINVAL; 5225 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5226 params.p2p_opp_ps = tmp; 5227 if (params.p2p_opp_ps != 0 && 5228 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5229 return -EINVAL; 5230 } 5231 5232 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 5233 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 5234 if (err) 5235 return err; 5236 } else if (wdev->preset_chandef.chan) { 5237 params.chandef = wdev->preset_chandef; 5238 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 5239 return -EINVAL; 5240 5241 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 5242 wdev->iftype)) 5243 return -EINVAL; 5244 5245 if (info->attrs[NL80211_ATTR_TX_RATES]) { 5246 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 5247 NL80211_ATTR_TX_RATES, 5248 ¶ms.beacon_rate, 5249 dev); 5250 if (err) 5251 return err; 5252 5253 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 5254 ¶ms.beacon_rate); 5255 if (err) 5256 return err; 5257 } 5258 5259 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 5260 params.smps_mode = 5261 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 5262 switch (params.smps_mode) { 5263 case NL80211_SMPS_OFF: 5264 break; 5265 case NL80211_SMPS_STATIC: 5266 if (!(rdev->wiphy.features & 5267 NL80211_FEATURE_STATIC_SMPS)) 5268 return -EINVAL; 5269 break; 5270 case NL80211_SMPS_DYNAMIC: 5271 if (!(rdev->wiphy.features & 5272 NL80211_FEATURE_DYNAMIC_SMPS)) 5273 return -EINVAL; 5274 break; 5275 default: 5276 return -EINVAL; 5277 } 5278 } else { 5279 params.smps_mode = NL80211_SMPS_OFF; 5280 } 5281 5282 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 5283 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 5284 return -EOPNOTSUPP; 5285 5286 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 5287 params.acl = parse_acl_data(&rdev->wiphy, info); 5288 if (IS_ERR(params.acl)) 5289 return PTR_ERR(params.acl); 5290 } 5291 5292 params.twt_responder = 5293 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 5294 5295 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 5296 err = nl80211_parse_he_obss_pd( 5297 info->attrs[NL80211_ATTR_HE_OBSS_PD], 5298 ¶ms.he_obss_pd); 5299 if (err) 5300 goto out; 5301 } 5302 5303 if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5304 err = nl80211_parse_he_bss_color( 5305 info->attrs[NL80211_ATTR_HE_BSS_COLOR], 5306 ¶ms.he_bss_color); 5307 if (err) 5308 goto out; 5309 } 5310 5311 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 5312 err = nl80211_parse_fils_discovery(rdev, 5313 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 5314 ¶ms); 5315 if (err) 5316 goto out; 5317 } 5318 5319 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 5320 err = nl80211_parse_unsol_bcast_probe_resp( 5321 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 5322 ¶ms); 5323 if (err) 5324 return err; 5325 } 5326 5327 nl80211_calculate_ap_params(¶ms); 5328 5329 if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 5330 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 5331 5332 wdev_lock(wdev); 5333 err = rdev_start_ap(rdev, dev, ¶ms); 5334 if (!err) { 5335 wdev->preset_chandef = params.chandef; 5336 wdev->beacon_interval = params.beacon_interval; 5337 wdev->chandef = params.chandef; 5338 wdev->ssid_len = params.ssid_len; 5339 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 5340 5341 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 5342 wdev->conn_owner_nlportid = info->snd_portid; 5343 } 5344 wdev_unlock(wdev); 5345 5346 out: 5347 kfree(params.acl); 5348 5349 return err; 5350 } 5351 5352 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 5353 { 5354 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5355 struct net_device *dev = info->user_ptr[1]; 5356 struct wireless_dev *wdev = dev->ieee80211_ptr; 5357 struct cfg80211_beacon_data params; 5358 int err; 5359 5360 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5361 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5362 return -EOPNOTSUPP; 5363 5364 if (!rdev->ops->change_beacon) 5365 return -EOPNOTSUPP; 5366 5367 if (!wdev->beacon_interval) 5368 return -EINVAL; 5369 5370 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms); 5371 if (err) 5372 return err; 5373 5374 wdev_lock(wdev); 5375 err = rdev_change_beacon(rdev, dev, ¶ms); 5376 wdev_unlock(wdev); 5377 5378 return err; 5379 } 5380 5381 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 5382 { 5383 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5384 struct net_device *dev = info->user_ptr[1]; 5385 5386 return cfg80211_stop_ap(rdev, dev, false); 5387 } 5388 5389 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 5390 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 5391 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 5392 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 5393 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 5394 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 5395 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 5396 }; 5397 5398 static int parse_station_flags(struct genl_info *info, 5399 enum nl80211_iftype iftype, 5400 struct station_parameters *params) 5401 { 5402 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 5403 struct nlattr *nla; 5404 int flag; 5405 5406 /* 5407 * Try parsing the new attribute first so userspace 5408 * can specify both for older kernels. 5409 */ 5410 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 5411 if (nla) { 5412 struct nl80211_sta_flag_update *sta_flags; 5413 5414 sta_flags = nla_data(nla); 5415 params->sta_flags_mask = sta_flags->mask; 5416 params->sta_flags_set = sta_flags->set; 5417 params->sta_flags_set &= params->sta_flags_mask; 5418 if ((params->sta_flags_mask | 5419 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 5420 return -EINVAL; 5421 return 0; 5422 } 5423 5424 /* if present, parse the old attribute */ 5425 5426 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 5427 if (!nla) 5428 return 0; 5429 5430 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 5431 return -EINVAL; 5432 5433 /* 5434 * Only allow certain flags for interface types so that 5435 * other attributes are silently ignored. Remember that 5436 * this is backward compatibility code with old userspace 5437 * and shouldn't be hit in other cases anyway. 5438 */ 5439 switch (iftype) { 5440 case NL80211_IFTYPE_AP: 5441 case NL80211_IFTYPE_AP_VLAN: 5442 case NL80211_IFTYPE_P2P_GO: 5443 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5444 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5445 BIT(NL80211_STA_FLAG_WME) | 5446 BIT(NL80211_STA_FLAG_MFP); 5447 break; 5448 case NL80211_IFTYPE_P2P_CLIENT: 5449 case NL80211_IFTYPE_STATION: 5450 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 5451 BIT(NL80211_STA_FLAG_TDLS_PEER); 5452 break; 5453 case NL80211_IFTYPE_MESH_POINT: 5454 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5455 BIT(NL80211_STA_FLAG_MFP) | 5456 BIT(NL80211_STA_FLAG_AUTHORIZED); 5457 break; 5458 default: 5459 return -EINVAL; 5460 } 5461 5462 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 5463 if (flags[flag]) { 5464 params->sta_flags_set |= (1<<flag); 5465 5466 /* no longer support new API additions in old API */ 5467 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 5468 return -EINVAL; 5469 } 5470 } 5471 5472 return 0; 5473 } 5474 5475 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 5476 { 5477 struct nlattr *rate; 5478 u32 bitrate; 5479 u16 bitrate_compat; 5480 enum nl80211_rate_info rate_flg; 5481 5482 rate = nla_nest_start_noflag(msg, attr); 5483 if (!rate) 5484 return false; 5485 5486 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 5487 bitrate = cfg80211_calculate_bitrate(info); 5488 /* report 16-bit bitrate only if we can */ 5489 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 5490 if (bitrate > 0 && 5491 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 5492 return false; 5493 if (bitrate_compat > 0 && 5494 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 5495 return false; 5496 5497 switch (info->bw) { 5498 case RATE_INFO_BW_5: 5499 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 5500 break; 5501 case RATE_INFO_BW_10: 5502 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 5503 break; 5504 default: 5505 WARN_ON(1); 5506 fallthrough; 5507 case RATE_INFO_BW_20: 5508 rate_flg = 0; 5509 break; 5510 case RATE_INFO_BW_40: 5511 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 5512 break; 5513 case RATE_INFO_BW_80: 5514 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 5515 break; 5516 case RATE_INFO_BW_160: 5517 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 5518 break; 5519 case RATE_INFO_BW_HE_RU: 5520 rate_flg = 0; 5521 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 5522 } 5523 5524 if (rate_flg && nla_put_flag(msg, rate_flg)) 5525 return false; 5526 5527 if (info->flags & RATE_INFO_FLAGS_MCS) { 5528 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 5529 return false; 5530 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5531 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5532 return false; 5533 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 5534 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 5535 return false; 5536 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 5537 return false; 5538 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 5539 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 5540 return false; 5541 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 5542 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 5543 return false; 5544 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 5545 return false; 5546 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 5547 return false; 5548 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 5549 return false; 5550 if (info->bw == RATE_INFO_BW_HE_RU && 5551 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 5552 info->he_ru_alloc)) 5553 return false; 5554 } 5555 5556 nla_nest_end(msg, rate); 5557 return true; 5558 } 5559 5560 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 5561 int id) 5562 { 5563 void *attr; 5564 int i = 0; 5565 5566 if (!mask) 5567 return true; 5568 5569 attr = nla_nest_start_noflag(msg, id); 5570 if (!attr) 5571 return false; 5572 5573 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 5574 if (!(mask & BIT(i))) 5575 continue; 5576 5577 if (nla_put_u8(msg, i, signal[i])) 5578 return false; 5579 } 5580 5581 nla_nest_end(msg, attr); 5582 5583 return true; 5584 } 5585 5586 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 5587 u32 seq, int flags, 5588 struct cfg80211_registered_device *rdev, 5589 struct net_device *dev, 5590 const u8 *mac_addr, struct station_info *sinfo) 5591 { 5592 void *hdr; 5593 struct nlattr *sinfoattr, *bss_param; 5594 5595 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 5596 if (!hdr) { 5597 cfg80211_sinfo_release_content(sinfo); 5598 return -1; 5599 } 5600 5601 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5602 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 5603 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 5604 goto nla_put_failure; 5605 5606 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 5607 if (!sinfoattr) 5608 goto nla_put_failure; 5609 5610 #define PUT_SINFO(attr, memb, type) do { \ 5611 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 5612 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5613 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 5614 sinfo->memb)) \ 5615 goto nla_put_failure; \ 5616 } while (0) 5617 #define PUT_SINFO_U64(attr, memb) do { \ 5618 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 5619 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 5620 sinfo->memb, NL80211_STA_INFO_PAD)) \ 5621 goto nla_put_failure; \ 5622 } while (0) 5623 5624 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 5625 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 5626 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 5627 5628 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 5629 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 5630 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 5631 (u32)sinfo->rx_bytes)) 5632 goto nla_put_failure; 5633 5634 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 5635 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 5636 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 5637 (u32)sinfo->tx_bytes)) 5638 goto nla_put_failure; 5639 5640 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 5641 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 5642 PUT_SINFO(LLID, llid, u16); 5643 PUT_SINFO(PLID, plid, u16); 5644 PUT_SINFO(PLINK_STATE, plink_state, u8); 5645 PUT_SINFO_U64(RX_DURATION, rx_duration); 5646 PUT_SINFO_U64(TX_DURATION, tx_duration); 5647 5648 if (wiphy_ext_feature_isset(&rdev->wiphy, 5649 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 5650 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 5651 5652 switch (rdev->wiphy.signal_type) { 5653 case CFG80211_SIGNAL_TYPE_MBM: 5654 PUT_SINFO(SIGNAL, signal, u8); 5655 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 5656 break; 5657 default: 5658 break; 5659 } 5660 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 5661 if (!nl80211_put_signal(msg, sinfo->chains, 5662 sinfo->chain_signal, 5663 NL80211_STA_INFO_CHAIN_SIGNAL)) 5664 goto nla_put_failure; 5665 } 5666 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 5667 if (!nl80211_put_signal(msg, sinfo->chains, 5668 sinfo->chain_signal_avg, 5669 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 5670 goto nla_put_failure; 5671 } 5672 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 5673 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 5674 NL80211_STA_INFO_TX_BITRATE)) 5675 goto nla_put_failure; 5676 } 5677 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 5678 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 5679 NL80211_STA_INFO_RX_BITRATE)) 5680 goto nla_put_failure; 5681 } 5682 5683 PUT_SINFO(RX_PACKETS, rx_packets, u32); 5684 PUT_SINFO(TX_PACKETS, tx_packets, u32); 5685 PUT_SINFO(TX_RETRIES, tx_retries, u32); 5686 PUT_SINFO(TX_FAILED, tx_failed, u32); 5687 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 5688 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 5689 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 5690 PUT_SINFO(LOCAL_PM, local_pm, u32); 5691 PUT_SINFO(PEER_PM, peer_pm, u32); 5692 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 5693 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 5694 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 5695 5696 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 5697 bss_param = nla_nest_start_noflag(msg, 5698 NL80211_STA_INFO_BSS_PARAM); 5699 if (!bss_param) 5700 goto nla_put_failure; 5701 5702 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 5703 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 5704 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 5705 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 5706 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 5707 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 5708 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 5709 sinfo->bss_param.dtim_period) || 5710 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 5711 sinfo->bss_param.beacon_interval)) 5712 goto nla_put_failure; 5713 5714 nla_nest_end(msg, bss_param); 5715 } 5716 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 5717 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 5718 sizeof(struct nl80211_sta_flag_update), 5719 &sinfo->sta_flags)) 5720 goto nla_put_failure; 5721 5722 PUT_SINFO_U64(T_OFFSET, t_offset); 5723 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 5724 PUT_SINFO_U64(BEACON_RX, rx_beacon); 5725 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 5726 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 5727 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 5728 if (wiphy_ext_feature_isset(&rdev->wiphy, 5729 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 5730 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 5731 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 5732 } 5733 5734 #undef PUT_SINFO 5735 #undef PUT_SINFO_U64 5736 5737 if (sinfo->pertid) { 5738 struct nlattr *tidsattr; 5739 int tid; 5740 5741 tidsattr = nla_nest_start_noflag(msg, 5742 NL80211_STA_INFO_TID_STATS); 5743 if (!tidsattr) 5744 goto nla_put_failure; 5745 5746 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 5747 struct cfg80211_tid_stats *tidstats; 5748 struct nlattr *tidattr; 5749 5750 tidstats = &sinfo->pertid[tid]; 5751 5752 if (!tidstats->filled) 5753 continue; 5754 5755 tidattr = nla_nest_start_noflag(msg, tid + 1); 5756 if (!tidattr) 5757 goto nla_put_failure; 5758 5759 #define PUT_TIDVAL_U64(attr, memb) do { \ 5760 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 5761 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 5762 tidstats->memb, NL80211_TID_STATS_PAD)) \ 5763 goto nla_put_failure; \ 5764 } while (0) 5765 5766 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 5767 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 5768 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 5769 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 5770 5771 #undef PUT_TIDVAL_U64 5772 if ((tidstats->filled & 5773 BIT(NL80211_TID_STATS_TXQ_STATS)) && 5774 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 5775 NL80211_TID_STATS_TXQ_STATS)) 5776 goto nla_put_failure; 5777 5778 nla_nest_end(msg, tidattr); 5779 } 5780 5781 nla_nest_end(msg, tidsattr); 5782 } 5783 5784 nla_nest_end(msg, sinfoattr); 5785 5786 if (sinfo->assoc_req_ies_len && 5787 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 5788 sinfo->assoc_req_ies)) 5789 goto nla_put_failure; 5790 5791 cfg80211_sinfo_release_content(sinfo); 5792 genlmsg_end(msg, hdr); 5793 return 0; 5794 5795 nla_put_failure: 5796 cfg80211_sinfo_release_content(sinfo); 5797 genlmsg_cancel(msg, hdr); 5798 return -EMSGSIZE; 5799 } 5800 5801 static int nl80211_dump_station(struct sk_buff *skb, 5802 struct netlink_callback *cb) 5803 { 5804 struct station_info sinfo; 5805 struct cfg80211_registered_device *rdev; 5806 struct wireless_dev *wdev; 5807 u8 mac_addr[ETH_ALEN]; 5808 int sta_idx = cb->args[2]; 5809 int err; 5810 5811 rtnl_lock(); 5812 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 5813 if (err) 5814 goto out_err; 5815 5816 if (!wdev->netdev) { 5817 err = -EINVAL; 5818 goto out_err; 5819 } 5820 5821 if (!rdev->ops->dump_station) { 5822 err = -EOPNOTSUPP; 5823 goto out_err; 5824 } 5825 5826 while (1) { 5827 memset(&sinfo, 0, sizeof(sinfo)); 5828 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 5829 mac_addr, &sinfo); 5830 if (err == -ENOENT) 5831 break; 5832 if (err) 5833 goto out_err; 5834 5835 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 5836 NETLINK_CB(cb->skb).portid, 5837 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5838 rdev, wdev->netdev, mac_addr, 5839 &sinfo) < 0) 5840 goto out; 5841 5842 sta_idx++; 5843 } 5844 5845 out: 5846 cb->args[2] = sta_idx; 5847 err = skb->len; 5848 out_err: 5849 rtnl_unlock(); 5850 5851 return err; 5852 } 5853 5854 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 5855 { 5856 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5857 struct net_device *dev = info->user_ptr[1]; 5858 struct station_info sinfo; 5859 struct sk_buff *msg; 5860 u8 *mac_addr = NULL; 5861 int err; 5862 5863 memset(&sinfo, 0, sizeof(sinfo)); 5864 5865 if (!info->attrs[NL80211_ATTR_MAC]) 5866 return -EINVAL; 5867 5868 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5869 5870 if (!rdev->ops->get_station) 5871 return -EOPNOTSUPP; 5872 5873 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 5874 if (err) 5875 return err; 5876 5877 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5878 if (!msg) { 5879 cfg80211_sinfo_release_content(&sinfo); 5880 return -ENOMEM; 5881 } 5882 5883 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 5884 info->snd_portid, info->snd_seq, 0, 5885 rdev, dev, mac_addr, &sinfo) < 0) { 5886 nlmsg_free(msg); 5887 return -ENOBUFS; 5888 } 5889 5890 return genlmsg_reply(msg, info); 5891 } 5892 5893 int cfg80211_check_station_change(struct wiphy *wiphy, 5894 struct station_parameters *params, 5895 enum cfg80211_station_type statype) 5896 { 5897 if (params->listen_interval != -1 && 5898 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5899 return -EINVAL; 5900 5901 if (params->support_p2p_ps != -1 && 5902 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5903 return -EINVAL; 5904 5905 if (params->aid && 5906 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 5907 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 5908 return -EINVAL; 5909 5910 /* When you run into this, adjust the code below for the new flag */ 5911 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5912 5913 switch (statype) { 5914 case CFG80211_STA_MESH_PEER_KERNEL: 5915 case CFG80211_STA_MESH_PEER_USER: 5916 /* 5917 * No ignoring the TDLS flag here -- the userspace mesh 5918 * code doesn't have the bug of including TDLS in the 5919 * mask everywhere. 5920 */ 5921 if (params->sta_flags_mask & 5922 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5923 BIT(NL80211_STA_FLAG_MFP) | 5924 BIT(NL80211_STA_FLAG_AUTHORIZED))) 5925 return -EINVAL; 5926 break; 5927 case CFG80211_STA_TDLS_PEER_SETUP: 5928 case CFG80211_STA_TDLS_PEER_ACTIVE: 5929 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5930 return -EINVAL; 5931 /* ignore since it can't change */ 5932 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5933 break; 5934 default: 5935 /* disallow mesh-specific things */ 5936 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 5937 return -EINVAL; 5938 if (params->local_pm) 5939 return -EINVAL; 5940 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 5941 return -EINVAL; 5942 } 5943 5944 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5945 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 5946 /* TDLS can't be set, ... */ 5947 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 5948 return -EINVAL; 5949 /* 5950 * ... but don't bother the driver with it. This works around 5951 * a hostapd/wpa_supplicant issue -- it always includes the 5952 * TLDS_PEER flag in the mask even for AP mode. 5953 */ 5954 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5955 } 5956 5957 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 5958 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5959 /* reject other things that can't change */ 5960 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 5961 return -EINVAL; 5962 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 5963 return -EINVAL; 5964 if (params->supported_rates) 5965 return -EINVAL; 5966 if (params->ext_capab || params->ht_capa || params->vht_capa || 5967 params->he_capa) 5968 return -EINVAL; 5969 } 5970 5971 if (statype != CFG80211_STA_AP_CLIENT && 5972 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5973 if (params->vlan) 5974 return -EINVAL; 5975 } 5976 5977 switch (statype) { 5978 case CFG80211_STA_AP_MLME_CLIENT: 5979 /* Use this only for authorizing/unauthorizing a station */ 5980 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 5981 return -EOPNOTSUPP; 5982 break; 5983 case CFG80211_STA_AP_CLIENT: 5984 case CFG80211_STA_AP_CLIENT_UNASSOC: 5985 /* accept only the listed bits */ 5986 if (params->sta_flags_mask & 5987 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5988 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5989 BIT(NL80211_STA_FLAG_ASSOCIATED) | 5990 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5991 BIT(NL80211_STA_FLAG_WME) | 5992 BIT(NL80211_STA_FLAG_MFP))) 5993 return -EINVAL; 5994 5995 /* but authenticated/associated only if driver handles it */ 5996 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5997 params->sta_flags_mask & 5998 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5999 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6000 return -EINVAL; 6001 break; 6002 case CFG80211_STA_IBSS: 6003 case CFG80211_STA_AP_STA: 6004 /* reject any changes other than AUTHORIZED */ 6005 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6006 return -EINVAL; 6007 break; 6008 case CFG80211_STA_TDLS_PEER_SETUP: 6009 /* reject any changes other than AUTHORIZED or WME */ 6010 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6011 BIT(NL80211_STA_FLAG_WME))) 6012 return -EINVAL; 6013 /* force (at least) rates when authorizing */ 6014 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6015 !params->supported_rates) 6016 return -EINVAL; 6017 break; 6018 case CFG80211_STA_TDLS_PEER_ACTIVE: 6019 /* reject any changes */ 6020 return -EINVAL; 6021 case CFG80211_STA_MESH_PEER_KERNEL: 6022 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6023 return -EINVAL; 6024 break; 6025 case CFG80211_STA_MESH_PEER_USER: 6026 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6027 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6028 return -EINVAL; 6029 break; 6030 } 6031 6032 /* 6033 * Older kernel versions ignored this attribute entirely, so don't 6034 * reject attempts to update it but mark it as unused instead so the 6035 * driver won't look at the data. 6036 */ 6037 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 6038 statype != CFG80211_STA_TDLS_PEER_SETUP) 6039 params->opmode_notif_used = false; 6040 6041 return 0; 6042 } 6043 EXPORT_SYMBOL(cfg80211_check_station_change); 6044 6045 /* 6046 * Get vlan interface making sure it is running and on the right wiphy. 6047 */ 6048 static struct net_device *get_vlan(struct genl_info *info, 6049 struct cfg80211_registered_device *rdev) 6050 { 6051 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 6052 struct net_device *v; 6053 int ret; 6054 6055 if (!vlanattr) 6056 return NULL; 6057 6058 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 6059 if (!v) 6060 return ERR_PTR(-ENODEV); 6061 6062 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 6063 ret = -EINVAL; 6064 goto error; 6065 } 6066 6067 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 6068 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6069 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6070 ret = -EINVAL; 6071 goto error; 6072 } 6073 6074 if (!netif_running(v)) { 6075 ret = -ENETDOWN; 6076 goto error; 6077 } 6078 6079 return v; 6080 error: 6081 dev_put(v); 6082 return ERR_PTR(ret); 6083 } 6084 6085 static const struct nla_policy 6086 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 6087 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 6088 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 6089 }; 6090 6091 static int nl80211_parse_sta_wme(struct genl_info *info, 6092 struct station_parameters *params) 6093 { 6094 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 6095 struct nlattr *nla; 6096 int err; 6097 6098 /* parse WME attributes if present */ 6099 if (!info->attrs[NL80211_ATTR_STA_WME]) 6100 return 0; 6101 6102 nla = info->attrs[NL80211_ATTR_STA_WME]; 6103 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 6104 nl80211_sta_wme_policy, 6105 info->extack); 6106 if (err) 6107 return err; 6108 6109 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 6110 params->uapsd_queues = nla_get_u8( 6111 tb[NL80211_STA_WME_UAPSD_QUEUES]); 6112 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 6113 return -EINVAL; 6114 6115 if (tb[NL80211_STA_WME_MAX_SP]) 6116 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 6117 6118 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 6119 return -EINVAL; 6120 6121 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 6122 6123 return 0; 6124 } 6125 6126 static int nl80211_parse_sta_channel_info(struct genl_info *info, 6127 struct station_parameters *params) 6128 { 6129 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 6130 params->supported_channels = 6131 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6132 params->supported_channels_len = 6133 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 6134 /* 6135 * Need to include at least one (first channel, number of 6136 * channels) tuple for each subband (checked in policy), 6137 * and must have proper tuples for the rest of the data as well. 6138 */ 6139 if (params->supported_channels_len % 2) 6140 return -EINVAL; 6141 } 6142 6143 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 6144 params->supported_oper_classes = 6145 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6146 params->supported_oper_classes_len = 6147 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 6148 } 6149 return 0; 6150 } 6151 6152 static int nl80211_set_station_tdls(struct genl_info *info, 6153 struct station_parameters *params) 6154 { 6155 int err; 6156 /* Dummy STA entry gets updated once the peer capabilities are known */ 6157 if (info->attrs[NL80211_ATTR_PEER_AID]) 6158 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6159 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6160 params->ht_capa = 6161 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6162 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6163 params->vht_capa = 6164 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6165 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6166 params->he_capa = 6167 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6168 params->he_capa_len = 6169 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6170 } 6171 6172 err = nl80211_parse_sta_channel_info(info, params); 6173 if (err) 6174 return err; 6175 6176 return nl80211_parse_sta_wme(info, params); 6177 } 6178 6179 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 6180 struct station_parameters *params) 6181 { 6182 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6183 int idx; 6184 6185 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 6186 if (!rdev->ops->set_tx_power || 6187 !wiphy_ext_feature_isset(&rdev->wiphy, 6188 NL80211_EXT_FEATURE_STA_TX_PWR)) 6189 return -EOPNOTSUPP; 6190 6191 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 6192 params->txpwr.type = nla_get_u8(info->attrs[idx]); 6193 6194 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) { 6195 idx = NL80211_ATTR_STA_TX_POWER; 6196 6197 if (info->attrs[idx]) 6198 params->txpwr.power = 6199 nla_get_s16(info->attrs[idx]); 6200 else 6201 return -EINVAL; 6202 } 6203 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER; 6204 } 6205 6206 return 0; 6207 } 6208 6209 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 6210 { 6211 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6212 struct net_device *dev = info->user_ptr[1]; 6213 struct station_parameters params; 6214 u8 *mac_addr; 6215 int err; 6216 6217 memset(¶ms, 0, sizeof(params)); 6218 6219 if (!rdev->ops->change_station) 6220 return -EOPNOTSUPP; 6221 6222 /* 6223 * AID and listen_interval properties can be set only for unassociated 6224 * station. Include these parameters here and will check them in 6225 * cfg80211_check_station_change(). 6226 */ 6227 if (info->attrs[NL80211_ATTR_STA_AID]) 6228 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6229 6230 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6231 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6232 6233 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6234 params.listen_interval = 6235 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6236 else 6237 params.listen_interval = -1; 6238 6239 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 6240 params.support_p2p_ps = 6241 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6242 else 6243 params.support_p2p_ps = -1; 6244 6245 if (!info->attrs[NL80211_ATTR_MAC]) 6246 return -EINVAL; 6247 6248 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6249 6250 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 6251 params.supported_rates = 6252 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6253 params.supported_rates_len = 6254 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6255 } 6256 6257 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6258 params.capability = 6259 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6260 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6261 } 6262 6263 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6264 params.ext_capab = 6265 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6266 params.ext_capab_len = 6267 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6268 } 6269 6270 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6271 return -EINVAL; 6272 6273 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6274 params.plink_action = 6275 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6276 6277 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 6278 params.plink_state = 6279 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 6280 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 6281 params.peer_aid = nla_get_u16( 6282 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 6283 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 6284 } 6285 6286 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 6287 params.local_pm = nla_get_u32( 6288 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 6289 6290 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6291 params.opmode_notif_used = true; 6292 params.opmode_notif = 6293 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6294 } 6295 6296 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6297 params.he_6ghz_capa = 6298 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6299 6300 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6301 params.airtime_weight = 6302 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6303 6304 if (params.airtime_weight && 6305 !wiphy_ext_feature_isset(&rdev->wiphy, 6306 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6307 return -EOPNOTSUPP; 6308 6309 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6310 if (err) 6311 return err; 6312 6313 /* Include parameters for TDLS peer (will check later) */ 6314 err = nl80211_set_station_tdls(info, ¶ms); 6315 if (err) 6316 return err; 6317 6318 params.vlan = get_vlan(info, rdev); 6319 if (IS_ERR(params.vlan)) 6320 return PTR_ERR(params.vlan); 6321 6322 switch (dev->ieee80211_ptr->iftype) { 6323 case NL80211_IFTYPE_AP: 6324 case NL80211_IFTYPE_AP_VLAN: 6325 case NL80211_IFTYPE_P2P_GO: 6326 case NL80211_IFTYPE_P2P_CLIENT: 6327 case NL80211_IFTYPE_STATION: 6328 case NL80211_IFTYPE_ADHOC: 6329 case NL80211_IFTYPE_MESH_POINT: 6330 break; 6331 default: 6332 err = -EOPNOTSUPP; 6333 goto out_put_vlan; 6334 } 6335 6336 /* driver will call cfg80211_check_station_change() */ 6337 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 6338 6339 out_put_vlan: 6340 if (params.vlan) 6341 dev_put(params.vlan); 6342 6343 return err; 6344 } 6345 6346 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 6347 { 6348 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6349 int err; 6350 struct net_device *dev = info->user_ptr[1]; 6351 struct station_parameters params; 6352 u8 *mac_addr = NULL; 6353 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6354 BIT(NL80211_STA_FLAG_ASSOCIATED); 6355 6356 memset(¶ms, 0, sizeof(params)); 6357 6358 if (!rdev->ops->add_station) 6359 return -EOPNOTSUPP; 6360 6361 if (!info->attrs[NL80211_ATTR_MAC]) 6362 return -EINVAL; 6363 6364 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 6365 return -EINVAL; 6366 6367 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 6368 return -EINVAL; 6369 6370 if (!info->attrs[NL80211_ATTR_STA_AID] && 6371 !info->attrs[NL80211_ATTR_PEER_AID]) 6372 return -EINVAL; 6373 6374 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6375 params.supported_rates = 6376 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6377 params.supported_rates_len = 6378 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 6379 params.listen_interval = 6380 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 6381 6382 if (info->attrs[NL80211_ATTR_VLAN_ID]) 6383 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 6384 6385 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 6386 params.support_p2p_ps = 6387 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 6388 } else { 6389 /* 6390 * if not specified, assume it's supported for P2P GO interface, 6391 * and is NOT supported for AP interface 6392 */ 6393 params.support_p2p_ps = 6394 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 6395 } 6396 6397 if (info->attrs[NL80211_ATTR_PEER_AID]) 6398 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 6399 else 6400 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 6401 6402 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 6403 params.capability = 6404 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 6405 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 6406 } 6407 6408 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 6409 params.ext_capab = 6410 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6411 params.ext_capab_len = 6412 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 6413 } 6414 6415 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 6416 params.ht_capa = 6417 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 6418 6419 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 6420 params.vht_capa = 6421 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 6422 6423 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 6424 params.he_capa = 6425 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6426 params.he_capa_len = 6427 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 6428 } 6429 6430 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 6431 params.he_6ghz_capa = 6432 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 6433 6434 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 6435 params.opmode_notif_used = true; 6436 params.opmode_notif = 6437 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 6438 } 6439 6440 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 6441 params.plink_action = 6442 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 6443 6444 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 6445 params.airtime_weight = 6446 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 6447 6448 if (params.airtime_weight && 6449 !wiphy_ext_feature_isset(&rdev->wiphy, 6450 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6451 return -EOPNOTSUPP; 6452 6453 err = nl80211_parse_sta_txpower_setting(info, ¶ms); 6454 if (err) 6455 return err; 6456 6457 err = nl80211_parse_sta_channel_info(info, ¶ms); 6458 if (err) 6459 return err; 6460 6461 err = nl80211_parse_sta_wme(info, ¶ms); 6462 if (err) 6463 return err; 6464 6465 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 6466 return -EINVAL; 6467 6468 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 6469 * as userspace might just pass through the capabilities from the IEs 6470 * directly, rather than enforcing this restriction and returning an 6471 * error in this case. 6472 */ 6473 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 6474 params.ht_capa = NULL; 6475 params.vht_capa = NULL; 6476 6477 /* HE requires WME */ 6478 if (params.he_capa_len || params.he_6ghz_capa) 6479 return -EINVAL; 6480 } 6481 6482 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 6483 if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa)) 6484 return -EINVAL; 6485 6486 /* When you run into this, adjust the code below for the new flag */ 6487 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6488 6489 switch (dev->ieee80211_ptr->iftype) { 6490 case NL80211_IFTYPE_AP: 6491 case NL80211_IFTYPE_AP_VLAN: 6492 case NL80211_IFTYPE_P2P_GO: 6493 /* ignore WME attributes if iface/sta is not capable */ 6494 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 6495 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 6496 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6497 6498 /* TDLS peers cannot be added */ 6499 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6500 info->attrs[NL80211_ATTR_PEER_AID]) 6501 return -EINVAL; 6502 /* but don't bother the driver with it */ 6503 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6504 6505 /* allow authenticated/associated only if driver handles it */ 6506 if (!(rdev->wiphy.features & 6507 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6508 params.sta_flags_mask & auth_assoc) 6509 return -EINVAL; 6510 6511 /* Older userspace, or userspace wanting to be compatible with 6512 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 6513 * and assoc flags in the mask, but assumes the station will be 6514 * added as associated anyway since this was the required driver 6515 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 6516 * introduced. 6517 * In order to not bother drivers with this quirk in the API 6518 * set the flags in both the mask and set for new stations in 6519 * this case. 6520 */ 6521 if (!(params.sta_flags_mask & auth_assoc)) { 6522 params.sta_flags_mask |= auth_assoc; 6523 params.sta_flags_set |= auth_assoc; 6524 } 6525 6526 /* must be last in here for error handling */ 6527 params.vlan = get_vlan(info, rdev); 6528 if (IS_ERR(params.vlan)) 6529 return PTR_ERR(params.vlan); 6530 break; 6531 case NL80211_IFTYPE_MESH_POINT: 6532 /* ignore uAPSD data */ 6533 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6534 6535 /* associated is disallowed */ 6536 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 6537 return -EINVAL; 6538 /* TDLS peers cannot be added */ 6539 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 6540 info->attrs[NL80211_ATTR_PEER_AID]) 6541 return -EINVAL; 6542 break; 6543 case NL80211_IFTYPE_STATION: 6544 case NL80211_IFTYPE_P2P_CLIENT: 6545 /* ignore uAPSD data */ 6546 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 6547 6548 /* these are disallowed */ 6549 if (params.sta_flags_mask & 6550 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 6551 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 6552 return -EINVAL; 6553 /* Only TDLS peers can be added */ 6554 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6555 return -EINVAL; 6556 /* Can only add if TDLS ... */ 6557 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 6558 return -EOPNOTSUPP; 6559 /* ... with external setup is supported */ 6560 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 6561 return -EOPNOTSUPP; 6562 /* 6563 * Older wpa_supplicant versions always mark the TDLS peer 6564 * as authorized, but it shouldn't yet be. 6565 */ 6566 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 6567 break; 6568 default: 6569 return -EOPNOTSUPP; 6570 } 6571 6572 /* be aware of params.vlan when changing code here */ 6573 6574 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 6575 6576 if (params.vlan) 6577 dev_put(params.vlan); 6578 return err; 6579 } 6580 6581 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 6582 { 6583 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6584 struct net_device *dev = info->user_ptr[1]; 6585 struct station_del_parameters params; 6586 6587 memset(¶ms, 0, sizeof(params)); 6588 6589 if (info->attrs[NL80211_ATTR_MAC]) 6590 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 6591 6592 switch (dev->ieee80211_ptr->iftype) { 6593 case NL80211_IFTYPE_AP: 6594 case NL80211_IFTYPE_AP_VLAN: 6595 case NL80211_IFTYPE_MESH_POINT: 6596 case NL80211_IFTYPE_P2P_GO: 6597 /* always accept these */ 6598 break; 6599 case NL80211_IFTYPE_ADHOC: 6600 /* conditionally accept */ 6601 if (wiphy_ext_feature_isset(&rdev->wiphy, 6602 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 6603 break; 6604 return -EINVAL; 6605 default: 6606 return -EINVAL; 6607 } 6608 6609 if (!rdev->ops->del_station) 6610 return -EOPNOTSUPP; 6611 6612 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 6613 params.subtype = 6614 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 6615 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 6616 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 6617 return -EINVAL; 6618 } else { 6619 /* Default to Deauthentication frame */ 6620 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 6621 } 6622 6623 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 6624 params.reason_code = 6625 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 6626 if (params.reason_code == 0) 6627 return -EINVAL; /* 0 is reserved */ 6628 } else { 6629 /* Default to reason code 2 */ 6630 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 6631 } 6632 6633 return rdev_del_station(rdev, dev, ¶ms); 6634 } 6635 6636 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 6637 int flags, struct net_device *dev, 6638 u8 *dst, u8 *next_hop, 6639 struct mpath_info *pinfo) 6640 { 6641 void *hdr; 6642 struct nlattr *pinfoattr; 6643 6644 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 6645 if (!hdr) 6646 return -1; 6647 6648 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6649 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 6650 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 6651 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 6652 goto nla_put_failure; 6653 6654 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 6655 if (!pinfoattr) 6656 goto nla_put_failure; 6657 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 6658 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 6659 pinfo->frame_qlen)) 6660 goto nla_put_failure; 6661 if (((pinfo->filled & MPATH_INFO_SN) && 6662 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 6663 ((pinfo->filled & MPATH_INFO_METRIC) && 6664 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 6665 pinfo->metric)) || 6666 ((pinfo->filled & MPATH_INFO_EXPTIME) && 6667 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 6668 pinfo->exptime)) || 6669 ((pinfo->filled & MPATH_INFO_FLAGS) && 6670 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 6671 pinfo->flags)) || 6672 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 6673 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 6674 pinfo->discovery_timeout)) || 6675 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 6676 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 6677 pinfo->discovery_retries)) || 6678 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 6679 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 6680 pinfo->hop_count)) || 6681 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 6682 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 6683 pinfo->path_change_count))) 6684 goto nla_put_failure; 6685 6686 nla_nest_end(msg, pinfoattr); 6687 6688 genlmsg_end(msg, hdr); 6689 return 0; 6690 6691 nla_put_failure: 6692 genlmsg_cancel(msg, hdr); 6693 return -EMSGSIZE; 6694 } 6695 6696 static int nl80211_dump_mpath(struct sk_buff *skb, 6697 struct netlink_callback *cb) 6698 { 6699 struct mpath_info pinfo; 6700 struct cfg80211_registered_device *rdev; 6701 struct wireless_dev *wdev; 6702 u8 dst[ETH_ALEN]; 6703 u8 next_hop[ETH_ALEN]; 6704 int path_idx = cb->args[2]; 6705 int err; 6706 6707 rtnl_lock(); 6708 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6709 if (err) 6710 goto out_err; 6711 6712 if (!rdev->ops->dump_mpath) { 6713 err = -EOPNOTSUPP; 6714 goto out_err; 6715 } 6716 6717 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6718 err = -EOPNOTSUPP; 6719 goto out_err; 6720 } 6721 6722 while (1) { 6723 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 6724 next_hop, &pinfo); 6725 if (err == -ENOENT) 6726 break; 6727 if (err) 6728 goto out_err; 6729 6730 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6731 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6732 wdev->netdev, dst, next_hop, 6733 &pinfo) < 0) 6734 goto out; 6735 6736 path_idx++; 6737 } 6738 6739 out: 6740 cb->args[2] = path_idx; 6741 err = skb->len; 6742 out_err: 6743 rtnl_unlock(); 6744 return err; 6745 } 6746 6747 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 6748 { 6749 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6750 int err; 6751 struct net_device *dev = info->user_ptr[1]; 6752 struct mpath_info pinfo; 6753 struct sk_buff *msg; 6754 u8 *dst = NULL; 6755 u8 next_hop[ETH_ALEN]; 6756 6757 memset(&pinfo, 0, sizeof(pinfo)); 6758 6759 if (!info->attrs[NL80211_ATTR_MAC]) 6760 return -EINVAL; 6761 6762 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6763 6764 if (!rdev->ops->get_mpath) 6765 return -EOPNOTSUPP; 6766 6767 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6768 return -EOPNOTSUPP; 6769 6770 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 6771 if (err) 6772 return err; 6773 6774 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6775 if (!msg) 6776 return -ENOMEM; 6777 6778 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6779 dev, dst, next_hop, &pinfo) < 0) { 6780 nlmsg_free(msg); 6781 return -ENOBUFS; 6782 } 6783 6784 return genlmsg_reply(msg, info); 6785 } 6786 6787 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 6788 { 6789 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6790 struct net_device *dev = info->user_ptr[1]; 6791 u8 *dst = NULL; 6792 u8 *next_hop = NULL; 6793 6794 if (!info->attrs[NL80211_ATTR_MAC]) 6795 return -EINVAL; 6796 6797 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6798 return -EINVAL; 6799 6800 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6801 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6802 6803 if (!rdev->ops->change_mpath) 6804 return -EOPNOTSUPP; 6805 6806 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6807 return -EOPNOTSUPP; 6808 6809 return rdev_change_mpath(rdev, dev, dst, next_hop); 6810 } 6811 6812 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 6813 { 6814 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6815 struct net_device *dev = info->user_ptr[1]; 6816 u8 *dst = NULL; 6817 u8 *next_hop = NULL; 6818 6819 if (!info->attrs[NL80211_ATTR_MAC]) 6820 return -EINVAL; 6821 6822 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 6823 return -EINVAL; 6824 6825 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6826 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 6827 6828 if (!rdev->ops->add_mpath) 6829 return -EOPNOTSUPP; 6830 6831 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6832 return -EOPNOTSUPP; 6833 6834 return rdev_add_mpath(rdev, dev, dst, next_hop); 6835 } 6836 6837 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 6838 { 6839 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6840 struct net_device *dev = info->user_ptr[1]; 6841 u8 *dst = NULL; 6842 6843 if (info->attrs[NL80211_ATTR_MAC]) 6844 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6845 6846 if (!rdev->ops->del_mpath) 6847 return -EOPNOTSUPP; 6848 6849 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6850 return -EOPNOTSUPP; 6851 6852 return rdev_del_mpath(rdev, dev, dst); 6853 } 6854 6855 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 6856 { 6857 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6858 int err; 6859 struct net_device *dev = info->user_ptr[1]; 6860 struct mpath_info pinfo; 6861 struct sk_buff *msg; 6862 u8 *dst = NULL; 6863 u8 mpp[ETH_ALEN]; 6864 6865 memset(&pinfo, 0, sizeof(pinfo)); 6866 6867 if (!info->attrs[NL80211_ATTR_MAC]) 6868 return -EINVAL; 6869 6870 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 6871 6872 if (!rdev->ops->get_mpp) 6873 return -EOPNOTSUPP; 6874 6875 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 6876 return -EOPNOTSUPP; 6877 6878 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 6879 if (err) 6880 return err; 6881 6882 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6883 if (!msg) 6884 return -ENOMEM; 6885 6886 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 6887 dev, dst, mpp, &pinfo) < 0) { 6888 nlmsg_free(msg); 6889 return -ENOBUFS; 6890 } 6891 6892 return genlmsg_reply(msg, info); 6893 } 6894 6895 static int nl80211_dump_mpp(struct sk_buff *skb, 6896 struct netlink_callback *cb) 6897 { 6898 struct mpath_info pinfo; 6899 struct cfg80211_registered_device *rdev; 6900 struct wireless_dev *wdev; 6901 u8 dst[ETH_ALEN]; 6902 u8 mpp[ETH_ALEN]; 6903 int path_idx = cb->args[2]; 6904 int err; 6905 6906 rtnl_lock(); 6907 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 6908 if (err) 6909 goto out_err; 6910 6911 if (!rdev->ops->dump_mpp) { 6912 err = -EOPNOTSUPP; 6913 goto out_err; 6914 } 6915 6916 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 6917 err = -EOPNOTSUPP; 6918 goto out_err; 6919 } 6920 6921 while (1) { 6922 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 6923 mpp, &pinfo); 6924 if (err == -ENOENT) 6925 break; 6926 if (err) 6927 goto out_err; 6928 6929 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 6930 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6931 wdev->netdev, dst, mpp, 6932 &pinfo) < 0) 6933 goto out; 6934 6935 path_idx++; 6936 } 6937 6938 out: 6939 cb->args[2] = path_idx; 6940 err = skb->len; 6941 out_err: 6942 rtnl_unlock(); 6943 return err; 6944 } 6945 6946 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 6947 { 6948 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6949 struct net_device *dev = info->user_ptr[1]; 6950 struct wireless_dev *wdev = dev->ieee80211_ptr; 6951 struct bss_parameters params; 6952 int err; 6953 6954 memset(¶ms, 0, sizeof(params)); 6955 /* default to not changing parameters */ 6956 params.use_cts_prot = -1; 6957 params.use_short_preamble = -1; 6958 params.use_short_slot_time = -1; 6959 params.ap_isolate = -1; 6960 params.ht_opmode = -1; 6961 params.p2p_ctwindow = -1; 6962 params.p2p_opp_ps = -1; 6963 6964 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 6965 params.use_cts_prot = 6966 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 6967 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 6968 params.use_short_preamble = 6969 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 6970 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 6971 params.use_short_slot_time = 6972 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 6973 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 6974 params.basic_rates = 6975 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6976 params.basic_rates_len = 6977 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 6978 } 6979 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 6980 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 6981 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 6982 params.ht_opmode = 6983 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 6984 6985 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 6986 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6987 return -EINVAL; 6988 params.p2p_ctwindow = 6989 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 6990 if (params.p2p_ctwindow != 0 && 6991 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 6992 return -EINVAL; 6993 } 6994 6995 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 6996 u8 tmp; 6997 6998 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6999 return -EINVAL; 7000 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 7001 params.p2p_opp_ps = tmp; 7002 if (params.p2p_opp_ps && 7003 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 7004 return -EINVAL; 7005 } 7006 7007 if (!rdev->ops->change_bss) 7008 return -EOPNOTSUPP; 7009 7010 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7011 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 7012 return -EOPNOTSUPP; 7013 7014 wdev_lock(wdev); 7015 err = rdev_change_bss(rdev, dev, ¶ms); 7016 wdev_unlock(wdev); 7017 7018 return err; 7019 } 7020 7021 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 7022 { 7023 char *data = NULL; 7024 bool is_indoor; 7025 enum nl80211_user_reg_hint_type user_reg_hint_type; 7026 u32 owner_nlportid; 7027 7028 /* 7029 * You should only get this when cfg80211 hasn't yet initialized 7030 * completely when built-in to the kernel right between the time 7031 * window between nl80211_init() and regulatory_init(), if that is 7032 * even possible. 7033 */ 7034 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 7035 return -EINPROGRESS; 7036 7037 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 7038 user_reg_hint_type = 7039 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 7040 else 7041 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 7042 7043 switch (user_reg_hint_type) { 7044 case NL80211_USER_REG_HINT_USER: 7045 case NL80211_USER_REG_HINT_CELL_BASE: 7046 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7047 return -EINVAL; 7048 7049 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7050 return regulatory_hint_user(data, user_reg_hint_type); 7051 case NL80211_USER_REG_HINT_INDOOR: 7052 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 7053 owner_nlportid = info->snd_portid; 7054 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 7055 } else { 7056 owner_nlportid = 0; 7057 is_indoor = true; 7058 } 7059 7060 return regulatory_hint_indoor(is_indoor, owner_nlportid); 7061 default: 7062 return -EINVAL; 7063 } 7064 } 7065 7066 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 7067 { 7068 return reg_reload_regdb(); 7069 } 7070 7071 static int nl80211_get_mesh_config(struct sk_buff *skb, 7072 struct genl_info *info) 7073 { 7074 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7075 struct net_device *dev = info->user_ptr[1]; 7076 struct wireless_dev *wdev = dev->ieee80211_ptr; 7077 struct mesh_config cur_params; 7078 int err = 0; 7079 void *hdr; 7080 struct nlattr *pinfoattr; 7081 struct sk_buff *msg; 7082 7083 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7084 return -EOPNOTSUPP; 7085 7086 if (!rdev->ops->get_mesh_config) 7087 return -EOPNOTSUPP; 7088 7089 wdev_lock(wdev); 7090 /* If not connected, get default parameters */ 7091 if (!wdev->mesh_id_len) 7092 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 7093 else 7094 err = rdev_get_mesh_config(rdev, dev, &cur_params); 7095 wdev_unlock(wdev); 7096 7097 if (err) 7098 return err; 7099 7100 /* Draw up a netlink message to send back */ 7101 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7102 if (!msg) 7103 return -ENOMEM; 7104 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7105 NL80211_CMD_GET_MESH_CONFIG); 7106 if (!hdr) 7107 goto out; 7108 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 7109 if (!pinfoattr) 7110 goto nla_put_failure; 7111 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7112 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 7113 cur_params.dot11MeshRetryTimeout) || 7114 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 7115 cur_params.dot11MeshConfirmTimeout) || 7116 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 7117 cur_params.dot11MeshHoldingTimeout) || 7118 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 7119 cur_params.dot11MeshMaxPeerLinks) || 7120 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 7121 cur_params.dot11MeshMaxRetries) || 7122 nla_put_u8(msg, NL80211_MESHCONF_TTL, 7123 cur_params.dot11MeshTTL) || 7124 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 7125 cur_params.element_ttl) || 7126 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7127 cur_params.auto_open_plinks) || 7128 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7129 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 7130 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7131 cur_params.dot11MeshHWMPmaxPREQretries) || 7132 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 7133 cur_params.path_refresh_time) || 7134 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7135 cur_params.min_discovery_timeout) || 7136 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7137 cur_params.dot11MeshHWMPactivePathTimeout) || 7138 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7139 cur_params.dot11MeshHWMPpreqMinInterval) || 7140 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7141 cur_params.dot11MeshHWMPperrMinInterval) || 7142 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7143 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 7144 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 7145 cur_params.dot11MeshHWMPRootMode) || 7146 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7147 cur_params.dot11MeshHWMPRannInterval) || 7148 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7149 cur_params.dot11MeshGateAnnouncementProtocol) || 7150 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 7151 cur_params.dot11MeshForwarding) || 7152 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 7153 cur_params.rssi_threshold) || 7154 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 7155 cur_params.ht_opmode) || 7156 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7157 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 7158 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7159 cur_params.dot11MeshHWMProotInterval) || 7160 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7161 cur_params.dot11MeshHWMPconfirmationInterval) || 7162 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 7163 cur_params.power_mode) || 7164 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 7165 cur_params.dot11MeshAwakeWindowDuration) || 7166 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 7167 cur_params.plink_timeout) || 7168 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 7169 cur_params.dot11MeshConnectedToMeshGate) || 7170 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 7171 cur_params.dot11MeshNolearn) || 7172 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 7173 cur_params.dot11MeshConnectedToAuthServer)) 7174 goto nla_put_failure; 7175 nla_nest_end(msg, pinfoattr); 7176 genlmsg_end(msg, hdr); 7177 return genlmsg_reply(msg, info); 7178 7179 nla_put_failure: 7180 out: 7181 nlmsg_free(msg); 7182 return -ENOBUFS; 7183 } 7184 7185 static const struct nla_policy 7186 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 7187 [NL80211_MESHCONF_RETRY_TIMEOUT] = 7188 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7189 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 7190 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7191 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 7192 NLA_POLICY_RANGE(NLA_U16, 1, 255), 7193 [NL80211_MESHCONF_MAX_PEER_LINKS] = 7194 NLA_POLICY_RANGE(NLA_U16, 0, 255), 7195 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 7196 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7197 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 7198 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 7199 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 7200 NLA_POLICY_RANGE(NLA_U32, 1, 255), 7201 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 7202 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 7203 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 7204 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 7205 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 7206 NLA_POLICY_MIN(NLA_U16, 1), 7207 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 7208 NLA_POLICY_MIN(NLA_U16, 1), 7209 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 7210 NLA_POLICY_MIN(NLA_U16, 1), 7211 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 7212 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 7213 NLA_POLICY_MIN(NLA_U16, 1), 7214 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 7215 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 7216 [NL80211_MESHCONF_RSSI_THRESHOLD] = 7217 NLA_POLICY_RANGE(NLA_S32, -255, 0), 7218 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 7219 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 7220 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 7221 NLA_POLICY_MIN(NLA_U16, 1), 7222 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 7223 NLA_POLICY_MIN(NLA_U16, 1), 7224 [NL80211_MESHCONF_POWER_MODE] = 7225 NLA_POLICY_RANGE(NLA_U32, 7226 NL80211_MESH_POWER_ACTIVE, 7227 NL80211_MESH_POWER_MAX), 7228 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 7229 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 7230 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7231 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7232 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 7233 }; 7234 7235 static const struct nla_policy 7236 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 7237 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 7238 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 7239 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 7240 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 7241 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 7242 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 7243 [NL80211_MESH_SETUP_IE] = 7244 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 7245 IEEE80211_MAX_DATA_LEN), 7246 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 7247 }; 7248 7249 static int nl80211_parse_mesh_config(struct genl_info *info, 7250 struct mesh_config *cfg, 7251 u32 *mask_out) 7252 { 7253 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 7254 u32 mask = 0; 7255 u16 ht_opmode; 7256 7257 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 7258 do { \ 7259 if (tb[attr]) { \ 7260 cfg->param = fn(tb[attr]); \ 7261 mask |= BIT((attr) - 1); \ 7262 } \ 7263 } while (0) 7264 7265 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 7266 return -EINVAL; 7267 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 7268 return -EINVAL; 7269 7270 /* This makes sure that there aren't more than 32 mesh config 7271 * parameters (otherwise our bitfield scheme would not work.) */ 7272 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 7273 7274 /* Fill in the params struct */ 7275 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 7276 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 7277 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 7278 NL80211_MESHCONF_CONFIRM_TIMEOUT, 7279 nla_get_u16); 7280 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 7281 NL80211_MESHCONF_HOLDING_TIMEOUT, 7282 nla_get_u16); 7283 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 7284 NL80211_MESHCONF_MAX_PEER_LINKS, 7285 nla_get_u16); 7286 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 7287 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 7288 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 7289 NL80211_MESHCONF_TTL, nla_get_u8); 7290 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 7291 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 7292 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 7293 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 7294 nla_get_u8); 7295 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 7296 mask, 7297 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 7298 nla_get_u32); 7299 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 7300 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 7301 nla_get_u8); 7302 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 7303 NL80211_MESHCONF_PATH_REFRESH_TIME, 7304 nla_get_u32); 7305 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 7306 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 7307 return -EINVAL; 7308 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 7309 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 7310 nla_get_u16); 7311 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 7312 mask, 7313 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 7314 nla_get_u32); 7315 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 7316 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 7317 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 7318 return -EINVAL; 7319 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 7320 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 7321 nla_get_u16); 7322 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 7323 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 7324 nla_get_u16); 7325 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7326 dot11MeshHWMPnetDiameterTraversalTime, mask, 7327 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 7328 nla_get_u16); 7329 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 7330 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 7331 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 7332 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 7333 nla_get_u16); 7334 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 7335 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 7336 nla_get_u8); 7337 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 7338 NL80211_MESHCONF_FORWARDING, nla_get_u8); 7339 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 7340 NL80211_MESHCONF_RSSI_THRESHOLD, 7341 nla_get_s32); 7342 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 7343 NL80211_MESHCONF_CONNECTED_TO_GATE, 7344 nla_get_u8); 7345 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 7346 NL80211_MESHCONF_CONNECTED_TO_AS, 7347 nla_get_u8); 7348 /* 7349 * Check HT operation mode based on 7350 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 7351 */ 7352 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 7353 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 7354 7355 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 7356 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 7357 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 7358 return -EINVAL; 7359 7360 /* NON_HT_STA bit is reserved, but some programs set it */ 7361 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 7362 7363 cfg->ht_opmode = ht_opmode; 7364 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 7365 } 7366 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 7367 dot11MeshHWMPactivePathToRootTimeout, mask, 7368 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 7369 nla_get_u32); 7370 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 7371 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 7372 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 7373 return -EINVAL; 7374 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 7375 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 7376 nla_get_u16); 7377 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 7378 mask, 7379 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 7380 nla_get_u16); 7381 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 7382 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 7383 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 7384 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 7385 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 7386 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 7387 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 7388 NL80211_MESHCONF_NOLEARN, nla_get_u8); 7389 if (mask_out) 7390 *mask_out = mask; 7391 7392 return 0; 7393 7394 #undef FILL_IN_MESH_PARAM_IF_SET 7395 } 7396 7397 static int nl80211_parse_mesh_setup(struct genl_info *info, 7398 struct mesh_setup *setup) 7399 { 7400 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7401 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 7402 7403 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 7404 return -EINVAL; 7405 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 7406 return -EINVAL; 7407 7408 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 7409 setup->sync_method = 7410 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 7411 IEEE80211_SYNC_METHOD_VENDOR : 7412 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 7413 7414 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 7415 setup->path_sel_proto = 7416 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 7417 IEEE80211_PATH_PROTOCOL_VENDOR : 7418 IEEE80211_PATH_PROTOCOL_HWMP; 7419 7420 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 7421 setup->path_metric = 7422 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 7423 IEEE80211_PATH_METRIC_VENDOR : 7424 IEEE80211_PATH_METRIC_AIRTIME; 7425 7426 if (tb[NL80211_MESH_SETUP_IE]) { 7427 struct nlattr *ieattr = 7428 tb[NL80211_MESH_SETUP_IE]; 7429 setup->ie = nla_data(ieattr); 7430 setup->ie_len = nla_len(ieattr); 7431 } 7432 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 7433 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 7434 return -EINVAL; 7435 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 7436 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 7437 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 7438 if (setup->is_secure) 7439 setup->user_mpm = true; 7440 7441 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 7442 if (!setup->user_mpm) 7443 return -EINVAL; 7444 setup->auth_id = 7445 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 7446 } 7447 7448 return 0; 7449 } 7450 7451 static int nl80211_update_mesh_config(struct sk_buff *skb, 7452 struct genl_info *info) 7453 { 7454 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7455 struct net_device *dev = info->user_ptr[1]; 7456 struct wireless_dev *wdev = dev->ieee80211_ptr; 7457 struct mesh_config cfg; 7458 u32 mask; 7459 int err; 7460 7461 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 7462 return -EOPNOTSUPP; 7463 7464 if (!rdev->ops->update_mesh_config) 7465 return -EOPNOTSUPP; 7466 7467 err = nl80211_parse_mesh_config(info, &cfg, &mask); 7468 if (err) 7469 return err; 7470 7471 wdev_lock(wdev); 7472 if (!wdev->mesh_id_len) 7473 err = -ENOLINK; 7474 7475 if (!err) 7476 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 7477 7478 wdev_unlock(wdev); 7479 7480 return err; 7481 } 7482 7483 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 7484 struct sk_buff *msg) 7485 { 7486 struct nlattr *nl_reg_rules; 7487 unsigned int i; 7488 7489 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 7490 (regdom->dfs_region && 7491 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 7492 goto nla_put_failure; 7493 7494 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 7495 if (!nl_reg_rules) 7496 goto nla_put_failure; 7497 7498 for (i = 0; i < regdom->n_reg_rules; i++) { 7499 struct nlattr *nl_reg_rule; 7500 const struct ieee80211_reg_rule *reg_rule; 7501 const struct ieee80211_freq_range *freq_range; 7502 const struct ieee80211_power_rule *power_rule; 7503 unsigned int max_bandwidth_khz; 7504 7505 reg_rule = ®dom->reg_rules[i]; 7506 freq_range = ®_rule->freq_range; 7507 power_rule = ®_rule->power_rule; 7508 7509 nl_reg_rule = nla_nest_start_noflag(msg, i); 7510 if (!nl_reg_rule) 7511 goto nla_put_failure; 7512 7513 max_bandwidth_khz = freq_range->max_bandwidth_khz; 7514 if (!max_bandwidth_khz) 7515 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 7516 reg_rule); 7517 7518 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 7519 reg_rule->flags) || 7520 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 7521 freq_range->start_freq_khz) || 7522 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 7523 freq_range->end_freq_khz) || 7524 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 7525 max_bandwidth_khz) || 7526 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 7527 power_rule->max_antenna_gain) || 7528 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 7529 power_rule->max_eirp) || 7530 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 7531 reg_rule->dfs_cac_ms)) 7532 goto nla_put_failure; 7533 7534 nla_nest_end(msg, nl_reg_rule); 7535 } 7536 7537 nla_nest_end(msg, nl_reg_rules); 7538 return 0; 7539 7540 nla_put_failure: 7541 return -EMSGSIZE; 7542 } 7543 7544 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 7545 { 7546 const struct ieee80211_regdomain *regdom = NULL; 7547 struct cfg80211_registered_device *rdev; 7548 struct wiphy *wiphy = NULL; 7549 struct sk_buff *msg; 7550 void *hdr; 7551 7552 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7553 if (!msg) 7554 return -ENOBUFS; 7555 7556 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 7557 NL80211_CMD_GET_REG); 7558 if (!hdr) 7559 goto put_failure; 7560 7561 if (info->attrs[NL80211_ATTR_WIPHY]) { 7562 bool self_managed; 7563 7564 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 7565 if (IS_ERR(rdev)) { 7566 nlmsg_free(msg); 7567 return PTR_ERR(rdev); 7568 } 7569 7570 wiphy = &rdev->wiphy; 7571 self_managed = wiphy->regulatory_flags & 7572 REGULATORY_WIPHY_SELF_MANAGED; 7573 regdom = get_wiphy_regdom(wiphy); 7574 7575 /* a self-managed-reg device must have a private regdom */ 7576 if (WARN_ON(!regdom && self_managed)) { 7577 nlmsg_free(msg); 7578 return -EINVAL; 7579 } 7580 7581 if (regdom && 7582 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7583 goto nla_put_failure; 7584 } 7585 7586 if (!wiphy && reg_last_request_cell_base() && 7587 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7588 NL80211_USER_REG_HINT_CELL_BASE)) 7589 goto nla_put_failure; 7590 7591 rcu_read_lock(); 7592 7593 if (!regdom) 7594 regdom = rcu_dereference(cfg80211_regdomain); 7595 7596 if (nl80211_put_regdom(regdom, msg)) 7597 goto nla_put_failure_rcu; 7598 7599 rcu_read_unlock(); 7600 7601 genlmsg_end(msg, hdr); 7602 return genlmsg_reply(msg, info); 7603 7604 nla_put_failure_rcu: 7605 rcu_read_unlock(); 7606 nla_put_failure: 7607 put_failure: 7608 nlmsg_free(msg); 7609 return -EMSGSIZE; 7610 } 7611 7612 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 7613 u32 seq, int flags, struct wiphy *wiphy, 7614 const struct ieee80211_regdomain *regdom) 7615 { 7616 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7617 NL80211_CMD_GET_REG); 7618 7619 if (!hdr) 7620 return -1; 7621 7622 genl_dump_check_consistent(cb, hdr); 7623 7624 if (nl80211_put_regdom(regdom, msg)) 7625 goto nla_put_failure; 7626 7627 if (!wiphy && reg_last_request_cell_base() && 7628 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 7629 NL80211_USER_REG_HINT_CELL_BASE)) 7630 goto nla_put_failure; 7631 7632 if (wiphy && 7633 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 7634 goto nla_put_failure; 7635 7636 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 7637 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 7638 goto nla_put_failure; 7639 7640 genlmsg_end(msg, hdr); 7641 return 0; 7642 7643 nla_put_failure: 7644 genlmsg_cancel(msg, hdr); 7645 return -EMSGSIZE; 7646 } 7647 7648 static int nl80211_get_reg_dump(struct sk_buff *skb, 7649 struct netlink_callback *cb) 7650 { 7651 const struct ieee80211_regdomain *regdom = NULL; 7652 struct cfg80211_registered_device *rdev; 7653 int err, reg_idx, start = cb->args[2]; 7654 7655 rtnl_lock(); 7656 7657 if (cfg80211_regdomain && start == 0) { 7658 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7659 NLM_F_MULTI, NULL, 7660 rtnl_dereference(cfg80211_regdomain)); 7661 if (err < 0) 7662 goto out_err; 7663 } 7664 7665 /* the global regdom is idx 0 */ 7666 reg_idx = 1; 7667 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 7668 regdom = get_wiphy_regdom(&rdev->wiphy); 7669 if (!regdom) 7670 continue; 7671 7672 if (++reg_idx <= start) 7673 continue; 7674 7675 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 7676 NLM_F_MULTI, &rdev->wiphy, regdom); 7677 if (err < 0) { 7678 reg_idx--; 7679 break; 7680 } 7681 } 7682 7683 cb->args[2] = reg_idx; 7684 err = skb->len; 7685 out_err: 7686 rtnl_unlock(); 7687 return err; 7688 } 7689 7690 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 7691 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 7692 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 7693 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 7694 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 7695 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 7696 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 7697 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 7698 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 7699 }; 7700 7701 static int parse_reg_rule(struct nlattr *tb[], 7702 struct ieee80211_reg_rule *reg_rule) 7703 { 7704 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 7705 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 7706 7707 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 7708 return -EINVAL; 7709 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 7710 return -EINVAL; 7711 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 7712 return -EINVAL; 7713 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 7714 return -EINVAL; 7715 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 7716 return -EINVAL; 7717 7718 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 7719 7720 freq_range->start_freq_khz = 7721 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 7722 freq_range->end_freq_khz = 7723 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 7724 freq_range->max_bandwidth_khz = 7725 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 7726 7727 power_rule->max_eirp = 7728 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 7729 7730 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 7731 power_rule->max_antenna_gain = 7732 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 7733 7734 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 7735 reg_rule->dfs_cac_ms = 7736 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 7737 7738 return 0; 7739 } 7740 7741 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 7742 { 7743 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 7744 struct nlattr *nl_reg_rule; 7745 char *alpha2; 7746 int rem_reg_rules, r; 7747 u32 num_rules = 0, rule_idx = 0; 7748 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 7749 struct ieee80211_regdomain *rd; 7750 7751 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 7752 return -EINVAL; 7753 7754 if (!info->attrs[NL80211_ATTR_REG_RULES]) 7755 return -EINVAL; 7756 7757 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 7758 7759 if (info->attrs[NL80211_ATTR_DFS_REGION]) 7760 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 7761 7762 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7763 rem_reg_rules) { 7764 num_rules++; 7765 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 7766 return -EINVAL; 7767 } 7768 7769 if (!reg_is_valid_request(alpha2)) 7770 return -EINVAL; 7771 7772 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 7773 if (!rd) 7774 return -ENOMEM; 7775 7776 rd->n_reg_rules = num_rules; 7777 rd->alpha2[0] = alpha2[0]; 7778 rd->alpha2[1] = alpha2[1]; 7779 7780 /* 7781 * Disable DFS master mode if the DFS region was 7782 * not supported or known on this kernel. 7783 */ 7784 if (reg_supported_dfs_region(dfs_region)) 7785 rd->dfs_region = dfs_region; 7786 7787 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 7788 rem_reg_rules) { 7789 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 7790 nl_reg_rule, reg_rule_policy, 7791 info->extack); 7792 if (r) 7793 goto bad_reg; 7794 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 7795 if (r) 7796 goto bad_reg; 7797 7798 rule_idx++; 7799 7800 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 7801 r = -EINVAL; 7802 goto bad_reg; 7803 } 7804 } 7805 7806 /* set_regdom takes ownership of rd */ 7807 return set_regdom(rd, REGD_SOURCE_CRDA); 7808 bad_reg: 7809 kfree(rd); 7810 return r; 7811 } 7812 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 7813 7814 static int validate_scan_freqs(struct nlattr *freqs) 7815 { 7816 struct nlattr *attr1, *attr2; 7817 int n_channels = 0, tmp1, tmp2; 7818 7819 nla_for_each_nested(attr1, freqs, tmp1) 7820 if (nla_len(attr1) != sizeof(u32)) 7821 return 0; 7822 7823 nla_for_each_nested(attr1, freqs, tmp1) { 7824 n_channels++; 7825 /* 7826 * Some hardware has a limited channel list for 7827 * scanning, and it is pretty much nonsensical 7828 * to scan for a channel twice, so disallow that 7829 * and don't require drivers to check that the 7830 * channel list they get isn't longer than what 7831 * they can scan, as long as they can scan all 7832 * the channels they registered at once. 7833 */ 7834 nla_for_each_nested(attr2, freqs, tmp2) 7835 if (attr1 != attr2 && 7836 nla_get_u32(attr1) == nla_get_u32(attr2)) 7837 return 0; 7838 } 7839 7840 return n_channels; 7841 } 7842 7843 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 7844 { 7845 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 7846 } 7847 7848 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 7849 struct cfg80211_bss_selection *bss_select) 7850 { 7851 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 7852 struct nlattr *nest; 7853 int err; 7854 bool found = false; 7855 int i; 7856 7857 /* only process one nested attribute */ 7858 nest = nla_data(nla); 7859 if (!nla_ok(nest, nla_len(nest))) 7860 return -EINVAL; 7861 7862 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 7863 nest, nl80211_bss_select_policy, 7864 NULL); 7865 if (err) 7866 return err; 7867 7868 /* only one attribute may be given */ 7869 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 7870 if (attr[i]) { 7871 if (found) 7872 return -EINVAL; 7873 found = true; 7874 } 7875 } 7876 7877 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 7878 7879 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 7880 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 7881 7882 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 7883 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 7884 bss_select->param.band_pref = 7885 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 7886 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 7887 return -EINVAL; 7888 } 7889 7890 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 7891 struct nl80211_bss_select_rssi_adjust *adj_param; 7892 7893 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 7894 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 7895 bss_select->param.adjust.band = adj_param->band; 7896 bss_select->param.adjust.delta = adj_param->delta; 7897 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 7898 return -EINVAL; 7899 } 7900 7901 /* user-space did not provide behaviour attribute */ 7902 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 7903 return -EINVAL; 7904 7905 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 7906 return -EINVAL; 7907 7908 return 0; 7909 } 7910 7911 int nl80211_parse_random_mac(struct nlattr **attrs, 7912 u8 *mac_addr, u8 *mac_addr_mask) 7913 { 7914 int i; 7915 7916 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 7917 eth_zero_addr(mac_addr); 7918 eth_zero_addr(mac_addr_mask); 7919 mac_addr[0] = 0x2; 7920 mac_addr_mask[0] = 0x3; 7921 7922 return 0; 7923 } 7924 7925 /* need both or none */ 7926 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 7927 return -EINVAL; 7928 7929 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 7930 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 7931 7932 /* don't allow or configure an mcast address */ 7933 if (!is_multicast_ether_addr(mac_addr_mask) || 7934 is_multicast_ether_addr(mac_addr)) 7935 return -EINVAL; 7936 7937 /* 7938 * allow users to pass a MAC address that has bits set outside 7939 * of the mask, but don't bother drivers with having to deal 7940 * with such bits 7941 */ 7942 for (i = 0; i < ETH_ALEN; i++) 7943 mac_addr[i] &= mac_addr_mask[i]; 7944 7945 return 0; 7946 } 7947 7948 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 7949 { 7950 ASSERT_WDEV_LOCK(wdev); 7951 7952 if (!cfg80211_beaconing_iface_active(wdev)) 7953 return true; 7954 7955 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 7956 return true; 7957 7958 return regulatory_pre_cac_allowed(wdev->wiphy); 7959 } 7960 7961 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 7962 enum nl80211_ext_feature_index feat) 7963 { 7964 if (!(flags & flag)) 7965 return true; 7966 if (wiphy_ext_feature_isset(wiphy, feat)) 7967 return true; 7968 return false; 7969 } 7970 7971 static int 7972 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 7973 void *request, struct nlattr **attrs, 7974 bool is_sched_scan) 7975 { 7976 u8 *mac_addr, *mac_addr_mask; 7977 u32 *flags; 7978 enum nl80211_feature_flags randomness_flag; 7979 7980 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 7981 return 0; 7982 7983 if (is_sched_scan) { 7984 struct cfg80211_sched_scan_request *req = request; 7985 7986 randomness_flag = wdev ? 7987 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 7988 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 7989 flags = &req->flags; 7990 mac_addr = req->mac_addr; 7991 mac_addr_mask = req->mac_addr_mask; 7992 } else { 7993 struct cfg80211_scan_request *req = request; 7994 7995 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 7996 flags = &req->flags; 7997 mac_addr = req->mac_addr; 7998 mac_addr_mask = req->mac_addr_mask; 7999 } 8000 8001 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 8002 8003 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 8004 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 8005 !nl80211_check_scan_feat(wiphy, *flags, 8006 NL80211_SCAN_FLAG_LOW_SPAN, 8007 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 8008 !nl80211_check_scan_feat(wiphy, *flags, 8009 NL80211_SCAN_FLAG_LOW_POWER, 8010 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 8011 !nl80211_check_scan_feat(wiphy, *flags, 8012 NL80211_SCAN_FLAG_HIGH_ACCURACY, 8013 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 8014 !nl80211_check_scan_feat(wiphy, *flags, 8015 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 8016 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 8017 !nl80211_check_scan_feat(wiphy, *flags, 8018 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 8019 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 8020 !nl80211_check_scan_feat(wiphy, *flags, 8021 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 8022 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 8023 !nl80211_check_scan_feat(wiphy, *flags, 8024 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 8025 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 8026 !nl80211_check_scan_feat(wiphy, *flags, 8027 NL80211_SCAN_FLAG_RANDOM_SN, 8028 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 8029 !nl80211_check_scan_feat(wiphy, *flags, 8030 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 8031 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 8032 return -EOPNOTSUPP; 8033 8034 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 8035 int err; 8036 8037 if (!(wiphy->features & randomness_flag) || 8038 (wdev && wdev->current_bss)) 8039 return -EOPNOTSUPP; 8040 8041 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 8042 if (err) 8043 return err; 8044 } 8045 8046 return 0; 8047 } 8048 8049 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 8050 { 8051 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8052 struct wireless_dev *wdev = info->user_ptr[1]; 8053 struct cfg80211_scan_request *request; 8054 struct nlattr *scan_freqs = NULL; 8055 bool scan_freqs_khz = false; 8056 struct nlattr *attr; 8057 struct wiphy *wiphy; 8058 int err, tmp, n_ssids = 0, n_channels, i; 8059 size_t ie_len; 8060 8061 wiphy = &rdev->wiphy; 8062 8063 if (wdev->iftype == NL80211_IFTYPE_NAN) 8064 return -EOPNOTSUPP; 8065 8066 if (!rdev->ops->scan) 8067 return -EOPNOTSUPP; 8068 8069 if (rdev->scan_req || rdev->scan_msg) 8070 return -EBUSY; 8071 8072 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 8073 if (!wiphy_ext_feature_isset(wiphy, 8074 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 8075 return -EOPNOTSUPP; 8076 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 8077 scan_freqs_khz = true; 8078 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 8079 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 8080 8081 if (scan_freqs) { 8082 n_channels = validate_scan_freqs(scan_freqs); 8083 if (!n_channels) 8084 return -EINVAL; 8085 } else { 8086 n_channels = ieee80211_get_num_supported_channels(wiphy); 8087 } 8088 8089 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 8090 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 8091 n_ssids++; 8092 8093 if (n_ssids > wiphy->max_scan_ssids) 8094 return -EINVAL; 8095 8096 if (info->attrs[NL80211_ATTR_IE]) 8097 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8098 else 8099 ie_len = 0; 8100 8101 if (ie_len > wiphy->max_scan_ie_len) 8102 return -EINVAL; 8103 8104 request = kzalloc(sizeof(*request) 8105 + sizeof(*request->ssids) * n_ssids 8106 + sizeof(*request->channels) * n_channels 8107 + ie_len, GFP_KERNEL); 8108 if (!request) 8109 return -ENOMEM; 8110 8111 if (n_ssids) 8112 request->ssids = (void *)&request->channels[n_channels]; 8113 request->n_ssids = n_ssids; 8114 if (ie_len) { 8115 if (n_ssids) 8116 request->ie = (void *)(request->ssids + n_ssids); 8117 else 8118 request->ie = (void *)(request->channels + n_channels); 8119 } 8120 8121 i = 0; 8122 if (scan_freqs) { 8123 /* user specified, bail out if channel not found */ 8124 nla_for_each_nested(attr, scan_freqs, tmp) { 8125 struct ieee80211_channel *chan; 8126 int freq = nla_get_u32(attr); 8127 8128 if (!scan_freqs_khz) 8129 freq = MHZ_TO_KHZ(freq); 8130 8131 chan = ieee80211_get_channel_khz(wiphy, freq); 8132 if (!chan) { 8133 err = -EINVAL; 8134 goto out_free; 8135 } 8136 8137 /* ignore disabled channels */ 8138 if (chan->flags & IEEE80211_CHAN_DISABLED) 8139 continue; 8140 8141 request->channels[i] = chan; 8142 i++; 8143 } 8144 } else { 8145 enum nl80211_band band; 8146 8147 /* all channels */ 8148 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8149 int j; 8150 8151 if (!wiphy->bands[band]) 8152 continue; 8153 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8154 struct ieee80211_channel *chan; 8155 8156 chan = &wiphy->bands[band]->channels[j]; 8157 8158 if (chan->flags & IEEE80211_CHAN_DISABLED) 8159 continue; 8160 8161 request->channels[i] = chan; 8162 i++; 8163 } 8164 } 8165 } 8166 8167 if (!i) { 8168 err = -EINVAL; 8169 goto out_free; 8170 } 8171 8172 request->n_channels = i; 8173 8174 wdev_lock(wdev); 8175 if (!cfg80211_off_channel_oper_allowed(wdev)) { 8176 struct ieee80211_channel *chan; 8177 8178 if (request->n_channels != 1) { 8179 wdev_unlock(wdev); 8180 err = -EBUSY; 8181 goto out_free; 8182 } 8183 8184 chan = request->channels[0]; 8185 if (chan->center_freq != wdev->chandef.chan->center_freq) { 8186 wdev_unlock(wdev); 8187 err = -EBUSY; 8188 goto out_free; 8189 } 8190 } 8191 wdev_unlock(wdev); 8192 8193 i = 0; 8194 if (n_ssids) { 8195 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 8196 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8197 err = -EINVAL; 8198 goto out_free; 8199 } 8200 request->ssids[i].ssid_len = nla_len(attr); 8201 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 8202 i++; 8203 } 8204 } 8205 8206 if (info->attrs[NL80211_ATTR_IE]) { 8207 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8208 memcpy((void *)request->ie, 8209 nla_data(info->attrs[NL80211_ATTR_IE]), 8210 request->ie_len); 8211 } 8212 8213 for (i = 0; i < NUM_NL80211_BANDS; i++) 8214 if (wiphy->bands[i]) 8215 request->rates[i] = 8216 (1 << wiphy->bands[i]->n_bitrates) - 1; 8217 8218 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 8219 nla_for_each_nested(attr, 8220 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 8221 tmp) { 8222 enum nl80211_band band = nla_type(attr); 8223 8224 if (band < 0 || band >= NUM_NL80211_BANDS) { 8225 err = -EINVAL; 8226 goto out_free; 8227 } 8228 8229 if (!wiphy->bands[band]) 8230 continue; 8231 8232 err = ieee80211_get_ratemask(wiphy->bands[band], 8233 nla_data(attr), 8234 nla_len(attr), 8235 &request->rates[band]); 8236 if (err) 8237 goto out_free; 8238 } 8239 } 8240 8241 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 8242 if (!wiphy_ext_feature_isset(wiphy, 8243 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 8244 err = -EOPNOTSUPP; 8245 goto out_free; 8246 } 8247 8248 request->duration = 8249 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 8250 request->duration_mandatory = 8251 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 8252 } 8253 8254 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 8255 false); 8256 if (err) 8257 goto out_free; 8258 8259 request->no_cck = 8260 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 8261 8262 /* Initial implementation used NL80211_ATTR_MAC to set the specific 8263 * BSSID to scan for. This was problematic because that same attribute 8264 * was already used for another purpose (local random MAC address). The 8265 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 8266 * compatibility with older userspace components, also use the 8267 * NL80211_ATTR_MAC value here if it can be determined to be used for 8268 * the specific BSSID use case instead of the random MAC address 8269 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 8270 */ 8271 if (info->attrs[NL80211_ATTR_BSSID]) 8272 memcpy(request->bssid, 8273 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 8274 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 8275 info->attrs[NL80211_ATTR_MAC]) 8276 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 8277 ETH_ALEN); 8278 else 8279 eth_broadcast_addr(request->bssid); 8280 8281 request->wdev = wdev; 8282 request->wiphy = &rdev->wiphy; 8283 request->scan_start = jiffies; 8284 8285 rdev->scan_req = request; 8286 err = cfg80211_scan(rdev); 8287 8288 if (err) 8289 goto out_free; 8290 8291 nl80211_send_scan_start(rdev, wdev); 8292 if (wdev->netdev) 8293 dev_hold(wdev->netdev); 8294 8295 return 0; 8296 8297 out_free: 8298 rdev->scan_req = NULL; 8299 kfree(request); 8300 8301 return err; 8302 } 8303 8304 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 8305 { 8306 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8307 struct wireless_dev *wdev = info->user_ptr[1]; 8308 8309 if (!rdev->ops->abort_scan) 8310 return -EOPNOTSUPP; 8311 8312 if (rdev->scan_msg) 8313 return 0; 8314 8315 if (!rdev->scan_req) 8316 return -ENOENT; 8317 8318 rdev_abort_scan(rdev, wdev); 8319 return 0; 8320 } 8321 8322 static int 8323 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 8324 struct cfg80211_sched_scan_request *request, 8325 struct nlattr **attrs) 8326 { 8327 int tmp, err, i = 0; 8328 struct nlattr *attr; 8329 8330 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8331 u32 interval; 8332 8333 /* 8334 * If scan plans are not specified, 8335 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 8336 * case one scan plan will be set with the specified scan 8337 * interval and infinite number of iterations. 8338 */ 8339 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 8340 if (!interval) 8341 return -EINVAL; 8342 8343 request->scan_plans[0].interval = 8344 DIV_ROUND_UP(interval, MSEC_PER_SEC); 8345 if (!request->scan_plans[0].interval) 8346 return -EINVAL; 8347 8348 if (request->scan_plans[0].interval > 8349 wiphy->max_sched_scan_plan_interval) 8350 request->scan_plans[0].interval = 8351 wiphy->max_sched_scan_plan_interval; 8352 8353 return 0; 8354 } 8355 8356 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 8357 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 8358 8359 if (WARN_ON(i >= n_plans)) 8360 return -EINVAL; 8361 8362 err = nla_parse_nested_deprecated(plan, 8363 NL80211_SCHED_SCAN_PLAN_MAX, 8364 attr, nl80211_plan_policy, 8365 NULL); 8366 if (err) 8367 return err; 8368 8369 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 8370 return -EINVAL; 8371 8372 request->scan_plans[i].interval = 8373 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 8374 if (!request->scan_plans[i].interval || 8375 request->scan_plans[i].interval > 8376 wiphy->max_sched_scan_plan_interval) 8377 return -EINVAL; 8378 8379 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 8380 request->scan_plans[i].iterations = 8381 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 8382 if (!request->scan_plans[i].iterations || 8383 (request->scan_plans[i].iterations > 8384 wiphy->max_sched_scan_plan_iterations)) 8385 return -EINVAL; 8386 } else if (i < n_plans - 1) { 8387 /* 8388 * All scan plans but the last one must specify 8389 * a finite number of iterations 8390 */ 8391 return -EINVAL; 8392 } 8393 8394 i++; 8395 } 8396 8397 /* 8398 * The last scan plan must not specify the number of 8399 * iterations, it is supposed to run infinitely 8400 */ 8401 if (request->scan_plans[n_plans - 1].iterations) 8402 return -EINVAL; 8403 8404 return 0; 8405 } 8406 8407 static int 8408 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 8409 struct cfg80211_match_set *match_sets, 8410 struct nlattr *tb_band_rssi, 8411 s32 rssi_thold) 8412 { 8413 struct nlattr *attr; 8414 int i, tmp, ret = 0; 8415 8416 if (!wiphy_ext_feature_isset(wiphy, 8417 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 8418 if (tb_band_rssi) 8419 ret = -EOPNOTSUPP; 8420 else 8421 for (i = 0; i < NUM_NL80211_BANDS; i++) 8422 match_sets->per_band_rssi_thold[i] = 8423 NL80211_SCAN_RSSI_THOLD_OFF; 8424 return ret; 8425 } 8426 8427 for (i = 0; i < NUM_NL80211_BANDS; i++) 8428 match_sets->per_band_rssi_thold[i] = rssi_thold; 8429 8430 nla_for_each_nested(attr, tb_band_rssi, tmp) { 8431 enum nl80211_band band = nla_type(attr); 8432 8433 if (band < 0 || band >= NUM_NL80211_BANDS) 8434 return -EINVAL; 8435 8436 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 8437 } 8438 8439 return 0; 8440 } 8441 8442 static struct cfg80211_sched_scan_request * 8443 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 8444 struct nlattr **attrs, int max_match_sets) 8445 { 8446 struct cfg80211_sched_scan_request *request; 8447 struct nlattr *attr; 8448 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 8449 enum nl80211_band band; 8450 size_t ie_len; 8451 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 8452 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 8453 8454 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8455 n_channels = validate_scan_freqs( 8456 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 8457 if (!n_channels) 8458 return ERR_PTR(-EINVAL); 8459 } else { 8460 n_channels = ieee80211_get_num_supported_channels(wiphy); 8461 } 8462 8463 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 8464 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8465 tmp) 8466 n_ssids++; 8467 8468 if (n_ssids > wiphy->max_sched_scan_ssids) 8469 return ERR_PTR(-EINVAL); 8470 8471 /* 8472 * First, count the number of 'real' matchsets. Due to an issue with 8473 * the old implementation, matchsets containing only the RSSI attribute 8474 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 8475 * RSSI for all matchsets, rather than their own matchset for reporting 8476 * all APs with a strong RSSI. This is needed to be compatible with 8477 * older userspace that treated a matchset with only the RSSI as the 8478 * global RSSI for all other matchsets - if there are other matchsets. 8479 */ 8480 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8481 nla_for_each_nested(attr, 8482 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8483 tmp) { 8484 struct nlattr *rssi; 8485 8486 err = nla_parse_nested_deprecated(tb, 8487 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8488 attr, 8489 nl80211_match_policy, 8490 NULL); 8491 if (err) 8492 return ERR_PTR(err); 8493 8494 /* SSID and BSSID are mutually exclusive */ 8495 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 8496 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 8497 return ERR_PTR(-EINVAL); 8498 8499 /* add other standalone attributes here */ 8500 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 8501 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 8502 n_match_sets++; 8503 continue; 8504 } 8505 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8506 if (rssi) 8507 default_match_rssi = nla_get_s32(rssi); 8508 } 8509 } 8510 8511 /* However, if there's no other matchset, add the RSSI one */ 8512 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 8513 n_match_sets = 1; 8514 8515 if (n_match_sets > max_match_sets) 8516 return ERR_PTR(-EINVAL); 8517 8518 if (attrs[NL80211_ATTR_IE]) 8519 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 8520 else 8521 ie_len = 0; 8522 8523 if (ie_len > wiphy->max_sched_scan_ie_len) 8524 return ERR_PTR(-EINVAL); 8525 8526 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 8527 /* 8528 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 8529 * each scan plan already specifies its own interval 8530 */ 8531 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8532 return ERR_PTR(-EINVAL); 8533 8534 nla_for_each_nested(attr, 8535 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 8536 n_plans++; 8537 } else { 8538 /* 8539 * The scan interval attribute is kept for backward 8540 * compatibility. If no scan plans are specified and sched scan 8541 * interval is specified, one scan plan will be set with this 8542 * scan interval and infinite number of iterations. 8543 */ 8544 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 8545 return ERR_PTR(-EINVAL); 8546 8547 n_plans = 1; 8548 } 8549 8550 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 8551 return ERR_PTR(-EINVAL); 8552 8553 if (!wiphy_ext_feature_isset( 8554 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 8555 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 8556 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 8557 return ERR_PTR(-EINVAL); 8558 8559 request = kzalloc(sizeof(*request) 8560 + sizeof(*request->ssids) * n_ssids 8561 + sizeof(*request->match_sets) * n_match_sets 8562 + sizeof(*request->scan_plans) * n_plans 8563 + sizeof(*request->channels) * n_channels 8564 + ie_len, GFP_KERNEL); 8565 if (!request) 8566 return ERR_PTR(-ENOMEM); 8567 8568 if (n_ssids) 8569 request->ssids = (void *)&request->channels[n_channels]; 8570 request->n_ssids = n_ssids; 8571 if (ie_len) { 8572 if (n_ssids) 8573 request->ie = (void *)(request->ssids + n_ssids); 8574 else 8575 request->ie = (void *)(request->channels + n_channels); 8576 } 8577 8578 if (n_match_sets) { 8579 if (request->ie) 8580 request->match_sets = (void *)(request->ie + ie_len); 8581 else if (n_ssids) 8582 request->match_sets = 8583 (void *)(request->ssids + n_ssids); 8584 else 8585 request->match_sets = 8586 (void *)(request->channels + n_channels); 8587 } 8588 request->n_match_sets = n_match_sets; 8589 8590 if (n_match_sets) 8591 request->scan_plans = (void *)(request->match_sets + 8592 n_match_sets); 8593 else if (request->ie) 8594 request->scan_plans = (void *)(request->ie + ie_len); 8595 else if (n_ssids) 8596 request->scan_plans = (void *)(request->ssids + n_ssids); 8597 else 8598 request->scan_plans = (void *)(request->channels + n_channels); 8599 8600 request->n_scan_plans = n_plans; 8601 8602 i = 0; 8603 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 8604 /* user specified, bail out if channel not found */ 8605 nla_for_each_nested(attr, 8606 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 8607 tmp) { 8608 struct ieee80211_channel *chan; 8609 8610 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 8611 8612 if (!chan) { 8613 err = -EINVAL; 8614 goto out_free; 8615 } 8616 8617 /* ignore disabled channels */ 8618 if (chan->flags & IEEE80211_CHAN_DISABLED) 8619 continue; 8620 8621 request->channels[i] = chan; 8622 i++; 8623 } 8624 } else { 8625 /* all channels */ 8626 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8627 int j; 8628 8629 if (!wiphy->bands[band]) 8630 continue; 8631 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 8632 struct ieee80211_channel *chan; 8633 8634 chan = &wiphy->bands[band]->channels[j]; 8635 8636 if (chan->flags & IEEE80211_CHAN_DISABLED) 8637 continue; 8638 8639 request->channels[i] = chan; 8640 i++; 8641 } 8642 } 8643 } 8644 8645 if (!i) { 8646 err = -EINVAL; 8647 goto out_free; 8648 } 8649 8650 request->n_channels = i; 8651 8652 i = 0; 8653 if (n_ssids) { 8654 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 8655 tmp) { 8656 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 8657 err = -EINVAL; 8658 goto out_free; 8659 } 8660 request->ssids[i].ssid_len = nla_len(attr); 8661 memcpy(request->ssids[i].ssid, nla_data(attr), 8662 nla_len(attr)); 8663 i++; 8664 } 8665 } 8666 8667 i = 0; 8668 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 8669 nla_for_each_nested(attr, 8670 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 8671 tmp) { 8672 struct nlattr *ssid, *bssid, *rssi; 8673 8674 err = nla_parse_nested_deprecated(tb, 8675 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 8676 attr, 8677 nl80211_match_policy, 8678 NULL); 8679 if (err) 8680 goto out_free; 8681 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 8682 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 8683 8684 if (!ssid && !bssid) { 8685 i++; 8686 continue; 8687 } 8688 8689 if (WARN_ON(i >= n_match_sets)) { 8690 /* this indicates a programming error, 8691 * the loop above should have verified 8692 * things properly 8693 */ 8694 err = -EINVAL; 8695 goto out_free; 8696 } 8697 8698 if (ssid) { 8699 memcpy(request->match_sets[i].ssid.ssid, 8700 nla_data(ssid), nla_len(ssid)); 8701 request->match_sets[i].ssid.ssid_len = 8702 nla_len(ssid); 8703 } 8704 if (bssid) 8705 memcpy(request->match_sets[i].bssid, 8706 nla_data(bssid), ETH_ALEN); 8707 8708 /* special attribute - old implementation w/a */ 8709 request->match_sets[i].rssi_thold = default_match_rssi; 8710 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 8711 if (rssi) 8712 request->match_sets[i].rssi_thold = 8713 nla_get_s32(rssi); 8714 8715 /* Parse per band RSSI attribute */ 8716 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 8717 &request->match_sets[i], 8718 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 8719 request->match_sets[i].rssi_thold); 8720 if (err) 8721 goto out_free; 8722 8723 i++; 8724 } 8725 8726 /* there was no other matchset, so the RSSI one is alone */ 8727 if (i == 0 && n_match_sets) 8728 request->match_sets[0].rssi_thold = default_match_rssi; 8729 8730 request->min_rssi_thold = INT_MAX; 8731 for (i = 0; i < n_match_sets; i++) 8732 request->min_rssi_thold = 8733 min(request->match_sets[i].rssi_thold, 8734 request->min_rssi_thold); 8735 } else { 8736 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 8737 } 8738 8739 if (ie_len) { 8740 request->ie_len = ie_len; 8741 memcpy((void *)request->ie, 8742 nla_data(attrs[NL80211_ATTR_IE]), 8743 request->ie_len); 8744 } 8745 8746 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 8747 if (err) 8748 goto out_free; 8749 8750 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 8751 request->delay = 8752 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 8753 8754 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 8755 request->relative_rssi = nla_get_s8( 8756 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 8757 request->relative_rssi_set = true; 8758 } 8759 8760 if (request->relative_rssi_set && 8761 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 8762 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 8763 8764 rssi_adjust = nla_data( 8765 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 8766 request->rssi_adjust.band = rssi_adjust->band; 8767 request->rssi_adjust.delta = rssi_adjust->delta; 8768 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 8769 err = -EINVAL; 8770 goto out_free; 8771 } 8772 } 8773 8774 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 8775 if (err) 8776 goto out_free; 8777 8778 request->scan_start = jiffies; 8779 8780 return request; 8781 8782 out_free: 8783 kfree(request); 8784 return ERR_PTR(err); 8785 } 8786 8787 static int nl80211_start_sched_scan(struct sk_buff *skb, 8788 struct genl_info *info) 8789 { 8790 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8791 struct net_device *dev = info->user_ptr[1]; 8792 struct wireless_dev *wdev = dev->ieee80211_ptr; 8793 struct cfg80211_sched_scan_request *sched_scan_req; 8794 bool want_multi; 8795 int err; 8796 8797 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 8798 return -EOPNOTSUPP; 8799 8800 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 8801 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 8802 if (err) 8803 return err; 8804 8805 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 8806 info->attrs, 8807 rdev->wiphy.max_match_sets); 8808 8809 err = PTR_ERR_OR_ZERO(sched_scan_req); 8810 if (err) 8811 goto out_err; 8812 8813 /* leave request id zero for legacy request 8814 * or if driver does not support multi-scheduled scan 8815 */ 8816 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 8817 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 8818 8819 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 8820 if (err) 8821 goto out_free; 8822 8823 sched_scan_req->dev = dev; 8824 sched_scan_req->wiphy = &rdev->wiphy; 8825 8826 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 8827 sched_scan_req->owner_nlportid = info->snd_portid; 8828 8829 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 8830 8831 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 8832 return 0; 8833 8834 out_free: 8835 kfree(sched_scan_req); 8836 out_err: 8837 return err; 8838 } 8839 8840 static int nl80211_stop_sched_scan(struct sk_buff *skb, 8841 struct genl_info *info) 8842 { 8843 struct cfg80211_sched_scan_request *req; 8844 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8845 u64 cookie; 8846 8847 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 8848 return -EOPNOTSUPP; 8849 8850 if (info->attrs[NL80211_ATTR_COOKIE]) { 8851 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 8852 return __cfg80211_stop_sched_scan(rdev, cookie, false); 8853 } 8854 8855 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 8856 struct cfg80211_sched_scan_request, 8857 list); 8858 if (!req || req->reqid || 8859 (req->owner_nlportid && 8860 req->owner_nlportid != info->snd_portid)) 8861 return -ENOENT; 8862 8863 return cfg80211_stop_sched_scan_req(rdev, req, false); 8864 } 8865 8866 static int nl80211_start_radar_detection(struct sk_buff *skb, 8867 struct genl_info *info) 8868 { 8869 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8870 struct net_device *dev = info->user_ptr[1]; 8871 struct wireless_dev *wdev = dev->ieee80211_ptr; 8872 struct wiphy *wiphy = wdev->wiphy; 8873 struct cfg80211_chan_def chandef; 8874 enum nl80211_dfs_regions dfs_region; 8875 unsigned int cac_time_ms; 8876 int err; 8877 8878 dfs_region = reg_get_dfs_region(wiphy); 8879 if (dfs_region == NL80211_DFS_UNSET) 8880 return -EINVAL; 8881 8882 err = nl80211_parse_chandef(rdev, info, &chandef); 8883 if (err) 8884 return err; 8885 8886 if (netif_carrier_ok(dev)) 8887 return -EBUSY; 8888 8889 if (wdev->cac_started) 8890 return -EBUSY; 8891 8892 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8893 if (err < 0) 8894 return err; 8895 8896 if (err == 0) 8897 return -EINVAL; 8898 8899 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) 8900 return -EINVAL; 8901 8902 /* CAC start is offloaded to HW and can't be started manually */ 8903 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) 8904 return -EOPNOTSUPP; 8905 8906 if (!rdev->ops->start_radar_detection) 8907 return -EOPNOTSUPP; 8908 8909 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 8910 if (WARN_ON(!cac_time_ms)) 8911 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 8912 8913 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 8914 if (!err) { 8915 wdev->chandef = chandef; 8916 wdev->cac_started = true; 8917 wdev->cac_start_time = jiffies; 8918 wdev->cac_time_ms = cac_time_ms; 8919 } 8920 return err; 8921 } 8922 8923 static int nl80211_notify_radar_detection(struct sk_buff *skb, 8924 struct genl_info *info) 8925 { 8926 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8927 struct net_device *dev = info->user_ptr[1]; 8928 struct wireless_dev *wdev = dev->ieee80211_ptr; 8929 struct wiphy *wiphy = wdev->wiphy; 8930 struct cfg80211_chan_def chandef; 8931 enum nl80211_dfs_regions dfs_region; 8932 int err; 8933 8934 dfs_region = reg_get_dfs_region(wiphy); 8935 if (dfs_region == NL80211_DFS_UNSET) { 8936 GENL_SET_ERR_MSG(info, 8937 "DFS Region is not set. Unexpected Radar indication"); 8938 return -EINVAL; 8939 } 8940 8941 err = nl80211_parse_chandef(rdev, info, &chandef); 8942 if (err) { 8943 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 8944 return err; 8945 } 8946 8947 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 8948 if (err < 0) { 8949 GENL_SET_ERR_MSG(info, "chandef is invalid"); 8950 return err; 8951 } 8952 8953 if (err == 0) { 8954 GENL_SET_ERR_MSG(info, 8955 "Unexpected Radar indication for chandef/iftype"); 8956 return -EINVAL; 8957 } 8958 8959 /* Do not process this notification if radar is already detected 8960 * by kernel on this channel, and return success. 8961 */ 8962 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 8963 return 0; 8964 8965 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 8966 8967 cfg80211_sched_dfs_chan_update(rdev); 8968 8969 rdev->radar_chandef = chandef; 8970 8971 /* Propagate this notification to other radios as well */ 8972 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 8973 8974 return 0; 8975 } 8976 8977 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 8978 { 8979 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8980 struct net_device *dev = info->user_ptr[1]; 8981 struct wireless_dev *wdev = dev->ieee80211_ptr; 8982 struct cfg80211_csa_settings params; 8983 /* csa_attrs is defined static to avoid waste of stack size - this 8984 * function is called under RTNL lock, so this should not be a problem. 8985 */ 8986 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 8987 int err; 8988 bool need_new_beacon = false; 8989 bool need_handle_dfs_flag = true; 8990 int len, i; 8991 u32 cs_count; 8992 8993 if (!rdev->ops->channel_switch || 8994 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 8995 return -EOPNOTSUPP; 8996 8997 switch (dev->ieee80211_ptr->iftype) { 8998 case NL80211_IFTYPE_AP: 8999 case NL80211_IFTYPE_P2P_GO: 9000 need_new_beacon = true; 9001 /* For all modes except AP the handle_dfs flag needs to be 9002 * supplied to tell the kernel that userspace will handle radar 9003 * events when they happen. Otherwise a switch to a channel 9004 * requiring DFS will be rejected. 9005 */ 9006 need_handle_dfs_flag = false; 9007 9008 /* useless if AP is not running */ 9009 if (!wdev->beacon_interval) 9010 return -ENOTCONN; 9011 break; 9012 case NL80211_IFTYPE_ADHOC: 9013 if (!wdev->ssid_len) 9014 return -ENOTCONN; 9015 break; 9016 case NL80211_IFTYPE_MESH_POINT: 9017 if (!wdev->mesh_id_len) 9018 return -ENOTCONN; 9019 break; 9020 default: 9021 return -EOPNOTSUPP; 9022 } 9023 9024 memset(¶ms, 0, sizeof(params)); 9025 params.beacon_csa.ftm_responder = -1; 9026 9027 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9028 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 9029 return -EINVAL; 9030 9031 /* only important for AP, IBSS and mesh create IEs internally */ 9032 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 9033 return -EINVAL; 9034 9035 /* Even though the attribute is u32, the specification says 9036 * u8, so let's make sure we don't overflow. 9037 */ 9038 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 9039 if (cs_count > 255) 9040 return -EINVAL; 9041 9042 params.count = cs_count; 9043 9044 if (!need_new_beacon) 9045 goto skip_beacons; 9046 9047 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after); 9048 if (err) 9049 return err; 9050 9051 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 9052 info->attrs[NL80211_ATTR_CSA_IES], 9053 nl80211_policy, info->extack); 9054 if (err) 9055 return err; 9056 9057 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa); 9058 if (err) 9059 return err; 9060 9061 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) 9062 return -EINVAL; 9063 9064 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9065 if (!len || (len % sizeof(u16))) 9066 return -EINVAL; 9067 9068 params.n_counter_offsets_beacon = len / sizeof(u16); 9069 if (rdev->wiphy.max_num_csa_counters && 9070 (params.n_counter_offsets_beacon > 9071 rdev->wiphy.max_num_csa_counters)) 9072 return -EINVAL; 9073 9074 params.counter_offsets_beacon = 9075 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 9076 9077 /* sanity checks - counters should fit and be the same */ 9078 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 9079 u16 offset = params.counter_offsets_beacon[i]; 9080 9081 if (offset >= params.beacon_csa.tail_len) 9082 return -EINVAL; 9083 9084 if (params.beacon_csa.tail[offset] != params.count) 9085 return -EINVAL; 9086 } 9087 9088 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 9089 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9090 if (!len || (len % sizeof(u16))) 9091 return -EINVAL; 9092 9093 params.n_counter_offsets_presp = len / sizeof(u16); 9094 if (rdev->wiphy.max_num_csa_counters && 9095 (params.n_counter_offsets_presp > 9096 rdev->wiphy.max_num_csa_counters)) 9097 return -EINVAL; 9098 9099 params.counter_offsets_presp = 9100 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 9101 9102 /* sanity checks - counters should fit and be the same */ 9103 for (i = 0; i < params.n_counter_offsets_presp; i++) { 9104 u16 offset = params.counter_offsets_presp[i]; 9105 9106 if (offset >= params.beacon_csa.probe_resp_len) 9107 return -EINVAL; 9108 9109 if (params.beacon_csa.probe_resp[offset] != 9110 params.count) 9111 return -EINVAL; 9112 } 9113 } 9114 9115 skip_beacons: 9116 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 9117 if (err) 9118 return err; 9119 9120 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 9121 wdev->iftype)) 9122 return -EINVAL; 9123 9124 err = cfg80211_chandef_dfs_required(wdev->wiphy, 9125 ¶ms.chandef, 9126 wdev->iftype); 9127 if (err < 0) 9128 return err; 9129 9130 if (err > 0) { 9131 params.radar_required = true; 9132 if (need_handle_dfs_flag && 9133 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 9134 return -EINVAL; 9135 } 9136 } 9137 9138 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 9139 params.block_tx = true; 9140 9141 wdev_lock(wdev); 9142 err = rdev_channel_switch(rdev, dev, ¶ms); 9143 wdev_unlock(wdev); 9144 9145 return err; 9146 } 9147 9148 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 9149 u32 seq, int flags, 9150 struct cfg80211_registered_device *rdev, 9151 struct wireless_dev *wdev, 9152 struct cfg80211_internal_bss *intbss) 9153 { 9154 struct cfg80211_bss *res = &intbss->pub; 9155 const struct cfg80211_bss_ies *ies; 9156 void *hdr; 9157 struct nlattr *bss; 9158 9159 ASSERT_WDEV_LOCK(wdev); 9160 9161 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 9162 NL80211_CMD_NEW_SCAN_RESULTS); 9163 if (!hdr) 9164 return -1; 9165 9166 genl_dump_check_consistent(cb, hdr); 9167 9168 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 9169 goto nla_put_failure; 9170 if (wdev->netdev && 9171 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 9172 goto nla_put_failure; 9173 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 9174 NL80211_ATTR_PAD)) 9175 goto nla_put_failure; 9176 9177 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 9178 if (!bss) 9179 goto nla_put_failure; 9180 if ((!is_zero_ether_addr(res->bssid) && 9181 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 9182 goto nla_put_failure; 9183 9184 rcu_read_lock(); 9185 /* indicate whether we have probe response data or not */ 9186 if (rcu_access_pointer(res->proberesp_ies) && 9187 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 9188 goto fail_unlock_rcu; 9189 9190 /* this pointer prefers to be pointed to probe response data 9191 * but is always valid 9192 */ 9193 ies = rcu_dereference(res->ies); 9194 if (ies) { 9195 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 9196 NL80211_BSS_PAD)) 9197 goto fail_unlock_rcu; 9198 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 9199 ies->len, ies->data)) 9200 goto fail_unlock_rcu; 9201 } 9202 9203 /* and this pointer is always (unless driver didn't know) beacon data */ 9204 ies = rcu_dereference(res->beacon_ies); 9205 if (ies && ies->from_beacon) { 9206 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 9207 NL80211_BSS_PAD)) 9208 goto fail_unlock_rcu; 9209 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 9210 ies->len, ies->data)) 9211 goto fail_unlock_rcu; 9212 } 9213 rcu_read_unlock(); 9214 9215 if (res->beacon_interval && 9216 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 9217 goto nla_put_failure; 9218 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 9219 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 9220 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 9221 res->channel->freq_offset) || 9222 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 9223 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 9224 jiffies_to_msecs(jiffies - intbss->ts))) 9225 goto nla_put_failure; 9226 9227 if (intbss->parent_tsf && 9228 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 9229 intbss->parent_tsf, NL80211_BSS_PAD) || 9230 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 9231 intbss->parent_bssid))) 9232 goto nla_put_failure; 9233 9234 if (intbss->ts_boottime && 9235 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 9236 intbss->ts_boottime, NL80211_BSS_PAD)) 9237 goto nla_put_failure; 9238 9239 if (!nl80211_put_signal(msg, intbss->pub.chains, 9240 intbss->pub.chain_signal, 9241 NL80211_BSS_CHAIN_SIGNAL)) 9242 goto nla_put_failure; 9243 9244 switch (rdev->wiphy.signal_type) { 9245 case CFG80211_SIGNAL_TYPE_MBM: 9246 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 9247 goto nla_put_failure; 9248 break; 9249 case CFG80211_SIGNAL_TYPE_UNSPEC: 9250 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 9251 goto nla_put_failure; 9252 break; 9253 default: 9254 break; 9255 } 9256 9257 switch (wdev->iftype) { 9258 case NL80211_IFTYPE_P2P_CLIENT: 9259 case NL80211_IFTYPE_STATION: 9260 if (intbss == wdev->current_bss && 9261 nla_put_u32(msg, NL80211_BSS_STATUS, 9262 NL80211_BSS_STATUS_ASSOCIATED)) 9263 goto nla_put_failure; 9264 break; 9265 case NL80211_IFTYPE_ADHOC: 9266 if (intbss == wdev->current_bss && 9267 nla_put_u32(msg, NL80211_BSS_STATUS, 9268 NL80211_BSS_STATUS_IBSS_JOINED)) 9269 goto nla_put_failure; 9270 break; 9271 default: 9272 break; 9273 } 9274 9275 nla_nest_end(msg, bss); 9276 9277 genlmsg_end(msg, hdr); 9278 return 0; 9279 9280 fail_unlock_rcu: 9281 rcu_read_unlock(); 9282 nla_put_failure: 9283 genlmsg_cancel(msg, hdr); 9284 return -EMSGSIZE; 9285 } 9286 9287 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 9288 { 9289 struct cfg80211_registered_device *rdev; 9290 struct cfg80211_internal_bss *scan; 9291 struct wireless_dev *wdev; 9292 int start = cb->args[2], idx = 0; 9293 int err; 9294 9295 rtnl_lock(); 9296 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9297 if (err) { 9298 rtnl_unlock(); 9299 return err; 9300 } 9301 9302 wdev_lock(wdev); 9303 spin_lock_bh(&rdev->bss_lock); 9304 9305 /* 9306 * dump_scan will be called multiple times to break up the scan results 9307 * into multiple messages. It is unlikely that any more bss-es will be 9308 * expired after the first call, so only call only call this on the 9309 * first dump_scan invocation. 9310 */ 9311 if (start == 0) 9312 cfg80211_bss_expire(rdev); 9313 9314 cb->seq = rdev->bss_generation; 9315 9316 list_for_each_entry(scan, &rdev->bss_list, list) { 9317 if (++idx <= start) 9318 continue; 9319 if (nl80211_send_bss(skb, cb, 9320 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9321 rdev, wdev, scan) < 0) { 9322 idx--; 9323 break; 9324 } 9325 } 9326 9327 spin_unlock_bh(&rdev->bss_lock); 9328 wdev_unlock(wdev); 9329 9330 cb->args[2] = idx; 9331 rtnl_unlock(); 9332 9333 return skb->len; 9334 } 9335 9336 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 9337 int flags, struct net_device *dev, 9338 bool allow_radio_stats, 9339 struct survey_info *survey) 9340 { 9341 void *hdr; 9342 struct nlattr *infoattr; 9343 9344 /* skip radio stats if userspace didn't request them */ 9345 if (!survey->channel && !allow_radio_stats) 9346 return 0; 9347 9348 hdr = nl80211hdr_put(msg, portid, seq, flags, 9349 NL80211_CMD_NEW_SURVEY_RESULTS); 9350 if (!hdr) 9351 return -ENOMEM; 9352 9353 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 9354 goto nla_put_failure; 9355 9356 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 9357 if (!infoattr) 9358 goto nla_put_failure; 9359 9360 if (survey->channel && 9361 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 9362 survey->channel->center_freq)) 9363 goto nla_put_failure; 9364 9365 if (survey->channel && survey->channel->freq_offset && 9366 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 9367 survey->channel->freq_offset)) 9368 goto nla_put_failure; 9369 9370 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 9371 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 9372 goto nla_put_failure; 9373 if ((survey->filled & SURVEY_INFO_IN_USE) && 9374 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 9375 goto nla_put_failure; 9376 if ((survey->filled & SURVEY_INFO_TIME) && 9377 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 9378 survey->time, NL80211_SURVEY_INFO_PAD)) 9379 goto nla_put_failure; 9380 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 9381 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 9382 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 9383 goto nla_put_failure; 9384 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 9385 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 9386 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 9387 goto nla_put_failure; 9388 if ((survey->filled & SURVEY_INFO_TIME_RX) && 9389 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 9390 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 9391 goto nla_put_failure; 9392 if ((survey->filled & SURVEY_INFO_TIME_TX) && 9393 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 9394 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 9395 goto nla_put_failure; 9396 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 9397 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 9398 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 9399 goto nla_put_failure; 9400 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 9401 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 9402 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 9403 goto nla_put_failure; 9404 9405 nla_nest_end(msg, infoattr); 9406 9407 genlmsg_end(msg, hdr); 9408 return 0; 9409 9410 nla_put_failure: 9411 genlmsg_cancel(msg, hdr); 9412 return -EMSGSIZE; 9413 } 9414 9415 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 9416 { 9417 struct nlattr **attrbuf; 9418 struct survey_info survey; 9419 struct cfg80211_registered_device *rdev; 9420 struct wireless_dev *wdev; 9421 int survey_idx = cb->args[2]; 9422 int res; 9423 bool radio_stats; 9424 9425 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 9426 if (!attrbuf) 9427 return -ENOMEM; 9428 9429 rtnl_lock(); 9430 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 9431 if (res) 9432 goto out_err; 9433 9434 /* prepare_wdev_dump parsed the attributes */ 9435 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 9436 9437 if (!wdev->netdev) { 9438 res = -EINVAL; 9439 goto out_err; 9440 } 9441 9442 if (!rdev->ops->dump_survey) { 9443 res = -EOPNOTSUPP; 9444 goto out_err; 9445 } 9446 9447 while (1) { 9448 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 9449 if (res == -ENOENT) 9450 break; 9451 if (res) 9452 goto out_err; 9453 9454 /* don't send disabled channels, but do send non-channel data */ 9455 if (survey.channel && 9456 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 9457 survey_idx++; 9458 continue; 9459 } 9460 9461 if (nl80211_send_survey(skb, 9462 NETLINK_CB(cb->skb).portid, 9463 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9464 wdev->netdev, radio_stats, &survey) < 0) 9465 goto out; 9466 survey_idx++; 9467 } 9468 9469 out: 9470 cb->args[2] = survey_idx; 9471 res = skb->len; 9472 out_err: 9473 kfree(attrbuf); 9474 rtnl_unlock(); 9475 return res; 9476 } 9477 9478 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 9479 { 9480 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 9481 NL80211_WPA_VERSION_2 | 9482 NL80211_WPA_VERSION_3)); 9483 } 9484 9485 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 9486 { 9487 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9488 struct net_device *dev = info->user_ptr[1]; 9489 struct ieee80211_channel *chan; 9490 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 9491 int err, ssid_len, ie_len = 0, auth_data_len = 0; 9492 enum nl80211_auth_type auth_type; 9493 struct key_parse key; 9494 bool local_state_change; 9495 u32 freq; 9496 9497 if (!info->attrs[NL80211_ATTR_MAC]) 9498 return -EINVAL; 9499 9500 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 9501 return -EINVAL; 9502 9503 if (!info->attrs[NL80211_ATTR_SSID]) 9504 return -EINVAL; 9505 9506 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9507 return -EINVAL; 9508 9509 err = nl80211_parse_key(info, &key); 9510 if (err) 9511 return err; 9512 9513 if (key.idx >= 0) { 9514 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 9515 return -EINVAL; 9516 if (!key.p.key || !key.p.key_len) 9517 return -EINVAL; 9518 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 9519 key.p.key_len != WLAN_KEY_LEN_WEP40) && 9520 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 9521 key.p.key_len != WLAN_KEY_LEN_WEP104)) 9522 return -EINVAL; 9523 if (key.idx > 3) 9524 return -EINVAL; 9525 } else { 9526 key.p.key_len = 0; 9527 key.p.key = NULL; 9528 } 9529 9530 if (key.idx >= 0) { 9531 int i; 9532 bool ok = false; 9533 9534 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 9535 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 9536 ok = true; 9537 break; 9538 } 9539 } 9540 if (!ok) 9541 return -EINVAL; 9542 } 9543 9544 if (!rdev->ops->auth) 9545 return -EOPNOTSUPP; 9546 9547 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9548 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9549 return -EOPNOTSUPP; 9550 9551 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9552 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9553 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9554 freq += 9555 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9556 9557 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9558 if (!chan) 9559 return -EINVAL; 9560 9561 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9562 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9563 9564 if (info->attrs[NL80211_ATTR_IE]) { 9565 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9566 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9567 } 9568 9569 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9570 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 9571 return -EINVAL; 9572 9573 if ((auth_type == NL80211_AUTHTYPE_SAE || 9574 auth_type == NL80211_AUTHTYPE_FILS_SK || 9575 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 9576 auth_type == NL80211_AUTHTYPE_FILS_PK) && 9577 !info->attrs[NL80211_ATTR_AUTH_DATA]) 9578 return -EINVAL; 9579 9580 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 9581 if (auth_type != NL80211_AUTHTYPE_SAE && 9582 auth_type != NL80211_AUTHTYPE_FILS_SK && 9583 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 9584 auth_type != NL80211_AUTHTYPE_FILS_PK) 9585 return -EINVAL; 9586 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 9587 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 9588 } 9589 9590 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9591 9592 /* 9593 * Since we no longer track auth state, ignore 9594 * requests to only change local state. 9595 */ 9596 if (local_state_change) 9597 return 0; 9598 9599 wdev_lock(dev->ieee80211_ptr); 9600 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 9601 ssid, ssid_len, ie, ie_len, 9602 key.p.key, key.p.key_len, key.idx, 9603 auth_data, auth_data_len); 9604 wdev_unlock(dev->ieee80211_ptr); 9605 return err; 9606 } 9607 9608 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 9609 struct genl_info *info) 9610 { 9611 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9612 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 9613 return -EINVAL; 9614 } 9615 9616 if (!rdev->ops->tx_control_port || 9617 !wiphy_ext_feature_isset(&rdev->wiphy, 9618 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 9619 return -EOPNOTSUPP; 9620 9621 return 0; 9622 } 9623 9624 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 9625 struct genl_info *info, 9626 struct cfg80211_crypto_settings *settings, 9627 int cipher_limit) 9628 { 9629 memset(settings, 0, sizeof(*settings)); 9630 9631 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 9632 9633 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 9634 u16 proto; 9635 9636 proto = nla_get_u16( 9637 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 9638 settings->control_port_ethertype = cpu_to_be16(proto); 9639 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 9640 proto != ETH_P_PAE) 9641 return -EINVAL; 9642 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 9643 settings->control_port_no_encrypt = true; 9644 } else 9645 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 9646 9647 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 9648 int r = validate_pae_over_nl80211(rdev, info); 9649 9650 if (r < 0) 9651 return r; 9652 9653 settings->control_port_over_nl80211 = true; 9654 9655 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 9656 settings->control_port_no_preauth = true; 9657 } 9658 9659 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 9660 void *data; 9661 int len, i; 9662 9663 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9664 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 9665 settings->n_ciphers_pairwise = len / sizeof(u32); 9666 9667 if (len % sizeof(u32)) 9668 return -EINVAL; 9669 9670 if (settings->n_ciphers_pairwise > cipher_limit) 9671 return -EINVAL; 9672 9673 memcpy(settings->ciphers_pairwise, data, len); 9674 9675 for (i = 0; i < settings->n_ciphers_pairwise; i++) 9676 if (!cfg80211_supported_cipher_suite( 9677 &rdev->wiphy, 9678 settings->ciphers_pairwise[i])) 9679 return -EINVAL; 9680 } 9681 9682 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 9683 settings->cipher_group = 9684 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 9685 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 9686 settings->cipher_group)) 9687 return -EINVAL; 9688 } 9689 9690 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 9691 settings->wpa_versions = 9692 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 9693 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 9694 return -EINVAL; 9695 } 9696 9697 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 9698 void *data; 9699 int len; 9700 9701 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 9702 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 9703 settings->n_akm_suites = len / sizeof(u32); 9704 9705 if (len % sizeof(u32)) 9706 return -EINVAL; 9707 9708 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 9709 return -EINVAL; 9710 9711 memcpy(settings->akm_suites, data, len); 9712 } 9713 9714 if (info->attrs[NL80211_ATTR_PMK]) { 9715 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 9716 return -EINVAL; 9717 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9718 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 9719 !wiphy_ext_feature_isset(&rdev->wiphy, 9720 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 9721 return -EINVAL; 9722 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9723 } 9724 9725 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 9726 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9727 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 9728 !wiphy_ext_feature_isset(&rdev->wiphy, 9729 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 9730 return -EINVAL; 9731 settings->sae_pwd = 9732 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9733 settings->sae_pwd_len = 9734 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 9735 } 9736 9737 if (info->attrs[NL80211_ATTR_SAE_PWE]) 9738 settings->sae_pwe = 9739 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]); 9740 else 9741 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED; 9742 9743 return 0; 9744 } 9745 9746 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 9747 { 9748 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9749 struct net_device *dev = info->user_ptr[1]; 9750 struct ieee80211_channel *chan; 9751 struct cfg80211_assoc_request req = {}; 9752 const u8 *bssid, *ssid; 9753 int err, ssid_len = 0; 9754 u32 freq; 9755 9756 if (dev->ieee80211_ptr->conn_owner_nlportid && 9757 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9758 return -EPERM; 9759 9760 if (!info->attrs[NL80211_ATTR_MAC] || 9761 !info->attrs[NL80211_ATTR_SSID] || 9762 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9763 return -EINVAL; 9764 9765 if (!rdev->ops->assoc) 9766 return -EOPNOTSUPP; 9767 9768 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9769 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9770 return -EOPNOTSUPP; 9771 9772 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9773 9774 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 9775 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 9776 freq += 9777 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 9778 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 9779 if (!chan) 9780 return -EINVAL; 9781 9782 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9783 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9784 9785 if (info->attrs[NL80211_ATTR_IE]) { 9786 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9787 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9788 } 9789 9790 if (info->attrs[NL80211_ATTR_USE_MFP]) { 9791 enum nl80211_mfp mfp = 9792 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 9793 if (mfp == NL80211_MFP_REQUIRED) 9794 req.use_mfp = true; 9795 else if (mfp != NL80211_MFP_NO) 9796 return -EINVAL; 9797 } 9798 9799 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9800 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9801 9802 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9803 req.flags |= ASSOC_REQ_DISABLE_HT; 9804 9805 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9806 memcpy(&req.ht_capa_mask, 9807 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9808 sizeof(req.ht_capa_mask)); 9809 9810 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9811 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9812 return -EINVAL; 9813 memcpy(&req.ht_capa, 9814 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9815 sizeof(req.ht_capa)); 9816 } 9817 9818 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9819 req.flags |= ASSOC_REQ_DISABLE_VHT; 9820 9821 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9822 memcpy(&req.vht_capa_mask, 9823 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9824 sizeof(req.vht_capa_mask)); 9825 9826 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9827 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9828 return -EINVAL; 9829 memcpy(&req.vht_capa, 9830 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9831 sizeof(req.vht_capa)); 9832 } 9833 9834 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9835 if (!((rdev->wiphy.features & 9836 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9837 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9838 !wiphy_ext_feature_isset(&rdev->wiphy, 9839 NL80211_EXT_FEATURE_RRM)) 9840 return -EINVAL; 9841 req.flags |= ASSOC_REQ_USE_RRM; 9842 } 9843 9844 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 9845 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 9846 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 9847 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 9848 return -EINVAL; 9849 req.fils_nonces = 9850 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 9851 } 9852 9853 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 9854 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 9855 return -EINVAL; 9856 memcpy(&req.s1g_capa_mask, 9857 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 9858 sizeof(req.s1g_capa_mask)); 9859 } 9860 9861 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 9862 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 9863 return -EINVAL; 9864 memcpy(&req.s1g_capa, 9865 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 9866 sizeof(req.s1g_capa)); 9867 } 9868 9869 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 9870 if (!err) { 9871 wdev_lock(dev->ieee80211_ptr); 9872 9873 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 9874 ssid, ssid_len, &req); 9875 9876 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9877 dev->ieee80211_ptr->conn_owner_nlportid = 9878 info->snd_portid; 9879 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9880 bssid, ETH_ALEN); 9881 } 9882 9883 wdev_unlock(dev->ieee80211_ptr); 9884 } 9885 9886 return err; 9887 } 9888 9889 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 9890 { 9891 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9892 struct net_device *dev = info->user_ptr[1]; 9893 const u8 *ie = NULL, *bssid; 9894 int ie_len = 0, err; 9895 u16 reason_code; 9896 bool local_state_change; 9897 9898 if (dev->ieee80211_ptr->conn_owner_nlportid && 9899 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9900 return -EPERM; 9901 9902 if (!info->attrs[NL80211_ATTR_MAC]) 9903 return -EINVAL; 9904 9905 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9906 return -EINVAL; 9907 9908 if (!rdev->ops->deauth) 9909 return -EOPNOTSUPP; 9910 9911 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9912 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9913 return -EOPNOTSUPP; 9914 9915 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9916 9917 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9918 if (reason_code == 0) { 9919 /* Reason Code 0 is reserved */ 9920 return -EINVAL; 9921 } 9922 9923 if (info->attrs[NL80211_ATTR_IE]) { 9924 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9925 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9926 } 9927 9928 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9929 9930 wdev_lock(dev->ieee80211_ptr); 9931 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 9932 local_state_change); 9933 wdev_unlock(dev->ieee80211_ptr); 9934 return err; 9935 } 9936 9937 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 9938 { 9939 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9940 struct net_device *dev = info->user_ptr[1]; 9941 const u8 *ie = NULL, *bssid; 9942 int ie_len = 0, err; 9943 u16 reason_code; 9944 bool local_state_change; 9945 9946 if (dev->ieee80211_ptr->conn_owner_nlportid && 9947 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9948 return -EPERM; 9949 9950 if (!info->attrs[NL80211_ATTR_MAC]) 9951 return -EINVAL; 9952 9953 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9954 return -EINVAL; 9955 9956 if (!rdev->ops->disassoc) 9957 return -EOPNOTSUPP; 9958 9959 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9960 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9961 return -EOPNOTSUPP; 9962 9963 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9964 9965 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9966 if (reason_code == 0) { 9967 /* Reason Code 0 is reserved */ 9968 return -EINVAL; 9969 } 9970 9971 if (info->attrs[NL80211_ATTR_IE]) { 9972 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9973 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9974 } 9975 9976 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 9977 9978 wdev_lock(dev->ieee80211_ptr); 9979 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 9980 local_state_change); 9981 wdev_unlock(dev->ieee80211_ptr); 9982 return err; 9983 } 9984 9985 static bool 9986 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 9987 int mcast_rate[NUM_NL80211_BANDS], 9988 int rateval) 9989 { 9990 struct wiphy *wiphy = &rdev->wiphy; 9991 bool found = false; 9992 int band, i; 9993 9994 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9995 struct ieee80211_supported_band *sband; 9996 9997 sband = wiphy->bands[band]; 9998 if (!sband) 9999 continue; 10000 10001 for (i = 0; i < sband->n_bitrates; i++) { 10002 if (sband->bitrates[i].bitrate == rateval) { 10003 mcast_rate[band] = i + 1; 10004 found = true; 10005 break; 10006 } 10007 } 10008 } 10009 10010 return found; 10011 } 10012 10013 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 10014 { 10015 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10016 struct net_device *dev = info->user_ptr[1]; 10017 struct cfg80211_ibss_params ibss; 10018 struct wiphy *wiphy; 10019 struct cfg80211_cached_keys *connkeys = NULL; 10020 int err; 10021 10022 memset(&ibss, 0, sizeof(ibss)); 10023 10024 if (!info->attrs[NL80211_ATTR_SSID] || 10025 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10026 return -EINVAL; 10027 10028 ibss.beacon_interval = 100; 10029 10030 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 10031 ibss.beacon_interval = 10032 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10033 10034 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 10035 ibss.beacon_interval); 10036 if (err) 10037 return err; 10038 10039 if (!rdev->ops->join_ibss) 10040 return -EOPNOTSUPP; 10041 10042 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10043 return -EOPNOTSUPP; 10044 10045 wiphy = &rdev->wiphy; 10046 10047 if (info->attrs[NL80211_ATTR_MAC]) { 10048 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10049 10050 if (!is_valid_ether_addr(ibss.bssid)) 10051 return -EINVAL; 10052 } 10053 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10054 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10055 10056 if (info->attrs[NL80211_ATTR_IE]) { 10057 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10058 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10059 } 10060 10061 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 10062 if (err) 10063 return err; 10064 10065 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 10066 NL80211_IFTYPE_ADHOC)) 10067 return -EINVAL; 10068 10069 switch (ibss.chandef.width) { 10070 case NL80211_CHAN_WIDTH_5: 10071 case NL80211_CHAN_WIDTH_10: 10072 case NL80211_CHAN_WIDTH_20_NOHT: 10073 break; 10074 case NL80211_CHAN_WIDTH_20: 10075 case NL80211_CHAN_WIDTH_40: 10076 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10077 return -EINVAL; 10078 break; 10079 case NL80211_CHAN_WIDTH_80: 10080 case NL80211_CHAN_WIDTH_80P80: 10081 case NL80211_CHAN_WIDTH_160: 10082 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 10083 return -EINVAL; 10084 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10085 NL80211_EXT_FEATURE_VHT_IBSS)) 10086 return -EINVAL; 10087 break; 10088 default: 10089 return -EINVAL; 10090 } 10091 10092 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 10093 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 10094 10095 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10096 u8 *rates = 10097 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10098 int n_rates = 10099 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10100 struct ieee80211_supported_band *sband = 10101 wiphy->bands[ibss.chandef.chan->band]; 10102 10103 err = ieee80211_get_ratemask(sband, rates, n_rates, 10104 &ibss.basic_rates); 10105 if (err) 10106 return err; 10107 } 10108 10109 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10110 memcpy(&ibss.ht_capa_mask, 10111 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10112 sizeof(ibss.ht_capa_mask)); 10113 10114 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10115 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10116 return -EINVAL; 10117 memcpy(&ibss.ht_capa, 10118 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10119 sizeof(ibss.ht_capa)); 10120 } 10121 10122 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 10123 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 10124 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 10125 return -EINVAL; 10126 10127 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10128 bool no_ht = false; 10129 10130 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 10131 if (IS_ERR(connkeys)) 10132 return PTR_ERR(connkeys); 10133 10134 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 10135 no_ht) { 10136 kfree_sensitive(connkeys); 10137 return -EINVAL; 10138 } 10139 } 10140 10141 ibss.control_port = 10142 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 10143 10144 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10145 int r = validate_pae_over_nl80211(rdev, info); 10146 10147 if (r < 0) { 10148 kfree_sensitive(connkeys); 10149 return r; 10150 } 10151 10152 ibss.control_port_over_nl80211 = true; 10153 } 10154 10155 ibss.userspace_handles_dfs = 10156 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10157 10158 wdev_lock(dev->ieee80211_ptr); 10159 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 10160 if (err) 10161 kfree_sensitive(connkeys); 10162 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 10163 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10164 wdev_unlock(dev->ieee80211_ptr); 10165 10166 return err; 10167 } 10168 10169 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 10170 { 10171 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10172 struct net_device *dev = info->user_ptr[1]; 10173 10174 if (!rdev->ops->leave_ibss) 10175 return -EOPNOTSUPP; 10176 10177 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 10178 return -EOPNOTSUPP; 10179 10180 return cfg80211_leave_ibss(rdev, dev, false); 10181 } 10182 10183 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 10184 { 10185 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10186 struct net_device *dev = info->user_ptr[1]; 10187 int mcast_rate[NUM_NL80211_BANDS]; 10188 u32 nla_rate; 10189 int err; 10190 10191 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 10192 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 10193 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 10194 return -EOPNOTSUPP; 10195 10196 if (!rdev->ops->set_mcast_rate) 10197 return -EOPNOTSUPP; 10198 10199 memset(mcast_rate, 0, sizeof(mcast_rate)); 10200 10201 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 10202 return -EINVAL; 10203 10204 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 10205 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 10206 return -EINVAL; 10207 10208 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 10209 10210 return err; 10211 } 10212 10213 static struct sk_buff * 10214 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 10215 struct wireless_dev *wdev, int approxlen, 10216 u32 portid, u32 seq, enum nl80211_commands cmd, 10217 enum nl80211_attrs attr, 10218 const struct nl80211_vendor_cmd_info *info, 10219 gfp_t gfp) 10220 { 10221 struct sk_buff *skb; 10222 void *hdr; 10223 struct nlattr *data; 10224 10225 skb = nlmsg_new(approxlen + 100, gfp); 10226 if (!skb) 10227 return NULL; 10228 10229 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 10230 if (!hdr) { 10231 kfree_skb(skb); 10232 return NULL; 10233 } 10234 10235 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 10236 goto nla_put_failure; 10237 10238 if (info) { 10239 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 10240 info->vendor_id)) 10241 goto nla_put_failure; 10242 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 10243 info->subcmd)) 10244 goto nla_put_failure; 10245 } 10246 10247 if (wdev) { 10248 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 10249 wdev_id(wdev), NL80211_ATTR_PAD)) 10250 goto nla_put_failure; 10251 if (wdev->netdev && 10252 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 10253 wdev->netdev->ifindex)) 10254 goto nla_put_failure; 10255 } 10256 10257 data = nla_nest_start_noflag(skb, attr); 10258 if (!data) 10259 goto nla_put_failure; 10260 10261 ((void **)skb->cb)[0] = rdev; 10262 ((void **)skb->cb)[1] = hdr; 10263 ((void **)skb->cb)[2] = data; 10264 10265 return skb; 10266 10267 nla_put_failure: 10268 kfree_skb(skb); 10269 return NULL; 10270 } 10271 10272 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 10273 struct wireless_dev *wdev, 10274 enum nl80211_commands cmd, 10275 enum nl80211_attrs attr, 10276 unsigned int portid, 10277 int vendor_event_idx, 10278 int approxlen, gfp_t gfp) 10279 { 10280 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 10281 const struct nl80211_vendor_cmd_info *info; 10282 10283 switch (cmd) { 10284 case NL80211_CMD_TESTMODE: 10285 if (WARN_ON(vendor_event_idx != -1)) 10286 return NULL; 10287 info = NULL; 10288 break; 10289 case NL80211_CMD_VENDOR: 10290 if (WARN_ON(vendor_event_idx < 0 || 10291 vendor_event_idx >= wiphy->n_vendor_events)) 10292 return NULL; 10293 info = &wiphy->vendor_events[vendor_event_idx]; 10294 break; 10295 default: 10296 WARN_ON(1); 10297 return NULL; 10298 } 10299 10300 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 10301 cmd, attr, info, gfp); 10302 } 10303 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 10304 10305 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 10306 { 10307 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 10308 void *hdr = ((void **)skb->cb)[1]; 10309 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 10310 struct nlattr *data = ((void **)skb->cb)[2]; 10311 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 10312 10313 /* clear CB data for netlink core to own from now on */ 10314 memset(skb->cb, 0, sizeof(skb->cb)); 10315 10316 nla_nest_end(skb, data); 10317 genlmsg_end(skb, hdr); 10318 10319 if (nlhdr->nlmsg_pid) { 10320 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 10321 nlhdr->nlmsg_pid); 10322 } else { 10323 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 10324 mcgrp = NL80211_MCGRP_VENDOR; 10325 10326 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 10327 skb, 0, mcgrp, gfp); 10328 } 10329 } 10330 EXPORT_SYMBOL(__cfg80211_send_event_skb); 10331 10332 #ifdef CONFIG_NL80211_TESTMODE 10333 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 10334 { 10335 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10336 struct wireless_dev *wdev = 10337 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 10338 int err; 10339 10340 if (!rdev->ops->testmode_cmd) 10341 return -EOPNOTSUPP; 10342 10343 if (IS_ERR(wdev)) { 10344 err = PTR_ERR(wdev); 10345 if (err != -EINVAL) 10346 return err; 10347 wdev = NULL; 10348 } else if (wdev->wiphy != &rdev->wiphy) { 10349 return -EINVAL; 10350 } 10351 10352 if (!info->attrs[NL80211_ATTR_TESTDATA]) 10353 return -EINVAL; 10354 10355 rdev->cur_cmd_info = info; 10356 err = rdev_testmode_cmd(rdev, wdev, 10357 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 10358 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 10359 rdev->cur_cmd_info = NULL; 10360 10361 return err; 10362 } 10363 10364 static int nl80211_testmode_dump(struct sk_buff *skb, 10365 struct netlink_callback *cb) 10366 { 10367 struct cfg80211_registered_device *rdev; 10368 struct nlattr **attrbuf = NULL; 10369 int err; 10370 long phy_idx; 10371 void *data = NULL; 10372 int data_len = 0; 10373 10374 rtnl_lock(); 10375 10376 if (cb->args[0]) { 10377 /* 10378 * 0 is a valid index, but not valid for args[0], 10379 * so we need to offset by 1. 10380 */ 10381 phy_idx = cb->args[0] - 1; 10382 10383 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 10384 if (!rdev) { 10385 err = -ENOENT; 10386 goto out_err; 10387 } 10388 } else { 10389 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 10390 GFP_KERNEL); 10391 if (!attrbuf) { 10392 err = -ENOMEM; 10393 goto out_err; 10394 } 10395 10396 err = nlmsg_parse_deprecated(cb->nlh, 10397 GENL_HDRLEN + nl80211_fam.hdrsize, 10398 attrbuf, nl80211_fam.maxattr, 10399 nl80211_policy, NULL); 10400 if (err) 10401 goto out_err; 10402 10403 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 10404 if (IS_ERR(rdev)) { 10405 err = PTR_ERR(rdev); 10406 goto out_err; 10407 } 10408 phy_idx = rdev->wiphy_idx; 10409 10410 if (attrbuf[NL80211_ATTR_TESTDATA]) 10411 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 10412 } 10413 10414 if (cb->args[1]) { 10415 data = nla_data((void *)cb->args[1]); 10416 data_len = nla_len((void *)cb->args[1]); 10417 } 10418 10419 if (!rdev->ops->testmode_dump) { 10420 err = -EOPNOTSUPP; 10421 goto out_err; 10422 } 10423 10424 while (1) { 10425 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 10426 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10427 NL80211_CMD_TESTMODE); 10428 struct nlattr *tmdata; 10429 10430 if (!hdr) 10431 break; 10432 10433 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 10434 genlmsg_cancel(skb, hdr); 10435 break; 10436 } 10437 10438 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 10439 if (!tmdata) { 10440 genlmsg_cancel(skb, hdr); 10441 break; 10442 } 10443 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 10444 nla_nest_end(skb, tmdata); 10445 10446 if (err == -ENOBUFS || err == -ENOENT) { 10447 genlmsg_cancel(skb, hdr); 10448 break; 10449 } else if (err) { 10450 genlmsg_cancel(skb, hdr); 10451 goto out_err; 10452 } 10453 10454 genlmsg_end(skb, hdr); 10455 } 10456 10457 err = skb->len; 10458 /* see above */ 10459 cb->args[0] = phy_idx + 1; 10460 out_err: 10461 kfree(attrbuf); 10462 rtnl_unlock(); 10463 return err; 10464 } 10465 #endif 10466 10467 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 10468 { 10469 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10470 struct net_device *dev = info->user_ptr[1]; 10471 struct cfg80211_connect_params connect; 10472 struct wiphy *wiphy; 10473 struct cfg80211_cached_keys *connkeys = NULL; 10474 u32 freq = 0; 10475 int err; 10476 10477 memset(&connect, 0, sizeof(connect)); 10478 10479 if (!info->attrs[NL80211_ATTR_SSID] || 10480 !nla_len(info->attrs[NL80211_ATTR_SSID])) 10481 return -EINVAL; 10482 10483 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10484 connect.auth_type = 10485 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10486 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 10487 NL80211_CMD_CONNECT)) 10488 return -EINVAL; 10489 } else 10490 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 10491 10492 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 10493 10494 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 10495 !wiphy_ext_feature_isset(&rdev->wiphy, 10496 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 10497 return -EINVAL; 10498 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 10499 10500 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 10501 NL80211_MAX_NR_CIPHER_SUITES); 10502 if (err) 10503 return err; 10504 10505 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10506 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10507 return -EOPNOTSUPP; 10508 10509 wiphy = &rdev->wiphy; 10510 10511 connect.bg_scan_period = -1; 10512 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 10513 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 10514 connect.bg_scan_period = 10515 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 10516 } 10517 10518 if (info->attrs[NL80211_ATTR_MAC]) 10519 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10520 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 10521 connect.bssid_hint = 10522 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 10523 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10524 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10525 10526 if (info->attrs[NL80211_ATTR_IE]) { 10527 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10528 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10529 } 10530 10531 if (info->attrs[NL80211_ATTR_USE_MFP]) { 10532 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 10533 if (connect.mfp == NL80211_MFP_OPTIONAL && 10534 !wiphy_ext_feature_isset(&rdev->wiphy, 10535 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 10536 return -EOPNOTSUPP; 10537 } else { 10538 connect.mfp = NL80211_MFP_NO; 10539 } 10540 10541 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 10542 connect.prev_bssid = 10543 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 10544 10545 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10546 freq = MHZ_TO_KHZ(nla_get_u32( 10547 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10548 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10549 freq += 10550 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10551 10552 if (freq) { 10553 connect.channel = nl80211_get_valid_chan(wiphy, freq); 10554 if (!connect.channel) 10555 return -EINVAL; 10556 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 10557 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 10558 freq = MHZ_TO_KHZ(freq); 10559 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 10560 if (!connect.channel_hint) 10561 return -EINVAL; 10562 } 10563 10564 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 10565 connect.edmg.channels = 10566 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 10567 10568 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 10569 connect.edmg.bw_config = 10570 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 10571 } 10572 10573 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 10574 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 10575 if (IS_ERR(connkeys)) 10576 return PTR_ERR(connkeys); 10577 } 10578 10579 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 10580 connect.flags |= ASSOC_REQ_DISABLE_HT; 10581 10582 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 10583 memcpy(&connect.ht_capa_mask, 10584 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 10585 sizeof(connect.ht_capa_mask)); 10586 10587 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 10588 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 10589 kfree_sensitive(connkeys); 10590 return -EINVAL; 10591 } 10592 memcpy(&connect.ht_capa, 10593 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 10594 sizeof(connect.ht_capa)); 10595 } 10596 10597 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 10598 connect.flags |= ASSOC_REQ_DISABLE_VHT; 10599 10600 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 10601 memcpy(&connect.vht_capa_mask, 10602 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 10603 sizeof(connect.vht_capa_mask)); 10604 10605 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 10606 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 10607 kfree_sensitive(connkeys); 10608 return -EINVAL; 10609 } 10610 memcpy(&connect.vht_capa, 10611 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 10612 sizeof(connect.vht_capa)); 10613 } 10614 10615 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 10616 if (!((rdev->wiphy.features & 10617 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 10618 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 10619 !wiphy_ext_feature_isset(&rdev->wiphy, 10620 NL80211_EXT_FEATURE_RRM)) { 10621 kfree_sensitive(connkeys); 10622 return -EINVAL; 10623 } 10624 connect.flags |= ASSOC_REQ_USE_RRM; 10625 } 10626 10627 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 10628 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 10629 kfree_sensitive(connkeys); 10630 return -EOPNOTSUPP; 10631 } 10632 10633 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 10634 /* bss selection makes no sense if bssid is set */ 10635 if (connect.bssid) { 10636 kfree_sensitive(connkeys); 10637 return -EINVAL; 10638 } 10639 10640 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 10641 wiphy, &connect.bss_select); 10642 if (err) { 10643 kfree_sensitive(connkeys); 10644 return err; 10645 } 10646 } 10647 10648 if (wiphy_ext_feature_isset(&rdev->wiphy, 10649 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 10650 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10651 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10652 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10653 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10654 connect.fils_erp_username = 10655 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10656 connect.fils_erp_username_len = 10657 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10658 connect.fils_erp_realm = 10659 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10660 connect.fils_erp_realm_len = 10661 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10662 connect.fils_erp_next_seq_num = 10663 nla_get_u16( 10664 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10665 connect.fils_erp_rrk = 10666 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10667 connect.fils_erp_rrk_len = 10668 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10669 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10670 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10671 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10672 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10673 kfree_sensitive(connkeys); 10674 return -EINVAL; 10675 } 10676 10677 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 10678 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10679 kfree_sensitive(connkeys); 10680 GENL_SET_ERR_MSG(info, 10681 "external auth requires connection ownership"); 10682 return -EINVAL; 10683 } 10684 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 10685 } 10686 10687 wdev_lock(dev->ieee80211_ptr); 10688 10689 err = cfg80211_connect(rdev, dev, &connect, connkeys, 10690 connect.prev_bssid); 10691 if (err) 10692 kfree_sensitive(connkeys); 10693 10694 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10695 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10696 if (connect.bssid) 10697 memcpy(dev->ieee80211_ptr->disconnect_bssid, 10698 connect.bssid, ETH_ALEN); 10699 else 10700 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 10701 } 10702 10703 wdev_unlock(dev->ieee80211_ptr); 10704 10705 return err; 10706 } 10707 10708 static int nl80211_update_connect_params(struct sk_buff *skb, 10709 struct genl_info *info) 10710 { 10711 struct cfg80211_connect_params connect = {}; 10712 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10713 struct net_device *dev = info->user_ptr[1]; 10714 struct wireless_dev *wdev = dev->ieee80211_ptr; 10715 bool fils_sk_offload; 10716 u32 auth_type; 10717 u32 changed = 0; 10718 int ret; 10719 10720 if (!rdev->ops->update_connect_params) 10721 return -EOPNOTSUPP; 10722 10723 if (info->attrs[NL80211_ATTR_IE]) { 10724 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10725 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10726 changed |= UPDATE_ASSOC_IES; 10727 } 10728 10729 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 10730 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 10731 10732 /* 10733 * when driver supports fils-sk offload all attributes must be 10734 * provided. So the else covers "fils-sk-not-all" and 10735 * "no-fils-sk-any". 10736 */ 10737 if (fils_sk_offload && 10738 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 10739 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 10740 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 10741 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10742 connect.fils_erp_username = 10743 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10744 connect.fils_erp_username_len = 10745 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 10746 connect.fils_erp_realm = 10747 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10748 connect.fils_erp_realm_len = 10749 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 10750 connect.fils_erp_next_seq_num = 10751 nla_get_u16( 10752 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 10753 connect.fils_erp_rrk = 10754 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10755 connect.fils_erp_rrk_len = 10756 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 10757 changed |= UPDATE_FILS_ERP_INFO; 10758 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 10759 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 10760 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 10761 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 10762 return -EINVAL; 10763 } 10764 10765 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 10766 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10767 if (!nl80211_valid_auth_type(rdev, auth_type, 10768 NL80211_CMD_CONNECT)) 10769 return -EINVAL; 10770 10771 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 10772 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 10773 return -EINVAL; 10774 10775 connect.auth_type = auth_type; 10776 changed |= UPDATE_AUTH_TYPE; 10777 } 10778 10779 wdev_lock(dev->ieee80211_ptr); 10780 if (!wdev->current_bss) 10781 ret = -ENOLINK; 10782 else 10783 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 10784 wdev_unlock(dev->ieee80211_ptr); 10785 10786 return ret; 10787 } 10788 10789 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 10790 { 10791 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10792 struct net_device *dev = info->user_ptr[1]; 10793 u16 reason; 10794 int ret; 10795 10796 if (dev->ieee80211_ptr->conn_owner_nlportid && 10797 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10798 return -EPERM; 10799 10800 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 10801 reason = WLAN_REASON_DEAUTH_LEAVING; 10802 else 10803 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 10804 10805 if (reason == 0) 10806 return -EINVAL; 10807 10808 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10809 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10810 return -EOPNOTSUPP; 10811 10812 wdev_lock(dev->ieee80211_ptr); 10813 ret = cfg80211_disconnect(rdev, dev, reason, true); 10814 wdev_unlock(dev->ieee80211_ptr); 10815 return ret; 10816 } 10817 10818 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 10819 { 10820 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10821 struct net *net; 10822 int err; 10823 10824 if (info->attrs[NL80211_ATTR_PID]) { 10825 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 10826 10827 net = get_net_ns_by_pid(pid); 10828 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 10829 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 10830 10831 net = get_net_ns_by_fd(fd); 10832 } else { 10833 return -EINVAL; 10834 } 10835 10836 if (IS_ERR(net)) 10837 return PTR_ERR(net); 10838 10839 err = 0; 10840 10841 /* check if anything to do */ 10842 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 10843 err = cfg80211_switch_netns(rdev, net); 10844 10845 put_net(net); 10846 return err; 10847 } 10848 10849 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 10850 { 10851 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10852 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 10853 struct cfg80211_pmksa *pmksa) = NULL; 10854 struct net_device *dev = info->user_ptr[1]; 10855 struct cfg80211_pmksa pmksa; 10856 10857 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 10858 10859 if (!info->attrs[NL80211_ATTR_PMKID]) 10860 return -EINVAL; 10861 10862 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 10863 10864 if (info->attrs[NL80211_ATTR_MAC]) { 10865 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10866 } else if (info->attrs[NL80211_ATTR_SSID] && 10867 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 10868 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 10869 info->attrs[NL80211_ATTR_PMK])) { 10870 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10871 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10872 pmksa.cache_id = 10873 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 10874 } else { 10875 return -EINVAL; 10876 } 10877 if (info->attrs[NL80211_ATTR_PMK]) { 10878 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10879 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 10880 } 10881 10882 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 10883 pmksa.pmk_lifetime = 10884 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 10885 10886 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 10887 pmksa.pmk_reauth_threshold = 10888 nla_get_u8( 10889 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 10890 10891 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10892 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 10893 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP && 10894 wiphy_ext_feature_isset(&rdev->wiphy, 10895 NL80211_EXT_FEATURE_AP_PMKSA_CACHING))) 10896 return -EOPNOTSUPP; 10897 10898 switch (info->genlhdr->cmd) { 10899 case NL80211_CMD_SET_PMKSA: 10900 rdev_ops = rdev->ops->set_pmksa; 10901 break; 10902 case NL80211_CMD_DEL_PMKSA: 10903 rdev_ops = rdev->ops->del_pmksa; 10904 break; 10905 default: 10906 WARN_ON(1); 10907 break; 10908 } 10909 10910 if (!rdev_ops) 10911 return -EOPNOTSUPP; 10912 10913 return rdev_ops(&rdev->wiphy, dev, &pmksa); 10914 } 10915 10916 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 10917 { 10918 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10919 struct net_device *dev = info->user_ptr[1]; 10920 10921 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10922 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10923 return -EOPNOTSUPP; 10924 10925 if (!rdev->ops->flush_pmksa) 10926 return -EOPNOTSUPP; 10927 10928 return rdev_flush_pmksa(rdev, dev); 10929 } 10930 10931 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 10932 { 10933 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10934 struct net_device *dev = info->user_ptr[1]; 10935 u8 action_code, dialog_token; 10936 u32 peer_capability = 0; 10937 u16 status_code; 10938 u8 *peer; 10939 bool initiator; 10940 10941 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10942 !rdev->ops->tdls_mgmt) 10943 return -EOPNOTSUPP; 10944 10945 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 10946 !info->attrs[NL80211_ATTR_STATUS_CODE] || 10947 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 10948 !info->attrs[NL80211_ATTR_IE] || 10949 !info->attrs[NL80211_ATTR_MAC]) 10950 return -EINVAL; 10951 10952 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10953 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 10954 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 10955 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 10956 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 10957 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 10958 peer_capability = 10959 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 10960 10961 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 10962 dialog_token, status_code, peer_capability, 10963 initiator, 10964 nla_data(info->attrs[NL80211_ATTR_IE]), 10965 nla_len(info->attrs[NL80211_ATTR_IE])); 10966 } 10967 10968 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 10969 { 10970 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10971 struct net_device *dev = info->user_ptr[1]; 10972 enum nl80211_tdls_operation operation; 10973 u8 *peer; 10974 10975 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 10976 !rdev->ops->tdls_oper) 10977 return -EOPNOTSUPP; 10978 10979 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 10980 !info->attrs[NL80211_ATTR_MAC]) 10981 return -EINVAL; 10982 10983 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 10984 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 10985 10986 return rdev_tdls_oper(rdev, dev, peer, operation); 10987 } 10988 10989 static int nl80211_remain_on_channel(struct sk_buff *skb, 10990 struct genl_info *info) 10991 { 10992 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10993 struct wireless_dev *wdev = info->user_ptr[1]; 10994 struct cfg80211_chan_def chandef; 10995 const struct cfg80211_chan_def *compat_chandef; 10996 struct sk_buff *msg; 10997 void *hdr; 10998 u64 cookie; 10999 u32 duration; 11000 int err; 11001 11002 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 11003 !info->attrs[NL80211_ATTR_DURATION]) 11004 return -EINVAL; 11005 11006 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11007 11008 if (!rdev->ops->remain_on_channel || 11009 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 11010 return -EOPNOTSUPP; 11011 11012 /* 11013 * We should be on that channel for at least a minimum amount of 11014 * time (10ms) but no longer than the driver supports. 11015 */ 11016 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11017 duration > rdev->wiphy.max_remain_on_channel_duration) 11018 return -EINVAL; 11019 11020 err = nl80211_parse_chandef(rdev, info, &chandef); 11021 if (err) 11022 return err; 11023 11024 wdev_lock(wdev); 11025 if (!cfg80211_off_channel_oper_allowed(wdev) && 11026 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 11027 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 11028 &chandef); 11029 if (compat_chandef != &chandef) { 11030 wdev_unlock(wdev); 11031 return -EBUSY; 11032 } 11033 } 11034 wdev_unlock(wdev); 11035 11036 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11037 if (!msg) 11038 return -ENOMEM; 11039 11040 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11041 NL80211_CMD_REMAIN_ON_CHANNEL); 11042 if (!hdr) { 11043 err = -ENOBUFS; 11044 goto free_msg; 11045 } 11046 11047 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 11048 duration, &cookie); 11049 11050 if (err) 11051 goto free_msg; 11052 11053 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11054 NL80211_ATTR_PAD)) 11055 goto nla_put_failure; 11056 11057 genlmsg_end(msg, hdr); 11058 11059 return genlmsg_reply(msg, info); 11060 11061 nla_put_failure: 11062 err = -ENOBUFS; 11063 free_msg: 11064 nlmsg_free(msg); 11065 return err; 11066 } 11067 11068 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 11069 struct genl_info *info) 11070 { 11071 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11072 struct wireless_dev *wdev = info->user_ptr[1]; 11073 u64 cookie; 11074 11075 if (!info->attrs[NL80211_ATTR_COOKIE]) 11076 return -EINVAL; 11077 11078 if (!rdev->ops->cancel_remain_on_channel) 11079 return -EOPNOTSUPP; 11080 11081 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11082 11083 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 11084 } 11085 11086 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 11087 struct genl_info *info) 11088 { 11089 struct cfg80211_bitrate_mask mask; 11090 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11091 struct net_device *dev = info->user_ptr[1]; 11092 int err; 11093 11094 if (!rdev->ops->set_bitrate_mask) 11095 return -EOPNOTSUPP; 11096 11097 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11098 NL80211_ATTR_TX_RATES, &mask, 11099 dev); 11100 if (err) 11101 return err; 11102 11103 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 11104 } 11105 11106 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 11107 { 11108 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11109 struct wireless_dev *wdev = info->user_ptr[1]; 11110 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 11111 11112 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 11113 return -EINVAL; 11114 11115 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 11116 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 11117 11118 switch (wdev->iftype) { 11119 case NL80211_IFTYPE_STATION: 11120 case NL80211_IFTYPE_ADHOC: 11121 case NL80211_IFTYPE_P2P_CLIENT: 11122 case NL80211_IFTYPE_AP: 11123 case NL80211_IFTYPE_AP_VLAN: 11124 case NL80211_IFTYPE_MESH_POINT: 11125 case NL80211_IFTYPE_P2P_GO: 11126 case NL80211_IFTYPE_P2P_DEVICE: 11127 break; 11128 case NL80211_IFTYPE_NAN: 11129 default: 11130 return -EOPNOTSUPP; 11131 } 11132 11133 /* not much point in registering if we can't reply */ 11134 if (!rdev->ops->mgmt_tx) 11135 return -EOPNOTSUPP; 11136 11137 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 11138 !wiphy_ext_feature_isset(&rdev->wiphy, 11139 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 11140 GENL_SET_ERR_MSG(info, 11141 "multicast RX registrations are not supported"); 11142 return -EOPNOTSUPP; 11143 } 11144 11145 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 11146 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11147 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 11148 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 11149 info->extack); 11150 } 11151 11152 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 11153 { 11154 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11155 struct wireless_dev *wdev = info->user_ptr[1]; 11156 struct cfg80211_chan_def chandef; 11157 int err; 11158 void *hdr = NULL; 11159 u64 cookie; 11160 struct sk_buff *msg = NULL; 11161 struct cfg80211_mgmt_tx_params params = { 11162 .dont_wait_for_ack = 11163 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 11164 }; 11165 11166 if (!info->attrs[NL80211_ATTR_FRAME]) 11167 return -EINVAL; 11168 11169 if (!rdev->ops->mgmt_tx) 11170 return -EOPNOTSUPP; 11171 11172 switch (wdev->iftype) { 11173 case NL80211_IFTYPE_P2P_DEVICE: 11174 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11175 return -EINVAL; 11176 case NL80211_IFTYPE_STATION: 11177 case NL80211_IFTYPE_ADHOC: 11178 case NL80211_IFTYPE_P2P_CLIENT: 11179 case NL80211_IFTYPE_AP: 11180 case NL80211_IFTYPE_AP_VLAN: 11181 case NL80211_IFTYPE_MESH_POINT: 11182 case NL80211_IFTYPE_P2P_GO: 11183 break; 11184 case NL80211_IFTYPE_NAN: 11185 default: 11186 return -EOPNOTSUPP; 11187 } 11188 11189 if (info->attrs[NL80211_ATTR_DURATION]) { 11190 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11191 return -EINVAL; 11192 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 11193 11194 /* 11195 * We should wait on the channel for at least a minimum amount 11196 * of time (10ms) but no longer than the driver supports. 11197 */ 11198 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 11199 params.wait > rdev->wiphy.max_remain_on_channel_duration) 11200 return -EINVAL; 11201 } 11202 11203 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 11204 11205 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 11206 return -EINVAL; 11207 11208 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 11209 11210 /* get the channel if any has been specified, otherwise pass NULL to 11211 * the driver. The latter will use the current one 11212 */ 11213 chandef.chan = NULL; 11214 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11215 err = nl80211_parse_chandef(rdev, info, &chandef); 11216 if (err) 11217 return err; 11218 } 11219 11220 if (!chandef.chan && params.offchan) 11221 return -EINVAL; 11222 11223 wdev_lock(wdev); 11224 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 11225 wdev_unlock(wdev); 11226 return -EBUSY; 11227 } 11228 wdev_unlock(wdev); 11229 11230 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 11231 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 11232 11233 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 11234 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11235 int i; 11236 11237 if (len % sizeof(u16)) 11238 return -EINVAL; 11239 11240 params.n_csa_offsets = len / sizeof(u16); 11241 params.csa_offsets = 11242 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 11243 11244 /* check that all the offsets fit the frame */ 11245 for (i = 0; i < params.n_csa_offsets; i++) { 11246 if (params.csa_offsets[i] >= params.len) 11247 return -EINVAL; 11248 } 11249 } 11250 11251 if (!params.dont_wait_for_ack) { 11252 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11253 if (!msg) 11254 return -ENOMEM; 11255 11256 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11257 NL80211_CMD_FRAME); 11258 if (!hdr) { 11259 err = -ENOBUFS; 11260 goto free_msg; 11261 } 11262 } 11263 11264 params.chan = chandef.chan; 11265 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 11266 if (err) 11267 goto free_msg; 11268 11269 if (msg) { 11270 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11271 NL80211_ATTR_PAD)) 11272 goto nla_put_failure; 11273 11274 genlmsg_end(msg, hdr); 11275 return genlmsg_reply(msg, info); 11276 } 11277 11278 return 0; 11279 11280 nla_put_failure: 11281 err = -ENOBUFS; 11282 free_msg: 11283 nlmsg_free(msg); 11284 return err; 11285 } 11286 11287 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 11288 { 11289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11290 struct wireless_dev *wdev = info->user_ptr[1]; 11291 u64 cookie; 11292 11293 if (!info->attrs[NL80211_ATTR_COOKIE]) 11294 return -EINVAL; 11295 11296 if (!rdev->ops->mgmt_tx_cancel_wait) 11297 return -EOPNOTSUPP; 11298 11299 switch (wdev->iftype) { 11300 case NL80211_IFTYPE_STATION: 11301 case NL80211_IFTYPE_ADHOC: 11302 case NL80211_IFTYPE_P2P_CLIENT: 11303 case NL80211_IFTYPE_AP: 11304 case NL80211_IFTYPE_AP_VLAN: 11305 case NL80211_IFTYPE_P2P_GO: 11306 case NL80211_IFTYPE_P2P_DEVICE: 11307 break; 11308 case NL80211_IFTYPE_NAN: 11309 default: 11310 return -EOPNOTSUPP; 11311 } 11312 11313 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11314 11315 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 11316 } 11317 11318 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 11319 { 11320 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11321 struct wireless_dev *wdev; 11322 struct net_device *dev = info->user_ptr[1]; 11323 u8 ps_state; 11324 bool state; 11325 int err; 11326 11327 if (!info->attrs[NL80211_ATTR_PS_STATE]) 11328 return -EINVAL; 11329 11330 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 11331 11332 wdev = dev->ieee80211_ptr; 11333 11334 if (!rdev->ops->set_power_mgmt) 11335 return -EOPNOTSUPP; 11336 11337 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 11338 11339 if (state == wdev->ps) 11340 return 0; 11341 11342 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 11343 if (!err) 11344 wdev->ps = state; 11345 return err; 11346 } 11347 11348 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 11349 { 11350 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11351 enum nl80211_ps_state ps_state; 11352 struct wireless_dev *wdev; 11353 struct net_device *dev = info->user_ptr[1]; 11354 struct sk_buff *msg; 11355 void *hdr; 11356 int err; 11357 11358 wdev = dev->ieee80211_ptr; 11359 11360 if (!rdev->ops->set_power_mgmt) 11361 return -EOPNOTSUPP; 11362 11363 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11364 if (!msg) 11365 return -ENOMEM; 11366 11367 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11368 NL80211_CMD_GET_POWER_SAVE); 11369 if (!hdr) { 11370 err = -ENOBUFS; 11371 goto free_msg; 11372 } 11373 11374 if (wdev->ps) 11375 ps_state = NL80211_PS_ENABLED; 11376 else 11377 ps_state = NL80211_PS_DISABLED; 11378 11379 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 11380 goto nla_put_failure; 11381 11382 genlmsg_end(msg, hdr); 11383 return genlmsg_reply(msg, info); 11384 11385 nla_put_failure: 11386 err = -ENOBUFS; 11387 free_msg: 11388 nlmsg_free(msg); 11389 return err; 11390 } 11391 11392 static const struct nla_policy 11393 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 11394 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 11395 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 11396 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 11397 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 11398 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 11399 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 11400 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 11401 }; 11402 11403 static int nl80211_set_cqm_txe(struct genl_info *info, 11404 u32 rate, u32 pkts, u32 intvl) 11405 { 11406 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11407 struct net_device *dev = info->user_ptr[1]; 11408 struct wireless_dev *wdev = dev->ieee80211_ptr; 11409 11410 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 11411 return -EINVAL; 11412 11413 if (!rdev->ops->set_cqm_txe_config) 11414 return -EOPNOTSUPP; 11415 11416 if (wdev->iftype != NL80211_IFTYPE_STATION && 11417 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11418 return -EOPNOTSUPP; 11419 11420 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 11421 } 11422 11423 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 11424 struct net_device *dev) 11425 { 11426 struct wireless_dev *wdev = dev->ieee80211_ptr; 11427 s32 last, low, high; 11428 u32 hyst; 11429 int i, n, low_index; 11430 int err; 11431 11432 /* RSSI reporting disabled? */ 11433 if (!wdev->cqm_config) 11434 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 11435 11436 /* 11437 * Obtain current RSSI value if possible, if not and no RSSI threshold 11438 * event has been received yet, we should receive an event after a 11439 * connection is established and enough beacons received to calculate 11440 * the average. 11441 */ 11442 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 11443 rdev->ops->get_station) { 11444 struct station_info sinfo = {}; 11445 u8 *mac_addr; 11446 11447 mac_addr = wdev->current_bss->pub.bssid; 11448 11449 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 11450 if (err) 11451 return err; 11452 11453 cfg80211_sinfo_release_content(&sinfo); 11454 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 11455 wdev->cqm_config->last_rssi_event_value = 11456 (s8) sinfo.rx_beacon_signal_avg; 11457 } 11458 11459 last = wdev->cqm_config->last_rssi_event_value; 11460 hyst = wdev->cqm_config->rssi_hyst; 11461 n = wdev->cqm_config->n_rssi_thresholds; 11462 11463 for (i = 0; i < n; i++) { 11464 i = array_index_nospec(i, n); 11465 if (last < wdev->cqm_config->rssi_thresholds[i]) 11466 break; 11467 } 11468 11469 low_index = i - 1; 11470 if (low_index >= 0) { 11471 low_index = array_index_nospec(low_index, n); 11472 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 11473 } else { 11474 low = S32_MIN; 11475 } 11476 if (i < n) { 11477 i = array_index_nospec(i, n); 11478 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 11479 } else { 11480 high = S32_MAX; 11481 } 11482 11483 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 11484 } 11485 11486 static int nl80211_set_cqm_rssi(struct genl_info *info, 11487 const s32 *thresholds, int n_thresholds, 11488 u32 hysteresis) 11489 { 11490 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11491 struct net_device *dev = info->user_ptr[1]; 11492 struct wireless_dev *wdev = dev->ieee80211_ptr; 11493 int i, err; 11494 s32 prev = S32_MIN; 11495 11496 /* Check all values negative and sorted */ 11497 for (i = 0; i < n_thresholds; i++) { 11498 if (thresholds[i] > 0 || thresholds[i] <= prev) 11499 return -EINVAL; 11500 11501 prev = thresholds[i]; 11502 } 11503 11504 if (wdev->iftype != NL80211_IFTYPE_STATION && 11505 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 11506 return -EOPNOTSUPP; 11507 11508 wdev_lock(wdev); 11509 cfg80211_cqm_config_free(wdev); 11510 wdev_unlock(wdev); 11511 11512 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 11513 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 11514 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 11515 11516 return rdev_set_cqm_rssi_config(rdev, dev, 11517 thresholds[0], hysteresis); 11518 } 11519 11520 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11521 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 11522 return -EOPNOTSUPP; 11523 11524 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 11525 n_thresholds = 0; 11526 11527 wdev_lock(wdev); 11528 if (n_thresholds) { 11529 struct cfg80211_cqm_config *cqm_config; 11530 11531 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 11532 n_thresholds * sizeof(s32), GFP_KERNEL); 11533 if (!cqm_config) { 11534 err = -ENOMEM; 11535 goto unlock; 11536 } 11537 11538 cqm_config->rssi_hyst = hysteresis; 11539 cqm_config->n_rssi_thresholds = n_thresholds; 11540 memcpy(cqm_config->rssi_thresholds, thresholds, 11541 n_thresholds * sizeof(s32)); 11542 11543 wdev->cqm_config = cqm_config; 11544 } 11545 11546 err = cfg80211_cqm_rssi_update(rdev, dev); 11547 11548 unlock: 11549 wdev_unlock(wdev); 11550 11551 return err; 11552 } 11553 11554 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 11555 { 11556 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 11557 struct nlattr *cqm; 11558 int err; 11559 11560 cqm = info->attrs[NL80211_ATTR_CQM]; 11561 if (!cqm) 11562 return -EINVAL; 11563 11564 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 11565 nl80211_attr_cqm_policy, 11566 info->extack); 11567 if (err) 11568 return err; 11569 11570 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 11571 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 11572 const s32 *thresholds = 11573 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11574 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 11575 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 11576 11577 if (len % 4) 11578 return -EINVAL; 11579 11580 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 11581 hysteresis); 11582 } 11583 11584 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 11585 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 11586 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 11587 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 11588 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 11589 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 11590 11591 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 11592 } 11593 11594 return -EINVAL; 11595 } 11596 11597 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 11598 { 11599 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11600 struct net_device *dev = info->user_ptr[1]; 11601 struct ocb_setup setup = {}; 11602 int err; 11603 11604 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11605 if (err) 11606 return err; 11607 11608 return cfg80211_join_ocb(rdev, dev, &setup); 11609 } 11610 11611 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 11612 { 11613 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11614 struct net_device *dev = info->user_ptr[1]; 11615 11616 return cfg80211_leave_ocb(rdev, dev); 11617 } 11618 11619 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 11620 { 11621 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11622 struct net_device *dev = info->user_ptr[1]; 11623 struct mesh_config cfg; 11624 struct mesh_setup setup; 11625 int err; 11626 11627 /* start with default */ 11628 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 11629 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 11630 11631 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 11632 /* and parse parameters if given */ 11633 err = nl80211_parse_mesh_config(info, &cfg, NULL); 11634 if (err) 11635 return err; 11636 } 11637 11638 if (!info->attrs[NL80211_ATTR_MESH_ID] || 11639 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 11640 return -EINVAL; 11641 11642 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 11643 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 11644 11645 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11646 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 11647 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11648 return -EINVAL; 11649 11650 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 11651 setup.beacon_interval = 11652 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11653 11654 err = cfg80211_validate_beacon_int(rdev, 11655 NL80211_IFTYPE_MESH_POINT, 11656 setup.beacon_interval); 11657 if (err) 11658 return err; 11659 } 11660 11661 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 11662 setup.dtim_period = 11663 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 11664 if (setup.dtim_period < 1 || setup.dtim_period > 100) 11665 return -EINVAL; 11666 } 11667 11668 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 11669 /* parse additional setup parameters if given */ 11670 err = nl80211_parse_mesh_setup(info, &setup); 11671 if (err) 11672 return err; 11673 } 11674 11675 if (setup.user_mpm) 11676 cfg.auto_open_plinks = false; 11677 11678 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 11679 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 11680 if (err) 11681 return err; 11682 } else { 11683 /* __cfg80211_join_mesh() will sort it out */ 11684 setup.chandef.chan = NULL; 11685 } 11686 11687 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11688 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11689 int n_rates = 11690 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11691 struct ieee80211_supported_band *sband; 11692 11693 if (!setup.chandef.chan) 11694 return -EINVAL; 11695 11696 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 11697 11698 err = ieee80211_get_ratemask(sband, rates, n_rates, 11699 &setup.basic_rates); 11700 if (err) 11701 return err; 11702 } 11703 11704 if (info->attrs[NL80211_ATTR_TX_RATES]) { 11705 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 11706 NL80211_ATTR_TX_RATES, 11707 &setup.beacon_rate, 11708 dev); 11709 if (err) 11710 return err; 11711 11712 if (!setup.chandef.chan) 11713 return -EINVAL; 11714 11715 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 11716 &setup.beacon_rate); 11717 if (err) 11718 return err; 11719 } 11720 11721 setup.userspace_handles_dfs = 11722 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11723 11724 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11725 int r = validate_pae_over_nl80211(rdev, info); 11726 11727 if (r < 0) 11728 return r; 11729 11730 setup.control_port_over_nl80211 = true; 11731 } 11732 11733 wdev_lock(dev->ieee80211_ptr); 11734 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 11735 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11736 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11737 wdev_unlock(dev->ieee80211_ptr); 11738 11739 return err; 11740 } 11741 11742 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 11743 { 11744 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11745 struct net_device *dev = info->user_ptr[1]; 11746 11747 return cfg80211_leave_mesh(rdev, dev); 11748 } 11749 11750 #ifdef CONFIG_PM 11751 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 11752 struct cfg80211_registered_device *rdev) 11753 { 11754 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 11755 struct nlattr *nl_pats, *nl_pat; 11756 int i, pat_len; 11757 11758 if (!wowlan->n_patterns) 11759 return 0; 11760 11761 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 11762 if (!nl_pats) 11763 return -ENOBUFS; 11764 11765 for (i = 0; i < wowlan->n_patterns; i++) { 11766 nl_pat = nla_nest_start_noflag(msg, i + 1); 11767 if (!nl_pat) 11768 return -ENOBUFS; 11769 pat_len = wowlan->patterns[i].pattern_len; 11770 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 11771 wowlan->patterns[i].mask) || 11772 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 11773 wowlan->patterns[i].pattern) || 11774 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 11775 wowlan->patterns[i].pkt_offset)) 11776 return -ENOBUFS; 11777 nla_nest_end(msg, nl_pat); 11778 } 11779 nla_nest_end(msg, nl_pats); 11780 11781 return 0; 11782 } 11783 11784 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 11785 struct cfg80211_wowlan_tcp *tcp) 11786 { 11787 struct nlattr *nl_tcp; 11788 11789 if (!tcp) 11790 return 0; 11791 11792 nl_tcp = nla_nest_start_noflag(msg, 11793 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 11794 if (!nl_tcp) 11795 return -ENOBUFS; 11796 11797 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 11798 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 11799 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 11800 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 11801 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 11802 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 11803 tcp->payload_len, tcp->payload) || 11804 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 11805 tcp->data_interval) || 11806 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 11807 tcp->wake_len, tcp->wake_data) || 11808 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 11809 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 11810 return -ENOBUFS; 11811 11812 if (tcp->payload_seq.len && 11813 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 11814 sizeof(tcp->payload_seq), &tcp->payload_seq)) 11815 return -ENOBUFS; 11816 11817 if (tcp->payload_tok.len && 11818 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 11819 sizeof(tcp->payload_tok) + tcp->tokens_size, 11820 &tcp->payload_tok)) 11821 return -ENOBUFS; 11822 11823 nla_nest_end(msg, nl_tcp); 11824 11825 return 0; 11826 } 11827 11828 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 11829 struct cfg80211_sched_scan_request *req) 11830 { 11831 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 11832 int i; 11833 11834 if (!req) 11835 return 0; 11836 11837 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 11838 if (!nd) 11839 return -ENOBUFS; 11840 11841 if (req->n_scan_plans == 1 && 11842 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 11843 req->scan_plans[0].interval * 1000)) 11844 return -ENOBUFS; 11845 11846 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 11847 return -ENOBUFS; 11848 11849 if (req->relative_rssi_set) { 11850 struct nl80211_bss_select_rssi_adjust rssi_adjust; 11851 11852 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 11853 req->relative_rssi)) 11854 return -ENOBUFS; 11855 11856 rssi_adjust.band = req->rssi_adjust.band; 11857 rssi_adjust.delta = req->rssi_adjust.delta; 11858 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 11859 sizeof(rssi_adjust), &rssi_adjust)) 11860 return -ENOBUFS; 11861 } 11862 11863 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 11864 if (!freqs) 11865 return -ENOBUFS; 11866 11867 for (i = 0; i < req->n_channels; i++) { 11868 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 11869 return -ENOBUFS; 11870 } 11871 11872 nla_nest_end(msg, freqs); 11873 11874 if (req->n_match_sets) { 11875 matches = nla_nest_start_noflag(msg, 11876 NL80211_ATTR_SCHED_SCAN_MATCH); 11877 if (!matches) 11878 return -ENOBUFS; 11879 11880 for (i = 0; i < req->n_match_sets; i++) { 11881 match = nla_nest_start_noflag(msg, i); 11882 if (!match) 11883 return -ENOBUFS; 11884 11885 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 11886 req->match_sets[i].ssid.ssid_len, 11887 req->match_sets[i].ssid.ssid)) 11888 return -ENOBUFS; 11889 nla_nest_end(msg, match); 11890 } 11891 nla_nest_end(msg, matches); 11892 } 11893 11894 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 11895 if (!scan_plans) 11896 return -ENOBUFS; 11897 11898 for (i = 0; i < req->n_scan_plans; i++) { 11899 scan_plan = nla_nest_start_noflag(msg, i + 1); 11900 if (!scan_plan) 11901 return -ENOBUFS; 11902 11903 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 11904 req->scan_plans[i].interval) || 11905 (req->scan_plans[i].iterations && 11906 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 11907 req->scan_plans[i].iterations))) 11908 return -ENOBUFS; 11909 nla_nest_end(msg, scan_plan); 11910 } 11911 nla_nest_end(msg, scan_plans); 11912 11913 nla_nest_end(msg, nd); 11914 11915 return 0; 11916 } 11917 11918 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 11919 { 11920 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11921 struct sk_buff *msg; 11922 void *hdr; 11923 u32 size = NLMSG_DEFAULT_SIZE; 11924 11925 if (!rdev->wiphy.wowlan) 11926 return -EOPNOTSUPP; 11927 11928 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 11929 /* adjust size to have room for all the data */ 11930 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 11931 rdev->wiphy.wowlan_config->tcp->payload_len + 11932 rdev->wiphy.wowlan_config->tcp->wake_len + 11933 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 11934 } 11935 11936 msg = nlmsg_new(size, GFP_KERNEL); 11937 if (!msg) 11938 return -ENOMEM; 11939 11940 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11941 NL80211_CMD_GET_WOWLAN); 11942 if (!hdr) 11943 goto nla_put_failure; 11944 11945 if (rdev->wiphy.wowlan_config) { 11946 struct nlattr *nl_wowlan; 11947 11948 nl_wowlan = nla_nest_start_noflag(msg, 11949 NL80211_ATTR_WOWLAN_TRIGGERS); 11950 if (!nl_wowlan) 11951 goto nla_put_failure; 11952 11953 if ((rdev->wiphy.wowlan_config->any && 11954 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 11955 (rdev->wiphy.wowlan_config->disconnect && 11956 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 11957 (rdev->wiphy.wowlan_config->magic_pkt && 11958 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 11959 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 11960 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 11961 (rdev->wiphy.wowlan_config->eap_identity_req && 11962 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 11963 (rdev->wiphy.wowlan_config->four_way_handshake && 11964 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 11965 (rdev->wiphy.wowlan_config->rfkill_release && 11966 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 11967 goto nla_put_failure; 11968 11969 if (nl80211_send_wowlan_patterns(msg, rdev)) 11970 goto nla_put_failure; 11971 11972 if (nl80211_send_wowlan_tcp(msg, 11973 rdev->wiphy.wowlan_config->tcp)) 11974 goto nla_put_failure; 11975 11976 if (nl80211_send_wowlan_nd( 11977 msg, 11978 rdev->wiphy.wowlan_config->nd_config)) 11979 goto nla_put_failure; 11980 11981 nla_nest_end(msg, nl_wowlan); 11982 } 11983 11984 genlmsg_end(msg, hdr); 11985 return genlmsg_reply(msg, info); 11986 11987 nla_put_failure: 11988 nlmsg_free(msg); 11989 return -ENOBUFS; 11990 } 11991 11992 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 11993 struct nlattr *attr, 11994 struct cfg80211_wowlan *trig) 11995 { 11996 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 11997 struct cfg80211_wowlan_tcp *cfg; 11998 struct nl80211_wowlan_tcp_data_token *tok = NULL; 11999 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 12000 u32 size; 12001 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 12002 int err, port; 12003 12004 if (!rdev->wiphy.wowlan->tcp) 12005 return -EINVAL; 12006 12007 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 12008 nl80211_wowlan_tcp_policy, NULL); 12009 if (err) 12010 return err; 12011 12012 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 12013 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 12014 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 12015 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 12016 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 12017 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 12018 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 12019 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 12020 return -EINVAL; 12021 12022 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 12023 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 12024 return -EINVAL; 12025 12026 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 12027 rdev->wiphy.wowlan->tcp->data_interval_max || 12028 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 12029 return -EINVAL; 12030 12031 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 12032 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 12033 return -EINVAL; 12034 12035 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 12036 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 12037 return -EINVAL; 12038 12039 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 12040 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12041 12042 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 12043 tokens_size = tokln - sizeof(*tok); 12044 12045 if (!tok->len || tokens_size % tok->len) 12046 return -EINVAL; 12047 if (!rdev->wiphy.wowlan->tcp->tok) 12048 return -EINVAL; 12049 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 12050 return -EINVAL; 12051 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 12052 return -EINVAL; 12053 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 12054 return -EINVAL; 12055 if (tok->offset + tok->len > data_size) 12056 return -EINVAL; 12057 } 12058 12059 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 12060 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 12061 if (!rdev->wiphy.wowlan->tcp->seq) 12062 return -EINVAL; 12063 if (seq->len == 0 || seq->len > 4) 12064 return -EINVAL; 12065 if (seq->len + seq->offset > data_size) 12066 return -EINVAL; 12067 } 12068 12069 size = sizeof(*cfg); 12070 size += data_size; 12071 size += wake_size + wake_mask_size; 12072 size += tokens_size; 12073 12074 cfg = kzalloc(size, GFP_KERNEL); 12075 if (!cfg) 12076 return -ENOMEM; 12077 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 12078 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 12079 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 12080 ETH_ALEN); 12081 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 12082 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 12083 else 12084 port = 0; 12085 #ifdef CONFIG_INET 12086 /* allocate a socket and port for it and use it */ 12087 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 12088 IPPROTO_TCP, &cfg->sock, 1); 12089 if (err) { 12090 kfree(cfg); 12091 return err; 12092 } 12093 if (inet_csk_get_port(cfg->sock->sk, port)) { 12094 sock_release(cfg->sock); 12095 kfree(cfg); 12096 return -EADDRINUSE; 12097 } 12098 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 12099 #else 12100 if (!port) { 12101 kfree(cfg); 12102 return -EINVAL; 12103 } 12104 cfg->src_port = port; 12105 #endif 12106 12107 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 12108 cfg->payload_len = data_size; 12109 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 12110 memcpy((void *)cfg->payload, 12111 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 12112 data_size); 12113 if (seq) 12114 cfg->payload_seq = *seq; 12115 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 12116 cfg->wake_len = wake_size; 12117 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 12118 memcpy((void *)cfg->wake_data, 12119 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 12120 wake_size); 12121 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 12122 data_size + wake_size; 12123 memcpy((void *)cfg->wake_mask, 12124 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 12125 wake_mask_size); 12126 if (tok) { 12127 cfg->tokens_size = tokens_size; 12128 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 12129 } 12130 12131 trig->tcp = cfg; 12132 12133 return 0; 12134 } 12135 12136 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 12137 const struct wiphy_wowlan_support *wowlan, 12138 struct nlattr *attr, 12139 struct cfg80211_wowlan *trig) 12140 { 12141 struct nlattr **tb; 12142 int err; 12143 12144 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 12145 if (!tb) 12146 return -ENOMEM; 12147 12148 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 12149 err = -EOPNOTSUPP; 12150 goto out; 12151 } 12152 12153 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 12154 nl80211_policy, NULL); 12155 if (err) 12156 goto out; 12157 12158 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 12159 wowlan->max_nd_match_sets); 12160 err = PTR_ERR_OR_ZERO(trig->nd_config); 12161 if (err) 12162 trig->nd_config = NULL; 12163 12164 out: 12165 kfree(tb); 12166 return err; 12167 } 12168 12169 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 12170 { 12171 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12172 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 12173 struct cfg80211_wowlan new_triggers = {}; 12174 struct cfg80211_wowlan *ntrig; 12175 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 12176 int err, i; 12177 bool prev_enabled = rdev->wiphy.wowlan_config; 12178 bool regular = false; 12179 12180 if (!wowlan) 12181 return -EOPNOTSUPP; 12182 12183 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 12184 cfg80211_rdev_free_wowlan(rdev); 12185 rdev->wiphy.wowlan_config = NULL; 12186 goto set_wakeup; 12187 } 12188 12189 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 12190 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 12191 nl80211_wowlan_policy, info->extack); 12192 if (err) 12193 return err; 12194 12195 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 12196 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 12197 return -EINVAL; 12198 new_triggers.any = true; 12199 } 12200 12201 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 12202 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 12203 return -EINVAL; 12204 new_triggers.disconnect = true; 12205 regular = true; 12206 } 12207 12208 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 12209 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 12210 return -EINVAL; 12211 new_triggers.magic_pkt = true; 12212 regular = true; 12213 } 12214 12215 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 12216 return -EINVAL; 12217 12218 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 12219 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 12220 return -EINVAL; 12221 new_triggers.gtk_rekey_failure = true; 12222 regular = true; 12223 } 12224 12225 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 12226 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 12227 return -EINVAL; 12228 new_triggers.eap_identity_req = true; 12229 regular = true; 12230 } 12231 12232 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 12233 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 12234 return -EINVAL; 12235 new_triggers.four_way_handshake = true; 12236 regular = true; 12237 } 12238 12239 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 12240 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 12241 return -EINVAL; 12242 new_triggers.rfkill_release = true; 12243 regular = true; 12244 } 12245 12246 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 12247 struct nlattr *pat; 12248 int n_patterns = 0; 12249 int rem, pat_len, mask_len, pkt_offset; 12250 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12251 12252 regular = true; 12253 12254 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12255 rem) 12256 n_patterns++; 12257 if (n_patterns > wowlan->n_patterns) 12258 return -EINVAL; 12259 12260 new_triggers.patterns = kcalloc(n_patterns, 12261 sizeof(new_triggers.patterns[0]), 12262 GFP_KERNEL); 12263 if (!new_triggers.patterns) 12264 return -ENOMEM; 12265 12266 new_triggers.n_patterns = n_patterns; 12267 i = 0; 12268 12269 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 12270 rem) { 12271 u8 *mask_pat; 12272 12273 err = nla_parse_nested_deprecated(pat_tb, 12274 MAX_NL80211_PKTPAT, 12275 pat, 12276 nl80211_packet_pattern_policy, 12277 info->extack); 12278 if (err) 12279 goto error; 12280 12281 err = -EINVAL; 12282 if (!pat_tb[NL80211_PKTPAT_MASK] || 12283 !pat_tb[NL80211_PKTPAT_PATTERN]) 12284 goto error; 12285 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12286 mask_len = DIV_ROUND_UP(pat_len, 8); 12287 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12288 goto error; 12289 if (pat_len > wowlan->pattern_max_len || 12290 pat_len < wowlan->pattern_min_len) 12291 goto error; 12292 12293 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12294 pkt_offset = 0; 12295 else 12296 pkt_offset = nla_get_u32( 12297 pat_tb[NL80211_PKTPAT_OFFSET]); 12298 if (pkt_offset > wowlan->max_pkt_offset) 12299 goto error; 12300 new_triggers.patterns[i].pkt_offset = pkt_offset; 12301 12302 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12303 if (!mask_pat) { 12304 err = -ENOMEM; 12305 goto error; 12306 } 12307 new_triggers.patterns[i].mask = mask_pat; 12308 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12309 mask_len); 12310 mask_pat += mask_len; 12311 new_triggers.patterns[i].pattern = mask_pat; 12312 new_triggers.patterns[i].pattern_len = pat_len; 12313 memcpy(mask_pat, 12314 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12315 pat_len); 12316 i++; 12317 } 12318 } 12319 12320 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 12321 regular = true; 12322 err = nl80211_parse_wowlan_tcp( 12323 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 12324 &new_triggers); 12325 if (err) 12326 goto error; 12327 } 12328 12329 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 12330 regular = true; 12331 err = nl80211_parse_wowlan_nd( 12332 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 12333 &new_triggers); 12334 if (err) 12335 goto error; 12336 } 12337 12338 /* The 'any' trigger means the device continues operating more or less 12339 * as in its normal operation mode and wakes up the host on most of the 12340 * normal interrupts (like packet RX, ...) 12341 * It therefore makes little sense to combine with the more constrained 12342 * wakeup trigger modes. 12343 */ 12344 if (new_triggers.any && regular) { 12345 err = -EINVAL; 12346 goto error; 12347 } 12348 12349 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 12350 if (!ntrig) { 12351 err = -ENOMEM; 12352 goto error; 12353 } 12354 cfg80211_rdev_free_wowlan(rdev); 12355 rdev->wiphy.wowlan_config = ntrig; 12356 12357 set_wakeup: 12358 if (rdev->ops->set_wakeup && 12359 prev_enabled != !!rdev->wiphy.wowlan_config) 12360 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 12361 12362 return 0; 12363 error: 12364 for (i = 0; i < new_triggers.n_patterns; i++) 12365 kfree(new_triggers.patterns[i].mask); 12366 kfree(new_triggers.patterns); 12367 if (new_triggers.tcp && new_triggers.tcp->sock) 12368 sock_release(new_triggers.tcp->sock); 12369 kfree(new_triggers.tcp); 12370 kfree(new_triggers.nd_config); 12371 return err; 12372 } 12373 #endif 12374 12375 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 12376 struct cfg80211_registered_device *rdev) 12377 { 12378 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 12379 int i, j, pat_len; 12380 struct cfg80211_coalesce_rules *rule; 12381 12382 if (!rdev->coalesce->n_rules) 12383 return 0; 12384 12385 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 12386 if (!nl_rules) 12387 return -ENOBUFS; 12388 12389 for (i = 0; i < rdev->coalesce->n_rules; i++) { 12390 nl_rule = nla_nest_start_noflag(msg, i + 1); 12391 if (!nl_rule) 12392 return -ENOBUFS; 12393 12394 rule = &rdev->coalesce->rules[i]; 12395 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 12396 rule->delay)) 12397 return -ENOBUFS; 12398 12399 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 12400 rule->condition)) 12401 return -ENOBUFS; 12402 12403 nl_pats = nla_nest_start_noflag(msg, 12404 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 12405 if (!nl_pats) 12406 return -ENOBUFS; 12407 12408 for (j = 0; j < rule->n_patterns; j++) { 12409 nl_pat = nla_nest_start_noflag(msg, j + 1); 12410 if (!nl_pat) 12411 return -ENOBUFS; 12412 pat_len = rule->patterns[j].pattern_len; 12413 if (nla_put(msg, NL80211_PKTPAT_MASK, 12414 DIV_ROUND_UP(pat_len, 8), 12415 rule->patterns[j].mask) || 12416 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 12417 rule->patterns[j].pattern) || 12418 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 12419 rule->patterns[j].pkt_offset)) 12420 return -ENOBUFS; 12421 nla_nest_end(msg, nl_pat); 12422 } 12423 nla_nest_end(msg, nl_pats); 12424 nla_nest_end(msg, nl_rule); 12425 } 12426 nla_nest_end(msg, nl_rules); 12427 12428 return 0; 12429 } 12430 12431 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 12432 { 12433 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12434 struct sk_buff *msg; 12435 void *hdr; 12436 12437 if (!rdev->wiphy.coalesce) 12438 return -EOPNOTSUPP; 12439 12440 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12441 if (!msg) 12442 return -ENOMEM; 12443 12444 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12445 NL80211_CMD_GET_COALESCE); 12446 if (!hdr) 12447 goto nla_put_failure; 12448 12449 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 12450 goto nla_put_failure; 12451 12452 genlmsg_end(msg, hdr); 12453 return genlmsg_reply(msg, info); 12454 12455 nla_put_failure: 12456 nlmsg_free(msg); 12457 return -ENOBUFS; 12458 } 12459 12460 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 12461 { 12462 struct cfg80211_coalesce *coalesce = rdev->coalesce; 12463 int i, j; 12464 struct cfg80211_coalesce_rules *rule; 12465 12466 if (!coalesce) 12467 return; 12468 12469 for (i = 0; i < coalesce->n_rules; i++) { 12470 rule = &coalesce->rules[i]; 12471 for (j = 0; j < rule->n_patterns; j++) 12472 kfree(rule->patterns[j].mask); 12473 kfree(rule->patterns); 12474 } 12475 kfree(coalesce->rules); 12476 kfree(coalesce); 12477 rdev->coalesce = NULL; 12478 } 12479 12480 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 12481 struct nlattr *rule, 12482 struct cfg80211_coalesce_rules *new_rule) 12483 { 12484 int err, i; 12485 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12486 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 12487 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 12488 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 12489 12490 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 12491 rule, nl80211_coalesce_policy, NULL); 12492 if (err) 12493 return err; 12494 12495 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 12496 new_rule->delay = 12497 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 12498 if (new_rule->delay > coalesce->max_delay) 12499 return -EINVAL; 12500 12501 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 12502 new_rule->condition = 12503 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 12504 12505 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 12506 return -EINVAL; 12507 12508 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12509 rem) 12510 n_patterns++; 12511 if (n_patterns > coalesce->n_patterns) 12512 return -EINVAL; 12513 12514 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 12515 GFP_KERNEL); 12516 if (!new_rule->patterns) 12517 return -ENOMEM; 12518 12519 new_rule->n_patterns = n_patterns; 12520 i = 0; 12521 12522 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 12523 rem) { 12524 u8 *mask_pat; 12525 12526 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 12527 pat, 12528 nl80211_packet_pattern_policy, 12529 NULL); 12530 if (err) 12531 return err; 12532 12533 if (!pat_tb[NL80211_PKTPAT_MASK] || 12534 !pat_tb[NL80211_PKTPAT_PATTERN]) 12535 return -EINVAL; 12536 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 12537 mask_len = DIV_ROUND_UP(pat_len, 8); 12538 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 12539 return -EINVAL; 12540 if (pat_len > coalesce->pattern_max_len || 12541 pat_len < coalesce->pattern_min_len) 12542 return -EINVAL; 12543 12544 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 12545 pkt_offset = 0; 12546 else 12547 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 12548 if (pkt_offset > coalesce->max_pkt_offset) 12549 return -EINVAL; 12550 new_rule->patterns[i].pkt_offset = pkt_offset; 12551 12552 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 12553 if (!mask_pat) 12554 return -ENOMEM; 12555 12556 new_rule->patterns[i].mask = mask_pat; 12557 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 12558 mask_len); 12559 12560 mask_pat += mask_len; 12561 new_rule->patterns[i].pattern = mask_pat; 12562 new_rule->patterns[i].pattern_len = pat_len; 12563 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 12564 pat_len); 12565 i++; 12566 } 12567 12568 return 0; 12569 } 12570 12571 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 12572 { 12573 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12574 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 12575 struct cfg80211_coalesce new_coalesce = {}; 12576 struct cfg80211_coalesce *n_coalesce; 12577 int err, rem_rule, n_rules = 0, i, j; 12578 struct nlattr *rule; 12579 struct cfg80211_coalesce_rules *tmp_rule; 12580 12581 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 12582 return -EOPNOTSUPP; 12583 12584 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 12585 cfg80211_rdev_free_coalesce(rdev); 12586 rdev_set_coalesce(rdev, NULL); 12587 return 0; 12588 } 12589 12590 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12591 rem_rule) 12592 n_rules++; 12593 if (n_rules > coalesce->n_rules) 12594 return -EINVAL; 12595 12596 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 12597 GFP_KERNEL); 12598 if (!new_coalesce.rules) 12599 return -ENOMEM; 12600 12601 new_coalesce.n_rules = n_rules; 12602 i = 0; 12603 12604 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 12605 rem_rule) { 12606 err = nl80211_parse_coalesce_rule(rdev, rule, 12607 &new_coalesce.rules[i]); 12608 if (err) 12609 goto error; 12610 12611 i++; 12612 } 12613 12614 err = rdev_set_coalesce(rdev, &new_coalesce); 12615 if (err) 12616 goto error; 12617 12618 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 12619 if (!n_coalesce) { 12620 err = -ENOMEM; 12621 goto error; 12622 } 12623 cfg80211_rdev_free_coalesce(rdev); 12624 rdev->coalesce = n_coalesce; 12625 12626 return 0; 12627 error: 12628 for (i = 0; i < new_coalesce.n_rules; i++) { 12629 tmp_rule = &new_coalesce.rules[i]; 12630 for (j = 0; j < tmp_rule->n_patterns; j++) 12631 kfree(tmp_rule->patterns[j].mask); 12632 kfree(tmp_rule->patterns); 12633 } 12634 kfree(new_coalesce.rules); 12635 12636 return err; 12637 } 12638 12639 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 12640 { 12641 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12642 struct net_device *dev = info->user_ptr[1]; 12643 struct wireless_dev *wdev = dev->ieee80211_ptr; 12644 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 12645 struct cfg80211_gtk_rekey_data rekey_data; 12646 int err; 12647 12648 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 12649 return -EINVAL; 12650 12651 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 12652 info->attrs[NL80211_ATTR_REKEY_DATA], 12653 nl80211_rekey_policy, info->extack); 12654 if (err) 12655 return err; 12656 12657 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 12658 !tb[NL80211_REKEY_DATA_KCK]) 12659 return -EINVAL; 12660 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 12661 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12662 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 12663 return -ERANGE; 12664 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 12665 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 12666 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) 12667 return -ERANGE; 12668 12669 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 12670 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 12671 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 12672 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 12673 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 12674 if (tb[NL80211_REKEY_DATA_AKM]) 12675 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 12676 12677 wdev_lock(wdev); 12678 if (!wdev->current_bss) { 12679 err = -ENOTCONN; 12680 goto out; 12681 } 12682 12683 if (!rdev->ops->set_rekey_data) { 12684 err = -EOPNOTSUPP; 12685 goto out; 12686 } 12687 12688 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 12689 out: 12690 wdev_unlock(wdev); 12691 return err; 12692 } 12693 12694 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 12695 struct genl_info *info) 12696 { 12697 struct net_device *dev = info->user_ptr[1]; 12698 struct wireless_dev *wdev = dev->ieee80211_ptr; 12699 12700 if (wdev->iftype != NL80211_IFTYPE_AP && 12701 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12702 return -EINVAL; 12703 12704 if (wdev->ap_unexpected_nlportid) 12705 return -EBUSY; 12706 12707 wdev->ap_unexpected_nlportid = info->snd_portid; 12708 return 0; 12709 } 12710 12711 static int nl80211_probe_client(struct sk_buff *skb, 12712 struct genl_info *info) 12713 { 12714 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12715 struct net_device *dev = info->user_ptr[1]; 12716 struct wireless_dev *wdev = dev->ieee80211_ptr; 12717 struct sk_buff *msg; 12718 void *hdr; 12719 const u8 *addr; 12720 u64 cookie; 12721 int err; 12722 12723 if (wdev->iftype != NL80211_IFTYPE_AP && 12724 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12725 return -EOPNOTSUPP; 12726 12727 if (!info->attrs[NL80211_ATTR_MAC]) 12728 return -EINVAL; 12729 12730 if (!rdev->ops->probe_client) 12731 return -EOPNOTSUPP; 12732 12733 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12734 if (!msg) 12735 return -ENOMEM; 12736 12737 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12738 NL80211_CMD_PROBE_CLIENT); 12739 if (!hdr) { 12740 err = -ENOBUFS; 12741 goto free_msg; 12742 } 12743 12744 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12745 12746 err = rdev_probe_client(rdev, dev, addr, &cookie); 12747 if (err) 12748 goto free_msg; 12749 12750 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12751 NL80211_ATTR_PAD)) 12752 goto nla_put_failure; 12753 12754 genlmsg_end(msg, hdr); 12755 12756 return genlmsg_reply(msg, info); 12757 12758 nla_put_failure: 12759 err = -ENOBUFS; 12760 free_msg: 12761 nlmsg_free(msg); 12762 return err; 12763 } 12764 12765 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 12766 { 12767 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12768 struct cfg80211_beacon_registration *reg, *nreg; 12769 int rv; 12770 12771 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 12772 return -EOPNOTSUPP; 12773 12774 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 12775 if (!nreg) 12776 return -ENOMEM; 12777 12778 /* First, check if already registered. */ 12779 spin_lock_bh(&rdev->beacon_registrations_lock); 12780 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 12781 if (reg->nlportid == info->snd_portid) { 12782 rv = -EALREADY; 12783 goto out_err; 12784 } 12785 } 12786 /* Add it to the list */ 12787 nreg->nlportid = info->snd_portid; 12788 list_add(&nreg->list, &rdev->beacon_registrations); 12789 12790 spin_unlock_bh(&rdev->beacon_registrations_lock); 12791 12792 return 0; 12793 out_err: 12794 spin_unlock_bh(&rdev->beacon_registrations_lock); 12795 kfree(nreg); 12796 return rv; 12797 } 12798 12799 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 12800 { 12801 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12802 struct wireless_dev *wdev = info->user_ptr[1]; 12803 int err; 12804 12805 if (!rdev->ops->start_p2p_device) 12806 return -EOPNOTSUPP; 12807 12808 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12809 return -EOPNOTSUPP; 12810 12811 if (wdev_running(wdev)) 12812 return 0; 12813 12814 if (rfkill_blocked(rdev->rfkill)) 12815 return -ERFKILL; 12816 12817 err = rdev_start_p2p_device(rdev, wdev); 12818 if (err) 12819 return err; 12820 12821 wdev->is_running = true; 12822 rdev->opencount++; 12823 12824 return 0; 12825 } 12826 12827 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 12828 { 12829 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12830 struct wireless_dev *wdev = info->user_ptr[1]; 12831 12832 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 12833 return -EOPNOTSUPP; 12834 12835 if (!rdev->ops->stop_p2p_device) 12836 return -EOPNOTSUPP; 12837 12838 cfg80211_stop_p2p_device(rdev, wdev); 12839 12840 return 0; 12841 } 12842 12843 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 12844 { 12845 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12846 struct wireless_dev *wdev = info->user_ptr[1]; 12847 struct cfg80211_nan_conf conf = {}; 12848 int err; 12849 12850 if (wdev->iftype != NL80211_IFTYPE_NAN) 12851 return -EOPNOTSUPP; 12852 12853 if (wdev_running(wdev)) 12854 return -EEXIST; 12855 12856 if (rfkill_blocked(rdev->rfkill)) 12857 return -ERFKILL; 12858 12859 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 12860 return -EINVAL; 12861 12862 conf.master_pref = 12863 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 12864 12865 if (info->attrs[NL80211_ATTR_BANDS]) { 12866 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 12867 12868 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 12869 return -EOPNOTSUPP; 12870 12871 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 12872 return -EINVAL; 12873 12874 conf.bands = bands; 12875 } 12876 12877 err = rdev_start_nan(rdev, wdev, &conf); 12878 if (err) 12879 return err; 12880 12881 wdev->is_running = true; 12882 rdev->opencount++; 12883 12884 return 0; 12885 } 12886 12887 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 12888 { 12889 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12890 struct wireless_dev *wdev = info->user_ptr[1]; 12891 12892 if (wdev->iftype != NL80211_IFTYPE_NAN) 12893 return -EOPNOTSUPP; 12894 12895 cfg80211_stop_nan(rdev, wdev); 12896 12897 return 0; 12898 } 12899 12900 static int validate_nan_filter(struct nlattr *filter_attr) 12901 { 12902 struct nlattr *attr; 12903 int len = 0, n_entries = 0, rem; 12904 12905 nla_for_each_nested(attr, filter_attr, rem) { 12906 len += nla_len(attr); 12907 n_entries++; 12908 } 12909 12910 if (len >= U8_MAX) 12911 return -EINVAL; 12912 12913 return n_entries; 12914 } 12915 12916 static int handle_nan_filter(struct nlattr *attr_filter, 12917 struct cfg80211_nan_func *func, 12918 bool tx) 12919 { 12920 struct nlattr *attr; 12921 int n_entries, rem, i; 12922 struct cfg80211_nan_func_filter *filter; 12923 12924 n_entries = validate_nan_filter(attr_filter); 12925 if (n_entries < 0) 12926 return n_entries; 12927 12928 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 12929 12930 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 12931 if (!filter) 12932 return -ENOMEM; 12933 12934 i = 0; 12935 nla_for_each_nested(attr, attr_filter, rem) { 12936 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 12937 filter[i].len = nla_len(attr); 12938 i++; 12939 } 12940 if (tx) { 12941 func->num_tx_filters = n_entries; 12942 func->tx_filters = filter; 12943 } else { 12944 func->num_rx_filters = n_entries; 12945 func->rx_filters = filter; 12946 } 12947 12948 return 0; 12949 } 12950 12951 static int nl80211_nan_add_func(struct sk_buff *skb, 12952 struct genl_info *info) 12953 { 12954 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12955 struct wireless_dev *wdev = info->user_ptr[1]; 12956 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 12957 struct cfg80211_nan_func *func; 12958 struct sk_buff *msg = NULL; 12959 void *hdr = NULL; 12960 int err = 0; 12961 12962 if (wdev->iftype != NL80211_IFTYPE_NAN) 12963 return -EOPNOTSUPP; 12964 12965 if (!wdev_running(wdev)) 12966 return -ENOTCONN; 12967 12968 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 12969 return -EINVAL; 12970 12971 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 12972 info->attrs[NL80211_ATTR_NAN_FUNC], 12973 nl80211_nan_func_policy, 12974 info->extack); 12975 if (err) 12976 return err; 12977 12978 func = kzalloc(sizeof(*func), GFP_KERNEL); 12979 if (!func) 12980 return -ENOMEM; 12981 12982 func->cookie = cfg80211_assign_cookie(rdev); 12983 12984 if (!tb[NL80211_NAN_FUNC_TYPE]) { 12985 err = -EINVAL; 12986 goto out; 12987 } 12988 12989 12990 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 12991 12992 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 12993 err = -EINVAL; 12994 goto out; 12995 } 12996 12997 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 12998 sizeof(func->service_id)); 12999 13000 func->close_range = 13001 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 13002 13003 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 13004 func->serv_spec_info_len = 13005 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 13006 func->serv_spec_info = 13007 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 13008 func->serv_spec_info_len, 13009 GFP_KERNEL); 13010 if (!func->serv_spec_info) { 13011 err = -ENOMEM; 13012 goto out; 13013 } 13014 } 13015 13016 if (tb[NL80211_NAN_FUNC_TTL]) 13017 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 13018 13019 switch (func->type) { 13020 case NL80211_NAN_FUNC_PUBLISH: 13021 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 13022 err = -EINVAL; 13023 goto out; 13024 } 13025 13026 func->publish_type = 13027 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 13028 func->publish_bcast = 13029 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 13030 13031 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 13032 func->publish_bcast) { 13033 err = -EINVAL; 13034 goto out; 13035 } 13036 break; 13037 case NL80211_NAN_FUNC_SUBSCRIBE: 13038 func->subscribe_active = 13039 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 13040 break; 13041 case NL80211_NAN_FUNC_FOLLOW_UP: 13042 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 13043 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 13044 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 13045 err = -EINVAL; 13046 goto out; 13047 } 13048 13049 func->followup_id = 13050 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 13051 func->followup_reqid = 13052 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 13053 memcpy(func->followup_dest.addr, 13054 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 13055 sizeof(func->followup_dest.addr)); 13056 if (func->ttl) { 13057 err = -EINVAL; 13058 goto out; 13059 } 13060 break; 13061 default: 13062 err = -EINVAL; 13063 goto out; 13064 } 13065 13066 if (tb[NL80211_NAN_FUNC_SRF]) { 13067 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 13068 13069 err = nla_parse_nested_deprecated(srf_tb, 13070 NL80211_NAN_SRF_ATTR_MAX, 13071 tb[NL80211_NAN_FUNC_SRF], 13072 nl80211_nan_srf_policy, 13073 info->extack); 13074 if (err) 13075 goto out; 13076 13077 func->srf_include = 13078 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 13079 13080 if (srf_tb[NL80211_NAN_SRF_BF]) { 13081 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 13082 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 13083 err = -EINVAL; 13084 goto out; 13085 } 13086 13087 func->srf_bf_len = 13088 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 13089 func->srf_bf = 13090 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 13091 func->srf_bf_len, GFP_KERNEL); 13092 if (!func->srf_bf) { 13093 err = -ENOMEM; 13094 goto out; 13095 } 13096 13097 func->srf_bf_idx = 13098 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 13099 } else { 13100 struct nlattr *attr, *mac_attr = 13101 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 13102 int n_entries, rem, i = 0; 13103 13104 if (!mac_attr) { 13105 err = -EINVAL; 13106 goto out; 13107 } 13108 13109 n_entries = validate_acl_mac_addrs(mac_attr); 13110 if (n_entries <= 0) { 13111 err = -EINVAL; 13112 goto out; 13113 } 13114 13115 func->srf_num_macs = n_entries; 13116 func->srf_macs = 13117 kcalloc(n_entries, sizeof(*func->srf_macs), 13118 GFP_KERNEL); 13119 if (!func->srf_macs) { 13120 err = -ENOMEM; 13121 goto out; 13122 } 13123 13124 nla_for_each_nested(attr, mac_attr, rem) 13125 memcpy(func->srf_macs[i++].addr, nla_data(attr), 13126 sizeof(*func->srf_macs)); 13127 } 13128 } 13129 13130 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 13131 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 13132 func, true); 13133 if (err) 13134 goto out; 13135 } 13136 13137 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 13138 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 13139 func, false); 13140 if (err) 13141 goto out; 13142 } 13143 13144 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13145 if (!msg) { 13146 err = -ENOMEM; 13147 goto out; 13148 } 13149 13150 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13151 NL80211_CMD_ADD_NAN_FUNCTION); 13152 /* This can't really happen - we just allocated 4KB */ 13153 if (WARN_ON(!hdr)) { 13154 err = -ENOMEM; 13155 goto out; 13156 } 13157 13158 err = rdev_add_nan_func(rdev, wdev, func); 13159 out: 13160 if (err < 0) { 13161 cfg80211_free_nan_func(func); 13162 nlmsg_free(msg); 13163 return err; 13164 } 13165 13166 /* propagate the instance id and cookie to userspace */ 13167 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 13168 NL80211_ATTR_PAD)) 13169 goto nla_put_failure; 13170 13171 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13172 if (!func_attr) 13173 goto nla_put_failure; 13174 13175 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 13176 func->instance_id)) 13177 goto nla_put_failure; 13178 13179 nla_nest_end(msg, func_attr); 13180 13181 genlmsg_end(msg, hdr); 13182 return genlmsg_reply(msg, info); 13183 13184 nla_put_failure: 13185 nlmsg_free(msg); 13186 return -ENOBUFS; 13187 } 13188 13189 static int nl80211_nan_del_func(struct sk_buff *skb, 13190 struct genl_info *info) 13191 { 13192 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13193 struct wireless_dev *wdev = info->user_ptr[1]; 13194 u64 cookie; 13195 13196 if (wdev->iftype != NL80211_IFTYPE_NAN) 13197 return -EOPNOTSUPP; 13198 13199 if (!wdev_running(wdev)) 13200 return -ENOTCONN; 13201 13202 if (!info->attrs[NL80211_ATTR_COOKIE]) 13203 return -EINVAL; 13204 13205 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 13206 13207 rdev_del_nan_func(rdev, wdev, cookie); 13208 13209 return 0; 13210 } 13211 13212 static int nl80211_nan_change_config(struct sk_buff *skb, 13213 struct genl_info *info) 13214 { 13215 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13216 struct wireless_dev *wdev = info->user_ptr[1]; 13217 struct cfg80211_nan_conf conf = {}; 13218 u32 changed = 0; 13219 13220 if (wdev->iftype != NL80211_IFTYPE_NAN) 13221 return -EOPNOTSUPP; 13222 13223 if (!wdev_running(wdev)) 13224 return -ENOTCONN; 13225 13226 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 13227 conf.master_pref = 13228 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 13229 if (conf.master_pref <= 1 || conf.master_pref == 255) 13230 return -EINVAL; 13231 13232 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 13233 } 13234 13235 if (info->attrs[NL80211_ATTR_BANDS]) { 13236 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 13237 13238 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 13239 return -EOPNOTSUPP; 13240 13241 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 13242 return -EINVAL; 13243 13244 conf.bands = bands; 13245 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 13246 } 13247 13248 if (!changed) 13249 return -EINVAL; 13250 13251 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 13252 } 13253 13254 void cfg80211_nan_match(struct wireless_dev *wdev, 13255 struct cfg80211_nan_match_params *match, gfp_t gfp) 13256 { 13257 struct wiphy *wiphy = wdev->wiphy; 13258 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13259 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 13260 struct sk_buff *msg; 13261 void *hdr; 13262 13263 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 13264 return; 13265 13266 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13267 if (!msg) 13268 return; 13269 13270 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 13271 if (!hdr) { 13272 nlmsg_free(msg); 13273 return; 13274 } 13275 13276 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13277 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13278 wdev->netdev->ifindex)) || 13279 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13280 NL80211_ATTR_PAD)) 13281 goto nla_put_failure; 13282 13283 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 13284 NL80211_ATTR_PAD) || 13285 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 13286 goto nla_put_failure; 13287 13288 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 13289 if (!match_attr) 13290 goto nla_put_failure; 13291 13292 local_func_attr = nla_nest_start_noflag(msg, 13293 NL80211_NAN_MATCH_FUNC_LOCAL); 13294 if (!local_func_attr) 13295 goto nla_put_failure; 13296 13297 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 13298 goto nla_put_failure; 13299 13300 nla_nest_end(msg, local_func_attr); 13301 13302 peer_func_attr = nla_nest_start_noflag(msg, 13303 NL80211_NAN_MATCH_FUNC_PEER); 13304 if (!peer_func_attr) 13305 goto nla_put_failure; 13306 13307 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 13308 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 13309 goto nla_put_failure; 13310 13311 if (match->info && match->info_len && 13312 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 13313 match->info)) 13314 goto nla_put_failure; 13315 13316 nla_nest_end(msg, peer_func_attr); 13317 nla_nest_end(msg, match_attr); 13318 genlmsg_end(msg, hdr); 13319 13320 if (!wdev->owner_nlportid) 13321 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13322 msg, 0, NL80211_MCGRP_NAN, gfp); 13323 else 13324 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13325 wdev->owner_nlportid); 13326 13327 return; 13328 13329 nla_put_failure: 13330 nlmsg_free(msg); 13331 } 13332 EXPORT_SYMBOL(cfg80211_nan_match); 13333 13334 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 13335 u8 inst_id, 13336 enum nl80211_nan_func_term_reason reason, 13337 u64 cookie, gfp_t gfp) 13338 { 13339 struct wiphy *wiphy = wdev->wiphy; 13340 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13341 struct sk_buff *msg; 13342 struct nlattr *func_attr; 13343 void *hdr; 13344 13345 if (WARN_ON(!inst_id)) 13346 return; 13347 13348 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13349 if (!msg) 13350 return; 13351 13352 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 13353 if (!hdr) { 13354 nlmsg_free(msg); 13355 return; 13356 } 13357 13358 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13359 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13360 wdev->netdev->ifindex)) || 13361 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13362 NL80211_ATTR_PAD)) 13363 goto nla_put_failure; 13364 13365 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 13366 NL80211_ATTR_PAD)) 13367 goto nla_put_failure; 13368 13369 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 13370 if (!func_attr) 13371 goto nla_put_failure; 13372 13373 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 13374 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 13375 goto nla_put_failure; 13376 13377 nla_nest_end(msg, func_attr); 13378 genlmsg_end(msg, hdr); 13379 13380 if (!wdev->owner_nlportid) 13381 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 13382 msg, 0, NL80211_MCGRP_NAN, gfp); 13383 else 13384 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 13385 wdev->owner_nlportid); 13386 13387 return; 13388 13389 nla_put_failure: 13390 nlmsg_free(msg); 13391 } 13392 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 13393 13394 static int nl80211_get_protocol_features(struct sk_buff *skb, 13395 struct genl_info *info) 13396 { 13397 void *hdr; 13398 struct sk_buff *msg; 13399 13400 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13401 if (!msg) 13402 return -ENOMEM; 13403 13404 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13405 NL80211_CMD_GET_PROTOCOL_FEATURES); 13406 if (!hdr) 13407 goto nla_put_failure; 13408 13409 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 13410 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 13411 goto nla_put_failure; 13412 13413 genlmsg_end(msg, hdr); 13414 return genlmsg_reply(msg, info); 13415 13416 nla_put_failure: 13417 kfree_skb(msg); 13418 return -ENOBUFS; 13419 } 13420 13421 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 13422 { 13423 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13424 struct cfg80211_update_ft_ies_params ft_params; 13425 struct net_device *dev = info->user_ptr[1]; 13426 13427 if (!rdev->ops->update_ft_ies) 13428 return -EOPNOTSUPP; 13429 13430 if (!info->attrs[NL80211_ATTR_MDID] || 13431 !info->attrs[NL80211_ATTR_IE]) 13432 return -EINVAL; 13433 13434 memset(&ft_params, 0, sizeof(ft_params)); 13435 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 13436 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 13437 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 13438 13439 return rdev_update_ft_ies(rdev, dev, &ft_params); 13440 } 13441 13442 static int nl80211_crit_protocol_start(struct sk_buff *skb, 13443 struct genl_info *info) 13444 { 13445 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13446 struct wireless_dev *wdev = info->user_ptr[1]; 13447 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 13448 u16 duration; 13449 int ret; 13450 13451 if (!rdev->ops->crit_proto_start) 13452 return -EOPNOTSUPP; 13453 13454 if (WARN_ON(!rdev->ops->crit_proto_stop)) 13455 return -EINVAL; 13456 13457 if (rdev->crit_proto_nlportid) 13458 return -EBUSY; 13459 13460 /* determine protocol if provided */ 13461 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 13462 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 13463 13464 if (proto >= NUM_NL80211_CRIT_PROTO) 13465 return -EINVAL; 13466 13467 /* timeout must be provided */ 13468 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 13469 return -EINVAL; 13470 13471 duration = 13472 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 13473 13474 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 13475 if (!ret) 13476 rdev->crit_proto_nlportid = info->snd_portid; 13477 13478 return ret; 13479 } 13480 13481 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 13482 struct genl_info *info) 13483 { 13484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13485 struct wireless_dev *wdev = info->user_ptr[1]; 13486 13487 if (!rdev->ops->crit_proto_stop) 13488 return -EOPNOTSUPP; 13489 13490 if (rdev->crit_proto_nlportid) { 13491 rdev->crit_proto_nlportid = 0; 13492 rdev_crit_proto_stop(rdev, wdev); 13493 } 13494 return 0; 13495 } 13496 13497 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 13498 struct nlattr *attr, 13499 struct netlink_ext_ack *extack) 13500 { 13501 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 13502 if (attr->nla_type & NLA_F_NESTED) { 13503 NL_SET_ERR_MSG_ATTR(extack, attr, 13504 "unexpected nested data"); 13505 return -EINVAL; 13506 } 13507 13508 return 0; 13509 } 13510 13511 if (!(attr->nla_type & NLA_F_NESTED)) { 13512 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 13513 return -EINVAL; 13514 } 13515 13516 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 13517 } 13518 13519 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 13520 { 13521 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13522 struct wireless_dev *wdev = 13523 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 13524 int i, err; 13525 u32 vid, subcmd; 13526 13527 if (!rdev->wiphy.vendor_commands) 13528 return -EOPNOTSUPP; 13529 13530 if (IS_ERR(wdev)) { 13531 err = PTR_ERR(wdev); 13532 if (err != -EINVAL) 13533 return err; 13534 wdev = NULL; 13535 } else if (wdev->wiphy != &rdev->wiphy) { 13536 return -EINVAL; 13537 } 13538 13539 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 13540 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 13541 return -EINVAL; 13542 13543 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 13544 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 13545 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 13546 const struct wiphy_vendor_command *vcmd; 13547 void *data = NULL; 13548 int len = 0; 13549 13550 vcmd = &rdev->wiphy.vendor_commands[i]; 13551 13552 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13553 continue; 13554 13555 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13556 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13557 if (!wdev) 13558 return -EINVAL; 13559 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13560 !wdev->netdev) 13561 return -EINVAL; 13562 13563 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13564 if (!wdev_running(wdev)) 13565 return -ENETDOWN; 13566 } 13567 } else { 13568 wdev = NULL; 13569 } 13570 13571 if (!vcmd->doit) 13572 return -EOPNOTSUPP; 13573 13574 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 13575 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13576 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 13577 13578 err = nl80211_vendor_check_policy(vcmd, 13579 info->attrs[NL80211_ATTR_VENDOR_DATA], 13580 info->extack); 13581 if (err) 13582 return err; 13583 } 13584 13585 rdev->cur_cmd_info = info; 13586 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 13587 rdev->cur_cmd_info = NULL; 13588 return err; 13589 } 13590 13591 return -EOPNOTSUPP; 13592 } 13593 13594 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 13595 struct netlink_callback *cb, 13596 struct cfg80211_registered_device **rdev, 13597 struct wireless_dev **wdev) 13598 { 13599 struct nlattr **attrbuf; 13600 u32 vid, subcmd; 13601 unsigned int i; 13602 int vcmd_idx = -1; 13603 int err; 13604 void *data = NULL; 13605 unsigned int data_len = 0; 13606 13607 if (cb->args[0]) { 13608 /* subtract the 1 again here */ 13609 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 13610 struct wireless_dev *tmp; 13611 13612 if (!wiphy) 13613 return -ENODEV; 13614 *rdev = wiphy_to_rdev(wiphy); 13615 *wdev = NULL; 13616 13617 if (cb->args[1]) { 13618 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 13619 if (tmp->identifier == cb->args[1] - 1) { 13620 *wdev = tmp; 13621 break; 13622 } 13623 } 13624 } 13625 13626 /* keep rtnl locked in successful case */ 13627 return 0; 13628 } 13629 13630 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 13631 if (!attrbuf) 13632 return -ENOMEM; 13633 13634 err = nlmsg_parse_deprecated(cb->nlh, 13635 GENL_HDRLEN + nl80211_fam.hdrsize, 13636 attrbuf, nl80211_fam.maxattr, 13637 nl80211_policy, NULL); 13638 if (err) 13639 goto out; 13640 13641 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 13642 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 13643 err = -EINVAL; 13644 goto out; 13645 } 13646 13647 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 13648 if (IS_ERR(*wdev)) 13649 *wdev = NULL; 13650 13651 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 13652 if (IS_ERR(*rdev)) { 13653 err = PTR_ERR(*rdev); 13654 goto out; 13655 } 13656 13657 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 13658 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 13659 13660 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 13661 const struct wiphy_vendor_command *vcmd; 13662 13663 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 13664 13665 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 13666 continue; 13667 13668 if (!vcmd->dumpit) { 13669 err = -EOPNOTSUPP; 13670 goto out; 13671 } 13672 13673 vcmd_idx = i; 13674 break; 13675 } 13676 13677 if (vcmd_idx < 0) { 13678 err = -EOPNOTSUPP; 13679 goto out; 13680 } 13681 13682 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 13683 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13684 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 13685 13686 err = nl80211_vendor_check_policy( 13687 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 13688 attrbuf[NL80211_ATTR_VENDOR_DATA], 13689 cb->extack); 13690 if (err) 13691 goto out; 13692 } 13693 13694 /* 0 is the first index - add 1 to parse only once */ 13695 cb->args[0] = (*rdev)->wiphy_idx + 1; 13696 /* add 1 to know if it was NULL */ 13697 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 13698 cb->args[2] = vcmd_idx; 13699 cb->args[3] = (unsigned long)data; 13700 cb->args[4] = data_len; 13701 13702 /* keep rtnl locked in successful case */ 13703 err = 0; 13704 out: 13705 kfree(attrbuf); 13706 return err; 13707 } 13708 13709 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 13710 struct netlink_callback *cb) 13711 { 13712 struct cfg80211_registered_device *rdev; 13713 struct wireless_dev *wdev; 13714 unsigned int vcmd_idx; 13715 const struct wiphy_vendor_command *vcmd; 13716 void *data; 13717 int data_len; 13718 int err; 13719 struct nlattr *vendor_data; 13720 13721 rtnl_lock(); 13722 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 13723 if (err) 13724 goto out; 13725 13726 vcmd_idx = cb->args[2]; 13727 data = (void *)cb->args[3]; 13728 data_len = cb->args[4]; 13729 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 13730 13731 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 13732 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 13733 if (!wdev) { 13734 err = -EINVAL; 13735 goto out; 13736 } 13737 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 13738 !wdev->netdev) { 13739 err = -EINVAL; 13740 goto out; 13741 } 13742 13743 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 13744 if (!wdev_running(wdev)) { 13745 err = -ENETDOWN; 13746 goto out; 13747 } 13748 } 13749 } 13750 13751 while (1) { 13752 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 13753 cb->nlh->nlmsg_seq, NLM_F_MULTI, 13754 NL80211_CMD_VENDOR); 13755 if (!hdr) 13756 break; 13757 13758 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13759 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 13760 wdev_id(wdev), 13761 NL80211_ATTR_PAD))) { 13762 genlmsg_cancel(skb, hdr); 13763 break; 13764 } 13765 13766 vendor_data = nla_nest_start_noflag(skb, 13767 NL80211_ATTR_VENDOR_DATA); 13768 if (!vendor_data) { 13769 genlmsg_cancel(skb, hdr); 13770 break; 13771 } 13772 13773 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 13774 (unsigned long *)&cb->args[5]); 13775 nla_nest_end(skb, vendor_data); 13776 13777 if (err == -ENOBUFS || err == -ENOENT) { 13778 genlmsg_cancel(skb, hdr); 13779 break; 13780 } else if (err <= 0) { 13781 genlmsg_cancel(skb, hdr); 13782 goto out; 13783 } 13784 13785 genlmsg_end(skb, hdr); 13786 } 13787 13788 err = skb->len; 13789 out: 13790 rtnl_unlock(); 13791 return err; 13792 } 13793 13794 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 13795 enum nl80211_commands cmd, 13796 enum nl80211_attrs attr, 13797 int approxlen) 13798 { 13799 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13800 13801 if (WARN_ON(!rdev->cur_cmd_info)) 13802 return NULL; 13803 13804 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 13805 rdev->cur_cmd_info->snd_portid, 13806 rdev->cur_cmd_info->snd_seq, 13807 cmd, attr, NULL, GFP_KERNEL); 13808 } 13809 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 13810 13811 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 13812 { 13813 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 13814 void *hdr = ((void **)skb->cb)[1]; 13815 struct nlattr *data = ((void **)skb->cb)[2]; 13816 13817 /* clear CB data for netlink core to own from now on */ 13818 memset(skb->cb, 0, sizeof(skb->cb)); 13819 13820 if (WARN_ON(!rdev->cur_cmd_info)) { 13821 kfree_skb(skb); 13822 return -EINVAL; 13823 } 13824 13825 nla_nest_end(skb, data); 13826 genlmsg_end(skb, hdr); 13827 return genlmsg_reply(skb, rdev->cur_cmd_info); 13828 } 13829 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 13830 13831 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 13832 { 13833 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13834 13835 if (WARN_ON(!rdev->cur_cmd_info)) 13836 return 0; 13837 13838 return rdev->cur_cmd_info->snd_portid; 13839 } 13840 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 13841 13842 static int nl80211_set_qos_map(struct sk_buff *skb, 13843 struct genl_info *info) 13844 { 13845 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13846 struct cfg80211_qos_map *qos_map = NULL; 13847 struct net_device *dev = info->user_ptr[1]; 13848 u8 *pos, len, num_des, des_len, des; 13849 int ret; 13850 13851 if (!rdev->ops->set_qos_map) 13852 return -EOPNOTSUPP; 13853 13854 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 13855 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 13856 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 13857 13858 if (len % 2) 13859 return -EINVAL; 13860 13861 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 13862 if (!qos_map) 13863 return -ENOMEM; 13864 13865 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 13866 if (num_des) { 13867 des_len = num_des * 13868 sizeof(struct cfg80211_dscp_exception); 13869 memcpy(qos_map->dscp_exception, pos, des_len); 13870 qos_map->num_des = num_des; 13871 for (des = 0; des < num_des; des++) { 13872 if (qos_map->dscp_exception[des].up > 7) { 13873 kfree(qos_map); 13874 return -EINVAL; 13875 } 13876 } 13877 pos += des_len; 13878 } 13879 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 13880 } 13881 13882 wdev_lock(dev->ieee80211_ptr); 13883 ret = nl80211_key_allowed(dev->ieee80211_ptr); 13884 if (!ret) 13885 ret = rdev_set_qos_map(rdev, dev, qos_map); 13886 wdev_unlock(dev->ieee80211_ptr); 13887 13888 kfree(qos_map); 13889 return ret; 13890 } 13891 13892 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 13893 { 13894 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13895 struct net_device *dev = info->user_ptr[1]; 13896 struct wireless_dev *wdev = dev->ieee80211_ptr; 13897 const u8 *peer; 13898 u8 tsid, up; 13899 u16 admitted_time = 0; 13900 int err; 13901 13902 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 13903 return -EOPNOTSUPP; 13904 13905 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 13906 !info->attrs[NL80211_ATTR_USER_PRIO]) 13907 return -EINVAL; 13908 13909 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13910 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 13911 13912 /* WMM uses TIDs 0-7 even for TSPEC */ 13913 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 13914 /* TODO: handle 802.11 TSPEC/admission control 13915 * need more attributes for that (e.g. BA session requirement); 13916 * change the WMM adminssion test above to allow both then 13917 */ 13918 return -EINVAL; 13919 } 13920 13921 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13922 13923 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 13924 admitted_time = 13925 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 13926 if (!admitted_time) 13927 return -EINVAL; 13928 } 13929 13930 wdev_lock(wdev); 13931 switch (wdev->iftype) { 13932 case NL80211_IFTYPE_STATION: 13933 case NL80211_IFTYPE_P2P_CLIENT: 13934 if (wdev->current_bss) 13935 break; 13936 err = -ENOTCONN; 13937 goto out; 13938 default: 13939 err = -EOPNOTSUPP; 13940 goto out; 13941 } 13942 13943 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 13944 13945 out: 13946 wdev_unlock(wdev); 13947 return err; 13948 } 13949 13950 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 13951 { 13952 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13953 struct net_device *dev = info->user_ptr[1]; 13954 struct wireless_dev *wdev = dev->ieee80211_ptr; 13955 const u8 *peer; 13956 u8 tsid; 13957 int err; 13958 13959 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 13960 return -EINVAL; 13961 13962 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 13963 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 13964 13965 wdev_lock(wdev); 13966 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 13967 wdev_unlock(wdev); 13968 13969 return err; 13970 } 13971 13972 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 13973 struct genl_info *info) 13974 { 13975 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13976 struct net_device *dev = info->user_ptr[1]; 13977 struct wireless_dev *wdev = dev->ieee80211_ptr; 13978 struct cfg80211_chan_def chandef = {}; 13979 const u8 *addr; 13980 u8 oper_class; 13981 int err; 13982 13983 if (!rdev->ops->tdls_channel_switch || 13984 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 13985 return -EOPNOTSUPP; 13986 13987 switch (dev->ieee80211_ptr->iftype) { 13988 case NL80211_IFTYPE_STATION: 13989 case NL80211_IFTYPE_P2P_CLIENT: 13990 break; 13991 default: 13992 return -EOPNOTSUPP; 13993 } 13994 13995 if (!info->attrs[NL80211_ATTR_MAC] || 13996 !info->attrs[NL80211_ATTR_OPER_CLASS]) 13997 return -EINVAL; 13998 13999 err = nl80211_parse_chandef(rdev, info, &chandef); 14000 if (err) 14001 return err; 14002 14003 /* 14004 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 14005 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 14006 * specification is not defined for them. 14007 */ 14008 if (chandef.chan->band == NL80211_BAND_2GHZ && 14009 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 14010 chandef.width != NL80211_CHAN_WIDTH_20) 14011 return -EINVAL; 14012 14013 /* we will be active on the TDLS link */ 14014 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 14015 wdev->iftype)) 14016 return -EINVAL; 14017 14018 /* don't allow switching to DFS channels */ 14019 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 14020 return -EINVAL; 14021 14022 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14023 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 14024 14025 wdev_lock(wdev); 14026 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 14027 wdev_unlock(wdev); 14028 14029 return err; 14030 } 14031 14032 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 14033 struct genl_info *info) 14034 { 14035 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14036 struct net_device *dev = info->user_ptr[1]; 14037 struct wireless_dev *wdev = dev->ieee80211_ptr; 14038 const u8 *addr; 14039 14040 if (!rdev->ops->tdls_channel_switch || 14041 !rdev->ops->tdls_cancel_channel_switch || 14042 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 14043 return -EOPNOTSUPP; 14044 14045 switch (dev->ieee80211_ptr->iftype) { 14046 case NL80211_IFTYPE_STATION: 14047 case NL80211_IFTYPE_P2P_CLIENT: 14048 break; 14049 default: 14050 return -EOPNOTSUPP; 14051 } 14052 14053 if (!info->attrs[NL80211_ATTR_MAC]) 14054 return -EINVAL; 14055 14056 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14057 14058 wdev_lock(wdev); 14059 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 14060 wdev_unlock(wdev); 14061 14062 return 0; 14063 } 14064 14065 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 14066 struct genl_info *info) 14067 { 14068 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14069 struct net_device *dev = info->user_ptr[1]; 14070 struct wireless_dev *wdev = dev->ieee80211_ptr; 14071 const struct nlattr *nla; 14072 bool enabled; 14073 14074 if (!rdev->ops->set_multicast_to_unicast) 14075 return -EOPNOTSUPP; 14076 14077 if (wdev->iftype != NL80211_IFTYPE_AP && 14078 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14079 return -EOPNOTSUPP; 14080 14081 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 14082 enabled = nla_get_flag(nla); 14083 14084 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 14085 } 14086 14087 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 14088 { 14089 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14090 struct net_device *dev = info->user_ptr[1]; 14091 struct wireless_dev *wdev = dev->ieee80211_ptr; 14092 struct cfg80211_pmk_conf pmk_conf = {}; 14093 int ret; 14094 14095 if (wdev->iftype != NL80211_IFTYPE_STATION && 14096 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14097 return -EOPNOTSUPP; 14098 14099 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14100 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14101 return -EOPNOTSUPP; 14102 14103 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 14104 return -EINVAL; 14105 14106 wdev_lock(wdev); 14107 if (!wdev->current_bss) { 14108 ret = -ENOTCONN; 14109 goto out; 14110 } 14111 14112 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14113 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 14114 ret = -EINVAL; 14115 goto out; 14116 } 14117 14118 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 14119 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 14120 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 14121 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 14122 ret = -EINVAL; 14123 goto out; 14124 } 14125 14126 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 14127 pmk_conf.pmk_r0_name = 14128 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 14129 14130 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 14131 out: 14132 wdev_unlock(wdev); 14133 return ret; 14134 } 14135 14136 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 14137 { 14138 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14139 struct net_device *dev = info->user_ptr[1]; 14140 struct wireless_dev *wdev = dev->ieee80211_ptr; 14141 const u8 *aa; 14142 int ret; 14143 14144 if (wdev->iftype != NL80211_IFTYPE_STATION && 14145 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 14146 return -EOPNOTSUPP; 14147 14148 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14149 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 14150 return -EOPNOTSUPP; 14151 14152 if (!info->attrs[NL80211_ATTR_MAC]) 14153 return -EINVAL; 14154 14155 wdev_lock(wdev); 14156 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 14157 ret = rdev_del_pmk(rdev, dev, aa); 14158 wdev_unlock(wdev); 14159 14160 return ret; 14161 } 14162 14163 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 14164 { 14165 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14166 struct net_device *dev = info->user_ptr[1]; 14167 struct cfg80211_external_auth_params params; 14168 14169 if (!rdev->ops->external_auth) 14170 return -EOPNOTSUPP; 14171 14172 if (!info->attrs[NL80211_ATTR_SSID] && 14173 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 14174 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 14175 return -EINVAL; 14176 14177 if (!info->attrs[NL80211_ATTR_BSSID]) 14178 return -EINVAL; 14179 14180 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 14181 return -EINVAL; 14182 14183 memset(¶ms, 0, sizeof(params)); 14184 14185 if (info->attrs[NL80211_ATTR_SSID]) { 14186 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 14187 if (params.ssid.ssid_len == 0) 14188 return -EINVAL; 14189 memcpy(params.ssid.ssid, 14190 nla_data(info->attrs[NL80211_ATTR_SSID]), 14191 params.ssid.ssid_len); 14192 } 14193 14194 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 14195 ETH_ALEN); 14196 14197 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14198 14199 if (info->attrs[NL80211_ATTR_PMKID]) 14200 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 14201 14202 return rdev_external_auth(rdev, dev, ¶ms); 14203 } 14204 14205 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 14206 { 14207 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 14208 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14209 struct net_device *dev = info->user_ptr[1]; 14210 struct wireless_dev *wdev = dev->ieee80211_ptr; 14211 const u8 *buf; 14212 size_t len; 14213 u8 *dest; 14214 u16 proto; 14215 bool noencrypt; 14216 u64 cookie = 0; 14217 int err; 14218 14219 if (!wiphy_ext_feature_isset(&rdev->wiphy, 14220 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 14221 return -EOPNOTSUPP; 14222 14223 if (!rdev->ops->tx_control_port) 14224 return -EOPNOTSUPP; 14225 14226 if (!info->attrs[NL80211_ATTR_FRAME] || 14227 !info->attrs[NL80211_ATTR_MAC] || 14228 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 14229 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 14230 return -EINVAL; 14231 } 14232 14233 wdev_lock(wdev); 14234 14235 switch (wdev->iftype) { 14236 case NL80211_IFTYPE_AP: 14237 case NL80211_IFTYPE_P2P_GO: 14238 case NL80211_IFTYPE_MESH_POINT: 14239 break; 14240 case NL80211_IFTYPE_ADHOC: 14241 case NL80211_IFTYPE_STATION: 14242 case NL80211_IFTYPE_P2P_CLIENT: 14243 if (wdev->current_bss) 14244 break; 14245 err = -ENOTCONN; 14246 goto out; 14247 default: 14248 err = -EOPNOTSUPP; 14249 goto out; 14250 } 14251 14252 wdev_unlock(wdev); 14253 14254 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14255 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14256 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14257 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 14258 noencrypt = 14259 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 14260 14261 err = rdev_tx_control_port(rdev, dev, buf, len, 14262 dest, cpu_to_be16(proto), noencrypt, 14263 dont_wait_for_ack ? NULL : &cookie); 14264 if (!err && !dont_wait_for_ack) 14265 nl_set_extack_cookie_u64(info->extack, cookie); 14266 return err; 14267 out: 14268 wdev_unlock(wdev); 14269 return err; 14270 } 14271 14272 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 14273 struct genl_info *info) 14274 { 14275 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14276 struct net_device *dev = info->user_ptr[1]; 14277 struct wireless_dev *wdev = dev->ieee80211_ptr; 14278 struct cfg80211_ftm_responder_stats ftm_stats = {}; 14279 struct sk_buff *msg; 14280 void *hdr; 14281 struct nlattr *ftm_stats_attr; 14282 int err; 14283 14284 if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval) 14285 return -EOPNOTSUPP; 14286 14287 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 14288 if (err) 14289 return err; 14290 14291 if (!ftm_stats.filled) 14292 return -ENODATA; 14293 14294 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14295 if (!msg) 14296 return -ENOMEM; 14297 14298 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14299 NL80211_CMD_GET_FTM_RESPONDER_STATS); 14300 if (!hdr) 14301 goto nla_put_failure; 14302 14303 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14304 goto nla_put_failure; 14305 14306 ftm_stats_attr = nla_nest_start_noflag(msg, 14307 NL80211_ATTR_FTM_RESPONDER_STATS); 14308 if (!ftm_stats_attr) 14309 goto nla_put_failure; 14310 14311 #define SET_FTM(field, name, type) \ 14312 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14313 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 14314 ftm_stats.field)) \ 14315 goto nla_put_failure; } while (0) 14316 #define SET_FTM_U64(field, name) \ 14317 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 14318 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 14319 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 14320 goto nla_put_failure; } while (0) 14321 14322 SET_FTM(success_num, SUCCESS_NUM, u32); 14323 SET_FTM(partial_num, PARTIAL_NUM, u32); 14324 SET_FTM(failed_num, FAILED_NUM, u32); 14325 SET_FTM(asap_num, ASAP_NUM, u32); 14326 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 14327 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 14328 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 14329 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 14330 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 14331 #undef SET_FTM 14332 14333 nla_nest_end(msg, ftm_stats_attr); 14334 14335 genlmsg_end(msg, hdr); 14336 return genlmsg_reply(msg, info); 14337 14338 nla_put_failure: 14339 nlmsg_free(msg); 14340 return -ENOBUFS; 14341 } 14342 14343 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 14344 { 14345 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14346 struct cfg80211_update_owe_info owe_info; 14347 struct net_device *dev = info->user_ptr[1]; 14348 14349 if (!rdev->ops->update_owe_info) 14350 return -EOPNOTSUPP; 14351 14352 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 14353 !info->attrs[NL80211_ATTR_MAC]) 14354 return -EINVAL; 14355 14356 memset(&owe_info, 0, sizeof(owe_info)); 14357 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 14358 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 14359 14360 if (info->attrs[NL80211_ATTR_IE]) { 14361 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14362 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14363 } 14364 14365 return rdev_update_owe_info(rdev, dev, &owe_info); 14366 } 14367 14368 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 14369 { 14370 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14371 struct net_device *dev = info->user_ptr[1]; 14372 struct wireless_dev *wdev = dev->ieee80211_ptr; 14373 struct station_info sinfo = {}; 14374 const u8 *buf; 14375 size_t len; 14376 u8 *dest; 14377 int err; 14378 14379 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 14380 return -EOPNOTSUPP; 14381 14382 if (!info->attrs[NL80211_ATTR_MAC] || 14383 !info->attrs[NL80211_ATTR_FRAME]) { 14384 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 14385 return -EINVAL; 14386 } 14387 14388 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 14389 return -EOPNOTSUPP; 14390 14391 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 14392 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 14393 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 14394 14395 if (len < sizeof(struct ethhdr)) 14396 return -EINVAL; 14397 14398 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 14399 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 14400 return -EINVAL; 14401 14402 err = rdev_get_station(rdev, dev, dest, &sinfo); 14403 if (err) 14404 return err; 14405 14406 cfg80211_sinfo_release_content(&sinfo); 14407 14408 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 14409 } 14410 14411 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 14412 struct nlattr *attrs[], struct net_device *dev, 14413 struct cfg80211_tid_cfg *tid_conf, 14414 struct genl_info *info, const u8 *peer) 14415 { 14416 struct netlink_ext_ack *extack = info->extack; 14417 u64 mask; 14418 int err; 14419 14420 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 14421 return -EINVAL; 14422 14423 tid_conf->config_override = 14424 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 14425 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 14426 14427 if (tid_conf->config_override) { 14428 if (rdev->ops->reset_tid_config) { 14429 err = rdev_reset_tid_config(rdev, dev, peer, 14430 tid_conf->tids); 14431 if (err) 14432 return err; 14433 } else { 14434 return -EINVAL; 14435 } 14436 } 14437 14438 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 14439 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 14440 tid_conf->noack = 14441 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 14442 } 14443 14444 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 14445 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 14446 tid_conf->retry_short = 14447 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 14448 14449 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 14450 return -EINVAL; 14451 } 14452 14453 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 14454 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 14455 tid_conf->retry_long = 14456 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 14457 14458 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 14459 return -EINVAL; 14460 } 14461 14462 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 14463 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 14464 tid_conf->ampdu = 14465 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 14466 } 14467 14468 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 14469 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 14470 tid_conf->rtscts = 14471 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 14472 } 14473 14474 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 14475 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 14476 tid_conf->amsdu = 14477 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 14478 } 14479 14480 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 14481 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 14482 14483 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 14484 14485 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 14486 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 14487 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 14488 &tid_conf->txrate_mask, dev); 14489 if (err) 14490 return err; 14491 14492 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 14493 } 14494 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 14495 } 14496 14497 if (peer) 14498 mask = rdev->wiphy.tid_config_support.peer; 14499 else 14500 mask = rdev->wiphy.tid_config_support.vif; 14501 14502 if (tid_conf->mask & ~mask) { 14503 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 14504 return -ENOTSUPP; 14505 } 14506 14507 return 0; 14508 } 14509 14510 static int nl80211_set_tid_config(struct sk_buff *skb, 14511 struct genl_info *info) 14512 { 14513 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14514 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 14515 struct net_device *dev = info->user_ptr[1]; 14516 struct cfg80211_tid_config *tid_config; 14517 struct nlattr *tid; 14518 int conf_idx = 0, rem_conf; 14519 int ret = -EINVAL; 14520 u32 num_conf = 0; 14521 14522 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 14523 return -EINVAL; 14524 14525 if (!rdev->ops->set_tid_config) 14526 return -EOPNOTSUPP; 14527 14528 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14529 rem_conf) 14530 num_conf++; 14531 14532 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 14533 GFP_KERNEL); 14534 if (!tid_config) 14535 return -ENOMEM; 14536 14537 tid_config->n_tid_conf = num_conf; 14538 14539 if (info->attrs[NL80211_ATTR_MAC]) 14540 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 14541 14542 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 14543 rem_conf) { 14544 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 14545 tid, NULL, NULL); 14546 14547 if (ret) 14548 goto bad_tid_conf; 14549 14550 ret = parse_tid_conf(rdev, attrs, dev, 14551 &tid_config->tid_conf[conf_idx], 14552 info, tid_config->peer); 14553 if (ret) 14554 goto bad_tid_conf; 14555 14556 conf_idx++; 14557 } 14558 14559 ret = rdev_set_tid_config(rdev, dev, tid_config); 14560 14561 bad_tid_conf: 14562 kfree(tid_config); 14563 return ret; 14564 } 14565 14566 #define NL80211_FLAG_NEED_WIPHY 0x01 14567 #define NL80211_FLAG_NEED_NETDEV 0x02 14568 #define NL80211_FLAG_NEED_RTNL 0x04 14569 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 14570 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 14571 NL80211_FLAG_CHECK_NETDEV_UP) 14572 #define NL80211_FLAG_NEED_WDEV 0x10 14573 /* If a netdev is associated, it must be UP, P2P must be started */ 14574 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 14575 NL80211_FLAG_CHECK_NETDEV_UP) 14576 #define NL80211_FLAG_CLEAR_SKB 0x20 14577 14578 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 14579 struct genl_info *info) 14580 { 14581 struct cfg80211_registered_device *rdev; 14582 struct wireless_dev *wdev; 14583 struct net_device *dev; 14584 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 14585 14586 if (rtnl) 14587 rtnl_lock(); 14588 14589 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 14590 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 14591 if (IS_ERR(rdev)) { 14592 if (rtnl) 14593 rtnl_unlock(); 14594 return PTR_ERR(rdev); 14595 } 14596 info->user_ptr[0] = rdev; 14597 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 14598 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14599 ASSERT_RTNL(); 14600 14601 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 14602 info->attrs); 14603 if (IS_ERR(wdev)) { 14604 if (rtnl) 14605 rtnl_unlock(); 14606 return PTR_ERR(wdev); 14607 } 14608 14609 dev = wdev->netdev; 14610 rdev = wiphy_to_rdev(wdev->wiphy); 14611 14612 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 14613 if (!dev) { 14614 if (rtnl) 14615 rtnl_unlock(); 14616 return -EINVAL; 14617 } 14618 14619 info->user_ptr[1] = dev; 14620 } else { 14621 info->user_ptr[1] = wdev; 14622 } 14623 14624 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 14625 !wdev_running(wdev)) { 14626 if (rtnl) 14627 rtnl_unlock(); 14628 return -ENETDOWN; 14629 } 14630 14631 if (dev) 14632 dev_hold(dev); 14633 14634 info->user_ptr[0] = rdev; 14635 } 14636 14637 return 0; 14638 } 14639 14640 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 14641 struct genl_info *info) 14642 { 14643 if (info->user_ptr[1]) { 14644 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 14645 struct wireless_dev *wdev = info->user_ptr[1]; 14646 14647 if (wdev->netdev) 14648 dev_put(wdev->netdev); 14649 } else { 14650 dev_put(info->user_ptr[1]); 14651 } 14652 } 14653 14654 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 14655 rtnl_unlock(); 14656 14657 /* If needed, clear the netlink message payload from the SKB 14658 * as it might contain key data that shouldn't stick around on 14659 * the heap after the SKB is freed. The netlink message header 14660 * is still needed for further processing, so leave it intact. 14661 */ 14662 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 14663 struct nlmsghdr *nlh = nlmsg_hdr(skb); 14664 14665 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 14666 } 14667 } 14668 14669 static const struct genl_ops nl80211_ops[] = { 14670 { 14671 .cmd = NL80211_CMD_GET_WIPHY, 14672 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14673 .doit = nl80211_get_wiphy, 14674 .dumpit = nl80211_dump_wiphy, 14675 .done = nl80211_dump_wiphy_done, 14676 /* can be retrieved by unprivileged users */ 14677 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14678 NL80211_FLAG_NEED_RTNL, 14679 }, 14680 }; 14681 14682 static const struct genl_small_ops nl80211_small_ops[] = { 14683 { 14684 .cmd = NL80211_CMD_SET_WIPHY, 14685 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14686 .doit = nl80211_set_wiphy, 14687 .flags = GENL_UNS_ADMIN_PERM, 14688 .internal_flags = NL80211_FLAG_NEED_RTNL, 14689 }, 14690 { 14691 .cmd = NL80211_CMD_GET_INTERFACE, 14692 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14693 .doit = nl80211_get_interface, 14694 .dumpit = nl80211_dump_interface, 14695 /* can be retrieved by unprivileged users */ 14696 .internal_flags = NL80211_FLAG_NEED_WDEV | 14697 NL80211_FLAG_NEED_RTNL, 14698 }, 14699 { 14700 .cmd = NL80211_CMD_SET_INTERFACE, 14701 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14702 .doit = nl80211_set_interface, 14703 .flags = GENL_UNS_ADMIN_PERM, 14704 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14705 NL80211_FLAG_NEED_RTNL, 14706 }, 14707 { 14708 .cmd = NL80211_CMD_NEW_INTERFACE, 14709 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14710 .doit = nl80211_new_interface, 14711 .flags = GENL_UNS_ADMIN_PERM, 14712 .internal_flags = NL80211_FLAG_NEED_WIPHY | 14713 NL80211_FLAG_NEED_RTNL, 14714 }, 14715 { 14716 .cmd = NL80211_CMD_DEL_INTERFACE, 14717 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14718 .doit = nl80211_del_interface, 14719 .flags = GENL_UNS_ADMIN_PERM, 14720 .internal_flags = NL80211_FLAG_NEED_WDEV | 14721 NL80211_FLAG_NEED_RTNL, 14722 }, 14723 { 14724 .cmd = NL80211_CMD_GET_KEY, 14725 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14726 .doit = nl80211_get_key, 14727 .flags = GENL_UNS_ADMIN_PERM, 14728 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14729 NL80211_FLAG_NEED_RTNL, 14730 }, 14731 { 14732 .cmd = NL80211_CMD_SET_KEY, 14733 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14734 .doit = nl80211_set_key, 14735 .flags = GENL_UNS_ADMIN_PERM, 14736 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14737 NL80211_FLAG_NEED_RTNL | 14738 NL80211_FLAG_CLEAR_SKB, 14739 }, 14740 { 14741 .cmd = NL80211_CMD_NEW_KEY, 14742 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14743 .doit = nl80211_new_key, 14744 .flags = GENL_UNS_ADMIN_PERM, 14745 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14746 NL80211_FLAG_NEED_RTNL | 14747 NL80211_FLAG_CLEAR_SKB, 14748 }, 14749 { 14750 .cmd = NL80211_CMD_DEL_KEY, 14751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14752 .doit = nl80211_del_key, 14753 .flags = GENL_UNS_ADMIN_PERM, 14754 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14755 NL80211_FLAG_NEED_RTNL, 14756 }, 14757 { 14758 .cmd = NL80211_CMD_SET_BEACON, 14759 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14760 .flags = GENL_UNS_ADMIN_PERM, 14761 .doit = nl80211_set_beacon, 14762 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14763 NL80211_FLAG_NEED_RTNL, 14764 }, 14765 { 14766 .cmd = NL80211_CMD_START_AP, 14767 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14768 .flags = GENL_UNS_ADMIN_PERM, 14769 .doit = nl80211_start_ap, 14770 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14771 NL80211_FLAG_NEED_RTNL, 14772 }, 14773 { 14774 .cmd = NL80211_CMD_STOP_AP, 14775 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14776 .flags = GENL_UNS_ADMIN_PERM, 14777 .doit = nl80211_stop_ap, 14778 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14779 NL80211_FLAG_NEED_RTNL, 14780 }, 14781 { 14782 .cmd = NL80211_CMD_GET_STATION, 14783 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14784 .doit = nl80211_get_station, 14785 .dumpit = nl80211_dump_station, 14786 .internal_flags = NL80211_FLAG_NEED_NETDEV | 14787 NL80211_FLAG_NEED_RTNL, 14788 }, 14789 { 14790 .cmd = NL80211_CMD_SET_STATION, 14791 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14792 .doit = nl80211_set_station, 14793 .flags = GENL_UNS_ADMIN_PERM, 14794 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14795 NL80211_FLAG_NEED_RTNL, 14796 }, 14797 { 14798 .cmd = NL80211_CMD_NEW_STATION, 14799 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14800 .doit = nl80211_new_station, 14801 .flags = GENL_UNS_ADMIN_PERM, 14802 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14803 NL80211_FLAG_NEED_RTNL, 14804 }, 14805 { 14806 .cmd = NL80211_CMD_DEL_STATION, 14807 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14808 .doit = nl80211_del_station, 14809 .flags = GENL_UNS_ADMIN_PERM, 14810 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14811 NL80211_FLAG_NEED_RTNL, 14812 }, 14813 { 14814 .cmd = NL80211_CMD_GET_MPATH, 14815 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14816 .doit = nl80211_get_mpath, 14817 .dumpit = nl80211_dump_mpath, 14818 .flags = GENL_UNS_ADMIN_PERM, 14819 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14820 NL80211_FLAG_NEED_RTNL, 14821 }, 14822 { 14823 .cmd = NL80211_CMD_GET_MPP, 14824 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14825 .doit = nl80211_get_mpp, 14826 .dumpit = nl80211_dump_mpp, 14827 .flags = GENL_UNS_ADMIN_PERM, 14828 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14829 NL80211_FLAG_NEED_RTNL, 14830 }, 14831 { 14832 .cmd = NL80211_CMD_SET_MPATH, 14833 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14834 .doit = nl80211_set_mpath, 14835 .flags = GENL_UNS_ADMIN_PERM, 14836 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14837 NL80211_FLAG_NEED_RTNL, 14838 }, 14839 { 14840 .cmd = NL80211_CMD_NEW_MPATH, 14841 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14842 .doit = nl80211_new_mpath, 14843 .flags = GENL_UNS_ADMIN_PERM, 14844 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14845 NL80211_FLAG_NEED_RTNL, 14846 }, 14847 { 14848 .cmd = NL80211_CMD_DEL_MPATH, 14849 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14850 .doit = nl80211_del_mpath, 14851 .flags = GENL_UNS_ADMIN_PERM, 14852 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14853 NL80211_FLAG_NEED_RTNL, 14854 }, 14855 { 14856 .cmd = NL80211_CMD_SET_BSS, 14857 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14858 .doit = nl80211_set_bss, 14859 .flags = GENL_UNS_ADMIN_PERM, 14860 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14861 NL80211_FLAG_NEED_RTNL, 14862 }, 14863 { 14864 .cmd = NL80211_CMD_GET_REG, 14865 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14866 .doit = nl80211_get_reg_do, 14867 .dumpit = nl80211_get_reg_dump, 14868 .internal_flags = NL80211_FLAG_NEED_RTNL, 14869 /* can be retrieved by unprivileged users */ 14870 }, 14871 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 14872 { 14873 .cmd = NL80211_CMD_SET_REG, 14874 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14875 .doit = nl80211_set_reg, 14876 .flags = GENL_ADMIN_PERM, 14877 .internal_flags = NL80211_FLAG_NEED_RTNL, 14878 }, 14879 #endif 14880 { 14881 .cmd = NL80211_CMD_REQ_SET_REG, 14882 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14883 .doit = nl80211_req_set_reg, 14884 .flags = GENL_ADMIN_PERM, 14885 }, 14886 { 14887 .cmd = NL80211_CMD_RELOAD_REGDB, 14888 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14889 .doit = nl80211_reload_regdb, 14890 .flags = GENL_ADMIN_PERM, 14891 }, 14892 { 14893 .cmd = NL80211_CMD_GET_MESH_CONFIG, 14894 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14895 .doit = nl80211_get_mesh_config, 14896 /* can be retrieved by unprivileged users */ 14897 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14898 NL80211_FLAG_NEED_RTNL, 14899 }, 14900 { 14901 .cmd = NL80211_CMD_SET_MESH_CONFIG, 14902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14903 .doit = nl80211_update_mesh_config, 14904 .flags = GENL_UNS_ADMIN_PERM, 14905 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14906 NL80211_FLAG_NEED_RTNL, 14907 }, 14908 { 14909 .cmd = NL80211_CMD_TRIGGER_SCAN, 14910 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14911 .doit = nl80211_trigger_scan, 14912 .flags = GENL_UNS_ADMIN_PERM, 14913 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14914 NL80211_FLAG_NEED_RTNL, 14915 }, 14916 { 14917 .cmd = NL80211_CMD_ABORT_SCAN, 14918 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14919 .doit = nl80211_abort_scan, 14920 .flags = GENL_UNS_ADMIN_PERM, 14921 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 14922 NL80211_FLAG_NEED_RTNL, 14923 }, 14924 { 14925 .cmd = NL80211_CMD_GET_SCAN, 14926 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14927 .dumpit = nl80211_dump_scan, 14928 }, 14929 { 14930 .cmd = NL80211_CMD_START_SCHED_SCAN, 14931 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14932 .doit = nl80211_start_sched_scan, 14933 .flags = GENL_UNS_ADMIN_PERM, 14934 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14935 NL80211_FLAG_NEED_RTNL, 14936 }, 14937 { 14938 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 14939 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14940 .doit = nl80211_stop_sched_scan, 14941 .flags = GENL_UNS_ADMIN_PERM, 14942 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14943 NL80211_FLAG_NEED_RTNL, 14944 }, 14945 { 14946 .cmd = NL80211_CMD_AUTHENTICATE, 14947 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14948 .doit = nl80211_authenticate, 14949 .flags = GENL_UNS_ADMIN_PERM, 14950 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14951 NL80211_FLAG_NEED_RTNL | 14952 NL80211_FLAG_CLEAR_SKB, 14953 }, 14954 { 14955 .cmd = NL80211_CMD_ASSOCIATE, 14956 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14957 .doit = nl80211_associate, 14958 .flags = GENL_UNS_ADMIN_PERM, 14959 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14960 NL80211_FLAG_NEED_RTNL | 14961 NL80211_FLAG_CLEAR_SKB, 14962 }, 14963 { 14964 .cmd = NL80211_CMD_DEAUTHENTICATE, 14965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14966 .doit = nl80211_deauthenticate, 14967 .flags = GENL_UNS_ADMIN_PERM, 14968 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14969 NL80211_FLAG_NEED_RTNL, 14970 }, 14971 { 14972 .cmd = NL80211_CMD_DISASSOCIATE, 14973 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14974 .doit = nl80211_disassociate, 14975 .flags = GENL_UNS_ADMIN_PERM, 14976 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14977 NL80211_FLAG_NEED_RTNL, 14978 }, 14979 { 14980 .cmd = NL80211_CMD_JOIN_IBSS, 14981 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14982 .doit = nl80211_join_ibss, 14983 .flags = GENL_UNS_ADMIN_PERM, 14984 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14985 NL80211_FLAG_NEED_RTNL, 14986 }, 14987 { 14988 .cmd = NL80211_CMD_LEAVE_IBSS, 14989 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14990 .doit = nl80211_leave_ibss, 14991 .flags = GENL_UNS_ADMIN_PERM, 14992 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 14993 NL80211_FLAG_NEED_RTNL, 14994 }, 14995 #ifdef CONFIG_NL80211_TESTMODE 14996 { 14997 .cmd = NL80211_CMD_TESTMODE, 14998 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 14999 .doit = nl80211_testmode_do, 15000 .dumpit = nl80211_testmode_dump, 15001 .flags = GENL_UNS_ADMIN_PERM, 15002 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15003 NL80211_FLAG_NEED_RTNL, 15004 }, 15005 #endif 15006 { 15007 .cmd = NL80211_CMD_CONNECT, 15008 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15009 .doit = nl80211_connect, 15010 .flags = GENL_UNS_ADMIN_PERM, 15011 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15012 NL80211_FLAG_NEED_RTNL | 15013 NL80211_FLAG_CLEAR_SKB, 15014 }, 15015 { 15016 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 15017 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15018 .doit = nl80211_update_connect_params, 15019 .flags = GENL_ADMIN_PERM, 15020 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15021 NL80211_FLAG_NEED_RTNL | 15022 NL80211_FLAG_CLEAR_SKB, 15023 }, 15024 { 15025 .cmd = NL80211_CMD_DISCONNECT, 15026 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15027 .doit = nl80211_disconnect, 15028 .flags = GENL_UNS_ADMIN_PERM, 15029 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15030 NL80211_FLAG_NEED_RTNL, 15031 }, 15032 { 15033 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 15034 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15035 .doit = nl80211_wiphy_netns, 15036 .flags = GENL_UNS_ADMIN_PERM, 15037 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15038 NL80211_FLAG_NEED_RTNL, 15039 }, 15040 { 15041 .cmd = NL80211_CMD_GET_SURVEY, 15042 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15043 .dumpit = nl80211_dump_survey, 15044 }, 15045 { 15046 .cmd = NL80211_CMD_SET_PMKSA, 15047 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15048 .doit = nl80211_setdel_pmksa, 15049 .flags = GENL_UNS_ADMIN_PERM, 15050 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15051 NL80211_FLAG_NEED_RTNL | 15052 NL80211_FLAG_CLEAR_SKB, 15053 }, 15054 { 15055 .cmd = NL80211_CMD_DEL_PMKSA, 15056 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15057 .doit = nl80211_setdel_pmksa, 15058 .flags = GENL_UNS_ADMIN_PERM, 15059 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15060 NL80211_FLAG_NEED_RTNL, 15061 }, 15062 { 15063 .cmd = NL80211_CMD_FLUSH_PMKSA, 15064 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15065 .doit = nl80211_flush_pmksa, 15066 .flags = GENL_UNS_ADMIN_PERM, 15067 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15068 NL80211_FLAG_NEED_RTNL, 15069 }, 15070 { 15071 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 15072 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15073 .doit = nl80211_remain_on_channel, 15074 .flags = GENL_UNS_ADMIN_PERM, 15075 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15076 NL80211_FLAG_NEED_RTNL, 15077 }, 15078 { 15079 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 15080 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15081 .doit = nl80211_cancel_remain_on_channel, 15082 .flags = GENL_UNS_ADMIN_PERM, 15083 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15084 NL80211_FLAG_NEED_RTNL, 15085 }, 15086 { 15087 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 15088 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15089 .doit = nl80211_set_tx_bitrate_mask, 15090 .flags = GENL_UNS_ADMIN_PERM, 15091 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15092 NL80211_FLAG_NEED_RTNL, 15093 }, 15094 { 15095 .cmd = NL80211_CMD_REGISTER_FRAME, 15096 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15097 .doit = nl80211_register_mgmt, 15098 .flags = GENL_UNS_ADMIN_PERM, 15099 .internal_flags = NL80211_FLAG_NEED_WDEV | 15100 NL80211_FLAG_NEED_RTNL, 15101 }, 15102 { 15103 .cmd = NL80211_CMD_FRAME, 15104 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15105 .doit = nl80211_tx_mgmt, 15106 .flags = GENL_UNS_ADMIN_PERM, 15107 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15108 NL80211_FLAG_NEED_RTNL, 15109 }, 15110 { 15111 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 15112 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15113 .doit = nl80211_tx_mgmt_cancel_wait, 15114 .flags = GENL_UNS_ADMIN_PERM, 15115 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15116 NL80211_FLAG_NEED_RTNL, 15117 }, 15118 { 15119 .cmd = NL80211_CMD_SET_POWER_SAVE, 15120 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15121 .doit = nl80211_set_power_save, 15122 .flags = GENL_UNS_ADMIN_PERM, 15123 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15124 NL80211_FLAG_NEED_RTNL, 15125 }, 15126 { 15127 .cmd = NL80211_CMD_GET_POWER_SAVE, 15128 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15129 .doit = nl80211_get_power_save, 15130 /* can be retrieved by unprivileged users */ 15131 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15132 NL80211_FLAG_NEED_RTNL, 15133 }, 15134 { 15135 .cmd = NL80211_CMD_SET_CQM, 15136 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15137 .doit = nl80211_set_cqm, 15138 .flags = GENL_UNS_ADMIN_PERM, 15139 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15140 NL80211_FLAG_NEED_RTNL, 15141 }, 15142 { 15143 .cmd = NL80211_CMD_SET_CHANNEL, 15144 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15145 .doit = nl80211_set_channel, 15146 .flags = GENL_UNS_ADMIN_PERM, 15147 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15148 NL80211_FLAG_NEED_RTNL, 15149 }, 15150 { 15151 .cmd = NL80211_CMD_SET_WDS_PEER, 15152 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15153 .doit = nl80211_set_wds_peer, 15154 .flags = GENL_UNS_ADMIN_PERM, 15155 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15156 NL80211_FLAG_NEED_RTNL, 15157 }, 15158 { 15159 .cmd = NL80211_CMD_JOIN_MESH, 15160 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15161 .doit = nl80211_join_mesh, 15162 .flags = GENL_UNS_ADMIN_PERM, 15163 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15164 NL80211_FLAG_NEED_RTNL, 15165 }, 15166 { 15167 .cmd = NL80211_CMD_LEAVE_MESH, 15168 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15169 .doit = nl80211_leave_mesh, 15170 .flags = GENL_UNS_ADMIN_PERM, 15171 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15172 NL80211_FLAG_NEED_RTNL, 15173 }, 15174 { 15175 .cmd = NL80211_CMD_JOIN_OCB, 15176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15177 .doit = nl80211_join_ocb, 15178 .flags = GENL_UNS_ADMIN_PERM, 15179 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15180 NL80211_FLAG_NEED_RTNL, 15181 }, 15182 { 15183 .cmd = NL80211_CMD_LEAVE_OCB, 15184 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15185 .doit = nl80211_leave_ocb, 15186 .flags = GENL_UNS_ADMIN_PERM, 15187 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15188 NL80211_FLAG_NEED_RTNL, 15189 }, 15190 #ifdef CONFIG_PM 15191 { 15192 .cmd = NL80211_CMD_GET_WOWLAN, 15193 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15194 .doit = nl80211_get_wowlan, 15195 /* can be retrieved by unprivileged users */ 15196 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15197 NL80211_FLAG_NEED_RTNL, 15198 }, 15199 { 15200 .cmd = NL80211_CMD_SET_WOWLAN, 15201 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15202 .doit = nl80211_set_wowlan, 15203 .flags = GENL_UNS_ADMIN_PERM, 15204 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15205 NL80211_FLAG_NEED_RTNL, 15206 }, 15207 #endif 15208 { 15209 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 15210 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15211 .doit = nl80211_set_rekey_data, 15212 .flags = GENL_UNS_ADMIN_PERM, 15213 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15214 NL80211_FLAG_NEED_RTNL | 15215 NL80211_FLAG_CLEAR_SKB, 15216 }, 15217 { 15218 .cmd = NL80211_CMD_TDLS_MGMT, 15219 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15220 .doit = nl80211_tdls_mgmt, 15221 .flags = GENL_UNS_ADMIN_PERM, 15222 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15223 NL80211_FLAG_NEED_RTNL, 15224 }, 15225 { 15226 .cmd = NL80211_CMD_TDLS_OPER, 15227 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15228 .doit = nl80211_tdls_oper, 15229 .flags = GENL_UNS_ADMIN_PERM, 15230 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15231 NL80211_FLAG_NEED_RTNL, 15232 }, 15233 { 15234 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 15235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15236 .doit = nl80211_register_unexpected_frame, 15237 .flags = GENL_UNS_ADMIN_PERM, 15238 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15239 NL80211_FLAG_NEED_RTNL, 15240 }, 15241 { 15242 .cmd = NL80211_CMD_PROBE_CLIENT, 15243 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15244 .doit = nl80211_probe_client, 15245 .flags = GENL_UNS_ADMIN_PERM, 15246 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15247 NL80211_FLAG_NEED_RTNL, 15248 }, 15249 { 15250 .cmd = NL80211_CMD_REGISTER_BEACONS, 15251 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15252 .doit = nl80211_register_beacons, 15253 .flags = GENL_UNS_ADMIN_PERM, 15254 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15255 NL80211_FLAG_NEED_RTNL, 15256 }, 15257 { 15258 .cmd = NL80211_CMD_SET_NOACK_MAP, 15259 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15260 .doit = nl80211_set_noack_map, 15261 .flags = GENL_UNS_ADMIN_PERM, 15262 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15263 NL80211_FLAG_NEED_RTNL, 15264 }, 15265 { 15266 .cmd = NL80211_CMD_START_P2P_DEVICE, 15267 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15268 .doit = nl80211_start_p2p_device, 15269 .flags = GENL_UNS_ADMIN_PERM, 15270 .internal_flags = NL80211_FLAG_NEED_WDEV | 15271 NL80211_FLAG_NEED_RTNL, 15272 }, 15273 { 15274 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 15275 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15276 .doit = nl80211_stop_p2p_device, 15277 .flags = GENL_UNS_ADMIN_PERM, 15278 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15279 NL80211_FLAG_NEED_RTNL, 15280 }, 15281 { 15282 .cmd = NL80211_CMD_START_NAN, 15283 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15284 .doit = nl80211_start_nan, 15285 .flags = GENL_ADMIN_PERM, 15286 .internal_flags = NL80211_FLAG_NEED_WDEV | 15287 NL80211_FLAG_NEED_RTNL, 15288 }, 15289 { 15290 .cmd = NL80211_CMD_STOP_NAN, 15291 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15292 .doit = nl80211_stop_nan, 15293 .flags = GENL_ADMIN_PERM, 15294 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15295 NL80211_FLAG_NEED_RTNL, 15296 }, 15297 { 15298 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 15299 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15300 .doit = nl80211_nan_add_func, 15301 .flags = GENL_ADMIN_PERM, 15302 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15303 NL80211_FLAG_NEED_RTNL, 15304 }, 15305 { 15306 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 15307 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15308 .doit = nl80211_nan_del_func, 15309 .flags = GENL_ADMIN_PERM, 15310 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15311 NL80211_FLAG_NEED_RTNL, 15312 }, 15313 { 15314 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 15315 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15316 .doit = nl80211_nan_change_config, 15317 .flags = GENL_ADMIN_PERM, 15318 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15319 NL80211_FLAG_NEED_RTNL, 15320 }, 15321 { 15322 .cmd = NL80211_CMD_SET_MCAST_RATE, 15323 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15324 .doit = nl80211_set_mcast_rate, 15325 .flags = GENL_UNS_ADMIN_PERM, 15326 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15327 NL80211_FLAG_NEED_RTNL, 15328 }, 15329 { 15330 .cmd = NL80211_CMD_SET_MAC_ACL, 15331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15332 .doit = nl80211_set_mac_acl, 15333 .flags = GENL_UNS_ADMIN_PERM, 15334 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15335 NL80211_FLAG_NEED_RTNL, 15336 }, 15337 { 15338 .cmd = NL80211_CMD_RADAR_DETECT, 15339 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15340 .doit = nl80211_start_radar_detection, 15341 .flags = GENL_UNS_ADMIN_PERM, 15342 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15343 NL80211_FLAG_NEED_RTNL, 15344 }, 15345 { 15346 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 15347 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15348 .doit = nl80211_get_protocol_features, 15349 }, 15350 { 15351 .cmd = NL80211_CMD_UPDATE_FT_IES, 15352 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15353 .doit = nl80211_update_ft_ies, 15354 .flags = GENL_UNS_ADMIN_PERM, 15355 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15356 NL80211_FLAG_NEED_RTNL, 15357 }, 15358 { 15359 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 15360 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15361 .doit = nl80211_crit_protocol_start, 15362 .flags = GENL_UNS_ADMIN_PERM, 15363 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15364 NL80211_FLAG_NEED_RTNL, 15365 }, 15366 { 15367 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 15368 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15369 .doit = nl80211_crit_protocol_stop, 15370 .flags = GENL_UNS_ADMIN_PERM, 15371 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15372 NL80211_FLAG_NEED_RTNL, 15373 }, 15374 { 15375 .cmd = NL80211_CMD_GET_COALESCE, 15376 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15377 .doit = nl80211_get_coalesce, 15378 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15379 NL80211_FLAG_NEED_RTNL, 15380 }, 15381 { 15382 .cmd = NL80211_CMD_SET_COALESCE, 15383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15384 .doit = nl80211_set_coalesce, 15385 .flags = GENL_UNS_ADMIN_PERM, 15386 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15387 NL80211_FLAG_NEED_RTNL, 15388 }, 15389 { 15390 .cmd = NL80211_CMD_CHANNEL_SWITCH, 15391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15392 .doit = nl80211_channel_switch, 15393 .flags = GENL_UNS_ADMIN_PERM, 15394 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15395 NL80211_FLAG_NEED_RTNL, 15396 }, 15397 { 15398 .cmd = NL80211_CMD_VENDOR, 15399 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15400 .doit = nl80211_vendor_cmd, 15401 .dumpit = nl80211_vendor_cmd_dump, 15402 .flags = GENL_UNS_ADMIN_PERM, 15403 .internal_flags = NL80211_FLAG_NEED_WIPHY | 15404 NL80211_FLAG_NEED_RTNL | 15405 NL80211_FLAG_CLEAR_SKB, 15406 }, 15407 { 15408 .cmd = NL80211_CMD_SET_QOS_MAP, 15409 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15410 .doit = nl80211_set_qos_map, 15411 .flags = GENL_UNS_ADMIN_PERM, 15412 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15413 NL80211_FLAG_NEED_RTNL, 15414 }, 15415 { 15416 .cmd = NL80211_CMD_ADD_TX_TS, 15417 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15418 .doit = nl80211_add_tx_ts, 15419 .flags = GENL_UNS_ADMIN_PERM, 15420 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15421 NL80211_FLAG_NEED_RTNL, 15422 }, 15423 { 15424 .cmd = NL80211_CMD_DEL_TX_TS, 15425 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15426 .doit = nl80211_del_tx_ts, 15427 .flags = GENL_UNS_ADMIN_PERM, 15428 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15429 NL80211_FLAG_NEED_RTNL, 15430 }, 15431 { 15432 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 15433 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15434 .doit = nl80211_tdls_channel_switch, 15435 .flags = GENL_UNS_ADMIN_PERM, 15436 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15437 NL80211_FLAG_NEED_RTNL, 15438 }, 15439 { 15440 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 15441 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15442 .doit = nl80211_tdls_cancel_channel_switch, 15443 .flags = GENL_UNS_ADMIN_PERM, 15444 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15445 NL80211_FLAG_NEED_RTNL, 15446 }, 15447 { 15448 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 15449 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15450 .doit = nl80211_set_multicast_to_unicast, 15451 .flags = GENL_UNS_ADMIN_PERM, 15452 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15453 NL80211_FLAG_NEED_RTNL, 15454 }, 15455 { 15456 .cmd = NL80211_CMD_SET_PMK, 15457 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15458 .doit = nl80211_set_pmk, 15459 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15460 NL80211_FLAG_NEED_RTNL | 15461 NL80211_FLAG_CLEAR_SKB, 15462 }, 15463 { 15464 .cmd = NL80211_CMD_DEL_PMK, 15465 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15466 .doit = nl80211_del_pmk, 15467 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15468 NL80211_FLAG_NEED_RTNL, 15469 }, 15470 { 15471 .cmd = NL80211_CMD_EXTERNAL_AUTH, 15472 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15473 .doit = nl80211_external_auth, 15474 .flags = GENL_ADMIN_PERM, 15475 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15476 NL80211_FLAG_NEED_RTNL, 15477 }, 15478 { 15479 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 15480 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15481 .doit = nl80211_tx_control_port, 15482 .flags = GENL_UNS_ADMIN_PERM, 15483 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15484 NL80211_FLAG_NEED_RTNL, 15485 }, 15486 { 15487 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 15488 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15489 .doit = nl80211_get_ftm_responder_stats, 15490 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15491 NL80211_FLAG_NEED_RTNL, 15492 }, 15493 { 15494 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 15495 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15496 .doit = nl80211_pmsr_start, 15497 .flags = GENL_UNS_ADMIN_PERM, 15498 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 15499 NL80211_FLAG_NEED_RTNL, 15500 }, 15501 { 15502 .cmd = NL80211_CMD_NOTIFY_RADAR, 15503 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 15504 .doit = nl80211_notify_radar_detection, 15505 .flags = GENL_UNS_ADMIN_PERM, 15506 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15507 NL80211_FLAG_NEED_RTNL, 15508 }, 15509 { 15510 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 15511 .doit = nl80211_update_owe_info, 15512 .flags = GENL_ADMIN_PERM, 15513 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15514 NL80211_FLAG_NEED_RTNL, 15515 }, 15516 { 15517 .cmd = NL80211_CMD_PROBE_MESH_LINK, 15518 .doit = nl80211_probe_mesh_link, 15519 .flags = GENL_UNS_ADMIN_PERM, 15520 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 15521 NL80211_FLAG_NEED_RTNL, 15522 }, 15523 { 15524 .cmd = NL80211_CMD_SET_TID_CONFIG, 15525 .doit = nl80211_set_tid_config, 15526 .flags = GENL_UNS_ADMIN_PERM, 15527 .internal_flags = NL80211_FLAG_NEED_NETDEV | 15528 NL80211_FLAG_NEED_RTNL, 15529 }, 15530 }; 15531 15532 static struct genl_family nl80211_fam __ro_after_init = { 15533 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 15534 .hdrsize = 0, /* no private header */ 15535 .version = 1, /* no particular meaning now */ 15536 .maxattr = NL80211_ATTR_MAX, 15537 .policy = nl80211_policy, 15538 .netnsok = true, 15539 .pre_doit = nl80211_pre_doit, 15540 .post_doit = nl80211_post_doit, 15541 .module = THIS_MODULE, 15542 .ops = nl80211_ops, 15543 .n_ops = ARRAY_SIZE(nl80211_ops), 15544 .small_ops = nl80211_small_ops, 15545 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 15546 .mcgrps = nl80211_mcgrps, 15547 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 15548 .parallel_ops = true, 15549 }; 15550 15551 /* notification functions */ 15552 15553 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 15554 enum nl80211_commands cmd) 15555 { 15556 struct sk_buff *msg; 15557 struct nl80211_dump_wiphy_state state = {}; 15558 15559 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 15560 cmd != NL80211_CMD_DEL_WIPHY); 15561 15562 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15563 if (!msg) 15564 return; 15565 15566 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 15567 nlmsg_free(msg); 15568 return; 15569 } 15570 15571 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15572 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15573 } 15574 15575 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 15576 struct wireless_dev *wdev, 15577 enum nl80211_commands cmd) 15578 { 15579 struct sk_buff *msg; 15580 15581 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15582 if (!msg) 15583 return; 15584 15585 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 15586 nlmsg_free(msg); 15587 return; 15588 } 15589 15590 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15591 NL80211_MCGRP_CONFIG, GFP_KERNEL); 15592 } 15593 15594 static int nl80211_add_scan_req(struct sk_buff *msg, 15595 struct cfg80211_registered_device *rdev) 15596 { 15597 struct cfg80211_scan_request *req = rdev->scan_req; 15598 struct nlattr *nest; 15599 int i; 15600 struct cfg80211_scan_info *info; 15601 15602 if (WARN_ON(!req)) 15603 return 0; 15604 15605 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 15606 if (!nest) 15607 goto nla_put_failure; 15608 for (i = 0; i < req->n_ssids; i++) { 15609 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 15610 goto nla_put_failure; 15611 } 15612 nla_nest_end(msg, nest); 15613 15614 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 15615 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 15616 if (!nest) 15617 goto nla_put_failure; 15618 for (i = 0; i < req->n_channels; i++) { 15619 if (nla_put_u32(msg, i, 15620 ieee80211_channel_to_khz(req->channels[i]))) 15621 goto nla_put_failure; 15622 } 15623 nla_nest_end(msg, nest); 15624 } else { 15625 nest = nla_nest_start_noflag(msg, 15626 NL80211_ATTR_SCAN_FREQUENCIES); 15627 if (!nest) 15628 goto nla_put_failure; 15629 for (i = 0; i < req->n_channels; i++) { 15630 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 15631 goto nla_put_failure; 15632 } 15633 nla_nest_end(msg, nest); 15634 } 15635 15636 if (req->ie && 15637 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 15638 goto nla_put_failure; 15639 15640 if (req->flags && 15641 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 15642 goto nla_put_failure; 15643 15644 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 15645 &rdev->scan_req->info; 15646 if (info->scan_start_tsf && 15647 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 15648 info->scan_start_tsf, NL80211_BSS_PAD) || 15649 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 15650 info->tsf_bssid))) 15651 goto nla_put_failure; 15652 15653 return 0; 15654 nla_put_failure: 15655 return -ENOBUFS; 15656 } 15657 15658 static int nl80211_prep_scan_msg(struct sk_buff *msg, 15659 struct cfg80211_registered_device *rdev, 15660 struct wireless_dev *wdev, 15661 u32 portid, u32 seq, int flags, 15662 u32 cmd) 15663 { 15664 void *hdr; 15665 15666 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 15667 if (!hdr) 15668 return -1; 15669 15670 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15671 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15672 wdev->netdev->ifindex)) || 15673 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15674 NL80211_ATTR_PAD)) 15675 goto nla_put_failure; 15676 15677 /* ignore errors and send incomplete event anyway */ 15678 nl80211_add_scan_req(msg, rdev); 15679 15680 genlmsg_end(msg, hdr); 15681 return 0; 15682 15683 nla_put_failure: 15684 genlmsg_cancel(msg, hdr); 15685 return -EMSGSIZE; 15686 } 15687 15688 static int 15689 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 15690 struct cfg80211_sched_scan_request *req, u32 cmd) 15691 { 15692 void *hdr; 15693 15694 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15695 if (!hdr) 15696 return -1; 15697 15698 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 15699 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 15700 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 15701 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 15702 NL80211_ATTR_PAD)) 15703 goto nla_put_failure; 15704 15705 genlmsg_end(msg, hdr); 15706 return 0; 15707 15708 nla_put_failure: 15709 genlmsg_cancel(msg, hdr); 15710 return -EMSGSIZE; 15711 } 15712 15713 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 15714 struct wireless_dev *wdev) 15715 { 15716 struct sk_buff *msg; 15717 15718 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15719 if (!msg) 15720 return; 15721 15722 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15723 NL80211_CMD_TRIGGER_SCAN) < 0) { 15724 nlmsg_free(msg); 15725 return; 15726 } 15727 15728 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15729 NL80211_MCGRP_SCAN, GFP_KERNEL); 15730 } 15731 15732 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 15733 struct wireless_dev *wdev, bool aborted) 15734 { 15735 struct sk_buff *msg; 15736 15737 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15738 if (!msg) 15739 return NULL; 15740 15741 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 15742 aborted ? NL80211_CMD_SCAN_ABORTED : 15743 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 15744 nlmsg_free(msg); 15745 return NULL; 15746 } 15747 15748 return msg; 15749 } 15750 15751 /* send message created by nl80211_build_scan_msg() */ 15752 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 15753 struct sk_buff *msg) 15754 { 15755 if (!msg) 15756 return; 15757 15758 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15759 NL80211_MCGRP_SCAN, GFP_KERNEL); 15760 } 15761 15762 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 15763 { 15764 struct sk_buff *msg; 15765 15766 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15767 if (!msg) 15768 return; 15769 15770 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 15771 nlmsg_free(msg); 15772 return; 15773 } 15774 15775 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 15776 NL80211_MCGRP_SCAN, GFP_KERNEL); 15777 } 15778 15779 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 15780 struct regulatory_request *request) 15781 { 15782 /* Userspace can always count this one always being set */ 15783 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 15784 goto nla_put_failure; 15785 15786 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 15787 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15788 NL80211_REGDOM_TYPE_WORLD)) 15789 goto nla_put_failure; 15790 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 15791 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15792 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 15793 goto nla_put_failure; 15794 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 15795 request->intersect) { 15796 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15797 NL80211_REGDOM_TYPE_INTERSECTION)) 15798 goto nla_put_failure; 15799 } else { 15800 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 15801 NL80211_REGDOM_TYPE_COUNTRY) || 15802 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 15803 request->alpha2)) 15804 goto nla_put_failure; 15805 } 15806 15807 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 15808 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 15809 15810 if (wiphy && 15811 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 15812 goto nla_put_failure; 15813 15814 if (wiphy && 15815 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 15816 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 15817 goto nla_put_failure; 15818 } 15819 15820 return true; 15821 15822 nla_put_failure: 15823 return false; 15824 } 15825 15826 /* 15827 * This can happen on global regulatory changes or device specific settings 15828 * based on custom regulatory domains. 15829 */ 15830 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 15831 struct regulatory_request *request) 15832 { 15833 struct sk_buff *msg; 15834 void *hdr; 15835 15836 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15837 if (!msg) 15838 return; 15839 15840 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 15841 if (!hdr) 15842 goto nla_put_failure; 15843 15844 if (!nl80211_reg_change_event_fill(msg, request)) 15845 goto nla_put_failure; 15846 15847 genlmsg_end(msg, hdr); 15848 15849 rcu_read_lock(); 15850 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 15851 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 15852 rcu_read_unlock(); 15853 15854 return; 15855 15856 nla_put_failure: 15857 nlmsg_free(msg); 15858 } 15859 15860 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 15861 struct net_device *netdev, 15862 const u8 *buf, size_t len, 15863 enum nl80211_commands cmd, gfp_t gfp, 15864 int uapsd_queues, const u8 *req_ies, 15865 size_t req_ies_len) 15866 { 15867 struct sk_buff *msg; 15868 void *hdr; 15869 15870 msg = nlmsg_new(100 + len + req_ies_len, gfp); 15871 if (!msg) 15872 return; 15873 15874 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15875 if (!hdr) { 15876 nlmsg_free(msg); 15877 return; 15878 } 15879 15880 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15881 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15882 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 15883 (req_ies && 15884 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies))) 15885 goto nla_put_failure; 15886 15887 if (uapsd_queues >= 0) { 15888 struct nlattr *nla_wmm = 15889 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 15890 if (!nla_wmm) 15891 goto nla_put_failure; 15892 15893 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 15894 uapsd_queues)) 15895 goto nla_put_failure; 15896 15897 nla_nest_end(msg, nla_wmm); 15898 } 15899 15900 genlmsg_end(msg, hdr); 15901 15902 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15903 NL80211_MCGRP_MLME, gfp); 15904 return; 15905 15906 nla_put_failure: 15907 nlmsg_free(msg); 15908 } 15909 15910 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 15911 struct net_device *netdev, const u8 *buf, 15912 size_t len, gfp_t gfp) 15913 { 15914 nl80211_send_mlme_event(rdev, netdev, buf, len, 15915 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0); 15916 } 15917 15918 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 15919 struct net_device *netdev, const u8 *buf, 15920 size_t len, gfp_t gfp, int uapsd_queues, 15921 const u8 *req_ies, size_t req_ies_len) 15922 { 15923 nl80211_send_mlme_event(rdev, netdev, buf, len, 15924 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues, 15925 req_ies, req_ies_len); 15926 } 15927 15928 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 15929 struct net_device *netdev, const u8 *buf, 15930 size_t len, gfp_t gfp) 15931 { 15932 nl80211_send_mlme_event(rdev, netdev, buf, len, 15933 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0); 15934 } 15935 15936 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 15937 struct net_device *netdev, const u8 *buf, 15938 size_t len, gfp_t gfp) 15939 { 15940 nl80211_send_mlme_event(rdev, netdev, buf, len, 15941 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0); 15942 } 15943 15944 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 15945 size_t len) 15946 { 15947 struct wireless_dev *wdev = dev->ieee80211_ptr; 15948 struct wiphy *wiphy = wdev->wiphy; 15949 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15950 const struct ieee80211_mgmt *mgmt = (void *)buf; 15951 u32 cmd; 15952 15953 if (WARN_ON(len < 2)) 15954 return; 15955 15956 if (ieee80211_is_deauth(mgmt->frame_control)) { 15957 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 15958 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 15959 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 15960 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 15961 if (wdev->unprot_beacon_reported && 15962 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 15963 return; 15964 cmd = NL80211_CMD_UNPROT_BEACON; 15965 wdev->unprot_beacon_reported = jiffies; 15966 } else { 15967 return; 15968 } 15969 15970 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 15971 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1, 15972 NULL, 0); 15973 } 15974 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 15975 15976 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 15977 struct net_device *netdev, int cmd, 15978 const u8 *addr, gfp_t gfp) 15979 { 15980 struct sk_buff *msg; 15981 void *hdr; 15982 15983 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15984 if (!msg) 15985 return; 15986 15987 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 15988 if (!hdr) { 15989 nlmsg_free(msg); 15990 return; 15991 } 15992 15993 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15994 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15995 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 15996 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 15997 goto nla_put_failure; 15998 15999 genlmsg_end(msg, hdr); 16000 16001 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16002 NL80211_MCGRP_MLME, gfp); 16003 return; 16004 16005 nla_put_failure: 16006 nlmsg_free(msg); 16007 } 16008 16009 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 16010 struct net_device *netdev, const u8 *addr, 16011 gfp_t gfp) 16012 { 16013 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 16014 addr, gfp); 16015 } 16016 16017 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 16018 struct net_device *netdev, const u8 *addr, 16019 gfp_t gfp) 16020 { 16021 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 16022 addr, gfp); 16023 } 16024 16025 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 16026 struct net_device *netdev, 16027 struct cfg80211_connect_resp_params *cr, 16028 gfp_t gfp) 16029 { 16030 struct sk_buff *msg; 16031 void *hdr; 16032 16033 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 16034 cr->fils.kek_len + cr->fils.pmk_len + 16035 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16036 if (!msg) 16037 return; 16038 16039 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 16040 if (!hdr) { 16041 nlmsg_free(msg); 16042 return; 16043 } 16044 16045 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16046 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16047 (cr->bssid && 16048 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 16049 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 16050 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 16051 cr->status) || 16052 (cr->status < 0 && 16053 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 16054 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 16055 cr->timeout_reason))) || 16056 (cr->req_ie && 16057 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 16058 (cr->resp_ie && 16059 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 16060 cr->resp_ie)) || 16061 (cr->fils.update_erp_next_seq_num && 16062 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16063 cr->fils.erp_next_seq_num)) || 16064 (cr->status == WLAN_STATUS_SUCCESS && 16065 ((cr->fils.kek && 16066 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 16067 cr->fils.kek)) || 16068 (cr->fils.pmk && 16069 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 16070 (cr->fils.pmkid && 16071 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 16072 goto nla_put_failure; 16073 16074 genlmsg_end(msg, hdr); 16075 16076 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16077 NL80211_MCGRP_MLME, gfp); 16078 return; 16079 16080 nla_put_failure: 16081 nlmsg_free(msg); 16082 } 16083 16084 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 16085 struct net_device *netdev, 16086 struct cfg80211_roam_info *info, gfp_t gfp) 16087 { 16088 struct sk_buff *msg; 16089 void *hdr; 16090 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 16091 16092 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 16093 info->fils.kek_len + info->fils.pmk_len + 16094 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 16095 if (!msg) 16096 return; 16097 16098 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 16099 if (!hdr) { 16100 nlmsg_free(msg); 16101 return; 16102 } 16103 16104 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16105 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16106 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 16107 (info->req_ie && 16108 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 16109 info->req_ie)) || 16110 (info->resp_ie && 16111 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 16112 info->resp_ie)) || 16113 (info->fils.update_erp_next_seq_num && 16114 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 16115 info->fils.erp_next_seq_num)) || 16116 (info->fils.kek && 16117 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 16118 info->fils.kek)) || 16119 (info->fils.pmk && 16120 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 16121 (info->fils.pmkid && 16122 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 16123 goto nla_put_failure; 16124 16125 genlmsg_end(msg, hdr); 16126 16127 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16128 NL80211_MCGRP_MLME, gfp); 16129 return; 16130 16131 nla_put_failure: 16132 nlmsg_free(msg); 16133 } 16134 16135 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 16136 struct net_device *netdev, const u8 *bssid) 16137 { 16138 struct sk_buff *msg; 16139 void *hdr; 16140 16141 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16142 if (!msg) 16143 return; 16144 16145 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 16146 if (!hdr) { 16147 nlmsg_free(msg); 16148 return; 16149 } 16150 16151 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16152 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16153 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16154 goto nla_put_failure; 16155 16156 genlmsg_end(msg, hdr); 16157 16158 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16159 NL80211_MCGRP_MLME, GFP_KERNEL); 16160 return; 16161 16162 nla_put_failure: 16163 nlmsg_free(msg); 16164 } 16165 16166 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 16167 struct net_device *netdev, u16 reason, 16168 const u8 *ie, size_t ie_len, bool from_ap) 16169 { 16170 struct sk_buff *msg; 16171 void *hdr; 16172 16173 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 16174 if (!msg) 16175 return; 16176 16177 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 16178 if (!hdr) { 16179 nlmsg_free(msg); 16180 return; 16181 } 16182 16183 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16184 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16185 (reason && 16186 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 16187 (from_ap && 16188 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 16189 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 16190 goto nla_put_failure; 16191 16192 genlmsg_end(msg, hdr); 16193 16194 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16195 NL80211_MCGRP_MLME, GFP_KERNEL); 16196 return; 16197 16198 nla_put_failure: 16199 nlmsg_free(msg); 16200 } 16201 16202 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 16203 struct net_device *netdev, const u8 *bssid, 16204 gfp_t gfp) 16205 { 16206 struct sk_buff *msg; 16207 void *hdr; 16208 16209 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16210 if (!msg) 16211 return; 16212 16213 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 16214 if (!hdr) { 16215 nlmsg_free(msg); 16216 return; 16217 } 16218 16219 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16220 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16221 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16222 goto nla_put_failure; 16223 16224 genlmsg_end(msg, hdr); 16225 16226 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16227 NL80211_MCGRP_MLME, gfp); 16228 return; 16229 16230 nla_put_failure: 16231 nlmsg_free(msg); 16232 } 16233 16234 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 16235 const u8 *ie, u8 ie_len, 16236 int sig_dbm, gfp_t gfp) 16237 { 16238 struct wireless_dev *wdev = dev->ieee80211_ptr; 16239 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16240 struct sk_buff *msg; 16241 void *hdr; 16242 16243 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 16244 return; 16245 16246 trace_cfg80211_notify_new_peer_candidate(dev, addr); 16247 16248 msg = nlmsg_new(100 + ie_len, gfp); 16249 if (!msg) 16250 return; 16251 16252 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 16253 if (!hdr) { 16254 nlmsg_free(msg); 16255 return; 16256 } 16257 16258 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16259 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16260 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16261 (ie_len && ie && 16262 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 16263 (sig_dbm && 16264 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 16265 goto nla_put_failure; 16266 16267 genlmsg_end(msg, hdr); 16268 16269 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16270 NL80211_MCGRP_MLME, gfp); 16271 return; 16272 16273 nla_put_failure: 16274 nlmsg_free(msg); 16275 } 16276 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 16277 16278 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 16279 struct net_device *netdev, const u8 *addr, 16280 enum nl80211_key_type key_type, int key_id, 16281 const u8 *tsc, gfp_t gfp) 16282 { 16283 struct sk_buff *msg; 16284 void *hdr; 16285 16286 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16287 if (!msg) 16288 return; 16289 16290 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 16291 if (!hdr) { 16292 nlmsg_free(msg); 16293 return; 16294 } 16295 16296 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16297 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16298 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 16299 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 16300 (key_id != -1 && 16301 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 16302 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 16303 goto nla_put_failure; 16304 16305 genlmsg_end(msg, hdr); 16306 16307 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16308 NL80211_MCGRP_MLME, gfp); 16309 return; 16310 16311 nla_put_failure: 16312 nlmsg_free(msg); 16313 } 16314 16315 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 16316 struct ieee80211_channel *channel_before, 16317 struct ieee80211_channel *channel_after) 16318 { 16319 struct sk_buff *msg; 16320 void *hdr; 16321 struct nlattr *nl_freq; 16322 16323 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 16324 if (!msg) 16325 return; 16326 16327 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 16328 if (!hdr) { 16329 nlmsg_free(msg); 16330 return; 16331 } 16332 16333 /* 16334 * Since we are applying the beacon hint to a wiphy we know its 16335 * wiphy_idx is valid 16336 */ 16337 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 16338 goto nla_put_failure; 16339 16340 /* Before */ 16341 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 16342 if (!nl_freq) 16343 goto nla_put_failure; 16344 16345 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 16346 goto nla_put_failure; 16347 nla_nest_end(msg, nl_freq); 16348 16349 /* After */ 16350 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 16351 if (!nl_freq) 16352 goto nla_put_failure; 16353 16354 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 16355 goto nla_put_failure; 16356 nla_nest_end(msg, nl_freq); 16357 16358 genlmsg_end(msg, hdr); 16359 16360 rcu_read_lock(); 16361 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 16362 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 16363 rcu_read_unlock(); 16364 16365 return; 16366 16367 nla_put_failure: 16368 nlmsg_free(msg); 16369 } 16370 16371 static void nl80211_send_remain_on_chan_event( 16372 int cmd, struct cfg80211_registered_device *rdev, 16373 struct wireless_dev *wdev, u64 cookie, 16374 struct ieee80211_channel *chan, 16375 unsigned int duration, gfp_t gfp) 16376 { 16377 struct sk_buff *msg; 16378 void *hdr; 16379 16380 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16381 if (!msg) 16382 return; 16383 16384 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16385 if (!hdr) { 16386 nlmsg_free(msg); 16387 return; 16388 } 16389 16390 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16391 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16392 wdev->netdev->ifindex)) || 16393 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16394 NL80211_ATTR_PAD) || 16395 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 16396 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 16397 NL80211_CHAN_NO_HT) || 16398 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16399 NL80211_ATTR_PAD)) 16400 goto nla_put_failure; 16401 16402 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 16403 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 16404 goto nla_put_failure; 16405 16406 genlmsg_end(msg, hdr); 16407 16408 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16409 NL80211_MCGRP_MLME, gfp); 16410 return; 16411 16412 nla_put_failure: 16413 nlmsg_free(msg); 16414 } 16415 16416 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 16417 struct ieee80211_channel *chan, 16418 unsigned int duration, gfp_t gfp) 16419 { 16420 struct wiphy *wiphy = wdev->wiphy; 16421 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16422 16423 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 16424 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 16425 rdev, wdev, cookie, chan, 16426 duration, gfp); 16427 } 16428 EXPORT_SYMBOL(cfg80211_ready_on_channel); 16429 16430 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 16431 struct ieee80211_channel *chan, 16432 gfp_t gfp) 16433 { 16434 struct wiphy *wiphy = wdev->wiphy; 16435 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16436 16437 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 16438 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 16439 rdev, wdev, cookie, chan, 0, gfp); 16440 } 16441 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 16442 16443 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 16444 struct ieee80211_channel *chan, 16445 gfp_t gfp) 16446 { 16447 struct wiphy *wiphy = wdev->wiphy; 16448 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16449 16450 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 16451 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 16452 rdev, wdev, cookie, chan, 0, gfp); 16453 } 16454 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 16455 16456 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 16457 struct station_info *sinfo, gfp_t gfp) 16458 { 16459 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16460 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16461 struct sk_buff *msg; 16462 16463 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 16464 16465 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16466 if (!msg) 16467 return; 16468 16469 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 16470 rdev, dev, mac_addr, sinfo) < 0) { 16471 nlmsg_free(msg); 16472 return; 16473 } 16474 16475 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16476 NL80211_MCGRP_MLME, gfp); 16477 } 16478 EXPORT_SYMBOL(cfg80211_new_sta); 16479 16480 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 16481 struct station_info *sinfo, gfp_t gfp) 16482 { 16483 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16484 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16485 struct sk_buff *msg; 16486 struct station_info empty_sinfo = {}; 16487 16488 if (!sinfo) 16489 sinfo = &empty_sinfo; 16490 16491 trace_cfg80211_del_sta(dev, mac_addr); 16492 16493 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16494 if (!msg) { 16495 cfg80211_sinfo_release_content(sinfo); 16496 return; 16497 } 16498 16499 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 16500 rdev, dev, mac_addr, sinfo) < 0) { 16501 nlmsg_free(msg); 16502 return; 16503 } 16504 16505 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16506 NL80211_MCGRP_MLME, gfp); 16507 } 16508 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 16509 16510 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 16511 enum nl80211_connect_failed_reason reason, 16512 gfp_t gfp) 16513 { 16514 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 16515 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16516 struct sk_buff *msg; 16517 void *hdr; 16518 16519 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 16520 if (!msg) 16521 return; 16522 16523 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 16524 if (!hdr) { 16525 nlmsg_free(msg); 16526 return; 16527 } 16528 16529 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16530 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 16531 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 16532 goto nla_put_failure; 16533 16534 genlmsg_end(msg, hdr); 16535 16536 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16537 NL80211_MCGRP_MLME, gfp); 16538 return; 16539 16540 nla_put_failure: 16541 nlmsg_free(msg); 16542 } 16543 EXPORT_SYMBOL(cfg80211_conn_failed); 16544 16545 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 16546 const u8 *addr, gfp_t gfp) 16547 { 16548 struct wireless_dev *wdev = dev->ieee80211_ptr; 16549 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16550 struct sk_buff *msg; 16551 void *hdr; 16552 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 16553 16554 if (!nlportid) 16555 return false; 16556 16557 msg = nlmsg_new(100, gfp); 16558 if (!msg) 16559 return true; 16560 16561 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 16562 if (!hdr) { 16563 nlmsg_free(msg); 16564 return true; 16565 } 16566 16567 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16568 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16569 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 16570 goto nla_put_failure; 16571 16572 genlmsg_end(msg, hdr); 16573 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16574 return true; 16575 16576 nla_put_failure: 16577 nlmsg_free(msg); 16578 return true; 16579 } 16580 16581 bool cfg80211_rx_spurious_frame(struct net_device *dev, 16582 const u8 *addr, gfp_t gfp) 16583 { 16584 struct wireless_dev *wdev = dev->ieee80211_ptr; 16585 bool ret; 16586 16587 trace_cfg80211_rx_spurious_frame(dev, addr); 16588 16589 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16590 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 16591 trace_cfg80211_return_bool(false); 16592 return false; 16593 } 16594 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 16595 addr, gfp); 16596 trace_cfg80211_return_bool(ret); 16597 return ret; 16598 } 16599 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 16600 16601 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 16602 const u8 *addr, gfp_t gfp) 16603 { 16604 struct wireless_dev *wdev = dev->ieee80211_ptr; 16605 bool ret; 16606 16607 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 16608 16609 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 16610 wdev->iftype != NL80211_IFTYPE_P2P_GO && 16611 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 16612 trace_cfg80211_return_bool(false); 16613 return false; 16614 } 16615 ret = __nl80211_unexpected_frame(dev, 16616 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 16617 addr, gfp); 16618 trace_cfg80211_return_bool(ret); 16619 return ret; 16620 } 16621 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 16622 16623 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 16624 struct wireless_dev *wdev, u32 nlportid, 16625 int freq, int sig_dbm, 16626 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 16627 { 16628 struct net_device *netdev = wdev->netdev; 16629 struct sk_buff *msg; 16630 void *hdr; 16631 16632 msg = nlmsg_new(100 + len, gfp); 16633 if (!msg) 16634 return -ENOMEM; 16635 16636 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 16637 if (!hdr) { 16638 nlmsg_free(msg); 16639 return -ENOMEM; 16640 } 16641 16642 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16643 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16644 netdev->ifindex)) || 16645 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16646 NL80211_ATTR_PAD) || 16647 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) || 16648 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) || 16649 (sig_dbm && 16650 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 16651 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16652 (flags && 16653 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 16654 goto nla_put_failure; 16655 16656 genlmsg_end(msg, hdr); 16657 16658 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16659 16660 nla_put_failure: 16661 nlmsg_free(msg); 16662 return -ENOBUFS; 16663 } 16664 16665 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie, 16666 const u8 *buf, size_t len, bool ack, 16667 gfp_t gfp, enum nl80211_commands command) 16668 { 16669 struct wiphy *wiphy = wdev->wiphy; 16670 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16671 struct net_device *netdev = wdev->netdev; 16672 struct sk_buff *msg; 16673 void *hdr; 16674 16675 if (command == NL80211_CMD_FRAME_TX_STATUS) 16676 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 16677 else 16678 trace_cfg80211_control_port_tx_status(wdev, cookie, ack); 16679 16680 msg = nlmsg_new(100 + len, gfp); 16681 if (!msg) 16682 return; 16683 16684 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 16685 if (!hdr) { 16686 nlmsg_free(msg); 16687 return; 16688 } 16689 16690 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16691 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 16692 netdev->ifindex)) || 16693 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16694 NL80211_ATTR_PAD) || 16695 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 16696 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 16697 NL80211_ATTR_PAD) || 16698 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 16699 goto nla_put_failure; 16700 16701 genlmsg_end(msg, hdr); 16702 16703 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16704 NL80211_MCGRP_MLME, gfp); 16705 return; 16706 16707 nla_put_failure: 16708 nlmsg_free(msg); 16709 } 16710 16711 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 16712 const u8 *buf, size_t len, bool ack, 16713 gfp_t gfp) 16714 { 16715 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16716 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 16717 } 16718 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 16719 16720 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 16721 const u8 *buf, size_t len, bool ack, gfp_t gfp) 16722 { 16723 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp, 16724 NL80211_CMD_FRAME_TX_STATUS); 16725 } 16726 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 16727 16728 static int __nl80211_rx_control_port(struct net_device *dev, 16729 struct sk_buff *skb, 16730 bool unencrypted, gfp_t gfp) 16731 { 16732 struct wireless_dev *wdev = dev->ieee80211_ptr; 16733 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16734 struct ethhdr *ehdr = eth_hdr(skb); 16735 const u8 *addr = ehdr->h_source; 16736 u16 proto = be16_to_cpu(skb->protocol); 16737 struct sk_buff *msg; 16738 void *hdr; 16739 struct nlattr *frame; 16740 16741 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 16742 16743 if (!nlportid) 16744 return -ENOENT; 16745 16746 msg = nlmsg_new(100 + skb->len, gfp); 16747 if (!msg) 16748 return -ENOMEM; 16749 16750 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 16751 if (!hdr) { 16752 nlmsg_free(msg); 16753 return -ENOBUFS; 16754 } 16755 16756 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16757 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16758 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16759 NL80211_ATTR_PAD) || 16760 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 16761 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 16762 (unencrypted && nla_put_flag(msg, 16763 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 16764 goto nla_put_failure; 16765 16766 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 16767 if (!frame) 16768 goto nla_put_failure; 16769 16770 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 16771 genlmsg_end(msg, hdr); 16772 16773 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16774 16775 nla_put_failure: 16776 nlmsg_free(msg); 16777 return -ENOBUFS; 16778 } 16779 16780 bool cfg80211_rx_control_port(struct net_device *dev, 16781 struct sk_buff *skb, bool unencrypted) 16782 { 16783 int ret; 16784 16785 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 16786 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 16787 trace_cfg80211_return_bool(ret == 0); 16788 return ret == 0; 16789 } 16790 EXPORT_SYMBOL(cfg80211_rx_control_port); 16791 16792 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 16793 const char *mac, gfp_t gfp) 16794 { 16795 struct wireless_dev *wdev = dev->ieee80211_ptr; 16796 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16797 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16798 void **cb; 16799 16800 if (!msg) 16801 return NULL; 16802 16803 cb = (void **)msg->cb; 16804 16805 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 16806 if (!cb[0]) { 16807 nlmsg_free(msg); 16808 return NULL; 16809 } 16810 16811 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16812 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 16813 goto nla_put_failure; 16814 16815 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 16816 goto nla_put_failure; 16817 16818 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 16819 if (!cb[1]) 16820 goto nla_put_failure; 16821 16822 cb[2] = rdev; 16823 16824 return msg; 16825 nla_put_failure: 16826 nlmsg_free(msg); 16827 return NULL; 16828 } 16829 16830 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 16831 { 16832 void **cb = (void **)msg->cb; 16833 struct cfg80211_registered_device *rdev = cb[2]; 16834 16835 nla_nest_end(msg, cb[1]); 16836 genlmsg_end(msg, cb[0]); 16837 16838 memset(msg->cb, 0, sizeof(msg->cb)); 16839 16840 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16841 NL80211_MCGRP_MLME, gfp); 16842 } 16843 16844 void cfg80211_cqm_rssi_notify(struct net_device *dev, 16845 enum nl80211_cqm_rssi_threshold_event rssi_event, 16846 s32 rssi_level, gfp_t gfp) 16847 { 16848 struct sk_buff *msg; 16849 struct wireless_dev *wdev = dev->ieee80211_ptr; 16850 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16851 16852 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 16853 16854 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 16855 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 16856 return; 16857 16858 if (wdev->cqm_config) { 16859 wdev->cqm_config->last_rssi_event_value = rssi_level; 16860 16861 cfg80211_cqm_rssi_update(rdev, dev); 16862 16863 if (rssi_level == 0) 16864 rssi_level = wdev->cqm_config->last_rssi_event_value; 16865 } 16866 16867 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16868 if (!msg) 16869 return; 16870 16871 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 16872 rssi_event)) 16873 goto nla_put_failure; 16874 16875 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 16876 rssi_level)) 16877 goto nla_put_failure; 16878 16879 cfg80211_send_cqm(msg, gfp); 16880 16881 return; 16882 16883 nla_put_failure: 16884 nlmsg_free(msg); 16885 } 16886 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 16887 16888 void cfg80211_cqm_txe_notify(struct net_device *dev, 16889 const u8 *peer, u32 num_packets, 16890 u32 rate, u32 intvl, gfp_t gfp) 16891 { 16892 struct sk_buff *msg; 16893 16894 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16895 if (!msg) 16896 return; 16897 16898 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 16899 goto nla_put_failure; 16900 16901 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 16902 goto nla_put_failure; 16903 16904 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 16905 goto nla_put_failure; 16906 16907 cfg80211_send_cqm(msg, gfp); 16908 return; 16909 16910 nla_put_failure: 16911 nlmsg_free(msg); 16912 } 16913 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 16914 16915 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 16916 const u8 *peer, u32 num_packets, gfp_t gfp) 16917 { 16918 struct sk_buff *msg; 16919 16920 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 16921 16922 msg = cfg80211_prepare_cqm(dev, peer, gfp); 16923 if (!msg) 16924 return; 16925 16926 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 16927 goto nla_put_failure; 16928 16929 cfg80211_send_cqm(msg, gfp); 16930 return; 16931 16932 nla_put_failure: 16933 nlmsg_free(msg); 16934 } 16935 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 16936 16937 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 16938 { 16939 struct sk_buff *msg; 16940 16941 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 16942 if (!msg) 16943 return; 16944 16945 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 16946 goto nla_put_failure; 16947 16948 cfg80211_send_cqm(msg, gfp); 16949 return; 16950 16951 nla_put_failure: 16952 nlmsg_free(msg); 16953 } 16954 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 16955 16956 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 16957 struct net_device *netdev, const u8 *bssid, 16958 const u8 *replay_ctr, gfp_t gfp) 16959 { 16960 struct sk_buff *msg; 16961 struct nlattr *rekey_attr; 16962 void *hdr; 16963 16964 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16965 if (!msg) 16966 return; 16967 16968 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 16969 if (!hdr) { 16970 nlmsg_free(msg); 16971 return; 16972 } 16973 16974 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16975 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 16976 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 16977 goto nla_put_failure; 16978 16979 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 16980 if (!rekey_attr) 16981 goto nla_put_failure; 16982 16983 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 16984 NL80211_REPLAY_CTR_LEN, replay_ctr)) 16985 goto nla_put_failure; 16986 16987 nla_nest_end(msg, rekey_attr); 16988 16989 genlmsg_end(msg, hdr); 16990 16991 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 16992 NL80211_MCGRP_MLME, gfp); 16993 return; 16994 16995 nla_put_failure: 16996 nlmsg_free(msg); 16997 } 16998 16999 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 17000 const u8 *replay_ctr, gfp_t gfp) 17001 { 17002 struct wireless_dev *wdev = dev->ieee80211_ptr; 17003 struct wiphy *wiphy = wdev->wiphy; 17004 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17005 17006 trace_cfg80211_gtk_rekey_notify(dev, bssid); 17007 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 17008 } 17009 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 17010 17011 static void 17012 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 17013 struct net_device *netdev, int index, 17014 const u8 *bssid, bool preauth, gfp_t gfp) 17015 { 17016 struct sk_buff *msg; 17017 struct nlattr *attr; 17018 void *hdr; 17019 17020 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17021 if (!msg) 17022 return; 17023 17024 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 17025 if (!hdr) { 17026 nlmsg_free(msg); 17027 return; 17028 } 17029 17030 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17031 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17032 goto nla_put_failure; 17033 17034 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 17035 if (!attr) 17036 goto nla_put_failure; 17037 17038 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 17039 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 17040 (preauth && 17041 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 17042 goto nla_put_failure; 17043 17044 nla_nest_end(msg, attr); 17045 17046 genlmsg_end(msg, hdr); 17047 17048 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17049 NL80211_MCGRP_MLME, gfp); 17050 return; 17051 17052 nla_put_failure: 17053 nlmsg_free(msg); 17054 } 17055 17056 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 17057 const u8 *bssid, bool preauth, gfp_t gfp) 17058 { 17059 struct wireless_dev *wdev = dev->ieee80211_ptr; 17060 struct wiphy *wiphy = wdev->wiphy; 17061 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17062 17063 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 17064 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 17065 } 17066 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 17067 17068 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 17069 struct net_device *netdev, 17070 struct cfg80211_chan_def *chandef, 17071 gfp_t gfp, 17072 enum nl80211_commands notif, 17073 u8 count) 17074 { 17075 struct sk_buff *msg; 17076 void *hdr; 17077 17078 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17079 if (!msg) 17080 return; 17081 17082 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 17083 if (!hdr) { 17084 nlmsg_free(msg); 17085 return; 17086 } 17087 17088 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 17089 goto nla_put_failure; 17090 17091 if (nl80211_send_chandef(msg, chandef)) 17092 goto nla_put_failure; 17093 17094 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 17095 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 17096 goto nla_put_failure; 17097 17098 genlmsg_end(msg, hdr); 17099 17100 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17101 NL80211_MCGRP_MLME, gfp); 17102 return; 17103 17104 nla_put_failure: 17105 nlmsg_free(msg); 17106 } 17107 17108 void cfg80211_ch_switch_notify(struct net_device *dev, 17109 struct cfg80211_chan_def *chandef) 17110 { 17111 struct wireless_dev *wdev = dev->ieee80211_ptr; 17112 struct wiphy *wiphy = wdev->wiphy; 17113 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17114 17115 ASSERT_WDEV_LOCK(wdev); 17116 17117 trace_cfg80211_ch_switch_notify(dev, chandef); 17118 17119 wdev->chandef = *chandef; 17120 wdev->preset_chandef = *chandef; 17121 17122 if (wdev->iftype == NL80211_IFTYPE_STATION && 17123 !WARN_ON(!wdev->current_bss)) 17124 cfg80211_update_assoc_bss_entry(wdev, chandef->chan); 17125 17126 cfg80211_sched_dfs_chan_update(rdev); 17127 17128 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17129 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 17130 } 17131 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 17132 17133 void cfg80211_ch_switch_started_notify(struct net_device *dev, 17134 struct cfg80211_chan_def *chandef, 17135 u8 count) 17136 { 17137 struct wireless_dev *wdev = dev->ieee80211_ptr; 17138 struct wiphy *wiphy = wdev->wiphy; 17139 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17140 17141 trace_cfg80211_ch_switch_started_notify(dev, chandef); 17142 17143 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 17144 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 17145 } 17146 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 17147 17148 void 17149 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 17150 const struct cfg80211_chan_def *chandef, 17151 enum nl80211_radar_event event, 17152 struct net_device *netdev, gfp_t gfp) 17153 { 17154 struct sk_buff *msg; 17155 void *hdr; 17156 17157 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17158 if (!msg) 17159 return; 17160 17161 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 17162 if (!hdr) { 17163 nlmsg_free(msg); 17164 return; 17165 } 17166 17167 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17168 goto nla_put_failure; 17169 17170 /* NOP and radar events don't need a netdev parameter */ 17171 if (netdev) { 17172 struct wireless_dev *wdev = netdev->ieee80211_ptr; 17173 17174 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17175 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17176 NL80211_ATTR_PAD)) 17177 goto nla_put_failure; 17178 } 17179 17180 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 17181 goto nla_put_failure; 17182 17183 if (nl80211_send_chandef(msg, chandef)) 17184 goto nla_put_failure; 17185 17186 genlmsg_end(msg, hdr); 17187 17188 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17189 NL80211_MCGRP_MLME, gfp); 17190 return; 17191 17192 nla_put_failure: 17193 nlmsg_free(msg); 17194 } 17195 17196 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 17197 struct sta_opmode_info *sta_opmode, 17198 gfp_t gfp) 17199 { 17200 struct sk_buff *msg; 17201 struct wireless_dev *wdev = dev->ieee80211_ptr; 17202 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17203 void *hdr; 17204 17205 if (WARN_ON(!mac)) 17206 return; 17207 17208 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17209 if (!msg) 17210 return; 17211 17212 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 17213 if (!hdr) { 17214 nlmsg_free(msg); 17215 return; 17216 } 17217 17218 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 17219 goto nla_put_failure; 17220 17221 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 17222 goto nla_put_failure; 17223 17224 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 17225 goto nla_put_failure; 17226 17227 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 17228 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 17229 goto nla_put_failure; 17230 17231 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 17232 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 17233 goto nla_put_failure; 17234 17235 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 17236 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 17237 goto nla_put_failure; 17238 17239 genlmsg_end(msg, hdr); 17240 17241 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17242 NL80211_MCGRP_MLME, gfp); 17243 17244 return; 17245 17246 nla_put_failure: 17247 nlmsg_free(msg); 17248 } 17249 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 17250 17251 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 17252 u64 cookie, bool acked, s32 ack_signal, 17253 bool is_valid_ack_signal, gfp_t gfp) 17254 { 17255 struct wireless_dev *wdev = dev->ieee80211_ptr; 17256 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17257 struct sk_buff *msg; 17258 void *hdr; 17259 17260 trace_cfg80211_probe_status(dev, addr, cookie, acked); 17261 17262 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17263 17264 if (!msg) 17265 return; 17266 17267 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 17268 if (!hdr) { 17269 nlmsg_free(msg); 17270 return; 17271 } 17272 17273 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17274 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17275 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 17276 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 17277 NL80211_ATTR_PAD) || 17278 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 17279 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 17280 ack_signal))) 17281 goto nla_put_failure; 17282 17283 genlmsg_end(msg, hdr); 17284 17285 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17286 NL80211_MCGRP_MLME, gfp); 17287 return; 17288 17289 nla_put_failure: 17290 nlmsg_free(msg); 17291 } 17292 EXPORT_SYMBOL(cfg80211_probe_status); 17293 17294 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 17295 size_t len, int freq, int sig_dbm) 17296 { 17297 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17298 struct sk_buff *msg; 17299 void *hdr; 17300 struct cfg80211_beacon_registration *reg; 17301 17302 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 17303 17304 spin_lock_bh(&rdev->beacon_registrations_lock); 17305 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 17306 msg = nlmsg_new(len + 100, GFP_ATOMIC); 17307 if (!msg) { 17308 spin_unlock_bh(&rdev->beacon_registrations_lock); 17309 return; 17310 } 17311 17312 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 17313 if (!hdr) 17314 goto nla_put_failure; 17315 17316 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17317 (freq && 17318 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 17319 KHZ_TO_MHZ(freq)) || 17320 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 17321 freq % 1000))) || 17322 (sig_dbm && 17323 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 17324 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 17325 goto nla_put_failure; 17326 17327 genlmsg_end(msg, hdr); 17328 17329 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 17330 } 17331 spin_unlock_bh(&rdev->beacon_registrations_lock); 17332 return; 17333 17334 nla_put_failure: 17335 spin_unlock_bh(&rdev->beacon_registrations_lock); 17336 nlmsg_free(msg); 17337 } 17338 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 17339 17340 #ifdef CONFIG_PM 17341 static int cfg80211_net_detect_results(struct sk_buff *msg, 17342 struct cfg80211_wowlan_wakeup *wakeup) 17343 { 17344 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 17345 struct nlattr *nl_results, *nl_match, *nl_freqs; 17346 int i, j; 17347 17348 nl_results = nla_nest_start_noflag(msg, 17349 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 17350 if (!nl_results) 17351 return -EMSGSIZE; 17352 17353 for (i = 0; i < nd->n_matches; i++) { 17354 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 17355 17356 nl_match = nla_nest_start_noflag(msg, i); 17357 if (!nl_match) 17358 break; 17359 17360 /* The SSID attribute is optional in nl80211, but for 17361 * simplicity reasons it's always present in the 17362 * cfg80211 structure. If a driver can't pass the 17363 * SSID, that needs to be changed. A zero length SSID 17364 * is still a valid SSID (wildcard), so it cannot be 17365 * used for this purpose. 17366 */ 17367 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 17368 match->ssid.ssid)) { 17369 nla_nest_cancel(msg, nl_match); 17370 goto out; 17371 } 17372 17373 if (match->n_channels) { 17374 nl_freqs = nla_nest_start_noflag(msg, 17375 NL80211_ATTR_SCAN_FREQUENCIES); 17376 if (!nl_freqs) { 17377 nla_nest_cancel(msg, nl_match); 17378 goto out; 17379 } 17380 17381 for (j = 0; j < match->n_channels; j++) { 17382 if (nla_put_u32(msg, j, match->channels[j])) { 17383 nla_nest_cancel(msg, nl_freqs); 17384 nla_nest_cancel(msg, nl_match); 17385 goto out; 17386 } 17387 } 17388 17389 nla_nest_end(msg, nl_freqs); 17390 } 17391 17392 nla_nest_end(msg, nl_match); 17393 } 17394 17395 out: 17396 nla_nest_end(msg, nl_results); 17397 return 0; 17398 } 17399 17400 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 17401 struct cfg80211_wowlan_wakeup *wakeup, 17402 gfp_t gfp) 17403 { 17404 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17405 struct sk_buff *msg; 17406 void *hdr; 17407 int size = 200; 17408 17409 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 17410 17411 if (wakeup) 17412 size += wakeup->packet_present_len; 17413 17414 msg = nlmsg_new(size, gfp); 17415 if (!msg) 17416 return; 17417 17418 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 17419 if (!hdr) 17420 goto free_msg; 17421 17422 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17423 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17424 NL80211_ATTR_PAD)) 17425 goto free_msg; 17426 17427 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17428 wdev->netdev->ifindex)) 17429 goto free_msg; 17430 17431 if (wakeup) { 17432 struct nlattr *reasons; 17433 17434 reasons = nla_nest_start_noflag(msg, 17435 NL80211_ATTR_WOWLAN_TRIGGERS); 17436 if (!reasons) 17437 goto free_msg; 17438 17439 if (wakeup->disconnect && 17440 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 17441 goto free_msg; 17442 if (wakeup->magic_pkt && 17443 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 17444 goto free_msg; 17445 if (wakeup->gtk_rekey_failure && 17446 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 17447 goto free_msg; 17448 if (wakeup->eap_identity_req && 17449 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 17450 goto free_msg; 17451 if (wakeup->four_way_handshake && 17452 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 17453 goto free_msg; 17454 if (wakeup->rfkill_release && 17455 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 17456 goto free_msg; 17457 17458 if (wakeup->pattern_idx >= 0 && 17459 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 17460 wakeup->pattern_idx)) 17461 goto free_msg; 17462 17463 if (wakeup->tcp_match && 17464 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 17465 goto free_msg; 17466 17467 if (wakeup->tcp_connlost && 17468 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 17469 goto free_msg; 17470 17471 if (wakeup->tcp_nomoretokens && 17472 nla_put_flag(msg, 17473 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 17474 goto free_msg; 17475 17476 if (wakeup->packet) { 17477 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 17478 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 17479 17480 if (!wakeup->packet_80211) { 17481 pkt_attr = 17482 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 17483 len_attr = 17484 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 17485 } 17486 17487 if (wakeup->packet_len && 17488 nla_put_u32(msg, len_attr, wakeup->packet_len)) 17489 goto free_msg; 17490 17491 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 17492 wakeup->packet)) 17493 goto free_msg; 17494 } 17495 17496 if (wakeup->net_detect && 17497 cfg80211_net_detect_results(msg, wakeup)) 17498 goto free_msg; 17499 17500 nla_nest_end(msg, reasons); 17501 } 17502 17503 genlmsg_end(msg, hdr); 17504 17505 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17506 NL80211_MCGRP_MLME, gfp); 17507 return; 17508 17509 free_msg: 17510 nlmsg_free(msg); 17511 } 17512 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 17513 #endif 17514 17515 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 17516 enum nl80211_tdls_operation oper, 17517 u16 reason_code, gfp_t gfp) 17518 { 17519 struct wireless_dev *wdev = dev->ieee80211_ptr; 17520 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17521 struct sk_buff *msg; 17522 void *hdr; 17523 17524 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 17525 reason_code); 17526 17527 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17528 if (!msg) 17529 return; 17530 17531 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 17532 if (!hdr) { 17533 nlmsg_free(msg); 17534 return; 17535 } 17536 17537 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17538 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17539 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 17540 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 17541 (reason_code > 0 && 17542 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 17543 goto nla_put_failure; 17544 17545 genlmsg_end(msg, hdr); 17546 17547 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17548 NL80211_MCGRP_MLME, gfp); 17549 return; 17550 17551 nla_put_failure: 17552 nlmsg_free(msg); 17553 } 17554 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 17555 17556 static int nl80211_netlink_notify(struct notifier_block * nb, 17557 unsigned long state, 17558 void *_notify) 17559 { 17560 struct netlink_notify *notify = _notify; 17561 struct cfg80211_registered_device *rdev; 17562 struct wireless_dev *wdev; 17563 struct cfg80211_beacon_registration *reg, *tmp; 17564 17565 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 17566 return NOTIFY_DONE; 17567 17568 rcu_read_lock(); 17569 17570 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 17571 struct cfg80211_sched_scan_request *sched_scan_req; 17572 17573 list_for_each_entry_rcu(sched_scan_req, 17574 &rdev->sched_scan_req_list, 17575 list) { 17576 if (sched_scan_req->owner_nlportid == notify->portid) { 17577 sched_scan_req->nl_owner_dead = true; 17578 schedule_work(&rdev->sched_scan_stop_wk); 17579 } 17580 } 17581 17582 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 17583 cfg80211_mlme_unregister_socket(wdev, notify->portid); 17584 17585 if (wdev->owner_nlportid == notify->portid) { 17586 wdev->nl_owner_dead = true; 17587 schedule_work(&rdev->destroy_work); 17588 } else if (wdev->conn_owner_nlportid == notify->portid) { 17589 schedule_work(&wdev->disconnect_wk); 17590 } 17591 17592 cfg80211_release_pmsr(wdev, notify->portid); 17593 } 17594 17595 spin_lock_bh(&rdev->beacon_registrations_lock); 17596 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 17597 list) { 17598 if (reg->nlportid == notify->portid) { 17599 list_del(®->list); 17600 kfree(reg); 17601 break; 17602 } 17603 } 17604 spin_unlock_bh(&rdev->beacon_registrations_lock); 17605 } 17606 17607 rcu_read_unlock(); 17608 17609 /* 17610 * It is possible that the user space process that is controlling the 17611 * indoor setting disappeared, so notify the regulatory core. 17612 */ 17613 regulatory_netlink_notify(notify->portid); 17614 return NOTIFY_OK; 17615 } 17616 17617 static struct notifier_block nl80211_netlink_notifier = { 17618 .notifier_call = nl80211_netlink_notify, 17619 }; 17620 17621 void cfg80211_ft_event(struct net_device *netdev, 17622 struct cfg80211_ft_event_params *ft_event) 17623 { 17624 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17625 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17626 struct sk_buff *msg; 17627 void *hdr; 17628 17629 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 17630 17631 if (!ft_event->target_ap) 17632 return; 17633 17634 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 17635 GFP_KERNEL); 17636 if (!msg) 17637 return; 17638 17639 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 17640 if (!hdr) 17641 goto out; 17642 17643 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17644 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17645 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 17646 goto out; 17647 17648 if (ft_event->ies && 17649 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 17650 goto out; 17651 if (ft_event->ric_ies && 17652 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 17653 ft_event->ric_ies)) 17654 goto out; 17655 17656 genlmsg_end(msg, hdr); 17657 17658 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17659 NL80211_MCGRP_MLME, GFP_KERNEL); 17660 return; 17661 out: 17662 nlmsg_free(msg); 17663 } 17664 EXPORT_SYMBOL(cfg80211_ft_event); 17665 17666 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 17667 { 17668 struct cfg80211_registered_device *rdev; 17669 struct sk_buff *msg; 17670 void *hdr; 17671 u32 nlportid; 17672 17673 rdev = wiphy_to_rdev(wdev->wiphy); 17674 if (!rdev->crit_proto_nlportid) 17675 return; 17676 17677 nlportid = rdev->crit_proto_nlportid; 17678 rdev->crit_proto_nlportid = 0; 17679 17680 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17681 if (!msg) 17682 return; 17683 17684 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 17685 if (!hdr) 17686 goto nla_put_failure; 17687 17688 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17689 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17690 NL80211_ATTR_PAD)) 17691 goto nla_put_failure; 17692 17693 genlmsg_end(msg, hdr); 17694 17695 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 17696 return; 17697 17698 nla_put_failure: 17699 nlmsg_free(msg); 17700 } 17701 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 17702 17703 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 17704 { 17705 struct wiphy *wiphy = wdev->wiphy; 17706 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17707 struct sk_buff *msg; 17708 void *hdr; 17709 17710 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17711 if (!msg) 17712 return; 17713 17714 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 17715 if (!hdr) 17716 goto out; 17717 17718 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17719 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 17720 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17721 NL80211_ATTR_PAD)) 17722 goto out; 17723 17724 genlmsg_end(msg, hdr); 17725 17726 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 17727 NL80211_MCGRP_MLME, GFP_KERNEL); 17728 return; 17729 out: 17730 nlmsg_free(msg); 17731 } 17732 17733 int cfg80211_external_auth_request(struct net_device *dev, 17734 struct cfg80211_external_auth_params *params, 17735 gfp_t gfp) 17736 { 17737 struct wireless_dev *wdev = dev->ieee80211_ptr; 17738 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 17739 struct sk_buff *msg; 17740 void *hdr; 17741 17742 if (!wdev->conn_owner_nlportid) 17743 return -EINVAL; 17744 17745 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17746 if (!msg) 17747 return -ENOMEM; 17748 17749 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 17750 if (!hdr) 17751 goto nla_put_failure; 17752 17753 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17754 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 17755 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 17756 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 17757 params->action) || 17758 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 17759 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 17760 params->ssid.ssid)) 17761 goto nla_put_failure; 17762 17763 genlmsg_end(msg, hdr); 17764 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 17765 wdev->conn_owner_nlportid); 17766 return 0; 17767 17768 nla_put_failure: 17769 nlmsg_free(msg); 17770 return -ENOBUFS; 17771 } 17772 EXPORT_SYMBOL(cfg80211_external_auth_request); 17773 17774 void cfg80211_update_owe_info_event(struct net_device *netdev, 17775 struct cfg80211_update_owe_info *owe_info, 17776 gfp_t gfp) 17777 { 17778 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 17779 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 17780 struct sk_buff *msg; 17781 void *hdr; 17782 17783 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 17784 17785 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 17786 if (!msg) 17787 return; 17788 17789 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 17790 if (!hdr) 17791 goto nla_put_failure; 17792 17793 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17794 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17795 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 17796 goto nla_put_failure; 17797 17798 if (!owe_info->ie_len || 17799 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 17800 goto nla_put_failure; 17801 17802 genlmsg_end(msg, hdr); 17803 17804 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17805 NL80211_MCGRP_MLME, gfp); 17806 return; 17807 17808 nla_put_failure: 17809 genlmsg_cancel(msg, hdr); 17810 nlmsg_free(msg); 17811 } 17812 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 17813 17814 /* initialisation/exit functions */ 17815 17816 int __init nl80211_init(void) 17817 { 17818 int err; 17819 17820 err = genl_register_family(&nl80211_fam); 17821 if (err) 17822 return err; 17823 17824 err = netlink_register_notifier(&nl80211_netlink_notifier); 17825 if (err) 17826 goto err_out; 17827 17828 return 0; 17829 err_out: 17830 genl_unregister_family(&nl80211_fam); 17831 return err; 17832 } 17833 17834 void nl80211_exit(void) 17835 { 17836 netlink_unregister_notifier(&nl80211_netlink_notifier); 17837 genl_unregister_family(&nl80211_fam); 17838 } 17839