1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is the new netlink-based wireless configuration interface. 4 * 5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright 2015-2017 Intel Deutschland GmbH 8 * Copyright (C) 2018-2023 Intel Corporation 9 */ 10 11 #include <linux/if.h> 12 #include <linux/module.h> 13 #include <linux/err.h> 14 #include <linux/slab.h> 15 #include <linux/list.h> 16 #include <linux/if_ether.h> 17 #include <linux/ieee80211.h> 18 #include <linux/nl80211.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/netlink.h> 21 #include <linux/nospec.h> 22 #include <linux/etherdevice.h> 23 #include <linux/if_vlan.h> 24 #include <net/net_namespace.h> 25 #include <net/genetlink.h> 26 #include <net/cfg80211.h> 27 #include <net/sock.h> 28 #include <net/inet_connection_sock.h> 29 #include "core.h" 30 #include "nl80211.h" 31 #include "reg.h" 32 #include "rdev-ops.h" 33 34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 35 struct genl_info *info, 36 struct cfg80211_crypto_settings *settings, 37 int cipher_limit); 38 39 /* the netlink family */ 40 static struct genl_family nl80211_fam; 41 42 /* multicast groups */ 43 enum nl80211_multicast_groups { 44 NL80211_MCGRP_CONFIG, 45 NL80211_MCGRP_SCAN, 46 NL80211_MCGRP_REGULATORY, 47 NL80211_MCGRP_MLME, 48 NL80211_MCGRP_VENDOR, 49 NL80211_MCGRP_NAN, 50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 51 }; 52 53 static const struct genl_multicast_group nl80211_mcgrps[] = { 54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 60 #ifdef CONFIG_NL80211_TESTMODE 61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 62 #endif 63 }; 64 65 /* returns ERR_PTR values */ 66 static struct wireless_dev * 67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev, 68 struct net *netns, struct nlattr **attrs) 69 { 70 struct wireless_dev *result = NULL; 71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 73 u64 wdev_id = 0; 74 int wiphy_idx = -1; 75 int ifidx = -1; 76 77 if (!have_ifidx && !have_wdev_id) 78 return ERR_PTR(-EINVAL); 79 80 if (have_ifidx) 81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 82 if (have_wdev_id) { 83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 84 wiphy_idx = wdev_id >> 32; 85 } 86 87 if (rdev) { 88 struct wireless_dev *wdev; 89 90 lockdep_assert_held(&rdev->wiphy.mtx); 91 92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 93 if (have_ifidx && wdev->netdev && 94 wdev->netdev->ifindex == ifidx) { 95 result = wdev; 96 break; 97 } 98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 99 result = wdev; 100 break; 101 } 102 } 103 104 return result ?: ERR_PTR(-ENODEV); 105 } 106 107 ASSERT_RTNL(); 108 109 for_each_rdev(rdev) { 110 struct wireless_dev *wdev; 111 112 if (wiphy_net(&rdev->wiphy) != netns) 113 continue; 114 115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 116 continue; 117 118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 119 if (have_ifidx && wdev->netdev && 120 wdev->netdev->ifindex == ifidx) { 121 result = wdev; 122 break; 123 } 124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 125 result = wdev; 126 break; 127 } 128 } 129 130 if (result) 131 break; 132 } 133 134 if (result) 135 return result; 136 return ERR_PTR(-ENODEV); 137 } 138 139 static struct cfg80211_registered_device * 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 141 { 142 struct cfg80211_registered_device *rdev = NULL, *tmp; 143 struct net_device *netdev; 144 145 ASSERT_RTNL(); 146 147 if (!attrs[NL80211_ATTR_WIPHY] && 148 !attrs[NL80211_ATTR_IFINDEX] && 149 !attrs[NL80211_ATTR_WDEV]) 150 return ERR_PTR(-EINVAL); 151 152 if (attrs[NL80211_ATTR_WIPHY]) 153 rdev = cfg80211_rdev_by_wiphy_idx( 154 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 155 156 if (attrs[NL80211_ATTR_WDEV]) { 157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 158 struct wireless_dev *wdev; 159 bool found = false; 160 161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 162 if (tmp) { 163 /* make sure wdev exists */ 164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 165 if (wdev->identifier != (u32)wdev_id) 166 continue; 167 found = true; 168 break; 169 } 170 171 if (!found) 172 tmp = NULL; 173 174 if (rdev && tmp != rdev) 175 return ERR_PTR(-EINVAL); 176 rdev = tmp; 177 } 178 } 179 180 if (attrs[NL80211_ATTR_IFINDEX]) { 181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 182 183 netdev = __dev_get_by_index(netns, ifindex); 184 if (netdev) { 185 if (netdev->ieee80211_ptr) 186 tmp = wiphy_to_rdev( 187 netdev->ieee80211_ptr->wiphy); 188 else 189 tmp = NULL; 190 191 /* not wireless device -- return error */ 192 if (!tmp) 193 return ERR_PTR(-EINVAL); 194 195 /* mismatch -- return error */ 196 if (rdev && tmp != rdev) 197 return ERR_PTR(-EINVAL); 198 199 rdev = tmp; 200 } 201 } 202 203 if (!rdev) 204 return ERR_PTR(-ENODEV); 205 206 if (netns != wiphy_net(&rdev->wiphy)) 207 return ERR_PTR(-ENODEV); 208 209 return rdev; 210 } 211 212 /* 213 * This function returns a pointer to the driver 214 * that the genl_info item that is passed refers to. 215 * 216 * The result of this can be a PTR_ERR and hence must 217 * be checked with IS_ERR() for errors. 218 */ 219 static struct cfg80211_registered_device * 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 221 { 222 return __cfg80211_rdev_from_attrs(netns, info->attrs); 223 } 224 225 static int validate_beacon_head(const struct nlattr *attr, 226 struct netlink_ext_ack *extack) 227 { 228 const u8 *data = nla_data(attr); 229 unsigned int len = nla_len(attr); 230 const struct element *elem; 231 const struct ieee80211_mgmt *mgmt = (void *)data; 232 unsigned int fixedlen, hdrlen; 233 bool s1g_bcn; 234 235 if (len < offsetofend(typeof(*mgmt), frame_control)) 236 goto err; 237 238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control); 239 if (s1g_bcn) { 240 fixedlen = offsetof(struct ieee80211_ext, 241 u.s1g_beacon.variable); 242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon); 243 } else { 244 fixedlen = offsetof(struct ieee80211_mgmt, 245 u.beacon.variable); 246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon); 247 } 248 249 if (len < fixedlen) 250 goto err; 251 252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen) 253 goto err; 254 255 data += fixedlen; 256 len -= fixedlen; 257 258 for_each_element(elem, data, len) { 259 /* nothing */ 260 } 261 262 if (for_each_element_completed(elem, data, len)) 263 return 0; 264 265 err: 266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head"); 267 return -EINVAL; 268 } 269 270 static int validate_ie_attr(const struct nlattr *attr, 271 struct netlink_ext_ack *extack) 272 { 273 const u8 *data = nla_data(attr); 274 unsigned int len = nla_len(attr); 275 const struct element *elem; 276 277 for_each_element(elem, data, len) { 278 /* nothing */ 279 } 280 281 if (for_each_element_completed(elem, data, len)) 282 return 0; 283 284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 285 return -EINVAL; 286 } 287 288 static int validate_he_capa(const struct nlattr *attr, 289 struct netlink_ext_ack *extack) 290 { 291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr))) 292 return -EINVAL; 293 294 return 0; 295 } 296 297 /* policy for the attributes */ 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR]; 299 300 static const struct nla_policy 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 304 .len = U8_MAX }, 305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 306 .len = U8_MAX }, 307 }; 308 309 static const struct nla_policy 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { 311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG }, 312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 }, 313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] = 314 NLA_POLICY_MAX(NLA_U8, 15), 315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 }, 316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] = 317 NLA_POLICY_MAX(NLA_U8, 15), 318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = 319 NLA_POLICY_MAX(NLA_U8, 31), 320 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 }, 321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG }, 322 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG }, 323 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, 324 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, 325 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG }, 326 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 }, 327 }; 328 329 static const struct nla_policy 330 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = { 331 [NL80211_PMSR_TYPE_FTM] = 332 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy), 333 }; 334 335 static const struct nla_policy 336 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = { 337 [NL80211_PMSR_REQ_ATTR_DATA] = 338 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy), 339 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG }, 340 }; 341 342 static const struct nla_policy 343 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = { 344 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR, 345 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy), 346 [NL80211_PMSR_PEER_ATTR_REQ] = 347 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy), 348 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT }, 349 }; 350 351 static const struct nla_policy 352 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = { 353 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT }, 354 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT }, 355 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT }, 356 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT }, 357 [NL80211_PMSR_ATTR_PEERS] = 358 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy), 359 }; 360 361 static const struct nla_policy 362 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = { 363 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] = 364 NLA_POLICY_RANGE(NLA_U8, 1, 20), 365 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] = 366 NLA_POLICY_RANGE(NLA_U8, 1, 20), 367 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] = 368 NLA_POLICY_RANGE(NLA_U8, 1, 20), 369 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] = 370 NLA_POLICY_EXACT_LEN(8), 371 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] = 372 NLA_POLICY_EXACT_LEN(8), 373 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 }, 374 }; 375 376 static const struct nla_policy 377 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = { 378 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63), 379 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG }, 380 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG }, 381 }; 382 383 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 384 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 385 .len = NL80211_MAX_SUPP_RATES }, 386 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 387 .len = NL80211_MAX_SUPP_HT_RATES }, 388 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)), 389 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 390 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)), 391 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8, 392 NL80211_RATE_INFO_HE_GI_0_8, 393 NL80211_RATE_INFO_HE_GI_3_2), 394 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8, 395 NL80211_RATE_INFO_HE_1XLTF, 396 NL80211_RATE_INFO_HE_4XLTF), 397 }; 398 399 static const struct nla_policy 400 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = { 401 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 }, 402 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 }, 403 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG }, 404 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff), 405 [NL80211_TID_CONFIG_ATTR_NOACK] = 406 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 407 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 408 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 409 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] = 410 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 411 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] = 412 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 413 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] = 414 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE), 415 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] = 416 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED), 417 [NL80211_TID_CONFIG_ATTR_TX_RATE] = 418 NLA_POLICY_NESTED(nl80211_txattr_policy), 419 }; 420 421 static const struct nla_policy 422 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = { 423 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000), 424 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000), 425 [NL80211_FILS_DISCOVERY_ATTR_TMPL] = 426 NLA_POLICY_RANGE(NLA_BINARY, 427 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, 428 IEEE80211_MAX_DATA_LEN), 429 }; 430 431 static const struct nla_policy 432 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = { 433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20), 434 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY, 435 .len = IEEE80211_MAX_DATA_LEN } 436 }; 437 438 static const struct nla_policy 439 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = { 440 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 }, 441 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 }, 442 }; 443 444 static const struct nla_policy 445 sar_policy[NL80211_SAR_ATTR_MAX + 1] = { 446 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE), 447 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy), 448 }; 449 450 static const struct nla_policy 451 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = { 452 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2), 453 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] = 454 NLA_POLICY_MIN(NLA_U8, 1), 455 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 }, 456 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 }, 457 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG }, 458 }; 459 460 static const struct nla_policy 461 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 462 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 463 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 464 }; 465 466 static const struct netlink_range_validation nl80211_punct_bitmap_range = { 467 .min = 0, 468 .max = 0xffff, 469 }; 470 471 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 472 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 473 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 474 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 475 .len = 20-1 }, 476 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 477 478 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 479 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 480 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 481 NL80211_EDMG_CHANNELS_MIN, 482 NL80211_EDMG_CHANNELS_MAX), 483 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 484 NL80211_EDMG_BW_CONFIG_MIN, 485 NL80211_EDMG_BW_CONFIG_MAX), 486 487 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 488 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 489 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 490 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 491 492 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 493 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 494 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 495 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 496 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 497 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 498 499 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 500 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 501 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 502 503 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 504 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 505 506 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 507 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 508 .len = WLAN_MAX_KEY_LEN }, 509 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 510 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 511 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 512 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 513 [NL80211_ATTR_KEY_TYPE] = 514 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 515 516 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 517 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 518 [NL80211_ATTR_BEACON_HEAD] = 519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 520 IEEE80211_MAX_DATA_LEN), 521 [NL80211_ATTR_BEACON_TAIL] = 522 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 523 IEEE80211_MAX_DATA_LEN), 524 [NL80211_ATTR_STA_AID] = 525 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 526 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 527 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 528 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 529 .len = NL80211_MAX_SUPP_RATES }, 530 [NL80211_ATTR_STA_PLINK_ACTION] = 531 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 532 [NL80211_ATTR_STA_TX_POWER_SETTING] = 533 NLA_POLICY_RANGE(NLA_U8, 534 NL80211_TX_POWER_AUTOMATIC, 535 NL80211_TX_POWER_FIXED), 536 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 537 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 538 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 539 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 540 .len = IEEE80211_MAX_MESH_ID_LEN }, 541 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 542 543 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 544 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 545 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 546 547 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 548 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 549 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 550 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 551 .len = NL80211_MAX_SUPP_RATES }, 552 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 553 554 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 555 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 556 557 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 558 559 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 560 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 561 validate_ie_attr, 562 IEEE80211_MAX_DATA_LEN), 563 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 564 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 565 566 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 567 .len = IEEE80211_MAX_SSID_LEN }, 568 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 569 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 570 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 572 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 573 NL80211_MFP_NO, 574 NL80211_MFP_OPTIONAL), 575 [NL80211_ATTR_STA_FLAGS2] = 576 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)), 577 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 578 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 579 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 580 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 581 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 582 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 583 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 584 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 585 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 586 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 587 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 588 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 589 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 590 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 591 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 592 .len = IEEE80211_MAX_DATA_LEN }, 593 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 594 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 595 NL80211_PS_DISABLED, 596 NL80211_PS_ENABLED), 597 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 598 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 599 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 600 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 601 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 602 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 603 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 604 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 605 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 606 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 607 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 608 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 609 [NL80211_ATTR_STA_PLINK_STATE] = 610 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 611 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 612 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 613 [NL80211_ATTR_MESH_PEER_AID] = 614 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 615 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 616 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 617 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 618 [NL80211_ATTR_HIDDEN_SSID] = 619 NLA_POLICY_RANGE(NLA_U32, 620 NL80211_HIDDEN_SSID_NOT_IN_USE, 621 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 622 [NL80211_ATTR_IE_PROBE_RESP] = 623 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 624 IEEE80211_MAX_DATA_LEN), 625 [NL80211_ATTR_IE_ASSOC_RESP] = 626 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 627 IEEE80211_MAX_DATA_LEN), 628 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 629 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy), 630 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 631 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 632 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 633 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 634 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 635 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 636 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 637 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 638 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 639 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 640 .len = IEEE80211_MAX_DATA_LEN }, 641 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 642 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 643 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 644 .len = NL80211_HT_CAPABILITY_LEN 645 }, 646 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 647 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 648 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 649 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 650 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 651 652 /* need to include at least Auth Transaction and Status Code */ 653 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 654 655 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 656 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 657 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 658 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 659 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 660 NLA_POLICY_RANGE(NLA_U32, 661 NL80211_MESH_POWER_UNKNOWN + 1, 662 NL80211_MESH_POWER_MAX), 663 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 664 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 665 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 666 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 667 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 668 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 669 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 670 .len = NL80211_VHT_CAPABILITY_LEN, 671 }, 672 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 673 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 674 .len = IEEE80211_MAX_DATA_LEN }, 675 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 676 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 677 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 678 [NL80211_ATTR_PEER_AID] = 679 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 680 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 681 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 682 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 683 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 684 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 685 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 686 /* 687 * The value of the Length field of the Supported Operating 688 * Classes element is between 2 and 253. 689 */ 690 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 691 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 692 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 693 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 694 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 695 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 696 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 697 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 698 IEEE80211_QOS_MAP_LEN_MIN, 699 IEEE80211_QOS_MAP_LEN_MAX), 700 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 701 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 702 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 703 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 704 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 705 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 707 [NL80211_ATTR_USER_PRIO] = 708 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 709 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 710 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 711 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 712 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 713 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 714 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 715 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 716 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 717 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 718 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 719 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 720 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 721 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 722 .len = VHT_MUMIMO_GROUPS_DATA_LEN 723 }, 724 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 725 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 726 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 727 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 728 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 729 .len = FILS_MAX_KEK_LEN }, 730 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 731 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 732 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 733 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 734 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 735 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 736 }, 737 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 738 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 739 .len = FILS_ERP_MAX_USERNAME_LEN }, 740 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 741 .len = FILS_ERP_MAX_REALM_LEN }, 742 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 743 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 744 .len = FILS_ERP_MAX_RRK_LEN }, 745 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 746 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 747 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 748 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 749 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 750 751 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 752 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 753 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 754 [NL80211_ATTR_HE_CAPABILITY] = 755 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, 756 NL80211_HE_MAX_CAPABILITY_LEN), 757 [NL80211_ATTR_FTM_RESPONDER] = 758 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 759 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 760 [NL80211_ATTR_PEER_MEASUREMENTS] = 761 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 762 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 763 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 764 .len = SAE_PASSWORD_MAX_LEN }, 765 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 766 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 767 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 768 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 769 [NL80211_ATTR_TID_CONFIG] = 770 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 771 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 772 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 773 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 774 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 775 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 776 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 777 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 778 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 779 [NL80211_ATTR_FILS_DISCOVERY] = 780 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 781 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 782 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 783 [NL80211_ATTR_S1G_CAPABILITY] = 784 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 785 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 786 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 787 [NL80211_ATTR_SAE_PWE] = 788 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK, 789 NL80211_SAE_PWE_BOTH), 790 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT }, 791 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy), 792 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG }, 793 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 }, 794 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 }, 795 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 }, 796 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy), 797 [NL80211_ATTR_MBSSID_CONFIG] = 798 NLA_POLICY_NESTED(nl80211_mbssid_config_policy), 799 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED }, 800 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG }, 801 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 }, 802 [NL80211_ATTR_EHT_CAPABILITY] = 803 NLA_POLICY_RANGE(NLA_BINARY, 804 NL80211_EHT_MIN_CAPABILITY_LEN, 805 NL80211_EHT_MAX_CAPABILITY_LEN), 806 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG }, 807 [NL80211_ATTR_MLO_LINKS] = 808 NLA_POLICY_NESTED_ARRAY(nl80211_policy), 809 [NL80211_ATTR_MLO_LINK_ID] = 810 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS), 811 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN), 812 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG }, 813 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT }, 814 [NL80211_ATTR_PUNCT_BITMAP] = 815 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range), 816 817 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 }, 818 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG }, 819 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED }, 820 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG }, 821 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG }, 822 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8), 823 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8), 824 }; 825 826 /* policy for the key attributes */ 827 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 828 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 829 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 830 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 831 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 832 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 833 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 834 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 835 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 836 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), 837 }; 838 839 /* policy for the key default flags */ 840 static const struct nla_policy 841 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 842 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 843 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 844 }; 845 846 #ifdef CONFIG_PM 847 /* policy for WoWLAN attributes */ 848 static const struct nla_policy 849 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 850 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 851 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 852 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 853 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 854 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 855 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 856 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 857 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 858 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 859 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 860 }; 861 862 static const struct nla_policy 863 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 864 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 865 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 866 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 867 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 868 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 869 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 870 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 871 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 872 }, 873 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 874 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 875 }, 876 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 877 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1), 878 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1), 879 }; 880 #endif /* CONFIG_PM */ 881 882 /* policy for coalesce rule attributes */ 883 static const struct nla_policy 884 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 885 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 886 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 887 NLA_POLICY_RANGE(NLA_U32, 888 NL80211_COALESCE_CONDITION_MATCH, 889 NL80211_COALESCE_CONDITION_NO_MATCH), 890 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 891 }; 892 893 /* policy for GTK rekey offload attributes */ 894 static const struct nla_policy 895 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 896 [NL80211_REKEY_DATA_KEK] = { 897 .type = NLA_BINARY, 898 .len = NL80211_KEK_EXT_LEN 899 }, 900 [NL80211_REKEY_DATA_KCK] = { 901 .type = NLA_BINARY, 902 .len = NL80211_KCK_EXT_LEN_32 903 }, 904 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN), 905 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 }, 906 }; 907 908 static const struct nla_policy 909 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = { 910 [NL80211_BAND_2GHZ] = { .type = NLA_S32 }, 911 [NL80211_BAND_5GHZ] = { .type = NLA_S32 }, 912 [NL80211_BAND_6GHZ] = { .type = NLA_S32 }, 913 [NL80211_BAND_60GHZ] = { .type = NLA_S32 }, 914 [NL80211_BAND_LC] = { .type = NLA_S32 }, 915 }; 916 917 static const struct nla_policy 918 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 919 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 920 .len = IEEE80211_MAX_SSID_LEN }, 921 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 922 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 923 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] = 924 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy), 925 }; 926 927 static const struct nla_policy 928 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 929 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 930 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 931 }; 932 933 static const struct nla_policy 934 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 935 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 936 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 937 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 938 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 939 }, 940 }; 941 942 /* policy for NAN function attributes */ 943 static const struct nla_policy 944 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 945 [NL80211_NAN_FUNC_TYPE] = 946 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE), 947 [NL80211_NAN_FUNC_SERVICE_ID] = { 948 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 949 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 950 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 951 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 952 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 953 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 954 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 955 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 956 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 957 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 958 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 959 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 960 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 961 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 962 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 963 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 964 }; 965 966 /* policy for Service Response Filter attributes */ 967 static const struct nla_policy 968 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 969 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 970 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 971 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 972 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 973 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 974 }; 975 976 /* policy for packet pattern attributes */ 977 static const struct nla_policy 978 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 979 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 980 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 981 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 982 }; 983 984 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 985 struct cfg80211_registered_device **rdev, 986 struct wireless_dev **wdev, 987 struct nlattr **attrbuf) 988 { 989 int err; 990 991 if (!cb->args[0]) { 992 struct nlattr **attrbuf_free = NULL; 993 994 if (!attrbuf) { 995 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 996 GFP_KERNEL); 997 if (!attrbuf) 998 return -ENOMEM; 999 attrbuf_free = attrbuf; 1000 } 1001 1002 err = nlmsg_parse_deprecated(cb->nlh, 1003 GENL_HDRLEN + nl80211_fam.hdrsize, 1004 attrbuf, nl80211_fam.maxattr, 1005 nl80211_policy, NULL); 1006 if (err) { 1007 kfree(attrbuf_free); 1008 return err; 1009 } 1010 1011 rtnl_lock(); 1012 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk), 1013 attrbuf); 1014 kfree(attrbuf_free); 1015 if (IS_ERR(*wdev)) { 1016 rtnl_unlock(); 1017 return PTR_ERR(*wdev); 1018 } 1019 *rdev = wiphy_to_rdev((*wdev)->wiphy); 1020 mutex_lock(&(*rdev)->wiphy.mtx); 1021 rtnl_unlock(); 1022 /* 0 is the first index - add 1 to parse only once */ 1023 cb->args[0] = (*rdev)->wiphy_idx + 1; 1024 cb->args[1] = (*wdev)->identifier; 1025 } else { 1026 /* subtract the 1 again here */ 1027 struct wiphy *wiphy; 1028 struct wireless_dev *tmp; 1029 1030 rtnl_lock(); 1031 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 1032 if (!wiphy) { 1033 rtnl_unlock(); 1034 return -ENODEV; 1035 } 1036 *rdev = wiphy_to_rdev(wiphy); 1037 *wdev = NULL; 1038 1039 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 1040 if (tmp->identifier == cb->args[1]) { 1041 *wdev = tmp; 1042 break; 1043 } 1044 } 1045 1046 if (!*wdev) { 1047 rtnl_unlock(); 1048 return -ENODEV; 1049 } 1050 mutex_lock(&(*rdev)->wiphy.mtx); 1051 rtnl_unlock(); 1052 } 1053 1054 return 0; 1055 } 1056 1057 /* message building helper */ 1058 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 1059 int flags, u8 cmd) 1060 { 1061 /* since there is no private header just add the generic one */ 1062 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 1063 } 1064 1065 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 1066 const struct ieee80211_reg_rule *rule) 1067 { 1068 int j; 1069 struct nlattr *nl_wmm_rules = 1070 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM); 1071 1072 if (!nl_wmm_rules) 1073 goto nla_put_failure; 1074 1075 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 1076 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j); 1077 1078 if (!nl_wmm_rule) 1079 goto nla_put_failure; 1080 1081 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 1082 rule->wmm_rule.client[j].cw_min) || 1083 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 1084 rule->wmm_rule.client[j].cw_max) || 1085 nla_put_u8(msg, NL80211_WMMR_AIFSN, 1086 rule->wmm_rule.client[j].aifsn) || 1087 nla_put_u16(msg, NL80211_WMMR_TXOP, 1088 rule->wmm_rule.client[j].cot)) 1089 goto nla_put_failure; 1090 1091 nla_nest_end(msg, nl_wmm_rule); 1092 } 1093 nla_nest_end(msg, nl_wmm_rules); 1094 1095 return 0; 1096 1097 nla_put_failure: 1098 return -ENOBUFS; 1099 } 1100 1101 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 1102 struct ieee80211_channel *chan, 1103 bool large) 1104 { 1105 /* Some channels must be completely excluded from the 1106 * list to protect old user-space tools from breaking 1107 */ 1108 if (!large && chan->flags & 1109 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 1110 return 0; 1111 if (!large && chan->freq_offset) 1112 return 0; 1113 1114 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 1115 chan->center_freq)) 1116 goto nla_put_failure; 1117 1118 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset)) 1119 goto nla_put_failure; 1120 1121 if ((chan->flags & IEEE80211_CHAN_PSD) && 1122 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd)) 1123 goto nla_put_failure; 1124 1125 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 1126 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 1127 goto nla_put_failure; 1128 if (chan->flags & IEEE80211_CHAN_NO_IR) { 1129 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 1130 goto nla_put_failure; 1131 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 1132 goto nla_put_failure; 1133 } 1134 if (chan->flags & IEEE80211_CHAN_RADAR) { 1135 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 1136 goto nla_put_failure; 1137 if (large) { 1138 u32 time; 1139 1140 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 1141 1142 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 1143 chan->dfs_state)) 1144 goto nla_put_failure; 1145 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 1146 time)) 1147 goto nla_put_failure; 1148 if (nla_put_u32(msg, 1149 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 1150 chan->dfs_cac_ms)) 1151 goto nla_put_failure; 1152 } 1153 } 1154 1155 if (large) { 1156 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 1157 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 1158 goto nla_put_failure; 1159 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 1160 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 1161 goto nla_put_failure; 1162 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 1163 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 1164 goto nla_put_failure; 1165 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 1166 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 1167 goto nla_put_failure; 1168 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 1169 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 1170 goto nla_put_failure; 1171 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 1172 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 1173 goto nla_put_failure; 1174 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 1175 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 1176 goto nla_put_failure; 1177 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 1178 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 1179 goto nla_put_failure; 1180 if ((chan->flags & IEEE80211_CHAN_NO_HE) && 1181 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE)) 1182 goto nla_put_failure; 1183 if ((chan->flags & IEEE80211_CHAN_1MHZ) && 1184 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ)) 1185 goto nla_put_failure; 1186 if ((chan->flags & IEEE80211_CHAN_2MHZ) && 1187 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ)) 1188 goto nla_put_failure; 1189 if ((chan->flags & IEEE80211_CHAN_4MHZ) && 1190 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ)) 1191 goto nla_put_failure; 1192 if ((chan->flags & IEEE80211_CHAN_8MHZ) && 1193 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ)) 1194 goto nla_put_failure; 1195 if ((chan->flags & IEEE80211_CHAN_16MHZ) && 1196 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ)) 1197 goto nla_put_failure; 1198 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) && 1199 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ)) 1200 goto nla_put_failure; 1201 if ((chan->flags & IEEE80211_CHAN_NO_EHT) && 1202 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT)) 1203 goto nla_put_failure; 1204 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) && 1205 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT)) 1206 goto nla_put_failure; 1207 if ((chan->flags & IEEE80211_CHAN_NO_UHB_VLP_CLIENT) && 1208 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHB_VLP_CLIENT)) 1209 goto nla_put_failure; 1210 if ((chan->flags & IEEE80211_CHAN_NO_UHB_AFC_CLIENT) && 1211 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHB_AFC_CLIENT)) 1212 goto nla_put_failure; 1213 } 1214 1215 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 1216 DBM_TO_MBM(chan->max_power))) 1217 goto nla_put_failure; 1218 1219 if (large) { 1220 const struct ieee80211_reg_rule *rule = 1221 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 1222 1223 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 1224 if (nl80211_msg_put_wmm_rules(msg, rule)) 1225 goto nla_put_failure; 1226 } 1227 } 1228 1229 return 0; 1230 1231 nla_put_failure: 1232 return -ENOBUFS; 1233 } 1234 1235 static bool nl80211_put_txq_stats(struct sk_buff *msg, 1236 struct cfg80211_txq_stats *txqstats, 1237 int attrtype) 1238 { 1239 struct nlattr *txqattr; 1240 1241 #define PUT_TXQVAL_U32(attr, memb) do { \ 1242 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 1243 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 1244 return false; \ 1245 } while (0) 1246 1247 txqattr = nla_nest_start_noflag(msg, attrtype); 1248 if (!txqattr) 1249 return false; 1250 1251 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 1252 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 1253 PUT_TXQVAL_U32(FLOWS, flows); 1254 PUT_TXQVAL_U32(DROPS, drops); 1255 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 1256 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 1257 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 1258 PUT_TXQVAL_U32(COLLISIONS, collisions); 1259 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 1260 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 1261 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 1262 nla_nest_end(msg, txqattr); 1263 1264 #undef PUT_TXQVAL_U32 1265 return true; 1266 } 1267 1268 /* netlink command implementations */ 1269 1270 /** 1271 * nl80211_link_id - return link ID 1272 * @attrs: attributes to look at 1273 * 1274 * Returns: the link ID or 0 if not given 1275 * 1276 * Note this function doesn't do any validation of the link 1277 * ID validity wrt. links that were actually added, so it must 1278 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID 1279 * or if additional validation is done. 1280 */ 1281 static unsigned int nl80211_link_id(struct nlattr **attrs) 1282 { 1283 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1284 1285 if (!linkid) 1286 return 0; 1287 1288 return nla_get_u8(linkid); 1289 } 1290 1291 static int nl80211_link_id_or_invalid(struct nlattr **attrs) 1292 { 1293 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID]; 1294 1295 if (!linkid) 1296 return -1; 1297 1298 return nla_get_u8(linkid); 1299 } 1300 1301 struct key_parse { 1302 struct key_params p; 1303 int idx; 1304 int type; 1305 bool def, defmgmt, defbeacon; 1306 bool def_uni, def_multi; 1307 }; 1308 1309 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 1310 struct key_parse *k) 1311 { 1312 struct nlattr *tb[NL80211_KEY_MAX + 1]; 1313 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, 1314 nl80211_key_policy, 1315 info->extack); 1316 if (err) 1317 return err; 1318 1319 k->def = !!tb[NL80211_KEY_DEFAULT]; 1320 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 1321 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON]; 1322 1323 if (k->def) { 1324 k->def_uni = true; 1325 k->def_multi = true; 1326 } 1327 if (k->defmgmt || k->defbeacon) 1328 k->def_multi = true; 1329 1330 if (tb[NL80211_KEY_IDX]) 1331 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 1332 1333 if (tb[NL80211_KEY_DATA]) { 1334 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 1335 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 1336 } 1337 1338 if (tb[NL80211_KEY_SEQ]) { 1339 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 1340 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 1341 } 1342 1343 if (tb[NL80211_KEY_CIPHER]) 1344 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 1345 1346 if (tb[NL80211_KEY_TYPE]) 1347 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 1348 1349 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 1350 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1351 1352 err = nla_parse_nested_deprecated(kdt, 1353 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1354 tb[NL80211_KEY_DEFAULT_TYPES], 1355 nl80211_key_default_policy, 1356 info->extack); 1357 if (err) 1358 return err; 1359 1360 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1361 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1362 } 1363 1364 if (tb[NL80211_KEY_MODE]) 1365 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); 1366 1367 return 0; 1368 } 1369 1370 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 1371 { 1372 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 1373 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 1374 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 1375 } 1376 1377 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 1378 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 1379 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 1380 } 1381 1382 if (info->attrs[NL80211_ATTR_KEY_IDX]) 1383 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 1384 1385 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 1386 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 1387 1388 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 1389 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 1390 1391 if (k->def) { 1392 k->def_uni = true; 1393 k->def_multi = true; 1394 } 1395 if (k->defmgmt) 1396 k->def_multi = true; 1397 1398 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 1399 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 1400 1401 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 1402 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 1403 int err = nla_parse_nested_deprecated(kdt, 1404 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 1405 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 1406 nl80211_key_default_policy, 1407 info->extack); 1408 if (err) 1409 return err; 1410 1411 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 1412 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 1413 } 1414 1415 return 0; 1416 } 1417 1418 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 1419 { 1420 int err; 1421 1422 memset(k, 0, sizeof(*k)); 1423 k->idx = -1; 1424 k->type = -1; 1425 1426 if (info->attrs[NL80211_ATTR_KEY]) 1427 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 1428 else 1429 err = nl80211_parse_key_old(info, k); 1430 1431 if (err) 1432 return err; 1433 1434 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) + 1435 (k->defbeacon ? 1 : 0) > 1) { 1436 GENL_SET_ERR_MSG(info, 1437 "key with multiple default flags is invalid"); 1438 return -EINVAL; 1439 } 1440 1441 if (k->defmgmt || k->defbeacon) { 1442 if (k->def_uni || !k->def_multi) { 1443 GENL_SET_ERR_MSG(info, 1444 "defmgmt/defbeacon key must be mcast"); 1445 return -EINVAL; 1446 } 1447 } 1448 1449 if (k->idx != -1) { 1450 if (k->defmgmt) { 1451 if (k->idx < 4 || k->idx > 5) { 1452 GENL_SET_ERR_MSG(info, 1453 "defmgmt key idx not 4 or 5"); 1454 return -EINVAL; 1455 } 1456 } else if (k->defbeacon) { 1457 if (k->idx < 6 || k->idx > 7) { 1458 GENL_SET_ERR_MSG(info, 1459 "defbeacon key idx not 6 or 7"); 1460 return -EINVAL; 1461 } 1462 } else if (k->def) { 1463 if (k->idx < 0 || k->idx > 3) { 1464 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1465 return -EINVAL; 1466 } 1467 } else { 1468 if (k->idx < 0 || k->idx > 7) { 1469 GENL_SET_ERR_MSG(info, "key idx not 0-7"); 1470 return -EINVAL; 1471 } 1472 } 1473 } 1474 1475 return 0; 1476 } 1477 1478 static struct cfg80211_cached_keys * 1479 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1480 struct genl_info *info, bool *no_ht) 1481 { 1482 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1483 struct key_parse parse; 1484 struct nlattr *key; 1485 struct cfg80211_cached_keys *result; 1486 int rem, err, def = 0; 1487 bool have_key = false; 1488 1489 nla_for_each_nested(key, keys, rem) { 1490 have_key = true; 1491 break; 1492 } 1493 1494 if (!have_key) 1495 return NULL; 1496 1497 result = kzalloc(sizeof(*result), GFP_KERNEL); 1498 if (!result) 1499 return ERR_PTR(-ENOMEM); 1500 1501 result->def = -1; 1502 1503 nla_for_each_nested(key, keys, rem) { 1504 memset(&parse, 0, sizeof(parse)); 1505 parse.idx = -1; 1506 1507 err = nl80211_parse_key_new(info, key, &parse); 1508 if (err) 1509 goto error; 1510 err = -EINVAL; 1511 if (!parse.p.key) 1512 goto error; 1513 if (parse.idx < 0 || parse.idx > 3) { 1514 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1515 goto error; 1516 } 1517 if (parse.def) { 1518 if (def) { 1519 GENL_SET_ERR_MSG(info, 1520 "only one key can be default"); 1521 goto error; 1522 } 1523 def = 1; 1524 result->def = parse.idx; 1525 if (!parse.def_uni || !parse.def_multi) 1526 goto error; 1527 } else if (parse.defmgmt) 1528 goto error; 1529 err = cfg80211_validate_key_settings(rdev, &parse.p, 1530 parse.idx, false, NULL); 1531 if (err) 1532 goto error; 1533 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1534 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1535 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1536 err = -EINVAL; 1537 goto error; 1538 } 1539 result->params[parse.idx].cipher = parse.p.cipher; 1540 result->params[parse.idx].key_len = parse.p.key_len; 1541 result->params[parse.idx].key = result->data[parse.idx]; 1542 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1543 1544 /* must be WEP key if we got here */ 1545 if (no_ht) 1546 *no_ht = true; 1547 } 1548 1549 if (result->def < 0) { 1550 err = -EINVAL; 1551 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1552 goto error; 1553 } 1554 1555 return result; 1556 error: 1557 kfree(result); 1558 return ERR_PTR(err); 1559 } 1560 1561 static int nl80211_key_allowed(struct wireless_dev *wdev) 1562 { 1563 lockdep_assert_wiphy(wdev->wiphy); 1564 1565 switch (wdev->iftype) { 1566 case NL80211_IFTYPE_AP: 1567 case NL80211_IFTYPE_AP_VLAN: 1568 case NL80211_IFTYPE_P2P_GO: 1569 case NL80211_IFTYPE_MESH_POINT: 1570 break; 1571 case NL80211_IFTYPE_ADHOC: 1572 if (wdev->u.ibss.current_bss) 1573 return 0; 1574 return -ENOLINK; 1575 case NL80211_IFTYPE_STATION: 1576 case NL80211_IFTYPE_P2P_CLIENT: 1577 if (wdev->connected) 1578 return 0; 1579 return -ENOLINK; 1580 case NL80211_IFTYPE_NAN: 1581 if (wiphy_ext_feature_isset(wdev->wiphy, 1582 NL80211_EXT_FEATURE_SECURE_NAN)) 1583 return 0; 1584 return -EINVAL; 1585 case NL80211_IFTYPE_UNSPECIFIED: 1586 case NL80211_IFTYPE_OCB: 1587 case NL80211_IFTYPE_MONITOR: 1588 case NL80211_IFTYPE_P2P_DEVICE: 1589 case NL80211_IFTYPE_WDS: 1590 case NUM_NL80211_IFTYPES: 1591 return -EINVAL; 1592 } 1593 1594 return 0; 1595 } 1596 1597 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1598 u32 freq) 1599 { 1600 struct ieee80211_channel *chan; 1601 1602 chan = ieee80211_get_channel_khz(wiphy, freq); 1603 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1604 return NULL; 1605 return chan; 1606 } 1607 1608 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1609 { 1610 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr); 1611 int i; 1612 1613 if (!nl_modes) 1614 goto nla_put_failure; 1615 1616 i = 0; 1617 while (ifmodes) { 1618 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1619 goto nla_put_failure; 1620 ifmodes >>= 1; 1621 i++; 1622 } 1623 1624 nla_nest_end(msg, nl_modes); 1625 return 0; 1626 1627 nla_put_failure: 1628 return -ENOBUFS; 1629 } 1630 1631 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1632 struct sk_buff *msg, 1633 bool large) 1634 { 1635 struct nlattr *nl_combis; 1636 int i, j; 1637 1638 nl_combis = nla_nest_start_noflag(msg, 1639 NL80211_ATTR_INTERFACE_COMBINATIONS); 1640 if (!nl_combis) 1641 goto nla_put_failure; 1642 1643 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1644 const struct ieee80211_iface_combination *c; 1645 struct nlattr *nl_combi, *nl_limits; 1646 1647 c = &wiphy->iface_combinations[i]; 1648 1649 nl_combi = nla_nest_start_noflag(msg, i + 1); 1650 if (!nl_combi) 1651 goto nla_put_failure; 1652 1653 nl_limits = nla_nest_start_noflag(msg, 1654 NL80211_IFACE_COMB_LIMITS); 1655 if (!nl_limits) 1656 goto nla_put_failure; 1657 1658 for (j = 0; j < c->n_limits; j++) { 1659 struct nlattr *nl_limit; 1660 1661 nl_limit = nla_nest_start_noflag(msg, j + 1); 1662 if (!nl_limit) 1663 goto nla_put_failure; 1664 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1665 c->limits[j].max)) 1666 goto nla_put_failure; 1667 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1668 c->limits[j].types)) 1669 goto nla_put_failure; 1670 nla_nest_end(msg, nl_limit); 1671 } 1672 1673 nla_nest_end(msg, nl_limits); 1674 1675 if (c->beacon_int_infra_match && 1676 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1677 goto nla_put_failure; 1678 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1679 c->num_different_channels) || 1680 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1681 c->max_interfaces)) 1682 goto nla_put_failure; 1683 if (large && 1684 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1685 c->radar_detect_widths) || 1686 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1687 c->radar_detect_regions))) 1688 goto nla_put_failure; 1689 if (c->beacon_int_min_gcd && 1690 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1691 c->beacon_int_min_gcd)) 1692 goto nla_put_failure; 1693 1694 nla_nest_end(msg, nl_combi); 1695 } 1696 1697 nla_nest_end(msg, nl_combis); 1698 1699 return 0; 1700 nla_put_failure: 1701 return -ENOBUFS; 1702 } 1703 1704 #ifdef CONFIG_PM 1705 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1706 struct sk_buff *msg) 1707 { 1708 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1709 struct nlattr *nl_tcp; 1710 1711 if (!tcp) 1712 return 0; 1713 1714 nl_tcp = nla_nest_start_noflag(msg, 1715 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1716 if (!nl_tcp) 1717 return -ENOBUFS; 1718 1719 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1720 tcp->data_payload_max)) 1721 return -ENOBUFS; 1722 1723 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1724 tcp->data_payload_max)) 1725 return -ENOBUFS; 1726 1727 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1728 return -ENOBUFS; 1729 1730 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1731 sizeof(*tcp->tok), tcp->tok)) 1732 return -ENOBUFS; 1733 1734 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1735 tcp->data_interval_max)) 1736 return -ENOBUFS; 1737 1738 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1739 tcp->wake_payload_max)) 1740 return -ENOBUFS; 1741 1742 nla_nest_end(msg, nl_tcp); 1743 return 0; 1744 } 1745 1746 static int nl80211_send_wowlan(struct sk_buff *msg, 1747 struct cfg80211_registered_device *rdev, 1748 bool large) 1749 { 1750 struct nlattr *nl_wowlan; 1751 1752 if (!rdev->wiphy.wowlan) 1753 return 0; 1754 1755 nl_wowlan = nla_nest_start_noflag(msg, 1756 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1757 if (!nl_wowlan) 1758 return -ENOBUFS; 1759 1760 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1761 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1762 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1763 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1764 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1765 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1766 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1767 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1768 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1769 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1770 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1771 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1772 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1773 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1774 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1775 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1776 return -ENOBUFS; 1777 1778 if (rdev->wiphy.wowlan->n_patterns) { 1779 struct nl80211_pattern_support pat = { 1780 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1781 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1782 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1783 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1784 }; 1785 1786 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1787 sizeof(pat), &pat)) 1788 return -ENOBUFS; 1789 } 1790 1791 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1792 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1793 rdev->wiphy.wowlan->max_nd_match_sets)) 1794 return -ENOBUFS; 1795 1796 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1797 return -ENOBUFS; 1798 1799 nla_nest_end(msg, nl_wowlan); 1800 1801 return 0; 1802 } 1803 #endif 1804 1805 static int nl80211_send_coalesce(struct sk_buff *msg, 1806 struct cfg80211_registered_device *rdev) 1807 { 1808 struct nl80211_coalesce_rule_support rule; 1809 1810 if (!rdev->wiphy.coalesce) 1811 return 0; 1812 1813 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1814 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1815 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1816 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1817 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1818 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1819 1820 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1821 return -ENOBUFS; 1822 1823 return 0; 1824 } 1825 1826 static int 1827 nl80211_send_iftype_data(struct sk_buff *msg, 1828 const struct ieee80211_supported_band *sband, 1829 const struct ieee80211_sband_iftype_data *iftdata) 1830 { 1831 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1832 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap; 1833 1834 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1835 iftdata->types_mask)) 1836 return -ENOBUFS; 1837 1838 if (he_cap->has_he) { 1839 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1840 sizeof(he_cap->he_cap_elem.mac_cap_info), 1841 he_cap->he_cap_elem.mac_cap_info) || 1842 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1843 sizeof(he_cap->he_cap_elem.phy_cap_info), 1844 he_cap->he_cap_elem.phy_cap_info) || 1845 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1846 sizeof(he_cap->he_mcs_nss_supp), 1847 &he_cap->he_mcs_nss_supp) || 1848 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1849 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1850 return -ENOBUFS; 1851 } 1852 1853 if (eht_cap->has_eht && he_cap->has_he) { 1854 u8 mcs_nss_size, ppe_thresh_size; 1855 u16 ppe_thres_hdr; 1856 bool is_ap; 1857 1858 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) || 1859 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO); 1860 1861 mcs_nss_size = 1862 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem, 1863 &eht_cap->eht_cap_elem, 1864 is_ap); 1865 1866 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]); 1867 ppe_thresh_size = 1868 ieee80211_eht_ppe_size(ppe_thres_hdr, 1869 eht_cap->eht_cap_elem.phy_cap_info); 1870 1871 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC, 1872 sizeof(eht_cap->eht_cap_elem.mac_cap_info), 1873 eht_cap->eht_cap_elem.mac_cap_info) || 1874 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY, 1875 sizeof(eht_cap->eht_cap_elem.phy_cap_info), 1876 eht_cap->eht_cap_elem.phy_cap_info) || 1877 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET, 1878 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) || 1879 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE, 1880 ppe_thresh_size, eht_cap->eht_ppe_thres)) 1881 return -ENOBUFS; 1882 } 1883 1884 if (sband->band == NL80211_BAND_6GHZ && 1885 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA, 1886 sizeof(iftdata->he_6ghz_capa), 1887 &iftdata->he_6ghz_capa)) 1888 return -ENOBUFS; 1889 1890 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len && 1891 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS, 1892 iftdata->vendor_elems.len, iftdata->vendor_elems.data)) 1893 return -ENOBUFS; 1894 1895 return 0; 1896 } 1897 1898 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1899 struct ieee80211_supported_band *sband, 1900 bool large) 1901 { 1902 struct nlattr *nl_rates, *nl_rate; 1903 struct ieee80211_rate *rate; 1904 int i; 1905 1906 /* add HT info */ 1907 if (sband->ht_cap.ht_supported && 1908 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1909 sizeof(sband->ht_cap.mcs), 1910 &sband->ht_cap.mcs) || 1911 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1912 sband->ht_cap.cap) || 1913 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1914 sband->ht_cap.ampdu_factor) || 1915 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1916 sband->ht_cap.ampdu_density))) 1917 return -ENOBUFS; 1918 1919 /* add VHT info */ 1920 if (sband->vht_cap.vht_supported && 1921 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1922 sizeof(sband->vht_cap.vht_mcs), 1923 &sband->vht_cap.vht_mcs) || 1924 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1925 sband->vht_cap.cap))) 1926 return -ENOBUFS; 1927 1928 if (large && sband->n_iftype_data) { 1929 struct nlattr *nl_iftype_data = 1930 nla_nest_start_noflag(msg, 1931 NL80211_BAND_ATTR_IFTYPE_DATA); 1932 const struct ieee80211_sband_iftype_data *iftd; 1933 int err; 1934 1935 if (!nl_iftype_data) 1936 return -ENOBUFS; 1937 1938 for_each_sband_iftype_data(sband, i, iftd) { 1939 struct nlattr *iftdata; 1940 1941 iftdata = nla_nest_start_noflag(msg, i + 1); 1942 if (!iftdata) 1943 return -ENOBUFS; 1944 1945 err = nl80211_send_iftype_data(msg, sband, iftd); 1946 if (err) 1947 return err; 1948 1949 nla_nest_end(msg, iftdata); 1950 } 1951 1952 nla_nest_end(msg, nl_iftype_data); 1953 } 1954 1955 /* add EDMG info */ 1956 if (large && sband->edmg_cap.channels && 1957 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS, 1958 sband->edmg_cap.channels) || 1959 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG, 1960 sband->edmg_cap.bw_config))) 1961 1962 return -ENOBUFS; 1963 1964 /* add bitrates */ 1965 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES); 1966 if (!nl_rates) 1967 return -ENOBUFS; 1968 1969 for (i = 0; i < sband->n_bitrates; i++) { 1970 nl_rate = nla_nest_start_noflag(msg, i); 1971 if (!nl_rate) 1972 return -ENOBUFS; 1973 1974 rate = &sband->bitrates[i]; 1975 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1976 rate->bitrate)) 1977 return -ENOBUFS; 1978 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1979 nla_put_flag(msg, 1980 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1981 return -ENOBUFS; 1982 1983 nla_nest_end(msg, nl_rate); 1984 } 1985 1986 nla_nest_end(msg, nl_rates); 1987 1988 /* S1G capabilities */ 1989 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g && 1990 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA, 1991 sizeof(sband->s1g_cap.cap), 1992 sband->s1g_cap.cap) || 1993 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET, 1994 sizeof(sband->s1g_cap.nss_mcs), 1995 sband->s1g_cap.nss_mcs))) 1996 return -ENOBUFS; 1997 1998 return 0; 1999 } 2000 2001 static int 2002 nl80211_send_mgmt_stypes(struct sk_buff *msg, 2003 const struct ieee80211_txrx_stypes *mgmt_stypes) 2004 { 2005 u16 stypes; 2006 struct nlattr *nl_ftypes, *nl_ifs; 2007 enum nl80211_iftype ift; 2008 int i; 2009 2010 if (!mgmt_stypes) 2011 return 0; 2012 2013 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES); 2014 if (!nl_ifs) 2015 return -ENOBUFS; 2016 2017 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 2018 nl_ftypes = nla_nest_start_noflag(msg, ift); 2019 if (!nl_ftypes) 2020 return -ENOBUFS; 2021 i = 0; 2022 stypes = mgmt_stypes[ift].tx; 2023 while (stypes) { 2024 if ((stypes & 1) && 2025 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 2026 (i << 4) | IEEE80211_FTYPE_MGMT)) 2027 return -ENOBUFS; 2028 stypes >>= 1; 2029 i++; 2030 } 2031 nla_nest_end(msg, nl_ftypes); 2032 } 2033 2034 nla_nest_end(msg, nl_ifs); 2035 2036 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES); 2037 if (!nl_ifs) 2038 return -ENOBUFS; 2039 2040 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 2041 nl_ftypes = nla_nest_start_noflag(msg, ift); 2042 if (!nl_ftypes) 2043 return -ENOBUFS; 2044 i = 0; 2045 stypes = mgmt_stypes[ift].rx; 2046 while (stypes) { 2047 if ((stypes & 1) && 2048 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 2049 (i << 4) | IEEE80211_FTYPE_MGMT)) 2050 return -ENOBUFS; 2051 stypes >>= 1; 2052 i++; 2053 } 2054 nla_nest_end(msg, nl_ftypes); 2055 } 2056 nla_nest_end(msg, nl_ifs); 2057 2058 return 0; 2059 } 2060 2061 #define CMD(op, n) \ 2062 do { \ 2063 if (rdev->ops->op) { \ 2064 i++; \ 2065 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 2066 goto nla_put_failure; \ 2067 } \ 2068 } while (0) 2069 2070 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 2071 struct sk_buff *msg) 2072 { 2073 int i = 0; 2074 2075 /* 2076 * do *NOT* add anything into this function, new things need to be 2077 * advertised only to new versions of userspace that can deal with 2078 * the split (and they can't possibly care about new features... 2079 */ 2080 CMD(add_virtual_intf, NEW_INTERFACE); 2081 CMD(change_virtual_intf, SET_INTERFACE); 2082 CMD(add_key, NEW_KEY); 2083 CMD(start_ap, START_AP); 2084 CMD(add_station, NEW_STATION); 2085 CMD(add_mpath, NEW_MPATH); 2086 CMD(update_mesh_config, SET_MESH_CONFIG); 2087 CMD(change_bss, SET_BSS); 2088 CMD(auth, AUTHENTICATE); 2089 CMD(assoc, ASSOCIATE); 2090 CMD(deauth, DEAUTHENTICATE); 2091 CMD(disassoc, DISASSOCIATE); 2092 CMD(join_ibss, JOIN_IBSS); 2093 CMD(join_mesh, JOIN_MESH); 2094 CMD(set_pmksa, SET_PMKSA); 2095 CMD(del_pmksa, DEL_PMKSA); 2096 CMD(flush_pmksa, FLUSH_PMKSA); 2097 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 2098 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 2099 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 2100 CMD(mgmt_tx, FRAME); 2101 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 2102 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 2103 i++; 2104 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 2105 goto nla_put_failure; 2106 } 2107 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 2108 rdev->ops->join_mesh) { 2109 i++; 2110 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 2111 goto nla_put_failure; 2112 } 2113 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 2114 CMD(tdls_mgmt, TDLS_MGMT); 2115 CMD(tdls_oper, TDLS_OPER); 2116 } 2117 if (rdev->wiphy.max_sched_scan_reqs) 2118 CMD(sched_scan_start, START_SCHED_SCAN); 2119 CMD(probe_client, PROBE_CLIENT); 2120 CMD(set_noack_map, SET_NOACK_MAP); 2121 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 2122 i++; 2123 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 2124 goto nla_put_failure; 2125 } 2126 CMD(start_p2p_device, START_P2P_DEVICE); 2127 CMD(set_mcast_rate, SET_MCAST_RATE); 2128 #ifdef CONFIG_NL80211_TESTMODE 2129 CMD(testmode_cmd, TESTMODE); 2130 #endif 2131 2132 if (rdev->ops->connect || rdev->ops->auth) { 2133 i++; 2134 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 2135 goto nla_put_failure; 2136 } 2137 2138 if (rdev->ops->disconnect || rdev->ops->deauth) { 2139 i++; 2140 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 2141 goto nla_put_failure; 2142 } 2143 2144 return i; 2145 nla_put_failure: 2146 return -ENOBUFS; 2147 } 2148 2149 static int 2150 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap, 2151 struct sk_buff *msg) 2152 { 2153 struct nlattr *ftm; 2154 2155 if (!cap->ftm.supported) 2156 return 0; 2157 2158 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM); 2159 if (!ftm) 2160 return -ENOBUFS; 2161 2162 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP)) 2163 return -ENOBUFS; 2164 if (cap->ftm.non_asap && 2165 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP)) 2166 return -ENOBUFS; 2167 if (cap->ftm.request_lci && 2168 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI)) 2169 return -ENOBUFS; 2170 if (cap->ftm.request_civicloc && 2171 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC)) 2172 return -ENOBUFS; 2173 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES, 2174 cap->ftm.preambles)) 2175 return -ENOBUFS; 2176 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS, 2177 cap->ftm.bandwidths)) 2178 return -ENOBUFS; 2179 if (cap->ftm.max_bursts_exponent >= 0 && 2180 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT, 2181 cap->ftm.max_bursts_exponent)) 2182 return -ENOBUFS; 2183 if (cap->ftm.max_ftms_per_burst && 2184 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST, 2185 cap->ftm.max_ftms_per_burst)) 2186 return -ENOBUFS; 2187 if (cap->ftm.trigger_based && 2188 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED)) 2189 return -ENOBUFS; 2190 if (cap->ftm.non_trigger_based && 2191 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED)) 2192 return -ENOBUFS; 2193 2194 nla_nest_end(msg, ftm); 2195 return 0; 2196 } 2197 2198 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev, 2199 struct sk_buff *msg) 2200 { 2201 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa; 2202 struct nlattr *pmsr, *caps; 2203 2204 if (!cap) 2205 return 0; 2206 2207 /* 2208 * we don't need to clean up anything here since the caller 2209 * will genlmsg_cancel() if we fail 2210 */ 2211 2212 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS); 2213 if (!pmsr) 2214 return -ENOBUFS; 2215 2216 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers)) 2217 return -ENOBUFS; 2218 2219 if (cap->report_ap_tsf && 2220 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF)) 2221 return -ENOBUFS; 2222 2223 if (cap->randomize_mac_addr && 2224 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR)) 2225 return -ENOBUFS; 2226 2227 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA); 2228 if (!caps) 2229 return -ENOBUFS; 2230 2231 if (nl80211_send_pmsr_ftm_capa(cap, msg)) 2232 return -ENOBUFS; 2233 2234 nla_nest_end(msg, caps); 2235 nla_nest_end(msg, pmsr); 2236 2237 return 0; 2238 } 2239 2240 static int 2241 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev, 2242 struct sk_buff *msg) 2243 { 2244 int i; 2245 struct nlattr *nested, *nested_akms; 2246 const struct wiphy_iftype_akm_suites *iftype_akms; 2247 2248 if (!rdev->wiphy.num_iftype_akm_suites || 2249 !rdev->wiphy.iftype_akm_suites) 2250 return 0; 2251 2252 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES); 2253 if (!nested) 2254 return -ENOBUFS; 2255 2256 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) { 2257 nested_akms = nla_nest_start(msg, i + 1); 2258 if (!nested_akms) 2259 return -ENOBUFS; 2260 2261 iftype_akms = &rdev->wiphy.iftype_akm_suites[i]; 2262 2263 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES, 2264 iftype_akms->iftypes_mask)) 2265 return -ENOBUFS; 2266 2267 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES, 2268 sizeof(u32) * iftype_akms->n_akm_suites, 2269 iftype_akms->akm_suites)) { 2270 return -ENOBUFS; 2271 } 2272 nla_nest_end(msg, nested_akms); 2273 } 2274 2275 nla_nest_end(msg, nested); 2276 2277 return 0; 2278 } 2279 2280 static int 2281 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev, 2282 struct sk_buff *msg) 2283 { 2284 struct nlattr *supp; 2285 2286 if (!rdev->wiphy.tid_config_support.vif && 2287 !rdev->wiphy.tid_config_support.peer) 2288 return 0; 2289 2290 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG); 2291 if (!supp) 2292 return -ENOSPC; 2293 2294 if (rdev->wiphy.tid_config_support.vif && 2295 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP, 2296 rdev->wiphy.tid_config_support.vif, 2297 NL80211_TID_CONFIG_ATTR_PAD)) 2298 goto fail; 2299 2300 if (rdev->wiphy.tid_config_support.peer && 2301 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP, 2302 rdev->wiphy.tid_config_support.peer, 2303 NL80211_TID_CONFIG_ATTR_PAD)) 2304 goto fail; 2305 2306 /* for now we just use the same value ... makes more sense */ 2307 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT, 2308 rdev->wiphy.tid_config_support.max_retry)) 2309 goto fail; 2310 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG, 2311 rdev->wiphy.tid_config_support.max_retry)) 2312 goto fail; 2313 2314 nla_nest_end(msg, supp); 2315 2316 return 0; 2317 fail: 2318 nla_nest_cancel(msg, supp); 2319 return -ENOBUFS; 2320 } 2321 2322 static int 2323 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev, 2324 struct sk_buff *msg) 2325 { 2326 struct nlattr *sar_capa, *specs, *sub_freq_range; 2327 u8 num_freq_ranges; 2328 int i; 2329 2330 if (!rdev->wiphy.sar_capa) 2331 return 0; 2332 2333 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges; 2334 2335 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC); 2336 if (!sar_capa) 2337 return -ENOSPC; 2338 2339 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type)) 2340 goto fail; 2341 2342 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS); 2343 if (!specs) 2344 goto fail; 2345 2346 /* report supported freq_ranges */ 2347 for (i = 0; i < num_freq_ranges; i++) { 2348 sub_freq_range = nla_nest_start(msg, i + 1); 2349 if (!sub_freq_range) 2350 goto fail; 2351 2352 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ, 2353 rdev->wiphy.sar_capa->freq_ranges[i].start_freq)) 2354 goto fail; 2355 2356 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ, 2357 rdev->wiphy.sar_capa->freq_ranges[i].end_freq)) 2358 goto fail; 2359 2360 nla_nest_end(msg, sub_freq_range); 2361 } 2362 2363 nla_nest_end(msg, specs); 2364 nla_nest_end(msg, sar_capa); 2365 2366 return 0; 2367 fail: 2368 nla_nest_cancel(msg, sar_capa); 2369 return -ENOBUFS; 2370 } 2371 2372 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg) 2373 { 2374 struct nlattr *config; 2375 2376 if (!wiphy->mbssid_max_interfaces) 2377 return 0; 2378 2379 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG); 2380 if (!config) 2381 return -ENOBUFS; 2382 2383 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES, 2384 wiphy->mbssid_max_interfaces)) 2385 goto fail; 2386 2387 if (wiphy->ema_max_profile_periodicity && 2388 nla_put_u8(msg, 2389 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY, 2390 wiphy->ema_max_profile_periodicity)) 2391 goto fail; 2392 2393 nla_nest_end(msg, config); 2394 return 0; 2395 2396 fail: 2397 nla_nest_cancel(msg, config); 2398 return -ENOBUFS; 2399 } 2400 2401 struct nl80211_dump_wiphy_state { 2402 s64 filter_wiphy; 2403 long start; 2404 long split_start, band_start, chan_start, capa_start; 2405 bool split; 2406 }; 2407 2408 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 2409 enum nl80211_commands cmd, 2410 struct sk_buff *msg, u32 portid, u32 seq, 2411 int flags, struct nl80211_dump_wiphy_state *state) 2412 { 2413 void *hdr; 2414 struct nlattr *nl_bands, *nl_band; 2415 struct nlattr *nl_freqs, *nl_freq; 2416 struct nlattr *nl_cmds; 2417 enum nl80211_band band; 2418 struct ieee80211_channel *chan; 2419 int i; 2420 const struct ieee80211_txrx_stypes *mgmt_stypes = 2421 rdev->wiphy.mgmt_stypes; 2422 u32 features; 2423 2424 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2425 if (!hdr) 2426 return -ENOBUFS; 2427 2428 if (WARN_ON(!state)) 2429 return -EINVAL; 2430 2431 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2432 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 2433 wiphy_name(&rdev->wiphy)) || 2434 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2435 cfg80211_rdev_list_generation)) 2436 goto nla_put_failure; 2437 2438 if (cmd != NL80211_CMD_NEW_WIPHY) 2439 goto finish; 2440 2441 switch (state->split_start) { 2442 case 0: 2443 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 2444 rdev->wiphy.retry_short) || 2445 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 2446 rdev->wiphy.retry_long) || 2447 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 2448 rdev->wiphy.frag_threshold) || 2449 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 2450 rdev->wiphy.rts_threshold) || 2451 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 2452 rdev->wiphy.coverage_class) || 2453 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 2454 rdev->wiphy.max_scan_ssids) || 2455 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 2456 rdev->wiphy.max_sched_scan_ssids) || 2457 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 2458 rdev->wiphy.max_scan_ie_len) || 2459 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 2460 rdev->wiphy.max_sched_scan_ie_len) || 2461 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 2462 rdev->wiphy.max_match_sets)) 2463 goto nla_put_failure; 2464 2465 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 2466 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 2467 goto nla_put_failure; 2468 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 2469 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 2470 goto nla_put_failure; 2471 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 2472 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 2473 goto nla_put_failure; 2474 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 2475 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 2476 goto nla_put_failure; 2477 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 2478 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 2479 goto nla_put_failure; 2480 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 2481 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 2482 goto nla_put_failure; 2483 state->split_start++; 2484 if (state->split) 2485 break; 2486 fallthrough; 2487 case 1: 2488 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 2489 sizeof(u32) * rdev->wiphy.n_cipher_suites, 2490 rdev->wiphy.cipher_suites)) 2491 goto nla_put_failure; 2492 2493 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 2494 rdev->wiphy.max_num_pmkids)) 2495 goto nla_put_failure; 2496 2497 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 2498 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 2499 goto nla_put_failure; 2500 2501 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 2502 rdev->wiphy.available_antennas_tx) || 2503 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 2504 rdev->wiphy.available_antennas_rx)) 2505 goto nla_put_failure; 2506 2507 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 2508 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 2509 rdev->wiphy.probe_resp_offload)) 2510 goto nla_put_failure; 2511 2512 if ((rdev->wiphy.available_antennas_tx || 2513 rdev->wiphy.available_antennas_rx) && 2514 rdev->ops->get_antenna) { 2515 u32 tx_ant = 0, rx_ant = 0; 2516 int res; 2517 2518 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 2519 if (!res) { 2520 if (nla_put_u32(msg, 2521 NL80211_ATTR_WIPHY_ANTENNA_TX, 2522 tx_ant) || 2523 nla_put_u32(msg, 2524 NL80211_ATTR_WIPHY_ANTENNA_RX, 2525 rx_ant)) 2526 goto nla_put_failure; 2527 } 2528 } 2529 2530 state->split_start++; 2531 if (state->split) 2532 break; 2533 fallthrough; 2534 case 2: 2535 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 2536 rdev->wiphy.interface_modes)) 2537 goto nla_put_failure; 2538 state->split_start++; 2539 if (state->split) 2540 break; 2541 fallthrough; 2542 case 3: 2543 nl_bands = nla_nest_start_noflag(msg, 2544 NL80211_ATTR_WIPHY_BANDS); 2545 if (!nl_bands) 2546 goto nla_put_failure; 2547 2548 for (band = state->band_start; 2549 band < (state->split ? 2550 NUM_NL80211_BANDS : 2551 NL80211_BAND_60GHZ + 1); 2552 band++) { 2553 struct ieee80211_supported_band *sband; 2554 2555 /* omit higher bands for ancient software */ 2556 if (band > NL80211_BAND_5GHZ && !state->split) 2557 break; 2558 2559 sband = rdev->wiphy.bands[band]; 2560 2561 if (!sband) 2562 continue; 2563 2564 nl_band = nla_nest_start_noflag(msg, band); 2565 if (!nl_band) 2566 goto nla_put_failure; 2567 2568 switch (state->chan_start) { 2569 case 0: 2570 if (nl80211_send_band_rateinfo(msg, sband, 2571 state->split)) 2572 goto nla_put_failure; 2573 state->chan_start++; 2574 if (state->split) 2575 break; 2576 fallthrough; 2577 default: 2578 /* add frequencies */ 2579 nl_freqs = nla_nest_start_noflag(msg, 2580 NL80211_BAND_ATTR_FREQS); 2581 if (!nl_freqs) 2582 goto nla_put_failure; 2583 2584 for (i = state->chan_start - 1; 2585 i < sband->n_channels; 2586 i++) { 2587 nl_freq = nla_nest_start_noflag(msg, 2588 i); 2589 if (!nl_freq) 2590 goto nla_put_failure; 2591 2592 chan = &sband->channels[i]; 2593 2594 if (nl80211_msg_put_channel( 2595 msg, &rdev->wiphy, chan, 2596 state->split)) 2597 goto nla_put_failure; 2598 2599 nla_nest_end(msg, nl_freq); 2600 if (state->split) 2601 break; 2602 } 2603 if (i < sband->n_channels) 2604 state->chan_start = i + 2; 2605 else 2606 state->chan_start = 0; 2607 nla_nest_end(msg, nl_freqs); 2608 } 2609 2610 nla_nest_end(msg, nl_band); 2611 2612 if (state->split) { 2613 /* start again here */ 2614 if (state->chan_start) 2615 band--; 2616 break; 2617 } 2618 } 2619 nla_nest_end(msg, nl_bands); 2620 2621 if (band < NUM_NL80211_BANDS) 2622 state->band_start = band + 1; 2623 else 2624 state->band_start = 0; 2625 2626 /* if bands & channels are done, continue outside */ 2627 if (state->band_start == 0 && state->chan_start == 0) 2628 state->split_start++; 2629 if (state->split) 2630 break; 2631 fallthrough; 2632 case 4: 2633 nl_cmds = nla_nest_start_noflag(msg, 2634 NL80211_ATTR_SUPPORTED_COMMANDS); 2635 if (!nl_cmds) 2636 goto nla_put_failure; 2637 2638 i = nl80211_add_commands_unsplit(rdev, msg); 2639 if (i < 0) 2640 goto nla_put_failure; 2641 if (state->split) { 2642 CMD(crit_proto_start, CRIT_PROTOCOL_START); 2643 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 2644 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 2645 CMD(channel_switch, CHANNEL_SWITCH); 2646 CMD(set_qos_map, SET_QOS_MAP); 2647 if (rdev->wiphy.features & 2648 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 2649 CMD(add_tx_ts, ADD_TX_TS); 2650 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 2651 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 2652 CMD(update_ft_ies, UPDATE_FT_IES); 2653 if (rdev->wiphy.sar_capa) 2654 CMD(set_sar_specs, SET_SAR_SPECS); 2655 } 2656 #undef CMD 2657 2658 nla_nest_end(msg, nl_cmds); 2659 state->split_start++; 2660 if (state->split) 2661 break; 2662 fallthrough; 2663 case 5: 2664 if (rdev->ops->remain_on_channel && 2665 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 2666 nla_put_u32(msg, 2667 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 2668 rdev->wiphy.max_remain_on_channel_duration)) 2669 goto nla_put_failure; 2670 2671 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 2672 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 2673 goto nla_put_failure; 2674 2675 state->split_start++; 2676 if (state->split) 2677 break; 2678 fallthrough; 2679 case 6: 2680 #ifdef CONFIG_PM 2681 if (nl80211_send_wowlan(msg, rdev, state->split)) 2682 goto nla_put_failure; 2683 state->split_start++; 2684 if (state->split) 2685 break; 2686 #else 2687 state->split_start++; 2688 #endif 2689 fallthrough; 2690 case 7: 2691 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 2692 rdev->wiphy.software_iftypes)) 2693 goto nla_put_failure; 2694 2695 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 2696 state->split)) 2697 goto nla_put_failure; 2698 2699 state->split_start++; 2700 if (state->split) 2701 break; 2702 fallthrough; 2703 case 8: 2704 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 2705 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 2706 rdev->wiphy.ap_sme_capa)) 2707 goto nla_put_failure; 2708 2709 features = rdev->wiphy.features; 2710 /* 2711 * We can only add the per-channel limit information if the 2712 * dump is split, otherwise it makes it too big. Therefore 2713 * only advertise it in that case. 2714 */ 2715 if (state->split) 2716 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 2717 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 2718 goto nla_put_failure; 2719 2720 if (rdev->wiphy.ht_capa_mod_mask && 2721 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 2722 sizeof(*rdev->wiphy.ht_capa_mod_mask), 2723 rdev->wiphy.ht_capa_mod_mask)) 2724 goto nla_put_failure; 2725 2726 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 2727 rdev->wiphy.max_acl_mac_addrs && 2728 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 2729 rdev->wiphy.max_acl_mac_addrs)) 2730 goto nla_put_failure; 2731 2732 /* 2733 * Any information below this point is only available to 2734 * applications that can deal with it being split. This 2735 * helps ensure that newly added capabilities don't break 2736 * older tools by overrunning their buffers. 2737 * 2738 * We still increment split_start so that in the split 2739 * case we'll continue with more data in the next round, 2740 * but break unconditionally so unsplit data stops here. 2741 */ 2742 if (state->split) 2743 state->split_start++; 2744 else 2745 state->split_start = 0; 2746 break; 2747 case 9: 2748 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 2749 goto nla_put_failure; 2750 2751 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 2752 rdev->wiphy.max_sched_scan_plans) || 2753 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 2754 rdev->wiphy.max_sched_scan_plan_interval) || 2755 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 2756 rdev->wiphy.max_sched_scan_plan_iterations)) 2757 goto nla_put_failure; 2758 2759 if (rdev->wiphy.extended_capabilities && 2760 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 2761 rdev->wiphy.extended_capabilities_len, 2762 rdev->wiphy.extended_capabilities) || 2763 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2764 rdev->wiphy.extended_capabilities_len, 2765 rdev->wiphy.extended_capabilities_mask))) 2766 goto nla_put_failure; 2767 2768 if (rdev->wiphy.vht_capa_mod_mask && 2769 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 2770 sizeof(*rdev->wiphy.vht_capa_mod_mask), 2771 rdev->wiphy.vht_capa_mod_mask)) 2772 goto nla_put_failure; 2773 2774 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 2775 rdev->wiphy.perm_addr)) 2776 goto nla_put_failure; 2777 2778 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) && 2779 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 2780 rdev->wiphy.addr_mask)) 2781 goto nla_put_failure; 2782 2783 if (rdev->wiphy.n_addresses > 1) { 2784 void *attr; 2785 2786 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS); 2787 if (!attr) 2788 goto nla_put_failure; 2789 2790 for (i = 0; i < rdev->wiphy.n_addresses; i++) 2791 if (nla_put(msg, i + 1, ETH_ALEN, 2792 rdev->wiphy.addresses[i].addr)) 2793 goto nla_put_failure; 2794 2795 nla_nest_end(msg, attr); 2796 } 2797 2798 state->split_start++; 2799 break; 2800 case 10: 2801 if (nl80211_send_coalesce(msg, rdev)) 2802 goto nla_put_failure; 2803 2804 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 2805 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 2806 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 2807 goto nla_put_failure; 2808 2809 if (rdev->wiphy.max_ap_assoc_sta && 2810 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 2811 rdev->wiphy.max_ap_assoc_sta)) 2812 goto nla_put_failure; 2813 2814 state->split_start++; 2815 break; 2816 case 11: 2817 if (rdev->wiphy.n_vendor_commands) { 2818 const struct nl80211_vendor_cmd_info *info; 2819 struct nlattr *nested; 2820 2821 nested = nla_nest_start_noflag(msg, 2822 NL80211_ATTR_VENDOR_DATA); 2823 if (!nested) 2824 goto nla_put_failure; 2825 2826 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 2827 info = &rdev->wiphy.vendor_commands[i].info; 2828 if (nla_put(msg, i + 1, sizeof(*info), info)) 2829 goto nla_put_failure; 2830 } 2831 nla_nest_end(msg, nested); 2832 } 2833 2834 if (rdev->wiphy.n_vendor_events) { 2835 const struct nl80211_vendor_cmd_info *info; 2836 struct nlattr *nested; 2837 2838 nested = nla_nest_start_noflag(msg, 2839 NL80211_ATTR_VENDOR_EVENTS); 2840 if (!nested) 2841 goto nla_put_failure; 2842 2843 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2844 info = &rdev->wiphy.vendor_events[i]; 2845 if (nla_put(msg, i + 1, sizeof(*info), info)) 2846 goto nla_put_failure; 2847 } 2848 nla_nest_end(msg, nested); 2849 } 2850 state->split_start++; 2851 break; 2852 case 12: 2853 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2854 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2855 rdev->wiphy.max_num_csa_counters)) 2856 goto nla_put_failure; 2857 2858 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2859 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2860 goto nla_put_failure; 2861 2862 if (rdev->wiphy.max_sched_scan_reqs && 2863 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2864 rdev->wiphy.max_sched_scan_reqs)) 2865 goto nla_put_failure; 2866 2867 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2868 sizeof(rdev->wiphy.ext_features), 2869 rdev->wiphy.ext_features)) 2870 goto nla_put_failure; 2871 2872 if (rdev->wiphy.bss_select_support) { 2873 struct nlattr *nested; 2874 u32 bss_select_support = rdev->wiphy.bss_select_support; 2875 2876 nested = nla_nest_start_noflag(msg, 2877 NL80211_ATTR_BSS_SELECT); 2878 if (!nested) 2879 goto nla_put_failure; 2880 2881 i = 0; 2882 while (bss_select_support) { 2883 if ((bss_select_support & 1) && 2884 nla_put_flag(msg, i)) 2885 goto nla_put_failure; 2886 i++; 2887 bss_select_support >>= 1; 2888 } 2889 nla_nest_end(msg, nested); 2890 } 2891 2892 state->split_start++; 2893 break; 2894 case 13: 2895 if (rdev->wiphy.num_iftype_ext_capab && 2896 rdev->wiphy.iftype_ext_capab) { 2897 struct nlattr *nested_ext_capab, *nested; 2898 2899 nested = nla_nest_start_noflag(msg, 2900 NL80211_ATTR_IFTYPE_EXT_CAPA); 2901 if (!nested) 2902 goto nla_put_failure; 2903 2904 for (i = state->capa_start; 2905 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2906 const struct wiphy_iftype_ext_capab *capab; 2907 2908 capab = &rdev->wiphy.iftype_ext_capab[i]; 2909 2910 nested_ext_capab = nla_nest_start_noflag(msg, 2911 i); 2912 if (!nested_ext_capab || 2913 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2914 capab->iftype) || 2915 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2916 capab->extended_capabilities_len, 2917 capab->extended_capabilities) || 2918 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2919 capab->extended_capabilities_len, 2920 capab->extended_capabilities_mask)) 2921 goto nla_put_failure; 2922 2923 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO && 2924 (nla_put_u16(msg, 2925 NL80211_ATTR_EML_CAPABILITY, 2926 capab->eml_capabilities) || 2927 nla_put_u16(msg, 2928 NL80211_ATTR_MLD_CAPA_AND_OPS, 2929 capab->mld_capa_and_ops))) 2930 goto nla_put_failure; 2931 2932 nla_nest_end(msg, nested_ext_capab); 2933 if (state->split) 2934 break; 2935 } 2936 nla_nest_end(msg, nested); 2937 if (i < rdev->wiphy.num_iftype_ext_capab) { 2938 state->capa_start = i + 1; 2939 break; 2940 } 2941 } 2942 2943 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2944 rdev->wiphy.nan_supported_bands)) 2945 goto nla_put_failure; 2946 2947 if (wiphy_ext_feature_isset(&rdev->wiphy, 2948 NL80211_EXT_FEATURE_TXQS)) { 2949 struct cfg80211_txq_stats txqstats = {}; 2950 int res; 2951 2952 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2953 if (!res && 2954 !nl80211_put_txq_stats(msg, &txqstats, 2955 NL80211_ATTR_TXQ_STATS)) 2956 goto nla_put_failure; 2957 2958 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2959 rdev->wiphy.txq_limit)) 2960 goto nla_put_failure; 2961 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2962 rdev->wiphy.txq_memory_limit)) 2963 goto nla_put_failure; 2964 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2965 rdev->wiphy.txq_quantum)) 2966 goto nla_put_failure; 2967 } 2968 2969 state->split_start++; 2970 break; 2971 case 14: 2972 if (nl80211_send_pmsr_capa(rdev, msg)) 2973 goto nla_put_failure; 2974 2975 state->split_start++; 2976 break; 2977 case 15: 2978 if (rdev->wiphy.akm_suites && 2979 nla_put(msg, NL80211_ATTR_AKM_SUITES, 2980 sizeof(u32) * rdev->wiphy.n_akm_suites, 2981 rdev->wiphy.akm_suites)) 2982 goto nla_put_failure; 2983 2984 if (nl80211_put_iftype_akm_suites(rdev, msg)) 2985 goto nla_put_failure; 2986 2987 if (nl80211_put_tid_config_support(rdev, msg)) 2988 goto nla_put_failure; 2989 state->split_start++; 2990 break; 2991 case 16: 2992 if (nl80211_put_sar_specs(rdev, msg)) 2993 goto nla_put_failure; 2994 2995 if (nl80211_put_mbssid_support(&rdev->wiphy, msg)) 2996 goto nla_put_failure; 2997 2998 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES, 2999 rdev->wiphy.max_num_akm_suites)) 3000 goto nla_put_failure; 3001 3002 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO) 3003 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT); 3004 3005 if (rdev->wiphy.hw_timestamp_max_peers && 3006 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS, 3007 rdev->wiphy.hw_timestamp_max_peers)) 3008 goto nla_put_failure; 3009 3010 /* done */ 3011 state->split_start = 0; 3012 break; 3013 } 3014 finish: 3015 genlmsg_end(msg, hdr); 3016 return 0; 3017 3018 nla_put_failure: 3019 genlmsg_cancel(msg, hdr); 3020 return -EMSGSIZE; 3021 } 3022 3023 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 3024 struct netlink_callback *cb, 3025 struct nl80211_dump_wiphy_state *state) 3026 { 3027 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 3028 int ret; 3029 3030 if (!tb) 3031 return -ENOMEM; 3032 3033 ret = nlmsg_parse_deprecated(cb->nlh, 3034 GENL_HDRLEN + nl80211_fam.hdrsize, 3035 tb, nl80211_fam.maxattr, 3036 nl80211_policy, NULL); 3037 /* ignore parse errors for backward compatibility */ 3038 if (ret) { 3039 ret = 0; 3040 goto out; 3041 } 3042 3043 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 3044 if (tb[NL80211_ATTR_WIPHY]) 3045 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 3046 if (tb[NL80211_ATTR_WDEV]) 3047 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 3048 if (tb[NL80211_ATTR_IFINDEX]) { 3049 struct net_device *netdev; 3050 struct cfg80211_registered_device *rdev; 3051 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 3052 3053 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 3054 if (!netdev) { 3055 ret = -ENODEV; 3056 goto out; 3057 } 3058 if (netdev->ieee80211_ptr) { 3059 rdev = wiphy_to_rdev( 3060 netdev->ieee80211_ptr->wiphy); 3061 state->filter_wiphy = rdev->wiphy_idx; 3062 } 3063 } 3064 3065 ret = 0; 3066 out: 3067 kfree(tb); 3068 return ret; 3069 } 3070 3071 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 3072 { 3073 int idx = 0, ret; 3074 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 3075 struct cfg80211_registered_device *rdev; 3076 3077 rtnl_lock(); 3078 if (!state) { 3079 state = kzalloc(sizeof(*state), GFP_KERNEL); 3080 if (!state) { 3081 rtnl_unlock(); 3082 return -ENOMEM; 3083 } 3084 state->filter_wiphy = -1; 3085 ret = nl80211_dump_wiphy_parse(skb, cb, state); 3086 if (ret) { 3087 kfree(state); 3088 rtnl_unlock(); 3089 return ret; 3090 } 3091 cb->args[0] = (long)state; 3092 } 3093 3094 for_each_rdev(rdev) { 3095 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3096 continue; 3097 if (++idx <= state->start) 3098 continue; 3099 if (state->filter_wiphy != -1 && 3100 state->filter_wiphy != rdev->wiphy_idx) 3101 continue; 3102 wiphy_lock(&rdev->wiphy); 3103 /* attempt to fit multiple wiphy data chunks into the skb */ 3104 do { 3105 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 3106 skb, 3107 NETLINK_CB(cb->skb).portid, 3108 cb->nlh->nlmsg_seq, 3109 NLM_F_MULTI, state); 3110 if (ret < 0) { 3111 /* 3112 * If sending the wiphy data didn't fit (ENOBUFS 3113 * or EMSGSIZE returned), this SKB is still 3114 * empty (so it's not too big because another 3115 * wiphy dataset is already in the skb) and 3116 * we've not tried to adjust the dump allocation 3117 * yet ... then adjust the alloc size to be 3118 * bigger, and return 1 but with the empty skb. 3119 * This results in an empty message being RX'ed 3120 * in userspace, but that is ignored. 3121 * 3122 * We can then retry with the larger buffer. 3123 */ 3124 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 3125 !skb->len && !state->split && 3126 cb->min_dump_alloc < 4096) { 3127 cb->min_dump_alloc = 4096; 3128 state->split_start = 0; 3129 wiphy_unlock(&rdev->wiphy); 3130 rtnl_unlock(); 3131 return 1; 3132 } 3133 idx--; 3134 break; 3135 } 3136 } while (state->split_start > 0); 3137 wiphy_unlock(&rdev->wiphy); 3138 break; 3139 } 3140 rtnl_unlock(); 3141 3142 state->start = idx; 3143 3144 return skb->len; 3145 } 3146 3147 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 3148 { 3149 kfree((void *)cb->args[0]); 3150 return 0; 3151 } 3152 3153 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 3154 { 3155 struct sk_buff *msg; 3156 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3157 struct nl80211_dump_wiphy_state state = {}; 3158 3159 msg = nlmsg_new(4096, GFP_KERNEL); 3160 if (!msg) 3161 return -ENOMEM; 3162 3163 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 3164 info->snd_portid, info->snd_seq, 0, 3165 &state) < 0) { 3166 nlmsg_free(msg); 3167 return -ENOBUFS; 3168 } 3169 3170 return genlmsg_reply(msg, info); 3171 } 3172 3173 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 3174 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 3175 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 3176 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 3177 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 3178 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 3179 }; 3180 3181 static int parse_txq_params(struct nlattr *tb[], 3182 struct ieee80211_txq_params *txq_params) 3183 { 3184 u8 ac; 3185 3186 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 3187 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 3188 !tb[NL80211_TXQ_ATTR_AIFS]) 3189 return -EINVAL; 3190 3191 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 3192 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 3193 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 3194 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 3195 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 3196 3197 if (ac >= NL80211_NUM_ACS) 3198 return -EINVAL; 3199 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 3200 return 0; 3201 } 3202 3203 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 3204 { 3205 /* 3206 * You can only set the channel explicitly for some interfaces, 3207 * most have their channel managed via their respective 3208 * "establish a connection" command (connect, join, ...) 3209 * 3210 * For AP/GO and mesh mode, the channel can be set with the 3211 * channel userspace API, but is only stored and passed to the 3212 * low-level driver when the AP starts or the mesh is joined. 3213 * This is for backward compatibility, userspace can also give 3214 * the channel in the start-ap or join-mesh commands instead. 3215 * 3216 * Monitors are special as they are normally slaved to 3217 * whatever else is going on, so they have their own special 3218 * operation to set the monitor channel if possible. 3219 */ 3220 return !wdev || 3221 wdev->iftype == NL80211_IFTYPE_AP || 3222 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 3223 wdev->iftype == NL80211_IFTYPE_MONITOR || 3224 wdev->iftype == NL80211_IFTYPE_P2P_GO; 3225 } 3226 3227 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev, 3228 struct genl_info *info, 3229 const struct cfg80211_chan_def *chandef, 3230 u16 *punct_bitmap) 3231 { 3232 if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT)) 3233 return -EINVAL; 3234 3235 *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]); 3236 if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef)) 3237 return -EINVAL; 3238 3239 return 0; 3240 } 3241 3242 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 3243 struct genl_info *info, 3244 struct cfg80211_chan_def *chandef) 3245 { 3246 struct netlink_ext_ack *extack = info->extack; 3247 struct nlattr **attrs = info->attrs; 3248 u32 control_freq; 3249 3250 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) { 3251 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3252 "Frequency is missing"); 3253 return -EINVAL; 3254 } 3255 3256 control_freq = MHZ_TO_KHZ( 3257 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 3258 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 3259 control_freq += 3260 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 3261 3262 memset(chandef, 0, sizeof(*chandef)); 3263 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq); 3264 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 3265 chandef->center_freq1 = KHZ_TO_MHZ(control_freq); 3266 chandef->freq1_offset = control_freq % 1000; 3267 chandef->center_freq2 = 0; 3268 3269 /* Primary channel not allowed */ 3270 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 3271 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 3272 "Channel is disabled"); 3273 return -EINVAL; 3274 } 3275 3276 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 3277 enum nl80211_channel_type chantype; 3278 3279 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 3280 3281 switch (chantype) { 3282 case NL80211_CHAN_NO_HT: 3283 case NL80211_CHAN_HT20: 3284 case NL80211_CHAN_HT40PLUS: 3285 case NL80211_CHAN_HT40MINUS: 3286 cfg80211_chandef_create(chandef, chandef->chan, 3287 chantype); 3288 /* user input for center_freq is incorrect */ 3289 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 3290 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 3291 NL_SET_ERR_MSG_ATTR(extack, 3292 attrs[NL80211_ATTR_CENTER_FREQ1], 3293 "bad center frequency 1"); 3294 return -EINVAL; 3295 } 3296 /* center_freq2 must be zero */ 3297 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 3298 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 3299 NL_SET_ERR_MSG_ATTR(extack, 3300 attrs[NL80211_ATTR_CENTER_FREQ2], 3301 "center frequency 2 can't be used"); 3302 return -EINVAL; 3303 } 3304 break; 3305 default: 3306 NL_SET_ERR_MSG_ATTR(extack, 3307 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 3308 "invalid channel type"); 3309 return -EINVAL; 3310 } 3311 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 3312 chandef->width = 3313 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 3314 if (chandef->chan->band == NL80211_BAND_S1GHZ) { 3315 /* User input error for channel width doesn't match channel */ 3316 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) { 3317 NL_SET_ERR_MSG_ATTR(extack, 3318 attrs[NL80211_ATTR_CHANNEL_WIDTH], 3319 "bad channel width"); 3320 return -EINVAL; 3321 } 3322 } 3323 if (attrs[NL80211_ATTR_CENTER_FREQ1]) { 3324 chandef->center_freq1 = 3325 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 3326 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]) 3327 chandef->freq1_offset = nla_get_u32( 3328 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]); 3329 else 3330 chandef->freq1_offset = 0; 3331 } 3332 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 3333 chandef->center_freq2 = 3334 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 3335 } 3336 3337 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 3338 chandef->edmg.channels = 3339 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 3340 3341 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 3342 chandef->edmg.bw_config = 3343 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 3344 } else { 3345 chandef->edmg.bw_config = 0; 3346 chandef->edmg.channels = 0; 3347 } 3348 3349 if (!cfg80211_chandef_valid(chandef)) { 3350 NL_SET_ERR_MSG(extack, "invalid channel definition"); 3351 return -EINVAL; 3352 } 3353 3354 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 3355 IEEE80211_CHAN_DISABLED)) { 3356 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 3357 return -EINVAL; 3358 } 3359 3360 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 3361 chandef->width == NL80211_CHAN_WIDTH_10) && 3362 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 3363 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 3364 return -EINVAL; 3365 } 3366 3367 return 0; 3368 } 3369 3370 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 3371 struct net_device *dev, 3372 struct genl_info *info, 3373 int _link_id) 3374 { 3375 struct cfg80211_chan_def chandef; 3376 int result; 3377 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 3378 struct wireless_dev *wdev = NULL; 3379 int link_id = _link_id; 3380 3381 if (dev) 3382 wdev = dev->ieee80211_ptr; 3383 if (!nl80211_can_set_dev_channel(wdev)) 3384 return -EOPNOTSUPP; 3385 if (wdev) 3386 iftype = wdev->iftype; 3387 3388 if (link_id < 0) { 3389 if (wdev && wdev->valid_links) 3390 return -EINVAL; 3391 link_id = 0; 3392 } 3393 3394 result = nl80211_parse_chandef(rdev, info, &chandef); 3395 if (result) 3396 return result; 3397 3398 switch (iftype) { 3399 case NL80211_IFTYPE_AP: 3400 case NL80211_IFTYPE_P2P_GO: 3401 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 3402 iftype)) 3403 return -EINVAL; 3404 if (wdev->links[link_id].ap.beacon_interval) { 3405 struct ieee80211_channel *cur_chan; 3406 3407 if (!dev || !rdev->ops->set_ap_chanwidth || 3408 !(rdev->wiphy.features & 3409 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) 3410 return -EBUSY; 3411 3412 /* Only allow dynamic channel width changes */ 3413 cur_chan = wdev->links[link_id].ap.chandef.chan; 3414 if (chandef.chan != cur_chan) 3415 return -EBUSY; 3416 3417 result = rdev_set_ap_chanwidth(rdev, dev, link_id, 3418 &chandef); 3419 if (result) 3420 return result; 3421 wdev->links[link_id].ap.chandef = chandef; 3422 } else { 3423 wdev->u.ap.preset_chandef = chandef; 3424 } 3425 return 0; 3426 case NL80211_IFTYPE_MESH_POINT: 3427 return cfg80211_set_mesh_channel(rdev, wdev, &chandef); 3428 case NL80211_IFTYPE_MONITOR: 3429 return cfg80211_set_monitor_channel(rdev, &chandef); 3430 default: 3431 break; 3432 } 3433 3434 return -EINVAL; 3435 } 3436 3437 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 3438 { 3439 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3440 int link_id = nl80211_link_id_or_invalid(info->attrs); 3441 struct net_device *netdev = info->user_ptr[1]; 3442 3443 return __nl80211_set_channel(rdev, netdev, info, link_id); 3444 } 3445 3446 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 3447 { 3448 struct cfg80211_registered_device *rdev = NULL; 3449 struct net_device *netdev = NULL; 3450 struct wireless_dev *wdev; 3451 int result = 0, rem_txq_params = 0; 3452 struct nlattr *nl_txq_params; 3453 u32 changed; 3454 u8 retry_short = 0, retry_long = 0; 3455 u32 frag_threshold = 0, rts_threshold = 0; 3456 u8 coverage_class = 0; 3457 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 3458 3459 rtnl_lock(); 3460 /* 3461 * Try to find the wiphy and netdev. Normally this 3462 * function shouldn't need the netdev, but this is 3463 * done for backward compatibility -- previously 3464 * setting the channel was done per wiphy, but now 3465 * it is per netdev. Previous userland like hostapd 3466 * also passed a netdev to set_wiphy, so that it is 3467 * possible to let that go to the right netdev! 3468 */ 3469 3470 if (info->attrs[NL80211_ATTR_IFINDEX]) { 3471 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 3472 3473 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 3474 if (netdev && netdev->ieee80211_ptr) 3475 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 3476 else 3477 netdev = NULL; 3478 } 3479 3480 if (!netdev) { 3481 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 3482 info->attrs); 3483 if (IS_ERR(rdev)) { 3484 rtnl_unlock(); 3485 return PTR_ERR(rdev); 3486 } 3487 wdev = NULL; 3488 netdev = NULL; 3489 result = 0; 3490 } else 3491 wdev = netdev->ieee80211_ptr; 3492 3493 wiphy_lock(&rdev->wiphy); 3494 3495 /* 3496 * end workaround code, by now the rdev is available 3497 * and locked, and wdev may or may not be NULL. 3498 */ 3499 3500 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 3501 result = cfg80211_dev_rename( 3502 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 3503 rtnl_unlock(); 3504 3505 if (result) 3506 goto out; 3507 3508 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 3509 struct ieee80211_txq_params txq_params; 3510 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 3511 3512 if (!rdev->ops->set_txq_params) { 3513 result = -EOPNOTSUPP; 3514 goto out; 3515 } 3516 3517 if (!netdev) { 3518 result = -EINVAL; 3519 goto out; 3520 } 3521 3522 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3523 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 3524 result = -EINVAL; 3525 goto out; 3526 } 3527 3528 if (!netif_running(netdev)) { 3529 result = -ENETDOWN; 3530 goto out; 3531 } 3532 3533 nla_for_each_nested(nl_txq_params, 3534 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 3535 rem_txq_params) { 3536 result = nla_parse_nested_deprecated(tb, 3537 NL80211_TXQ_ATTR_MAX, 3538 nl_txq_params, 3539 txq_params_policy, 3540 info->extack); 3541 if (result) 3542 goto out; 3543 result = parse_txq_params(tb, &txq_params); 3544 if (result) 3545 goto out; 3546 3547 txq_params.link_id = 3548 nl80211_link_id_or_invalid(info->attrs); 3549 3550 if (txq_params.link_id >= 0 && 3551 !(netdev->ieee80211_ptr->valid_links & 3552 BIT(txq_params.link_id))) 3553 result = -ENOLINK; 3554 else if (txq_params.link_id >= 0 && 3555 !netdev->ieee80211_ptr->valid_links) 3556 result = -EINVAL; 3557 else 3558 result = rdev_set_txq_params(rdev, netdev, 3559 &txq_params); 3560 if (result) 3561 goto out; 3562 } 3563 } 3564 3565 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3566 int link_id = nl80211_link_id_or_invalid(info->attrs); 3567 3568 if (wdev) { 3569 result = __nl80211_set_channel( 3570 rdev, 3571 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 3572 info, link_id); 3573 } else { 3574 result = __nl80211_set_channel(rdev, netdev, info, link_id); 3575 } 3576 3577 if (result) 3578 goto out; 3579 } 3580 3581 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 3582 struct wireless_dev *txp_wdev = wdev; 3583 enum nl80211_tx_power_setting type; 3584 int idx, mbm = 0; 3585 3586 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 3587 txp_wdev = NULL; 3588 3589 if (!rdev->ops->set_tx_power) { 3590 result = -EOPNOTSUPP; 3591 goto out; 3592 } 3593 3594 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 3595 type = nla_get_u32(info->attrs[idx]); 3596 3597 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 3598 (type != NL80211_TX_POWER_AUTOMATIC)) { 3599 result = -EINVAL; 3600 goto out; 3601 } 3602 3603 if (type != NL80211_TX_POWER_AUTOMATIC) { 3604 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 3605 mbm = nla_get_u32(info->attrs[idx]); 3606 } 3607 3608 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 3609 if (result) 3610 goto out; 3611 } 3612 3613 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 3614 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 3615 u32 tx_ant, rx_ant; 3616 3617 if ((!rdev->wiphy.available_antennas_tx && 3618 !rdev->wiphy.available_antennas_rx) || 3619 !rdev->ops->set_antenna) { 3620 result = -EOPNOTSUPP; 3621 goto out; 3622 } 3623 3624 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 3625 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 3626 3627 /* reject antenna configurations which don't match the 3628 * available antenna masks, except for the "all" mask */ 3629 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 3630 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) { 3631 result = -EINVAL; 3632 goto out; 3633 } 3634 3635 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 3636 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 3637 3638 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 3639 if (result) 3640 goto out; 3641 } 3642 3643 changed = 0; 3644 3645 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 3646 retry_short = nla_get_u8( 3647 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 3648 3649 changed |= WIPHY_PARAM_RETRY_SHORT; 3650 } 3651 3652 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 3653 retry_long = nla_get_u8( 3654 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 3655 3656 changed |= WIPHY_PARAM_RETRY_LONG; 3657 } 3658 3659 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 3660 frag_threshold = nla_get_u32( 3661 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 3662 if (frag_threshold < 256) { 3663 result = -EINVAL; 3664 goto out; 3665 } 3666 3667 if (frag_threshold != (u32) -1) { 3668 /* 3669 * Fragments (apart from the last one) are required to 3670 * have even length. Make the fragmentation code 3671 * simpler by stripping LSB should someone try to use 3672 * odd threshold value. 3673 */ 3674 frag_threshold &= ~0x1; 3675 } 3676 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 3677 } 3678 3679 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 3680 rts_threshold = nla_get_u32( 3681 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 3682 changed |= WIPHY_PARAM_RTS_THRESHOLD; 3683 } 3684 3685 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 3686 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3687 result = -EINVAL; 3688 goto out; 3689 } 3690 3691 coverage_class = nla_get_u8( 3692 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 3693 changed |= WIPHY_PARAM_COVERAGE_CLASS; 3694 } 3695 3696 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 3697 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) { 3698 result = -EOPNOTSUPP; 3699 goto out; 3700 } 3701 3702 changed |= WIPHY_PARAM_DYN_ACK; 3703 } 3704 3705 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 3706 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3707 NL80211_EXT_FEATURE_TXQS)) { 3708 result = -EOPNOTSUPP; 3709 goto out; 3710 } 3711 txq_limit = nla_get_u32( 3712 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 3713 changed |= WIPHY_PARAM_TXQ_LIMIT; 3714 } 3715 3716 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 3717 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3718 NL80211_EXT_FEATURE_TXQS)) { 3719 result = -EOPNOTSUPP; 3720 goto out; 3721 } 3722 txq_memory_limit = nla_get_u32( 3723 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 3724 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 3725 } 3726 3727 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 3728 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3729 NL80211_EXT_FEATURE_TXQS)) { 3730 result = -EOPNOTSUPP; 3731 goto out; 3732 } 3733 txq_quantum = nla_get_u32( 3734 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 3735 changed |= WIPHY_PARAM_TXQ_QUANTUM; 3736 } 3737 3738 if (changed) { 3739 u8 old_retry_short, old_retry_long; 3740 u32 old_frag_threshold, old_rts_threshold; 3741 u8 old_coverage_class; 3742 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 3743 3744 if (!rdev->ops->set_wiphy_params) { 3745 result = -EOPNOTSUPP; 3746 goto out; 3747 } 3748 3749 old_retry_short = rdev->wiphy.retry_short; 3750 old_retry_long = rdev->wiphy.retry_long; 3751 old_frag_threshold = rdev->wiphy.frag_threshold; 3752 old_rts_threshold = rdev->wiphy.rts_threshold; 3753 old_coverage_class = rdev->wiphy.coverage_class; 3754 old_txq_limit = rdev->wiphy.txq_limit; 3755 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 3756 old_txq_quantum = rdev->wiphy.txq_quantum; 3757 3758 if (changed & WIPHY_PARAM_RETRY_SHORT) 3759 rdev->wiphy.retry_short = retry_short; 3760 if (changed & WIPHY_PARAM_RETRY_LONG) 3761 rdev->wiphy.retry_long = retry_long; 3762 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 3763 rdev->wiphy.frag_threshold = frag_threshold; 3764 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 3765 rdev->wiphy.rts_threshold = rts_threshold; 3766 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 3767 rdev->wiphy.coverage_class = coverage_class; 3768 if (changed & WIPHY_PARAM_TXQ_LIMIT) 3769 rdev->wiphy.txq_limit = txq_limit; 3770 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 3771 rdev->wiphy.txq_memory_limit = txq_memory_limit; 3772 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 3773 rdev->wiphy.txq_quantum = txq_quantum; 3774 3775 result = rdev_set_wiphy_params(rdev, changed); 3776 if (result) { 3777 rdev->wiphy.retry_short = old_retry_short; 3778 rdev->wiphy.retry_long = old_retry_long; 3779 rdev->wiphy.frag_threshold = old_frag_threshold; 3780 rdev->wiphy.rts_threshold = old_rts_threshold; 3781 rdev->wiphy.coverage_class = old_coverage_class; 3782 rdev->wiphy.txq_limit = old_txq_limit; 3783 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 3784 rdev->wiphy.txq_quantum = old_txq_quantum; 3785 goto out; 3786 } 3787 } 3788 3789 result = 0; 3790 3791 out: 3792 wiphy_unlock(&rdev->wiphy); 3793 return result; 3794 } 3795 3796 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef) 3797 { 3798 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 3799 return -EINVAL; 3800 3801 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 3802 chandef->chan->center_freq)) 3803 return -ENOBUFS; 3804 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 3805 chandef->chan->freq_offset)) 3806 return -ENOBUFS; 3807 switch (chandef->width) { 3808 case NL80211_CHAN_WIDTH_20_NOHT: 3809 case NL80211_CHAN_WIDTH_20: 3810 case NL80211_CHAN_WIDTH_40: 3811 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3812 cfg80211_get_chandef_type(chandef))) 3813 return -ENOBUFS; 3814 break; 3815 default: 3816 break; 3817 } 3818 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 3819 return -ENOBUFS; 3820 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 3821 return -ENOBUFS; 3822 if (chandef->center_freq2 && 3823 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 3824 return -ENOBUFS; 3825 return 0; 3826 } 3827 EXPORT_SYMBOL(nl80211_send_chandef); 3828 3829 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 3830 struct cfg80211_registered_device *rdev, 3831 struct wireless_dev *wdev, 3832 enum nl80211_commands cmd) 3833 { 3834 struct net_device *dev = wdev->netdev; 3835 void *hdr; 3836 3837 lockdep_assert_wiphy(&rdev->wiphy); 3838 3839 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 3840 cmd != NL80211_CMD_DEL_INTERFACE && 3841 cmd != NL80211_CMD_SET_INTERFACE); 3842 3843 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 3844 if (!hdr) 3845 return -1; 3846 3847 if (dev && 3848 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3849 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 3850 goto nla_put_failure; 3851 3852 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 3853 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 3854 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 3855 NL80211_ATTR_PAD) || 3856 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 3857 nla_put_u32(msg, NL80211_ATTR_GENERATION, 3858 rdev->devlist_generation ^ 3859 (cfg80211_rdev_list_generation << 2)) || 3860 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 3861 goto nla_put_failure; 3862 3863 if (rdev->ops->get_channel && !wdev->valid_links) { 3864 struct cfg80211_chan_def chandef = {}; 3865 int ret; 3866 3867 ret = rdev_get_channel(rdev, wdev, 0, &chandef); 3868 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3869 goto nla_put_failure; 3870 } 3871 3872 if (rdev->ops->get_tx_power) { 3873 int dbm, ret; 3874 3875 ret = rdev_get_tx_power(rdev, wdev, &dbm); 3876 if (ret == 0 && 3877 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 3878 DBM_TO_MBM(dbm))) 3879 goto nla_put_failure; 3880 } 3881 3882 switch (wdev->iftype) { 3883 case NL80211_IFTYPE_AP: 3884 case NL80211_IFTYPE_P2P_GO: 3885 if (wdev->u.ap.ssid_len && 3886 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 3887 wdev->u.ap.ssid)) 3888 goto nla_put_failure; 3889 break; 3890 case NL80211_IFTYPE_STATION: 3891 case NL80211_IFTYPE_P2P_CLIENT: 3892 if (wdev->u.client.ssid_len && 3893 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len, 3894 wdev->u.client.ssid)) 3895 goto nla_put_failure; 3896 break; 3897 case NL80211_IFTYPE_ADHOC: 3898 if (wdev->u.ibss.ssid_len && 3899 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len, 3900 wdev->u.ibss.ssid)) 3901 goto nla_put_failure; 3902 break; 3903 default: 3904 /* nothing */ 3905 break; 3906 } 3907 3908 if (rdev->ops->get_txq_stats) { 3909 struct cfg80211_txq_stats txqstats = {}; 3910 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 3911 3912 if (ret == 0 && 3913 !nl80211_put_txq_stats(msg, &txqstats, 3914 NL80211_ATTR_TXQ_STATS)) 3915 goto nla_put_failure; 3916 } 3917 3918 if (wdev->valid_links) { 3919 unsigned int link_id; 3920 struct nlattr *links = nla_nest_start(msg, 3921 NL80211_ATTR_MLO_LINKS); 3922 3923 if (!links) 3924 goto nla_put_failure; 3925 3926 for_each_valid_link(wdev, link_id) { 3927 struct nlattr *link = nla_nest_start(msg, link_id + 1); 3928 struct cfg80211_chan_def chandef = {}; 3929 int ret; 3930 3931 if (!link) 3932 goto nla_put_failure; 3933 3934 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 3935 goto nla_put_failure; 3936 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 3937 wdev->links[link_id].addr)) 3938 goto nla_put_failure; 3939 3940 ret = rdev_get_channel(rdev, wdev, link_id, &chandef); 3941 if (ret == 0 && nl80211_send_chandef(msg, &chandef)) 3942 goto nla_put_failure; 3943 3944 nla_nest_end(msg, link); 3945 } 3946 3947 nla_nest_end(msg, links); 3948 } 3949 3950 genlmsg_end(msg, hdr); 3951 return 0; 3952 3953 nla_put_failure: 3954 genlmsg_cancel(msg, hdr); 3955 return -EMSGSIZE; 3956 } 3957 3958 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 3959 { 3960 int wp_idx = 0; 3961 int if_idx = 0; 3962 int wp_start = cb->args[0]; 3963 int if_start = cb->args[1]; 3964 int filter_wiphy = -1; 3965 struct cfg80211_registered_device *rdev; 3966 struct wireless_dev *wdev; 3967 int ret; 3968 3969 rtnl_lock(); 3970 if (!cb->args[2]) { 3971 struct nl80211_dump_wiphy_state state = { 3972 .filter_wiphy = -1, 3973 }; 3974 3975 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 3976 if (ret) 3977 goto out_unlock; 3978 3979 filter_wiphy = state.filter_wiphy; 3980 3981 /* 3982 * if filtering, set cb->args[2] to +1 since 0 is the default 3983 * value needed to determine that parsing is necessary. 3984 */ 3985 if (filter_wiphy >= 0) 3986 cb->args[2] = filter_wiphy + 1; 3987 else 3988 cb->args[2] = -1; 3989 } else if (cb->args[2] > 0) { 3990 filter_wiphy = cb->args[2] - 1; 3991 } 3992 3993 for_each_rdev(rdev) { 3994 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 3995 continue; 3996 if (wp_idx < wp_start) { 3997 wp_idx++; 3998 continue; 3999 } 4000 4001 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 4002 continue; 4003 4004 if_idx = 0; 4005 4006 wiphy_lock(&rdev->wiphy); 4007 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 4008 if (if_idx < if_start) { 4009 if_idx++; 4010 continue; 4011 } 4012 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 4013 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4014 rdev, wdev, 4015 NL80211_CMD_NEW_INTERFACE) < 0) { 4016 wiphy_unlock(&rdev->wiphy); 4017 goto out; 4018 } 4019 if_idx++; 4020 } 4021 wiphy_unlock(&rdev->wiphy); 4022 4023 if_start = 0; 4024 wp_idx++; 4025 } 4026 out: 4027 cb->args[0] = wp_idx; 4028 cb->args[1] = if_idx; 4029 4030 ret = skb->len; 4031 out_unlock: 4032 rtnl_unlock(); 4033 4034 return ret; 4035 } 4036 4037 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 4038 { 4039 struct sk_buff *msg; 4040 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4041 struct wireless_dev *wdev = info->user_ptr[1]; 4042 4043 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4044 if (!msg) 4045 return -ENOMEM; 4046 4047 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4048 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4049 nlmsg_free(msg); 4050 return -ENOBUFS; 4051 } 4052 4053 return genlmsg_reply(msg, info); 4054 } 4055 4056 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 4057 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 4058 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 4059 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 4060 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 4061 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 4062 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 4063 }; 4064 4065 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 4066 { 4067 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 4068 int flag; 4069 4070 *mntrflags = 0; 4071 4072 if (!nla) 4073 return -EINVAL; 4074 4075 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL)) 4076 return -EINVAL; 4077 4078 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 4079 if (flags[flag]) 4080 *mntrflags |= (1<<flag); 4081 4082 *mntrflags |= MONITOR_FLAG_CHANGED; 4083 4084 return 0; 4085 } 4086 4087 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 4088 enum nl80211_iftype type, 4089 struct genl_info *info, 4090 struct vif_params *params) 4091 { 4092 bool change = false; 4093 int err; 4094 4095 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 4096 if (type != NL80211_IFTYPE_MONITOR) 4097 return -EINVAL; 4098 4099 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 4100 ¶ms->flags); 4101 if (err) 4102 return err; 4103 4104 change = true; 4105 } 4106 4107 if (params->flags & MONITOR_FLAG_ACTIVE && 4108 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 4109 return -EOPNOTSUPP; 4110 4111 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 4112 const u8 *mumimo_groups; 4113 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4114 4115 if (type != NL80211_IFTYPE_MONITOR) 4116 return -EINVAL; 4117 4118 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4119 return -EOPNOTSUPP; 4120 4121 mumimo_groups = 4122 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 4123 4124 /* bits 0 and 63 are reserved and must be zero */ 4125 if ((mumimo_groups[0] & BIT(0)) || 4126 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 4127 return -EINVAL; 4128 4129 params->vht_mumimo_groups = mumimo_groups; 4130 change = true; 4131 } 4132 4133 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 4134 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 4135 4136 if (type != NL80211_IFTYPE_MONITOR) 4137 return -EINVAL; 4138 4139 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 4140 return -EOPNOTSUPP; 4141 4142 params->vht_mumimo_follow_addr = 4143 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 4144 change = true; 4145 } 4146 4147 return change ? 1 : 0; 4148 } 4149 4150 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 4151 struct net_device *netdev, u8 use_4addr, 4152 enum nl80211_iftype iftype) 4153 { 4154 if (!use_4addr) { 4155 if (netdev && netif_is_bridge_port(netdev)) 4156 return -EBUSY; 4157 return 0; 4158 } 4159 4160 switch (iftype) { 4161 case NL80211_IFTYPE_AP_VLAN: 4162 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 4163 return 0; 4164 break; 4165 case NL80211_IFTYPE_STATION: 4166 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 4167 return 0; 4168 break; 4169 default: 4170 break; 4171 } 4172 4173 return -EOPNOTSUPP; 4174 } 4175 4176 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 4177 { 4178 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4179 struct vif_params params; 4180 int err; 4181 enum nl80211_iftype otype, ntype; 4182 struct net_device *dev = info->user_ptr[1]; 4183 bool change = false; 4184 4185 memset(¶ms, 0, sizeof(params)); 4186 4187 otype = ntype = dev->ieee80211_ptr->iftype; 4188 4189 if (info->attrs[NL80211_ATTR_IFTYPE]) { 4190 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4191 if (otype != ntype) 4192 change = true; 4193 } 4194 4195 if (info->attrs[NL80211_ATTR_MESH_ID]) { 4196 struct wireless_dev *wdev = dev->ieee80211_ptr; 4197 4198 if (ntype != NL80211_IFTYPE_MESH_POINT) 4199 return -EINVAL; 4200 if (netif_running(dev)) 4201 return -EBUSY; 4202 4203 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4204 IEEE80211_MAX_MESH_ID_LEN); 4205 wdev->u.mesh.id_up_len = 4206 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4207 memcpy(wdev->u.mesh.id, 4208 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4209 wdev->u.mesh.id_up_len); 4210 } 4211 4212 if (info->attrs[NL80211_ATTR_4ADDR]) { 4213 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4214 change = true; 4215 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 4216 if (err) 4217 return err; 4218 } else { 4219 params.use_4addr = -1; 4220 } 4221 4222 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 4223 if (err < 0) 4224 return err; 4225 if (err > 0) 4226 change = true; 4227 4228 if (change) 4229 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 4230 else 4231 err = 0; 4232 4233 if (!err && params.use_4addr != -1) 4234 dev->ieee80211_ptr->use_4addr = params.use_4addr; 4235 4236 if (change && !err) { 4237 struct wireless_dev *wdev = dev->ieee80211_ptr; 4238 4239 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE); 4240 } 4241 4242 return err; 4243 } 4244 4245 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4246 { 4247 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4248 struct vif_params params; 4249 struct wireless_dev *wdev; 4250 struct sk_buff *msg; 4251 int err; 4252 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 4253 4254 memset(¶ms, 0, sizeof(params)); 4255 4256 if (!info->attrs[NL80211_ATTR_IFNAME]) 4257 return -EINVAL; 4258 4259 if (info->attrs[NL80211_ATTR_IFTYPE]) 4260 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 4261 4262 if (!rdev->ops->add_virtual_intf) 4263 return -EOPNOTSUPP; 4264 4265 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 4266 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 4267 info->attrs[NL80211_ATTR_MAC]) { 4268 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 4269 ETH_ALEN); 4270 if (!is_valid_ether_addr(params.macaddr)) 4271 return -EADDRNOTAVAIL; 4272 } 4273 4274 if (info->attrs[NL80211_ATTR_4ADDR]) { 4275 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 4276 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 4277 if (err) 4278 return err; 4279 } 4280 4281 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) 4282 return -EOPNOTSUPP; 4283 4284 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 4285 if (err < 0) 4286 return err; 4287 4288 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4289 if (!msg) 4290 return -ENOMEM; 4291 4292 wdev = rdev_add_virtual_intf(rdev, 4293 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 4294 NET_NAME_USER, type, ¶ms); 4295 if (WARN_ON(!wdev)) { 4296 nlmsg_free(msg); 4297 return -EPROTO; 4298 } else if (IS_ERR(wdev)) { 4299 nlmsg_free(msg); 4300 return PTR_ERR(wdev); 4301 } 4302 4303 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 4304 wdev->owner_nlportid = info->snd_portid; 4305 4306 switch (type) { 4307 case NL80211_IFTYPE_MESH_POINT: 4308 if (!info->attrs[NL80211_ATTR_MESH_ID]) 4309 break; 4310 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 4311 IEEE80211_MAX_MESH_ID_LEN); 4312 wdev->u.mesh.id_up_len = 4313 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 4314 memcpy(wdev->u.mesh.id, 4315 nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 4316 wdev->u.mesh.id_up_len); 4317 break; 4318 case NL80211_IFTYPE_NAN: 4319 case NL80211_IFTYPE_P2P_DEVICE: 4320 /* 4321 * P2P Device and NAN do not have a netdev, so don't go 4322 * through the netdev notifier and must be added here 4323 */ 4324 cfg80211_init_wdev(wdev); 4325 cfg80211_register_wdev(rdev, wdev); 4326 break; 4327 default: 4328 break; 4329 } 4330 4331 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 4332 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) { 4333 nlmsg_free(msg); 4334 return -ENOBUFS; 4335 } 4336 4337 return genlmsg_reply(msg, info); 4338 } 4339 4340 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 4341 { 4342 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4343 int ret; 4344 4345 /* to avoid failing a new interface creation due to pending removal */ 4346 cfg80211_destroy_ifaces(rdev); 4347 4348 wiphy_lock(&rdev->wiphy); 4349 ret = _nl80211_new_interface(skb, info); 4350 wiphy_unlock(&rdev->wiphy); 4351 4352 return ret; 4353 } 4354 4355 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 4356 { 4357 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4358 struct wireless_dev *wdev = info->user_ptr[1]; 4359 4360 if (!rdev->ops->del_virtual_intf) 4361 return -EOPNOTSUPP; 4362 4363 /* 4364 * We hold RTNL, so this is safe, without RTNL opencount cannot 4365 * reach 0, and thus the rdev cannot be deleted. 4366 * 4367 * We need to do it for the dev_close(), since that will call 4368 * the netdev notifiers, and we need to acquire the mutex there 4369 * but don't know if we get there from here or from some other 4370 * place (e.g. "ip link set ... down"). 4371 */ 4372 mutex_unlock(&rdev->wiphy.mtx); 4373 4374 /* 4375 * If we remove a wireless device without a netdev then clear 4376 * user_ptr[1] so that nl80211_post_doit won't dereference it 4377 * to check if it needs to do dev_put(). Otherwise it crashes 4378 * since the wdev has been freed, unlike with a netdev where 4379 * we need the dev_put() for the netdev to really be freed. 4380 */ 4381 if (!wdev->netdev) 4382 info->user_ptr[1] = NULL; 4383 else 4384 dev_close(wdev->netdev); 4385 4386 mutex_lock(&rdev->wiphy.mtx); 4387 4388 return cfg80211_remove_virtual_intf(rdev, wdev); 4389 } 4390 4391 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 4392 { 4393 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4394 struct net_device *dev = info->user_ptr[1]; 4395 u16 noack_map; 4396 4397 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 4398 return -EINVAL; 4399 4400 if (!rdev->ops->set_noack_map) 4401 return -EOPNOTSUPP; 4402 4403 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 4404 4405 return rdev_set_noack_map(rdev, dev, noack_map); 4406 } 4407 4408 static int nl80211_validate_key_link_id(struct genl_info *info, 4409 struct wireless_dev *wdev, 4410 int link_id, bool pairwise) 4411 { 4412 if (pairwise) { 4413 if (link_id != -1) { 4414 GENL_SET_ERR_MSG(info, 4415 "link ID not allowed for pairwise key"); 4416 return -EINVAL; 4417 } 4418 4419 return 0; 4420 } 4421 4422 if (wdev->valid_links) { 4423 if (link_id == -1) { 4424 GENL_SET_ERR_MSG(info, 4425 "link ID must for MLO group key"); 4426 return -EINVAL; 4427 } 4428 if (!(wdev->valid_links & BIT(link_id))) { 4429 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key"); 4430 return -EINVAL; 4431 } 4432 } else if (link_id != -1) { 4433 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key"); 4434 return -EINVAL; 4435 } 4436 4437 return 0; 4438 } 4439 4440 struct get_key_cookie { 4441 struct sk_buff *msg; 4442 int error; 4443 int idx; 4444 }; 4445 4446 static void get_key_callback(void *c, struct key_params *params) 4447 { 4448 struct nlattr *key; 4449 struct get_key_cookie *cookie = c; 4450 4451 if ((params->key && 4452 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 4453 params->key_len, params->key)) || 4454 (params->seq && 4455 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 4456 params->seq_len, params->seq)) || 4457 (params->cipher && 4458 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 4459 params->cipher))) 4460 goto nla_put_failure; 4461 4462 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY); 4463 if (!key) 4464 goto nla_put_failure; 4465 4466 if ((params->key && 4467 nla_put(cookie->msg, NL80211_KEY_DATA, 4468 params->key_len, params->key)) || 4469 (params->seq && 4470 nla_put(cookie->msg, NL80211_KEY_SEQ, 4471 params->seq_len, params->seq)) || 4472 (params->cipher && 4473 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 4474 params->cipher))) 4475 goto nla_put_failure; 4476 4477 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 4478 goto nla_put_failure; 4479 4480 nla_nest_end(cookie->msg, key); 4481 4482 return; 4483 nla_put_failure: 4484 cookie->error = 1; 4485 } 4486 4487 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 4488 { 4489 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4490 int err; 4491 struct net_device *dev = info->user_ptr[1]; 4492 u8 key_idx = 0; 4493 const u8 *mac_addr = NULL; 4494 bool pairwise; 4495 struct get_key_cookie cookie = { 4496 .error = 0, 4497 }; 4498 void *hdr; 4499 struct sk_buff *msg; 4500 bool bigtk_support = false; 4501 int link_id = nl80211_link_id_or_invalid(info->attrs); 4502 struct wireless_dev *wdev = dev->ieee80211_ptr; 4503 4504 if (wiphy_ext_feature_isset(&rdev->wiphy, 4505 NL80211_EXT_FEATURE_BEACON_PROTECTION)) 4506 bigtk_support = true; 4507 4508 if ((wdev->iftype == NL80211_IFTYPE_STATION || 4509 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && 4510 wiphy_ext_feature_isset(&rdev->wiphy, 4511 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT)) 4512 bigtk_support = true; 4513 4514 if (info->attrs[NL80211_ATTR_KEY_IDX]) { 4515 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 4516 4517 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) { 4518 GENL_SET_ERR_MSG(info, "BIGTK not supported"); 4519 return -EINVAL; 4520 } 4521 } 4522 4523 if (info->attrs[NL80211_ATTR_MAC]) 4524 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4525 4526 pairwise = !!mac_addr; 4527 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 4528 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 4529 4530 if (kt != NL80211_KEYTYPE_GROUP && 4531 kt != NL80211_KEYTYPE_PAIRWISE) 4532 return -EINVAL; 4533 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 4534 } 4535 4536 if (!rdev->ops->get_key) 4537 return -EOPNOTSUPP; 4538 4539 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4540 return -ENOENT; 4541 4542 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4543 if (!msg) 4544 return -ENOMEM; 4545 4546 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 4547 NL80211_CMD_NEW_KEY); 4548 if (!hdr) 4549 goto nla_put_failure; 4550 4551 cookie.msg = msg; 4552 cookie.idx = key_idx; 4553 4554 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4555 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 4556 goto nla_put_failure; 4557 if (mac_addr && 4558 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 4559 goto nla_put_failure; 4560 4561 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise); 4562 if (err) 4563 goto free_msg; 4564 4565 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr, 4566 &cookie, get_key_callback); 4567 4568 if (err) 4569 goto free_msg; 4570 4571 if (cookie.error) 4572 goto nla_put_failure; 4573 4574 genlmsg_end(msg, hdr); 4575 return genlmsg_reply(msg, info); 4576 4577 nla_put_failure: 4578 err = -ENOBUFS; 4579 free_msg: 4580 nlmsg_free(msg); 4581 return err; 4582 } 4583 4584 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 4585 { 4586 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4587 struct key_parse key; 4588 int err; 4589 struct net_device *dev = info->user_ptr[1]; 4590 int link_id = nl80211_link_id_or_invalid(info->attrs); 4591 struct wireless_dev *wdev = dev->ieee80211_ptr; 4592 4593 err = nl80211_parse_key(info, &key); 4594 if (err) 4595 return err; 4596 4597 if (key.idx < 0) 4598 return -EINVAL; 4599 4600 /* Only support setting default key and 4601 * Extended Key ID action NL80211_KEY_SET_TX. 4602 */ 4603 if (!key.def && !key.defmgmt && !key.defbeacon && 4604 !(key.p.mode == NL80211_KEY_SET_TX)) 4605 return -EINVAL; 4606 4607 if (key.def) { 4608 if (!rdev->ops->set_default_key) 4609 return -EOPNOTSUPP; 4610 4611 err = nl80211_key_allowed(wdev); 4612 if (err) 4613 return err; 4614 4615 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4616 if (err) 4617 return err; 4618 4619 err = rdev_set_default_key(rdev, dev, link_id, key.idx, 4620 key.def_uni, key.def_multi); 4621 4622 if (err) 4623 return err; 4624 4625 #ifdef CONFIG_CFG80211_WEXT 4626 wdev->wext.default_key = key.idx; 4627 #endif 4628 return 0; 4629 } else if (key.defmgmt) { 4630 if (key.def_uni || !key.def_multi) 4631 return -EINVAL; 4632 4633 if (!rdev->ops->set_default_mgmt_key) 4634 return -EOPNOTSUPP; 4635 4636 err = nl80211_key_allowed(wdev); 4637 if (err) 4638 return err; 4639 4640 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4641 if (err) 4642 return err; 4643 4644 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx); 4645 if (err) 4646 return err; 4647 4648 #ifdef CONFIG_CFG80211_WEXT 4649 wdev->wext.default_mgmt_key = key.idx; 4650 #endif 4651 return 0; 4652 } else if (key.defbeacon) { 4653 if (key.def_uni || !key.def_multi) 4654 return -EINVAL; 4655 4656 if (!rdev->ops->set_default_beacon_key) 4657 return -EOPNOTSUPP; 4658 4659 err = nl80211_key_allowed(wdev); 4660 if (err) 4661 return err; 4662 4663 err = nl80211_validate_key_link_id(info, wdev, link_id, false); 4664 if (err) 4665 return err; 4666 4667 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx); 4668 } else if (key.p.mode == NL80211_KEY_SET_TX && 4669 wiphy_ext_feature_isset(&rdev->wiphy, 4670 NL80211_EXT_FEATURE_EXT_KEY_ID)) { 4671 u8 *mac_addr = NULL; 4672 4673 if (info->attrs[NL80211_ATTR_MAC]) 4674 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4675 4676 if (!mac_addr || key.idx < 0 || key.idx > 1) 4677 return -EINVAL; 4678 4679 err = nl80211_validate_key_link_id(info, wdev, link_id, true); 4680 if (err) 4681 return err; 4682 4683 return rdev_add_key(rdev, dev, link_id, key.idx, 4684 NL80211_KEYTYPE_PAIRWISE, 4685 mac_addr, &key.p); 4686 } 4687 4688 return -EINVAL; 4689 } 4690 4691 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 4692 { 4693 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4694 int err; 4695 struct net_device *dev = info->user_ptr[1]; 4696 struct key_parse key; 4697 const u8 *mac_addr = NULL; 4698 int link_id = nl80211_link_id_or_invalid(info->attrs); 4699 struct wireless_dev *wdev = dev->ieee80211_ptr; 4700 4701 err = nl80211_parse_key(info, &key); 4702 if (err) 4703 return err; 4704 4705 if (!key.p.key) { 4706 GENL_SET_ERR_MSG(info, "no key"); 4707 return -EINVAL; 4708 } 4709 4710 if (info->attrs[NL80211_ATTR_MAC]) 4711 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4712 4713 if (key.type == -1) { 4714 if (mac_addr) 4715 key.type = NL80211_KEYTYPE_PAIRWISE; 4716 else 4717 key.type = NL80211_KEYTYPE_GROUP; 4718 } 4719 4720 /* for now */ 4721 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4722 key.type != NL80211_KEYTYPE_GROUP) { 4723 GENL_SET_ERR_MSG(info, "key type not pairwise or group"); 4724 return -EINVAL; 4725 } 4726 4727 if (key.type == NL80211_KEYTYPE_GROUP && 4728 info->attrs[NL80211_ATTR_VLAN_ID]) 4729 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 4730 4731 if (!rdev->ops->add_key) 4732 return -EOPNOTSUPP; 4733 4734 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 4735 key.type == NL80211_KEYTYPE_PAIRWISE, 4736 mac_addr)) { 4737 GENL_SET_ERR_MSG(info, "key setting validation failed"); 4738 return -EINVAL; 4739 } 4740 4741 err = nl80211_key_allowed(wdev); 4742 if (err) 4743 GENL_SET_ERR_MSG(info, "key not allowed"); 4744 4745 if (!err) 4746 err = nl80211_validate_key_link_id(info, wdev, link_id, 4747 key.type == NL80211_KEYTYPE_PAIRWISE); 4748 4749 if (!err) { 4750 err = rdev_add_key(rdev, dev, link_id, key.idx, 4751 key.type == NL80211_KEYTYPE_PAIRWISE, 4752 mac_addr, &key.p); 4753 if (err) 4754 GENL_SET_ERR_MSG(info, "key addition failed"); 4755 } 4756 4757 return err; 4758 } 4759 4760 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 4761 { 4762 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4763 int err; 4764 struct net_device *dev = info->user_ptr[1]; 4765 u8 *mac_addr = NULL; 4766 struct key_parse key; 4767 int link_id = nl80211_link_id_or_invalid(info->attrs); 4768 struct wireless_dev *wdev = dev->ieee80211_ptr; 4769 4770 err = nl80211_parse_key(info, &key); 4771 if (err) 4772 return err; 4773 4774 if (info->attrs[NL80211_ATTR_MAC]) 4775 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4776 4777 if (key.type == -1) { 4778 if (mac_addr) 4779 key.type = NL80211_KEYTYPE_PAIRWISE; 4780 else 4781 key.type = NL80211_KEYTYPE_GROUP; 4782 } 4783 4784 /* for now */ 4785 if (key.type != NL80211_KEYTYPE_PAIRWISE && 4786 key.type != NL80211_KEYTYPE_GROUP) 4787 return -EINVAL; 4788 4789 if (!cfg80211_valid_key_idx(rdev, key.idx, 4790 key.type == NL80211_KEYTYPE_PAIRWISE)) 4791 return -EINVAL; 4792 4793 if (!rdev->ops->del_key) 4794 return -EOPNOTSUPP; 4795 4796 err = nl80211_key_allowed(wdev); 4797 4798 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 4799 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 4800 err = -ENOENT; 4801 4802 if (!err) 4803 err = nl80211_validate_key_link_id(info, wdev, link_id, 4804 key.type == NL80211_KEYTYPE_PAIRWISE); 4805 4806 if (!err) 4807 err = rdev_del_key(rdev, dev, link_id, key.idx, 4808 key.type == NL80211_KEYTYPE_PAIRWISE, 4809 mac_addr); 4810 4811 #ifdef CONFIG_CFG80211_WEXT 4812 if (!err) { 4813 if (key.idx == wdev->wext.default_key) 4814 wdev->wext.default_key = -1; 4815 else if (key.idx == wdev->wext.default_mgmt_key) 4816 wdev->wext.default_mgmt_key = -1; 4817 } 4818 #endif 4819 4820 return err; 4821 } 4822 4823 /* This function returns an error or the number of nested attributes */ 4824 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 4825 { 4826 struct nlattr *attr; 4827 int n_entries = 0, tmp; 4828 4829 nla_for_each_nested(attr, nl_attr, tmp) { 4830 if (nla_len(attr) != ETH_ALEN) 4831 return -EINVAL; 4832 4833 n_entries++; 4834 } 4835 4836 return n_entries; 4837 } 4838 4839 /* 4840 * This function parses ACL information and allocates memory for ACL data. 4841 * On successful return, the calling function is responsible to free the 4842 * ACL buffer returned by this function. 4843 */ 4844 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 4845 struct genl_info *info) 4846 { 4847 enum nl80211_acl_policy acl_policy; 4848 struct nlattr *attr; 4849 struct cfg80211_acl_data *acl; 4850 int i = 0, n_entries, tmp; 4851 4852 if (!wiphy->max_acl_mac_addrs) 4853 return ERR_PTR(-EOPNOTSUPP); 4854 4855 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 4856 return ERR_PTR(-EINVAL); 4857 4858 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 4859 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 4860 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 4861 return ERR_PTR(-EINVAL); 4862 4863 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 4864 return ERR_PTR(-EINVAL); 4865 4866 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 4867 if (n_entries < 0) 4868 return ERR_PTR(n_entries); 4869 4870 if (n_entries > wiphy->max_acl_mac_addrs) 4871 return ERR_PTR(-EOPNOTSUPP); 4872 4873 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); 4874 if (!acl) 4875 return ERR_PTR(-ENOMEM); 4876 acl->n_acl_entries = n_entries; 4877 4878 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 4879 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 4880 i++; 4881 } 4882 acl->acl_policy = acl_policy; 4883 4884 return acl; 4885 } 4886 4887 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 4888 { 4889 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4890 struct net_device *dev = info->user_ptr[1]; 4891 struct cfg80211_acl_data *acl; 4892 int err; 4893 4894 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4895 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4896 return -EOPNOTSUPP; 4897 4898 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval) 4899 return -EINVAL; 4900 4901 acl = parse_acl_data(&rdev->wiphy, info); 4902 if (IS_ERR(acl)) 4903 return PTR_ERR(acl); 4904 4905 err = rdev_set_mac_acl(rdev, dev, acl); 4906 4907 kfree(acl); 4908 4909 return err; 4910 } 4911 4912 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 4913 u8 *rates, u8 rates_len) 4914 { 4915 u8 i; 4916 u32 mask = 0; 4917 4918 for (i = 0; i < rates_len; i++) { 4919 int rate = (rates[i] & 0x7f) * 5; 4920 int ridx; 4921 4922 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 4923 struct ieee80211_rate *srate = 4924 &sband->bitrates[ridx]; 4925 if (rate == srate->bitrate) { 4926 mask |= 1 << ridx; 4927 break; 4928 } 4929 } 4930 if (ridx == sband->n_bitrates) 4931 return 0; /* rate not found */ 4932 } 4933 4934 return mask; 4935 } 4936 4937 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 4938 u8 *rates, u8 rates_len, 4939 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 4940 { 4941 u8 i; 4942 4943 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 4944 4945 for (i = 0; i < rates_len; i++) { 4946 int ridx, rbit; 4947 4948 ridx = rates[i] / 8; 4949 rbit = BIT(rates[i] % 8); 4950 4951 /* check validity */ 4952 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 4953 return false; 4954 4955 /* check availability */ 4956 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 4957 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 4958 mcs[ridx] |= rbit; 4959 else 4960 return false; 4961 } 4962 4963 return true; 4964 } 4965 4966 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 4967 { 4968 u16 mcs_mask = 0; 4969 4970 switch (vht_mcs_map) { 4971 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 4972 break; 4973 case IEEE80211_VHT_MCS_SUPPORT_0_7: 4974 mcs_mask = 0x00FF; 4975 break; 4976 case IEEE80211_VHT_MCS_SUPPORT_0_8: 4977 mcs_mask = 0x01FF; 4978 break; 4979 case IEEE80211_VHT_MCS_SUPPORT_0_9: 4980 mcs_mask = 0x03FF; 4981 break; 4982 default: 4983 break; 4984 } 4985 4986 return mcs_mask; 4987 } 4988 4989 static void vht_build_mcs_mask(u16 vht_mcs_map, 4990 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 4991 { 4992 u8 nss; 4993 4994 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 4995 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 4996 vht_mcs_map >>= 2; 4997 } 4998 } 4999 5000 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 5001 struct nl80211_txrate_vht *txrate, 5002 u16 mcs[NL80211_VHT_NSS_MAX]) 5003 { 5004 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 5005 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 5006 u8 i; 5007 5008 if (!sband->vht_cap.vht_supported) 5009 return false; 5010 5011 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 5012 5013 /* Build vht_mcs_mask from VHT capabilities */ 5014 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5015 5016 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5017 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5018 mcs[i] = txrate->mcs[i]; 5019 else 5020 return false; 5021 } 5022 5023 return true; 5024 } 5025 5026 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map) 5027 { 5028 switch (he_mcs_map) { 5029 case IEEE80211_HE_MCS_NOT_SUPPORTED: 5030 return 0; 5031 case IEEE80211_HE_MCS_SUPPORT_0_7: 5032 return 0x00FF; 5033 case IEEE80211_HE_MCS_SUPPORT_0_9: 5034 return 0x03FF; 5035 case IEEE80211_HE_MCS_SUPPORT_0_11: 5036 return 0xFFF; 5037 default: 5038 break; 5039 } 5040 return 0; 5041 } 5042 5043 static void he_build_mcs_mask(u16 he_mcs_map, 5044 u16 he_mcs_mask[NL80211_HE_NSS_MAX]) 5045 { 5046 u8 nss; 5047 5048 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) { 5049 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03); 5050 he_mcs_map >>= 2; 5051 } 5052 } 5053 5054 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id, 5055 const struct ieee80211_sta_he_cap *he_cap) 5056 { 5057 struct net_device *dev = info->user_ptr[1]; 5058 struct wireless_dev *wdev = dev->ieee80211_ptr; 5059 struct cfg80211_chan_def *chandef; 5060 __le16 tx_mcs; 5061 5062 chandef = wdev_chandef(wdev, link_id); 5063 if (!chandef) { 5064 /* 5065 * This is probably broken, but we never maintained 5066 * a chandef in these cases, so it always was. 5067 */ 5068 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80); 5069 } 5070 5071 switch (chandef->width) { 5072 case NL80211_CHAN_WIDTH_80P80: 5073 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80; 5074 break; 5075 case NL80211_CHAN_WIDTH_160: 5076 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160; 5077 break; 5078 default: 5079 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80; 5080 break; 5081 } 5082 5083 return le16_to_cpu(tx_mcs); 5084 } 5085 5086 static bool he_set_mcs_mask(struct genl_info *info, 5087 struct wireless_dev *wdev, 5088 struct ieee80211_supported_band *sband, 5089 struct nl80211_txrate_he *txrate, 5090 u16 mcs[NL80211_HE_NSS_MAX], 5091 unsigned int link_id) 5092 { 5093 const struct ieee80211_sta_he_cap *he_cap; 5094 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {}; 5095 u16 tx_mcs_map = 0; 5096 u8 i; 5097 5098 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5099 if (!he_cap) 5100 return false; 5101 5102 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX); 5103 5104 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5105 5106 /* Build he_mcs_mask from HE capabilities */ 5107 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 5108 5109 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5110 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 5111 mcs[i] = txrate->mcs[i]; 5112 else 5113 return false; 5114 } 5115 5116 return true; 5117 } 5118 5119 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 5120 struct nlattr *attrs[], 5121 enum nl80211_attrs attr, 5122 struct cfg80211_bitrate_mask *mask, 5123 struct net_device *dev, 5124 bool default_all_enabled, 5125 unsigned int link_id) 5126 { 5127 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 5128 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5129 struct wireless_dev *wdev = dev->ieee80211_ptr; 5130 int rem, i; 5131 struct nlattr *tx_rates; 5132 struct ieee80211_supported_band *sband; 5133 u16 vht_tx_mcs_map, he_tx_mcs_map; 5134 5135 memset(mask, 0, sizeof(*mask)); 5136 /* Default to all rates enabled */ 5137 for (i = 0; i < NUM_NL80211_BANDS; i++) { 5138 const struct ieee80211_sta_he_cap *he_cap; 5139 5140 if (!default_all_enabled) 5141 break; 5142 5143 sband = rdev->wiphy.bands[i]; 5144 5145 if (!sband) 5146 continue; 5147 5148 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 5149 memcpy(mask->control[i].ht_mcs, 5150 sband->ht_cap.mcs.rx_mask, 5151 sizeof(mask->control[i].ht_mcs)); 5152 5153 if (sband->vht_cap.vht_supported) { 5154 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 5155 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 5156 } 5157 5158 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype); 5159 if (!he_cap) 5160 continue; 5161 5162 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap); 5163 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs); 5164 5165 mask->control[i].he_gi = 0xFF; 5166 mask->control[i].he_ltf = 0xFF; 5167 } 5168 5169 /* if no rates are given set it back to the defaults */ 5170 if (!attrs[attr]) 5171 goto out; 5172 5173 /* The nested attribute uses enum nl80211_band as the index. This maps 5174 * directly to the enum nl80211_band values used in cfg80211. 5175 */ 5176 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 5177 nla_for_each_nested(tx_rates, attrs[attr], rem) { 5178 enum nl80211_band band = nla_type(tx_rates); 5179 int err; 5180 5181 if (band < 0 || band >= NUM_NL80211_BANDS) 5182 return -EINVAL; 5183 sband = rdev->wiphy.bands[band]; 5184 if (sband == NULL) 5185 return -EINVAL; 5186 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX, 5187 tx_rates, 5188 nl80211_txattr_policy, 5189 info->extack); 5190 if (err) 5191 return err; 5192 if (tb[NL80211_TXRATE_LEGACY]) { 5193 mask->control[band].legacy = rateset_to_mask( 5194 sband, 5195 nla_data(tb[NL80211_TXRATE_LEGACY]), 5196 nla_len(tb[NL80211_TXRATE_LEGACY])); 5197 if ((mask->control[band].legacy == 0) && 5198 nla_len(tb[NL80211_TXRATE_LEGACY])) 5199 return -EINVAL; 5200 } 5201 if (tb[NL80211_TXRATE_HT]) { 5202 if (!ht_rateset_to_mask( 5203 sband, 5204 nla_data(tb[NL80211_TXRATE_HT]), 5205 nla_len(tb[NL80211_TXRATE_HT]), 5206 mask->control[band].ht_mcs)) 5207 return -EINVAL; 5208 } 5209 5210 if (tb[NL80211_TXRATE_VHT]) { 5211 if (!vht_set_mcs_mask( 5212 sband, 5213 nla_data(tb[NL80211_TXRATE_VHT]), 5214 mask->control[band].vht_mcs)) 5215 return -EINVAL; 5216 } 5217 5218 if (tb[NL80211_TXRATE_GI]) { 5219 mask->control[band].gi = 5220 nla_get_u8(tb[NL80211_TXRATE_GI]); 5221 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 5222 return -EINVAL; 5223 } 5224 if (tb[NL80211_TXRATE_HE] && 5225 !he_set_mcs_mask(info, wdev, sband, 5226 nla_data(tb[NL80211_TXRATE_HE]), 5227 mask->control[band].he_mcs, 5228 link_id)) 5229 return -EINVAL; 5230 5231 if (tb[NL80211_TXRATE_HE_GI]) 5232 mask->control[band].he_gi = 5233 nla_get_u8(tb[NL80211_TXRATE_HE_GI]); 5234 if (tb[NL80211_TXRATE_HE_LTF]) 5235 mask->control[band].he_ltf = 5236 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]); 5237 5238 if (mask->control[band].legacy == 0) { 5239 /* don't allow empty legacy rates if HT, VHT or HE 5240 * are not even supported. 5241 */ 5242 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 5243 rdev->wiphy.bands[band]->vht_cap.vht_supported || 5244 ieee80211_get_he_iftype_cap(sband, wdev->iftype))) 5245 return -EINVAL; 5246 5247 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 5248 if (mask->control[band].ht_mcs[i]) 5249 goto out; 5250 5251 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 5252 if (mask->control[band].vht_mcs[i]) 5253 goto out; 5254 5255 for (i = 0; i < NL80211_HE_NSS_MAX; i++) 5256 if (mask->control[band].he_mcs[i]) 5257 goto out; 5258 5259 /* legacy and mcs rates may not be both empty */ 5260 return -EINVAL; 5261 } 5262 } 5263 5264 out: 5265 return 0; 5266 } 5267 5268 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 5269 enum nl80211_band band, 5270 struct cfg80211_bitrate_mask *beacon_rate) 5271 { 5272 u32 count_ht, count_vht, count_he, i; 5273 u32 rate = beacon_rate->control[band].legacy; 5274 5275 /* Allow only one rate */ 5276 if (hweight32(rate) > 1) 5277 return -EINVAL; 5278 5279 count_ht = 0; 5280 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 5281 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 5282 return -EINVAL; 5283 } else if (beacon_rate->control[band].ht_mcs[i]) { 5284 count_ht++; 5285 if (count_ht > 1) 5286 return -EINVAL; 5287 } 5288 if (count_ht && rate) 5289 return -EINVAL; 5290 } 5291 5292 count_vht = 0; 5293 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 5294 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 5295 return -EINVAL; 5296 } else if (beacon_rate->control[band].vht_mcs[i]) { 5297 count_vht++; 5298 if (count_vht > 1) 5299 return -EINVAL; 5300 } 5301 if (count_vht && rate) 5302 return -EINVAL; 5303 } 5304 5305 count_he = 0; 5306 for (i = 0; i < NL80211_HE_NSS_MAX; i++) { 5307 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) { 5308 return -EINVAL; 5309 } else if (beacon_rate->control[band].he_mcs[i]) { 5310 count_he++; 5311 if (count_he > 1) 5312 return -EINVAL; 5313 } 5314 if (count_he && rate) 5315 return -EINVAL; 5316 } 5317 5318 if ((count_ht && count_vht && count_he) || 5319 (!rate && !count_ht && !count_vht && !count_he)) 5320 return -EINVAL; 5321 5322 if (rate && 5323 !wiphy_ext_feature_isset(&rdev->wiphy, 5324 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 5325 return -EINVAL; 5326 if (count_ht && 5327 !wiphy_ext_feature_isset(&rdev->wiphy, 5328 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 5329 return -EINVAL; 5330 if (count_vht && 5331 !wiphy_ext_feature_isset(&rdev->wiphy, 5332 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 5333 return -EINVAL; 5334 if (count_he && 5335 !wiphy_ext_feature_isset(&rdev->wiphy, 5336 NL80211_EXT_FEATURE_BEACON_RATE_HE)) 5337 return -EINVAL; 5338 5339 return 0; 5340 } 5341 5342 static int nl80211_parse_mbssid_config(struct wiphy *wiphy, 5343 struct net_device *dev, 5344 struct nlattr *attrs, 5345 struct cfg80211_mbssid_config *config, 5346 u8 num_elems) 5347 { 5348 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1]; 5349 5350 if (!wiphy->mbssid_max_interfaces) 5351 return -EOPNOTSUPP; 5352 5353 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL, 5354 NULL) || 5355 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]) 5356 return -EINVAL; 5357 5358 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]); 5359 if (config->ema) { 5360 if (!wiphy->ema_max_profile_periodicity) 5361 return -EOPNOTSUPP; 5362 5363 if (num_elems > wiphy->ema_max_profile_periodicity) 5364 return -EINVAL; 5365 } 5366 5367 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]); 5368 if (config->index >= wiphy->mbssid_max_interfaces || 5369 (!config->index && !num_elems)) 5370 return -EINVAL; 5371 5372 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) { 5373 u32 tx_ifindex = 5374 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]); 5375 5376 if ((!config->index && tx_ifindex != dev->ifindex) || 5377 (config->index && tx_ifindex == dev->ifindex)) 5378 return -EINVAL; 5379 5380 if (tx_ifindex != dev->ifindex) { 5381 struct net_device *tx_netdev = 5382 dev_get_by_index(wiphy_net(wiphy), tx_ifindex); 5383 5384 if (!tx_netdev || !tx_netdev->ieee80211_ptr || 5385 tx_netdev->ieee80211_ptr->wiphy != wiphy || 5386 tx_netdev->ieee80211_ptr->iftype != 5387 NL80211_IFTYPE_AP) { 5388 dev_put(tx_netdev); 5389 return -EINVAL; 5390 } 5391 5392 config->tx_wdev = tx_netdev->ieee80211_ptr; 5393 } else { 5394 config->tx_wdev = dev->ieee80211_ptr; 5395 } 5396 } else if (!config->index) { 5397 config->tx_wdev = dev->ieee80211_ptr; 5398 } else { 5399 return -EINVAL; 5400 } 5401 5402 return 0; 5403 } 5404 5405 static struct cfg80211_mbssid_elems * 5406 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs) 5407 { 5408 struct nlattr *nl_elems; 5409 struct cfg80211_mbssid_elems *elems; 5410 int rem_elems; 5411 u8 i = 0, num_elems = 0; 5412 5413 if (!wiphy->mbssid_max_interfaces) 5414 return ERR_PTR(-EINVAL); 5415 5416 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5417 if (num_elems >= 255) 5418 return ERR_PTR(-EINVAL); 5419 num_elems++; 5420 } 5421 5422 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL); 5423 if (!elems) 5424 return ERR_PTR(-ENOMEM); 5425 elems->cnt = num_elems; 5426 5427 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5428 elems->elem[i].data = nla_data(nl_elems); 5429 elems->elem[i].len = nla_len(nl_elems); 5430 i++; 5431 } 5432 return elems; 5433 } 5434 5435 static struct cfg80211_rnr_elems * 5436 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs, 5437 struct netlink_ext_ack *extack) 5438 { 5439 struct nlattr *nl_elems; 5440 struct cfg80211_rnr_elems *elems; 5441 int rem_elems; 5442 u8 i = 0, num_elems = 0; 5443 5444 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5445 int ret; 5446 5447 ret = validate_ie_attr(nl_elems, extack); 5448 if (ret) 5449 return ERR_PTR(ret); 5450 5451 num_elems++; 5452 } 5453 5454 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL); 5455 if (!elems) 5456 return ERR_PTR(-ENOMEM); 5457 elems->cnt = num_elems; 5458 5459 nla_for_each_nested(nl_elems, attrs, rem_elems) { 5460 elems->elem[i].data = nla_data(nl_elems); 5461 elems->elem[i].len = nla_len(nl_elems); 5462 i++; 5463 } 5464 return elems; 5465 } 5466 5467 static int nl80211_parse_he_bss_color(struct nlattr *attrs, 5468 struct cfg80211_he_bss_color *he_bss_color) 5469 { 5470 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1]; 5471 int err; 5472 5473 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs, 5474 he_bss_color_policy, NULL); 5475 if (err) 5476 return err; 5477 5478 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]) 5479 return -EINVAL; 5480 5481 he_bss_color->color = 5482 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]); 5483 he_bss_color->enabled = 5484 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]); 5485 he_bss_color->partial = 5486 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]); 5487 5488 return 0; 5489 } 5490 5491 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 5492 struct nlattr *attrs[], 5493 struct cfg80211_beacon_data *bcn, 5494 struct netlink_ext_ack *extack) 5495 { 5496 bool haveinfo = false; 5497 int err; 5498 5499 memset(bcn, 0, sizeof(*bcn)); 5500 5501 bcn->link_id = nl80211_link_id(attrs); 5502 5503 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 5504 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 5505 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 5506 if (!bcn->head_len) 5507 return -EINVAL; 5508 haveinfo = true; 5509 } 5510 5511 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 5512 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 5513 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 5514 haveinfo = true; 5515 } 5516 5517 if (!haveinfo) 5518 return -EINVAL; 5519 5520 if (attrs[NL80211_ATTR_IE]) { 5521 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 5522 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 5523 } 5524 5525 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 5526 bcn->proberesp_ies = 5527 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5528 bcn->proberesp_ies_len = 5529 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 5530 } 5531 5532 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 5533 bcn->assocresp_ies = 5534 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5535 bcn->assocresp_ies_len = 5536 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 5537 } 5538 5539 if (attrs[NL80211_ATTR_PROBE_RESP]) { 5540 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 5541 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 5542 } 5543 5544 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 5545 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 5546 5547 err = nla_parse_nested_deprecated(tb, 5548 NL80211_FTM_RESP_ATTR_MAX, 5549 attrs[NL80211_ATTR_FTM_RESPONDER], 5550 NULL, NULL); 5551 if (err) 5552 return err; 5553 5554 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 5555 wiphy_ext_feature_isset(&rdev->wiphy, 5556 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 5557 bcn->ftm_responder = 1; 5558 else 5559 return -EOPNOTSUPP; 5560 5561 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 5562 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 5563 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 5564 } 5565 5566 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 5567 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5568 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 5569 } 5570 } else { 5571 bcn->ftm_responder = -1; 5572 } 5573 5574 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) { 5575 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR], 5576 &bcn->he_bss_color); 5577 if (err) 5578 return err; 5579 bcn->he_bss_color_valid = true; 5580 } 5581 5582 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) { 5583 struct cfg80211_mbssid_elems *mbssid = 5584 nl80211_parse_mbssid_elems(&rdev->wiphy, 5585 attrs[NL80211_ATTR_MBSSID_ELEMS]); 5586 5587 if (IS_ERR(mbssid)) 5588 return PTR_ERR(mbssid); 5589 5590 bcn->mbssid_ies = mbssid; 5591 5592 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) { 5593 struct cfg80211_rnr_elems *rnr = 5594 nl80211_parse_rnr_elems(&rdev->wiphy, 5595 attrs[NL80211_ATTR_EMA_RNR_ELEMS], 5596 extack); 5597 5598 if (IS_ERR(rnr)) 5599 return PTR_ERR(rnr); 5600 5601 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) 5602 return -EINVAL; 5603 5604 bcn->rnr_ies = rnr; 5605 } 5606 } 5607 5608 return 0; 5609 } 5610 5611 static int nl80211_parse_he_obss_pd(struct nlattr *attrs, 5612 struct ieee80211_he_obss_pd *he_obss_pd) 5613 { 5614 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1]; 5615 int err; 5616 5617 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs, 5618 he_obss_pd_policy, NULL); 5619 if (err) 5620 return err; 5621 5622 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]) 5623 return -EINVAL; 5624 5625 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]); 5626 5627 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) 5628 he_obss_pd->min_offset = 5629 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); 5630 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) 5631 he_obss_pd->max_offset = 5632 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); 5633 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]) 5634 he_obss_pd->non_srg_max_offset = 5635 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]); 5636 5637 if (he_obss_pd->min_offset > he_obss_pd->max_offset) 5638 return -EINVAL; 5639 5640 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]) 5641 memcpy(he_obss_pd->bss_color_bitmap, 5642 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]), 5643 sizeof(he_obss_pd->bss_color_bitmap)); 5644 5645 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]) 5646 memcpy(he_obss_pd->partial_bssid_bitmap, 5647 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]), 5648 sizeof(he_obss_pd->partial_bssid_bitmap)); 5649 5650 he_obss_pd->enable = true; 5651 5652 return 0; 5653 } 5654 5655 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev, 5656 struct nlattr *attrs, 5657 struct cfg80211_fils_discovery *fd) 5658 { 5659 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1]; 5660 int ret; 5661 5662 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5663 NL80211_EXT_FEATURE_FILS_DISCOVERY)) 5664 return -EINVAL; 5665 5666 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs, 5667 NULL, NULL); 5668 if (ret) 5669 return ret; 5670 5671 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] && 5672 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] && 5673 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) { 5674 fd->update = true; 5675 return 0; 5676 } 5677 5678 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] || 5679 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] || 5680 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) 5681 return -EINVAL; 5682 5683 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5684 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]); 5685 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]); 5686 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]); 5687 fd->update = true; 5688 return 0; 5689 } 5690 5691 static int 5692 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev, 5693 struct nlattr *attrs, 5694 struct cfg80211_unsol_bcast_probe_resp *presp) 5695 { 5696 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1]; 5697 int ret; 5698 5699 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5700 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP)) 5701 return -EINVAL; 5702 5703 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX, 5704 attrs, NULL, NULL); 5705 if (ret) 5706 return ret; 5707 5708 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] && 5709 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) { 5710 presp->update = true; 5711 return 0; 5712 } 5713 5714 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] || 5715 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) 5716 return -EINVAL; 5717 5718 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5719 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]); 5720 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]); 5721 presp->update = true; 5722 return 0; 5723 } 5724 5725 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 5726 const struct element *rates) 5727 { 5728 int i; 5729 5730 if (!rates) 5731 return; 5732 5733 for (i = 0; i < rates->datalen; i++) { 5734 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 5735 params->ht_required = true; 5736 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 5737 params->vht_required = true; 5738 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY) 5739 params->he_required = true; 5740 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E) 5741 params->sae_h2e_required = true; 5742 } 5743 } 5744 5745 /* 5746 * Since the nl80211 API didn't include, from the beginning, attributes about 5747 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 5748 * benefit of drivers that rebuild IEs in the firmware. 5749 */ 5750 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 5751 { 5752 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 5753 size_t ies_len = bcn->tail_len; 5754 const u8 *ies = bcn->tail; 5755 const struct element *rates; 5756 const struct element *cap; 5757 5758 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len); 5759 nl80211_check_ap_rate_selectors(params, rates); 5760 5761 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 5762 nl80211_check_ap_rate_selectors(params, rates); 5763 5764 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len); 5765 if (cap && cap->datalen >= sizeof(*params->ht_cap)) 5766 params->ht_cap = (void *)cap->data; 5767 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 5768 if (cap && cap->datalen >= sizeof(*params->vht_cap)) 5769 params->vht_cap = (void *)cap->data; 5770 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 5771 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1) 5772 params->he_cap = (void *)(cap->data + 1); 5773 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len); 5774 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) 5775 params->he_oper = (void *)(cap->data + 1); 5776 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len); 5777 if (cap) { 5778 if (!cap->datalen) 5779 return -EINVAL; 5780 params->eht_cap = (void *)(cap->data + 1); 5781 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap, 5782 (const u8 *)params->eht_cap, 5783 cap->datalen - 1, true)) 5784 return -EINVAL; 5785 } 5786 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len); 5787 if (cap) { 5788 if (!cap->datalen) 5789 return -EINVAL; 5790 params->eht_oper = (void *)(cap->data + 1); 5791 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper, 5792 cap->datalen - 1)) 5793 return -EINVAL; 5794 } 5795 return 0; 5796 } 5797 5798 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 5799 struct cfg80211_ap_settings *params) 5800 { 5801 struct wireless_dev *wdev; 5802 5803 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 5804 if (wdev->iftype != NL80211_IFTYPE_AP && 5805 wdev->iftype != NL80211_IFTYPE_P2P_GO) 5806 continue; 5807 5808 if (!wdev->u.ap.preset_chandef.chan) 5809 continue; 5810 5811 params->chandef = wdev->u.ap.preset_chandef; 5812 return true; 5813 } 5814 5815 return false; 5816 } 5817 5818 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 5819 enum nl80211_auth_type auth_type, 5820 enum nl80211_commands cmd) 5821 { 5822 if (auth_type > NL80211_AUTHTYPE_MAX) 5823 return false; 5824 5825 switch (cmd) { 5826 case NL80211_CMD_AUTHENTICATE: 5827 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5828 auth_type == NL80211_AUTHTYPE_SAE) 5829 return false; 5830 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5831 NL80211_EXT_FEATURE_FILS_STA) && 5832 (auth_type == NL80211_AUTHTYPE_FILS_SK || 5833 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5834 auth_type == NL80211_AUTHTYPE_FILS_PK)) 5835 return false; 5836 return true; 5837 case NL80211_CMD_CONNECT: 5838 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 5839 !wiphy_ext_feature_isset(&rdev->wiphy, 5840 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 5841 auth_type == NL80211_AUTHTYPE_SAE) 5842 return false; 5843 5844 /* FILS with SK PFS or PK not supported yet */ 5845 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5846 auth_type == NL80211_AUTHTYPE_FILS_PK) 5847 return false; 5848 if (!wiphy_ext_feature_isset( 5849 &rdev->wiphy, 5850 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 5851 auth_type == NL80211_AUTHTYPE_FILS_SK) 5852 return false; 5853 return true; 5854 case NL80211_CMD_START_AP: 5855 if (!wiphy_ext_feature_isset(&rdev->wiphy, 5856 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) && 5857 auth_type == NL80211_AUTHTYPE_SAE) 5858 return false; 5859 /* FILS not supported yet */ 5860 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 5861 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 5862 auth_type == NL80211_AUTHTYPE_FILS_PK) 5863 return false; 5864 return true; 5865 default: 5866 return false; 5867 } 5868 } 5869 5870 static void nl80211_send_ap_started(struct wireless_dev *wdev, 5871 unsigned int link_id) 5872 { 5873 struct wiphy *wiphy = wdev->wiphy; 5874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 5875 struct sk_buff *msg; 5876 void *hdr; 5877 5878 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5879 if (!msg) 5880 return; 5881 5882 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP); 5883 if (!hdr) 5884 goto out; 5885 5886 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 5887 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 5888 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 5889 NL80211_ATTR_PAD) || 5890 (wdev->u.ap.ssid_len && 5891 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len, 5892 wdev->u.ap.ssid)) || 5893 (wdev->valid_links && 5894 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 5895 goto out; 5896 5897 genlmsg_end(msg, hdr); 5898 5899 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 5900 NL80211_MCGRP_MLME, GFP_KERNEL); 5901 return; 5902 out: 5903 nlmsg_free(msg); 5904 } 5905 5906 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params) 5907 { 5908 struct ieee80211_channel *channel = params->chandef.chan; 5909 5910 if ((params->he_cap || params->he_oper) && 5911 (channel->flags & IEEE80211_CHAN_NO_HE)) 5912 return -EOPNOTSUPP; 5913 5914 if ((params->eht_cap || params->eht_oper) && 5915 (channel->flags & IEEE80211_CHAN_NO_EHT)) 5916 return -EOPNOTSUPP; 5917 5918 return 0; 5919 } 5920 5921 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 5922 { 5923 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5924 unsigned int link_id = nl80211_link_id(info->attrs); 5925 struct net_device *dev = info->user_ptr[1]; 5926 struct wireless_dev *wdev = dev->ieee80211_ptr; 5927 struct cfg80211_ap_settings *params; 5928 int err; 5929 5930 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5931 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5932 return -EOPNOTSUPP; 5933 5934 if (!rdev->ops->start_ap) 5935 return -EOPNOTSUPP; 5936 5937 if (wdev->links[link_id].ap.beacon_interval) 5938 return -EALREADY; 5939 5940 /* these are required for START_AP */ 5941 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 5942 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 5943 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 5944 return -EINVAL; 5945 5946 params = kzalloc(sizeof(*params), GFP_KERNEL); 5947 if (!params) 5948 return -ENOMEM; 5949 5950 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon, 5951 info->extack); 5952 if (err) 5953 goto out; 5954 5955 params->beacon_interval = 5956 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 5957 params->dtim_period = 5958 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 5959 5960 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 5961 params->beacon_interval); 5962 if (err) 5963 goto out; 5964 5965 /* 5966 * In theory, some of these attributes should be required here 5967 * but since they were not used when the command was originally 5968 * added, keep them optional for old user space programs to let 5969 * them continue to work with drivers that do not need the 5970 * additional information -- drivers must check! 5971 */ 5972 if (info->attrs[NL80211_ATTR_SSID]) { 5973 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 5974 params->ssid_len = 5975 nla_len(info->attrs[NL80211_ATTR_SSID]); 5976 if (params->ssid_len == 0) { 5977 err = -EINVAL; 5978 goto out; 5979 } 5980 5981 if (wdev->u.ap.ssid_len && 5982 (wdev->u.ap.ssid_len != params->ssid_len || 5983 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) { 5984 /* require identical SSID for MLO */ 5985 err = -EINVAL; 5986 goto out; 5987 } 5988 } else if (wdev->valid_links) { 5989 /* require SSID for MLO */ 5990 err = -EINVAL; 5991 goto out; 5992 } 5993 5994 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 5995 params->hidden_ssid = nla_get_u32( 5996 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 5997 5998 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 5999 6000 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 6001 params->auth_type = nla_get_u32( 6002 info->attrs[NL80211_ATTR_AUTH_TYPE]); 6003 if (!nl80211_valid_auth_type(rdev, params->auth_type, 6004 NL80211_CMD_START_AP)) { 6005 err = -EINVAL; 6006 goto out; 6007 } 6008 } else 6009 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC; 6010 6011 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto, 6012 NL80211_MAX_NR_CIPHER_SUITES); 6013 if (err) 6014 goto out; 6015 6016 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 6017 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) { 6018 err = -EOPNOTSUPP; 6019 goto out; 6020 } 6021 params->inactivity_timeout = nla_get_u16( 6022 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 6023 } 6024 6025 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 6026 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6027 err = -EINVAL; 6028 goto out; 6029 } 6030 params->p2p_ctwindow = 6031 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 6032 if (params->p2p_ctwindow != 0 && 6033 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) { 6034 err = -EINVAL; 6035 goto out; 6036 } 6037 } 6038 6039 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 6040 u8 tmp; 6041 6042 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 6043 err = -EINVAL; 6044 goto out; 6045 } 6046 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 6047 params->p2p_opp_ps = tmp; 6048 if (params->p2p_opp_ps != 0 && 6049 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) { 6050 err = -EINVAL; 6051 goto out; 6052 } 6053 } 6054 6055 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 6056 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef); 6057 if (err) 6058 goto out; 6059 } else if (wdev->valid_links) { 6060 /* with MLD need to specify the channel configuration */ 6061 err = -EINVAL; 6062 goto out; 6063 } else if (wdev->u.ap.preset_chandef.chan) { 6064 params->chandef = wdev->u.ap.preset_chandef; 6065 } else if (!nl80211_get_ap_channel(rdev, params)) { 6066 err = -EINVAL; 6067 goto out; 6068 } 6069 6070 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 6071 err = nl80211_parse_punct_bitmap(rdev, info, 6072 ¶ms->chandef, 6073 ¶ms->punct_bitmap); 6074 if (err) 6075 goto out; 6076 } 6077 6078 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms->chandef, 6079 wdev->iftype)) { 6080 err = -EINVAL; 6081 goto out; 6082 } 6083 6084 if (info->attrs[NL80211_ATTR_TX_RATES]) { 6085 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 6086 NL80211_ATTR_TX_RATES, 6087 ¶ms->beacon_rate, 6088 dev, false, link_id); 6089 if (err) 6090 goto out; 6091 6092 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band, 6093 ¶ms->beacon_rate); 6094 if (err) 6095 goto out; 6096 } 6097 6098 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 6099 params->smps_mode = 6100 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 6101 switch (params->smps_mode) { 6102 case NL80211_SMPS_OFF: 6103 break; 6104 case NL80211_SMPS_STATIC: 6105 if (!(rdev->wiphy.features & 6106 NL80211_FEATURE_STATIC_SMPS)) { 6107 err = -EINVAL; 6108 goto out; 6109 } 6110 break; 6111 case NL80211_SMPS_DYNAMIC: 6112 if (!(rdev->wiphy.features & 6113 NL80211_FEATURE_DYNAMIC_SMPS)) { 6114 err = -EINVAL; 6115 goto out; 6116 } 6117 break; 6118 default: 6119 err = -EINVAL; 6120 goto out; 6121 } 6122 } else { 6123 params->smps_mode = NL80211_SMPS_OFF; 6124 } 6125 6126 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 6127 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 6128 err = -EOPNOTSUPP; 6129 goto out; 6130 } 6131 6132 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 6133 params->acl = parse_acl_data(&rdev->wiphy, info); 6134 if (IS_ERR(params->acl)) { 6135 err = PTR_ERR(params->acl); 6136 params->acl = NULL; 6137 goto out; 6138 } 6139 } 6140 6141 params->twt_responder = 6142 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]); 6143 6144 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) { 6145 err = nl80211_parse_he_obss_pd( 6146 info->attrs[NL80211_ATTR_HE_OBSS_PD], 6147 ¶ms->he_obss_pd); 6148 if (err) 6149 goto out; 6150 } 6151 6152 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { 6153 err = nl80211_parse_fils_discovery(rdev, 6154 info->attrs[NL80211_ATTR_FILS_DISCOVERY], 6155 ¶ms->fils_discovery); 6156 if (err) 6157 goto out; 6158 } 6159 6160 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { 6161 err = nl80211_parse_unsol_bcast_probe_resp( 6162 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], 6163 ¶ms->unsol_bcast_probe_resp); 6164 if (err) 6165 goto out; 6166 } 6167 6168 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) { 6169 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, 6170 info->attrs[NL80211_ATTR_MBSSID_CONFIG], 6171 ¶ms->mbssid_config, 6172 params->beacon.mbssid_ies ? 6173 params->beacon.mbssid_ies->cnt : 6174 0); 6175 if (err) 6176 goto out; 6177 } 6178 6179 if (!params->mbssid_config.ema && params->beacon.rnr_ies) { 6180 err = -EINVAL; 6181 goto out; 6182 } 6183 6184 err = nl80211_calculate_ap_params(params); 6185 if (err) 6186 goto out; 6187 6188 err = nl80211_validate_ap_phy_operation(params); 6189 if (err) 6190 goto out; 6191 6192 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]) 6193 params->flags = nla_get_u32( 6194 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]); 6195 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) 6196 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; 6197 6198 if (wdev->conn_owner_nlportid && 6199 info->attrs[NL80211_ATTR_SOCKET_OWNER] && 6200 wdev->conn_owner_nlportid != info->snd_portid) { 6201 err = -EINVAL; 6202 goto out; 6203 } 6204 6205 /* FIXME: validate MLO/link-id against driver capabilities */ 6206 6207 err = rdev_start_ap(rdev, dev, params); 6208 if (!err) { 6209 wdev->links[link_id].ap.beacon_interval = params->beacon_interval; 6210 wdev->links[link_id].ap.chandef = params->chandef; 6211 wdev->u.ap.ssid_len = params->ssid_len; 6212 memcpy(wdev->u.ap.ssid, params->ssid, 6213 params->ssid_len); 6214 6215 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 6216 wdev->conn_owner_nlportid = info->snd_portid; 6217 6218 nl80211_send_ap_started(wdev, link_id); 6219 } 6220 out: 6221 kfree(params->acl); 6222 kfree(params->beacon.mbssid_ies); 6223 if (params->mbssid_config.tx_wdev && 6224 params->mbssid_config.tx_wdev->netdev && 6225 params->mbssid_config.tx_wdev->netdev != dev) 6226 dev_put(params->mbssid_config.tx_wdev->netdev); 6227 kfree(params->beacon.rnr_ies); 6228 kfree(params); 6229 6230 return err; 6231 } 6232 6233 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 6234 { 6235 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6236 unsigned int link_id = nl80211_link_id(info->attrs); 6237 struct net_device *dev = info->user_ptr[1]; 6238 struct wireless_dev *wdev = dev->ieee80211_ptr; 6239 struct cfg80211_ap_update *params; 6240 struct nlattr *attr; 6241 int err; 6242 6243 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 6244 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 6245 return -EOPNOTSUPP; 6246 6247 if (!rdev->ops->change_beacon) 6248 return -EOPNOTSUPP; 6249 6250 if (!wdev->links[link_id].ap.beacon_interval) 6251 return -EINVAL; 6252 6253 params = kzalloc(sizeof(*params), GFP_KERNEL); 6254 if (!params) 6255 return -ENOMEM; 6256 6257 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon, 6258 info->extack); 6259 if (err) 6260 goto out; 6261 6262 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY]; 6263 if (attr) { 6264 err = nl80211_parse_fils_discovery(rdev, attr, 6265 ¶ms->fils_discovery); 6266 if (err) 6267 goto out; 6268 } 6269 6270 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]; 6271 if (attr) { 6272 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr, 6273 ¶ms->unsol_bcast_probe_resp); 6274 if (err) 6275 goto out; 6276 } 6277 6278 err = rdev_change_beacon(rdev, dev, params); 6279 6280 out: 6281 kfree(params->beacon.mbssid_ies); 6282 kfree(params->beacon.rnr_ies); 6283 kfree(params); 6284 return err; 6285 } 6286 6287 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 6288 { 6289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6290 unsigned int link_id = nl80211_link_id(info->attrs); 6291 struct net_device *dev = info->user_ptr[1]; 6292 6293 return cfg80211_stop_ap(rdev, dev, link_id, false); 6294 } 6295 6296 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 6297 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 6298 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 6299 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 6300 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 6301 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 6302 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 6303 }; 6304 6305 static int parse_station_flags(struct genl_info *info, 6306 enum nl80211_iftype iftype, 6307 struct station_parameters *params) 6308 { 6309 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 6310 struct nlattr *nla; 6311 int flag; 6312 6313 /* 6314 * Try parsing the new attribute first so userspace 6315 * can specify both for older kernels. 6316 */ 6317 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 6318 if (nla) { 6319 struct nl80211_sta_flag_update *sta_flags; 6320 6321 sta_flags = nla_data(nla); 6322 params->sta_flags_mask = sta_flags->mask; 6323 params->sta_flags_set = sta_flags->set; 6324 params->sta_flags_set &= params->sta_flags_mask; 6325 if ((params->sta_flags_mask | 6326 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 6327 return -EINVAL; 6328 return 0; 6329 } 6330 6331 /* if present, parse the old attribute */ 6332 6333 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 6334 if (!nla) 6335 return 0; 6336 6337 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack)) 6338 return -EINVAL; 6339 6340 /* 6341 * Only allow certain flags for interface types so that 6342 * other attributes are silently ignored. Remember that 6343 * this is backward compatibility code with old userspace 6344 * and shouldn't be hit in other cases anyway. 6345 */ 6346 switch (iftype) { 6347 case NL80211_IFTYPE_AP: 6348 case NL80211_IFTYPE_AP_VLAN: 6349 case NL80211_IFTYPE_P2P_GO: 6350 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6351 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6352 BIT(NL80211_STA_FLAG_WME) | 6353 BIT(NL80211_STA_FLAG_MFP); 6354 break; 6355 case NL80211_IFTYPE_P2P_CLIENT: 6356 case NL80211_IFTYPE_STATION: 6357 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 6358 BIT(NL80211_STA_FLAG_TDLS_PEER); 6359 break; 6360 case NL80211_IFTYPE_MESH_POINT: 6361 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6362 BIT(NL80211_STA_FLAG_MFP) | 6363 BIT(NL80211_STA_FLAG_AUTHORIZED); 6364 break; 6365 default: 6366 return -EINVAL; 6367 } 6368 6369 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 6370 if (flags[flag]) { 6371 params->sta_flags_set |= (1<<flag); 6372 6373 /* no longer support new API additions in old API */ 6374 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 6375 return -EINVAL; 6376 } 6377 } 6378 6379 return 0; 6380 } 6381 6382 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr) 6383 { 6384 struct nlattr *rate; 6385 u32 bitrate; 6386 u16 bitrate_compat; 6387 enum nl80211_rate_info rate_flg; 6388 6389 rate = nla_nest_start_noflag(msg, attr); 6390 if (!rate) 6391 return false; 6392 6393 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 6394 bitrate = cfg80211_calculate_bitrate(info); 6395 /* report 16-bit bitrate only if we can */ 6396 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 6397 if (bitrate > 0 && 6398 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 6399 return false; 6400 if (bitrate_compat > 0 && 6401 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 6402 return false; 6403 6404 switch (info->bw) { 6405 case RATE_INFO_BW_1: 6406 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH; 6407 break; 6408 case RATE_INFO_BW_2: 6409 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH; 6410 break; 6411 case RATE_INFO_BW_4: 6412 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH; 6413 break; 6414 case RATE_INFO_BW_5: 6415 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 6416 break; 6417 case RATE_INFO_BW_8: 6418 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH; 6419 break; 6420 case RATE_INFO_BW_10: 6421 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 6422 break; 6423 case RATE_INFO_BW_16: 6424 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH; 6425 break; 6426 default: 6427 WARN_ON(1); 6428 fallthrough; 6429 case RATE_INFO_BW_20: 6430 rate_flg = 0; 6431 break; 6432 case RATE_INFO_BW_40: 6433 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 6434 break; 6435 case RATE_INFO_BW_80: 6436 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 6437 break; 6438 case RATE_INFO_BW_160: 6439 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 6440 break; 6441 case RATE_INFO_BW_HE_RU: 6442 rate_flg = 0; 6443 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 6444 break; 6445 case RATE_INFO_BW_320: 6446 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH; 6447 break; 6448 case RATE_INFO_BW_EHT_RU: 6449 rate_flg = 0; 6450 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS)); 6451 break; 6452 } 6453 6454 if (rate_flg && nla_put_flag(msg, rate_flg)) 6455 return false; 6456 6457 if (info->flags & RATE_INFO_FLAGS_MCS) { 6458 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 6459 return false; 6460 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6461 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6462 return false; 6463 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 6464 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 6465 return false; 6466 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 6467 return false; 6468 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6469 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6470 return false; 6471 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 6472 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 6473 return false; 6474 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 6475 return false; 6476 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 6477 return false; 6478 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 6479 return false; 6480 if (info->bw == RATE_INFO_BW_HE_RU && 6481 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 6482 info->he_ru_alloc)) 6483 return false; 6484 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) { 6485 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs)) 6486 return false; 6487 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss)) 6488 return false; 6489 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 6490 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 6491 return false; 6492 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) { 6493 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs)) 6494 return false; 6495 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss)) 6496 return false; 6497 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi)) 6498 return false; 6499 if (info->bw == RATE_INFO_BW_EHT_RU && 6500 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC, 6501 info->eht_ru_alloc)) 6502 return false; 6503 } 6504 6505 nla_nest_end(msg, rate); 6506 return true; 6507 } 6508 6509 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 6510 int id) 6511 { 6512 void *attr; 6513 int i = 0; 6514 6515 if (!mask) 6516 return true; 6517 6518 attr = nla_nest_start_noflag(msg, id); 6519 if (!attr) 6520 return false; 6521 6522 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 6523 if (!(mask & BIT(i))) 6524 continue; 6525 6526 if (nla_put_u8(msg, i, signal[i])) 6527 return false; 6528 } 6529 6530 nla_nest_end(msg, attr); 6531 6532 return true; 6533 } 6534 6535 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 6536 u32 seq, int flags, 6537 struct cfg80211_registered_device *rdev, 6538 struct net_device *dev, 6539 const u8 *mac_addr, struct station_info *sinfo) 6540 { 6541 void *hdr; 6542 struct nlattr *sinfoattr, *bss_param; 6543 6544 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 6545 if (!hdr) { 6546 cfg80211_sinfo_release_content(sinfo); 6547 return -1; 6548 } 6549 6550 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6551 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 6552 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 6553 goto nla_put_failure; 6554 6555 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO); 6556 if (!sinfoattr) 6557 goto nla_put_failure; 6558 6559 #define PUT_SINFO(attr, memb, type) do { \ 6560 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 6561 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6562 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 6563 sinfo->memb)) \ 6564 goto nla_put_failure; \ 6565 } while (0) 6566 #define PUT_SINFO_U64(attr, memb) do { \ 6567 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 6568 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 6569 sinfo->memb, NL80211_STA_INFO_PAD)) \ 6570 goto nla_put_failure; \ 6571 } while (0) 6572 6573 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 6574 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 6575 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at); 6576 6577 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 6578 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 6579 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 6580 (u32)sinfo->rx_bytes)) 6581 goto nla_put_failure; 6582 6583 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 6584 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 6585 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 6586 (u32)sinfo->tx_bytes)) 6587 goto nla_put_failure; 6588 6589 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 6590 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 6591 PUT_SINFO(LLID, llid, u16); 6592 PUT_SINFO(PLID, plid, u16); 6593 PUT_SINFO(PLINK_STATE, plink_state, u8); 6594 PUT_SINFO_U64(RX_DURATION, rx_duration); 6595 PUT_SINFO_U64(TX_DURATION, tx_duration); 6596 6597 if (wiphy_ext_feature_isset(&rdev->wiphy, 6598 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 6599 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16); 6600 6601 switch (rdev->wiphy.signal_type) { 6602 case CFG80211_SIGNAL_TYPE_MBM: 6603 PUT_SINFO(SIGNAL, signal, u8); 6604 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 6605 break; 6606 default: 6607 break; 6608 } 6609 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 6610 if (!nl80211_put_signal(msg, sinfo->chains, 6611 sinfo->chain_signal, 6612 NL80211_STA_INFO_CHAIN_SIGNAL)) 6613 goto nla_put_failure; 6614 } 6615 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 6616 if (!nl80211_put_signal(msg, sinfo->chains, 6617 sinfo->chain_signal_avg, 6618 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 6619 goto nla_put_failure; 6620 } 6621 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 6622 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 6623 NL80211_STA_INFO_TX_BITRATE)) 6624 goto nla_put_failure; 6625 } 6626 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 6627 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 6628 NL80211_STA_INFO_RX_BITRATE)) 6629 goto nla_put_failure; 6630 } 6631 6632 PUT_SINFO(RX_PACKETS, rx_packets, u32); 6633 PUT_SINFO(TX_PACKETS, tx_packets, u32); 6634 PUT_SINFO(TX_RETRIES, tx_retries, u32); 6635 PUT_SINFO(TX_FAILED, tx_failed, u32); 6636 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 6637 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32); 6638 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 6639 PUT_SINFO(LOCAL_PM, local_pm, u32); 6640 PUT_SINFO(PEER_PM, peer_pm, u32); 6641 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 6642 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8); 6643 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8); 6644 6645 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 6646 bss_param = nla_nest_start_noflag(msg, 6647 NL80211_STA_INFO_BSS_PARAM); 6648 if (!bss_param) 6649 goto nla_put_failure; 6650 6651 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 6652 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 6653 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 6654 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 6655 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 6656 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 6657 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 6658 sinfo->bss_param.dtim_period) || 6659 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 6660 sinfo->bss_param.beacon_interval)) 6661 goto nla_put_failure; 6662 6663 nla_nest_end(msg, bss_param); 6664 } 6665 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 6666 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 6667 sizeof(struct nl80211_sta_flag_update), 6668 &sinfo->sta_flags)) 6669 goto nla_put_failure; 6670 6671 PUT_SINFO_U64(T_OFFSET, t_offset); 6672 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 6673 PUT_SINFO_U64(BEACON_RX, rx_beacon); 6674 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 6675 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 6676 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 6677 if (wiphy_ext_feature_isset(&rdev->wiphy, 6678 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 6679 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 6680 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 6681 } 6682 6683 #undef PUT_SINFO 6684 #undef PUT_SINFO_U64 6685 6686 if (sinfo->pertid) { 6687 struct nlattr *tidsattr; 6688 int tid; 6689 6690 tidsattr = nla_nest_start_noflag(msg, 6691 NL80211_STA_INFO_TID_STATS); 6692 if (!tidsattr) 6693 goto nla_put_failure; 6694 6695 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 6696 struct cfg80211_tid_stats *tidstats; 6697 struct nlattr *tidattr; 6698 6699 tidstats = &sinfo->pertid[tid]; 6700 6701 if (!tidstats->filled) 6702 continue; 6703 6704 tidattr = nla_nest_start_noflag(msg, tid + 1); 6705 if (!tidattr) 6706 goto nla_put_failure; 6707 6708 #define PUT_TIDVAL_U64(attr, memb) do { \ 6709 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 6710 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 6711 tidstats->memb, NL80211_TID_STATS_PAD)) \ 6712 goto nla_put_failure; \ 6713 } while (0) 6714 6715 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 6716 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 6717 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 6718 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 6719 6720 #undef PUT_TIDVAL_U64 6721 if ((tidstats->filled & 6722 BIT(NL80211_TID_STATS_TXQ_STATS)) && 6723 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 6724 NL80211_TID_STATS_TXQ_STATS)) 6725 goto nla_put_failure; 6726 6727 nla_nest_end(msg, tidattr); 6728 } 6729 6730 nla_nest_end(msg, tidsattr); 6731 } 6732 6733 nla_nest_end(msg, sinfoattr); 6734 6735 if (sinfo->assoc_req_ies_len && 6736 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 6737 sinfo->assoc_req_ies)) 6738 goto nla_put_failure; 6739 6740 if (sinfo->assoc_resp_ies_len && 6741 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len, 6742 sinfo->assoc_resp_ies)) 6743 goto nla_put_failure; 6744 6745 if (sinfo->mlo_params_valid) { 6746 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 6747 sinfo->assoc_link_id)) 6748 goto nla_put_failure; 6749 6750 if (!is_zero_ether_addr(sinfo->mld_addr) && 6751 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 6752 sinfo->mld_addr)) 6753 goto nla_put_failure; 6754 } 6755 6756 cfg80211_sinfo_release_content(sinfo); 6757 genlmsg_end(msg, hdr); 6758 return 0; 6759 6760 nla_put_failure: 6761 cfg80211_sinfo_release_content(sinfo); 6762 genlmsg_cancel(msg, hdr); 6763 return -EMSGSIZE; 6764 } 6765 6766 static int nl80211_dump_station(struct sk_buff *skb, 6767 struct netlink_callback *cb) 6768 { 6769 struct station_info sinfo; 6770 struct cfg80211_registered_device *rdev; 6771 struct wireless_dev *wdev; 6772 u8 mac_addr[ETH_ALEN]; 6773 int sta_idx = cb->args[2]; 6774 int err; 6775 6776 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 6777 if (err) 6778 return err; 6779 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 6780 __acquire(&rdev->wiphy.mtx); 6781 6782 if (!wdev->netdev) { 6783 err = -EINVAL; 6784 goto out_err; 6785 } 6786 6787 if (!rdev->ops->dump_station) { 6788 err = -EOPNOTSUPP; 6789 goto out_err; 6790 } 6791 6792 while (1) { 6793 memset(&sinfo, 0, sizeof(sinfo)); 6794 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 6795 mac_addr, &sinfo); 6796 if (err == -ENOENT) 6797 break; 6798 if (err) 6799 goto out_err; 6800 6801 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 6802 NETLINK_CB(cb->skb).portid, 6803 cb->nlh->nlmsg_seq, NLM_F_MULTI, 6804 rdev, wdev->netdev, mac_addr, 6805 &sinfo) < 0) 6806 goto out; 6807 6808 sta_idx++; 6809 } 6810 6811 out: 6812 cb->args[2] = sta_idx; 6813 err = skb->len; 6814 out_err: 6815 wiphy_unlock(&rdev->wiphy); 6816 6817 return err; 6818 } 6819 6820 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 6821 { 6822 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6823 struct net_device *dev = info->user_ptr[1]; 6824 struct station_info sinfo; 6825 struct sk_buff *msg; 6826 u8 *mac_addr = NULL; 6827 int err; 6828 6829 memset(&sinfo, 0, sizeof(sinfo)); 6830 6831 if (!info->attrs[NL80211_ATTR_MAC]) 6832 return -EINVAL; 6833 6834 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 6835 6836 if (!rdev->ops->get_station) 6837 return -EOPNOTSUPP; 6838 6839 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 6840 if (err) 6841 return err; 6842 6843 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6844 if (!msg) { 6845 cfg80211_sinfo_release_content(&sinfo); 6846 return -ENOMEM; 6847 } 6848 6849 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 6850 info->snd_portid, info->snd_seq, 0, 6851 rdev, dev, mac_addr, &sinfo) < 0) { 6852 nlmsg_free(msg); 6853 return -ENOBUFS; 6854 } 6855 6856 return genlmsg_reply(msg, info); 6857 } 6858 6859 int cfg80211_check_station_change(struct wiphy *wiphy, 6860 struct station_parameters *params, 6861 enum cfg80211_station_type statype) 6862 { 6863 if (params->listen_interval != -1 && 6864 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6865 return -EINVAL; 6866 6867 if (params->support_p2p_ps != -1 && 6868 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6869 return -EINVAL; 6870 6871 if (params->aid && 6872 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 6873 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 6874 return -EINVAL; 6875 6876 /* When you run into this, adjust the code below for the new flag */ 6877 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 6878 6879 switch (statype) { 6880 case CFG80211_STA_MESH_PEER_KERNEL: 6881 case CFG80211_STA_MESH_PEER_USER: 6882 /* 6883 * No ignoring the TDLS flag here -- the userspace mesh 6884 * code doesn't have the bug of including TDLS in the 6885 * mask everywhere. 6886 */ 6887 if (params->sta_flags_mask & 6888 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6889 BIT(NL80211_STA_FLAG_MFP) | 6890 BIT(NL80211_STA_FLAG_AUTHORIZED))) 6891 return -EINVAL; 6892 break; 6893 case CFG80211_STA_TDLS_PEER_SETUP: 6894 case CFG80211_STA_TDLS_PEER_ACTIVE: 6895 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 6896 return -EINVAL; 6897 /* ignore since it can't change */ 6898 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6899 break; 6900 default: 6901 /* disallow mesh-specific things */ 6902 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 6903 return -EINVAL; 6904 if (params->local_pm) 6905 return -EINVAL; 6906 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6907 return -EINVAL; 6908 } 6909 6910 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6911 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 6912 /* TDLS can't be set, ... */ 6913 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 6914 return -EINVAL; 6915 /* 6916 * ... but don't bother the driver with it. This works around 6917 * a hostapd/wpa_supplicant issue -- it always includes the 6918 * TLDS_PEER flag in the mask even for AP mode. 6919 */ 6920 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 6921 } 6922 6923 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 6924 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6925 /* reject other things that can't change */ 6926 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 6927 return -EINVAL; 6928 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 6929 return -EINVAL; 6930 if (params->link_sta_params.supported_rates) 6931 return -EINVAL; 6932 if (params->ext_capab || params->link_sta_params.ht_capa || 6933 params->link_sta_params.vht_capa || 6934 params->link_sta_params.he_capa || 6935 params->link_sta_params.eht_capa) 6936 return -EINVAL; 6937 } 6938 6939 if (statype != CFG80211_STA_AP_CLIENT && 6940 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 6941 if (params->vlan) 6942 return -EINVAL; 6943 } 6944 6945 switch (statype) { 6946 case CFG80211_STA_AP_MLME_CLIENT: 6947 /* Use this only for authorizing/unauthorizing a station */ 6948 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 6949 return -EOPNOTSUPP; 6950 break; 6951 case CFG80211_STA_AP_CLIENT: 6952 case CFG80211_STA_AP_CLIENT_UNASSOC: 6953 /* accept only the listed bits */ 6954 if (params->sta_flags_mask & 6955 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6956 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6957 BIT(NL80211_STA_FLAG_ASSOCIATED) | 6958 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 6959 BIT(NL80211_STA_FLAG_WME) | 6960 BIT(NL80211_STA_FLAG_MFP))) 6961 return -EINVAL; 6962 6963 /* but authenticated/associated only if driver handles it */ 6964 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 6965 params->sta_flags_mask & 6966 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 6967 BIT(NL80211_STA_FLAG_ASSOCIATED))) 6968 return -EINVAL; 6969 break; 6970 case CFG80211_STA_IBSS: 6971 case CFG80211_STA_AP_STA: 6972 /* reject any changes other than AUTHORIZED */ 6973 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 6974 return -EINVAL; 6975 break; 6976 case CFG80211_STA_TDLS_PEER_SETUP: 6977 /* reject any changes other than AUTHORIZED or WME */ 6978 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 6979 BIT(NL80211_STA_FLAG_WME))) 6980 return -EINVAL; 6981 /* force (at least) rates when authorizing */ 6982 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 6983 !params->link_sta_params.supported_rates) 6984 return -EINVAL; 6985 break; 6986 case CFG80211_STA_TDLS_PEER_ACTIVE: 6987 /* reject any changes */ 6988 return -EINVAL; 6989 case CFG80211_STA_MESH_PEER_KERNEL: 6990 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 6991 return -EINVAL; 6992 break; 6993 case CFG80211_STA_MESH_PEER_USER: 6994 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 6995 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 6996 return -EINVAL; 6997 break; 6998 } 6999 7000 /* 7001 * Older kernel versions ignored this attribute entirely, so don't 7002 * reject attempts to update it but mark it as unused instead so the 7003 * driver won't look at the data. 7004 */ 7005 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 7006 statype != CFG80211_STA_TDLS_PEER_SETUP) 7007 params->link_sta_params.opmode_notif_used = false; 7008 7009 return 0; 7010 } 7011 EXPORT_SYMBOL(cfg80211_check_station_change); 7012 7013 /* 7014 * Get vlan interface making sure it is running and on the right wiphy. 7015 */ 7016 static struct net_device *get_vlan(struct genl_info *info, 7017 struct cfg80211_registered_device *rdev) 7018 { 7019 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 7020 struct net_device *v; 7021 int ret; 7022 7023 if (!vlanattr) 7024 return NULL; 7025 7026 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 7027 if (!v) 7028 return ERR_PTR(-ENODEV); 7029 7030 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 7031 ret = -EINVAL; 7032 goto error; 7033 } 7034 7035 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 7036 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 7037 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 7038 ret = -EINVAL; 7039 goto error; 7040 } 7041 7042 if (!netif_running(v)) { 7043 ret = -ENETDOWN; 7044 goto error; 7045 } 7046 7047 return v; 7048 error: 7049 dev_put(v); 7050 return ERR_PTR(ret); 7051 } 7052 7053 static int nl80211_parse_sta_wme(struct genl_info *info, 7054 struct station_parameters *params) 7055 { 7056 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 7057 struct nlattr *nla; 7058 int err; 7059 7060 /* parse WME attributes if present */ 7061 if (!info->attrs[NL80211_ATTR_STA_WME]) 7062 return 0; 7063 7064 nla = info->attrs[NL80211_ATTR_STA_WME]; 7065 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla, 7066 nl80211_sta_wme_policy, 7067 info->extack); 7068 if (err) 7069 return err; 7070 7071 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 7072 params->uapsd_queues = nla_get_u8( 7073 tb[NL80211_STA_WME_UAPSD_QUEUES]); 7074 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 7075 return -EINVAL; 7076 7077 if (tb[NL80211_STA_WME_MAX_SP]) 7078 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 7079 7080 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 7081 return -EINVAL; 7082 7083 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 7084 7085 return 0; 7086 } 7087 7088 static int nl80211_parse_sta_channel_info(struct genl_info *info, 7089 struct station_parameters *params) 7090 { 7091 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 7092 params->supported_channels = 7093 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 7094 params->supported_channels_len = 7095 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 7096 /* 7097 * Need to include at least one (first channel, number of 7098 * channels) tuple for each subband (checked in policy), 7099 * and must have proper tuples for the rest of the data as well. 7100 */ 7101 if (params->supported_channels_len % 2) 7102 return -EINVAL; 7103 } 7104 7105 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 7106 params->supported_oper_classes = 7107 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 7108 params->supported_oper_classes_len = 7109 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 7110 } 7111 return 0; 7112 } 7113 7114 static int nl80211_set_station_tdls(struct genl_info *info, 7115 struct station_parameters *params) 7116 { 7117 int err; 7118 /* Dummy STA entry gets updated once the peer capabilities are known */ 7119 if (info->attrs[NL80211_ATTR_PEER_AID]) 7120 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 7121 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 7122 params->link_sta_params.ht_capa = 7123 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 7124 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 7125 params->link_sta_params.vht_capa = 7126 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 7127 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 7128 params->link_sta_params.he_capa = 7129 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7130 params->link_sta_params.he_capa_len = 7131 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7132 7133 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 7134 params->link_sta_params.eht_capa = 7135 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7136 params->link_sta_params.eht_capa_len = 7137 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7138 7139 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa, 7140 (const u8 *)params->link_sta_params.eht_capa, 7141 params->link_sta_params.eht_capa_len, 7142 false)) 7143 return -EINVAL; 7144 } 7145 } 7146 7147 err = nl80211_parse_sta_channel_info(info, params); 7148 if (err) 7149 return err; 7150 7151 return nl80211_parse_sta_wme(info, params); 7152 } 7153 7154 static int nl80211_parse_sta_txpower_setting(struct genl_info *info, 7155 struct sta_txpwr *txpwr, 7156 bool *txpwr_set) 7157 { 7158 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7159 int idx; 7160 7161 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) { 7162 if (!rdev->ops->set_tx_power || 7163 !wiphy_ext_feature_isset(&rdev->wiphy, 7164 NL80211_EXT_FEATURE_STA_TX_PWR)) 7165 return -EOPNOTSUPP; 7166 7167 idx = NL80211_ATTR_STA_TX_POWER_SETTING; 7168 txpwr->type = nla_get_u8(info->attrs[idx]); 7169 7170 if (txpwr->type == NL80211_TX_POWER_LIMITED) { 7171 idx = NL80211_ATTR_STA_TX_POWER; 7172 7173 if (info->attrs[idx]) 7174 txpwr->power = nla_get_s16(info->attrs[idx]); 7175 else 7176 return -EINVAL; 7177 } 7178 7179 *txpwr_set = true; 7180 } else { 7181 *txpwr_set = false; 7182 } 7183 7184 return 0; 7185 } 7186 7187 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 7188 { 7189 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7190 struct net_device *dev = info->user_ptr[1]; 7191 struct station_parameters params; 7192 u8 *mac_addr; 7193 int err; 7194 7195 memset(¶ms, 0, sizeof(params)); 7196 7197 if (!rdev->ops->change_station) 7198 return -EOPNOTSUPP; 7199 7200 /* 7201 * AID and listen_interval properties can be set only for unassociated 7202 * station. Include these parameters here and will check them in 7203 * cfg80211_check_station_change(). 7204 */ 7205 if (info->attrs[NL80211_ATTR_STA_AID]) 7206 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7207 7208 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7209 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7210 7211 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7212 params.listen_interval = 7213 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7214 else 7215 params.listen_interval = -1; 7216 7217 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 7218 params.support_p2p_ps = 7219 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7220 else 7221 params.support_p2p_ps = -1; 7222 7223 if (!info->attrs[NL80211_ATTR_MAC]) 7224 return -EINVAL; 7225 7226 params.link_sta_params.link_id = 7227 nl80211_link_id_or_invalid(info->attrs); 7228 7229 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7230 /* If MLD_ADDR attribute is set then this is an MLD station 7231 * and the MLD_ADDR attribute holds the MLD address and the 7232 * MAC attribute holds for the LINK address. 7233 * In that case, the link_id is also expected to be valid. 7234 */ 7235 if (params.link_sta_params.link_id < 0) 7236 return -EINVAL; 7237 7238 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7239 params.link_sta_params.mld_mac = mac_addr; 7240 params.link_sta_params.link_mac = 7241 nla_data(info->attrs[NL80211_ATTR_MAC]); 7242 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7243 return -EINVAL; 7244 } else { 7245 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7246 } 7247 7248 7249 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 7250 params.link_sta_params.supported_rates = 7251 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7252 params.link_sta_params.supported_rates_len = 7253 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7254 } 7255 7256 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7257 params.capability = 7258 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7259 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7260 } 7261 7262 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7263 params.ext_capab = 7264 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7265 params.ext_capab_len = 7266 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7267 } 7268 7269 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7270 return -EINVAL; 7271 7272 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7273 params.plink_action = 7274 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7275 7276 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 7277 params.plink_state = 7278 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 7279 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 7280 params.peer_aid = nla_get_u16( 7281 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 7282 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 7283 } 7284 7285 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 7286 params.local_pm = nla_get_u32( 7287 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 7288 7289 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7290 params.link_sta_params.opmode_notif_used = true; 7291 params.link_sta_params.opmode_notif = 7292 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7293 } 7294 7295 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7296 params.link_sta_params.he_6ghz_capa = 7297 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7298 7299 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7300 params.airtime_weight = 7301 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7302 7303 if (params.airtime_weight && 7304 !wiphy_ext_feature_isset(&rdev->wiphy, 7305 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7306 return -EOPNOTSUPP; 7307 7308 err = nl80211_parse_sta_txpower_setting(info, 7309 ¶ms.link_sta_params.txpwr, 7310 ¶ms.link_sta_params.txpwr_set); 7311 if (err) 7312 return err; 7313 7314 /* Include parameters for TDLS peer (will check later) */ 7315 err = nl80211_set_station_tdls(info, ¶ms); 7316 if (err) 7317 return err; 7318 7319 params.vlan = get_vlan(info, rdev); 7320 if (IS_ERR(params.vlan)) 7321 return PTR_ERR(params.vlan); 7322 7323 switch (dev->ieee80211_ptr->iftype) { 7324 case NL80211_IFTYPE_AP: 7325 case NL80211_IFTYPE_AP_VLAN: 7326 case NL80211_IFTYPE_P2P_GO: 7327 case NL80211_IFTYPE_P2P_CLIENT: 7328 case NL80211_IFTYPE_STATION: 7329 case NL80211_IFTYPE_ADHOC: 7330 case NL80211_IFTYPE_MESH_POINT: 7331 break; 7332 default: 7333 err = -EOPNOTSUPP; 7334 goto out_put_vlan; 7335 } 7336 7337 /* driver will call cfg80211_check_station_change() */ 7338 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 7339 7340 out_put_vlan: 7341 dev_put(params.vlan); 7342 7343 return err; 7344 } 7345 7346 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 7347 { 7348 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7349 int err; 7350 struct net_device *dev = info->user_ptr[1]; 7351 struct wireless_dev *wdev = dev->ieee80211_ptr; 7352 struct station_parameters params; 7353 u8 *mac_addr = NULL; 7354 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 7355 BIT(NL80211_STA_FLAG_ASSOCIATED); 7356 7357 memset(¶ms, 0, sizeof(params)); 7358 7359 if (!rdev->ops->add_station) 7360 return -EOPNOTSUPP; 7361 7362 if (!info->attrs[NL80211_ATTR_MAC]) 7363 return -EINVAL; 7364 7365 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 7366 return -EINVAL; 7367 7368 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 7369 return -EINVAL; 7370 7371 if (!info->attrs[NL80211_ATTR_STA_AID] && 7372 !info->attrs[NL80211_ATTR_PEER_AID]) 7373 return -EINVAL; 7374 7375 params.link_sta_params.link_id = 7376 nl80211_link_id_or_invalid(info->attrs); 7377 7378 if (info->attrs[NL80211_ATTR_MLD_ADDR]) { 7379 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 7380 params.link_sta_params.mld_mac = mac_addr; 7381 params.link_sta_params.link_mac = 7382 nla_data(info->attrs[NL80211_ATTR_MAC]); 7383 if (!is_valid_ether_addr(params.link_sta_params.link_mac)) 7384 return -EINVAL; 7385 } else { 7386 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 7387 } 7388 7389 params.link_sta_params.supported_rates = 7390 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7391 params.link_sta_params.supported_rates_len = 7392 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 7393 params.listen_interval = 7394 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 7395 7396 if (info->attrs[NL80211_ATTR_VLAN_ID]) 7397 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]); 7398 7399 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 7400 params.support_p2p_ps = 7401 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 7402 } else { 7403 /* 7404 * if not specified, assume it's supported for P2P GO interface, 7405 * and is NOT supported for AP interface 7406 */ 7407 params.support_p2p_ps = 7408 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 7409 } 7410 7411 if (info->attrs[NL80211_ATTR_PEER_AID]) 7412 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 7413 else 7414 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 7415 7416 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 7417 params.capability = 7418 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 7419 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 7420 } 7421 7422 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 7423 params.ext_capab = 7424 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7425 params.ext_capab_len = 7426 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 7427 } 7428 7429 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 7430 params.link_sta_params.ht_capa = 7431 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 7432 7433 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 7434 params.link_sta_params.vht_capa = 7435 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 7436 7437 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 7438 params.link_sta_params.he_capa = 7439 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7440 params.link_sta_params.he_capa_len = 7441 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 7442 7443 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 7444 params.link_sta_params.eht_capa = 7445 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7446 params.link_sta_params.eht_capa_len = 7447 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 7448 7449 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa, 7450 (const u8 *)params.link_sta_params.eht_capa, 7451 params.link_sta_params.eht_capa_len, 7452 false)) 7453 return -EINVAL; 7454 } 7455 } 7456 7457 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 7458 params.link_sta_params.he_6ghz_capa = 7459 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 7460 7461 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 7462 params.link_sta_params.opmode_notif_used = true; 7463 params.link_sta_params.opmode_notif = 7464 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 7465 } 7466 7467 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 7468 params.plink_action = 7469 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 7470 7471 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]) 7472 params.airtime_weight = 7473 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]); 7474 7475 if (params.airtime_weight && 7476 !wiphy_ext_feature_isset(&rdev->wiphy, 7477 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) 7478 return -EOPNOTSUPP; 7479 7480 err = nl80211_parse_sta_txpower_setting(info, 7481 ¶ms.link_sta_params.txpwr, 7482 ¶ms.link_sta_params.txpwr_set); 7483 if (err) 7484 return err; 7485 7486 err = nl80211_parse_sta_channel_info(info, ¶ms); 7487 if (err) 7488 return err; 7489 7490 err = nl80211_parse_sta_wme(info, ¶ms); 7491 if (err) 7492 return err; 7493 7494 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 7495 return -EINVAL; 7496 7497 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 7498 * as userspace might just pass through the capabilities from the IEs 7499 * directly, rather than enforcing this restriction and returning an 7500 * error in this case. 7501 */ 7502 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 7503 params.link_sta_params.ht_capa = NULL; 7504 params.link_sta_params.vht_capa = NULL; 7505 7506 /* HE and EHT require WME */ 7507 if (params.link_sta_params.he_capa_len || 7508 params.link_sta_params.he_6ghz_capa || 7509 params.link_sta_params.eht_capa_len) 7510 return -EINVAL; 7511 } 7512 7513 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */ 7514 if (params.link_sta_params.he_6ghz_capa && 7515 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa)) 7516 return -EINVAL; 7517 7518 /* When you run into this, adjust the code below for the new flag */ 7519 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 7520 7521 switch (dev->ieee80211_ptr->iftype) { 7522 case NL80211_IFTYPE_AP: 7523 case NL80211_IFTYPE_AP_VLAN: 7524 case NL80211_IFTYPE_P2P_GO: 7525 /* ignore WME attributes if iface/sta is not capable */ 7526 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 7527 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 7528 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7529 7530 /* TDLS peers cannot be added */ 7531 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7532 info->attrs[NL80211_ATTR_PEER_AID]) 7533 return -EINVAL; 7534 /* but don't bother the driver with it */ 7535 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 7536 7537 /* allow authenticated/associated only if driver handles it */ 7538 if (!(rdev->wiphy.features & 7539 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 7540 params.sta_flags_mask & auth_assoc) 7541 return -EINVAL; 7542 7543 /* Older userspace, or userspace wanting to be compatible with 7544 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 7545 * and assoc flags in the mask, but assumes the station will be 7546 * added as associated anyway since this was the required driver 7547 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 7548 * introduced. 7549 * In order to not bother drivers with this quirk in the API 7550 * set the flags in both the mask and set for new stations in 7551 * this case. 7552 */ 7553 if (!(params.sta_flags_mask & auth_assoc)) { 7554 params.sta_flags_mask |= auth_assoc; 7555 params.sta_flags_set |= auth_assoc; 7556 } 7557 7558 /* must be last in here for error handling */ 7559 params.vlan = get_vlan(info, rdev); 7560 if (IS_ERR(params.vlan)) 7561 return PTR_ERR(params.vlan); 7562 break; 7563 case NL80211_IFTYPE_MESH_POINT: 7564 /* ignore uAPSD data */ 7565 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7566 7567 /* associated is disallowed */ 7568 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 7569 return -EINVAL; 7570 /* TDLS peers cannot be added */ 7571 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 7572 info->attrs[NL80211_ATTR_PEER_AID]) 7573 return -EINVAL; 7574 break; 7575 case NL80211_IFTYPE_STATION: 7576 case NL80211_IFTYPE_P2P_CLIENT: 7577 /* ignore uAPSD data */ 7578 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 7579 7580 /* these are disallowed */ 7581 if (params.sta_flags_mask & 7582 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 7583 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 7584 return -EINVAL; 7585 /* Only TDLS peers can be added */ 7586 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 7587 return -EINVAL; 7588 /* Can only add if TDLS ... */ 7589 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 7590 return -EOPNOTSUPP; 7591 /* ... with external setup is supported */ 7592 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 7593 return -EOPNOTSUPP; 7594 /* 7595 * Older wpa_supplicant versions always mark the TDLS peer 7596 * as authorized, but it shouldn't yet be. 7597 */ 7598 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 7599 break; 7600 default: 7601 return -EOPNOTSUPP; 7602 } 7603 7604 /* be aware of params.vlan when changing code here */ 7605 7606 if (wdev->valid_links) { 7607 if (params.link_sta_params.link_id < 0) { 7608 err = -EINVAL; 7609 goto out; 7610 } 7611 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) { 7612 err = -ENOLINK; 7613 goto out; 7614 } 7615 } else { 7616 if (params.link_sta_params.link_id >= 0) { 7617 err = -EINVAL; 7618 goto out; 7619 } 7620 } 7621 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 7622 out: 7623 dev_put(params.vlan); 7624 return err; 7625 } 7626 7627 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 7628 { 7629 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7630 struct net_device *dev = info->user_ptr[1]; 7631 struct station_del_parameters params; 7632 7633 memset(¶ms, 0, sizeof(params)); 7634 7635 if (info->attrs[NL80211_ATTR_MAC]) 7636 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 7637 7638 switch (dev->ieee80211_ptr->iftype) { 7639 case NL80211_IFTYPE_AP: 7640 case NL80211_IFTYPE_AP_VLAN: 7641 case NL80211_IFTYPE_MESH_POINT: 7642 case NL80211_IFTYPE_P2P_GO: 7643 /* always accept these */ 7644 break; 7645 case NL80211_IFTYPE_ADHOC: 7646 /* conditionally accept */ 7647 if (wiphy_ext_feature_isset(&rdev->wiphy, 7648 NL80211_EXT_FEATURE_DEL_IBSS_STA)) 7649 break; 7650 return -EINVAL; 7651 default: 7652 return -EINVAL; 7653 } 7654 7655 if (!rdev->ops->del_station) 7656 return -EOPNOTSUPP; 7657 7658 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 7659 params.subtype = 7660 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 7661 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 7662 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 7663 return -EINVAL; 7664 } else { 7665 /* Default to Deauthentication frame */ 7666 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 7667 } 7668 7669 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 7670 params.reason_code = 7671 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 7672 if (params.reason_code == 0) 7673 return -EINVAL; /* 0 is reserved */ 7674 } else { 7675 /* Default to reason code 2 */ 7676 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 7677 } 7678 7679 return rdev_del_station(rdev, dev, ¶ms); 7680 } 7681 7682 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 7683 int flags, struct net_device *dev, 7684 u8 *dst, u8 *next_hop, 7685 struct mpath_info *pinfo) 7686 { 7687 void *hdr; 7688 struct nlattr *pinfoattr; 7689 7690 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 7691 if (!hdr) 7692 return -1; 7693 7694 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 7695 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 7696 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 7697 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 7698 goto nla_put_failure; 7699 7700 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO); 7701 if (!pinfoattr) 7702 goto nla_put_failure; 7703 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 7704 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 7705 pinfo->frame_qlen)) 7706 goto nla_put_failure; 7707 if (((pinfo->filled & MPATH_INFO_SN) && 7708 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 7709 ((pinfo->filled & MPATH_INFO_METRIC) && 7710 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 7711 pinfo->metric)) || 7712 ((pinfo->filled & MPATH_INFO_EXPTIME) && 7713 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 7714 pinfo->exptime)) || 7715 ((pinfo->filled & MPATH_INFO_FLAGS) && 7716 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 7717 pinfo->flags)) || 7718 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 7719 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 7720 pinfo->discovery_timeout)) || 7721 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 7722 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 7723 pinfo->discovery_retries)) || 7724 ((pinfo->filled & MPATH_INFO_HOP_COUNT) && 7725 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT, 7726 pinfo->hop_count)) || 7727 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) && 7728 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE, 7729 pinfo->path_change_count))) 7730 goto nla_put_failure; 7731 7732 nla_nest_end(msg, pinfoattr); 7733 7734 genlmsg_end(msg, hdr); 7735 return 0; 7736 7737 nla_put_failure: 7738 genlmsg_cancel(msg, hdr); 7739 return -EMSGSIZE; 7740 } 7741 7742 static int nl80211_dump_mpath(struct sk_buff *skb, 7743 struct netlink_callback *cb) 7744 { 7745 struct mpath_info pinfo; 7746 struct cfg80211_registered_device *rdev; 7747 struct wireless_dev *wdev; 7748 u8 dst[ETH_ALEN]; 7749 u8 next_hop[ETH_ALEN]; 7750 int path_idx = cb->args[2]; 7751 int err; 7752 7753 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7754 if (err) 7755 return err; 7756 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7757 __acquire(&rdev->wiphy.mtx); 7758 7759 if (!rdev->ops->dump_mpath) { 7760 err = -EOPNOTSUPP; 7761 goto out_err; 7762 } 7763 7764 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7765 err = -EOPNOTSUPP; 7766 goto out_err; 7767 } 7768 7769 while (1) { 7770 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 7771 next_hop, &pinfo); 7772 if (err == -ENOENT) 7773 break; 7774 if (err) 7775 goto out_err; 7776 7777 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7778 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7779 wdev->netdev, dst, next_hop, 7780 &pinfo) < 0) 7781 goto out; 7782 7783 path_idx++; 7784 } 7785 7786 out: 7787 cb->args[2] = path_idx; 7788 err = skb->len; 7789 out_err: 7790 wiphy_unlock(&rdev->wiphy); 7791 return err; 7792 } 7793 7794 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 7795 { 7796 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7797 int err; 7798 struct net_device *dev = info->user_ptr[1]; 7799 struct mpath_info pinfo; 7800 struct sk_buff *msg; 7801 u8 *dst = NULL; 7802 u8 next_hop[ETH_ALEN]; 7803 7804 memset(&pinfo, 0, sizeof(pinfo)); 7805 7806 if (!info->attrs[NL80211_ATTR_MAC]) 7807 return -EINVAL; 7808 7809 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7810 7811 if (!rdev->ops->get_mpath) 7812 return -EOPNOTSUPP; 7813 7814 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7815 return -EOPNOTSUPP; 7816 7817 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 7818 if (err) 7819 return err; 7820 7821 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7822 if (!msg) 7823 return -ENOMEM; 7824 7825 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7826 dev, dst, next_hop, &pinfo) < 0) { 7827 nlmsg_free(msg); 7828 return -ENOBUFS; 7829 } 7830 7831 return genlmsg_reply(msg, info); 7832 } 7833 7834 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 7835 { 7836 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7837 struct net_device *dev = info->user_ptr[1]; 7838 u8 *dst = NULL; 7839 u8 *next_hop = NULL; 7840 7841 if (!info->attrs[NL80211_ATTR_MAC]) 7842 return -EINVAL; 7843 7844 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7845 return -EINVAL; 7846 7847 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7848 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7849 7850 if (!rdev->ops->change_mpath) 7851 return -EOPNOTSUPP; 7852 7853 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7854 return -EOPNOTSUPP; 7855 7856 return rdev_change_mpath(rdev, dev, dst, next_hop); 7857 } 7858 7859 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 7860 { 7861 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7862 struct net_device *dev = info->user_ptr[1]; 7863 u8 *dst = NULL; 7864 u8 *next_hop = NULL; 7865 7866 if (!info->attrs[NL80211_ATTR_MAC]) 7867 return -EINVAL; 7868 7869 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 7870 return -EINVAL; 7871 7872 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7873 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 7874 7875 if (!rdev->ops->add_mpath) 7876 return -EOPNOTSUPP; 7877 7878 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7879 return -EOPNOTSUPP; 7880 7881 return rdev_add_mpath(rdev, dev, dst, next_hop); 7882 } 7883 7884 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 7885 { 7886 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7887 struct net_device *dev = info->user_ptr[1]; 7888 u8 *dst = NULL; 7889 7890 if (info->attrs[NL80211_ATTR_MAC]) 7891 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7892 7893 if (!rdev->ops->del_mpath) 7894 return -EOPNOTSUPP; 7895 7896 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7897 return -EOPNOTSUPP; 7898 7899 return rdev_del_mpath(rdev, dev, dst); 7900 } 7901 7902 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 7903 { 7904 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7905 int err; 7906 struct net_device *dev = info->user_ptr[1]; 7907 struct mpath_info pinfo; 7908 struct sk_buff *msg; 7909 u8 *dst = NULL; 7910 u8 mpp[ETH_ALEN]; 7911 7912 memset(&pinfo, 0, sizeof(pinfo)); 7913 7914 if (!info->attrs[NL80211_ATTR_MAC]) 7915 return -EINVAL; 7916 7917 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 7918 7919 if (!rdev->ops->get_mpp) 7920 return -EOPNOTSUPP; 7921 7922 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 7923 return -EOPNOTSUPP; 7924 7925 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 7926 if (err) 7927 return err; 7928 7929 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 7930 if (!msg) 7931 return -ENOMEM; 7932 7933 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 7934 dev, dst, mpp, &pinfo) < 0) { 7935 nlmsg_free(msg); 7936 return -ENOBUFS; 7937 } 7938 7939 return genlmsg_reply(msg, info); 7940 } 7941 7942 static int nl80211_dump_mpp(struct sk_buff *skb, 7943 struct netlink_callback *cb) 7944 { 7945 struct mpath_info pinfo; 7946 struct cfg80211_registered_device *rdev; 7947 struct wireless_dev *wdev; 7948 u8 dst[ETH_ALEN]; 7949 u8 mpp[ETH_ALEN]; 7950 int path_idx = cb->args[2]; 7951 int err; 7952 7953 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL); 7954 if (err) 7955 return err; 7956 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 7957 __acquire(&rdev->wiphy.mtx); 7958 7959 if (!rdev->ops->dump_mpp) { 7960 err = -EOPNOTSUPP; 7961 goto out_err; 7962 } 7963 7964 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 7965 err = -EOPNOTSUPP; 7966 goto out_err; 7967 } 7968 7969 while (1) { 7970 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 7971 mpp, &pinfo); 7972 if (err == -ENOENT) 7973 break; 7974 if (err) 7975 goto out_err; 7976 7977 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 7978 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7979 wdev->netdev, dst, mpp, 7980 &pinfo) < 0) 7981 goto out; 7982 7983 path_idx++; 7984 } 7985 7986 out: 7987 cb->args[2] = path_idx; 7988 err = skb->len; 7989 out_err: 7990 wiphy_unlock(&rdev->wiphy); 7991 return err; 7992 } 7993 7994 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 7995 { 7996 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7997 struct net_device *dev = info->user_ptr[1]; 7998 struct bss_parameters params; 7999 8000 memset(¶ms, 0, sizeof(params)); 8001 params.link_id = nl80211_link_id_or_invalid(info->attrs); 8002 /* default to not changing parameters */ 8003 params.use_cts_prot = -1; 8004 params.use_short_preamble = -1; 8005 params.use_short_slot_time = -1; 8006 params.ap_isolate = -1; 8007 params.ht_opmode = -1; 8008 params.p2p_ctwindow = -1; 8009 params.p2p_opp_ps = -1; 8010 8011 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 8012 params.use_cts_prot = 8013 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 8014 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 8015 params.use_short_preamble = 8016 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 8017 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 8018 params.use_short_slot_time = 8019 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 8020 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8021 params.basic_rates = 8022 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8023 params.basic_rates_len = 8024 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8025 } 8026 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 8027 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 8028 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 8029 params.ht_opmode = 8030 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 8031 8032 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 8033 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8034 return -EINVAL; 8035 params.p2p_ctwindow = 8036 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 8037 if (params.p2p_ctwindow != 0 && 8038 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 8039 return -EINVAL; 8040 } 8041 8042 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 8043 u8 tmp; 8044 8045 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8046 return -EINVAL; 8047 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 8048 params.p2p_opp_ps = tmp; 8049 if (params.p2p_opp_ps && 8050 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 8051 return -EINVAL; 8052 } 8053 8054 if (!rdev->ops->change_bss) 8055 return -EOPNOTSUPP; 8056 8057 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 8058 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 8059 return -EOPNOTSUPP; 8060 8061 return rdev_change_bss(rdev, dev, ¶ms); 8062 } 8063 8064 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 8065 { 8066 char *data = NULL; 8067 bool is_indoor; 8068 enum nl80211_user_reg_hint_type user_reg_hint_type; 8069 u32 owner_nlportid; 8070 8071 /* 8072 * You should only get this when cfg80211 hasn't yet initialized 8073 * completely when built-in to the kernel right between the time 8074 * window between nl80211_init() and regulatory_init(), if that is 8075 * even possible. 8076 */ 8077 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 8078 return -EINPROGRESS; 8079 8080 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 8081 user_reg_hint_type = 8082 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 8083 else 8084 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 8085 8086 switch (user_reg_hint_type) { 8087 case NL80211_USER_REG_HINT_USER: 8088 case NL80211_USER_REG_HINT_CELL_BASE: 8089 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 8090 return -EINVAL; 8091 8092 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 8093 return regulatory_hint_user(data, user_reg_hint_type); 8094 case NL80211_USER_REG_HINT_INDOOR: 8095 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8096 owner_nlportid = info->snd_portid; 8097 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 8098 } else { 8099 owner_nlportid = 0; 8100 is_indoor = true; 8101 } 8102 8103 return regulatory_hint_indoor(is_indoor, owner_nlportid); 8104 default: 8105 return -EINVAL; 8106 } 8107 } 8108 8109 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 8110 { 8111 return reg_reload_regdb(); 8112 } 8113 8114 static int nl80211_get_mesh_config(struct sk_buff *skb, 8115 struct genl_info *info) 8116 { 8117 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8118 struct net_device *dev = info->user_ptr[1]; 8119 struct wireless_dev *wdev = dev->ieee80211_ptr; 8120 struct mesh_config cur_params; 8121 int err = 0; 8122 void *hdr; 8123 struct nlattr *pinfoattr; 8124 struct sk_buff *msg; 8125 8126 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8127 return -EOPNOTSUPP; 8128 8129 if (!rdev->ops->get_mesh_config) 8130 return -EOPNOTSUPP; 8131 8132 /* If not connected, get default parameters */ 8133 if (!wdev->u.mesh.id_len) 8134 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 8135 else 8136 err = rdev_get_mesh_config(rdev, dev, &cur_params); 8137 8138 if (err) 8139 return err; 8140 8141 /* Draw up a netlink message to send back */ 8142 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8143 if (!msg) 8144 return -ENOMEM; 8145 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8146 NL80211_CMD_GET_MESH_CONFIG); 8147 if (!hdr) 8148 goto out; 8149 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG); 8150 if (!pinfoattr) 8151 goto nla_put_failure; 8152 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 8153 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 8154 cur_params.dot11MeshRetryTimeout) || 8155 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 8156 cur_params.dot11MeshConfirmTimeout) || 8157 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 8158 cur_params.dot11MeshHoldingTimeout) || 8159 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 8160 cur_params.dot11MeshMaxPeerLinks) || 8161 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 8162 cur_params.dot11MeshMaxRetries) || 8163 nla_put_u8(msg, NL80211_MESHCONF_TTL, 8164 cur_params.dot11MeshTTL) || 8165 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 8166 cur_params.element_ttl) || 8167 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8168 cur_params.auto_open_plinks) || 8169 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8170 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 8171 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8172 cur_params.dot11MeshHWMPmaxPREQretries) || 8173 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 8174 cur_params.path_refresh_time) || 8175 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8176 cur_params.min_discovery_timeout) || 8177 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8178 cur_params.dot11MeshHWMPactivePathTimeout) || 8179 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8180 cur_params.dot11MeshHWMPpreqMinInterval) || 8181 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8182 cur_params.dot11MeshHWMPperrMinInterval) || 8183 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8184 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 8185 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 8186 cur_params.dot11MeshHWMPRootMode) || 8187 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8188 cur_params.dot11MeshHWMPRannInterval) || 8189 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8190 cur_params.dot11MeshGateAnnouncementProtocol) || 8191 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 8192 cur_params.dot11MeshForwarding) || 8193 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 8194 cur_params.rssi_threshold) || 8195 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 8196 cur_params.ht_opmode) || 8197 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8198 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 8199 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8200 cur_params.dot11MeshHWMProotInterval) || 8201 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8202 cur_params.dot11MeshHWMPconfirmationInterval) || 8203 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 8204 cur_params.power_mode) || 8205 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 8206 cur_params.dot11MeshAwakeWindowDuration) || 8207 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 8208 cur_params.plink_timeout) || 8209 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE, 8210 cur_params.dot11MeshConnectedToMeshGate) || 8211 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN, 8212 cur_params.dot11MeshNolearn) || 8213 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS, 8214 cur_params.dot11MeshConnectedToAuthServer)) 8215 goto nla_put_failure; 8216 nla_nest_end(msg, pinfoattr); 8217 genlmsg_end(msg, hdr); 8218 return genlmsg_reply(msg, info); 8219 8220 nla_put_failure: 8221 out: 8222 nlmsg_free(msg); 8223 return -ENOBUFS; 8224 } 8225 8226 static const struct nla_policy 8227 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 8228 [NL80211_MESHCONF_RETRY_TIMEOUT] = 8229 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8230 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 8231 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8232 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 8233 NLA_POLICY_RANGE(NLA_U16, 1, 255), 8234 [NL80211_MESHCONF_MAX_PEER_LINKS] = 8235 NLA_POLICY_RANGE(NLA_U16, 0, 255), 8236 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 8237 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8238 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 8239 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 8240 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 8241 NLA_POLICY_RANGE(NLA_U32, 1, 255), 8242 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 8243 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 8244 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 8245 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 8246 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 8247 NLA_POLICY_MIN(NLA_U16, 1), 8248 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 8249 NLA_POLICY_MIN(NLA_U16, 1), 8250 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 8251 NLA_POLICY_MIN(NLA_U16, 1), 8252 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 8253 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 8254 NLA_POLICY_MIN(NLA_U16, 1), 8255 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 8256 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 8257 [NL80211_MESHCONF_RSSI_THRESHOLD] = 8258 NLA_POLICY_RANGE(NLA_S32, -255, 0), 8259 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 8260 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 8261 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 8262 NLA_POLICY_MIN(NLA_U16, 1), 8263 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 8264 NLA_POLICY_MIN(NLA_U16, 1), 8265 [NL80211_MESHCONF_POWER_MODE] = 8266 NLA_POLICY_RANGE(NLA_U32, 8267 NL80211_MESH_POWER_ACTIVE, 8268 NL80211_MESH_POWER_MAX), 8269 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 8270 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 8271 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8272 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8273 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1), 8274 }; 8275 8276 static const struct nla_policy 8277 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 8278 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 8279 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 8280 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 8281 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 8282 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 8283 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 8284 [NL80211_MESH_SETUP_IE] = 8285 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 8286 IEEE80211_MAX_DATA_LEN), 8287 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 8288 }; 8289 8290 static int nl80211_parse_mesh_config(struct genl_info *info, 8291 struct mesh_config *cfg, 8292 u32 *mask_out) 8293 { 8294 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 8295 u32 mask = 0; 8296 u16 ht_opmode; 8297 8298 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 8299 do { \ 8300 if (tb[attr]) { \ 8301 cfg->param = fn(tb[attr]); \ 8302 mask |= BIT((attr) - 1); \ 8303 } \ 8304 } while (0) 8305 8306 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 8307 return -EINVAL; 8308 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack)) 8309 return -EINVAL; 8310 8311 /* This makes sure that there aren't more than 32 mesh config 8312 * parameters (otherwise our bitfield scheme would not work.) */ 8313 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 8314 8315 /* Fill in the params struct */ 8316 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 8317 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 8318 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 8319 NL80211_MESHCONF_CONFIRM_TIMEOUT, 8320 nla_get_u16); 8321 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 8322 NL80211_MESHCONF_HOLDING_TIMEOUT, 8323 nla_get_u16); 8324 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 8325 NL80211_MESHCONF_MAX_PEER_LINKS, 8326 nla_get_u16); 8327 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 8328 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 8329 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 8330 NL80211_MESHCONF_TTL, nla_get_u8); 8331 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 8332 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 8333 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 8334 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 8335 nla_get_u8); 8336 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 8337 mask, 8338 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 8339 nla_get_u32); 8340 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 8341 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 8342 nla_get_u8); 8343 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 8344 NL80211_MESHCONF_PATH_REFRESH_TIME, 8345 nla_get_u32); 8346 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 8347 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 8348 return -EINVAL; 8349 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 8350 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 8351 nla_get_u16); 8352 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 8353 mask, 8354 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 8355 nla_get_u32); 8356 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 8357 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 8358 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 8359 return -EINVAL; 8360 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 8361 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 8362 nla_get_u16); 8363 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 8364 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 8365 nla_get_u16); 8366 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8367 dot11MeshHWMPnetDiameterTraversalTime, mask, 8368 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 8369 nla_get_u16); 8370 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 8371 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 8372 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 8373 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 8374 nla_get_u16); 8375 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 8376 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 8377 nla_get_u8); 8378 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 8379 NL80211_MESHCONF_FORWARDING, nla_get_u8); 8380 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 8381 NL80211_MESHCONF_RSSI_THRESHOLD, 8382 nla_get_s32); 8383 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask, 8384 NL80211_MESHCONF_CONNECTED_TO_GATE, 8385 nla_get_u8); 8386 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask, 8387 NL80211_MESHCONF_CONNECTED_TO_AS, 8388 nla_get_u8); 8389 /* 8390 * Check HT operation mode based on 8391 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 8392 */ 8393 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 8394 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 8395 8396 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 8397 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 8398 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 8399 return -EINVAL; 8400 8401 /* NON_HT_STA bit is reserved, but some programs set it */ 8402 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 8403 8404 cfg->ht_opmode = ht_opmode; 8405 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 8406 } 8407 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 8408 dot11MeshHWMPactivePathToRootTimeout, mask, 8409 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 8410 nla_get_u32); 8411 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 8412 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 8413 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 8414 return -EINVAL; 8415 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 8416 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 8417 nla_get_u16); 8418 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 8419 mask, 8420 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 8421 nla_get_u16); 8422 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 8423 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 8424 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 8425 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 8426 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 8427 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 8428 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask, 8429 NL80211_MESHCONF_NOLEARN, nla_get_u8); 8430 if (mask_out) 8431 *mask_out = mask; 8432 8433 return 0; 8434 8435 #undef FILL_IN_MESH_PARAM_IF_SET 8436 } 8437 8438 static int nl80211_parse_mesh_setup(struct genl_info *info, 8439 struct mesh_setup *setup) 8440 { 8441 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8442 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 8443 8444 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 8445 return -EINVAL; 8446 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack)) 8447 return -EINVAL; 8448 8449 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 8450 setup->sync_method = 8451 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 8452 IEEE80211_SYNC_METHOD_VENDOR : 8453 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 8454 8455 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 8456 setup->path_sel_proto = 8457 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 8458 IEEE80211_PATH_PROTOCOL_VENDOR : 8459 IEEE80211_PATH_PROTOCOL_HWMP; 8460 8461 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 8462 setup->path_metric = 8463 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 8464 IEEE80211_PATH_METRIC_VENDOR : 8465 IEEE80211_PATH_METRIC_AIRTIME; 8466 8467 if (tb[NL80211_MESH_SETUP_IE]) { 8468 struct nlattr *ieattr = 8469 tb[NL80211_MESH_SETUP_IE]; 8470 setup->ie = nla_data(ieattr); 8471 setup->ie_len = nla_len(ieattr); 8472 } 8473 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 8474 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 8475 return -EINVAL; 8476 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 8477 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 8478 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 8479 if (setup->is_secure) 8480 setup->user_mpm = true; 8481 8482 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 8483 if (!setup->user_mpm) 8484 return -EINVAL; 8485 setup->auth_id = 8486 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 8487 } 8488 8489 return 0; 8490 } 8491 8492 static int nl80211_update_mesh_config(struct sk_buff *skb, 8493 struct genl_info *info) 8494 { 8495 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8496 struct net_device *dev = info->user_ptr[1]; 8497 struct wireless_dev *wdev = dev->ieee80211_ptr; 8498 struct mesh_config cfg = {}; 8499 u32 mask; 8500 int err; 8501 8502 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 8503 return -EOPNOTSUPP; 8504 8505 if (!rdev->ops->update_mesh_config) 8506 return -EOPNOTSUPP; 8507 8508 err = nl80211_parse_mesh_config(info, &cfg, &mask); 8509 if (err) 8510 return err; 8511 8512 if (!wdev->u.mesh.id_len) 8513 err = -ENOLINK; 8514 8515 if (!err) 8516 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 8517 8518 return err; 8519 } 8520 8521 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 8522 struct sk_buff *msg) 8523 { 8524 struct nlattr *nl_reg_rules; 8525 unsigned int i; 8526 8527 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 8528 (regdom->dfs_region && 8529 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 8530 goto nla_put_failure; 8531 8532 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES); 8533 if (!nl_reg_rules) 8534 goto nla_put_failure; 8535 8536 for (i = 0; i < regdom->n_reg_rules; i++) { 8537 struct nlattr *nl_reg_rule; 8538 const struct ieee80211_reg_rule *reg_rule; 8539 const struct ieee80211_freq_range *freq_range; 8540 const struct ieee80211_power_rule *power_rule; 8541 unsigned int max_bandwidth_khz; 8542 8543 reg_rule = ®dom->reg_rules[i]; 8544 freq_range = ®_rule->freq_range; 8545 power_rule = ®_rule->power_rule; 8546 8547 nl_reg_rule = nla_nest_start_noflag(msg, i); 8548 if (!nl_reg_rule) 8549 goto nla_put_failure; 8550 8551 max_bandwidth_khz = freq_range->max_bandwidth_khz; 8552 if (!max_bandwidth_khz) 8553 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 8554 reg_rule); 8555 8556 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 8557 reg_rule->flags) || 8558 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 8559 freq_range->start_freq_khz) || 8560 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 8561 freq_range->end_freq_khz) || 8562 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 8563 max_bandwidth_khz) || 8564 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 8565 power_rule->max_antenna_gain) || 8566 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 8567 power_rule->max_eirp) || 8568 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 8569 reg_rule->dfs_cac_ms)) 8570 goto nla_put_failure; 8571 8572 if ((reg_rule->flags & NL80211_RRF_PSD) && 8573 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD, 8574 reg_rule->psd)) 8575 goto nla_put_failure; 8576 8577 nla_nest_end(msg, nl_reg_rule); 8578 } 8579 8580 nla_nest_end(msg, nl_reg_rules); 8581 return 0; 8582 8583 nla_put_failure: 8584 return -EMSGSIZE; 8585 } 8586 8587 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 8588 { 8589 const struct ieee80211_regdomain *regdom = NULL; 8590 struct cfg80211_registered_device *rdev; 8591 struct wiphy *wiphy = NULL; 8592 struct sk_buff *msg; 8593 int err = -EMSGSIZE; 8594 void *hdr; 8595 8596 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 8597 if (!msg) 8598 return -ENOBUFS; 8599 8600 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 8601 NL80211_CMD_GET_REG); 8602 if (!hdr) 8603 goto put_failure; 8604 8605 rtnl_lock(); 8606 8607 if (info->attrs[NL80211_ATTR_WIPHY]) { 8608 bool self_managed; 8609 8610 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 8611 if (IS_ERR(rdev)) { 8612 err = PTR_ERR(rdev); 8613 goto nla_put_failure; 8614 } 8615 8616 wiphy = &rdev->wiphy; 8617 self_managed = wiphy->regulatory_flags & 8618 REGULATORY_WIPHY_SELF_MANAGED; 8619 8620 rcu_read_lock(); 8621 8622 regdom = get_wiphy_regdom(wiphy); 8623 8624 /* a self-managed-reg device must have a private regdom */ 8625 if (WARN_ON(!regdom && self_managed)) { 8626 err = -EINVAL; 8627 goto nla_put_failure_rcu; 8628 } 8629 8630 if (regdom && 8631 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8632 goto nla_put_failure_rcu; 8633 } else { 8634 rcu_read_lock(); 8635 } 8636 8637 if (!wiphy && reg_last_request_cell_base() && 8638 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8639 NL80211_USER_REG_HINT_CELL_BASE)) 8640 goto nla_put_failure_rcu; 8641 8642 if (!regdom) 8643 regdom = rcu_dereference(cfg80211_regdomain); 8644 8645 if (nl80211_put_regdom(regdom, msg)) 8646 goto nla_put_failure_rcu; 8647 8648 rcu_read_unlock(); 8649 8650 genlmsg_end(msg, hdr); 8651 rtnl_unlock(); 8652 return genlmsg_reply(msg, info); 8653 8654 nla_put_failure_rcu: 8655 rcu_read_unlock(); 8656 nla_put_failure: 8657 rtnl_unlock(); 8658 put_failure: 8659 nlmsg_free(msg); 8660 return err; 8661 } 8662 8663 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 8664 u32 seq, int flags, struct wiphy *wiphy, 8665 const struct ieee80211_regdomain *regdom) 8666 { 8667 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 8668 NL80211_CMD_GET_REG); 8669 8670 if (!hdr) 8671 return -1; 8672 8673 genl_dump_check_consistent(cb, hdr); 8674 8675 if (nl80211_put_regdom(regdom, msg)) 8676 goto nla_put_failure; 8677 8678 if (!wiphy && reg_last_request_cell_base() && 8679 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 8680 NL80211_USER_REG_HINT_CELL_BASE)) 8681 goto nla_put_failure; 8682 8683 if (wiphy && 8684 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 8685 goto nla_put_failure; 8686 8687 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 8688 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 8689 goto nla_put_failure; 8690 8691 genlmsg_end(msg, hdr); 8692 return 0; 8693 8694 nla_put_failure: 8695 genlmsg_cancel(msg, hdr); 8696 return -EMSGSIZE; 8697 } 8698 8699 static int nl80211_get_reg_dump(struct sk_buff *skb, 8700 struct netlink_callback *cb) 8701 { 8702 const struct ieee80211_regdomain *regdom = NULL; 8703 struct cfg80211_registered_device *rdev; 8704 int err, reg_idx, start = cb->args[2]; 8705 8706 rcu_read_lock(); 8707 8708 if (cfg80211_regdomain && start == 0) { 8709 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8710 NLM_F_MULTI, NULL, 8711 rcu_dereference(cfg80211_regdomain)); 8712 if (err < 0) 8713 goto out_err; 8714 } 8715 8716 /* the global regdom is idx 0 */ 8717 reg_idx = 1; 8718 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 8719 regdom = get_wiphy_regdom(&rdev->wiphy); 8720 if (!regdom) 8721 continue; 8722 8723 if (++reg_idx <= start) 8724 continue; 8725 8726 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 8727 NLM_F_MULTI, &rdev->wiphy, regdom); 8728 if (err < 0) { 8729 reg_idx--; 8730 break; 8731 } 8732 } 8733 8734 cb->args[2] = reg_idx; 8735 err = skb->len; 8736 out_err: 8737 rcu_read_unlock(); 8738 return err; 8739 } 8740 8741 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 8742 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 8743 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 8744 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 8745 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 8746 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 8747 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 8748 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 8749 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 8750 }; 8751 8752 static int parse_reg_rule(struct nlattr *tb[], 8753 struct ieee80211_reg_rule *reg_rule) 8754 { 8755 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 8756 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 8757 8758 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 8759 return -EINVAL; 8760 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 8761 return -EINVAL; 8762 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 8763 return -EINVAL; 8764 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 8765 return -EINVAL; 8766 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 8767 return -EINVAL; 8768 8769 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 8770 8771 freq_range->start_freq_khz = 8772 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 8773 freq_range->end_freq_khz = 8774 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 8775 freq_range->max_bandwidth_khz = 8776 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 8777 8778 power_rule->max_eirp = 8779 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 8780 8781 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 8782 power_rule->max_antenna_gain = 8783 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 8784 8785 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 8786 reg_rule->dfs_cac_ms = 8787 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 8788 8789 return 0; 8790 } 8791 8792 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 8793 { 8794 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 8795 struct nlattr *nl_reg_rule; 8796 char *alpha2; 8797 int rem_reg_rules, r; 8798 u32 num_rules = 0, rule_idx = 0; 8799 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 8800 struct ieee80211_regdomain *rd; 8801 8802 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 8803 return -EINVAL; 8804 8805 if (!info->attrs[NL80211_ATTR_REG_RULES]) 8806 return -EINVAL; 8807 8808 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 8809 8810 if (info->attrs[NL80211_ATTR_DFS_REGION]) 8811 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 8812 8813 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8814 rem_reg_rules) { 8815 num_rules++; 8816 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 8817 return -EINVAL; 8818 } 8819 8820 rtnl_lock(); 8821 if (!reg_is_valid_request(alpha2)) { 8822 r = -EINVAL; 8823 goto out; 8824 } 8825 8826 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL); 8827 if (!rd) { 8828 r = -ENOMEM; 8829 goto out; 8830 } 8831 8832 rd->n_reg_rules = num_rules; 8833 rd->alpha2[0] = alpha2[0]; 8834 rd->alpha2[1] = alpha2[1]; 8835 8836 /* 8837 * Disable DFS master mode if the DFS region was 8838 * not supported or known on this kernel. 8839 */ 8840 if (reg_supported_dfs_region(dfs_region)) 8841 rd->dfs_region = dfs_region; 8842 8843 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 8844 rem_reg_rules) { 8845 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX, 8846 nl_reg_rule, reg_rule_policy, 8847 info->extack); 8848 if (r) 8849 goto bad_reg; 8850 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 8851 if (r) 8852 goto bad_reg; 8853 8854 rule_idx++; 8855 8856 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 8857 r = -EINVAL; 8858 goto bad_reg; 8859 } 8860 } 8861 8862 r = set_regdom(rd, REGD_SOURCE_CRDA); 8863 /* set_regdom takes ownership of rd */ 8864 rd = NULL; 8865 bad_reg: 8866 kfree(rd); 8867 out: 8868 rtnl_unlock(); 8869 return r; 8870 } 8871 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 8872 8873 static int validate_scan_freqs(struct nlattr *freqs) 8874 { 8875 struct nlattr *attr1, *attr2; 8876 int n_channels = 0, tmp1, tmp2; 8877 8878 nla_for_each_nested(attr1, freqs, tmp1) 8879 if (nla_len(attr1) != sizeof(u32)) 8880 return 0; 8881 8882 nla_for_each_nested(attr1, freqs, tmp1) { 8883 n_channels++; 8884 /* 8885 * Some hardware has a limited channel list for 8886 * scanning, and it is pretty much nonsensical 8887 * to scan for a channel twice, so disallow that 8888 * and don't require drivers to check that the 8889 * channel list they get isn't longer than what 8890 * they can scan, as long as they can scan all 8891 * the channels they registered at once. 8892 */ 8893 nla_for_each_nested(attr2, freqs, tmp2) 8894 if (attr1 != attr2 && 8895 nla_get_u32(attr1) == nla_get_u32(attr2)) 8896 return 0; 8897 } 8898 8899 return n_channels; 8900 } 8901 8902 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 8903 { 8904 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 8905 } 8906 8907 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 8908 struct cfg80211_bss_selection *bss_select) 8909 { 8910 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 8911 struct nlattr *nest; 8912 int err; 8913 bool found = false; 8914 int i; 8915 8916 /* only process one nested attribute */ 8917 nest = nla_data(nla); 8918 if (!nla_ok(nest, nla_len(nest))) 8919 return -EINVAL; 8920 8921 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX, 8922 nest, nl80211_bss_select_policy, 8923 NULL); 8924 if (err) 8925 return err; 8926 8927 /* only one attribute may be given */ 8928 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 8929 if (attr[i]) { 8930 if (found) 8931 return -EINVAL; 8932 found = true; 8933 } 8934 } 8935 8936 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 8937 8938 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 8939 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 8940 8941 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 8942 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 8943 bss_select->param.band_pref = 8944 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 8945 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 8946 return -EINVAL; 8947 } 8948 8949 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 8950 struct nl80211_bss_select_rssi_adjust *adj_param; 8951 8952 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 8953 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 8954 bss_select->param.adjust.band = adj_param->band; 8955 bss_select->param.adjust.delta = adj_param->delta; 8956 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 8957 return -EINVAL; 8958 } 8959 8960 /* user-space did not provide behaviour attribute */ 8961 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 8962 return -EINVAL; 8963 8964 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 8965 return -EINVAL; 8966 8967 return 0; 8968 } 8969 8970 int nl80211_parse_random_mac(struct nlattr **attrs, 8971 u8 *mac_addr, u8 *mac_addr_mask) 8972 { 8973 int i; 8974 8975 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 8976 eth_zero_addr(mac_addr); 8977 eth_zero_addr(mac_addr_mask); 8978 mac_addr[0] = 0x2; 8979 mac_addr_mask[0] = 0x3; 8980 8981 return 0; 8982 } 8983 8984 /* need both or none */ 8985 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 8986 return -EINVAL; 8987 8988 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 8989 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 8990 8991 /* don't allow or configure an mcast address */ 8992 if (!is_multicast_ether_addr(mac_addr_mask) || 8993 is_multicast_ether_addr(mac_addr)) 8994 return -EINVAL; 8995 8996 /* 8997 * allow users to pass a MAC address that has bits set outside 8998 * of the mask, but don't bother drivers with having to deal 8999 * with such bits 9000 */ 9001 for (i = 0; i < ETH_ALEN; i++) 9002 mac_addr[i] &= mac_addr_mask[i]; 9003 9004 return 0; 9005 } 9006 9007 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev, 9008 struct ieee80211_channel *chan) 9009 { 9010 unsigned int link_id; 9011 bool all_ok = true; 9012 9013 lockdep_assert_wiphy(wdev->wiphy); 9014 9015 if (!cfg80211_beaconing_iface_active(wdev)) 9016 return true; 9017 9018 /* 9019 * FIXME: check if we have a free HW resource/link for chan 9020 * 9021 * This, as well as the FIXME below, requires knowing the link 9022 * capabilities of the hardware. 9023 */ 9024 9025 /* we cannot leave radar channels */ 9026 for_each_valid_link(wdev, link_id) { 9027 struct cfg80211_chan_def *chandef; 9028 9029 chandef = wdev_chandef(wdev, link_id); 9030 if (!chandef || !chandef->chan) 9031 continue; 9032 9033 /* 9034 * FIXME: don't require all_ok, but rather check only the 9035 * correct HW resource/link onto which 'chan' falls, 9036 * as only that link leaves the channel for doing 9037 * the off-channel operation. 9038 */ 9039 9040 if (chandef->chan->flags & IEEE80211_CHAN_RADAR) 9041 all_ok = false; 9042 } 9043 9044 if (all_ok) 9045 return true; 9046 9047 return regulatory_pre_cac_allowed(wdev->wiphy); 9048 } 9049 9050 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 9051 enum nl80211_ext_feature_index feat) 9052 { 9053 if (!(flags & flag)) 9054 return true; 9055 if (wiphy_ext_feature_isset(wiphy, feat)) 9056 return true; 9057 return false; 9058 } 9059 9060 static int 9061 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 9062 void *request, struct nlattr **attrs, 9063 bool is_sched_scan) 9064 { 9065 u8 *mac_addr, *mac_addr_mask; 9066 u32 *flags; 9067 enum nl80211_feature_flags randomness_flag; 9068 9069 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 9070 return 0; 9071 9072 if (is_sched_scan) { 9073 struct cfg80211_sched_scan_request *req = request; 9074 9075 randomness_flag = wdev ? 9076 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 9077 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 9078 flags = &req->flags; 9079 mac_addr = req->mac_addr; 9080 mac_addr_mask = req->mac_addr_mask; 9081 } else { 9082 struct cfg80211_scan_request *req = request; 9083 9084 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 9085 flags = &req->flags; 9086 mac_addr = req->mac_addr; 9087 mac_addr_mask = req->mac_addr_mask; 9088 } 9089 9090 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 9091 9092 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 9093 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 9094 !nl80211_check_scan_feat(wiphy, *flags, 9095 NL80211_SCAN_FLAG_LOW_SPAN, 9096 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 9097 !nl80211_check_scan_feat(wiphy, *flags, 9098 NL80211_SCAN_FLAG_LOW_POWER, 9099 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 9100 !nl80211_check_scan_feat(wiphy, *flags, 9101 NL80211_SCAN_FLAG_HIGH_ACCURACY, 9102 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 9103 !nl80211_check_scan_feat(wiphy, *flags, 9104 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 9105 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 9106 !nl80211_check_scan_feat(wiphy, *flags, 9107 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 9108 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 9109 !nl80211_check_scan_feat(wiphy, *flags, 9110 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 9111 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 9112 !nl80211_check_scan_feat(wiphy, *flags, 9113 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 9114 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 9115 !nl80211_check_scan_feat(wiphy, *flags, 9116 NL80211_SCAN_FLAG_RANDOM_SN, 9117 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 9118 !nl80211_check_scan_feat(wiphy, *flags, 9119 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 9120 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 9121 return -EOPNOTSUPP; 9122 9123 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 9124 int err; 9125 9126 if (!(wiphy->features & randomness_flag) || 9127 (wdev && wdev->connected)) 9128 return -EOPNOTSUPP; 9129 9130 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 9131 if (err) 9132 return err; 9133 } 9134 9135 return 0; 9136 } 9137 9138 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 9139 { 9140 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9141 struct wireless_dev *wdev = info->user_ptr[1]; 9142 struct cfg80211_scan_request *request; 9143 struct nlattr *scan_freqs = NULL; 9144 bool scan_freqs_khz = false; 9145 struct nlattr *attr; 9146 struct wiphy *wiphy; 9147 int err, tmp, n_ssids = 0, n_channels, i; 9148 size_t ie_len, size; 9149 9150 wiphy = &rdev->wiphy; 9151 9152 if (wdev->iftype == NL80211_IFTYPE_NAN) 9153 return -EOPNOTSUPP; 9154 9155 if (!rdev->ops->scan) 9156 return -EOPNOTSUPP; 9157 9158 if (rdev->scan_req || rdev->scan_msg) 9159 return -EBUSY; 9160 9161 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) { 9162 if (!wiphy_ext_feature_isset(wiphy, 9163 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ)) 9164 return -EOPNOTSUPP; 9165 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]; 9166 scan_freqs_khz = true; 9167 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) 9168 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]; 9169 9170 if (scan_freqs) { 9171 n_channels = validate_scan_freqs(scan_freqs); 9172 if (!n_channels) 9173 return -EINVAL; 9174 } else { 9175 n_channels = ieee80211_get_num_supported_channels(wiphy); 9176 } 9177 9178 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 9179 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 9180 n_ssids++; 9181 9182 if (n_ssids > wiphy->max_scan_ssids) 9183 return -EINVAL; 9184 9185 if (info->attrs[NL80211_ATTR_IE]) 9186 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9187 else 9188 ie_len = 0; 9189 9190 if (ie_len > wiphy->max_scan_ie_len) 9191 return -EINVAL; 9192 9193 size = struct_size(request, channels, n_channels); 9194 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids)); 9195 size = size_add(size, ie_len); 9196 request = kzalloc(size, GFP_KERNEL); 9197 if (!request) 9198 return -ENOMEM; 9199 9200 if (n_ssids) 9201 request->ssids = (void *)&request->channels[n_channels]; 9202 request->n_ssids = n_ssids; 9203 if (ie_len) { 9204 if (n_ssids) 9205 request->ie = (void *)(request->ssids + n_ssids); 9206 else 9207 request->ie = (void *)(request->channels + n_channels); 9208 } 9209 9210 i = 0; 9211 if (scan_freqs) { 9212 /* user specified, bail out if channel not found */ 9213 nla_for_each_nested(attr, scan_freqs, tmp) { 9214 struct ieee80211_channel *chan; 9215 int freq = nla_get_u32(attr); 9216 9217 if (!scan_freqs_khz) 9218 freq = MHZ_TO_KHZ(freq); 9219 9220 chan = ieee80211_get_channel_khz(wiphy, freq); 9221 if (!chan) { 9222 err = -EINVAL; 9223 goto out_free; 9224 } 9225 9226 /* ignore disabled channels */ 9227 if (chan->flags & IEEE80211_CHAN_DISABLED) 9228 continue; 9229 9230 request->channels[i] = chan; 9231 i++; 9232 } 9233 } else { 9234 enum nl80211_band band; 9235 9236 /* all channels */ 9237 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9238 int j; 9239 9240 if (!wiphy->bands[band]) 9241 continue; 9242 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9243 struct ieee80211_channel *chan; 9244 9245 chan = &wiphy->bands[band]->channels[j]; 9246 9247 if (chan->flags & IEEE80211_CHAN_DISABLED) 9248 continue; 9249 9250 request->channels[i] = chan; 9251 i++; 9252 } 9253 } 9254 } 9255 9256 if (!i) { 9257 err = -EINVAL; 9258 goto out_free; 9259 } 9260 9261 request->n_channels = i; 9262 9263 for (i = 0; i < request->n_channels; i++) { 9264 struct ieee80211_channel *chan = request->channels[i]; 9265 9266 /* if we can go off-channel to the target channel we're good */ 9267 if (cfg80211_off_channel_oper_allowed(wdev, chan)) 9268 continue; 9269 9270 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) { 9271 err = -EBUSY; 9272 goto out_free; 9273 } 9274 } 9275 9276 i = 0; 9277 if (n_ssids) { 9278 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 9279 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9280 err = -EINVAL; 9281 goto out_free; 9282 } 9283 request->ssids[i].ssid_len = nla_len(attr); 9284 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 9285 i++; 9286 } 9287 } 9288 9289 if (info->attrs[NL80211_ATTR_IE]) { 9290 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9291 memcpy((void *)request->ie, 9292 nla_data(info->attrs[NL80211_ATTR_IE]), 9293 request->ie_len); 9294 } 9295 9296 for (i = 0; i < NUM_NL80211_BANDS; i++) 9297 if (wiphy->bands[i]) 9298 request->rates[i] = 9299 (1 << wiphy->bands[i]->n_bitrates) - 1; 9300 9301 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 9302 nla_for_each_nested(attr, 9303 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 9304 tmp) { 9305 enum nl80211_band band = nla_type(attr); 9306 9307 if (band < 0 || band >= NUM_NL80211_BANDS) { 9308 err = -EINVAL; 9309 goto out_free; 9310 } 9311 9312 if (!wiphy->bands[band]) 9313 continue; 9314 9315 err = ieee80211_get_ratemask(wiphy->bands[band], 9316 nla_data(attr), 9317 nla_len(attr), 9318 &request->rates[band]); 9319 if (err) 9320 goto out_free; 9321 } 9322 } 9323 9324 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 9325 request->duration = 9326 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 9327 request->duration_mandatory = 9328 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 9329 } 9330 9331 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 9332 false); 9333 if (err) 9334 goto out_free; 9335 9336 request->no_cck = 9337 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9338 9339 /* Initial implementation used NL80211_ATTR_MAC to set the specific 9340 * BSSID to scan for. This was problematic because that same attribute 9341 * was already used for another purpose (local random MAC address). The 9342 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 9343 * compatibility with older userspace components, also use the 9344 * NL80211_ATTR_MAC value here if it can be determined to be used for 9345 * the specific BSSID use case instead of the random MAC address 9346 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 9347 */ 9348 if (info->attrs[NL80211_ATTR_BSSID]) 9349 memcpy(request->bssid, 9350 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 9351 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 9352 info->attrs[NL80211_ATTR_MAC]) 9353 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 9354 ETH_ALEN); 9355 else 9356 eth_broadcast_addr(request->bssid); 9357 9358 request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs); 9359 request->wdev = wdev; 9360 request->wiphy = &rdev->wiphy; 9361 request->scan_start = jiffies; 9362 9363 rdev->scan_req = request; 9364 err = cfg80211_scan(rdev); 9365 9366 if (err) 9367 goto out_free; 9368 9369 nl80211_send_scan_start(rdev, wdev); 9370 dev_hold(wdev->netdev); 9371 9372 return 0; 9373 9374 out_free: 9375 rdev->scan_req = NULL; 9376 kfree(request); 9377 9378 return err; 9379 } 9380 9381 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 9382 { 9383 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9384 struct wireless_dev *wdev = info->user_ptr[1]; 9385 9386 if (!rdev->ops->abort_scan) 9387 return -EOPNOTSUPP; 9388 9389 if (rdev->scan_msg) 9390 return 0; 9391 9392 if (!rdev->scan_req) 9393 return -ENOENT; 9394 9395 rdev_abort_scan(rdev, wdev); 9396 return 0; 9397 } 9398 9399 static int 9400 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 9401 struct cfg80211_sched_scan_request *request, 9402 struct nlattr **attrs) 9403 { 9404 int tmp, err, i = 0; 9405 struct nlattr *attr; 9406 9407 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9408 u32 interval; 9409 9410 /* 9411 * If scan plans are not specified, 9412 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 9413 * case one scan plan will be set with the specified scan 9414 * interval and infinite number of iterations. 9415 */ 9416 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 9417 if (!interval) 9418 return -EINVAL; 9419 9420 request->scan_plans[0].interval = 9421 DIV_ROUND_UP(interval, MSEC_PER_SEC); 9422 if (!request->scan_plans[0].interval) 9423 return -EINVAL; 9424 9425 if (request->scan_plans[0].interval > 9426 wiphy->max_sched_scan_plan_interval) 9427 request->scan_plans[0].interval = 9428 wiphy->max_sched_scan_plan_interval; 9429 9430 return 0; 9431 } 9432 9433 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 9434 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 9435 9436 if (WARN_ON(i >= n_plans)) 9437 return -EINVAL; 9438 9439 err = nla_parse_nested_deprecated(plan, 9440 NL80211_SCHED_SCAN_PLAN_MAX, 9441 attr, nl80211_plan_policy, 9442 NULL); 9443 if (err) 9444 return err; 9445 9446 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 9447 return -EINVAL; 9448 9449 request->scan_plans[i].interval = 9450 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 9451 if (!request->scan_plans[i].interval || 9452 request->scan_plans[i].interval > 9453 wiphy->max_sched_scan_plan_interval) 9454 return -EINVAL; 9455 9456 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 9457 request->scan_plans[i].iterations = 9458 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 9459 if (!request->scan_plans[i].iterations || 9460 (request->scan_plans[i].iterations > 9461 wiphy->max_sched_scan_plan_iterations)) 9462 return -EINVAL; 9463 } else if (i < n_plans - 1) { 9464 /* 9465 * All scan plans but the last one must specify 9466 * a finite number of iterations 9467 */ 9468 return -EINVAL; 9469 } 9470 9471 i++; 9472 } 9473 9474 /* 9475 * The last scan plan must not specify the number of 9476 * iterations, it is supposed to run infinitely 9477 */ 9478 if (request->scan_plans[n_plans - 1].iterations) 9479 return -EINVAL; 9480 9481 return 0; 9482 } 9483 9484 static int 9485 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy, 9486 struct cfg80211_match_set *match_sets, 9487 struct nlattr *tb_band_rssi, 9488 s32 rssi_thold) 9489 { 9490 struct nlattr *attr; 9491 int i, tmp, ret = 0; 9492 9493 if (!wiphy_ext_feature_isset(wiphy, 9494 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) { 9495 if (tb_band_rssi) 9496 ret = -EOPNOTSUPP; 9497 else 9498 for (i = 0; i < NUM_NL80211_BANDS; i++) 9499 match_sets->per_band_rssi_thold[i] = 9500 NL80211_SCAN_RSSI_THOLD_OFF; 9501 return ret; 9502 } 9503 9504 for (i = 0; i < NUM_NL80211_BANDS; i++) 9505 match_sets->per_band_rssi_thold[i] = rssi_thold; 9506 9507 nla_for_each_nested(attr, tb_band_rssi, tmp) { 9508 enum nl80211_band band = nla_type(attr); 9509 9510 if (band < 0 || band >= NUM_NL80211_BANDS) 9511 return -EINVAL; 9512 9513 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr); 9514 } 9515 9516 return 0; 9517 } 9518 9519 static struct cfg80211_sched_scan_request * 9520 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 9521 struct nlattr **attrs, int max_match_sets) 9522 { 9523 struct cfg80211_sched_scan_request *request; 9524 struct nlattr *attr; 9525 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 9526 enum nl80211_band band; 9527 size_t ie_len, size; 9528 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 9529 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 9530 9531 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9532 n_channels = validate_scan_freqs( 9533 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 9534 if (!n_channels) 9535 return ERR_PTR(-EINVAL); 9536 } else { 9537 n_channels = ieee80211_get_num_supported_channels(wiphy); 9538 } 9539 9540 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 9541 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9542 tmp) 9543 n_ssids++; 9544 9545 if (n_ssids > wiphy->max_sched_scan_ssids) 9546 return ERR_PTR(-EINVAL); 9547 9548 /* 9549 * First, count the number of 'real' matchsets. Due to an issue with 9550 * the old implementation, matchsets containing only the RSSI attribute 9551 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 9552 * RSSI for all matchsets, rather than their own matchset for reporting 9553 * all APs with a strong RSSI. This is needed to be compatible with 9554 * older userspace that treated a matchset with only the RSSI as the 9555 * global RSSI for all other matchsets - if there are other matchsets. 9556 */ 9557 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9558 nla_for_each_nested(attr, 9559 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9560 tmp) { 9561 struct nlattr *rssi; 9562 9563 err = nla_parse_nested_deprecated(tb, 9564 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9565 attr, 9566 nl80211_match_policy, 9567 NULL); 9568 if (err) 9569 return ERR_PTR(err); 9570 9571 /* SSID and BSSID are mutually exclusive */ 9572 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 9573 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 9574 return ERR_PTR(-EINVAL); 9575 9576 /* add other standalone attributes here */ 9577 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 9578 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 9579 n_match_sets++; 9580 continue; 9581 } 9582 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9583 if (rssi) 9584 default_match_rssi = nla_get_s32(rssi); 9585 } 9586 } 9587 9588 /* However, if there's no other matchset, add the RSSI one */ 9589 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 9590 n_match_sets = 1; 9591 9592 if (n_match_sets > max_match_sets) 9593 return ERR_PTR(-EINVAL); 9594 9595 if (attrs[NL80211_ATTR_IE]) 9596 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 9597 else 9598 ie_len = 0; 9599 9600 if (ie_len > wiphy->max_sched_scan_ie_len) 9601 return ERR_PTR(-EINVAL); 9602 9603 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 9604 /* 9605 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 9606 * each scan plan already specifies its own interval 9607 */ 9608 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9609 return ERR_PTR(-EINVAL); 9610 9611 nla_for_each_nested(attr, 9612 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 9613 n_plans++; 9614 } else { 9615 /* 9616 * The scan interval attribute is kept for backward 9617 * compatibility. If no scan plans are specified and sched scan 9618 * interval is specified, one scan plan will be set with this 9619 * scan interval and infinite number of iterations. 9620 */ 9621 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 9622 return ERR_PTR(-EINVAL); 9623 9624 n_plans = 1; 9625 } 9626 9627 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 9628 return ERR_PTR(-EINVAL); 9629 9630 if (!wiphy_ext_feature_isset( 9631 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 9632 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 9633 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 9634 return ERR_PTR(-EINVAL); 9635 9636 size = struct_size(request, channels, n_channels); 9637 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids)); 9638 size = size_add(size, array_size(sizeof(*request->match_sets), 9639 n_match_sets)); 9640 size = size_add(size, array_size(sizeof(*request->scan_plans), 9641 n_plans)); 9642 size = size_add(size, ie_len); 9643 request = kzalloc(size, GFP_KERNEL); 9644 if (!request) 9645 return ERR_PTR(-ENOMEM); 9646 9647 if (n_ssids) 9648 request->ssids = (void *)&request->channels[n_channels]; 9649 request->n_ssids = n_ssids; 9650 if (ie_len) { 9651 if (n_ssids) 9652 request->ie = (void *)(request->ssids + n_ssids); 9653 else 9654 request->ie = (void *)(request->channels + n_channels); 9655 } 9656 9657 if (n_match_sets) { 9658 if (request->ie) 9659 request->match_sets = (void *)(request->ie + ie_len); 9660 else if (n_ssids) 9661 request->match_sets = 9662 (void *)(request->ssids + n_ssids); 9663 else 9664 request->match_sets = 9665 (void *)(request->channels + n_channels); 9666 } 9667 request->n_match_sets = n_match_sets; 9668 9669 if (n_match_sets) 9670 request->scan_plans = (void *)(request->match_sets + 9671 n_match_sets); 9672 else if (request->ie) 9673 request->scan_plans = (void *)(request->ie + ie_len); 9674 else if (n_ssids) 9675 request->scan_plans = (void *)(request->ssids + n_ssids); 9676 else 9677 request->scan_plans = (void *)(request->channels + n_channels); 9678 9679 request->n_scan_plans = n_plans; 9680 9681 i = 0; 9682 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 9683 /* user specified, bail out if channel not found */ 9684 nla_for_each_nested(attr, 9685 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 9686 tmp) { 9687 struct ieee80211_channel *chan; 9688 9689 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 9690 9691 if (!chan) { 9692 err = -EINVAL; 9693 goto out_free; 9694 } 9695 9696 /* ignore disabled channels */ 9697 if (chan->flags & IEEE80211_CHAN_DISABLED) 9698 continue; 9699 9700 request->channels[i] = chan; 9701 i++; 9702 } 9703 } else { 9704 /* all channels */ 9705 for (band = 0; band < NUM_NL80211_BANDS; band++) { 9706 int j; 9707 9708 if (!wiphy->bands[band]) 9709 continue; 9710 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 9711 struct ieee80211_channel *chan; 9712 9713 chan = &wiphy->bands[band]->channels[j]; 9714 9715 if (chan->flags & IEEE80211_CHAN_DISABLED) 9716 continue; 9717 9718 request->channels[i] = chan; 9719 i++; 9720 } 9721 } 9722 } 9723 9724 if (!i) { 9725 err = -EINVAL; 9726 goto out_free; 9727 } 9728 9729 request->n_channels = i; 9730 9731 i = 0; 9732 if (n_ssids) { 9733 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 9734 tmp) { 9735 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 9736 err = -EINVAL; 9737 goto out_free; 9738 } 9739 request->ssids[i].ssid_len = nla_len(attr); 9740 memcpy(request->ssids[i].ssid, nla_data(attr), 9741 nla_len(attr)); 9742 i++; 9743 } 9744 } 9745 9746 i = 0; 9747 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 9748 nla_for_each_nested(attr, 9749 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 9750 tmp) { 9751 struct nlattr *ssid, *bssid, *rssi; 9752 9753 err = nla_parse_nested_deprecated(tb, 9754 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 9755 attr, 9756 nl80211_match_policy, 9757 NULL); 9758 if (err) 9759 goto out_free; 9760 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 9761 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 9762 9763 if (!ssid && !bssid) { 9764 i++; 9765 continue; 9766 } 9767 9768 if (WARN_ON(i >= n_match_sets)) { 9769 /* this indicates a programming error, 9770 * the loop above should have verified 9771 * things properly 9772 */ 9773 err = -EINVAL; 9774 goto out_free; 9775 } 9776 9777 if (ssid) { 9778 memcpy(request->match_sets[i].ssid.ssid, 9779 nla_data(ssid), nla_len(ssid)); 9780 request->match_sets[i].ssid.ssid_len = 9781 nla_len(ssid); 9782 } 9783 if (bssid) 9784 memcpy(request->match_sets[i].bssid, 9785 nla_data(bssid), ETH_ALEN); 9786 9787 /* special attribute - old implementation w/a */ 9788 request->match_sets[i].rssi_thold = default_match_rssi; 9789 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 9790 if (rssi) 9791 request->match_sets[i].rssi_thold = 9792 nla_get_s32(rssi); 9793 9794 /* Parse per band RSSI attribute */ 9795 err = nl80211_parse_sched_scan_per_band_rssi(wiphy, 9796 &request->match_sets[i], 9797 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI], 9798 request->match_sets[i].rssi_thold); 9799 if (err) 9800 goto out_free; 9801 9802 i++; 9803 } 9804 9805 /* there was no other matchset, so the RSSI one is alone */ 9806 if (i == 0 && n_match_sets) 9807 request->match_sets[0].rssi_thold = default_match_rssi; 9808 9809 request->min_rssi_thold = INT_MAX; 9810 for (i = 0; i < n_match_sets; i++) 9811 request->min_rssi_thold = 9812 min(request->match_sets[i].rssi_thold, 9813 request->min_rssi_thold); 9814 } else { 9815 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 9816 } 9817 9818 if (ie_len) { 9819 request->ie_len = ie_len; 9820 memcpy((void *)request->ie, 9821 nla_data(attrs[NL80211_ATTR_IE]), 9822 request->ie_len); 9823 } 9824 9825 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 9826 if (err) 9827 goto out_free; 9828 9829 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 9830 request->delay = 9831 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 9832 9833 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 9834 request->relative_rssi = nla_get_s8( 9835 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 9836 request->relative_rssi_set = true; 9837 } 9838 9839 if (request->relative_rssi_set && 9840 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 9841 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 9842 9843 rssi_adjust = nla_data( 9844 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 9845 request->rssi_adjust.band = rssi_adjust->band; 9846 request->rssi_adjust.delta = rssi_adjust->delta; 9847 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 9848 err = -EINVAL; 9849 goto out_free; 9850 } 9851 } 9852 9853 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 9854 if (err) 9855 goto out_free; 9856 9857 request->scan_start = jiffies; 9858 9859 return request; 9860 9861 out_free: 9862 kfree(request); 9863 return ERR_PTR(err); 9864 } 9865 9866 static int nl80211_start_sched_scan(struct sk_buff *skb, 9867 struct genl_info *info) 9868 { 9869 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9870 struct net_device *dev = info->user_ptr[1]; 9871 struct wireless_dev *wdev = dev->ieee80211_ptr; 9872 struct cfg80211_sched_scan_request *sched_scan_req; 9873 bool want_multi; 9874 int err; 9875 9876 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 9877 return -EOPNOTSUPP; 9878 9879 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 9880 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 9881 if (err) 9882 return err; 9883 9884 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 9885 info->attrs, 9886 rdev->wiphy.max_match_sets); 9887 9888 err = PTR_ERR_OR_ZERO(sched_scan_req); 9889 if (err) 9890 goto out_err; 9891 9892 /* leave request id zero for legacy request 9893 * or if driver does not support multi-scheduled scan 9894 */ 9895 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) 9896 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 9897 9898 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 9899 if (err) 9900 goto out_free; 9901 9902 sched_scan_req->dev = dev; 9903 sched_scan_req->wiphy = &rdev->wiphy; 9904 9905 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 9906 sched_scan_req->owner_nlportid = info->snd_portid; 9907 9908 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 9909 9910 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 9911 return 0; 9912 9913 out_free: 9914 kfree(sched_scan_req); 9915 out_err: 9916 return err; 9917 } 9918 9919 static int nl80211_stop_sched_scan(struct sk_buff *skb, 9920 struct genl_info *info) 9921 { 9922 struct cfg80211_sched_scan_request *req; 9923 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9924 u64 cookie; 9925 9926 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 9927 return -EOPNOTSUPP; 9928 9929 if (info->attrs[NL80211_ATTR_COOKIE]) { 9930 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9931 return __cfg80211_stop_sched_scan(rdev, cookie, false); 9932 } 9933 9934 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 9935 struct cfg80211_sched_scan_request, 9936 list); 9937 if (!req || req->reqid || 9938 (req->owner_nlportid && 9939 req->owner_nlportid != info->snd_portid)) 9940 return -ENOENT; 9941 9942 return cfg80211_stop_sched_scan_req(rdev, req, false); 9943 } 9944 9945 static int nl80211_start_radar_detection(struct sk_buff *skb, 9946 struct genl_info *info) 9947 { 9948 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9949 struct net_device *dev = info->user_ptr[1]; 9950 struct wireless_dev *wdev = dev->ieee80211_ptr; 9951 struct wiphy *wiphy = wdev->wiphy; 9952 struct cfg80211_chan_def chandef; 9953 enum nl80211_dfs_regions dfs_region; 9954 unsigned int cac_time_ms; 9955 int err = -EINVAL; 9956 9957 flush_delayed_work(&rdev->dfs_update_channels_wk); 9958 9959 wiphy_lock(wiphy); 9960 9961 dfs_region = reg_get_dfs_region(wiphy); 9962 if (dfs_region == NL80211_DFS_UNSET) 9963 goto unlock; 9964 9965 err = nl80211_parse_chandef(rdev, info, &chandef); 9966 if (err) 9967 goto unlock; 9968 9969 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 9970 if (err < 0) 9971 goto unlock; 9972 9973 if (err == 0) { 9974 err = -EINVAL; 9975 goto unlock; 9976 } 9977 9978 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) { 9979 err = -EINVAL; 9980 goto unlock; 9981 } 9982 9983 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) { 9984 err = cfg80211_start_background_radar_detection(rdev, wdev, 9985 &chandef); 9986 goto unlock; 9987 } 9988 9989 if (netif_carrier_ok(dev)) { 9990 err = -EBUSY; 9991 goto unlock; 9992 } 9993 9994 if (wdev->cac_started) { 9995 err = -EBUSY; 9996 goto unlock; 9997 } 9998 9999 /* CAC start is offloaded to HW and can't be started manually */ 10000 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) { 10001 err = -EOPNOTSUPP; 10002 goto unlock; 10003 } 10004 10005 if (!rdev->ops->start_radar_detection) { 10006 err = -EOPNOTSUPP; 10007 goto unlock; 10008 } 10009 10010 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 10011 if (WARN_ON(!cac_time_ms)) 10012 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 10013 10014 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 10015 if (!err) { 10016 wdev->links[0].ap.chandef = chandef; 10017 wdev->cac_started = true; 10018 wdev->cac_start_time = jiffies; 10019 wdev->cac_time_ms = cac_time_ms; 10020 } 10021 unlock: 10022 wiphy_unlock(wiphy); 10023 10024 return err; 10025 } 10026 10027 static int nl80211_notify_radar_detection(struct sk_buff *skb, 10028 struct genl_info *info) 10029 { 10030 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10031 struct net_device *dev = info->user_ptr[1]; 10032 struct wireless_dev *wdev = dev->ieee80211_ptr; 10033 struct wiphy *wiphy = wdev->wiphy; 10034 struct cfg80211_chan_def chandef; 10035 enum nl80211_dfs_regions dfs_region; 10036 int err; 10037 10038 dfs_region = reg_get_dfs_region(wiphy); 10039 if (dfs_region == NL80211_DFS_UNSET) { 10040 GENL_SET_ERR_MSG(info, 10041 "DFS Region is not set. Unexpected Radar indication"); 10042 return -EINVAL; 10043 } 10044 10045 err = nl80211_parse_chandef(rdev, info, &chandef); 10046 if (err) { 10047 GENL_SET_ERR_MSG(info, "Unable to extract chandef info"); 10048 return err; 10049 } 10050 10051 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 10052 if (err < 0) { 10053 GENL_SET_ERR_MSG(info, "chandef is invalid"); 10054 return err; 10055 } 10056 10057 if (err == 0) { 10058 GENL_SET_ERR_MSG(info, 10059 "Unexpected Radar indication for chandef/iftype"); 10060 return -EINVAL; 10061 } 10062 10063 /* Do not process this notification if radar is already detected 10064 * by kernel on this channel, and return success. 10065 */ 10066 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE) 10067 return 0; 10068 10069 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE); 10070 10071 cfg80211_sched_dfs_chan_update(rdev); 10072 10073 rdev->radar_chandef = chandef; 10074 10075 /* Propagate this notification to other radios as well */ 10076 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 10077 10078 return 0; 10079 } 10080 10081 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 10082 { 10083 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10084 unsigned int link_id = nl80211_link_id(info->attrs); 10085 struct net_device *dev = info->user_ptr[1]; 10086 struct wireless_dev *wdev = dev->ieee80211_ptr; 10087 struct cfg80211_csa_settings params; 10088 struct nlattr **csa_attrs = NULL; 10089 int err; 10090 bool need_new_beacon = false; 10091 bool need_handle_dfs_flag = true; 10092 int len, i; 10093 u32 cs_count; 10094 10095 if (!rdev->ops->channel_switch || 10096 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 10097 return -EOPNOTSUPP; 10098 10099 switch (dev->ieee80211_ptr->iftype) { 10100 case NL80211_IFTYPE_AP: 10101 case NL80211_IFTYPE_P2P_GO: 10102 need_new_beacon = true; 10103 /* For all modes except AP the handle_dfs flag needs to be 10104 * supplied to tell the kernel that userspace will handle radar 10105 * events when they happen. Otherwise a switch to a channel 10106 * requiring DFS will be rejected. 10107 */ 10108 need_handle_dfs_flag = false; 10109 10110 /* useless if AP is not running */ 10111 if (!wdev->links[link_id].ap.beacon_interval) 10112 return -ENOTCONN; 10113 break; 10114 case NL80211_IFTYPE_ADHOC: 10115 if (!wdev->u.ibss.ssid_len) 10116 return -ENOTCONN; 10117 break; 10118 case NL80211_IFTYPE_MESH_POINT: 10119 if (!wdev->u.mesh.id_len) 10120 return -ENOTCONN; 10121 break; 10122 default: 10123 return -EOPNOTSUPP; 10124 } 10125 10126 memset(¶ms, 0, sizeof(params)); 10127 params.beacon_csa.ftm_responder = -1; 10128 10129 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 10130 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 10131 return -EINVAL; 10132 10133 /* only important for AP, IBSS and mesh create IEs internally */ 10134 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 10135 return -EINVAL; 10136 10137 /* Even though the attribute is u32, the specification says 10138 * u8, so let's make sure we don't overflow. 10139 */ 10140 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 10141 if (cs_count > 255) 10142 return -EINVAL; 10143 10144 params.count = cs_count; 10145 10146 if (!need_new_beacon) 10147 goto skip_beacons; 10148 10149 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after, 10150 info->extack); 10151 if (err) 10152 goto free; 10153 10154 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs), 10155 GFP_KERNEL); 10156 if (!csa_attrs) { 10157 err = -ENOMEM; 10158 goto free; 10159 } 10160 10161 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX, 10162 info->attrs[NL80211_ATTR_CSA_IES], 10163 nl80211_policy, info->extack); 10164 if (err) 10165 goto free; 10166 10167 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa, 10168 info->extack); 10169 if (err) 10170 goto free; 10171 10172 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 10173 err = -EINVAL; 10174 goto free; 10175 } 10176 10177 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10178 if (!len || (len % sizeof(u16))) { 10179 err = -EINVAL; 10180 goto free; 10181 } 10182 10183 params.n_counter_offsets_beacon = len / sizeof(u16); 10184 if (rdev->wiphy.max_num_csa_counters && 10185 (params.n_counter_offsets_beacon > 10186 rdev->wiphy.max_num_csa_counters)) { 10187 err = -EINVAL; 10188 goto free; 10189 } 10190 10191 params.counter_offsets_beacon = 10192 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 10193 10194 /* sanity checks - counters should fit and be the same */ 10195 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 10196 u16 offset = params.counter_offsets_beacon[i]; 10197 10198 if (offset >= params.beacon_csa.tail_len) { 10199 err = -EINVAL; 10200 goto free; 10201 } 10202 10203 if (params.beacon_csa.tail[offset] != params.count) { 10204 err = -EINVAL; 10205 goto free; 10206 } 10207 } 10208 10209 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 10210 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10211 if (!len || (len % sizeof(u16))) { 10212 err = -EINVAL; 10213 goto free; 10214 } 10215 10216 params.n_counter_offsets_presp = len / sizeof(u16); 10217 if (rdev->wiphy.max_num_csa_counters && 10218 (params.n_counter_offsets_presp > 10219 rdev->wiphy.max_num_csa_counters)) { 10220 err = -EINVAL; 10221 goto free; 10222 } 10223 10224 params.counter_offsets_presp = 10225 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 10226 10227 /* sanity checks - counters should fit and be the same */ 10228 for (i = 0; i < params.n_counter_offsets_presp; i++) { 10229 u16 offset = params.counter_offsets_presp[i]; 10230 10231 if (offset >= params.beacon_csa.probe_resp_len) { 10232 err = -EINVAL; 10233 goto free; 10234 } 10235 10236 if (params.beacon_csa.probe_resp[offset] != 10237 params.count) { 10238 err = -EINVAL; 10239 goto free; 10240 } 10241 } 10242 } 10243 10244 skip_beacons: 10245 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 10246 if (err) 10247 goto free; 10248 10249 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 10250 wdev->iftype)) { 10251 err = -EINVAL; 10252 goto free; 10253 } 10254 10255 err = cfg80211_chandef_dfs_required(wdev->wiphy, 10256 ¶ms.chandef, 10257 wdev->iftype); 10258 if (err < 0) 10259 goto free; 10260 10261 if (err > 0) { 10262 params.radar_required = true; 10263 if (need_handle_dfs_flag && 10264 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 10265 err = -EINVAL; 10266 goto free; 10267 } 10268 } 10269 10270 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 10271 params.block_tx = true; 10272 10273 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) { 10274 err = nl80211_parse_punct_bitmap(rdev, info, 10275 ¶ms.chandef, 10276 ¶ms.punct_bitmap); 10277 if (err) 10278 goto free; 10279 } 10280 10281 err = rdev_channel_switch(rdev, dev, ¶ms); 10282 10283 free: 10284 kfree(params.beacon_after.mbssid_ies); 10285 kfree(params.beacon_csa.mbssid_ies); 10286 kfree(params.beacon_after.rnr_ies); 10287 kfree(params.beacon_csa.rnr_ies); 10288 kfree(csa_attrs); 10289 return err; 10290 } 10291 10292 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 10293 u32 seq, int flags, 10294 struct cfg80211_registered_device *rdev, 10295 struct wireless_dev *wdev, 10296 struct cfg80211_internal_bss *intbss) 10297 { 10298 struct cfg80211_bss *res = &intbss->pub; 10299 const struct cfg80211_bss_ies *ies; 10300 unsigned int link_id; 10301 void *hdr; 10302 struct nlattr *bss; 10303 10304 lockdep_assert_wiphy(wdev->wiphy); 10305 10306 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 10307 NL80211_CMD_NEW_SCAN_RESULTS); 10308 if (!hdr) 10309 return -1; 10310 10311 genl_dump_check_consistent(cb, hdr); 10312 10313 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 10314 goto nla_put_failure; 10315 if (wdev->netdev && 10316 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 10317 goto nla_put_failure; 10318 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 10319 NL80211_ATTR_PAD)) 10320 goto nla_put_failure; 10321 10322 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS); 10323 if (!bss) 10324 goto nla_put_failure; 10325 if ((!is_zero_ether_addr(res->bssid) && 10326 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 10327 goto nla_put_failure; 10328 10329 rcu_read_lock(); 10330 /* indicate whether we have probe response data or not */ 10331 if (rcu_access_pointer(res->proberesp_ies) && 10332 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 10333 goto fail_unlock_rcu; 10334 10335 /* this pointer prefers to be pointed to probe response data 10336 * but is always valid 10337 */ 10338 ies = rcu_dereference(res->ies); 10339 if (ies) { 10340 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 10341 NL80211_BSS_PAD)) 10342 goto fail_unlock_rcu; 10343 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 10344 ies->len, ies->data)) 10345 goto fail_unlock_rcu; 10346 } 10347 10348 /* and this pointer is always (unless driver didn't know) beacon data */ 10349 ies = rcu_dereference(res->beacon_ies); 10350 if (ies && ies->from_beacon) { 10351 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 10352 NL80211_BSS_PAD)) 10353 goto fail_unlock_rcu; 10354 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 10355 ies->len, ies->data)) 10356 goto fail_unlock_rcu; 10357 } 10358 rcu_read_unlock(); 10359 10360 if (res->beacon_interval && 10361 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 10362 goto nla_put_failure; 10363 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 10364 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 10365 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET, 10366 res->channel->freq_offset) || 10367 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 10368 jiffies_to_msecs(jiffies - intbss->ts))) 10369 goto nla_put_failure; 10370 10371 if (intbss->parent_tsf && 10372 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 10373 intbss->parent_tsf, NL80211_BSS_PAD) || 10374 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 10375 intbss->parent_bssid))) 10376 goto nla_put_failure; 10377 10378 if (intbss->ts_boottime && 10379 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 10380 intbss->ts_boottime, NL80211_BSS_PAD)) 10381 goto nla_put_failure; 10382 10383 if (!nl80211_put_signal(msg, intbss->pub.chains, 10384 intbss->pub.chain_signal, 10385 NL80211_BSS_CHAIN_SIGNAL)) 10386 goto nla_put_failure; 10387 10388 switch (rdev->wiphy.signal_type) { 10389 case CFG80211_SIGNAL_TYPE_MBM: 10390 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 10391 goto nla_put_failure; 10392 break; 10393 case CFG80211_SIGNAL_TYPE_UNSPEC: 10394 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 10395 goto nla_put_failure; 10396 break; 10397 default: 10398 break; 10399 } 10400 10401 switch (wdev->iftype) { 10402 case NL80211_IFTYPE_P2P_CLIENT: 10403 case NL80211_IFTYPE_STATION: 10404 for_each_valid_link(wdev, link_id) { 10405 if (intbss == wdev->links[link_id].client.current_bss && 10406 (nla_put_u32(msg, NL80211_BSS_STATUS, 10407 NL80211_BSS_STATUS_ASSOCIATED) || 10408 (wdev->valid_links && 10409 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID, 10410 link_id) || 10411 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN, 10412 wdev->u.client.connected_addr))))) 10413 goto nla_put_failure; 10414 } 10415 break; 10416 case NL80211_IFTYPE_ADHOC: 10417 if (intbss == wdev->u.ibss.current_bss && 10418 nla_put_u32(msg, NL80211_BSS_STATUS, 10419 NL80211_BSS_STATUS_IBSS_JOINED)) 10420 goto nla_put_failure; 10421 break; 10422 default: 10423 break; 10424 } 10425 10426 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for)) 10427 goto nla_put_failure; 10428 10429 if (res->cannot_use_reasons && 10430 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS, 10431 res->cannot_use_reasons, 10432 NL80211_BSS_PAD)) 10433 goto nla_put_failure; 10434 10435 nla_nest_end(msg, bss); 10436 10437 genlmsg_end(msg, hdr); 10438 return 0; 10439 10440 fail_unlock_rcu: 10441 rcu_read_unlock(); 10442 nla_put_failure: 10443 genlmsg_cancel(msg, hdr); 10444 return -EMSGSIZE; 10445 } 10446 10447 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 10448 { 10449 struct cfg80211_registered_device *rdev; 10450 struct cfg80211_internal_bss *scan; 10451 struct wireless_dev *wdev; 10452 struct nlattr **attrbuf; 10453 int start = cb->args[2], idx = 0; 10454 bool dump_include_use_data; 10455 int err; 10456 10457 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 10458 if (!attrbuf) 10459 return -ENOMEM; 10460 10461 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf); 10462 if (err) { 10463 kfree(attrbuf); 10464 return err; 10465 } 10466 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10467 __acquire(&rdev->wiphy.mtx); 10468 10469 dump_include_use_data = 10470 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA]; 10471 kfree(attrbuf); 10472 10473 spin_lock_bh(&rdev->bss_lock); 10474 10475 /* 10476 * dump_scan will be called multiple times to break up the scan results 10477 * into multiple messages. It is unlikely that any more bss-es will be 10478 * expired after the first call, so only call only call this on the 10479 * first dump_scan invocation. 10480 */ 10481 if (start == 0) 10482 cfg80211_bss_expire(rdev); 10483 10484 cb->seq = rdev->bss_generation; 10485 10486 list_for_each_entry(scan, &rdev->bss_list, list) { 10487 if (++idx <= start) 10488 continue; 10489 if (!dump_include_use_data && 10490 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL)) 10491 continue; 10492 if (nl80211_send_bss(skb, cb, 10493 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10494 rdev, wdev, scan) < 0) { 10495 idx--; 10496 break; 10497 } 10498 } 10499 10500 spin_unlock_bh(&rdev->bss_lock); 10501 10502 cb->args[2] = idx; 10503 wiphy_unlock(&rdev->wiphy); 10504 10505 return skb->len; 10506 } 10507 10508 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 10509 int flags, struct net_device *dev, 10510 bool allow_radio_stats, 10511 struct survey_info *survey) 10512 { 10513 void *hdr; 10514 struct nlattr *infoattr; 10515 10516 /* skip radio stats if userspace didn't request them */ 10517 if (!survey->channel && !allow_radio_stats) 10518 return 0; 10519 10520 hdr = nl80211hdr_put(msg, portid, seq, flags, 10521 NL80211_CMD_NEW_SURVEY_RESULTS); 10522 if (!hdr) 10523 return -ENOMEM; 10524 10525 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 10526 goto nla_put_failure; 10527 10528 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO); 10529 if (!infoattr) 10530 goto nla_put_failure; 10531 10532 if (survey->channel && 10533 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 10534 survey->channel->center_freq)) 10535 goto nla_put_failure; 10536 10537 if (survey->channel && survey->channel->freq_offset && 10538 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET, 10539 survey->channel->freq_offset)) 10540 goto nla_put_failure; 10541 10542 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 10543 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 10544 goto nla_put_failure; 10545 if ((survey->filled & SURVEY_INFO_IN_USE) && 10546 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 10547 goto nla_put_failure; 10548 if ((survey->filled & SURVEY_INFO_TIME) && 10549 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 10550 survey->time, NL80211_SURVEY_INFO_PAD)) 10551 goto nla_put_failure; 10552 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 10553 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 10554 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 10555 goto nla_put_failure; 10556 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 10557 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 10558 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 10559 goto nla_put_failure; 10560 if ((survey->filled & SURVEY_INFO_TIME_RX) && 10561 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 10562 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 10563 goto nla_put_failure; 10564 if ((survey->filled & SURVEY_INFO_TIME_TX) && 10565 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 10566 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 10567 goto nla_put_failure; 10568 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 10569 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 10570 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 10571 goto nla_put_failure; 10572 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) && 10573 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX, 10574 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD)) 10575 goto nla_put_failure; 10576 10577 nla_nest_end(msg, infoattr); 10578 10579 genlmsg_end(msg, hdr); 10580 return 0; 10581 10582 nla_put_failure: 10583 genlmsg_cancel(msg, hdr); 10584 return -EMSGSIZE; 10585 } 10586 10587 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 10588 { 10589 struct nlattr **attrbuf; 10590 struct survey_info survey; 10591 struct cfg80211_registered_device *rdev; 10592 struct wireless_dev *wdev; 10593 int survey_idx = cb->args[2]; 10594 int res; 10595 bool radio_stats; 10596 10597 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 10598 if (!attrbuf) 10599 return -ENOMEM; 10600 10601 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf); 10602 if (res) { 10603 kfree(attrbuf); 10604 return res; 10605 } 10606 /* nl80211_prepare_wdev_dump acquired it in the successful case */ 10607 __acquire(&rdev->wiphy.mtx); 10608 10609 /* prepare_wdev_dump parsed the attributes */ 10610 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 10611 10612 if (!wdev->netdev) { 10613 res = -EINVAL; 10614 goto out_err; 10615 } 10616 10617 if (!rdev->ops->dump_survey) { 10618 res = -EOPNOTSUPP; 10619 goto out_err; 10620 } 10621 10622 while (1) { 10623 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 10624 if (res == -ENOENT) 10625 break; 10626 if (res) 10627 goto out_err; 10628 10629 /* don't send disabled channels, but do send non-channel data */ 10630 if (survey.channel && 10631 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 10632 survey_idx++; 10633 continue; 10634 } 10635 10636 if (nl80211_send_survey(skb, 10637 NETLINK_CB(cb->skb).portid, 10638 cb->nlh->nlmsg_seq, NLM_F_MULTI, 10639 wdev->netdev, radio_stats, &survey) < 0) 10640 goto out; 10641 survey_idx++; 10642 } 10643 10644 out: 10645 cb->args[2] = survey_idx; 10646 res = skb->len; 10647 out_err: 10648 kfree(attrbuf); 10649 wiphy_unlock(&rdev->wiphy); 10650 return res; 10651 } 10652 10653 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 10654 { 10655 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 10656 NL80211_WPA_VERSION_2 | 10657 NL80211_WPA_VERSION_3)); 10658 } 10659 10660 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 10661 { 10662 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10663 struct net_device *dev = info->user_ptr[1]; 10664 struct ieee80211_channel *chan; 10665 const u8 *bssid, *ssid; 10666 int err, ssid_len; 10667 enum nl80211_auth_type auth_type; 10668 struct key_parse key; 10669 bool local_state_change; 10670 struct cfg80211_auth_request req = {}; 10671 u32 freq; 10672 10673 if (!info->attrs[NL80211_ATTR_MAC]) 10674 return -EINVAL; 10675 10676 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 10677 return -EINVAL; 10678 10679 if (!info->attrs[NL80211_ATTR_SSID]) 10680 return -EINVAL; 10681 10682 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 10683 return -EINVAL; 10684 10685 err = nl80211_parse_key(info, &key); 10686 if (err) 10687 return err; 10688 10689 if (key.idx >= 0) { 10690 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 10691 return -EINVAL; 10692 if (!key.p.key || !key.p.key_len) 10693 return -EINVAL; 10694 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 10695 key.p.key_len != WLAN_KEY_LEN_WEP40) && 10696 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 10697 key.p.key_len != WLAN_KEY_LEN_WEP104)) 10698 return -EINVAL; 10699 if (key.idx > 3) 10700 return -EINVAL; 10701 } else { 10702 key.p.key_len = 0; 10703 key.p.key = NULL; 10704 } 10705 10706 if (key.idx >= 0) { 10707 int i; 10708 bool ok = false; 10709 10710 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 10711 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 10712 ok = true; 10713 break; 10714 } 10715 } 10716 if (!ok) 10717 return -EINVAL; 10718 } 10719 10720 if (!rdev->ops->auth) 10721 return -EOPNOTSUPP; 10722 10723 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 10724 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 10725 return -EOPNOTSUPP; 10726 10727 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 10728 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ])); 10729 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10730 freq += 10731 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10732 10733 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10734 if (!chan) 10735 return -EINVAL; 10736 10737 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 10738 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 10739 10740 if (info->attrs[NL80211_ATTR_IE]) { 10741 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 10742 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 10743 } 10744 10745 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 10746 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 10747 return -EINVAL; 10748 10749 if ((auth_type == NL80211_AUTHTYPE_SAE || 10750 auth_type == NL80211_AUTHTYPE_FILS_SK || 10751 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 10752 auth_type == NL80211_AUTHTYPE_FILS_PK) && 10753 !info->attrs[NL80211_ATTR_AUTH_DATA]) 10754 return -EINVAL; 10755 10756 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 10757 if (auth_type != NL80211_AUTHTYPE_SAE && 10758 auth_type != NL80211_AUTHTYPE_FILS_SK && 10759 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 10760 auth_type != NL80211_AUTHTYPE_FILS_PK) 10761 return -EINVAL; 10762 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 10763 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 10764 } 10765 10766 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 10767 10768 /* 10769 * Since we no longer track auth state, ignore 10770 * requests to only change local state. 10771 */ 10772 if (local_state_change) 10773 return 0; 10774 10775 req.auth_type = auth_type; 10776 req.key = key.p.key; 10777 req.key_len = key.p.key_len; 10778 req.key_idx = key.idx; 10779 req.link_id = nl80211_link_id_or_invalid(info->attrs); 10780 if (req.link_id >= 0) { 10781 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 10782 return -EINVAL; 10783 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 10784 return -EINVAL; 10785 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 10786 if (!is_valid_ether_addr(req.ap_mld_addr)) 10787 return -EINVAL; 10788 } 10789 10790 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 10791 IEEE80211_BSS_TYPE_ESS, 10792 IEEE80211_PRIVACY_ANY); 10793 if (!req.bss) 10794 return -ENOENT; 10795 10796 err = cfg80211_mlme_auth(rdev, dev, &req); 10797 10798 cfg80211_put_bss(&rdev->wiphy, req.bss); 10799 10800 return err; 10801 } 10802 10803 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 10804 struct genl_info *info) 10805 { 10806 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 10807 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 10808 return -EINVAL; 10809 } 10810 10811 if (!rdev->ops->tx_control_port || 10812 !wiphy_ext_feature_isset(&rdev->wiphy, 10813 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 10814 return -EOPNOTSUPP; 10815 10816 return 0; 10817 } 10818 10819 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 10820 struct genl_info *info, 10821 struct cfg80211_crypto_settings *settings, 10822 int cipher_limit) 10823 { 10824 memset(settings, 0, sizeof(*settings)); 10825 10826 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 10827 10828 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 10829 u16 proto; 10830 10831 proto = nla_get_u16( 10832 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 10833 settings->control_port_ethertype = cpu_to_be16(proto); 10834 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 10835 proto != ETH_P_PAE) 10836 return -EINVAL; 10837 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 10838 settings->control_port_no_encrypt = true; 10839 } else 10840 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 10841 10842 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10843 int r = validate_pae_over_nl80211(rdev, info); 10844 10845 if (r < 0) 10846 return r; 10847 10848 settings->control_port_over_nl80211 = true; 10849 10850 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH]) 10851 settings->control_port_no_preauth = true; 10852 } 10853 10854 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 10855 void *data; 10856 int len, i; 10857 10858 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10859 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 10860 settings->n_ciphers_pairwise = len / sizeof(u32); 10861 10862 if (len % sizeof(u32)) 10863 return -EINVAL; 10864 10865 if (settings->n_ciphers_pairwise > cipher_limit) 10866 return -EINVAL; 10867 10868 memcpy(settings->ciphers_pairwise, data, len); 10869 10870 for (i = 0; i < settings->n_ciphers_pairwise; i++) 10871 if (!cfg80211_supported_cipher_suite( 10872 &rdev->wiphy, 10873 settings->ciphers_pairwise[i])) 10874 return -EINVAL; 10875 } 10876 10877 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 10878 settings->cipher_group = 10879 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 10880 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 10881 settings->cipher_group)) 10882 return -EINVAL; 10883 } 10884 10885 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 10886 settings->wpa_versions = 10887 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 10888 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 10889 return -EINVAL; 10890 } 10891 10892 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 10893 void *data; 10894 int len; 10895 10896 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 10897 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 10898 settings->n_akm_suites = len / sizeof(u32); 10899 10900 if (len % sizeof(u32)) 10901 return -EINVAL; 10902 10903 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites) 10904 return -EINVAL; 10905 10906 memcpy(settings->akm_suites, data, len); 10907 } 10908 10909 if (info->attrs[NL80211_ATTR_PMK]) { 10910 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 10911 return -EINVAL; 10912 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10913 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) && 10914 !wiphy_ext_feature_isset(&rdev->wiphy, 10915 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK)) 10916 return -EINVAL; 10917 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 10918 } 10919 10920 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) { 10921 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10922 NL80211_EXT_FEATURE_SAE_OFFLOAD) && 10923 !wiphy_ext_feature_isset(&rdev->wiphy, 10924 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP)) 10925 return -EINVAL; 10926 settings->sae_pwd = 10927 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10928 settings->sae_pwd_len = 10929 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]); 10930 } 10931 10932 if (info->attrs[NL80211_ATTR_SAE_PWE]) 10933 settings->sae_pwe = 10934 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]); 10935 else 10936 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED; 10937 10938 return 0; 10939 } 10940 10941 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev, 10942 const u8 *ssid, int ssid_len, 10943 struct nlattr **attrs, 10944 int assoc_link_id, int link_id) 10945 { 10946 struct ieee80211_channel *chan; 10947 struct cfg80211_bss *bss; 10948 const u8 *bssid; 10949 u32 freq, use_for = 0; 10950 10951 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ]) 10952 return ERR_PTR(-EINVAL); 10953 10954 bssid = nla_data(attrs[NL80211_ATTR_MAC]); 10955 10956 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ])); 10957 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 10958 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 10959 10960 chan = nl80211_get_valid_chan(&rdev->wiphy, freq); 10961 if (!chan) 10962 return ERR_PTR(-EINVAL); 10963 10964 if (assoc_link_id >= 0) 10965 use_for = NL80211_BSS_USE_FOR_MLD_LINK; 10966 if (assoc_link_id == link_id) 10967 use_for |= NL80211_BSS_USE_FOR_NORMAL; 10968 10969 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid, 10970 ssid, ssid_len, 10971 IEEE80211_BSS_TYPE_ESS, 10972 IEEE80211_PRIVACY_ANY, 10973 use_for); 10974 if (!bss) 10975 return ERR_PTR(-ENOENT); 10976 10977 return bss; 10978 } 10979 10980 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 10981 { 10982 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10983 struct net_device *dev = info->user_ptr[1]; 10984 struct cfg80211_assoc_request req = {}; 10985 struct nlattr **attrs = NULL; 10986 const u8 *ap_addr, *ssid; 10987 unsigned int link_id; 10988 int err, ssid_len; 10989 10990 if (dev->ieee80211_ptr->conn_owner_nlportid && 10991 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 10992 return -EPERM; 10993 10994 if (!info->attrs[NL80211_ATTR_SSID]) 10995 return -EINVAL; 10996 10997 if (!rdev->ops->assoc) 10998 return -EOPNOTSUPP; 10999 11000 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11001 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11002 return -EOPNOTSUPP; 11003 11004 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11005 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11006 11007 if (info->attrs[NL80211_ATTR_IE]) { 11008 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11009 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11010 11011 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 11012 req.ie, req.ie_len)) { 11013 NL_SET_ERR_MSG_ATTR(info->extack, 11014 info->attrs[NL80211_ATTR_IE], 11015 "non-inheritance makes no sense"); 11016 return -EINVAL; 11017 } 11018 } 11019 11020 if (info->attrs[NL80211_ATTR_USE_MFP]) { 11021 enum nl80211_mfp mfp = 11022 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 11023 if (mfp == NL80211_MFP_REQUIRED) 11024 req.use_mfp = true; 11025 else if (mfp != NL80211_MFP_NO) 11026 return -EINVAL; 11027 } 11028 11029 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 11030 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 11031 11032 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 11033 req.flags |= ASSOC_REQ_DISABLE_HT; 11034 11035 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11036 memcpy(&req.ht_capa_mask, 11037 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11038 sizeof(req.ht_capa_mask)); 11039 11040 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11041 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11042 return -EINVAL; 11043 memcpy(&req.ht_capa, 11044 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11045 sizeof(req.ht_capa)); 11046 } 11047 11048 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 11049 req.flags |= ASSOC_REQ_DISABLE_VHT; 11050 11051 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 11052 req.flags |= ASSOC_REQ_DISABLE_HE; 11053 11054 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 11055 req.flags |= ASSOC_REQ_DISABLE_EHT; 11056 11057 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11058 memcpy(&req.vht_capa_mask, 11059 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 11060 sizeof(req.vht_capa_mask)); 11061 11062 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 11063 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11064 return -EINVAL; 11065 memcpy(&req.vht_capa, 11066 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 11067 sizeof(req.vht_capa)); 11068 } 11069 11070 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 11071 if (!((rdev->wiphy.features & 11072 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 11073 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 11074 !wiphy_ext_feature_isset(&rdev->wiphy, 11075 NL80211_EXT_FEATURE_RRM)) 11076 return -EINVAL; 11077 req.flags |= ASSOC_REQ_USE_RRM; 11078 } 11079 11080 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 11081 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 11082 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 11083 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 11084 return -EINVAL; 11085 req.fils_nonces = 11086 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 11087 } 11088 11089 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) { 11090 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY]) 11091 return -EINVAL; 11092 memcpy(&req.s1g_capa_mask, 11093 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]), 11094 sizeof(req.s1g_capa_mask)); 11095 } 11096 11097 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) { 11098 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) 11099 return -EINVAL; 11100 memcpy(&req.s1g_capa, 11101 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]), 11102 sizeof(req.s1g_capa)); 11103 } 11104 11105 req.link_id = nl80211_link_id_or_invalid(info->attrs); 11106 11107 if (info->attrs[NL80211_ATTR_MLO_LINKS]) { 11108 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs); 11109 struct nlattr *link; 11110 int rem = 0; 11111 11112 if (req.link_id < 0) 11113 return -EINVAL; 11114 11115 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)) 11116 return -EINVAL; 11117 11118 if (info->attrs[NL80211_ATTR_MAC] || 11119 info->attrs[NL80211_ATTR_WIPHY_FREQ] || 11120 !info->attrs[NL80211_ATTR_MLD_ADDR]) 11121 return -EINVAL; 11122 11123 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 11124 ap_addr = req.ap_mld_addr; 11125 11126 attrs = kzalloc(attrsize, GFP_KERNEL); 11127 if (!attrs) 11128 return -ENOMEM; 11129 11130 nla_for_each_nested(link, 11131 info->attrs[NL80211_ATTR_MLO_LINKS], 11132 rem) { 11133 memset(attrs, 0, attrsize); 11134 11135 nla_parse_nested(attrs, NL80211_ATTR_MAX, 11136 link, NULL, NULL); 11137 11138 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) { 11139 err = -EINVAL; 11140 NL_SET_BAD_ATTR(info->extack, link); 11141 goto free; 11142 } 11143 11144 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]); 11145 /* cannot use the same link ID again */ 11146 if (req.links[link_id].bss) { 11147 err = -EINVAL; 11148 NL_SET_BAD_ATTR(info->extack, link); 11149 goto free; 11150 } 11151 req.links[link_id].bss = 11152 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs, 11153 req.link_id, link_id); 11154 if (IS_ERR(req.links[link_id].bss)) { 11155 err = PTR_ERR(req.links[link_id].bss); 11156 req.links[link_id].bss = NULL; 11157 NL_SET_ERR_MSG_ATTR(info->extack, 11158 link, "Error fetching BSS for link"); 11159 goto free; 11160 } 11161 11162 if (attrs[NL80211_ATTR_IE]) { 11163 req.links[link_id].elems = 11164 nla_data(attrs[NL80211_ATTR_IE]); 11165 req.links[link_id].elems_len = 11166 nla_len(attrs[NL80211_ATTR_IE]); 11167 11168 if (cfg80211_find_elem(WLAN_EID_FRAGMENT, 11169 req.links[link_id].elems, 11170 req.links[link_id].elems_len)) { 11171 NL_SET_ERR_MSG_ATTR(info->extack, 11172 attrs[NL80211_ATTR_IE], 11173 "cannot deal with fragmentation"); 11174 err = -EINVAL; 11175 goto free; 11176 } 11177 11178 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 11179 req.links[link_id].elems, 11180 req.links[link_id].elems_len)) { 11181 NL_SET_ERR_MSG_ATTR(info->extack, 11182 attrs[NL80211_ATTR_IE], 11183 "cannot deal with non-inheritance"); 11184 err = -EINVAL; 11185 goto free; 11186 } 11187 } 11188 11189 req.links[link_id].disabled = 11190 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]); 11191 } 11192 11193 if (!req.links[req.link_id].bss) { 11194 err = -EINVAL; 11195 goto free; 11196 } 11197 11198 if (req.links[req.link_id].elems_len) { 11199 GENL_SET_ERR_MSG(info, 11200 "cannot have per-link elems on assoc link"); 11201 err = -EINVAL; 11202 goto free; 11203 } 11204 11205 if (req.links[req.link_id].disabled) { 11206 GENL_SET_ERR_MSG(info, 11207 "cannot have assoc link disabled"); 11208 err = -EINVAL; 11209 goto free; 11210 } 11211 11212 kfree(attrs); 11213 attrs = NULL; 11214 } else { 11215 if (req.link_id >= 0) 11216 return -EINVAL; 11217 11218 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs, 11219 -1, -1); 11220 if (IS_ERR(req.bss)) 11221 return PTR_ERR(req.bss); 11222 ap_addr = req.bss->bssid; 11223 } 11224 11225 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 11226 if (!err) { 11227 struct nlattr *link; 11228 int rem = 0; 11229 11230 err = cfg80211_mlme_assoc(rdev, dev, &req); 11231 11232 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 11233 dev->ieee80211_ptr->conn_owner_nlportid = 11234 info->snd_portid; 11235 memcpy(dev->ieee80211_ptr->disconnect_bssid, 11236 ap_addr, ETH_ALEN); 11237 } 11238 11239 /* Report error from first problematic link */ 11240 if (info->attrs[NL80211_ATTR_MLO_LINKS]) { 11241 nla_for_each_nested(link, 11242 info->attrs[NL80211_ATTR_MLO_LINKS], 11243 rem) { 11244 struct nlattr *link_id_attr = 11245 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID); 11246 11247 if (!link_id_attr) 11248 continue; 11249 11250 link_id = nla_get_u8(link_id_attr); 11251 11252 if (link_id == req.link_id) 11253 continue; 11254 11255 if (!req.links[link_id].error || 11256 WARN_ON(req.links[link_id].error > 0)) 11257 continue; 11258 11259 WARN_ON(err >= 0); 11260 11261 NL_SET_BAD_ATTR(info->extack, link); 11262 err = req.links[link_id].error; 11263 break; 11264 } 11265 } 11266 } 11267 11268 free: 11269 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++) 11270 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss); 11271 cfg80211_put_bss(&rdev->wiphy, req.bss); 11272 kfree(attrs); 11273 11274 return err; 11275 } 11276 11277 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 11278 { 11279 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11280 struct net_device *dev = info->user_ptr[1]; 11281 const u8 *ie = NULL, *bssid; 11282 int ie_len = 0; 11283 u16 reason_code; 11284 bool local_state_change; 11285 11286 if (dev->ieee80211_ptr->conn_owner_nlportid && 11287 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11288 return -EPERM; 11289 11290 if (!info->attrs[NL80211_ATTR_MAC]) 11291 return -EINVAL; 11292 11293 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11294 return -EINVAL; 11295 11296 if (!rdev->ops->deauth) 11297 return -EOPNOTSUPP; 11298 11299 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11300 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11301 return -EOPNOTSUPP; 11302 11303 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11304 11305 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11306 if (reason_code == 0) { 11307 /* Reason Code 0 is reserved */ 11308 return -EINVAL; 11309 } 11310 11311 if (info->attrs[NL80211_ATTR_IE]) { 11312 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11313 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11314 } 11315 11316 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11317 11318 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 11319 local_state_change); 11320 } 11321 11322 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 11323 { 11324 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11325 struct net_device *dev = info->user_ptr[1]; 11326 const u8 *ie = NULL, *bssid; 11327 int ie_len = 0; 11328 u16 reason_code; 11329 bool local_state_change; 11330 11331 if (dev->ieee80211_ptr->conn_owner_nlportid && 11332 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 11333 return -EPERM; 11334 11335 if (!info->attrs[NL80211_ATTR_MAC]) 11336 return -EINVAL; 11337 11338 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 11339 return -EINVAL; 11340 11341 if (!rdev->ops->disassoc) 11342 return -EOPNOTSUPP; 11343 11344 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11345 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11346 return -EOPNOTSUPP; 11347 11348 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11349 11350 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 11351 if (reason_code == 0) { 11352 /* Reason Code 0 is reserved */ 11353 return -EINVAL; 11354 } 11355 11356 if (info->attrs[NL80211_ATTR_IE]) { 11357 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11358 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11359 } 11360 11361 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 11362 11363 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 11364 local_state_change); 11365 } 11366 11367 static bool 11368 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 11369 int mcast_rate[NUM_NL80211_BANDS], 11370 int rateval) 11371 { 11372 struct wiphy *wiphy = &rdev->wiphy; 11373 bool found = false; 11374 int band, i; 11375 11376 for (band = 0; band < NUM_NL80211_BANDS; band++) { 11377 struct ieee80211_supported_band *sband; 11378 11379 sband = wiphy->bands[band]; 11380 if (!sband) 11381 continue; 11382 11383 for (i = 0; i < sband->n_bitrates; i++) { 11384 if (sband->bitrates[i].bitrate == rateval) { 11385 mcast_rate[band] = i + 1; 11386 found = true; 11387 break; 11388 } 11389 } 11390 } 11391 11392 return found; 11393 } 11394 11395 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 11396 { 11397 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11398 struct net_device *dev = info->user_ptr[1]; 11399 struct cfg80211_ibss_params ibss; 11400 struct wiphy *wiphy; 11401 struct cfg80211_cached_keys *connkeys = NULL; 11402 int err; 11403 11404 memset(&ibss, 0, sizeof(ibss)); 11405 11406 if (!info->attrs[NL80211_ATTR_SSID] || 11407 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11408 return -EINVAL; 11409 11410 ibss.beacon_interval = 100; 11411 11412 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 11413 ibss.beacon_interval = 11414 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 11415 11416 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 11417 ibss.beacon_interval); 11418 if (err) 11419 return err; 11420 11421 if (!rdev->ops->join_ibss) 11422 return -EOPNOTSUPP; 11423 11424 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11425 return -EOPNOTSUPP; 11426 11427 wiphy = &rdev->wiphy; 11428 11429 if (info->attrs[NL80211_ATTR_MAC]) { 11430 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11431 11432 if (!is_valid_ether_addr(ibss.bssid)) 11433 return -EINVAL; 11434 } 11435 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11436 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11437 11438 if (info->attrs[NL80211_ATTR_IE]) { 11439 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11440 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11441 } 11442 11443 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 11444 if (err) 11445 return err; 11446 11447 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 11448 NL80211_IFTYPE_ADHOC)) 11449 return -EINVAL; 11450 11451 switch (ibss.chandef.width) { 11452 case NL80211_CHAN_WIDTH_5: 11453 case NL80211_CHAN_WIDTH_10: 11454 case NL80211_CHAN_WIDTH_20_NOHT: 11455 break; 11456 case NL80211_CHAN_WIDTH_20: 11457 case NL80211_CHAN_WIDTH_40: 11458 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11459 return -EINVAL; 11460 break; 11461 case NL80211_CHAN_WIDTH_80: 11462 case NL80211_CHAN_WIDTH_80P80: 11463 case NL80211_CHAN_WIDTH_160: 11464 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 11465 return -EINVAL; 11466 if (!wiphy_ext_feature_isset(&rdev->wiphy, 11467 NL80211_EXT_FEATURE_VHT_IBSS)) 11468 return -EINVAL; 11469 break; 11470 case NL80211_CHAN_WIDTH_320: 11471 return -EINVAL; 11472 default: 11473 return -EINVAL; 11474 } 11475 11476 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 11477 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 11478 11479 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 11480 u8 *rates = 11481 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11482 int n_rates = 11483 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 11484 struct ieee80211_supported_band *sband = 11485 wiphy->bands[ibss.chandef.chan->band]; 11486 11487 err = ieee80211_get_ratemask(sband, rates, n_rates, 11488 &ibss.basic_rates); 11489 if (err) 11490 return err; 11491 } 11492 11493 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11494 memcpy(&ibss.ht_capa_mask, 11495 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11496 sizeof(ibss.ht_capa_mask)); 11497 11498 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11499 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11500 return -EINVAL; 11501 memcpy(&ibss.ht_capa, 11502 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11503 sizeof(ibss.ht_capa)); 11504 } 11505 11506 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 11507 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 11508 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 11509 return -EINVAL; 11510 11511 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11512 bool no_ht = false; 11513 11514 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 11515 if (IS_ERR(connkeys)) 11516 return PTR_ERR(connkeys); 11517 11518 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 11519 no_ht) { 11520 kfree_sensitive(connkeys); 11521 return -EINVAL; 11522 } 11523 } 11524 11525 ibss.control_port = 11526 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 11527 11528 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 11529 int r = validate_pae_over_nl80211(rdev, info); 11530 11531 if (r < 0) { 11532 kfree_sensitive(connkeys); 11533 return r; 11534 } 11535 11536 ibss.control_port_over_nl80211 = true; 11537 } 11538 11539 ibss.userspace_handles_dfs = 11540 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 11541 11542 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 11543 if (err) 11544 kfree_sensitive(connkeys); 11545 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 11546 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 11547 11548 return err; 11549 } 11550 11551 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 11552 { 11553 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11554 struct net_device *dev = info->user_ptr[1]; 11555 11556 if (!rdev->ops->leave_ibss) 11557 return -EOPNOTSUPP; 11558 11559 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 11560 return -EOPNOTSUPP; 11561 11562 return cfg80211_leave_ibss(rdev, dev, false); 11563 } 11564 11565 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 11566 { 11567 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11568 struct net_device *dev = info->user_ptr[1]; 11569 int mcast_rate[NUM_NL80211_BANDS]; 11570 u32 nla_rate; 11571 11572 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 11573 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 11574 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 11575 return -EOPNOTSUPP; 11576 11577 if (!rdev->ops->set_mcast_rate) 11578 return -EOPNOTSUPP; 11579 11580 memset(mcast_rate, 0, sizeof(mcast_rate)); 11581 11582 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 11583 return -EINVAL; 11584 11585 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 11586 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 11587 return -EINVAL; 11588 11589 return rdev_set_mcast_rate(rdev, dev, mcast_rate); 11590 } 11591 11592 static struct sk_buff * 11593 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 11594 struct wireless_dev *wdev, int approxlen, 11595 u32 portid, u32 seq, enum nl80211_commands cmd, 11596 enum nl80211_attrs attr, 11597 const struct nl80211_vendor_cmd_info *info, 11598 gfp_t gfp) 11599 { 11600 struct sk_buff *skb; 11601 void *hdr; 11602 struct nlattr *data; 11603 11604 skb = nlmsg_new(approxlen + 100, gfp); 11605 if (!skb) 11606 return NULL; 11607 11608 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 11609 if (!hdr) { 11610 kfree_skb(skb); 11611 return NULL; 11612 } 11613 11614 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 11615 goto nla_put_failure; 11616 11617 if (info) { 11618 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 11619 info->vendor_id)) 11620 goto nla_put_failure; 11621 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 11622 info->subcmd)) 11623 goto nla_put_failure; 11624 } 11625 11626 if (wdev) { 11627 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 11628 wdev_id(wdev), NL80211_ATTR_PAD)) 11629 goto nla_put_failure; 11630 if (wdev->netdev && 11631 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 11632 wdev->netdev->ifindex)) 11633 goto nla_put_failure; 11634 } 11635 11636 data = nla_nest_start_noflag(skb, attr); 11637 if (!data) 11638 goto nla_put_failure; 11639 11640 ((void **)skb->cb)[0] = rdev; 11641 ((void **)skb->cb)[1] = hdr; 11642 ((void **)skb->cb)[2] = data; 11643 11644 return skb; 11645 11646 nla_put_failure: 11647 kfree_skb(skb); 11648 return NULL; 11649 } 11650 11651 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 11652 struct wireless_dev *wdev, 11653 enum nl80211_commands cmd, 11654 enum nl80211_attrs attr, 11655 unsigned int portid, 11656 int vendor_event_idx, 11657 int approxlen, gfp_t gfp) 11658 { 11659 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11660 const struct nl80211_vendor_cmd_info *info; 11661 11662 switch (cmd) { 11663 case NL80211_CMD_TESTMODE: 11664 if (WARN_ON(vendor_event_idx != -1)) 11665 return NULL; 11666 info = NULL; 11667 break; 11668 case NL80211_CMD_VENDOR: 11669 if (WARN_ON(vendor_event_idx < 0 || 11670 vendor_event_idx >= wiphy->n_vendor_events)) 11671 return NULL; 11672 info = &wiphy->vendor_events[vendor_event_idx]; 11673 break; 11674 default: 11675 WARN_ON(1); 11676 return NULL; 11677 } 11678 11679 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0, 11680 cmd, attr, info, gfp); 11681 } 11682 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 11683 11684 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 11685 { 11686 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 11687 void *hdr = ((void **)skb->cb)[1]; 11688 struct nlmsghdr *nlhdr = nlmsg_hdr(skb); 11689 struct nlattr *data = ((void **)skb->cb)[2]; 11690 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 11691 11692 /* clear CB data for netlink core to own from now on */ 11693 memset(skb->cb, 0, sizeof(skb->cb)); 11694 11695 nla_nest_end(skb, data); 11696 genlmsg_end(skb, hdr); 11697 11698 if (nlhdr->nlmsg_pid) { 11699 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb, 11700 nlhdr->nlmsg_pid); 11701 } else { 11702 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 11703 mcgrp = NL80211_MCGRP_VENDOR; 11704 11705 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11706 skb, 0, mcgrp, gfp); 11707 } 11708 } 11709 EXPORT_SYMBOL(__cfg80211_send_event_skb); 11710 11711 #ifdef CONFIG_NL80211_TESTMODE 11712 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 11713 { 11714 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11715 struct wireless_dev *wdev; 11716 int err; 11717 11718 lockdep_assert_held(&rdev->wiphy.mtx); 11719 11720 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 11721 info->attrs); 11722 11723 if (!rdev->ops->testmode_cmd) 11724 return -EOPNOTSUPP; 11725 11726 if (IS_ERR(wdev)) { 11727 err = PTR_ERR(wdev); 11728 if (err != -EINVAL) 11729 return err; 11730 wdev = NULL; 11731 } else if (wdev->wiphy != &rdev->wiphy) { 11732 return -EINVAL; 11733 } 11734 11735 if (!info->attrs[NL80211_ATTR_TESTDATA]) 11736 return -EINVAL; 11737 11738 rdev->cur_cmd_info = info; 11739 err = rdev_testmode_cmd(rdev, wdev, 11740 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 11741 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 11742 rdev->cur_cmd_info = NULL; 11743 11744 return err; 11745 } 11746 11747 static int nl80211_testmode_dump(struct sk_buff *skb, 11748 struct netlink_callback *cb) 11749 { 11750 struct cfg80211_registered_device *rdev; 11751 struct nlattr **attrbuf = NULL; 11752 int err; 11753 long phy_idx; 11754 void *data = NULL; 11755 int data_len = 0; 11756 11757 rtnl_lock(); 11758 11759 if (cb->args[0]) { 11760 /* 11761 * 0 is a valid index, but not valid for args[0], 11762 * so we need to offset by 1. 11763 */ 11764 phy_idx = cb->args[0] - 1; 11765 11766 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 11767 if (!rdev) { 11768 err = -ENOENT; 11769 goto out_err; 11770 } 11771 } else { 11772 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), 11773 GFP_KERNEL); 11774 if (!attrbuf) { 11775 err = -ENOMEM; 11776 goto out_err; 11777 } 11778 11779 err = nlmsg_parse_deprecated(cb->nlh, 11780 GENL_HDRLEN + nl80211_fam.hdrsize, 11781 attrbuf, nl80211_fam.maxattr, 11782 nl80211_policy, NULL); 11783 if (err) 11784 goto out_err; 11785 11786 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11787 if (IS_ERR(rdev)) { 11788 err = PTR_ERR(rdev); 11789 goto out_err; 11790 } 11791 phy_idx = rdev->wiphy_idx; 11792 11793 if (attrbuf[NL80211_ATTR_TESTDATA]) 11794 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 11795 } 11796 11797 if (cb->args[1]) { 11798 data = nla_data((void *)cb->args[1]); 11799 data_len = nla_len((void *)cb->args[1]); 11800 } 11801 11802 if (!rdev->ops->testmode_dump) { 11803 err = -EOPNOTSUPP; 11804 goto out_err; 11805 } 11806 11807 while (1) { 11808 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 11809 cb->nlh->nlmsg_seq, NLM_F_MULTI, 11810 NL80211_CMD_TESTMODE); 11811 struct nlattr *tmdata; 11812 11813 if (!hdr) 11814 break; 11815 11816 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 11817 genlmsg_cancel(skb, hdr); 11818 break; 11819 } 11820 11821 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA); 11822 if (!tmdata) { 11823 genlmsg_cancel(skb, hdr); 11824 break; 11825 } 11826 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 11827 nla_nest_end(skb, tmdata); 11828 11829 if (err == -ENOBUFS || err == -ENOENT) { 11830 genlmsg_cancel(skb, hdr); 11831 break; 11832 } else if (err) { 11833 genlmsg_cancel(skb, hdr); 11834 goto out_err; 11835 } 11836 11837 genlmsg_end(skb, hdr); 11838 } 11839 11840 err = skb->len; 11841 /* see above */ 11842 cb->args[0] = phy_idx + 1; 11843 out_err: 11844 kfree(attrbuf); 11845 rtnl_unlock(); 11846 return err; 11847 } 11848 #endif 11849 11850 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 11851 { 11852 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11853 struct net_device *dev = info->user_ptr[1]; 11854 struct cfg80211_connect_params connect; 11855 struct wiphy *wiphy; 11856 struct cfg80211_cached_keys *connkeys = NULL; 11857 u32 freq = 0; 11858 int err; 11859 11860 memset(&connect, 0, sizeof(connect)); 11861 11862 if (!info->attrs[NL80211_ATTR_SSID] || 11863 !nla_len(info->attrs[NL80211_ATTR_SSID])) 11864 return -EINVAL; 11865 11866 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 11867 connect.auth_type = 11868 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 11869 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 11870 NL80211_CMD_CONNECT)) 11871 return -EINVAL; 11872 } else 11873 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 11874 11875 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 11876 11877 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 11878 !wiphy_ext_feature_isset(&rdev->wiphy, 11879 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 11880 return -EINVAL; 11881 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 11882 11883 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 11884 NL80211_MAX_NR_CIPHER_SUITES); 11885 if (err) 11886 return err; 11887 11888 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 11889 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 11890 return -EOPNOTSUPP; 11891 11892 wiphy = &rdev->wiphy; 11893 11894 connect.bg_scan_period = -1; 11895 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 11896 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 11897 connect.bg_scan_period = 11898 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 11899 } 11900 11901 if (info->attrs[NL80211_ATTR_MAC]) 11902 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 11903 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 11904 connect.bssid_hint = 11905 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 11906 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 11907 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 11908 11909 if (info->attrs[NL80211_ATTR_IE]) { 11910 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11911 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11912 } 11913 11914 if (info->attrs[NL80211_ATTR_USE_MFP]) { 11915 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 11916 if (connect.mfp == NL80211_MFP_OPTIONAL && 11917 !wiphy_ext_feature_isset(&rdev->wiphy, 11918 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 11919 return -EOPNOTSUPP; 11920 } else { 11921 connect.mfp = NL80211_MFP_NO; 11922 } 11923 11924 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 11925 connect.prev_bssid = 11926 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 11927 11928 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) 11929 freq = MHZ_TO_KHZ(nla_get_u32( 11930 info->attrs[NL80211_ATTR_WIPHY_FREQ])); 11931 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]) 11932 freq += 11933 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]); 11934 11935 if (freq) { 11936 connect.channel = nl80211_get_valid_chan(wiphy, freq); 11937 if (!connect.channel) 11938 return -EINVAL; 11939 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 11940 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 11941 freq = MHZ_TO_KHZ(freq); 11942 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq); 11943 if (!connect.channel_hint) 11944 return -EINVAL; 11945 } 11946 11947 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) { 11948 connect.edmg.channels = 11949 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]); 11950 11951 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]) 11952 connect.edmg.bw_config = 11953 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]); 11954 } 11955 11956 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 11957 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 11958 if (IS_ERR(connkeys)) 11959 return PTR_ERR(connkeys); 11960 } 11961 11962 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 11963 connect.flags |= ASSOC_REQ_DISABLE_HT; 11964 11965 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 11966 memcpy(&connect.ht_capa_mask, 11967 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 11968 sizeof(connect.ht_capa_mask)); 11969 11970 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 11971 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 11972 kfree_sensitive(connkeys); 11973 return -EINVAL; 11974 } 11975 memcpy(&connect.ht_capa, 11976 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 11977 sizeof(connect.ht_capa)); 11978 } 11979 11980 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 11981 connect.flags |= ASSOC_REQ_DISABLE_VHT; 11982 11983 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE])) 11984 connect.flags |= ASSOC_REQ_DISABLE_HE; 11985 11986 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT])) 11987 connect.flags |= ASSOC_REQ_DISABLE_EHT; 11988 11989 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 11990 memcpy(&connect.vht_capa_mask, 11991 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 11992 sizeof(connect.vht_capa_mask)); 11993 11994 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 11995 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 11996 kfree_sensitive(connkeys); 11997 return -EINVAL; 11998 } 11999 memcpy(&connect.vht_capa, 12000 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 12001 sizeof(connect.vht_capa)); 12002 } 12003 12004 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 12005 if (!((rdev->wiphy.features & 12006 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 12007 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 12008 !wiphy_ext_feature_isset(&rdev->wiphy, 12009 NL80211_EXT_FEATURE_RRM)) { 12010 kfree_sensitive(connkeys); 12011 return -EINVAL; 12012 } 12013 connect.flags |= ASSOC_REQ_USE_RRM; 12014 } 12015 12016 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 12017 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 12018 kfree_sensitive(connkeys); 12019 return -EOPNOTSUPP; 12020 } 12021 12022 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 12023 /* bss selection makes no sense if bssid is set */ 12024 if (connect.bssid) { 12025 kfree_sensitive(connkeys); 12026 return -EINVAL; 12027 } 12028 12029 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 12030 wiphy, &connect.bss_select); 12031 if (err) { 12032 kfree_sensitive(connkeys); 12033 return err; 12034 } 12035 } 12036 12037 if (wiphy_ext_feature_isset(&rdev->wiphy, 12038 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 12039 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 12040 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 12041 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 12042 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12043 connect.fils_erp_username = 12044 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12045 connect.fils_erp_username_len = 12046 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12047 connect.fils_erp_realm = 12048 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12049 connect.fils_erp_realm_len = 12050 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12051 connect.fils_erp_next_seq_num = 12052 nla_get_u16( 12053 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 12054 connect.fils_erp_rrk = 12055 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12056 connect.fils_erp_rrk_len = 12057 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12058 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 12059 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 12060 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 12061 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12062 kfree_sensitive(connkeys); 12063 return -EINVAL; 12064 } 12065 12066 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 12067 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 12068 kfree_sensitive(connkeys); 12069 GENL_SET_ERR_MSG(info, 12070 "external auth requires connection ownership"); 12071 return -EINVAL; 12072 } 12073 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 12074 } 12075 12076 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT])) 12077 connect.flags |= CONNECT_REQ_MLO_SUPPORT; 12078 12079 err = cfg80211_connect(rdev, dev, &connect, connkeys, 12080 connect.prev_bssid); 12081 if (err) 12082 kfree_sensitive(connkeys); 12083 12084 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 12085 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 12086 if (connect.bssid) 12087 memcpy(dev->ieee80211_ptr->disconnect_bssid, 12088 connect.bssid, ETH_ALEN); 12089 else 12090 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid); 12091 } 12092 12093 return err; 12094 } 12095 12096 static int nl80211_update_connect_params(struct sk_buff *skb, 12097 struct genl_info *info) 12098 { 12099 struct cfg80211_connect_params connect = {}; 12100 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12101 struct net_device *dev = info->user_ptr[1]; 12102 struct wireless_dev *wdev = dev->ieee80211_ptr; 12103 bool fils_sk_offload; 12104 u32 auth_type; 12105 u32 changed = 0; 12106 12107 if (!rdev->ops->update_connect_params) 12108 return -EOPNOTSUPP; 12109 12110 if (info->attrs[NL80211_ATTR_IE]) { 12111 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 12112 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 12113 changed |= UPDATE_ASSOC_IES; 12114 } 12115 12116 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 12117 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 12118 12119 /* 12120 * when driver supports fils-sk offload all attributes must be 12121 * provided. So the else covers "fils-sk-not-all" and 12122 * "no-fils-sk-any". 12123 */ 12124 if (fils_sk_offload && 12125 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 12126 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 12127 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 12128 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12129 connect.fils_erp_username = 12130 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12131 connect.fils_erp_username_len = 12132 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 12133 connect.fils_erp_realm = 12134 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12135 connect.fils_erp_realm_len = 12136 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 12137 connect.fils_erp_next_seq_num = 12138 nla_get_u16( 12139 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 12140 connect.fils_erp_rrk = 12141 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12142 connect.fils_erp_rrk_len = 12143 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 12144 changed |= UPDATE_FILS_ERP_INFO; 12145 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 12146 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 12147 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 12148 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 12149 return -EINVAL; 12150 } 12151 12152 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 12153 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 12154 if (!nl80211_valid_auth_type(rdev, auth_type, 12155 NL80211_CMD_CONNECT)) 12156 return -EINVAL; 12157 12158 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 12159 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 12160 return -EINVAL; 12161 12162 connect.auth_type = auth_type; 12163 changed |= UPDATE_AUTH_TYPE; 12164 } 12165 12166 if (!wdev->connected) 12167 return -ENOLINK; 12168 12169 return rdev_update_connect_params(rdev, dev, &connect, changed); 12170 } 12171 12172 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 12173 { 12174 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12175 struct net_device *dev = info->user_ptr[1]; 12176 u16 reason; 12177 12178 if (dev->ieee80211_ptr->conn_owner_nlportid && 12179 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 12180 return -EPERM; 12181 12182 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 12183 reason = WLAN_REASON_DEAUTH_LEAVING; 12184 else 12185 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 12186 12187 if (reason == 0) 12188 return -EINVAL; 12189 12190 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12191 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12192 return -EOPNOTSUPP; 12193 12194 return cfg80211_disconnect(rdev, dev, reason, true); 12195 } 12196 12197 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 12198 { 12199 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12200 struct net *net; 12201 int err; 12202 12203 if (info->attrs[NL80211_ATTR_PID]) { 12204 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 12205 12206 net = get_net_ns_by_pid(pid); 12207 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 12208 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 12209 12210 net = get_net_ns_by_fd(fd); 12211 } else { 12212 return -EINVAL; 12213 } 12214 12215 if (IS_ERR(net)) 12216 return PTR_ERR(net); 12217 12218 err = 0; 12219 12220 /* check if anything to do */ 12221 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 12222 err = cfg80211_switch_netns(rdev, net); 12223 12224 put_net(net); 12225 return err; 12226 } 12227 12228 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info) 12229 { 12230 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12231 struct net_device *dev = info->user_ptr[1]; 12232 struct cfg80211_pmksa pmksa; 12233 bool ap_pmksa_caching_support = false; 12234 12235 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 12236 12237 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy, 12238 NL80211_EXT_FEATURE_AP_PMKSA_CACHING); 12239 12240 if (!info->attrs[NL80211_ATTR_PMKID]) 12241 return -EINVAL; 12242 12243 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 12244 12245 if (info->attrs[NL80211_ATTR_MAC]) { 12246 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 12247 } else if (info->attrs[NL80211_ATTR_SSID] && 12248 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 12249 info->attrs[NL80211_ATTR_PMK]) { 12250 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 12251 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12252 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 12253 } else { 12254 return -EINVAL; 12255 } 12256 12257 if (info->attrs[NL80211_ATTR_PMK]) { 12258 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12259 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12260 } 12261 12262 if (info->attrs[NL80211_ATTR_PMK_LIFETIME]) 12263 pmksa.pmk_lifetime = 12264 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]); 12265 12266 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]) 12267 pmksa.pmk_reauth_threshold = 12268 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]); 12269 12270 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12271 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 12272 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP || 12273 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) && 12274 ap_pmksa_caching_support)) 12275 return -EOPNOTSUPP; 12276 12277 if (!rdev->ops->set_pmksa) 12278 return -EOPNOTSUPP; 12279 12280 return rdev_set_pmksa(rdev, dev, &pmksa); 12281 } 12282 12283 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info) 12284 { 12285 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12286 struct net_device *dev = info->user_ptr[1]; 12287 struct cfg80211_pmksa pmksa; 12288 bool sae_offload_support = false; 12289 bool owe_offload_support = false; 12290 bool ap_pmksa_caching_support = false; 12291 12292 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 12293 12294 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy, 12295 NL80211_EXT_FEATURE_SAE_OFFLOAD); 12296 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy, 12297 NL80211_EXT_FEATURE_OWE_OFFLOAD); 12298 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy, 12299 NL80211_EXT_FEATURE_AP_PMKSA_CACHING); 12300 12301 if (info->attrs[NL80211_ATTR_PMKID]) 12302 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 12303 12304 if (info->attrs[NL80211_ATTR_MAC]) { 12305 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 12306 } else if (info->attrs[NL80211_ATTR_SSID]) { 12307 /* SSID based pmksa flush suppported only for FILS, 12308 * OWE/SAE OFFLOAD cases 12309 */ 12310 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 12311 info->attrs[NL80211_ATTR_PMK]) { 12312 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 12313 } else if (!sae_offload_support && !owe_offload_support) { 12314 return -EINVAL; 12315 } 12316 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 12317 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12318 } else { 12319 return -EINVAL; 12320 } 12321 12322 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12323 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT && 12324 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP || 12325 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) && 12326 ap_pmksa_caching_support)) 12327 return -EOPNOTSUPP; 12328 12329 if (!rdev->ops->del_pmksa) 12330 return -EOPNOTSUPP; 12331 12332 return rdev_del_pmksa(rdev, dev, &pmksa); 12333 } 12334 12335 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 12336 { 12337 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12338 struct net_device *dev = info->user_ptr[1]; 12339 12340 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 12341 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 12342 return -EOPNOTSUPP; 12343 12344 if (!rdev->ops->flush_pmksa) 12345 return -EOPNOTSUPP; 12346 12347 return rdev_flush_pmksa(rdev, dev); 12348 } 12349 12350 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 12351 { 12352 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12353 struct net_device *dev = info->user_ptr[1]; 12354 u8 action_code, dialog_token; 12355 u32 peer_capability = 0; 12356 u16 status_code; 12357 u8 *peer; 12358 int link_id; 12359 bool initiator; 12360 12361 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12362 !rdev->ops->tdls_mgmt) 12363 return -EOPNOTSUPP; 12364 12365 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 12366 !info->attrs[NL80211_ATTR_STATUS_CODE] || 12367 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 12368 !info->attrs[NL80211_ATTR_IE] || 12369 !info->attrs[NL80211_ATTR_MAC]) 12370 return -EINVAL; 12371 12372 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12373 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 12374 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 12375 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 12376 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 12377 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 12378 peer_capability = 12379 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 12380 link_id = nl80211_link_id_or_invalid(info->attrs); 12381 12382 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code, 12383 dialog_token, status_code, peer_capability, 12384 initiator, 12385 nla_data(info->attrs[NL80211_ATTR_IE]), 12386 nla_len(info->attrs[NL80211_ATTR_IE])); 12387 } 12388 12389 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 12390 { 12391 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12392 struct net_device *dev = info->user_ptr[1]; 12393 enum nl80211_tdls_operation operation; 12394 u8 *peer; 12395 12396 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 12397 !rdev->ops->tdls_oper) 12398 return -EOPNOTSUPP; 12399 12400 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 12401 !info->attrs[NL80211_ATTR_MAC]) 12402 return -EINVAL; 12403 12404 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 12405 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12406 12407 return rdev_tdls_oper(rdev, dev, peer, operation); 12408 } 12409 12410 static int nl80211_remain_on_channel(struct sk_buff *skb, 12411 struct genl_info *info) 12412 { 12413 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12414 unsigned int link_id = nl80211_link_id(info->attrs); 12415 struct wireless_dev *wdev = info->user_ptr[1]; 12416 struct cfg80211_chan_def chandef; 12417 struct sk_buff *msg; 12418 void *hdr; 12419 u64 cookie; 12420 u32 duration; 12421 int err; 12422 12423 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 12424 !info->attrs[NL80211_ATTR_DURATION]) 12425 return -EINVAL; 12426 12427 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12428 12429 if (!rdev->ops->remain_on_channel || 12430 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 12431 return -EOPNOTSUPP; 12432 12433 /* 12434 * We should be on that channel for at least a minimum amount of 12435 * time (10ms) but no longer than the driver supports. 12436 */ 12437 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12438 duration > rdev->wiphy.max_remain_on_channel_duration) 12439 return -EINVAL; 12440 12441 err = nl80211_parse_chandef(rdev, info, &chandef); 12442 if (err) 12443 return err; 12444 12445 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) { 12446 const struct cfg80211_chan_def *oper_chandef, *compat_chandef; 12447 12448 oper_chandef = wdev_chandef(wdev, link_id); 12449 12450 if (WARN_ON(!oper_chandef)) { 12451 /* cannot happen since we must beacon to get here */ 12452 WARN_ON(1); 12453 return -EBUSY; 12454 } 12455 12456 /* note: returns first one if identical chandefs */ 12457 compat_chandef = cfg80211_chandef_compatible(&chandef, 12458 oper_chandef); 12459 12460 if (compat_chandef != &chandef) 12461 return -EBUSY; 12462 } 12463 12464 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12465 if (!msg) 12466 return -ENOMEM; 12467 12468 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12469 NL80211_CMD_REMAIN_ON_CHANNEL); 12470 if (!hdr) { 12471 err = -ENOBUFS; 12472 goto free_msg; 12473 } 12474 12475 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 12476 duration, &cookie); 12477 12478 if (err) 12479 goto free_msg; 12480 12481 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12482 NL80211_ATTR_PAD)) 12483 goto nla_put_failure; 12484 12485 genlmsg_end(msg, hdr); 12486 12487 return genlmsg_reply(msg, info); 12488 12489 nla_put_failure: 12490 err = -ENOBUFS; 12491 free_msg: 12492 nlmsg_free(msg); 12493 return err; 12494 } 12495 12496 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 12497 struct genl_info *info) 12498 { 12499 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12500 struct wireless_dev *wdev = info->user_ptr[1]; 12501 u64 cookie; 12502 12503 if (!info->attrs[NL80211_ATTR_COOKIE]) 12504 return -EINVAL; 12505 12506 if (!rdev->ops->cancel_remain_on_channel) 12507 return -EOPNOTSUPP; 12508 12509 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12510 12511 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 12512 } 12513 12514 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 12515 struct genl_info *info) 12516 { 12517 struct cfg80211_bitrate_mask mask; 12518 unsigned int link_id = nl80211_link_id(info->attrs); 12519 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12520 struct net_device *dev = info->user_ptr[1]; 12521 int err; 12522 12523 if (!rdev->ops->set_bitrate_mask) 12524 return -EOPNOTSUPP; 12525 12526 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 12527 NL80211_ATTR_TX_RATES, &mask, 12528 dev, true, link_id); 12529 if (err) 12530 return err; 12531 12532 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask); 12533 } 12534 12535 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 12536 { 12537 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12538 struct wireless_dev *wdev = info->user_ptr[1]; 12539 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 12540 12541 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 12542 return -EINVAL; 12543 12544 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 12545 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 12546 12547 switch (wdev->iftype) { 12548 case NL80211_IFTYPE_STATION: 12549 case NL80211_IFTYPE_ADHOC: 12550 case NL80211_IFTYPE_P2P_CLIENT: 12551 case NL80211_IFTYPE_AP: 12552 case NL80211_IFTYPE_AP_VLAN: 12553 case NL80211_IFTYPE_MESH_POINT: 12554 case NL80211_IFTYPE_P2P_GO: 12555 case NL80211_IFTYPE_P2P_DEVICE: 12556 break; 12557 case NL80211_IFTYPE_NAN: 12558 if (!wiphy_ext_feature_isset(wdev->wiphy, 12559 NL80211_EXT_FEATURE_SECURE_NAN)) 12560 return -EOPNOTSUPP; 12561 break; 12562 default: 12563 return -EOPNOTSUPP; 12564 } 12565 12566 /* not much point in registering if we can't reply */ 12567 if (!rdev->ops->mgmt_tx) 12568 return -EOPNOTSUPP; 12569 12570 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] && 12571 !wiphy_ext_feature_isset(&rdev->wiphy, 12572 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) { 12573 GENL_SET_ERR_MSG(info, 12574 "multicast RX registrations are not supported"); 12575 return -EOPNOTSUPP; 12576 } 12577 12578 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 12579 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12580 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]), 12581 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST], 12582 info->extack); 12583 } 12584 12585 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 12586 { 12587 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12588 struct wireless_dev *wdev = info->user_ptr[1]; 12589 struct cfg80211_chan_def chandef; 12590 int err; 12591 void *hdr = NULL; 12592 u64 cookie; 12593 struct sk_buff *msg = NULL; 12594 struct cfg80211_mgmt_tx_params params = { 12595 .dont_wait_for_ack = 12596 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 12597 }; 12598 12599 if (!info->attrs[NL80211_ATTR_FRAME]) 12600 return -EINVAL; 12601 12602 if (!rdev->ops->mgmt_tx) 12603 return -EOPNOTSUPP; 12604 12605 switch (wdev->iftype) { 12606 case NL80211_IFTYPE_P2P_DEVICE: 12607 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 12608 return -EINVAL; 12609 break; 12610 case NL80211_IFTYPE_STATION: 12611 case NL80211_IFTYPE_ADHOC: 12612 case NL80211_IFTYPE_P2P_CLIENT: 12613 case NL80211_IFTYPE_AP: 12614 case NL80211_IFTYPE_AP_VLAN: 12615 case NL80211_IFTYPE_MESH_POINT: 12616 case NL80211_IFTYPE_P2P_GO: 12617 break; 12618 case NL80211_IFTYPE_NAN: 12619 if (!wiphy_ext_feature_isset(wdev->wiphy, 12620 NL80211_EXT_FEATURE_SECURE_NAN)) 12621 return -EOPNOTSUPP; 12622 break; 12623 default: 12624 return -EOPNOTSUPP; 12625 } 12626 12627 if (info->attrs[NL80211_ATTR_DURATION]) { 12628 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12629 return -EINVAL; 12630 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 12631 12632 /* 12633 * We should wait on the channel for at least a minimum amount 12634 * of time (10ms) but no longer than the driver supports. 12635 */ 12636 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 12637 params.wait > rdev->wiphy.max_remain_on_channel_duration) 12638 return -EINVAL; 12639 } 12640 12641 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 12642 12643 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 12644 return -EINVAL; 12645 12646 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 12647 12648 /* get the channel if any has been specified, otherwise pass NULL to 12649 * the driver. The latter will use the current one 12650 */ 12651 chandef.chan = NULL; 12652 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 12653 err = nl80211_parse_chandef(rdev, info, &chandef); 12654 if (err) 12655 return err; 12656 } 12657 12658 if (!chandef.chan && params.offchan) 12659 return -EINVAL; 12660 12661 if (params.offchan && 12662 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) 12663 return -EBUSY; 12664 12665 params.link_id = nl80211_link_id_or_invalid(info->attrs); 12666 /* 12667 * This now races due to the unlock, but we cannot check 12668 * the valid links for the _station_ anyway, so that's up 12669 * to the driver. 12670 */ 12671 if (params.link_id >= 0 && 12672 !(wdev->valid_links & BIT(params.link_id))) 12673 return -EINVAL; 12674 12675 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 12676 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 12677 12678 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 12679 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12680 int i; 12681 12682 if (len % sizeof(u16)) 12683 return -EINVAL; 12684 12685 params.n_csa_offsets = len / sizeof(u16); 12686 params.csa_offsets = 12687 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 12688 12689 /* check that all the offsets fit the frame */ 12690 for (i = 0; i < params.n_csa_offsets; i++) { 12691 if (params.csa_offsets[i] >= params.len) 12692 return -EINVAL; 12693 } 12694 } 12695 12696 if (!params.dont_wait_for_ack) { 12697 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12698 if (!msg) 12699 return -ENOMEM; 12700 12701 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12702 NL80211_CMD_FRAME); 12703 if (!hdr) { 12704 err = -ENOBUFS; 12705 goto free_msg; 12706 } 12707 } 12708 12709 params.chan = chandef.chan; 12710 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 12711 if (err) 12712 goto free_msg; 12713 12714 if (msg) { 12715 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12716 NL80211_ATTR_PAD)) 12717 goto nla_put_failure; 12718 12719 genlmsg_end(msg, hdr); 12720 return genlmsg_reply(msg, info); 12721 } 12722 12723 return 0; 12724 12725 nla_put_failure: 12726 err = -ENOBUFS; 12727 free_msg: 12728 nlmsg_free(msg); 12729 return err; 12730 } 12731 12732 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 12733 { 12734 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12735 struct wireless_dev *wdev = info->user_ptr[1]; 12736 u64 cookie; 12737 12738 if (!info->attrs[NL80211_ATTR_COOKIE]) 12739 return -EINVAL; 12740 12741 if (!rdev->ops->mgmt_tx_cancel_wait) 12742 return -EOPNOTSUPP; 12743 12744 switch (wdev->iftype) { 12745 case NL80211_IFTYPE_STATION: 12746 case NL80211_IFTYPE_ADHOC: 12747 case NL80211_IFTYPE_P2P_CLIENT: 12748 case NL80211_IFTYPE_AP: 12749 case NL80211_IFTYPE_AP_VLAN: 12750 case NL80211_IFTYPE_P2P_GO: 12751 case NL80211_IFTYPE_P2P_DEVICE: 12752 break; 12753 case NL80211_IFTYPE_NAN: 12754 if (!wiphy_ext_feature_isset(wdev->wiphy, 12755 NL80211_EXT_FEATURE_SECURE_NAN)) 12756 return -EOPNOTSUPP; 12757 break; 12758 default: 12759 return -EOPNOTSUPP; 12760 } 12761 12762 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 12763 12764 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 12765 } 12766 12767 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 12768 { 12769 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12770 struct wireless_dev *wdev; 12771 struct net_device *dev = info->user_ptr[1]; 12772 u8 ps_state; 12773 bool state; 12774 int err; 12775 12776 if (!info->attrs[NL80211_ATTR_PS_STATE]) 12777 return -EINVAL; 12778 12779 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 12780 12781 wdev = dev->ieee80211_ptr; 12782 12783 if (!rdev->ops->set_power_mgmt) 12784 return -EOPNOTSUPP; 12785 12786 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 12787 12788 if (state == wdev->ps) 12789 return 0; 12790 12791 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 12792 if (!err) 12793 wdev->ps = state; 12794 return err; 12795 } 12796 12797 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 12798 { 12799 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12800 enum nl80211_ps_state ps_state; 12801 struct wireless_dev *wdev; 12802 struct net_device *dev = info->user_ptr[1]; 12803 struct sk_buff *msg; 12804 void *hdr; 12805 int err; 12806 12807 wdev = dev->ieee80211_ptr; 12808 12809 if (!rdev->ops->set_power_mgmt) 12810 return -EOPNOTSUPP; 12811 12812 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12813 if (!msg) 12814 return -ENOMEM; 12815 12816 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12817 NL80211_CMD_GET_POWER_SAVE); 12818 if (!hdr) { 12819 err = -ENOBUFS; 12820 goto free_msg; 12821 } 12822 12823 if (wdev->ps) 12824 ps_state = NL80211_PS_ENABLED; 12825 else 12826 ps_state = NL80211_PS_DISABLED; 12827 12828 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 12829 goto nla_put_failure; 12830 12831 genlmsg_end(msg, hdr); 12832 return genlmsg_reply(msg, info); 12833 12834 nla_put_failure: 12835 err = -ENOBUFS; 12836 free_msg: 12837 nlmsg_free(msg); 12838 return err; 12839 } 12840 12841 static const struct nla_policy 12842 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 12843 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 12844 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 12845 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 12846 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 12847 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 12848 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 12849 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 12850 }; 12851 12852 static int nl80211_set_cqm_txe(struct genl_info *info, 12853 u32 rate, u32 pkts, u32 intvl) 12854 { 12855 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12856 struct net_device *dev = info->user_ptr[1]; 12857 struct wireless_dev *wdev = dev->ieee80211_ptr; 12858 12859 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 12860 return -EINVAL; 12861 12862 if (!rdev->ops->set_cqm_txe_config) 12863 return -EOPNOTSUPP; 12864 12865 if (wdev->iftype != NL80211_IFTYPE_STATION && 12866 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12867 return -EOPNOTSUPP; 12868 12869 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 12870 } 12871 12872 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 12873 struct net_device *dev, 12874 struct cfg80211_cqm_config *cqm_config) 12875 { 12876 struct wireless_dev *wdev = dev->ieee80211_ptr; 12877 s32 last, low, high; 12878 u32 hyst; 12879 int i, n, low_index; 12880 int err; 12881 12882 /* 12883 * Obtain current RSSI value if possible, if not and no RSSI threshold 12884 * event has been received yet, we should receive an event after a 12885 * connection is established and enough beacons received to calculate 12886 * the average. 12887 */ 12888 if (!cqm_config->last_rssi_event_value && 12889 wdev->links[0].client.current_bss && 12890 rdev->ops->get_station) { 12891 struct station_info sinfo = {}; 12892 u8 *mac_addr; 12893 12894 mac_addr = wdev->links[0].client.current_bss->pub.bssid; 12895 12896 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 12897 if (err) 12898 return err; 12899 12900 cfg80211_sinfo_release_content(&sinfo); 12901 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 12902 cqm_config->last_rssi_event_value = 12903 (s8) sinfo.rx_beacon_signal_avg; 12904 } 12905 12906 last = cqm_config->last_rssi_event_value; 12907 hyst = cqm_config->rssi_hyst; 12908 n = cqm_config->n_rssi_thresholds; 12909 12910 for (i = 0; i < n; i++) { 12911 i = array_index_nospec(i, n); 12912 if (last < cqm_config->rssi_thresholds[i]) 12913 break; 12914 } 12915 12916 low_index = i - 1; 12917 if (low_index >= 0) { 12918 low_index = array_index_nospec(low_index, n); 12919 low = cqm_config->rssi_thresholds[low_index] - hyst; 12920 } else { 12921 low = S32_MIN; 12922 } 12923 if (i < n) { 12924 i = array_index_nospec(i, n); 12925 high = cqm_config->rssi_thresholds[i] + hyst - 1; 12926 } else { 12927 high = S32_MAX; 12928 } 12929 12930 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 12931 } 12932 12933 static int nl80211_set_cqm_rssi(struct genl_info *info, 12934 const s32 *thresholds, int n_thresholds, 12935 u32 hysteresis) 12936 { 12937 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12938 struct cfg80211_cqm_config *cqm_config = NULL, *old; 12939 struct net_device *dev = info->user_ptr[1]; 12940 struct wireless_dev *wdev = dev->ieee80211_ptr; 12941 s32 prev = S32_MIN; 12942 int i, err; 12943 12944 /* Check all values negative and sorted */ 12945 for (i = 0; i < n_thresholds; i++) { 12946 if (thresholds[i] > 0 || thresholds[i] <= prev) 12947 return -EINVAL; 12948 12949 prev = thresholds[i]; 12950 } 12951 12952 if (wdev->iftype != NL80211_IFTYPE_STATION && 12953 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12954 return -EOPNOTSUPP; 12955 12956 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 12957 n_thresholds = 0; 12958 12959 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config); 12960 12961 /* if already disabled just succeed */ 12962 if (!n_thresholds && !old) 12963 return 0; 12964 12965 if (n_thresholds > 1) { 12966 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12967 NL80211_EXT_FEATURE_CQM_RSSI_LIST) || 12968 !rdev->ops->set_cqm_rssi_range_config) 12969 return -EOPNOTSUPP; 12970 } else { 12971 if (!rdev->ops->set_cqm_rssi_config) 12972 return -EOPNOTSUPP; 12973 } 12974 12975 if (n_thresholds) { 12976 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds, 12977 n_thresholds), 12978 GFP_KERNEL); 12979 if (!cqm_config) 12980 return -ENOMEM; 12981 12982 cqm_config->rssi_hyst = hysteresis; 12983 cqm_config->n_rssi_thresholds = n_thresholds; 12984 memcpy(cqm_config->rssi_thresholds, thresholds, 12985 flex_array_size(cqm_config, rssi_thresholds, 12986 n_thresholds)); 12987 cqm_config->use_range_api = n_thresholds > 1 || 12988 !rdev->ops->set_cqm_rssi_config; 12989 12990 rcu_assign_pointer(wdev->cqm_config, cqm_config); 12991 12992 if (cqm_config->use_range_api) 12993 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config); 12994 else 12995 err = rdev_set_cqm_rssi_config(rdev, dev, 12996 thresholds[0], 12997 hysteresis); 12998 } else { 12999 RCU_INIT_POINTER(wdev->cqm_config, NULL); 13000 /* if enabled as range also disable via range */ 13001 if (old->use_range_api) 13002 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 13003 else 13004 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 13005 } 13006 13007 if (err) { 13008 rcu_assign_pointer(wdev->cqm_config, old); 13009 kfree_rcu(cqm_config, rcu_head); 13010 } else { 13011 kfree_rcu(old, rcu_head); 13012 } 13013 13014 return err; 13015 } 13016 13017 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 13018 { 13019 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 13020 struct nlattr *cqm; 13021 int err; 13022 13023 cqm = info->attrs[NL80211_ATTR_CQM]; 13024 if (!cqm) 13025 return -EINVAL; 13026 13027 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm, 13028 nl80211_attr_cqm_policy, 13029 info->extack); 13030 if (err) 13031 return err; 13032 13033 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 13034 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 13035 const s32 *thresholds = 13036 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 13037 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 13038 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 13039 13040 if (len % 4) 13041 return -EINVAL; 13042 13043 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 13044 hysteresis); 13045 } 13046 13047 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 13048 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 13049 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 13050 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 13051 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 13052 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 13053 13054 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 13055 } 13056 13057 return -EINVAL; 13058 } 13059 13060 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 13061 { 13062 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13063 struct net_device *dev = info->user_ptr[1]; 13064 struct ocb_setup setup = {}; 13065 int err; 13066 13067 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 13068 if (err) 13069 return err; 13070 13071 return cfg80211_join_ocb(rdev, dev, &setup); 13072 } 13073 13074 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 13075 { 13076 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13077 struct net_device *dev = info->user_ptr[1]; 13078 13079 return cfg80211_leave_ocb(rdev, dev); 13080 } 13081 13082 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 13083 { 13084 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13085 struct net_device *dev = info->user_ptr[1]; 13086 struct mesh_config cfg; 13087 struct mesh_setup setup; 13088 int err; 13089 13090 /* start with default */ 13091 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 13092 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 13093 13094 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 13095 /* and parse parameters if given */ 13096 err = nl80211_parse_mesh_config(info, &cfg, NULL); 13097 if (err) 13098 return err; 13099 } 13100 13101 if (!info->attrs[NL80211_ATTR_MESH_ID] || 13102 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 13103 return -EINVAL; 13104 13105 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 13106 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 13107 13108 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 13109 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 13110 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 13111 return -EINVAL; 13112 13113 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 13114 setup.beacon_interval = 13115 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 13116 13117 err = cfg80211_validate_beacon_int(rdev, 13118 NL80211_IFTYPE_MESH_POINT, 13119 setup.beacon_interval); 13120 if (err) 13121 return err; 13122 } 13123 13124 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 13125 setup.dtim_period = 13126 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 13127 if (setup.dtim_period < 1 || setup.dtim_period > 100) 13128 return -EINVAL; 13129 } 13130 13131 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 13132 /* parse additional setup parameters if given */ 13133 err = nl80211_parse_mesh_setup(info, &setup); 13134 if (err) 13135 return err; 13136 } 13137 13138 if (setup.user_mpm) 13139 cfg.auto_open_plinks = false; 13140 13141 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 13142 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 13143 if (err) 13144 return err; 13145 } else { 13146 /* __cfg80211_join_mesh() will sort it out */ 13147 setup.chandef.chan = NULL; 13148 } 13149 13150 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 13151 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 13152 int n_rates = 13153 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 13154 struct ieee80211_supported_band *sband; 13155 13156 if (!setup.chandef.chan) 13157 return -EINVAL; 13158 13159 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 13160 13161 err = ieee80211_get_ratemask(sband, rates, n_rates, 13162 &setup.basic_rates); 13163 if (err) 13164 return err; 13165 } 13166 13167 if (info->attrs[NL80211_ATTR_TX_RATES]) { 13168 err = nl80211_parse_tx_bitrate_mask(info, info->attrs, 13169 NL80211_ATTR_TX_RATES, 13170 &setup.beacon_rate, 13171 dev, false, 0); 13172 if (err) 13173 return err; 13174 13175 if (!setup.chandef.chan) 13176 return -EINVAL; 13177 13178 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 13179 &setup.beacon_rate); 13180 if (err) 13181 return err; 13182 } 13183 13184 setup.userspace_handles_dfs = 13185 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 13186 13187 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 13188 int r = validate_pae_over_nl80211(rdev, info); 13189 13190 if (r < 0) 13191 return r; 13192 13193 setup.control_port_over_nl80211 = true; 13194 } 13195 13196 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 13197 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 13198 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 13199 13200 return err; 13201 } 13202 13203 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 13204 { 13205 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13206 struct net_device *dev = info->user_ptr[1]; 13207 13208 return cfg80211_leave_mesh(rdev, dev); 13209 } 13210 13211 #ifdef CONFIG_PM 13212 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 13213 struct cfg80211_registered_device *rdev) 13214 { 13215 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 13216 struct nlattr *nl_pats, *nl_pat; 13217 int i, pat_len; 13218 13219 if (!wowlan->n_patterns) 13220 return 0; 13221 13222 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 13223 if (!nl_pats) 13224 return -ENOBUFS; 13225 13226 for (i = 0; i < wowlan->n_patterns; i++) { 13227 nl_pat = nla_nest_start_noflag(msg, i + 1); 13228 if (!nl_pat) 13229 return -ENOBUFS; 13230 pat_len = wowlan->patterns[i].pattern_len; 13231 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 13232 wowlan->patterns[i].mask) || 13233 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13234 wowlan->patterns[i].pattern) || 13235 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13236 wowlan->patterns[i].pkt_offset)) 13237 return -ENOBUFS; 13238 nla_nest_end(msg, nl_pat); 13239 } 13240 nla_nest_end(msg, nl_pats); 13241 13242 return 0; 13243 } 13244 13245 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 13246 struct cfg80211_wowlan_tcp *tcp) 13247 { 13248 struct nlattr *nl_tcp; 13249 13250 if (!tcp) 13251 return 0; 13252 13253 nl_tcp = nla_nest_start_noflag(msg, 13254 NL80211_WOWLAN_TRIG_TCP_CONNECTION); 13255 if (!nl_tcp) 13256 return -ENOBUFS; 13257 13258 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 13259 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 13260 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 13261 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 13262 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 13263 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 13264 tcp->payload_len, tcp->payload) || 13265 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 13266 tcp->data_interval) || 13267 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 13268 tcp->wake_len, tcp->wake_data) || 13269 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 13270 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 13271 return -ENOBUFS; 13272 13273 if (tcp->payload_seq.len && 13274 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 13275 sizeof(tcp->payload_seq), &tcp->payload_seq)) 13276 return -ENOBUFS; 13277 13278 if (tcp->payload_tok.len && 13279 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 13280 sizeof(tcp->payload_tok) + tcp->tokens_size, 13281 &tcp->payload_tok)) 13282 return -ENOBUFS; 13283 13284 nla_nest_end(msg, nl_tcp); 13285 13286 return 0; 13287 } 13288 13289 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 13290 struct cfg80211_sched_scan_request *req) 13291 { 13292 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 13293 int i; 13294 13295 if (!req) 13296 return 0; 13297 13298 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 13299 if (!nd) 13300 return -ENOBUFS; 13301 13302 if (req->n_scan_plans == 1 && 13303 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 13304 req->scan_plans[0].interval * 1000)) 13305 return -ENOBUFS; 13306 13307 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 13308 return -ENOBUFS; 13309 13310 if (req->relative_rssi_set) { 13311 struct nl80211_bss_select_rssi_adjust rssi_adjust; 13312 13313 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 13314 req->relative_rssi)) 13315 return -ENOBUFS; 13316 13317 rssi_adjust.band = req->rssi_adjust.band; 13318 rssi_adjust.delta = req->rssi_adjust.delta; 13319 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 13320 sizeof(rssi_adjust), &rssi_adjust)) 13321 return -ENOBUFS; 13322 } 13323 13324 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13325 if (!freqs) 13326 return -ENOBUFS; 13327 13328 for (i = 0; i < req->n_channels; i++) { 13329 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13330 return -ENOBUFS; 13331 } 13332 13333 nla_nest_end(msg, freqs); 13334 13335 if (req->n_match_sets) { 13336 matches = nla_nest_start_noflag(msg, 13337 NL80211_ATTR_SCHED_SCAN_MATCH); 13338 if (!matches) 13339 return -ENOBUFS; 13340 13341 for (i = 0; i < req->n_match_sets; i++) { 13342 match = nla_nest_start_noflag(msg, i); 13343 if (!match) 13344 return -ENOBUFS; 13345 13346 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 13347 req->match_sets[i].ssid.ssid_len, 13348 req->match_sets[i].ssid.ssid)) 13349 return -ENOBUFS; 13350 nla_nest_end(msg, match); 13351 } 13352 nla_nest_end(msg, matches); 13353 } 13354 13355 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 13356 if (!scan_plans) 13357 return -ENOBUFS; 13358 13359 for (i = 0; i < req->n_scan_plans; i++) { 13360 scan_plan = nla_nest_start_noflag(msg, i + 1); 13361 if (!scan_plan) 13362 return -ENOBUFS; 13363 13364 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 13365 req->scan_plans[i].interval) || 13366 (req->scan_plans[i].iterations && 13367 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 13368 req->scan_plans[i].iterations))) 13369 return -ENOBUFS; 13370 nla_nest_end(msg, scan_plan); 13371 } 13372 nla_nest_end(msg, scan_plans); 13373 13374 nla_nest_end(msg, nd); 13375 13376 return 0; 13377 } 13378 13379 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 13380 { 13381 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13382 struct sk_buff *msg; 13383 void *hdr; 13384 u32 size = NLMSG_DEFAULT_SIZE; 13385 13386 if (!rdev->wiphy.wowlan) 13387 return -EOPNOTSUPP; 13388 13389 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 13390 /* adjust size to have room for all the data */ 13391 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 13392 rdev->wiphy.wowlan_config->tcp->payload_len + 13393 rdev->wiphy.wowlan_config->tcp->wake_len + 13394 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 13395 } 13396 13397 msg = nlmsg_new(size, GFP_KERNEL); 13398 if (!msg) 13399 return -ENOMEM; 13400 13401 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13402 NL80211_CMD_GET_WOWLAN); 13403 if (!hdr) 13404 goto nla_put_failure; 13405 13406 if (rdev->wiphy.wowlan_config) { 13407 struct nlattr *nl_wowlan; 13408 13409 nl_wowlan = nla_nest_start_noflag(msg, 13410 NL80211_ATTR_WOWLAN_TRIGGERS); 13411 if (!nl_wowlan) 13412 goto nla_put_failure; 13413 13414 if ((rdev->wiphy.wowlan_config->any && 13415 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 13416 (rdev->wiphy.wowlan_config->disconnect && 13417 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 13418 (rdev->wiphy.wowlan_config->magic_pkt && 13419 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 13420 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 13421 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 13422 (rdev->wiphy.wowlan_config->eap_identity_req && 13423 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 13424 (rdev->wiphy.wowlan_config->four_way_handshake && 13425 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 13426 (rdev->wiphy.wowlan_config->rfkill_release && 13427 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 13428 goto nla_put_failure; 13429 13430 if (nl80211_send_wowlan_patterns(msg, rdev)) 13431 goto nla_put_failure; 13432 13433 if (nl80211_send_wowlan_tcp(msg, 13434 rdev->wiphy.wowlan_config->tcp)) 13435 goto nla_put_failure; 13436 13437 if (nl80211_send_wowlan_nd( 13438 msg, 13439 rdev->wiphy.wowlan_config->nd_config)) 13440 goto nla_put_failure; 13441 13442 nla_nest_end(msg, nl_wowlan); 13443 } 13444 13445 genlmsg_end(msg, hdr); 13446 return genlmsg_reply(msg, info); 13447 13448 nla_put_failure: 13449 nlmsg_free(msg); 13450 return -ENOBUFS; 13451 } 13452 13453 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 13454 struct nlattr *attr, 13455 struct cfg80211_wowlan *trig) 13456 { 13457 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 13458 struct cfg80211_wowlan_tcp *cfg; 13459 struct nl80211_wowlan_tcp_data_token *tok = NULL; 13460 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 13461 u32 size; 13462 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 13463 int err, port; 13464 13465 if (!rdev->wiphy.wowlan->tcp) 13466 return -EINVAL; 13467 13468 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr, 13469 nl80211_wowlan_tcp_policy, NULL); 13470 if (err) 13471 return err; 13472 13473 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 13474 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 13475 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 13476 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 13477 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 13478 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 13479 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 13480 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 13481 return -EINVAL; 13482 13483 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 13484 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 13485 return -EINVAL; 13486 13487 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 13488 rdev->wiphy.wowlan->tcp->data_interval_max || 13489 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 13490 return -EINVAL; 13491 13492 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 13493 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 13494 return -EINVAL; 13495 13496 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 13497 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 13498 return -EINVAL; 13499 13500 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 13501 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13502 13503 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 13504 tokens_size = tokln - sizeof(*tok); 13505 13506 if (!tok->len || tokens_size % tok->len) 13507 return -EINVAL; 13508 if (!rdev->wiphy.wowlan->tcp->tok) 13509 return -EINVAL; 13510 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 13511 return -EINVAL; 13512 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 13513 return -EINVAL; 13514 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 13515 return -EINVAL; 13516 if (tok->offset + tok->len > data_size) 13517 return -EINVAL; 13518 } 13519 13520 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 13521 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 13522 if (!rdev->wiphy.wowlan->tcp->seq) 13523 return -EINVAL; 13524 if (seq->len == 0 || seq->len > 4) 13525 return -EINVAL; 13526 if (seq->len + seq->offset > data_size) 13527 return -EINVAL; 13528 } 13529 13530 size = sizeof(*cfg); 13531 size += data_size; 13532 size += wake_size + wake_mask_size; 13533 size += tokens_size; 13534 13535 cfg = kzalloc(size, GFP_KERNEL); 13536 if (!cfg) 13537 return -ENOMEM; 13538 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 13539 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 13540 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 13541 ETH_ALEN); 13542 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 13543 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 13544 else 13545 port = 0; 13546 #ifdef CONFIG_INET 13547 /* allocate a socket and port for it and use it */ 13548 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 13549 IPPROTO_TCP, &cfg->sock, 1); 13550 if (err) { 13551 kfree(cfg); 13552 return err; 13553 } 13554 if (inet_csk_get_port(cfg->sock->sk, port)) { 13555 sock_release(cfg->sock); 13556 kfree(cfg); 13557 return -EADDRINUSE; 13558 } 13559 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 13560 #else 13561 if (!port) { 13562 kfree(cfg); 13563 return -EINVAL; 13564 } 13565 cfg->src_port = port; 13566 #endif 13567 13568 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 13569 cfg->payload_len = data_size; 13570 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 13571 memcpy((void *)cfg->payload, 13572 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 13573 data_size); 13574 if (seq) 13575 cfg->payload_seq = *seq; 13576 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 13577 cfg->wake_len = wake_size; 13578 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 13579 memcpy((void *)cfg->wake_data, 13580 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 13581 wake_size); 13582 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 13583 data_size + wake_size; 13584 memcpy((void *)cfg->wake_mask, 13585 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 13586 wake_mask_size); 13587 if (tok) { 13588 cfg->tokens_size = tokens_size; 13589 cfg->payload_tok = *tok; 13590 memcpy(cfg->payload_tok.token_stream, tok->token_stream, 13591 tokens_size); 13592 } 13593 13594 trig->tcp = cfg; 13595 13596 return 0; 13597 } 13598 13599 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 13600 const struct wiphy_wowlan_support *wowlan, 13601 struct nlattr *attr, 13602 struct cfg80211_wowlan *trig) 13603 { 13604 struct nlattr **tb; 13605 int err; 13606 13607 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 13608 if (!tb) 13609 return -ENOMEM; 13610 13611 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 13612 err = -EOPNOTSUPP; 13613 goto out; 13614 } 13615 13616 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr, 13617 nl80211_policy, NULL); 13618 if (err) 13619 goto out; 13620 13621 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 13622 wowlan->max_nd_match_sets); 13623 err = PTR_ERR_OR_ZERO(trig->nd_config); 13624 if (err) 13625 trig->nd_config = NULL; 13626 13627 out: 13628 kfree(tb); 13629 return err; 13630 } 13631 13632 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 13633 { 13634 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13635 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 13636 struct cfg80211_wowlan new_triggers = {}; 13637 struct cfg80211_wowlan *ntrig; 13638 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 13639 int err, i; 13640 bool prev_enabled = rdev->wiphy.wowlan_config; 13641 bool regular = false; 13642 13643 if (!wowlan) 13644 return -EOPNOTSUPP; 13645 13646 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 13647 cfg80211_rdev_free_wowlan(rdev); 13648 rdev->wiphy.wowlan_config = NULL; 13649 goto set_wakeup; 13650 } 13651 13652 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG, 13653 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 13654 nl80211_wowlan_policy, info->extack); 13655 if (err) 13656 return err; 13657 13658 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 13659 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 13660 return -EINVAL; 13661 new_triggers.any = true; 13662 } 13663 13664 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 13665 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 13666 return -EINVAL; 13667 new_triggers.disconnect = true; 13668 regular = true; 13669 } 13670 13671 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 13672 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 13673 return -EINVAL; 13674 new_triggers.magic_pkt = true; 13675 regular = true; 13676 } 13677 13678 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 13679 return -EINVAL; 13680 13681 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 13682 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 13683 return -EINVAL; 13684 new_triggers.gtk_rekey_failure = true; 13685 regular = true; 13686 } 13687 13688 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 13689 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 13690 return -EINVAL; 13691 new_triggers.eap_identity_req = true; 13692 regular = true; 13693 } 13694 13695 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 13696 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 13697 return -EINVAL; 13698 new_triggers.four_way_handshake = true; 13699 regular = true; 13700 } 13701 13702 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 13703 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 13704 return -EINVAL; 13705 new_triggers.rfkill_release = true; 13706 regular = true; 13707 } 13708 13709 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 13710 struct nlattr *pat; 13711 int n_patterns = 0; 13712 int rem, pat_len, mask_len, pkt_offset; 13713 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13714 13715 regular = true; 13716 13717 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13718 rem) 13719 n_patterns++; 13720 if (n_patterns > wowlan->n_patterns) 13721 return -EINVAL; 13722 13723 new_triggers.patterns = kcalloc(n_patterns, 13724 sizeof(new_triggers.patterns[0]), 13725 GFP_KERNEL); 13726 if (!new_triggers.patterns) 13727 return -ENOMEM; 13728 13729 new_triggers.n_patterns = n_patterns; 13730 i = 0; 13731 13732 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 13733 rem) { 13734 u8 *mask_pat; 13735 13736 err = nla_parse_nested_deprecated(pat_tb, 13737 MAX_NL80211_PKTPAT, 13738 pat, 13739 nl80211_packet_pattern_policy, 13740 info->extack); 13741 if (err) 13742 goto error; 13743 13744 err = -EINVAL; 13745 if (!pat_tb[NL80211_PKTPAT_MASK] || 13746 !pat_tb[NL80211_PKTPAT_PATTERN]) 13747 goto error; 13748 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 13749 mask_len = DIV_ROUND_UP(pat_len, 8); 13750 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 13751 goto error; 13752 if (pat_len > wowlan->pattern_max_len || 13753 pat_len < wowlan->pattern_min_len) 13754 goto error; 13755 13756 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 13757 pkt_offset = 0; 13758 else 13759 pkt_offset = nla_get_u32( 13760 pat_tb[NL80211_PKTPAT_OFFSET]); 13761 if (pkt_offset > wowlan->max_pkt_offset) 13762 goto error; 13763 new_triggers.patterns[i].pkt_offset = pkt_offset; 13764 13765 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 13766 if (!mask_pat) { 13767 err = -ENOMEM; 13768 goto error; 13769 } 13770 new_triggers.patterns[i].mask = mask_pat; 13771 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 13772 mask_len); 13773 mask_pat += mask_len; 13774 new_triggers.patterns[i].pattern = mask_pat; 13775 new_triggers.patterns[i].pattern_len = pat_len; 13776 memcpy(mask_pat, 13777 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 13778 pat_len); 13779 i++; 13780 } 13781 } 13782 13783 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 13784 regular = true; 13785 err = nl80211_parse_wowlan_tcp( 13786 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 13787 &new_triggers); 13788 if (err) 13789 goto error; 13790 } 13791 13792 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 13793 regular = true; 13794 err = nl80211_parse_wowlan_nd( 13795 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 13796 &new_triggers); 13797 if (err) 13798 goto error; 13799 } 13800 13801 /* The 'any' trigger means the device continues operating more or less 13802 * as in its normal operation mode and wakes up the host on most of the 13803 * normal interrupts (like packet RX, ...) 13804 * It therefore makes little sense to combine with the more constrained 13805 * wakeup trigger modes. 13806 */ 13807 if (new_triggers.any && regular) { 13808 err = -EINVAL; 13809 goto error; 13810 } 13811 13812 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 13813 if (!ntrig) { 13814 err = -ENOMEM; 13815 goto error; 13816 } 13817 cfg80211_rdev_free_wowlan(rdev); 13818 rdev->wiphy.wowlan_config = ntrig; 13819 13820 set_wakeup: 13821 if (rdev->ops->set_wakeup && 13822 prev_enabled != !!rdev->wiphy.wowlan_config) 13823 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 13824 13825 return 0; 13826 error: 13827 for (i = 0; i < new_triggers.n_patterns; i++) 13828 kfree(new_triggers.patterns[i].mask); 13829 kfree(new_triggers.patterns); 13830 if (new_triggers.tcp && new_triggers.tcp->sock) 13831 sock_release(new_triggers.tcp->sock); 13832 kfree(new_triggers.tcp); 13833 kfree(new_triggers.nd_config); 13834 return err; 13835 } 13836 #endif 13837 13838 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 13839 struct cfg80211_registered_device *rdev) 13840 { 13841 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 13842 int i, j, pat_len; 13843 struct cfg80211_coalesce_rules *rule; 13844 13845 if (!rdev->coalesce->n_rules) 13846 return 0; 13847 13848 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE); 13849 if (!nl_rules) 13850 return -ENOBUFS; 13851 13852 for (i = 0; i < rdev->coalesce->n_rules; i++) { 13853 nl_rule = nla_nest_start_noflag(msg, i + 1); 13854 if (!nl_rule) 13855 return -ENOBUFS; 13856 13857 rule = &rdev->coalesce->rules[i]; 13858 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 13859 rule->delay)) 13860 return -ENOBUFS; 13861 13862 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 13863 rule->condition)) 13864 return -ENOBUFS; 13865 13866 nl_pats = nla_nest_start_noflag(msg, 13867 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 13868 if (!nl_pats) 13869 return -ENOBUFS; 13870 13871 for (j = 0; j < rule->n_patterns; j++) { 13872 nl_pat = nla_nest_start_noflag(msg, j + 1); 13873 if (!nl_pat) 13874 return -ENOBUFS; 13875 pat_len = rule->patterns[j].pattern_len; 13876 if (nla_put(msg, NL80211_PKTPAT_MASK, 13877 DIV_ROUND_UP(pat_len, 8), 13878 rule->patterns[j].mask) || 13879 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 13880 rule->patterns[j].pattern) || 13881 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 13882 rule->patterns[j].pkt_offset)) 13883 return -ENOBUFS; 13884 nla_nest_end(msg, nl_pat); 13885 } 13886 nla_nest_end(msg, nl_pats); 13887 nla_nest_end(msg, nl_rule); 13888 } 13889 nla_nest_end(msg, nl_rules); 13890 13891 return 0; 13892 } 13893 13894 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 13895 { 13896 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 13897 struct sk_buff *msg; 13898 void *hdr; 13899 13900 if (!rdev->wiphy.coalesce) 13901 return -EOPNOTSUPP; 13902 13903 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13904 if (!msg) 13905 return -ENOMEM; 13906 13907 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 13908 NL80211_CMD_GET_COALESCE); 13909 if (!hdr) 13910 goto nla_put_failure; 13911 13912 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 13913 goto nla_put_failure; 13914 13915 genlmsg_end(msg, hdr); 13916 return genlmsg_reply(msg, info); 13917 13918 nla_put_failure: 13919 nlmsg_free(msg); 13920 return -ENOBUFS; 13921 } 13922 13923 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 13924 { 13925 struct cfg80211_coalesce *coalesce = rdev->coalesce; 13926 int i, j; 13927 struct cfg80211_coalesce_rules *rule; 13928 13929 if (!coalesce) 13930 return; 13931 13932 for (i = 0; i < coalesce->n_rules; i++) { 13933 rule = &coalesce->rules[i]; 13934 for (j = 0; j < rule->n_patterns; j++) 13935 kfree(rule->patterns[j].mask); 13936 kfree(rule->patterns); 13937 } 13938 kfree(coalesce->rules); 13939 kfree(coalesce); 13940 rdev->coalesce = NULL; 13941 } 13942 13943 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 13944 struct nlattr *rule, 13945 struct cfg80211_coalesce_rules *new_rule) 13946 { 13947 int err, i; 13948 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 13949 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 13950 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 13951 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 13952 13953 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX, 13954 rule, nl80211_coalesce_policy, NULL); 13955 if (err) 13956 return err; 13957 13958 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 13959 new_rule->delay = 13960 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 13961 if (new_rule->delay > coalesce->max_delay) 13962 return -EINVAL; 13963 13964 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 13965 new_rule->condition = 13966 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 13967 13968 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 13969 return -EINVAL; 13970 13971 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13972 rem) 13973 n_patterns++; 13974 if (n_patterns > coalesce->n_patterns) 13975 return -EINVAL; 13976 13977 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 13978 GFP_KERNEL); 13979 if (!new_rule->patterns) 13980 return -ENOMEM; 13981 13982 new_rule->n_patterns = n_patterns; 13983 i = 0; 13984 13985 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 13986 rem) { 13987 u8 *mask_pat; 13988 13989 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT, 13990 pat, 13991 nl80211_packet_pattern_policy, 13992 NULL); 13993 if (err) 13994 return err; 13995 13996 if (!pat_tb[NL80211_PKTPAT_MASK] || 13997 !pat_tb[NL80211_PKTPAT_PATTERN]) 13998 return -EINVAL; 13999 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 14000 mask_len = DIV_ROUND_UP(pat_len, 8); 14001 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 14002 return -EINVAL; 14003 if (pat_len > coalesce->pattern_max_len || 14004 pat_len < coalesce->pattern_min_len) 14005 return -EINVAL; 14006 14007 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 14008 pkt_offset = 0; 14009 else 14010 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 14011 if (pkt_offset > coalesce->max_pkt_offset) 14012 return -EINVAL; 14013 new_rule->patterns[i].pkt_offset = pkt_offset; 14014 14015 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 14016 if (!mask_pat) 14017 return -ENOMEM; 14018 14019 new_rule->patterns[i].mask = mask_pat; 14020 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 14021 mask_len); 14022 14023 mask_pat += mask_len; 14024 new_rule->patterns[i].pattern = mask_pat; 14025 new_rule->patterns[i].pattern_len = pat_len; 14026 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 14027 pat_len); 14028 i++; 14029 } 14030 14031 return 0; 14032 } 14033 14034 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 14035 { 14036 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14037 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 14038 struct cfg80211_coalesce new_coalesce = {}; 14039 struct cfg80211_coalesce *n_coalesce; 14040 int err, rem_rule, n_rules = 0, i, j; 14041 struct nlattr *rule; 14042 struct cfg80211_coalesce_rules *tmp_rule; 14043 14044 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 14045 return -EOPNOTSUPP; 14046 14047 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 14048 cfg80211_rdev_free_coalesce(rdev); 14049 rdev_set_coalesce(rdev, NULL); 14050 return 0; 14051 } 14052 14053 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 14054 rem_rule) 14055 n_rules++; 14056 if (n_rules > coalesce->n_rules) 14057 return -EINVAL; 14058 14059 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 14060 GFP_KERNEL); 14061 if (!new_coalesce.rules) 14062 return -ENOMEM; 14063 14064 new_coalesce.n_rules = n_rules; 14065 i = 0; 14066 14067 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 14068 rem_rule) { 14069 err = nl80211_parse_coalesce_rule(rdev, rule, 14070 &new_coalesce.rules[i]); 14071 if (err) 14072 goto error; 14073 14074 i++; 14075 } 14076 14077 err = rdev_set_coalesce(rdev, &new_coalesce); 14078 if (err) 14079 goto error; 14080 14081 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 14082 if (!n_coalesce) { 14083 err = -ENOMEM; 14084 goto error; 14085 } 14086 cfg80211_rdev_free_coalesce(rdev); 14087 rdev->coalesce = n_coalesce; 14088 14089 return 0; 14090 error: 14091 for (i = 0; i < new_coalesce.n_rules; i++) { 14092 tmp_rule = &new_coalesce.rules[i]; 14093 for (j = 0; j < tmp_rule->n_patterns; j++) 14094 kfree(tmp_rule->patterns[j].mask); 14095 kfree(tmp_rule->patterns); 14096 } 14097 kfree(new_coalesce.rules); 14098 14099 return err; 14100 } 14101 14102 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 14103 { 14104 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14105 struct net_device *dev = info->user_ptr[1]; 14106 struct wireless_dev *wdev = dev->ieee80211_ptr; 14107 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 14108 struct cfg80211_gtk_rekey_data rekey_data = {}; 14109 int err; 14110 14111 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 14112 return -EINVAL; 14113 14114 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA, 14115 info->attrs[NL80211_ATTR_REKEY_DATA], 14116 nl80211_rekey_policy, info->extack); 14117 if (err) 14118 return err; 14119 14120 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 14121 !tb[NL80211_REKEY_DATA_KCK]) 14122 return -EINVAL; 14123 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN && 14124 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 14125 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN)) 14126 return -ERANGE; 14127 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && 14128 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && 14129 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) && 14130 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 && 14131 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32)) 14132 return -ERANGE; 14133 14134 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 14135 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 14136 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 14137 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]); 14138 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]); 14139 if (tb[NL80211_REKEY_DATA_AKM]) 14140 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]); 14141 14142 if (!wdev->connected) 14143 return -ENOTCONN; 14144 14145 if (!rdev->ops->set_rekey_data) 14146 return -EOPNOTSUPP; 14147 14148 return rdev_set_rekey_data(rdev, dev, &rekey_data); 14149 } 14150 14151 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 14152 struct genl_info *info) 14153 { 14154 struct net_device *dev = info->user_ptr[1]; 14155 struct wireless_dev *wdev = dev->ieee80211_ptr; 14156 14157 if (wdev->iftype != NL80211_IFTYPE_AP && 14158 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14159 return -EINVAL; 14160 14161 if (wdev->ap_unexpected_nlportid) 14162 return -EBUSY; 14163 14164 wdev->ap_unexpected_nlportid = info->snd_portid; 14165 return 0; 14166 } 14167 14168 static int nl80211_probe_client(struct sk_buff *skb, 14169 struct genl_info *info) 14170 { 14171 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14172 struct net_device *dev = info->user_ptr[1]; 14173 struct wireless_dev *wdev = dev->ieee80211_ptr; 14174 struct sk_buff *msg; 14175 void *hdr; 14176 const u8 *addr; 14177 u64 cookie; 14178 int err; 14179 14180 if (wdev->iftype != NL80211_IFTYPE_AP && 14181 wdev->iftype != NL80211_IFTYPE_P2P_GO) 14182 return -EOPNOTSUPP; 14183 14184 if (!info->attrs[NL80211_ATTR_MAC]) 14185 return -EINVAL; 14186 14187 if (!rdev->ops->probe_client) 14188 return -EOPNOTSUPP; 14189 14190 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14191 if (!msg) 14192 return -ENOMEM; 14193 14194 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14195 NL80211_CMD_PROBE_CLIENT); 14196 if (!hdr) { 14197 err = -ENOBUFS; 14198 goto free_msg; 14199 } 14200 14201 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 14202 14203 err = rdev_probe_client(rdev, dev, addr, &cookie); 14204 if (err) 14205 goto free_msg; 14206 14207 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14208 NL80211_ATTR_PAD)) 14209 goto nla_put_failure; 14210 14211 genlmsg_end(msg, hdr); 14212 14213 return genlmsg_reply(msg, info); 14214 14215 nla_put_failure: 14216 err = -ENOBUFS; 14217 free_msg: 14218 nlmsg_free(msg); 14219 return err; 14220 } 14221 14222 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 14223 { 14224 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14225 struct cfg80211_beacon_registration *reg, *nreg; 14226 int rv; 14227 14228 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 14229 return -EOPNOTSUPP; 14230 14231 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 14232 if (!nreg) 14233 return -ENOMEM; 14234 14235 /* First, check if already registered. */ 14236 spin_lock_bh(&rdev->beacon_registrations_lock); 14237 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14238 if (reg->nlportid == info->snd_portid) { 14239 rv = -EALREADY; 14240 goto out_err; 14241 } 14242 } 14243 /* Add it to the list */ 14244 nreg->nlportid = info->snd_portid; 14245 list_add(&nreg->list, &rdev->beacon_registrations); 14246 14247 spin_unlock_bh(&rdev->beacon_registrations_lock); 14248 14249 return 0; 14250 out_err: 14251 spin_unlock_bh(&rdev->beacon_registrations_lock); 14252 kfree(nreg); 14253 return rv; 14254 } 14255 14256 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 14257 { 14258 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14259 struct wireless_dev *wdev = info->user_ptr[1]; 14260 int err; 14261 14262 if (!rdev->ops->start_p2p_device) 14263 return -EOPNOTSUPP; 14264 14265 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14266 return -EOPNOTSUPP; 14267 14268 if (wdev_running(wdev)) 14269 return 0; 14270 14271 if (rfkill_blocked(rdev->wiphy.rfkill)) 14272 return -ERFKILL; 14273 14274 err = rdev_start_p2p_device(rdev, wdev); 14275 if (err) 14276 return err; 14277 14278 wdev->is_running = true; 14279 rdev->opencount++; 14280 14281 return 0; 14282 } 14283 14284 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 14285 { 14286 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14287 struct wireless_dev *wdev = info->user_ptr[1]; 14288 14289 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 14290 return -EOPNOTSUPP; 14291 14292 if (!rdev->ops->stop_p2p_device) 14293 return -EOPNOTSUPP; 14294 14295 cfg80211_stop_p2p_device(rdev, wdev); 14296 14297 return 0; 14298 } 14299 14300 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 14301 { 14302 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14303 struct wireless_dev *wdev = info->user_ptr[1]; 14304 struct cfg80211_nan_conf conf = {}; 14305 int err; 14306 14307 if (wdev->iftype != NL80211_IFTYPE_NAN) 14308 return -EOPNOTSUPP; 14309 14310 if (wdev_running(wdev)) 14311 return -EEXIST; 14312 14313 if (rfkill_blocked(rdev->wiphy.rfkill)) 14314 return -ERFKILL; 14315 14316 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 14317 return -EINVAL; 14318 14319 conf.master_pref = 14320 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14321 14322 if (info->attrs[NL80211_ATTR_BANDS]) { 14323 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14324 14325 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14326 return -EOPNOTSUPP; 14327 14328 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14329 return -EINVAL; 14330 14331 conf.bands = bands; 14332 } 14333 14334 err = rdev_start_nan(rdev, wdev, &conf); 14335 if (err) 14336 return err; 14337 14338 wdev->is_running = true; 14339 rdev->opencount++; 14340 14341 return 0; 14342 } 14343 14344 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 14345 { 14346 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14347 struct wireless_dev *wdev = info->user_ptr[1]; 14348 14349 if (wdev->iftype != NL80211_IFTYPE_NAN) 14350 return -EOPNOTSUPP; 14351 14352 cfg80211_stop_nan(rdev, wdev); 14353 14354 return 0; 14355 } 14356 14357 static int validate_nan_filter(struct nlattr *filter_attr) 14358 { 14359 struct nlattr *attr; 14360 int len = 0, n_entries = 0, rem; 14361 14362 nla_for_each_nested(attr, filter_attr, rem) { 14363 len += nla_len(attr); 14364 n_entries++; 14365 } 14366 14367 if (len >= U8_MAX) 14368 return -EINVAL; 14369 14370 return n_entries; 14371 } 14372 14373 static int handle_nan_filter(struct nlattr *attr_filter, 14374 struct cfg80211_nan_func *func, 14375 bool tx) 14376 { 14377 struct nlattr *attr; 14378 int n_entries, rem, i; 14379 struct cfg80211_nan_func_filter *filter; 14380 14381 n_entries = validate_nan_filter(attr_filter); 14382 if (n_entries < 0) 14383 return n_entries; 14384 14385 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 14386 14387 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 14388 if (!filter) 14389 return -ENOMEM; 14390 14391 i = 0; 14392 nla_for_each_nested(attr, attr_filter, rem) { 14393 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 14394 if (!filter[i].filter) 14395 goto err; 14396 14397 filter[i].len = nla_len(attr); 14398 i++; 14399 } 14400 if (tx) { 14401 func->num_tx_filters = n_entries; 14402 func->tx_filters = filter; 14403 } else { 14404 func->num_rx_filters = n_entries; 14405 func->rx_filters = filter; 14406 } 14407 14408 return 0; 14409 14410 err: 14411 i = 0; 14412 nla_for_each_nested(attr, attr_filter, rem) { 14413 kfree(filter[i].filter); 14414 i++; 14415 } 14416 kfree(filter); 14417 return -ENOMEM; 14418 } 14419 14420 static int nl80211_nan_add_func(struct sk_buff *skb, 14421 struct genl_info *info) 14422 { 14423 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14424 struct wireless_dev *wdev = info->user_ptr[1]; 14425 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 14426 struct cfg80211_nan_func *func; 14427 struct sk_buff *msg = NULL; 14428 void *hdr = NULL; 14429 int err = 0; 14430 14431 if (wdev->iftype != NL80211_IFTYPE_NAN) 14432 return -EOPNOTSUPP; 14433 14434 if (!wdev_running(wdev)) 14435 return -ENOTCONN; 14436 14437 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 14438 return -EINVAL; 14439 14440 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX, 14441 info->attrs[NL80211_ATTR_NAN_FUNC], 14442 nl80211_nan_func_policy, 14443 info->extack); 14444 if (err) 14445 return err; 14446 14447 func = kzalloc(sizeof(*func), GFP_KERNEL); 14448 if (!func) 14449 return -ENOMEM; 14450 14451 func->cookie = cfg80211_assign_cookie(rdev); 14452 14453 if (!tb[NL80211_NAN_FUNC_TYPE]) { 14454 err = -EINVAL; 14455 goto out; 14456 } 14457 14458 14459 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 14460 14461 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 14462 err = -EINVAL; 14463 goto out; 14464 } 14465 14466 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 14467 sizeof(func->service_id)); 14468 14469 func->close_range = 14470 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 14471 14472 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 14473 func->serv_spec_info_len = 14474 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 14475 func->serv_spec_info = 14476 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 14477 func->serv_spec_info_len, 14478 GFP_KERNEL); 14479 if (!func->serv_spec_info) { 14480 err = -ENOMEM; 14481 goto out; 14482 } 14483 } 14484 14485 if (tb[NL80211_NAN_FUNC_TTL]) 14486 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 14487 14488 switch (func->type) { 14489 case NL80211_NAN_FUNC_PUBLISH: 14490 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 14491 err = -EINVAL; 14492 goto out; 14493 } 14494 14495 func->publish_type = 14496 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 14497 func->publish_bcast = 14498 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 14499 14500 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 14501 func->publish_bcast) { 14502 err = -EINVAL; 14503 goto out; 14504 } 14505 break; 14506 case NL80211_NAN_FUNC_SUBSCRIBE: 14507 func->subscribe_active = 14508 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 14509 break; 14510 case NL80211_NAN_FUNC_FOLLOW_UP: 14511 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 14512 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 14513 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 14514 err = -EINVAL; 14515 goto out; 14516 } 14517 14518 func->followup_id = 14519 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 14520 func->followup_reqid = 14521 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 14522 memcpy(func->followup_dest.addr, 14523 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 14524 sizeof(func->followup_dest.addr)); 14525 if (func->ttl) { 14526 err = -EINVAL; 14527 goto out; 14528 } 14529 break; 14530 default: 14531 err = -EINVAL; 14532 goto out; 14533 } 14534 14535 if (tb[NL80211_NAN_FUNC_SRF]) { 14536 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 14537 14538 err = nla_parse_nested_deprecated(srf_tb, 14539 NL80211_NAN_SRF_ATTR_MAX, 14540 tb[NL80211_NAN_FUNC_SRF], 14541 nl80211_nan_srf_policy, 14542 info->extack); 14543 if (err) 14544 goto out; 14545 14546 func->srf_include = 14547 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 14548 14549 if (srf_tb[NL80211_NAN_SRF_BF]) { 14550 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 14551 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 14552 err = -EINVAL; 14553 goto out; 14554 } 14555 14556 func->srf_bf_len = 14557 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 14558 func->srf_bf = 14559 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 14560 func->srf_bf_len, GFP_KERNEL); 14561 if (!func->srf_bf) { 14562 err = -ENOMEM; 14563 goto out; 14564 } 14565 14566 func->srf_bf_idx = 14567 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 14568 } else { 14569 struct nlattr *attr, *mac_attr = 14570 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 14571 int n_entries, rem, i = 0; 14572 14573 if (!mac_attr) { 14574 err = -EINVAL; 14575 goto out; 14576 } 14577 14578 n_entries = validate_acl_mac_addrs(mac_attr); 14579 if (n_entries <= 0) { 14580 err = -EINVAL; 14581 goto out; 14582 } 14583 14584 func->srf_num_macs = n_entries; 14585 func->srf_macs = 14586 kcalloc(n_entries, sizeof(*func->srf_macs), 14587 GFP_KERNEL); 14588 if (!func->srf_macs) { 14589 err = -ENOMEM; 14590 goto out; 14591 } 14592 14593 nla_for_each_nested(attr, mac_attr, rem) 14594 memcpy(func->srf_macs[i++].addr, nla_data(attr), 14595 sizeof(*func->srf_macs)); 14596 } 14597 } 14598 14599 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 14600 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 14601 func, true); 14602 if (err) 14603 goto out; 14604 } 14605 14606 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 14607 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 14608 func, false); 14609 if (err) 14610 goto out; 14611 } 14612 14613 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14614 if (!msg) { 14615 err = -ENOMEM; 14616 goto out; 14617 } 14618 14619 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14620 NL80211_CMD_ADD_NAN_FUNCTION); 14621 /* This can't really happen - we just allocated 4KB */ 14622 if (WARN_ON(!hdr)) { 14623 err = -ENOMEM; 14624 goto out; 14625 } 14626 14627 err = rdev_add_nan_func(rdev, wdev, func); 14628 out: 14629 if (err < 0) { 14630 cfg80211_free_nan_func(func); 14631 nlmsg_free(msg); 14632 return err; 14633 } 14634 14635 /* propagate the instance id and cookie to userspace */ 14636 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 14637 NL80211_ATTR_PAD)) 14638 goto nla_put_failure; 14639 14640 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14641 if (!func_attr) 14642 goto nla_put_failure; 14643 14644 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 14645 func->instance_id)) 14646 goto nla_put_failure; 14647 14648 nla_nest_end(msg, func_attr); 14649 14650 genlmsg_end(msg, hdr); 14651 return genlmsg_reply(msg, info); 14652 14653 nla_put_failure: 14654 nlmsg_free(msg); 14655 return -ENOBUFS; 14656 } 14657 14658 static int nl80211_nan_del_func(struct sk_buff *skb, 14659 struct genl_info *info) 14660 { 14661 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14662 struct wireless_dev *wdev = info->user_ptr[1]; 14663 u64 cookie; 14664 14665 if (wdev->iftype != NL80211_IFTYPE_NAN) 14666 return -EOPNOTSUPP; 14667 14668 if (!wdev_running(wdev)) 14669 return -ENOTCONN; 14670 14671 if (!info->attrs[NL80211_ATTR_COOKIE]) 14672 return -EINVAL; 14673 14674 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 14675 14676 rdev_del_nan_func(rdev, wdev, cookie); 14677 14678 return 0; 14679 } 14680 14681 static int nl80211_nan_change_config(struct sk_buff *skb, 14682 struct genl_info *info) 14683 { 14684 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14685 struct wireless_dev *wdev = info->user_ptr[1]; 14686 struct cfg80211_nan_conf conf = {}; 14687 u32 changed = 0; 14688 14689 if (wdev->iftype != NL80211_IFTYPE_NAN) 14690 return -EOPNOTSUPP; 14691 14692 if (!wdev_running(wdev)) 14693 return -ENOTCONN; 14694 14695 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 14696 conf.master_pref = 14697 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 14698 if (conf.master_pref <= 1 || conf.master_pref == 255) 14699 return -EINVAL; 14700 14701 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 14702 } 14703 14704 if (info->attrs[NL80211_ATTR_BANDS]) { 14705 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 14706 14707 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 14708 return -EOPNOTSUPP; 14709 14710 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 14711 return -EINVAL; 14712 14713 conf.bands = bands; 14714 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 14715 } 14716 14717 if (!changed) 14718 return -EINVAL; 14719 14720 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 14721 } 14722 14723 void cfg80211_nan_match(struct wireless_dev *wdev, 14724 struct cfg80211_nan_match_params *match, gfp_t gfp) 14725 { 14726 struct wiphy *wiphy = wdev->wiphy; 14727 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14728 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 14729 struct sk_buff *msg; 14730 void *hdr; 14731 14732 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 14733 return; 14734 14735 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14736 if (!msg) 14737 return; 14738 14739 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 14740 if (!hdr) { 14741 nlmsg_free(msg); 14742 return; 14743 } 14744 14745 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14746 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14747 wdev->netdev->ifindex)) || 14748 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14749 NL80211_ATTR_PAD)) 14750 goto nla_put_failure; 14751 14752 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 14753 NL80211_ATTR_PAD) || 14754 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 14755 goto nla_put_failure; 14756 14757 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH); 14758 if (!match_attr) 14759 goto nla_put_failure; 14760 14761 local_func_attr = nla_nest_start_noflag(msg, 14762 NL80211_NAN_MATCH_FUNC_LOCAL); 14763 if (!local_func_attr) 14764 goto nla_put_failure; 14765 14766 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 14767 goto nla_put_failure; 14768 14769 nla_nest_end(msg, local_func_attr); 14770 14771 peer_func_attr = nla_nest_start_noflag(msg, 14772 NL80211_NAN_MATCH_FUNC_PEER); 14773 if (!peer_func_attr) 14774 goto nla_put_failure; 14775 14776 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 14777 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 14778 goto nla_put_failure; 14779 14780 if (match->info && match->info_len && 14781 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 14782 match->info)) 14783 goto nla_put_failure; 14784 14785 nla_nest_end(msg, peer_func_attr); 14786 nla_nest_end(msg, match_attr); 14787 genlmsg_end(msg, hdr); 14788 14789 if (!wdev->owner_nlportid) 14790 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14791 msg, 0, NL80211_MCGRP_NAN, gfp); 14792 else 14793 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14794 wdev->owner_nlportid); 14795 14796 return; 14797 14798 nla_put_failure: 14799 nlmsg_free(msg); 14800 } 14801 EXPORT_SYMBOL(cfg80211_nan_match); 14802 14803 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 14804 u8 inst_id, 14805 enum nl80211_nan_func_term_reason reason, 14806 u64 cookie, gfp_t gfp) 14807 { 14808 struct wiphy *wiphy = wdev->wiphy; 14809 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14810 struct sk_buff *msg; 14811 struct nlattr *func_attr; 14812 void *hdr; 14813 14814 if (WARN_ON(!inst_id)) 14815 return; 14816 14817 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14818 if (!msg) 14819 return; 14820 14821 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 14822 if (!hdr) { 14823 nlmsg_free(msg); 14824 return; 14825 } 14826 14827 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14828 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14829 wdev->netdev->ifindex)) || 14830 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14831 NL80211_ATTR_PAD)) 14832 goto nla_put_failure; 14833 14834 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14835 NL80211_ATTR_PAD)) 14836 goto nla_put_failure; 14837 14838 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC); 14839 if (!func_attr) 14840 goto nla_put_failure; 14841 14842 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 14843 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 14844 goto nla_put_failure; 14845 14846 nla_nest_end(msg, func_attr); 14847 genlmsg_end(msg, hdr); 14848 14849 if (!wdev->owner_nlportid) 14850 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 14851 msg, 0, NL80211_MCGRP_NAN, gfp); 14852 else 14853 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 14854 wdev->owner_nlportid); 14855 14856 return; 14857 14858 nla_put_failure: 14859 nlmsg_free(msg); 14860 } 14861 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 14862 14863 static int nl80211_get_protocol_features(struct sk_buff *skb, 14864 struct genl_info *info) 14865 { 14866 void *hdr; 14867 struct sk_buff *msg; 14868 14869 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14870 if (!msg) 14871 return -ENOMEM; 14872 14873 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 14874 NL80211_CMD_GET_PROTOCOL_FEATURES); 14875 if (!hdr) 14876 goto nla_put_failure; 14877 14878 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 14879 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 14880 goto nla_put_failure; 14881 14882 genlmsg_end(msg, hdr); 14883 return genlmsg_reply(msg, info); 14884 14885 nla_put_failure: 14886 kfree_skb(msg); 14887 return -ENOBUFS; 14888 } 14889 14890 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 14891 { 14892 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14893 struct cfg80211_update_ft_ies_params ft_params; 14894 struct net_device *dev = info->user_ptr[1]; 14895 14896 if (!rdev->ops->update_ft_ies) 14897 return -EOPNOTSUPP; 14898 14899 if (!info->attrs[NL80211_ATTR_MDID] || 14900 !info->attrs[NL80211_ATTR_IE]) 14901 return -EINVAL; 14902 14903 memset(&ft_params, 0, sizeof(ft_params)); 14904 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 14905 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 14906 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 14907 14908 return rdev_update_ft_ies(rdev, dev, &ft_params); 14909 } 14910 14911 static int nl80211_crit_protocol_start(struct sk_buff *skb, 14912 struct genl_info *info) 14913 { 14914 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14915 struct wireless_dev *wdev = info->user_ptr[1]; 14916 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 14917 u16 duration; 14918 int ret; 14919 14920 if (!rdev->ops->crit_proto_start) 14921 return -EOPNOTSUPP; 14922 14923 if (WARN_ON(!rdev->ops->crit_proto_stop)) 14924 return -EINVAL; 14925 14926 if (rdev->crit_proto_nlportid) 14927 return -EBUSY; 14928 14929 /* determine protocol if provided */ 14930 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 14931 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 14932 14933 if (proto >= NUM_NL80211_CRIT_PROTO) 14934 return -EINVAL; 14935 14936 /* timeout must be provided */ 14937 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 14938 return -EINVAL; 14939 14940 duration = 14941 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 14942 14943 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 14944 if (!ret) 14945 rdev->crit_proto_nlportid = info->snd_portid; 14946 14947 return ret; 14948 } 14949 14950 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 14951 struct genl_info *info) 14952 { 14953 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14954 struct wireless_dev *wdev = info->user_ptr[1]; 14955 14956 if (!rdev->ops->crit_proto_stop) 14957 return -EOPNOTSUPP; 14958 14959 if (rdev->crit_proto_nlportid) { 14960 rdev->crit_proto_nlportid = 0; 14961 rdev_crit_proto_stop(rdev, wdev); 14962 } 14963 return 0; 14964 } 14965 14966 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd, 14967 struct nlattr *attr, 14968 struct netlink_ext_ack *extack) 14969 { 14970 if (vcmd->policy == VENDOR_CMD_RAW_DATA) { 14971 if (attr->nla_type & NLA_F_NESTED) { 14972 NL_SET_ERR_MSG_ATTR(extack, attr, 14973 "unexpected nested data"); 14974 return -EINVAL; 14975 } 14976 14977 return 0; 14978 } 14979 14980 if (!(attr->nla_type & NLA_F_NESTED)) { 14981 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data"); 14982 return -EINVAL; 14983 } 14984 14985 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack); 14986 } 14987 14988 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 14989 { 14990 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 14991 struct wireless_dev *wdev = 14992 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info), 14993 info->attrs); 14994 int i, err; 14995 u32 vid, subcmd; 14996 14997 if (!rdev->wiphy.vendor_commands) 14998 return -EOPNOTSUPP; 14999 15000 if (IS_ERR(wdev)) { 15001 err = PTR_ERR(wdev); 15002 if (err != -EINVAL) 15003 return err; 15004 wdev = NULL; 15005 } else if (wdev->wiphy != &rdev->wiphy) { 15006 return -EINVAL; 15007 } 15008 15009 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 15010 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 15011 return -EINVAL; 15012 15013 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 15014 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 15015 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 15016 const struct wiphy_vendor_command *vcmd; 15017 void *data = NULL; 15018 int len = 0; 15019 15020 vcmd = &rdev->wiphy.vendor_commands[i]; 15021 15022 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 15023 continue; 15024 15025 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 15026 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 15027 if (!wdev) 15028 return -EINVAL; 15029 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 15030 !wdev->netdev) 15031 return -EINVAL; 15032 15033 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 15034 if (!wdev_running(wdev)) 15035 return -ENETDOWN; 15036 } 15037 } else { 15038 wdev = NULL; 15039 } 15040 15041 if (!vcmd->doit) 15042 return -EOPNOTSUPP; 15043 15044 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 15045 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 15046 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 15047 15048 err = nl80211_vendor_check_policy(vcmd, 15049 info->attrs[NL80211_ATTR_VENDOR_DATA], 15050 info->extack); 15051 if (err) 15052 return err; 15053 } 15054 15055 rdev->cur_cmd_info = info; 15056 err = vcmd->doit(&rdev->wiphy, wdev, data, len); 15057 rdev->cur_cmd_info = NULL; 15058 return err; 15059 } 15060 15061 return -EOPNOTSUPP; 15062 } 15063 15064 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 15065 struct netlink_callback *cb, 15066 struct cfg80211_registered_device **rdev, 15067 struct wireless_dev **wdev) 15068 { 15069 struct nlattr **attrbuf; 15070 u32 vid, subcmd; 15071 unsigned int i; 15072 int vcmd_idx = -1; 15073 int err; 15074 void *data = NULL; 15075 unsigned int data_len = 0; 15076 15077 if (cb->args[0]) { 15078 /* subtract the 1 again here */ 15079 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 15080 struct wireless_dev *tmp; 15081 15082 if (!wiphy) 15083 return -ENODEV; 15084 *rdev = wiphy_to_rdev(wiphy); 15085 *wdev = NULL; 15086 15087 if (cb->args[1]) { 15088 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 15089 if (tmp->identifier == cb->args[1] - 1) { 15090 *wdev = tmp; 15091 break; 15092 } 15093 } 15094 } 15095 15096 /* keep rtnl locked in successful case */ 15097 return 0; 15098 } 15099 15100 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL); 15101 if (!attrbuf) 15102 return -ENOMEM; 15103 15104 err = nlmsg_parse_deprecated(cb->nlh, 15105 GENL_HDRLEN + nl80211_fam.hdrsize, 15106 attrbuf, nl80211_fam.maxattr, 15107 nl80211_policy, NULL); 15108 if (err) 15109 goto out; 15110 15111 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 15112 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { 15113 err = -EINVAL; 15114 goto out; 15115 } 15116 15117 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf); 15118 if (IS_ERR(*wdev)) 15119 *wdev = NULL; 15120 15121 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 15122 if (IS_ERR(*rdev)) { 15123 err = PTR_ERR(*rdev); 15124 goto out; 15125 } 15126 15127 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 15128 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 15129 15130 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 15131 const struct wiphy_vendor_command *vcmd; 15132 15133 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 15134 15135 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 15136 continue; 15137 15138 if (!vcmd->dumpit) { 15139 err = -EOPNOTSUPP; 15140 goto out; 15141 } 15142 15143 vcmd_idx = i; 15144 break; 15145 } 15146 15147 if (vcmd_idx < 0) { 15148 err = -EOPNOTSUPP; 15149 goto out; 15150 } 15151 15152 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 15153 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 15154 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 15155 15156 err = nl80211_vendor_check_policy( 15157 &(*rdev)->wiphy.vendor_commands[vcmd_idx], 15158 attrbuf[NL80211_ATTR_VENDOR_DATA], 15159 cb->extack); 15160 if (err) 15161 goto out; 15162 } 15163 15164 /* 0 is the first index - add 1 to parse only once */ 15165 cb->args[0] = (*rdev)->wiphy_idx + 1; 15166 /* add 1 to know if it was NULL */ 15167 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 15168 cb->args[2] = vcmd_idx; 15169 cb->args[3] = (unsigned long)data; 15170 cb->args[4] = data_len; 15171 15172 /* keep rtnl locked in successful case */ 15173 err = 0; 15174 out: 15175 kfree(attrbuf); 15176 return err; 15177 } 15178 15179 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 15180 struct netlink_callback *cb) 15181 { 15182 struct cfg80211_registered_device *rdev; 15183 struct wireless_dev *wdev; 15184 unsigned int vcmd_idx; 15185 const struct wiphy_vendor_command *vcmd; 15186 void *data; 15187 int data_len; 15188 int err; 15189 struct nlattr *vendor_data; 15190 15191 rtnl_lock(); 15192 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 15193 if (err) 15194 goto out; 15195 15196 vcmd_idx = cb->args[2]; 15197 data = (void *)cb->args[3]; 15198 data_len = cb->args[4]; 15199 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 15200 15201 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 15202 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 15203 if (!wdev) { 15204 err = -EINVAL; 15205 goto out; 15206 } 15207 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 15208 !wdev->netdev) { 15209 err = -EINVAL; 15210 goto out; 15211 } 15212 15213 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 15214 if (!wdev_running(wdev)) { 15215 err = -ENETDOWN; 15216 goto out; 15217 } 15218 } 15219 } 15220 15221 while (1) { 15222 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 15223 cb->nlh->nlmsg_seq, NLM_F_MULTI, 15224 NL80211_CMD_VENDOR); 15225 if (!hdr) 15226 break; 15227 15228 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15229 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 15230 wdev_id(wdev), 15231 NL80211_ATTR_PAD))) { 15232 genlmsg_cancel(skb, hdr); 15233 break; 15234 } 15235 15236 vendor_data = nla_nest_start_noflag(skb, 15237 NL80211_ATTR_VENDOR_DATA); 15238 if (!vendor_data) { 15239 genlmsg_cancel(skb, hdr); 15240 break; 15241 } 15242 15243 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 15244 (unsigned long *)&cb->args[5]); 15245 nla_nest_end(skb, vendor_data); 15246 15247 if (err == -ENOBUFS || err == -ENOENT) { 15248 genlmsg_cancel(skb, hdr); 15249 break; 15250 } else if (err <= 0) { 15251 genlmsg_cancel(skb, hdr); 15252 goto out; 15253 } 15254 15255 genlmsg_end(skb, hdr); 15256 } 15257 15258 err = skb->len; 15259 out: 15260 rtnl_unlock(); 15261 return err; 15262 } 15263 15264 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 15265 enum nl80211_commands cmd, 15266 enum nl80211_attrs attr, 15267 int approxlen) 15268 { 15269 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15270 15271 if (WARN_ON(!rdev->cur_cmd_info)) 15272 return NULL; 15273 15274 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 15275 rdev->cur_cmd_info->snd_portid, 15276 rdev->cur_cmd_info->snd_seq, 15277 cmd, attr, NULL, GFP_KERNEL); 15278 } 15279 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 15280 15281 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 15282 { 15283 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 15284 void *hdr = ((void **)skb->cb)[1]; 15285 struct nlattr *data = ((void **)skb->cb)[2]; 15286 15287 /* clear CB data for netlink core to own from now on */ 15288 memset(skb->cb, 0, sizeof(skb->cb)); 15289 15290 if (WARN_ON(!rdev->cur_cmd_info)) { 15291 kfree_skb(skb); 15292 return -EINVAL; 15293 } 15294 15295 nla_nest_end(skb, data); 15296 genlmsg_end(skb, hdr); 15297 return genlmsg_reply(skb, rdev->cur_cmd_info); 15298 } 15299 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 15300 15301 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy) 15302 { 15303 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15304 15305 if (WARN_ON(!rdev->cur_cmd_info)) 15306 return 0; 15307 15308 return rdev->cur_cmd_info->snd_portid; 15309 } 15310 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender); 15311 15312 static int nl80211_set_qos_map(struct sk_buff *skb, 15313 struct genl_info *info) 15314 { 15315 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15316 struct cfg80211_qos_map *qos_map = NULL; 15317 struct net_device *dev = info->user_ptr[1]; 15318 u8 *pos, len, num_des, des_len, des; 15319 int ret; 15320 15321 if (!rdev->ops->set_qos_map) 15322 return -EOPNOTSUPP; 15323 15324 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 15325 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 15326 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 15327 15328 if (len % 2) 15329 return -EINVAL; 15330 15331 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 15332 if (!qos_map) 15333 return -ENOMEM; 15334 15335 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 15336 if (num_des) { 15337 des_len = num_des * 15338 sizeof(struct cfg80211_dscp_exception); 15339 memcpy(qos_map->dscp_exception, pos, des_len); 15340 qos_map->num_des = num_des; 15341 for (des = 0; des < num_des; des++) { 15342 if (qos_map->dscp_exception[des].up > 7) { 15343 kfree(qos_map); 15344 return -EINVAL; 15345 } 15346 } 15347 pos += des_len; 15348 } 15349 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 15350 } 15351 15352 ret = nl80211_key_allowed(dev->ieee80211_ptr); 15353 if (!ret) 15354 ret = rdev_set_qos_map(rdev, dev, qos_map); 15355 15356 kfree(qos_map); 15357 return ret; 15358 } 15359 15360 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 15361 { 15362 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15363 struct net_device *dev = info->user_ptr[1]; 15364 struct wireless_dev *wdev = dev->ieee80211_ptr; 15365 const u8 *peer; 15366 u8 tsid, up; 15367 u16 admitted_time = 0; 15368 15369 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 15370 return -EOPNOTSUPP; 15371 15372 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 15373 !info->attrs[NL80211_ATTR_USER_PRIO]) 15374 return -EINVAL; 15375 15376 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15377 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 15378 15379 /* WMM uses TIDs 0-7 even for TSPEC */ 15380 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 15381 /* TODO: handle 802.11 TSPEC/admission control 15382 * need more attributes for that (e.g. BA session requirement); 15383 * change the WMM adminssion test above to allow both then 15384 */ 15385 return -EINVAL; 15386 } 15387 15388 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15389 15390 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 15391 admitted_time = 15392 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 15393 if (!admitted_time) 15394 return -EINVAL; 15395 } 15396 15397 switch (wdev->iftype) { 15398 case NL80211_IFTYPE_STATION: 15399 case NL80211_IFTYPE_P2P_CLIENT: 15400 if (wdev->connected) 15401 break; 15402 return -ENOTCONN; 15403 default: 15404 return -EOPNOTSUPP; 15405 } 15406 15407 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 15408 } 15409 15410 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 15411 { 15412 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15413 struct net_device *dev = info->user_ptr[1]; 15414 const u8 *peer; 15415 u8 tsid; 15416 15417 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 15418 return -EINVAL; 15419 15420 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 15421 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15422 15423 return rdev_del_tx_ts(rdev, dev, tsid, peer); 15424 } 15425 15426 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 15427 struct genl_info *info) 15428 { 15429 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15430 struct net_device *dev = info->user_ptr[1]; 15431 struct wireless_dev *wdev = dev->ieee80211_ptr; 15432 struct cfg80211_chan_def chandef = {}; 15433 const u8 *addr; 15434 u8 oper_class; 15435 int err; 15436 15437 if (!rdev->ops->tdls_channel_switch || 15438 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15439 return -EOPNOTSUPP; 15440 15441 switch (dev->ieee80211_ptr->iftype) { 15442 case NL80211_IFTYPE_STATION: 15443 case NL80211_IFTYPE_P2P_CLIENT: 15444 break; 15445 default: 15446 return -EOPNOTSUPP; 15447 } 15448 15449 if (!info->attrs[NL80211_ATTR_MAC] || 15450 !info->attrs[NL80211_ATTR_OPER_CLASS]) 15451 return -EINVAL; 15452 15453 err = nl80211_parse_chandef(rdev, info, &chandef); 15454 if (err) 15455 return err; 15456 15457 /* 15458 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 15459 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 15460 * specification is not defined for them. 15461 */ 15462 if (chandef.chan->band == NL80211_BAND_2GHZ && 15463 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 15464 chandef.width != NL80211_CHAN_WIDTH_20) 15465 return -EINVAL; 15466 15467 /* we will be active on the TDLS link */ 15468 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 15469 wdev->iftype)) 15470 return -EINVAL; 15471 15472 /* don't allow switching to DFS channels */ 15473 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 15474 return -EINVAL; 15475 15476 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15477 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 15478 15479 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 15480 } 15481 15482 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 15483 struct genl_info *info) 15484 { 15485 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15486 struct net_device *dev = info->user_ptr[1]; 15487 const u8 *addr; 15488 15489 if (!rdev->ops->tdls_channel_switch || 15490 !rdev->ops->tdls_cancel_channel_switch || 15491 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 15492 return -EOPNOTSUPP; 15493 15494 switch (dev->ieee80211_ptr->iftype) { 15495 case NL80211_IFTYPE_STATION: 15496 case NL80211_IFTYPE_P2P_CLIENT: 15497 break; 15498 default: 15499 return -EOPNOTSUPP; 15500 } 15501 15502 if (!info->attrs[NL80211_ATTR_MAC]) 15503 return -EINVAL; 15504 15505 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 15506 15507 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 15508 15509 return 0; 15510 } 15511 15512 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 15513 struct genl_info *info) 15514 { 15515 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15516 struct net_device *dev = info->user_ptr[1]; 15517 struct wireless_dev *wdev = dev->ieee80211_ptr; 15518 const struct nlattr *nla; 15519 bool enabled; 15520 15521 if (!rdev->ops->set_multicast_to_unicast) 15522 return -EOPNOTSUPP; 15523 15524 if (wdev->iftype != NL80211_IFTYPE_AP && 15525 wdev->iftype != NL80211_IFTYPE_P2P_GO) 15526 return -EOPNOTSUPP; 15527 15528 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 15529 enabled = nla_get_flag(nla); 15530 15531 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 15532 } 15533 15534 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 15535 { 15536 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15537 struct net_device *dev = info->user_ptr[1]; 15538 struct wireless_dev *wdev = dev->ieee80211_ptr; 15539 struct cfg80211_pmk_conf pmk_conf = {}; 15540 15541 if (wdev->iftype != NL80211_IFTYPE_STATION && 15542 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15543 return -EOPNOTSUPP; 15544 15545 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15546 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15547 return -EOPNOTSUPP; 15548 15549 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 15550 return -EINVAL; 15551 15552 if (!wdev->connected) 15553 return -ENOTCONN; 15554 15555 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15556 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) 15557 return -EINVAL; 15558 15559 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 15560 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 15561 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 15562 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) 15563 return -EINVAL; 15564 15565 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) 15566 pmk_conf.pmk_r0_name = 15567 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 15568 15569 return rdev_set_pmk(rdev, dev, &pmk_conf); 15570 } 15571 15572 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 15573 { 15574 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15575 struct net_device *dev = info->user_ptr[1]; 15576 struct wireless_dev *wdev = dev->ieee80211_ptr; 15577 const u8 *aa; 15578 15579 if (wdev->iftype != NL80211_IFTYPE_STATION && 15580 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 15581 return -EOPNOTSUPP; 15582 15583 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15584 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 15585 return -EOPNOTSUPP; 15586 15587 if (!info->attrs[NL80211_ATTR_MAC]) 15588 return -EINVAL; 15589 15590 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 15591 return rdev_del_pmk(rdev, dev, aa); 15592 } 15593 15594 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 15595 { 15596 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15597 struct net_device *dev = info->user_ptr[1]; 15598 struct cfg80211_external_auth_params params; 15599 15600 if (!rdev->ops->external_auth) 15601 return -EOPNOTSUPP; 15602 15603 if (!info->attrs[NL80211_ATTR_SSID] && 15604 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 15605 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 15606 return -EINVAL; 15607 15608 if (!info->attrs[NL80211_ATTR_BSSID]) 15609 return -EINVAL; 15610 15611 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 15612 return -EINVAL; 15613 15614 memset(¶ms, 0, sizeof(params)); 15615 15616 if (info->attrs[NL80211_ATTR_SSID]) { 15617 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 15618 if (params.ssid.ssid_len == 0) 15619 return -EINVAL; 15620 memcpy(params.ssid.ssid, 15621 nla_data(info->attrs[NL80211_ATTR_SSID]), 15622 params.ssid.ssid_len); 15623 } 15624 15625 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 15626 ETH_ALEN); 15627 15628 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15629 15630 if (info->attrs[NL80211_ATTR_PMKID]) 15631 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 15632 15633 return rdev_external_auth(rdev, dev, ¶ms); 15634 } 15635 15636 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 15637 { 15638 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK]; 15639 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15640 struct net_device *dev = info->user_ptr[1]; 15641 struct wireless_dev *wdev = dev->ieee80211_ptr; 15642 const u8 *buf; 15643 size_t len; 15644 u8 *dest; 15645 u16 proto; 15646 bool noencrypt; 15647 u64 cookie = 0; 15648 int link_id; 15649 int err; 15650 15651 if (!wiphy_ext_feature_isset(&rdev->wiphy, 15652 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 15653 return -EOPNOTSUPP; 15654 15655 if (!rdev->ops->tx_control_port) 15656 return -EOPNOTSUPP; 15657 15658 if (!info->attrs[NL80211_ATTR_FRAME] || 15659 !info->attrs[NL80211_ATTR_MAC] || 15660 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 15661 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 15662 return -EINVAL; 15663 } 15664 15665 switch (wdev->iftype) { 15666 case NL80211_IFTYPE_AP: 15667 case NL80211_IFTYPE_P2P_GO: 15668 case NL80211_IFTYPE_MESH_POINT: 15669 break; 15670 case NL80211_IFTYPE_ADHOC: 15671 if (wdev->u.ibss.current_bss) 15672 break; 15673 return -ENOTCONN; 15674 case NL80211_IFTYPE_STATION: 15675 case NL80211_IFTYPE_P2P_CLIENT: 15676 if (wdev->connected) 15677 break; 15678 return -ENOTCONN; 15679 default: 15680 return -EOPNOTSUPP; 15681 } 15682 15683 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15684 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15685 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15686 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 15687 noencrypt = 15688 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 15689 15690 link_id = nl80211_link_id_or_invalid(info->attrs); 15691 15692 err = rdev_tx_control_port(rdev, dev, buf, len, 15693 dest, cpu_to_be16(proto), noencrypt, link_id, 15694 dont_wait_for_ack ? NULL : &cookie); 15695 if (!err && !dont_wait_for_ack) 15696 nl_set_extack_cookie_u64(info->extack, cookie); 15697 return err; 15698 } 15699 15700 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 15701 struct genl_info *info) 15702 { 15703 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15704 struct net_device *dev = info->user_ptr[1]; 15705 struct wireless_dev *wdev = dev->ieee80211_ptr; 15706 struct cfg80211_ftm_responder_stats ftm_stats = {}; 15707 unsigned int link_id = nl80211_link_id(info->attrs); 15708 struct sk_buff *msg; 15709 void *hdr; 15710 struct nlattr *ftm_stats_attr; 15711 int err; 15712 15713 if (wdev->iftype != NL80211_IFTYPE_AP || 15714 !wdev->links[link_id].ap.beacon_interval) 15715 return -EOPNOTSUPP; 15716 15717 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 15718 if (err) 15719 return err; 15720 15721 if (!ftm_stats.filled) 15722 return -ENODATA; 15723 15724 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15725 if (!msg) 15726 return -ENOMEM; 15727 15728 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 15729 NL80211_CMD_GET_FTM_RESPONDER_STATS); 15730 if (!hdr) 15731 goto nla_put_failure; 15732 15733 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15734 goto nla_put_failure; 15735 15736 ftm_stats_attr = nla_nest_start_noflag(msg, 15737 NL80211_ATTR_FTM_RESPONDER_STATS); 15738 if (!ftm_stats_attr) 15739 goto nla_put_failure; 15740 15741 #define SET_FTM(field, name, type) \ 15742 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15743 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 15744 ftm_stats.field)) \ 15745 goto nla_put_failure; } while (0) 15746 #define SET_FTM_U64(field, name) \ 15747 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 15748 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 15749 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 15750 goto nla_put_failure; } while (0) 15751 15752 SET_FTM(success_num, SUCCESS_NUM, u32); 15753 SET_FTM(partial_num, PARTIAL_NUM, u32); 15754 SET_FTM(failed_num, FAILED_NUM, u32); 15755 SET_FTM(asap_num, ASAP_NUM, u32); 15756 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 15757 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 15758 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 15759 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 15760 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 15761 #undef SET_FTM 15762 15763 nla_nest_end(msg, ftm_stats_attr); 15764 15765 genlmsg_end(msg, hdr); 15766 return genlmsg_reply(msg, info); 15767 15768 nla_put_failure: 15769 nlmsg_free(msg); 15770 return -ENOBUFS; 15771 } 15772 15773 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info) 15774 { 15775 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15776 struct cfg80211_update_owe_info owe_info; 15777 struct net_device *dev = info->user_ptr[1]; 15778 15779 if (!rdev->ops->update_owe_info) 15780 return -EOPNOTSUPP; 15781 15782 if (!info->attrs[NL80211_ATTR_STATUS_CODE] || 15783 !info->attrs[NL80211_ATTR_MAC]) 15784 return -EINVAL; 15785 15786 memset(&owe_info, 0, sizeof(owe_info)); 15787 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 15788 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN); 15789 15790 if (info->attrs[NL80211_ATTR_IE]) { 15791 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 15792 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 15793 } 15794 15795 return rdev_update_owe_info(rdev, dev, &owe_info); 15796 } 15797 15798 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info) 15799 { 15800 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15801 struct net_device *dev = info->user_ptr[1]; 15802 struct wireless_dev *wdev = dev->ieee80211_ptr; 15803 struct station_info sinfo = {}; 15804 const u8 *buf; 15805 size_t len; 15806 u8 *dest; 15807 int err; 15808 15809 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station) 15810 return -EOPNOTSUPP; 15811 15812 if (!info->attrs[NL80211_ATTR_MAC] || 15813 !info->attrs[NL80211_ATTR_FRAME]) { 15814 GENL_SET_ERR_MSG(info, "Frame or MAC missing"); 15815 return -EINVAL; 15816 } 15817 15818 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 15819 return -EOPNOTSUPP; 15820 15821 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 15822 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 15823 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 15824 15825 if (len < sizeof(struct ethhdr)) 15826 return -EINVAL; 15827 15828 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) || 15829 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr)) 15830 return -EINVAL; 15831 15832 err = rdev_get_station(rdev, dev, dest, &sinfo); 15833 if (err) 15834 return err; 15835 15836 cfg80211_sinfo_release_content(&sinfo); 15837 15838 return rdev_probe_mesh_link(rdev, dev, dest, buf, len); 15839 } 15840 15841 static int parse_tid_conf(struct cfg80211_registered_device *rdev, 15842 struct nlattr *attrs[], struct net_device *dev, 15843 struct cfg80211_tid_cfg *tid_conf, 15844 struct genl_info *info, const u8 *peer, 15845 unsigned int link_id) 15846 { 15847 struct netlink_ext_ack *extack = info->extack; 15848 u64 mask; 15849 int err; 15850 15851 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS]) 15852 return -EINVAL; 15853 15854 tid_conf->config_override = 15855 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]); 15856 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]); 15857 15858 if (tid_conf->config_override) { 15859 if (rdev->ops->reset_tid_config) { 15860 err = rdev_reset_tid_config(rdev, dev, peer, 15861 tid_conf->tids); 15862 if (err) 15863 return err; 15864 } else { 15865 return -EINVAL; 15866 } 15867 } 15868 15869 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) { 15870 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK); 15871 tid_conf->noack = 15872 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]); 15873 } 15874 15875 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) { 15876 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT); 15877 tid_conf->retry_short = 15878 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]); 15879 15880 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count) 15881 return -EINVAL; 15882 } 15883 15884 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) { 15885 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG); 15886 tid_conf->retry_long = 15887 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]); 15888 15889 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count) 15890 return -EINVAL; 15891 } 15892 15893 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) { 15894 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL); 15895 tid_conf->ampdu = 15896 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]); 15897 } 15898 15899 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) { 15900 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL); 15901 tid_conf->rtscts = 15902 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]); 15903 } 15904 15905 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) { 15906 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL); 15907 tid_conf->amsdu = 15908 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]); 15909 } 15910 15911 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) { 15912 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr; 15913 15914 tid_conf->txrate_type = nla_get_u8(attrs[idx]); 15915 15916 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) { 15917 attr = NL80211_TID_CONFIG_ATTR_TX_RATE; 15918 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr, 15919 &tid_conf->txrate_mask, dev, 15920 true, link_id); 15921 if (err) 15922 return err; 15923 15924 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE); 15925 } 15926 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE); 15927 } 15928 15929 if (peer) 15930 mask = rdev->wiphy.tid_config_support.peer; 15931 else 15932 mask = rdev->wiphy.tid_config_support.vif; 15933 15934 if (tid_conf->mask & ~mask) { 15935 NL_SET_ERR_MSG(extack, "unsupported TID configuration"); 15936 return -EOPNOTSUPP; 15937 } 15938 15939 return 0; 15940 } 15941 15942 static int nl80211_set_tid_config(struct sk_buff *skb, 15943 struct genl_info *info) 15944 { 15945 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 15946 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1]; 15947 unsigned int link_id = nl80211_link_id(info->attrs); 15948 struct net_device *dev = info->user_ptr[1]; 15949 struct cfg80211_tid_config *tid_config; 15950 struct nlattr *tid; 15951 int conf_idx = 0, rem_conf; 15952 int ret = -EINVAL; 15953 u32 num_conf = 0; 15954 15955 if (!info->attrs[NL80211_ATTR_TID_CONFIG]) 15956 return -EINVAL; 15957 15958 if (!rdev->ops->set_tid_config) 15959 return -EOPNOTSUPP; 15960 15961 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15962 rem_conf) 15963 num_conf++; 15964 15965 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf), 15966 GFP_KERNEL); 15967 if (!tid_config) 15968 return -ENOMEM; 15969 15970 tid_config->n_tid_conf = num_conf; 15971 15972 if (info->attrs[NL80211_ATTR_MAC]) 15973 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 15974 15975 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], 15976 rem_conf) { 15977 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, 15978 tid, NULL, NULL); 15979 15980 if (ret) 15981 goto bad_tid_conf; 15982 15983 ret = parse_tid_conf(rdev, attrs, dev, 15984 &tid_config->tid_conf[conf_idx], 15985 info, tid_config->peer, link_id); 15986 if (ret) 15987 goto bad_tid_conf; 15988 15989 conf_idx++; 15990 } 15991 15992 ret = rdev_set_tid_config(rdev, dev, tid_config); 15993 15994 bad_tid_conf: 15995 kfree(tid_config); 15996 return ret; 15997 } 15998 15999 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info) 16000 { 16001 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16002 struct cfg80211_color_change_settings params = {}; 16003 struct net_device *dev = info->user_ptr[1]; 16004 struct wireless_dev *wdev = dev->ieee80211_ptr; 16005 struct nlattr **tb; 16006 u16 offset; 16007 int err; 16008 16009 if (!rdev->ops->color_change) 16010 return -EOPNOTSUPP; 16011 16012 if (!wiphy_ext_feature_isset(&rdev->wiphy, 16013 NL80211_EXT_FEATURE_BSS_COLOR)) 16014 return -EOPNOTSUPP; 16015 16016 if (wdev->iftype != NL80211_IFTYPE_AP) 16017 return -EOPNOTSUPP; 16018 16019 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] || 16020 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] || 16021 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS]) 16022 return -EINVAL; 16023 16024 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]); 16025 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]); 16026 16027 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next, 16028 info->extack); 16029 if (err) 16030 return err; 16031 16032 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL); 16033 if (!tb) 16034 return -ENOMEM; 16035 16036 err = nla_parse_nested(tb, NL80211_ATTR_MAX, 16037 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS], 16038 nl80211_policy, info->extack); 16039 if (err) 16040 goto out; 16041 16042 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change, 16043 info->extack); 16044 if (err) 16045 goto out; 16046 16047 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) { 16048 err = -EINVAL; 16049 goto out; 16050 } 16051 16052 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) { 16053 err = -EINVAL; 16054 goto out; 16055 } 16056 16057 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]); 16058 if (offset >= params.beacon_color_change.tail_len) { 16059 err = -EINVAL; 16060 goto out; 16061 } 16062 16063 if (params.beacon_color_change.tail[offset] != params.count) { 16064 err = -EINVAL; 16065 goto out; 16066 } 16067 16068 params.counter_offset_beacon = offset; 16069 16070 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) { 16071 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) != 16072 sizeof(u16)) { 16073 err = -EINVAL; 16074 goto out; 16075 } 16076 16077 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]); 16078 if (offset >= params.beacon_color_change.probe_resp_len) { 16079 err = -EINVAL; 16080 goto out; 16081 } 16082 16083 if (params.beacon_color_change.probe_resp[offset] != 16084 params.count) { 16085 err = -EINVAL; 16086 goto out; 16087 } 16088 16089 params.counter_offset_presp = offset; 16090 } 16091 16092 err = rdev_color_change(rdev, dev, ¶ms); 16093 16094 out: 16095 kfree(params.beacon_next.mbssid_ies); 16096 kfree(params.beacon_color_change.mbssid_ies); 16097 kfree(params.beacon_next.rnr_ies); 16098 kfree(params.beacon_color_change.rnr_ies); 16099 kfree(tb); 16100 return err; 16101 } 16102 16103 static int nl80211_set_fils_aad(struct sk_buff *skb, 16104 struct genl_info *info) 16105 { 16106 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16107 struct net_device *dev = info->user_ptr[1]; 16108 struct cfg80211_fils_aad fils_aad = {}; 16109 u8 *nonces; 16110 16111 if (!info->attrs[NL80211_ATTR_MAC] || 16112 !info->attrs[NL80211_ATTR_FILS_KEK] || 16113 !info->attrs[NL80211_ATTR_FILS_NONCES]) 16114 return -EINVAL; 16115 16116 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]); 16117 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 16118 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 16119 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 16120 fils_aad.snonce = nonces; 16121 fils_aad.anonce = nonces + FILS_NONCE_LEN; 16122 16123 return rdev_set_fils_aad(rdev, dev, &fils_aad); 16124 } 16125 16126 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info) 16127 { 16128 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16129 unsigned int link_id = nl80211_link_id(info->attrs); 16130 struct net_device *dev = info->user_ptr[1]; 16131 struct wireless_dev *wdev = dev->ieee80211_ptr; 16132 int ret; 16133 16134 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)) 16135 return -EINVAL; 16136 16137 switch (wdev->iftype) { 16138 case NL80211_IFTYPE_AP: 16139 break; 16140 default: 16141 return -EINVAL; 16142 } 16143 16144 if (!info->attrs[NL80211_ATTR_MAC] || 16145 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC]))) 16146 return -EINVAL; 16147 16148 wdev->valid_links |= BIT(link_id); 16149 ether_addr_copy(wdev->links[link_id].addr, 16150 nla_data(info->attrs[NL80211_ATTR_MAC])); 16151 16152 ret = rdev_add_intf_link(rdev, wdev, link_id); 16153 if (ret) { 16154 wdev->valid_links &= ~BIT(link_id); 16155 eth_zero_addr(wdev->links[link_id].addr); 16156 } 16157 16158 return ret; 16159 } 16160 16161 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info) 16162 { 16163 unsigned int link_id = nl80211_link_id(info->attrs); 16164 struct net_device *dev = info->user_ptr[1]; 16165 struct wireless_dev *wdev = dev->ieee80211_ptr; 16166 16167 /* cannot remove if there's no link */ 16168 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16169 return -EINVAL; 16170 16171 switch (wdev->iftype) { 16172 case NL80211_IFTYPE_AP: 16173 break; 16174 default: 16175 return -EINVAL; 16176 } 16177 16178 cfg80211_remove_link(wdev, link_id); 16179 16180 return 0; 16181 } 16182 16183 static int 16184 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info, 16185 bool add) 16186 { 16187 struct link_station_parameters params = {}; 16188 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16189 struct net_device *dev = info->user_ptr[1]; 16190 int err; 16191 16192 if ((add && !rdev->ops->add_link_station) || 16193 (!add && !rdev->ops->mod_link_station)) 16194 return -EOPNOTSUPP; 16195 16196 if (add && !info->attrs[NL80211_ATTR_MAC]) 16197 return -EINVAL; 16198 16199 if (!info->attrs[NL80211_ATTR_MLD_ADDR]) 16200 return -EINVAL; 16201 16202 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 16203 return -EINVAL; 16204 16205 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16206 16207 if (info->attrs[NL80211_ATTR_MAC]) { 16208 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 16209 if (!is_valid_ether_addr(params.link_mac)) 16210 return -EINVAL; 16211 } 16212 16213 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16214 return -EINVAL; 16215 16216 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16217 16218 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 16219 params.supported_rates = 16220 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16221 params.supported_rates_len = 16222 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 16223 } 16224 16225 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 16226 params.ht_capa = 16227 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 16228 16229 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 16230 params.vht_capa = 16231 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 16232 16233 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 16234 params.he_capa = 16235 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16236 params.he_capa_len = 16237 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 16238 16239 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) { 16240 params.eht_capa = 16241 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16242 params.eht_capa_len = 16243 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]); 16244 16245 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa, 16246 (const u8 *)params.eht_capa, 16247 params.eht_capa_len, 16248 false)) 16249 return -EINVAL; 16250 } 16251 } 16252 16253 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]) 16254 params.he_6ghz_capa = 16255 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]); 16256 16257 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 16258 params.opmode_notif_used = true; 16259 params.opmode_notif = 16260 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 16261 } 16262 16263 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr, 16264 ¶ms.txpwr_set); 16265 if (err) 16266 return err; 16267 16268 if (add) 16269 return rdev_add_link_station(rdev, dev, ¶ms); 16270 16271 return rdev_mod_link_station(rdev, dev, ¶ms); 16272 } 16273 16274 static int 16275 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info) 16276 { 16277 return nl80211_add_mod_link_station(skb, info, true); 16278 } 16279 16280 static int 16281 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info) 16282 { 16283 return nl80211_add_mod_link_station(skb, info, false); 16284 } 16285 16286 static int 16287 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info) 16288 { 16289 struct link_station_del_parameters params = {}; 16290 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16291 struct net_device *dev = info->user_ptr[1]; 16292 16293 if (!rdev->ops->del_link_station) 16294 return -EOPNOTSUPP; 16295 16296 if (!info->attrs[NL80211_ATTR_MLD_ADDR] || 16297 !info->attrs[NL80211_ATTR_MLO_LINK_ID]) 16298 return -EINVAL; 16299 16300 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); 16301 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]); 16302 16303 return rdev_del_link_station(rdev, dev, ¶ms); 16304 } 16305 16306 static int nl80211_set_hw_timestamp(struct sk_buff *skb, 16307 struct genl_info *info) 16308 { 16309 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16310 struct net_device *dev = info->user_ptr[1]; 16311 struct cfg80211_set_hw_timestamp hwts = {}; 16312 16313 if (!rdev->wiphy.hw_timestamp_max_peers) 16314 return -EOPNOTSUPP; 16315 16316 if (!info->attrs[NL80211_ATTR_MAC] && 16317 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS) 16318 return -EOPNOTSUPP; 16319 16320 if (info->attrs[NL80211_ATTR_MAC]) 16321 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]); 16322 16323 hwts.enable = 16324 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]); 16325 16326 return rdev_set_hw_timestamp(rdev, dev, &hwts); 16327 } 16328 16329 static int 16330 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info) 16331 { 16332 struct cfg80211_ttlm_params params = {}; 16333 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16334 struct net_device *dev = info->user_ptr[1]; 16335 struct wireless_dev *wdev = dev->ieee80211_ptr; 16336 16337 if (wdev->iftype != NL80211_IFTYPE_STATION && 16338 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 16339 return -EOPNOTSUPP; 16340 16341 if (!wdev->connected) 16342 return -ENOLINK; 16343 16344 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] || 16345 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK]) 16346 return -EINVAL; 16347 16348 nla_memcpy(params.dlink, 16349 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK], 16350 sizeof(params.dlink)); 16351 nla_memcpy(params.ulink, 16352 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK], 16353 sizeof(params.ulink)); 16354 16355 return rdev_set_ttlm(rdev, dev, ¶ms); 16356 } 16357 16358 #define NL80211_FLAG_NEED_WIPHY 0x01 16359 #define NL80211_FLAG_NEED_NETDEV 0x02 16360 #define NL80211_FLAG_NEED_RTNL 0x04 16361 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 16362 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 16363 NL80211_FLAG_CHECK_NETDEV_UP) 16364 #define NL80211_FLAG_NEED_WDEV 0x10 16365 /* If a netdev is associated, it must be UP, P2P must be started */ 16366 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 16367 NL80211_FLAG_CHECK_NETDEV_UP) 16368 #define NL80211_FLAG_CLEAR_SKB 0x20 16369 #define NL80211_FLAG_NO_WIPHY_MTX 0x40 16370 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80 16371 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100 16372 16373 #define INTERNAL_FLAG_SELECTORS(__sel) \ 16374 SELECTOR(__sel, NONE, 0) /* must be first */ \ 16375 SELECTOR(__sel, WIPHY, \ 16376 NL80211_FLAG_NEED_WIPHY) \ 16377 SELECTOR(__sel, WDEV, \ 16378 NL80211_FLAG_NEED_WDEV) \ 16379 SELECTOR(__sel, NETDEV, \ 16380 NL80211_FLAG_NEED_NETDEV) \ 16381 SELECTOR(__sel, NETDEV_LINK, \ 16382 NL80211_FLAG_NEED_NETDEV | \ 16383 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16384 SELECTOR(__sel, NETDEV_NO_MLO, \ 16385 NL80211_FLAG_NEED_NETDEV | \ 16386 NL80211_FLAG_MLO_UNSUPPORTED) \ 16387 SELECTOR(__sel, WIPHY_RTNL, \ 16388 NL80211_FLAG_NEED_WIPHY | \ 16389 NL80211_FLAG_NEED_RTNL) \ 16390 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \ 16391 NL80211_FLAG_NEED_WIPHY | \ 16392 NL80211_FLAG_NEED_RTNL | \ 16393 NL80211_FLAG_NO_WIPHY_MTX) \ 16394 SELECTOR(__sel, WDEV_RTNL, \ 16395 NL80211_FLAG_NEED_WDEV | \ 16396 NL80211_FLAG_NEED_RTNL) \ 16397 SELECTOR(__sel, NETDEV_RTNL, \ 16398 NL80211_FLAG_NEED_NETDEV | \ 16399 NL80211_FLAG_NEED_RTNL) \ 16400 SELECTOR(__sel, NETDEV_UP, \ 16401 NL80211_FLAG_NEED_NETDEV_UP) \ 16402 SELECTOR(__sel, NETDEV_UP_LINK, \ 16403 NL80211_FLAG_NEED_NETDEV_UP | \ 16404 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16405 SELECTOR(__sel, NETDEV_UP_NO_MLO, \ 16406 NL80211_FLAG_NEED_NETDEV_UP | \ 16407 NL80211_FLAG_MLO_UNSUPPORTED) \ 16408 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \ 16409 NL80211_FLAG_NEED_NETDEV_UP | \ 16410 NL80211_FLAG_CLEAR_SKB | \ 16411 NL80211_FLAG_MLO_UNSUPPORTED) \ 16412 SELECTOR(__sel, NETDEV_UP_NOTMX, \ 16413 NL80211_FLAG_NEED_NETDEV_UP | \ 16414 NL80211_FLAG_NO_WIPHY_MTX) \ 16415 SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO, \ 16416 NL80211_FLAG_NEED_NETDEV_UP | \ 16417 NL80211_FLAG_NO_WIPHY_MTX | \ 16418 NL80211_FLAG_MLO_UNSUPPORTED) \ 16419 SELECTOR(__sel, NETDEV_UP_CLEAR, \ 16420 NL80211_FLAG_NEED_NETDEV_UP | \ 16421 NL80211_FLAG_CLEAR_SKB) \ 16422 SELECTOR(__sel, WDEV_UP, \ 16423 NL80211_FLAG_NEED_WDEV_UP) \ 16424 SELECTOR(__sel, WDEV_UP_LINK, \ 16425 NL80211_FLAG_NEED_WDEV_UP | \ 16426 NL80211_FLAG_MLO_VALID_LINK_ID) \ 16427 SELECTOR(__sel, WDEV_UP_RTNL, \ 16428 NL80211_FLAG_NEED_WDEV_UP | \ 16429 NL80211_FLAG_NEED_RTNL) \ 16430 SELECTOR(__sel, WIPHY_CLEAR, \ 16431 NL80211_FLAG_NEED_WIPHY | \ 16432 NL80211_FLAG_CLEAR_SKB) 16433 16434 enum nl80211_internal_flags_selector { 16435 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name, 16436 INTERNAL_FLAG_SELECTORS(_) 16437 #undef SELECTOR 16438 }; 16439 16440 static u32 nl80211_internal_flags[] = { 16441 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value, 16442 INTERNAL_FLAG_SELECTORS(_) 16443 #undef SELECTOR 16444 }; 16445 16446 static int nl80211_pre_doit(const struct genl_split_ops *ops, 16447 struct sk_buff *skb, 16448 struct genl_info *info) 16449 { 16450 struct cfg80211_registered_device *rdev = NULL; 16451 struct wireless_dev *wdev = NULL; 16452 struct net_device *dev = NULL; 16453 u32 internal_flags; 16454 int err; 16455 16456 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags))) 16457 return -EINVAL; 16458 16459 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16460 16461 rtnl_lock(); 16462 if (internal_flags & NL80211_FLAG_NEED_WIPHY) { 16463 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 16464 if (IS_ERR(rdev)) { 16465 err = PTR_ERR(rdev); 16466 goto out_unlock; 16467 } 16468 info->user_ptr[0] = rdev; 16469 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV || 16470 internal_flags & NL80211_FLAG_NEED_WDEV) { 16471 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info), 16472 info->attrs); 16473 if (IS_ERR(wdev)) { 16474 err = PTR_ERR(wdev); 16475 goto out_unlock; 16476 } 16477 16478 dev = wdev->netdev; 16479 dev_hold(dev); 16480 rdev = wiphy_to_rdev(wdev->wiphy); 16481 16482 if (internal_flags & NL80211_FLAG_NEED_NETDEV) { 16483 if (!dev) { 16484 err = -EINVAL; 16485 goto out_unlock; 16486 } 16487 16488 info->user_ptr[1] = dev; 16489 } else { 16490 info->user_ptr[1] = wdev; 16491 } 16492 16493 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 16494 !wdev_running(wdev)) { 16495 err = -ENETDOWN; 16496 goto out_unlock; 16497 } 16498 16499 info->user_ptr[0] = rdev; 16500 } 16501 16502 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) { 16503 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID]; 16504 16505 if (!wdev) { 16506 err = -EINVAL; 16507 goto out_unlock; 16508 } 16509 16510 /* MLO -> require valid link ID */ 16511 if (wdev->valid_links && 16512 (!link_id || 16513 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) { 16514 err = -EINVAL; 16515 goto out_unlock; 16516 } 16517 16518 /* non-MLO -> no link ID attribute accepted */ 16519 if (!wdev->valid_links && link_id) { 16520 err = -EINVAL; 16521 goto out_unlock; 16522 } 16523 } 16524 16525 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) { 16526 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] || 16527 (wdev && wdev->valid_links)) { 16528 err = -EINVAL; 16529 goto out_unlock; 16530 } 16531 } 16532 16533 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16534 wiphy_lock(&rdev->wiphy); 16535 /* we keep the mutex locked until post_doit */ 16536 __release(&rdev->wiphy.mtx); 16537 } 16538 if (!(internal_flags & NL80211_FLAG_NEED_RTNL)) 16539 rtnl_unlock(); 16540 16541 return 0; 16542 out_unlock: 16543 rtnl_unlock(); 16544 dev_put(dev); 16545 return err; 16546 } 16547 16548 static void nl80211_post_doit(const struct genl_split_ops *ops, 16549 struct sk_buff *skb, 16550 struct genl_info *info) 16551 { 16552 u32 internal_flags = nl80211_internal_flags[ops->internal_flags]; 16553 16554 if (info->user_ptr[1]) { 16555 if (internal_flags & NL80211_FLAG_NEED_WDEV) { 16556 struct wireless_dev *wdev = info->user_ptr[1]; 16557 16558 dev_put(wdev->netdev); 16559 } else { 16560 dev_put(info->user_ptr[1]); 16561 } 16562 } 16563 16564 if (info->user_ptr[0] && 16565 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) { 16566 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16567 16568 /* we kept the mutex locked since pre_doit */ 16569 __acquire(&rdev->wiphy.mtx); 16570 wiphy_unlock(&rdev->wiphy); 16571 } 16572 16573 if (internal_flags & NL80211_FLAG_NEED_RTNL) 16574 rtnl_unlock(); 16575 16576 /* If needed, clear the netlink message payload from the SKB 16577 * as it might contain key data that shouldn't stick around on 16578 * the heap after the SKB is freed. The netlink message header 16579 * is still needed for further processing, so leave it intact. 16580 */ 16581 if (internal_flags & NL80211_FLAG_CLEAR_SKB) { 16582 struct nlmsghdr *nlh = nlmsg_hdr(skb); 16583 16584 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 16585 } 16586 } 16587 16588 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev, 16589 struct cfg80211_sar_specs *sar_specs, 16590 struct nlattr *spec[], int index) 16591 { 16592 u32 range_index, i; 16593 16594 if (!sar_specs || !spec) 16595 return -EINVAL; 16596 16597 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] || 16598 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]) 16599 return -EINVAL; 16600 16601 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]); 16602 16603 /* check if range_index exceeds num_freq_ranges */ 16604 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges) 16605 return -EINVAL; 16606 16607 /* check if range_index duplicates */ 16608 for (i = 0; i < index; i++) { 16609 if (sar_specs->sub_specs[i].freq_range_index == range_index) 16610 return -EINVAL; 16611 } 16612 16613 sar_specs->sub_specs[index].power = 16614 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]); 16615 16616 sar_specs->sub_specs[index].freq_range_index = range_index; 16617 16618 return 0; 16619 } 16620 16621 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) 16622 { 16623 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 16624 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1]; 16625 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1]; 16626 struct cfg80211_sar_specs *sar_spec; 16627 enum nl80211_sar_type type; 16628 struct nlattr *spec_list; 16629 u32 specs; 16630 int rem, err; 16631 16632 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs) 16633 return -EOPNOTSUPP; 16634 16635 if (!info->attrs[NL80211_ATTR_SAR_SPEC]) 16636 return -EINVAL; 16637 16638 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX, 16639 info->attrs[NL80211_ATTR_SAR_SPEC], 16640 NULL, NULL); 16641 16642 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS]) 16643 return -EINVAL; 16644 16645 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]); 16646 if (type != rdev->wiphy.sar_capa->type) 16647 return -EINVAL; 16648 16649 specs = 0; 16650 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) 16651 specs++; 16652 16653 if (specs > rdev->wiphy.sar_capa->num_freq_ranges) 16654 return -EINVAL; 16655 16656 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL); 16657 if (!sar_spec) 16658 return -ENOMEM; 16659 16660 sar_spec->type = type; 16661 specs = 0; 16662 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) { 16663 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX, 16664 spec_list, NULL, NULL); 16665 16666 switch (type) { 16667 case NL80211_SAR_TYPE_POWER: 16668 if (nl80211_set_sar_sub_specs(rdev, sar_spec, 16669 spec, specs)) { 16670 err = -EINVAL; 16671 goto error; 16672 } 16673 break; 16674 default: 16675 err = -EINVAL; 16676 goto error; 16677 } 16678 specs++; 16679 } 16680 16681 sar_spec->num_sub_specs = specs; 16682 16683 rdev->cur_cmd_info = info; 16684 err = rdev_set_sar_specs(rdev, sar_spec); 16685 rdev->cur_cmd_info = NULL; 16686 error: 16687 kfree(sar_spec); 16688 return err; 16689 } 16690 16691 #define SELECTOR(__sel, name, value) \ 16692 ((__sel) == (value)) ? NL80211_IFL_SEL_##name : 16693 int __missing_selector(void); 16694 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector() 16695 16696 static const struct genl_ops nl80211_ops[] = { 16697 { 16698 .cmd = NL80211_CMD_GET_WIPHY, 16699 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16700 .doit = nl80211_get_wiphy, 16701 .dumpit = nl80211_dump_wiphy, 16702 .done = nl80211_dump_wiphy_done, 16703 /* can be retrieved by unprivileged users */ 16704 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 16705 }, 16706 }; 16707 16708 static const struct genl_small_ops nl80211_small_ops[] = { 16709 { 16710 .cmd = NL80211_CMD_SET_WIPHY, 16711 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16712 .doit = nl80211_set_wiphy, 16713 .flags = GENL_UNS_ADMIN_PERM, 16714 }, 16715 { 16716 .cmd = NL80211_CMD_GET_INTERFACE, 16717 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16718 .doit = nl80211_get_interface, 16719 .dumpit = nl80211_dump_interface, 16720 /* can be retrieved by unprivileged users */ 16721 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 16722 }, 16723 { 16724 .cmd = NL80211_CMD_SET_INTERFACE, 16725 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16726 .doit = nl80211_set_interface, 16727 .flags = GENL_UNS_ADMIN_PERM, 16728 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 16729 NL80211_FLAG_NEED_RTNL), 16730 }, 16731 { 16732 .cmd = NL80211_CMD_NEW_INTERFACE, 16733 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16734 .doit = nl80211_new_interface, 16735 .flags = GENL_UNS_ADMIN_PERM, 16736 .internal_flags = 16737 IFLAGS(NL80211_FLAG_NEED_WIPHY | 16738 NL80211_FLAG_NEED_RTNL | 16739 /* we take the wiphy mutex later ourselves */ 16740 NL80211_FLAG_NO_WIPHY_MTX), 16741 }, 16742 { 16743 .cmd = NL80211_CMD_DEL_INTERFACE, 16744 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16745 .doit = nl80211_del_interface, 16746 .flags = GENL_UNS_ADMIN_PERM, 16747 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 16748 NL80211_FLAG_NEED_RTNL), 16749 }, 16750 { 16751 .cmd = NL80211_CMD_GET_KEY, 16752 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16753 .doit = nl80211_get_key, 16754 .flags = GENL_UNS_ADMIN_PERM, 16755 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16756 }, 16757 { 16758 .cmd = NL80211_CMD_SET_KEY, 16759 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16760 .doit = nl80211_set_key, 16761 .flags = GENL_UNS_ADMIN_PERM, 16762 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */ 16763 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16764 NL80211_FLAG_CLEAR_SKB), 16765 }, 16766 { 16767 .cmd = NL80211_CMD_NEW_KEY, 16768 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16769 .doit = nl80211_new_key, 16770 .flags = GENL_UNS_ADMIN_PERM, 16771 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16772 NL80211_FLAG_CLEAR_SKB), 16773 }, 16774 { 16775 .cmd = NL80211_CMD_DEL_KEY, 16776 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16777 .doit = nl80211_del_key, 16778 .flags = GENL_UNS_ADMIN_PERM, 16779 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16780 }, 16781 { 16782 .cmd = NL80211_CMD_SET_BEACON, 16783 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16784 .flags = GENL_UNS_ADMIN_PERM, 16785 .doit = nl80211_set_beacon, 16786 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16787 NL80211_FLAG_MLO_VALID_LINK_ID), 16788 }, 16789 { 16790 .cmd = NL80211_CMD_START_AP, 16791 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16792 .flags = GENL_UNS_ADMIN_PERM, 16793 .doit = nl80211_start_ap, 16794 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16795 NL80211_FLAG_MLO_VALID_LINK_ID), 16796 }, 16797 { 16798 .cmd = NL80211_CMD_STOP_AP, 16799 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16800 .flags = GENL_UNS_ADMIN_PERM, 16801 .doit = nl80211_stop_ap, 16802 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16803 NL80211_FLAG_MLO_VALID_LINK_ID), 16804 }, 16805 { 16806 .cmd = NL80211_CMD_GET_STATION, 16807 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16808 .doit = nl80211_get_station, 16809 .dumpit = nl80211_dump_station, 16810 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 16811 }, 16812 { 16813 .cmd = NL80211_CMD_SET_STATION, 16814 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16815 .doit = nl80211_set_station, 16816 .flags = GENL_UNS_ADMIN_PERM, 16817 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16818 }, 16819 { 16820 .cmd = NL80211_CMD_NEW_STATION, 16821 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16822 .doit = nl80211_new_station, 16823 .flags = GENL_UNS_ADMIN_PERM, 16824 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16825 }, 16826 { 16827 .cmd = NL80211_CMD_DEL_STATION, 16828 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16829 .doit = nl80211_del_station, 16830 .flags = GENL_UNS_ADMIN_PERM, 16831 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16832 }, 16833 { 16834 .cmd = NL80211_CMD_GET_MPATH, 16835 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16836 .doit = nl80211_get_mpath, 16837 .dumpit = nl80211_dump_mpath, 16838 .flags = GENL_UNS_ADMIN_PERM, 16839 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16840 }, 16841 { 16842 .cmd = NL80211_CMD_GET_MPP, 16843 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16844 .doit = nl80211_get_mpp, 16845 .dumpit = nl80211_dump_mpp, 16846 .flags = GENL_UNS_ADMIN_PERM, 16847 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16848 }, 16849 { 16850 .cmd = NL80211_CMD_SET_MPATH, 16851 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16852 .doit = nl80211_set_mpath, 16853 .flags = GENL_UNS_ADMIN_PERM, 16854 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16855 }, 16856 { 16857 .cmd = NL80211_CMD_NEW_MPATH, 16858 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16859 .doit = nl80211_new_mpath, 16860 .flags = GENL_UNS_ADMIN_PERM, 16861 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16862 }, 16863 { 16864 .cmd = NL80211_CMD_DEL_MPATH, 16865 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16866 .doit = nl80211_del_mpath, 16867 .flags = GENL_UNS_ADMIN_PERM, 16868 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16869 }, 16870 { 16871 .cmd = NL80211_CMD_SET_BSS, 16872 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16873 .doit = nl80211_set_bss, 16874 .flags = GENL_UNS_ADMIN_PERM, 16875 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16876 NL80211_FLAG_MLO_VALID_LINK_ID), 16877 }, 16878 { 16879 .cmd = NL80211_CMD_GET_REG, 16880 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16881 .doit = nl80211_get_reg_do, 16882 .dumpit = nl80211_get_reg_dump, 16883 /* can be retrieved by unprivileged users */ 16884 }, 16885 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 16886 { 16887 .cmd = NL80211_CMD_SET_REG, 16888 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16889 .doit = nl80211_set_reg, 16890 .flags = GENL_ADMIN_PERM, 16891 }, 16892 #endif 16893 { 16894 .cmd = NL80211_CMD_REQ_SET_REG, 16895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16896 .doit = nl80211_req_set_reg, 16897 .flags = GENL_ADMIN_PERM, 16898 }, 16899 { 16900 .cmd = NL80211_CMD_RELOAD_REGDB, 16901 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16902 .doit = nl80211_reload_regdb, 16903 .flags = GENL_ADMIN_PERM, 16904 }, 16905 { 16906 .cmd = NL80211_CMD_GET_MESH_CONFIG, 16907 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16908 .doit = nl80211_get_mesh_config, 16909 /* can be retrieved by unprivileged users */ 16910 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16911 }, 16912 { 16913 .cmd = NL80211_CMD_SET_MESH_CONFIG, 16914 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16915 .doit = nl80211_update_mesh_config, 16916 .flags = GENL_UNS_ADMIN_PERM, 16917 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16918 }, 16919 { 16920 .cmd = NL80211_CMD_TRIGGER_SCAN, 16921 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16922 .doit = nl80211_trigger_scan, 16923 .flags = GENL_UNS_ADMIN_PERM, 16924 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16925 }, 16926 { 16927 .cmd = NL80211_CMD_ABORT_SCAN, 16928 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16929 .doit = nl80211_abort_scan, 16930 .flags = GENL_UNS_ADMIN_PERM, 16931 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 16932 }, 16933 { 16934 .cmd = NL80211_CMD_GET_SCAN, 16935 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16936 .dumpit = nl80211_dump_scan, 16937 }, 16938 { 16939 .cmd = NL80211_CMD_START_SCHED_SCAN, 16940 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16941 .doit = nl80211_start_sched_scan, 16942 .flags = GENL_UNS_ADMIN_PERM, 16943 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16944 }, 16945 { 16946 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 16947 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16948 .doit = nl80211_stop_sched_scan, 16949 .flags = GENL_UNS_ADMIN_PERM, 16950 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16951 }, 16952 { 16953 .cmd = NL80211_CMD_AUTHENTICATE, 16954 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16955 .doit = nl80211_authenticate, 16956 .flags = GENL_UNS_ADMIN_PERM, 16957 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16958 NL80211_FLAG_CLEAR_SKB), 16959 }, 16960 { 16961 .cmd = NL80211_CMD_ASSOCIATE, 16962 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16963 .doit = nl80211_associate, 16964 .flags = GENL_UNS_ADMIN_PERM, 16965 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 16966 NL80211_FLAG_CLEAR_SKB), 16967 }, 16968 { 16969 .cmd = NL80211_CMD_DEAUTHENTICATE, 16970 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16971 .doit = nl80211_deauthenticate, 16972 .flags = GENL_UNS_ADMIN_PERM, 16973 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16974 }, 16975 { 16976 .cmd = NL80211_CMD_DISASSOCIATE, 16977 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16978 .doit = nl80211_disassociate, 16979 .flags = GENL_UNS_ADMIN_PERM, 16980 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16981 }, 16982 { 16983 .cmd = NL80211_CMD_JOIN_IBSS, 16984 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16985 .doit = nl80211_join_ibss, 16986 .flags = GENL_UNS_ADMIN_PERM, 16987 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16988 }, 16989 { 16990 .cmd = NL80211_CMD_LEAVE_IBSS, 16991 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 16992 .doit = nl80211_leave_ibss, 16993 .flags = GENL_UNS_ADMIN_PERM, 16994 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 16995 }, 16996 #ifdef CONFIG_NL80211_TESTMODE 16997 { 16998 .cmd = NL80211_CMD_TESTMODE, 16999 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17000 .doit = nl80211_testmode_do, 17001 .dumpit = nl80211_testmode_dump, 17002 .flags = GENL_UNS_ADMIN_PERM, 17003 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17004 }, 17005 #endif 17006 { 17007 .cmd = NL80211_CMD_CONNECT, 17008 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17009 .doit = nl80211_connect, 17010 .flags = GENL_UNS_ADMIN_PERM, 17011 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17012 NL80211_FLAG_CLEAR_SKB), 17013 }, 17014 { 17015 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 17016 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17017 .doit = nl80211_update_connect_params, 17018 .flags = GENL_ADMIN_PERM, 17019 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17020 NL80211_FLAG_CLEAR_SKB), 17021 }, 17022 { 17023 .cmd = NL80211_CMD_DISCONNECT, 17024 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17025 .doit = nl80211_disconnect, 17026 .flags = GENL_UNS_ADMIN_PERM, 17027 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17028 }, 17029 { 17030 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 17031 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17032 .doit = nl80211_wiphy_netns, 17033 .flags = GENL_UNS_ADMIN_PERM, 17034 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17035 NL80211_FLAG_NEED_RTNL | 17036 NL80211_FLAG_NO_WIPHY_MTX), 17037 }, 17038 { 17039 .cmd = NL80211_CMD_GET_SURVEY, 17040 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17041 .dumpit = nl80211_dump_survey, 17042 }, 17043 { 17044 .cmd = NL80211_CMD_SET_PMKSA, 17045 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17046 .doit = nl80211_set_pmksa, 17047 .flags = GENL_UNS_ADMIN_PERM, 17048 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17049 NL80211_FLAG_CLEAR_SKB), 17050 }, 17051 { 17052 .cmd = NL80211_CMD_DEL_PMKSA, 17053 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17054 .doit = nl80211_del_pmksa, 17055 .flags = GENL_UNS_ADMIN_PERM, 17056 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17057 }, 17058 { 17059 .cmd = NL80211_CMD_FLUSH_PMKSA, 17060 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17061 .doit = nl80211_flush_pmksa, 17062 .flags = GENL_UNS_ADMIN_PERM, 17063 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17064 }, 17065 { 17066 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 17067 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17068 .doit = nl80211_remain_on_channel, 17069 .flags = GENL_UNS_ADMIN_PERM, 17070 /* FIXME: requiring a link ID here is probably not good */ 17071 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17072 NL80211_FLAG_MLO_VALID_LINK_ID), 17073 }, 17074 { 17075 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 17076 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17077 .doit = nl80211_cancel_remain_on_channel, 17078 .flags = GENL_UNS_ADMIN_PERM, 17079 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17080 }, 17081 { 17082 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 17083 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17084 .doit = nl80211_set_tx_bitrate_mask, 17085 .flags = GENL_UNS_ADMIN_PERM, 17086 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17087 NL80211_FLAG_MLO_VALID_LINK_ID), 17088 }, 17089 { 17090 .cmd = NL80211_CMD_REGISTER_FRAME, 17091 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17092 .doit = nl80211_register_mgmt, 17093 .flags = GENL_UNS_ADMIN_PERM, 17094 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV), 17095 }, 17096 { 17097 .cmd = NL80211_CMD_FRAME, 17098 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17099 .doit = nl80211_tx_mgmt, 17100 .flags = GENL_UNS_ADMIN_PERM, 17101 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17102 }, 17103 { 17104 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 17105 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17106 .doit = nl80211_tx_mgmt_cancel_wait, 17107 .flags = GENL_UNS_ADMIN_PERM, 17108 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17109 }, 17110 { 17111 .cmd = NL80211_CMD_SET_POWER_SAVE, 17112 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17113 .doit = nl80211_set_power_save, 17114 .flags = GENL_UNS_ADMIN_PERM, 17115 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17116 }, 17117 { 17118 .cmd = NL80211_CMD_GET_POWER_SAVE, 17119 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17120 .doit = nl80211_get_power_save, 17121 /* can be retrieved by unprivileged users */ 17122 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17123 }, 17124 { 17125 .cmd = NL80211_CMD_SET_CQM, 17126 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17127 .doit = nl80211_set_cqm, 17128 .flags = GENL_UNS_ADMIN_PERM, 17129 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17130 }, 17131 { 17132 .cmd = NL80211_CMD_SET_CHANNEL, 17133 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17134 .doit = nl80211_set_channel, 17135 .flags = GENL_UNS_ADMIN_PERM, 17136 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17137 NL80211_FLAG_MLO_VALID_LINK_ID), 17138 }, 17139 { 17140 .cmd = NL80211_CMD_JOIN_MESH, 17141 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17142 .doit = nl80211_join_mesh, 17143 .flags = GENL_UNS_ADMIN_PERM, 17144 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17145 }, 17146 { 17147 .cmd = NL80211_CMD_LEAVE_MESH, 17148 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17149 .doit = nl80211_leave_mesh, 17150 .flags = GENL_UNS_ADMIN_PERM, 17151 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17152 }, 17153 { 17154 .cmd = NL80211_CMD_JOIN_OCB, 17155 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17156 .doit = nl80211_join_ocb, 17157 .flags = GENL_UNS_ADMIN_PERM, 17158 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17159 }, 17160 { 17161 .cmd = NL80211_CMD_LEAVE_OCB, 17162 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17163 .doit = nl80211_leave_ocb, 17164 .flags = GENL_UNS_ADMIN_PERM, 17165 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17166 }, 17167 #ifdef CONFIG_PM 17168 { 17169 .cmd = NL80211_CMD_GET_WOWLAN, 17170 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17171 .doit = nl80211_get_wowlan, 17172 /* can be retrieved by unprivileged users */ 17173 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17174 }, 17175 { 17176 .cmd = NL80211_CMD_SET_WOWLAN, 17177 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17178 .doit = nl80211_set_wowlan, 17179 .flags = GENL_UNS_ADMIN_PERM, 17180 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17181 }, 17182 #endif 17183 { 17184 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 17185 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17186 .doit = nl80211_set_rekey_data, 17187 .flags = GENL_UNS_ADMIN_PERM, 17188 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17189 NL80211_FLAG_CLEAR_SKB), 17190 }, 17191 { 17192 .cmd = NL80211_CMD_TDLS_MGMT, 17193 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17194 .doit = nl80211_tdls_mgmt, 17195 .flags = GENL_UNS_ADMIN_PERM, 17196 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17197 NL80211_FLAG_MLO_VALID_LINK_ID), 17198 }, 17199 { 17200 .cmd = NL80211_CMD_TDLS_OPER, 17201 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17202 .doit = nl80211_tdls_oper, 17203 .flags = GENL_UNS_ADMIN_PERM, 17204 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17205 }, 17206 { 17207 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 17208 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17209 .doit = nl80211_register_unexpected_frame, 17210 .flags = GENL_UNS_ADMIN_PERM, 17211 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17212 }, 17213 { 17214 .cmd = NL80211_CMD_PROBE_CLIENT, 17215 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17216 .doit = nl80211_probe_client, 17217 .flags = GENL_UNS_ADMIN_PERM, 17218 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17219 }, 17220 { 17221 .cmd = NL80211_CMD_REGISTER_BEACONS, 17222 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17223 .doit = nl80211_register_beacons, 17224 .flags = GENL_UNS_ADMIN_PERM, 17225 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17226 }, 17227 { 17228 .cmd = NL80211_CMD_SET_NOACK_MAP, 17229 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17230 .doit = nl80211_set_noack_map, 17231 .flags = GENL_UNS_ADMIN_PERM, 17232 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17233 }, 17234 { 17235 .cmd = NL80211_CMD_START_P2P_DEVICE, 17236 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17237 .doit = nl80211_start_p2p_device, 17238 .flags = GENL_UNS_ADMIN_PERM, 17239 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17240 NL80211_FLAG_NEED_RTNL), 17241 }, 17242 { 17243 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 17244 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17245 .doit = nl80211_stop_p2p_device, 17246 .flags = GENL_UNS_ADMIN_PERM, 17247 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17248 NL80211_FLAG_NEED_RTNL), 17249 }, 17250 { 17251 .cmd = NL80211_CMD_START_NAN, 17252 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17253 .doit = nl80211_start_nan, 17254 .flags = GENL_ADMIN_PERM, 17255 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV | 17256 NL80211_FLAG_NEED_RTNL), 17257 }, 17258 { 17259 .cmd = NL80211_CMD_STOP_NAN, 17260 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17261 .doit = nl80211_stop_nan, 17262 .flags = GENL_ADMIN_PERM, 17263 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP | 17264 NL80211_FLAG_NEED_RTNL), 17265 }, 17266 { 17267 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 17268 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17269 .doit = nl80211_nan_add_func, 17270 .flags = GENL_ADMIN_PERM, 17271 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17272 }, 17273 { 17274 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 17275 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17276 .doit = nl80211_nan_del_func, 17277 .flags = GENL_ADMIN_PERM, 17278 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17279 }, 17280 { 17281 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 17282 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17283 .doit = nl80211_nan_change_config, 17284 .flags = GENL_ADMIN_PERM, 17285 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17286 }, 17287 { 17288 .cmd = NL80211_CMD_SET_MCAST_RATE, 17289 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17290 .doit = nl80211_set_mcast_rate, 17291 .flags = GENL_UNS_ADMIN_PERM, 17292 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17293 }, 17294 { 17295 .cmd = NL80211_CMD_SET_MAC_ACL, 17296 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17297 .doit = nl80211_set_mac_acl, 17298 .flags = GENL_UNS_ADMIN_PERM, 17299 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17300 NL80211_FLAG_MLO_UNSUPPORTED), 17301 }, 17302 { 17303 .cmd = NL80211_CMD_RADAR_DETECT, 17304 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17305 .doit = nl80211_start_radar_detection, 17306 .flags = GENL_UNS_ADMIN_PERM, 17307 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17308 NL80211_FLAG_NO_WIPHY_MTX | 17309 NL80211_FLAG_MLO_UNSUPPORTED), 17310 }, 17311 { 17312 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 17313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17314 .doit = nl80211_get_protocol_features, 17315 }, 17316 { 17317 .cmd = NL80211_CMD_UPDATE_FT_IES, 17318 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17319 .doit = nl80211_update_ft_ies, 17320 .flags = GENL_UNS_ADMIN_PERM, 17321 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17322 }, 17323 { 17324 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 17325 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17326 .doit = nl80211_crit_protocol_start, 17327 .flags = GENL_UNS_ADMIN_PERM, 17328 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17329 }, 17330 { 17331 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 17332 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17333 .doit = nl80211_crit_protocol_stop, 17334 .flags = GENL_UNS_ADMIN_PERM, 17335 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17336 }, 17337 { 17338 .cmd = NL80211_CMD_GET_COALESCE, 17339 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17340 .doit = nl80211_get_coalesce, 17341 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17342 }, 17343 { 17344 .cmd = NL80211_CMD_SET_COALESCE, 17345 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17346 .doit = nl80211_set_coalesce, 17347 .flags = GENL_UNS_ADMIN_PERM, 17348 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY), 17349 }, 17350 { 17351 .cmd = NL80211_CMD_CHANNEL_SWITCH, 17352 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17353 .doit = nl80211_channel_switch, 17354 .flags = GENL_UNS_ADMIN_PERM, 17355 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17356 NL80211_FLAG_MLO_VALID_LINK_ID), 17357 }, 17358 { 17359 .cmd = NL80211_CMD_VENDOR, 17360 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17361 .doit = nl80211_vendor_cmd, 17362 .dumpit = nl80211_vendor_cmd_dump, 17363 .flags = GENL_UNS_ADMIN_PERM, 17364 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17365 NL80211_FLAG_CLEAR_SKB), 17366 }, 17367 { 17368 .cmd = NL80211_CMD_SET_QOS_MAP, 17369 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17370 .doit = nl80211_set_qos_map, 17371 .flags = GENL_UNS_ADMIN_PERM, 17372 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17373 }, 17374 { 17375 .cmd = NL80211_CMD_ADD_TX_TS, 17376 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17377 .doit = nl80211_add_tx_ts, 17378 .flags = GENL_UNS_ADMIN_PERM, 17379 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17380 NL80211_FLAG_MLO_UNSUPPORTED), 17381 }, 17382 { 17383 .cmd = NL80211_CMD_DEL_TX_TS, 17384 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17385 .doit = nl80211_del_tx_ts, 17386 .flags = GENL_UNS_ADMIN_PERM, 17387 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17388 }, 17389 { 17390 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 17391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17392 .doit = nl80211_tdls_channel_switch, 17393 .flags = GENL_UNS_ADMIN_PERM, 17394 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17395 }, 17396 { 17397 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 17398 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17399 .doit = nl80211_tdls_cancel_channel_switch, 17400 .flags = GENL_UNS_ADMIN_PERM, 17401 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17402 }, 17403 { 17404 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 17405 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17406 .doit = nl80211_set_multicast_to_unicast, 17407 .flags = GENL_UNS_ADMIN_PERM, 17408 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV), 17409 }, 17410 { 17411 .cmd = NL80211_CMD_SET_PMK, 17412 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17413 .doit = nl80211_set_pmk, 17414 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17415 NL80211_FLAG_CLEAR_SKB), 17416 }, 17417 { 17418 .cmd = NL80211_CMD_DEL_PMK, 17419 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17420 .doit = nl80211_del_pmk, 17421 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17422 }, 17423 { 17424 .cmd = NL80211_CMD_EXTERNAL_AUTH, 17425 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17426 .doit = nl80211_external_auth, 17427 .flags = GENL_ADMIN_PERM, 17428 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17429 }, 17430 { 17431 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 17432 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17433 .doit = nl80211_tx_control_port, 17434 .flags = GENL_UNS_ADMIN_PERM, 17435 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17436 }, 17437 { 17438 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 17439 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17440 .doit = nl80211_get_ftm_responder_stats, 17441 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17442 NL80211_FLAG_MLO_VALID_LINK_ID), 17443 }, 17444 { 17445 .cmd = NL80211_CMD_PEER_MEASUREMENT_START, 17446 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17447 .doit = nl80211_pmsr_start, 17448 .flags = GENL_UNS_ADMIN_PERM, 17449 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP), 17450 }, 17451 { 17452 .cmd = NL80211_CMD_NOTIFY_RADAR, 17453 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17454 .doit = nl80211_notify_radar_detection, 17455 .flags = GENL_UNS_ADMIN_PERM, 17456 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17457 }, 17458 { 17459 .cmd = NL80211_CMD_UPDATE_OWE_INFO, 17460 .doit = nl80211_update_owe_info, 17461 .flags = GENL_ADMIN_PERM, 17462 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17463 }, 17464 { 17465 .cmd = NL80211_CMD_PROBE_MESH_LINK, 17466 .doit = nl80211_probe_mesh_link, 17467 .flags = GENL_UNS_ADMIN_PERM, 17468 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17469 }, 17470 { 17471 .cmd = NL80211_CMD_SET_TID_CONFIG, 17472 .doit = nl80211_set_tid_config, 17473 .flags = GENL_UNS_ADMIN_PERM, 17474 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV | 17475 NL80211_FLAG_MLO_VALID_LINK_ID), 17476 }, 17477 { 17478 .cmd = NL80211_CMD_SET_SAR_SPECS, 17479 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17480 .doit = nl80211_set_sar_specs, 17481 .flags = GENL_UNS_ADMIN_PERM, 17482 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY | 17483 NL80211_FLAG_NEED_RTNL), 17484 }, 17485 { 17486 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST, 17487 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17488 .doit = nl80211_color_change, 17489 .flags = GENL_UNS_ADMIN_PERM, 17490 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17491 }, 17492 { 17493 .cmd = NL80211_CMD_SET_FILS_AAD, 17494 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 17495 .doit = nl80211_set_fils_aad, 17496 .flags = GENL_UNS_ADMIN_PERM, 17497 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17498 }, 17499 { 17500 .cmd = NL80211_CMD_ADD_LINK, 17501 .doit = nl80211_add_link, 17502 .flags = GENL_UNS_ADMIN_PERM, 17503 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17504 }, 17505 { 17506 .cmd = NL80211_CMD_REMOVE_LINK, 17507 .doit = nl80211_remove_link, 17508 .flags = GENL_UNS_ADMIN_PERM, 17509 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17510 NL80211_FLAG_MLO_VALID_LINK_ID), 17511 }, 17512 { 17513 .cmd = NL80211_CMD_ADD_LINK_STA, 17514 .doit = nl80211_add_link_station, 17515 .flags = GENL_UNS_ADMIN_PERM, 17516 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17517 NL80211_FLAG_MLO_VALID_LINK_ID), 17518 }, 17519 { 17520 .cmd = NL80211_CMD_MODIFY_LINK_STA, 17521 .doit = nl80211_modify_link_station, 17522 .flags = GENL_UNS_ADMIN_PERM, 17523 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17524 NL80211_FLAG_MLO_VALID_LINK_ID), 17525 }, 17526 { 17527 .cmd = NL80211_CMD_REMOVE_LINK_STA, 17528 .doit = nl80211_remove_link_station, 17529 .flags = GENL_UNS_ADMIN_PERM, 17530 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP | 17531 NL80211_FLAG_MLO_VALID_LINK_ID), 17532 }, 17533 { 17534 .cmd = NL80211_CMD_SET_HW_TIMESTAMP, 17535 .doit = nl80211_set_hw_timestamp, 17536 .flags = GENL_UNS_ADMIN_PERM, 17537 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17538 }, 17539 { 17540 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING, 17541 .doit = nl80211_set_ttlm, 17542 .flags = GENL_UNS_ADMIN_PERM, 17543 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP), 17544 }, 17545 }; 17546 17547 static struct genl_family nl80211_fam __ro_after_init = { 17548 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 17549 .hdrsize = 0, /* no private header */ 17550 .version = 1, /* no particular meaning now */ 17551 .maxattr = NL80211_ATTR_MAX, 17552 .policy = nl80211_policy, 17553 .netnsok = true, 17554 .pre_doit = nl80211_pre_doit, 17555 .post_doit = nl80211_post_doit, 17556 .module = THIS_MODULE, 17557 .ops = nl80211_ops, 17558 .n_ops = ARRAY_SIZE(nl80211_ops), 17559 .small_ops = nl80211_small_ops, 17560 .n_small_ops = ARRAY_SIZE(nl80211_small_ops), 17561 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1, 17562 .mcgrps = nl80211_mcgrps, 17563 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 17564 .parallel_ops = true, 17565 }; 17566 17567 /* notification functions */ 17568 17569 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 17570 enum nl80211_commands cmd) 17571 { 17572 struct sk_buff *msg; 17573 struct nl80211_dump_wiphy_state state = {}; 17574 17575 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 17576 cmd != NL80211_CMD_DEL_WIPHY); 17577 17578 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17579 if (!msg) 17580 return; 17581 17582 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 17583 nlmsg_free(msg); 17584 return; 17585 } 17586 17587 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17588 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17589 } 17590 17591 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 17592 struct wireless_dev *wdev, 17593 enum nl80211_commands cmd) 17594 { 17595 struct sk_buff *msg; 17596 17597 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17598 if (!msg) 17599 return; 17600 17601 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) { 17602 nlmsg_free(msg); 17603 return; 17604 } 17605 17606 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17607 NL80211_MCGRP_CONFIG, GFP_KERNEL); 17608 } 17609 17610 static int nl80211_add_scan_req(struct sk_buff *msg, 17611 struct cfg80211_registered_device *rdev) 17612 { 17613 struct cfg80211_scan_request *req = rdev->scan_req; 17614 struct nlattr *nest; 17615 int i; 17616 struct cfg80211_scan_info *info; 17617 17618 if (WARN_ON(!req)) 17619 return 0; 17620 17621 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS); 17622 if (!nest) 17623 goto nla_put_failure; 17624 for (i = 0; i < req->n_ssids; i++) { 17625 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 17626 goto nla_put_failure; 17627 } 17628 nla_nest_end(msg, nest); 17629 17630 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) { 17631 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ); 17632 if (!nest) 17633 goto nla_put_failure; 17634 for (i = 0; i < req->n_channels; i++) { 17635 if (nla_put_u32(msg, i, 17636 ieee80211_channel_to_khz(req->channels[i]))) 17637 goto nla_put_failure; 17638 } 17639 nla_nest_end(msg, nest); 17640 } else { 17641 nest = nla_nest_start_noflag(msg, 17642 NL80211_ATTR_SCAN_FREQUENCIES); 17643 if (!nest) 17644 goto nla_put_failure; 17645 for (i = 0; i < req->n_channels; i++) { 17646 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 17647 goto nla_put_failure; 17648 } 17649 nla_nest_end(msg, nest); 17650 } 17651 17652 if (req->ie && 17653 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 17654 goto nla_put_failure; 17655 17656 if (req->flags && 17657 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 17658 goto nla_put_failure; 17659 17660 info = rdev->int_scan_req ? &rdev->int_scan_req->info : 17661 &rdev->scan_req->info; 17662 if (info->scan_start_tsf && 17663 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 17664 info->scan_start_tsf, NL80211_BSS_PAD) || 17665 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 17666 info->tsf_bssid))) 17667 goto nla_put_failure; 17668 17669 return 0; 17670 nla_put_failure: 17671 return -ENOBUFS; 17672 } 17673 17674 static int nl80211_prep_scan_msg(struct sk_buff *msg, 17675 struct cfg80211_registered_device *rdev, 17676 struct wireless_dev *wdev, 17677 u32 portid, u32 seq, int flags, 17678 u32 cmd) 17679 { 17680 void *hdr; 17681 17682 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 17683 if (!hdr) 17684 return -1; 17685 17686 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17687 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 17688 wdev->netdev->ifindex)) || 17689 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 17690 NL80211_ATTR_PAD)) 17691 goto nla_put_failure; 17692 17693 /* ignore errors and send incomplete event anyway */ 17694 nl80211_add_scan_req(msg, rdev); 17695 17696 genlmsg_end(msg, hdr); 17697 return 0; 17698 17699 nla_put_failure: 17700 genlmsg_cancel(msg, hdr); 17701 return -EMSGSIZE; 17702 } 17703 17704 static int 17705 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 17706 struct cfg80211_sched_scan_request *req, u32 cmd) 17707 { 17708 void *hdr; 17709 17710 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 17711 if (!hdr) 17712 return -1; 17713 17714 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 17715 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 17716 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 17717 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 17718 NL80211_ATTR_PAD)) 17719 goto nla_put_failure; 17720 17721 genlmsg_end(msg, hdr); 17722 return 0; 17723 17724 nla_put_failure: 17725 genlmsg_cancel(msg, hdr); 17726 return -EMSGSIZE; 17727 } 17728 17729 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 17730 struct wireless_dev *wdev) 17731 { 17732 struct sk_buff *msg; 17733 17734 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17735 if (!msg) 17736 return; 17737 17738 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17739 NL80211_CMD_TRIGGER_SCAN) < 0) { 17740 nlmsg_free(msg); 17741 return; 17742 } 17743 17744 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17745 NL80211_MCGRP_SCAN, GFP_KERNEL); 17746 } 17747 17748 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 17749 struct wireless_dev *wdev, bool aborted) 17750 { 17751 struct sk_buff *msg; 17752 17753 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17754 if (!msg) 17755 return NULL; 17756 17757 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 17758 aborted ? NL80211_CMD_SCAN_ABORTED : 17759 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 17760 nlmsg_free(msg); 17761 return NULL; 17762 } 17763 17764 return msg; 17765 } 17766 17767 /* send message created by nl80211_build_scan_msg() */ 17768 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 17769 struct sk_buff *msg) 17770 { 17771 if (!msg) 17772 return; 17773 17774 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17775 NL80211_MCGRP_SCAN, GFP_KERNEL); 17776 } 17777 17778 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 17779 { 17780 struct sk_buff *msg; 17781 17782 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17783 if (!msg) 17784 return; 17785 17786 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 17787 nlmsg_free(msg); 17788 return; 17789 } 17790 17791 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 17792 NL80211_MCGRP_SCAN, GFP_KERNEL); 17793 } 17794 17795 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 17796 struct regulatory_request *request) 17797 { 17798 /* Userspace can always count this one always being set */ 17799 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 17800 goto nla_put_failure; 17801 17802 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 17803 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17804 NL80211_REGDOM_TYPE_WORLD)) 17805 goto nla_put_failure; 17806 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 17807 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17808 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 17809 goto nla_put_failure; 17810 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 17811 request->intersect) { 17812 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17813 NL80211_REGDOM_TYPE_INTERSECTION)) 17814 goto nla_put_failure; 17815 } else { 17816 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 17817 NL80211_REGDOM_TYPE_COUNTRY) || 17818 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 17819 request->alpha2)) 17820 goto nla_put_failure; 17821 } 17822 17823 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 17824 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 17825 17826 if (wiphy && 17827 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 17828 goto nla_put_failure; 17829 17830 if (wiphy && 17831 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 17832 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 17833 goto nla_put_failure; 17834 } 17835 17836 return true; 17837 17838 nla_put_failure: 17839 return false; 17840 } 17841 17842 /* 17843 * This can happen on global regulatory changes or device specific settings 17844 * based on custom regulatory domains. 17845 */ 17846 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 17847 struct regulatory_request *request) 17848 { 17849 struct sk_buff *msg; 17850 void *hdr; 17851 17852 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 17853 if (!msg) 17854 return; 17855 17856 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 17857 if (!hdr) 17858 goto nla_put_failure; 17859 17860 if (!nl80211_reg_change_event_fill(msg, request)) 17861 goto nla_put_failure; 17862 17863 genlmsg_end(msg, hdr); 17864 17865 rcu_read_lock(); 17866 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 17867 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 17868 rcu_read_unlock(); 17869 17870 return; 17871 17872 nla_put_failure: 17873 nlmsg_free(msg); 17874 } 17875 17876 struct nl80211_mlme_event { 17877 enum nl80211_commands cmd; 17878 const u8 *buf; 17879 size_t buf_len; 17880 int uapsd_queues; 17881 const u8 *req_ies; 17882 size_t req_ies_len; 17883 bool reconnect; 17884 }; 17885 17886 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 17887 struct net_device *netdev, 17888 const struct nl80211_mlme_event *event, 17889 gfp_t gfp) 17890 { 17891 struct sk_buff *msg; 17892 void *hdr; 17893 17894 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp); 17895 if (!msg) 17896 return; 17897 17898 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd); 17899 if (!hdr) { 17900 nlmsg_free(msg); 17901 return; 17902 } 17903 17904 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 17905 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 17906 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) || 17907 (event->req_ies && 17908 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len, 17909 event->req_ies))) 17910 goto nla_put_failure; 17911 17912 if (event->reconnect && 17913 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED)) 17914 goto nla_put_failure; 17915 17916 if (event->uapsd_queues >= 0) { 17917 struct nlattr *nla_wmm = 17918 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME); 17919 if (!nla_wmm) 17920 goto nla_put_failure; 17921 17922 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 17923 event->uapsd_queues)) 17924 goto nla_put_failure; 17925 17926 nla_nest_end(msg, nla_wmm); 17927 } 17928 17929 genlmsg_end(msg, hdr); 17930 17931 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 17932 NL80211_MCGRP_MLME, gfp); 17933 return; 17934 17935 nla_put_failure: 17936 nlmsg_free(msg); 17937 } 17938 17939 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 17940 struct net_device *netdev, const u8 *buf, 17941 size_t len, gfp_t gfp) 17942 { 17943 struct nl80211_mlme_event event = { 17944 .cmd = NL80211_CMD_AUTHENTICATE, 17945 .buf = buf, 17946 .buf_len = len, 17947 .uapsd_queues = -1, 17948 }; 17949 17950 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17951 } 17952 17953 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 17954 struct net_device *netdev, 17955 const struct cfg80211_rx_assoc_resp_data *data) 17956 { 17957 struct nl80211_mlme_event event = { 17958 .cmd = NL80211_CMD_ASSOCIATE, 17959 .buf = data->buf, 17960 .buf_len = data->len, 17961 .uapsd_queues = data->uapsd_queues, 17962 .req_ies = data->req_ies, 17963 .req_ies_len = data->req_ies_len, 17964 }; 17965 17966 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL); 17967 } 17968 17969 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 17970 struct net_device *netdev, const u8 *buf, 17971 size_t len, bool reconnect, gfp_t gfp) 17972 { 17973 struct nl80211_mlme_event event = { 17974 .cmd = NL80211_CMD_DEAUTHENTICATE, 17975 .buf = buf, 17976 .buf_len = len, 17977 .reconnect = reconnect, 17978 .uapsd_queues = -1, 17979 }; 17980 17981 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17982 } 17983 17984 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 17985 struct net_device *netdev, const u8 *buf, 17986 size_t len, bool reconnect, gfp_t gfp) 17987 { 17988 struct nl80211_mlme_event event = { 17989 .cmd = NL80211_CMD_DISASSOCIATE, 17990 .buf = buf, 17991 .buf_len = len, 17992 .reconnect = reconnect, 17993 .uapsd_queues = -1, 17994 }; 17995 17996 nl80211_send_mlme_event(rdev, netdev, &event, gfp); 17997 } 17998 17999 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 18000 size_t len) 18001 { 18002 struct wireless_dev *wdev = dev->ieee80211_ptr; 18003 struct wiphy *wiphy = wdev->wiphy; 18004 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18005 const struct ieee80211_mgmt *mgmt = (void *)buf; 18006 struct nl80211_mlme_event event = { 18007 .buf = buf, 18008 .buf_len = len, 18009 .uapsd_queues = -1, 18010 }; 18011 18012 if (WARN_ON(len < 2)) 18013 return; 18014 18015 if (ieee80211_is_deauth(mgmt->frame_control)) { 18016 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 18017 } else if (ieee80211_is_disassoc(mgmt->frame_control)) { 18018 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 18019 } else if (ieee80211_is_beacon(mgmt->frame_control)) { 18020 if (wdev->unprot_beacon_reported && 18021 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000) 18022 return; 18023 event.cmd = NL80211_CMD_UNPROT_BEACON; 18024 wdev->unprot_beacon_reported = jiffies; 18025 } else { 18026 return; 18027 } 18028 18029 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 18030 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC); 18031 } 18032 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 18033 18034 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 18035 struct net_device *netdev, int cmd, 18036 const u8 *addr, gfp_t gfp) 18037 { 18038 struct sk_buff *msg; 18039 void *hdr; 18040 18041 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18042 if (!msg) 18043 return; 18044 18045 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18046 if (!hdr) { 18047 nlmsg_free(msg); 18048 return; 18049 } 18050 18051 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18052 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18053 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 18054 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 18055 goto nla_put_failure; 18056 18057 genlmsg_end(msg, hdr); 18058 18059 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18060 NL80211_MCGRP_MLME, gfp); 18061 return; 18062 18063 nla_put_failure: 18064 nlmsg_free(msg); 18065 } 18066 18067 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 18068 struct net_device *netdev, const u8 *addr, 18069 gfp_t gfp) 18070 { 18071 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 18072 addr, gfp); 18073 } 18074 18075 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 18076 struct net_device *netdev, const u8 *addr, 18077 gfp_t gfp) 18078 { 18079 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 18080 addr, gfp); 18081 } 18082 18083 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 18084 struct net_device *netdev, 18085 struct cfg80211_connect_resp_params *cr, 18086 gfp_t gfp) 18087 { 18088 struct sk_buff *msg; 18089 void *hdr; 18090 unsigned int link; 18091 size_t link_info_size = 0; 18092 const u8 *connected_addr = cr->valid_links ? 18093 cr->ap_mld_addr : cr->links[0].bssid; 18094 18095 if (cr->valid_links) { 18096 for_each_valid_link(cr, link) { 18097 /* Nested attribute header */ 18098 link_info_size += NLA_HDRLEN; 18099 /* Link ID */ 18100 link_info_size += nla_total_size(sizeof(u8)); 18101 link_info_size += cr->links[link].addr ? 18102 nla_total_size(ETH_ALEN) : 0; 18103 link_info_size += (cr->links[link].bssid || 18104 cr->links[link].bss) ? 18105 nla_total_size(ETH_ALEN) : 0; 18106 link_info_size += nla_total_size(sizeof(u16)); 18107 } 18108 } 18109 18110 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 18111 cr->fils.kek_len + cr->fils.pmk_len + 18112 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size, 18113 gfp); 18114 if (!msg) 18115 return; 18116 18117 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 18118 if (!hdr) { 18119 nlmsg_free(msg); 18120 return; 18121 } 18122 18123 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18124 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18125 (connected_addr && 18126 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) || 18127 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 18128 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 18129 cr->status) || 18130 (cr->status < 0 && 18131 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 18132 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 18133 cr->timeout_reason))) || 18134 (cr->req_ie && 18135 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 18136 (cr->resp_ie && 18137 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 18138 cr->resp_ie)) || 18139 (cr->fils.update_erp_next_seq_num && 18140 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 18141 cr->fils.erp_next_seq_num)) || 18142 (cr->status == WLAN_STATUS_SUCCESS && 18143 ((cr->fils.kek && 18144 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 18145 cr->fils.kek)) || 18146 (cr->fils.pmk && 18147 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 18148 (cr->fils.pmkid && 18149 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 18150 goto nla_put_failure; 18151 18152 if (cr->valid_links) { 18153 int i = 1; 18154 struct nlattr *nested; 18155 18156 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18157 if (!nested) 18158 goto nla_put_failure; 18159 18160 for_each_valid_link(cr, link) { 18161 struct nlattr *nested_mlo_links; 18162 const u8 *bssid = cr->links[link].bss ? 18163 cr->links[link].bss->bssid : 18164 cr->links[link].bssid; 18165 18166 nested_mlo_links = nla_nest_start(msg, i); 18167 if (!nested_mlo_links) 18168 goto nla_put_failure; 18169 18170 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 18171 (bssid && 18172 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 18173 (cr->links[link].addr && 18174 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 18175 cr->links[link].addr)) || 18176 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 18177 cr->links[link].status)) 18178 goto nla_put_failure; 18179 18180 nla_nest_end(msg, nested_mlo_links); 18181 i++; 18182 } 18183 nla_nest_end(msg, nested); 18184 } 18185 18186 genlmsg_end(msg, hdr); 18187 18188 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18189 NL80211_MCGRP_MLME, gfp); 18190 return; 18191 18192 nla_put_failure: 18193 nlmsg_free(msg); 18194 } 18195 18196 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 18197 struct net_device *netdev, 18198 struct cfg80211_roam_info *info, gfp_t gfp) 18199 { 18200 struct sk_buff *msg; 18201 void *hdr; 18202 size_t link_info_size = 0; 18203 unsigned int link; 18204 const u8 *connected_addr = info->ap_mld_addr ? 18205 info->ap_mld_addr : 18206 (info->links[0].bss ? 18207 info->links[0].bss->bssid : 18208 info->links[0].bssid); 18209 18210 if (info->valid_links) { 18211 for_each_valid_link(info, link) { 18212 /* Nested attribute header */ 18213 link_info_size += NLA_HDRLEN; 18214 /* Link ID */ 18215 link_info_size += nla_total_size(sizeof(u8)); 18216 link_info_size += info->links[link].addr ? 18217 nla_total_size(ETH_ALEN) : 0; 18218 link_info_size += (info->links[link].bssid || 18219 info->links[link].bss) ? 18220 nla_total_size(ETH_ALEN) : 0; 18221 } 18222 } 18223 18224 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 18225 info->fils.kek_len + info->fils.pmk_len + 18226 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) + 18227 link_info_size, gfp); 18228 if (!msg) 18229 return; 18230 18231 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 18232 if (!hdr) { 18233 nlmsg_free(msg); 18234 return; 18235 } 18236 18237 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18238 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18239 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) || 18240 (info->req_ie && 18241 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 18242 info->req_ie)) || 18243 (info->resp_ie && 18244 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 18245 info->resp_ie)) || 18246 (info->fils.update_erp_next_seq_num && 18247 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 18248 info->fils.erp_next_seq_num)) || 18249 (info->fils.kek && 18250 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 18251 info->fils.kek)) || 18252 (info->fils.pmk && 18253 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 18254 (info->fils.pmkid && 18255 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 18256 goto nla_put_failure; 18257 18258 if (info->valid_links) { 18259 int i = 1; 18260 struct nlattr *nested; 18261 18262 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18263 if (!nested) 18264 goto nla_put_failure; 18265 18266 for_each_valid_link(info, link) { 18267 struct nlattr *nested_mlo_links; 18268 const u8 *bssid = info->links[link].bss ? 18269 info->links[link].bss->bssid : 18270 info->links[link].bssid; 18271 18272 nested_mlo_links = nla_nest_start(msg, i); 18273 if (!nested_mlo_links) 18274 goto nla_put_failure; 18275 18276 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) || 18277 (bssid && 18278 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) || 18279 (info->links[link].addr && 18280 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 18281 info->links[link].addr))) 18282 goto nla_put_failure; 18283 18284 nla_nest_end(msg, nested_mlo_links); 18285 i++; 18286 } 18287 nla_nest_end(msg, nested); 18288 } 18289 18290 genlmsg_end(msg, hdr); 18291 18292 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18293 NL80211_MCGRP_MLME, gfp); 18294 return; 18295 18296 nla_put_failure: 18297 nlmsg_free(msg); 18298 } 18299 18300 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 18301 struct net_device *netdev, const u8 *peer_addr, 18302 const u8 *td_bitmap, u8 td_bitmap_len) 18303 { 18304 struct sk_buff *msg; 18305 void *hdr; 18306 18307 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18308 if (!msg) 18309 return; 18310 18311 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 18312 if (!hdr) { 18313 nlmsg_free(msg); 18314 return; 18315 } 18316 18317 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18318 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18319 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr)) 18320 goto nla_put_failure; 18321 18322 if ((td_bitmap_len > 0) && td_bitmap) 18323 if (nla_put(msg, NL80211_ATTR_TD_BITMAP, 18324 td_bitmap_len, td_bitmap)) 18325 goto nla_put_failure; 18326 18327 genlmsg_end(msg, hdr); 18328 18329 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18330 NL80211_MCGRP_MLME, GFP_KERNEL); 18331 return; 18332 18333 nla_put_failure: 18334 nlmsg_free(msg); 18335 } 18336 18337 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 18338 struct net_device *netdev, u16 reason, 18339 const u8 *ie, size_t ie_len, bool from_ap) 18340 { 18341 struct sk_buff *msg; 18342 void *hdr; 18343 18344 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 18345 if (!msg) 18346 return; 18347 18348 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 18349 if (!hdr) { 18350 nlmsg_free(msg); 18351 return; 18352 } 18353 18354 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18355 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18356 (reason && 18357 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 18358 (from_ap && 18359 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 18360 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 18361 goto nla_put_failure; 18362 18363 genlmsg_end(msg, hdr); 18364 18365 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18366 NL80211_MCGRP_MLME, GFP_KERNEL); 18367 return; 18368 18369 nla_put_failure: 18370 nlmsg_free(msg); 18371 } 18372 18373 void cfg80211_links_removed(struct net_device *dev, u16 link_mask) 18374 { 18375 struct wireless_dev *wdev = dev->ieee80211_ptr; 18376 struct wiphy *wiphy = wdev->wiphy; 18377 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18378 struct sk_buff *msg; 18379 struct nlattr *links; 18380 void *hdr; 18381 18382 lockdep_assert_wiphy(wdev->wiphy); 18383 trace_cfg80211_links_removed(dev, link_mask); 18384 18385 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION && 18386 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) 18387 return; 18388 18389 if (WARN_ON(!wdev->valid_links || !link_mask || 18390 (wdev->valid_links & link_mask) != link_mask || 18391 wdev->valid_links == link_mask)) 18392 return; 18393 18394 cfg80211_wdev_release_link_bsses(wdev, link_mask); 18395 wdev->valid_links &= ~link_mask; 18396 18397 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18398 if (!msg) 18399 return; 18400 18401 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED); 18402 if (!hdr) { 18403 nlmsg_free(msg); 18404 return; 18405 } 18406 18407 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18408 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 18409 goto nla_put_failure; 18410 18411 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS); 18412 if (!links) 18413 goto nla_put_failure; 18414 18415 while (link_mask) { 18416 struct nlattr *link; 18417 int link_id = __ffs(link_mask); 18418 18419 link = nla_nest_start(msg, link_id + 1); 18420 if (!link) 18421 goto nla_put_failure; 18422 18423 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 18424 goto nla_put_failure; 18425 18426 nla_nest_end(msg, link); 18427 link_mask &= ~(1 << link_id); 18428 } 18429 18430 nla_nest_end(msg, links); 18431 18432 genlmsg_end(msg, hdr); 18433 18434 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18435 NL80211_MCGRP_MLME, GFP_KERNEL); 18436 return; 18437 18438 nla_put_failure: 18439 nlmsg_free(msg); 18440 } 18441 EXPORT_SYMBOL(cfg80211_links_removed); 18442 18443 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 18444 struct net_device *netdev, const u8 *bssid, 18445 gfp_t gfp) 18446 { 18447 struct sk_buff *msg; 18448 void *hdr; 18449 18450 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18451 if (!msg) 18452 return; 18453 18454 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 18455 if (!hdr) { 18456 nlmsg_free(msg); 18457 return; 18458 } 18459 18460 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18461 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18462 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 18463 goto nla_put_failure; 18464 18465 genlmsg_end(msg, hdr); 18466 18467 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18468 NL80211_MCGRP_MLME, gfp); 18469 return; 18470 18471 nla_put_failure: 18472 nlmsg_free(msg); 18473 } 18474 18475 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 18476 const u8 *ie, u8 ie_len, 18477 int sig_dbm, gfp_t gfp) 18478 { 18479 struct wireless_dev *wdev = dev->ieee80211_ptr; 18480 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18481 struct sk_buff *msg; 18482 void *hdr; 18483 18484 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 18485 return; 18486 18487 trace_cfg80211_notify_new_peer_candidate(dev, addr); 18488 18489 msg = nlmsg_new(100 + ie_len, gfp); 18490 if (!msg) 18491 return; 18492 18493 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 18494 if (!hdr) { 18495 nlmsg_free(msg); 18496 return; 18497 } 18498 18499 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18500 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18501 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 18502 (ie_len && ie && 18503 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) || 18504 (sig_dbm && 18505 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm))) 18506 goto nla_put_failure; 18507 18508 genlmsg_end(msg, hdr); 18509 18510 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18511 NL80211_MCGRP_MLME, gfp); 18512 return; 18513 18514 nla_put_failure: 18515 nlmsg_free(msg); 18516 } 18517 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 18518 18519 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 18520 struct net_device *netdev, const u8 *addr, 18521 enum nl80211_key_type key_type, int key_id, 18522 const u8 *tsc, gfp_t gfp) 18523 { 18524 struct sk_buff *msg; 18525 void *hdr; 18526 18527 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18528 if (!msg) 18529 return; 18530 18531 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 18532 if (!hdr) { 18533 nlmsg_free(msg); 18534 return; 18535 } 18536 18537 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18538 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18539 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 18540 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 18541 (key_id != -1 && 18542 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 18543 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 18544 goto nla_put_failure; 18545 18546 genlmsg_end(msg, hdr); 18547 18548 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18549 NL80211_MCGRP_MLME, gfp); 18550 return; 18551 18552 nla_put_failure: 18553 nlmsg_free(msg); 18554 } 18555 18556 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 18557 struct ieee80211_channel *channel_before, 18558 struct ieee80211_channel *channel_after) 18559 { 18560 struct sk_buff *msg; 18561 void *hdr; 18562 struct nlattr *nl_freq; 18563 18564 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 18565 if (!msg) 18566 return; 18567 18568 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 18569 if (!hdr) { 18570 nlmsg_free(msg); 18571 return; 18572 } 18573 18574 /* 18575 * Since we are applying the beacon hint to a wiphy we know its 18576 * wiphy_idx is valid 18577 */ 18578 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 18579 goto nla_put_failure; 18580 18581 /* Before */ 18582 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE); 18583 if (!nl_freq) 18584 goto nla_put_failure; 18585 18586 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 18587 goto nla_put_failure; 18588 nla_nest_end(msg, nl_freq); 18589 18590 /* After */ 18591 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER); 18592 if (!nl_freq) 18593 goto nla_put_failure; 18594 18595 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 18596 goto nla_put_failure; 18597 nla_nest_end(msg, nl_freq); 18598 18599 genlmsg_end(msg, hdr); 18600 18601 rcu_read_lock(); 18602 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 18603 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 18604 rcu_read_unlock(); 18605 18606 return; 18607 18608 nla_put_failure: 18609 nlmsg_free(msg); 18610 } 18611 18612 static void nl80211_send_remain_on_chan_event( 18613 int cmd, struct cfg80211_registered_device *rdev, 18614 struct wireless_dev *wdev, u64 cookie, 18615 struct ieee80211_channel *chan, 18616 unsigned int duration, gfp_t gfp) 18617 { 18618 struct sk_buff *msg; 18619 void *hdr; 18620 18621 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18622 if (!msg) 18623 return; 18624 18625 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18626 if (!hdr) { 18627 nlmsg_free(msg); 18628 return; 18629 } 18630 18631 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18632 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18633 wdev->netdev->ifindex)) || 18634 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18635 NL80211_ATTR_PAD) || 18636 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 18637 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 18638 NL80211_CHAN_NO_HT) || 18639 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 18640 NL80211_ATTR_PAD)) 18641 goto nla_put_failure; 18642 18643 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 18644 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 18645 goto nla_put_failure; 18646 18647 genlmsg_end(msg, hdr); 18648 18649 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18650 NL80211_MCGRP_MLME, gfp); 18651 return; 18652 18653 nla_put_failure: 18654 nlmsg_free(msg); 18655 } 18656 18657 void cfg80211_assoc_comeback(struct net_device *netdev, 18658 const u8 *ap_addr, u32 timeout) 18659 { 18660 struct wireless_dev *wdev = netdev->ieee80211_ptr; 18661 struct wiphy *wiphy = wdev->wiphy; 18662 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18663 struct sk_buff *msg; 18664 void *hdr; 18665 18666 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout); 18667 18668 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 18669 if (!msg) 18670 return; 18671 18672 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK); 18673 if (!hdr) { 18674 nlmsg_free(msg); 18675 return; 18676 } 18677 18678 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18679 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 18680 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) || 18681 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout)) 18682 goto nla_put_failure; 18683 18684 genlmsg_end(msg, hdr); 18685 18686 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18687 NL80211_MCGRP_MLME, GFP_KERNEL); 18688 return; 18689 18690 nla_put_failure: 18691 nlmsg_free(msg); 18692 } 18693 EXPORT_SYMBOL(cfg80211_assoc_comeback); 18694 18695 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 18696 struct ieee80211_channel *chan, 18697 unsigned int duration, gfp_t gfp) 18698 { 18699 struct wiphy *wiphy = wdev->wiphy; 18700 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18701 18702 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 18703 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 18704 rdev, wdev, cookie, chan, 18705 duration, gfp); 18706 } 18707 EXPORT_SYMBOL(cfg80211_ready_on_channel); 18708 18709 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 18710 struct ieee80211_channel *chan, 18711 gfp_t gfp) 18712 { 18713 struct wiphy *wiphy = wdev->wiphy; 18714 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18715 18716 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 18717 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 18718 rdev, wdev, cookie, chan, 0, gfp); 18719 } 18720 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 18721 18722 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie, 18723 struct ieee80211_channel *chan, 18724 gfp_t gfp) 18725 { 18726 struct wiphy *wiphy = wdev->wiphy; 18727 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18728 18729 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan); 18730 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL, 18731 rdev, wdev, cookie, chan, 0, gfp); 18732 } 18733 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired); 18734 18735 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 18736 struct station_info *sinfo, gfp_t gfp) 18737 { 18738 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18739 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18740 struct sk_buff *msg; 18741 18742 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 18743 18744 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18745 if (!msg) 18746 return; 18747 18748 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 18749 rdev, dev, mac_addr, sinfo) < 0) { 18750 nlmsg_free(msg); 18751 return; 18752 } 18753 18754 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18755 NL80211_MCGRP_MLME, gfp); 18756 } 18757 EXPORT_SYMBOL(cfg80211_new_sta); 18758 18759 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 18760 struct station_info *sinfo, gfp_t gfp) 18761 { 18762 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18763 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18764 struct sk_buff *msg; 18765 struct station_info empty_sinfo = {}; 18766 18767 if (!sinfo) 18768 sinfo = &empty_sinfo; 18769 18770 trace_cfg80211_del_sta(dev, mac_addr); 18771 18772 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 18773 if (!msg) { 18774 cfg80211_sinfo_release_content(sinfo); 18775 return; 18776 } 18777 18778 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 18779 rdev, dev, mac_addr, sinfo) < 0) { 18780 nlmsg_free(msg); 18781 return; 18782 } 18783 18784 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18785 NL80211_MCGRP_MLME, gfp); 18786 } 18787 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 18788 18789 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 18790 enum nl80211_connect_failed_reason reason, 18791 gfp_t gfp) 18792 { 18793 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 18794 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18795 struct sk_buff *msg; 18796 void *hdr; 18797 18798 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 18799 if (!msg) 18800 return; 18801 18802 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 18803 if (!hdr) { 18804 nlmsg_free(msg); 18805 return; 18806 } 18807 18808 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18809 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 18810 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 18811 goto nla_put_failure; 18812 18813 genlmsg_end(msg, hdr); 18814 18815 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 18816 NL80211_MCGRP_MLME, gfp); 18817 return; 18818 18819 nla_put_failure: 18820 nlmsg_free(msg); 18821 } 18822 EXPORT_SYMBOL(cfg80211_conn_failed); 18823 18824 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 18825 const u8 *addr, gfp_t gfp) 18826 { 18827 struct wireless_dev *wdev = dev->ieee80211_ptr; 18828 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 18829 struct sk_buff *msg; 18830 void *hdr; 18831 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 18832 18833 if (!nlportid) 18834 return false; 18835 18836 msg = nlmsg_new(100, gfp); 18837 if (!msg) 18838 return true; 18839 18840 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 18841 if (!hdr) { 18842 nlmsg_free(msg); 18843 return true; 18844 } 18845 18846 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18847 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 18848 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 18849 goto nla_put_failure; 18850 18851 genlmsg_end(msg, hdr); 18852 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18853 return true; 18854 18855 nla_put_failure: 18856 nlmsg_free(msg); 18857 return true; 18858 } 18859 18860 bool cfg80211_rx_spurious_frame(struct net_device *dev, 18861 const u8 *addr, gfp_t gfp) 18862 { 18863 struct wireless_dev *wdev = dev->ieee80211_ptr; 18864 bool ret; 18865 18866 trace_cfg80211_rx_spurious_frame(dev, addr); 18867 18868 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18869 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 18870 trace_cfg80211_return_bool(false); 18871 return false; 18872 } 18873 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 18874 addr, gfp); 18875 trace_cfg80211_return_bool(ret); 18876 return ret; 18877 } 18878 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 18879 18880 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 18881 const u8 *addr, gfp_t gfp) 18882 { 18883 struct wireless_dev *wdev = dev->ieee80211_ptr; 18884 bool ret; 18885 18886 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 18887 18888 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 18889 wdev->iftype != NL80211_IFTYPE_P2P_GO && 18890 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 18891 trace_cfg80211_return_bool(false); 18892 return false; 18893 } 18894 ret = __nl80211_unexpected_frame(dev, 18895 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 18896 addr, gfp); 18897 trace_cfg80211_return_bool(ret); 18898 return ret; 18899 } 18900 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 18901 18902 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 18903 struct wireless_dev *wdev, u32 nlportid, 18904 struct cfg80211_rx_info *info, gfp_t gfp) 18905 { 18906 struct net_device *netdev = wdev->netdev; 18907 struct sk_buff *msg; 18908 void *hdr; 18909 18910 msg = nlmsg_new(100 + info->len, gfp); 18911 if (!msg) 18912 return -ENOMEM; 18913 18914 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 18915 if (!hdr) { 18916 nlmsg_free(msg); 18917 return -ENOMEM; 18918 } 18919 18920 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18921 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18922 netdev->ifindex)) || 18923 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18924 NL80211_ATTR_PAD) || 18925 (info->have_link_id && 18926 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) || 18927 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) || 18928 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) || 18929 (info->sig_dbm && 18930 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) || 18931 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) || 18932 (info->flags && 18933 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) || 18934 (info->rx_tstamp && nla_put_u64_64bit(msg, 18935 NL80211_ATTR_RX_HW_TIMESTAMP, 18936 info->rx_tstamp, 18937 NL80211_ATTR_PAD)) || 18938 (info->ack_tstamp && nla_put_u64_64bit(msg, 18939 NL80211_ATTR_TX_HW_TIMESTAMP, 18940 info->ack_tstamp, 18941 NL80211_ATTR_PAD))) 18942 goto nla_put_failure; 18943 18944 genlmsg_end(msg, hdr); 18945 18946 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 18947 18948 nla_put_failure: 18949 nlmsg_free(msg); 18950 return -ENOBUFS; 18951 } 18952 18953 static void nl80211_frame_tx_status(struct wireless_dev *wdev, 18954 struct cfg80211_tx_status *status, 18955 gfp_t gfp, enum nl80211_commands command) 18956 { 18957 struct wiphy *wiphy = wdev->wiphy; 18958 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 18959 struct net_device *netdev = wdev->netdev; 18960 struct sk_buff *msg; 18961 void *hdr; 18962 18963 if (command == NL80211_CMD_FRAME_TX_STATUS) 18964 trace_cfg80211_mgmt_tx_status(wdev, status->cookie, 18965 status->ack); 18966 else 18967 trace_cfg80211_control_port_tx_status(wdev, status->cookie, 18968 status->ack); 18969 18970 msg = nlmsg_new(100 + status->len, gfp); 18971 if (!msg) 18972 return; 18973 18974 hdr = nl80211hdr_put(msg, 0, 0, 0, command); 18975 if (!hdr) { 18976 nlmsg_free(msg); 18977 return; 18978 } 18979 18980 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 18981 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 18982 netdev->ifindex)) || 18983 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 18984 NL80211_ATTR_PAD) || 18985 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) || 18986 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie, 18987 NL80211_ATTR_PAD) || 18988 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) || 18989 (status->tx_tstamp && 18990 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP, 18991 status->tx_tstamp, NL80211_ATTR_PAD)) || 18992 (status->ack_tstamp && 18993 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP, 18994 status->ack_tstamp, NL80211_ATTR_PAD))) 18995 goto nla_put_failure; 18996 18997 genlmsg_end(msg, hdr); 18998 18999 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19000 NL80211_MCGRP_MLME, gfp); 19001 return; 19002 19003 nla_put_failure: 19004 nlmsg_free(msg); 19005 } 19006 19007 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie, 19008 const u8 *buf, size_t len, bool ack, 19009 gfp_t gfp) 19010 { 19011 struct cfg80211_tx_status status = { 19012 .cookie = cookie, 19013 .buf = buf, 19014 .len = len, 19015 .ack = ack 19016 }; 19017 19018 nl80211_frame_tx_status(wdev, &status, gfp, 19019 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS); 19020 } 19021 EXPORT_SYMBOL(cfg80211_control_port_tx_status); 19022 19023 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev, 19024 struct cfg80211_tx_status *status, gfp_t gfp) 19025 { 19026 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS); 19027 } 19028 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext); 19029 19030 static int __nl80211_rx_control_port(struct net_device *dev, 19031 struct sk_buff *skb, 19032 bool unencrypted, 19033 int link_id, 19034 gfp_t gfp) 19035 { 19036 struct wireless_dev *wdev = dev->ieee80211_ptr; 19037 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19038 struct ethhdr *ehdr = eth_hdr(skb); 19039 const u8 *addr = ehdr->h_source; 19040 u16 proto = be16_to_cpu(skb->protocol); 19041 struct sk_buff *msg; 19042 void *hdr; 19043 struct nlattr *frame; 19044 19045 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 19046 19047 if (!nlportid) 19048 return -ENOENT; 19049 19050 msg = nlmsg_new(100 + skb->len, gfp); 19051 if (!msg) 19052 return -ENOMEM; 19053 19054 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 19055 if (!hdr) { 19056 nlmsg_free(msg); 19057 return -ENOBUFS; 19058 } 19059 19060 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19061 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19062 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19063 NL80211_ATTR_PAD) || 19064 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 19065 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 19066 (link_id >= 0 && 19067 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) || 19068 (unencrypted && nla_put_flag(msg, 19069 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 19070 goto nla_put_failure; 19071 19072 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 19073 if (!frame) 19074 goto nla_put_failure; 19075 19076 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 19077 genlmsg_end(msg, hdr); 19078 19079 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 19080 19081 nla_put_failure: 19082 nlmsg_free(msg); 19083 return -ENOBUFS; 19084 } 19085 19086 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb, 19087 bool unencrypted, int link_id) 19088 { 19089 int ret; 19090 19091 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id); 19092 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id, 19093 GFP_ATOMIC); 19094 trace_cfg80211_return_bool(ret == 0); 19095 return ret == 0; 19096 } 19097 EXPORT_SYMBOL(cfg80211_rx_control_port); 19098 19099 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 19100 const char *mac, gfp_t gfp) 19101 { 19102 struct wireless_dev *wdev = dev->ieee80211_ptr; 19103 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19104 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19105 void **cb; 19106 19107 if (!msg) 19108 return NULL; 19109 19110 cb = (void **)msg->cb; 19111 19112 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 19113 if (!cb[0]) { 19114 nlmsg_free(msg); 19115 return NULL; 19116 } 19117 19118 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19119 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19120 goto nla_put_failure; 19121 19122 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 19123 goto nla_put_failure; 19124 19125 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM); 19126 if (!cb[1]) 19127 goto nla_put_failure; 19128 19129 cb[2] = rdev; 19130 19131 return msg; 19132 nla_put_failure: 19133 nlmsg_free(msg); 19134 return NULL; 19135 } 19136 19137 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 19138 { 19139 void **cb = (void **)msg->cb; 19140 struct cfg80211_registered_device *rdev = cb[2]; 19141 19142 nla_nest_end(msg, cb[1]); 19143 genlmsg_end(msg, cb[0]); 19144 19145 memset(msg->cb, 0, sizeof(msg->cb)); 19146 19147 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19148 NL80211_MCGRP_MLME, gfp); 19149 } 19150 19151 void cfg80211_cqm_rssi_notify(struct net_device *dev, 19152 enum nl80211_cqm_rssi_threshold_event rssi_event, 19153 s32 rssi_level, gfp_t gfp) 19154 { 19155 struct wireless_dev *wdev = dev->ieee80211_ptr; 19156 struct cfg80211_cqm_config *cqm_config; 19157 19158 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 19159 19160 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 19161 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 19162 return; 19163 19164 rcu_read_lock(); 19165 cqm_config = rcu_dereference(wdev->cqm_config); 19166 if (cqm_config) { 19167 cqm_config->last_rssi_event_value = rssi_level; 19168 cqm_config->last_rssi_event_type = rssi_event; 19169 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work); 19170 } 19171 rcu_read_unlock(); 19172 } 19173 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 19174 19175 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work) 19176 { 19177 struct wireless_dev *wdev = container_of(work, struct wireless_dev, 19178 cqm_rssi_work); 19179 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19180 enum nl80211_cqm_rssi_threshold_event rssi_event; 19181 struct cfg80211_cqm_config *cqm_config; 19182 struct sk_buff *msg; 19183 s32 rssi_level; 19184 19185 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config); 19186 if (!cqm_config) 19187 return; 19188 19189 if (cqm_config->use_range_api) 19190 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config); 19191 19192 rssi_level = cqm_config->last_rssi_event_value; 19193 rssi_event = cqm_config->last_rssi_event_type; 19194 19195 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL); 19196 if (!msg) 19197 return; 19198 19199 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 19200 rssi_event)) 19201 goto nla_put_failure; 19202 19203 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 19204 rssi_level)) 19205 goto nla_put_failure; 19206 19207 cfg80211_send_cqm(msg, GFP_KERNEL); 19208 19209 return; 19210 19211 nla_put_failure: 19212 nlmsg_free(msg); 19213 } 19214 19215 void cfg80211_cqm_txe_notify(struct net_device *dev, 19216 const u8 *peer, u32 num_packets, 19217 u32 rate, u32 intvl, gfp_t gfp) 19218 { 19219 struct sk_buff *msg; 19220 19221 msg = cfg80211_prepare_cqm(dev, peer, gfp); 19222 if (!msg) 19223 return; 19224 19225 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 19226 goto nla_put_failure; 19227 19228 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 19229 goto nla_put_failure; 19230 19231 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 19232 goto nla_put_failure; 19233 19234 cfg80211_send_cqm(msg, gfp); 19235 return; 19236 19237 nla_put_failure: 19238 nlmsg_free(msg); 19239 } 19240 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 19241 19242 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 19243 const u8 *peer, u32 num_packets, gfp_t gfp) 19244 { 19245 struct sk_buff *msg; 19246 19247 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 19248 19249 msg = cfg80211_prepare_cqm(dev, peer, gfp); 19250 if (!msg) 19251 return; 19252 19253 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 19254 goto nla_put_failure; 19255 19256 cfg80211_send_cqm(msg, gfp); 19257 return; 19258 19259 nla_put_failure: 19260 nlmsg_free(msg); 19261 } 19262 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 19263 19264 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 19265 { 19266 struct sk_buff *msg; 19267 19268 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 19269 if (!msg) 19270 return; 19271 19272 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 19273 goto nla_put_failure; 19274 19275 cfg80211_send_cqm(msg, gfp); 19276 return; 19277 19278 nla_put_failure: 19279 nlmsg_free(msg); 19280 } 19281 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 19282 19283 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 19284 struct net_device *netdev, const u8 *bssid, 19285 const u8 *replay_ctr, gfp_t gfp) 19286 { 19287 struct sk_buff *msg; 19288 struct nlattr *rekey_attr; 19289 void *hdr; 19290 19291 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19292 if (!msg) 19293 return; 19294 19295 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 19296 if (!hdr) { 19297 nlmsg_free(msg); 19298 return; 19299 } 19300 19301 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19302 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19303 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 19304 goto nla_put_failure; 19305 19306 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA); 19307 if (!rekey_attr) 19308 goto nla_put_failure; 19309 19310 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 19311 NL80211_REPLAY_CTR_LEN, replay_ctr)) 19312 goto nla_put_failure; 19313 19314 nla_nest_end(msg, rekey_attr); 19315 19316 genlmsg_end(msg, hdr); 19317 19318 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19319 NL80211_MCGRP_MLME, gfp); 19320 return; 19321 19322 nla_put_failure: 19323 nlmsg_free(msg); 19324 } 19325 19326 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 19327 const u8 *replay_ctr, gfp_t gfp) 19328 { 19329 struct wireless_dev *wdev = dev->ieee80211_ptr; 19330 struct wiphy *wiphy = wdev->wiphy; 19331 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19332 19333 trace_cfg80211_gtk_rekey_notify(dev, bssid); 19334 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 19335 } 19336 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 19337 19338 static void 19339 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 19340 struct net_device *netdev, int index, 19341 const u8 *bssid, bool preauth, gfp_t gfp) 19342 { 19343 struct sk_buff *msg; 19344 struct nlattr *attr; 19345 void *hdr; 19346 19347 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19348 if (!msg) 19349 return; 19350 19351 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 19352 if (!hdr) { 19353 nlmsg_free(msg); 19354 return; 19355 } 19356 19357 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19358 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19359 goto nla_put_failure; 19360 19361 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE); 19362 if (!attr) 19363 goto nla_put_failure; 19364 19365 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 19366 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 19367 (preauth && 19368 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 19369 goto nla_put_failure; 19370 19371 nla_nest_end(msg, attr); 19372 19373 genlmsg_end(msg, hdr); 19374 19375 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19376 NL80211_MCGRP_MLME, gfp); 19377 return; 19378 19379 nla_put_failure: 19380 nlmsg_free(msg); 19381 } 19382 19383 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 19384 const u8 *bssid, bool preauth, gfp_t gfp) 19385 { 19386 struct wireless_dev *wdev = dev->ieee80211_ptr; 19387 struct wiphy *wiphy = wdev->wiphy; 19388 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19389 19390 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 19391 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 19392 } 19393 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 19394 19395 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 19396 struct net_device *netdev, 19397 unsigned int link_id, 19398 struct cfg80211_chan_def *chandef, 19399 gfp_t gfp, 19400 enum nl80211_commands notif, 19401 u8 count, bool quiet, u16 punct_bitmap) 19402 { 19403 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19404 struct sk_buff *msg; 19405 void *hdr; 19406 19407 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19408 if (!msg) 19409 return; 19410 19411 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 19412 if (!hdr) { 19413 nlmsg_free(msg); 19414 return; 19415 } 19416 19417 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 19418 goto nla_put_failure; 19419 19420 if (wdev->valid_links && 19421 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) 19422 goto nla_put_failure; 19423 19424 if (nl80211_send_chandef(msg, chandef)) 19425 goto nla_put_failure; 19426 19427 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) { 19428 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)) 19429 goto nla_put_failure; 19430 if (quiet && 19431 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)) 19432 goto nla_put_failure; 19433 } 19434 19435 if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap)) 19436 goto nla_put_failure; 19437 19438 genlmsg_end(msg, hdr); 19439 19440 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19441 NL80211_MCGRP_MLME, gfp); 19442 return; 19443 19444 nla_put_failure: 19445 nlmsg_free(msg); 19446 } 19447 19448 void cfg80211_ch_switch_notify(struct net_device *dev, 19449 struct cfg80211_chan_def *chandef, 19450 unsigned int link_id, u16 punct_bitmap) 19451 { 19452 struct wireless_dev *wdev = dev->ieee80211_ptr; 19453 struct wiphy *wiphy = wdev->wiphy; 19454 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19455 19456 lockdep_assert_wiphy(wdev->wiphy); 19457 WARN_INVALID_LINK_ID(wdev, link_id); 19458 19459 trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap); 19460 19461 switch (wdev->iftype) { 19462 case NL80211_IFTYPE_STATION: 19463 case NL80211_IFTYPE_P2P_CLIENT: 19464 if (!WARN_ON(!wdev->links[link_id].client.current_bss)) 19465 cfg80211_update_assoc_bss_entry(wdev, link_id, 19466 chandef->chan); 19467 break; 19468 case NL80211_IFTYPE_MESH_POINT: 19469 wdev->u.mesh.chandef = *chandef; 19470 wdev->u.mesh.preset_chandef = *chandef; 19471 break; 19472 case NL80211_IFTYPE_AP: 19473 case NL80211_IFTYPE_P2P_GO: 19474 wdev->links[link_id].ap.chandef = *chandef; 19475 break; 19476 case NL80211_IFTYPE_ADHOC: 19477 wdev->u.ibss.chandef = *chandef; 19478 break; 19479 default: 19480 WARN_ON(1); 19481 break; 19482 } 19483 19484 cfg80211_schedule_channels_check(wdev); 19485 cfg80211_sched_dfs_chan_update(rdev); 19486 19487 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19488 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false, 19489 punct_bitmap); 19490 } 19491 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 19492 19493 void cfg80211_ch_switch_started_notify(struct net_device *dev, 19494 struct cfg80211_chan_def *chandef, 19495 unsigned int link_id, u8 count, 19496 bool quiet, u16 punct_bitmap) 19497 { 19498 struct wireless_dev *wdev = dev->ieee80211_ptr; 19499 struct wiphy *wiphy = wdev->wiphy; 19500 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19501 19502 lockdep_assert_wiphy(wdev->wiphy); 19503 WARN_INVALID_LINK_ID(wdev, link_id); 19504 19505 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id, 19506 punct_bitmap); 19507 19508 19509 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL, 19510 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, 19511 count, quiet, punct_bitmap); 19512 } 19513 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 19514 19515 int cfg80211_bss_color_notify(struct net_device *dev, 19516 enum nl80211_commands cmd, u8 count, 19517 u64 color_bitmap) 19518 { 19519 struct wireless_dev *wdev = dev->ieee80211_ptr; 19520 struct wiphy *wiphy = wdev->wiphy; 19521 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19522 struct sk_buff *msg; 19523 void *hdr; 19524 19525 lockdep_assert_wiphy(wdev->wiphy); 19526 19527 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap); 19528 19529 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 19530 if (!msg) 19531 return -ENOMEM; 19532 19533 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 19534 if (!hdr) 19535 goto nla_put_failure; 19536 19537 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19538 goto nla_put_failure; 19539 19540 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED && 19541 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count)) 19542 goto nla_put_failure; 19543 19544 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION && 19545 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP, 19546 color_bitmap, NL80211_ATTR_PAD)) 19547 goto nla_put_failure; 19548 19549 genlmsg_end(msg, hdr); 19550 19551 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 19552 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL); 19553 19554 nla_put_failure: 19555 nlmsg_free(msg); 19556 return -EINVAL; 19557 } 19558 EXPORT_SYMBOL(cfg80211_bss_color_notify); 19559 19560 void 19561 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 19562 const struct cfg80211_chan_def *chandef, 19563 enum nl80211_radar_event event, 19564 struct net_device *netdev, gfp_t gfp) 19565 { 19566 struct sk_buff *msg; 19567 void *hdr; 19568 19569 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19570 if (!msg) 19571 return; 19572 19573 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 19574 if (!hdr) { 19575 nlmsg_free(msg); 19576 return; 19577 } 19578 19579 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19580 goto nla_put_failure; 19581 19582 /* NOP and radar events don't need a netdev parameter */ 19583 if (netdev) { 19584 struct wireless_dev *wdev = netdev->ieee80211_ptr; 19585 19586 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 19587 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19588 NL80211_ATTR_PAD)) 19589 goto nla_put_failure; 19590 } 19591 19592 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 19593 goto nla_put_failure; 19594 19595 if (nl80211_send_chandef(msg, chandef)) 19596 goto nla_put_failure; 19597 19598 genlmsg_end(msg, hdr); 19599 19600 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19601 NL80211_MCGRP_MLME, gfp); 19602 return; 19603 19604 nla_put_failure: 19605 nlmsg_free(msg); 19606 } 19607 19608 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 19609 struct sta_opmode_info *sta_opmode, 19610 gfp_t gfp) 19611 { 19612 struct sk_buff *msg; 19613 struct wireless_dev *wdev = dev->ieee80211_ptr; 19614 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19615 void *hdr; 19616 19617 if (WARN_ON(!mac)) 19618 return; 19619 19620 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19621 if (!msg) 19622 return; 19623 19624 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 19625 if (!hdr) { 19626 nlmsg_free(msg); 19627 return; 19628 } 19629 19630 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 19631 goto nla_put_failure; 19632 19633 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 19634 goto nla_put_failure; 19635 19636 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 19637 goto nla_put_failure; 19638 19639 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 19640 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 19641 goto nla_put_failure; 19642 19643 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 19644 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 19645 goto nla_put_failure; 19646 19647 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 19648 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 19649 goto nla_put_failure; 19650 19651 genlmsg_end(msg, hdr); 19652 19653 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19654 NL80211_MCGRP_MLME, gfp); 19655 19656 return; 19657 19658 nla_put_failure: 19659 nlmsg_free(msg); 19660 } 19661 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 19662 19663 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 19664 u64 cookie, bool acked, s32 ack_signal, 19665 bool is_valid_ack_signal, gfp_t gfp) 19666 { 19667 struct wireless_dev *wdev = dev->ieee80211_ptr; 19668 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19669 struct sk_buff *msg; 19670 void *hdr; 19671 19672 trace_cfg80211_probe_status(dev, addr, cookie, acked); 19673 19674 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19675 19676 if (!msg) 19677 return; 19678 19679 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 19680 if (!hdr) { 19681 nlmsg_free(msg); 19682 return; 19683 } 19684 19685 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19686 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19687 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 19688 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 19689 NL80211_ATTR_PAD) || 19690 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 19691 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 19692 ack_signal))) 19693 goto nla_put_failure; 19694 19695 genlmsg_end(msg, hdr); 19696 19697 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19698 NL80211_MCGRP_MLME, gfp); 19699 return; 19700 19701 nla_put_failure: 19702 nlmsg_free(msg); 19703 } 19704 EXPORT_SYMBOL(cfg80211_probe_status); 19705 19706 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame, 19707 size_t len, int freq, int sig_dbm) 19708 { 19709 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 19710 struct sk_buff *msg; 19711 void *hdr; 19712 struct cfg80211_beacon_registration *reg; 19713 19714 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 19715 19716 spin_lock_bh(&rdev->beacon_registrations_lock); 19717 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 19718 msg = nlmsg_new(len + 100, GFP_ATOMIC); 19719 if (!msg) { 19720 spin_unlock_bh(&rdev->beacon_registrations_lock); 19721 return; 19722 } 19723 19724 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 19725 if (!hdr) 19726 goto nla_put_failure; 19727 19728 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19729 (freq && 19730 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 19731 KHZ_TO_MHZ(freq)) || 19732 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, 19733 freq % 1000))) || 19734 (sig_dbm && 19735 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 19736 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 19737 goto nla_put_failure; 19738 19739 genlmsg_end(msg, hdr); 19740 19741 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 19742 } 19743 spin_unlock_bh(&rdev->beacon_registrations_lock); 19744 return; 19745 19746 nla_put_failure: 19747 spin_unlock_bh(&rdev->beacon_registrations_lock); 19748 nlmsg_free(msg); 19749 } 19750 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz); 19751 19752 #ifdef CONFIG_PM 19753 static int cfg80211_net_detect_results(struct sk_buff *msg, 19754 struct cfg80211_wowlan_wakeup *wakeup) 19755 { 19756 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 19757 struct nlattr *nl_results, *nl_match, *nl_freqs; 19758 int i, j; 19759 19760 nl_results = nla_nest_start_noflag(msg, 19761 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 19762 if (!nl_results) 19763 return -EMSGSIZE; 19764 19765 for (i = 0; i < nd->n_matches; i++) { 19766 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 19767 19768 nl_match = nla_nest_start_noflag(msg, i); 19769 if (!nl_match) 19770 break; 19771 19772 /* The SSID attribute is optional in nl80211, but for 19773 * simplicity reasons it's always present in the 19774 * cfg80211 structure. If a driver can't pass the 19775 * SSID, that needs to be changed. A zero length SSID 19776 * is still a valid SSID (wildcard), so it cannot be 19777 * used for this purpose. 19778 */ 19779 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 19780 match->ssid.ssid)) { 19781 nla_nest_cancel(msg, nl_match); 19782 goto out; 19783 } 19784 19785 if (match->n_channels) { 19786 nl_freqs = nla_nest_start_noflag(msg, 19787 NL80211_ATTR_SCAN_FREQUENCIES); 19788 if (!nl_freqs) { 19789 nla_nest_cancel(msg, nl_match); 19790 goto out; 19791 } 19792 19793 for (j = 0; j < match->n_channels; j++) { 19794 if (nla_put_u32(msg, j, match->channels[j])) { 19795 nla_nest_cancel(msg, nl_freqs); 19796 nla_nest_cancel(msg, nl_match); 19797 goto out; 19798 } 19799 } 19800 19801 nla_nest_end(msg, nl_freqs); 19802 } 19803 19804 nla_nest_end(msg, nl_match); 19805 } 19806 19807 out: 19808 nla_nest_end(msg, nl_results); 19809 return 0; 19810 } 19811 19812 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 19813 struct cfg80211_wowlan_wakeup *wakeup, 19814 gfp_t gfp) 19815 { 19816 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19817 struct sk_buff *msg; 19818 void *hdr; 19819 int size = 200; 19820 19821 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 19822 19823 if (wakeup) 19824 size += wakeup->packet_present_len; 19825 19826 msg = nlmsg_new(size, gfp); 19827 if (!msg) 19828 return; 19829 19830 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 19831 if (!hdr) 19832 goto free_msg; 19833 19834 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19835 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 19836 NL80211_ATTR_PAD)) 19837 goto free_msg; 19838 19839 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 19840 wdev->netdev->ifindex)) 19841 goto free_msg; 19842 19843 if (wakeup) { 19844 struct nlattr *reasons; 19845 19846 reasons = nla_nest_start_noflag(msg, 19847 NL80211_ATTR_WOWLAN_TRIGGERS); 19848 if (!reasons) 19849 goto free_msg; 19850 19851 if (wakeup->disconnect && 19852 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 19853 goto free_msg; 19854 if (wakeup->magic_pkt && 19855 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 19856 goto free_msg; 19857 if (wakeup->gtk_rekey_failure && 19858 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 19859 goto free_msg; 19860 if (wakeup->eap_identity_req && 19861 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 19862 goto free_msg; 19863 if (wakeup->four_way_handshake && 19864 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 19865 goto free_msg; 19866 if (wakeup->rfkill_release && 19867 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 19868 goto free_msg; 19869 19870 if (wakeup->pattern_idx >= 0 && 19871 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 19872 wakeup->pattern_idx)) 19873 goto free_msg; 19874 19875 if (wakeup->tcp_match && 19876 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 19877 goto free_msg; 19878 19879 if (wakeup->tcp_connlost && 19880 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 19881 goto free_msg; 19882 19883 if (wakeup->tcp_nomoretokens && 19884 nla_put_flag(msg, 19885 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 19886 goto free_msg; 19887 19888 if (wakeup->packet) { 19889 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 19890 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 19891 19892 if (!wakeup->packet_80211) { 19893 pkt_attr = 19894 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 19895 len_attr = 19896 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 19897 } 19898 19899 if (wakeup->packet_len && 19900 nla_put_u32(msg, len_attr, wakeup->packet_len)) 19901 goto free_msg; 19902 19903 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 19904 wakeup->packet)) 19905 goto free_msg; 19906 } 19907 19908 if (wakeup->net_detect && 19909 cfg80211_net_detect_results(msg, wakeup)) 19910 goto free_msg; 19911 19912 nla_nest_end(msg, reasons); 19913 } 19914 19915 genlmsg_end(msg, hdr); 19916 19917 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19918 NL80211_MCGRP_MLME, gfp); 19919 return; 19920 19921 free_msg: 19922 nlmsg_free(msg); 19923 } 19924 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 19925 #endif 19926 19927 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 19928 enum nl80211_tdls_operation oper, 19929 u16 reason_code, gfp_t gfp) 19930 { 19931 struct wireless_dev *wdev = dev->ieee80211_ptr; 19932 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 19933 struct sk_buff *msg; 19934 void *hdr; 19935 19936 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 19937 reason_code); 19938 19939 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 19940 if (!msg) 19941 return; 19942 19943 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 19944 if (!hdr) { 19945 nlmsg_free(msg); 19946 return; 19947 } 19948 19949 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 19950 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 19951 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 19952 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 19953 (reason_code > 0 && 19954 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 19955 goto nla_put_failure; 19956 19957 genlmsg_end(msg, hdr); 19958 19959 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 19960 NL80211_MCGRP_MLME, gfp); 19961 return; 19962 19963 nla_put_failure: 19964 nlmsg_free(msg); 19965 } 19966 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 19967 19968 static int nl80211_netlink_notify(struct notifier_block * nb, 19969 unsigned long state, 19970 void *_notify) 19971 { 19972 struct netlink_notify *notify = _notify; 19973 struct cfg80211_registered_device *rdev; 19974 struct wireless_dev *wdev; 19975 struct cfg80211_beacon_registration *reg, *tmp; 19976 19977 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 19978 return NOTIFY_DONE; 19979 19980 rcu_read_lock(); 19981 19982 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 19983 struct cfg80211_sched_scan_request *sched_scan_req; 19984 19985 list_for_each_entry_rcu(sched_scan_req, 19986 &rdev->sched_scan_req_list, 19987 list) { 19988 if (sched_scan_req->owner_nlportid == notify->portid) { 19989 sched_scan_req->nl_owner_dead = true; 19990 wiphy_work_queue(&rdev->wiphy, 19991 &rdev->sched_scan_stop_wk); 19992 } 19993 } 19994 19995 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 19996 cfg80211_mlme_unregister_socket(wdev, notify->portid); 19997 19998 if (wdev->owner_nlportid == notify->portid) { 19999 wdev->nl_owner_dead = true; 20000 schedule_work(&rdev->destroy_work); 20001 } else if (wdev->conn_owner_nlportid == notify->portid) { 20002 schedule_work(&wdev->disconnect_wk); 20003 } 20004 20005 cfg80211_release_pmsr(wdev, notify->portid); 20006 } 20007 20008 spin_lock_bh(&rdev->beacon_registrations_lock); 20009 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 20010 list) { 20011 if (reg->nlportid == notify->portid) { 20012 list_del(®->list); 20013 kfree(reg); 20014 break; 20015 } 20016 } 20017 spin_unlock_bh(&rdev->beacon_registrations_lock); 20018 } 20019 20020 rcu_read_unlock(); 20021 20022 /* 20023 * It is possible that the user space process that is controlling the 20024 * indoor setting disappeared, so notify the regulatory core. 20025 */ 20026 regulatory_netlink_notify(notify->portid); 20027 return NOTIFY_OK; 20028 } 20029 20030 static struct notifier_block nl80211_netlink_notifier = { 20031 .notifier_call = nl80211_netlink_notify, 20032 }; 20033 20034 void cfg80211_ft_event(struct net_device *netdev, 20035 struct cfg80211_ft_event_params *ft_event) 20036 { 20037 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 20038 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20039 struct sk_buff *msg; 20040 void *hdr; 20041 20042 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 20043 20044 if (!ft_event->target_ap) 20045 return; 20046 20047 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 20048 GFP_KERNEL); 20049 if (!msg) 20050 return; 20051 20052 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 20053 if (!hdr) 20054 goto out; 20055 20056 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20057 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 20058 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 20059 goto out; 20060 20061 if (ft_event->ies && 20062 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 20063 goto out; 20064 if (ft_event->ric_ies && 20065 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 20066 ft_event->ric_ies)) 20067 goto out; 20068 20069 genlmsg_end(msg, hdr); 20070 20071 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 20072 NL80211_MCGRP_MLME, GFP_KERNEL); 20073 return; 20074 out: 20075 nlmsg_free(msg); 20076 } 20077 EXPORT_SYMBOL(cfg80211_ft_event); 20078 20079 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 20080 { 20081 struct cfg80211_registered_device *rdev; 20082 struct sk_buff *msg; 20083 void *hdr; 20084 u32 nlportid; 20085 20086 rdev = wiphy_to_rdev(wdev->wiphy); 20087 if (!rdev->crit_proto_nlportid) 20088 return; 20089 20090 nlportid = rdev->crit_proto_nlportid; 20091 rdev->crit_proto_nlportid = 0; 20092 20093 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20094 if (!msg) 20095 return; 20096 20097 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 20098 if (!hdr) 20099 goto nla_put_failure; 20100 20101 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20102 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 20103 NL80211_ATTR_PAD)) 20104 goto nla_put_failure; 20105 20106 genlmsg_end(msg, hdr); 20107 20108 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 20109 return; 20110 20111 nla_put_failure: 20112 nlmsg_free(msg); 20113 } 20114 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 20115 20116 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id) 20117 { 20118 struct wiphy *wiphy = wdev->wiphy; 20119 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20120 struct sk_buff *msg; 20121 void *hdr; 20122 20123 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 20124 if (!msg) 20125 return; 20126 20127 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 20128 if (!hdr) 20129 goto out; 20130 20131 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20132 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 20133 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 20134 NL80211_ATTR_PAD) || 20135 (wdev->valid_links && 20136 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))) 20137 goto out; 20138 20139 genlmsg_end(msg, hdr); 20140 20141 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 20142 NL80211_MCGRP_MLME, GFP_KERNEL); 20143 return; 20144 out: 20145 nlmsg_free(msg); 20146 } 20147 20148 int cfg80211_external_auth_request(struct net_device *dev, 20149 struct cfg80211_external_auth_params *params, 20150 gfp_t gfp) 20151 { 20152 struct wireless_dev *wdev = dev->ieee80211_ptr; 20153 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 20154 struct sk_buff *msg; 20155 void *hdr; 20156 20157 if (!wdev->conn_owner_nlportid) 20158 return -EINVAL; 20159 20160 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20161 if (!msg) 20162 return -ENOMEM; 20163 20164 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 20165 if (!hdr) 20166 goto nla_put_failure; 20167 20168 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20169 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 20170 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 20171 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 20172 params->action) || 20173 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 20174 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 20175 params->ssid.ssid) || 20176 (!is_zero_ether_addr(params->mld_addr) && 20177 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr))) 20178 goto nla_put_failure; 20179 20180 genlmsg_end(msg, hdr); 20181 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 20182 wdev->conn_owner_nlportid); 20183 return 0; 20184 20185 nla_put_failure: 20186 nlmsg_free(msg); 20187 return -ENOBUFS; 20188 } 20189 EXPORT_SYMBOL(cfg80211_external_auth_request); 20190 20191 void cfg80211_update_owe_info_event(struct net_device *netdev, 20192 struct cfg80211_update_owe_info *owe_info, 20193 gfp_t gfp) 20194 { 20195 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 20196 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 20197 struct sk_buff *msg; 20198 void *hdr; 20199 20200 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info); 20201 20202 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 20203 if (!msg) 20204 return; 20205 20206 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO); 20207 if (!hdr) 20208 goto nla_put_failure; 20209 20210 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 20211 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 20212 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer)) 20213 goto nla_put_failure; 20214 20215 if (!owe_info->ie_len || 20216 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie)) 20217 goto nla_put_failure; 20218 20219 if (owe_info->assoc_link_id != -1) { 20220 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, 20221 owe_info->assoc_link_id)) 20222 goto nla_put_failure; 20223 20224 if (!is_zero_ether_addr(owe_info->peer_mld_addr) && 20225 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, 20226 owe_info->peer_mld_addr)) 20227 goto nla_put_failure; 20228 } 20229 20230 genlmsg_end(msg, hdr); 20231 20232 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 20233 NL80211_MCGRP_MLME, gfp); 20234 return; 20235 20236 nla_put_failure: 20237 genlmsg_cancel(msg, hdr); 20238 nlmsg_free(msg); 20239 } 20240 EXPORT_SYMBOL(cfg80211_update_owe_info_event); 20241 20242 void cfg80211_schedule_channels_check(struct wireless_dev *wdev) 20243 { 20244 struct wiphy *wiphy = wdev->wiphy; 20245 20246 /* Schedule channels check if NO_IR or DFS relaxations are supported */ 20247 if (wdev->iftype == NL80211_IFTYPE_STATION && 20248 (wiphy_ext_feature_isset(wiphy, 20249 NL80211_EXT_FEATURE_DFS_CONCURRENT) || 20250 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) && 20251 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR))) 20252 reg_check_channels(); 20253 } 20254 EXPORT_SYMBOL(cfg80211_schedule_channels_check); 20255 20256 /* initialisation/exit functions */ 20257 20258 int __init nl80211_init(void) 20259 { 20260 int err; 20261 20262 err = genl_register_family(&nl80211_fam); 20263 if (err) 20264 return err; 20265 20266 err = netlink_register_notifier(&nl80211_netlink_notifier); 20267 if (err) 20268 goto err_out; 20269 20270 return 0; 20271 err_out: 20272 genl_unregister_family(&nl80211_fam); 20273 return err; 20274 } 20275 20276 void nl80211_exit(void) 20277 { 20278 netlink_unregister_notifier(&nl80211_netlink_notifier); 20279 genl_unregister_family(&nl80211_fam); 20280 } 20281