projects / linux-2.6-block.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Merge tag 'probes-fixes-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git...
[linux-2.6-block.git] / net / wireless / nl80211.c
... / ...
CommitLineData
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2025 Intel Corporation
9 */
10
11#include <linux/if.h>
12#include <linux/module.h>
13#include <linux/err.h>
14#include <linux/slab.h>
15#include <linux/list.h>
16#include <linux/if_ether.h>
17#include <linux/ieee80211.h>
18#include <linux/nl80211.h>
19#include <linux/rtnetlink.h>
20#include <linux/netlink.h>
21#include <linux/nospec.h>
22#include <linux/etherdevice.h>
23#include <linux/if_vlan.h>
24#include <net/net_namespace.h>
25#include <net/genetlink.h>
26#include <net/cfg80211.h>
27#include <net/sock.h>
28#include <net/inet_connection_sock.h>
29#include "core.h"
30#include "nl80211.h"
31#include "reg.h"
32#include "rdev-ops.h"
33
34static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39/* the netlink family */
40static struct genl_family nl80211_fam;
41
42/* multicast groups */
43enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51};
52
53static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60#ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62#endif
63};
64
65/* returns ERR_PTR values */
66static struct wireless_dev *
67__cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69{
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 for_each_rdev(rdev) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137}
138
139static struct cfg80211_registered_device *
140__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141{
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210}
211
212/*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219static struct cfg80211_registered_device *
220cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221{
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223}
224
225static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227{
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 const struct ieee80211_ext *ext;
233 unsigned int fixedlen, hdrlen;
234 bool s1g_bcn;
235
236 if (len < offsetofend(typeof(*mgmt), frame_control))
237 goto err;
238
239 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
240 if (s1g_bcn) {
241 ext = (struct ieee80211_ext *)mgmt;
242 fixedlen =
243 offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
244 ieee80211_s1g_optional_len(ext->frame_control);
245 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
246 } else {
247 fixedlen = offsetof(struct ieee80211_mgmt,
248 u.beacon.variable);
249 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
250 }
251
252 if (len < fixedlen)
253 goto err;
254
255 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
256 goto err;
257
258 data += fixedlen;
259 len -= fixedlen;
260
261 for_each_element(elem, data, len) {
262 /* nothing */
263 }
264
265 if (for_each_element_completed(elem, data, len))
266 return 0;
267
268err:
269 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
270 return -EINVAL;
271}
272
273static int validate_ie_attr(const struct nlattr *attr,
274 struct netlink_ext_ack *extack)
275{
276 const u8 *data = nla_data(attr);
277 unsigned int len = nla_len(attr);
278 const struct element *elem;
279
280 for_each_element(elem, data, len) {
281 /* nothing */
282 }
283
284 if (for_each_element_completed(elem, data, len))
285 return 0;
286
287 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
288 return -EINVAL;
289}
290
291static int validate_he_capa(const struct nlattr *attr,
292 struct netlink_ext_ack *extack)
293{
294 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
295 return -EINVAL;
296
297 return 0;
298}
299
300static int validate_supported_selectors(const struct nlattr *attr,
301 struct netlink_ext_ack *extack)
302{
303 const u8 *supported_selectors = nla_data(attr);
304 u8 supported_selectors_len = nla_len(attr);
305
306 /* The top bit must not be set as it is not part of the selector */
307 for (int i = 0; i < supported_selectors_len; i++) {
308 if (supported_selectors[i] & 0x80)
309 return -EINVAL;
310 }
311
312 return 0;
313}
314
315/* policy for the attributes */
316static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
317
318static const struct nla_policy
319nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
320 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
321 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
322 .len = U8_MAX },
323 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
324 .len = U8_MAX },
325};
326
327static const struct nla_policy
328nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
329 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
330 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
331 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
332 NLA_POLICY_MAX(NLA_U8, 15),
333 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
334 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
335 NLA_POLICY_MAX(NLA_U8, 15),
336 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
337 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
338 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
339 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
340 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
341 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
342 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
343 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
344};
345
346static const struct nla_policy
347nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
348 [NL80211_PMSR_TYPE_FTM] =
349 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
350};
351
352static const struct nla_policy
353nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
354 [NL80211_PMSR_REQ_ATTR_DATA] =
355 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
356 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
357};
358
359static const struct nla_policy
360nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
361 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
362 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
363 [NL80211_PMSR_PEER_ATTR_REQ] =
364 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
365 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
366};
367
368static const struct nla_policy
369nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
370 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
371 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
372 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
373 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
374 [NL80211_PMSR_ATTR_PEERS] =
375 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
376};
377
378static const struct nla_policy
379he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
380 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
381 NLA_POLICY_RANGE(NLA_U8, 1, 20),
382 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
383 NLA_POLICY_RANGE(NLA_U8, 1, 20),
384 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
385 NLA_POLICY_RANGE(NLA_U8, 1, 20),
386 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
387 NLA_POLICY_EXACT_LEN(8),
388 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
389 NLA_POLICY_EXACT_LEN(8),
390 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
391};
392
393static const struct nla_policy
394he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
395 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
396 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
397 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
398};
399
400static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
401 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
402 .len = NL80211_MAX_SUPP_RATES },
403 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
404 .len = NL80211_MAX_SUPP_HT_RATES },
405 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
406 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
407 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
408 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
409 NL80211_RATE_INFO_HE_GI_0_8,
410 NL80211_RATE_INFO_HE_GI_3_2),
411 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
412 NL80211_RATE_INFO_HE_1XLTF,
413 NL80211_RATE_INFO_HE_4XLTF),
414};
415
416static const struct nla_policy
417nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
418 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
419 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
420 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
421 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
422 [NL80211_TID_CONFIG_ATTR_NOACK] =
423 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
424 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
425 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
426 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
427 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
428 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
429 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
430 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
431 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
432 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
433 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
434 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
435 NLA_POLICY_NESTED(nl80211_txattr_policy),
436};
437
438static const struct nla_policy
439nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
440 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
441 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
442 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
443 NLA_POLICY_RANGE(NLA_BINARY,
444 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
445 IEEE80211_MAX_DATA_LEN),
446};
447
448static const struct nla_policy
449nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
450 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
451 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
452 .len = IEEE80211_MAX_DATA_LEN }
453};
454
455static const struct nla_policy
456sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
457 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
458 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
459};
460
461static const struct nla_policy
462sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
463 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
464 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
465};
466
467static const struct nla_policy
468nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
469 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
470 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
471 NLA_POLICY_MIN(NLA_U8, 1),
472 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
473 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
474 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
475 [NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
476 NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
477};
478
479static const struct nla_policy
480nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
481 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
482 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
483};
484
485static const struct netlink_range_validation nl80211_punct_bitmap_range = {
486 .min = 0,
487 .max = 0xffff,
488};
489
490static const struct netlink_range_validation q_range = {
491 .max = INT_MAX,
492};
493
494static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
495 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
496 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
497 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
498 .len = 20-1 },
499 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
500
501 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
502 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
503 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
504 NL80211_EDMG_CHANNELS_MIN,
505 NL80211_EDMG_CHANNELS_MAX),
506 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
507 NL80211_EDMG_BW_CONFIG_MIN,
508 NL80211_EDMG_BW_CONFIG_MAX),
509
510 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
511 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
512 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
513 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
514
515 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
516 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
517 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
518 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
519 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
520 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
521
522 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
523 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
524 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
525
526 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
527 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
528
529 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
530 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
531 .len = WLAN_MAX_KEY_LEN },
532 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
533 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
534 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
535 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
536 [NL80211_ATTR_KEY_TYPE] =
537 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
538
539 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
540 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
541 [NL80211_ATTR_BEACON_HEAD] =
542 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
543 IEEE80211_MAX_DATA_LEN),
544 [NL80211_ATTR_BEACON_TAIL] =
545 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
546 IEEE80211_MAX_DATA_LEN),
547 [NL80211_ATTR_STA_AID] =
548 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
549 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
550 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
551 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
552 .len = NL80211_MAX_SUPP_RATES },
553 [NL80211_ATTR_STA_PLINK_ACTION] =
554 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
555 [NL80211_ATTR_STA_TX_POWER_SETTING] =
556 NLA_POLICY_RANGE(NLA_U8,
557 NL80211_TX_POWER_AUTOMATIC,
558 NL80211_TX_POWER_FIXED),
559 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
560 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
561 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
562 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
563 .len = IEEE80211_MAX_MESH_ID_LEN },
564 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
565
566 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
567 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
568 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
569
570 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
571 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
572 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
573 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
574 .len = NL80211_MAX_SUPP_RATES },
575 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
576
577 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
578 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
579
580 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
581
582 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
583 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
584 validate_ie_attr,
585 IEEE80211_MAX_DATA_LEN),
586 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
587 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
588
589 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
590 .len = IEEE80211_MAX_SSID_LEN },
591 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
592 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
593 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
594 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
595 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
596 NL80211_MFP_NO,
597 NL80211_MFP_OPTIONAL),
598 [NL80211_ATTR_STA_FLAGS2] =
599 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
600 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
601 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
602 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
603 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
604 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
605 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
606 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
607 [NL80211_ATTR_WPA_VERSIONS] =
608 NLA_POLICY_RANGE(NLA_U32, 0,
609 NL80211_WPA_VERSION_1 |
610 NL80211_WPA_VERSION_2 |
611 NL80211_WPA_VERSION_3),
612 [NL80211_ATTR_PID] = { .type = NLA_U32 },
613 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
614 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
615 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
616 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
617 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
618 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
619 .len = IEEE80211_MAX_DATA_LEN },
620 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
621 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
622 NL80211_PS_DISABLED,
623 NL80211_PS_ENABLED),
624 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
625 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
626 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
627 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
628 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
629 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
630 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
631 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
632 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
633 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
634 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
635 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
636 [NL80211_ATTR_STA_PLINK_STATE] =
637 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
638 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
639 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
640 [NL80211_ATTR_MESH_PEER_AID] =
641 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
642 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
643 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
644 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
645 [NL80211_ATTR_HIDDEN_SSID] =
646 NLA_POLICY_RANGE(NLA_U32,
647 NL80211_HIDDEN_SSID_NOT_IN_USE,
648 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
649 [NL80211_ATTR_IE_PROBE_RESP] =
650 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
651 IEEE80211_MAX_DATA_LEN),
652 [NL80211_ATTR_IE_ASSOC_RESP] =
653 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
654 IEEE80211_MAX_DATA_LEN),
655 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
656 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
657 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
658 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
659 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
660 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
661 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
662 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
663 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
664 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
665 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
666 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
667 .len = IEEE80211_MAX_DATA_LEN },
668 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
669 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
670 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
671 .len = NL80211_HT_CAPABILITY_LEN
672 },
673 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
674 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
675 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
676 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
677 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
678
679 /* need to include at least Auth Transaction and Status Code */
680 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
681
682 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
683 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
684 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
685 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
686 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
687 NLA_POLICY_RANGE(NLA_U32,
688 NL80211_MESH_POWER_UNKNOWN + 1,
689 NL80211_MESH_POWER_MAX),
690 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
691 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
692 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
693 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
694 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
695 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
696 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
697 .len = NL80211_VHT_CAPABILITY_LEN,
698 },
699 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
700 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
701 .len = IEEE80211_MAX_DATA_LEN },
702 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
703 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
704 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
705 [NL80211_ATTR_PEER_AID] =
706 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
707 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
708 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
709 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
710 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
711 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
712 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
713 /*
714 * The value of the Length field of the Supported Operating
715 * Classes element is between 2 and 253.
716 */
717 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
718 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
719 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
720 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
721 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
722 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
723 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
724 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
725 IEEE80211_QOS_MAP_LEN_MIN,
726 IEEE80211_QOS_MAP_LEN_MAX),
727 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
728 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
729 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
730 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
731 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
732 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
733 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
734 [NL80211_ATTR_USER_PRIO] =
735 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
736 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
737 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
738 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
739 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
740 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
741 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
742 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
743 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
744 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
745 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
746 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
747 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
748 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
749 .len = VHT_MUMIMO_GROUPS_DATA_LEN
750 },
751 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
752 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
753 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
754 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
755 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
756 .len = FILS_MAX_KEK_LEN },
757 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
758 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
759 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
760 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
761 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
762 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
763 },
764 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
765 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
766 .len = FILS_ERP_MAX_USERNAME_LEN },
767 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
768 .len = FILS_ERP_MAX_REALM_LEN },
769 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
770 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
771 .len = FILS_ERP_MAX_RRK_LEN },
772 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
773 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
774 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
775 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
776 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
777
778 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
779 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
780 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
781 [NL80211_ATTR_HE_CAPABILITY] =
782 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
783 NL80211_HE_MAX_CAPABILITY_LEN),
784 [NL80211_ATTR_FTM_RESPONDER] =
785 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
786 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
787 [NL80211_ATTR_PEER_MEASUREMENTS] =
788 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
789 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
790 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
791 .len = SAE_PASSWORD_MAX_LEN },
792 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
793 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
794 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
795 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
796 [NL80211_ATTR_TID_CONFIG] =
797 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
798 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
799 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
800 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
801 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
802 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
803 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
804 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
805 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
806 [NL80211_ATTR_FILS_DISCOVERY] =
807 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
808 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
809 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
810 [NL80211_ATTR_S1G_CAPABILITY] =
811 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
812 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
813 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
814 [NL80211_ATTR_SAE_PWE] =
815 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
816 NL80211_SAE_PWE_BOTH),
817 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
818 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
819 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
820 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
821 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
822 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
823 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
824 [NL80211_ATTR_MBSSID_CONFIG] =
825 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
826 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
827 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
828 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
829 [NL80211_ATTR_EHT_CAPABILITY] =
830 NLA_POLICY_RANGE(NLA_BINARY,
831 NL80211_EHT_MIN_CAPABILITY_LEN,
832 NL80211_EHT_MAX_CAPABILITY_LEN),
833 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
834 [NL80211_ATTR_MLO_LINKS] =
835 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
836 [NL80211_ATTR_MLO_LINK_ID] =
837 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
838 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
839 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
840 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
841 [NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
842 [NL80211_ATTR_PUNCT_BITMAP] =
843 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
844
845 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
846 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
847 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
848 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
849 [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
850 [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
851 [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
852 [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
853 [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
854 [NL80211_ATTR_SUPPORTED_SELECTORS] =
855 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
856 NL80211_MAX_SUPP_SELECTORS),
857 [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
858 [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
859 [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
860};
861
862/* policy for the key attributes */
863static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
864 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
865 [NL80211_KEY_IDX] = { .type = NLA_U8 },
866 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
867 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
868 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
869 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
870 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
871 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
872 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
873};
874
875/* policy for the key default flags */
876static const struct nla_policy
877nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
878 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
879 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
880};
881
882#ifdef CONFIG_PM
883/* policy for WoWLAN attributes */
884static const struct nla_policy
885nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
886 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
887 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
888 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
889 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
890 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
891 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
892 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
893 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
894 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
895 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
896};
897
898static const struct nla_policy
899nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
900 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
901 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
902 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
903 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
904 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
905 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
906 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
907 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
908 },
909 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
910 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
911 },
912 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
913 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
914 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
915};
916#endif /* CONFIG_PM */
917
918/* policy for coalesce rule attributes */
919static const struct nla_policy
920nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
921 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
922 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
923 NLA_POLICY_RANGE(NLA_U32,
924 NL80211_COALESCE_CONDITION_MATCH,
925 NL80211_COALESCE_CONDITION_NO_MATCH),
926 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
927};
928
929/* policy for GTK rekey offload attributes */
930static const struct nla_policy
931nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
932 [NL80211_REKEY_DATA_KEK] = {
933 .type = NLA_BINARY,
934 .len = NL80211_KEK_EXT_LEN
935 },
936 [NL80211_REKEY_DATA_KCK] = {
937 .type = NLA_BINARY,
938 .len = NL80211_KCK_EXT_LEN_32
939 },
940 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
941 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
942};
943
944static const struct nla_policy
945nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
946 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
947 .len = IEEE80211_MAX_SSID_LEN },
948 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
949 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
950};
951
952static const struct nla_policy
953nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
954 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
955 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
956};
957
958static const struct nla_policy
959nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
960 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
961 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
962 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
963 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
964 },
965};
966
967/* policy for NAN function attributes */
968static const struct nla_policy
969nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
970 [NL80211_NAN_FUNC_TYPE] =
971 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
972 [NL80211_NAN_FUNC_SERVICE_ID] = {
973 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
974 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
975 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
976 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
977 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
978 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
979 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
980 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
981 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
982 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
983 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
984 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
985 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
986 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
987 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
988 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
989};
990
991/* policy for Service Response Filter attributes */
992static const struct nla_policy
993nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
994 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
995 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
996 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
997 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
998 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
999};
1000
1001/* policy for packet pattern attributes */
1002static const struct nla_policy
1003nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
1004 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
1005 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1006 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1007};
1008
1009static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1010 struct cfg80211_registered_device **rdev,
1011 struct wireless_dev **wdev,
1012 struct nlattr **attrbuf)
1013{
1014 int err;
1015
1016 if (!cb->args[0]) {
1017 struct nlattr **attrbuf_free = NULL;
1018
1019 if (!attrbuf) {
1020 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1021 GFP_KERNEL);
1022 if (!attrbuf)
1023 return -ENOMEM;
1024 attrbuf_free = attrbuf;
1025 }
1026
1027 err = nlmsg_parse_deprecated(cb->nlh,
1028 GENL_HDRLEN + nl80211_fam.hdrsize,
1029 attrbuf, nl80211_fam.maxattr,
1030 nl80211_policy, NULL);
1031 if (err) {
1032 kfree(attrbuf_free);
1033 return err;
1034 }
1035
1036 rtnl_lock();
1037 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1038 attrbuf);
1039 kfree(attrbuf_free);
1040 if (IS_ERR(*wdev)) {
1041 rtnl_unlock();
1042 return PTR_ERR(*wdev);
1043 }
1044 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1045 mutex_lock(&(*rdev)->wiphy.mtx);
1046 rtnl_unlock();
1047 /* 0 is the first index - add 1 to parse only once */
1048 cb->args[0] = (*rdev)->wiphy_idx + 1;
1049 cb->args[1] = (*wdev)->identifier;
1050 } else {
1051 /* subtract the 1 again here */
1052 struct wiphy *wiphy;
1053 struct wireless_dev *tmp;
1054
1055 rtnl_lock();
1056 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1057 if (!wiphy) {
1058 rtnl_unlock();
1059 return -ENODEV;
1060 }
1061 *rdev = wiphy_to_rdev(wiphy);
1062 *wdev = NULL;
1063
1064 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1065 if (tmp->identifier == cb->args[1]) {
1066 *wdev = tmp;
1067 break;
1068 }
1069 }
1070
1071 if (!*wdev) {
1072 rtnl_unlock();
1073 return -ENODEV;
1074 }
1075 mutex_lock(&(*rdev)->wiphy.mtx);
1076 rtnl_unlock();
1077 }
1078
1079 return 0;
1080}
1081
1082/* message building helper */
1083void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1084 int flags, u8 cmd)
1085{
1086 /* since there is no private header just add the generic one */
1087 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1088}
1089
1090static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1091 const struct ieee80211_reg_rule *rule)
1092{
1093 int j;
1094 struct nlattr *nl_wmm_rules =
1095 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1096
1097 if (!nl_wmm_rules)
1098 goto nla_put_failure;
1099
1100 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1101 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1102
1103 if (!nl_wmm_rule)
1104 goto nla_put_failure;
1105
1106 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1107 rule->wmm_rule.client[j].cw_min) ||
1108 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1109 rule->wmm_rule.client[j].cw_max) ||
1110 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1111 rule->wmm_rule.client[j].aifsn) ||
1112 nla_put_u16(msg, NL80211_WMMR_TXOP,
1113 rule->wmm_rule.client[j].cot))
1114 goto nla_put_failure;
1115
1116 nla_nest_end(msg, nl_wmm_rule);
1117 }
1118 nla_nest_end(msg, nl_wmm_rules);
1119
1120 return 0;
1121
1122nla_put_failure:
1123 return -ENOBUFS;
1124}
1125
1126static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1127 struct ieee80211_channel *chan,
1128 bool large)
1129{
1130 /* Some channels must be completely excluded from the
1131 * list to protect old user-space tools from breaking
1132 */
1133 if (!large && chan->flags &
1134 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1135 return 0;
1136 if (!large && chan->freq_offset)
1137 return 0;
1138
1139 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1140 chan->center_freq))
1141 goto nla_put_failure;
1142
1143 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1144 goto nla_put_failure;
1145
1146 if ((chan->flags & IEEE80211_CHAN_PSD) &&
1147 nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1148 goto nla_put_failure;
1149
1150 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1151 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1152 goto nla_put_failure;
1153 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1154 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1155 goto nla_put_failure;
1156 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1157 goto nla_put_failure;
1158 }
1159 if (chan->flags & IEEE80211_CHAN_RADAR) {
1160 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1161 goto nla_put_failure;
1162 if (large) {
1163 u32 time;
1164
1165 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1166
1167 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1168 chan->dfs_state))
1169 goto nla_put_failure;
1170 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1171 time))
1172 goto nla_put_failure;
1173 if (nla_put_u32(msg,
1174 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1175 chan->dfs_cac_ms))
1176 goto nla_put_failure;
1177 }
1178 }
1179
1180 if (large) {
1181 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1182 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1183 goto nla_put_failure;
1184 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1185 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1186 goto nla_put_failure;
1187 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1188 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1189 goto nla_put_failure;
1190 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1191 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1192 goto nla_put_failure;
1193 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1194 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1195 goto nla_put_failure;
1196 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1197 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1198 goto nla_put_failure;
1199 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1200 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1201 goto nla_put_failure;
1202 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1203 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1204 goto nla_put_failure;
1205 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1206 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1207 goto nla_put_failure;
1208 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1209 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1210 goto nla_put_failure;
1211 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1212 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1213 goto nla_put_failure;
1214 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1215 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1216 goto nla_put_failure;
1217 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1218 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1219 goto nla_put_failure;
1220 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1221 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1222 goto nla_put_failure;
1223 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1224 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1225 goto nla_put_failure;
1226 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1227 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1228 goto nla_put_failure;
1229 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1230 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1231 goto nla_put_failure;
1232 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1233 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1234 goto nla_put_failure;
1235 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1236 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1237 goto nla_put_failure;
1238 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1239 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1240 goto nla_put_failure;
1241 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1242 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1243 goto nla_put_failure;
1244 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1245 nla_put_flag(msg,
1246 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1247 goto nla_put_failure;
1248 }
1249
1250 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1251 DBM_TO_MBM(chan->max_power)))
1252 goto nla_put_failure;
1253
1254 if (large) {
1255 const struct ieee80211_reg_rule *rule =
1256 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1257
1258 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1259 if (nl80211_msg_put_wmm_rules(msg, rule))
1260 goto nla_put_failure;
1261 }
1262 }
1263
1264 return 0;
1265
1266 nla_put_failure:
1267 return -ENOBUFS;
1268}
1269
1270static bool nl80211_put_txq_stats(struct sk_buff *msg,
1271 struct cfg80211_txq_stats *txqstats,
1272 int attrtype)
1273{
1274 struct nlattr *txqattr;
1275
1276#define PUT_TXQVAL_U32(attr, memb) do { \
1277 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1278 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1279 return false; \
1280 } while (0)
1281
1282 txqattr = nla_nest_start_noflag(msg, attrtype);
1283 if (!txqattr)
1284 return false;
1285
1286 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1287 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1288 PUT_TXQVAL_U32(FLOWS, flows);
1289 PUT_TXQVAL_U32(DROPS, drops);
1290 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1291 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1292 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1293 PUT_TXQVAL_U32(COLLISIONS, collisions);
1294 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1295 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1296 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1297 nla_nest_end(msg, txqattr);
1298
1299#undef PUT_TXQVAL_U32
1300 return true;
1301}
1302
1303/* netlink command implementations */
1304
1305/**
1306 * nl80211_link_id - return link ID
1307 * @attrs: attributes to look at
1308 *
1309 * Returns: the link ID or 0 if not given
1310 *
1311 * Note this function doesn't do any validation of the link
1312 * ID validity wrt. links that were actually added, so it must
1313 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1314 * or if additional validation is done.
1315 */
1316static unsigned int nl80211_link_id(struct nlattr **attrs)
1317{
1318 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1319
1320 return nla_get_u8_default(linkid, 0);
1321}
1322
1323static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1324{
1325 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1326
1327 if (!linkid)
1328 return -1;
1329
1330 return nla_get_u8(linkid);
1331}
1332
1333struct key_parse {
1334 struct key_params p;
1335 int idx;
1336 int type;
1337 bool def, defmgmt, defbeacon;
1338 bool def_uni, def_multi;
1339};
1340
1341static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1342 struct key_parse *k)
1343{
1344 struct nlattr *tb[NL80211_KEY_MAX + 1];
1345 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1346 nl80211_key_policy,
1347 info->extack);
1348 if (err)
1349 return err;
1350
1351 k->def = !!tb[NL80211_KEY_DEFAULT];
1352 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1353 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1354
1355 if (k->def) {
1356 k->def_uni = true;
1357 k->def_multi = true;
1358 }
1359 if (k->defmgmt || k->defbeacon)
1360 k->def_multi = true;
1361
1362 if (tb[NL80211_KEY_IDX])
1363 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1364
1365 if (tb[NL80211_KEY_DATA]) {
1366 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1367 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1368 }
1369
1370 if (tb[NL80211_KEY_SEQ]) {
1371 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1372 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1373 }
1374
1375 if (tb[NL80211_KEY_CIPHER])
1376 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1377
1378 if (tb[NL80211_KEY_TYPE])
1379 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1380
1381 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1382 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1383
1384 err = nla_parse_nested_deprecated(kdt,
1385 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1386 tb[NL80211_KEY_DEFAULT_TYPES],
1387 nl80211_key_default_policy,
1388 info->extack);
1389 if (err)
1390 return err;
1391
1392 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1393 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1394 }
1395
1396 if (tb[NL80211_KEY_MODE])
1397 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1398
1399 return 0;
1400}
1401
1402static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1403{
1404 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1405 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1406 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1407 }
1408
1409 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1410 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1411 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1412 }
1413
1414 if (info->attrs[NL80211_ATTR_KEY_IDX])
1415 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1416
1417 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1418 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1419
1420 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1421 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1422
1423 if (k->def) {
1424 k->def_uni = true;
1425 k->def_multi = true;
1426 }
1427 if (k->defmgmt)
1428 k->def_multi = true;
1429
1430 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1431 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1432
1433 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1434 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1435 int err = nla_parse_nested_deprecated(kdt,
1436 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1437 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1438 nl80211_key_default_policy,
1439 info->extack);
1440 if (err)
1441 return err;
1442
1443 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1444 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1445 }
1446
1447 return 0;
1448}
1449
1450static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1451{
1452 int err;
1453
1454 memset(k, 0, sizeof(*k));
1455 k->idx = -1;
1456 k->type = -1;
1457
1458 if (info->attrs[NL80211_ATTR_KEY])
1459 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1460 else
1461 err = nl80211_parse_key_old(info, k);
1462
1463 if (err)
1464 return err;
1465
1466 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1467 (k->defbeacon ? 1 : 0) > 1) {
1468 GENL_SET_ERR_MSG(info,
1469 "key with multiple default flags is invalid");
1470 return -EINVAL;
1471 }
1472
1473 if (k->defmgmt || k->defbeacon) {
1474 if (k->def_uni || !k->def_multi) {
1475 GENL_SET_ERR_MSG(info,
1476 "defmgmt/defbeacon key must be mcast");
1477 return -EINVAL;
1478 }
1479 }
1480
1481 if (k->idx != -1) {
1482 if (k->defmgmt) {
1483 if (k->idx < 4 || k->idx > 5) {
1484 GENL_SET_ERR_MSG(info,
1485 "defmgmt key idx not 4 or 5");
1486 return -EINVAL;
1487 }
1488 } else if (k->defbeacon) {
1489 if (k->idx < 6 || k->idx > 7) {
1490 GENL_SET_ERR_MSG(info,
1491 "defbeacon key idx not 6 or 7");
1492 return -EINVAL;
1493 }
1494 } else if (k->def) {
1495 if (k->idx < 0 || k->idx > 3) {
1496 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1497 return -EINVAL;
1498 }
1499 } else {
1500 if (k->idx < 0 || k->idx > 7) {
1501 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1502 return -EINVAL;
1503 }
1504 }
1505 }
1506
1507 return 0;
1508}
1509
1510static struct cfg80211_cached_keys *
1511nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1512 struct genl_info *info, bool *no_ht)
1513{
1514 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1515 struct key_parse parse;
1516 struct nlattr *key;
1517 struct cfg80211_cached_keys *result;
1518 int rem, err, def = 0;
1519 bool have_key = false;
1520
1521 nla_for_each_nested(key, keys, rem) {
1522 have_key = true;
1523 break;
1524 }
1525
1526 if (!have_key)
1527 return NULL;
1528
1529 result = kzalloc(sizeof(*result), GFP_KERNEL);
1530 if (!result)
1531 return ERR_PTR(-ENOMEM);
1532
1533 result->def = -1;
1534
1535 nla_for_each_nested(key, keys, rem) {
1536 memset(&parse, 0, sizeof(parse));
1537 parse.idx = -1;
1538
1539 err = nl80211_parse_key_new(info, key, &parse);
1540 if (err)
1541 goto error;
1542 err = -EINVAL;
1543 if (!parse.p.key)
1544 goto error;
1545 if (parse.idx < 0 || parse.idx > 3) {
1546 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1547 goto error;
1548 }
1549 if (parse.def) {
1550 if (def) {
1551 GENL_SET_ERR_MSG(info,
1552 "only one key can be default");
1553 goto error;
1554 }
1555 def = 1;
1556 result->def = parse.idx;
1557 if (!parse.def_uni || !parse.def_multi)
1558 goto error;
1559 } else if (parse.defmgmt)
1560 goto error;
1561 err = cfg80211_validate_key_settings(rdev, &parse.p,
1562 parse.idx, false, NULL);
1563 if (err)
1564 goto error;
1565 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1566 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1567 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1568 err = -EINVAL;
1569 goto error;
1570 }
1571 result->params[parse.idx].cipher = parse.p.cipher;
1572 result->params[parse.idx].key_len = parse.p.key_len;
1573 result->params[parse.idx].key = result->data[parse.idx];
1574 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1575
1576 /* must be WEP key if we got here */
1577 if (no_ht)
1578 *no_ht = true;
1579 }
1580
1581 if (result->def < 0) {
1582 err = -EINVAL;
1583 GENL_SET_ERR_MSG(info, "need a default/TX key");
1584 goto error;
1585 }
1586
1587 return result;
1588 error:
1589 kfree_sensitive(result);
1590 return ERR_PTR(err);
1591}
1592
1593static int nl80211_key_allowed(struct wireless_dev *wdev)
1594{
1595 lockdep_assert_wiphy(wdev->wiphy);
1596
1597 switch (wdev->iftype) {
1598 case NL80211_IFTYPE_AP:
1599 case NL80211_IFTYPE_AP_VLAN:
1600 case NL80211_IFTYPE_P2P_GO:
1601 case NL80211_IFTYPE_MESH_POINT:
1602 break;
1603 case NL80211_IFTYPE_ADHOC:
1604 if (wdev->u.ibss.current_bss)
1605 return 0;
1606 return -ENOLINK;
1607 case NL80211_IFTYPE_STATION:
1608 case NL80211_IFTYPE_P2P_CLIENT:
1609 if (wdev->connected)
1610 return 0;
1611 return -ENOLINK;
1612 case NL80211_IFTYPE_NAN:
1613 if (wiphy_ext_feature_isset(wdev->wiphy,
1614 NL80211_EXT_FEATURE_SECURE_NAN))
1615 return 0;
1616 return -EINVAL;
1617 case NL80211_IFTYPE_UNSPECIFIED:
1618 case NL80211_IFTYPE_OCB:
1619 case NL80211_IFTYPE_MONITOR:
1620 case NL80211_IFTYPE_P2P_DEVICE:
1621 case NL80211_IFTYPE_WDS:
1622 case NUM_NL80211_IFTYPES:
1623 return -EINVAL;
1624 }
1625
1626 return 0;
1627}
1628
1629static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1630 u32 freq)
1631{
1632 struct ieee80211_channel *chan;
1633
1634 chan = ieee80211_get_channel_khz(wiphy, freq);
1635 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1636 return NULL;
1637 return chan;
1638}
1639
1640static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1641{
1642 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1643 int i;
1644
1645 if (!nl_modes)
1646 goto nla_put_failure;
1647
1648 i = 0;
1649 while (ifmodes) {
1650 if ((ifmodes & 1) && nla_put_flag(msg, i))
1651 goto nla_put_failure;
1652 ifmodes >>= 1;
1653 i++;
1654 }
1655
1656 nla_nest_end(msg, nl_modes);
1657 return 0;
1658
1659nla_put_failure:
1660 return -ENOBUFS;
1661}
1662
1663static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1664 const struct ieee80211_iface_combination *c,
1665 u16 nested)
1666{
1667 struct nlattr *nl_combi, *nl_limits;
1668 int i;
1669
1670 nl_combi = nla_nest_start_noflag(msg, idx | nested);
1671 if (!nl_combi)
1672 goto nla_put_failure;
1673
1674 nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1675 nested);
1676 if (!nl_limits)
1677 goto nla_put_failure;
1678
1679 for (i = 0; i < c->n_limits; i++) {
1680 struct nlattr *nl_limit;
1681
1682 nl_limit = nla_nest_start_noflag(msg, i + 1);
1683 if (!nl_limit)
1684 goto nla_put_failure;
1685 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1686 goto nla_put_failure;
1687 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1688 c->limits[i].types))
1689 goto nla_put_failure;
1690 nla_nest_end(msg, nl_limit);
1691 }
1692
1693 nla_nest_end(msg, nl_limits);
1694
1695 if (c->beacon_int_infra_match &&
1696 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1697 goto nla_put_failure;
1698 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1699 c->num_different_channels) ||
1700 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1701 c->max_interfaces))
1702 goto nla_put_failure;
1703 if (large &&
1704 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1705 c->radar_detect_widths) ||
1706 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1707 c->radar_detect_regions)))
1708 goto nla_put_failure;
1709 if (c->beacon_int_min_gcd &&
1710 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1711 c->beacon_int_min_gcd))
1712 goto nla_put_failure;
1713
1714 nla_nest_end(msg, nl_combi);
1715
1716 return 0;
1717nla_put_failure:
1718 return -ENOBUFS;
1719}
1720
1721static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1722 struct sk_buff *msg,
1723 int attr, int radio,
1724 bool large, u16 nested)
1725{
1726 const struct ieee80211_iface_combination *c;
1727 struct nlattr *nl_combis;
1728 int i, n;
1729
1730 nl_combis = nla_nest_start_noflag(msg, attr | nested);
1731 if (!nl_combis)
1732 goto nla_put_failure;
1733
1734 if (radio >= 0) {
1735 c = wiphy->radio[0].iface_combinations;
1736 n = wiphy->radio[0].n_iface_combinations;
1737 } else {
1738 c = wiphy->iface_combinations;
1739 n = wiphy->n_iface_combinations;
1740 }
1741 for (i = 0; i < n; i++)
1742 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1743 goto nla_put_failure;
1744
1745 nla_nest_end(msg, nl_combis);
1746
1747 return 0;
1748nla_put_failure:
1749 return -ENOBUFS;
1750}
1751
1752#ifdef CONFIG_PM
1753static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1754 struct sk_buff *msg)
1755{
1756 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1757 struct nlattr *nl_tcp;
1758
1759 if (!tcp)
1760 return 0;
1761
1762 nl_tcp = nla_nest_start_noflag(msg,
1763 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1764 if (!nl_tcp)
1765 return -ENOBUFS;
1766
1767 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1768 tcp->data_payload_max))
1769 return -ENOBUFS;
1770
1771 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1772 tcp->data_payload_max))
1773 return -ENOBUFS;
1774
1775 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1776 return -ENOBUFS;
1777
1778 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1779 sizeof(*tcp->tok), tcp->tok))
1780 return -ENOBUFS;
1781
1782 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1783 tcp->data_interval_max))
1784 return -ENOBUFS;
1785
1786 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1787 tcp->wake_payload_max))
1788 return -ENOBUFS;
1789
1790 nla_nest_end(msg, nl_tcp);
1791 return 0;
1792}
1793
1794static int nl80211_send_wowlan(struct sk_buff *msg,
1795 struct cfg80211_registered_device *rdev,
1796 bool large)
1797{
1798 struct nlattr *nl_wowlan;
1799
1800 if (!rdev->wiphy.wowlan)
1801 return 0;
1802
1803 nl_wowlan = nla_nest_start_noflag(msg,
1804 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1805 if (!nl_wowlan)
1806 return -ENOBUFS;
1807
1808 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1809 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1810 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1811 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1812 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1813 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1814 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1815 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1816 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1817 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1818 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1819 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1820 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1821 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1822 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1823 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1824 return -ENOBUFS;
1825
1826 if (rdev->wiphy.wowlan->n_patterns) {
1827 struct nl80211_pattern_support pat = {
1828 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1829 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1830 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1831 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1832 };
1833
1834 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1835 sizeof(pat), &pat))
1836 return -ENOBUFS;
1837 }
1838
1839 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1840 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1841 rdev->wiphy.wowlan->max_nd_match_sets))
1842 return -ENOBUFS;
1843
1844 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1845 return -ENOBUFS;
1846
1847 nla_nest_end(msg, nl_wowlan);
1848
1849 return 0;
1850}
1851#endif
1852
1853static int nl80211_send_coalesce(struct sk_buff *msg,
1854 struct cfg80211_registered_device *rdev)
1855{
1856 struct nl80211_coalesce_rule_support rule;
1857
1858 if (!rdev->wiphy.coalesce)
1859 return 0;
1860
1861 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1862 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1863 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1864 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1865 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1866 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1867
1868 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1869 return -ENOBUFS;
1870
1871 return 0;
1872}
1873
1874static int
1875nl80211_send_iftype_data(struct sk_buff *msg,
1876 const struct ieee80211_supported_band *sband,
1877 const struct ieee80211_sband_iftype_data *iftdata)
1878{
1879 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1880 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1881
1882 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1883 iftdata->types_mask))
1884 return -ENOBUFS;
1885
1886 if (he_cap->has_he) {
1887 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1888 sizeof(he_cap->he_cap_elem.mac_cap_info),
1889 he_cap->he_cap_elem.mac_cap_info) ||
1890 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1891 sizeof(he_cap->he_cap_elem.phy_cap_info),
1892 he_cap->he_cap_elem.phy_cap_info) ||
1893 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1894 sizeof(he_cap->he_mcs_nss_supp),
1895 &he_cap->he_mcs_nss_supp) ||
1896 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1897 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1898 return -ENOBUFS;
1899 }
1900
1901 if (eht_cap->has_eht && he_cap->has_he) {
1902 u8 mcs_nss_size, ppe_thresh_size;
1903 u16 ppe_thres_hdr;
1904 bool is_ap;
1905
1906 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1907 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1908
1909 mcs_nss_size =
1910 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1911 &eht_cap->eht_cap_elem,
1912 is_ap);
1913
1914 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1915 ppe_thresh_size =
1916 ieee80211_eht_ppe_size(ppe_thres_hdr,
1917 eht_cap->eht_cap_elem.phy_cap_info);
1918
1919 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1920 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1921 eht_cap->eht_cap_elem.mac_cap_info) ||
1922 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1923 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1924 eht_cap->eht_cap_elem.phy_cap_info) ||
1925 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1926 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1927 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1928 ppe_thresh_size, eht_cap->eht_ppe_thres))
1929 return -ENOBUFS;
1930 }
1931
1932 if (sband->band == NL80211_BAND_6GHZ &&
1933 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1934 sizeof(iftdata->he_6ghz_capa),
1935 &iftdata->he_6ghz_capa))
1936 return -ENOBUFS;
1937
1938 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1939 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1940 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1941 return -ENOBUFS;
1942
1943 return 0;
1944}
1945
1946static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1947 struct ieee80211_supported_band *sband,
1948 bool large)
1949{
1950 struct nlattr *nl_rates, *nl_rate;
1951 struct ieee80211_rate *rate;
1952 int i;
1953
1954 /* add HT info */
1955 if (sband->ht_cap.ht_supported &&
1956 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1957 sizeof(sband->ht_cap.mcs),
1958 &sband->ht_cap.mcs) ||
1959 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1960 sband->ht_cap.cap) ||
1961 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1962 sband->ht_cap.ampdu_factor) ||
1963 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1964 sband->ht_cap.ampdu_density)))
1965 return -ENOBUFS;
1966
1967 /* add VHT info */
1968 if (sband->vht_cap.vht_supported &&
1969 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1970 sizeof(sband->vht_cap.vht_mcs),
1971 &sband->vht_cap.vht_mcs) ||
1972 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1973 sband->vht_cap.cap)))
1974 return -ENOBUFS;
1975
1976 if (large && sband->n_iftype_data) {
1977 struct nlattr *nl_iftype_data =
1978 nla_nest_start_noflag(msg,
1979 NL80211_BAND_ATTR_IFTYPE_DATA);
1980 const struct ieee80211_sband_iftype_data *iftd;
1981 int err;
1982
1983 if (!nl_iftype_data)
1984 return -ENOBUFS;
1985
1986 for_each_sband_iftype_data(sband, i, iftd) {
1987 struct nlattr *iftdata;
1988
1989 iftdata = nla_nest_start_noflag(msg, i + 1);
1990 if (!iftdata)
1991 return -ENOBUFS;
1992
1993 err = nl80211_send_iftype_data(msg, sband, iftd);
1994 if (err)
1995 return err;
1996
1997 nla_nest_end(msg, iftdata);
1998 }
1999
2000 nla_nest_end(msg, nl_iftype_data);
2001 }
2002
2003 /* add EDMG info */
2004 if (large && sband->edmg_cap.channels &&
2005 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2006 sband->edmg_cap.channels) ||
2007 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2008 sband->edmg_cap.bw_config)))
2009
2010 return -ENOBUFS;
2011
2012 /* add bitrates */
2013 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2014 if (!nl_rates)
2015 return -ENOBUFS;
2016
2017 for (i = 0; i < sband->n_bitrates; i++) {
2018 nl_rate = nla_nest_start_noflag(msg, i);
2019 if (!nl_rate)
2020 return -ENOBUFS;
2021
2022 rate = &sband->bitrates[i];
2023 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2024 rate->bitrate))
2025 return -ENOBUFS;
2026 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2027 nla_put_flag(msg,
2028 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2029 return -ENOBUFS;
2030
2031 nla_nest_end(msg, nl_rate);
2032 }
2033
2034 nla_nest_end(msg, nl_rates);
2035
2036 /* S1G capabilities */
2037 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2038 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2039 sizeof(sband->s1g_cap.cap),
2040 sband->s1g_cap.cap) ||
2041 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2042 sizeof(sband->s1g_cap.nss_mcs),
2043 sband->s1g_cap.nss_mcs)))
2044 return -ENOBUFS;
2045
2046 return 0;
2047}
2048
2049static int
2050nl80211_send_mgmt_stypes(struct sk_buff *msg,
2051 const struct ieee80211_txrx_stypes *mgmt_stypes)
2052{
2053 u16 stypes;
2054 struct nlattr *nl_ftypes, *nl_ifs;
2055 enum nl80211_iftype ift;
2056 int i;
2057
2058 if (!mgmt_stypes)
2059 return 0;
2060
2061 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2062 if (!nl_ifs)
2063 return -ENOBUFS;
2064
2065 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2066 nl_ftypes = nla_nest_start_noflag(msg, ift);
2067 if (!nl_ftypes)
2068 return -ENOBUFS;
2069 i = 0;
2070 stypes = mgmt_stypes[ift].tx;
2071 while (stypes) {
2072 if ((stypes & 1) &&
2073 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2074 (i << 4) | IEEE80211_FTYPE_MGMT))
2075 return -ENOBUFS;
2076 stypes >>= 1;
2077 i++;
2078 }
2079 nla_nest_end(msg, nl_ftypes);
2080 }
2081
2082 nla_nest_end(msg, nl_ifs);
2083
2084 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2085 if (!nl_ifs)
2086 return -ENOBUFS;
2087
2088 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2089 nl_ftypes = nla_nest_start_noflag(msg, ift);
2090 if (!nl_ftypes)
2091 return -ENOBUFS;
2092 i = 0;
2093 stypes = mgmt_stypes[ift].rx;
2094 while (stypes) {
2095 if ((stypes & 1) &&
2096 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2097 (i << 4) | IEEE80211_FTYPE_MGMT))
2098 return -ENOBUFS;
2099 stypes >>= 1;
2100 i++;
2101 }
2102 nla_nest_end(msg, nl_ftypes);
2103 }
2104 nla_nest_end(msg, nl_ifs);
2105
2106 return 0;
2107}
2108
2109#define CMD(op, n) \
2110 do { \
2111 if (rdev->ops->op) { \
2112 i++; \
2113 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2114 goto nla_put_failure; \
2115 } \
2116 } while (0)
2117
2118static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2119 struct sk_buff *msg)
2120{
2121 int i = 0;
2122
2123 /*
2124 * do *NOT* add anything into this function, new things need to be
2125 * advertised only to new versions of userspace that can deal with
2126 * the split (and they can't possibly care about new features...
2127 */
2128 CMD(add_virtual_intf, NEW_INTERFACE);
2129 CMD(change_virtual_intf, SET_INTERFACE);
2130 CMD(add_key, NEW_KEY);
2131 CMD(start_ap, START_AP);
2132 CMD(add_station, NEW_STATION);
2133 CMD(add_mpath, NEW_MPATH);
2134 CMD(update_mesh_config, SET_MESH_CONFIG);
2135 CMD(change_bss, SET_BSS);
2136 CMD(auth, AUTHENTICATE);
2137 CMD(assoc, ASSOCIATE);
2138 CMD(deauth, DEAUTHENTICATE);
2139 CMD(disassoc, DISASSOCIATE);
2140 CMD(join_ibss, JOIN_IBSS);
2141 CMD(join_mesh, JOIN_MESH);
2142 CMD(set_pmksa, SET_PMKSA);
2143 CMD(del_pmksa, DEL_PMKSA);
2144 CMD(flush_pmksa, FLUSH_PMKSA);
2145 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2146 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2147 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2148 CMD(mgmt_tx, FRAME);
2149 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2150 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2151 i++;
2152 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2153 goto nla_put_failure;
2154 }
2155 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2156 rdev->ops->join_mesh) {
2157 i++;
2158 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2159 goto nla_put_failure;
2160 }
2161 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2162 CMD(tdls_mgmt, TDLS_MGMT);
2163 CMD(tdls_oper, TDLS_OPER);
2164 }
2165 if (rdev->wiphy.max_sched_scan_reqs)
2166 CMD(sched_scan_start, START_SCHED_SCAN);
2167 CMD(probe_client, PROBE_CLIENT);
2168 CMD(set_noack_map, SET_NOACK_MAP);
2169 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2170 i++;
2171 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2172 goto nla_put_failure;
2173 }
2174 CMD(start_p2p_device, START_P2P_DEVICE);
2175 CMD(set_mcast_rate, SET_MCAST_RATE);
2176#ifdef CONFIG_NL80211_TESTMODE
2177 CMD(testmode_cmd, TESTMODE);
2178#endif
2179
2180 if (rdev->ops->connect || rdev->ops->auth) {
2181 i++;
2182 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2183 goto nla_put_failure;
2184 }
2185
2186 if (rdev->ops->disconnect || rdev->ops->deauth) {
2187 i++;
2188 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2189 goto nla_put_failure;
2190 }
2191
2192 return i;
2193 nla_put_failure:
2194 return -ENOBUFS;
2195}
2196
2197static int
2198nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2199 struct sk_buff *msg)
2200{
2201 struct nlattr *ftm;
2202
2203 if (!cap->ftm.supported)
2204 return 0;
2205
2206 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2207 if (!ftm)
2208 return -ENOBUFS;
2209
2210 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2211 return -ENOBUFS;
2212 if (cap->ftm.non_asap &&
2213 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2214 return -ENOBUFS;
2215 if (cap->ftm.request_lci &&
2216 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2217 return -ENOBUFS;
2218 if (cap->ftm.request_civicloc &&
2219 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2220 return -ENOBUFS;
2221 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2222 cap->ftm.preambles))
2223 return -ENOBUFS;
2224 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2225 cap->ftm.bandwidths))
2226 return -ENOBUFS;
2227 if (cap->ftm.max_bursts_exponent >= 0 &&
2228 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2229 cap->ftm.max_bursts_exponent))
2230 return -ENOBUFS;
2231 if (cap->ftm.max_ftms_per_burst &&
2232 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2233 cap->ftm.max_ftms_per_burst))
2234 return -ENOBUFS;
2235 if (cap->ftm.trigger_based &&
2236 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2237 return -ENOBUFS;
2238 if (cap->ftm.non_trigger_based &&
2239 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2240 return -ENOBUFS;
2241
2242 nla_nest_end(msg, ftm);
2243 return 0;
2244}
2245
2246static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2247 struct sk_buff *msg)
2248{
2249 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2250 struct nlattr *pmsr, *caps;
2251
2252 if (!cap)
2253 return 0;
2254
2255 /*
2256 * we don't need to clean up anything here since the caller
2257 * will genlmsg_cancel() if we fail
2258 */
2259
2260 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2261 if (!pmsr)
2262 return -ENOBUFS;
2263
2264 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2265 return -ENOBUFS;
2266
2267 if (cap->report_ap_tsf &&
2268 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2269 return -ENOBUFS;
2270
2271 if (cap->randomize_mac_addr &&
2272 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2273 return -ENOBUFS;
2274
2275 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2276 if (!caps)
2277 return -ENOBUFS;
2278
2279 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2280 return -ENOBUFS;
2281
2282 nla_nest_end(msg, caps);
2283 nla_nest_end(msg, pmsr);
2284
2285 return 0;
2286}
2287
2288static int
2289nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2290 struct sk_buff *msg)
2291{
2292 int i;
2293 struct nlattr *nested, *nested_akms;
2294 const struct wiphy_iftype_akm_suites *iftype_akms;
2295
2296 if (!rdev->wiphy.num_iftype_akm_suites ||
2297 !rdev->wiphy.iftype_akm_suites)
2298 return 0;
2299
2300 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2301 if (!nested)
2302 return -ENOBUFS;
2303
2304 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2305 nested_akms = nla_nest_start(msg, i + 1);
2306 if (!nested_akms)
2307 return -ENOBUFS;
2308
2309 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2310
2311 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2312 iftype_akms->iftypes_mask))
2313 return -ENOBUFS;
2314
2315 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2316 sizeof(u32) * iftype_akms->n_akm_suites,
2317 iftype_akms->akm_suites)) {
2318 return -ENOBUFS;
2319 }
2320 nla_nest_end(msg, nested_akms);
2321 }
2322
2323 nla_nest_end(msg, nested);
2324
2325 return 0;
2326}
2327
2328static int
2329nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2330 struct sk_buff *msg)
2331{
2332 struct nlattr *supp;
2333
2334 if (!rdev->wiphy.tid_config_support.vif &&
2335 !rdev->wiphy.tid_config_support.peer)
2336 return 0;
2337
2338 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2339 if (!supp)
2340 return -ENOSPC;
2341
2342 if (rdev->wiphy.tid_config_support.vif &&
2343 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2344 rdev->wiphy.tid_config_support.vif,
2345 NL80211_TID_CONFIG_ATTR_PAD))
2346 goto fail;
2347
2348 if (rdev->wiphy.tid_config_support.peer &&
2349 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2350 rdev->wiphy.tid_config_support.peer,
2351 NL80211_TID_CONFIG_ATTR_PAD))
2352 goto fail;
2353
2354 /* for now we just use the same value ... makes more sense */
2355 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2356 rdev->wiphy.tid_config_support.max_retry))
2357 goto fail;
2358 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2359 rdev->wiphy.tid_config_support.max_retry))
2360 goto fail;
2361
2362 nla_nest_end(msg, supp);
2363
2364 return 0;
2365fail:
2366 nla_nest_cancel(msg, supp);
2367 return -ENOBUFS;
2368}
2369
2370static int
2371nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2372 struct sk_buff *msg)
2373{
2374 struct nlattr *sar_capa, *specs, *sub_freq_range;
2375 u8 num_freq_ranges;
2376 int i;
2377
2378 if (!rdev->wiphy.sar_capa)
2379 return 0;
2380
2381 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2382
2383 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2384 if (!sar_capa)
2385 return -ENOSPC;
2386
2387 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2388 goto fail;
2389
2390 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2391 if (!specs)
2392 goto fail;
2393
2394 /* report supported freq_ranges */
2395 for (i = 0; i < num_freq_ranges; i++) {
2396 sub_freq_range = nla_nest_start(msg, i + 1);
2397 if (!sub_freq_range)
2398 goto fail;
2399
2400 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2401 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2402 goto fail;
2403
2404 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2405 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2406 goto fail;
2407
2408 nla_nest_end(msg, sub_freq_range);
2409 }
2410
2411 nla_nest_end(msg, specs);
2412 nla_nest_end(msg, sar_capa);
2413
2414 return 0;
2415fail:
2416 nla_nest_cancel(msg, sar_capa);
2417 return -ENOBUFS;
2418}
2419
2420static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2421{
2422 struct nlattr *config;
2423
2424 if (!wiphy->mbssid_max_interfaces)
2425 return 0;
2426
2427 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2428 if (!config)
2429 return -ENOBUFS;
2430
2431 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2432 wiphy->mbssid_max_interfaces))
2433 goto fail;
2434
2435 if (wiphy->ema_max_profile_periodicity &&
2436 nla_put_u8(msg,
2437 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2438 wiphy->ema_max_profile_periodicity))
2439 goto fail;
2440
2441 nla_nest_end(msg, config);
2442 return 0;
2443
2444fail:
2445 nla_nest_cancel(msg, config);
2446 return -ENOBUFS;
2447}
2448
2449static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2450{
2451 const struct wiphy_radio *r = &wiphy->radio[idx];
2452 struct nlattr *radio, *freq;
2453 int i;
2454
2455 radio = nla_nest_start(msg, idx);
2456 if (!radio)
2457 return -ENOBUFS;
2458
2459 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2460 goto nla_put_failure;
2461
2462 if (r->antenna_mask &&
2463 nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2464 r->antenna_mask))
2465 goto nla_put_failure;
2466
2467 for (i = 0; i < r->n_freq_range; i++) {
2468 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2469
2470 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2471 if (!freq)
2472 goto nla_put_failure;
2473
2474 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2475 range->start_freq) ||
2476 nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2477 range->end_freq))
2478 goto nla_put_failure;
2479
2480 nla_nest_end(msg, freq);
2481 }
2482
2483 for (i = 0; i < r->n_iface_combinations; i++)
2484 if (nl80211_put_ifcomb_data(msg, true,
2485 NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2486 &r->iface_combinations[i],
2487 NLA_F_NESTED))
2488 goto nla_put_failure;
2489
2490 nla_nest_end(msg, radio);
2491
2492 return 0;
2493
2494nla_put_failure:
2495 return -ENOBUFS;
2496}
2497
2498static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2499{
2500 struct nlattr *radios;
2501 int i;
2502
2503 if (!wiphy->n_radio)
2504 return 0;
2505
2506 radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2507 if (!radios)
2508 return -ENOBUFS;
2509
2510 for (i = 0; i < wiphy->n_radio; i++)
2511 if (nl80211_put_radio(wiphy, msg, i))
2512 goto fail;
2513
2514 nla_nest_end(msg, radios);
2515
2516 if (nl80211_put_iface_combinations(wiphy, msg,
2517 NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2518 -1, true, NLA_F_NESTED))
2519 return -ENOBUFS;
2520
2521 return 0;
2522
2523fail:
2524 nla_nest_cancel(msg, radios);
2525 return -ENOBUFS;
2526}
2527
2528struct nl80211_dump_wiphy_state {
2529 s64 filter_wiphy;
2530 long start;
2531 long split_start, band_start, chan_start, capa_start;
2532 bool split;
2533};
2534
2535static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2536 enum nl80211_commands cmd,
2537 struct sk_buff *msg, u32 portid, u32 seq,
2538 int flags, struct nl80211_dump_wiphy_state *state)
2539{
2540 void *hdr;
2541 struct nlattr *nl_bands, *nl_band;
2542 struct nlattr *nl_freqs, *nl_freq;
2543 struct nlattr *nl_cmds;
2544 enum nl80211_band band;
2545 struct ieee80211_channel *chan;
2546 int i;
2547 const struct ieee80211_txrx_stypes *mgmt_stypes =
2548 rdev->wiphy.mgmt_stypes;
2549 u32 features;
2550
2551 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2552 if (!hdr)
2553 return -ENOBUFS;
2554
2555 if (WARN_ON(!state))
2556 return -EINVAL;
2557
2558 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2559 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2560 wiphy_name(&rdev->wiphy)) ||
2561 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2562 cfg80211_rdev_list_generation))
2563 goto nla_put_failure;
2564
2565 if (cmd != NL80211_CMD_NEW_WIPHY)
2566 goto finish;
2567
2568 switch (state->split_start) {
2569 case 0:
2570 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2571 rdev->wiphy.retry_short) ||
2572 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2573 rdev->wiphy.retry_long) ||
2574 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2575 rdev->wiphy.frag_threshold) ||
2576 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2577 rdev->wiphy.rts_threshold) ||
2578 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2579 rdev->wiphy.coverage_class) ||
2580 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2581 rdev->wiphy.max_scan_ssids) ||
2582 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2583 rdev->wiphy.max_sched_scan_ssids) ||
2584 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2585 rdev->wiphy.max_scan_ie_len) ||
2586 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2587 rdev->wiphy.max_sched_scan_ie_len) ||
2588 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2589 rdev->wiphy.max_match_sets))
2590 goto nla_put_failure;
2591
2592 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2593 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2594 goto nla_put_failure;
2595 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2596 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2597 goto nla_put_failure;
2598 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2599 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2600 goto nla_put_failure;
2601 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2602 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2603 goto nla_put_failure;
2604 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2605 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2606 goto nla_put_failure;
2607 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2608 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2609 goto nla_put_failure;
2610 state->split_start++;
2611 if (state->split)
2612 break;
2613 fallthrough;
2614 case 1:
2615 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2616 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2617 rdev->wiphy.cipher_suites))
2618 goto nla_put_failure;
2619
2620 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2621 rdev->wiphy.max_num_pmkids))
2622 goto nla_put_failure;
2623
2624 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2625 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2626 goto nla_put_failure;
2627
2628 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2629 rdev->wiphy.available_antennas_tx) ||
2630 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2631 rdev->wiphy.available_antennas_rx))
2632 goto nla_put_failure;
2633
2634 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2635 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2636 rdev->wiphy.probe_resp_offload))
2637 goto nla_put_failure;
2638
2639 if ((rdev->wiphy.available_antennas_tx ||
2640 rdev->wiphy.available_antennas_rx) &&
2641 rdev->ops->get_antenna) {
2642 u32 tx_ant = 0, rx_ant = 0;
2643 int res;
2644
2645 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2646 if (!res) {
2647 if (nla_put_u32(msg,
2648 NL80211_ATTR_WIPHY_ANTENNA_TX,
2649 tx_ant) ||
2650 nla_put_u32(msg,
2651 NL80211_ATTR_WIPHY_ANTENNA_RX,
2652 rx_ant))
2653 goto nla_put_failure;
2654 }
2655 }
2656
2657 state->split_start++;
2658 if (state->split)
2659 break;
2660 fallthrough;
2661 case 2:
2662 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2663 rdev->wiphy.interface_modes))
2664 goto nla_put_failure;
2665 state->split_start++;
2666 if (state->split)
2667 break;
2668 fallthrough;
2669 case 3:
2670 nl_bands = nla_nest_start_noflag(msg,
2671 NL80211_ATTR_WIPHY_BANDS);
2672 if (!nl_bands)
2673 goto nla_put_failure;
2674
2675 for (band = state->band_start;
2676 band < (state->split ?
2677 NUM_NL80211_BANDS :
2678 NL80211_BAND_60GHZ + 1);
2679 band++) {
2680 struct ieee80211_supported_band *sband;
2681
2682 /* omit higher bands for ancient software */
2683 if (band > NL80211_BAND_5GHZ && !state->split)
2684 break;
2685
2686 sband = rdev->wiphy.bands[band];
2687
2688 if (!sband)
2689 continue;
2690
2691 nl_band = nla_nest_start_noflag(msg, band);
2692 if (!nl_band)
2693 goto nla_put_failure;
2694
2695 switch (state->chan_start) {
2696 case 0:
2697 if (nl80211_send_band_rateinfo(msg, sband,
2698 state->split))
2699 goto nla_put_failure;
2700 state->chan_start++;
2701 if (state->split)
2702 break;
2703 fallthrough;
2704 default:
2705 /* add frequencies */
2706 nl_freqs = nla_nest_start_noflag(msg,
2707 NL80211_BAND_ATTR_FREQS);
2708 if (!nl_freqs)
2709 goto nla_put_failure;
2710
2711 for (i = state->chan_start - 1;
2712 i < sband->n_channels;
2713 i++) {
2714 nl_freq = nla_nest_start_noflag(msg,
2715 i);
2716 if (!nl_freq)
2717 goto nla_put_failure;
2718
2719 chan = &sband->channels[i];
2720
2721 if (nl80211_msg_put_channel(
2722 msg, &rdev->wiphy, chan,
2723 state->split))
2724 goto nla_put_failure;
2725
2726 nla_nest_end(msg, nl_freq);
2727 if (state->split)
2728 break;
2729 }
2730 if (i < sband->n_channels)
2731 state->chan_start = i + 2;
2732 else
2733 state->chan_start = 0;
2734 nla_nest_end(msg, nl_freqs);
2735 }
2736
2737 nla_nest_end(msg, nl_band);
2738
2739 if (state->split) {
2740 /* start again here */
2741 if (state->chan_start)
2742 band--;
2743 break;
2744 }
2745 }
2746 nla_nest_end(msg, nl_bands);
2747
2748 if (band < NUM_NL80211_BANDS)
2749 state->band_start = band + 1;
2750 else
2751 state->band_start = 0;
2752
2753 /* if bands & channels are done, continue outside */
2754 if (state->band_start == 0 && state->chan_start == 0)
2755 state->split_start++;
2756 if (state->split)
2757 break;
2758 fallthrough;
2759 case 4:
2760 nl_cmds = nla_nest_start_noflag(msg,
2761 NL80211_ATTR_SUPPORTED_COMMANDS);
2762 if (!nl_cmds)
2763 goto nla_put_failure;
2764
2765 i = nl80211_add_commands_unsplit(rdev, msg);
2766 if (i < 0)
2767 goto nla_put_failure;
2768 if (state->split) {
2769 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2770 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2771 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2772 CMD(channel_switch, CHANNEL_SWITCH);
2773 CMD(set_qos_map, SET_QOS_MAP);
2774 if (rdev->wiphy.features &
2775 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2776 CMD(add_tx_ts, ADD_TX_TS);
2777 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2778 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2779 CMD(update_ft_ies, UPDATE_FT_IES);
2780 if (rdev->wiphy.sar_capa)
2781 CMD(set_sar_specs, SET_SAR_SPECS);
2782 CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2783 }
2784#undef CMD
2785
2786 nla_nest_end(msg, nl_cmds);
2787 state->split_start++;
2788 if (state->split)
2789 break;
2790 fallthrough;
2791 case 5:
2792 if (rdev->ops->remain_on_channel &&
2793 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2794 nla_put_u32(msg,
2795 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2796 rdev->wiphy.max_remain_on_channel_duration))
2797 goto nla_put_failure;
2798
2799 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2800 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2801 goto nla_put_failure;
2802
2803 state->split_start++;
2804 if (state->split)
2805 break;
2806 fallthrough;
2807 case 6:
2808#ifdef CONFIG_PM
2809 if (nl80211_send_wowlan(msg, rdev, state->split))
2810 goto nla_put_failure;
2811 state->split_start++;
2812 if (state->split)
2813 break;
2814#else
2815 state->split_start++;
2816#endif
2817 fallthrough;
2818 case 7:
2819 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2820 rdev->wiphy.software_iftypes))
2821 goto nla_put_failure;
2822
2823 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2824 NL80211_ATTR_INTERFACE_COMBINATIONS,
2825 rdev->wiphy.n_radio ? 0 : -1,
2826 state->split, 0))
2827 goto nla_put_failure;
2828
2829 state->split_start++;
2830 if (state->split)
2831 break;
2832 fallthrough;
2833 case 8:
2834 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2835 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2836 rdev->wiphy.ap_sme_capa))
2837 goto nla_put_failure;
2838
2839 features = rdev->wiphy.features;
2840 /*
2841 * We can only add the per-channel limit information if the
2842 * dump is split, otherwise it makes it too big. Therefore
2843 * only advertise it in that case.
2844 */
2845 if (state->split)
2846 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2847 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2848 goto nla_put_failure;
2849
2850 if (rdev->wiphy.ht_capa_mod_mask &&
2851 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2852 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2853 rdev->wiphy.ht_capa_mod_mask))
2854 goto nla_put_failure;
2855
2856 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2857 rdev->wiphy.max_acl_mac_addrs &&
2858 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2859 rdev->wiphy.max_acl_mac_addrs))
2860 goto nla_put_failure;
2861
2862 /*
2863 * Any information below this point is only available to
2864 * applications that can deal with it being split. This
2865 * helps ensure that newly added capabilities don't break
2866 * older tools by overrunning their buffers.
2867 *
2868 * We still increment split_start so that in the split
2869 * case we'll continue with more data in the next round,
2870 * but break unconditionally so unsplit data stops here.
2871 */
2872 if (state->split)
2873 state->split_start++;
2874 else
2875 state->split_start = 0;
2876 break;
2877 case 9:
2878 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2879 goto nla_put_failure;
2880
2881 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2882 rdev->wiphy.max_sched_scan_plans) ||
2883 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2884 rdev->wiphy.max_sched_scan_plan_interval) ||
2885 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2886 rdev->wiphy.max_sched_scan_plan_iterations))
2887 goto nla_put_failure;
2888
2889 if (rdev->wiphy.extended_capabilities &&
2890 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2891 rdev->wiphy.extended_capabilities_len,
2892 rdev->wiphy.extended_capabilities) ||
2893 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2894 rdev->wiphy.extended_capabilities_len,
2895 rdev->wiphy.extended_capabilities_mask)))
2896 goto nla_put_failure;
2897
2898 if (rdev->wiphy.vht_capa_mod_mask &&
2899 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2900 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2901 rdev->wiphy.vht_capa_mod_mask))
2902 goto nla_put_failure;
2903
2904 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2905 rdev->wiphy.perm_addr))
2906 goto nla_put_failure;
2907
2908 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2909 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2910 rdev->wiphy.addr_mask))
2911 goto nla_put_failure;
2912
2913 if (rdev->wiphy.n_addresses > 1) {
2914 void *attr;
2915
2916 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2917 if (!attr)
2918 goto nla_put_failure;
2919
2920 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2921 if (nla_put(msg, i + 1, ETH_ALEN,
2922 rdev->wiphy.addresses[i].addr))
2923 goto nla_put_failure;
2924
2925 nla_nest_end(msg, attr);
2926 }
2927
2928 state->split_start++;
2929 break;
2930 case 10:
2931 if (nl80211_send_coalesce(msg, rdev))
2932 goto nla_put_failure;
2933
2934 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2935 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2936 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2937 goto nla_put_failure;
2938
2939 if (rdev->wiphy.max_ap_assoc_sta &&
2940 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2941 rdev->wiphy.max_ap_assoc_sta))
2942 goto nla_put_failure;
2943
2944 state->split_start++;
2945 break;
2946 case 11:
2947 if (rdev->wiphy.n_vendor_commands) {
2948 const struct nl80211_vendor_cmd_info *info;
2949 struct nlattr *nested;
2950
2951 nested = nla_nest_start_noflag(msg,
2952 NL80211_ATTR_VENDOR_DATA);
2953 if (!nested)
2954 goto nla_put_failure;
2955
2956 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2957 info = &rdev->wiphy.vendor_commands[i].info;
2958 if (nla_put(msg, i + 1, sizeof(*info), info))
2959 goto nla_put_failure;
2960 }
2961 nla_nest_end(msg, nested);
2962 }
2963
2964 if (rdev->wiphy.n_vendor_events) {
2965 const struct nl80211_vendor_cmd_info *info;
2966 struct nlattr *nested;
2967
2968 nested = nla_nest_start_noflag(msg,
2969 NL80211_ATTR_VENDOR_EVENTS);
2970 if (!nested)
2971 goto nla_put_failure;
2972
2973 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2974 info = &rdev->wiphy.vendor_events[i];
2975 if (nla_put(msg, i + 1, sizeof(*info), info))
2976 goto nla_put_failure;
2977 }
2978 nla_nest_end(msg, nested);
2979 }
2980 state->split_start++;
2981 break;
2982 case 12:
2983 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2984 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2985 rdev->wiphy.max_num_csa_counters))
2986 goto nla_put_failure;
2987
2988 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2989 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2990 goto nla_put_failure;
2991
2992 if (rdev->wiphy.max_sched_scan_reqs &&
2993 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2994 rdev->wiphy.max_sched_scan_reqs))
2995 goto nla_put_failure;
2996
2997 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2998 sizeof(rdev->wiphy.ext_features),
2999 rdev->wiphy.ext_features))
3000 goto nla_put_failure;
3001
3002 if (rdev->wiphy.bss_select_support) {
3003 struct nlattr *nested;
3004 u32 bss_select_support = rdev->wiphy.bss_select_support;
3005
3006 nested = nla_nest_start_noflag(msg,
3007 NL80211_ATTR_BSS_SELECT);
3008 if (!nested)
3009 goto nla_put_failure;
3010
3011 i = 0;
3012 while (bss_select_support) {
3013 if ((bss_select_support & 1) &&
3014 nla_put_flag(msg, i))
3015 goto nla_put_failure;
3016 i++;
3017 bss_select_support >>= 1;
3018 }
3019 nla_nest_end(msg, nested);
3020 }
3021
3022 state->split_start++;
3023 break;
3024 case 13:
3025 if (rdev->wiphy.num_iftype_ext_capab &&
3026 rdev->wiphy.iftype_ext_capab) {
3027 struct nlattr *nested_ext_capab, *nested;
3028
3029 nested = nla_nest_start_noflag(msg,
3030 NL80211_ATTR_IFTYPE_EXT_CAPA);
3031 if (!nested)
3032 goto nla_put_failure;
3033
3034 for (i = state->capa_start;
3035 i < rdev->wiphy.num_iftype_ext_capab; i++) {
3036 const struct wiphy_iftype_ext_capab *capab;
3037
3038 capab = &rdev->wiphy.iftype_ext_capab[i];
3039
3040 nested_ext_capab = nla_nest_start_noflag(msg,
3041 i);
3042 if (!nested_ext_capab ||
3043 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3044 capab->iftype) ||
3045 nla_put(msg, NL80211_ATTR_EXT_CAPA,
3046 capab->extended_capabilities_len,
3047 capab->extended_capabilities) ||
3048 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3049 capab->extended_capabilities_len,
3050 capab->extended_capabilities_mask))
3051 goto nla_put_failure;
3052
3053 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3054 (nla_put_u16(msg,
3055 NL80211_ATTR_EML_CAPABILITY,
3056 capab->eml_capabilities) ||
3057 nla_put_u16(msg,
3058 NL80211_ATTR_MLD_CAPA_AND_OPS,
3059 capab->mld_capa_and_ops)))
3060 goto nla_put_failure;
3061
3062 nla_nest_end(msg, nested_ext_capab);
3063 if (state->split)
3064 break;
3065 }
3066 nla_nest_end(msg, nested);
3067 if (i < rdev->wiphy.num_iftype_ext_capab) {
3068 state->capa_start = i + 1;
3069 break;
3070 }
3071 }
3072
3073 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3074 rdev->wiphy.nan_supported_bands))
3075 goto nla_put_failure;
3076
3077 if (wiphy_ext_feature_isset(&rdev->wiphy,
3078 NL80211_EXT_FEATURE_TXQS)) {
3079 struct cfg80211_txq_stats txqstats = {};
3080 int res;
3081
3082 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3083 if (!res &&
3084 !nl80211_put_txq_stats(msg, &txqstats,
3085 NL80211_ATTR_TXQ_STATS))
3086 goto nla_put_failure;
3087
3088 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3089 rdev->wiphy.txq_limit))
3090 goto nla_put_failure;
3091 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3092 rdev->wiphy.txq_memory_limit))
3093 goto nla_put_failure;
3094 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3095 rdev->wiphy.txq_quantum))
3096 goto nla_put_failure;
3097 }
3098
3099 state->split_start++;
3100 break;
3101 case 14:
3102 if (nl80211_send_pmsr_capa(rdev, msg))
3103 goto nla_put_failure;
3104
3105 state->split_start++;
3106 break;
3107 case 15:
3108 if (rdev->wiphy.akm_suites &&
3109 nla_put(msg, NL80211_ATTR_AKM_SUITES,
3110 sizeof(u32) * rdev->wiphy.n_akm_suites,
3111 rdev->wiphy.akm_suites))
3112 goto nla_put_failure;
3113
3114 if (nl80211_put_iftype_akm_suites(rdev, msg))
3115 goto nla_put_failure;
3116
3117 if (nl80211_put_tid_config_support(rdev, msg))
3118 goto nla_put_failure;
3119 state->split_start++;
3120 break;
3121 case 16:
3122 if (nl80211_put_sar_specs(rdev, msg))
3123 goto nla_put_failure;
3124
3125 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3126 goto nla_put_failure;
3127
3128 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3129 rdev->wiphy.max_num_akm_suites))
3130 goto nla_put_failure;
3131
3132 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3133 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3134
3135 if (rdev->wiphy.hw_timestamp_max_peers &&
3136 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3137 rdev->wiphy.hw_timestamp_max_peers))
3138 goto nla_put_failure;
3139
3140 state->split_start++;
3141 break;
3142 case 17:
3143 if (nl80211_put_radios(&rdev->wiphy, msg))
3144 goto nla_put_failure;
3145
3146 /* done */
3147 state->split_start = 0;
3148 break;
3149 }
3150 finish:
3151 genlmsg_end(msg, hdr);
3152 return 0;
3153
3154 nla_put_failure:
3155 genlmsg_cancel(msg, hdr);
3156 return -EMSGSIZE;
3157}
3158
3159static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3160 struct netlink_callback *cb,
3161 struct nl80211_dump_wiphy_state *state)
3162{
3163 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3164 int ret;
3165
3166 if (!tb)
3167 return -ENOMEM;
3168
3169 ret = nlmsg_parse_deprecated(cb->nlh,
3170 GENL_HDRLEN + nl80211_fam.hdrsize,
3171 tb, nl80211_fam.maxattr,
3172 nl80211_policy, NULL);
3173 /* ignore parse errors for backward compatibility */
3174 if (ret) {
3175 ret = 0;
3176 goto out;
3177 }
3178
3179 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3180 if (tb[NL80211_ATTR_WIPHY])
3181 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3182 if (tb[NL80211_ATTR_WDEV])
3183 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3184 if (tb[NL80211_ATTR_IFINDEX]) {
3185 struct net_device *netdev;
3186 struct cfg80211_registered_device *rdev;
3187 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3188
3189 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3190 if (!netdev) {
3191 ret = -ENODEV;
3192 goto out;
3193 }
3194 if (netdev->ieee80211_ptr) {
3195 rdev = wiphy_to_rdev(
3196 netdev->ieee80211_ptr->wiphy);
3197 state->filter_wiphy = rdev->wiphy_idx;
3198 }
3199 }
3200
3201 ret = 0;
3202out:
3203 kfree(tb);
3204 return ret;
3205}
3206
3207static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3208{
3209 int idx = 0, ret;
3210 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3211 struct cfg80211_registered_device *rdev;
3212
3213 rtnl_lock();
3214 if (!state) {
3215 state = kzalloc(sizeof(*state), GFP_KERNEL);
3216 if (!state) {
3217 rtnl_unlock();
3218 return -ENOMEM;
3219 }
3220 state->filter_wiphy = -1;
3221 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3222 if (ret) {
3223 kfree(state);
3224 rtnl_unlock();
3225 return ret;
3226 }
3227 cb->args[0] = (long)state;
3228 }
3229
3230 for_each_rdev(rdev) {
3231 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3232 continue;
3233 if (++idx <= state->start)
3234 continue;
3235 if (state->filter_wiphy != -1 &&
3236 state->filter_wiphy != rdev->wiphy_idx)
3237 continue;
3238 wiphy_lock(&rdev->wiphy);
3239 /* attempt to fit multiple wiphy data chunks into the skb */
3240 do {
3241 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3242 skb,
3243 NETLINK_CB(cb->skb).portid,
3244 cb->nlh->nlmsg_seq,
3245 NLM_F_MULTI, state);
3246 if (ret < 0) {
3247 /*
3248 * If sending the wiphy data didn't fit (ENOBUFS
3249 * or EMSGSIZE returned), this SKB is still
3250 * empty (so it's not too big because another
3251 * wiphy dataset is already in the skb) and
3252 * we've not tried to adjust the dump allocation
3253 * yet ... then adjust the alloc size to be
3254 * bigger, and return 1 but with the empty skb.
3255 * This results in an empty message being RX'ed
3256 * in userspace, but that is ignored.
3257 *
3258 * We can then retry with the larger buffer.
3259 */
3260 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3261 !skb->len && !state->split &&
3262 cb->min_dump_alloc < 4096) {
3263 cb->min_dump_alloc = 4096;
3264 state->split_start = 0;
3265 wiphy_unlock(&rdev->wiphy);
3266 rtnl_unlock();
3267 return 1;
3268 }
3269 idx--;
3270 break;
3271 }
3272 } while (state->split_start > 0);
3273 wiphy_unlock(&rdev->wiphy);
3274 break;
3275 }
3276 rtnl_unlock();
3277
3278 state->start = idx;
3279
3280 return skb->len;
3281}
3282
3283static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3284{
3285 kfree((void *)cb->args[0]);
3286 return 0;
3287}
3288
3289static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3290{
3291 struct sk_buff *msg;
3292 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3293 struct nl80211_dump_wiphy_state state = {};
3294
3295 msg = nlmsg_new(4096, GFP_KERNEL);
3296 if (!msg)
3297 return -ENOMEM;
3298
3299 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3300 info->snd_portid, info->snd_seq, 0,
3301 &state) < 0) {
3302 nlmsg_free(msg);
3303 return -ENOBUFS;
3304 }
3305
3306 return genlmsg_reply(msg, info);
3307}
3308
3309static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3310 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3311 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3312 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3313 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3314 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3315};
3316
3317static int parse_txq_params(struct nlattr *tb[],
3318 struct ieee80211_txq_params *txq_params)
3319{
3320 u8 ac;
3321
3322 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3323 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3324 !tb[NL80211_TXQ_ATTR_AIFS])
3325 return -EINVAL;
3326
3327 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3328 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3329 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3330 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3331 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3332
3333 if (ac >= NL80211_NUM_ACS)
3334 return -EINVAL;
3335 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3336 return 0;
3337}
3338
3339static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3340{
3341 /*
3342 * You can only set the channel explicitly for some interfaces,
3343 * most have their channel managed via their respective
3344 * "establish a connection" command (connect, join, ...)
3345 *
3346 * For AP/GO and mesh mode, the channel can be set with the
3347 * channel userspace API, but is only stored and passed to the
3348 * low-level driver when the AP starts or the mesh is joined.
3349 * This is for backward compatibility, userspace can also give
3350 * the channel in the start-ap or join-mesh commands instead.
3351 *
3352 * Monitors are special as they are normally slaved to
3353 * whatever else is going on, so they have their own special
3354 * operation to set the monitor channel if possible.
3355 */
3356 return !wdev ||
3357 wdev->iftype == NL80211_IFTYPE_AP ||
3358 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3359 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3360 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3361}
3362
3363static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3364 struct genl_info *info, bool monitor,
3365 struct cfg80211_chan_def *chandef)
3366{
3367 struct netlink_ext_ack *extack = info->extack;
3368 struct nlattr **attrs = info->attrs;
3369 u32 control_freq;
3370
3371 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3372 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3373 "Frequency is missing");
3374 return -EINVAL;
3375 }
3376
3377 control_freq = MHZ_TO_KHZ(
3378 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3379 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3380 control_freq +=
3381 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3382
3383 memset(chandef, 0, sizeof(*chandef));
3384 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3385 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3386 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3387 chandef->freq1_offset = control_freq % 1000;
3388 chandef->center_freq2 = 0;
3389
3390 if (!chandef->chan) {
3391 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3392 "Unknown channel");
3393 return -EINVAL;
3394 }
3395
3396 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3397 enum nl80211_channel_type chantype;
3398
3399 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3400
3401 switch (chantype) {
3402 case NL80211_CHAN_NO_HT:
3403 case NL80211_CHAN_HT20:
3404 case NL80211_CHAN_HT40PLUS:
3405 case NL80211_CHAN_HT40MINUS:
3406 cfg80211_chandef_create(chandef, chandef->chan,
3407 chantype);
3408 /* user input for center_freq is incorrect */
3409 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3410 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3411 NL_SET_ERR_MSG_ATTR(extack,
3412 attrs[NL80211_ATTR_CENTER_FREQ1],
3413 "bad center frequency 1");
3414 return -EINVAL;
3415 }
3416 /* center_freq2 must be zero */
3417 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3418 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3419 NL_SET_ERR_MSG_ATTR(extack,
3420 attrs[NL80211_ATTR_CENTER_FREQ2],
3421 "center frequency 2 can't be used");
3422 return -EINVAL;
3423 }
3424 break;
3425 default:
3426 NL_SET_ERR_MSG_ATTR(extack,
3427 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3428 "invalid channel type");
3429 return -EINVAL;
3430 }
3431 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3432 chandef->width =
3433 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3434 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3435 /* User input error for channel width doesn't match channel */
3436 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3437 NL_SET_ERR_MSG_ATTR(extack,
3438 attrs[NL80211_ATTR_CHANNEL_WIDTH],
3439 "bad channel width");
3440 return -EINVAL;
3441 }
3442 }
3443 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3444 chandef->center_freq1 =
3445 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3446 chandef->freq1_offset =
3447 nla_get_u32_default(attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET],
3448 0);
3449 }
3450 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3451 chandef->center_freq2 =
3452 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3453 }
3454
3455 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3456 chandef->edmg.channels =
3457 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3458
3459 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3460 chandef->edmg.bw_config =
3461 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3462 } else {
3463 chandef->edmg.bw_config = 0;
3464 chandef->edmg.channels = 0;
3465 }
3466
3467 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3468 chandef->punctured =
3469 nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3470
3471 if (chandef->punctured &&
3472 !wiphy_ext_feature_isset(&rdev->wiphy,
3473 NL80211_EXT_FEATURE_PUNCT)) {
3474 NL_SET_ERR_MSG(extack,
3475 "driver doesn't support puncturing");
3476 return -EINVAL;
3477 }
3478 }
3479
3480 if (!cfg80211_chandef_valid(chandef)) {
3481 NL_SET_ERR_MSG(extack, "invalid channel definition");
3482 return -EINVAL;
3483 }
3484
3485 if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3486 IEEE80211_CHAN_DISABLED,
3487 monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3488 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3489 return -EINVAL;
3490 }
3491
3492 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3493 chandef->width == NL80211_CHAN_WIDTH_10) &&
3494 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3495 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3496 return -EINVAL;
3497 }
3498
3499 return 0;
3500}
3501
3502int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3503 struct genl_info *info,
3504 struct cfg80211_chan_def *chandef)
3505{
3506 return _nl80211_parse_chandef(rdev, info, false, chandef);
3507}
3508
3509static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3510 struct net_device *dev,
3511 struct genl_info *info,
3512 int _link_id)
3513{
3514 struct cfg80211_chan_def chandef;
3515 int result;
3516 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3517 struct wireless_dev *wdev = NULL;
3518 int link_id = _link_id;
3519
3520 if (dev)
3521 wdev = dev->ieee80211_ptr;
3522 if (!nl80211_can_set_dev_channel(wdev))
3523 return -EOPNOTSUPP;
3524 if (wdev)
3525 iftype = wdev->iftype;
3526
3527 if (link_id < 0) {
3528 if (wdev && wdev->valid_links)
3529 return -EINVAL;
3530 link_id = 0;
3531 }
3532
3533 result = _nl80211_parse_chandef(rdev, info,
3534 iftype == NL80211_IFTYPE_MONITOR,
3535 &chandef);
3536 if (result)
3537 return result;
3538
3539 switch (iftype) {
3540 case NL80211_IFTYPE_AP:
3541 case NL80211_IFTYPE_P2P_GO:
3542 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3543 iftype))
3544 return -EINVAL;
3545 if (wdev->links[link_id].ap.beacon_interval) {
3546 struct ieee80211_channel *cur_chan;
3547
3548 if (!dev || !rdev->ops->set_ap_chanwidth ||
3549 !(rdev->wiphy.features &
3550 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3551 return -EBUSY;
3552
3553 /* Only allow dynamic channel width changes */
3554 cur_chan = wdev->links[link_id].ap.chandef.chan;
3555 if (chandef.chan != cur_chan)
3556 return -EBUSY;
3557
3558 /* only allow this for regular channel widths */
3559 switch (wdev->links[link_id].ap.chandef.width) {
3560 case NL80211_CHAN_WIDTH_20_NOHT:
3561 case NL80211_CHAN_WIDTH_20:
3562 case NL80211_CHAN_WIDTH_40:
3563 case NL80211_CHAN_WIDTH_80:
3564 case NL80211_CHAN_WIDTH_80P80:
3565 case NL80211_CHAN_WIDTH_160:
3566 case NL80211_CHAN_WIDTH_320:
3567 break;
3568 default:
3569 return -EINVAL;
3570 }
3571
3572 switch (chandef.width) {
3573 case NL80211_CHAN_WIDTH_20_NOHT:
3574 case NL80211_CHAN_WIDTH_20:
3575 case NL80211_CHAN_WIDTH_40:
3576 case NL80211_CHAN_WIDTH_80:
3577 case NL80211_CHAN_WIDTH_80P80:
3578 case NL80211_CHAN_WIDTH_160:
3579 case NL80211_CHAN_WIDTH_320:
3580 break;
3581 default:
3582 return -EINVAL;
3583 }
3584
3585 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3586 &chandef);
3587 if (result)
3588 return result;
3589 wdev->links[link_id].ap.chandef = chandef;
3590 } else {
3591 wdev->u.ap.preset_chandef = chandef;
3592 }
3593 return 0;
3594 case NL80211_IFTYPE_MESH_POINT:
3595 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3596 case NL80211_IFTYPE_MONITOR:
3597 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3598 default:
3599 break;
3600 }
3601
3602 return -EINVAL;
3603}
3604
3605static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3606{
3607 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3608 int link_id = nl80211_link_id_or_invalid(info->attrs);
3609 struct net_device *netdev = info->user_ptr[1];
3610
3611 return __nl80211_set_channel(rdev, netdev, info, link_id);
3612}
3613
3614static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3615{
3616 struct cfg80211_registered_device *rdev = NULL;
3617 struct net_device *netdev = NULL;
3618 struct wireless_dev *wdev;
3619 int result = 0, rem_txq_params = 0;
3620 struct nlattr *nl_txq_params;
3621 u32 changed;
3622 u8 retry_short = 0, retry_long = 0;
3623 u32 frag_threshold = 0, rts_threshold = 0;
3624 u8 coverage_class = 0;
3625 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3626
3627 rtnl_lock();
3628 /*
3629 * Try to find the wiphy and netdev. Normally this
3630 * function shouldn't need the netdev, but this is
3631 * done for backward compatibility -- previously
3632 * setting the channel was done per wiphy, but now
3633 * it is per netdev. Previous userland like hostapd
3634 * also passed a netdev to set_wiphy, so that it is
3635 * possible to let that go to the right netdev!
3636 */
3637
3638 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3639 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3640
3641 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3642 if (netdev && netdev->ieee80211_ptr)
3643 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3644 else
3645 netdev = NULL;
3646 }
3647
3648 if (!netdev) {
3649 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3650 info->attrs);
3651 if (IS_ERR(rdev)) {
3652 rtnl_unlock();
3653 return PTR_ERR(rdev);
3654 }
3655 wdev = NULL;
3656 netdev = NULL;
3657 result = 0;
3658 } else
3659 wdev = netdev->ieee80211_ptr;
3660
3661 guard(wiphy)(&rdev->wiphy);
3662
3663 /*
3664 * end workaround code, by now the rdev is available
3665 * and locked, and wdev may or may not be NULL.
3666 */
3667
3668 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3669 result = cfg80211_dev_rename(
3670 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3671 rtnl_unlock();
3672
3673 if (result)
3674 return result;
3675
3676 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3677 struct ieee80211_txq_params txq_params;
3678 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3679
3680 if (!rdev->ops->set_txq_params)
3681 return -EOPNOTSUPP;
3682
3683 if (!netdev)
3684 return -EINVAL;
3685
3686 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3687 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3688 return -EINVAL;
3689
3690 if (!netif_running(netdev))
3691 return -ENETDOWN;
3692
3693 nla_for_each_nested(nl_txq_params,
3694 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3695 rem_txq_params) {
3696 result = nla_parse_nested_deprecated(tb,
3697 NL80211_TXQ_ATTR_MAX,
3698 nl_txq_params,
3699 txq_params_policy,
3700 info->extack);
3701 if (result)
3702 return result;
3703
3704 result = parse_txq_params(tb, &txq_params);
3705 if (result)
3706 return result;
3707
3708 txq_params.link_id =
3709 nl80211_link_id_or_invalid(info->attrs);
3710
3711 if (txq_params.link_id >= 0 &&
3712 !(netdev->ieee80211_ptr->valid_links &
3713 BIT(txq_params.link_id)))
3714 result = -ENOLINK;
3715 else if (txq_params.link_id >= 0 &&
3716 !netdev->ieee80211_ptr->valid_links)
3717 result = -EINVAL;
3718 else
3719 result = rdev_set_txq_params(rdev, netdev,
3720 &txq_params);
3721 if (result)
3722 return result;
3723 }
3724 }
3725
3726 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3727 int link_id = nl80211_link_id_or_invalid(info->attrs);
3728
3729 if (wdev) {
3730 result = __nl80211_set_channel(
3731 rdev,
3732 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3733 info, link_id);
3734 } else {
3735 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3736 }
3737
3738 if (result)
3739 return result;
3740 }
3741
3742 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3743 struct wireless_dev *txp_wdev = wdev;
3744 enum nl80211_tx_power_setting type;
3745 int idx, mbm = 0;
3746
3747 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3748 txp_wdev = NULL;
3749
3750 if (!rdev->ops->set_tx_power)
3751 return -EOPNOTSUPP;
3752
3753 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3754 type = nla_get_u32(info->attrs[idx]);
3755
3756 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3757 (type != NL80211_TX_POWER_AUTOMATIC))
3758 return -EINVAL;
3759
3760 if (type != NL80211_TX_POWER_AUTOMATIC) {
3761 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3762 mbm = nla_get_u32(info->attrs[idx]);
3763 }
3764
3765 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3766 if (result)
3767 return result;
3768 }
3769
3770 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3771 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3772 u32 tx_ant, rx_ant;
3773
3774 if ((!rdev->wiphy.available_antennas_tx &&
3775 !rdev->wiphy.available_antennas_rx) ||
3776 !rdev->ops->set_antenna)
3777 return -EOPNOTSUPP;
3778
3779 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3780 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3781
3782 /* reject antenna configurations which don't match the
3783 * available antenna masks, except for the "all" mask */
3784 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3785 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3786 return -EINVAL;
3787
3788 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3789 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3790
3791 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3792 if (result)
3793 return result;
3794 }
3795
3796 changed = 0;
3797
3798 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3799 retry_short = nla_get_u8(
3800 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3801
3802 changed |= WIPHY_PARAM_RETRY_SHORT;
3803 }
3804
3805 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3806 retry_long = nla_get_u8(
3807 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3808
3809 changed |= WIPHY_PARAM_RETRY_LONG;
3810 }
3811
3812 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3813 frag_threshold = nla_get_u32(
3814 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3815 if (frag_threshold < 256)
3816 return -EINVAL;
3817
3818 if (frag_threshold != (u32) -1) {
3819 /*
3820 * Fragments (apart from the last one) are required to
3821 * have even length. Make the fragmentation code
3822 * simpler by stripping LSB should someone try to use
3823 * odd threshold value.
3824 */
3825 frag_threshold &= ~0x1;
3826 }
3827 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3828 }
3829
3830 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3831 rts_threshold = nla_get_u32(
3832 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3833 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3834 }
3835
3836 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3837 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3838 return -EINVAL;
3839
3840 coverage_class = nla_get_u8(
3841 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3842 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3843 }
3844
3845 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3846 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3847 return -EOPNOTSUPP;
3848
3849 changed |= WIPHY_PARAM_DYN_ACK;
3850 }
3851
3852 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3853 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3854 NL80211_EXT_FEATURE_TXQS))
3855 return -EOPNOTSUPP;
3856
3857 txq_limit = nla_get_u32(
3858 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3859 changed |= WIPHY_PARAM_TXQ_LIMIT;
3860 }
3861
3862 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3863 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3864 NL80211_EXT_FEATURE_TXQS))
3865 return -EOPNOTSUPP;
3866
3867 txq_memory_limit = nla_get_u32(
3868 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3869 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3870 }
3871
3872 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3873 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3874 NL80211_EXT_FEATURE_TXQS))
3875 return -EOPNOTSUPP;
3876
3877 txq_quantum = nla_get_u32(
3878 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3879 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3880 }
3881
3882 if (changed) {
3883 u8 old_retry_short, old_retry_long;
3884 u32 old_frag_threshold, old_rts_threshold;
3885 u8 old_coverage_class;
3886 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3887
3888 if (!rdev->ops->set_wiphy_params)
3889 return -EOPNOTSUPP;
3890
3891 old_retry_short = rdev->wiphy.retry_short;
3892 old_retry_long = rdev->wiphy.retry_long;
3893 old_frag_threshold = rdev->wiphy.frag_threshold;
3894 old_rts_threshold = rdev->wiphy.rts_threshold;
3895 old_coverage_class = rdev->wiphy.coverage_class;
3896 old_txq_limit = rdev->wiphy.txq_limit;
3897 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3898 old_txq_quantum = rdev->wiphy.txq_quantum;
3899
3900 if (changed & WIPHY_PARAM_RETRY_SHORT)
3901 rdev->wiphy.retry_short = retry_short;
3902 if (changed & WIPHY_PARAM_RETRY_LONG)
3903 rdev->wiphy.retry_long = retry_long;
3904 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3905 rdev->wiphy.frag_threshold = frag_threshold;
3906 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3907 rdev->wiphy.rts_threshold = rts_threshold;
3908 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3909 rdev->wiphy.coverage_class = coverage_class;
3910 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3911 rdev->wiphy.txq_limit = txq_limit;
3912 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3913 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3914 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3915 rdev->wiphy.txq_quantum = txq_quantum;
3916
3917 result = rdev_set_wiphy_params(rdev, changed);
3918 if (result) {
3919 rdev->wiphy.retry_short = old_retry_short;
3920 rdev->wiphy.retry_long = old_retry_long;
3921 rdev->wiphy.frag_threshold = old_frag_threshold;
3922 rdev->wiphy.rts_threshold = old_rts_threshold;
3923 rdev->wiphy.coverage_class = old_coverage_class;
3924 rdev->wiphy.txq_limit = old_txq_limit;
3925 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3926 rdev->wiphy.txq_quantum = old_txq_quantum;
3927 return result;
3928 }
3929 }
3930
3931 return 0;
3932}
3933
3934int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3935{
3936 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3937 return -EINVAL;
3938
3939 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3940 chandef->chan->center_freq))
3941 return -ENOBUFS;
3942 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3943 chandef->chan->freq_offset))
3944 return -ENOBUFS;
3945 switch (chandef->width) {
3946 case NL80211_CHAN_WIDTH_20_NOHT:
3947 case NL80211_CHAN_WIDTH_20:
3948 case NL80211_CHAN_WIDTH_40:
3949 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3950 cfg80211_get_chandef_type(chandef)))
3951 return -ENOBUFS;
3952 break;
3953 default:
3954 break;
3955 }
3956 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3957 return -ENOBUFS;
3958 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3959 return -ENOBUFS;
3960 if (chandef->center_freq2 &&
3961 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3962 return -ENOBUFS;
3963 if (chandef->punctured &&
3964 nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
3965 return -ENOBUFS;
3966
3967 return 0;
3968}
3969EXPORT_SYMBOL(nl80211_send_chandef);
3970
3971static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3972 struct cfg80211_registered_device *rdev,
3973 struct wireless_dev *wdev,
3974 enum nl80211_commands cmd)
3975{
3976 struct net_device *dev = wdev->netdev;
3977 void *hdr;
3978
3979 lockdep_assert_wiphy(&rdev->wiphy);
3980
3981 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3982 cmd != NL80211_CMD_DEL_INTERFACE &&
3983 cmd != NL80211_CMD_SET_INTERFACE);
3984
3985 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3986 if (!hdr)
3987 return -1;
3988
3989 if (dev &&
3990 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3991 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3992 goto nla_put_failure;
3993
3994 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3995 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3996 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3997 NL80211_ATTR_PAD) ||
3998 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3999 nla_put_u32(msg, NL80211_ATTR_GENERATION,
4000 rdev->devlist_generation ^
4001 (cfg80211_rdev_list_generation << 2)) ||
4002 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
4003 nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
4004 goto nla_put_failure;
4005
4006 if (rdev->ops->get_channel && !wdev->valid_links) {
4007 struct cfg80211_chan_def chandef = {};
4008 int ret;
4009
4010 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4011 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4012 goto nla_put_failure;
4013 }
4014
4015 if (rdev->ops->get_tx_power && !wdev->valid_links) {
4016 int dbm, ret;
4017
4018 ret = rdev_get_tx_power(rdev, wdev, 0, &dbm);
4019 if (ret == 0 &&
4020 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4021 DBM_TO_MBM(dbm)))
4022 goto nla_put_failure;
4023 }
4024
4025 switch (wdev->iftype) {
4026 case NL80211_IFTYPE_AP:
4027 case NL80211_IFTYPE_P2P_GO:
4028 if (wdev->u.ap.ssid_len &&
4029 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4030 wdev->u.ap.ssid))
4031 goto nla_put_failure;
4032 break;
4033 case NL80211_IFTYPE_STATION:
4034 case NL80211_IFTYPE_P2P_CLIENT:
4035 if (wdev->u.client.ssid_len &&
4036 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4037 wdev->u.client.ssid))
4038 goto nla_put_failure;
4039 break;
4040 case NL80211_IFTYPE_ADHOC:
4041 if (wdev->u.ibss.ssid_len &&
4042 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4043 wdev->u.ibss.ssid))
4044 goto nla_put_failure;
4045 break;
4046 default:
4047 /* nothing */
4048 break;
4049 }
4050
4051 if (rdev->ops->get_txq_stats) {
4052 struct cfg80211_txq_stats txqstats = {};
4053 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4054
4055 if (ret == 0 &&
4056 !nl80211_put_txq_stats(msg, &txqstats,
4057 NL80211_ATTR_TXQ_STATS))
4058 goto nla_put_failure;
4059 }
4060
4061 if (wdev->valid_links) {
4062 unsigned int link_id;
4063 struct nlattr *links = nla_nest_start(msg,
4064 NL80211_ATTR_MLO_LINKS);
4065
4066 if (!links)
4067 goto nla_put_failure;
4068
4069 for_each_valid_link(wdev, link_id) {
4070 struct nlattr *link = nla_nest_start(msg, link_id + 1);
4071 struct cfg80211_chan_def chandef = {};
4072 int ret;
4073
4074 if (!link)
4075 goto nla_put_failure;
4076
4077 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4078 goto nla_put_failure;
4079 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4080 wdev->links[link_id].addr))
4081 goto nla_put_failure;
4082
4083 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4084 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4085 goto nla_put_failure;
4086
4087 if (rdev->ops->get_tx_power) {
4088 int dbm, ret;
4089
4090 ret = rdev_get_tx_power(rdev, wdev, link_id, &dbm);
4091 if (ret == 0 &&
4092 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4093 DBM_TO_MBM(dbm)))
4094 goto nla_put_failure;
4095 }
4096 nla_nest_end(msg, link);
4097 }
4098
4099 nla_nest_end(msg, links);
4100 }
4101
4102 genlmsg_end(msg, hdr);
4103 return 0;
4104
4105 nla_put_failure:
4106 genlmsg_cancel(msg, hdr);
4107 return -EMSGSIZE;
4108}
4109
4110static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4111{
4112 int wp_idx = 0;
4113 int if_idx = 0;
4114 int wp_start = cb->args[0];
4115 int if_start = cb->args[1];
4116 int filter_wiphy = -1;
4117 struct cfg80211_registered_device *rdev;
4118 struct wireless_dev *wdev;
4119 int ret;
4120
4121 rtnl_lock();
4122 if (!cb->args[2]) {
4123 struct nl80211_dump_wiphy_state state = {
4124 .filter_wiphy = -1,
4125 };
4126
4127 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4128 if (ret)
4129 goto out_unlock;
4130
4131 filter_wiphy = state.filter_wiphy;
4132
4133 /*
4134 * if filtering, set cb->args[2] to +1 since 0 is the default
4135 * value needed to determine that parsing is necessary.
4136 */
4137 if (filter_wiphy >= 0)
4138 cb->args[2] = filter_wiphy + 1;
4139 else
4140 cb->args[2] = -1;
4141 } else if (cb->args[2] > 0) {
4142 filter_wiphy = cb->args[2] - 1;
4143 }
4144
4145 for_each_rdev(rdev) {
4146 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4147 continue;
4148 if (wp_idx < wp_start) {
4149 wp_idx++;
4150 continue;
4151 }
4152
4153 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4154 continue;
4155
4156 if_idx = 0;
4157
4158 guard(wiphy)(&rdev->wiphy);
4159
4160 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4161 if (if_idx < if_start) {
4162 if_idx++;
4163 continue;
4164 }
4165
4166 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4167 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4168 rdev, wdev,
4169 NL80211_CMD_NEW_INTERFACE) < 0)
4170 goto out;
4171
4172 if_idx++;
4173 }
4174
4175 if_start = 0;
4176 wp_idx++;
4177 }
4178 out:
4179 cb->args[0] = wp_idx;
4180 cb->args[1] = if_idx;
4181
4182 ret = skb->len;
4183 out_unlock:
4184 rtnl_unlock();
4185
4186 return ret;
4187}
4188
4189static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4190{
4191 struct sk_buff *msg;
4192 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4193 struct wireless_dev *wdev = info->user_ptr[1];
4194
4195 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4196 if (!msg)
4197 return -ENOMEM;
4198
4199 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4200 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4201 nlmsg_free(msg);
4202 return -ENOBUFS;
4203 }
4204
4205 return genlmsg_reply(msg, info);
4206}
4207
4208static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4209 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4210 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4211 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4212 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4213 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4214 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4215 [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4216};
4217
4218static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4219{
4220 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4221 int flag;
4222
4223 *mntrflags = 0;
4224
4225 if (!nla)
4226 return -EINVAL;
4227
4228 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4229 return -EINVAL;
4230
4231 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4232 if (flags[flag])
4233 *mntrflags |= (1<<flag);
4234
4235 /* cooked monitor mode is incompatible with other modes */
4236 if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4237 *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4238 return -EOPNOTSUPP;
4239
4240 *mntrflags |= MONITOR_FLAG_CHANGED;
4241
4242 return 0;
4243}
4244
4245static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4246 enum nl80211_iftype type,
4247 struct genl_info *info,
4248 struct vif_params *params)
4249{
4250 bool change = false;
4251 int err;
4252
4253 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4254 if (type != NL80211_IFTYPE_MONITOR)
4255 return -EINVAL;
4256
4257 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4258 &params->flags);
4259 if (err)
4260 return err;
4261
4262 change = true;
4263 }
4264
4265 /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4266 if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4267 return -EOPNOTSUPP;
4268
4269 if (params->flags & MONITOR_FLAG_ACTIVE &&
4270 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4271 return -EOPNOTSUPP;
4272
4273 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4274 const u8 *mumimo_groups;
4275 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4276
4277 if (type != NL80211_IFTYPE_MONITOR)
4278 return -EINVAL;
4279
4280 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4281 return -EOPNOTSUPP;
4282
4283 mumimo_groups =
4284 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4285
4286 /* bits 0 and 63 are reserved and must be zero */
4287 if ((mumimo_groups[0] & BIT(0)) ||
4288 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4289 return -EINVAL;
4290
4291 params->vht_mumimo_groups = mumimo_groups;
4292 change = true;
4293 }
4294
4295 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4296 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4297
4298 if (type != NL80211_IFTYPE_MONITOR)
4299 return -EINVAL;
4300
4301 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4302 return -EOPNOTSUPP;
4303
4304 params->vht_mumimo_follow_addr =
4305 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4306 change = true;
4307 }
4308
4309 return change ? 1 : 0;
4310}
4311
4312static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4313 struct net_device *netdev, u8 use_4addr,
4314 enum nl80211_iftype iftype)
4315{
4316 if (!use_4addr) {
4317 if (netdev && netif_is_bridge_port(netdev))
4318 return -EBUSY;
4319 return 0;
4320 }
4321
4322 switch (iftype) {
4323 case NL80211_IFTYPE_AP_VLAN:
4324 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4325 return 0;
4326 break;
4327 case NL80211_IFTYPE_STATION:
4328 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4329 return 0;
4330 break;
4331 default:
4332 break;
4333 }
4334
4335 return -EOPNOTSUPP;
4336}
4337
4338static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4339 u32 *radio_mask)
4340{
4341 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4342 struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4343 u32 mask, allowed;
4344
4345 if (!attr) {
4346 *radio_mask = 0;
4347 return 0;
4348 }
4349
4350 allowed = BIT(rdev->wiphy.n_radio) - 1;
4351 mask = nla_get_u32(attr);
4352 if (mask & ~allowed)
4353 return -EINVAL;
4354 if (!mask)
4355 mask = allowed;
4356 *radio_mask = mask;
4357
4358 return 1;
4359}
4360
4361static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4362{
4363 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4364 struct vif_params params;
4365 int err;
4366 enum nl80211_iftype otype, ntype;
4367 struct net_device *dev = info->user_ptr[1];
4368 struct wireless_dev *wdev = dev->ieee80211_ptr;
4369 u32 radio_mask = 0;
4370 bool change = false;
4371
4372 memset(&params, 0, sizeof(params));
4373
4374 otype = ntype = dev->ieee80211_ptr->iftype;
4375
4376 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4377 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4378 if (otype != ntype)
4379 change = true;
4380 }
4381
4382 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4383 if (ntype != NL80211_IFTYPE_MESH_POINT)
4384 return -EINVAL;
4385 if (otype != NL80211_IFTYPE_MESH_POINT)
4386 return -EINVAL;
4387 if (netif_running(dev))
4388 return -EBUSY;
4389
4390 wdev->u.mesh.id_up_len =
4391 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4392 memcpy(wdev->u.mesh.id,
4393 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4394 wdev->u.mesh.id_up_len);
4395 }
4396
4397 if (info->attrs[NL80211_ATTR_4ADDR]) {
4398 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4399 change = true;
4400 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4401 if (err)
4402 return err;
4403 } else {
4404 params.use_4addr = -1;
4405 }
4406
4407 err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4408 if (err < 0)
4409 return err;
4410 if (err > 0)
4411 change = true;
4412
4413 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4414 if (err < 0)
4415 return err;
4416 if (err && netif_running(dev))
4417 return -EBUSY;
4418
4419 if (change)
4420 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4421 else
4422 err = 0;
4423
4424 if (!err && params.use_4addr != -1)
4425 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4426
4427 if (radio_mask)
4428 wdev->radio_mask = radio_mask;
4429
4430 if (change && !err)
4431 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4432
4433 return err;
4434}
4435
4436static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4437{
4438 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4439 struct vif_params params;
4440 struct wireless_dev *wdev;
4441 struct sk_buff *msg;
4442 u32 radio_mask;
4443 int err;
4444 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4445
4446 memset(&params, 0, sizeof(params));
4447
4448 if (!info->attrs[NL80211_ATTR_IFNAME])
4449 return -EINVAL;
4450
4451 if (info->attrs[NL80211_ATTR_IFTYPE])
4452 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4453
4454 if (!rdev->ops->add_virtual_intf)
4455 return -EOPNOTSUPP;
4456
4457 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4458 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4459 info->attrs[NL80211_ATTR_MAC]) {
4460 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4461 ETH_ALEN);
4462 if (!is_valid_ether_addr(params.macaddr))
4463 return -EADDRNOTAVAIL;
4464 }
4465
4466 if (info->attrs[NL80211_ATTR_4ADDR]) {
4467 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4468 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4469 if (err)
4470 return err;
4471 }
4472
4473 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4474 return -EOPNOTSUPP;
4475
4476 err = nl80211_parse_mon_options(rdev, type, info, &params);
4477 if (err < 0)
4478 return err;
4479
4480 err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4481 if (err < 0)
4482 return err;
4483
4484 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4485 if (!msg)
4486 return -ENOMEM;
4487
4488 wdev = rdev_add_virtual_intf(rdev,
4489 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4490 NET_NAME_USER, type, &params);
4491 if (WARN_ON(!wdev)) {
4492 nlmsg_free(msg);
4493 return -EPROTO;
4494 } else if (IS_ERR(wdev)) {
4495 nlmsg_free(msg);
4496 return PTR_ERR(wdev);
4497 }
4498
4499 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4500 wdev->owner_nlportid = info->snd_portid;
4501
4502 switch (type) {
4503 case NL80211_IFTYPE_MESH_POINT:
4504 if (!info->attrs[NL80211_ATTR_MESH_ID])
4505 break;
4506 wdev->u.mesh.id_up_len =
4507 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4508 memcpy(wdev->u.mesh.id,
4509 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4510 wdev->u.mesh.id_up_len);
4511 break;
4512 case NL80211_IFTYPE_NAN:
4513 case NL80211_IFTYPE_P2P_DEVICE:
4514 /*
4515 * P2P Device and NAN do not have a netdev, so don't go
4516 * through the netdev notifier and must be added here
4517 */
4518 cfg80211_init_wdev(wdev);
4519 cfg80211_register_wdev(rdev, wdev);
4520 break;
4521 default:
4522 break;
4523 }
4524
4525 if (radio_mask)
4526 wdev->radio_mask = radio_mask;
4527
4528 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4529 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4530 nlmsg_free(msg);
4531 return -ENOBUFS;
4532 }
4533
4534 return genlmsg_reply(msg, info);
4535}
4536
4537static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4538{
4539 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4540
4541 /* to avoid failing a new interface creation due to pending removal */
4542 cfg80211_destroy_ifaces(rdev);
4543
4544 guard(wiphy)(&rdev->wiphy);
4545
4546 return _nl80211_new_interface(skb, info);
4547}
4548
4549static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4550{
4551 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4552 struct wireless_dev *wdev = info->user_ptr[1];
4553
4554 if (!rdev->ops->del_virtual_intf)
4555 return -EOPNOTSUPP;
4556
4557 /*
4558 * We hold RTNL, so this is safe, without RTNL opencount cannot
4559 * reach 0, and thus the rdev cannot be deleted.
4560 *
4561 * We need to do it for the dev_close(), since that will call
4562 * the netdev notifiers, and we need to acquire the mutex there
4563 * but don't know if we get there from here or from some other
4564 * place (e.g. "ip link set ... down").
4565 */
4566 mutex_unlock(&rdev->wiphy.mtx);
4567
4568 /*
4569 * If we remove a wireless device without a netdev then clear
4570 * user_ptr[1] so that nl80211_post_doit won't dereference it
4571 * to check if it needs to do dev_put(). Otherwise it crashes
4572 * since the wdev has been freed, unlike with a netdev where
4573 * we need the dev_put() for the netdev to really be freed.
4574 */
4575 if (!wdev->netdev)
4576 info->user_ptr[1] = NULL;
4577 else
4578 dev_close(wdev->netdev);
4579
4580 mutex_lock(&rdev->wiphy.mtx);
4581
4582 return cfg80211_remove_virtual_intf(rdev, wdev);
4583}
4584
4585static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4586{
4587 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4588 struct net_device *dev = info->user_ptr[1];
4589 u16 noack_map;
4590
4591 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4592 return -EINVAL;
4593
4594 if (!rdev->ops->set_noack_map)
4595 return -EOPNOTSUPP;
4596
4597 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4598
4599 return rdev_set_noack_map(rdev, dev, noack_map);
4600}
4601
4602static int nl80211_validate_key_link_id(struct genl_info *info,
4603 struct wireless_dev *wdev,
4604 int link_id, bool pairwise)
4605{
4606 if (pairwise) {
4607 if (link_id != -1) {
4608 GENL_SET_ERR_MSG(info,
4609 "link ID not allowed for pairwise key");
4610 return -EINVAL;
4611 }
4612
4613 return 0;
4614 }
4615
4616 if (wdev->valid_links) {
4617 if (link_id == -1) {
4618 GENL_SET_ERR_MSG(info,
4619 "link ID must for MLO group key");
4620 return -EINVAL;
4621 }
4622 if (!(wdev->valid_links & BIT(link_id))) {
4623 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4624 return -EINVAL;
4625 }
4626 } else if (link_id != -1) {
4627 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4628 return -EINVAL;
4629 }
4630
4631 return 0;
4632}
4633
4634struct get_key_cookie {
4635 struct sk_buff *msg;
4636 int error;
4637 int idx;
4638};
4639
4640static void get_key_callback(void *c, struct key_params *params)
4641{
4642 struct nlattr *key;
4643 struct get_key_cookie *cookie = c;
4644
4645 if ((params->seq &&
4646 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4647 params->seq_len, params->seq)) ||
4648 (params->cipher &&
4649 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4650 params->cipher)))
4651 goto nla_put_failure;
4652
4653 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4654 if (!key)
4655 goto nla_put_failure;
4656
4657 if ((params->seq &&
4658 nla_put(cookie->msg, NL80211_KEY_SEQ,
4659 params->seq_len, params->seq)) ||
4660 (params->cipher &&
4661 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4662 params->cipher)))
4663 goto nla_put_failure;
4664
4665 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4666 goto nla_put_failure;
4667
4668 nla_nest_end(cookie->msg, key);
4669
4670 return;
4671 nla_put_failure:
4672 cookie->error = 1;
4673}
4674
4675static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4676{
4677 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4678 int err;
4679 struct net_device *dev = info->user_ptr[1];
4680 u8 key_idx = 0;
4681 const u8 *mac_addr = NULL;
4682 bool pairwise;
4683 struct get_key_cookie cookie = {
4684 .error = 0,
4685 };
4686 void *hdr;
4687 struct sk_buff *msg;
4688 bool bigtk_support = false;
4689 int link_id = nl80211_link_id_or_invalid(info->attrs);
4690 struct wireless_dev *wdev = dev->ieee80211_ptr;
4691
4692 if (wiphy_ext_feature_isset(&rdev->wiphy,
4693 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4694 bigtk_support = true;
4695
4696 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4697 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4698 wiphy_ext_feature_isset(&rdev->wiphy,
4699 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4700 bigtk_support = true;
4701
4702 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4703 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4704
4705 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4706 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4707 return -EINVAL;
4708 }
4709 }
4710
4711 if (info->attrs[NL80211_ATTR_MAC])
4712 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4713
4714 pairwise = !!mac_addr;
4715 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4716 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4717
4718 if (kt != NL80211_KEYTYPE_GROUP &&
4719 kt != NL80211_KEYTYPE_PAIRWISE)
4720 return -EINVAL;
4721 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4722 }
4723
4724 if (!rdev->ops->get_key)
4725 return -EOPNOTSUPP;
4726
4727 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4728 return -ENOENT;
4729
4730 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4731 if (!msg)
4732 return -ENOMEM;
4733
4734 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4735 NL80211_CMD_NEW_KEY);
4736 if (!hdr)
4737 goto nla_put_failure;
4738
4739 cookie.msg = msg;
4740 cookie.idx = key_idx;
4741
4742 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4743 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4744 goto nla_put_failure;
4745 if (mac_addr &&
4746 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4747 goto nla_put_failure;
4748
4749 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4750 if (err)
4751 goto free_msg;
4752
4753 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4754 &cookie, get_key_callback);
4755
4756 if (err)
4757 goto free_msg;
4758
4759 if (cookie.error)
4760 goto nla_put_failure;
4761
4762 genlmsg_end(msg, hdr);
4763 return genlmsg_reply(msg, info);
4764
4765 nla_put_failure:
4766 err = -ENOBUFS;
4767 free_msg:
4768 nlmsg_free(msg);
4769 return err;
4770}
4771
4772static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4773{
4774 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4775 struct key_parse key;
4776 int err;
4777 struct net_device *dev = info->user_ptr[1];
4778 int link_id = nl80211_link_id_or_invalid(info->attrs);
4779 struct wireless_dev *wdev = dev->ieee80211_ptr;
4780
4781 err = nl80211_parse_key(info, &key);
4782 if (err)
4783 return err;
4784
4785 if (key.idx < 0)
4786 return -EINVAL;
4787
4788 /* Only support setting default key and
4789 * Extended Key ID action NL80211_KEY_SET_TX.
4790 */
4791 if (!key.def && !key.defmgmt && !key.defbeacon &&
4792 !(key.p.mode == NL80211_KEY_SET_TX))
4793 return -EINVAL;
4794
4795 if (key.def) {
4796 if (!rdev->ops->set_default_key)
4797 return -EOPNOTSUPP;
4798
4799 err = nl80211_key_allowed(wdev);
4800 if (err)
4801 return err;
4802
4803 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4804 if (err)
4805 return err;
4806
4807 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4808 key.def_uni, key.def_multi);
4809
4810 if (err)
4811 return err;
4812
4813#ifdef CONFIG_CFG80211_WEXT
4814 wdev->wext.default_key = key.idx;
4815#endif
4816 return 0;
4817 } else if (key.defmgmt) {
4818 if (key.def_uni || !key.def_multi)
4819 return -EINVAL;
4820
4821 if (!rdev->ops->set_default_mgmt_key)
4822 return -EOPNOTSUPP;
4823
4824 err = nl80211_key_allowed(wdev);
4825 if (err)
4826 return err;
4827
4828 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4829 if (err)
4830 return err;
4831
4832 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4833 if (err)
4834 return err;
4835
4836#ifdef CONFIG_CFG80211_WEXT
4837 wdev->wext.default_mgmt_key = key.idx;
4838#endif
4839 return 0;
4840 } else if (key.defbeacon) {
4841 if (key.def_uni || !key.def_multi)
4842 return -EINVAL;
4843
4844 if (!rdev->ops->set_default_beacon_key)
4845 return -EOPNOTSUPP;
4846
4847 err = nl80211_key_allowed(wdev);
4848 if (err)
4849 return err;
4850
4851 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4852 if (err)
4853 return err;
4854
4855 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4856 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4857 wiphy_ext_feature_isset(&rdev->wiphy,
4858 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4859 u8 *mac_addr = NULL;
4860
4861 if (info->attrs[NL80211_ATTR_MAC])
4862 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4863
4864 if (!mac_addr || key.idx < 0 || key.idx > 1)
4865 return -EINVAL;
4866
4867 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4868 if (err)
4869 return err;
4870
4871 return rdev_add_key(rdev, dev, link_id, key.idx,
4872 NL80211_KEYTYPE_PAIRWISE,
4873 mac_addr, &key.p);
4874 }
4875
4876 return -EINVAL;
4877}
4878
4879static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4880{
4881 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4882 int err;
4883 struct net_device *dev = info->user_ptr[1];
4884 struct key_parse key;
4885 const u8 *mac_addr = NULL;
4886 int link_id = nl80211_link_id_or_invalid(info->attrs);
4887 struct wireless_dev *wdev = dev->ieee80211_ptr;
4888
4889 err = nl80211_parse_key(info, &key);
4890 if (err)
4891 return err;
4892
4893 if (!key.p.key) {
4894 GENL_SET_ERR_MSG(info, "no key");
4895 return -EINVAL;
4896 }
4897
4898 if (info->attrs[NL80211_ATTR_MAC])
4899 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4900
4901 if (key.type == -1) {
4902 if (mac_addr)
4903 key.type = NL80211_KEYTYPE_PAIRWISE;
4904 else
4905 key.type = NL80211_KEYTYPE_GROUP;
4906 }
4907
4908 /* for now */
4909 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4910 key.type != NL80211_KEYTYPE_GROUP) {
4911 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4912 return -EINVAL;
4913 }
4914
4915 if (key.type == NL80211_KEYTYPE_GROUP &&
4916 info->attrs[NL80211_ATTR_VLAN_ID])
4917 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4918
4919 if (!rdev->ops->add_key)
4920 return -EOPNOTSUPP;
4921
4922 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4923 key.type == NL80211_KEYTYPE_PAIRWISE,
4924 mac_addr)) {
4925 GENL_SET_ERR_MSG(info, "key setting validation failed");
4926 return -EINVAL;
4927 }
4928
4929 err = nl80211_key_allowed(wdev);
4930 if (err)
4931 GENL_SET_ERR_MSG(info, "key not allowed");
4932
4933 if (!err)
4934 err = nl80211_validate_key_link_id(info, wdev, link_id,
4935 key.type == NL80211_KEYTYPE_PAIRWISE);
4936
4937 if (!err) {
4938 err = rdev_add_key(rdev, dev, link_id, key.idx,
4939 key.type == NL80211_KEYTYPE_PAIRWISE,
4940 mac_addr, &key.p);
4941 if (err)
4942 GENL_SET_ERR_MSG(info, "key addition failed");
4943 }
4944
4945 return err;
4946}
4947
4948static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4949{
4950 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4951 int err;
4952 struct net_device *dev = info->user_ptr[1];
4953 u8 *mac_addr = NULL;
4954 struct key_parse key;
4955 int link_id = nl80211_link_id_or_invalid(info->attrs);
4956 struct wireless_dev *wdev = dev->ieee80211_ptr;
4957
4958 err = nl80211_parse_key(info, &key);
4959 if (err)
4960 return err;
4961
4962 if (info->attrs[NL80211_ATTR_MAC])
4963 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4964
4965 if (key.type == -1) {
4966 if (mac_addr)
4967 key.type = NL80211_KEYTYPE_PAIRWISE;
4968 else
4969 key.type = NL80211_KEYTYPE_GROUP;
4970 }
4971
4972 /* for now */
4973 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4974 key.type != NL80211_KEYTYPE_GROUP)
4975 return -EINVAL;
4976
4977 if (!cfg80211_valid_key_idx(rdev, key.idx,
4978 key.type == NL80211_KEYTYPE_PAIRWISE))
4979 return -EINVAL;
4980
4981 if (!rdev->ops->del_key)
4982 return -EOPNOTSUPP;
4983
4984 err = nl80211_key_allowed(wdev);
4985
4986 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4987 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4988 err = -ENOENT;
4989
4990 if (!err)
4991 err = nl80211_validate_key_link_id(info, wdev, link_id,
4992 key.type == NL80211_KEYTYPE_PAIRWISE);
4993
4994 if (!err)
4995 err = rdev_del_key(rdev, dev, link_id, key.idx,
4996 key.type == NL80211_KEYTYPE_PAIRWISE,
4997 mac_addr);
4998
4999#ifdef CONFIG_CFG80211_WEXT
5000 if (!err) {
5001 if (key.idx == wdev->wext.default_key)
5002 wdev->wext.default_key = -1;
5003 else if (key.idx == wdev->wext.default_mgmt_key)
5004 wdev->wext.default_mgmt_key = -1;
5005 }
5006#endif
5007
5008 return err;
5009}
5010
5011/* This function returns an error or the number of nested attributes */
5012static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5013{
5014 struct nlattr *attr;
5015 int n_entries = 0, tmp;
5016
5017 nla_for_each_nested(attr, nl_attr, tmp) {
5018 if (nla_len(attr) != ETH_ALEN)
5019 return -EINVAL;
5020
5021 n_entries++;
5022 }
5023
5024 return n_entries;
5025}
5026
5027/*
5028 * This function parses ACL information and allocates memory for ACL data.
5029 * On successful return, the calling function is responsible to free the
5030 * ACL buffer returned by this function.
5031 */
5032static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5033 struct genl_info *info)
5034{
5035 enum nl80211_acl_policy acl_policy;
5036 struct nlattr *attr;
5037 struct cfg80211_acl_data *acl;
5038 int i = 0, n_entries, tmp;
5039
5040 if (!wiphy->max_acl_mac_addrs)
5041 return ERR_PTR(-EOPNOTSUPP);
5042
5043 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5044 return ERR_PTR(-EINVAL);
5045
5046 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5047 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5048 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5049 return ERR_PTR(-EINVAL);
5050
5051 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5052 return ERR_PTR(-EINVAL);
5053
5054 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5055 if (n_entries < 0)
5056 return ERR_PTR(n_entries);
5057
5058 if (n_entries > wiphy->max_acl_mac_addrs)
5059 return ERR_PTR(-EOPNOTSUPP);
5060
5061 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5062 if (!acl)
5063 return ERR_PTR(-ENOMEM);
5064 acl->n_acl_entries = n_entries;
5065
5066 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5067 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5068 i++;
5069 }
5070 acl->acl_policy = acl_policy;
5071
5072 return acl;
5073}
5074
5075static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5076{
5077 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5078 struct net_device *dev = info->user_ptr[1];
5079 struct cfg80211_acl_data *acl;
5080 int err;
5081
5082 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5083 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5084 return -EOPNOTSUPP;
5085
5086 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5087 return -EINVAL;
5088
5089 acl = parse_acl_data(&rdev->wiphy, info);
5090 if (IS_ERR(acl))
5091 return PTR_ERR(acl);
5092
5093 err = rdev_set_mac_acl(rdev, dev, acl);
5094
5095 kfree(acl);
5096
5097 return err;
5098}
5099
5100static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5101 u8 *rates, u8 rates_len)
5102{
5103 u8 i;
5104 u32 mask = 0;
5105
5106 for (i = 0; i < rates_len; i++) {
5107 int rate = (rates[i] & 0x7f) * 5;
5108 int ridx;
5109
5110 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5111 struct ieee80211_rate *srate =
5112 &sband->bitrates[ridx];
5113 if (rate == srate->bitrate) {
5114 mask |= 1 << ridx;
5115 break;
5116 }
5117 }
5118 if (ridx == sband->n_bitrates)
5119 return 0; /* rate not found */
5120 }
5121
5122 return mask;
5123}
5124
5125static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5126 u8 *rates, u8 rates_len,
5127 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5128{
5129 u8 i;
5130
5131 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5132
5133 for (i = 0; i < rates_len; i++) {
5134 int ridx, rbit;
5135
5136 ridx = rates[i] / 8;
5137 rbit = BIT(rates[i] % 8);
5138
5139 /* check validity */
5140 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5141 return false;
5142
5143 /* check availability */
5144 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5145 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5146 mcs[ridx] |= rbit;
5147 else
5148 return false;
5149 }
5150
5151 return true;
5152}
5153
5154static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5155{
5156 u16 mcs_mask = 0;
5157
5158 switch (vht_mcs_map) {
5159 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5160 break;
5161 case IEEE80211_VHT_MCS_SUPPORT_0_7:
5162 mcs_mask = 0x00FF;
5163 break;
5164 case IEEE80211_VHT_MCS_SUPPORT_0_8:
5165 mcs_mask = 0x01FF;
5166 break;
5167 case IEEE80211_VHT_MCS_SUPPORT_0_9:
5168 mcs_mask = 0x03FF;
5169 break;
5170 default:
5171 break;
5172 }
5173
5174 return mcs_mask;
5175}
5176
5177static void vht_build_mcs_mask(u16 vht_mcs_map,
5178 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5179{
5180 u8 nss;
5181
5182 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5183 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5184 vht_mcs_map >>= 2;
5185 }
5186}
5187
5188static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5189 struct nl80211_txrate_vht *txrate,
5190 u16 mcs[NL80211_VHT_NSS_MAX])
5191{
5192 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5193 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5194 u8 i;
5195
5196 if (!sband->vht_cap.vht_supported)
5197 return false;
5198
5199 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5200
5201 /* Build vht_mcs_mask from VHT capabilities */
5202 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5203
5204 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5205 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5206 mcs[i] = txrate->mcs[i];
5207 else
5208 return false;
5209 }
5210
5211 return true;
5212}
5213
5214static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5215{
5216 switch (he_mcs_map) {
5217 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5218 return 0;
5219 case IEEE80211_HE_MCS_SUPPORT_0_7:
5220 return 0x00FF;
5221 case IEEE80211_HE_MCS_SUPPORT_0_9:
5222 return 0x03FF;
5223 case IEEE80211_HE_MCS_SUPPORT_0_11:
5224 return 0xFFF;
5225 default:
5226 break;
5227 }
5228 return 0;
5229}
5230
5231static void he_build_mcs_mask(u16 he_mcs_map,
5232 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5233{
5234 u8 nss;
5235
5236 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5237 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5238 he_mcs_map >>= 2;
5239 }
5240}
5241
5242static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5243 const struct ieee80211_sta_he_cap *he_cap)
5244{
5245 struct net_device *dev = info->user_ptr[1];
5246 struct wireless_dev *wdev = dev->ieee80211_ptr;
5247 struct cfg80211_chan_def *chandef;
5248 __le16 tx_mcs;
5249
5250 chandef = wdev_chandef(wdev, link_id);
5251 if (!chandef) {
5252 /*
5253 * This is probably broken, but we never maintained
5254 * a chandef in these cases, so it always was.
5255 */
5256 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5257 }
5258
5259 switch (chandef->width) {
5260 case NL80211_CHAN_WIDTH_80P80:
5261 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5262 break;
5263 case NL80211_CHAN_WIDTH_160:
5264 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5265 break;
5266 default:
5267 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5268 break;
5269 }
5270
5271 return le16_to_cpu(tx_mcs);
5272}
5273
5274static bool he_set_mcs_mask(struct genl_info *info,
5275 struct wireless_dev *wdev,
5276 struct ieee80211_supported_band *sband,
5277 struct nl80211_txrate_he *txrate,
5278 u16 mcs[NL80211_HE_NSS_MAX],
5279 unsigned int link_id)
5280{
5281 const struct ieee80211_sta_he_cap *he_cap;
5282 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5283 u16 tx_mcs_map = 0;
5284 u8 i;
5285
5286 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5287 if (!he_cap)
5288 return false;
5289
5290 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5291
5292 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5293
5294 /* Build he_mcs_mask from HE capabilities */
5295 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5296
5297 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5298 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5299 mcs[i] = txrate->mcs[i];
5300 else
5301 return false;
5302 }
5303
5304 return true;
5305}
5306
5307static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5308 struct nlattr *attrs[],
5309 enum nl80211_attrs attr,
5310 struct cfg80211_bitrate_mask *mask,
5311 struct net_device *dev,
5312 bool default_all_enabled,
5313 unsigned int link_id)
5314{
5315 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5316 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5317 struct wireless_dev *wdev = dev->ieee80211_ptr;
5318 int rem, i;
5319 struct nlattr *tx_rates;
5320 struct ieee80211_supported_band *sband;
5321 u16 vht_tx_mcs_map, he_tx_mcs_map;
5322
5323 memset(mask, 0, sizeof(*mask));
5324 /* Default to all rates enabled */
5325 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5326 const struct ieee80211_sta_he_cap *he_cap;
5327
5328 if (!default_all_enabled)
5329 break;
5330
5331 sband = rdev->wiphy.bands[i];
5332
5333 if (!sband)
5334 continue;
5335
5336 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5337 memcpy(mask->control[i].ht_mcs,
5338 sband->ht_cap.mcs.rx_mask,
5339 sizeof(mask->control[i].ht_mcs));
5340
5341 if (sband->vht_cap.vht_supported) {
5342 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5343 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5344 }
5345
5346 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5347 if (!he_cap)
5348 continue;
5349
5350 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5351 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5352
5353 mask->control[i].he_gi = 0xFF;
5354 mask->control[i].he_ltf = 0xFF;
5355 }
5356
5357 /* if no rates are given set it back to the defaults */
5358 if (!attrs[attr])
5359 goto out;
5360
5361 /* The nested attribute uses enum nl80211_band as the index. This maps
5362 * directly to the enum nl80211_band values used in cfg80211.
5363 */
5364 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5365 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5366 enum nl80211_band band = nla_type(tx_rates);
5367 int err;
5368
5369 if (band < 0 || band >= NUM_NL80211_BANDS)
5370 return -EINVAL;
5371 sband = rdev->wiphy.bands[band];
5372 if (sband == NULL)
5373 return -EINVAL;
5374 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5375 tx_rates,
5376 nl80211_txattr_policy,
5377 info->extack);
5378 if (err)
5379 return err;
5380 if (tb[NL80211_TXRATE_LEGACY]) {
5381 mask->control[band].legacy = rateset_to_mask(
5382 sband,
5383 nla_data(tb[NL80211_TXRATE_LEGACY]),
5384 nla_len(tb[NL80211_TXRATE_LEGACY]));
5385 if ((mask->control[band].legacy == 0) &&
5386 nla_len(tb[NL80211_TXRATE_LEGACY]))
5387 return -EINVAL;
5388 }
5389 if (tb[NL80211_TXRATE_HT]) {
5390 if (!ht_rateset_to_mask(
5391 sband,
5392 nla_data(tb[NL80211_TXRATE_HT]),
5393 nla_len(tb[NL80211_TXRATE_HT]),
5394 mask->control[band].ht_mcs))
5395 return -EINVAL;
5396 }
5397
5398 if (tb[NL80211_TXRATE_VHT]) {
5399 if (!vht_set_mcs_mask(
5400 sband,
5401 nla_data(tb[NL80211_TXRATE_VHT]),
5402 mask->control[band].vht_mcs))
5403 return -EINVAL;
5404 }
5405
5406 if (tb[NL80211_TXRATE_GI]) {
5407 mask->control[band].gi =
5408 nla_get_u8(tb[NL80211_TXRATE_GI]);
5409 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5410 return -EINVAL;
5411 }
5412 if (tb[NL80211_TXRATE_HE] &&
5413 !he_set_mcs_mask(info, wdev, sband,
5414 nla_data(tb[NL80211_TXRATE_HE]),
5415 mask->control[band].he_mcs,
5416 link_id))
5417 return -EINVAL;
5418
5419 if (tb[NL80211_TXRATE_HE_GI])
5420 mask->control[band].he_gi =
5421 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5422 if (tb[NL80211_TXRATE_HE_LTF])
5423 mask->control[band].he_ltf =
5424 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5425
5426 if (mask->control[band].legacy == 0) {
5427 /* don't allow empty legacy rates if HT, VHT or HE
5428 * are not even supported.
5429 */
5430 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5431 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5432 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5433 return -EINVAL;
5434
5435 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5436 if (mask->control[band].ht_mcs[i])
5437 goto out;
5438
5439 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5440 if (mask->control[band].vht_mcs[i])
5441 goto out;
5442
5443 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5444 if (mask->control[band].he_mcs[i])
5445 goto out;
5446
5447 /* legacy and mcs rates may not be both empty */
5448 return -EINVAL;
5449 }
5450 }
5451
5452out:
5453 return 0;
5454}
5455
5456static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5457 enum nl80211_band band,
5458 struct cfg80211_bitrate_mask *beacon_rate)
5459{
5460 u32 count_ht, count_vht, count_he, i;
5461 u32 rate = beacon_rate->control[band].legacy;
5462
5463 /* Allow only one rate */
5464 if (hweight32(rate) > 1)
5465 return -EINVAL;
5466
5467 count_ht = 0;
5468 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5469 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5470 return -EINVAL;
5471 } else if (beacon_rate->control[band].ht_mcs[i]) {
5472 count_ht++;
5473 if (count_ht > 1)
5474 return -EINVAL;
5475 }
5476 if (count_ht && rate)
5477 return -EINVAL;
5478 }
5479
5480 count_vht = 0;
5481 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5482 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5483 return -EINVAL;
5484 } else if (beacon_rate->control[band].vht_mcs[i]) {
5485 count_vht++;
5486 if (count_vht > 1)
5487 return -EINVAL;
5488 }
5489 if (count_vht && rate)
5490 return -EINVAL;
5491 }
5492
5493 count_he = 0;
5494 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5495 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5496 return -EINVAL;
5497 } else if (beacon_rate->control[band].he_mcs[i]) {
5498 count_he++;
5499 if (count_he > 1)
5500 return -EINVAL;
5501 }
5502 if (count_he && rate)
5503 return -EINVAL;
5504 }
5505
5506 if ((count_ht && count_vht && count_he) ||
5507 (!rate && !count_ht && !count_vht && !count_he))
5508 return -EINVAL;
5509
5510 if (rate &&
5511 !wiphy_ext_feature_isset(&rdev->wiphy,
5512 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5513 return -EINVAL;
5514 if (count_ht &&
5515 !wiphy_ext_feature_isset(&rdev->wiphy,
5516 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5517 return -EINVAL;
5518 if (count_vht &&
5519 !wiphy_ext_feature_isset(&rdev->wiphy,
5520 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5521 return -EINVAL;
5522 if (count_he &&
5523 !wiphy_ext_feature_isset(&rdev->wiphy,
5524 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5525 return -EINVAL;
5526
5527 return 0;
5528}
5529
5530static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5531 struct net_device *dev,
5532 unsigned int link_id,
5533 struct nlattr *attrs,
5534 struct cfg80211_mbssid_config *config,
5535 u8 num_elems)
5536{
5537 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5538 int tx_link_id = -1;
5539
5540 if (!wiphy->mbssid_max_interfaces)
5541 return -EOPNOTSUPP;
5542
5543 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5544 NULL) ||
5545 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5546 return -EINVAL;
5547
5548 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5549 if (config->ema) {
5550 if (!wiphy->ema_max_profile_periodicity)
5551 return -EOPNOTSUPP;
5552
5553 if (num_elems > wiphy->ema_max_profile_periodicity)
5554 return -EINVAL;
5555 }
5556
5557 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5558 if (config->index >= wiphy->mbssid_max_interfaces ||
5559 (!config->index && !num_elems))
5560 return -EINVAL;
5561
5562 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
5563 tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
5564
5565 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5566 u32 tx_ifindex =
5567 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5568
5569 if ((!config->index && tx_ifindex != dev->ifindex) ||
5570 (config->index && tx_ifindex == dev->ifindex))
5571 return -EINVAL;
5572
5573 if (tx_ifindex != dev->ifindex) {
5574 struct net_device *tx_netdev =
5575 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5576
5577 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5578 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5579 tx_netdev->ieee80211_ptr->iftype !=
5580 NL80211_IFTYPE_AP) {
5581 dev_put(tx_netdev);
5582 return -EINVAL;
5583 }
5584
5585 config->tx_wdev = tx_netdev->ieee80211_ptr;
5586 /* Caller should call dev_put(config->tx_wdev) from this point */
5587
5588 if (config->tx_wdev->valid_links) {
5589 if (tx_link_id == -1 ||
5590 !(config->tx_wdev->valid_links & BIT(tx_link_id)))
5591 return -ENOLINK;
5592
5593 config->tx_link_id = tx_link_id;
5594 }
5595 } else {
5596 if (tx_link_id >= 0 && tx_link_id != link_id)
5597 return -EINVAL;
5598
5599 config->tx_wdev = dev->ieee80211_ptr;
5600 }
5601 } else if (!config->index) {
5602 if (tx_link_id >= 0 && tx_link_id != link_id)
5603 return -EINVAL;
5604
5605 config->tx_wdev = dev->ieee80211_ptr;
5606 } else {
5607 return -EINVAL;
5608 }
5609
5610 return 0;
5611}
5612
5613static struct cfg80211_mbssid_elems *
5614nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5615{
5616 struct nlattr *nl_elems;
5617 struct cfg80211_mbssid_elems *elems;
5618 int rem_elems;
5619 u8 i = 0, num_elems = 0;
5620
5621 if (!wiphy->mbssid_max_interfaces)
5622 return ERR_PTR(-EINVAL);
5623
5624 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5625 if (num_elems >= 255)
5626 return ERR_PTR(-EINVAL);
5627 num_elems++;
5628 }
5629
5630 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5631 if (!elems)
5632 return ERR_PTR(-ENOMEM);
5633 elems->cnt = num_elems;
5634
5635 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5636 elems->elem[i].data = nla_data(nl_elems);
5637 elems->elem[i].len = nla_len(nl_elems);
5638 i++;
5639 }
5640 return elems;
5641}
5642
5643static struct cfg80211_rnr_elems *
5644nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5645 struct netlink_ext_ack *extack)
5646{
5647 struct nlattr *nl_elems;
5648 struct cfg80211_rnr_elems *elems;
5649 int rem_elems;
5650 u8 i = 0, num_elems = 0;
5651
5652 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5653 int ret;
5654
5655 ret = validate_ie_attr(nl_elems, extack);
5656 if (ret)
5657 return ERR_PTR(ret);
5658
5659 num_elems++;
5660 }
5661
5662 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5663 if (!elems)
5664 return ERR_PTR(-ENOMEM);
5665 elems->cnt = num_elems;
5666
5667 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5668 elems->elem[i].data = nla_data(nl_elems);
5669 elems->elem[i].len = nla_len(nl_elems);
5670 i++;
5671 }
5672 return elems;
5673}
5674
5675static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5676 struct cfg80211_he_bss_color *he_bss_color)
5677{
5678 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5679 int err;
5680
5681 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5682 he_bss_color_policy, NULL);
5683 if (err)
5684 return err;
5685
5686 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5687 return -EINVAL;
5688
5689 he_bss_color->color =
5690 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5691 he_bss_color->enabled =
5692 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5693 he_bss_color->partial =
5694 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5695
5696 return 0;
5697}
5698
5699static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5700 struct nlattr *attrs[],
5701 struct cfg80211_beacon_data *bcn,
5702 struct netlink_ext_ack *extack)
5703{
5704 bool haveinfo = false;
5705 int err;
5706
5707 memset(bcn, 0, sizeof(*bcn));
5708
5709 bcn->link_id = nl80211_link_id(attrs);
5710
5711 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5712 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5713 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5714 if (!bcn->head_len)
5715 return -EINVAL;
5716 haveinfo = true;
5717 }
5718
5719 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5720 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5721 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5722 haveinfo = true;
5723 }
5724
5725 if (!haveinfo)
5726 return -EINVAL;
5727
5728 if (attrs[NL80211_ATTR_IE]) {
5729 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5730 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5731 }
5732
5733 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5734 bcn->proberesp_ies =
5735 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5736 bcn->proberesp_ies_len =
5737 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5738 }
5739
5740 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5741 bcn->assocresp_ies =
5742 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5743 bcn->assocresp_ies_len =
5744 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5745 }
5746
5747 if (attrs[NL80211_ATTR_PROBE_RESP]) {
5748 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5749 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5750 }
5751
5752 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5753 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5754
5755 err = nla_parse_nested_deprecated(tb,
5756 NL80211_FTM_RESP_ATTR_MAX,
5757 attrs[NL80211_ATTR_FTM_RESPONDER],
5758 NULL, NULL);
5759 if (err)
5760 return err;
5761
5762 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5763 wiphy_ext_feature_isset(&rdev->wiphy,
5764 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5765 bcn->ftm_responder = 1;
5766 else
5767 return -EOPNOTSUPP;
5768
5769 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5770 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5771 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5772 }
5773
5774 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5775 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5776 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5777 }
5778 } else {
5779 bcn->ftm_responder = -1;
5780 }
5781
5782 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5783 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5784 &bcn->he_bss_color);
5785 if (err)
5786 return err;
5787 bcn->he_bss_color_valid = true;
5788 }
5789
5790 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5791 struct cfg80211_mbssid_elems *mbssid =
5792 nl80211_parse_mbssid_elems(&rdev->wiphy,
5793 attrs[NL80211_ATTR_MBSSID_ELEMS]);
5794
5795 if (IS_ERR(mbssid))
5796 return PTR_ERR(mbssid);
5797
5798 bcn->mbssid_ies = mbssid;
5799
5800 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5801 struct cfg80211_rnr_elems *rnr =
5802 nl80211_parse_rnr_elems(&rdev->wiphy,
5803 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5804 extack);
5805
5806 if (IS_ERR(rnr))
5807 return PTR_ERR(rnr);
5808
5809 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5810 return -EINVAL;
5811
5812 bcn->rnr_ies = rnr;
5813 }
5814 }
5815
5816 return 0;
5817}
5818
5819static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5820 struct ieee80211_he_obss_pd *he_obss_pd)
5821{
5822 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5823 int err;
5824
5825 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5826 he_obss_pd_policy, NULL);
5827 if (err)
5828 return err;
5829
5830 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5831 return -EINVAL;
5832
5833 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5834
5835 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5836 he_obss_pd->min_offset =
5837 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5838 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5839 he_obss_pd->max_offset =
5840 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5841 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5842 he_obss_pd->non_srg_max_offset =
5843 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5844
5845 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5846 return -EINVAL;
5847
5848 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5849 memcpy(he_obss_pd->bss_color_bitmap,
5850 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5851 sizeof(he_obss_pd->bss_color_bitmap));
5852
5853 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5854 memcpy(he_obss_pd->partial_bssid_bitmap,
5855 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5856 sizeof(he_obss_pd->partial_bssid_bitmap));
5857
5858 he_obss_pd->enable = true;
5859
5860 return 0;
5861}
5862
5863static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5864 struct nlattr *attrs,
5865 struct cfg80211_fils_discovery *fd)
5866{
5867 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5868 int ret;
5869
5870 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5871 NL80211_EXT_FEATURE_FILS_DISCOVERY))
5872 return -EINVAL;
5873
5874 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5875 NULL, NULL);
5876 if (ret)
5877 return ret;
5878
5879 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
5880 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
5881 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
5882 fd->update = true;
5883 return 0;
5884 }
5885
5886 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5887 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5888 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5889 return -EINVAL;
5890
5891 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5892 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5893 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5894 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5895 fd->update = true;
5896 return 0;
5897}
5898
5899static int
5900nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5901 struct nlattr *attrs,
5902 struct cfg80211_unsol_bcast_probe_resp *presp)
5903{
5904 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5905 int ret;
5906
5907 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5908 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5909 return -EINVAL;
5910
5911 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5912 attrs, NULL, NULL);
5913 if (ret)
5914 return ret;
5915
5916 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
5917 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
5918 presp->update = true;
5919 return 0;
5920 }
5921
5922 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5923 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5924 return -EINVAL;
5925
5926 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5927 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5928 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5929 presp->update = true;
5930 return 0;
5931}
5932
5933static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5934 const struct element *rates)
5935{
5936 int i;
5937
5938 if (!rates)
5939 return;
5940
5941 for (i = 0; i < rates->datalen; i++) {
5942 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5943 params->ht_required = true;
5944 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5945 params->vht_required = true;
5946 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5947 params->he_required = true;
5948 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5949 params->sae_h2e_required = true;
5950 }
5951}
5952
5953/*
5954 * Since the nl80211 API didn't include, from the beginning, attributes about
5955 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5956 * benefit of drivers that rebuild IEs in the firmware.
5957 */
5958static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5959{
5960 const struct cfg80211_beacon_data *bcn = &params->beacon;
5961 size_t ies_len = bcn->tail_len;
5962 const u8 *ies = bcn->tail;
5963 const struct element *rates;
5964 const struct element *cap;
5965
5966 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5967 nl80211_check_ap_rate_selectors(params, rates);
5968
5969 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5970 nl80211_check_ap_rate_selectors(params, rates);
5971
5972 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5973 if (cap && cap->datalen >= sizeof(*params->ht_cap))
5974 params->ht_cap = (void *)cap->data;
5975 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5976 if (cap && cap->datalen >= sizeof(*params->vht_cap))
5977 params->vht_cap = (void *)cap->data;
5978 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5979 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5980 params->he_cap = (void *)(cap->data + 1);
5981 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5982 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5983 params->he_oper = (void *)(cap->data + 1);
5984 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5985 if (cap) {
5986 if (!cap->datalen)
5987 return -EINVAL;
5988 params->eht_cap = (void *)(cap->data + 1);
5989 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5990 (const u8 *)params->eht_cap,
5991 cap->datalen - 1, true))
5992 return -EINVAL;
5993 }
5994 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5995 if (cap) {
5996 if (!cap->datalen)
5997 return -EINVAL;
5998 params->eht_oper = (void *)(cap->data + 1);
5999 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
6000 cap->datalen - 1))
6001 return -EINVAL;
6002 }
6003 return 0;
6004}
6005
6006static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
6007 struct cfg80211_ap_settings *params)
6008{
6009 struct wireless_dev *wdev;
6010
6011 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
6012 if (wdev->iftype != NL80211_IFTYPE_AP &&
6013 wdev->iftype != NL80211_IFTYPE_P2P_GO)
6014 continue;
6015
6016 if (!wdev->u.ap.preset_chandef.chan)
6017 continue;
6018
6019 params->chandef = wdev->u.ap.preset_chandef;
6020 return true;
6021 }
6022
6023 return false;
6024}
6025
6026static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6027 enum nl80211_auth_type auth_type,
6028 enum nl80211_commands cmd)
6029{
6030 if (auth_type > NL80211_AUTHTYPE_MAX)
6031 return false;
6032
6033 switch (cmd) {
6034 case NL80211_CMD_AUTHENTICATE:
6035 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6036 auth_type == NL80211_AUTHTYPE_SAE)
6037 return false;
6038 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6039 NL80211_EXT_FEATURE_FILS_STA) &&
6040 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6041 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6042 auth_type == NL80211_AUTHTYPE_FILS_PK))
6043 return false;
6044 return true;
6045 case NL80211_CMD_CONNECT:
6046 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6047 !wiphy_ext_feature_isset(&rdev->wiphy,
6048 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6049 auth_type == NL80211_AUTHTYPE_SAE)
6050 return false;
6051
6052 /* FILS with SK PFS or PK not supported yet */
6053 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6054 auth_type == NL80211_AUTHTYPE_FILS_PK)
6055 return false;
6056 if (!wiphy_ext_feature_isset(
6057 &rdev->wiphy,
6058 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6059 auth_type == NL80211_AUTHTYPE_FILS_SK)
6060 return false;
6061 return true;
6062 case NL80211_CMD_START_AP:
6063 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6064 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6065 auth_type == NL80211_AUTHTYPE_SAE)
6066 return false;
6067 /* FILS not supported yet */
6068 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6069 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6070 auth_type == NL80211_AUTHTYPE_FILS_PK)
6071 return false;
6072 return true;
6073 default:
6074 return false;
6075 }
6076}
6077
6078static void nl80211_send_ap_started(struct wireless_dev *wdev,
6079 unsigned int link_id)
6080{
6081 struct wiphy *wiphy = wdev->wiphy;
6082 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6083 struct sk_buff *msg;
6084 void *hdr;
6085
6086 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6087 if (!msg)
6088 return;
6089
6090 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6091 if (!hdr)
6092 goto out;
6093
6094 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6095 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6096 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6097 NL80211_ATTR_PAD) ||
6098 (wdev->u.ap.ssid_len &&
6099 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6100 wdev->u.ap.ssid)) ||
6101 (wdev->valid_links &&
6102 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6103 goto out;
6104
6105 genlmsg_end(msg, hdr);
6106
6107 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6108 NL80211_MCGRP_MLME, GFP_KERNEL);
6109 return;
6110out:
6111 nlmsg_free(msg);
6112}
6113
6114static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6115{
6116 struct ieee80211_channel *channel = params->chandef.chan;
6117
6118 if ((params->he_cap || params->he_oper) &&
6119 (channel->flags & IEEE80211_CHAN_NO_HE))
6120 return -EOPNOTSUPP;
6121
6122 if ((params->eht_cap || params->eht_oper) &&
6123 (channel->flags & IEEE80211_CHAN_NO_EHT))
6124 return -EOPNOTSUPP;
6125
6126 return 0;
6127}
6128
6129static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6130{
6131 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6132 struct cfg80211_beaconing_check_config beacon_check = {};
6133 unsigned int link_id = nl80211_link_id(info->attrs);
6134 struct net_device *dev = info->user_ptr[1];
6135 struct wireless_dev *wdev = dev->ieee80211_ptr;
6136 struct cfg80211_ap_settings *params;
6137 int err;
6138
6139 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6140 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6141 return -EOPNOTSUPP;
6142
6143 if (!rdev->ops->start_ap)
6144 return -EOPNOTSUPP;
6145
6146 if (wdev->links[link_id].cac_started)
6147 return -EBUSY;
6148
6149 if (wdev->links[link_id].ap.beacon_interval)
6150 return -EALREADY;
6151
6152 /* these are required for START_AP */
6153 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6154 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6155 !info->attrs[NL80211_ATTR_BEACON_HEAD])
6156 return -EINVAL;
6157
6158 if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6159 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6160 return -EOPNOTSUPP;
6161
6162 params = kzalloc(sizeof(*params), GFP_KERNEL);
6163 if (!params)
6164 return -ENOMEM;
6165
6166 err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
6167 info->extack);
6168 if (err)
6169 goto out;
6170
6171 params->beacon_interval =
6172 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6173 params->dtim_period =
6174 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6175
6176 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6177 params->beacon_interval);
6178 if (err)
6179 goto out;
6180
6181 /*
6182 * In theory, some of these attributes should be required here
6183 * but since they were not used when the command was originally
6184 * added, keep them optional for old user space programs to let
6185 * them continue to work with drivers that do not need the
6186 * additional information -- drivers must check!
6187 */
6188 if (info->attrs[NL80211_ATTR_SSID]) {
6189 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6190 params->ssid_len =
6191 nla_len(info->attrs[NL80211_ATTR_SSID]);
6192 if (params->ssid_len == 0) {
6193 err = -EINVAL;
6194 goto out;
6195 }
6196
6197 if (wdev->u.ap.ssid_len &&
6198 (wdev->u.ap.ssid_len != params->ssid_len ||
6199 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6200 /* require identical SSID for MLO */
6201 err = -EINVAL;
6202 goto out;
6203 }
6204 } else if (wdev->valid_links) {
6205 /* require SSID for MLO */
6206 err = -EINVAL;
6207 goto out;
6208 }
6209
6210 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6211 params->hidden_ssid = nla_get_u32(
6212 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6213
6214 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6215
6216 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6217 params->auth_type = nla_get_u32(
6218 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6219 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6220 NL80211_CMD_START_AP)) {
6221 err = -EINVAL;
6222 goto out;
6223 }
6224 } else
6225 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6226
6227 err = nl80211_crypto_settings(rdev, info, &params->crypto,
6228 NL80211_MAX_NR_CIPHER_SUITES);
6229 if (err)
6230 goto out;
6231
6232 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6233 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6234 err = -EOPNOTSUPP;
6235 goto out;
6236 }
6237 params->inactivity_timeout = nla_get_u16(
6238 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6239 }
6240
6241 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6242 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6243 err = -EINVAL;
6244 goto out;
6245 }
6246 params->p2p_ctwindow =
6247 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6248 if (params->p2p_ctwindow != 0 &&
6249 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6250 err = -EINVAL;
6251 goto out;
6252 }
6253 }
6254
6255 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6256 u8 tmp;
6257
6258 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6259 err = -EINVAL;
6260 goto out;
6261 }
6262 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6263 params->p2p_opp_ps = tmp;
6264 if (params->p2p_opp_ps != 0 &&
6265 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6266 err = -EINVAL;
6267 goto out;
6268 }
6269 }
6270
6271 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6272 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6273 if (err)
6274 goto out;
6275 } else if (wdev->valid_links) {
6276 /* with MLD need to specify the channel configuration */
6277 err = -EINVAL;
6278 goto out;
6279 } else if (wdev->u.ap.preset_chandef.chan) {
6280 params->chandef = wdev->u.ap.preset_chandef;
6281 } else if (!nl80211_get_ap_channel(rdev, params)) {
6282 err = -EINVAL;
6283 goto out;
6284 }
6285
6286 beacon_check.iftype = wdev->iftype;
6287 beacon_check.relax = true;
6288 beacon_check.reg_power =
6289 cfg80211_get_6ghz_power_type(params->beacon.tail,
6290 params->beacon.tail_len);
6291 if (!cfg80211_reg_check_beaconing(&rdev->wiphy, &params->chandef,
6292 &beacon_check)) {
6293 err = -EINVAL;
6294 goto out;
6295 }
6296
6297 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6298 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6299 NL80211_ATTR_TX_RATES,
6300 &params->beacon_rate,
6301 dev, false, link_id);
6302 if (err)
6303 goto out;
6304
6305 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6306 &params->beacon_rate);
6307 if (err)
6308 goto out;
6309 }
6310
6311 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6312 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6313 err = -EOPNOTSUPP;
6314 goto out;
6315 }
6316
6317 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6318 params->acl = parse_acl_data(&rdev->wiphy, info);
6319 if (IS_ERR(params->acl)) {
6320 err = PTR_ERR(params->acl);
6321 params->acl = NULL;
6322 goto out;
6323 }
6324 }
6325
6326 params->twt_responder =
6327 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6328
6329 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6330 err = nl80211_parse_he_obss_pd(
6331 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6332 &params->he_obss_pd);
6333 if (err)
6334 goto out;
6335 }
6336
6337 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6338 err = nl80211_parse_fils_discovery(rdev,
6339 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6340 &params->fils_discovery);
6341 if (err)
6342 goto out;
6343 }
6344
6345 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6346 err = nl80211_parse_unsol_bcast_probe_resp(
6347 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6348 &params->unsol_bcast_probe_resp);
6349 if (err)
6350 goto out;
6351 }
6352
6353 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6354 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
6355 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6356 &params->mbssid_config,
6357 params->beacon.mbssid_ies ?
6358 params->beacon.mbssid_ies->cnt :
6359 0);
6360 if (err)
6361 goto out;
6362 }
6363
6364 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6365 err = -EINVAL;
6366 goto out;
6367 }
6368
6369 err = nl80211_calculate_ap_params(params);
6370 if (err)
6371 goto out;
6372
6373 err = nl80211_validate_ap_phy_operation(params);
6374 if (err)
6375 goto out;
6376
6377 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6378 params->flags = nla_get_u32(
6379 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6380 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6381 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6382
6383 if (wdev->conn_owner_nlportid &&
6384 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6385 wdev->conn_owner_nlportid != info->snd_portid) {
6386 err = -EINVAL;
6387 goto out;
6388 }
6389
6390 /* FIXME: validate MLO/link-id against driver capabilities */
6391
6392 err = rdev_start_ap(rdev, dev, params);
6393 if (!err) {
6394 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6395 wdev->links[link_id].ap.chandef = params->chandef;
6396 wdev->u.ap.ssid_len = params->ssid_len;
6397 memcpy(wdev->u.ap.ssid, params->ssid,
6398 params->ssid_len);
6399
6400 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6401 wdev->conn_owner_nlportid = info->snd_portid;
6402
6403 nl80211_send_ap_started(wdev, link_id);
6404 }
6405out:
6406 kfree(params->acl);
6407 kfree(params->beacon.mbssid_ies);
6408 if (params->mbssid_config.tx_wdev &&
6409 params->mbssid_config.tx_wdev->netdev &&
6410 params->mbssid_config.tx_wdev->netdev != dev)
6411 dev_put(params->mbssid_config.tx_wdev->netdev);
6412 kfree(params->beacon.rnr_ies);
6413 kfree(params);
6414
6415 return err;
6416}
6417
6418static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6419{
6420 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6421 struct cfg80211_beaconing_check_config beacon_check = {};
6422 unsigned int link_id = nl80211_link_id(info->attrs);
6423 struct net_device *dev = info->user_ptr[1];
6424 struct wireless_dev *wdev = dev->ieee80211_ptr;
6425 struct cfg80211_ap_update *params;
6426 struct nlattr *attr;
6427 int err;
6428
6429 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6430 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6431 return -EOPNOTSUPP;
6432
6433 if (!rdev->ops->change_beacon)
6434 return -EOPNOTSUPP;
6435
6436 if (!wdev->links[link_id].ap.beacon_interval)
6437 return -EINVAL;
6438
6439 params = kzalloc(sizeof(*params), GFP_KERNEL);
6440 if (!params)
6441 return -ENOMEM;
6442
6443 err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
6444 info->extack);
6445 if (err)
6446 goto out;
6447
6448 /* recheck beaconing is permitted with possibly changed power type */
6449 beacon_check.iftype = wdev->iftype;
6450 beacon_check.relax = true;
6451 beacon_check.reg_power =
6452 cfg80211_get_6ghz_power_type(params->beacon.tail,
6453 params->beacon.tail_len);
6454 if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6455 &wdev->links[link_id].ap.chandef,
6456 &beacon_check)) {
6457 err = -EINVAL;
6458 goto out;
6459 }
6460
6461 attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6462 if (attr) {
6463 err = nl80211_parse_fils_discovery(rdev, attr,
6464 &params->fils_discovery);
6465 if (err)
6466 goto out;
6467 }
6468
6469 attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6470 if (attr) {
6471 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6472 &params->unsol_bcast_probe_resp);
6473 if (err)
6474 goto out;
6475 }
6476
6477 err = rdev_change_beacon(rdev, dev, params);
6478
6479out:
6480 kfree(params->beacon.mbssid_ies);
6481 kfree(params->beacon.rnr_ies);
6482 kfree(params);
6483 return err;
6484}
6485
6486static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6487{
6488 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6489 unsigned int link_id = nl80211_link_id(info->attrs);
6490 struct net_device *dev = info->user_ptr[1];
6491
6492 return cfg80211_stop_ap(rdev, dev, link_id, false);
6493}
6494
6495static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6496 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6497 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6498 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6499 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6500 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6501 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6502};
6503
6504static int parse_station_flags(struct genl_info *info,
6505 enum nl80211_iftype iftype,
6506 struct station_parameters *params)
6507{
6508 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6509 struct nlattr *nla;
6510 int flag;
6511
6512 /*
6513 * Try parsing the new attribute first so userspace
6514 * can specify both for older kernels.
6515 */
6516 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6517 if (nla) {
6518 struct nl80211_sta_flag_update *sta_flags;
6519
6520 sta_flags = nla_data(nla);
6521 params->sta_flags_mask = sta_flags->mask;
6522 params->sta_flags_set = sta_flags->set;
6523 params->sta_flags_set &= params->sta_flags_mask;
6524 if ((params->sta_flags_mask |
6525 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6526 return -EINVAL;
6527 return 0;
6528 }
6529
6530 /* if present, parse the old attribute */
6531
6532 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6533 if (!nla)
6534 return 0;
6535
6536 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6537 return -EINVAL;
6538
6539 /*
6540 * Only allow certain flags for interface types so that
6541 * other attributes are silently ignored. Remember that
6542 * this is backward compatibility code with old userspace
6543 * and shouldn't be hit in other cases anyway.
6544 */
6545 switch (iftype) {
6546 case NL80211_IFTYPE_AP:
6547 case NL80211_IFTYPE_AP_VLAN:
6548 case NL80211_IFTYPE_P2P_GO:
6549 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6550 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6551 BIT(NL80211_STA_FLAG_WME) |
6552 BIT(NL80211_STA_FLAG_MFP);
6553 break;
6554 case NL80211_IFTYPE_P2P_CLIENT:
6555 case NL80211_IFTYPE_STATION:
6556 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6557 BIT(NL80211_STA_FLAG_TDLS_PEER);
6558 break;
6559 case NL80211_IFTYPE_MESH_POINT:
6560 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6561 BIT(NL80211_STA_FLAG_MFP) |
6562 BIT(NL80211_STA_FLAG_AUTHORIZED);
6563 break;
6564 default:
6565 return -EINVAL;
6566 }
6567
6568 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6569 if (flags[flag]) {
6570 params->sta_flags_set |= (1<<flag);
6571
6572 /* no longer support new API additions in old API */
6573 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6574 return -EINVAL;
6575 }
6576 }
6577
6578 return 0;
6579}
6580
6581bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6582{
6583 struct nlattr *rate;
6584 u32 bitrate;
6585 u16 bitrate_compat;
6586 enum nl80211_rate_info rate_flg;
6587
6588 rate = nla_nest_start_noflag(msg, attr);
6589 if (!rate)
6590 return false;
6591
6592 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6593 bitrate = cfg80211_calculate_bitrate(info);
6594 /* report 16-bit bitrate only if we can */
6595 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6596 if (bitrate > 0 &&
6597 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6598 return false;
6599 if (bitrate_compat > 0 &&
6600 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6601 return false;
6602
6603 switch (info->bw) {
6604 case RATE_INFO_BW_1:
6605 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6606 break;
6607 case RATE_INFO_BW_2:
6608 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6609 break;
6610 case RATE_INFO_BW_4:
6611 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6612 break;
6613 case RATE_INFO_BW_5:
6614 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6615 break;
6616 case RATE_INFO_BW_8:
6617 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6618 break;
6619 case RATE_INFO_BW_10:
6620 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6621 break;
6622 case RATE_INFO_BW_16:
6623 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6624 break;
6625 default:
6626 WARN_ON(1);
6627 fallthrough;
6628 case RATE_INFO_BW_20:
6629 rate_flg = 0;
6630 break;
6631 case RATE_INFO_BW_40:
6632 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6633 break;
6634 case RATE_INFO_BW_80:
6635 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6636 break;
6637 case RATE_INFO_BW_160:
6638 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6639 break;
6640 case RATE_INFO_BW_HE_RU:
6641 rate_flg = 0;
6642 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6643 break;
6644 case RATE_INFO_BW_320:
6645 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6646 break;
6647 case RATE_INFO_BW_EHT_RU:
6648 rate_flg = 0;
6649 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6650 break;
6651 }
6652
6653 if (rate_flg && nla_put_flag(msg, rate_flg))
6654 return false;
6655
6656 if (info->flags & RATE_INFO_FLAGS_MCS) {
6657 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6658 return false;
6659 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6660 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6661 return false;
6662 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6663 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6664 return false;
6665 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6666 return false;
6667 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6668 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6669 return false;
6670 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6671 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6672 return false;
6673 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6674 return false;
6675 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6676 return false;
6677 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6678 return false;
6679 if (info->bw == RATE_INFO_BW_HE_RU &&
6680 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6681 info->he_ru_alloc))
6682 return false;
6683 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6684 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6685 return false;
6686 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6687 return false;
6688 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6689 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6690 return false;
6691 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6692 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6693 return false;
6694 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6695 return false;
6696 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6697 return false;
6698 if (info->bw == RATE_INFO_BW_EHT_RU &&
6699 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6700 info->eht_ru_alloc))
6701 return false;
6702 }
6703
6704 nla_nest_end(msg, rate);
6705 return true;
6706}
6707
6708static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6709 int id)
6710{
6711 void *attr;
6712 int i = 0;
6713
6714 if (!mask)
6715 return true;
6716
6717 attr = nla_nest_start_noflag(msg, id);
6718 if (!attr)
6719 return false;
6720
6721 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6722 if (!(mask & BIT(i)))
6723 continue;
6724
6725 if (nla_put_u8(msg, i, signal[i]))
6726 return false;
6727 }
6728
6729 nla_nest_end(msg, attr);
6730
6731 return true;
6732}
6733
6734static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6735 u32 seq, int flags,
6736 struct cfg80211_registered_device *rdev,
6737 struct net_device *dev,
6738 const u8 *mac_addr, struct station_info *sinfo)
6739{
6740 void *hdr;
6741 struct nlattr *sinfoattr, *bss_param;
6742
6743 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6744 if (!hdr) {
6745 cfg80211_sinfo_release_content(sinfo);
6746 return -1;
6747 }
6748
6749 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6750 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6751 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6752 goto nla_put_failure;
6753
6754 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6755 if (!sinfoattr)
6756 goto nla_put_failure;
6757
6758#define PUT_SINFO(attr, memb, type) do { \
6759 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
6760 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6761 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
6762 sinfo->memb)) \
6763 goto nla_put_failure; \
6764 } while (0)
6765#define PUT_SINFO_U64(attr, memb) do { \
6766 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6767 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
6768 sinfo->memb, NL80211_STA_INFO_PAD)) \
6769 goto nla_put_failure; \
6770 } while (0)
6771
6772 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6773 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6774 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6775
6776 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6777 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6778 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6779 (u32)sinfo->rx_bytes))
6780 goto nla_put_failure;
6781
6782 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6783 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6784 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6785 (u32)sinfo->tx_bytes))
6786 goto nla_put_failure;
6787
6788 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6789 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6790 PUT_SINFO_U64(RX_DURATION, rx_duration);
6791 PUT_SINFO_U64(TX_DURATION, tx_duration);
6792
6793 if (wiphy_ext_feature_isset(&rdev->wiphy,
6794 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6795 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6796
6797 switch (rdev->wiphy.signal_type) {
6798 case CFG80211_SIGNAL_TYPE_MBM:
6799 PUT_SINFO(SIGNAL, signal, u8);
6800 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6801 break;
6802 default:
6803 break;
6804 }
6805 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6806 if (!nl80211_put_signal(msg, sinfo->chains,
6807 sinfo->chain_signal,
6808 NL80211_STA_INFO_CHAIN_SIGNAL))
6809 goto nla_put_failure;
6810 }
6811 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6812 if (!nl80211_put_signal(msg, sinfo->chains,
6813 sinfo->chain_signal_avg,
6814 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6815 goto nla_put_failure;
6816 }
6817 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6818 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6819 NL80211_STA_INFO_TX_BITRATE))
6820 goto nla_put_failure;
6821 }
6822 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6823 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6824 NL80211_STA_INFO_RX_BITRATE))
6825 goto nla_put_failure;
6826 }
6827
6828 PUT_SINFO(RX_PACKETS, rx_packets, u32);
6829 PUT_SINFO(TX_PACKETS, tx_packets, u32);
6830 PUT_SINFO(TX_RETRIES, tx_retries, u32);
6831 PUT_SINFO(TX_FAILED, tx_failed, u32);
6832 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6833 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6834
6835 PUT_SINFO(LLID, llid, u16);
6836 PUT_SINFO(PLID, plid, u16);
6837 PUT_SINFO(PLINK_STATE, plink_state, u8);
6838 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6839 PUT_SINFO(LOCAL_PM, local_pm, u32);
6840 PUT_SINFO(PEER_PM, peer_pm, u32);
6841 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6842 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6843 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6844 PUT_SINFO_U64(T_OFFSET, t_offset);
6845
6846 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6847 bss_param = nla_nest_start_noflag(msg,
6848 NL80211_STA_INFO_BSS_PARAM);
6849 if (!bss_param)
6850 goto nla_put_failure;
6851
6852 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6853 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6854 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6855 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6856 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6857 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6858 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6859 sinfo->bss_param.dtim_period) ||
6860 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6861 sinfo->bss_param.beacon_interval))
6862 goto nla_put_failure;
6863
6864 nla_nest_end(msg, bss_param);
6865 }
6866 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6867 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6868 sizeof(struct nl80211_sta_flag_update),
6869 &sinfo->sta_flags))
6870 goto nla_put_failure;
6871
6872 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6873 PUT_SINFO_U64(BEACON_RX, rx_beacon);
6874 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6875 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6876 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6877 if (wiphy_ext_feature_isset(&rdev->wiphy,
6878 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6879 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6880 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6881 }
6882
6883#undef PUT_SINFO
6884#undef PUT_SINFO_U64
6885
6886 if (sinfo->pertid) {
6887 struct nlattr *tidsattr;
6888 int tid;
6889
6890 tidsattr = nla_nest_start_noflag(msg,
6891 NL80211_STA_INFO_TID_STATS);
6892 if (!tidsattr)
6893 goto nla_put_failure;
6894
6895 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6896 struct cfg80211_tid_stats *tidstats;
6897 struct nlattr *tidattr;
6898
6899 tidstats = &sinfo->pertid[tid];
6900
6901 if (!tidstats->filled)
6902 continue;
6903
6904 tidattr = nla_nest_start_noflag(msg, tid + 1);
6905 if (!tidattr)
6906 goto nla_put_failure;
6907
6908#define PUT_TIDVAL_U64(attr, memb) do { \
6909 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
6910 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
6911 tidstats->memb, NL80211_TID_STATS_PAD)) \
6912 goto nla_put_failure; \
6913 } while (0)
6914
6915 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6916 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6917 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6918 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6919
6920#undef PUT_TIDVAL_U64
6921 if ((tidstats->filled &
6922 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6923 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6924 NL80211_TID_STATS_TXQ_STATS))
6925 goto nla_put_failure;
6926
6927 nla_nest_end(msg, tidattr);
6928 }
6929
6930 nla_nest_end(msg, tidsattr);
6931 }
6932
6933 nla_nest_end(msg, sinfoattr);
6934
6935 if (sinfo->assoc_req_ies_len &&
6936 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6937 sinfo->assoc_req_ies))
6938 goto nla_put_failure;
6939
6940 if (sinfo->assoc_resp_ies_len &&
6941 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6942 sinfo->assoc_resp_ies))
6943 goto nla_put_failure;
6944
6945 if (sinfo->mlo_params_valid) {
6946 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6947 sinfo->assoc_link_id))
6948 goto nla_put_failure;
6949
6950 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6951 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6952 sinfo->mld_addr))
6953 goto nla_put_failure;
6954 }
6955
6956 cfg80211_sinfo_release_content(sinfo);
6957 genlmsg_end(msg, hdr);
6958 return 0;
6959
6960 nla_put_failure:
6961 cfg80211_sinfo_release_content(sinfo);
6962 genlmsg_cancel(msg, hdr);
6963 return -EMSGSIZE;
6964}
6965
6966static int nl80211_dump_station(struct sk_buff *skb,
6967 struct netlink_callback *cb)
6968{
6969 struct station_info sinfo;
6970 struct cfg80211_registered_device *rdev;
6971 struct wireless_dev *wdev;
6972 u8 mac_addr[ETH_ALEN];
6973 int sta_idx = cb->args[2];
6974 int err;
6975
6976 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6977 if (err)
6978 return err;
6979 /* nl80211_prepare_wdev_dump acquired it in the successful case */
6980 __acquire(&rdev->wiphy.mtx);
6981
6982 if (!wdev->netdev) {
6983 err = -EINVAL;
6984 goto out_err;
6985 }
6986
6987 if (!rdev->ops->dump_station) {
6988 err = -EOPNOTSUPP;
6989 goto out_err;
6990 }
6991
6992 while (1) {
6993 memset(&sinfo, 0, sizeof(sinfo));
6994 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6995 mac_addr, &sinfo);
6996 if (err == -ENOENT)
6997 break;
6998 if (err)
6999 goto out_err;
7000
7001 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
7002 NETLINK_CB(cb->skb).portid,
7003 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7004 rdev, wdev->netdev, mac_addr,
7005 &sinfo) < 0)
7006 goto out;
7007
7008 sta_idx++;
7009 }
7010
7011 out:
7012 cb->args[2] = sta_idx;
7013 err = skb->len;
7014 out_err:
7015 wiphy_unlock(&rdev->wiphy);
7016
7017 return err;
7018}
7019
7020static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
7021{
7022 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7023 struct net_device *dev = info->user_ptr[1];
7024 struct station_info sinfo;
7025 struct sk_buff *msg;
7026 u8 *mac_addr = NULL;
7027 int err;
7028
7029 memset(&sinfo, 0, sizeof(sinfo));
7030
7031 if (!info->attrs[NL80211_ATTR_MAC])
7032 return -EINVAL;
7033
7034 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7035
7036 if (!rdev->ops->get_station)
7037 return -EOPNOTSUPP;
7038
7039 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7040 if (err)
7041 return err;
7042
7043 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7044 if (!msg) {
7045 cfg80211_sinfo_release_content(&sinfo);
7046 return -ENOMEM;
7047 }
7048
7049 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7050 info->snd_portid, info->snd_seq, 0,
7051 rdev, dev, mac_addr, &sinfo) < 0) {
7052 nlmsg_free(msg);
7053 return -ENOBUFS;
7054 }
7055
7056 return genlmsg_reply(msg, info);
7057}
7058
7059int cfg80211_check_station_change(struct wiphy *wiphy,
7060 struct station_parameters *params,
7061 enum cfg80211_station_type statype)
7062{
7063 if (params->listen_interval != -1 &&
7064 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7065 return -EINVAL;
7066
7067 if (params->support_p2p_ps != -1 &&
7068 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7069 return -EINVAL;
7070
7071 if (params->aid &&
7072 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
7073 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7074 return -EINVAL;
7075
7076 /* When you run into this, adjust the code below for the new flag */
7077 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7078
7079 switch (statype) {
7080 case CFG80211_STA_MESH_PEER_KERNEL:
7081 case CFG80211_STA_MESH_PEER_USER:
7082 /*
7083 * No ignoring the TDLS flag here -- the userspace mesh
7084 * code doesn't have the bug of including TDLS in the
7085 * mask everywhere.
7086 */
7087 if (params->sta_flags_mask &
7088 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7089 BIT(NL80211_STA_FLAG_MFP) |
7090 BIT(NL80211_STA_FLAG_AUTHORIZED)))
7091 return -EINVAL;
7092 break;
7093 case CFG80211_STA_TDLS_PEER_SETUP:
7094 case CFG80211_STA_TDLS_PEER_ACTIVE:
7095 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7096 return -EINVAL;
7097 /* ignore since it can't change */
7098 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7099 break;
7100 default:
7101 /* disallow mesh-specific things */
7102 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
7103 return -EINVAL;
7104 if (params->local_pm)
7105 return -EINVAL;
7106 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7107 return -EINVAL;
7108 }
7109
7110 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7111 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
7112 /* TDLS can't be set, ... */
7113 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
7114 return -EINVAL;
7115 /*
7116 * ... but don't bother the driver with it. This works around
7117 * a hostapd/wpa_supplicant issue -- it always includes the
7118 * TLDS_PEER flag in the mask even for AP mode.
7119 */
7120 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7121 }
7122
7123 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7124 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7125 /* reject other things that can't change */
7126 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
7127 return -EINVAL;
7128 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
7129 return -EINVAL;
7130 if (params->link_sta_params.supported_rates)
7131 return -EINVAL;
7132 if (params->ext_capab || params->link_sta_params.ht_capa ||
7133 params->link_sta_params.vht_capa ||
7134 params->link_sta_params.he_capa ||
7135 params->link_sta_params.eht_capa)
7136 return -EINVAL;
7137 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7138 return -EINVAL;
7139 }
7140
7141 if (statype != CFG80211_STA_AP_CLIENT &&
7142 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7143 if (params->vlan)
7144 return -EINVAL;
7145 }
7146
7147 /* Accept EMLSR capabilities only for AP client before association */
7148 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7149 params->eml_cap_present)
7150 return -EINVAL;
7151
7152 switch (statype) {
7153 case CFG80211_STA_AP_MLME_CLIENT:
7154 /* Use this only for authorizing/unauthorizing a station */
7155 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
7156 return -EOPNOTSUPP;
7157 break;
7158 case CFG80211_STA_AP_CLIENT:
7159 case CFG80211_STA_AP_CLIENT_UNASSOC:
7160 /* accept only the listed bits */
7161 if (params->sta_flags_mask &
7162 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7163 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7164 BIT(NL80211_STA_FLAG_ASSOCIATED) |
7165 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7166 BIT(NL80211_STA_FLAG_WME) |
7167 BIT(NL80211_STA_FLAG_MFP) |
7168 BIT(NL80211_STA_FLAG_SPP_AMSDU)))
7169 return -EINVAL;
7170
7171 /* but authenticated/associated only if driver handles it */
7172 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7173 params->sta_flags_mask &
7174 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7175 BIT(NL80211_STA_FLAG_ASSOCIATED)))
7176 return -EINVAL;
7177 break;
7178 case CFG80211_STA_IBSS:
7179 case CFG80211_STA_AP_STA:
7180 /* reject any changes other than AUTHORIZED */
7181 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
7182 return -EINVAL;
7183 break;
7184 case CFG80211_STA_TDLS_PEER_SETUP:
7185 /* reject any changes other than AUTHORIZED or WME */
7186 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7187 BIT(NL80211_STA_FLAG_WME)))
7188 return -EINVAL;
7189 /* force (at least) rates when authorizing */
7190 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
7191 !params->link_sta_params.supported_rates)
7192 return -EINVAL;
7193 break;
7194 case CFG80211_STA_TDLS_PEER_ACTIVE:
7195 /* reject any changes */
7196 return -EINVAL;
7197 case CFG80211_STA_MESH_PEER_KERNEL:
7198 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7199 return -EINVAL;
7200 break;
7201 case CFG80211_STA_MESH_PEER_USER:
7202 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
7203 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
7204 return -EINVAL;
7205 break;
7206 }
7207
7208 /*
7209 * Older kernel versions ignored this attribute entirely, so don't
7210 * reject attempts to update it but mark it as unused instead so the
7211 * driver won't look at the data.
7212 */
7213 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7214 statype != CFG80211_STA_TDLS_PEER_SETUP)
7215 params->link_sta_params.opmode_notif_used = false;
7216
7217 return 0;
7218}
7219EXPORT_SYMBOL(cfg80211_check_station_change);
7220
7221/*
7222 * Get vlan interface making sure it is running and on the right wiphy.
7223 */
7224static struct net_device *get_vlan(struct genl_info *info,
7225 struct cfg80211_registered_device *rdev)
7226{
7227 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7228 struct net_device *v;
7229 int ret;
7230
7231 if (!vlanattr)
7232 return NULL;
7233
7234 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7235 if (!v)
7236 return ERR_PTR(-ENODEV);
7237
7238 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7239 ret = -EINVAL;
7240 goto error;
7241 }
7242
7243 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7244 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7245 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7246 ret = -EINVAL;
7247 goto error;
7248 }
7249
7250 if (!netif_running(v)) {
7251 ret = -ENETDOWN;
7252 goto error;
7253 }
7254
7255 return v;
7256 error:
7257 dev_put(v);
7258 return ERR_PTR(ret);
7259}
7260
7261static int nl80211_parse_sta_wme(struct genl_info *info,
7262 struct station_parameters *params)
7263{
7264 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7265 struct nlattr *nla;
7266 int err;
7267
7268 /* parse WME attributes if present */
7269 if (!info->attrs[NL80211_ATTR_STA_WME])
7270 return 0;
7271
7272 nla = info->attrs[NL80211_ATTR_STA_WME];
7273 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7274 nl80211_sta_wme_policy,
7275 info->extack);
7276 if (err)
7277 return err;
7278
7279 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7280 params->uapsd_queues = nla_get_u8(
7281 tb[NL80211_STA_WME_UAPSD_QUEUES]);
7282 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7283 return -EINVAL;
7284
7285 if (tb[NL80211_STA_WME_MAX_SP])
7286 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7287
7288 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7289 return -EINVAL;
7290
7291 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7292
7293 return 0;
7294}
7295
7296static int nl80211_parse_sta_channel_info(struct genl_info *info,
7297 struct station_parameters *params)
7298{
7299 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7300 params->supported_channels =
7301 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7302 params->supported_channels_len =
7303 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7304 /*
7305 * Need to include at least one (first channel, number of
7306 * channels) tuple for each subband (checked in policy),
7307 * and must have proper tuples for the rest of the data as well.
7308 */
7309 if (params->supported_channels_len % 2)
7310 return -EINVAL;
7311 }
7312
7313 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7314 params->supported_oper_classes =
7315 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7316 params->supported_oper_classes_len =
7317 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7318 }
7319 return 0;
7320}
7321
7322static int nl80211_set_station_tdls(struct genl_info *info,
7323 struct station_parameters *params)
7324{
7325 int err;
7326 /* Dummy STA entry gets updated once the peer capabilities are known */
7327 if (info->attrs[NL80211_ATTR_PEER_AID])
7328 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7329 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7330 params->link_sta_params.ht_capa =
7331 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7332 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7333 params->link_sta_params.vht_capa =
7334 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7335 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7336 params->link_sta_params.he_capa =
7337 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7338 params->link_sta_params.he_capa_len =
7339 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7340
7341 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7342 params->link_sta_params.eht_capa =
7343 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7344 params->link_sta_params.eht_capa_len =
7345 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7346
7347 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7348 (const u8 *)params->link_sta_params.eht_capa,
7349 params->link_sta_params.eht_capa_len,
7350 false))
7351 return -EINVAL;
7352 }
7353 }
7354
7355 err = nl80211_parse_sta_channel_info(info, params);
7356 if (err)
7357 return err;
7358
7359 return nl80211_parse_sta_wme(info, params);
7360}
7361
7362static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7363 struct sta_txpwr *txpwr,
7364 bool *txpwr_set)
7365{
7366 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7367 int idx;
7368
7369 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7370 if (!rdev->ops->set_tx_power ||
7371 !wiphy_ext_feature_isset(&rdev->wiphy,
7372 NL80211_EXT_FEATURE_STA_TX_PWR))
7373 return -EOPNOTSUPP;
7374
7375 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7376 txpwr->type = nla_get_u8(info->attrs[idx]);
7377
7378 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7379 idx = NL80211_ATTR_STA_TX_POWER;
7380
7381 if (info->attrs[idx])
7382 txpwr->power = nla_get_s16(info->attrs[idx]);
7383 else
7384 return -EINVAL;
7385 }
7386
7387 *txpwr_set = true;
7388 } else {
7389 *txpwr_set = false;
7390 }
7391
7392 return 0;
7393}
7394
7395static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7396{
7397 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7398 struct net_device *dev = info->user_ptr[1];
7399 struct station_parameters params;
7400 u8 *mac_addr;
7401 int err;
7402
7403 memset(&params, 0, sizeof(params));
7404
7405 if (!rdev->ops->change_station)
7406 return -EOPNOTSUPP;
7407
7408 /*
7409 * AID and listen_interval properties can be set only for unassociated
7410 * station. Include these parameters here and will check them in
7411 * cfg80211_check_station_change().
7412 */
7413 if (info->attrs[NL80211_ATTR_STA_AID])
7414 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7415
7416 if (info->attrs[NL80211_ATTR_VLAN_ID])
7417 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7418
7419 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7420 params.listen_interval =
7421 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7422 else
7423 params.listen_interval = -1;
7424
7425 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7426 params.support_p2p_ps =
7427 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7428 else
7429 params.support_p2p_ps = -1;
7430
7431 if (!info->attrs[NL80211_ATTR_MAC])
7432 return -EINVAL;
7433
7434 params.link_sta_params.link_id =
7435 nl80211_link_id_or_invalid(info->attrs);
7436
7437 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7438 /* If MLD_ADDR attribute is set then this is an MLD station
7439 * and the MLD_ADDR attribute holds the MLD address and the
7440 * MAC attribute holds for the LINK address.
7441 * In that case, the link_id is also expected to be valid.
7442 */
7443 if (params.link_sta_params.link_id < 0)
7444 return -EINVAL;
7445
7446 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7447 params.link_sta_params.mld_mac = mac_addr;
7448 params.link_sta_params.link_mac =
7449 nla_data(info->attrs[NL80211_ATTR_MAC]);
7450 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7451 return -EINVAL;
7452 } else {
7453 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7454 }
7455
7456
7457 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7458 params.link_sta_params.supported_rates =
7459 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7460 params.link_sta_params.supported_rates_len =
7461 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7462 }
7463
7464 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7465 params.capability =
7466 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7467 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7468 }
7469
7470 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7471 params.ext_capab =
7472 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7473 params.ext_capab_len =
7474 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7475 }
7476
7477 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7478 return -EINVAL;
7479
7480 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7481 params.plink_action =
7482 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7483
7484 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7485 params.plink_state =
7486 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7487 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7488 params.peer_aid = nla_get_u16(
7489 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7490 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7491 }
7492
7493 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7494 params.local_pm = nla_get_u32(
7495 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7496
7497 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7498 params.link_sta_params.opmode_notif_used = true;
7499 params.link_sta_params.opmode_notif =
7500 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7501 }
7502
7503 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7504 params.link_sta_params.he_6ghz_capa =
7505 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7506
7507 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
7508 params.eml_cap_present = true;
7509 params.eml_cap =
7510 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
7511 }
7512
7513 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7514 params.airtime_weight =
7515 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7516
7517 if (params.airtime_weight &&
7518 !wiphy_ext_feature_isset(&rdev->wiphy,
7519 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7520 return -EOPNOTSUPP;
7521
7522 err = nl80211_parse_sta_txpower_setting(info,
7523 &params.link_sta_params.txpwr,
7524 &params.link_sta_params.txpwr_set);
7525 if (err)
7526 return err;
7527
7528 /* Include parameters for TDLS peer (will check later) */
7529 err = nl80211_set_station_tdls(info, &params);
7530 if (err)
7531 return err;
7532
7533 params.vlan = get_vlan(info, rdev);
7534 if (IS_ERR(params.vlan))
7535 return PTR_ERR(params.vlan);
7536
7537 switch (dev->ieee80211_ptr->iftype) {
7538 case NL80211_IFTYPE_AP:
7539 case NL80211_IFTYPE_AP_VLAN:
7540 case NL80211_IFTYPE_P2P_GO:
7541 case NL80211_IFTYPE_P2P_CLIENT:
7542 case NL80211_IFTYPE_STATION:
7543 case NL80211_IFTYPE_ADHOC:
7544 case NL80211_IFTYPE_MESH_POINT:
7545 break;
7546 default:
7547 err = -EOPNOTSUPP;
7548 goto out_put_vlan;
7549 }
7550
7551 /* driver will call cfg80211_check_station_change() */
7552 err = rdev_change_station(rdev, dev, mac_addr, &params);
7553
7554 out_put_vlan:
7555 dev_put(params.vlan);
7556
7557 return err;
7558}
7559
7560static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7561{
7562 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7563 int err;
7564 struct net_device *dev = info->user_ptr[1];
7565 struct wireless_dev *wdev = dev->ieee80211_ptr;
7566 struct station_parameters params;
7567 u8 *mac_addr = NULL;
7568 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7569 BIT(NL80211_STA_FLAG_ASSOCIATED);
7570
7571 memset(&params, 0, sizeof(params));
7572
7573 if (!rdev->ops->add_station)
7574 return -EOPNOTSUPP;
7575
7576 if (!info->attrs[NL80211_ATTR_MAC])
7577 return -EINVAL;
7578
7579 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7580 return -EINVAL;
7581
7582 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7583 return -EINVAL;
7584
7585 if (!info->attrs[NL80211_ATTR_STA_AID] &&
7586 !info->attrs[NL80211_ATTR_PEER_AID])
7587 return -EINVAL;
7588
7589 params.link_sta_params.link_id =
7590 nl80211_link_id_or_invalid(info->attrs);
7591
7592 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7593 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7594 params.link_sta_params.mld_mac = mac_addr;
7595 params.link_sta_params.link_mac =
7596 nla_data(info->attrs[NL80211_ATTR_MAC]);
7597 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7598 return -EINVAL;
7599 } else {
7600 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7601 }
7602
7603 params.link_sta_params.supported_rates =
7604 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7605 params.link_sta_params.supported_rates_len =
7606 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7607 params.listen_interval =
7608 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7609
7610 if (info->attrs[NL80211_ATTR_VLAN_ID])
7611 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7612
7613 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7614 params.support_p2p_ps =
7615 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7616 } else {
7617 /*
7618 * if not specified, assume it's supported for P2P GO interface,
7619 * and is NOT supported for AP interface
7620 */
7621 params.support_p2p_ps =
7622 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7623 }
7624
7625 if (info->attrs[NL80211_ATTR_PEER_AID])
7626 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7627 else
7628 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7629
7630 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7631 params.capability =
7632 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7633 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7634 }
7635
7636 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7637 params.ext_capab =
7638 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7639 params.ext_capab_len =
7640 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7641 }
7642
7643 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7644 params.link_sta_params.ht_capa =
7645 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7646
7647 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7648 params.link_sta_params.vht_capa =
7649 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7650
7651 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7652 params.link_sta_params.he_capa =
7653 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7654 params.link_sta_params.he_capa_len =
7655 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7656
7657 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7658 params.link_sta_params.eht_capa =
7659 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7660 params.link_sta_params.eht_capa_len =
7661 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7662
7663 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7664 (const u8 *)params.link_sta_params.eht_capa,
7665 params.link_sta_params.eht_capa_len,
7666 false))
7667 return -EINVAL;
7668 }
7669 }
7670
7671 if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
7672 params.eml_cap_present = true;
7673 params.eml_cap =
7674 nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
7675 }
7676
7677 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7678 params.link_sta_params.he_6ghz_capa =
7679 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7680
7681 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7682 params.link_sta_params.opmode_notif_used = true;
7683 params.link_sta_params.opmode_notif =
7684 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7685 }
7686
7687 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7688 params.plink_action =
7689 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7690
7691 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7692 params.airtime_weight =
7693 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7694
7695 if (params.airtime_weight &&
7696 !wiphy_ext_feature_isset(&rdev->wiphy,
7697 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7698 return -EOPNOTSUPP;
7699
7700 err = nl80211_parse_sta_txpower_setting(info,
7701 &params.link_sta_params.txpwr,
7702 &params.link_sta_params.txpwr_set);
7703 if (err)
7704 return err;
7705
7706 err = nl80211_parse_sta_channel_info(info, &params);
7707 if (err)
7708 return err;
7709
7710 err = nl80211_parse_sta_wme(info, &params);
7711 if (err)
7712 return err;
7713
7714 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7715 return -EINVAL;
7716
7717 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7718 * as userspace might just pass through the capabilities from the IEs
7719 * directly, rather than enforcing this restriction and returning an
7720 * error in this case.
7721 */
7722 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7723 params.link_sta_params.ht_capa = NULL;
7724 params.link_sta_params.vht_capa = NULL;
7725
7726 /* HE and EHT require WME */
7727 if (params.link_sta_params.he_capa_len ||
7728 params.link_sta_params.he_6ghz_capa ||
7729 params.link_sta_params.eht_capa_len)
7730 return -EINVAL;
7731 }
7732
7733 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7734 if (params.link_sta_params.he_6ghz_capa &&
7735 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7736 return -EINVAL;
7737
7738 /* When you run into this, adjust the code below for the new flag */
7739 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7740
7741 switch (dev->ieee80211_ptr->iftype) {
7742 case NL80211_IFTYPE_AP:
7743 case NL80211_IFTYPE_AP_VLAN:
7744 case NL80211_IFTYPE_P2P_GO:
7745 /* ignore WME attributes if iface/sta is not capable */
7746 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7747 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7748 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7749
7750 /* TDLS peers cannot be added */
7751 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7752 info->attrs[NL80211_ATTR_PEER_AID])
7753 return -EINVAL;
7754 /* but don't bother the driver with it */
7755 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7756
7757 /* allow authenticated/associated only if driver handles it */
7758 if (!(rdev->wiphy.features &
7759 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7760 params.sta_flags_mask & auth_assoc)
7761 return -EINVAL;
7762
7763 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7764 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
7765 params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7766 return -EINVAL;
7767
7768 /* Older userspace, or userspace wanting to be compatible with
7769 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7770 * and assoc flags in the mask, but assumes the station will be
7771 * added as associated anyway since this was the required driver
7772 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7773 * introduced.
7774 * In order to not bother drivers with this quirk in the API
7775 * set the flags in both the mask and set for new stations in
7776 * this case.
7777 */
7778 if (!(params.sta_flags_mask & auth_assoc)) {
7779 params.sta_flags_mask |= auth_assoc;
7780 params.sta_flags_set |= auth_assoc;
7781 }
7782
7783 /* must be last in here for error handling */
7784 params.vlan = get_vlan(info, rdev);
7785 if (IS_ERR(params.vlan))
7786 return PTR_ERR(params.vlan);
7787 break;
7788 case NL80211_IFTYPE_MESH_POINT:
7789 /* ignore uAPSD data */
7790 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7791
7792 /* associated is disallowed */
7793 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7794 return -EINVAL;
7795 /* TDLS peers cannot be added */
7796 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7797 info->attrs[NL80211_ATTR_PEER_AID])
7798 return -EINVAL;
7799 break;
7800 case NL80211_IFTYPE_STATION:
7801 case NL80211_IFTYPE_P2P_CLIENT:
7802 /* ignore uAPSD data */
7803 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7804
7805 /* these are disallowed */
7806 if (params.sta_flags_mask &
7807 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7808 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7809 return -EINVAL;
7810 /* Only TDLS peers can be added */
7811 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7812 return -EINVAL;
7813 /* Can only add if TDLS ... */
7814 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7815 return -EOPNOTSUPP;
7816 /* ... with external setup is supported */
7817 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7818 return -EOPNOTSUPP;
7819 /*
7820 * Older wpa_supplicant versions always mark the TDLS peer
7821 * as authorized, but it shouldn't yet be.
7822 */
7823 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7824 break;
7825 default:
7826 return -EOPNOTSUPP;
7827 }
7828
7829 /* be aware of params.vlan when changing code here */
7830
7831 if (wdev->valid_links) {
7832 if (params.link_sta_params.link_id < 0) {
7833 err = -EINVAL;
7834 goto out;
7835 }
7836 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7837 err = -ENOLINK;
7838 goto out;
7839 }
7840 } else {
7841 if (params.link_sta_params.link_id >= 0) {
7842 err = -EINVAL;
7843 goto out;
7844 }
7845 }
7846 err = rdev_add_station(rdev, dev, mac_addr, &params);
7847out:
7848 dev_put(params.vlan);
7849 return err;
7850}
7851
7852static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7853{
7854 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7855 struct net_device *dev = info->user_ptr[1];
7856 struct wireless_dev *wdev = dev->ieee80211_ptr;
7857 struct station_del_parameters params;
7858 int link_id = nl80211_link_id_or_invalid(info->attrs);
7859
7860 memset(&params, 0, sizeof(params));
7861
7862 if (info->attrs[NL80211_ATTR_MAC])
7863 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7864
7865 switch (wdev->iftype) {
7866 case NL80211_IFTYPE_AP:
7867 case NL80211_IFTYPE_AP_VLAN:
7868 case NL80211_IFTYPE_MESH_POINT:
7869 case NL80211_IFTYPE_P2P_GO:
7870 /* always accept these */
7871 break;
7872 case NL80211_IFTYPE_ADHOC:
7873 /* conditionally accept */
7874 if (wiphy_ext_feature_isset(&rdev->wiphy,
7875 NL80211_EXT_FEATURE_DEL_IBSS_STA))
7876 break;
7877 return -EINVAL;
7878 default:
7879 return -EINVAL;
7880 }
7881
7882 if (!rdev->ops->del_station)
7883 return -EOPNOTSUPP;
7884
7885 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7886 params.subtype =
7887 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7888 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7889 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7890 return -EINVAL;
7891 } else {
7892 /* Default to Deauthentication frame */
7893 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7894 }
7895
7896 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7897 params.reason_code =
7898 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7899 if (params.reason_code == 0)
7900 return -EINVAL; /* 0 is reserved */
7901 } else {
7902 /* Default to reason code 2 */
7903 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7904 }
7905
7906 /* Link ID not expected in case of non-ML operation */
7907 if (!wdev->valid_links && link_id != -1)
7908 return -EINVAL;
7909
7910 /* If given, a valid link ID should be passed during MLO */
7911 if (wdev->valid_links && link_id >= 0 &&
7912 !(wdev->valid_links & BIT(link_id)))
7913 return -EINVAL;
7914
7915 params.link_id = link_id;
7916
7917 return rdev_del_station(rdev, dev, &params);
7918}
7919
7920static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7921 int flags, struct net_device *dev,
7922 u8 *dst, u8 *next_hop,
7923 struct mpath_info *pinfo)
7924{
7925 void *hdr;
7926 struct nlattr *pinfoattr;
7927
7928 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7929 if (!hdr)
7930 return -1;
7931
7932 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7933 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7934 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7935 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7936 goto nla_put_failure;
7937
7938 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7939 if (!pinfoattr)
7940 goto nla_put_failure;
7941 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7942 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7943 pinfo->frame_qlen))
7944 goto nla_put_failure;
7945 if (((pinfo->filled & MPATH_INFO_SN) &&
7946 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7947 ((pinfo->filled & MPATH_INFO_METRIC) &&
7948 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7949 pinfo->metric)) ||
7950 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7951 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7952 pinfo->exptime)) ||
7953 ((pinfo->filled & MPATH_INFO_FLAGS) &&
7954 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7955 pinfo->flags)) ||
7956 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7957 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7958 pinfo->discovery_timeout)) ||
7959 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7960 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7961 pinfo->discovery_retries)) ||
7962 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7963 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7964 pinfo->hop_count)) ||
7965 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7966 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7967 pinfo->path_change_count)))
7968 goto nla_put_failure;
7969
7970 nla_nest_end(msg, pinfoattr);
7971
7972 genlmsg_end(msg, hdr);
7973 return 0;
7974
7975 nla_put_failure:
7976 genlmsg_cancel(msg, hdr);
7977 return -EMSGSIZE;
7978}
7979
7980static int nl80211_dump_mpath(struct sk_buff *skb,
7981 struct netlink_callback *cb)
7982{
7983 struct mpath_info pinfo;
7984 struct cfg80211_registered_device *rdev;
7985 struct wireless_dev *wdev;
7986 u8 dst[ETH_ALEN];
7987 u8 next_hop[ETH_ALEN];
7988 int path_idx = cb->args[2];
7989 int err;
7990
7991 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7992 if (err)
7993 return err;
7994 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7995 __acquire(&rdev->wiphy.mtx);
7996
7997 if (!rdev->ops->dump_mpath) {
7998 err = -EOPNOTSUPP;
7999 goto out_err;
8000 }
8001
8002 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8003 err = -EOPNOTSUPP;
8004 goto out_err;
8005 }
8006
8007 while (1) {
8008 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
8009 next_hop, &pinfo);
8010 if (err == -ENOENT)
8011 break;
8012 if (err)
8013 goto out_err;
8014
8015 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8016 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8017 wdev->netdev, dst, next_hop,
8018 &pinfo) < 0)
8019 goto out;
8020
8021 path_idx++;
8022 }
8023
8024 out:
8025 cb->args[2] = path_idx;
8026 err = skb->len;
8027 out_err:
8028 wiphy_unlock(&rdev->wiphy);
8029 return err;
8030}
8031
8032static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
8033{
8034 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8035 int err;
8036 struct net_device *dev = info->user_ptr[1];
8037 struct mpath_info pinfo;
8038 struct sk_buff *msg;
8039 u8 *dst = NULL;
8040 u8 next_hop[ETH_ALEN];
8041
8042 memset(&pinfo, 0, sizeof(pinfo));
8043
8044 if (!info->attrs[NL80211_ATTR_MAC])
8045 return -EINVAL;
8046
8047 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8048
8049 if (!rdev->ops->get_mpath)
8050 return -EOPNOTSUPP;
8051
8052 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8053 return -EOPNOTSUPP;
8054
8055 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8056 if (err)
8057 return err;
8058
8059 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8060 if (!msg)
8061 return -ENOMEM;
8062
8063 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8064 dev, dst, next_hop, &pinfo) < 0) {
8065 nlmsg_free(msg);
8066 return -ENOBUFS;
8067 }
8068
8069 return genlmsg_reply(msg, info);
8070}
8071
8072static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
8073{
8074 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8075 struct net_device *dev = info->user_ptr[1];
8076 u8 *dst = NULL;
8077 u8 *next_hop = NULL;
8078
8079 if (!info->attrs[NL80211_ATTR_MAC])
8080 return -EINVAL;
8081
8082 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8083 return -EINVAL;
8084
8085 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8086 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8087
8088 if (!rdev->ops->change_mpath)
8089 return -EOPNOTSUPP;
8090
8091 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8092 return -EOPNOTSUPP;
8093
8094 return rdev_change_mpath(rdev, dev, dst, next_hop);
8095}
8096
8097static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
8098{
8099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8100 struct net_device *dev = info->user_ptr[1];
8101 u8 *dst = NULL;
8102 u8 *next_hop = NULL;
8103
8104 if (!info->attrs[NL80211_ATTR_MAC])
8105 return -EINVAL;
8106
8107 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8108 return -EINVAL;
8109
8110 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8111 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8112
8113 if (!rdev->ops->add_mpath)
8114 return -EOPNOTSUPP;
8115
8116 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8117 return -EOPNOTSUPP;
8118
8119 return rdev_add_mpath(rdev, dev, dst, next_hop);
8120}
8121
8122static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
8123{
8124 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8125 struct net_device *dev = info->user_ptr[1];
8126 u8 *dst = NULL;
8127
8128 if (info->attrs[NL80211_ATTR_MAC])
8129 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8130
8131 if (!rdev->ops->del_mpath)
8132 return -EOPNOTSUPP;
8133
8134 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8135 return -EOPNOTSUPP;
8136
8137 return rdev_del_mpath(rdev, dev, dst);
8138}
8139
8140static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
8141{
8142 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8143 int err;
8144 struct net_device *dev = info->user_ptr[1];
8145 struct mpath_info pinfo;
8146 struct sk_buff *msg;
8147 u8 *dst = NULL;
8148 u8 mpp[ETH_ALEN];
8149
8150 memset(&pinfo, 0, sizeof(pinfo));
8151
8152 if (!info->attrs[NL80211_ATTR_MAC])
8153 return -EINVAL;
8154
8155 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8156
8157 if (!rdev->ops->get_mpp)
8158 return -EOPNOTSUPP;
8159
8160 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8161 return -EOPNOTSUPP;
8162
8163 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
8164 if (err)
8165 return err;
8166
8167 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8168 if (!msg)
8169 return -ENOMEM;
8170
8171 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8172 dev, dst, mpp, &pinfo) < 0) {
8173 nlmsg_free(msg);
8174 return -ENOBUFS;
8175 }
8176
8177 return genlmsg_reply(msg, info);
8178}
8179
8180static int nl80211_dump_mpp(struct sk_buff *skb,
8181 struct netlink_callback *cb)
8182{
8183 struct mpath_info pinfo;
8184 struct cfg80211_registered_device *rdev;
8185 struct wireless_dev *wdev;
8186 u8 dst[ETH_ALEN];
8187 u8 mpp[ETH_ALEN];
8188 int path_idx = cb->args[2];
8189 int err;
8190
8191 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8192 if (err)
8193 return err;
8194 /* nl80211_prepare_wdev_dump acquired it in the successful case */
8195 __acquire(&rdev->wiphy.mtx);
8196
8197 if (!rdev->ops->dump_mpp) {
8198 err = -EOPNOTSUPP;
8199 goto out_err;
8200 }
8201
8202 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8203 err = -EOPNOTSUPP;
8204 goto out_err;
8205 }
8206
8207 while (1) {
8208 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
8209 mpp, &pinfo);
8210 if (err == -ENOENT)
8211 break;
8212 if (err)
8213 goto out_err;
8214
8215 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8216 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8217 wdev->netdev, dst, mpp,
8218 &pinfo) < 0)
8219 goto out;
8220
8221 path_idx++;
8222 }
8223
8224 out:
8225 cb->args[2] = path_idx;
8226 err = skb->len;
8227 out_err:
8228 wiphy_unlock(&rdev->wiphy);
8229 return err;
8230}
8231
8232static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
8233{
8234 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8235 struct net_device *dev = info->user_ptr[1];
8236 struct bss_parameters params;
8237
8238 memset(&params, 0, sizeof(params));
8239 params.link_id = nl80211_link_id_or_invalid(info->attrs);
8240 /* default to not changing parameters */
8241 params.use_cts_prot = -1;
8242 params.use_short_preamble = -1;
8243 params.use_short_slot_time = -1;
8244 params.ap_isolate = -1;
8245 params.ht_opmode = -1;
8246 params.p2p_ctwindow = -1;
8247 params.p2p_opp_ps = -1;
8248
8249 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
8250 params.use_cts_prot =
8251 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8252 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8253 params.use_short_preamble =
8254 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8255 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8256 params.use_short_slot_time =
8257 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8258 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8259 params.basic_rates =
8260 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8261 params.basic_rates_len =
8262 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8263 }
8264 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8265 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8266 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8267 params.ht_opmode =
8268 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8269
8270 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8271 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8272 return -EINVAL;
8273 params.p2p_ctwindow =
8274 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8275 if (params.p2p_ctwindow != 0 &&
8276 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8277 return -EINVAL;
8278 }
8279
8280 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8281 u8 tmp;
8282
8283 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8284 return -EINVAL;
8285 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8286 params.p2p_opp_ps = tmp;
8287 if (params.p2p_opp_ps &&
8288 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8289 return -EINVAL;
8290 }
8291
8292 if (!rdev->ops->change_bss)
8293 return -EOPNOTSUPP;
8294
8295 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8296 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8297 return -EOPNOTSUPP;
8298
8299 return rdev_change_bss(rdev, dev, &params);
8300}
8301
8302static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8303{
8304 char *data = NULL;
8305 bool is_indoor;
8306 enum nl80211_user_reg_hint_type user_reg_hint_type;
8307 u32 owner_nlportid;
8308
8309 /*
8310 * You should only get this when cfg80211 hasn't yet initialized
8311 * completely when built-in to the kernel right between the time
8312 * window between nl80211_init() and regulatory_init(), if that is
8313 * even possible.
8314 */
8315 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8316 return -EINPROGRESS;
8317
8318 user_reg_hint_type =
8319 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
8320 NL80211_USER_REG_HINT_USER);
8321
8322 switch (user_reg_hint_type) {
8323 case NL80211_USER_REG_HINT_USER:
8324 case NL80211_USER_REG_HINT_CELL_BASE:
8325 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8326 return -EINVAL;
8327
8328 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8329 return regulatory_hint_user(data, user_reg_hint_type);
8330 case NL80211_USER_REG_HINT_INDOOR:
8331 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8332 owner_nlportid = info->snd_portid;
8333 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8334 } else {
8335 owner_nlportid = 0;
8336 is_indoor = true;
8337 }
8338
8339 regulatory_hint_indoor(is_indoor, owner_nlportid);
8340 return 0;
8341 default:
8342 return -EINVAL;
8343 }
8344}
8345
8346static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8347{
8348 return reg_reload_regdb();
8349}
8350
8351static int nl80211_get_mesh_config(struct sk_buff *skb,
8352 struct genl_info *info)
8353{
8354 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8355 struct net_device *dev = info->user_ptr[1];
8356 struct wireless_dev *wdev = dev->ieee80211_ptr;
8357 struct mesh_config cur_params;
8358 int err = 0;
8359 void *hdr;
8360 struct nlattr *pinfoattr;
8361 struct sk_buff *msg;
8362
8363 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8364 return -EOPNOTSUPP;
8365
8366 if (!rdev->ops->get_mesh_config)
8367 return -EOPNOTSUPP;
8368
8369 /* If not connected, get default parameters */
8370 if (!wdev->u.mesh.id_len)
8371 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8372 else
8373 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8374
8375 if (err)
8376 return err;
8377
8378 /* Draw up a netlink message to send back */
8379 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8380 if (!msg)
8381 return -ENOMEM;
8382 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8383 NL80211_CMD_GET_MESH_CONFIG);
8384 if (!hdr)
8385 goto out;
8386 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8387 if (!pinfoattr)
8388 goto nla_put_failure;
8389 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8390 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8391 cur_params.dot11MeshRetryTimeout) ||
8392 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8393 cur_params.dot11MeshConfirmTimeout) ||
8394 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8395 cur_params.dot11MeshHoldingTimeout) ||
8396 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8397 cur_params.dot11MeshMaxPeerLinks) ||
8398 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8399 cur_params.dot11MeshMaxRetries) ||
8400 nla_put_u8(msg, NL80211_MESHCONF_TTL,
8401 cur_params.dot11MeshTTL) ||
8402 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8403 cur_params.element_ttl) ||
8404 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8405 cur_params.auto_open_plinks) ||
8406 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8407 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8408 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8409 cur_params.dot11MeshHWMPmaxPREQretries) ||
8410 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8411 cur_params.path_refresh_time) ||
8412 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8413 cur_params.min_discovery_timeout) ||
8414 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8415 cur_params.dot11MeshHWMPactivePathTimeout) ||
8416 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8417 cur_params.dot11MeshHWMPpreqMinInterval) ||
8418 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8419 cur_params.dot11MeshHWMPperrMinInterval) ||
8420 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8421 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8422 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8423 cur_params.dot11MeshHWMPRootMode) ||
8424 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8425 cur_params.dot11MeshHWMPRannInterval) ||
8426 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8427 cur_params.dot11MeshGateAnnouncementProtocol) ||
8428 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8429 cur_params.dot11MeshForwarding) ||
8430 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8431 cur_params.rssi_threshold) ||
8432 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8433 cur_params.ht_opmode) ||
8434 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8435 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8436 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8437 cur_params.dot11MeshHWMProotInterval) ||
8438 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8439 cur_params.dot11MeshHWMPconfirmationInterval) ||
8440 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8441 cur_params.power_mode) ||
8442 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8443 cur_params.dot11MeshAwakeWindowDuration) ||
8444 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8445 cur_params.plink_timeout) ||
8446 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8447 cur_params.dot11MeshConnectedToMeshGate) ||
8448 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8449 cur_params.dot11MeshNolearn) ||
8450 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8451 cur_params.dot11MeshConnectedToAuthServer))
8452 goto nla_put_failure;
8453 nla_nest_end(msg, pinfoattr);
8454 genlmsg_end(msg, hdr);
8455 return genlmsg_reply(msg, info);
8456
8457 nla_put_failure:
8458 out:
8459 nlmsg_free(msg);
8460 return -ENOBUFS;
8461}
8462
8463static const struct nla_policy
8464nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8465 [NL80211_MESHCONF_RETRY_TIMEOUT] =
8466 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8467 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8468 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8469 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8470 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8471 [NL80211_MESHCONF_MAX_PEER_LINKS] =
8472 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8473 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8474 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8475 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8476 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8477 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8478 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8479 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8480 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8481 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8482 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8483 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8484 NLA_POLICY_MIN(NLA_U16, 1),
8485 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8486 NLA_POLICY_MIN(NLA_U16, 1),
8487 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8488 NLA_POLICY_MIN(NLA_U16, 1),
8489 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8490 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8491 NLA_POLICY_MIN(NLA_U16, 1),
8492 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8493 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8494 [NL80211_MESHCONF_RSSI_THRESHOLD] =
8495 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8496 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8497 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8498 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8499 NLA_POLICY_MIN(NLA_U16, 1),
8500 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8501 NLA_POLICY_MIN(NLA_U16, 1),
8502 [NL80211_MESHCONF_POWER_MODE] =
8503 NLA_POLICY_RANGE(NLA_U32,
8504 NL80211_MESH_POWER_ACTIVE,
8505 NL80211_MESH_POWER_MAX),
8506 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8507 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8508 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8509 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8510 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8511};
8512
8513static const struct nla_policy
8514 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8515 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8516 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8517 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8518 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8519 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8520 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8521 [NL80211_MESH_SETUP_IE] =
8522 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8523 IEEE80211_MAX_DATA_LEN),
8524 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8525};
8526
8527static int nl80211_parse_mesh_config(struct genl_info *info,
8528 struct mesh_config *cfg,
8529 u32 *mask_out)
8530{
8531 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8532 u32 mask = 0;
8533 u16 ht_opmode;
8534
8535#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
8536do { \
8537 if (tb[attr]) { \
8538 cfg->param = fn(tb[attr]); \
8539 mask |= BIT((attr) - 1); \
8540 } \
8541} while (0)
8542
8543 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8544 return -EINVAL;
8545 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8546 return -EINVAL;
8547
8548 /* This makes sure that there aren't more than 32 mesh config
8549 * parameters (otherwise our bitfield scheme would not work.) */
8550 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8551
8552 /* Fill in the params struct */
8553 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8554 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8555 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8556 NL80211_MESHCONF_CONFIRM_TIMEOUT,
8557 nla_get_u16);
8558 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8559 NL80211_MESHCONF_HOLDING_TIMEOUT,
8560 nla_get_u16);
8561 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8562 NL80211_MESHCONF_MAX_PEER_LINKS,
8563 nla_get_u16);
8564 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8565 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8566 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8567 NL80211_MESHCONF_TTL, nla_get_u8);
8568 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8569 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8570 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8571 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8572 nla_get_u8);
8573 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8574 mask,
8575 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8576 nla_get_u32);
8577 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8578 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8579 nla_get_u8);
8580 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8581 NL80211_MESHCONF_PATH_REFRESH_TIME,
8582 nla_get_u32);
8583 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8584 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8585 return -EINVAL;
8586 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8587 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8588 nla_get_u16);
8589 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8590 mask,
8591 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8592 nla_get_u32);
8593 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8594 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8595 cfg->dot11MeshHWMPactivePathTimeout > 65535))
8596 return -EINVAL;
8597 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8598 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8599 nla_get_u16);
8600 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8601 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8602 nla_get_u16);
8603 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8604 dot11MeshHWMPnetDiameterTraversalTime, mask,
8605 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8606 nla_get_u16);
8607 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8608 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8609 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8610 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8611 nla_get_u16);
8612 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8613 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8614 nla_get_u8);
8615 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8616 NL80211_MESHCONF_FORWARDING, nla_get_u8);
8617 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8618 NL80211_MESHCONF_RSSI_THRESHOLD,
8619 nla_get_s32);
8620 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8621 NL80211_MESHCONF_CONNECTED_TO_GATE,
8622 nla_get_u8);
8623 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8624 NL80211_MESHCONF_CONNECTED_TO_AS,
8625 nla_get_u8);
8626 /*
8627 * Check HT operation mode based on
8628 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8629 */
8630 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8631 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8632
8633 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8634 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8635 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8636 return -EINVAL;
8637
8638 /* NON_HT_STA bit is reserved, but some programs set it */
8639 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8640
8641 cfg->ht_opmode = ht_opmode;
8642 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8643 }
8644 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8645 dot11MeshHWMPactivePathToRootTimeout, mask,
8646 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8647 nla_get_u32);
8648 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8649 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8650 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8651 return -EINVAL;
8652 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8653 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8654 nla_get_u16);
8655 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8656 mask,
8657 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8658 nla_get_u16);
8659 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8660 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8661 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8662 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8663 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8664 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8665 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8666 NL80211_MESHCONF_NOLEARN, nla_get_u8);
8667 if (mask_out)
8668 *mask_out = mask;
8669
8670 return 0;
8671
8672#undef FILL_IN_MESH_PARAM_IF_SET
8673}
8674
8675static int nl80211_parse_mesh_setup(struct genl_info *info,
8676 struct mesh_setup *setup)
8677{
8678 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8679 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8680
8681 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8682 return -EINVAL;
8683 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8684 return -EINVAL;
8685
8686 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8687 setup->sync_method =
8688 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8689 IEEE80211_SYNC_METHOD_VENDOR :
8690 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8691
8692 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8693 setup->path_sel_proto =
8694 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8695 IEEE80211_PATH_PROTOCOL_VENDOR :
8696 IEEE80211_PATH_PROTOCOL_HWMP;
8697
8698 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8699 setup->path_metric =
8700 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8701 IEEE80211_PATH_METRIC_VENDOR :
8702 IEEE80211_PATH_METRIC_AIRTIME;
8703
8704 if (tb[NL80211_MESH_SETUP_IE]) {
8705 struct nlattr *ieattr =
8706 tb[NL80211_MESH_SETUP_IE];
8707 setup->ie = nla_data(ieattr);
8708 setup->ie_len = nla_len(ieattr);
8709 }
8710 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8711 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8712 return -EINVAL;
8713 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8714 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8715 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8716 if (setup->is_secure)
8717 setup->user_mpm = true;
8718
8719 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8720 if (!setup->user_mpm)
8721 return -EINVAL;
8722 setup->auth_id =
8723 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8724 }
8725
8726 return 0;
8727}
8728
8729static int nl80211_update_mesh_config(struct sk_buff *skb,
8730 struct genl_info *info)
8731{
8732 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8733 struct net_device *dev = info->user_ptr[1];
8734 struct wireless_dev *wdev = dev->ieee80211_ptr;
8735 struct mesh_config cfg = {};
8736 u32 mask;
8737 int err;
8738
8739 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8740 return -EOPNOTSUPP;
8741
8742 if (!rdev->ops->update_mesh_config)
8743 return -EOPNOTSUPP;
8744
8745 err = nl80211_parse_mesh_config(info, &cfg, &mask);
8746 if (err)
8747 return err;
8748
8749 if (!wdev->u.mesh.id_len)
8750 err = -ENOLINK;
8751
8752 if (!err)
8753 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8754
8755 return err;
8756}
8757
8758static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8759 struct sk_buff *msg)
8760{
8761 struct nlattr *nl_reg_rules;
8762 unsigned int i;
8763
8764 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8765 (regdom->dfs_region &&
8766 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8767 goto nla_put_failure;
8768
8769 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8770 if (!nl_reg_rules)
8771 goto nla_put_failure;
8772
8773 for (i = 0; i < regdom->n_reg_rules; i++) {
8774 struct nlattr *nl_reg_rule;
8775 const struct ieee80211_reg_rule *reg_rule;
8776 const struct ieee80211_freq_range *freq_range;
8777 const struct ieee80211_power_rule *power_rule;
8778 unsigned int max_bandwidth_khz;
8779
8780 reg_rule = &regdom->reg_rules[i];
8781 freq_range = &reg_rule->freq_range;
8782 power_rule = &reg_rule->power_rule;
8783
8784 nl_reg_rule = nla_nest_start_noflag(msg, i);
8785 if (!nl_reg_rule)
8786 goto nla_put_failure;
8787
8788 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8789 if (!max_bandwidth_khz)
8790 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8791 reg_rule);
8792
8793 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8794 reg_rule->flags) ||
8795 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8796 freq_range->start_freq_khz) ||
8797 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8798 freq_range->end_freq_khz) ||
8799 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8800 max_bandwidth_khz) ||
8801 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8802 power_rule->max_antenna_gain) ||
8803 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8804 power_rule->max_eirp) ||
8805 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8806 reg_rule->dfs_cac_ms))
8807 goto nla_put_failure;
8808
8809 if ((reg_rule->flags & NL80211_RRF_PSD) &&
8810 nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
8811 reg_rule->psd))
8812 goto nla_put_failure;
8813
8814 nla_nest_end(msg, nl_reg_rule);
8815 }
8816
8817 nla_nest_end(msg, nl_reg_rules);
8818 return 0;
8819
8820nla_put_failure:
8821 return -EMSGSIZE;
8822}
8823
8824static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8825{
8826 const struct ieee80211_regdomain *regdom = NULL;
8827 struct cfg80211_registered_device *rdev;
8828 struct wiphy *wiphy = NULL;
8829 struct sk_buff *msg;
8830 int err = -EMSGSIZE;
8831 void *hdr;
8832
8833 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8834 if (!msg)
8835 return -ENOBUFS;
8836
8837 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8838 NL80211_CMD_GET_REG);
8839 if (!hdr)
8840 goto put_failure;
8841
8842 rtnl_lock();
8843
8844 if (info->attrs[NL80211_ATTR_WIPHY]) {
8845 bool self_managed;
8846
8847 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8848 if (IS_ERR(rdev)) {
8849 err = PTR_ERR(rdev);
8850 goto nla_put_failure;
8851 }
8852
8853 wiphy = &rdev->wiphy;
8854 self_managed = wiphy->regulatory_flags &
8855 REGULATORY_WIPHY_SELF_MANAGED;
8856
8857 rcu_read_lock();
8858
8859 regdom = get_wiphy_regdom(wiphy);
8860
8861 /* a self-managed-reg device must have a private regdom */
8862 if (WARN_ON(!regdom && self_managed)) {
8863 err = -EINVAL;
8864 goto nla_put_failure_rcu;
8865 }
8866
8867 if (regdom &&
8868 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8869 goto nla_put_failure_rcu;
8870 } else {
8871 rcu_read_lock();
8872 }
8873
8874 if (!wiphy && reg_last_request_cell_base() &&
8875 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8876 NL80211_USER_REG_HINT_CELL_BASE))
8877 goto nla_put_failure_rcu;
8878
8879 if (!regdom)
8880 regdom = rcu_dereference(cfg80211_regdomain);
8881
8882 if (nl80211_put_regdom(regdom, msg))
8883 goto nla_put_failure_rcu;
8884
8885 rcu_read_unlock();
8886
8887 genlmsg_end(msg, hdr);
8888 rtnl_unlock();
8889 return genlmsg_reply(msg, info);
8890
8891nla_put_failure_rcu:
8892 rcu_read_unlock();
8893nla_put_failure:
8894 rtnl_unlock();
8895put_failure:
8896 nlmsg_free(msg);
8897 return err;
8898}
8899
8900static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8901 u32 seq, int flags, struct wiphy *wiphy,
8902 const struct ieee80211_regdomain *regdom)
8903{
8904 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8905 NL80211_CMD_GET_REG);
8906
8907 if (!hdr)
8908 return -1;
8909
8910 genl_dump_check_consistent(cb, hdr);
8911
8912 if (nl80211_put_regdom(regdom, msg))
8913 goto nla_put_failure;
8914
8915 if (!wiphy && reg_last_request_cell_base() &&
8916 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8917 NL80211_USER_REG_HINT_CELL_BASE))
8918 goto nla_put_failure;
8919
8920 if (wiphy &&
8921 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8922 goto nla_put_failure;
8923
8924 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8925 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8926 goto nla_put_failure;
8927
8928 genlmsg_end(msg, hdr);
8929 return 0;
8930
8931nla_put_failure:
8932 genlmsg_cancel(msg, hdr);
8933 return -EMSGSIZE;
8934}
8935
8936static int nl80211_get_reg_dump(struct sk_buff *skb,
8937 struct netlink_callback *cb)
8938{
8939 const struct ieee80211_regdomain *regdom = NULL;
8940 struct cfg80211_registered_device *rdev;
8941 int err, reg_idx, start = cb->args[2];
8942
8943 rcu_read_lock();
8944
8945 if (cfg80211_regdomain && start == 0) {
8946 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8947 NLM_F_MULTI, NULL,
8948 rcu_dereference(cfg80211_regdomain));
8949 if (err < 0)
8950 goto out_err;
8951 }
8952
8953 /* the global regdom is idx 0 */
8954 reg_idx = 1;
8955 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8956 regdom = get_wiphy_regdom(&rdev->wiphy);
8957 if (!regdom)
8958 continue;
8959
8960 if (++reg_idx <= start)
8961 continue;
8962
8963 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8964 NLM_F_MULTI, &rdev->wiphy, regdom);
8965 if (err < 0) {
8966 reg_idx--;
8967 break;
8968 }
8969 }
8970
8971 cb->args[2] = reg_idx;
8972 err = skb->len;
8973out_err:
8974 rcu_read_unlock();
8975 return err;
8976}
8977
8978#ifdef CONFIG_CFG80211_CRDA_SUPPORT
8979static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8980 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
8981 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
8982 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
8983 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
8984 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
8985 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
8986 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
8987};
8988
8989static int parse_reg_rule(struct nlattr *tb[],
8990 struct ieee80211_reg_rule *reg_rule)
8991{
8992 struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8993 struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8994
8995 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8996 return -EINVAL;
8997 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8998 return -EINVAL;
8999 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
9000 return -EINVAL;
9001 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
9002 return -EINVAL;
9003 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
9004 return -EINVAL;
9005
9006 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
9007
9008 freq_range->start_freq_khz =
9009 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
9010 freq_range->end_freq_khz =
9011 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
9012 freq_range->max_bandwidth_khz =
9013 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
9014
9015 power_rule->max_eirp =
9016 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
9017
9018 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
9019 power_rule->max_antenna_gain =
9020 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
9021
9022 if (tb[NL80211_ATTR_DFS_CAC_TIME])
9023 reg_rule->dfs_cac_ms =
9024 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
9025
9026 return 0;
9027}
9028
9029static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
9030{
9031 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
9032 struct nlattr *nl_reg_rule;
9033 char *alpha2;
9034 int rem_reg_rules, r;
9035 u32 num_rules = 0, rule_idx = 0;
9036 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
9037 struct ieee80211_regdomain *rd;
9038
9039 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
9040 return -EINVAL;
9041
9042 if (!info->attrs[NL80211_ATTR_REG_RULES])
9043 return -EINVAL;
9044
9045 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9046
9047 if (info->attrs[NL80211_ATTR_DFS_REGION])
9048 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
9049
9050 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9051 rem_reg_rules) {
9052 num_rules++;
9053 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
9054 return -EINVAL;
9055 }
9056
9057 rtnl_lock();
9058 if (!reg_is_valid_request(alpha2)) {
9059 r = -EINVAL;
9060 goto out;
9061 }
9062
9063 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
9064 if (!rd) {
9065 r = -ENOMEM;
9066 goto out;
9067 }
9068
9069 rd->n_reg_rules = num_rules;
9070 rd->alpha2[0] = alpha2[0];
9071 rd->alpha2[1] = alpha2[1];
9072
9073 /*
9074 * Disable DFS master mode if the DFS region was
9075 * not supported or known on this kernel.
9076 */
9077 if (reg_supported_dfs_region(dfs_region))
9078 rd->dfs_region = dfs_region;
9079
9080 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9081 rem_reg_rules) {
9082 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
9083 nl_reg_rule, reg_rule_policy,
9084 info->extack);
9085 if (r)
9086 goto bad_reg;
9087 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
9088 if (r)
9089 goto bad_reg;
9090
9091 rule_idx++;
9092
9093 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
9094 r = -EINVAL;
9095 goto bad_reg;
9096 }
9097 }
9098
9099 r = set_regdom(rd, REGD_SOURCE_CRDA);
9100 /* set_regdom takes ownership of rd */
9101 rd = NULL;
9102 bad_reg:
9103 kfree(rd);
9104 out:
9105 rtnl_unlock();
9106 return r;
9107}
9108#endif /* CONFIG_CFG80211_CRDA_SUPPORT */
9109
9110static int validate_scan_freqs(struct nlattr *freqs)
9111{
9112 struct nlattr *attr1, *attr2;
9113 int n_channels = 0, tmp1, tmp2;
9114
9115 nla_for_each_nested(attr1, freqs, tmp1)
9116 if (nla_len(attr1) != sizeof(u32))
9117 return 0;
9118
9119 nla_for_each_nested(attr1, freqs, tmp1) {
9120 n_channels++;
9121 /*
9122 * Some hardware has a limited channel list for
9123 * scanning, and it is pretty much nonsensical
9124 * to scan for a channel twice, so disallow that
9125 * and don't require drivers to check that the
9126 * channel list they get isn't longer than what
9127 * they can scan, as long as they can scan all
9128 * the channels they registered at once.
9129 */
9130 nla_for_each_nested(attr2, freqs, tmp2)
9131 if (attr1 != attr2 &&
9132 nla_get_u32(attr1) == nla_get_u32(attr2))
9133 return 0;
9134 }
9135
9136 return n_channels;
9137}
9138
9139static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
9140{
9141 return b < NUM_NL80211_BANDS && wiphy->bands[b];
9142}
9143
9144static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
9145 struct cfg80211_bss_selection *bss_select)
9146{
9147 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
9148 struct nlattr *nest;
9149 int err;
9150 bool found = false;
9151 int i;
9152
9153 /* only process one nested attribute */
9154 nest = nla_data(nla);
9155 if (!nla_ok(nest, nla_len(nest)))
9156 return -EINVAL;
9157
9158 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
9159 nest, nl80211_bss_select_policy,
9160 NULL);
9161 if (err)
9162 return err;
9163
9164 /* only one attribute may be given */
9165 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
9166 if (attr[i]) {
9167 if (found)
9168 return -EINVAL;
9169 found = true;
9170 }
9171 }
9172
9173 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
9174
9175 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
9176 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
9177
9178 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
9179 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
9180 bss_select->param.band_pref =
9181 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
9182 if (!is_band_valid(wiphy, bss_select->param.band_pref))
9183 return -EINVAL;
9184 }
9185
9186 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
9187 struct nl80211_bss_select_rssi_adjust *adj_param;
9188
9189 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
9190 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
9191 bss_select->param.adjust.band = adj_param->band;
9192 bss_select->param.adjust.delta = adj_param->delta;
9193 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
9194 return -EINVAL;
9195 }
9196
9197 /* user-space did not provide behaviour attribute */
9198 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
9199 return -EINVAL;
9200
9201 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
9202 return -EINVAL;
9203
9204 return 0;
9205}
9206
9207int nl80211_parse_random_mac(struct nlattr **attrs,
9208 u8 *mac_addr, u8 *mac_addr_mask)
9209{
9210 int i;
9211
9212 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
9213 eth_zero_addr(mac_addr);
9214 eth_zero_addr(mac_addr_mask);
9215 mac_addr[0] = 0x2;
9216 mac_addr_mask[0] = 0x3;
9217
9218 return 0;
9219 }
9220
9221 /* need both or none */
9222 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
9223 return -EINVAL;
9224
9225 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
9226 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
9227
9228 /* don't allow or configure an mcast address */
9229 if (!is_multicast_ether_addr(mac_addr_mask) ||
9230 is_multicast_ether_addr(mac_addr))
9231 return -EINVAL;
9232
9233 /*
9234 * allow users to pass a MAC address that has bits set outside
9235 * of the mask, but don't bother drivers with having to deal
9236 * with such bits
9237 */
9238 for (i = 0; i < ETH_ALEN; i++)
9239 mac_addr[i] &= mac_addr_mask[i];
9240
9241 return 0;
9242}
9243
9244static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
9245 struct ieee80211_channel *chan)
9246{
9247 unsigned int link_id;
9248 bool all_ok = true;
9249
9250 lockdep_assert_wiphy(wdev->wiphy);
9251
9252 if (!cfg80211_wdev_channel_allowed(wdev, chan))
9253 return false;
9254
9255 if (!cfg80211_beaconing_iface_active(wdev))
9256 return true;
9257
9258 /*
9259 * FIXME: check if we have a free HW resource/link for chan
9260 *
9261 * This, as well as the FIXME below, requires knowing the link
9262 * capabilities of the hardware.
9263 */
9264
9265 /* we cannot leave radar channels */
9266 for_each_valid_link(wdev, link_id) {
9267 struct cfg80211_chan_def *chandef;
9268
9269 chandef = wdev_chandef(wdev, link_id);
9270 if (!chandef || !chandef->chan)
9271 continue;
9272
9273 /*
9274 * FIXME: don't require all_ok, but rather check only the
9275 * correct HW resource/link onto which 'chan' falls,
9276 * as only that link leaves the channel for doing
9277 * the off-channel operation.
9278 */
9279
9280 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9281 all_ok = false;
9282 }
9283
9284 if (all_ok)
9285 return true;
9286
9287 return regulatory_pre_cac_allowed(wdev->wiphy);
9288}
9289
9290static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9291 enum nl80211_ext_feature_index feat)
9292{
9293 if (!(flags & flag))
9294 return true;
9295 if (wiphy_ext_feature_isset(wiphy, feat))
9296 return true;
9297 return false;
9298}
9299
9300static int
9301nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9302 void *request, struct nlattr **attrs,
9303 bool is_sched_scan)
9304{
9305 u8 *mac_addr, *mac_addr_mask;
9306 u32 *flags;
9307 enum nl80211_feature_flags randomness_flag;
9308
9309 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9310 return 0;
9311
9312 if (is_sched_scan) {
9313 struct cfg80211_sched_scan_request *req = request;
9314
9315 randomness_flag = wdev ?
9316 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9317 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9318 flags = &req->flags;
9319 mac_addr = req->mac_addr;
9320 mac_addr_mask = req->mac_addr_mask;
9321 } else {
9322 struct cfg80211_scan_request *req = request;
9323
9324 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9325 flags = &req->flags;
9326 mac_addr = req->mac_addr;
9327 mac_addr_mask = req->mac_addr_mask;
9328 }
9329
9330 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9331
9332 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9333 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9334 !nl80211_check_scan_feat(wiphy, *flags,
9335 NL80211_SCAN_FLAG_LOW_SPAN,
9336 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9337 !nl80211_check_scan_feat(wiphy, *flags,
9338 NL80211_SCAN_FLAG_LOW_POWER,
9339 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9340 !nl80211_check_scan_feat(wiphy, *flags,
9341 NL80211_SCAN_FLAG_HIGH_ACCURACY,
9342 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9343 !nl80211_check_scan_feat(wiphy, *flags,
9344 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9345 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9346 !nl80211_check_scan_feat(wiphy, *flags,
9347 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9348 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9349 !nl80211_check_scan_feat(wiphy, *flags,
9350 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9351 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9352 !nl80211_check_scan_feat(wiphy, *flags,
9353 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9354 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9355 !nl80211_check_scan_feat(wiphy, *flags,
9356 NL80211_SCAN_FLAG_RANDOM_SN,
9357 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9358 !nl80211_check_scan_feat(wiphy, *flags,
9359 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9360 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9361 return -EOPNOTSUPP;
9362
9363 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9364 int err;
9365
9366 if (!(wiphy->features & randomness_flag) ||
9367 (wdev && wdev->connected))
9368 return -EOPNOTSUPP;
9369
9370 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9371 if (err)
9372 return err;
9373 }
9374
9375 return 0;
9376}
9377
9378static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9379{
9380 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9381 struct wireless_dev *wdev = info->user_ptr[1];
9382 struct cfg80211_scan_request *request;
9383 struct nlattr *scan_freqs = NULL;
9384 bool scan_freqs_khz = false;
9385 struct nlattr *attr;
9386 struct wiphy *wiphy;
9387 int err, tmp, n_ssids = 0, n_channels, i;
9388 size_t ie_len, size;
9389 size_t ssids_offset, ie_offset;
9390
9391 wiphy = &rdev->wiphy;
9392
9393 if (wdev->iftype == NL80211_IFTYPE_NAN)
9394 return -EOPNOTSUPP;
9395
9396 if (!rdev->ops->scan)
9397 return -EOPNOTSUPP;
9398
9399 if (rdev->scan_req || rdev->scan_msg)
9400 return -EBUSY;
9401
9402 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9403 if (!wiphy_ext_feature_isset(wiphy,
9404 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9405 return -EOPNOTSUPP;
9406 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9407 scan_freqs_khz = true;
9408 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9409 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9410
9411 if (scan_freqs) {
9412 n_channels = validate_scan_freqs(scan_freqs);
9413 if (!n_channels)
9414 return -EINVAL;
9415 } else {
9416 n_channels = ieee80211_get_num_supported_channels(wiphy);
9417 }
9418
9419 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9420 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9421 n_ssids++;
9422
9423 if (n_ssids > wiphy->max_scan_ssids)
9424 return -EINVAL;
9425
9426 if (info->attrs[NL80211_ATTR_IE])
9427 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9428 else
9429 ie_len = 0;
9430
9431 if (ie_len > wiphy->max_scan_ie_len)
9432 return -EINVAL;
9433
9434 size = struct_size(request, channels, n_channels);
9435 ssids_offset = size;
9436 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9437 ie_offset = size;
9438 size = size_add(size, ie_len);
9439 request = kzalloc(size, GFP_KERNEL);
9440 if (!request)
9441 return -ENOMEM;
9442 request->n_channels = n_channels;
9443
9444 if (n_ssids)
9445 request->ssids = (void *)request + ssids_offset;
9446 request->n_ssids = n_ssids;
9447 if (ie_len)
9448 request->ie = (void *)request + ie_offset;
9449
9450 i = 0;
9451 if (scan_freqs) {
9452 /* user specified, bail out if channel not found */
9453 nla_for_each_nested(attr, scan_freqs, tmp) {
9454 struct ieee80211_channel *chan;
9455 int freq = nla_get_u32(attr);
9456
9457 if (!scan_freqs_khz)
9458 freq = MHZ_TO_KHZ(freq);
9459
9460 chan = ieee80211_get_channel_khz(wiphy, freq);
9461 if (!chan) {
9462 err = -EINVAL;
9463 goto out_free;
9464 }
9465
9466 /* ignore disabled channels */
9467 if (chan->flags & IEEE80211_CHAN_DISABLED ||
9468 !cfg80211_wdev_channel_allowed(wdev, chan))
9469 continue;
9470
9471 request->channels[i] = chan;
9472 i++;
9473 }
9474 } else {
9475 enum nl80211_band band;
9476
9477 /* all channels */
9478 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9479 int j;
9480
9481 if (!wiphy->bands[band])
9482 continue;
9483 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9484 struct ieee80211_channel *chan;
9485
9486 chan = &wiphy->bands[band]->channels[j];
9487
9488 if (chan->flags & IEEE80211_CHAN_DISABLED ||
9489 !cfg80211_wdev_channel_allowed(wdev, chan))
9490 continue;
9491
9492 request->channels[i] = chan;
9493 i++;
9494 }
9495 }
9496 }
9497
9498 if (!i) {
9499 err = -EINVAL;
9500 goto out_free;
9501 }
9502
9503 request->n_channels = i;
9504
9505 for (i = 0; i < request->n_channels; i++) {
9506 struct ieee80211_channel *chan = request->channels[i];
9507
9508 /* if we can go off-channel to the target channel we're good */
9509 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9510 continue;
9511
9512 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9513 err = -EBUSY;
9514 goto out_free;
9515 }
9516 }
9517
9518 i = 0;
9519 if (n_ssids) {
9520 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9521 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9522 err = -EINVAL;
9523 goto out_free;
9524 }
9525 request->ssids[i].ssid_len = nla_len(attr);
9526 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9527 i++;
9528 }
9529 }
9530
9531 if (info->attrs[NL80211_ATTR_IE]) {
9532 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9533 memcpy((void *)request->ie,
9534 nla_data(info->attrs[NL80211_ATTR_IE]),
9535 request->ie_len);
9536 }
9537
9538 for (i = 0; i < NUM_NL80211_BANDS; i++)
9539 if (wiphy->bands[i])
9540 request->rates[i] =
9541 (1 << wiphy->bands[i]->n_bitrates) - 1;
9542
9543 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9544 nla_for_each_nested(attr,
9545 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9546 tmp) {
9547 enum nl80211_band band = nla_type(attr);
9548
9549 if (band < 0 || band >= NUM_NL80211_BANDS) {
9550 err = -EINVAL;
9551 goto out_free;
9552 }
9553
9554 if (!wiphy->bands[band])
9555 continue;
9556
9557 err = ieee80211_get_ratemask(wiphy->bands[band],
9558 nla_data(attr),
9559 nla_len(attr),
9560 &request->rates[band]);
9561 if (err)
9562 goto out_free;
9563 }
9564 }
9565
9566 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9567 request->duration =
9568 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9569 request->duration_mandatory =
9570 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9571 }
9572
9573 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9574 false);
9575 if (err)
9576 goto out_free;
9577
9578 request->no_cck =
9579 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9580
9581 /* Initial implementation used NL80211_ATTR_MAC to set the specific
9582 * BSSID to scan for. This was problematic because that same attribute
9583 * was already used for another purpose (local random MAC address). The
9584 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9585 * compatibility with older userspace components, also use the
9586 * NL80211_ATTR_MAC value here if it can be determined to be used for
9587 * the specific BSSID use case instead of the random MAC address
9588 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9589 */
9590 if (info->attrs[NL80211_ATTR_BSSID])
9591 memcpy(request->bssid,
9592 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9593 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9594 info->attrs[NL80211_ATTR_MAC])
9595 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9596 ETH_ALEN);
9597 else
9598 eth_broadcast_addr(request->bssid);
9599
9600 request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs);
9601 request->wdev = wdev;
9602 request->wiphy = &rdev->wiphy;
9603 request->scan_start = jiffies;
9604
9605 rdev->scan_req = request;
9606 err = cfg80211_scan(rdev);
9607
9608 if (err)
9609 goto out_free;
9610
9611 nl80211_send_scan_start(rdev, wdev);
9612 dev_hold(wdev->netdev);
9613
9614 return 0;
9615
9616 out_free:
9617 rdev->scan_req = NULL;
9618 kfree(request);
9619
9620 return err;
9621}
9622
9623static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9624{
9625 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9626 struct wireless_dev *wdev = info->user_ptr[1];
9627
9628 if (!rdev->ops->abort_scan)
9629 return -EOPNOTSUPP;
9630
9631 if (rdev->scan_msg)
9632 return 0;
9633
9634 if (!rdev->scan_req)
9635 return -ENOENT;
9636
9637 rdev_abort_scan(rdev, wdev);
9638 return 0;
9639}
9640
9641static int
9642nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9643 struct cfg80211_sched_scan_request *request,
9644 struct nlattr **attrs)
9645{
9646 int tmp, err, i = 0;
9647 struct nlattr *attr;
9648
9649 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9650 u32 interval;
9651
9652 /*
9653 * If scan plans are not specified,
9654 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9655 * case one scan plan will be set with the specified scan
9656 * interval and infinite number of iterations.
9657 */
9658 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9659 if (!interval)
9660 return -EINVAL;
9661
9662 request->scan_plans[0].interval =
9663 DIV_ROUND_UP(interval, MSEC_PER_SEC);
9664 if (!request->scan_plans[0].interval)
9665 return -EINVAL;
9666
9667 if (request->scan_plans[0].interval >
9668 wiphy->max_sched_scan_plan_interval)
9669 request->scan_plans[0].interval =
9670 wiphy->max_sched_scan_plan_interval;
9671
9672 return 0;
9673 }
9674
9675 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9676 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9677
9678 if (WARN_ON(i >= n_plans))
9679 return -EINVAL;
9680
9681 err = nla_parse_nested_deprecated(plan,
9682 NL80211_SCHED_SCAN_PLAN_MAX,
9683 attr, nl80211_plan_policy,
9684 NULL);
9685 if (err)
9686 return err;
9687
9688 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9689 return -EINVAL;
9690
9691 request->scan_plans[i].interval =
9692 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9693 if (!request->scan_plans[i].interval ||
9694 request->scan_plans[i].interval >
9695 wiphy->max_sched_scan_plan_interval)
9696 return -EINVAL;
9697
9698 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9699 request->scan_plans[i].iterations =
9700 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9701 if (!request->scan_plans[i].iterations ||
9702 (request->scan_plans[i].iterations >
9703 wiphy->max_sched_scan_plan_iterations))
9704 return -EINVAL;
9705 } else if (i < n_plans - 1) {
9706 /*
9707 * All scan plans but the last one must specify
9708 * a finite number of iterations
9709 */
9710 return -EINVAL;
9711 }
9712
9713 i++;
9714 }
9715
9716 /*
9717 * The last scan plan must not specify the number of
9718 * iterations, it is supposed to run infinitely
9719 */
9720 if (request->scan_plans[n_plans - 1].iterations)
9721 return -EINVAL;
9722
9723 return 0;
9724}
9725
9726static struct cfg80211_sched_scan_request *
9727nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9728 struct nlattr **attrs, int max_match_sets)
9729{
9730 struct cfg80211_sched_scan_request *request;
9731 struct nlattr *attr;
9732 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9733 enum nl80211_band band;
9734 size_t ie_len, size;
9735 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9736 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9737
9738 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9739 n_channels = validate_scan_freqs(
9740 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9741 if (!n_channels)
9742 return ERR_PTR(-EINVAL);
9743 } else {
9744 n_channels = ieee80211_get_num_supported_channels(wiphy);
9745 }
9746
9747 if (attrs[NL80211_ATTR_SCAN_SSIDS])
9748 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9749 tmp)
9750 n_ssids++;
9751
9752 if (n_ssids > wiphy->max_sched_scan_ssids)
9753 return ERR_PTR(-EINVAL);
9754
9755 /*
9756 * First, count the number of 'real' matchsets. Due to an issue with
9757 * the old implementation, matchsets containing only the RSSI attribute
9758 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9759 * RSSI for all matchsets, rather than their own matchset for reporting
9760 * all APs with a strong RSSI. This is needed to be compatible with
9761 * older userspace that treated a matchset with only the RSSI as the
9762 * global RSSI for all other matchsets - if there are other matchsets.
9763 */
9764 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9765 nla_for_each_nested(attr,
9766 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9767 tmp) {
9768 struct nlattr *rssi;
9769
9770 err = nla_parse_nested_deprecated(tb,
9771 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9772 attr,
9773 nl80211_match_policy,
9774 NULL);
9775 if (err)
9776 return ERR_PTR(err);
9777
9778 /* SSID and BSSID are mutually exclusive */
9779 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9780 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9781 return ERR_PTR(-EINVAL);
9782
9783 /* add other standalone attributes here */
9784 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9785 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9786 n_match_sets++;
9787 continue;
9788 }
9789 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9790 if (rssi)
9791 default_match_rssi = nla_get_s32(rssi);
9792 }
9793 }
9794
9795 /* However, if there's no other matchset, add the RSSI one */
9796 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9797 n_match_sets = 1;
9798
9799 if (n_match_sets > max_match_sets)
9800 return ERR_PTR(-EINVAL);
9801
9802 if (attrs[NL80211_ATTR_IE])
9803 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9804 else
9805 ie_len = 0;
9806
9807 if (ie_len > wiphy->max_sched_scan_ie_len)
9808 return ERR_PTR(-EINVAL);
9809
9810 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9811 /*
9812 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9813 * each scan plan already specifies its own interval
9814 */
9815 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9816 return ERR_PTR(-EINVAL);
9817
9818 nla_for_each_nested(attr,
9819 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9820 n_plans++;
9821 } else {
9822 /*
9823 * The scan interval attribute is kept for backward
9824 * compatibility. If no scan plans are specified and sched scan
9825 * interval is specified, one scan plan will be set with this
9826 * scan interval and infinite number of iterations.
9827 */
9828 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9829 return ERR_PTR(-EINVAL);
9830
9831 n_plans = 1;
9832 }
9833
9834 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9835 return ERR_PTR(-EINVAL);
9836
9837 if (!wiphy_ext_feature_isset(
9838 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9839 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9840 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9841 return ERR_PTR(-EINVAL);
9842
9843 size = struct_size(request, channels, n_channels);
9844 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9845 size = size_add(size, array_size(sizeof(*request->match_sets),
9846 n_match_sets));
9847 size = size_add(size, array_size(sizeof(*request->scan_plans),
9848 n_plans));
9849 size = size_add(size, ie_len);
9850 request = kzalloc(size, GFP_KERNEL);
9851 if (!request)
9852 return ERR_PTR(-ENOMEM);
9853 request->n_channels = n_channels;
9854
9855 if (n_ssids)
9856 request->ssids = (void *)request +
9857 struct_size(request, channels, n_channels);
9858 request->n_ssids = n_ssids;
9859 if (ie_len) {
9860 if (n_ssids)
9861 request->ie = (void *)(request->ssids + n_ssids);
9862 else
9863 request->ie = (void *)(request->channels + n_channels);
9864 }
9865
9866 if (n_match_sets) {
9867 if (request->ie)
9868 request->match_sets = (void *)(request->ie + ie_len);
9869 else if (n_ssids)
9870 request->match_sets =
9871 (void *)(request->ssids + n_ssids);
9872 else
9873 request->match_sets =
9874 (void *)(request->channels + n_channels);
9875 }
9876 request->n_match_sets = n_match_sets;
9877
9878 if (n_match_sets)
9879 request->scan_plans = (void *)(request->match_sets +
9880 n_match_sets);
9881 else if (request->ie)
9882 request->scan_plans = (void *)(request->ie + ie_len);
9883 else if (n_ssids)
9884 request->scan_plans = (void *)(request->ssids + n_ssids);
9885 else
9886 request->scan_plans = (void *)(request->channels + n_channels);
9887
9888 request->n_scan_plans = n_plans;
9889
9890 i = 0;
9891 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9892 /* user specified, bail out if channel not found */
9893 nla_for_each_nested(attr,
9894 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9895 tmp) {
9896 struct ieee80211_channel *chan;
9897
9898 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9899
9900 if (!chan) {
9901 err = -EINVAL;
9902 goto out_free;
9903 }
9904
9905 /* ignore disabled channels */
9906 if (chan->flags & IEEE80211_CHAN_DISABLED)
9907 continue;
9908
9909 request->channels[i] = chan;
9910 i++;
9911 }
9912 } else {
9913 /* all channels */
9914 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9915 int j;
9916
9917 if (!wiphy->bands[band])
9918 continue;
9919 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9920 struct ieee80211_channel *chan;
9921
9922 chan = &wiphy->bands[band]->channels[j];
9923
9924 if (chan->flags & IEEE80211_CHAN_DISABLED)
9925 continue;
9926
9927 request->channels[i] = chan;
9928 i++;
9929 }
9930 }
9931 }
9932
9933 if (!i) {
9934 err = -EINVAL;
9935 goto out_free;
9936 }
9937
9938 request->n_channels = i;
9939
9940 i = 0;
9941 if (n_ssids) {
9942 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9943 tmp) {
9944 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9945 err = -EINVAL;
9946 goto out_free;
9947 }
9948 request->ssids[i].ssid_len = nla_len(attr);
9949 memcpy(request->ssids[i].ssid, nla_data(attr),
9950 nla_len(attr));
9951 i++;
9952 }
9953 }
9954
9955 i = 0;
9956 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9957 nla_for_each_nested(attr,
9958 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9959 tmp) {
9960 struct nlattr *ssid, *bssid, *rssi;
9961
9962 err = nla_parse_nested_deprecated(tb,
9963 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9964 attr,
9965 nl80211_match_policy,
9966 NULL);
9967 if (err)
9968 goto out_free;
9969 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9970 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9971
9972 if (!ssid && !bssid) {
9973 i++;
9974 continue;
9975 }
9976
9977 if (WARN_ON(i >= n_match_sets)) {
9978 /* this indicates a programming error,
9979 * the loop above should have verified
9980 * things properly
9981 */
9982 err = -EINVAL;
9983 goto out_free;
9984 }
9985
9986 if (ssid) {
9987 memcpy(request->match_sets[i].ssid.ssid,
9988 nla_data(ssid), nla_len(ssid));
9989 request->match_sets[i].ssid.ssid_len =
9990 nla_len(ssid);
9991 }
9992 if (bssid)
9993 memcpy(request->match_sets[i].bssid,
9994 nla_data(bssid), ETH_ALEN);
9995
9996 /* special attribute - old implementation w/a */
9997 request->match_sets[i].rssi_thold = default_match_rssi;
9998 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9999 if (rssi)
10000 request->match_sets[i].rssi_thold =
10001 nla_get_s32(rssi);
10002 i++;
10003 }
10004
10005 /* there was no other matchset, so the RSSI one is alone */
10006 if (i == 0 && n_match_sets)
10007 request->match_sets[0].rssi_thold = default_match_rssi;
10008
10009 request->min_rssi_thold = INT_MAX;
10010 for (i = 0; i < n_match_sets; i++)
10011 request->min_rssi_thold =
10012 min(request->match_sets[i].rssi_thold,
10013 request->min_rssi_thold);
10014 } else {
10015 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
10016 }
10017
10018 if (ie_len) {
10019 request->ie_len = ie_len;
10020 memcpy((void *)request->ie,
10021 nla_data(attrs[NL80211_ATTR_IE]),
10022 request->ie_len);
10023 }
10024
10025 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
10026 if (err)
10027 goto out_free;
10028
10029 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
10030 request->delay =
10031 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
10032
10033 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
10034 request->relative_rssi = nla_get_s8(
10035 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
10036 request->relative_rssi_set = true;
10037 }
10038
10039 if (request->relative_rssi_set &&
10040 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
10041 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
10042
10043 rssi_adjust = nla_data(
10044 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
10045 request->rssi_adjust.band = rssi_adjust->band;
10046 request->rssi_adjust.delta = rssi_adjust->delta;
10047 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
10048 err = -EINVAL;
10049 goto out_free;
10050 }
10051 }
10052
10053 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
10054 if (err)
10055 goto out_free;
10056
10057 request->scan_start = jiffies;
10058
10059 return request;
10060
10061out_free:
10062 kfree(request);
10063 return ERR_PTR(err);
10064}
10065
10066static int nl80211_start_sched_scan(struct sk_buff *skb,
10067 struct genl_info *info)
10068{
10069 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10070 struct net_device *dev = info->user_ptr[1];
10071 struct wireless_dev *wdev = dev->ieee80211_ptr;
10072 struct cfg80211_sched_scan_request *sched_scan_req;
10073 bool want_multi;
10074 int err;
10075
10076 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
10077 return -EOPNOTSUPP;
10078
10079 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
10080 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
10081 if (err)
10082 return err;
10083
10084 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
10085 info->attrs,
10086 rdev->wiphy.max_match_sets);
10087
10088 err = PTR_ERR_OR_ZERO(sched_scan_req);
10089 if (err)
10090 goto out_err;
10091
10092 /* leave request id zero for legacy request
10093 * or if driver does not support multi-scheduled scan
10094 */
10095 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
10096 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
10097
10098 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
10099 if (err)
10100 goto out_free;
10101
10102 sched_scan_req->dev = dev;
10103 sched_scan_req->wiphy = &rdev->wiphy;
10104
10105 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10106 sched_scan_req->owner_nlportid = info->snd_portid;
10107
10108 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
10109
10110 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
10111 return 0;
10112
10113out_free:
10114 kfree(sched_scan_req);
10115out_err:
10116 return err;
10117}
10118
10119static int nl80211_stop_sched_scan(struct sk_buff *skb,
10120 struct genl_info *info)
10121{
10122 struct cfg80211_sched_scan_request *req;
10123 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10124 u64 cookie;
10125
10126 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
10127 return -EOPNOTSUPP;
10128
10129 if (info->attrs[NL80211_ATTR_COOKIE]) {
10130 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10131 return __cfg80211_stop_sched_scan(rdev, cookie, false);
10132 }
10133
10134 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
10135 struct cfg80211_sched_scan_request,
10136 list);
10137 if (!req || req->reqid ||
10138 (req->owner_nlportid &&
10139 req->owner_nlportid != info->snd_portid))
10140 return -ENOENT;
10141
10142 return cfg80211_stop_sched_scan_req(rdev, req, false);
10143}
10144
10145static int nl80211_start_radar_detection(struct sk_buff *skb,
10146 struct genl_info *info)
10147{
10148 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10149 struct net_device *dev = info->user_ptr[1];
10150 struct wireless_dev *wdev = dev->ieee80211_ptr;
10151 int link_id = nl80211_link_id(info->attrs);
10152 struct wiphy *wiphy = wdev->wiphy;
10153 struct cfg80211_chan_def chandef;
10154 enum nl80211_dfs_regions dfs_region;
10155 unsigned int cac_time_ms;
10156 int err;
10157
10158 flush_delayed_work(&rdev->dfs_update_channels_wk);
10159
10160 switch (wdev->iftype) {
10161 case NL80211_IFTYPE_AP:
10162 case NL80211_IFTYPE_P2P_GO:
10163 case NL80211_IFTYPE_MESH_POINT:
10164 case NL80211_IFTYPE_ADHOC:
10165 break;
10166 default:
10167 /* caution - see cfg80211_beaconing_iface_active() below */
10168 return -EINVAL;
10169 }
10170
10171 guard(wiphy)(wiphy);
10172
10173 dfs_region = reg_get_dfs_region(wiphy);
10174 if (dfs_region == NL80211_DFS_UNSET)
10175 return -EINVAL;
10176
10177 err = nl80211_parse_chandef(rdev, info, &chandef);
10178 if (err)
10179 return err;
10180
10181 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10182 if (err < 0)
10183 return err;
10184
10185 if (err == 0)
10186 return -EINVAL;
10187
10188 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
10189 return -EINVAL;
10190
10191 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
10192 return cfg80211_start_background_radar_detection(rdev, wdev,
10193 &chandef);
10194
10195 if (cfg80211_beaconing_iface_active(wdev)) {
10196 /* During MLO other link(s) can beacon, only the current link
10197 * can not already beacon
10198 */
10199 if (wdev->valid_links &&
10200 !wdev->links[link_id].ap.beacon_interval) {
10201 /* nothing */
10202 } else {
10203 return -EBUSY;
10204 }
10205 }
10206
10207 if (wdev->links[link_id].cac_started)
10208 return -EBUSY;
10209
10210 /* CAC start is offloaded to HW and can't be started manually */
10211 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
10212 return -EOPNOTSUPP;
10213
10214 if (!rdev->ops->start_radar_detection)
10215 return -EOPNOTSUPP;
10216
10217 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
10218 if (WARN_ON(!cac_time_ms))
10219 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10220
10221 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
10222 link_id);
10223 if (err)
10224 return err;
10225
10226 switch (wdev->iftype) {
10227 case NL80211_IFTYPE_AP:
10228 case NL80211_IFTYPE_P2P_GO:
10229 wdev->links[link_id].ap.chandef = chandef;
10230 break;
10231 case NL80211_IFTYPE_ADHOC:
10232 wdev->u.ibss.chandef = chandef;
10233 break;
10234 case NL80211_IFTYPE_MESH_POINT:
10235 wdev->u.mesh.chandef = chandef;
10236 break;
10237 default:
10238 break;
10239 }
10240 wdev->links[link_id].cac_started = true;
10241 wdev->links[link_id].cac_start_time = jiffies;
10242 wdev->links[link_id].cac_time_ms = cac_time_ms;
10243
10244 return 0;
10245}
10246
10247static int nl80211_notify_radar_detection(struct sk_buff *skb,
10248 struct genl_info *info)
10249{
10250 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10251 struct net_device *dev = info->user_ptr[1];
10252 struct wireless_dev *wdev = dev->ieee80211_ptr;
10253 struct wiphy *wiphy = wdev->wiphy;
10254 struct cfg80211_chan_def chandef;
10255 enum nl80211_dfs_regions dfs_region;
10256 int err;
10257
10258 dfs_region = reg_get_dfs_region(wiphy);
10259 if (dfs_region == NL80211_DFS_UNSET) {
10260 GENL_SET_ERR_MSG(info,
10261 "DFS Region is not set. Unexpected Radar indication");
10262 return -EINVAL;
10263 }
10264
10265 err = nl80211_parse_chandef(rdev, info, &chandef);
10266 if (err) {
10267 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10268 return err;
10269 }
10270
10271 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10272 if (err < 0) {
10273 GENL_SET_ERR_MSG(info, "chandef is invalid");
10274 return err;
10275 }
10276
10277 if (err == 0) {
10278 GENL_SET_ERR_MSG(info,
10279 "Unexpected Radar indication for chandef/iftype");
10280 return -EINVAL;
10281 }
10282
10283 /* Do not process this notification if radar is already detected
10284 * by kernel on this channel, and return success.
10285 */
10286 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10287 return 0;
10288
10289 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10290
10291 cfg80211_sched_dfs_chan_update(rdev);
10292
10293 rdev->radar_chandef = chandef;
10294
10295 /* Propagate this notification to other radios as well */
10296 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10297
10298 return 0;
10299}
10300
10301static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
10302 const u8 *data, size_t datalen,
10303 int first_count, struct nlattr *attr,
10304 const u16 **offsets, unsigned int *n_offsets)
10305{
10306 int i;
10307
10308 *n_offsets = 0;
10309
10310 if (!attr)
10311 return 0;
10312
10313 if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
10314 return -EINVAL;
10315
10316 *n_offsets = nla_len(attr) / sizeof(u16);
10317 if (rdev->wiphy.max_num_csa_counters &&
10318 (*n_offsets > rdev->wiphy.max_num_csa_counters))
10319 return -EINVAL;
10320
10321 *offsets = nla_data(attr);
10322
10323 /* sanity checks - counters should fit and be the same */
10324 for (i = 0; i < *n_offsets; i++) {
10325 u16 offset = (*offsets)[i];
10326
10327 if (offset >= datalen)
10328 return -EINVAL;
10329
10330 if (first_count != -1 && data[offset] != first_count)
10331 return -EINVAL;
10332 }
10333
10334 return 0;
10335}
10336
10337static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10338{
10339 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10340 unsigned int link_id = nl80211_link_id(info->attrs);
10341 struct net_device *dev = info->user_ptr[1];
10342 struct wireless_dev *wdev = dev->ieee80211_ptr;
10343 struct cfg80211_csa_settings params;
10344 struct nlattr **csa_attrs = NULL;
10345 int err;
10346 bool need_new_beacon = false;
10347 bool need_handle_dfs_flag = true;
10348 u32 cs_count;
10349
10350 if (!rdev->ops->channel_switch ||
10351 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10352 return -EOPNOTSUPP;
10353
10354 switch (dev->ieee80211_ptr->iftype) {
10355 case NL80211_IFTYPE_AP:
10356 case NL80211_IFTYPE_P2P_GO:
10357 need_new_beacon = true;
10358 /* For all modes except AP the handle_dfs flag needs to be
10359 * supplied to tell the kernel that userspace will handle radar
10360 * events when they happen. Otherwise a switch to a channel
10361 * requiring DFS will be rejected.
10362 */
10363 need_handle_dfs_flag = false;
10364
10365 /* useless if AP is not running */
10366 if (!wdev->links[link_id].ap.beacon_interval)
10367 return -ENOTCONN;
10368 break;
10369 case NL80211_IFTYPE_ADHOC:
10370 if (!wdev->u.ibss.ssid_len)
10371 return -ENOTCONN;
10372 break;
10373 case NL80211_IFTYPE_MESH_POINT:
10374 if (!wdev->u.mesh.id_len)
10375 return -ENOTCONN;
10376 break;
10377 default:
10378 return -EOPNOTSUPP;
10379 }
10380
10381 memset(&params, 0, sizeof(params));
10382 params.beacon_csa.ftm_responder = -1;
10383
10384 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10385 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10386 return -EINVAL;
10387
10388 /* only important for AP, IBSS and mesh create IEs internally */
10389 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10390 return -EINVAL;
10391
10392 /* Even though the attribute is u32, the specification says
10393 * u8, so let's make sure we don't overflow.
10394 */
10395 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10396 if (cs_count > 255)
10397 return -EINVAL;
10398
10399 params.count = cs_count;
10400
10401 if (!need_new_beacon)
10402 goto skip_beacons;
10403
10404 err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10405 info->extack);
10406 if (err)
10407 goto free;
10408
10409 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10410 GFP_KERNEL);
10411 if (!csa_attrs) {
10412 err = -ENOMEM;
10413 goto free;
10414 }
10415
10416 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10417 info->attrs[NL80211_ATTR_CSA_IES],
10418 nl80211_policy, info->extack);
10419 if (err)
10420 goto free;
10421
10422 err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10423 info->extack);
10424 if (err)
10425 goto free;
10426
10427 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10428 err = -EINVAL;
10429 goto free;
10430 }
10431
10432 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
10433 params.beacon_csa.tail_len,
10434 params.count,
10435 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
10436 &params.counter_offsets_beacon,
10437 &params.n_counter_offsets_beacon);
10438 if (err)
10439 goto free;
10440
10441 err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
10442 params.beacon_csa.probe_resp_len,
10443 params.count,
10444 csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
10445 &params.counter_offsets_presp,
10446 &params.n_counter_offsets_presp);
10447 if (err)
10448 goto free;
10449
10450skip_beacons:
10451 err = nl80211_parse_chandef(rdev, info, &params.chandef);
10452 if (err)
10453 goto free;
10454
10455 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10456 wdev->iftype)) {
10457 err = -EINVAL;
10458 goto free;
10459 }
10460
10461 err = cfg80211_chandef_dfs_required(wdev->wiphy,
10462 &params.chandef,
10463 wdev->iftype);
10464 if (err < 0)
10465 goto free;
10466
10467 if (err > 0) {
10468 params.radar_required = true;
10469 if (need_handle_dfs_flag &&
10470 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10471 err = -EINVAL;
10472 goto free;
10473 }
10474 }
10475
10476 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10477 params.block_tx = true;
10478
10479 params.link_id = link_id;
10480 err = rdev_channel_switch(rdev, dev, &params);
10481
10482free:
10483 kfree(params.beacon_after.mbssid_ies);
10484 kfree(params.beacon_csa.mbssid_ies);
10485 kfree(params.beacon_after.rnr_ies);
10486 kfree(params.beacon_csa.rnr_ies);
10487 kfree(csa_attrs);
10488 return err;
10489}
10490
10491static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10492 u32 seq, int flags,
10493 struct cfg80211_registered_device *rdev,
10494 struct wireless_dev *wdev,
10495 struct cfg80211_internal_bss *intbss)
10496{
10497 struct cfg80211_bss *res = &intbss->pub;
10498 const struct cfg80211_bss_ies *ies;
10499 unsigned int link_id;
10500 void *hdr;
10501 struct nlattr *bss;
10502
10503 lockdep_assert_wiphy(wdev->wiphy);
10504
10505 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10506 NL80211_CMD_NEW_SCAN_RESULTS);
10507 if (!hdr)
10508 return -1;
10509
10510 genl_dump_check_consistent(cb, hdr);
10511
10512 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10513 goto nla_put_failure;
10514 if (wdev->netdev &&
10515 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10516 goto nla_put_failure;
10517 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10518 NL80211_ATTR_PAD))
10519 goto nla_put_failure;
10520
10521 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10522 if (!bss)
10523 goto nla_put_failure;
10524 if ((!is_zero_ether_addr(res->bssid) &&
10525 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10526 goto nla_put_failure;
10527
10528 rcu_read_lock();
10529 /* indicate whether we have probe response data or not */
10530 if (rcu_access_pointer(res->proberesp_ies) &&
10531 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10532 goto fail_unlock_rcu;
10533
10534 /* this pointer prefers to be pointed to probe response data
10535 * but is always valid
10536 */
10537 ies = rcu_dereference(res->ies);
10538 if (ies) {
10539 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10540 NL80211_BSS_PAD))
10541 goto fail_unlock_rcu;
10542 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10543 ies->len, ies->data))
10544 goto fail_unlock_rcu;
10545 }
10546
10547 /* and this pointer is always (unless driver didn't know) beacon data */
10548 ies = rcu_dereference(res->beacon_ies);
10549 if (ies && ies->from_beacon) {
10550 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10551 NL80211_BSS_PAD))
10552 goto fail_unlock_rcu;
10553 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10554 ies->len, ies->data))
10555 goto fail_unlock_rcu;
10556 }
10557 rcu_read_unlock();
10558
10559 if (res->beacon_interval &&
10560 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10561 goto nla_put_failure;
10562 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10563 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10564 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10565 res->channel->freq_offset) ||
10566 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10567 jiffies_to_msecs(jiffies - intbss->ts)))
10568 goto nla_put_failure;
10569
10570 if (intbss->parent_tsf &&
10571 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10572 intbss->parent_tsf, NL80211_BSS_PAD) ||
10573 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10574 intbss->parent_bssid)))
10575 goto nla_put_failure;
10576
10577 if (res->ts_boottime &&
10578 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10579 res->ts_boottime, NL80211_BSS_PAD))
10580 goto nla_put_failure;
10581
10582 if (!nl80211_put_signal(msg, intbss->pub.chains,
10583 intbss->pub.chain_signal,
10584 NL80211_BSS_CHAIN_SIGNAL))
10585 goto nla_put_failure;
10586
10587 if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
10588 switch (rdev->wiphy.signal_type) {
10589 case CFG80211_SIGNAL_TYPE_MBM:
10590 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
10591 res->signal))
10592 goto nla_put_failure;
10593 break;
10594 case CFG80211_SIGNAL_TYPE_UNSPEC:
10595 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
10596 res->signal))
10597 goto nla_put_failure;
10598 break;
10599 default:
10600 break;
10601 }
10602 }
10603
10604 switch (wdev->iftype) {
10605 case NL80211_IFTYPE_P2P_CLIENT:
10606 case NL80211_IFTYPE_STATION:
10607 for_each_valid_link(wdev, link_id) {
10608 if (intbss == wdev->links[link_id].client.current_bss &&
10609 (nla_put_u32(msg, NL80211_BSS_STATUS,
10610 NL80211_BSS_STATUS_ASSOCIATED) ||
10611 (wdev->valid_links &&
10612 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10613 link_id) ||
10614 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10615 wdev->u.client.connected_addr)))))
10616 goto nla_put_failure;
10617 }
10618 break;
10619 case NL80211_IFTYPE_ADHOC:
10620 if (intbss == wdev->u.ibss.current_bss &&
10621 nla_put_u32(msg, NL80211_BSS_STATUS,
10622 NL80211_BSS_STATUS_IBSS_JOINED))
10623 goto nla_put_failure;
10624 break;
10625 default:
10626 break;
10627 }
10628
10629 if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
10630 goto nla_put_failure;
10631
10632 if (res->cannot_use_reasons &&
10633 nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
10634 res->cannot_use_reasons,
10635 NL80211_BSS_PAD))
10636 goto nla_put_failure;
10637
10638 nla_nest_end(msg, bss);
10639
10640 genlmsg_end(msg, hdr);
10641 return 0;
10642
10643 fail_unlock_rcu:
10644 rcu_read_unlock();
10645 nla_put_failure:
10646 genlmsg_cancel(msg, hdr);
10647 return -EMSGSIZE;
10648}
10649
10650static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10651{
10652 struct cfg80211_registered_device *rdev;
10653 struct cfg80211_internal_bss *scan;
10654 struct wireless_dev *wdev;
10655 struct nlattr **attrbuf;
10656 int start = cb->args[2], idx = 0;
10657 bool dump_include_use_data;
10658 int err;
10659
10660 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10661 if (!attrbuf)
10662 return -ENOMEM;
10663
10664 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10665 if (err) {
10666 kfree(attrbuf);
10667 return err;
10668 }
10669 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10670 __acquire(&rdev->wiphy.mtx);
10671
10672 dump_include_use_data =
10673 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
10674 kfree(attrbuf);
10675
10676 spin_lock_bh(&rdev->bss_lock);
10677
10678 /*
10679 * dump_scan will be called multiple times to break up the scan results
10680 * into multiple messages. It is unlikely that any more bss-es will be
10681 * expired after the first call, so only call only call this on the
10682 * first dump_scan invocation.
10683 */
10684 if (start == 0)
10685 cfg80211_bss_expire(rdev);
10686
10687 cb->seq = rdev->bss_generation;
10688
10689 list_for_each_entry(scan, &rdev->bss_list, list) {
10690 if (++idx <= start)
10691 continue;
10692 if (!dump_include_use_data &&
10693 !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
10694 continue;
10695 if (nl80211_send_bss(skb, cb,
10696 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10697 rdev, wdev, scan) < 0) {
10698 idx--;
10699 break;
10700 }
10701 }
10702
10703 spin_unlock_bh(&rdev->bss_lock);
10704
10705 cb->args[2] = idx;
10706 wiphy_unlock(&rdev->wiphy);
10707
10708 return skb->len;
10709}
10710
10711static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10712 int flags, struct net_device *dev,
10713 bool allow_radio_stats,
10714 struct survey_info *survey)
10715{
10716 void *hdr;
10717 struct nlattr *infoattr;
10718
10719 /* skip radio stats if userspace didn't request them */
10720 if (!survey->channel && !allow_radio_stats)
10721 return 0;
10722
10723 hdr = nl80211hdr_put(msg, portid, seq, flags,
10724 NL80211_CMD_NEW_SURVEY_RESULTS);
10725 if (!hdr)
10726 return -ENOMEM;
10727
10728 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10729 goto nla_put_failure;
10730
10731 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10732 if (!infoattr)
10733 goto nla_put_failure;
10734
10735 if (survey->channel &&
10736 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10737 survey->channel->center_freq))
10738 goto nla_put_failure;
10739
10740 if (survey->channel && survey->channel->freq_offset &&
10741 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10742 survey->channel->freq_offset))
10743 goto nla_put_failure;
10744
10745 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10746 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10747 goto nla_put_failure;
10748 if ((survey->filled & SURVEY_INFO_IN_USE) &&
10749 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10750 goto nla_put_failure;
10751 if ((survey->filled & SURVEY_INFO_TIME) &&
10752 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10753 survey->time, NL80211_SURVEY_INFO_PAD))
10754 goto nla_put_failure;
10755 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10756 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10757 survey->time_busy, NL80211_SURVEY_INFO_PAD))
10758 goto nla_put_failure;
10759 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10760 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10761 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10762 goto nla_put_failure;
10763 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10764 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10765 survey->time_rx, NL80211_SURVEY_INFO_PAD))
10766 goto nla_put_failure;
10767 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10768 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10769 survey->time_tx, NL80211_SURVEY_INFO_PAD))
10770 goto nla_put_failure;
10771 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10772 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10773 survey->time_scan, NL80211_SURVEY_INFO_PAD))
10774 goto nla_put_failure;
10775 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10776 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10777 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10778 goto nla_put_failure;
10779
10780 nla_nest_end(msg, infoattr);
10781
10782 genlmsg_end(msg, hdr);
10783 return 0;
10784
10785 nla_put_failure:
10786 genlmsg_cancel(msg, hdr);
10787 return -EMSGSIZE;
10788}
10789
10790static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10791{
10792 struct nlattr **attrbuf;
10793 struct survey_info survey;
10794 struct cfg80211_registered_device *rdev;
10795 struct wireless_dev *wdev;
10796 int survey_idx = cb->args[2];
10797 int res;
10798 bool radio_stats;
10799
10800 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10801 if (!attrbuf)
10802 return -ENOMEM;
10803
10804 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10805 if (res) {
10806 kfree(attrbuf);
10807 return res;
10808 }
10809 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10810 __acquire(&rdev->wiphy.mtx);
10811
10812 /* prepare_wdev_dump parsed the attributes */
10813 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10814
10815 if (!wdev->netdev) {
10816 res = -EINVAL;
10817 goto out_err;
10818 }
10819
10820 if (!rdev->ops->dump_survey) {
10821 res = -EOPNOTSUPP;
10822 goto out_err;
10823 }
10824
10825 while (1) {
10826 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10827 if (res == -ENOENT)
10828 break;
10829 if (res)
10830 goto out_err;
10831
10832 /* don't send disabled channels, but do send non-channel data */
10833 if (survey.channel &&
10834 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10835 survey_idx++;
10836 continue;
10837 }
10838
10839 if (nl80211_send_survey(skb,
10840 NETLINK_CB(cb->skb).portid,
10841 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10842 wdev->netdev, radio_stats, &survey) < 0)
10843 goto out;
10844 survey_idx++;
10845 }
10846
10847 out:
10848 cb->args[2] = survey_idx;
10849 res = skb->len;
10850 out_err:
10851 kfree(attrbuf);
10852 wiphy_unlock(&rdev->wiphy);
10853 return res;
10854}
10855
10856static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10857{
10858 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10859 struct net_device *dev = info->user_ptr[1];
10860 struct ieee80211_channel *chan;
10861 const u8 *bssid, *ssid;
10862 int err, ssid_len;
10863 enum nl80211_auth_type auth_type;
10864 struct key_parse key;
10865 bool local_state_change;
10866 struct cfg80211_auth_request req = {};
10867 u32 freq;
10868
10869 if (!info->attrs[NL80211_ATTR_MAC])
10870 return -EINVAL;
10871
10872 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10873 return -EINVAL;
10874
10875 if (!info->attrs[NL80211_ATTR_SSID])
10876 return -EINVAL;
10877
10878 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10879 return -EINVAL;
10880
10881 err = nl80211_parse_key(info, &key);
10882 if (err)
10883 return err;
10884
10885 if (key.idx >= 0) {
10886 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10887 return -EINVAL;
10888 if (!key.p.key || !key.p.key_len)
10889 return -EINVAL;
10890 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10891 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10892 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10893 key.p.key_len != WLAN_KEY_LEN_WEP104))
10894 return -EINVAL;
10895 if (key.idx > 3)
10896 return -EINVAL;
10897 } else {
10898 key.p.key_len = 0;
10899 key.p.key = NULL;
10900 }
10901
10902 if (key.idx >= 0) {
10903 int i;
10904 bool ok = false;
10905
10906 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10907 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10908 ok = true;
10909 break;
10910 }
10911 }
10912 if (!ok)
10913 return -EINVAL;
10914 }
10915
10916 if (!rdev->ops->auth)
10917 return -EOPNOTSUPP;
10918
10919 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10920 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10921 return -EOPNOTSUPP;
10922
10923 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10924 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10925 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10926 freq +=
10927 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10928
10929 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10930 if (!chan)
10931 return -EINVAL;
10932
10933 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10934 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10935
10936 if (info->attrs[NL80211_ATTR_IE]) {
10937 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10938 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10939 }
10940
10941 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
10942 req.supported_selectors =
10943 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10944 req.supported_selectors_len =
10945 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10946 }
10947
10948 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10949 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10950 return -EINVAL;
10951
10952 if ((auth_type == NL80211_AUTHTYPE_SAE ||
10953 auth_type == NL80211_AUTHTYPE_FILS_SK ||
10954 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10955 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10956 !info->attrs[NL80211_ATTR_AUTH_DATA])
10957 return -EINVAL;
10958
10959 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10960 if (auth_type != NL80211_AUTHTYPE_SAE &&
10961 auth_type != NL80211_AUTHTYPE_FILS_SK &&
10962 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10963 auth_type != NL80211_AUTHTYPE_FILS_PK)
10964 return -EINVAL;
10965 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10966 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10967 }
10968
10969 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10970
10971 /*
10972 * Since we no longer track auth state, ignore
10973 * requests to only change local state.
10974 */
10975 if (local_state_change)
10976 return 0;
10977
10978 req.auth_type = auth_type;
10979 req.key = key.p.key;
10980 req.key_len = key.p.key_len;
10981 req.key_idx = key.idx;
10982 req.link_id = nl80211_link_id_or_invalid(info->attrs);
10983 if (req.link_id >= 0) {
10984 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10985 return -EINVAL;
10986 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10987 return -EINVAL;
10988 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10989 if (!is_valid_ether_addr(req.ap_mld_addr))
10990 return -EINVAL;
10991 }
10992
10993 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10994 IEEE80211_BSS_TYPE_ESS,
10995 IEEE80211_PRIVACY_ANY);
10996 if (!req.bss)
10997 return -ENOENT;
10998
10999 err = cfg80211_mlme_auth(rdev, dev, &req);
11000
11001 cfg80211_put_bss(&rdev->wiphy, req.bss);
11002
11003 return err;
11004}
11005
11006static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
11007 struct genl_info *info)
11008{
11009 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11010 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
11011 return -EINVAL;
11012 }
11013
11014 if (!rdev->ops->tx_control_port ||
11015 !wiphy_ext_feature_isset(&rdev->wiphy,
11016 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
11017 return -EOPNOTSUPP;
11018
11019 return 0;
11020}
11021
11022static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
11023 struct genl_info *info,
11024 struct cfg80211_crypto_settings *settings,
11025 int cipher_limit)
11026{
11027 memset(settings, 0, sizeof(*settings));
11028
11029 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
11030
11031 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
11032 u16 proto;
11033
11034 proto = nla_get_u16(
11035 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
11036 settings->control_port_ethertype = cpu_to_be16(proto);
11037 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
11038 proto != ETH_P_PAE)
11039 return -EINVAL;
11040 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
11041 settings->control_port_no_encrypt = true;
11042 } else
11043 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
11044
11045 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11046 int r = validate_pae_over_nl80211(rdev, info);
11047
11048 if (r < 0)
11049 return r;
11050
11051 settings->control_port_over_nl80211 = true;
11052
11053 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
11054 settings->control_port_no_preauth = true;
11055 }
11056
11057 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
11058 void *data;
11059 int len, i;
11060
11061 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11062 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11063 settings->n_ciphers_pairwise = len / sizeof(u32);
11064
11065 if (len % sizeof(u32))
11066 return -EINVAL;
11067
11068 if (settings->n_ciphers_pairwise > cipher_limit)
11069 return -EINVAL;
11070
11071 memcpy(settings->ciphers_pairwise, data, len);
11072
11073 for (i = 0; i < settings->n_ciphers_pairwise; i++)
11074 if (!cfg80211_supported_cipher_suite(
11075 &rdev->wiphy,
11076 settings->ciphers_pairwise[i]))
11077 return -EINVAL;
11078 }
11079
11080 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
11081 settings->cipher_group =
11082 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
11083 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
11084 settings->cipher_group))
11085 return -EINVAL;
11086 }
11087
11088 if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
11089 settings->wpa_versions =
11090 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
11091
11092 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
11093 void *data;
11094 int len;
11095
11096 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
11097 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
11098 settings->n_akm_suites = len / sizeof(u32);
11099
11100 if (len % sizeof(u32))
11101 return -EINVAL;
11102
11103 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
11104 return -EINVAL;
11105
11106 memcpy(settings->akm_suites, data, len);
11107 }
11108
11109 if (info->attrs[NL80211_ATTR_PMK]) {
11110 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
11111 return -EINVAL;
11112 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11113 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
11114 !wiphy_ext_feature_isset(&rdev->wiphy,
11115 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
11116 return -EINVAL;
11117 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11118 }
11119
11120 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
11121 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11122 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
11123 !wiphy_ext_feature_isset(&rdev->wiphy,
11124 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
11125 return -EINVAL;
11126 settings->sae_pwd =
11127 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11128 settings->sae_pwd_len =
11129 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11130 }
11131
11132 settings->sae_pwe =
11133 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
11134 NL80211_SAE_PWE_UNSPECIFIED);
11135
11136 return 0;
11137}
11138
11139static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
11140 const u8 *ssid, int ssid_len,
11141 struct nlattr **attrs,
11142 int assoc_link_id, int link_id)
11143{
11144 struct ieee80211_channel *chan;
11145 struct cfg80211_bss *bss;
11146 const u8 *bssid;
11147 u32 freq, use_for = 0;
11148
11149 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
11150 return ERR_PTR(-EINVAL);
11151
11152 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
11153
11154 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
11155 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11156 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11157
11158 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11159 if (!chan)
11160 return ERR_PTR(-EINVAL);
11161
11162 if (assoc_link_id >= 0)
11163 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
11164 if (assoc_link_id == link_id)
11165 use_for |= NL80211_BSS_USE_FOR_NORMAL;
11166
11167 bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
11168 ssid, ssid_len,
11169 IEEE80211_BSS_TYPE_ESS,
11170 IEEE80211_PRIVACY_ANY,
11171 use_for);
11172 if (!bss)
11173 return ERR_PTR(-ENOENT);
11174
11175 return bss;
11176}
11177
11178static int nl80211_process_links(struct cfg80211_registered_device *rdev,
11179 struct cfg80211_assoc_link *links,
11180 int assoc_link_id,
11181 const u8 *ssid, int ssid_len,
11182 struct genl_info *info)
11183{
11184 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
11185 struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
11186 struct nlattr *link;
11187 unsigned int link_id;
11188 int rem, err;
11189
11190 if (!attrs)
11191 return -ENOMEM;
11192
11193 nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
11194 memset(attrs, 0, attrsize);
11195
11196 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
11197
11198 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11199 NL_SET_BAD_ATTR(info->extack, link);
11200 return -EINVAL;
11201 }
11202
11203 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11204 /* cannot use the same link ID again */
11205 if (links[link_id].bss) {
11206 NL_SET_BAD_ATTR(info->extack, link);
11207 return -EINVAL;
11208 }
11209 links[link_id].bss =
11210 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
11211 assoc_link_id, link_id);
11212 if (IS_ERR(links[link_id].bss)) {
11213 err = PTR_ERR(links[link_id].bss);
11214 links[link_id].bss = NULL;
11215 NL_SET_ERR_MSG_ATTR(info->extack, link,
11216 "Error fetching BSS for link");
11217 return err;
11218 }
11219
11220 if (attrs[NL80211_ATTR_IE]) {
11221 links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
11222 links[link_id].elems_len =
11223 nla_len(attrs[NL80211_ATTR_IE]);
11224
11225 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11226 links[link_id].elems,
11227 links[link_id].elems_len)) {
11228 NL_SET_ERR_MSG_ATTR(info->extack,
11229 attrs[NL80211_ATTR_IE],
11230 "cannot deal with fragmentation");
11231 return -EINVAL;
11232 }
11233
11234 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11235 links[link_id].elems,
11236 links[link_id].elems_len)) {
11237 NL_SET_ERR_MSG_ATTR(info->extack,
11238 attrs[NL80211_ATTR_IE],
11239 "cannot deal with non-inheritance");
11240 return -EINVAL;
11241 }
11242 }
11243
11244 links[link_id].disabled =
11245 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11246 }
11247
11248 return 0;
11249}
11250
11251static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
11252{
11253 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11254 struct net_device *dev = info->user_ptr[1];
11255 struct cfg80211_assoc_request req = {};
11256 const u8 *ap_addr, *ssid;
11257 unsigned int link_id;
11258 int err, ssid_len;
11259
11260 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11261 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11262 return -EPERM;
11263
11264 if (!info->attrs[NL80211_ATTR_SSID])
11265 return -EINVAL;
11266
11267 if (!rdev->ops->assoc)
11268 return -EOPNOTSUPP;
11269
11270 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11271 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11272 return -EOPNOTSUPP;
11273
11274 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11275 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11276
11277 if (info->attrs[NL80211_ATTR_IE]) {
11278 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11279 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11280
11281 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11282 req.ie, req.ie_len)) {
11283 NL_SET_ERR_MSG_ATTR(info->extack,
11284 info->attrs[NL80211_ATTR_IE],
11285 "non-inheritance makes no sense");
11286 return -EINVAL;
11287 }
11288 }
11289
11290 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11291 enum nl80211_mfp mfp =
11292 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11293 if (mfp == NL80211_MFP_REQUIRED)
11294 req.use_mfp = true;
11295 else if (mfp != NL80211_MFP_NO)
11296 return -EINVAL;
11297 }
11298
11299 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11300 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11301
11302 if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11303 req.supported_selectors =
11304 nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11305 req.supported_selectors_len =
11306 nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11307 }
11308
11309 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11310 req.flags |= ASSOC_REQ_DISABLE_HT;
11311
11312 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11313 memcpy(&req.ht_capa_mask,
11314 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11315 sizeof(req.ht_capa_mask));
11316
11317 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11318 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11319 return -EINVAL;
11320 memcpy(&req.ht_capa,
11321 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11322 sizeof(req.ht_capa));
11323 }
11324
11325 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11326 req.flags |= ASSOC_REQ_DISABLE_VHT;
11327
11328 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11329 req.flags |= ASSOC_REQ_DISABLE_HE;
11330
11331 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11332 req.flags |= ASSOC_REQ_DISABLE_EHT;
11333
11334 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11335 memcpy(&req.vht_capa_mask,
11336 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11337 sizeof(req.vht_capa_mask));
11338
11339 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11340 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11341 return -EINVAL;
11342 memcpy(&req.vht_capa,
11343 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11344 sizeof(req.vht_capa));
11345 }
11346
11347 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11348 if (!((rdev->wiphy.features &
11349 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11350 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11351 !wiphy_ext_feature_isset(&rdev->wiphy,
11352 NL80211_EXT_FEATURE_RRM))
11353 return -EINVAL;
11354 req.flags |= ASSOC_REQ_USE_RRM;
11355 }
11356
11357 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11358 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11359 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11360 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11361 return -EINVAL;
11362 req.fils_nonces =
11363 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11364 }
11365
11366 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11367 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11368 return -EINVAL;
11369 memcpy(&req.s1g_capa_mask,
11370 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11371 sizeof(req.s1g_capa_mask));
11372 }
11373
11374 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11375 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11376 return -EINVAL;
11377 memcpy(&req.s1g_capa,
11378 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11379 sizeof(req.s1g_capa));
11380 }
11381
11382 if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
11383 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11384 NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
11385 GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
11386 return -EINVAL;
11387 }
11388 req.flags |= ASSOC_REQ_SPP_AMSDU;
11389 }
11390
11391 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11392
11393 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11394 if (req.link_id < 0)
11395 return -EINVAL;
11396
11397 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11398 return -EINVAL;
11399
11400 if (info->attrs[NL80211_ATTR_MAC] ||
11401 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11402 !info->attrs[NL80211_ATTR_MLD_ADDR])
11403 return -EINVAL;
11404
11405 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11406 ap_addr = req.ap_mld_addr;
11407
11408 err = nl80211_process_links(rdev, req.links, req.link_id,
11409 ssid, ssid_len, info);
11410 if (err)
11411 goto free;
11412
11413 if (!req.links[req.link_id].bss) {
11414 err = -EINVAL;
11415 goto free;
11416 }
11417
11418 if (req.links[req.link_id].elems_len) {
11419 GENL_SET_ERR_MSG(info,
11420 "cannot have per-link elems on assoc link");
11421 err = -EINVAL;
11422 goto free;
11423 }
11424
11425 if (req.links[req.link_id].disabled) {
11426 GENL_SET_ERR_MSG(info,
11427 "cannot have assoc link disabled");
11428 err = -EINVAL;
11429 goto free;
11430 }
11431
11432 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11433 req.ext_mld_capa_ops =
11434 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
11435 } else {
11436 if (req.link_id >= 0)
11437 return -EINVAL;
11438
11439 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
11440 -1, -1);
11441 if (IS_ERR(req.bss))
11442 return PTR_ERR(req.bss);
11443 ap_addr = req.bss->bssid;
11444
11445 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11446 return -EINVAL;
11447 }
11448
11449 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11450 if (!err) {
11451 struct nlattr *link;
11452 int rem = 0;
11453
11454 err = cfg80211_mlme_assoc(rdev, dev, &req,
11455 info->extack);
11456
11457 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11458 dev->ieee80211_ptr->conn_owner_nlportid =
11459 info->snd_portid;
11460 memcpy(dev->ieee80211_ptr->disconnect_bssid,
11461 ap_addr, ETH_ALEN);
11462 }
11463
11464 /* Report error from first problematic link */
11465 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11466 nla_for_each_nested(link,
11467 info->attrs[NL80211_ATTR_MLO_LINKS],
11468 rem) {
11469 struct nlattr *link_id_attr =
11470 nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
11471
11472 if (!link_id_attr)
11473 continue;
11474
11475 link_id = nla_get_u8(link_id_attr);
11476
11477 if (link_id == req.link_id)
11478 continue;
11479
11480 if (!req.links[link_id].error ||
11481 WARN_ON(req.links[link_id].error > 0))
11482 continue;
11483
11484 WARN_ON(err >= 0);
11485
11486 NL_SET_BAD_ATTR(info->extack, link);
11487 err = req.links[link_id].error;
11488 break;
11489 }
11490 }
11491 }
11492
11493free:
11494 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11495 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11496 cfg80211_put_bss(&rdev->wiphy, req.bss);
11497
11498 return err;
11499}
11500
11501static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11502{
11503 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11504 struct net_device *dev = info->user_ptr[1];
11505 const u8 *ie = NULL, *bssid;
11506 int ie_len = 0;
11507 u16 reason_code;
11508 bool local_state_change;
11509
11510 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11511 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11512 return -EPERM;
11513
11514 if (!info->attrs[NL80211_ATTR_MAC])
11515 return -EINVAL;
11516
11517 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11518 return -EINVAL;
11519
11520 if (!rdev->ops->deauth)
11521 return -EOPNOTSUPP;
11522
11523 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11524 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11525 return -EOPNOTSUPP;
11526
11527 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11528
11529 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11530 if (reason_code == 0) {
11531 /* Reason Code 0 is reserved */
11532 return -EINVAL;
11533 }
11534
11535 if (info->attrs[NL80211_ATTR_IE]) {
11536 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11537 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11538 }
11539
11540 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11541
11542 return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11543 local_state_change);
11544}
11545
11546static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11547{
11548 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11549 struct net_device *dev = info->user_ptr[1];
11550 const u8 *ie = NULL, *bssid;
11551 int ie_len = 0;
11552 u16 reason_code;
11553 bool local_state_change;
11554
11555 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11556 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11557 return -EPERM;
11558
11559 if (!info->attrs[NL80211_ATTR_MAC])
11560 return -EINVAL;
11561
11562 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11563 return -EINVAL;
11564
11565 if (!rdev->ops->disassoc)
11566 return -EOPNOTSUPP;
11567
11568 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11569 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11570 return -EOPNOTSUPP;
11571
11572 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11573
11574 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11575 if (reason_code == 0) {
11576 /* Reason Code 0 is reserved */
11577 return -EINVAL;
11578 }
11579
11580 if (info->attrs[NL80211_ATTR_IE]) {
11581 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11582 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11583 }
11584
11585 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11586
11587 return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11588 local_state_change);
11589}
11590
11591static bool
11592nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11593 int mcast_rate[NUM_NL80211_BANDS],
11594 int rateval)
11595{
11596 struct wiphy *wiphy = &rdev->wiphy;
11597 bool found = false;
11598 int band, i;
11599
11600 for (band = 0; band < NUM_NL80211_BANDS; band++) {
11601 struct ieee80211_supported_band *sband;
11602
11603 sband = wiphy->bands[band];
11604 if (!sband)
11605 continue;
11606
11607 for (i = 0; i < sband->n_bitrates; i++) {
11608 if (sband->bitrates[i].bitrate == rateval) {
11609 mcast_rate[band] = i + 1;
11610 found = true;
11611 break;
11612 }
11613 }
11614 }
11615
11616 return found;
11617}
11618
11619static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11620{
11621 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11622 struct net_device *dev = info->user_ptr[1];
11623 struct cfg80211_ibss_params ibss;
11624 struct wiphy *wiphy;
11625 struct cfg80211_cached_keys *connkeys = NULL;
11626 int err;
11627
11628 memset(&ibss, 0, sizeof(ibss));
11629
11630 if (!info->attrs[NL80211_ATTR_SSID] ||
11631 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11632 return -EINVAL;
11633
11634 ibss.beacon_interval = 100;
11635
11636 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11637 ibss.beacon_interval =
11638 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11639
11640 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11641 ibss.beacon_interval);
11642 if (err)
11643 return err;
11644
11645 if (!rdev->ops->join_ibss)
11646 return -EOPNOTSUPP;
11647
11648 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11649 return -EOPNOTSUPP;
11650
11651 wiphy = &rdev->wiphy;
11652
11653 if (info->attrs[NL80211_ATTR_MAC]) {
11654 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11655
11656 if (!is_valid_ether_addr(ibss.bssid))
11657 return -EINVAL;
11658 }
11659 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11660 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11661
11662 if (info->attrs[NL80211_ATTR_IE]) {
11663 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11664 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11665 }
11666
11667 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11668 if (err)
11669 return err;
11670
11671 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11672 NL80211_IFTYPE_ADHOC))
11673 return -EINVAL;
11674
11675 switch (ibss.chandef.width) {
11676 case NL80211_CHAN_WIDTH_5:
11677 case NL80211_CHAN_WIDTH_10:
11678 case NL80211_CHAN_WIDTH_20_NOHT:
11679 break;
11680 case NL80211_CHAN_WIDTH_20:
11681 case NL80211_CHAN_WIDTH_40:
11682 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11683 return -EINVAL;
11684 break;
11685 case NL80211_CHAN_WIDTH_80:
11686 case NL80211_CHAN_WIDTH_80P80:
11687 case NL80211_CHAN_WIDTH_160:
11688 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11689 return -EINVAL;
11690 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11691 NL80211_EXT_FEATURE_VHT_IBSS))
11692 return -EINVAL;
11693 break;
11694 case NL80211_CHAN_WIDTH_320:
11695 return -EINVAL;
11696 default:
11697 return -EINVAL;
11698 }
11699
11700 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11701 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11702
11703 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11704 u8 *rates =
11705 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11706 int n_rates =
11707 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11708 struct ieee80211_supported_band *sband =
11709 wiphy->bands[ibss.chandef.chan->band];
11710
11711 err = ieee80211_get_ratemask(sband, rates, n_rates,
11712 &ibss.basic_rates);
11713 if (err)
11714 return err;
11715 }
11716
11717 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11718 memcpy(&ibss.ht_capa_mask,
11719 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11720 sizeof(ibss.ht_capa_mask));
11721
11722 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11723 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11724 return -EINVAL;
11725 memcpy(&ibss.ht_capa,
11726 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11727 sizeof(ibss.ht_capa));
11728 }
11729
11730 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11731 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11732 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11733 return -EINVAL;
11734
11735 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11736 bool no_ht = false;
11737
11738 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11739 if (IS_ERR(connkeys))
11740 return PTR_ERR(connkeys);
11741
11742 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11743 no_ht) {
11744 kfree_sensitive(connkeys);
11745 return -EINVAL;
11746 }
11747 }
11748
11749 ibss.control_port =
11750 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11751
11752 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11753 int r = validate_pae_over_nl80211(rdev, info);
11754
11755 if (r < 0) {
11756 kfree_sensitive(connkeys);
11757 return r;
11758 }
11759
11760 ibss.control_port_over_nl80211 = true;
11761 }
11762
11763 ibss.userspace_handles_dfs =
11764 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11765
11766 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11767 if (err)
11768 kfree_sensitive(connkeys);
11769 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11770 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11771
11772 return err;
11773}
11774
11775static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11776{
11777 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11778 struct net_device *dev = info->user_ptr[1];
11779
11780 if (!rdev->ops->leave_ibss)
11781 return -EOPNOTSUPP;
11782
11783 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11784 return -EOPNOTSUPP;
11785
11786 return cfg80211_leave_ibss(rdev, dev, false);
11787}
11788
11789static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11790{
11791 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11792 struct net_device *dev = info->user_ptr[1];
11793 int mcast_rate[NUM_NL80211_BANDS];
11794 u32 nla_rate;
11795
11796 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11797 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11798 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11799 return -EOPNOTSUPP;
11800
11801 if (!rdev->ops->set_mcast_rate)
11802 return -EOPNOTSUPP;
11803
11804 memset(mcast_rate, 0, sizeof(mcast_rate));
11805
11806 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11807 return -EINVAL;
11808
11809 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11810 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11811 return -EINVAL;
11812
11813 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11814}
11815
11816static struct sk_buff *
11817__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11818 struct wireless_dev *wdev, int approxlen,
11819 u32 portid, u32 seq, enum nl80211_commands cmd,
11820 enum nl80211_attrs attr,
11821 const struct nl80211_vendor_cmd_info *info,
11822 gfp_t gfp)
11823{
11824 struct sk_buff *skb;
11825 void *hdr;
11826 struct nlattr *data;
11827
11828 skb = nlmsg_new(approxlen + 100, gfp);
11829 if (!skb)
11830 return NULL;
11831
11832 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11833 if (!hdr) {
11834 kfree_skb(skb);
11835 return NULL;
11836 }
11837
11838 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11839 goto nla_put_failure;
11840
11841 if (info) {
11842 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11843 info->vendor_id))
11844 goto nla_put_failure;
11845 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11846 info->subcmd))
11847 goto nla_put_failure;
11848 }
11849
11850 if (wdev) {
11851 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11852 wdev_id(wdev), NL80211_ATTR_PAD))
11853 goto nla_put_failure;
11854 if (wdev->netdev &&
11855 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11856 wdev->netdev->ifindex))
11857 goto nla_put_failure;
11858 }
11859
11860 data = nla_nest_start_noflag(skb, attr);
11861 if (!data)
11862 goto nla_put_failure;
11863
11864 ((void **)skb->cb)[0] = rdev;
11865 ((void **)skb->cb)[1] = hdr;
11866 ((void **)skb->cb)[2] = data;
11867
11868 return skb;
11869
11870 nla_put_failure:
11871 kfree_skb(skb);
11872 return NULL;
11873}
11874
11875struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11876 struct wireless_dev *wdev,
11877 enum nl80211_commands cmd,
11878 enum nl80211_attrs attr,
11879 unsigned int portid,
11880 int vendor_event_idx,
11881 int approxlen, gfp_t gfp)
11882{
11883 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11884 const struct nl80211_vendor_cmd_info *info;
11885
11886 switch (cmd) {
11887 case NL80211_CMD_TESTMODE:
11888 if (WARN_ON(vendor_event_idx != -1))
11889 return NULL;
11890 info = NULL;
11891 break;
11892 case NL80211_CMD_VENDOR:
11893 if (WARN_ON(vendor_event_idx < 0 ||
11894 vendor_event_idx >= wiphy->n_vendor_events))
11895 return NULL;
11896 info = &wiphy->vendor_events[vendor_event_idx];
11897 break;
11898 default:
11899 WARN_ON(1);
11900 return NULL;
11901 }
11902
11903 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11904 cmd, attr, info, gfp);
11905}
11906EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11907
11908void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11909{
11910 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11911 void *hdr = ((void **)skb->cb)[1];
11912 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11913 struct nlattr *data = ((void **)skb->cb)[2];
11914 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11915
11916 /* clear CB data for netlink core to own from now on */
11917 memset(skb->cb, 0, sizeof(skb->cb));
11918
11919 nla_nest_end(skb, data);
11920 genlmsg_end(skb, hdr);
11921
11922 if (nlhdr->nlmsg_pid) {
11923 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11924 nlhdr->nlmsg_pid);
11925 } else {
11926 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11927 mcgrp = NL80211_MCGRP_VENDOR;
11928
11929 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11930 skb, 0, mcgrp, gfp);
11931 }
11932}
11933EXPORT_SYMBOL(__cfg80211_send_event_skb);
11934
11935#ifdef CONFIG_NL80211_TESTMODE
11936static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11937{
11938 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11939 struct wireless_dev *wdev;
11940 int err;
11941
11942 lockdep_assert_held(&rdev->wiphy.mtx);
11943
11944 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11945 info->attrs);
11946
11947 if (!rdev->ops->testmode_cmd)
11948 return -EOPNOTSUPP;
11949
11950 if (IS_ERR(wdev)) {
11951 err = PTR_ERR(wdev);
11952 if (err != -EINVAL)
11953 return err;
11954 wdev = NULL;
11955 } else if (wdev->wiphy != &rdev->wiphy) {
11956 return -EINVAL;
11957 }
11958
11959 if (!info->attrs[NL80211_ATTR_TESTDATA])
11960 return -EINVAL;
11961
11962 rdev->cur_cmd_info = info;
11963 err = rdev_testmode_cmd(rdev, wdev,
11964 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11965 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11966 rdev->cur_cmd_info = NULL;
11967
11968 return err;
11969}
11970
11971static int nl80211_testmode_dump(struct sk_buff *skb,
11972 struct netlink_callback *cb)
11973{
11974 struct cfg80211_registered_device *rdev;
11975 struct nlattr **attrbuf = NULL;
11976 int err;
11977 long phy_idx;
11978 void *data = NULL;
11979 int data_len = 0;
11980
11981 rtnl_lock();
11982
11983 if (cb->args[0]) {
11984 /*
11985 * 0 is a valid index, but not valid for args[0],
11986 * so we need to offset by 1.
11987 */
11988 phy_idx = cb->args[0] - 1;
11989
11990 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11991 if (!rdev) {
11992 err = -ENOENT;
11993 goto out_err;
11994 }
11995 } else {
11996 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11997 GFP_KERNEL);
11998 if (!attrbuf) {
11999 err = -ENOMEM;
12000 goto out_err;
12001 }
12002
12003 err = nlmsg_parse_deprecated(cb->nlh,
12004 GENL_HDRLEN + nl80211_fam.hdrsize,
12005 attrbuf, nl80211_fam.maxattr,
12006 nl80211_policy, NULL);
12007 if (err)
12008 goto out_err;
12009
12010 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12011 if (IS_ERR(rdev)) {
12012 err = PTR_ERR(rdev);
12013 goto out_err;
12014 }
12015 phy_idx = rdev->wiphy_idx;
12016
12017 if (attrbuf[NL80211_ATTR_TESTDATA])
12018 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
12019 }
12020
12021 if (cb->args[1]) {
12022 data = nla_data((void *)cb->args[1]);
12023 data_len = nla_len((void *)cb->args[1]);
12024 }
12025
12026 if (!rdev->ops->testmode_dump) {
12027 err = -EOPNOTSUPP;
12028 goto out_err;
12029 }
12030
12031 while (1) {
12032 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12033 cb->nlh->nlmsg_seq, NLM_F_MULTI,
12034 NL80211_CMD_TESTMODE);
12035 struct nlattr *tmdata;
12036
12037 if (!hdr)
12038 break;
12039
12040 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
12041 genlmsg_cancel(skb, hdr);
12042 break;
12043 }
12044
12045 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
12046 if (!tmdata) {
12047 genlmsg_cancel(skb, hdr);
12048 break;
12049 }
12050 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
12051 nla_nest_end(skb, tmdata);
12052
12053 if (err == -ENOBUFS || err == -ENOENT) {
12054 genlmsg_cancel(skb, hdr);
12055 break;
12056 } else if (err) {
12057 genlmsg_cancel(skb, hdr);
12058 goto out_err;
12059 }
12060
12061 genlmsg_end(skb, hdr);
12062 }
12063
12064 err = skb->len;
12065 /* see above */
12066 cb->args[0] = phy_idx + 1;
12067 out_err:
12068 kfree(attrbuf);
12069 rtnl_unlock();
12070 return err;
12071}
12072#endif
12073
12074static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
12075{
12076 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12077 struct net_device *dev = info->user_ptr[1];
12078 struct cfg80211_connect_params connect;
12079 struct wiphy *wiphy;
12080 struct cfg80211_cached_keys *connkeys = NULL;
12081 u32 freq = 0;
12082 int err;
12083
12084 memset(&connect, 0, sizeof(connect));
12085
12086 if (!info->attrs[NL80211_ATTR_SSID] ||
12087 !nla_len(info->attrs[NL80211_ATTR_SSID]))
12088 return -EINVAL;
12089
12090 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12091 connect.auth_type =
12092 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12093 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
12094 NL80211_CMD_CONNECT))
12095 return -EINVAL;
12096 } else
12097 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
12098
12099 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
12100
12101 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
12102 !wiphy_ext_feature_isset(&rdev->wiphy,
12103 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12104 return -EINVAL;
12105 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
12106
12107 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
12108 NL80211_MAX_NR_CIPHER_SUITES);
12109 if (err)
12110 return err;
12111
12112 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12113 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12114 return -EOPNOTSUPP;
12115
12116 wiphy = &rdev->wiphy;
12117
12118 connect.bg_scan_period = -1;
12119 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
12120 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
12121 connect.bg_scan_period =
12122 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
12123 }
12124
12125 if (info->attrs[NL80211_ATTR_MAC])
12126 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12127 else if (info->attrs[NL80211_ATTR_MAC_HINT])
12128 connect.bssid_hint =
12129 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
12130 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12131 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12132
12133 if (info->attrs[NL80211_ATTR_IE]) {
12134 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12135 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12136 }
12137
12138 if (info->attrs[NL80211_ATTR_USE_MFP]) {
12139 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12140 if (connect.mfp == NL80211_MFP_OPTIONAL &&
12141 !wiphy_ext_feature_isset(&rdev->wiphy,
12142 NL80211_EXT_FEATURE_MFP_OPTIONAL))
12143 return -EOPNOTSUPP;
12144 } else {
12145 connect.mfp = NL80211_MFP_NO;
12146 }
12147
12148 if (info->attrs[NL80211_ATTR_PREV_BSSID])
12149 connect.prev_bssid =
12150 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12151
12152 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
12153 freq = MHZ_TO_KHZ(nla_get_u32(
12154 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
12155 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12156 freq +=
12157 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12158
12159 if (freq) {
12160 connect.channel = nl80211_get_valid_chan(wiphy, freq);
12161 if (!connect.channel)
12162 return -EINVAL;
12163 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
12164 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
12165 freq = MHZ_TO_KHZ(freq);
12166 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
12167 if (!connect.channel_hint)
12168 return -EINVAL;
12169 }
12170
12171 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
12172 connect.edmg.channels =
12173 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
12174
12175 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
12176 connect.edmg.bw_config =
12177 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
12178 }
12179
12180 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12181 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
12182 if (IS_ERR(connkeys))
12183 return PTR_ERR(connkeys);
12184 }
12185
12186 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12187 connect.flags |= ASSOC_REQ_DISABLE_HT;
12188
12189 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12190 memcpy(&connect.ht_capa_mask,
12191 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12192 sizeof(connect.ht_capa_mask));
12193
12194 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12195 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
12196 kfree_sensitive(connkeys);
12197 return -EINVAL;
12198 }
12199 memcpy(&connect.ht_capa,
12200 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12201 sizeof(connect.ht_capa));
12202 }
12203
12204 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12205 connect.flags |= ASSOC_REQ_DISABLE_VHT;
12206
12207 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12208 connect.flags |= ASSOC_REQ_DISABLE_HE;
12209
12210 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12211 connect.flags |= ASSOC_REQ_DISABLE_EHT;
12212
12213 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12214 memcpy(&connect.vht_capa_mask,
12215 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12216 sizeof(connect.vht_capa_mask));
12217
12218 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12219 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
12220 kfree_sensitive(connkeys);
12221 return -EINVAL;
12222 }
12223 memcpy(&connect.vht_capa,
12224 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12225 sizeof(connect.vht_capa));
12226 }
12227
12228 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12229 if (!((rdev->wiphy.features &
12230 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12231 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12232 !wiphy_ext_feature_isset(&rdev->wiphy,
12233 NL80211_EXT_FEATURE_RRM)) {
12234 kfree_sensitive(connkeys);
12235 return -EINVAL;
12236 }
12237 connect.flags |= ASSOC_REQ_USE_RRM;
12238 }
12239
12240 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
12241 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
12242 kfree_sensitive(connkeys);
12243 return -EOPNOTSUPP;
12244 }
12245
12246 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
12247 /* bss selection makes no sense if bssid is set */
12248 if (connect.bssid) {
12249 kfree_sensitive(connkeys);
12250 return -EINVAL;
12251 }
12252
12253 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
12254 wiphy, &connect.bss_select);
12255 if (err) {
12256 kfree_sensitive(connkeys);
12257 return err;
12258 }
12259 }
12260
12261 if (wiphy_ext_feature_isset(&rdev->wiphy,
12262 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
12263 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12264 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12265 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12266 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12267 connect.fils_erp_username =
12268 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12269 connect.fils_erp_username_len =
12270 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12271 connect.fils_erp_realm =
12272 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12273 connect.fils_erp_realm_len =
12274 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12275 connect.fils_erp_next_seq_num =
12276 nla_get_u16(
12277 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12278 connect.fils_erp_rrk =
12279 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12280 connect.fils_erp_rrk_len =
12281 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12282 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12283 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12284 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12285 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12286 kfree_sensitive(connkeys);
12287 return -EINVAL;
12288 }
12289
12290 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12291 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12292 kfree_sensitive(connkeys);
12293 GENL_SET_ERR_MSG(info,
12294 "external auth requires connection ownership");
12295 return -EINVAL;
12296 }
12297 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12298 }
12299
12300 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12301 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12302
12303 err = cfg80211_connect(rdev, dev, &connect, connkeys,
12304 connect.prev_bssid);
12305 if (err)
12306 kfree_sensitive(connkeys);
12307
12308 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12309 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12310 if (connect.bssid)
12311 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12312 connect.bssid, ETH_ALEN);
12313 else
12314 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12315 }
12316
12317 return err;
12318}
12319
12320static int nl80211_update_connect_params(struct sk_buff *skb,
12321 struct genl_info *info)
12322{
12323 struct cfg80211_connect_params connect = {};
12324 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12325 struct net_device *dev = info->user_ptr[1];
12326 struct wireless_dev *wdev = dev->ieee80211_ptr;
12327 bool fils_sk_offload;
12328 u32 auth_type;
12329 u32 changed = 0;
12330
12331 if (!rdev->ops->update_connect_params)
12332 return -EOPNOTSUPP;
12333
12334 if (info->attrs[NL80211_ATTR_IE]) {
12335 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12336 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12337 changed |= UPDATE_ASSOC_IES;
12338 }
12339
12340 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12341 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12342
12343 /*
12344 * when driver supports fils-sk offload all attributes must be
12345 * provided. So the else covers "fils-sk-not-all" and
12346 * "no-fils-sk-any".
12347 */
12348 if (fils_sk_offload &&
12349 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12350 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12351 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12352 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12353 connect.fils_erp_username =
12354 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12355 connect.fils_erp_username_len =
12356 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12357 connect.fils_erp_realm =
12358 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12359 connect.fils_erp_realm_len =
12360 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12361 connect.fils_erp_next_seq_num =
12362 nla_get_u16(
12363 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12364 connect.fils_erp_rrk =
12365 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12366 connect.fils_erp_rrk_len =
12367 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12368 changed |= UPDATE_FILS_ERP_INFO;
12369 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12370 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12371 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12372 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12373 return -EINVAL;
12374 }
12375
12376 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12377 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12378 if (!nl80211_valid_auth_type(rdev, auth_type,
12379 NL80211_CMD_CONNECT))
12380 return -EINVAL;
12381
12382 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12383 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12384 return -EINVAL;
12385
12386 connect.auth_type = auth_type;
12387 changed |= UPDATE_AUTH_TYPE;
12388 }
12389
12390 if (!wdev->connected)
12391 return -ENOLINK;
12392
12393 return rdev_update_connect_params(rdev, dev, &connect, changed);
12394}
12395
12396static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12397{
12398 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12399 struct net_device *dev = info->user_ptr[1];
12400 u16 reason;
12401
12402 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12403 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12404 return -EPERM;
12405
12406 reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
12407 WLAN_REASON_DEAUTH_LEAVING);
12408
12409 if (reason == 0)
12410 return -EINVAL;
12411
12412 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12413 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12414 return -EOPNOTSUPP;
12415
12416 return cfg80211_disconnect(rdev, dev, reason, true);
12417}
12418
12419static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12420{
12421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12422 struct net *net;
12423 int err;
12424
12425 if (info->attrs[NL80211_ATTR_PID]) {
12426 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12427
12428 net = get_net_ns_by_pid(pid);
12429 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12430 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12431
12432 net = get_net_ns_by_fd(fd);
12433 } else {
12434 return -EINVAL;
12435 }
12436
12437 if (IS_ERR(net))
12438 return PTR_ERR(net);
12439
12440 err = 0;
12441
12442 /* check if anything to do */
12443 if (!net_eq(wiphy_net(&rdev->wiphy), net))
12444 err = cfg80211_switch_netns(rdev, net);
12445
12446 put_net(net);
12447 return err;
12448}
12449
12450static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
12451{
12452 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12453 struct net_device *dev = info->user_ptr[1];
12454 struct cfg80211_pmksa pmksa;
12455 bool ap_pmksa_caching_support = false;
12456
12457 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12458
12459 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12460 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12461
12462 if (!info->attrs[NL80211_ATTR_PMKID])
12463 return -EINVAL;
12464
12465 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12466
12467 if (info->attrs[NL80211_ATTR_MAC]) {
12468 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12469 } else if (info->attrs[NL80211_ATTR_SSID] &&
12470 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12471 info->attrs[NL80211_ATTR_PMK]) {
12472 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12473 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12474 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12475 } else {
12476 return -EINVAL;
12477 }
12478
12479 if (info->attrs[NL80211_ATTR_PMK]) {
12480 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12481 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12482 }
12483
12484 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12485 pmksa.pmk_lifetime =
12486 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12487
12488 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12489 pmksa.pmk_reauth_threshold =
12490 nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12491
12492 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12493 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12494 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12495 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12496 ap_pmksa_caching_support))
12497 return -EOPNOTSUPP;
12498
12499 if (!rdev->ops->set_pmksa)
12500 return -EOPNOTSUPP;
12501
12502 return rdev_set_pmksa(rdev, dev, &pmksa);
12503}
12504
12505static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
12506{
12507 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12508 struct net_device *dev = info->user_ptr[1];
12509 struct cfg80211_pmksa pmksa;
12510 bool sae_offload_support = false;
12511 bool owe_offload_support = false;
12512 bool ap_pmksa_caching_support = false;
12513
12514 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12515
12516 sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12517 NL80211_EXT_FEATURE_SAE_OFFLOAD);
12518 owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12519 NL80211_EXT_FEATURE_OWE_OFFLOAD);
12520 ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12521 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12522
12523 if (info->attrs[NL80211_ATTR_PMKID])
12524 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12525
12526 if (info->attrs[NL80211_ATTR_MAC]) {
12527 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12528 } else if (info->attrs[NL80211_ATTR_SSID]) {
12529 /* SSID based pmksa flush supported only for FILS,
12530 * OWE/SAE OFFLOAD cases
12531 */
12532 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12533 info->attrs[NL80211_ATTR_PMK]) {
12534 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12535 } else if (!sae_offload_support && !owe_offload_support) {
12536 return -EINVAL;
12537 }
12538 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12539 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12540 } else {
12541 return -EINVAL;
12542 }
12543
12544 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12545 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12546 !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12547 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12548 ap_pmksa_caching_support))
12549 return -EOPNOTSUPP;
12550
12551 if (!rdev->ops->del_pmksa)
12552 return -EOPNOTSUPP;
12553
12554 return rdev_del_pmksa(rdev, dev, &pmksa);
12555}
12556
12557static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12558{
12559 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12560 struct net_device *dev = info->user_ptr[1];
12561
12562 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12563 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12564 return -EOPNOTSUPP;
12565
12566 if (!rdev->ops->flush_pmksa)
12567 return -EOPNOTSUPP;
12568
12569 return rdev_flush_pmksa(rdev, dev);
12570}
12571
12572static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12573{
12574 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12575 struct net_device *dev = info->user_ptr[1];
12576 u8 action_code, dialog_token;
12577 u32 peer_capability = 0;
12578 u16 status_code;
12579 u8 *peer;
12580 int link_id;
12581 bool initiator;
12582
12583 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12584 !rdev->ops->tdls_mgmt)
12585 return -EOPNOTSUPP;
12586
12587 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12588 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12589 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12590 !info->attrs[NL80211_ATTR_IE] ||
12591 !info->attrs[NL80211_ATTR_MAC])
12592 return -EINVAL;
12593
12594 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12595 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12596 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12597 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12598 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12599 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12600 peer_capability =
12601 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12602 link_id = nl80211_link_id_or_invalid(info->attrs);
12603
12604 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12605 dialog_token, status_code, peer_capability,
12606 initiator,
12607 nla_data(info->attrs[NL80211_ATTR_IE]),
12608 nla_len(info->attrs[NL80211_ATTR_IE]));
12609}
12610
12611static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12612{
12613 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12614 struct net_device *dev = info->user_ptr[1];
12615 enum nl80211_tdls_operation operation;
12616 u8 *peer;
12617
12618 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12619 !rdev->ops->tdls_oper)
12620 return -EOPNOTSUPP;
12621
12622 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12623 !info->attrs[NL80211_ATTR_MAC])
12624 return -EINVAL;
12625
12626 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12627 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12628
12629 return rdev_tdls_oper(rdev, dev, peer, operation);
12630}
12631
12632static int nl80211_remain_on_channel(struct sk_buff *skb,
12633 struct genl_info *info)
12634{
12635 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12636 unsigned int link_id = nl80211_link_id(info->attrs);
12637 struct wireless_dev *wdev = info->user_ptr[1];
12638 struct cfg80211_chan_def chandef;
12639 struct sk_buff *msg;
12640 void *hdr;
12641 u64 cookie;
12642 u32 duration;
12643 int err;
12644
12645 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12646 !info->attrs[NL80211_ATTR_DURATION])
12647 return -EINVAL;
12648
12649 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12650
12651 if (!rdev->ops->remain_on_channel ||
12652 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12653 return -EOPNOTSUPP;
12654
12655 /*
12656 * We should be on that channel for at least a minimum amount of
12657 * time (10ms) but no longer than the driver supports.
12658 */
12659 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12660 duration > rdev->wiphy.max_remain_on_channel_duration)
12661 return -EINVAL;
12662
12663 err = nl80211_parse_chandef(rdev, info, &chandef);
12664 if (err)
12665 return err;
12666
12667 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12668 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12669
12670 oper_chandef = wdev_chandef(wdev, link_id);
12671
12672 if (WARN_ON(!oper_chandef)) {
12673 /* cannot happen since we must beacon to get here */
12674 WARN_ON(1);
12675 return -EBUSY;
12676 }
12677
12678 /* note: returns first one if identical chandefs */
12679 compat_chandef = cfg80211_chandef_compatible(&chandef,
12680 oper_chandef);
12681
12682 if (compat_chandef != &chandef)
12683 return -EBUSY;
12684 }
12685
12686 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12687 if (!msg)
12688 return -ENOMEM;
12689
12690 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12691 NL80211_CMD_REMAIN_ON_CHANNEL);
12692 if (!hdr) {
12693 err = -ENOBUFS;
12694 goto free_msg;
12695 }
12696
12697 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12698 duration, &cookie);
12699
12700 if (err)
12701 goto free_msg;
12702
12703 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12704 NL80211_ATTR_PAD))
12705 goto nla_put_failure;
12706
12707 genlmsg_end(msg, hdr);
12708
12709 return genlmsg_reply(msg, info);
12710
12711 nla_put_failure:
12712 err = -ENOBUFS;
12713 free_msg:
12714 nlmsg_free(msg);
12715 return err;
12716}
12717
12718static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12719 struct genl_info *info)
12720{
12721 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12722 struct wireless_dev *wdev = info->user_ptr[1];
12723 u64 cookie;
12724
12725 if (!info->attrs[NL80211_ATTR_COOKIE])
12726 return -EINVAL;
12727
12728 if (!rdev->ops->cancel_remain_on_channel)
12729 return -EOPNOTSUPP;
12730
12731 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12732
12733 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12734}
12735
12736static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12737 struct genl_info *info)
12738{
12739 struct cfg80211_bitrate_mask mask;
12740 unsigned int link_id = nl80211_link_id(info->attrs);
12741 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12742 struct net_device *dev = info->user_ptr[1];
12743 int err;
12744
12745 if (!rdev->ops->set_bitrate_mask)
12746 return -EOPNOTSUPP;
12747
12748 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12749 NL80211_ATTR_TX_RATES, &mask,
12750 dev, true, link_id);
12751 if (err)
12752 return err;
12753
12754 return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12755}
12756
12757static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12758{
12759 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12760 struct wireless_dev *wdev = info->user_ptr[1];
12761 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12762
12763 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12764 return -EINVAL;
12765
12766 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12767 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12768
12769 switch (wdev->iftype) {
12770 case NL80211_IFTYPE_STATION:
12771 case NL80211_IFTYPE_ADHOC:
12772 case NL80211_IFTYPE_P2P_CLIENT:
12773 case NL80211_IFTYPE_AP:
12774 case NL80211_IFTYPE_AP_VLAN:
12775 case NL80211_IFTYPE_MESH_POINT:
12776 case NL80211_IFTYPE_P2P_GO:
12777 case NL80211_IFTYPE_P2P_DEVICE:
12778 break;
12779 case NL80211_IFTYPE_NAN:
12780 if (!wiphy_ext_feature_isset(wdev->wiphy,
12781 NL80211_EXT_FEATURE_SECURE_NAN))
12782 return -EOPNOTSUPP;
12783 break;
12784 default:
12785 return -EOPNOTSUPP;
12786 }
12787
12788 /* not much point in registering if we can't reply */
12789 if (!rdev->ops->mgmt_tx)
12790 return -EOPNOTSUPP;
12791
12792 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12793 !wiphy_ext_feature_isset(&rdev->wiphy,
12794 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12795 GENL_SET_ERR_MSG(info,
12796 "multicast RX registrations are not supported");
12797 return -EOPNOTSUPP;
12798 }
12799
12800 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12801 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12802 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12803 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12804 info->extack);
12805}
12806
12807static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12808{
12809 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12810 struct wireless_dev *wdev = info->user_ptr[1];
12811 struct cfg80211_chan_def chandef;
12812 int err;
12813 void *hdr = NULL;
12814 u64 cookie;
12815 struct sk_buff *msg = NULL;
12816 struct cfg80211_mgmt_tx_params params = {
12817 .dont_wait_for_ack =
12818 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12819 };
12820
12821 if (!info->attrs[NL80211_ATTR_FRAME])
12822 return -EINVAL;
12823
12824 if (!rdev->ops->mgmt_tx)
12825 return -EOPNOTSUPP;
12826
12827 switch (wdev->iftype) {
12828 case NL80211_IFTYPE_P2P_DEVICE:
12829 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12830 return -EINVAL;
12831 break;
12832 case NL80211_IFTYPE_STATION:
12833 case NL80211_IFTYPE_ADHOC:
12834 case NL80211_IFTYPE_P2P_CLIENT:
12835 case NL80211_IFTYPE_AP:
12836 case NL80211_IFTYPE_AP_VLAN:
12837 case NL80211_IFTYPE_MESH_POINT:
12838 case NL80211_IFTYPE_P2P_GO:
12839 break;
12840 case NL80211_IFTYPE_NAN:
12841 if (!wiphy_ext_feature_isset(wdev->wiphy,
12842 NL80211_EXT_FEATURE_SECURE_NAN))
12843 return -EOPNOTSUPP;
12844 break;
12845 default:
12846 return -EOPNOTSUPP;
12847 }
12848
12849 if (info->attrs[NL80211_ATTR_DURATION]) {
12850 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12851 return -EINVAL;
12852 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12853
12854 /*
12855 * We should wait on the channel for at least a minimum amount
12856 * of time (10ms) but no longer than the driver supports.
12857 */
12858 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12859 params.wait > rdev->wiphy.max_remain_on_channel_duration)
12860 return -EINVAL;
12861 }
12862
12863 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12864
12865 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12866 return -EINVAL;
12867
12868 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12869
12870 /* get the channel if any has been specified, otherwise pass NULL to
12871 * the driver. The latter will use the current one
12872 */
12873 chandef.chan = NULL;
12874 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12875 err = nl80211_parse_chandef(rdev, info, &chandef);
12876 if (err)
12877 return err;
12878 }
12879
12880 if (!chandef.chan && params.offchan)
12881 return -EINVAL;
12882
12883 if (params.offchan &&
12884 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
12885 return -EBUSY;
12886
12887 params.link_id = nl80211_link_id_or_invalid(info->attrs);
12888 /*
12889 * This now races due to the unlock, but we cannot check
12890 * the valid links for the _station_ anyway, so that's up
12891 * to the driver.
12892 */
12893 if (params.link_id >= 0 &&
12894 !(wdev->valid_links & BIT(params.link_id)))
12895 return -EINVAL;
12896
12897 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12898 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12899
12900 err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
12901 info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
12902 &params.csa_offsets,
12903 &params.n_csa_offsets);
12904 if (err)
12905 return err;
12906
12907 if (!params.dont_wait_for_ack) {
12908 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12909 if (!msg)
12910 return -ENOMEM;
12911
12912 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12913 NL80211_CMD_FRAME);
12914 if (!hdr) {
12915 err = -ENOBUFS;
12916 goto free_msg;
12917 }
12918 }
12919
12920 params.chan = chandef.chan;
12921 err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12922 if (err)
12923 goto free_msg;
12924
12925 if (msg) {
12926 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12927 NL80211_ATTR_PAD))
12928 goto nla_put_failure;
12929
12930 genlmsg_end(msg, hdr);
12931 return genlmsg_reply(msg, info);
12932 }
12933
12934 return 0;
12935
12936 nla_put_failure:
12937 err = -ENOBUFS;
12938 free_msg:
12939 nlmsg_free(msg);
12940 return err;
12941}
12942
12943static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12944{
12945 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12946 struct wireless_dev *wdev = info->user_ptr[1];
12947 u64 cookie;
12948
12949 if (!info->attrs[NL80211_ATTR_COOKIE])
12950 return -EINVAL;
12951
12952 if (!rdev->ops->mgmt_tx_cancel_wait)
12953 return -EOPNOTSUPP;
12954
12955 switch (wdev->iftype) {
12956 case NL80211_IFTYPE_STATION:
12957 case NL80211_IFTYPE_ADHOC:
12958 case NL80211_IFTYPE_P2P_CLIENT:
12959 case NL80211_IFTYPE_AP:
12960 case NL80211_IFTYPE_AP_VLAN:
12961 case NL80211_IFTYPE_P2P_GO:
12962 case NL80211_IFTYPE_P2P_DEVICE:
12963 break;
12964 case NL80211_IFTYPE_NAN:
12965 if (!wiphy_ext_feature_isset(wdev->wiphy,
12966 NL80211_EXT_FEATURE_SECURE_NAN))
12967 return -EOPNOTSUPP;
12968 break;
12969 default:
12970 return -EOPNOTSUPP;
12971 }
12972
12973 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12974
12975 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12976}
12977
12978static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12979{
12980 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12981 struct wireless_dev *wdev;
12982 struct net_device *dev = info->user_ptr[1];
12983 u8 ps_state;
12984 bool state;
12985 int err;
12986
12987 if (!info->attrs[NL80211_ATTR_PS_STATE])
12988 return -EINVAL;
12989
12990 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12991
12992 wdev = dev->ieee80211_ptr;
12993
12994 if (!rdev->ops->set_power_mgmt)
12995 return -EOPNOTSUPP;
12996
12997 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12998
12999 if (state == wdev->ps)
13000 return 0;
13001
13002 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
13003 if (!err)
13004 wdev->ps = state;
13005 return err;
13006}
13007
13008static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
13009{
13010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13011 enum nl80211_ps_state ps_state;
13012 struct wireless_dev *wdev;
13013 struct net_device *dev = info->user_ptr[1];
13014 struct sk_buff *msg;
13015 void *hdr;
13016 int err;
13017
13018 wdev = dev->ieee80211_ptr;
13019
13020 if (!rdev->ops->set_power_mgmt)
13021 return -EOPNOTSUPP;
13022
13023 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13024 if (!msg)
13025 return -ENOMEM;
13026
13027 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13028 NL80211_CMD_GET_POWER_SAVE);
13029 if (!hdr) {
13030 err = -ENOBUFS;
13031 goto free_msg;
13032 }
13033
13034 if (wdev->ps)
13035 ps_state = NL80211_PS_ENABLED;
13036 else
13037 ps_state = NL80211_PS_DISABLED;
13038
13039 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
13040 goto nla_put_failure;
13041
13042 genlmsg_end(msg, hdr);
13043 return genlmsg_reply(msg, info);
13044
13045 nla_put_failure:
13046 err = -ENOBUFS;
13047 free_msg:
13048 nlmsg_free(msg);
13049 return err;
13050}
13051
13052static const struct nla_policy
13053nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
13054 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
13055 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
13056 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
13057 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
13058 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
13059 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
13060 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
13061};
13062
13063static int nl80211_set_cqm_txe(struct genl_info *info,
13064 u32 rate, u32 pkts, u32 intvl)
13065{
13066 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13067 struct net_device *dev = info->user_ptr[1];
13068 struct wireless_dev *wdev = dev->ieee80211_ptr;
13069
13070 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
13071 return -EINVAL;
13072
13073 if (!rdev->ops->set_cqm_txe_config)
13074 return -EOPNOTSUPP;
13075
13076 if (wdev->iftype != NL80211_IFTYPE_STATION &&
13077 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13078 return -EOPNOTSUPP;
13079
13080 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
13081}
13082
13083static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
13084 struct net_device *dev,
13085 struct cfg80211_cqm_config *cqm_config)
13086{
13087 struct wireless_dev *wdev = dev->ieee80211_ptr;
13088 s32 last, low, high;
13089 u32 hyst;
13090 int i, n, low_index;
13091 int err;
13092
13093 /*
13094 * Obtain current RSSI value if possible, if not and no RSSI threshold
13095 * event has been received yet, we should receive an event after a
13096 * connection is established and enough beacons received to calculate
13097 * the average.
13098 */
13099 if (!cqm_config->last_rssi_event_value &&
13100 wdev->links[0].client.current_bss &&
13101 rdev->ops->get_station) {
13102 struct station_info sinfo = {};
13103 u8 *mac_addr;
13104
13105 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
13106
13107 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
13108 if (err)
13109 return err;
13110
13111 cfg80211_sinfo_release_content(&sinfo);
13112 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
13113 cqm_config->last_rssi_event_value =
13114 (s8) sinfo.rx_beacon_signal_avg;
13115 }
13116
13117 last = cqm_config->last_rssi_event_value;
13118 hyst = cqm_config->rssi_hyst;
13119 n = cqm_config->n_rssi_thresholds;
13120
13121 for (i = 0; i < n; i++) {
13122 i = array_index_nospec(i, n);
13123 if (last < cqm_config->rssi_thresholds[i])
13124 break;
13125 }
13126
13127 low_index = i - 1;
13128 if (low_index >= 0) {
13129 low_index = array_index_nospec(low_index, n);
13130 low = cqm_config->rssi_thresholds[low_index] - hyst;
13131 } else {
13132 low = S32_MIN;
13133 }
13134 if (i < n) {
13135 i = array_index_nospec(i, n);
13136 high = cqm_config->rssi_thresholds[i] + hyst - 1;
13137 } else {
13138 high = S32_MAX;
13139 }
13140
13141 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
13142}
13143
13144static int nl80211_set_cqm_rssi(struct genl_info *info,
13145 const s32 *thresholds, int n_thresholds,
13146 u32 hysteresis)
13147{
13148 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13149 struct cfg80211_cqm_config *cqm_config = NULL, *old;
13150 struct net_device *dev = info->user_ptr[1];
13151 struct wireless_dev *wdev = dev->ieee80211_ptr;
13152 s32 prev = S32_MIN;
13153 int i, err;
13154
13155 /* Check all values negative and sorted */
13156 for (i = 0; i < n_thresholds; i++) {
13157 if (thresholds[i] > 0 || thresholds[i] <= prev)
13158 return -EINVAL;
13159
13160 prev = thresholds[i];
13161 }
13162
13163 if (wdev->iftype != NL80211_IFTYPE_STATION &&
13164 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13165 return -EOPNOTSUPP;
13166
13167 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
13168 n_thresholds = 0;
13169
13170 old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
13171
13172 /* if already disabled just succeed */
13173 if (!n_thresholds && !old)
13174 return 0;
13175
13176 if (n_thresholds > 1) {
13177 if (!wiphy_ext_feature_isset(&rdev->wiphy,
13178 NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
13179 !rdev->ops->set_cqm_rssi_range_config)
13180 return -EOPNOTSUPP;
13181 } else {
13182 if (!rdev->ops->set_cqm_rssi_config)
13183 return -EOPNOTSUPP;
13184 }
13185
13186 if (n_thresholds) {
13187 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
13188 n_thresholds),
13189 GFP_KERNEL);
13190 if (!cqm_config)
13191 return -ENOMEM;
13192
13193 cqm_config->rssi_hyst = hysteresis;
13194 cqm_config->n_rssi_thresholds = n_thresholds;
13195 memcpy(cqm_config->rssi_thresholds, thresholds,
13196 flex_array_size(cqm_config, rssi_thresholds,
13197 n_thresholds));
13198 cqm_config->use_range_api = n_thresholds > 1 ||
13199 !rdev->ops->set_cqm_rssi_config;
13200
13201 rcu_assign_pointer(wdev->cqm_config, cqm_config);
13202
13203 if (cqm_config->use_range_api)
13204 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
13205 else
13206 err = rdev_set_cqm_rssi_config(rdev, dev,
13207 thresholds[0],
13208 hysteresis);
13209 } else {
13210 RCU_INIT_POINTER(wdev->cqm_config, NULL);
13211 /* if enabled as range also disable via range */
13212 if (old->use_range_api)
13213 err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
13214 else
13215 err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
13216 }
13217
13218 if (err) {
13219 rcu_assign_pointer(wdev->cqm_config, old);
13220 kfree_rcu(cqm_config, rcu_head);
13221 } else {
13222 kfree_rcu(old, rcu_head);
13223 }
13224
13225 return err;
13226}
13227
13228static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
13229{
13230 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
13231 struct nlattr *cqm;
13232 int err;
13233
13234 cqm = info->attrs[NL80211_ATTR_CQM];
13235 if (!cqm)
13236 return -EINVAL;
13237
13238 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
13239 nl80211_attr_cqm_policy,
13240 info->extack);
13241 if (err)
13242 return err;
13243
13244 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
13245 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
13246 const s32 *thresholds =
13247 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13248 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13249 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
13250
13251 if (len % 4)
13252 return -EINVAL;
13253
13254 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
13255 hysteresis);
13256 }
13257
13258 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
13259 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
13260 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
13261 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
13262 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
13263 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
13264
13265 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
13266 }
13267
13268 return -EINVAL;
13269}
13270
13271static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
13272{
13273 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13274 struct net_device *dev = info->user_ptr[1];
13275 struct ocb_setup setup = {};
13276 int err;
13277
13278 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13279 if (err)
13280 return err;
13281
13282 return cfg80211_join_ocb(rdev, dev, &setup);
13283}
13284
13285static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
13286{
13287 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13288 struct net_device *dev = info->user_ptr[1];
13289
13290 return cfg80211_leave_ocb(rdev, dev);
13291}
13292
13293static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
13294{
13295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13296 struct net_device *dev = info->user_ptr[1];
13297 struct mesh_config cfg;
13298 struct mesh_setup setup;
13299 int err;
13300
13301 /* start with default */
13302 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13303 memcpy(&setup, &default_mesh_setup, sizeof(setup));
13304
13305 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13306 /* and parse parameters if given */
13307 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13308 if (err)
13309 return err;
13310 }
13311
13312 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13313 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13314 return -EINVAL;
13315
13316 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13317 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13318
13319 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13320 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13321 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13322 return -EINVAL;
13323
13324 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13325 setup.beacon_interval =
13326 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13327
13328 err = cfg80211_validate_beacon_int(rdev,
13329 NL80211_IFTYPE_MESH_POINT,
13330 setup.beacon_interval);
13331 if (err)
13332 return err;
13333 }
13334
13335 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13336 setup.dtim_period =
13337 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13338 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13339 return -EINVAL;
13340 }
13341
13342 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13343 /* parse additional setup parameters if given */
13344 err = nl80211_parse_mesh_setup(info, &setup);
13345 if (err)
13346 return err;
13347 }
13348
13349 if (setup.user_mpm)
13350 cfg.auto_open_plinks = false;
13351
13352 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13353 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13354 if (err)
13355 return err;
13356 } else {
13357 /* __cfg80211_join_mesh() will sort it out */
13358 setup.chandef.chan = NULL;
13359 }
13360
13361 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13362 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13363 int n_rates =
13364 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13365 struct ieee80211_supported_band *sband;
13366
13367 if (!setup.chandef.chan)
13368 return -EINVAL;
13369
13370 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13371
13372 err = ieee80211_get_ratemask(sband, rates, n_rates,
13373 &setup.basic_rates);
13374 if (err)
13375 return err;
13376 }
13377
13378 if (info->attrs[NL80211_ATTR_TX_RATES]) {
13379 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13380 NL80211_ATTR_TX_RATES,
13381 &setup.beacon_rate,
13382 dev, false, 0);
13383 if (err)
13384 return err;
13385
13386 if (!setup.chandef.chan)
13387 return -EINVAL;
13388
13389 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13390 &setup.beacon_rate);
13391 if (err)
13392 return err;
13393 }
13394
13395 setup.userspace_handles_dfs =
13396 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13397
13398 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13399 int r = validate_pae_over_nl80211(rdev, info);
13400
13401 if (r < 0)
13402 return r;
13403
13404 setup.control_port_over_nl80211 = true;
13405 }
13406
13407 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13408 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13409 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13410
13411 return err;
13412}
13413
13414static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13415{
13416 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13417 struct net_device *dev = info->user_ptr[1];
13418
13419 return cfg80211_leave_mesh(rdev, dev);
13420}
13421
13422#ifdef CONFIG_PM
13423static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13424 struct cfg80211_registered_device *rdev)
13425{
13426 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13427 struct nlattr *nl_pats, *nl_pat;
13428 int i, pat_len;
13429
13430 if (!wowlan->n_patterns)
13431 return 0;
13432
13433 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13434 if (!nl_pats)
13435 return -ENOBUFS;
13436
13437 for (i = 0; i < wowlan->n_patterns; i++) {
13438 nl_pat = nla_nest_start_noflag(msg, i + 1);
13439 if (!nl_pat)
13440 return -ENOBUFS;
13441 pat_len = wowlan->patterns[i].pattern_len;
13442 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13443 wowlan->patterns[i].mask) ||
13444 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13445 wowlan->patterns[i].pattern) ||
13446 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13447 wowlan->patterns[i].pkt_offset))
13448 return -ENOBUFS;
13449 nla_nest_end(msg, nl_pat);
13450 }
13451 nla_nest_end(msg, nl_pats);
13452
13453 return 0;
13454}
13455
13456static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13457 struct cfg80211_wowlan_tcp *tcp)
13458{
13459 struct nlattr *nl_tcp;
13460
13461 if (!tcp)
13462 return 0;
13463
13464 nl_tcp = nla_nest_start_noflag(msg,
13465 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13466 if (!nl_tcp)
13467 return -ENOBUFS;
13468
13469 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13470 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13471 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13472 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13473 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13474 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13475 tcp->payload_len, tcp->payload) ||
13476 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13477 tcp->data_interval) ||
13478 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13479 tcp->wake_len, tcp->wake_data) ||
13480 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13481 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13482 return -ENOBUFS;
13483
13484 if (tcp->payload_seq.len &&
13485 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13486 sizeof(tcp->payload_seq), &tcp->payload_seq))
13487 return -ENOBUFS;
13488
13489 if (tcp->payload_tok.len &&
13490 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13491 sizeof(tcp->payload_tok) + tcp->tokens_size,
13492 &tcp->payload_tok))
13493 return -ENOBUFS;
13494
13495 nla_nest_end(msg, nl_tcp);
13496
13497 return 0;
13498}
13499
13500static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13501 struct cfg80211_sched_scan_request *req)
13502{
13503 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13504 int i;
13505
13506 if (!req)
13507 return 0;
13508
13509 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13510 if (!nd)
13511 return -ENOBUFS;
13512
13513 if (req->n_scan_plans == 1 &&
13514 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13515 req->scan_plans[0].interval * 1000))
13516 return -ENOBUFS;
13517
13518 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13519 return -ENOBUFS;
13520
13521 if (req->relative_rssi_set) {
13522 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13523
13524 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13525 req->relative_rssi))
13526 return -ENOBUFS;
13527
13528 rssi_adjust.band = req->rssi_adjust.band;
13529 rssi_adjust.delta = req->rssi_adjust.delta;
13530 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13531 sizeof(rssi_adjust), &rssi_adjust))
13532 return -ENOBUFS;
13533 }
13534
13535 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13536 if (!freqs)
13537 return -ENOBUFS;
13538
13539 for (i = 0; i < req->n_channels; i++) {
13540 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13541 return -ENOBUFS;
13542 }
13543
13544 nla_nest_end(msg, freqs);
13545
13546 if (req->n_match_sets) {
13547 matches = nla_nest_start_noflag(msg,
13548 NL80211_ATTR_SCHED_SCAN_MATCH);
13549 if (!matches)
13550 return -ENOBUFS;
13551
13552 for (i = 0; i < req->n_match_sets; i++) {
13553 match = nla_nest_start_noflag(msg, i);
13554 if (!match)
13555 return -ENOBUFS;
13556
13557 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13558 req->match_sets[i].ssid.ssid_len,
13559 req->match_sets[i].ssid.ssid))
13560 return -ENOBUFS;
13561 nla_nest_end(msg, match);
13562 }
13563 nla_nest_end(msg, matches);
13564 }
13565
13566 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13567 if (!scan_plans)
13568 return -ENOBUFS;
13569
13570 for (i = 0; i < req->n_scan_plans; i++) {
13571 scan_plan = nla_nest_start_noflag(msg, i + 1);
13572 if (!scan_plan)
13573 return -ENOBUFS;
13574
13575 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13576 req->scan_plans[i].interval) ||
13577 (req->scan_plans[i].iterations &&
13578 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13579 req->scan_plans[i].iterations)))
13580 return -ENOBUFS;
13581 nla_nest_end(msg, scan_plan);
13582 }
13583 nla_nest_end(msg, scan_plans);
13584
13585 nla_nest_end(msg, nd);
13586
13587 return 0;
13588}
13589
13590static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13591{
13592 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13593 struct sk_buff *msg;
13594 void *hdr;
13595 u32 size = NLMSG_DEFAULT_SIZE;
13596
13597 if (!rdev->wiphy.wowlan)
13598 return -EOPNOTSUPP;
13599
13600 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13601 /* adjust size to have room for all the data */
13602 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13603 rdev->wiphy.wowlan_config->tcp->payload_len +
13604 rdev->wiphy.wowlan_config->tcp->wake_len +
13605 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13606 }
13607
13608 msg = nlmsg_new(size, GFP_KERNEL);
13609 if (!msg)
13610 return -ENOMEM;
13611
13612 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13613 NL80211_CMD_GET_WOWLAN);
13614 if (!hdr)
13615 goto nla_put_failure;
13616
13617 if (rdev->wiphy.wowlan_config) {
13618 struct nlattr *nl_wowlan;
13619
13620 nl_wowlan = nla_nest_start_noflag(msg,
13621 NL80211_ATTR_WOWLAN_TRIGGERS);
13622 if (!nl_wowlan)
13623 goto nla_put_failure;
13624
13625 if ((rdev->wiphy.wowlan_config->any &&
13626 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13627 (rdev->wiphy.wowlan_config->disconnect &&
13628 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13629 (rdev->wiphy.wowlan_config->magic_pkt &&
13630 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13631 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13632 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13633 (rdev->wiphy.wowlan_config->eap_identity_req &&
13634 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13635 (rdev->wiphy.wowlan_config->four_way_handshake &&
13636 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13637 (rdev->wiphy.wowlan_config->rfkill_release &&
13638 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13639 goto nla_put_failure;
13640
13641 if (nl80211_send_wowlan_patterns(msg, rdev))
13642 goto nla_put_failure;
13643
13644 if (nl80211_send_wowlan_tcp(msg,
13645 rdev->wiphy.wowlan_config->tcp))
13646 goto nla_put_failure;
13647
13648 if (nl80211_send_wowlan_nd(
13649 msg,
13650 rdev->wiphy.wowlan_config->nd_config))
13651 goto nla_put_failure;
13652
13653 nla_nest_end(msg, nl_wowlan);
13654 }
13655
13656 genlmsg_end(msg, hdr);
13657 return genlmsg_reply(msg, info);
13658
13659nla_put_failure:
13660 nlmsg_free(msg);
13661 return -ENOBUFS;
13662}
13663
13664static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13665 struct nlattr *attr,
13666 struct cfg80211_wowlan *trig)
13667{
13668 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13669 struct cfg80211_wowlan_tcp *cfg;
13670 struct nl80211_wowlan_tcp_data_token *tok = NULL;
13671 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13672 u32 size;
13673 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13674 int err, port;
13675
13676 if (!rdev->wiphy.wowlan->tcp)
13677 return -EINVAL;
13678
13679 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13680 nl80211_wowlan_tcp_policy, NULL);
13681 if (err)
13682 return err;
13683
13684 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13685 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13686 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13687 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13688 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13689 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13690 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13691 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13692 return -EINVAL;
13693
13694 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13695 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13696 return -EINVAL;
13697
13698 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13699 rdev->wiphy.wowlan->tcp->data_interval_max ||
13700 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13701 return -EINVAL;
13702
13703 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13704 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13705 return -EINVAL;
13706
13707 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13708 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13709 return -EINVAL;
13710
13711 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13712 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13713
13714 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13715 tokens_size = tokln - sizeof(*tok);
13716
13717 if (!tok->len || tokens_size % tok->len)
13718 return -EINVAL;
13719 if (!rdev->wiphy.wowlan->tcp->tok)
13720 return -EINVAL;
13721 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13722 return -EINVAL;
13723 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13724 return -EINVAL;
13725 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13726 return -EINVAL;
13727 if (tok->offset + tok->len > data_size)
13728 return -EINVAL;
13729 }
13730
13731 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13732 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13733 if (!rdev->wiphy.wowlan->tcp->seq)
13734 return -EINVAL;
13735 if (seq->len == 0 || seq->len > 4)
13736 return -EINVAL;
13737 if (seq->len + seq->offset > data_size)
13738 return -EINVAL;
13739 }
13740
13741 size = sizeof(*cfg);
13742 size += data_size;
13743 size += wake_size + wake_mask_size;
13744 size += tokens_size;
13745
13746 cfg = kzalloc(size, GFP_KERNEL);
13747 if (!cfg)
13748 return -ENOMEM;
13749 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13750 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13751 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13752 ETH_ALEN);
13753 port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
13754#ifdef CONFIG_INET
13755 /* allocate a socket and port for it and use it */
13756 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13757 IPPROTO_TCP, &cfg->sock, 1);
13758 if (err) {
13759 kfree(cfg);
13760 return err;
13761 }
13762 if (inet_csk_get_port(cfg->sock->sk, port)) {
13763 sock_release(cfg->sock);
13764 kfree(cfg);
13765 return -EADDRINUSE;
13766 }
13767 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13768#else
13769 if (!port) {
13770 kfree(cfg);
13771 return -EINVAL;
13772 }
13773 cfg->src_port = port;
13774#endif
13775
13776 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13777 cfg->payload_len = data_size;
13778 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13779 memcpy((void *)cfg->payload,
13780 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13781 data_size);
13782 if (seq)
13783 cfg->payload_seq = *seq;
13784 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13785 cfg->wake_len = wake_size;
13786 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13787 memcpy((void *)cfg->wake_data,
13788 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13789 wake_size);
13790 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13791 data_size + wake_size;
13792 memcpy((void *)cfg->wake_mask,
13793 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13794 wake_mask_size);
13795 if (tok) {
13796 cfg->tokens_size = tokens_size;
13797 cfg->payload_tok = *tok;
13798 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13799 tokens_size);
13800 }
13801
13802 trig->tcp = cfg;
13803
13804 return 0;
13805}
13806
13807static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13808 const struct wiphy_wowlan_support *wowlan,
13809 struct nlattr *attr,
13810 struct cfg80211_wowlan *trig)
13811{
13812 struct nlattr **tb;
13813 int err;
13814
13815 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13816 if (!tb)
13817 return -ENOMEM;
13818
13819 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13820 err = -EOPNOTSUPP;
13821 goto out;
13822 }
13823
13824 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13825 nl80211_policy, NULL);
13826 if (err)
13827 goto out;
13828
13829 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13830 wowlan->max_nd_match_sets);
13831 err = PTR_ERR_OR_ZERO(trig->nd_config);
13832 if (err)
13833 trig->nd_config = NULL;
13834
13835out:
13836 kfree(tb);
13837 return err;
13838}
13839
13840static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13841{
13842 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13843 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13844 struct cfg80211_wowlan new_triggers = {};
13845 struct cfg80211_wowlan *ntrig;
13846 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13847 int err, i;
13848 bool prev_enabled = rdev->wiphy.wowlan_config;
13849 bool regular = false;
13850
13851 if (!wowlan)
13852 return -EOPNOTSUPP;
13853
13854 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13855 cfg80211_rdev_free_wowlan(rdev);
13856 rdev->wiphy.wowlan_config = NULL;
13857 goto set_wakeup;
13858 }
13859
13860 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13861 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13862 nl80211_wowlan_policy, info->extack);
13863 if (err)
13864 return err;
13865
13866 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13867 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13868 return -EINVAL;
13869 new_triggers.any = true;
13870 }
13871
13872 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13873 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13874 return -EINVAL;
13875 new_triggers.disconnect = true;
13876 regular = true;
13877 }
13878
13879 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13880 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13881 return -EINVAL;
13882 new_triggers.magic_pkt = true;
13883 regular = true;
13884 }
13885
13886 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13887 return -EINVAL;
13888
13889 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13890 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13891 return -EINVAL;
13892 new_triggers.gtk_rekey_failure = true;
13893 regular = true;
13894 }
13895
13896 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13897 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13898 return -EINVAL;
13899 new_triggers.eap_identity_req = true;
13900 regular = true;
13901 }
13902
13903 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13904 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13905 return -EINVAL;
13906 new_triggers.four_way_handshake = true;
13907 regular = true;
13908 }
13909
13910 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13911 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13912 return -EINVAL;
13913 new_triggers.rfkill_release = true;
13914 regular = true;
13915 }
13916
13917 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13918 struct nlattr *pat;
13919 int n_patterns = 0;
13920 int rem, pat_len, mask_len, pkt_offset;
13921 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13922
13923 regular = true;
13924
13925 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13926 rem)
13927 n_patterns++;
13928 if (n_patterns > wowlan->n_patterns)
13929 return -EINVAL;
13930
13931 new_triggers.patterns = kcalloc(n_patterns,
13932 sizeof(new_triggers.patterns[0]),
13933 GFP_KERNEL);
13934 if (!new_triggers.patterns)
13935 return -ENOMEM;
13936
13937 new_triggers.n_patterns = n_patterns;
13938 i = 0;
13939
13940 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13941 rem) {
13942 u8 *mask_pat;
13943
13944 err = nla_parse_nested_deprecated(pat_tb,
13945 MAX_NL80211_PKTPAT,
13946 pat,
13947 nl80211_packet_pattern_policy,
13948 info->extack);
13949 if (err)
13950 goto error;
13951
13952 err = -EINVAL;
13953 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13954 !pat_tb[NL80211_PKTPAT_PATTERN])
13955 goto error;
13956 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13957 mask_len = DIV_ROUND_UP(pat_len, 8);
13958 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13959 goto error;
13960 if (pat_len > wowlan->pattern_max_len ||
13961 pat_len < wowlan->pattern_min_len)
13962 goto error;
13963
13964 pkt_offset =
13965 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
13966 0);
13967 if (pkt_offset > wowlan->max_pkt_offset)
13968 goto error;
13969 new_triggers.patterns[i].pkt_offset = pkt_offset;
13970
13971 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13972 if (!mask_pat) {
13973 err = -ENOMEM;
13974 goto error;
13975 }
13976 new_triggers.patterns[i].mask = mask_pat;
13977 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13978 mask_len);
13979 mask_pat += mask_len;
13980 new_triggers.patterns[i].pattern = mask_pat;
13981 new_triggers.patterns[i].pattern_len = pat_len;
13982 memcpy(mask_pat,
13983 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13984 pat_len);
13985 i++;
13986 }
13987 }
13988
13989 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13990 regular = true;
13991 err = nl80211_parse_wowlan_tcp(
13992 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13993 &new_triggers);
13994 if (err)
13995 goto error;
13996 }
13997
13998 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13999 regular = true;
14000 err = nl80211_parse_wowlan_nd(
14001 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
14002 &new_triggers);
14003 if (err)
14004 goto error;
14005 }
14006
14007 /* The 'any' trigger means the device continues operating more or less
14008 * as in its normal operation mode and wakes up the host on most of the
14009 * normal interrupts (like packet RX, ...)
14010 * It therefore makes little sense to combine with the more constrained
14011 * wakeup trigger modes.
14012 */
14013 if (new_triggers.any && regular) {
14014 err = -EINVAL;
14015 goto error;
14016 }
14017
14018 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
14019 if (!ntrig) {
14020 err = -ENOMEM;
14021 goto error;
14022 }
14023 cfg80211_rdev_free_wowlan(rdev);
14024 rdev->wiphy.wowlan_config = ntrig;
14025
14026 set_wakeup:
14027 if (rdev->ops->set_wakeup &&
14028 prev_enabled != !!rdev->wiphy.wowlan_config)
14029 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
14030
14031 return 0;
14032 error:
14033 for (i = 0; i < new_triggers.n_patterns; i++)
14034 kfree(new_triggers.patterns[i].mask);
14035 kfree(new_triggers.patterns);
14036 if (new_triggers.tcp && new_triggers.tcp->sock)
14037 sock_release(new_triggers.tcp->sock);
14038 kfree(new_triggers.tcp);
14039 kfree(new_triggers.nd_config);
14040 return err;
14041}
14042#endif
14043
14044static int nl80211_send_coalesce_rules(struct sk_buff *msg,
14045 struct cfg80211_registered_device *rdev)
14046{
14047 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
14048 int i, j, pat_len;
14049 struct cfg80211_coalesce_rules *rule;
14050
14051 if (!rdev->coalesce->n_rules)
14052 return 0;
14053
14054 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
14055 if (!nl_rules)
14056 return -ENOBUFS;
14057
14058 for (i = 0; i < rdev->coalesce->n_rules; i++) {
14059 nl_rule = nla_nest_start_noflag(msg, i + 1);
14060 if (!nl_rule)
14061 return -ENOBUFS;
14062
14063 rule = &rdev->coalesce->rules[i];
14064 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
14065 rule->delay))
14066 return -ENOBUFS;
14067
14068 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
14069 rule->condition))
14070 return -ENOBUFS;
14071
14072 nl_pats = nla_nest_start_noflag(msg,
14073 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
14074 if (!nl_pats)
14075 return -ENOBUFS;
14076
14077 for (j = 0; j < rule->n_patterns; j++) {
14078 nl_pat = nla_nest_start_noflag(msg, j + 1);
14079 if (!nl_pat)
14080 return -ENOBUFS;
14081 pat_len = rule->patterns[j].pattern_len;
14082 if (nla_put(msg, NL80211_PKTPAT_MASK,
14083 DIV_ROUND_UP(pat_len, 8),
14084 rule->patterns[j].mask) ||
14085 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14086 rule->patterns[j].pattern) ||
14087 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14088 rule->patterns[j].pkt_offset))
14089 return -ENOBUFS;
14090 nla_nest_end(msg, nl_pat);
14091 }
14092 nla_nest_end(msg, nl_pats);
14093 nla_nest_end(msg, nl_rule);
14094 }
14095 nla_nest_end(msg, nl_rules);
14096
14097 return 0;
14098}
14099
14100static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
14101{
14102 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14103 struct sk_buff *msg;
14104 void *hdr;
14105
14106 if (!rdev->wiphy.coalesce)
14107 return -EOPNOTSUPP;
14108
14109 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14110 if (!msg)
14111 return -ENOMEM;
14112
14113 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14114 NL80211_CMD_GET_COALESCE);
14115 if (!hdr)
14116 goto nla_put_failure;
14117
14118 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
14119 goto nla_put_failure;
14120
14121 genlmsg_end(msg, hdr);
14122 return genlmsg_reply(msg, info);
14123
14124nla_put_failure:
14125 nlmsg_free(msg);
14126 return -ENOBUFS;
14127}
14128
14129void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
14130{
14131 int i, j;
14132 struct cfg80211_coalesce_rules *rule;
14133
14134 if (!coalesce)
14135 return;
14136
14137 for (i = 0; i < coalesce->n_rules; i++) {
14138 rule = &coalesce->rules[i];
14139 for (j = 0; j < rule->n_patterns; j++)
14140 kfree(rule->patterns[j].mask);
14141 kfree(rule->patterns);
14142 }
14143 kfree(coalesce);
14144}
14145
14146static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
14147 struct nlattr *rule,
14148 struct cfg80211_coalesce_rules *new_rule)
14149{
14150 int err, i;
14151 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14152 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
14153 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
14154 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14155
14156 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
14157 rule, nl80211_coalesce_policy, NULL);
14158 if (err)
14159 return err;
14160
14161 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
14162 new_rule->delay =
14163 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
14164 if (new_rule->delay > coalesce->max_delay)
14165 return -EINVAL;
14166
14167 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
14168 new_rule->condition =
14169 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
14170
14171 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
14172 return -EINVAL;
14173
14174 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14175 rem)
14176 n_patterns++;
14177 if (n_patterns > coalesce->n_patterns)
14178 return -EINVAL;
14179
14180 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
14181 GFP_KERNEL);
14182 if (!new_rule->patterns)
14183 return -ENOMEM;
14184
14185 new_rule->n_patterns = n_patterns;
14186 i = 0;
14187
14188 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14189 rem) {
14190 u8 *mask_pat;
14191
14192 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
14193 pat,
14194 nl80211_packet_pattern_policy,
14195 NULL);
14196 if (err)
14197 return err;
14198
14199 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14200 !pat_tb[NL80211_PKTPAT_PATTERN])
14201 return -EINVAL;
14202 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14203 mask_len = DIV_ROUND_UP(pat_len, 8);
14204 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14205 return -EINVAL;
14206 if (pat_len > coalesce->pattern_max_len ||
14207 pat_len < coalesce->pattern_min_len)
14208 return -EINVAL;
14209
14210 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14211 0);
14212 if (pkt_offset > coalesce->max_pkt_offset)
14213 return -EINVAL;
14214 new_rule->patterns[i].pkt_offset = pkt_offset;
14215
14216 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14217 if (!mask_pat)
14218 return -ENOMEM;
14219
14220 new_rule->patterns[i].mask = mask_pat;
14221 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14222 mask_len);
14223
14224 mask_pat += mask_len;
14225 new_rule->patterns[i].pattern = mask_pat;
14226 new_rule->patterns[i].pattern_len = pat_len;
14227 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14228 pat_len);
14229 i++;
14230 }
14231
14232 return 0;
14233}
14234
14235static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
14236{
14237 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14238 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14239 struct cfg80211_coalesce *new_coalesce;
14240 int err, rem_rule, n_rules = 0, i;
14241 struct nlattr *rule;
14242
14243 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
14244 return -EOPNOTSUPP;
14245
14246 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
14247 cfg80211_free_coalesce(rdev->coalesce);
14248 rdev->coalesce = NULL;
14249 rdev_set_coalesce(rdev, NULL);
14250 return 0;
14251 }
14252
14253 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14254 rem_rule)
14255 n_rules++;
14256 if (n_rules > coalesce->n_rules)
14257 return -EINVAL;
14258
14259 new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
14260 GFP_KERNEL);
14261 if (!new_coalesce)
14262 return -ENOMEM;
14263
14264 new_coalesce->n_rules = n_rules;
14265 i = 0;
14266
14267 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14268 rem_rule) {
14269 err = nl80211_parse_coalesce_rule(rdev, rule,
14270 &new_coalesce->rules[i]);
14271 if (err)
14272 goto error;
14273
14274 i++;
14275 }
14276
14277 err = rdev_set_coalesce(rdev, new_coalesce);
14278 if (err)
14279 goto error;
14280
14281 cfg80211_free_coalesce(rdev->coalesce);
14282 rdev->coalesce = new_coalesce;
14283
14284 return 0;
14285error:
14286 cfg80211_free_coalesce(new_coalesce);
14287
14288 return err;
14289}
14290
14291static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14292{
14293 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14294 struct net_device *dev = info->user_ptr[1];
14295 struct wireless_dev *wdev = dev->ieee80211_ptr;
14296 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14297 struct cfg80211_gtk_rekey_data rekey_data = {};
14298 int err;
14299
14300 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14301 return -EINVAL;
14302
14303 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14304 info->attrs[NL80211_ATTR_REKEY_DATA],
14305 nl80211_rekey_policy, info->extack);
14306 if (err)
14307 return err;
14308
14309 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14310 !tb[NL80211_REKEY_DATA_KCK])
14311 return -EINVAL;
14312 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14313 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14314 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14315 return -ERANGE;
14316 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14317 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14318 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14319 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14320 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14321 return -ERANGE;
14322
14323 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14324 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14325 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14326 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14327 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14328 if (tb[NL80211_REKEY_DATA_AKM])
14329 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14330
14331 if (!wdev->connected)
14332 return -ENOTCONN;
14333
14334 if (!rdev->ops->set_rekey_data)
14335 return -EOPNOTSUPP;
14336
14337 return rdev_set_rekey_data(rdev, dev, &rekey_data);
14338}
14339
14340static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14341 struct genl_info *info)
14342{
14343 struct net_device *dev = info->user_ptr[1];
14344 struct wireless_dev *wdev = dev->ieee80211_ptr;
14345
14346 if (wdev->iftype != NL80211_IFTYPE_AP &&
14347 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14348 return -EINVAL;
14349
14350 if (wdev->ap_unexpected_nlportid)
14351 return -EBUSY;
14352
14353 wdev->ap_unexpected_nlportid = info->snd_portid;
14354 return 0;
14355}
14356
14357static int nl80211_probe_client(struct sk_buff *skb,
14358 struct genl_info *info)
14359{
14360 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14361 struct net_device *dev = info->user_ptr[1];
14362 struct wireless_dev *wdev = dev->ieee80211_ptr;
14363 struct sk_buff *msg;
14364 void *hdr;
14365 const u8 *addr;
14366 u64 cookie;
14367 int err;
14368
14369 if (wdev->iftype != NL80211_IFTYPE_AP &&
14370 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14371 return -EOPNOTSUPP;
14372
14373 if (!info->attrs[NL80211_ATTR_MAC])
14374 return -EINVAL;
14375
14376 if (!rdev->ops->probe_client)
14377 return -EOPNOTSUPP;
14378
14379 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14380 if (!msg)
14381 return -ENOMEM;
14382
14383 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14384 NL80211_CMD_PROBE_CLIENT);
14385 if (!hdr) {
14386 err = -ENOBUFS;
14387 goto free_msg;
14388 }
14389
14390 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14391
14392 err = rdev_probe_client(rdev, dev, addr, &cookie);
14393 if (err)
14394 goto free_msg;
14395
14396 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14397 NL80211_ATTR_PAD))
14398 goto nla_put_failure;
14399
14400 genlmsg_end(msg, hdr);
14401
14402 return genlmsg_reply(msg, info);
14403
14404 nla_put_failure:
14405 err = -ENOBUFS;
14406 free_msg:
14407 nlmsg_free(msg);
14408 return err;
14409}
14410
14411static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14412{
14413 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14414 struct cfg80211_beacon_registration *reg, *nreg;
14415 int rv;
14416
14417 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14418 return -EOPNOTSUPP;
14419
14420 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14421 if (!nreg)
14422 return -ENOMEM;
14423
14424 /* First, check if already registered. */
14425 spin_lock_bh(&rdev->beacon_registrations_lock);
14426 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14427 if (reg->nlportid == info->snd_portid) {
14428 rv = -EALREADY;
14429 goto out_err;
14430 }
14431 }
14432 /* Add it to the list */
14433 nreg->nlportid = info->snd_portid;
14434 list_add(&nreg->list, &rdev->beacon_registrations);
14435
14436 spin_unlock_bh(&rdev->beacon_registrations_lock);
14437
14438 return 0;
14439out_err:
14440 spin_unlock_bh(&rdev->beacon_registrations_lock);
14441 kfree(nreg);
14442 return rv;
14443}
14444
14445static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14446{
14447 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14448 struct wireless_dev *wdev = info->user_ptr[1];
14449 int err;
14450
14451 if (!rdev->ops->start_p2p_device)
14452 return -EOPNOTSUPP;
14453
14454 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14455 return -EOPNOTSUPP;
14456
14457 if (wdev_running(wdev))
14458 return 0;
14459
14460 if (rfkill_blocked(rdev->wiphy.rfkill))
14461 return -ERFKILL;
14462
14463 err = rdev_start_p2p_device(rdev, wdev);
14464 if (err)
14465 return err;
14466
14467 wdev->is_running = true;
14468 rdev->opencount++;
14469
14470 return 0;
14471}
14472
14473static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14474{
14475 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14476 struct wireless_dev *wdev = info->user_ptr[1];
14477
14478 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14479 return -EOPNOTSUPP;
14480
14481 if (!rdev->ops->stop_p2p_device)
14482 return -EOPNOTSUPP;
14483
14484 cfg80211_stop_p2p_device(rdev, wdev);
14485
14486 return 0;
14487}
14488
14489static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14490{
14491 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14492 struct wireless_dev *wdev = info->user_ptr[1];
14493 struct cfg80211_nan_conf conf = {};
14494 int err;
14495
14496 if (wdev->iftype != NL80211_IFTYPE_NAN)
14497 return -EOPNOTSUPP;
14498
14499 if (wdev_running(wdev))
14500 return -EEXIST;
14501
14502 if (rfkill_blocked(rdev->wiphy.rfkill))
14503 return -ERFKILL;
14504
14505 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14506 return -EINVAL;
14507
14508 conf.master_pref =
14509 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14510
14511 if (info->attrs[NL80211_ATTR_BANDS]) {
14512 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14513
14514 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14515 return -EOPNOTSUPP;
14516
14517 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14518 return -EINVAL;
14519
14520 conf.bands = bands;
14521 }
14522
14523 err = rdev_start_nan(rdev, wdev, &conf);
14524 if (err)
14525 return err;
14526
14527 wdev->is_running = true;
14528 rdev->opencount++;
14529
14530 return 0;
14531}
14532
14533static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14534{
14535 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14536 struct wireless_dev *wdev = info->user_ptr[1];
14537
14538 if (wdev->iftype != NL80211_IFTYPE_NAN)
14539 return -EOPNOTSUPP;
14540
14541 cfg80211_stop_nan(rdev, wdev);
14542
14543 return 0;
14544}
14545
14546static int validate_nan_filter(struct nlattr *filter_attr)
14547{
14548 struct nlattr *attr;
14549 int len = 0, n_entries = 0, rem;
14550
14551 nla_for_each_nested(attr, filter_attr, rem) {
14552 len += nla_len(attr);
14553 n_entries++;
14554 }
14555
14556 if (len >= U8_MAX)
14557 return -EINVAL;
14558
14559 return n_entries;
14560}
14561
14562static int handle_nan_filter(struct nlattr *attr_filter,
14563 struct cfg80211_nan_func *func,
14564 bool tx)
14565{
14566 struct nlattr *attr;
14567 int n_entries, rem, i;
14568 struct cfg80211_nan_func_filter *filter;
14569
14570 n_entries = validate_nan_filter(attr_filter);
14571 if (n_entries < 0)
14572 return n_entries;
14573
14574 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14575
14576 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14577 if (!filter)
14578 return -ENOMEM;
14579
14580 i = 0;
14581 nla_for_each_nested(attr, attr_filter, rem) {
14582 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14583 if (!filter[i].filter)
14584 goto err;
14585
14586 filter[i].len = nla_len(attr);
14587 i++;
14588 }
14589 if (tx) {
14590 func->num_tx_filters = n_entries;
14591 func->tx_filters = filter;
14592 } else {
14593 func->num_rx_filters = n_entries;
14594 func->rx_filters = filter;
14595 }
14596
14597 return 0;
14598
14599err:
14600 i = 0;
14601 nla_for_each_nested(attr, attr_filter, rem) {
14602 kfree(filter[i].filter);
14603 i++;
14604 }
14605 kfree(filter);
14606 return -ENOMEM;
14607}
14608
14609static int nl80211_nan_add_func(struct sk_buff *skb,
14610 struct genl_info *info)
14611{
14612 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14613 struct wireless_dev *wdev = info->user_ptr[1];
14614 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14615 struct cfg80211_nan_func *func;
14616 struct sk_buff *msg = NULL;
14617 void *hdr = NULL;
14618 int err = 0;
14619
14620 if (wdev->iftype != NL80211_IFTYPE_NAN)
14621 return -EOPNOTSUPP;
14622
14623 if (!wdev_running(wdev))
14624 return -ENOTCONN;
14625
14626 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14627 return -EINVAL;
14628
14629 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14630 info->attrs[NL80211_ATTR_NAN_FUNC],
14631 nl80211_nan_func_policy,
14632 info->extack);
14633 if (err)
14634 return err;
14635
14636 func = kzalloc(sizeof(*func), GFP_KERNEL);
14637 if (!func)
14638 return -ENOMEM;
14639
14640 func->cookie = cfg80211_assign_cookie(rdev);
14641
14642 if (!tb[NL80211_NAN_FUNC_TYPE]) {
14643 err = -EINVAL;
14644 goto out;
14645 }
14646
14647
14648 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14649
14650 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14651 err = -EINVAL;
14652 goto out;
14653 }
14654
14655 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14656 sizeof(func->service_id));
14657
14658 func->close_range =
14659 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14660
14661 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14662 func->serv_spec_info_len =
14663 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14664 func->serv_spec_info =
14665 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14666 func->serv_spec_info_len,
14667 GFP_KERNEL);
14668 if (!func->serv_spec_info) {
14669 err = -ENOMEM;
14670 goto out;
14671 }
14672 }
14673
14674 if (tb[NL80211_NAN_FUNC_TTL])
14675 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14676
14677 switch (func->type) {
14678 case NL80211_NAN_FUNC_PUBLISH:
14679 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14680 err = -EINVAL;
14681 goto out;
14682 }
14683
14684 func->publish_type =
14685 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14686 func->publish_bcast =
14687 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14688
14689 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14690 func->publish_bcast) {
14691 err = -EINVAL;
14692 goto out;
14693 }
14694 break;
14695 case NL80211_NAN_FUNC_SUBSCRIBE:
14696 func->subscribe_active =
14697 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14698 break;
14699 case NL80211_NAN_FUNC_FOLLOW_UP:
14700 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14701 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14702 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14703 err = -EINVAL;
14704 goto out;
14705 }
14706
14707 func->followup_id =
14708 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14709 func->followup_reqid =
14710 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14711 memcpy(func->followup_dest.addr,
14712 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14713 sizeof(func->followup_dest.addr));
14714 if (func->ttl) {
14715 err = -EINVAL;
14716 goto out;
14717 }
14718 break;
14719 default:
14720 err = -EINVAL;
14721 goto out;
14722 }
14723
14724 if (tb[NL80211_NAN_FUNC_SRF]) {
14725 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14726
14727 err = nla_parse_nested_deprecated(srf_tb,
14728 NL80211_NAN_SRF_ATTR_MAX,
14729 tb[NL80211_NAN_FUNC_SRF],
14730 nl80211_nan_srf_policy,
14731 info->extack);
14732 if (err)
14733 goto out;
14734
14735 func->srf_include =
14736 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14737
14738 if (srf_tb[NL80211_NAN_SRF_BF]) {
14739 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14740 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14741 err = -EINVAL;
14742 goto out;
14743 }
14744
14745 func->srf_bf_len =
14746 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14747 func->srf_bf =
14748 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14749 func->srf_bf_len, GFP_KERNEL);
14750 if (!func->srf_bf) {
14751 err = -ENOMEM;
14752 goto out;
14753 }
14754
14755 func->srf_bf_idx =
14756 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14757 } else {
14758 struct nlattr *attr, *mac_attr =
14759 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14760 int n_entries, rem, i = 0;
14761
14762 if (!mac_attr) {
14763 err = -EINVAL;
14764 goto out;
14765 }
14766
14767 n_entries = validate_acl_mac_addrs(mac_attr);
14768 if (n_entries <= 0) {
14769 err = -EINVAL;
14770 goto out;
14771 }
14772
14773 func->srf_num_macs = n_entries;
14774 func->srf_macs =
14775 kcalloc(n_entries, sizeof(*func->srf_macs),
14776 GFP_KERNEL);
14777 if (!func->srf_macs) {
14778 err = -ENOMEM;
14779 goto out;
14780 }
14781
14782 nla_for_each_nested(attr, mac_attr, rem)
14783 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14784 sizeof(*func->srf_macs));
14785 }
14786 }
14787
14788 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14789 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14790 func, true);
14791 if (err)
14792 goto out;
14793 }
14794
14795 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14796 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14797 func, false);
14798 if (err)
14799 goto out;
14800 }
14801
14802 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14803 if (!msg) {
14804 err = -ENOMEM;
14805 goto out;
14806 }
14807
14808 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14809 NL80211_CMD_ADD_NAN_FUNCTION);
14810 /* This can't really happen - we just allocated 4KB */
14811 if (WARN_ON(!hdr)) {
14812 err = -ENOMEM;
14813 goto out;
14814 }
14815
14816 err = rdev_add_nan_func(rdev, wdev, func);
14817out:
14818 if (err < 0) {
14819 cfg80211_free_nan_func(func);
14820 nlmsg_free(msg);
14821 return err;
14822 }
14823
14824 /* propagate the instance id and cookie to userspace */
14825 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14826 NL80211_ATTR_PAD))
14827 goto nla_put_failure;
14828
14829 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14830 if (!func_attr)
14831 goto nla_put_failure;
14832
14833 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14834 func->instance_id))
14835 goto nla_put_failure;
14836
14837 nla_nest_end(msg, func_attr);
14838
14839 genlmsg_end(msg, hdr);
14840 return genlmsg_reply(msg, info);
14841
14842nla_put_failure:
14843 nlmsg_free(msg);
14844 return -ENOBUFS;
14845}
14846
14847static int nl80211_nan_del_func(struct sk_buff *skb,
14848 struct genl_info *info)
14849{
14850 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14851 struct wireless_dev *wdev = info->user_ptr[1];
14852 u64 cookie;
14853
14854 if (wdev->iftype != NL80211_IFTYPE_NAN)
14855 return -EOPNOTSUPP;
14856
14857 if (!wdev_running(wdev))
14858 return -ENOTCONN;
14859
14860 if (!info->attrs[NL80211_ATTR_COOKIE])
14861 return -EINVAL;
14862
14863 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14864
14865 rdev_del_nan_func(rdev, wdev, cookie);
14866
14867 return 0;
14868}
14869
14870static int nl80211_nan_change_config(struct sk_buff *skb,
14871 struct genl_info *info)
14872{
14873 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14874 struct wireless_dev *wdev = info->user_ptr[1];
14875 struct cfg80211_nan_conf conf = {};
14876 u32 changed = 0;
14877
14878 if (wdev->iftype != NL80211_IFTYPE_NAN)
14879 return -EOPNOTSUPP;
14880
14881 if (!wdev_running(wdev))
14882 return -ENOTCONN;
14883
14884 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14885 conf.master_pref =
14886 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14887 if (conf.master_pref <= 1 || conf.master_pref == 255)
14888 return -EINVAL;
14889
14890 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14891 }
14892
14893 if (info->attrs[NL80211_ATTR_BANDS]) {
14894 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14895
14896 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14897 return -EOPNOTSUPP;
14898
14899 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14900 return -EINVAL;
14901
14902 conf.bands = bands;
14903 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14904 }
14905
14906 if (!changed)
14907 return -EINVAL;
14908
14909 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14910}
14911
14912void cfg80211_nan_match(struct wireless_dev *wdev,
14913 struct cfg80211_nan_match_params *match, gfp_t gfp)
14914{
14915 struct wiphy *wiphy = wdev->wiphy;
14916 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14917 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14918 struct sk_buff *msg;
14919 void *hdr;
14920
14921 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14922 return;
14923
14924 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14925 if (!msg)
14926 return;
14927
14928 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14929 if (!hdr) {
14930 nlmsg_free(msg);
14931 return;
14932 }
14933
14934 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14935 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14936 wdev->netdev->ifindex)) ||
14937 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14938 NL80211_ATTR_PAD))
14939 goto nla_put_failure;
14940
14941 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14942 NL80211_ATTR_PAD) ||
14943 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14944 goto nla_put_failure;
14945
14946 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14947 if (!match_attr)
14948 goto nla_put_failure;
14949
14950 local_func_attr = nla_nest_start_noflag(msg,
14951 NL80211_NAN_MATCH_FUNC_LOCAL);
14952 if (!local_func_attr)
14953 goto nla_put_failure;
14954
14955 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14956 goto nla_put_failure;
14957
14958 nla_nest_end(msg, local_func_attr);
14959
14960 peer_func_attr = nla_nest_start_noflag(msg,
14961 NL80211_NAN_MATCH_FUNC_PEER);
14962 if (!peer_func_attr)
14963 goto nla_put_failure;
14964
14965 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14966 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14967 goto nla_put_failure;
14968
14969 if (match->info && match->info_len &&
14970 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14971 match->info))
14972 goto nla_put_failure;
14973
14974 nla_nest_end(msg, peer_func_attr);
14975 nla_nest_end(msg, match_attr);
14976 genlmsg_end(msg, hdr);
14977
14978 if (!wdev->owner_nlportid)
14979 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14980 msg, 0, NL80211_MCGRP_NAN, gfp);
14981 else
14982 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14983 wdev->owner_nlportid);
14984
14985 return;
14986
14987nla_put_failure:
14988 nlmsg_free(msg);
14989}
14990EXPORT_SYMBOL(cfg80211_nan_match);
14991
14992void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14993 u8 inst_id,
14994 enum nl80211_nan_func_term_reason reason,
14995 u64 cookie, gfp_t gfp)
14996{
14997 struct wiphy *wiphy = wdev->wiphy;
14998 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14999 struct sk_buff *msg;
15000 struct nlattr *func_attr;
15001 void *hdr;
15002
15003 if (WARN_ON(!inst_id))
15004 return;
15005
15006 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15007 if (!msg)
15008 return;
15009
15010 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
15011 if (!hdr) {
15012 nlmsg_free(msg);
15013 return;
15014 }
15015
15016 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15017 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15018 wdev->netdev->ifindex)) ||
15019 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15020 NL80211_ATTR_PAD))
15021 goto nla_put_failure;
15022
15023 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15024 NL80211_ATTR_PAD))
15025 goto nla_put_failure;
15026
15027 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
15028 if (!func_attr)
15029 goto nla_put_failure;
15030
15031 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
15032 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
15033 goto nla_put_failure;
15034
15035 nla_nest_end(msg, func_attr);
15036 genlmsg_end(msg, hdr);
15037
15038 if (!wdev->owner_nlportid)
15039 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
15040 msg, 0, NL80211_MCGRP_NAN, gfp);
15041 else
15042 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
15043 wdev->owner_nlportid);
15044
15045 return;
15046
15047nla_put_failure:
15048 nlmsg_free(msg);
15049}
15050EXPORT_SYMBOL(cfg80211_nan_func_terminated);
15051
15052static int nl80211_get_protocol_features(struct sk_buff *skb,
15053 struct genl_info *info)
15054{
15055 void *hdr;
15056 struct sk_buff *msg;
15057
15058 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15059 if (!msg)
15060 return -ENOMEM;
15061
15062 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15063 NL80211_CMD_GET_PROTOCOL_FEATURES);
15064 if (!hdr)
15065 goto nla_put_failure;
15066
15067 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
15068 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
15069 goto nla_put_failure;
15070
15071 genlmsg_end(msg, hdr);
15072 return genlmsg_reply(msg, info);
15073
15074 nla_put_failure:
15075 kfree_skb(msg);
15076 return -ENOBUFS;
15077}
15078
15079static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
15080{
15081 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15082 struct cfg80211_update_ft_ies_params ft_params;
15083 struct net_device *dev = info->user_ptr[1];
15084
15085 if (!rdev->ops->update_ft_ies)
15086 return -EOPNOTSUPP;
15087
15088 if (!info->attrs[NL80211_ATTR_MDID] ||
15089 !info->attrs[NL80211_ATTR_IE])
15090 return -EINVAL;
15091
15092 memset(&ft_params, 0, sizeof(ft_params));
15093 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
15094 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15095 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15096
15097 return rdev_update_ft_ies(rdev, dev, &ft_params);
15098}
15099
15100static int nl80211_crit_protocol_start(struct sk_buff *skb,
15101 struct genl_info *info)
15102{
15103 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15104 struct wireless_dev *wdev = info->user_ptr[1];
15105 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
15106 u16 duration;
15107 int ret;
15108
15109 if (!rdev->ops->crit_proto_start)
15110 return -EOPNOTSUPP;
15111
15112 if (WARN_ON(!rdev->ops->crit_proto_stop))
15113 return -EINVAL;
15114
15115 if (rdev->crit_proto_nlportid)
15116 return -EBUSY;
15117
15118 /* determine protocol if provided */
15119 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
15120 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
15121
15122 if (proto >= NUM_NL80211_CRIT_PROTO)
15123 return -EINVAL;
15124
15125 /* timeout must be provided */
15126 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
15127 return -EINVAL;
15128
15129 duration =
15130 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
15131
15132 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
15133 if (!ret)
15134 rdev->crit_proto_nlportid = info->snd_portid;
15135
15136 return ret;
15137}
15138
15139static int nl80211_crit_protocol_stop(struct sk_buff *skb,
15140 struct genl_info *info)
15141{
15142 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15143 struct wireless_dev *wdev = info->user_ptr[1];
15144
15145 if (!rdev->ops->crit_proto_stop)
15146 return -EOPNOTSUPP;
15147
15148 if (rdev->crit_proto_nlportid) {
15149 rdev->crit_proto_nlportid = 0;
15150 rdev_crit_proto_stop(rdev, wdev);
15151 }
15152 return 0;
15153}
15154
15155static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
15156 struct nlattr *attr,
15157 struct netlink_ext_ack *extack)
15158{
15159 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
15160 if (attr->nla_type & NLA_F_NESTED) {
15161 NL_SET_ERR_MSG_ATTR(extack, attr,
15162 "unexpected nested data");
15163 return -EINVAL;
15164 }
15165
15166 return 0;
15167 }
15168
15169 if (!(attr->nla_type & NLA_F_NESTED)) {
15170 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
15171 return -EINVAL;
15172 }
15173
15174 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
15175}
15176
15177static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
15178{
15179 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15180 struct wireless_dev *wdev =
15181 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
15182 info->attrs);
15183 int i, err;
15184 u32 vid, subcmd;
15185
15186 if (!rdev->wiphy.vendor_commands)
15187 return -EOPNOTSUPP;
15188
15189 if (IS_ERR(wdev)) {
15190 err = PTR_ERR(wdev);
15191 if (err != -EINVAL)
15192 return err;
15193 wdev = NULL;
15194 } else if (wdev->wiphy != &rdev->wiphy) {
15195 return -EINVAL;
15196 }
15197
15198 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
15199 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
15200 return -EINVAL;
15201
15202 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
15203 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
15204 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
15205 const struct wiphy_vendor_command *vcmd;
15206 void *data = NULL;
15207 int len = 0;
15208
15209 vcmd = &rdev->wiphy.vendor_commands[i];
15210
15211 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15212 continue;
15213
15214 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15215 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15216 if (!wdev)
15217 return -EINVAL;
15218 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15219 !wdev->netdev)
15220 return -EINVAL;
15221
15222 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15223 if (!wdev_running(wdev))
15224 return -ENETDOWN;
15225 }
15226 } else {
15227 wdev = NULL;
15228 }
15229
15230 if (!vcmd->doit)
15231 return -EOPNOTSUPP;
15232
15233 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
15234 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15235 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15236
15237 err = nl80211_vendor_check_policy(vcmd,
15238 info->attrs[NL80211_ATTR_VENDOR_DATA],
15239 info->extack);
15240 if (err)
15241 return err;
15242 }
15243
15244 rdev->cur_cmd_info = info;
15245 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
15246 rdev->cur_cmd_info = NULL;
15247 return err;
15248 }
15249
15250 return -EOPNOTSUPP;
15251}
15252
15253static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
15254 struct netlink_callback *cb,
15255 struct cfg80211_registered_device **rdev,
15256 struct wireless_dev **wdev)
15257{
15258 struct nlattr **attrbuf;
15259 u32 vid, subcmd;
15260 unsigned int i;
15261 int vcmd_idx = -1;
15262 int err;
15263 void *data = NULL;
15264 unsigned int data_len = 0;
15265
15266 if (cb->args[0]) {
15267 /* subtract the 1 again here */
15268 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15269 struct wireless_dev *tmp;
15270
15271 if (!wiphy)
15272 return -ENODEV;
15273 *rdev = wiphy_to_rdev(wiphy);
15274 *wdev = NULL;
15275
15276 if (cb->args[1]) {
15277 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15278 if (tmp->identifier == cb->args[1] - 1) {
15279 *wdev = tmp;
15280 break;
15281 }
15282 }
15283 }
15284
15285 /* keep rtnl locked in successful case */
15286 return 0;
15287 }
15288
15289 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15290 if (!attrbuf)
15291 return -ENOMEM;
15292
15293 err = nlmsg_parse_deprecated(cb->nlh,
15294 GENL_HDRLEN + nl80211_fam.hdrsize,
15295 attrbuf, nl80211_fam.maxattr,
15296 nl80211_policy, NULL);
15297 if (err)
15298 goto out;
15299
15300 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15301 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15302 err = -EINVAL;
15303 goto out;
15304 }
15305
15306 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15307 if (IS_ERR(*wdev))
15308 *wdev = NULL;
15309
15310 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15311 if (IS_ERR(*rdev)) {
15312 err = PTR_ERR(*rdev);
15313 goto out;
15314 }
15315
15316 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15317 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15318
15319 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15320 const struct wiphy_vendor_command *vcmd;
15321
15322 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15323
15324 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15325 continue;
15326
15327 if (!vcmd->dumpit) {
15328 err = -EOPNOTSUPP;
15329 goto out;
15330 }
15331
15332 vcmd_idx = i;
15333 break;
15334 }
15335
15336 if (vcmd_idx < 0) {
15337 err = -EOPNOTSUPP;
15338 goto out;
15339 }
15340
15341 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15342 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15343 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15344
15345 err = nl80211_vendor_check_policy(
15346 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15347 attrbuf[NL80211_ATTR_VENDOR_DATA],
15348 cb->extack);
15349 if (err)
15350 goto out;
15351 }
15352
15353 /* 0 is the first index - add 1 to parse only once */
15354 cb->args[0] = (*rdev)->wiphy_idx + 1;
15355 /* add 1 to know if it was NULL */
15356 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15357 cb->args[2] = vcmd_idx;
15358 cb->args[3] = (unsigned long)data;
15359 cb->args[4] = data_len;
15360
15361 /* keep rtnl locked in successful case */
15362 err = 0;
15363out:
15364 kfree(attrbuf);
15365 return err;
15366}
15367
15368static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15369 struct netlink_callback *cb)
15370{
15371 struct cfg80211_registered_device *rdev;
15372 struct wireless_dev *wdev;
15373 unsigned int vcmd_idx;
15374 const struct wiphy_vendor_command *vcmd;
15375 void *data;
15376 int data_len;
15377 int err;
15378 struct nlattr *vendor_data;
15379
15380 rtnl_lock();
15381 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15382 if (err)
15383 goto out;
15384
15385 vcmd_idx = cb->args[2];
15386 data = (void *)cb->args[3];
15387 data_len = cb->args[4];
15388 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15389
15390 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15391 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15392 if (!wdev) {
15393 err = -EINVAL;
15394 goto out;
15395 }
15396 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15397 !wdev->netdev) {
15398 err = -EINVAL;
15399 goto out;
15400 }
15401
15402 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15403 if (!wdev_running(wdev)) {
15404 err = -ENETDOWN;
15405 goto out;
15406 }
15407 }
15408 }
15409
15410 while (1) {
15411 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15412 cb->nlh->nlmsg_seq, NLM_F_MULTI,
15413 NL80211_CMD_VENDOR);
15414 if (!hdr)
15415 break;
15416
15417 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15418 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15419 wdev_id(wdev),
15420 NL80211_ATTR_PAD))) {
15421 genlmsg_cancel(skb, hdr);
15422 break;
15423 }
15424
15425 vendor_data = nla_nest_start_noflag(skb,
15426 NL80211_ATTR_VENDOR_DATA);
15427 if (!vendor_data) {
15428 genlmsg_cancel(skb, hdr);
15429 break;
15430 }
15431
15432 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15433 (unsigned long *)&cb->args[5]);
15434 nla_nest_end(skb, vendor_data);
15435
15436 if (err == -ENOBUFS || err == -ENOENT) {
15437 genlmsg_cancel(skb, hdr);
15438 break;
15439 } else if (err <= 0) {
15440 genlmsg_cancel(skb, hdr);
15441 goto out;
15442 }
15443
15444 genlmsg_end(skb, hdr);
15445 }
15446
15447 err = skb->len;
15448 out:
15449 rtnl_unlock();
15450 return err;
15451}
15452
15453struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15454 enum nl80211_commands cmd,
15455 enum nl80211_attrs attr,
15456 int approxlen)
15457{
15458 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15459
15460 if (WARN_ON(!rdev->cur_cmd_info))
15461 return NULL;
15462
15463 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15464 rdev->cur_cmd_info->snd_portid,
15465 rdev->cur_cmd_info->snd_seq,
15466 cmd, attr, NULL, GFP_KERNEL);
15467}
15468EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15469
15470int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15471{
15472 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15473 void *hdr = ((void **)skb->cb)[1];
15474 struct nlattr *data = ((void **)skb->cb)[2];
15475
15476 /* clear CB data for netlink core to own from now on */
15477 memset(skb->cb, 0, sizeof(skb->cb));
15478
15479 if (WARN_ON(!rdev->cur_cmd_info)) {
15480 kfree_skb(skb);
15481 return -EINVAL;
15482 }
15483
15484 nla_nest_end(skb, data);
15485 genlmsg_end(skb, hdr);
15486 return genlmsg_reply(skb, rdev->cur_cmd_info);
15487}
15488EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15489
15490unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15491{
15492 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15493
15494 if (WARN_ON(!rdev->cur_cmd_info))
15495 return 0;
15496
15497 return rdev->cur_cmd_info->snd_portid;
15498}
15499EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15500
15501static int nl80211_set_qos_map(struct sk_buff *skb,
15502 struct genl_info *info)
15503{
15504 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15505 struct cfg80211_qos_map *qos_map = NULL;
15506 struct net_device *dev = info->user_ptr[1];
15507 u8 *pos, len, num_des, des_len, des;
15508 int ret;
15509
15510 if (!rdev->ops->set_qos_map)
15511 return -EOPNOTSUPP;
15512
15513 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15514 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15515 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15516
15517 if (len % 2)
15518 return -EINVAL;
15519
15520 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15521 if (!qos_map)
15522 return -ENOMEM;
15523
15524 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15525 if (num_des) {
15526 des_len = num_des *
15527 sizeof(struct cfg80211_dscp_exception);
15528 memcpy(qos_map->dscp_exception, pos, des_len);
15529 qos_map->num_des = num_des;
15530 for (des = 0; des < num_des; des++) {
15531 if (qos_map->dscp_exception[des].up > 7) {
15532 kfree(qos_map);
15533 return -EINVAL;
15534 }
15535 }
15536 pos += des_len;
15537 }
15538 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15539 }
15540
15541 ret = nl80211_key_allowed(dev->ieee80211_ptr);
15542 if (!ret)
15543 ret = rdev_set_qos_map(rdev, dev, qos_map);
15544
15545 kfree(qos_map);
15546 return ret;
15547}
15548
15549static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15550{
15551 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15552 struct net_device *dev = info->user_ptr[1];
15553 struct wireless_dev *wdev = dev->ieee80211_ptr;
15554 const u8 *peer;
15555 u8 tsid, up;
15556 u16 admitted_time = 0;
15557
15558 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15559 return -EOPNOTSUPP;
15560
15561 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15562 !info->attrs[NL80211_ATTR_USER_PRIO])
15563 return -EINVAL;
15564
15565 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15566 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15567
15568 /* WMM uses TIDs 0-7 even for TSPEC */
15569 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15570 /* TODO: handle 802.11 TSPEC/admission control
15571 * need more attributes for that (e.g. BA session requirement);
15572 * change the WMM admission test above to allow both then
15573 */
15574 return -EINVAL;
15575 }
15576
15577 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15578
15579 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15580 admitted_time =
15581 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15582 if (!admitted_time)
15583 return -EINVAL;
15584 }
15585
15586 switch (wdev->iftype) {
15587 case NL80211_IFTYPE_STATION:
15588 case NL80211_IFTYPE_P2P_CLIENT:
15589 if (wdev->connected)
15590 break;
15591 return -ENOTCONN;
15592 default:
15593 return -EOPNOTSUPP;
15594 }
15595
15596 return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15597}
15598
15599static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15600{
15601 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15602 struct net_device *dev = info->user_ptr[1];
15603 const u8 *peer;
15604 u8 tsid;
15605
15606 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15607 return -EINVAL;
15608
15609 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15610 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15611
15612 return rdev_del_tx_ts(rdev, dev, tsid, peer);
15613}
15614
15615static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15616 struct genl_info *info)
15617{
15618 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15619 struct net_device *dev = info->user_ptr[1];
15620 struct wireless_dev *wdev = dev->ieee80211_ptr;
15621 struct cfg80211_chan_def chandef = {};
15622 const u8 *addr;
15623 u8 oper_class;
15624 int err;
15625
15626 if (!rdev->ops->tdls_channel_switch ||
15627 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15628 return -EOPNOTSUPP;
15629
15630 switch (dev->ieee80211_ptr->iftype) {
15631 case NL80211_IFTYPE_STATION:
15632 case NL80211_IFTYPE_P2P_CLIENT:
15633 break;
15634 default:
15635 return -EOPNOTSUPP;
15636 }
15637
15638 if (!info->attrs[NL80211_ATTR_MAC] ||
15639 !info->attrs[NL80211_ATTR_OPER_CLASS])
15640 return -EINVAL;
15641
15642 err = nl80211_parse_chandef(rdev, info, &chandef);
15643 if (err)
15644 return err;
15645
15646 /*
15647 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15648 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15649 * specification is not defined for them.
15650 */
15651 if (chandef.chan->band == NL80211_BAND_2GHZ &&
15652 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15653 chandef.width != NL80211_CHAN_WIDTH_20)
15654 return -EINVAL;
15655
15656 /* we will be active on the TDLS link */
15657 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15658 wdev->iftype))
15659 return -EINVAL;
15660
15661 /* don't allow switching to DFS channels */
15662 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15663 return -EINVAL;
15664
15665 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15666 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15667
15668 return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15669}
15670
15671static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15672 struct genl_info *info)
15673{
15674 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15675 struct net_device *dev = info->user_ptr[1];
15676 const u8 *addr;
15677
15678 if (!rdev->ops->tdls_channel_switch ||
15679 !rdev->ops->tdls_cancel_channel_switch ||
15680 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15681 return -EOPNOTSUPP;
15682
15683 switch (dev->ieee80211_ptr->iftype) {
15684 case NL80211_IFTYPE_STATION:
15685 case NL80211_IFTYPE_P2P_CLIENT:
15686 break;
15687 default:
15688 return -EOPNOTSUPP;
15689 }
15690
15691 if (!info->attrs[NL80211_ATTR_MAC])
15692 return -EINVAL;
15693
15694 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15695
15696 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15697
15698 return 0;
15699}
15700
15701static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15702 struct genl_info *info)
15703{
15704 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15705 struct net_device *dev = info->user_ptr[1];
15706 struct wireless_dev *wdev = dev->ieee80211_ptr;
15707 const struct nlattr *nla;
15708 bool enabled;
15709
15710 if (!rdev->ops->set_multicast_to_unicast)
15711 return -EOPNOTSUPP;
15712
15713 if (wdev->iftype != NL80211_IFTYPE_AP &&
15714 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15715 return -EOPNOTSUPP;
15716
15717 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15718 enabled = nla_get_flag(nla);
15719
15720 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15721}
15722
15723static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15724{
15725 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15726 struct net_device *dev = info->user_ptr[1];
15727 struct wireless_dev *wdev = dev->ieee80211_ptr;
15728 struct cfg80211_pmk_conf pmk_conf = {};
15729
15730 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15731 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15732 return -EOPNOTSUPP;
15733
15734 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15735 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15736 return -EOPNOTSUPP;
15737
15738 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15739 return -EINVAL;
15740
15741 if (!wdev->connected)
15742 return -ENOTCONN;
15743
15744 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15745 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
15746 return -EINVAL;
15747
15748 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15749 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15750 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15751 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
15752 return -EINVAL;
15753
15754 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15755 pmk_conf.pmk_r0_name =
15756 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15757
15758 return rdev_set_pmk(rdev, dev, &pmk_conf);
15759}
15760
15761static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15762{
15763 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15764 struct net_device *dev = info->user_ptr[1];
15765 struct wireless_dev *wdev = dev->ieee80211_ptr;
15766 const u8 *aa;
15767
15768 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15769 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15770 return -EOPNOTSUPP;
15771
15772 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15773 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15774 return -EOPNOTSUPP;
15775
15776 if (!info->attrs[NL80211_ATTR_MAC])
15777 return -EINVAL;
15778
15779 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15780 return rdev_del_pmk(rdev, dev, aa);
15781}
15782
15783static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15784{
15785 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15786 struct net_device *dev = info->user_ptr[1];
15787 struct cfg80211_external_auth_params params;
15788
15789 if (!rdev->ops->external_auth)
15790 return -EOPNOTSUPP;
15791
15792 if (!info->attrs[NL80211_ATTR_SSID] &&
15793 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15794 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15795 return -EINVAL;
15796
15797 if (!info->attrs[NL80211_ATTR_BSSID])
15798 return -EINVAL;
15799
15800 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15801 return -EINVAL;
15802
15803 memset(&params, 0, sizeof(params));
15804
15805 if (info->attrs[NL80211_ATTR_SSID]) {
15806 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15807 if (params.ssid.ssid_len == 0)
15808 return -EINVAL;
15809 memcpy(params.ssid.ssid,
15810 nla_data(info->attrs[NL80211_ATTR_SSID]),
15811 params.ssid.ssid_len);
15812 }
15813
15814 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15815 ETH_ALEN);
15816
15817 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15818
15819 if (info->attrs[NL80211_ATTR_PMKID])
15820 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15821
15822 return rdev_external_auth(rdev, dev, &params);
15823}
15824
15825static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15826{
15827 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15828 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15829 struct net_device *dev = info->user_ptr[1];
15830 struct wireless_dev *wdev = dev->ieee80211_ptr;
15831 const u8 *buf;
15832 size_t len;
15833 u8 *dest;
15834 u16 proto;
15835 bool noencrypt;
15836 u64 cookie = 0;
15837 int link_id;
15838 int err;
15839
15840 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15841 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15842 return -EOPNOTSUPP;
15843
15844 if (!rdev->ops->tx_control_port)
15845 return -EOPNOTSUPP;
15846
15847 if (!info->attrs[NL80211_ATTR_FRAME] ||
15848 !info->attrs[NL80211_ATTR_MAC] ||
15849 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15850 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15851 return -EINVAL;
15852 }
15853
15854 switch (wdev->iftype) {
15855 case NL80211_IFTYPE_AP:
15856 case NL80211_IFTYPE_P2P_GO:
15857 case NL80211_IFTYPE_MESH_POINT:
15858 break;
15859 case NL80211_IFTYPE_ADHOC:
15860 if (wdev->u.ibss.current_bss)
15861 break;
15862 return -ENOTCONN;
15863 case NL80211_IFTYPE_STATION:
15864 case NL80211_IFTYPE_P2P_CLIENT:
15865 if (wdev->connected)
15866 break;
15867 return -ENOTCONN;
15868 default:
15869 return -EOPNOTSUPP;
15870 }
15871
15872 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15873 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15874 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15875 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15876 noencrypt =
15877 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15878
15879 link_id = nl80211_link_id_or_invalid(info->attrs);
15880
15881 err = rdev_tx_control_port(rdev, dev, buf, len,
15882 dest, cpu_to_be16(proto), noencrypt, link_id,
15883 dont_wait_for_ack ? NULL : &cookie);
15884 if (!err && !dont_wait_for_ack)
15885 nl_set_extack_cookie_u64(info->extack, cookie);
15886 return err;
15887}
15888
15889static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15890 struct genl_info *info)
15891{
15892 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15893 struct net_device *dev = info->user_ptr[1];
15894 struct wireless_dev *wdev = dev->ieee80211_ptr;
15895 struct cfg80211_ftm_responder_stats ftm_stats = {};
15896 unsigned int link_id = nl80211_link_id(info->attrs);
15897 struct sk_buff *msg;
15898 void *hdr;
15899 struct nlattr *ftm_stats_attr;
15900 int err;
15901
15902 if (wdev->iftype != NL80211_IFTYPE_AP ||
15903 !wdev->links[link_id].ap.beacon_interval)
15904 return -EOPNOTSUPP;
15905
15906 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15907 if (err)
15908 return err;
15909
15910 if (!ftm_stats.filled)
15911 return -ENODATA;
15912
15913 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15914 if (!msg)
15915 return -ENOMEM;
15916
15917 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15918 NL80211_CMD_GET_FTM_RESPONDER_STATS);
15919 if (!hdr)
15920 goto nla_put_failure;
15921
15922 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15923 goto nla_put_failure;
15924
15925 ftm_stats_attr = nla_nest_start_noflag(msg,
15926 NL80211_ATTR_FTM_RESPONDER_STATS);
15927 if (!ftm_stats_attr)
15928 goto nla_put_failure;
15929
15930#define SET_FTM(field, name, type) \
15931 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15932 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
15933 ftm_stats.field)) \
15934 goto nla_put_failure; } while (0)
15935#define SET_FTM_U64(field, name) \
15936 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15937 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
15938 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
15939 goto nla_put_failure; } while (0)
15940
15941 SET_FTM(success_num, SUCCESS_NUM, u32);
15942 SET_FTM(partial_num, PARTIAL_NUM, u32);
15943 SET_FTM(failed_num, FAILED_NUM, u32);
15944 SET_FTM(asap_num, ASAP_NUM, u32);
15945 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15946 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15947 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15948 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15949 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15950#undef SET_FTM
15951
15952 nla_nest_end(msg, ftm_stats_attr);
15953
15954 genlmsg_end(msg, hdr);
15955 return genlmsg_reply(msg, info);
15956
15957nla_put_failure:
15958 nlmsg_free(msg);
15959 return -ENOBUFS;
15960}
15961
15962static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15963{
15964 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15965 struct cfg80211_update_owe_info owe_info;
15966 struct net_device *dev = info->user_ptr[1];
15967
15968 if (!rdev->ops->update_owe_info)
15969 return -EOPNOTSUPP;
15970
15971 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15972 !info->attrs[NL80211_ATTR_MAC])
15973 return -EINVAL;
15974
15975 memset(&owe_info, 0, sizeof(owe_info));
15976 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15977 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15978
15979 if (info->attrs[NL80211_ATTR_IE]) {
15980 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15981 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15982 }
15983
15984 return rdev_update_owe_info(rdev, dev, &owe_info);
15985}
15986
15987static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15988{
15989 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15990 struct net_device *dev = info->user_ptr[1];
15991 struct wireless_dev *wdev = dev->ieee80211_ptr;
15992 struct station_info sinfo = {};
15993 const u8 *buf;
15994 size_t len;
15995 u8 *dest;
15996 int err;
15997
15998 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15999 return -EOPNOTSUPP;
16000
16001 if (!info->attrs[NL80211_ATTR_MAC] ||
16002 !info->attrs[NL80211_ATTR_FRAME]) {
16003 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
16004 return -EINVAL;
16005 }
16006
16007 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
16008 return -EOPNOTSUPP;
16009
16010 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
16011 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
16012 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
16013
16014 if (len < sizeof(struct ethhdr))
16015 return -EINVAL;
16016
16017 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
16018 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
16019 return -EINVAL;
16020
16021 err = rdev_get_station(rdev, dev, dest, &sinfo);
16022 if (err)
16023 return err;
16024
16025 cfg80211_sinfo_release_content(&sinfo);
16026
16027 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
16028}
16029
16030static int parse_tid_conf(struct cfg80211_registered_device *rdev,
16031 struct nlattr *attrs[], struct net_device *dev,
16032 struct cfg80211_tid_cfg *tid_conf,
16033 struct genl_info *info, const u8 *peer,
16034 unsigned int link_id)
16035{
16036 struct netlink_ext_ack *extack = info->extack;
16037 u64 mask;
16038 int err;
16039
16040 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
16041 return -EINVAL;
16042
16043 tid_conf->config_override =
16044 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
16045 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
16046
16047 if (tid_conf->config_override) {
16048 if (rdev->ops->reset_tid_config) {
16049 err = rdev_reset_tid_config(rdev, dev, peer,
16050 tid_conf->tids);
16051 if (err)
16052 return err;
16053 } else {
16054 return -EINVAL;
16055 }
16056 }
16057
16058 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
16059 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
16060 tid_conf->noack =
16061 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
16062 }
16063
16064 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
16065 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
16066 tid_conf->retry_short =
16067 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
16068
16069 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
16070 return -EINVAL;
16071 }
16072
16073 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
16074 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
16075 tid_conf->retry_long =
16076 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
16077
16078 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
16079 return -EINVAL;
16080 }
16081
16082 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
16083 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
16084 tid_conf->ampdu =
16085 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
16086 }
16087
16088 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
16089 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
16090 tid_conf->rtscts =
16091 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
16092 }
16093
16094 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
16095 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
16096 tid_conf->amsdu =
16097 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
16098 }
16099
16100 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
16101 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
16102
16103 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
16104
16105 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
16106 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
16107 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
16108 &tid_conf->txrate_mask, dev,
16109 true, link_id);
16110 if (err)
16111 return err;
16112
16113 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
16114 }
16115 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
16116 }
16117
16118 if (peer)
16119 mask = rdev->wiphy.tid_config_support.peer;
16120 else
16121 mask = rdev->wiphy.tid_config_support.vif;
16122
16123 if (tid_conf->mask & ~mask) {
16124 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
16125 return -EOPNOTSUPP;
16126 }
16127
16128 return 0;
16129}
16130
16131static int nl80211_set_tid_config(struct sk_buff *skb,
16132 struct genl_info *info)
16133{
16134 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16135 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
16136 unsigned int link_id = nl80211_link_id(info->attrs);
16137 struct net_device *dev = info->user_ptr[1];
16138 struct cfg80211_tid_config *tid_config;
16139 struct nlattr *tid;
16140 int conf_idx = 0, rem_conf;
16141 int ret = -EINVAL;
16142 u32 num_conf = 0;
16143
16144 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
16145 return -EINVAL;
16146
16147 if (!rdev->ops->set_tid_config)
16148 return -EOPNOTSUPP;
16149
16150 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16151 rem_conf)
16152 num_conf++;
16153
16154 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
16155 GFP_KERNEL);
16156 if (!tid_config)
16157 return -ENOMEM;
16158
16159 tid_config->n_tid_conf = num_conf;
16160
16161 if (info->attrs[NL80211_ATTR_MAC])
16162 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16163
16164 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16165 rem_conf) {
16166 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
16167 tid, NULL, NULL);
16168
16169 if (ret)
16170 goto bad_tid_conf;
16171
16172 ret = parse_tid_conf(rdev, attrs, dev,
16173 &tid_config->tid_conf[conf_idx],
16174 info, tid_config->peer, link_id);
16175 if (ret)
16176 goto bad_tid_conf;
16177
16178 conf_idx++;
16179 }
16180
16181 ret = rdev_set_tid_config(rdev, dev, tid_config);
16182
16183bad_tid_conf:
16184 kfree(tid_config);
16185 return ret;
16186}
16187
16188static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
16189{
16190 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16191 struct cfg80211_color_change_settings params = {};
16192 struct net_device *dev = info->user_ptr[1];
16193 struct wireless_dev *wdev = dev->ieee80211_ptr;
16194 struct nlattr **tb;
16195 u16 offset;
16196 int err;
16197
16198 if (!rdev->ops->color_change)
16199 return -EOPNOTSUPP;
16200
16201 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16202 NL80211_EXT_FEATURE_BSS_COLOR))
16203 return -EOPNOTSUPP;
16204
16205 if (wdev->iftype != NL80211_IFTYPE_AP)
16206 return -EOPNOTSUPP;
16207
16208 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
16209 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
16210 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
16211 return -EINVAL;
16212
16213 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16214 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16215
16216 err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
16217 info->extack);
16218 if (err)
16219 return err;
16220
16221 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16222 if (!tb)
16223 return -ENOMEM;
16224
16225 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16226 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16227 nl80211_policy, info->extack);
16228 if (err)
16229 goto out;
16230
16231 err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
16232 info->extack);
16233 if (err)
16234 goto out;
16235
16236 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16237 err = -EINVAL;
16238 goto out;
16239 }
16240
16241 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16242 err = -EINVAL;
16243 goto out;
16244 }
16245
16246 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16247 if (offset >= params.beacon_color_change.tail_len) {
16248 err = -EINVAL;
16249 goto out;
16250 }
16251
16252 if (params.beacon_color_change.tail[offset] != params.count) {
16253 err = -EINVAL;
16254 goto out;
16255 }
16256
16257 params.counter_offset_beacon = offset;
16258
16259 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16260 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16261 sizeof(u16)) {
16262 err = -EINVAL;
16263 goto out;
16264 }
16265
16266 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16267 if (offset >= params.beacon_color_change.probe_resp_len) {
16268 err = -EINVAL;
16269 goto out;
16270 }
16271
16272 if (params.beacon_color_change.probe_resp[offset] !=
16273 params.count) {
16274 err = -EINVAL;
16275 goto out;
16276 }
16277
16278 params.counter_offset_presp = offset;
16279 }
16280
16281 params.link_id = nl80211_link_id(info->attrs);
16282 err = rdev_color_change(rdev, dev, &params);
16283
16284out:
16285 kfree(params.beacon_next.mbssid_ies);
16286 kfree(params.beacon_color_change.mbssid_ies);
16287 kfree(params.beacon_next.rnr_ies);
16288 kfree(params.beacon_color_change.rnr_ies);
16289 kfree(tb);
16290 return err;
16291}
16292
16293static int nl80211_set_fils_aad(struct sk_buff *skb,
16294 struct genl_info *info)
16295{
16296 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16297 struct net_device *dev = info->user_ptr[1];
16298 struct cfg80211_fils_aad fils_aad = {};
16299 u8 *nonces;
16300
16301 if (!info->attrs[NL80211_ATTR_MAC] ||
16302 !info->attrs[NL80211_ATTR_FILS_KEK] ||
16303 !info->attrs[NL80211_ATTR_FILS_NONCES])
16304 return -EINVAL;
16305
16306 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16307 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16308 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16309 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16310 fils_aad.snonce = nonces;
16311 fils_aad.anonce = nonces + FILS_NONCE_LEN;
16312
16313 return rdev_set_fils_aad(rdev, dev, &fils_aad);
16314}
16315
16316static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16317{
16318 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16319 unsigned int link_id = nl80211_link_id(info->attrs);
16320 struct net_device *dev = info->user_ptr[1];
16321 struct wireless_dev *wdev = dev->ieee80211_ptr;
16322 int ret;
16323
16324 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16325 return -EINVAL;
16326
16327 switch (wdev->iftype) {
16328 case NL80211_IFTYPE_AP:
16329 break;
16330 default:
16331 return -EINVAL;
16332 }
16333
16334 if (!info->attrs[NL80211_ATTR_MAC] ||
16335 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16336 return -EINVAL;
16337
16338 wdev->valid_links |= BIT(link_id);
16339 ether_addr_copy(wdev->links[link_id].addr,
16340 nla_data(info->attrs[NL80211_ATTR_MAC]));
16341
16342 ret = rdev_add_intf_link(rdev, wdev, link_id);
16343 if (ret) {
16344 wdev->valid_links &= ~BIT(link_id);
16345 eth_zero_addr(wdev->links[link_id].addr);
16346 }
16347
16348 return ret;
16349}
16350
16351static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16352{
16353 unsigned int link_id = nl80211_link_id(info->attrs);
16354 struct net_device *dev = info->user_ptr[1];
16355 struct wireless_dev *wdev = dev->ieee80211_ptr;
16356
16357 /* cannot remove if there's no link */
16358 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16359 return -EINVAL;
16360
16361 switch (wdev->iftype) {
16362 case NL80211_IFTYPE_AP:
16363 break;
16364 default:
16365 return -EINVAL;
16366 }
16367
16368 cfg80211_remove_link(wdev, link_id);
16369
16370 return 0;
16371}
16372
16373static int
16374nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16375 bool add)
16376{
16377 struct link_station_parameters params = {};
16378 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16379 struct net_device *dev = info->user_ptr[1];
16380 int err;
16381
16382 if ((add && !rdev->ops->add_link_station) ||
16383 (!add && !rdev->ops->mod_link_station))
16384 return -EOPNOTSUPP;
16385
16386 if (add && !info->attrs[NL80211_ATTR_MAC])
16387 return -EINVAL;
16388
16389 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16390 return -EINVAL;
16391
16392 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16393 return -EINVAL;
16394
16395 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16396
16397 if (info->attrs[NL80211_ATTR_MAC]) {
16398 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16399 if (!is_valid_ether_addr(params.link_mac))
16400 return -EINVAL;
16401 }
16402
16403 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16404 return -EINVAL;
16405
16406 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16407
16408 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16409 params.supported_rates =
16410 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16411 params.supported_rates_len =
16412 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16413 }
16414
16415 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16416 params.ht_capa =
16417 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16418
16419 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16420 params.vht_capa =
16421 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16422
16423 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16424 params.he_capa =
16425 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16426 params.he_capa_len =
16427 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16428
16429 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16430 params.eht_capa =
16431 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16432 params.eht_capa_len =
16433 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16434
16435 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16436 (const u8 *)params.eht_capa,
16437 params.eht_capa_len,
16438 false))
16439 return -EINVAL;
16440 }
16441 }
16442
16443 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16444 params.he_6ghz_capa =
16445 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16446
16447 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16448 params.opmode_notif_used = true;
16449 params.opmode_notif =
16450 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16451 }
16452
16453 err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16454 &params.txpwr_set);
16455 if (err)
16456 return err;
16457
16458 if (add)
16459 return rdev_add_link_station(rdev, dev, &params);
16460
16461 return rdev_mod_link_station(rdev, dev, &params);
16462}
16463
16464static int
16465nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16466{
16467 return nl80211_add_mod_link_station(skb, info, true);
16468}
16469
16470static int
16471nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16472{
16473 return nl80211_add_mod_link_station(skb, info, false);
16474}
16475
16476static int
16477nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16478{
16479 struct link_station_del_parameters params = {};
16480 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16481 struct net_device *dev = info->user_ptr[1];
16482
16483 if (!rdev->ops->del_link_station)
16484 return -EOPNOTSUPP;
16485
16486 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16487 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16488 return -EINVAL;
16489
16490 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16491 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16492
16493 return rdev_del_link_station(rdev, dev, &params);
16494}
16495
16496static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16497 struct genl_info *info)
16498{
16499 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16500 struct net_device *dev = info->user_ptr[1];
16501 struct cfg80211_set_hw_timestamp hwts = {};
16502
16503 if (!rdev->wiphy.hw_timestamp_max_peers)
16504 return -EOPNOTSUPP;
16505
16506 if (!info->attrs[NL80211_ATTR_MAC] &&
16507 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16508 return -EOPNOTSUPP;
16509
16510 if (info->attrs[NL80211_ATTR_MAC])
16511 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16512
16513 hwts.enable =
16514 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16515
16516 return rdev_set_hw_timestamp(rdev, dev, &hwts);
16517}
16518
16519static int
16520nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
16521{
16522 struct cfg80211_ttlm_params params = {};
16523 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16524 struct net_device *dev = info->user_ptr[1];
16525 struct wireless_dev *wdev = dev->ieee80211_ptr;
16526
16527 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16528 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16529 return -EOPNOTSUPP;
16530
16531 if (!wdev->connected)
16532 return -ENOLINK;
16533
16534 if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
16535 !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
16536 return -EINVAL;
16537
16538 nla_memcpy(params.dlink,
16539 info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
16540 sizeof(params.dlink));
16541 nla_memcpy(params.ulink,
16542 info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
16543 sizeof(params.ulink));
16544
16545 return rdev_set_ttlm(rdev, dev, &params);
16546}
16547
16548static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
16549{
16550 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16551 struct net_device *dev = info->user_ptr[1];
16552 struct wireless_dev *wdev = dev->ieee80211_ptr;
16553 struct cfg80211_ml_reconf_req req = {};
16554 unsigned int link_id;
16555 u16 add_links;
16556 int err;
16557
16558 if (!wdev->valid_links)
16559 return -EINVAL;
16560
16561 if (dev->ieee80211_ptr->conn_owner_nlportid &&
16562 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
16563 return -EPERM;
16564
16565 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
16566 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
16567 return -EOPNOTSUPP;
16568
16569 add_links = 0;
16570 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
16571 err = nl80211_process_links(rdev, req.add_links,
16572 /* mark as MLO, but not assoc */
16573 IEEE80211_MLD_MAX_NUM_LINKS,
16574 NULL, 0, info);
16575 if (err)
16576 return err;
16577
16578 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
16579 link_id++) {
16580 if (!req.add_links[link_id].bss)
16581 continue;
16582 add_links |= BIT(link_id);
16583 }
16584 }
16585
16586 if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
16587 req.rem_links =
16588 nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
16589
16590 /* Validate that existing links are not added, removed links are valid
16591 * and don't allow adding and removing the same links
16592 */
16593 if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
16594 (wdev->valid_links & add_links) ||
16595 ((wdev->valid_links & req.rem_links) != req.rem_links)) {
16596 err = -EINVAL;
16597 goto out;
16598 }
16599
16600 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
16601 req.ext_mld_capa_ops =
16602 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
16603
16604 err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
16605
16606out:
16607 for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
16608 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
16609
16610 return err;
16611}
16612
16613static int
16614nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
16615{
16616 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16617 struct net_device *dev = info->user_ptr[1];
16618 struct wireless_dev *wdev = dev->ieee80211_ptr;
16619 bool val;
16620
16621 if (wdev->iftype != NL80211_IFTYPE_STATION &&
16622 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16623 return -EOPNOTSUPP;
16624
16625 if (!wdev->connected)
16626 return -ENOLINK;
16627
16628 val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
16629
16630 return rdev_set_epcs(rdev, dev, val);
16631}
16632
16633#define NL80211_FLAG_NEED_WIPHY 0x01
16634#define NL80211_FLAG_NEED_NETDEV 0x02
16635#define NL80211_FLAG_NEED_RTNL 0x04
16636#define NL80211_FLAG_CHECK_NETDEV_UP 0x08
16637#define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
16638 NL80211_FLAG_CHECK_NETDEV_UP)
16639#define NL80211_FLAG_NEED_WDEV 0x10
16640/* If a netdev is associated, it must be UP, P2P must be started */
16641#define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
16642 NL80211_FLAG_CHECK_NETDEV_UP)
16643#define NL80211_FLAG_CLEAR_SKB 0x20
16644#define NL80211_FLAG_NO_WIPHY_MTX 0x40
16645#define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
16646#define NL80211_FLAG_MLO_UNSUPPORTED 0x100
16647
16648#define INTERNAL_FLAG_SELECTORS(__sel) \
16649 SELECTOR(__sel, NONE, 0) /* must be first */ \
16650 SELECTOR(__sel, WIPHY, \
16651 NL80211_FLAG_NEED_WIPHY) \
16652 SELECTOR(__sel, WDEV, \
16653 NL80211_FLAG_NEED_WDEV) \
16654 SELECTOR(__sel, NETDEV, \
16655 NL80211_FLAG_NEED_NETDEV) \
16656 SELECTOR(__sel, NETDEV_LINK, \
16657 NL80211_FLAG_NEED_NETDEV | \
16658 NL80211_FLAG_MLO_VALID_LINK_ID) \
16659 SELECTOR(__sel, NETDEV_NO_MLO, \
16660 NL80211_FLAG_NEED_NETDEV | \
16661 NL80211_FLAG_MLO_UNSUPPORTED) \
16662 SELECTOR(__sel, WIPHY_RTNL, \
16663 NL80211_FLAG_NEED_WIPHY | \
16664 NL80211_FLAG_NEED_RTNL) \
16665 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
16666 NL80211_FLAG_NEED_WIPHY | \
16667 NL80211_FLAG_NEED_RTNL | \
16668 NL80211_FLAG_NO_WIPHY_MTX) \
16669 SELECTOR(__sel, WDEV_RTNL, \
16670 NL80211_FLAG_NEED_WDEV | \
16671 NL80211_FLAG_NEED_RTNL) \
16672 SELECTOR(__sel, NETDEV_RTNL, \
16673 NL80211_FLAG_NEED_NETDEV | \
16674 NL80211_FLAG_NEED_RTNL) \
16675 SELECTOR(__sel, NETDEV_UP, \
16676 NL80211_FLAG_NEED_NETDEV_UP) \
16677 SELECTOR(__sel, NETDEV_UP_LINK, \
16678 NL80211_FLAG_NEED_NETDEV_UP | \
16679 NL80211_FLAG_MLO_VALID_LINK_ID) \
16680 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
16681 NL80211_FLAG_NEED_NETDEV_UP | \
16682 NL80211_FLAG_MLO_UNSUPPORTED) \
16683 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
16684 NL80211_FLAG_NEED_NETDEV_UP | \
16685 NL80211_FLAG_CLEAR_SKB | \
16686 NL80211_FLAG_MLO_UNSUPPORTED) \
16687 SELECTOR(__sel, NETDEV_UP_NOTMX, \
16688 NL80211_FLAG_NEED_NETDEV_UP | \
16689 NL80211_FLAG_NO_WIPHY_MTX) \
16690 SELECTOR(__sel, NETDEV_UP_NOTMX_MLO, \
16691 NL80211_FLAG_NEED_NETDEV_UP | \
16692 NL80211_FLAG_NO_WIPHY_MTX | \
16693 NL80211_FLAG_MLO_VALID_LINK_ID) \
16694 SELECTOR(__sel, NETDEV_UP_CLEAR, \
16695 NL80211_FLAG_NEED_NETDEV_UP | \
16696 NL80211_FLAG_CLEAR_SKB) \
16697 SELECTOR(__sel, WDEV_UP, \
16698 NL80211_FLAG_NEED_WDEV_UP) \
16699 SELECTOR(__sel, WDEV_UP_LINK, \
16700 NL80211_FLAG_NEED_WDEV_UP | \
16701 NL80211_FLAG_MLO_VALID_LINK_ID) \
16702 SELECTOR(__sel, WDEV_UP_RTNL, \
16703 NL80211_FLAG_NEED_WDEV_UP | \
16704 NL80211_FLAG_NEED_RTNL) \
16705 SELECTOR(__sel, WIPHY_CLEAR, \
16706 NL80211_FLAG_NEED_WIPHY | \
16707 NL80211_FLAG_CLEAR_SKB)
16708
16709enum nl80211_internal_flags_selector {
16710#define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
16711 INTERNAL_FLAG_SELECTORS(_)
16712#undef SELECTOR
16713};
16714
16715static u32 nl80211_internal_flags[] = {
16716#define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
16717 INTERNAL_FLAG_SELECTORS(_)
16718#undef SELECTOR
16719};
16720
16721static int nl80211_pre_doit(const struct genl_split_ops *ops,
16722 struct sk_buff *skb,
16723 struct genl_info *info)
16724{
16725 struct cfg80211_registered_device *rdev = NULL;
16726 struct wireless_dev *wdev = NULL;
16727 struct net_device *dev = NULL;
16728 u32 internal_flags;
16729 int err;
16730
16731 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16732 return -EINVAL;
16733
16734 internal_flags = nl80211_internal_flags[ops->internal_flags];
16735
16736 rtnl_lock();
16737 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16738 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16739 if (IS_ERR(rdev)) {
16740 err = PTR_ERR(rdev);
16741 goto out_unlock;
16742 }
16743 info->user_ptr[0] = rdev;
16744 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16745 internal_flags & NL80211_FLAG_NEED_WDEV) {
16746 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16747 info->attrs);
16748 if (IS_ERR(wdev)) {
16749 err = PTR_ERR(wdev);
16750 goto out_unlock;
16751 }
16752
16753 dev = wdev->netdev;
16754 dev_hold(dev);
16755 rdev = wiphy_to_rdev(wdev->wiphy);
16756
16757 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16758 if (!dev) {
16759 err = -EINVAL;
16760 goto out_unlock;
16761 }
16762
16763 info->user_ptr[1] = dev;
16764 } else {
16765 info->user_ptr[1] = wdev;
16766 }
16767
16768 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16769 !wdev_running(wdev)) {
16770 err = -ENETDOWN;
16771 goto out_unlock;
16772 }
16773
16774 info->user_ptr[0] = rdev;
16775 }
16776
16777 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16778 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16779
16780 if (!wdev) {
16781 err = -EINVAL;
16782 goto out_unlock;
16783 }
16784
16785 /* MLO -> require valid link ID */
16786 if (wdev->valid_links &&
16787 (!link_id ||
16788 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16789 err = -EINVAL;
16790 goto out_unlock;
16791 }
16792
16793 /* non-MLO -> no link ID attribute accepted */
16794 if (!wdev->valid_links && link_id) {
16795 err = -EINVAL;
16796 goto out_unlock;
16797 }
16798 }
16799
16800 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16801 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16802 (wdev && wdev->valid_links)) {
16803 err = -EINVAL;
16804 goto out_unlock;
16805 }
16806 }
16807
16808 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16809 wiphy_lock(&rdev->wiphy);
16810 /* we keep the mutex locked until post_doit */
16811 __release(&rdev->wiphy.mtx);
16812 }
16813 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16814 rtnl_unlock();
16815
16816 return 0;
16817out_unlock:
16818 rtnl_unlock();
16819 dev_put(dev);
16820 return err;
16821}
16822
16823static void nl80211_post_doit(const struct genl_split_ops *ops,
16824 struct sk_buff *skb,
16825 struct genl_info *info)
16826{
16827 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16828
16829 if (info->user_ptr[1]) {
16830 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16831 struct wireless_dev *wdev = info->user_ptr[1];
16832
16833 dev_put(wdev->netdev);
16834 } else {
16835 dev_put(info->user_ptr[1]);
16836 }
16837 }
16838
16839 if (info->user_ptr[0] &&
16840 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16841 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16842
16843 /* we kept the mutex locked since pre_doit */
16844 __acquire(&rdev->wiphy.mtx);
16845 wiphy_unlock(&rdev->wiphy);
16846 }
16847
16848 if (internal_flags & NL80211_FLAG_NEED_RTNL)
16849 rtnl_unlock();
16850
16851 /* If needed, clear the netlink message payload from the SKB
16852 * as it might contain key data that shouldn't stick around on
16853 * the heap after the SKB is freed. The netlink message header
16854 * is still needed for further processing, so leave it intact.
16855 */
16856 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16857 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16858
16859 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16860 }
16861}
16862
16863static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16864 struct cfg80211_sar_specs *sar_specs,
16865 struct nlattr *spec[], int index)
16866{
16867 u32 range_index, i;
16868
16869 if (!sar_specs || !spec)
16870 return -EINVAL;
16871
16872 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16873 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16874 return -EINVAL;
16875
16876 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16877
16878 /* check if range_index exceeds num_freq_ranges */
16879 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16880 return -EINVAL;
16881
16882 /* check if range_index duplicates */
16883 for (i = 0; i < index; i++) {
16884 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16885 return -EINVAL;
16886 }
16887
16888 sar_specs->sub_specs[index].power =
16889 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16890
16891 sar_specs->sub_specs[index].freq_range_index = range_index;
16892
16893 return 0;
16894}
16895
16896static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16897{
16898 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16899 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16900 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16901 struct cfg80211_sar_specs *sar_spec;
16902 enum nl80211_sar_type type;
16903 struct nlattr *spec_list;
16904 u32 specs;
16905 int rem, err;
16906
16907 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16908 return -EOPNOTSUPP;
16909
16910 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16911 return -EINVAL;
16912
16913 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16914 info->attrs[NL80211_ATTR_SAR_SPEC],
16915 NULL, NULL);
16916
16917 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16918 return -EINVAL;
16919
16920 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16921 if (type != rdev->wiphy.sar_capa->type)
16922 return -EINVAL;
16923
16924 specs = 0;
16925 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16926 specs++;
16927
16928 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16929 return -EINVAL;
16930
16931 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16932 if (!sar_spec)
16933 return -ENOMEM;
16934
16935 sar_spec->type = type;
16936 specs = 0;
16937 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16938 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16939 spec_list, NULL, NULL);
16940
16941 switch (type) {
16942 case NL80211_SAR_TYPE_POWER:
16943 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16944 spec, specs)) {
16945 err = -EINVAL;
16946 goto error;
16947 }
16948 break;
16949 default:
16950 err = -EINVAL;
16951 goto error;
16952 }
16953 specs++;
16954 }
16955
16956 sar_spec->num_sub_specs = specs;
16957
16958 rdev->cur_cmd_info = info;
16959 err = rdev_set_sar_specs(rdev, sar_spec);
16960 rdev->cur_cmd_info = NULL;
16961error:
16962 kfree(sar_spec);
16963 return err;
16964}
16965
16966#define SELECTOR(__sel, name, value) \
16967 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16968int __missing_selector(void);
16969#define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16970
16971static const struct genl_ops nl80211_ops[] = {
16972 {
16973 .cmd = NL80211_CMD_GET_WIPHY,
16974 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16975 .doit = nl80211_get_wiphy,
16976 .dumpit = nl80211_dump_wiphy,
16977 .done = nl80211_dump_wiphy_done,
16978 /* can be retrieved by unprivileged users */
16979 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16980 },
16981};
16982
16983static const struct genl_small_ops nl80211_small_ops[] = {
16984 {
16985 .cmd = NL80211_CMD_SET_WIPHY,
16986 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16987 .doit = nl80211_set_wiphy,
16988 .flags = GENL_UNS_ADMIN_PERM,
16989 },
16990 {
16991 .cmd = NL80211_CMD_GET_INTERFACE,
16992 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16993 .doit = nl80211_get_interface,
16994 .dumpit = nl80211_dump_interface,
16995 /* can be retrieved by unprivileged users */
16996 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16997 },
16998 {
16999 .cmd = NL80211_CMD_SET_INTERFACE,
17000 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17001 .doit = nl80211_set_interface,
17002 .flags = GENL_UNS_ADMIN_PERM,
17003 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17004 NL80211_FLAG_NEED_RTNL),
17005 },
17006 {
17007 .cmd = NL80211_CMD_NEW_INTERFACE,
17008 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17009 .doit = nl80211_new_interface,
17010 .flags = GENL_UNS_ADMIN_PERM,
17011 .internal_flags =
17012 IFLAGS(NL80211_FLAG_NEED_WIPHY |
17013 NL80211_FLAG_NEED_RTNL |
17014 /* we take the wiphy mutex later ourselves */
17015 NL80211_FLAG_NO_WIPHY_MTX),
17016 },
17017 {
17018 .cmd = NL80211_CMD_DEL_INTERFACE,
17019 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17020 .doit = nl80211_del_interface,
17021 .flags = GENL_UNS_ADMIN_PERM,
17022 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17023 NL80211_FLAG_NEED_RTNL),
17024 },
17025 {
17026 .cmd = NL80211_CMD_GET_KEY,
17027 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17028 .doit = nl80211_get_key,
17029 .flags = GENL_UNS_ADMIN_PERM,
17030 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17031 },
17032 {
17033 .cmd = NL80211_CMD_SET_KEY,
17034 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17035 .doit = nl80211_set_key,
17036 .flags = GENL_UNS_ADMIN_PERM,
17037 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
17038 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17039 NL80211_FLAG_CLEAR_SKB),
17040 },
17041 {
17042 .cmd = NL80211_CMD_NEW_KEY,
17043 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17044 .doit = nl80211_new_key,
17045 .flags = GENL_UNS_ADMIN_PERM,
17046 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17047 NL80211_FLAG_CLEAR_SKB),
17048 },
17049 {
17050 .cmd = NL80211_CMD_DEL_KEY,
17051 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17052 .doit = nl80211_del_key,
17053 .flags = GENL_UNS_ADMIN_PERM,
17054 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17055 },
17056 {
17057 .cmd = NL80211_CMD_SET_BEACON,
17058 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17059 .flags = GENL_UNS_ADMIN_PERM,
17060 .doit = nl80211_set_beacon,
17061 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17062 NL80211_FLAG_MLO_VALID_LINK_ID),
17063 },
17064 {
17065 .cmd = NL80211_CMD_START_AP,
17066 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17067 .flags = GENL_UNS_ADMIN_PERM,
17068 .doit = nl80211_start_ap,
17069 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17070 NL80211_FLAG_MLO_VALID_LINK_ID),
17071 },
17072 {
17073 .cmd = NL80211_CMD_STOP_AP,
17074 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17075 .flags = GENL_UNS_ADMIN_PERM,
17076 .doit = nl80211_stop_ap,
17077 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17078 NL80211_FLAG_MLO_VALID_LINK_ID),
17079 },
17080 {
17081 .cmd = NL80211_CMD_GET_STATION,
17082 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17083 .doit = nl80211_get_station,
17084 .dumpit = nl80211_dump_station,
17085 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17086 },
17087 {
17088 .cmd = NL80211_CMD_SET_STATION,
17089 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17090 .doit = nl80211_set_station,
17091 .flags = GENL_UNS_ADMIN_PERM,
17092 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17093 },
17094 {
17095 .cmd = NL80211_CMD_NEW_STATION,
17096 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17097 .doit = nl80211_new_station,
17098 .flags = GENL_UNS_ADMIN_PERM,
17099 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17100 },
17101 {
17102 .cmd = NL80211_CMD_DEL_STATION,
17103 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17104 .doit = nl80211_del_station,
17105 .flags = GENL_UNS_ADMIN_PERM,
17106 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
17107 * whether MAC address is passed or not. If MAC address is
17108 * passed, then even during MLO, link ID is not required.
17109 */
17110 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17111 },
17112 {
17113 .cmd = NL80211_CMD_GET_MPATH,
17114 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115 .doit = nl80211_get_mpath,
17116 .dumpit = nl80211_dump_mpath,
17117 .flags = GENL_UNS_ADMIN_PERM,
17118 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17119 },
17120 {
17121 .cmd = NL80211_CMD_GET_MPP,
17122 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17123 .doit = nl80211_get_mpp,
17124 .dumpit = nl80211_dump_mpp,
17125 .flags = GENL_UNS_ADMIN_PERM,
17126 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17127 },
17128 {
17129 .cmd = NL80211_CMD_SET_MPATH,
17130 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17131 .doit = nl80211_set_mpath,
17132 .flags = GENL_UNS_ADMIN_PERM,
17133 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17134 },
17135 {
17136 .cmd = NL80211_CMD_NEW_MPATH,
17137 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17138 .doit = nl80211_new_mpath,
17139 .flags = GENL_UNS_ADMIN_PERM,
17140 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17141 },
17142 {
17143 .cmd = NL80211_CMD_DEL_MPATH,
17144 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17145 .doit = nl80211_del_mpath,
17146 .flags = GENL_UNS_ADMIN_PERM,
17147 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17148 },
17149 {
17150 .cmd = NL80211_CMD_SET_BSS,
17151 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17152 .doit = nl80211_set_bss,
17153 .flags = GENL_UNS_ADMIN_PERM,
17154 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17155 NL80211_FLAG_MLO_VALID_LINK_ID),
17156 },
17157 {
17158 .cmd = NL80211_CMD_GET_REG,
17159 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17160 .doit = nl80211_get_reg_do,
17161 .dumpit = nl80211_get_reg_dump,
17162 /* can be retrieved by unprivileged users */
17163 },
17164#ifdef CONFIG_CFG80211_CRDA_SUPPORT
17165 {
17166 .cmd = NL80211_CMD_SET_REG,
17167 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17168 .doit = nl80211_set_reg,
17169 .flags = GENL_ADMIN_PERM,
17170 },
17171#endif
17172 {
17173 .cmd = NL80211_CMD_REQ_SET_REG,
17174 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17175 .doit = nl80211_req_set_reg,
17176 .flags = GENL_ADMIN_PERM,
17177 },
17178 {
17179 .cmd = NL80211_CMD_RELOAD_REGDB,
17180 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17181 .doit = nl80211_reload_regdb,
17182 .flags = GENL_ADMIN_PERM,
17183 },
17184 {
17185 .cmd = NL80211_CMD_GET_MESH_CONFIG,
17186 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17187 .doit = nl80211_get_mesh_config,
17188 /* can be retrieved by unprivileged users */
17189 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17190 },
17191 {
17192 .cmd = NL80211_CMD_SET_MESH_CONFIG,
17193 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17194 .doit = nl80211_update_mesh_config,
17195 .flags = GENL_UNS_ADMIN_PERM,
17196 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17197 },
17198 {
17199 .cmd = NL80211_CMD_TRIGGER_SCAN,
17200 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17201 .doit = nl80211_trigger_scan,
17202 .flags = GENL_UNS_ADMIN_PERM,
17203 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17204 },
17205 {
17206 .cmd = NL80211_CMD_ABORT_SCAN,
17207 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17208 .doit = nl80211_abort_scan,
17209 .flags = GENL_UNS_ADMIN_PERM,
17210 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17211 },
17212 {
17213 .cmd = NL80211_CMD_GET_SCAN,
17214 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17215 .dumpit = nl80211_dump_scan,
17216 },
17217 {
17218 .cmd = NL80211_CMD_START_SCHED_SCAN,
17219 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17220 .doit = nl80211_start_sched_scan,
17221 .flags = GENL_UNS_ADMIN_PERM,
17222 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17223 },
17224 {
17225 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
17226 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17227 .doit = nl80211_stop_sched_scan,
17228 .flags = GENL_UNS_ADMIN_PERM,
17229 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17230 },
17231 {
17232 .cmd = NL80211_CMD_AUTHENTICATE,
17233 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17234 .doit = nl80211_authenticate,
17235 .flags = GENL_UNS_ADMIN_PERM,
17236 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17237 NL80211_FLAG_CLEAR_SKB),
17238 },
17239 {
17240 .cmd = NL80211_CMD_ASSOCIATE,
17241 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17242 .doit = nl80211_associate,
17243 .flags = GENL_UNS_ADMIN_PERM,
17244 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17245 NL80211_FLAG_CLEAR_SKB),
17246 },
17247 {
17248 .cmd = NL80211_CMD_DEAUTHENTICATE,
17249 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17250 .doit = nl80211_deauthenticate,
17251 .flags = GENL_UNS_ADMIN_PERM,
17252 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17253 },
17254 {
17255 .cmd = NL80211_CMD_DISASSOCIATE,
17256 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17257 .doit = nl80211_disassociate,
17258 .flags = GENL_UNS_ADMIN_PERM,
17259 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17260 },
17261 {
17262 .cmd = NL80211_CMD_JOIN_IBSS,
17263 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17264 .doit = nl80211_join_ibss,
17265 .flags = GENL_UNS_ADMIN_PERM,
17266 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17267 },
17268 {
17269 .cmd = NL80211_CMD_LEAVE_IBSS,
17270 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17271 .doit = nl80211_leave_ibss,
17272 .flags = GENL_UNS_ADMIN_PERM,
17273 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17274 },
17275#ifdef CONFIG_NL80211_TESTMODE
17276 {
17277 .cmd = NL80211_CMD_TESTMODE,
17278 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17279 .doit = nl80211_testmode_do,
17280 .dumpit = nl80211_testmode_dump,
17281 .flags = GENL_UNS_ADMIN_PERM,
17282 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17283 },
17284#endif
17285 {
17286 .cmd = NL80211_CMD_CONNECT,
17287 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17288 .doit = nl80211_connect,
17289 .flags = GENL_UNS_ADMIN_PERM,
17290 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17291 NL80211_FLAG_CLEAR_SKB),
17292 },
17293 {
17294 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
17295 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17296 .doit = nl80211_update_connect_params,
17297 .flags = GENL_ADMIN_PERM,
17298 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17299 NL80211_FLAG_CLEAR_SKB),
17300 },
17301 {
17302 .cmd = NL80211_CMD_DISCONNECT,
17303 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17304 .doit = nl80211_disconnect,
17305 .flags = GENL_UNS_ADMIN_PERM,
17306 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17307 },
17308 {
17309 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
17310 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17311 .doit = nl80211_wiphy_netns,
17312 .flags = GENL_UNS_ADMIN_PERM,
17313 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17314 NL80211_FLAG_NEED_RTNL |
17315 NL80211_FLAG_NO_WIPHY_MTX),
17316 },
17317 {
17318 .cmd = NL80211_CMD_GET_SURVEY,
17319 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17320 .dumpit = nl80211_dump_survey,
17321 },
17322 {
17323 .cmd = NL80211_CMD_SET_PMKSA,
17324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17325 .doit = nl80211_set_pmksa,
17326 .flags = GENL_UNS_ADMIN_PERM,
17327 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17328 NL80211_FLAG_CLEAR_SKB),
17329 },
17330 {
17331 .cmd = NL80211_CMD_DEL_PMKSA,
17332 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17333 .doit = nl80211_del_pmksa,
17334 .flags = GENL_UNS_ADMIN_PERM,
17335 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17336 },
17337 {
17338 .cmd = NL80211_CMD_FLUSH_PMKSA,
17339 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17340 .doit = nl80211_flush_pmksa,
17341 .flags = GENL_UNS_ADMIN_PERM,
17342 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17343 },
17344 {
17345 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17346 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17347 .doit = nl80211_remain_on_channel,
17348 .flags = GENL_UNS_ADMIN_PERM,
17349 /* FIXME: requiring a link ID here is probably not good */
17350 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17351 NL80211_FLAG_MLO_VALID_LINK_ID),
17352 },
17353 {
17354 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17355 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17356 .doit = nl80211_cancel_remain_on_channel,
17357 .flags = GENL_UNS_ADMIN_PERM,
17358 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17359 },
17360 {
17361 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17362 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17363 .doit = nl80211_set_tx_bitrate_mask,
17364 .flags = GENL_UNS_ADMIN_PERM,
17365 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17366 NL80211_FLAG_MLO_VALID_LINK_ID),
17367 },
17368 {
17369 .cmd = NL80211_CMD_REGISTER_FRAME,
17370 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17371 .doit = nl80211_register_mgmt,
17372 .flags = GENL_UNS_ADMIN_PERM,
17373 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17374 },
17375 {
17376 .cmd = NL80211_CMD_FRAME,
17377 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17378 .doit = nl80211_tx_mgmt,
17379 .flags = GENL_UNS_ADMIN_PERM,
17380 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17381 },
17382 {
17383 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17384 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17385 .doit = nl80211_tx_mgmt_cancel_wait,
17386 .flags = GENL_UNS_ADMIN_PERM,
17387 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17388 },
17389 {
17390 .cmd = NL80211_CMD_SET_POWER_SAVE,
17391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17392 .doit = nl80211_set_power_save,
17393 .flags = GENL_UNS_ADMIN_PERM,
17394 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17395 },
17396 {
17397 .cmd = NL80211_CMD_GET_POWER_SAVE,
17398 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17399 .doit = nl80211_get_power_save,
17400 /* can be retrieved by unprivileged users */
17401 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17402 },
17403 {
17404 .cmd = NL80211_CMD_SET_CQM,
17405 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17406 .doit = nl80211_set_cqm,
17407 .flags = GENL_UNS_ADMIN_PERM,
17408 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17409 },
17410 {
17411 .cmd = NL80211_CMD_SET_CHANNEL,
17412 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17413 .doit = nl80211_set_channel,
17414 .flags = GENL_UNS_ADMIN_PERM,
17415 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17416 NL80211_FLAG_MLO_VALID_LINK_ID),
17417 },
17418 {
17419 .cmd = NL80211_CMD_JOIN_MESH,
17420 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17421 .doit = nl80211_join_mesh,
17422 .flags = GENL_UNS_ADMIN_PERM,
17423 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17424 },
17425 {
17426 .cmd = NL80211_CMD_LEAVE_MESH,
17427 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17428 .doit = nl80211_leave_mesh,
17429 .flags = GENL_UNS_ADMIN_PERM,
17430 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17431 },
17432 {
17433 .cmd = NL80211_CMD_JOIN_OCB,
17434 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17435 .doit = nl80211_join_ocb,
17436 .flags = GENL_UNS_ADMIN_PERM,
17437 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17438 },
17439 {
17440 .cmd = NL80211_CMD_LEAVE_OCB,
17441 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17442 .doit = nl80211_leave_ocb,
17443 .flags = GENL_UNS_ADMIN_PERM,
17444 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17445 },
17446#ifdef CONFIG_PM
17447 {
17448 .cmd = NL80211_CMD_GET_WOWLAN,
17449 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17450 .doit = nl80211_get_wowlan,
17451 /* can be retrieved by unprivileged users */
17452 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17453 },
17454 {
17455 .cmd = NL80211_CMD_SET_WOWLAN,
17456 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17457 .doit = nl80211_set_wowlan,
17458 .flags = GENL_UNS_ADMIN_PERM,
17459 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17460 },
17461#endif
17462 {
17463 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17464 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17465 .doit = nl80211_set_rekey_data,
17466 .flags = GENL_UNS_ADMIN_PERM,
17467 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17468 NL80211_FLAG_CLEAR_SKB),
17469 },
17470 {
17471 .cmd = NL80211_CMD_TDLS_MGMT,
17472 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17473 .doit = nl80211_tdls_mgmt,
17474 .flags = GENL_UNS_ADMIN_PERM,
17475 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17476 NL80211_FLAG_MLO_VALID_LINK_ID),
17477 },
17478 {
17479 .cmd = NL80211_CMD_TDLS_OPER,
17480 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17481 .doit = nl80211_tdls_oper,
17482 .flags = GENL_UNS_ADMIN_PERM,
17483 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17484 },
17485 {
17486 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17487 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17488 .doit = nl80211_register_unexpected_frame,
17489 .flags = GENL_UNS_ADMIN_PERM,
17490 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17491 },
17492 {
17493 .cmd = NL80211_CMD_PROBE_CLIENT,
17494 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17495 .doit = nl80211_probe_client,
17496 .flags = GENL_UNS_ADMIN_PERM,
17497 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17498 },
17499 {
17500 .cmd = NL80211_CMD_REGISTER_BEACONS,
17501 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17502 .doit = nl80211_register_beacons,
17503 .flags = GENL_UNS_ADMIN_PERM,
17504 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17505 },
17506 {
17507 .cmd = NL80211_CMD_SET_NOACK_MAP,
17508 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17509 .doit = nl80211_set_noack_map,
17510 .flags = GENL_UNS_ADMIN_PERM,
17511 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17512 },
17513 {
17514 .cmd = NL80211_CMD_START_P2P_DEVICE,
17515 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17516 .doit = nl80211_start_p2p_device,
17517 .flags = GENL_UNS_ADMIN_PERM,
17518 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17519 NL80211_FLAG_NEED_RTNL),
17520 },
17521 {
17522 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17523 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17524 .doit = nl80211_stop_p2p_device,
17525 .flags = GENL_UNS_ADMIN_PERM,
17526 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17527 NL80211_FLAG_NEED_RTNL),
17528 },
17529 {
17530 .cmd = NL80211_CMD_START_NAN,
17531 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17532 .doit = nl80211_start_nan,
17533 .flags = GENL_ADMIN_PERM,
17534 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17535 NL80211_FLAG_NEED_RTNL),
17536 },
17537 {
17538 .cmd = NL80211_CMD_STOP_NAN,
17539 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17540 .doit = nl80211_stop_nan,
17541 .flags = GENL_ADMIN_PERM,
17542 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17543 NL80211_FLAG_NEED_RTNL),
17544 },
17545 {
17546 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17547 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17548 .doit = nl80211_nan_add_func,
17549 .flags = GENL_ADMIN_PERM,
17550 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17551 },
17552 {
17553 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17554 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17555 .doit = nl80211_nan_del_func,
17556 .flags = GENL_ADMIN_PERM,
17557 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17558 },
17559 {
17560 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17561 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17562 .doit = nl80211_nan_change_config,
17563 .flags = GENL_ADMIN_PERM,
17564 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17565 },
17566 {
17567 .cmd = NL80211_CMD_SET_MCAST_RATE,
17568 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17569 .doit = nl80211_set_mcast_rate,
17570 .flags = GENL_UNS_ADMIN_PERM,
17571 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17572 },
17573 {
17574 .cmd = NL80211_CMD_SET_MAC_ACL,
17575 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17576 .doit = nl80211_set_mac_acl,
17577 .flags = GENL_UNS_ADMIN_PERM,
17578 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17579 NL80211_FLAG_MLO_UNSUPPORTED),
17580 },
17581 {
17582 .cmd = NL80211_CMD_RADAR_DETECT,
17583 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17584 .doit = nl80211_start_radar_detection,
17585 .flags = GENL_UNS_ADMIN_PERM,
17586 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17587 NL80211_FLAG_NO_WIPHY_MTX |
17588 NL80211_FLAG_MLO_VALID_LINK_ID),
17589 },
17590 {
17591 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17592 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17593 .doit = nl80211_get_protocol_features,
17594 },
17595 {
17596 .cmd = NL80211_CMD_UPDATE_FT_IES,
17597 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17598 .doit = nl80211_update_ft_ies,
17599 .flags = GENL_UNS_ADMIN_PERM,
17600 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17601 },
17602 {
17603 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17604 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17605 .doit = nl80211_crit_protocol_start,
17606 .flags = GENL_UNS_ADMIN_PERM,
17607 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17608 },
17609 {
17610 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17611 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17612 .doit = nl80211_crit_protocol_stop,
17613 .flags = GENL_UNS_ADMIN_PERM,
17614 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17615 },
17616 {
17617 .cmd = NL80211_CMD_GET_COALESCE,
17618 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17619 .doit = nl80211_get_coalesce,
17620 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17621 },
17622 {
17623 .cmd = NL80211_CMD_SET_COALESCE,
17624 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17625 .doit = nl80211_set_coalesce,
17626 .flags = GENL_UNS_ADMIN_PERM,
17627 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17628 },
17629 {
17630 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17631 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17632 .doit = nl80211_channel_switch,
17633 .flags = GENL_UNS_ADMIN_PERM,
17634 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17635 NL80211_FLAG_MLO_VALID_LINK_ID),
17636 },
17637 {
17638 .cmd = NL80211_CMD_VENDOR,
17639 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17640 .doit = nl80211_vendor_cmd,
17641 .dumpit = nl80211_vendor_cmd_dump,
17642 .flags = GENL_UNS_ADMIN_PERM,
17643 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17644 NL80211_FLAG_CLEAR_SKB),
17645 },
17646 {
17647 .cmd = NL80211_CMD_SET_QOS_MAP,
17648 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17649 .doit = nl80211_set_qos_map,
17650 .flags = GENL_UNS_ADMIN_PERM,
17651 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17652 },
17653 {
17654 .cmd = NL80211_CMD_ADD_TX_TS,
17655 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17656 .doit = nl80211_add_tx_ts,
17657 .flags = GENL_UNS_ADMIN_PERM,
17658 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17659 NL80211_FLAG_MLO_UNSUPPORTED),
17660 },
17661 {
17662 .cmd = NL80211_CMD_DEL_TX_TS,
17663 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17664 .doit = nl80211_del_tx_ts,
17665 .flags = GENL_UNS_ADMIN_PERM,
17666 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17667 },
17668 {
17669 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17670 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17671 .doit = nl80211_tdls_channel_switch,
17672 .flags = GENL_UNS_ADMIN_PERM,
17673 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17674 },
17675 {
17676 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17677 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17678 .doit = nl80211_tdls_cancel_channel_switch,
17679 .flags = GENL_UNS_ADMIN_PERM,
17680 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17681 },
17682 {
17683 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17684 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17685 .doit = nl80211_set_multicast_to_unicast,
17686 .flags = GENL_UNS_ADMIN_PERM,
17687 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17688 },
17689 {
17690 .cmd = NL80211_CMD_SET_PMK,
17691 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17692 .doit = nl80211_set_pmk,
17693 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17694 NL80211_FLAG_CLEAR_SKB),
17695 },
17696 {
17697 .cmd = NL80211_CMD_DEL_PMK,
17698 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17699 .doit = nl80211_del_pmk,
17700 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17701 },
17702 {
17703 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17704 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17705 .doit = nl80211_external_auth,
17706 .flags = GENL_ADMIN_PERM,
17707 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17708 },
17709 {
17710 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17711 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17712 .doit = nl80211_tx_control_port,
17713 .flags = GENL_UNS_ADMIN_PERM,
17714 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17715 },
17716 {
17717 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17718 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17719 .doit = nl80211_get_ftm_responder_stats,
17720 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17721 NL80211_FLAG_MLO_VALID_LINK_ID),
17722 },
17723 {
17724 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17725 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17726 .doit = nl80211_pmsr_start,
17727 .flags = GENL_UNS_ADMIN_PERM,
17728 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17729 },
17730 {
17731 .cmd = NL80211_CMD_NOTIFY_RADAR,
17732 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17733 .doit = nl80211_notify_radar_detection,
17734 .flags = GENL_UNS_ADMIN_PERM,
17735 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17736 },
17737 {
17738 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17739 .doit = nl80211_update_owe_info,
17740 .flags = GENL_ADMIN_PERM,
17741 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17742 },
17743 {
17744 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17745 .doit = nl80211_probe_mesh_link,
17746 .flags = GENL_UNS_ADMIN_PERM,
17747 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17748 },
17749 {
17750 .cmd = NL80211_CMD_SET_TID_CONFIG,
17751 .doit = nl80211_set_tid_config,
17752 .flags = GENL_UNS_ADMIN_PERM,
17753 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17754 NL80211_FLAG_MLO_VALID_LINK_ID),
17755 },
17756 {
17757 .cmd = NL80211_CMD_SET_SAR_SPECS,
17758 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17759 .doit = nl80211_set_sar_specs,
17760 .flags = GENL_UNS_ADMIN_PERM,
17761 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17762 NL80211_FLAG_NEED_RTNL),
17763 },
17764 {
17765 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17766 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17767 .doit = nl80211_color_change,
17768 .flags = GENL_UNS_ADMIN_PERM,
17769 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17770 NL80211_FLAG_MLO_VALID_LINK_ID),
17771 },
17772 {
17773 .cmd = NL80211_CMD_SET_FILS_AAD,
17774 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17775 .doit = nl80211_set_fils_aad,
17776 .flags = GENL_UNS_ADMIN_PERM,
17777 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17778 },
17779 {
17780 .cmd = NL80211_CMD_ADD_LINK,
17781 .doit = nl80211_add_link,
17782 .flags = GENL_UNS_ADMIN_PERM,
17783 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17784 },
17785 {
17786 .cmd = NL80211_CMD_REMOVE_LINK,
17787 .doit = nl80211_remove_link,
17788 .flags = GENL_UNS_ADMIN_PERM,
17789 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17790 NL80211_FLAG_MLO_VALID_LINK_ID),
17791 },
17792 {
17793 .cmd = NL80211_CMD_ADD_LINK_STA,
17794 .doit = nl80211_add_link_station,
17795 .flags = GENL_UNS_ADMIN_PERM,
17796 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17797 NL80211_FLAG_MLO_VALID_LINK_ID),
17798 },
17799 {
17800 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17801 .doit = nl80211_modify_link_station,
17802 .flags = GENL_UNS_ADMIN_PERM,
17803 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17804 NL80211_FLAG_MLO_VALID_LINK_ID),
17805 },
17806 {
17807 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17808 .doit = nl80211_remove_link_station,
17809 .flags = GENL_UNS_ADMIN_PERM,
17810 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17811 NL80211_FLAG_MLO_VALID_LINK_ID),
17812 },
17813 {
17814 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17815 .doit = nl80211_set_hw_timestamp,
17816 .flags = GENL_UNS_ADMIN_PERM,
17817 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17818 },
17819 {
17820 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
17821 .doit = nl80211_set_ttlm,
17822 .flags = GENL_UNS_ADMIN_PERM,
17823 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17824 },
17825 {
17826 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
17827 .doit = nl80211_assoc_ml_reconf,
17828 .flags = GENL_UNS_ADMIN_PERM,
17829 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17830 },
17831 {
17832 .cmd = NL80211_CMD_EPCS_CFG,
17833 .doit = nl80211_epcs_cfg,
17834 .flags = GENL_UNS_ADMIN_PERM,
17835 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17836 },
17837};
17838
17839static struct genl_family nl80211_fam __ro_after_init = {
17840 .name = NL80211_GENL_NAME, /* have users key off the name instead */
17841 .hdrsize = 0, /* no private header */
17842 .version = 1, /* no particular meaning now */
17843 .maxattr = NL80211_ATTR_MAX,
17844 .policy = nl80211_policy,
17845 .netnsok = true,
17846 .pre_doit = nl80211_pre_doit,
17847 .post_doit = nl80211_post_doit,
17848 .module = THIS_MODULE,
17849 .ops = nl80211_ops,
17850 .n_ops = ARRAY_SIZE(nl80211_ops),
17851 .small_ops = nl80211_small_ops,
17852 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17853 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17854 .mcgrps = nl80211_mcgrps,
17855 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17856 .parallel_ops = true,
17857};
17858
17859/* notification functions */
17860
17861void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17862 enum nl80211_commands cmd)
17863{
17864 struct sk_buff *msg;
17865 struct nl80211_dump_wiphy_state state = {};
17866
17867 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17868 cmd != NL80211_CMD_DEL_WIPHY);
17869
17870 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17871 if (!msg)
17872 return;
17873
17874 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17875 nlmsg_free(msg);
17876 return;
17877 }
17878
17879 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17880 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17881}
17882
17883void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17884 struct wireless_dev *wdev,
17885 enum nl80211_commands cmd)
17886{
17887 struct sk_buff *msg;
17888
17889 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17890 if (!msg)
17891 return;
17892
17893 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17894 nlmsg_free(msg);
17895 return;
17896 }
17897
17898 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17899 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17900}
17901
17902static int nl80211_add_scan_req(struct sk_buff *msg,
17903 struct cfg80211_registered_device *rdev)
17904{
17905 struct cfg80211_scan_request *req = rdev->scan_req;
17906 struct nlattr *nest;
17907 int i;
17908 struct cfg80211_scan_info *info;
17909
17910 if (WARN_ON(!req))
17911 return 0;
17912
17913 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17914 if (!nest)
17915 goto nla_put_failure;
17916 for (i = 0; i < req->n_ssids; i++) {
17917 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17918 goto nla_put_failure;
17919 }
17920 nla_nest_end(msg, nest);
17921
17922 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17923 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17924 if (!nest)
17925 goto nla_put_failure;
17926 for (i = 0; i < req->n_channels; i++) {
17927 if (nla_put_u32(msg, i,
17928 ieee80211_channel_to_khz(req->channels[i])))
17929 goto nla_put_failure;
17930 }
17931 nla_nest_end(msg, nest);
17932 } else {
17933 nest = nla_nest_start_noflag(msg,
17934 NL80211_ATTR_SCAN_FREQUENCIES);
17935 if (!nest)
17936 goto nla_put_failure;
17937 for (i = 0; i < req->n_channels; i++) {
17938 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17939 goto nla_put_failure;
17940 }
17941 nla_nest_end(msg, nest);
17942 }
17943
17944 if (req->ie &&
17945 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17946 goto nla_put_failure;
17947
17948 if (req->flags &&
17949 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17950 goto nla_put_failure;
17951
17952 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17953 &rdev->scan_req->info;
17954 if (info->scan_start_tsf &&
17955 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17956 info->scan_start_tsf, NL80211_BSS_PAD) ||
17957 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17958 info->tsf_bssid)))
17959 goto nla_put_failure;
17960
17961 return 0;
17962 nla_put_failure:
17963 return -ENOBUFS;
17964}
17965
17966static int nl80211_prep_scan_msg(struct sk_buff *msg,
17967 struct cfg80211_registered_device *rdev,
17968 struct wireless_dev *wdev,
17969 u32 portid, u32 seq, int flags,
17970 u32 cmd)
17971{
17972 void *hdr;
17973
17974 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17975 if (!hdr)
17976 return -1;
17977
17978 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17979 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17980 wdev->netdev->ifindex)) ||
17981 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17982 NL80211_ATTR_PAD))
17983 goto nla_put_failure;
17984
17985 /* ignore errors and send incomplete event anyway */
17986 nl80211_add_scan_req(msg, rdev);
17987
17988 genlmsg_end(msg, hdr);
17989 return 0;
17990
17991 nla_put_failure:
17992 genlmsg_cancel(msg, hdr);
17993 return -EMSGSIZE;
17994}
17995
17996static int
17997nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17998 struct cfg80211_sched_scan_request *req, u32 cmd)
17999{
18000 void *hdr;
18001
18002 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18003 if (!hdr)
18004 return -1;
18005
18006 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
18007 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
18008 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
18009 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
18010 NL80211_ATTR_PAD))
18011 goto nla_put_failure;
18012
18013 genlmsg_end(msg, hdr);
18014 return 0;
18015
18016 nla_put_failure:
18017 genlmsg_cancel(msg, hdr);
18018 return -EMSGSIZE;
18019}
18020
18021void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
18022 struct wireless_dev *wdev)
18023{
18024 struct sk_buff *msg;
18025
18026 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18027 if (!msg)
18028 return;
18029
18030 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
18031 NL80211_CMD_TRIGGER_SCAN) < 0) {
18032 nlmsg_free(msg);
18033 return;
18034 }
18035
18036 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18037 NL80211_MCGRP_SCAN, GFP_KERNEL);
18038}
18039
18040struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
18041 struct wireless_dev *wdev, bool aborted)
18042{
18043 struct sk_buff *msg;
18044
18045 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18046 if (!msg)
18047 return NULL;
18048
18049 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
18050 aborted ? NL80211_CMD_SCAN_ABORTED :
18051 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
18052 nlmsg_free(msg);
18053 return NULL;
18054 }
18055
18056 return msg;
18057}
18058
18059/* send message created by nl80211_build_scan_msg() */
18060void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
18061 struct sk_buff *msg)
18062{
18063 if (!msg)
18064 return;
18065
18066 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18067 NL80211_MCGRP_SCAN, GFP_KERNEL);
18068}
18069
18070void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
18071{
18072 struct sk_buff *msg;
18073
18074 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18075 if (!msg)
18076 return;
18077
18078 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
18079 nlmsg_free(msg);
18080 return;
18081 }
18082
18083 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
18084 NL80211_MCGRP_SCAN, GFP_KERNEL);
18085}
18086
18087static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
18088 struct regulatory_request *request)
18089{
18090 /* Userspace can always count this one always being set */
18091 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
18092 goto nla_put_failure;
18093
18094 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
18095 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18096 NL80211_REGDOM_TYPE_WORLD))
18097 goto nla_put_failure;
18098 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
18099 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18100 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
18101 goto nla_put_failure;
18102 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
18103 request->intersect) {
18104 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18105 NL80211_REGDOM_TYPE_INTERSECTION))
18106 goto nla_put_failure;
18107 } else {
18108 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18109 NL80211_REGDOM_TYPE_COUNTRY) ||
18110 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
18111 request->alpha2))
18112 goto nla_put_failure;
18113 }
18114
18115 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
18116 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
18117
18118 if (wiphy &&
18119 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
18120 goto nla_put_failure;
18121
18122 if (wiphy &&
18123 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
18124 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
18125 goto nla_put_failure;
18126 }
18127
18128 return true;
18129
18130nla_put_failure:
18131 return false;
18132}
18133
18134/*
18135 * This can happen on global regulatory changes or device specific settings
18136 * based on custom regulatory domains.
18137 */
18138void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
18139 struct regulatory_request *request)
18140{
18141 struct sk_buff *msg;
18142 void *hdr;
18143
18144 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18145 if (!msg)
18146 return;
18147
18148 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
18149 if (!hdr)
18150 goto nla_put_failure;
18151
18152 if (!nl80211_reg_change_event_fill(msg, request))
18153 goto nla_put_failure;
18154
18155 genlmsg_end(msg, hdr);
18156
18157 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18158 NL80211_MCGRP_REGULATORY);
18159
18160 return;
18161
18162nla_put_failure:
18163 nlmsg_free(msg);
18164}
18165
18166struct nl80211_mlme_event {
18167 enum nl80211_commands cmd;
18168 const u8 *buf;
18169 size_t buf_len;
18170 int uapsd_queues;
18171 const u8 *req_ies;
18172 size_t req_ies_len;
18173 bool reconnect;
18174};
18175
18176static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
18177 struct net_device *netdev,
18178 const struct nl80211_mlme_event *event,
18179 gfp_t gfp)
18180{
18181 struct sk_buff *msg;
18182 void *hdr;
18183
18184 msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
18185 if (!msg)
18186 return;
18187
18188 hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
18189 if (!hdr) {
18190 nlmsg_free(msg);
18191 return;
18192 }
18193
18194 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18195 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18196 nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
18197 (event->req_ies &&
18198 nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
18199 event->req_ies)))
18200 goto nla_put_failure;
18201
18202 if (event->reconnect &&
18203 nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
18204 goto nla_put_failure;
18205
18206 if (event->uapsd_queues >= 0) {
18207 struct nlattr *nla_wmm =
18208 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
18209 if (!nla_wmm)
18210 goto nla_put_failure;
18211
18212 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
18213 event->uapsd_queues))
18214 goto nla_put_failure;
18215
18216 nla_nest_end(msg, nla_wmm);
18217 }
18218
18219 genlmsg_end(msg, hdr);
18220
18221 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18222 NL80211_MCGRP_MLME, gfp);
18223 return;
18224
18225 nla_put_failure:
18226 nlmsg_free(msg);
18227}
18228
18229void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
18230 struct net_device *netdev, const u8 *buf,
18231 size_t len, gfp_t gfp)
18232{
18233 struct nl80211_mlme_event event = {
18234 .cmd = NL80211_CMD_AUTHENTICATE,
18235 .buf = buf,
18236 .buf_len = len,
18237 .uapsd_queues = -1,
18238 };
18239
18240 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18241}
18242
18243void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
18244 struct net_device *netdev,
18245 const struct cfg80211_rx_assoc_resp_data *data)
18246{
18247 struct nl80211_mlme_event event = {
18248 .cmd = NL80211_CMD_ASSOCIATE,
18249 .buf = data->buf,
18250 .buf_len = data->len,
18251 .uapsd_queues = data->uapsd_queues,
18252 .req_ies = data->req_ies,
18253 .req_ies_len = data->req_ies_len,
18254 };
18255
18256 nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
18257}
18258
18259void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
18260 struct net_device *netdev, const u8 *buf,
18261 size_t len, bool reconnect, gfp_t gfp)
18262{
18263 struct nl80211_mlme_event event = {
18264 .cmd = NL80211_CMD_DEAUTHENTICATE,
18265 .buf = buf,
18266 .buf_len = len,
18267 .reconnect = reconnect,
18268 .uapsd_queues = -1,
18269 };
18270
18271 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18272}
18273
18274void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
18275 struct net_device *netdev, const u8 *buf,
18276 size_t len, bool reconnect, gfp_t gfp)
18277{
18278 struct nl80211_mlme_event event = {
18279 .cmd = NL80211_CMD_DISASSOCIATE,
18280 .buf = buf,
18281 .buf_len = len,
18282 .reconnect = reconnect,
18283 .uapsd_queues = -1,
18284 };
18285
18286 nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18287}
18288
18289void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
18290 size_t len)
18291{
18292 struct wireless_dev *wdev = dev->ieee80211_ptr;
18293 struct wiphy *wiphy = wdev->wiphy;
18294 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18295 const struct ieee80211_mgmt *mgmt = (void *)buf;
18296 struct nl80211_mlme_event event = {
18297 .buf = buf,
18298 .buf_len = len,
18299 .uapsd_queues = -1,
18300 };
18301
18302 if (WARN_ON(len < 2))
18303 return;
18304
18305 if (ieee80211_is_deauth(mgmt->frame_control)) {
18306 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
18307 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
18308 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
18309 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
18310 if (wdev->unprot_beacon_reported &&
18311 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
18312 return;
18313 event.cmd = NL80211_CMD_UNPROT_BEACON;
18314 wdev->unprot_beacon_reported = jiffies;
18315 } else {
18316 return;
18317 }
18318
18319 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
18320 nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
18321}
18322EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
18323
18324static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
18325 struct net_device *netdev, int cmd,
18326 const u8 *addr, gfp_t gfp)
18327{
18328 struct sk_buff *msg;
18329 void *hdr;
18330
18331 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18332 if (!msg)
18333 return;
18334
18335 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18336 if (!hdr) {
18337 nlmsg_free(msg);
18338 return;
18339 }
18340
18341 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18342 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18343 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18344 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18345 goto nla_put_failure;
18346
18347 genlmsg_end(msg, hdr);
18348
18349 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18350 NL80211_MCGRP_MLME, gfp);
18351 return;
18352
18353 nla_put_failure:
18354 nlmsg_free(msg);
18355}
18356
18357void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
18358 struct net_device *netdev, const u8 *addr,
18359 gfp_t gfp)
18360{
18361 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
18362 addr, gfp);
18363}
18364
18365void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
18366 struct net_device *netdev, const u8 *addr,
18367 gfp_t gfp)
18368{
18369 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18370 addr, gfp);
18371}
18372
18373void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18374 struct net_device *netdev,
18375 struct cfg80211_connect_resp_params *cr,
18376 gfp_t gfp)
18377{
18378 struct sk_buff *msg;
18379 void *hdr;
18380 unsigned int link;
18381 size_t link_info_size = 0;
18382 const u8 *connected_addr = cr->valid_links ?
18383 cr->ap_mld_addr : cr->links[0].bssid;
18384
18385 if (cr->valid_links) {
18386 for_each_valid_link(cr, link) {
18387 /* Nested attribute header */
18388 link_info_size += NLA_HDRLEN;
18389 /* Link ID */
18390 link_info_size += nla_total_size(sizeof(u8));
18391 link_info_size += cr->links[link].addr ?
18392 nla_total_size(ETH_ALEN) : 0;
18393 link_info_size += (cr->links[link].bssid ||
18394 cr->links[link].bss) ?
18395 nla_total_size(ETH_ALEN) : 0;
18396 link_info_size += nla_total_size(sizeof(u16));
18397 }
18398 }
18399
18400 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18401 cr->fils.kek_len + cr->fils.pmk_len +
18402 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18403 gfp);
18404 if (!msg)
18405 return;
18406
18407 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18408 if (!hdr) {
18409 nlmsg_free(msg);
18410 return;
18411 }
18412
18413 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18414 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18415 (connected_addr &&
18416 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18417 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18418 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18419 cr->status) ||
18420 (cr->status < 0 &&
18421 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18422 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18423 cr->timeout_reason))) ||
18424 (cr->req_ie &&
18425 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18426 (cr->resp_ie &&
18427 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18428 cr->resp_ie)) ||
18429 (cr->fils.update_erp_next_seq_num &&
18430 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18431 cr->fils.erp_next_seq_num)) ||
18432 (cr->status == WLAN_STATUS_SUCCESS &&
18433 ((cr->fils.kek &&
18434 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18435 cr->fils.kek)) ||
18436 (cr->fils.pmk &&
18437 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18438 (cr->fils.pmkid &&
18439 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18440 goto nla_put_failure;
18441
18442 if (cr->valid_links) {
18443 int i = 1;
18444 struct nlattr *nested;
18445
18446 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18447 if (!nested)
18448 goto nla_put_failure;
18449
18450 for_each_valid_link(cr, link) {
18451 struct nlattr *nested_mlo_links;
18452 const u8 *bssid = cr->links[link].bss ?
18453 cr->links[link].bss->bssid :
18454 cr->links[link].bssid;
18455
18456 nested_mlo_links = nla_nest_start(msg, i);
18457 if (!nested_mlo_links)
18458 goto nla_put_failure;
18459
18460 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18461 (bssid &&
18462 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18463 (cr->links[link].addr &&
18464 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18465 cr->links[link].addr)) ||
18466 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18467 cr->links[link].status))
18468 goto nla_put_failure;
18469
18470 nla_nest_end(msg, nested_mlo_links);
18471 i++;
18472 }
18473 nla_nest_end(msg, nested);
18474 }
18475
18476 genlmsg_end(msg, hdr);
18477
18478 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18479 NL80211_MCGRP_MLME, gfp);
18480 return;
18481
18482 nla_put_failure:
18483 nlmsg_free(msg);
18484}
18485
18486void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18487 struct net_device *netdev,
18488 struct cfg80211_roam_info *info, gfp_t gfp)
18489{
18490 struct sk_buff *msg;
18491 void *hdr;
18492 size_t link_info_size = 0;
18493 unsigned int link;
18494 const u8 *connected_addr = info->ap_mld_addr ?
18495 info->ap_mld_addr :
18496 (info->links[0].bss ?
18497 info->links[0].bss->bssid :
18498 info->links[0].bssid);
18499
18500 if (info->valid_links) {
18501 for_each_valid_link(info, link) {
18502 /* Nested attribute header */
18503 link_info_size += NLA_HDRLEN;
18504 /* Link ID */
18505 link_info_size += nla_total_size(sizeof(u8));
18506 link_info_size += info->links[link].addr ?
18507 nla_total_size(ETH_ALEN) : 0;
18508 link_info_size += (info->links[link].bssid ||
18509 info->links[link].bss) ?
18510 nla_total_size(ETH_ALEN) : 0;
18511 }
18512 }
18513
18514 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18515 info->fils.kek_len + info->fils.pmk_len +
18516 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18517 link_info_size, gfp);
18518 if (!msg)
18519 return;
18520
18521 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18522 if (!hdr) {
18523 nlmsg_free(msg);
18524 return;
18525 }
18526
18527 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18528 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18529 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18530 (info->req_ie &&
18531 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18532 info->req_ie)) ||
18533 (info->resp_ie &&
18534 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18535 info->resp_ie)) ||
18536 (info->fils.update_erp_next_seq_num &&
18537 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18538 info->fils.erp_next_seq_num)) ||
18539 (info->fils.kek &&
18540 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18541 info->fils.kek)) ||
18542 (info->fils.pmk &&
18543 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18544 (info->fils.pmkid &&
18545 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18546 goto nla_put_failure;
18547
18548 if (info->valid_links) {
18549 int i = 1;
18550 struct nlattr *nested;
18551
18552 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18553 if (!nested)
18554 goto nla_put_failure;
18555
18556 for_each_valid_link(info, link) {
18557 struct nlattr *nested_mlo_links;
18558 const u8 *bssid = info->links[link].bss ?
18559 info->links[link].bss->bssid :
18560 info->links[link].bssid;
18561
18562 nested_mlo_links = nla_nest_start(msg, i);
18563 if (!nested_mlo_links)
18564 goto nla_put_failure;
18565
18566 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18567 (bssid &&
18568 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18569 (info->links[link].addr &&
18570 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18571 info->links[link].addr)))
18572 goto nla_put_failure;
18573
18574 nla_nest_end(msg, nested_mlo_links);
18575 i++;
18576 }
18577 nla_nest_end(msg, nested);
18578 }
18579
18580 genlmsg_end(msg, hdr);
18581
18582 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18583 NL80211_MCGRP_MLME, gfp);
18584 return;
18585
18586 nla_put_failure:
18587 nlmsg_free(msg);
18588}
18589
18590void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18591 struct net_device *netdev, const u8 *peer_addr,
18592 const u8 *td_bitmap, u8 td_bitmap_len)
18593{
18594 struct sk_buff *msg;
18595 void *hdr;
18596
18597 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18598 if (!msg)
18599 return;
18600
18601 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18602 if (!hdr) {
18603 nlmsg_free(msg);
18604 return;
18605 }
18606
18607 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18608 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18609 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
18610 goto nla_put_failure;
18611
18612 if (td_bitmap_len > 0 && td_bitmap &&
18613 nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
18614 goto nla_put_failure;
18615
18616 genlmsg_end(msg, hdr);
18617
18618 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18619 NL80211_MCGRP_MLME, GFP_KERNEL);
18620 return;
18621
18622 nla_put_failure:
18623 nlmsg_free(msg);
18624}
18625
18626void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18627 struct net_device *netdev, u16 reason,
18628 const u8 *ie, size_t ie_len, bool from_ap)
18629{
18630 struct sk_buff *msg;
18631 void *hdr;
18632
18633 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18634 if (!msg)
18635 return;
18636
18637 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18638 if (!hdr) {
18639 nlmsg_free(msg);
18640 return;
18641 }
18642
18643 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18644 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18645 (reason &&
18646 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18647 (from_ap &&
18648 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18649 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18650 goto nla_put_failure;
18651
18652 genlmsg_end(msg, hdr);
18653
18654 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18655 NL80211_MCGRP_MLME, GFP_KERNEL);
18656 return;
18657
18658 nla_put_failure:
18659 nlmsg_free(msg);
18660}
18661
18662void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18663{
18664 struct wireless_dev *wdev = dev->ieee80211_ptr;
18665 struct wiphy *wiphy = wdev->wiphy;
18666 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18667 struct sk_buff *msg;
18668 struct nlattr *links;
18669 void *hdr;
18670
18671 lockdep_assert_wiphy(wdev->wiphy);
18672 trace_cfg80211_links_removed(dev, link_mask);
18673
18674 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18675 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18676 return;
18677
18678 if (WARN_ON(!wdev->valid_links || !link_mask ||
18679 (wdev->valid_links & link_mask) != link_mask ||
18680 wdev->valid_links == link_mask))
18681 return;
18682
18683 cfg80211_wdev_release_link_bsses(wdev, link_mask);
18684 wdev->valid_links &= ~link_mask;
18685
18686 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18687 if (!msg)
18688 return;
18689
18690 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18691 if (!hdr) {
18692 nlmsg_free(msg);
18693 return;
18694 }
18695
18696 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18697 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18698 goto nla_put_failure;
18699
18700 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18701 if (!links)
18702 goto nla_put_failure;
18703
18704 while (link_mask) {
18705 struct nlattr *link;
18706 int link_id = __ffs(link_mask);
18707
18708 link = nla_nest_start(msg, link_id + 1);
18709 if (!link)
18710 goto nla_put_failure;
18711
18712 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18713 goto nla_put_failure;
18714
18715 nla_nest_end(msg, link);
18716 link_mask &= ~(1 << link_id);
18717 }
18718
18719 nla_nest_end(msg, links);
18720
18721 genlmsg_end(msg, hdr);
18722
18723 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18724 NL80211_MCGRP_MLME, GFP_KERNEL);
18725 return;
18726
18727 nla_put_failure:
18728 nlmsg_free(msg);
18729}
18730EXPORT_SYMBOL(cfg80211_links_removed);
18731
18732void nl80211_mlo_reconf_add_done(struct net_device *dev,
18733 struct cfg80211_mlo_reconf_done_data *data)
18734{
18735 struct wireless_dev *wdev = dev->ieee80211_ptr;
18736 struct wiphy *wiphy = wdev->wiphy;
18737 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18738 struct nl80211_mlme_event event = {
18739 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
18740 .buf = data->buf,
18741 .buf_len = data->len,
18742 .uapsd_queues = -1,
18743 };
18744
18745 nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
18746}
18747EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
18748
18749void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18750 struct net_device *netdev, const u8 *bssid,
18751 gfp_t gfp)
18752{
18753 struct sk_buff *msg;
18754 void *hdr;
18755
18756 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18757 if (!msg)
18758 return;
18759
18760 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18761 if (!hdr) {
18762 nlmsg_free(msg);
18763 return;
18764 }
18765
18766 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18767 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18768 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18769 goto nla_put_failure;
18770
18771 genlmsg_end(msg, hdr);
18772
18773 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18774 NL80211_MCGRP_MLME, gfp);
18775 return;
18776
18777 nla_put_failure:
18778 nlmsg_free(msg);
18779}
18780
18781void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18782 const u8 *ie, u8 ie_len,
18783 int sig_dbm, gfp_t gfp)
18784{
18785 struct wireless_dev *wdev = dev->ieee80211_ptr;
18786 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18787 struct sk_buff *msg;
18788 void *hdr;
18789
18790 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18791 return;
18792
18793 trace_cfg80211_notify_new_peer_candidate(dev, addr);
18794
18795 msg = nlmsg_new(100 + ie_len, gfp);
18796 if (!msg)
18797 return;
18798
18799 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18800 if (!hdr) {
18801 nlmsg_free(msg);
18802 return;
18803 }
18804
18805 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18806 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18807 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18808 (ie_len && ie &&
18809 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18810 (sig_dbm &&
18811 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18812 goto nla_put_failure;
18813
18814 genlmsg_end(msg, hdr);
18815
18816 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18817 NL80211_MCGRP_MLME, gfp);
18818 return;
18819
18820 nla_put_failure:
18821 nlmsg_free(msg);
18822}
18823EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18824
18825void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18826 struct net_device *netdev, const u8 *addr,
18827 enum nl80211_key_type key_type, int key_id,
18828 const u8 *tsc, gfp_t gfp)
18829{
18830 struct sk_buff *msg;
18831 void *hdr;
18832
18833 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18834 if (!msg)
18835 return;
18836
18837 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18838 if (!hdr) {
18839 nlmsg_free(msg);
18840 return;
18841 }
18842
18843 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18844 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18845 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18846 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18847 (key_id != -1 &&
18848 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18849 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18850 goto nla_put_failure;
18851
18852 genlmsg_end(msg, hdr);
18853
18854 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18855 NL80211_MCGRP_MLME, gfp);
18856 return;
18857
18858 nla_put_failure:
18859 nlmsg_free(msg);
18860}
18861
18862void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18863 struct ieee80211_channel *channel_before,
18864 struct ieee80211_channel *channel_after)
18865{
18866 struct sk_buff *msg;
18867 void *hdr;
18868 struct nlattr *nl_freq;
18869
18870 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18871 if (!msg)
18872 return;
18873
18874 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18875 if (!hdr) {
18876 nlmsg_free(msg);
18877 return;
18878 }
18879
18880 /*
18881 * Since we are applying the beacon hint to a wiphy we know its
18882 * wiphy_idx is valid
18883 */
18884 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18885 goto nla_put_failure;
18886
18887 /* Before */
18888 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18889 if (!nl_freq)
18890 goto nla_put_failure;
18891
18892 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18893 goto nla_put_failure;
18894 nla_nest_end(msg, nl_freq);
18895
18896 /* After */
18897 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18898 if (!nl_freq)
18899 goto nla_put_failure;
18900
18901 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18902 goto nla_put_failure;
18903 nla_nest_end(msg, nl_freq);
18904
18905 genlmsg_end(msg, hdr);
18906
18907 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18908 NL80211_MCGRP_REGULATORY);
18909
18910 return;
18911
18912nla_put_failure:
18913 nlmsg_free(msg);
18914}
18915
18916static void nl80211_send_remain_on_chan_event(
18917 int cmd, struct cfg80211_registered_device *rdev,
18918 struct wireless_dev *wdev, u64 cookie,
18919 struct ieee80211_channel *chan,
18920 unsigned int duration, gfp_t gfp)
18921{
18922 struct sk_buff *msg;
18923 void *hdr;
18924
18925 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18926 if (!msg)
18927 return;
18928
18929 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18930 if (!hdr) {
18931 nlmsg_free(msg);
18932 return;
18933 }
18934
18935 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18936 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18937 wdev->netdev->ifindex)) ||
18938 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18939 NL80211_ATTR_PAD) ||
18940 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18941 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18942 NL80211_CHAN_NO_HT) ||
18943 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18944 NL80211_ATTR_PAD))
18945 goto nla_put_failure;
18946
18947 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18948 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18949 goto nla_put_failure;
18950
18951 genlmsg_end(msg, hdr);
18952
18953 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18954 NL80211_MCGRP_MLME, gfp);
18955 return;
18956
18957 nla_put_failure:
18958 nlmsg_free(msg);
18959}
18960
18961void cfg80211_assoc_comeback(struct net_device *netdev,
18962 const u8 *ap_addr, u32 timeout)
18963{
18964 struct wireless_dev *wdev = netdev->ieee80211_ptr;
18965 struct wiphy *wiphy = wdev->wiphy;
18966 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18967 struct sk_buff *msg;
18968 void *hdr;
18969
18970 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18971
18972 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18973 if (!msg)
18974 return;
18975
18976 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18977 if (!hdr) {
18978 nlmsg_free(msg);
18979 return;
18980 }
18981
18982 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18983 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18984 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18985 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18986 goto nla_put_failure;
18987
18988 genlmsg_end(msg, hdr);
18989
18990 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18991 NL80211_MCGRP_MLME, GFP_KERNEL);
18992 return;
18993
18994 nla_put_failure:
18995 nlmsg_free(msg);
18996}
18997EXPORT_SYMBOL(cfg80211_assoc_comeback);
18998
18999void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
19000 struct ieee80211_channel *chan,
19001 unsigned int duration, gfp_t gfp)
19002{
19003 struct wiphy *wiphy = wdev->wiphy;
19004 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19005
19006 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
19007 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
19008 rdev, wdev, cookie, chan,
19009 duration, gfp);
19010}
19011EXPORT_SYMBOL(cfg80211_ready_on_channel);
19012
19013void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
19014 struct ieee80211_channel *chan,
19015 gfp_t gfp)
19016{
19017 struct wiphy *wiphy = wdev->wiphy;
19018 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19019
19020 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
19021 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
19022 rdev, wdev, cookie, chan, 0, gfp);
19023}
19024EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
19025
19026void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
19027 struct ieee80211_channel *chan,
19028 gfp_t gfp)
19029{
19030 struct wiphy *wiphy = wdev->wiphy;
19031 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19032
19033 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
19034 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
19035 rdev, wdev, cookie, chan, 0, gfp);
19036}
19037EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
19038
19039void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
19040 struct station_info *sinfo, gfp_t gfp)
19041{
19042 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19043 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19044 struct sk_buff *msg;
19045
19046 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
19047
19048 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19049 if (!msg)
19050 return;
19051
19052 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
19053 rdev, dev, mac_addr, sinfo) < 0) {
19054 nlmsg_free(msg);
19055 return;
19056 }
19057
19058 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19059 NL80211_MCGRP_MLME, gfp);
19060}
19061EXPORT_SYMBOL(cfg80211_new_sta);
19062
19063void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
19064 struct station_info *sinfo, gfp_t gfp)
19065{
19066 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19067 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19068 struct sk_buff *msg;
19069 struct station_info empty_sinfo = {};
19070
19071 if (!sinfo)
19072 sinfo = &empty_sinfo;
19073
19074 trace_cfg80211_del_sta(dev, mac_addr);
19075
19076 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19077 if (!msg) {
19078 cfg80211_sinfo_release_content(sinfo);
19079 return;
19080 }
19081
19082 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
19083 rdev, dev, mac_addr, sinfo) < 0) {
19084 nlmsg_free(msg);
19085 return;
19086 }
19087
19088 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19089 NL80211_MCGRP_MLME, gfp);
19090}
19091EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
19092
19093void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
19094 enum nl80211_connect_failed_reason reason,
19095 gfp_t gfp)
19096{
19097 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19098 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19099 struct sk_buff *msg;
19100 void *hdr;
19101
19102 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
19103 if (!msg)
19104 return;
19105
19106 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
19107 if (!hdr) {
19108 nlmsg_free(msg);
19109 return;
19110 }
19111
19112 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19113 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
19114 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
19115 goto nla_put_failure;
19116
19117 genlmsg_end(msg, hdr);
19118
19119 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19120 NL80211_MCGRP_MLME, gfp);
19121 return;
19122
19123 nla_put_failure:
19124 nlmsg_free(msg);
19125}
19126EXPORT_SYMBOL(cfg80211_conn_failed);
19127
19128static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
19129 const u8 *addr, gfp_t gfp)
19130{
19131 struct wireless_dev *wdev = dev->ieee80211_ptr;
19132 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19133 struct sk_buff *msg;
19134 void *hdr;
19135 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
19136
19137 if (!nlportid)
19138 return false;
19139
19140 msg = nlmsg_new(100, gfp);
19141 if (!msg)
19142 return true;
19143
19144 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19145 if (!hdr) {
19146 nlmsg_free(msg);
19147 return true;
19148 }
19149
19150 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19151 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19152 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19153 goto nla_put_failure;
19154
19155 genlmsg_end(msg, hdr);
19156 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19157 return true;
19158
19159 nla_put_failure:
19160 nlmsg_free(msg);
19161 return true;
19162}
19163
19164bool cfg80211_rx_spurious_frame(struct net_device *dev,
19165 const u8 *addr, gfp_t gfp)
19166{
19167 struct wireless_dev *wdev = dev->ieee80211_ptr;
19168 bool ret;
19169
19170 trace_cfg80211_rx_spurious_frame(dev, addr);
19171
19172 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19173 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
19174 trace_cfg80211_return_bool(false);
19175 return false;
19176 }
19177 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
19178 addr, gfp);
19179 trace_cfg80211_return_bool(ret);
19180 return ret;
19181}
19182EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
19183
19184bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
19185 const u8 *addr, gfp_t gfp)
19186{
19187 struct wireless_dev *wdev = dev->ieee80211_ptr;
19188 bool ret;
19189
19190 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
19191
19192 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19193 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
19194 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
19195 trace_cfg80211_return_bool(false);
19196 return false;
19197 }
19198 ret = __nl80211_unexpected_frame(dev,
19199 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
19200 addr, gfp);
19201 trace_cfg80211_return_bool(ret);
19202 return ret;
19203}
19204EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
19205
19206int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
19207 struct wireless_dev *wdev, u32 nlportid,
19208 struct cfg80211_rx_info *info, gfp_t gfp)
19209{
19210 struct net_device *netdev = wdev->netdev;
19211 struct sk_buff *msg;
19212 void *hdr;
19213
19214 msg = nlmsg_new(100 + info->len, gfp);
19215 if (!msg)
19216 return -ENOMEM;
19217
19218 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19219 if (!hdr) {
19220 nlmsg_free(msg);
19221 return -ENOMEM;
19222 }
19223
19224 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19225 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19226 netdev->ifindex)) ||
19227 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19228 NL80211_ATTR_PAD) ||
19229 (info->have_link_id &&
19230 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
19231 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
19232 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
19233 (info->sig_dbm &&
19234 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
19235 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
19236 (info->flags &&
19237 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
19238 (info->rx_tstamp && nla_put_u64_64bit(msg,
19239 NL80211_ATTR_RX_HW_TIMESTAMP,
19240 info->rx_tstamp,
19241 NL80211_ATTR_PAD)) ||
19242 (info->ack_tstamp && nla_put_u64_64bit(msg,
19243 NL80211_ATTR_TX_HW_TIMESTAMP,
19244 info->ack_tstamp,
19245 NL80211_ATTR_PAD)))
19246 goto nla_put_failure;
19247
19248 genlmsg_end(msg, hdr);
19249
19250 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19251
19252 nla_put_failure:
19253 nlmsg_free(msg);
19254 return -ENOBUFS;
19255}
19256
19257static void nl80211_frame_tx_status(struct wireless_dev *wdev,
19258 struct cfg80211_tx_status *status,
19259 gfp_t gfp, enum nl80211_commands command)
19260{
19261 struct wiphy *wiphy = wdev->wiphy;
19262 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19263 struct net_device *netdev = wdev->netdev;
19264 struct sk_buff *msg;
19265 void *hdr;
19266
19267 if (command == NL80211_CMD_FRAME_TX_STATUS)
19268 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
19269 status->ack);
19270 else
19271 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
19272 status->ack);
19273
19274 msg = nlmsg_new(100 + status->len, gfp);
19275 if (!msg)
19276 return;
19277
19278 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
19279 if (!hdr) {
19280 nlmsg_free(msg);
19281 return;
19282 }
19283
19284 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19285 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19286 netdev->ifindex)) ||
19287 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19288 NL80211_ATTR_PAD) ||
19289 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
19290 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
19291 NL80211_ATTR_PAD) ||
19292 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19293 (status->tx_tstamp &&
19294 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
19295 status->tx_tstamp, NL80211_ATTR_PAD)) ||
19296 (status->ack_tstamp &&
19297 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
19298 status->ack_tstamp, NL80211_ATTR_PAD)))
19299 goto nla_put_failure;
19300
19301 genlmsg_end(msg, hdr);
19302
19303 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19304 NL80211_MCGRP_MLME, gfp);
19305 return;
19306
19307nla_put_failure:
19308 nlmsg_free(msg);
19309}
19310
19311void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
19312 const u8 *buf, size_t len, bool ack,
19313 gfp_t gfp)
19314{
19315 struct cfg80211_tx_status status = {
19316 .cookie = cookie,
19317 .buf = buf,
19318 .len = len,
19319 .ack = ack
19320 };
19321
19322 nl80211_frame_tx_status(wdev, &status, gfp,
19323 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
19324}
19325EXPORT_SYMBOL(cfg80211_control_port_tx_status);
19326
19327void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
19328 struct cfg80211_tx_status *status, gfp_t gfp)
19329{
19330 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
19331}
19332EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
19333
19334static int __nl80211_rx_control_port(struct net_device *dev,
19335 struct sk_buff *skb,
19336 bool unencrypted,
19337 int link_id,
19338 gfp_t gfp)
19339{
19340 struct wireless_dev *wdev = dev->ieee80211_ptr;
19341 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19342 struct ethhdr *ehdr = eth_hdr(skb);
19343 const u8 *addr = ehdr->h_source;
19344 u16 proto = be16_to_cpu(skb->protocol);
19345 struct sk_buff *msg;
19346 void *hdr;
19347 struct nlattr *frame;
19348
19349 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
19350
19351 if (!nlportid)
19352 return -ENOENT;
19353
19354 msg = nlmsg_new(100 + skb->len, gfp);
19355 if (!msg)
19356 return -ENOMEM;
19357
19358 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
19359 if (!hdr) {
19360 nlmsg_free(msg);
19361 return -ENOBUFS;
19362 }
19363
19364 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19365 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19366 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19367 NL80211_ATTR_PAD) ||
19368 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19369 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
19370 (link_id >= 0 &&
19371 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
19372 (unencrypted && nla_put_flag(msg,
19373 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
19374 goto nla_put_failure;
19375
19376 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
19377 if (!frame)
19378 goto nla_put_failure;
19379
19380 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
19381 genlmsg_end(msg, hdr);
19382
19383 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19384
19385 nla_put_failure:
19386 nlmsg_free(msg);
19387 return -ENOBUFS;
19388}
19389
19390bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19391 bool unencrypted, int link_id)
19392{
19393 int ret;
19394
19395 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19396 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19397 GFP_ATOMIC);
19398 trace_cfg80211_return_bool(ret == 0);
19399 return ret == 0;
19400}
19401EXPORT_SYMBOL(cfg80211_rx_control_port);
19402
19403static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19404 const char *mac, gfp_t gfp)
19405{
19406 struct wireless_dev *wdev = dev->ieee80211_ptr;
19407 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19408 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19409 void **cb;
19410
19411 if (!msg)
19412 return NULL;
19413
19414 cb = (void **)msg->cb;
19415
19416 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19417 if (!cb[0]) {
19418 nlmsg_free(msg);
19419 return NULL;
19420 }
19421
19422 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19423 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19424 goto nla_put_failure;
19425
19426 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19427 goto nla_put_failure;
19428
19429 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19430 if (!cb[1])
19431 goto nla_put_failure;
19432
19433 cb[2] = rdev;
19434
19435 return msg;
19436 nla_put_failure:
19437 nlmsg_free(msg);
19438 return NULL;
19439}
19440
19441static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19442{
19443 void **cb = (void **)msg->cb;
19444 struct cfg80211_registered_device *rdev = cb[2];
19445
19446 nla_nest_end(msg, cb[1]);
19447 genlmsg_end(msg, cb[0]);
19448
19449 memset(msg->cb, 0, sizeof(msg->cb));
19450
19451 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19452 NL80211_MCGRP_MLME, gfp);
19453}
19454
19455void cfg80211_cqm_rssi_notify(struct net_device *dev,
19456 enum nl80211_cqm_rssi_threshold_event rssi_event,
19457 s32 rssi_level, gfp_t gfp)
19458{
19459 struct wireless_dev *wdev = dev->ieee80211_ptr;
19460 struct cfg80211_cqm_config *cqm_config;
19461
19462 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19463
19464 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19465 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19466 return;
19467
19468 rcu_read_lock();
19469 cqm_config = rcu_dereference(wdev->cqm_config);
19470 if (cqm_config) {
19471 cqm_config->last_rssi_event_value = rssi_level;
19472 cqm_config->last_rssi_event_type = rssi_event;
19473 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19474 }
19475 rcu_read_unlock();
19476}
19477EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19478
19479void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19480{
19481 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19482 cqm_rssi_work);
19483 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19484 enum nl80211_cqm_rssi_threshold_event rssi_event;
19485 struct cfg80211_cqm_config *cqm_config;
19486 struct sk_buff *msg;
19487 s32 rssi_level;
19488
19489 cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
19490 if (!cqm_config)
19491 return;
19492
19493 if (cqm_config->use_range_api)
19494 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19495
19496 rssi_level = cqm_config->last_rssi_event_value;
19497 rssi_event = cqm_config->last_rssi_event_type;
19498
19499 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19500 if (!msg)
19501 return;
19502
19503 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19504 rssi_event))
19505 goto nla_put_failure;
19506
19507 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19508 rssi_level))
19509 goto nla_put_failure;
19510
19511 cfg80211_send_cqm(msg, GFP_KERNEL);
19512
19513 return;
19514
19515 nla_put_failure:
19516 nlmsg_free(msg);
19517}
19518
19519void cfg80211_cqm_txe_notify(struct net_device *dev,
19520 const u8 *peer, u32 num_packets,
19521 u32 rate, u32 intvl, gfp_t gfp)
19522{
19523 struct sk_buff *msg;
19524
19525 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19526 if (!msg)
19527 return;
19528
19529 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19530 goto nla_put_failure;
19531
19532 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19533 goto nla_put_failure;
19534
19535 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19536 goto nla_put_failure;
19537
19538 cfg80211_send_cqm(msg, gfp);
19539 return;
19540
19541 nla_put_failure:
19542 nlmsg_free(msg);
19543}
19544EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19545
19546void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19547 const u8 *peer, u32 num_packets, gfp_t gfp)
19548{
19549 struct sk_buff *msg;
19550
19551 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19552
19553 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19554 if (!msg)
19555 return;
19556
19557 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19558 goto nla_put_failure;
19559
19560 cfg80211_send_cqm(msg, gfp);
19561 return;
19562
19563 nla_put_failure:
19564 nlmsg_free(msg);
19565}
19566EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19567
19568void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19569{
19570 struct sk_buff *msg;
19571
19572 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19573 if (!msg)
19574 return;
19575
19576 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19577 goto nla_put_failure;
19578
19579 cfg80211_send_cqm(msg, gfp);
19580 return;
19581
19582 nla_put_failure:
19583 nlmsg_free(msg);
19584}
19585EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19586
19587static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19588 struct net_device *netdev, const u8 *bssid,
19589 const u8 *replay_ctr, gfp_t gfp)
19590{
19591 struct sk_buff *msg;
19592 struct nlattr *rekey_attr;
19593 void *hdr;
19594
19595 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19596 if (!msg)
19597 return;
19598
19599 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19600 if (!hdr) {
19601 nlmsg_free(msg);
19602 return;
19603 }
19604
19605 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19606 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19607 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19608 goto nla_put_failure;
19609
19610 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19611 if (!rekey_attr)
19612 goto nla_put_failure;
19613
19614 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19615 NL80211_REPLAY_CTR_LEN, replay_ctr))
19616 goto nla_put_failure;
19617
19618 nla_nest_end(msg, rekey_attr);
19619
19620 genlmsg_end(msg, hdr);
19621
19622 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19623 NL80211_MCGRP_MLME, gfp);
19624 return;
19625
19626 nla_put_failure:
19627 nlmsg_free(msg);
19628}
19629
19630void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19631 const u8 *replay_ctr, gfp_t gfp)
19632{
19633 struct wireless_dev *wdev = dev->ieee80211_ptr;
19634 struct wiphy *wiphy = wdev->wiphy;
19635 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19636
19637 trace_cfg80211_gtk_rekey_notify(dev, bssid);
19638 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19639}
19640EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19641
19642static void
19643nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19644 struct net_device *netdev, int index,
19645 const u8 *bssid, bool preauth, gfp_t gfp)
19646{
19647 struct sk_buff *msg;
19648 struct nlattr *attr;
19649 void *hdr;
19650
19651 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19652 if (!msg)
19653 return;
19654
19655 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19656 if (!hdr) {
19657 nlmsg_free(msg);
19658 return;
19659 }
19660
19661 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19662 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19663 goto nla_put_failure;
19664
19665 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19666 if (!attr)
19667 goto nla_put_failure;
19668
19669 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19670 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19671 (preauth &&
19672 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19673 goto nla_put_failure;
19674
19675 nla_nest_end(msg, attr);
19676
19677 genlmsg_end(msg, hdr);
19678
19679 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19680 NL80211_MCGRP_MLME, gfp);
19681 return;
19682
19683 nla_put_failure:
19684 nlmsg_free(msg);
19685}
19686
19687void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19688 const u8 *bssid, bool preauth, gfp_t gfp)
19689{
19690 struct wireless_dev *wdev = dev->ieee80211_ptr;
19691 struct wiphy *wiphy = wdev->wiphy;
19692 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19693
19694 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19695 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19696}
19697EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19698
19699static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19700 struct net_device *netdev,
19701 unsigned int link_id,
19702 struct cfg80211_chan_def *chandef,
19703 gfp_t gfp,
19704 enum nl80211_commands notif,
19705 u8 count, bool quiet)
19706{
19707 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19708 struct sk_buff *msg;
19709 void *hdr;
19710
19711 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19712 if (!msg)
19713 return;
19714
19715 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19716 if (!hdr) {
19717 nlmsg_free(msg);
19718 return;
19719 }
19720
19721 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19722 goto nla_put_failure;
19723
19724 if (wdev->valid_links &&
19725 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19726 goto nla_put_failure;
19727
19728 if (nl80211_send_chandef(msg, chandef))
19729 goto nla_put_failure;
19730
19731 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19732 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19733 goto nla_put_failure;
19734 if (quiet &&
19735 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19736 goto nla_put_failure;
19737 }
19738
19739 genlmsg_end(msg, hdr);
19740
19741 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19742 NL80211_MCGRP_MLME, gfp);
19743 return;
19744
19745 nla_put_failure:
19746 nlmsg_free(msg);
19747}
19748
19749void cfg80211_ch_switch_notify(struct net_device *dev,
19750 struct cfg80211_chan_def *chandef,
19751 unsigned int link_id)
19752{
19753 struct wireless_dev *wdev = dev->ieee80211_ptr;
19754 struct wiphy *wiphy = wdev->wiphy;
19755 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19756
19757 lockdep_assert_wiphy(wdev->wiphy);
19758 WARN_INVALID_LINK_ID(wdev, link_id);
19759
19760 trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
19761
19762 switch (wdev->iftype) {
19763 case NL80211_IFTYPE_STATION:
19764 case NL80211_IFTYPE_P2P_CLIENT:
19765 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19766 cfg80211_update_assoc_bss_entry(wdev, link_id,
19767 chandef->chan);
19768 break;
19769 case NL80211_IFTYPE_MESH_POINT:
19770 wdev->u.mesh.chandef = *chandef;
19771 wdev->u.mesh.preset_chandef = *chandef;
19772 break;
19773 case NL80211_IFTYPE_AP:
19774 case NL80211_IFTYPE_P2P_GO:
19775 wdev->links[link_id].ap.chandef = *chandef;
19776 break;
19777 case NL80211_IFTYPE_ADHOC:
19778 wdev->u.ibss.chandef = *chandef;
19779 break;
19780 default:
19781 WARN_ON(1);
19782 break;
19783 }
19784
19785 cfg80211_schedule_channels_check(wdev);
19786 cfg80211_sched_dfs_chan_update(rdev);
19787
19788 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19789 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
19790}
19791EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19792
19793void cfg80211_ch_switch_started_notify(struct net_device *dev,
19794 struct cfg80211_chan_def *chandef,
19795 unsigned int link_id, u8 count,
19796 bool quiet)
19797{
19798 struct wireless_dev *wdev = dev->ieee80211_ptr;
19799 struct wiphy *wiphy = wdev->wiphy;
19800 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19801
19802 lockdep_assert_wiphy(wdev->wiphy);
19803 WARN_INVALID_LINK_ID(wdev, link_id);
19804
19805 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
19806
19807
19808 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19809 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19810 count, quiet);
19811}
19812EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19813
19814int cfg80211_bss_color_notify(struct net_device *dev,
19815 enum nl80211_commands cmd, u8 count,
19816 u64 color_bitmap, u8 link_id)
19817{
19818 struct wireless_dev *wdev = dev->ieee80211_ptr;
19819 struct wiphy *wiphy = wdev->wiphy;
19820 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19821 struct sk_buff *msg;
19822 void *hdr;
19823
19824 lockdep_assert_wiphy(wdev->wiphy);
19825
19826 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19827
19828 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19829 if (!msg)
19830 return -ENOMEM;
19831
19832 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19833 if (!hdr)
19834 goto nla_put_failure;
19835
19836 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19837 goto nla_put_failure;
19838
19839 if (wdev->valid_links &&
19840 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19841 goto nla_put_failure;
19842
19843 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19844 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19845 goto nla_put_failure;
19846
19847 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19848 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19849 color_bitmap, NL80211_ATTR_PAD))
19850 goto nla_put_failure;
19851
19852 genlmsg_end(msg, hdr);
19853
19854 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19855 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19856
19857nla_put_failure:
19858 nlmsg_free(msg);
19859 return -EINVAL;
19860}
19861EXPORT_SYMBOL(cfg80211_bss_color_notify);
19862
19863void
19864nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19865 const struct cfg80211_chan_def *chandef,
19866 enum nl80211_radar_event event,
19867 struct net_device *netdev, gfp_t gfp)
19868{
19869 struct sk_buff *msg;
19870 void *hdr;
19871
19872 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19873 if (!msg)
19874 return;
19875
19876 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19877 if (!hdr) {
19878 nlmsg_free(msg);
19879 return;
19880 }
19881
19882 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19883 goto nla_put_failure;
19884
19885 /* NOP and radar events don't need a netdev parameter */
19886 if (netdev) {
19887 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19888
19889 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19890 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19891 NL80211_ATTR_PAD))
19892 goto nla_put_failure;
19893 }
19894
19895 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19896 goto nla_put_failure;
19897
19898 if (nl80211_send_chandef(msg, chandef))
19899 goto nla_put_failure;
19900
19901 genlmsg_end(msg, hdr);
19902
19903 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19904 NL80211_MCGRP_MLME, gfp);
19905 return;
19906
19907 nla_put_failure:
19908 nlmsg_free(msg);
19909}
19910
19911void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19912 struct sta_opmode_info *sta_opmode,
19913 gfp_t gfp)
19914{
19915 struct sk_buff *msg;
19916 struct wireless_dev *wdev = dev->ieee80211_ptr;
19917 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19918 void *hdr;
19919
19920 if (WARN_ON(!mac))
19921 return;
19922
19923 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19924 if (!msg)
19925 return;
19926
19927 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19928 if (!hdr) {
19929 nlmsg_free(msg);
19930 return;
19931 }
19932
19933 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19934 goto nla_put_failure;
19935
19936 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19937 goto nla_put_failure;
19938
19939 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19940 goto nla_put_failure;
19941
19942 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19943 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19944 goto nla_put_failure;
19945
19946 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19947 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19948 goto nla_put_failure;
19949
19950 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19951 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19952 goto nla_put_failure;
19953
19954 genlmsg_end(msg, hdr);
19955
19956 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19957 NL80211_MCGRP_MLME, gfp);
19958
19959 return;
19960
19961nla_put_failure:
19962 nlmsg_free(msg);
19963}
19964EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19965
19966void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19967 u64 cookie, bool acked, s32 ack_signal,
19968 bool is_valid_ack_signal, gfp_t gfp)
19969{
19970 struct wireless_dev *wdev = dev->ieee80211_ptr;
19971 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19972 struct sk_buff *msg;
19973 void *hdr;
19974
19975 trace_cfg80211_probe_status(dev, addr, cookie, acked);
19976
19977 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19978
19979 if (!msg)
19980 return;
19981
19982 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19983 if (!hdr) {
19984 nlmsg_free(msg);
19985 return;
19986 }
19987
19988 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19989 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19990 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19991 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19992 NL80211_ATTR_PAD) ||
19993 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19994 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19995 ack_signal)))
19996 goto nla_put_failure;
19997
19998 genlmsg_end(msg, hdr);
19999
20000 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20001 NL80211_MCGRP_MLME, gfp);
20002 return;
20003
20004 nla_put_failure:
20005 nlmsg_free(msg);
20006}
20007EXPORT_SYMBOL(cfg80211_probe_status);
20008
20009void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
20010 size_t len, int freq, int sig_dbm)
20011{
20012 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20013 struct sk_buff *msg;
20014 void *hdr;
20015 struct cfg80211_beacon_registration *reg;
20016
20017 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
20018
20019 spin_lock_bh(&rdev->beacon_registrations_lock);
20020 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
20021 msg = nlmsg_new(len + 100, GFP_ATOMIC);
20022 if (!msg) {
20023 spin_unlock_bh(&rdev->beacon_registrations_lock);
20024 return;
20025 }
20026
20027 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20028 if (!hdr)
20029 goto nla_put_failure;
20030
20031 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20032 (freq &&
20033 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
20034 KHZ_TO_MHZ(freq)) ||
20035 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
20036 freq % 1000))) ||
20037 (sig_dbm &&
20038 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
20039 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
20040 goto nla_put_failure;
20041
20042 genlmsg_end(msg, hdr);
20043
20044 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
20045 }
20046 spin_unlock_bh(&rdev->beacon_registrations_lock);
20047 return;
20048
20049 nla_put_failure:
20050 spin_unlock_bh(&rdev->beacon_registrations_lock);
20051 nlmsg_free(msg);
20052}
20053EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
20054
20055#ifdef CONFIG_PM
20056static int cfg80211_net_detect_results(struct sk_buff *msg,
20057 struct cfg80211_wowlan_wakeup *wakeup)
20058{
20059 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
20060 struct nlattr *nl_results, *nl_match, *nl_freqs;
20061 int i, j;
20062
20063 nl_results = nla_nest_start_noflag(msg,
20064 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
20065 if (!nl_results)
20066 return -EMSGSIZE;
20067
20068 for (i = 0; i < nd->n_matches; i++) {
20069 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
20070
20071 nl_match = nla_nest_start_noflag(msg, i);
20072 if (!nl_match)
20073 break;
20074
20075 /* The SSID attribute is optional in nl80211, but for
20076 * simplicity reasons it's always present in the
20077 * cfg80211 structure. If a driver can't pass the
20078 * SSID, that needs to be changed. A zero length SSID
20079 * is still a valid SSID (wildcard), so it cannot be
20080 * used for this purpose.
20081 */
20082 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
20083 match->ssid.ssid)) {
20084 nla_nest_cancel(msg, nl_match);
20085 goto out;
20086 }
20087
20088 if (match->n_channels) {
20089 nl_freqs = nla_nest_start_noflag(msg,
20090 NL80211_ATTR_SCAN_FREQUENCIES);
20091 if (!nl_freqs) {
20092 nla_nest_cancel(msg, nl_match);
20093 goto out;
20094 }
20095
20096 for (j = 0; j < match->n_channels; j++) {
20097 if (nla_put_u32(msg, j, match->channels[j])) {
20098 nla_nest_cancel(msg, nl_freqs);
20099 nla_nest_cancel(msg, nl_match);
20100 goto out;
20101 }
20102 }
20103
20104 nla_nest_end(msg, nl_freqs);
20105 }
20106
20107 nla_nest_end(msg, nl_match);
20108 }
20109
20110out:
20111 nla_nest_end(msg, nl_results);
20112 return 0;
20113}
20114
20115void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
20116 struct cfg80211_wowlan_wakeup *wakeup,
20117 gfp_t gfp)
20118{
20119 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20120 struct sk_buff *msg;
20121 void *hdr;
20122 int size = 200;
20123
20124 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
20125
20126 if (wakeup)
20127 size += wakeup->packet_present_len;
20128
20129 msg = nlmsg_new(size, gfp);
20130 if (!msg)
20131 return;
20132
20133 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
20134 if (!hdr)
20135 goto free_msg;
20136
20137 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20138 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20139 NL80211_ATTR_PAD))
20140 goto free_msg;
20141
20142 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20143 wdev->netdev->ifindex))
20144 goto free_msg;
20145
20146 if (wakeup) {
20147 struct nlattr *reasons;
20148
20149 reasons = nla_nest_start_noflag(msg,
20150 NL80211_ATTR_WOWLAN_TRIGGERS);
20151 if (!reasons)
20152 goto free_msg;
20153
20154 if (wakeup->disconnect &&
20155 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
20156 goto free_msg;
20157 if (wakeup->magic_pkt &&
20158 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
20159 goto free_msg;
20160 if (wakeup->gtk_rekey_failure &&
20161 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
20162 goto free_msg;
20163 if (wakeup->eap_identity_req &&
20164 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
20165 goto free_msg;
20166 if (wakeup->four_way_handshake &&
20167 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
20168 goto free_msg;
20169 if (wakeup->rfkill_release &&
20170 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
20171 goto free_msg;
20172
20173 if (wakeup->pattern_idx >= 0 &&
20174 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
20175 wakeup->pattern_idx))
20176 goto free_msg;
20177
20178 if (wakeup->tcp_match &&
20179 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
20180 goto free_msg;
20181
20182 if (wakeup->tcp_connlost &&
20183 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
20184 goto free_msg;
20185
20186 if (wakeup->tcp_nomoretokens &&
20187 nla_put_flag(msg,
20188 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
20189 goto free_msg;
20190
20191 if (wakeup->unprot_deauth_disassoc &&
20192 nla_put_flag(msg,
20193 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
20194 goto free_msg;
20195
20196 if (wakeup->packet) {
20197 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
20198 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
20199
20200 if (!wakeup->packet_80211) {
20201 pkt_attr =
20202 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
20203 len_attr =
20204 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
20205 }
20206
20207 if (wakeup->packet_len &&
20208 nla_put_u32(msg, len_attr, wakeup->packet_len))
20209 goto free_msg;
20210
20211 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
20212 wakeup->packet))
20213 goto free_msg;
20214 }
20215
20216 if (wakeup->net_detect &&
20217 cfg80211_net_detect_results(msg, wakeup))
20218 goto free_msg;
20219
20220 nla_nest_end(msg, reasons);
20221 }
20222
20223 genlmsg_end(msg, hdr);
20224
20225 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20226 NL80211_MCGRP_MLME, gfp);
20227 return;
20228
20229 free_msg:
20230 nlmsg_free(msg);
20231}
20232EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
20233#endif
20234
20235void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
20236 enum nl80211_tdls_operation oper,
20237 u16 reason_code, gfp_t gfp)
20238{
20239 struct wireless_dev *wdev = dev->ieee80211_ptr;
20240 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20241 struct sk_buff *msg;
20242 void *hdr;
20243
20244 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
20245 reason_code);
20246
20247 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20248 if (!msg)
20249 return;
20250
20251 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
20252 if (!hdr) {
20253 nlmsg_free(msg);
20254 return;
20255 }
20256
20257 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20258 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20259 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
20260 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
20261 (reason_code > 0 &&
20262 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
20263 goto nla_put_failure;
20264
20265 genlmsg_end(msg, hdr);
20266
20267 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20268 NL80211_MCGRP_MLME, gfp);
20269 return;
20270
20271 nla_put_failure:
20272 nlmsg_free(msg);
20273}
20274EXPORT_SYMBOL(cfg80211_tdls_oper_request);
20275
20276static int nl80211_netlink_notify(struct notifier_block * nb,
20277 unsigned long state,
20278 void *_notify)
20279{
20280 struct netlink_notify *notify = _notify;
20281 struct cfg80211_registered_device *rdev;
20282 struct wireless_dev *wdev;
20283 struct cfg80211_beacon_registration *reg, *tmp;
20284
20285 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
20286 return NOTIFY_DONE;
20287
20288 rcu_read_lock();
20289
20290 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
20291 struct cfg80211_sched_scan_request *sched_scan_req;
20292
20293 list_for_each_entry_rcu(sched_scan_req,
20294 &rdev->sched_scan_req_list,
20295 list) {
20296 if (sched_scan_req->owner_nlportid == notify->portid) {
20297 sched_scan_req->nl_owner_dead = true;
20298 wiphy_work_queue(&rdev->wiphy,
20299 &rdev->sched_scan_stop_wk);
20300 }
20301 }
20302
20303 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
20304 cfg80211_mlme_unregister_socket(wdev, notify->portid);
20305
20306 if (wdev->owner_nlportid == notify->portid) {
20307 wdev->nl_owner_dead = true;
20308 schedule_work(&rdev->destroy_work);
20309 } else if (wdev->conn_owner_nlportid == notify->portid) {
20310 schedule_work(&wdev->disconnect_wk);
20311 }
20312
20313 cfg80211_release_pmsr(wdev, notify->portid);
20314 }
20315
20316 spin_lock_bh(&rdev->beacon_registrations_lock);
20317 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
20318 list) {
20319 if (reg->nlportid == notify->portid) {
20320 list_del(&reg->list);
20321 kfree(reg);
20322 break;
20323 }
20324 }
20325 spin_unlock_bh(&rdev->beacon_registrations_lock);
20326 }
20327
20328 rcu_read_unlock();
20329
20330 /*
20331 * It is possible that the user space process that is controlling the
20332 * indoor setting disappeared, so notify the regulatory core.
20333 */
20334 regulatory_netlink_notify(notify->portid);
20335 return NOTIFY_OK;
20336}
20337
20338static struct notifier_block nl80211_netlink_notifier = {
20339 .notifier_call = nl80211_netlink_notify,
20340};
20341
20342void cfg80211_ft_event(struct net_device *netdev,
20343 struct cfg80211_ft_event_params *ft_event)
20344{
20345 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20346 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20347 struct sk_buff *msg;
20348 void *hdr;
20349
20350 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
20351
20352 if (!ft_event->target_ap)
20353 return;
20354
20355 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
20356 GFP_KERNEL);
20357 if (!msg)
20358 return;
20359
20360 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
20361 if (!hdr)
20362 goto out;
20363
20364 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20365 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20366 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
20367 goto out;
20368
20369 if (ft_event->ies &&
20370 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
20371 goto out;
20372 if (ft_event->ric_ies &&
20373 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
20374 ft_event->ric_ies))
20375 goto out;
20376
20377 genlmsg_end(msg, hdr);
20378
20379 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20380 NL80211_MCGRP_MLME, GFP_KERNEL);
20381 return;
20382 out:
20383 nlmsg_free(msg);
20384}
20385EXPORT_SYMBOL(cfg80211_ft_event);
20386
20387void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
20388{
20389 struct cfg80211_registered_device *rdev;
20390 struct sk_buff *msg;
20391 void *hdr;
20392 u32 nlportid;
20393
20394 rdev = wiphy_to_rdev(wdev->wiphy);
20395 if (!rdev->crit_proto_nlportid)
20396 return;
20397
20398 nlportid = rdev->crit_proto_nlportid;
20399 rdev->crit_proto_nlportid = 0;
20400
20401 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20402 if (!msg)
20403 return;
20404
20405 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
20406 if (!hdr)
20407 goto nla_put_failure;
20408
20409 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20410 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20411 NL80211_ATTR_PAD))
20412 goto nla_put_failure;
20413
20414 genlmsg_end(msg, hdr);
20415
20416 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20417 return;
20418
20419 nla_put_failure:
20420 nlmsg_free(msg);
20421}
20422EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20423
20424void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20425{
20426 struct wiphy *wiphy = wdev->wiphy;
20427 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20428 struct sk_buff *msg;
20429 void *hdr;
20430
20431 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20432 if (!msg)
20433 return;
20434
20435 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20436 if (!hdr)
20437 goto out;
20438
20439 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20440 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20441 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20442 NL80211_ATTR_PAD) ||
20443 (wdev->valid_links &&
20444 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20445 goto out;
20446
20447 genlmsg_end(msg, hdr);
20448
20449 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20450 NL80211_MCGRP_MLME, GFP_KERNEL);
20451 return;
20452 out:
20453 nlmsg_free(msg);
20454}
20455
20456int cfg80211_external_auth_request(struct net_device *dev,
20457 struct cfg80211_external_auth_params *params,
20458 gfp_t gfp)
20459{
20460 struct wireless_dev *wdev = dev->ieee80211_ptr;
20461 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20462 struct sk_buff *msg;
20463 void *hdr;
20464
20465 if (!wdev->conn_owner_nlportid)
20466 return -EINVAL;
20467
20468 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20469 if (!msg)
20470 return -ENOMEM;
20471
20472 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20473 if (!hdr)
20474 goto nla_put_failure;
20475
20476 /* Some historical mistakes in drivers <-> userspace interface (notably
20477 * between drivers and wpa_supplicant) led to a big-endian conversion
20478 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
20479 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
20480 * benefit of older wpa_supplicant versions, send this particular value
20481 * in big-endian. Note that newer wpa_supplicant will also detect this
20482 * particular value in big endian still, so it all continues to work.
20483 */
20484 if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
20485 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
20486 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
20487 goto nla_put_failure;
20488 } else {
20489 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
20490 params->key_mgmt_suite))
20491 goto nla_put_failure;
20492 }
20493
20494 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20495 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20496 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20497 params->action) ||
20498 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20499 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20500 params->ssid.ssid) ||
20501 (!is_zero_ether_addr(params->mld_addr) &&
20502 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20503 goto nla_put_failure;
20504
20505 genlmsg_end(msg, hdr);
20506 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20507 wdev->conn_owner_nlportid);
20508 return 0;
20509
20510 nla_put_failure:
20511 nlmsg_free(msg);
20512 return -ENOBUFS;
20513}
20514EXPORT_SYMBOL(cfg80211_external_auth_request);
20515
20516void cfg80211_update_owe_info_event(struct net_device *netdev,
20517 struct cfg80211_update_owe_info *owe_info,
20518 gfp_t gfp)
20519{
20520 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20521 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20522 struct sk_buff *msg;
20523 void *hdr;
20524
20525 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20526
20527 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20528 if (!msg)
20529 return;
20530
20531 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20532 if (!hdr)
20533 goto nla_put_failure;
20534
20535 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20536 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20537 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20538 goto nla_put_failure;
20539
20540 if (!owe_info->ie_len ||
20541 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20542 goto nla_put_failure;
20543
20544 if (owe_info->assoc_link_id != -1) {
20545 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20546 owe_info->assoc_link_id))
20547 goto nla_put_failure;
20548
20549 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20550 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20551 owe_info->peer_mld_addr))
20552 goto nla_put_failure;
20553 }
20554
20555 genlmsg_end(msg, hdr);
20556
20557 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20558 NL80211_MCGRP_MLME, gfp);
20559 return;
20560
20561nla_put_failure:
20562 genlmsg_cancel(msg, hdr);
20563 nlmsg_free(msg);
20564}
20565EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20566
20567void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
20568{
20569 struct wiphy *wiphy = wdev->wiphy;
20570
20571 /* Schedule channels check if NO_IR or DFS relaxations are supported */
20572 if (wdev->iftype == NL80211_IFTYPE_STATION &&
20573 (wiphy_ext_feature_isset(wiphy,
20574 NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
20575 (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
20576 wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
20577 reg_check_channels();
20578}
20579EXPORT_SYMBOL(cfg80211_schedule_channels_check);
20580
20581void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
20582{
20583 struct wireless_dev *wdev = netdev->ieee80211_ptr;
20584 struct wiphy *wiphy = wdev->wiphy;
20585 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20586 struct sk_buff *msg;
20587 void *hdr;
20588
20589 trace_cfg80211_epcs_changed(wdev, enabled);
20590
20591 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20592 if (!msg)
20593 return;
20594
20595 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
20596 if (!hdr) {
20597 nlmsg_free(msg);
20598 return;
20599 }
20600
20601 if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
20602 goto nla_put_failure;
20603
20604 genlmsg_end(msg, hdr);
20605 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20606 NL80211_MCGRP_MLME, GFP_KERNEL);
20607 return;
20608
20609 nla_put_failure:
20610 nlmsg_free(msg);
20611}
20612EXPORT_SYMBOL(cfg80211_epcs_changed);
20613
20614/* initialisation/exit functions */
20615
20616int __init nl80211_init(void)
20617{
20618 int err;
20619
20620 err = genl_register_family(&nl80211_fam);
20621 if (err)
20622 return err;
20623
20624 err = netlink_register_notifier(&nl80211_netlink_notifier);
20625 if (err)
20626 goto err_out;
20627
20628 return 0;
20629 err_out:
20630 genl_unregister_family(&nl80211_fam);
20631 return err;
20632}
20633
20634void nl80211_exit(void)
20635{
20636 netlink_unregister_notifier(&nl80211_netlink_notifier);
20637 genl_unregister_family(&nl80211_fam);
20638}
Linux 6.x block layer and io_uring tree(s)