net/wireless/mlme.c

   1 /*
   2  * cfg80211 MLME SAP interface
   3  *
   4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   5  */
   6
   7 #include <linux/kernel.h>
   8 #include <linux/module.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/netdevice.h>
  11 #include <linux/nl80211.h>
  12 #include <linux/slab.h>
  13 #include <linux/wireless.h>
  14 #include <net/cfg80211.h>
  15 #include <net/iw_handler.h>
  16 #include "core.h"
  17 #include "nl80211.h"
  18 #include "rdev-ops.h"
  19
  20
  21 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
  22                             const u8 *buf, size_t len)
  23 {
  24         u16 status_code;
  25         struct wireless_dev *wdev = dev->ieee80211_ptr;
  26         struct wiphy *wiphy = wdev->wiphy;
  27         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  28         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  29         u8 *ie = mgmt->u.assoc_resp.variable;
  30         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  31
  32         trace_cfg80211_send_rx_assoc(dev, bss);
  33
  34         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  35
  36         /*
  37          * This is a bit of a hack, we don't notify userspace of
  38          * a (re-)association reply if we tried to send a reassoc
  39          * and got a reject -- we only try again with an assoc
  40          * frame instead of reassoc.
  41          */
  42         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
  43             cfg80211_sme_failed_reassoc(wdev)) {
  44                 cfg80211_put_bss(wiphy, bss);
  45                 return;
  46         }
  47
  48         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
  49
  50         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn) {
  51                 cfg80211_sme_failed_assoc(wdev);
  52                 /*
  53                  * do not call connect_result() now because the
  54                  * sme will schedule work that does it later.
  55                  */
  56                 cfg80211_put_bss(wiphy, bss);
  57                 return;
  58         }
  59
  60         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
  61                 /*
  62                  * This is for the userspace SME, the CONNECTING
  63                  * state will be changed to CONNECTED by
  64                  * __cfg80211_connect_result() below.
  65                  */
  66                 wdev->sme_state = CFG80211_SME_CONNECTING;
  67         }
  68
  69         /* this consumes the bss reference */
  70         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
  71                                   status_code,
  72                                   status_code == WLAN_STATUS_SUCCESS, bss);
  73 }
  74 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  75
  76 static void cfg80211_process_deauth(struct net_device *dev,
  77                                     const u8 *buf, size_t len)
  78 {
  79         struct wireless_dev *wdev = dev->ieee80211_ptr;
  80         struct wiphy *wiphy = wdev->wiphy;
  81         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  82         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  83         const u8 *bssid = mgmt->bssid;
  84         bool was_current = false;
  85
  86         if (wdev->current_bss &&
  87             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
  88                 cfg80211_unhold_bss(wdev->current_bss);
  89                 cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
  90                 wdev->current_bss = NULL;
  91                 was_current = true;
  92         }
  93
  94         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
  95
  96         if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
  97                 u16 reason_code;
  98                 bool from_ap;
  99
 100                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 101
 102                 from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
 103                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 104         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
 105                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 106                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 107                                           false, NULL);
 108         }
 109 }
 110
 111 static void cfg80211_process_disassoc(struct net_device *dev,
 112                                       const u8 *buf, size_t len)
 113 {
 114         struct wireless_dev *wdev = dev->ieee80211_ptr;
 115         struct wiphy *wiphy = wdev->wiphy;
 116         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 117         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 118         const u8 *bssid = mgmt->bssid;
 119         u16 reason_code;
 120         bool from_ap;
 121
 122         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
 123
 124         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 125                 return;
 126
 127         if (wdev->current_bss &&
 128             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
 129                 cfg80211_sme_disassoc(dev, wdev->current_bss);
 130                 cfg80211_unhold_bss(wdev->current_bss);
 131                 cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
 132                 wdev->current_bss = NULL;
 133         } else
 134                 WARN_ON(1);
 135
 136         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 137
 138         from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
 139         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 140 }
 141
 142 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 143 {
 144         struct wireless_dev *wdev = dev->ieee80211_ptr;
 145         struct wiphy *wiphy = wdev->wiphy;
 146         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 147         struct ieee80211_mgmt *mgmt = (void *)buf;
 148
 149         ASSERT_WDEV_LOCK(wdev);
 150
 151         trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 152
 153         if (WARN_ON(len < 2))
 154                 return;
 155
 156         if (ieee80211_is_auth(mgmt->frame_control)) {
 157                 nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
 158                 cfg80211_sme_rx_auth(dev, buf, len);
 159         } else if (ieee80211_is_deauth(mgmt->frame_control)) {
 160                 cfg80211_process_deauth(dev, buf, len);
 161         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
 162                 cfg80211_process_disassoc(dev, buf, len);
 163         }
 164 }
 165 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 166
 167 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 168 {
 169         struct wireless_dev *wdev = dev->ieee80211_ptr;
 170         struct wiphy *wiphy = wdev->wiphy;
 171         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 172
 173         trace_cfg80211_send_auth_timeout(dev, addr);
 174
 175         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 176         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 177                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 178                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 179                                           false, NULL);
 180 }
 181 EXPORT_SYMBOL(cfg80211_auth_timeout);
 182
 183 void cfg80211_assoc_timeout(struct net_device *dev, const u8 *addr)
 184 {
 185         struct wireless_dev *wdev = dev->ieee80211_ptr;
 186         struct wiphy *wiphy = wdev->wiphy;
 187         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 188
 189         trace_cfg80211_send_assoc_timeout(dev, addr);
 190
 191         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 192         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 193                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 194                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 195                                           false, NULL);
 196 }
 197 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 198
 199 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 200 {
 201         struct wireless_dev *wdev = dev->ieee80211_ptr;
 202         struct ieee80211_mgmt *mgmt = (void *)buf;
 203
 204         ASSERT_WDEV_LOCK(wdev);
 205
 206         trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
 207
 208         if (WARN_ON(len < 2))
 209                 return;
 210
 211         if (ieee80211_is_deauth(mgmt->frame_control))
 212                 cfg80211_process_deauth(dev, buf, len);
 213         else
 214                 cfg80211_process_disassoc(dev, buf, len);
 215 }
 216 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 217
 218 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 219                                   enum nl80211_key_type key_type, int key_id,
 220                                   const u8 *tsc, gfp_t gfp)
 221 {
 222         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 223         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 224 #ifdef CONFIG_CFG80211_WEXT
 225         union iwreq_data wrqu;
 226         char *buf = kmalloc(128, gfp);
 227
 228         if (buf) {
 229                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 230                         "keyid=%d %scast addr=%pM)", key_id,
 231                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 232                         addr);
 233                 memset(&wrqu, 0, sizeof(wrqu));
 234                 wrqu.data.length = strlen(buf);
 235                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 236                 kfree(buf);
 237         }
 238 #endif
 239
 240         trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 241         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 242 }
 243 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 244
 245 /* some MLME handling for userspace SME */
 246 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 247                        struct net_device *dev,
 248                        struct ieee80211_channel *chan,
 249                        enum nl80211_auth_type auth_type,
 250                        const u8 *bssid,
 251                        const u8 *ssid, int ssid_len,
 252                        const u8 *ie, int ie_len,
 253                        const u8 *key, int key_len, int key_idx,
 254                        const u8 *sae_data, int sae_data_len)
 255 {
 256         struct wireless_dev *wdev = dev->ieee80211_ptr;
 257         struct cfg80211_auth_request req = {
 258                 .ie = ie,
 259                 .ie_len = ie_len,
 260                 .sae_data = sae_data,
 261                 .sae_data_len = sae_data_len,
 262                 .auth_type = auth_type,
 263                 .key = key,
 264                 .key_len = key_len,
 265                 .key_idx = key_idx,
 266         };
 267         int err;
 268
 269         ASSERT_WDEV_LOCK(wdev);
 270
 271         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 272                 if (!key || !key_len || key_idx < 0 || key_idx > 4)
 273                         return -EINVAL;
 274
 275         if (wdev->current_bss &&
 276             ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
 277                 return -EALREADY;
 278
 279         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 280                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 281         if (!req.bss)
 282                 return -ENOENT;
 283
 284         err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
 285                                     CHAN_MODE_SHARED);
 286         if (err)
 287                 goto out;
 288
 289         err = rdev_auth(rdev, dev, &req);
 290
 291 out:
 292         cfg80211_put_bss(&rdev->wiphy, req.bss);
 293         return err;
 294 }
 295
 296 /*  Do a logical ht_capa &= ht_capa_mask.  */
 297 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 298                                const struct ieee80211_ht_cap *ht_capa_mask)
 299 {
 300         int i;
 301         u8 *p1, *p2;
 302         if (!ht_capa_mask) {
 303                 memset(ht_capa, 0, sizeof(*ht_capa));
 304                 return;
 305         }
 306
 307         p1 = (u8*)(ht_capa);
 308         p2 = (u8*)(ht_capa_mask);
 309         for (i = 0; i<sizeof(*ht_capa); i++)
 310                 p1[i] &= p2[i];
 311 }
 312
 313 /*  Do a logical ht_capa &= ht_capa_mask.  */
 314 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 315                                 const struct ieee80211_vht_cap *vht_capa_mask)
 316 {
 317         int i;
 318         u8 *p1, *p2;
 319         if (!vht_capa_mask) {
 320                 memset(vht_capa, 0, sizeof(*vht_capa));
 321                 return;
 322         }
 323
 324         p1 = (u8*)(vht_capa);
 325         p2 = (u8*)(vht_capa_mask);
 326         for (i = 0; i < sizeof(*vht_capa); i++)
 327                 p1[i] &= p2[i];
 328 }
 329
 330 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 331                         struct net_device *dev,
 332                         struct ieee80211_channel *chan,
 333                         const u8 *bssid,
 334                         const u8 *ssid, int ssid_len,
 335                         struct cfg80211_assoc_request *req)
 336 {
 337         struct wireless_dev *wdev = dev->ieee80211_ptr;
 338         int err;
 339         bool was_connected = false;
 340
 341         ASSERT_WDEV_LOCK(wdev);
 342
 343         if (wdev->current_bss && req->prev_bssid &&
 344             ether_addr_equal(wdev->current_bss->pub.bssid, req->prev_bssid)) {
 345                 /*
 346                  * Trying to reassociate: Allow this to proceed and let the old
 347                  * association to be dropped when the new one is completed.
 348                  */
 349                 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 350                         was_connected = true;
 351                         wdev->sme_state = CFG80211_SME_CONNECTING;
 352                 }
 353         } else if (wdev->current_bss)
 354                 return -EALREADY;
 355
 356         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 357                                   rdev->wiphy.ht_capa_mod_mask);
 358         cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 359                                    rdev->wiphy.vht_capa_mod_mask);
 360
 361         req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 362                                     WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 363         if (!req->bss) {
 364                 if (was_connected)
 365                         wdev->sme_state = CFG80211_SME_CONNECTED;
 366                 return -ENOENT;
 367         }
 368
 369         err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
 370         if (err)
 371                 goto out;
 372
 373         err = rdev_assoc(rdev, dev, req);
 374
 375 out:
 376         if (err) {
 377                 if (was_connected)
 378                         wdev->sme_state = CFG80211_SME_CONNECTED;
 379                 cfg80211_put_bss(&rdev->wiphy, req->bss);
 380         }
 381
 382         return err;
 383 }
 384
 385 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 386                          struct net_device *dev, const u8 *bssid,
 387                          const u8 *ie, int ie_len, u16 reason,
 388                          bool local_state_change)
 389 {
 390         struct wireless_dev *wdev = dev->ieee80211_ptr;
 391         struct cfg80211_deauth_request req = {
 392                 .bssid = bssid,
 393                 .reason_code = reason,
 394                 .ie = ie,
 395                 .ie_len = ie_len,
 396                 .local_state_change = local_state_change,
 397         };
 398
 399         ASSERT_WDEV_LOCK(wdev);
 400
 401         if (local_state_change && (!wdev->current_bss ||
 402             !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 403                 return 0;
 404
 405         return rdev_deauth(rdev, dev, &req);
 406 }
 407
 408 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 409                            struct net_device *dev, const u8 *bssid,
 410                            const u8 *ie, int ie_len, u16 reason,
 411                            bool local_state_change)
 412 {
 413         struct wireless_dev *wdev = dev->ieee80211_ptr;
 414         struct cfg80211_disassoc_request req = {
 415                 .reason_code = reason,
 416                 .local_state_change = local_state_change,
 417                 .ie = ie,
 418                 .ie_len = ie_len,
 419         };
 420
 421         ASSERT_WDEV_LOCK(wdev);
 422
 423         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 424                 return -ENOTCONN;
 425
 426         if (WARN(!wdev->current_bss, "sme_state=%d\n", wdev->sme_state))
 427                 return -ENOTCONN;
 428
 429         if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
 430                 req.bss = &wdev->current_bss->pub;
 431         else
 432                 return -ENOTCONN;
 433
 434         return rdev_disassoc(rdev, dev, &req);
 435 }
 436
 437 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 438                         struct net_device *dev)
 439 {
 440         struct wireless_dev *wdev = dev->ieee80211_ptr;
 441         u8 bssid[ETH_ALEN];
 442         struct cfg80211_deauth_request req = {
 443                 .reason_code = WLAN_REASON_DEAUTH_LEAVING,
 444                 .bssid = bssid,
 445         };
 446
 447         ASSERT_WDEV_LOCK(wdev);
 448
 449         if (!rdev->ops->deauth)
 450                 return;
 451
 452         if (!wdev->current_bss)
 453                 return;
 454
 455         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
 456         rdev_deauth(rdev, dev, &req);
 457
 458         if (wdev->current_bss) {
 459                 cfg80211_unhold_bss(wdev->current_bss);
 460                 cfg80211_put_bss(&rdev->wiphy, &wdev->current_bss->pub);
 461                 wdev->current_bss = NULL;
 462         }
 463 }
 464
 465 struct cfg80211_mgmt_registration {
 466         struct list_head list;
 467
 468         u32 nlportid;
 469
 470         int match_len;
 471
 472         __le16 frame_type;
 473
 474         u8 match[];
 475 };
 476
 477 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 478                                 u16 frame_type, const u8 *match_data,
 479                                 int match_len)
 480 {
 481         struct wiphy *wiphy = wdev->wiphy;
 482         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 483         struct cfg80211_mgmt_registration *reg, *nreg;
 484         int err = 0;
 485         u16 mgmt_type;
 486
 487         if (!wdev->wiphy->mgmt_stypes)
 488                 return -EOPNOTSUPP;
 489
 490         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
 491                 return -EINVAL;
 492
 493         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
 494                 return -EINVAL;
 495
 496         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 497         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
 498                 return -EINVAL;
 499
 500         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 501         if (!nreg)
 502                 return -ENOMEM;
 503
 504         spin_lock_bh(&wdev->mgmt_registrations_lock);
 505
 506         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 507                 int mlen = min(match_len, reg->match_len);
 508
 509                 if (frame_type != le16_to_cpu(reg->frame_type))
 510                         continue;
 511
 512                 if (memcmp(reg->match, match_data, mlen) == 0) {
 513                         err = -EALREADY;
 514                         break;
 515                 }
 516         }
 517
 518         if (err) {
 519                 kfree(nreg);
 520                 goto out;
 521         }
 522
 523         memcpy(nreg->match, match_data, match_len);
 524         nreg->match_len = match_len;
 525         nreg->nlportid = snd_portid;
 526         nreg->frame_type = cpu_to_le16(frame_type);
 527         list_add(&nreg->list, &wdev->mgmt_registrations);
 528
 529         if (rdev->ops->mgmt_frame_register)
 530                 rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
 531
 532  out:
 533         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 534
 535         return err;
 536 }
 537
 538 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 539 {
 540         struct wiphy *wiphy = wdev->wiphy;
 541         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 542         struct cfg80211_mgmt_registration *reg, *tmp;
 543
 544         spin_lock_bh(&wdev->mgmt_registrations_lock);
 545
 546         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 547                 if (reg->nlportid != nlportid)
 548                         continue;
 549
 550                 if (rdev->ops->mgmt_frame_register) {
 551                         u16 frame_type = le16_to_cpu(reg->frame_type);
 552
 553                         rdev_mgmt_frame_register(rdev, wdev,
 554                                                  frame_type, false);
 555                 }
 556
 557                 list_del(&reg->list);
 558                 kfree(reg);
 559         }
 560
 561         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 562
 563         if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 564                 rdev->crit_proto_nlportid = 0;
 565                 rdev_crit_proto_stop(rdev, wdev);
 566         }
 567
 568         if (nlportid == wdev->ap_unexpected_nlportid)
 569                 wdev->ap_unexpected_nlportid = 0;
 570 }
 571
 572 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 573 {
 574         struct cfg80211_mgmt_registration *reg, *tmp;
 575
 576         spin_lock_bh(&wdev->mgmt_registrations_lock);
 577
 578         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 579                 list_del(&reg->list);
 580                 kfree(reg);
 581         }
 582
 583         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 584 }
 585
 586 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 587                           struct wireless_dev *wdev,
 588                           struct ieee80211_channel *chan, bool offchan,
 589                           unsigned int wait, const u8 *buf, size_t len,
 590                           bool no_cck, bool dont_wait_for_ack, u64 *cookie)
 591 {
 592         const struct ieee80211_mgmt *mgmt;
 593         u16 stype;
 594
 595         if (!wdev->wiphy->mgmt_stypes)
 596                 return -EOPNOTSUPP;
 597
 598         if (!rdev->ops->mgmt_tx)
 599                 return -EOPNOTSUPP;
 600
 601         if (len < 24 + 1)
 602                 return -EINVAL;
 603
 604         mgmt = (const struct ieee80211_mgmt *) buf;
 605
 606         if (!ieee80211_is_mgmt(mgmt->frame_control))
 607                 return -EINVAL;
 608
 609         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 610         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 611                 return -EINVAL;
 612
 613         if (ieee80211_is_action(mgmt->frame_control) &&
 614             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 615                 int err = 0;
 616
 617                 wdev_lock(wdev);
 618
 619                 switch (wdev->iftype) {
 620                 case NL80211_IFTYPE_ADHOC:
 621                 case NL80211_IFTYPE_STATION:
 622                 case NL80211_IFTYPE_P2P_CLIENT:
 623                         if (!wdev->current_bss) {
 624                                 err = -ENOTCONN;
 625                                 break;
 626                         }
 627
 628                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 629                                               mgmt->bssid)) {
 630                                 err = -ENOTCONN;
 631                                 break;
 632                         }
 633
 634                         /*
 635                          * check for IBSS DA must be done by driver as
 636                          * cfg80211 doesn't track the stations
 637                          */
 638                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 639                                 break;
 640
 641                         /* for station, check that DA is the AP */
 642                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 643                                               mgmt->da)) {
 644                                 err = -ENOTCONN;
 645                                 break;
 646                         }
 647                         break;
 648                 case NL80211_IFTYPE_AP:
 649                 case NL80211_IFTYPE_P2P_GO:
 650                 case NL80211_IFTYPE_AP_VLAN:
 651                         if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
 652                                 err = -EINVAL;
 653                         break;
 654                 case NL80211_IFTYPE_MESH_POINT:
 655                         if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 656                                 err = -EINVAL;
 657                                 break;
 658                         }
 659                         /*
 660                          * check for mesh DA must be done by driver as
 661                          * cfg80211 doesn't track the stations
 662                          */
 663                         break;
 664                 case NL80211_IFTYPE_P2P_DEVICE:
 665                         /*
 666                          * fall through, P2P device only supports
 667                          * public action frames
 668                          */
 669                 default:
 670                         err = -EOPNOTSUPP;
 671                         break;
 672                 }
 673                 wdev_unlock(wdev);
 674
 675                 if (err)
 676                         return err;
 677         }
 678
 679         if (!ether_addr_equal(mgmt->sa, wdev_address(wdev)))
 680                 return -EINVAL;
 681
 682         /* Transmit the Action frame as requested by user space */
 683         return rdev_mgmt_tx(rdev, wdev, chan, offchan,
 684                             wait, buf, len, no_cck, dont_wait_for_ack,
 685                             cookie);
 686 }
 687
 688 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
 689                       const u8 *buf, size_t len, gfp_t gfp)
 690 {
 691         struct wiphy *wiphy = wdev->wiphy;
 692         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 693         struct cfg80211_mgmt_registration *reg;
 694         const struct ieee80211_txrx_stypes *stypes =
 695                 &wiphy->mgmt_stypes[wdev->iftype];
 696         struct ieee80211_mgmt *mgmt = (void *)buf;
 697         const u8 *data;
 698         int data_len;
 699         bool result = false;
 700         __le16 ftype = mgmt->frame_control &
 701                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 702         u16 stype;
 703
 704         trace_cfg80211_rx_mgmt(wdev, freq, sig_mbm);
 705         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 706
 707         if (!(stypes->rx & BIT(stype))) {
 708                 trace_cfg80211_return_bool(false);
 709                 return false;
 710         }
 711
 712         data = buf + ieee80211_hdrlen(mgmt->frame_control);
 713         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
 714
 715         spin_lock_bh(&wdev->mgmt_registrations_lock);
 716
 717         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 718                 if (reg->frame_type != ftype)
 719                         continue;
 720
 721                 if (reg->match_len > data_len)
 722                         continue;
 723
 724                 if (memcmp(reg->match, data, reg->match_len))
 725                         continue;
 726
 727                 /* found match! */
 728
 729                 /* Indicate the received Action frame to user space */
 730                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
 731                                       freq, sig_mbm,
 732                                       buf, len, gfp))
 733                         continue;
 734
 735                 result = true;
 736                 break;
 737         }
 738
 739         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 740
 741         trace_cfg80211_return_bool(result);
 742         return result;
 743 }
 744 EXPORT_SYMBOL(cfg80211_rx_mgmt);
 745
 746 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 747 {
 748         struct delayed_work *delayed_work;
 749         struct cfg80211_registered_device *rdev;
 750         struct cfg80211_chan_def chandef;
 751         struct ieee80211_supported_band *sband;
 752         struct ieee80211_channel *c;
 753         struct wiphy *wiphy;
 754         bool check_again = false;
 755         unsigned long timeout, next_time = 0;
 756         int bandid, i;
 757
 758         delayed_work = container_of(work, struct delayed_work, work);
 759         rdev = container_of(delayed_work, struct cfg80211_registered_device,
 760                             dfs_update_channels_wk);
 761         wiphy = &rdev->wiphy;
 762
 763         rtnl_lock();
 764         for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
 765                 sband = wiphy->bands[bandid];
 766                 if (!sband)
 767                         continue;
 768
 769                 for (i = 0; i < sband->n_channels; i++) {
 770                         c = &sband->channels[i];
 771
 772                         if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
 773                                 continue;
 774
 775                         timeout = c->dfs_state_entered +
 776                                   IEEE80211_DFS_MIN_NOP_TIME_MS;
 777
 778                         if (time_after_eq(jiffies, timeout)) {
 779                                 c->dfs_state = NL80211_DFS_USABLE;
 780                                 cfg80211_chandef_create(&chandef, c,
 781                                                         NL80211_CHAN_NO_HT);
 782
 783                                 nl80211_radar_notify(rdev, &chandef,
 784                                                      NL80211_RADAR_NOP_FINISHED,
 785                                                      NULL, GFP_ATOMIC);
 786                                 continue;
 787                         }
 788
 789                         if (!check_again)
 790                                 next_time = timeout - jiffies;
 791                         else
 792                                 next_time = min(next_time, timeout - jiffies);
 793                         check_again = true;
 794                 }
 795         }
 796         rtnl_unlock();
 797
 798         /* reschedule if there are other channels waiting to be cleared again */
 799         if (check_again)
 800                 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 801                                    next_time);
 802 }
 803
 804
 805 void cfg80211_radar_event(struct wiphy *wiphy,
 806                           struct cfg80211_chan_def *chandef,
 807                           gfp_t gfp)
 808 {
 809         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 810         unsigned long timeout;
 811
 812         trace_cfg80211_radar_event(wiphy, chandef);
 813
 814         /* only set the chandef supplied channel to unavailable, in
 815          * case the radar is detected on only one of multiple channels
 816          * spanned by the chandef.
 817          */
 818         cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 819
 820         timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
 821         queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 822                            timeout);
 823
 824         nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 825 }
 826 EXPORT_SYMBOL(cfg80211_radar_event);
 827
 828 void cfg80211_cac_event(struct net_device *netdev,
 829                         enum nl80211_radar_event event, gfp_t gfp)
 830 {
 831         struct wireless_dev *wdev = netdev->ieee80211_ptr;
 832         struct wiphy *wiphy = wdev->wiphy;
 833         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 834         struct cfg80211_chan_def chandef;
 835         unsigned long timeout;
 836
 837         trace_cfg80211_cac_event(netdev, event);
 838
 839         if (WARN_ON(!wdev->cac_started))
 840                 return;
 841
 842         if (WARN_ON(!wdev->channel))
 843                 return;
 844
 845         cfg80211_chandef_create(&chandef, wdev->channel, NL80211_CHAN_NO_HT);
 846
 847         switch (event) {
 848         case NL80211_RADAR_CAC_FINISHED:
 849                 timeout = wdev->cac_start_time +
 850                           msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
 851                 WARN_ON(!time_after_eq(jiffies, timeout));
 852                 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_AVAILABLE);
 853                 break;
 854         case NL80211_RADAR_CAC_ABORTED:
 855                 break;
 856         default:
 857                 WARN_ON(1);
 858                 return;
 859         }
 860         wdev->cac_started = false;
 861
 862         nl80211_radar_notify(rdev, &chandef, event, netdev, gfp);
 863 }
 864 EXPORT_SYMBOL(cfg80211_cac_event);