1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * cfg80211 MLME SAP interface
4 *
5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
6 * Copyright (c) 2015 Intel Deutschland GmbH
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/etherdevice.h>
12 #include <linux/netdevice.h>
13 #include <linux/nl80211.h>
14 #include <linux/slab.h>
15 #include <linux/wireless.h>
16 #include <net/cfg80211.h>
17 #include <net/iw_handler.h>
18 #include "core.h"
19 #include "nl80211.h"
20 #include "rdev-ops.h"
21
22
cfg80211_rx_assoc_resp(struct net_device * dev,struct cfg80211_bss * bss,const u8 * buf,size_t len,int uapsd_queues,const u8 * req_ies,size_t req_ies_len)23 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
24 const u8 *buf, size_t len, int uapsd_queues,
25 const u8 *req_ies, size_t req_ies_len)
26 {
27 struct wireless_dev *wdev = dev->ieee80211_ptr;
28 struct wiphy *wiphy = wdev->wiphy;
29 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
30 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
31 struct cfg80211_connect_resp_params cr;
32
33 memset(&cr, 0, sizeof(cr));
34 cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code);
35 cr.bssid = mgmt->bssid;
36 cr.bss = bss;
37 cr.req_ie = req_ies;
38 cr.req_ie_len = req_ies_len;
39 cr.resp_ie = mgmt->u.assoc_resp.variable;
40 cr.resp_ie_len =
41 len - offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
42 cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED;
43
44 trace_cfg80211_send_rx_assoc(dev, bss);
45
46 /*
47 * This is a bit of a hack, we don't notify userspace of
48 * a (re-)association reply if we tried to send a reassoc
49 * and got a reject -- we only try again with an assoc
50 * frame instead of reassoc.
51 */
52 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
53 cfg80211_unhold_bss(bss_from_pub(bss));
54 cfg80211_put_bss(wiphy, bss);
55 return;
56 }
57
58 nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues,
59 req_ies, req_ies_len);
60 /* update current_bss etc., consumes the bss reference */
61 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
62 }
63 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
64
cfg80211_process_auth(struct wireless_dev * wdev,const u8 * buf,size_t len)65 static void cfg80211_process_auth(struct wireless_dev *wdev,
66 const u8 *buf, size_t len)
67 {
68 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
69
70 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
71 cfg80211_sme_rx_auth(wdev, buf, len);
72 }
73
cfg80211_process_deauth(struct wireless_dev * wdev,const u8 * buf,size_t len)74 static void cfg80211_process_deauth(struct wireless_dev *wdev,
75 const u8 *buf, size_t len)
76 {
77 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
78 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
79 const u8 *bssid = mgmt->bssid;
80 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
81 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
82
83 nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
84
85 if (!wdev->current_bss ||
86 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
87 return;
88
89 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
90 cfg80211_sme_deauth(wdev);
91 }
92
cfg80211_process_disassoc(struct wireless_dev * wdev,const u8 * buf,size_t len)93 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
94 const u8 *buf, size_t len)
95 {
96 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
97 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
98 const u8 *bssid = mgmt->bssid;
99 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
100 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
101
102 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
103
104 if (WARN_ON(!wdev->current_bss ||
105 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
106 return;
107
108 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
109 cfg80211_sme_disassoc(wdev);
110 }
111
cfg80211_rx_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)112 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
113 {
114 struct wireless_dev *wdev = dev->ieee80211_ptr;
115 struct ieee80211_mgmt *mgmt = (void *)buf;
116
117 ASSERT_WDEV_LOCK(wdev);
118
119 trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
120
121 if (WARN_ON(len < 2))
122 return;
123
124 if (ieee80211_is_auth(mgmt->frame_control))
125 cfg80211_process_auth(wdev, buf, len);
126 else if (ieee80211_is_deauth(mgmt->frame_control))
127 cfg80211_process_deauth(wdev, buf, len);
128 else if (ieee80211_is_disassoc(mgmt->frame_control))
129 cfg80211_process_disassoc(wdev, buf, len);
130 }
131 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
132
cfg80211_auth_timeout(struct net_device * dev,const u8 * addr)133 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
134 {
135 struct wireless_dev *wdev = dev->ieee80211_ptr;
136 struct wiphy *wiphy = wdev->wiphy;
137 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
138
139 trace_cfg80211_send_auth_timeout(dev, addr);
140
141 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
142 cfg80211_sme_auth_timeout(wdev);
143 }
144 EXPORT_SYMBOL(cfg80211_auth_timeout);
145
cfg80211_assoc_timeout(struct net_device * dev,struct cfg80211_bss * bss)146 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
147 {
148 struct wireless_dev *wdev = dev->ieee80211_ptr;
149 struct wiphy *wiphy = wdev->wiphy;
150 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
151
152 trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
153
154 nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
155 cfg80211_sme_assoc_timeout(wdev);
156
157 cfg80211_unhold_bss(bss_from_pub(bss));
158 cfg80211_put_bss(wiphy, bss);
159 }
160 EXPORT_SYMBOL(cfg80211_assoc_timeout);
161
cfg80211_abandon_assoc(struct net_device * dev,struct cfg80211_bss * bss)162 void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
163 {
164 struct wireless_dev *wdev = dev->ieee80211_ptr;
165 struct wiphy *wiphy = wdev->wiphy;
166
167 cfg80211_sme_abandon_assoc(wdev);
168
169 cfg80211_unhold_bss(bss_from_pub(bss));
170 cfg80211_put_bss(wiphy, bss);
171 }
172 EXPORT_SYMBOL(cfg80211_abandon_assoc);
173
cfg80211_tx_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)174 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
175 {
176 struct wireless_dev *wdev = dev->ieee80211_ptr;
177 struct ieee80211_mgmt *mgmt = (void *)buf;
178
179 ASSERT_WDEV_LOCK(wdev);
180
181 trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
182
183 if (WARN_ON(len < 2))
184 return;
185
186 if (ieee80211_is_deauth(mgmt->frame_control))
187 cfg80211_process_deauth(wdev, buf, len);
188 else
189 cfg80211_process_disassoc(wdev, buf, len);
190 }
191 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
192
cfg80211_michael_mic_failure(struct net_device * dev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)193 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
194 enum nl80211_key_type key_type, int key_id,
195 const u8 *tsc, gfp_t gfp)
196 {
197 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
198 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
199 #ifdef CONFIG_CFG80211_WEXT
200 union iwreq_data wrqu;
201 char *buf = kmalloc(128, gfp);
202
203 if (buf) {
204 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
205 "keyid=%d %scast addr=%pM)", key_id,
206 key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
207 addr);
208 memset(&wrqu, 0, sizeof(wrqu));
209 wrqu.data.length = strlen(buf);
210 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
211 kfree(buf);
212 }
213 #endif
214
215 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
216 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
217 }
218 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
219
220 /* some MLME handling for userspace SME */
cfg80211_mlme_auth(struct cfg80211_registered_device * rdev,struct net_device * dev,struct ieee80211_channel * chan,enum nl80211_auth_type auth_type,const u8 * bssid,const u8 * ssid,int ssid_len,const u8 * ie,int ie_len,const u8 * key,int key_len,int key_idx,const u8 * auth_data,int auth_data_len)221 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
222 struct net_device *dev,
223 struct ieee80211_channel *chan,
224 enum nl80211_auth_type auth_type,
225 const u8 *bssid,
226 const u8 *ssid, int ssid_len,
227 const u8 *ie, int ie_len,
228 const u8 *key, int key_len, int key_idx,
229 const u8 *auth_data, int auth_data_len)
230 {
231 struct wireless_dev *wdev = dev->ieee80211_ptr;
232 struct cfg80211_auth_request req = {
233 .ie = ie,
234 .ie_len = ie_len,
235 .auth_data = auth_data,
236 .auth_data_len = auth_data_len,
237 .auth_type = auth_type,
238 .key = key,
239 .key_len = key_len,
240 .key_idx = key_idx,
241 };
242 int err;
243
244 ASSERT_WDEV_LOCK(wdev);
245
246 if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
247 if (!key || !key_len || key_idx < 0 || key_idx > 3)
248 return -EINVAL;
249
250 if (wdev->current_bss &&
251 ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
252 return -EALREADY;
253
254 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
255 IEEE80211_BSS_TYPE_ESS,
256 IEEE80211_PRIVACY_ANY);
257 if (!req.bss)
258 return -ENOENT;
259
260 err = rdev_auth(rdev, dev, &req);
261
262 cfg80211_put_bss(&rdev->wiphy, req.bss);
263 return err;
264 }
265
266 /* Do a logical ht_capa &= ht_capa_mask. */
cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap * ht_capa,const struct ieee80211_ht_cap * ht_capa_mask)267 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
268 const struct ieee80211_ht_cap *ht_capa_mask)
269 {
270 int i;
271 u8 *p1, *p2;
272 if (!ht_capa_mask) {
273 memset(ht_capa, 0, sizeof(*ht_capa));
274 return;
275 }
276
277 p1 = (u8*)(ht_capa);
278 p2 = (u8*)(ht_capa_mask);
279 for (i = 0; i < sizeof(*ht_capa); i++)
280 p1[i] &= p2[i];
281 }
282
283 /* Do a logical vht_capa &= vht_capa_mask. */
cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap * vht_capa,const struct ieee80211_vht_cap * vht_capa_mask)284 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
285 const struct ieee80211_vht_cap *vht_capa_mask)
286 {
287 int i;
288 u8 *p1, *p2;
289 if (!vht_capa_mask) {
290 memset(vht_capa, 0, sizeof(*vht_capa));
291 return;
292 }
293
294 p1 = (u8*)(vht_capa);
295 p2 = (u8*)(vht_capa_mask);
296 for (i = 0; i < sizeof(*vht_capa); i++)
297 p1[i] &= p2[i];
298 }
299
cfg80211_mlme_assoc(struct cfg80211_registered_device * rdev,struct net_device * dev,struct ieee80211_channel * chan,const u8 * bssid,const u8 * ssid,int ssid_len,struct cfg80211_assoc_request * req)300 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
301 struct net_device *dev,
302 struct ieee80211_channel *chan,
303 const u8 *bssid,
304 const u8 *ssid, int ssid_len,
305 struct cfg80211_assoc_request *req)
306 {
307 struct wireless_dev *wdev = dev->ieee80211_ptr;
308 int err;
309
310 ASSERT_WDEV_LOCK(wdev);
311
312 if (wdev->current_bss &&
313 (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
314 req->prev_bssid)))
315 return -EALREADY;
316
317 cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
318 rdev->wiphy.ht_capa_mod_mask);
319 cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
320 rdev->wiphy.vht_capa_mod_mask);
321
322 req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
323 IEEE80211_BSS_TYPE_ESS,
324 IEEE80211_PRIVACY_ANY);
325 if (!req->bss)
326 return -ENOENT;
327
328 err = rdev_assoc(rdev, dev, req);
329 if (!err)
330 cfg80211_hold_bss(bss_from_pub(req->bss));
331 else
332 cfg80211_put_bss(&rdev->wiphy, req->bss);
333
334 return err;
335 }
336
cfg80211_mlme_deauth(struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * bssid,const u8 * ie,int ie_len,u16 reason,bool local_state_change)337 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
338 struct net_device *dev, const u8 *bssid,
339 const u8 *ie, int ie_len, u16 reason,
340 bool local_state_change)
341 {
342 struct wireless_dev *wdev = dev->ieee80211_ptr;
343 struct cfg80211_deauth_request req = {
344 .bssid = bssid,
345 .reason_code = reason,
346 .ie = ie,
347 .ie_len = ie_len,
348 .local_state_change = local_state_change,
349 };
350
351 ASSERT_WDEV_LOCK(wdev);
352
353 if (local_state_change &&
354 (!wdev->current_bss ||
355 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
356 return 0;
357
358 if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
359 (wdev->current_bss &&
360 ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
361 wdev->conn_owner_nlportid = 0;
362
363 return rdev_deauth(rdev, dev, &req);
364 }
365
cfg80211_mlme_disassoc(struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * bssid,const u8 * ie,int ie_len,u16 reason,bool local_state_change)366 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
367 struct net_device *dev, const u8 *bssid,
368 const u8 *ie, int ie_len, u16 reason,
369 bool local_state_change)
370 {
371 struct wireless_dev *wdev = dev->ieee80211_ptr;
372 struct cfg80211_disassoc_request req = {
373 .reason_code = reason,
374 .local_state_change = local_state_change,
375 .ie = ie,
376 .ie_len = ie_len,
377 };
378 int err;
379
380 ASSERT_WDEV_LOCK(wdev);
381
382 if (!wdev->current_bss)
383 return -ENOTCONN;
384
385 if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
386 req.bss = &wdev->current_bss->pub;
387 else
388 return -ENOTCONN;
389
390 err = rdev_disassoc(rdev, dev, &req);
391 if (err)
392 return err;
393
394 /* driver should have reported the disassoc */
395 WARN_ON(wdev->current_bss);
396 return 0;
397 }
398
cfg80211_mlme_down(struct cfg80211_registered_device * rdev,struct net_device * dev)399 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
400 struct net_device *dev)
401 {
402 struct wireless_dev *wdev = dev->ieee80211_ptr;
403 u8 bssid[ETH_ALEN];
404
405 ASSERT_WDEV_LOCK(wdev);
406
407 if (!rdev->ops->deauth)
408 return;
409
410 if (!wdev->current_bss)
411 return;
412
413 memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
414 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
415 WLAN_REASON_DEAUTH_LEAVING, false);
416 }
417
418 struct cfg80211_mgmt_registration {
419 struct list_head list;
420 struct wireless_dev *wdev;
421
422 u32 nlportid;
423
424 int match_len;
425
426 __le16 frame_type;
427
428 u8 match[];
429 };
430
431 static void
cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device * rdev)432 cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device *rdev)
433 {
434 struct cfg80211_mgmt_registration *reg;
435
436 ASSERT_RTNL();
437
438 spin_lock_bh(&rdev->mlme_unreg_lock);
439 while ((reg = list_first_entry_or_null(&rdev->mlme_unreg,
440 struct cfg80211_mgmt_registration,
441 list))) {
442 list_del(®->list);
443 spin_unlock_bh(&rdev->mlme_unreg_lock);
444
445 if (rdev->ops->mgmt_frame_register) {
446 u16 frame_type = le16_to_cpu(reg->frame_type);
447
448 rdev_mgmt_frame_register(rdev, reg->wdev,
449 frame_type, false);
450 }
451
452 kfree(reg);
453
454 spin_lock_bh(&rdev->mlme_unreg_lock);
455 }
456 spin_unlock_bh(&rdev->mlme_unreg_lock);
457 }
458
cfg80211_mlme_unreg_wk(struct work_struct * wk)459 void cfg80211_mlme_unreg_wk(struct work_struct *wk)
460 {
461 struct cfg80211_registered_device *rdev;
462
463 rdev = container_of(wk, struct cfg80211_registered_device,
464 mlme_unreg_wk);
465
466 rtnl_lock();
467 cfg80211_process_mlme_unregistrations(rdev);
468 rtnl_unlock();
469 }
470
cfg80211_mlme_register_mgmt(struct wireless_dev * wdev,u32 snd_portid,u16 frame_type,const u8 * match_data,int match_len)471 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
472 u16 frame_type, const u8 *match_data,
473 int match_len)
474 {
475 struct wiphy *wiphy = wdev->wiphy;
476 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
477 struct cfg80211_mgmt_registration *reg, *nreg;
478 int err = 0;
479 u16 mgmt_type;
480
481 if (!wdev->wiphy->mgmt_stypes)
482 return -EOPNOTSUPP;
483
484 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
485 return -EINVAL;
486
487 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
488 return -EINVAL;
489
490 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
491 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
492 return -EINVAL;
493
494 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
495 if (!nreg)
496 return -ENOMEM;
497
498 spin_lock_bh(&wdev->mgmt_registrations_lock);
499
500 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
501 int mlen = min(match_len, reg->match_len);
502
503 if (frame_type != le16_to_cpu(reg->frame_type))
504 continue;
505
506 if (memcmp(reg->match, match_data, mlen) == 0) {
507 err = -EALREADY;
508 break;
509 }
510 }
511
512 if (err) {
513 kfree(nreg);
514 goto out;
515 }
516
517 memcpy(nreg->match, match_data, match_len);
518 nreg->match_len = match_len;
519 nreg->nlportid = snd_portid;
520 nreg->frame_type = cpu_to_le16(frame_type);
521 nreg->wdev = wdev;
522 list_add(&nreg->list, &wdev->mgmt_registrations);
523 spin_unlock_bh(&wdev->mgmt_registrations_lock);
524
525 /* process all unregistrations to avoid driver confusion */
526 cfg80211_process_mlme_unregistrations(rdev);
527
528 if (rdev->ops->mgmt_frame_register)
529 rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
530
531 return 0;
532
533 out:
534 spin_unlock_bh(&wdev->mgmt_registrations_lock);
535
536 return err;
537 }
538
cfg80211_mlme_unregister_socket(struct wireless_dev * wdev,u32 nlportid)539 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
540 {
541 struct wiphy *wiphy = wdev->wiphy;
542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
543 struct cfg80211_mgmt_registration *reg, *tmp;
544
545 spin_lock_bh(&wdev->mgmt_registrations_lock);
546
547 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
548 if (reg->nlportid != nlportid)
549 continue;
550
551 list_del(®->list);
552 spin_lock(&rdev->mlme_unreg_lock);
553 list_add_tail(®->list, &rdev->mlme_unreg);
554 spin_unlock(&rdev->mlme_unreg_lock);
555
556 schedule_work(&rdev->mlme_unreg_wk);
557 }
558
559 spin_unlock_bh(&wdev->mgmt_registrations_lock);
560
561 if (nlportid && rdev->crit_proto_nlportid == nlportid) {
562 rdev->crit_proto_nlportid = 0;
563 rdev_crit_proto_stop(rdev, wdev);
564 }
565
566 if (nlportid == wdev->ap_unexpected_nlportid)
567 wdev->ap_unexpected_nlportid = 0;
568 }
569
cfg80211_mlme_purge_registrations(struct wireless_dev * wdev)570 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
571 {
572 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
573
574 spin_lock_bh(&wdev->mgmt_registrations_lock);
575 spin_lock(&rdev->mlme_unreg_lock);
576 list_splice_tail_init(&wdev->mgmt_registrations, &rdev->mlme_unreg);
577 spin_unlock(&rdev->mlme_unreg_lock);
578 spin_unlock_bh(&wdev->mgmt_registrations_lock);
579
580 cfg80211_process_mlme_unregistrations(rdev);
581 }
582
cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_mgmt_tx_params * params,u64 * cookie)583 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
584 struct wireless_dev *wdev,
585 struct cfg80211_mgmt_tx_params *params, u64 *cookie)
586 {
587 const struct ieee80211_mgmt *mgmt;
588 u16 stype;
589
590 if (!wdev->wiphy->mgmt_stypes)
591 return -EOPNOTSUPP;
592
593 if (!rdev->ops->mgmt_tx)
594 return -EOPNOTSUPP;
595
596 if (params->len < 24 + 1)
597 return -EINVAL;
598
599 mgmt = (const struct ieee80211_mgmt *)params->buf;
600
601 if (!ieee80211_is_mgmt(mgmt->frame_control))
602 return -EINVAL;
603
604 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
605 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
606 return -EINVAL;
607
608 if (ieee80211_is_action(mgmt->frame_control) &&
609 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
610 int err = 0;
611
612 wdev_lock(wdev);
613
614 switch (wdev->iftype) {
615 case NL80211_IFTYPE_ADHOC:
616 case NL80211_IFTYPE_STATION:
617 case NL80211_IFTYPE_P2P_CLIENT:
618 if (!wdev->current_bss) {
619 err = -ENOTCONN;
620 break;
621 }
622
623 if (!ether_addr_equal(wdev->current_bss->pub.bssid,
624 mgmt->bssid)) {
625 err = -ENOTCONN;
626 break;
627 }
628
629 /*
630 * check for IBSS DA must be done by driver as
631 * cfg80211 doesn't track the stations
632 */
633 if (wdev->iftype == NL80211_IFTYPE_ADHOC)
634 break;
635
636 /* for station, check that DA is the AP */
637 if (!ether_addr_equal(wdev->current_bss->pub.bssid,
638 mgmt->da)) {
639 err = -ENOTCONN;
640 break;
641 }
642 break;
643 case NL80211_IFTYPE_AP:
644 case NL80211_IFTYPE_P2P_GO:
645 case NL80211_IFTYPE_AP_VLAN:
646 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
647 err = -EINVAL;
648 break;
649 case NL80211_IFTYPE_MESH_POINT:
650 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
651 err = -EINVAL;
652 break;
653 }
654 /*
655 * check for mesh DA must be done by driver as
656 * cfg80211 doesn't track the stations
657 */
658 break;
659 case NL80211_IFTYPE_P2P_DEVICE:
660 /*
661 * fall through, P2P device only supports
662 * public action frames
663 */
664 case NL80211_IFTYPE_NAN:
665 default:
666 err = -EOPNOTSUPP;
667 break;
668 }
669 wdev_unlock(wdev);
670
671 if (err)
672 return err;
673 }
674
675 if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) {
676 /* Allow random TA to be used with Public Action frames if the
677 * driver has indicated support for this. Otherwise, only allow
678 * the local address to be used.
679 */
680 if (!ieee80211_is_action(mgmt->frame_control) ||
681 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
682 return -EINVAL;
683 if (!wdev->current_bss &&
684 !wiphy_ext_feature_isset(
685 &rdev->wiphy,
686 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
687 return -EINVAL;
688 if (wdev->current_bss &&
689 !wiphy_ext_feature_isset(
690 &rdev->wiphy,
691 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
692 return -EINVAL;
693 }
694
695 /* Transmit the Action frame as requested by user space */
696 return rdev_mgmt_tx(rdev, wdev, params, cookie);
697 }
698
cfg80211_rx_mgmt(struct wireless_dev * wdev,int freq,int sig_dbm,const u8 * buf,size_t len,u32 flags)699 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
700 const u8 *buf, size_t len, u32 flags)
701 {
702 struct wiphy *wiphy = wdev->wiphy;
703 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
704 struct cfg80211_mgmt_registration *reg;
705 const struct ieee80211_txrx_stypes *stypes =
706 &wiphy->mgmt_stypes[wdev->iftype];
707 struct ieee80211_mgmt *mgmt = (void *)buf;
708 const u8 *data;
709 int data_len;
710 bool result = false;
711 __le16 ftype = mgmt->frame_control &
712 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
713 u16 stype;
714
715 trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm);
716 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
717
718 if (!(stypes->rx & BIT(stype))) {
719 trace_cfg80211_return_bool(false);
720 return false;
721 }
722
723 data = buf + ieee80211_hdrlen(mgmt->frame_control);
724 data_len = len - ieee80211_hdrlen(mgmt->frame_control);
725
726 spin_lock_bh(&wdev->mgmt_registrations_lock);
727
728 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
729 if (reg->frame_type != ftype)
730 continue;
731
732 if (reg->match_len > data_len)
733 continue;
734
735 if (memcmp(reg->match, data, reg->match_len))
736 continue;
737
738 /* found match! */
739
740 /* Indicate the received Action frame to user space */
741 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
742 freq, sig_dbm,
743 buf, len, flags, GFP_ATOMIC))
744 continue;
745
746 result = true;
747 break;
748 }
749
750 spin_unlock_bh(&wdev->mgmt_registrations_lock);
751
752 trace_cfg80211_return_bool(result);
753 return result;
754 }
755 EXPORT_SYMBOL(cfg80211_rx_mgmt);
756
cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device * rdev)757 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
758 {
759 cancel_delayed_work(&rdev->dfs_update_channels_wk);
760 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
761 }
762
cfg80211_dfs_channels_update_work(struct work_struct * work)763 void cfg80211_dfs_channels_update_work(struct work_struct *work)
764 {
765 struct delayed_work *delayed_work = to_delayed_work(work);
766 struct cfg80211_registered_device *rdev;
767 struct cfg80211_chan_def chandef;
768 struct ieee80211_supported_band *sband;
769 struct ieee80211_channel *c;
770 struct wiphy *wiphy;
771 bool check_again = false;
772 unsigned long timeout, next_time = 0;
773 unsigned long time_dfs_update;
774 enum nl80211_radar_event radar_event;
775 int bandid, i;
776
777 rdev = container_of(delayed_work, struct cfg80211_registered_device,
778 dfs_update_channels_wk);
779 wiphy = &rdev->wiphy;
780
781 rtnl_lock();
782 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
783 sband = wiphy->bands[bandid];
784 if (!sband)
785 continue;
786
787 for (i = 0; i < sband->n_channels; i++) {
788 c = &sband->channels[i];
789
790 if (!(c->flags & IEEE80211_CHAN_RADAR))
791 continue;
792
793 if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
794 c->dfs_state != NL80211_DFS_AVAILABLE)
795 continue;
796
797 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
798 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
799 radar_event = NL80211_RADAR_NOP_FINISHED;
800 } else {
801 if (regulatory_pre_cac_allowed(wiphy) ||
802 cfg80211_any_wiphy_oper_chan(wiphy, c))
803 continue;
804
805 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
806 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
807 }
808
809 timeout = c->dfs_state_entered +
810 msecs_to_jiffies(time_dfs_update);
811
812 if (time_after_eq(jiffies, timeout)) {
813 c->dfs_state = NL80211_DFS_USABLE;
814 c->dfs_state_entered = jiffies;
815
816 cfg80211_chandef_create(&chandef, c,
817 NL80211_CHAN_NO_HT);
818
819 nl80211_radar_notify(rdev, &chandef,
820 radar_event, NULL,
821 GFP_ATOMIC);
822
823 regulatory_propagate_dfs_state(wiphy, &chandef,
824 c->dfs_state,
825 radar_event);
826 continue;
827 }
828
829 if (!check_again)
830 next_time = timeout - jiffies;
831 else
832 next_time = min(next_time, timeout - jiffies);
833 check_again = true;
834 }
835 }
836 rtnl_unlock();
837
838 /* reschedule if there are other channels waiting to be cleared again */
839 if (check_again)
840 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
841 next_time);
842 }
843
844
cfg80211_radar_event(struct wiphy * wiphy,struct cfg80211_chan_def * chandef,gfp_t gfp)845 void cfg80211_radar_event(struct wiphy *wiphy,
846 struct cfg80211_chan_def *chandef,
847 gfp_t gfp)
848 {
849 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
850
851 trace_cfg80211_radar_event(wiphy, chandef);
852
853 /* only set the chandef supplied channel to unavailable, in
854 * case the radar is detected on only one of multiple channels
855 * spanned by the chandef.
856 */
857 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
858
859 cfg80211_sched_dfs_chan_update(rdev);
860
861 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
862
863 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
864 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
865 }
866 EXPORT_SYMBOL(cfg80211_radar_event);
867
cfg80211_cac_event(struct net_device * netdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,gfp_t gfp)868 void cfg80211_cac_event(struct net_device *netdev,
869 const struct cfg80211_chan_def *chandef,
870 enum nl80211_radar_event event, gfp_t gfp)
871 {
872 struct wireless_dev *wdev = netdev->ieee80211_ptr;
873 struct wiphy *wiphy = wdev->wiphy;
874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
875 unsigned long timeout;
876
877 trace_cfg80211_cac_event(netdev, event);
878
879 if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
880 return;
881
882 if (WARN_ON(!wdev->chandef.chan))
883 return;
884
885 switch (event) {
886 case NL80211_RADAR_CAC_FINISHED:
887 timeout = wdev->cac_start_time +
888 msecs_to_jiffies(wdev->cac_time_ms);
889 WARN_ON(!time_after_eq(jiffies, timeout));
890 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
891 memcpy(&rdev->cac_done_chandef, chandef,
892 sizeof(struct cfg80211_chan_def));
893 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
894 cfg80211_sched_dfs_chan_update(rdev);
895 /* fall through */
896 case NL80211_RADAR_CAC_ABORTED:
897 wdev->cac_started = false;
898 break;
899 case NL80211_RADAR_CAC_STARTED:
900 wdev->cac_started = true;
901 break;
902 default:
903 WARN_ON(1);
904 return;
905 }
906
907 nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
908 }
909 EXPORT_SYMBOL(cfg80211_cac_event);
910