Linux Audio

Check our new training course

Loading...
v6.8
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * cfg80211 MLME SAP interface
   4 *
   5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   6 * Copyright (c) 2015		Intel Deutschland GmbH
   7 * Copyright (C) 2019-2020, 2022-2023 Intel Corporation
   8 */
   9
  10#include <linux/kernel.h>
  11#include <linux/module.h>
  12#include <linux/etherdevice.h>
  13#include <linux/netdevice.h>
  14#include <linux/nl80211.h>
  15#include <linux/slab.h>
  16#include <linux/wireless.h>
  17#include <net/cfg80211.h>
  18#include <net/iw_handler.h>
  19#include "core.h"
  20#include "nl80211.h"
  21#include "rdev-ops.h"
  22
  23
  24void cfg80211_rx_assoc_resp(struct net_device *dev,
  25			    const struct cfg80211_rx_assoc_resp_data *data)
  26{
  27	struct wireless_dev *wdev = dev->ieee80211_ptr;
  28	struct wiphy *wiphy = wdev->wiphy;
  29	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  30	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf;
  31	struct cfg80211_connect_resp_params cr = {
  32		.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED,
  33		.req_ie = data->req_ies,
  34		.req_ie_len = data->req_ies_len,
  35		.resp_ie = mgmt->u.assoc_resp.variable,
  36		.resp_ie_len = data->len -
  37			       offsetof(struct ieee80211_mgmt,
  38					u.assoc_resp.variable),
  39		.status = le16_to_cpu(mgmt->u.assoc_resp.status_code),
  40		.ap_mld_addr = data->ap_mld_addr,
  41	};
  42	unsigned int link_id;
  43
  44	for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  45		cr.links[link_id].status = data->links[link_id].status;
  46		cr.links[link_id].bss = data->links[link_id].bss;
  47
  48		WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&
  49			     (!cr.ap_mld_addr || !cr.links[link_id].bss));
  50
  51		if (!cr.links[link_id].bss)
  52			continue;
  53		cr.links[link_id].bssid = data->links[link_id].bss->bssid;
  54		cr.links[link_id].addr = data->links[link_id].addr;
  55		/* need to have local link addresses for MLO connections */
  56		WARN_ON(cr.ap_mld_addr &&
  57			!is_valid_ether_addr(cr.links[link_id].addr));
  58
  59		BUG_ON(!cr.links[link_id].bss->channel);
  60
  61		if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) {
  62			WARN_ON(link_id);
  63			cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;
  64			cr.resp_ie_len = data->len -
  65					 offsetof(struct ieee80211_mgmt,
  66						  u.s1g_assoc_resp.variable);
  67		}
 
  68
  69		if (cr.ap_mld_addr)
  70			cr.valid_links |= BIT(link_id);
 
  71	}
  72
  73	trace_cfg80211_send_rx_assoc(dev, data);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  74
  75	/*
  76	 * This is a bit of a hack, we don't notify userspace of
  77	 * a (re-)association reply if we tried to send a reassoc
  78	 * and got a reject -- we only try again with an assoc
  79	 * frame instead of reassoc.
  80	 */
  81	if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
  82		for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  83			struct cfg80211_bss *bss = data->links[link_id].bss;
  84
  85			if (!bss)
  86				continue;
  87
  88			cfg80211_unhold_bss(bss_from_pub(bss));
  89			cfg80211_put_bss(wiphy, bss);
 
 
 
 
 
 
 
 
 
 
  90		}
  91		return;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  92	}
  93
  94	nl80211_send_rx_assoc(rdev, dev, data);
  95	/* update current_bss etc., consumes the bss reference */
  96	__cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
  97}
  98EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
 
 
 
  99
 100static void cfg80211_process_auth(struct wireless_dev *wdev,
 101				  const u8 *buf, size_t len)
 102{
 103	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
 
 
 
 
 
 104
 105	nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
 106	cfg80211_sme_rx_auth(wdev, buf, len);
 107}
 
 108
 109static void cfg80211_process_deauth(struct wireless_dev *wdev,
 110				    const u8 *buf, size_t len,
 111				    bool reconnect)
 112{
 113	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
 
 114	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 115	const u8 *bssid = mgmt->bssid;
 116	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 117	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 118
 119	nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
 120
 121	if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 122		return;
 123
 124	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 125	cfg80211_sme_deauth(wdev);
 
 
 
 
 
 
 
 
 
 
 
 
 
 126}
 
 127
 128static void cfg80211_process_disassoc(struct wireless_dev *wdev,
 129				      const u8 *buf, size_t len,
 130				      bool reconnect)
 131{
 132	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
 
 
 
 
 
 
 
 
 
 
 
 
 133	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 134	const u8 *bssid = mgmt->bssid;
 135	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 136	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 
 
 137
 138	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
 139			      GFP_KERNEL);
 140
 141	if (WARN_ON(!wdev->connected ||
 142		    !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 
 143		return;
 144
 145	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 146	cfg80211_sme_disassoc(wdev);
 147}
 
 
 
 
 
 
 
 
 
 
 
 148
 149void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 150{
 151	struct wireless_dev *wdev = dev->ieee80211_ptr;
 152	struct ieee80211_mgmt *mgmt = (void *)buf;
 153
 154	lockdep_assert_wiphy(wdev->wiphy);
 155
 156	trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 
 
 
 157
 158	if (WARN_ON(len < 2))
 159		return;
 
 160
 161	if (ieee80211_is_auth(mgmt->frame_control))
 162		cfg80211_process_auth(wdev, buf, len);
 163	else if (ieee80211_is_deauth(mgmt->frame_control))
 164		cfg80211_process_deauth(wdev, buf, len, false);
 165	else if (ieee80211_is_disassoc(mgmt->frame_control))
 166		cfg80211_process_disassoc(wdev, buf, len, false);
 167}
 168EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 169
 170void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 
 171{
 172	struct wireless_dev *wdev = dev->ieee80211_ptr;
 173	struct wiphy *wiphy = wdev->wiphy;
 174	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 175
 176	trace_cfg80211_send_auth_timeout(dev, addr);
 177
 178	nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 179	cfg80211_sme_auth_timeout(wdev);
 180}
 181EXPORT_SYMBOL(cfg80211_auth_timeout);
 182
 183void cfg80211_assoc_failure(struct net_device *dev,
 184			    struct cfg80211_assoc_failure *data)
 185{
 186	struct wireless_dev *wdev = dev->ieee80211_ptr;
 187	struct wiphy *wiphy = wdev->wiphy;
 188	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 189	const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid;
 
 
 
 
 
 
 190	int i;
 
 191
 192	trace_cfg80211_send_assoc_failure(dev, data);
 193
 194	if (data->timeout) {
 195		nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 196		cfg80211_sme_assoc_timeout(wdev);
 197	} else {
 198		cfg80211_sme_abandon_assoc(wdev);
 
 
 
 
 
 199	}
 200
 201	for (i = 0; i < ARRAY_SIZE(data->bss); i++) {
 202		struct cfg80211_bss *bss = data->bss[i];
 203
 204		if (!bss)
 205			continue;
 
 
 
 206
 207		cfg80211_unhold_bss(bss_from_pub(bss));
 208		cfg80211_put_bss(wiphy, bss);
 209	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 210}
 211EXPORT_SYMBOL(cfg80211_assoc_failure);
 212
 213void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
 214			   bool reconnect)
 215{
 216	struct wireless_dev *wdev = dev->ieee80211_ptr;
 217	struct ieee80211_mgmt *mgmt = (void *)buf;
 
 
 
 218
 219	lockdep_assert_wiphy(wdev->wiphy);
 220
 221	trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 222
 223	if (WARN_ON(len < 2))
 224		return;
 225
 226	if (ieee80211_is_deauth(mgmt->frame_control))
 227		cfg80211_process_deauth(wdev, buf, len, reconnect);
 228	else
 229		cfg80211_process_disassoc(wdev, buf, len, reconnect);
 230}
 231EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 232
 233void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 234				  enum nl80211_key_type key_type, int key_id,
 235				  const u8 *tsc, gfp_t gfp)
 236{
 237	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 238	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 239#ifdef CONFIG_CFG80211_WEXT
 240	union iwreq_data wrqu;
 241	char *buf = kmalloc(128, gfp);
 242
 243	if (buf) {
 244		sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 245			"keyid=%d %scast addr=%pM)", key_id,
 246			key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 247			addr);
 248		memset(&wrqu, 0, sizeof(wrqu));
 249		wrqu.data.length = strlen(buf);
 250		wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 251		kfree(buf);
 252	}
 253#endif
 254
 255	trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 256	nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 257}
 258EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 259
 260/* some MLME handling for userspace SME */
 261int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 262		       struct net_device *dev,
 263		       struct cfg80211_auth_request *req)
 
 
 
 
 
 
 264{
 265	struct wireless_dev *wdev = dev->ieee80211_ptr;
 
 
 
 
 
 
 
 
 
 266
 267	lockdep_assert_wiphy(wdev->wiphy);
 
 
 268
 269	if (!req->bss)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 270		return -ENOENT;
 271
 272	if (req->link_id >= 0 &&
 273	    !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
 274		return -EINVAL;
 275
 276	if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
 277		if (!req->key || !req->key_len ||
 278		    req->key_idx < 0 || req->key_idx > 3)
 279			return -EINVAL;
 
 280	}
 281
 282	if (wdev->connected &&
 283	    ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
 284		return -EALREADY;
 
 
 285
 286	if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
 287	    (req->link_id >= 0 &&
 288	     ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 289		return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 290
 291	return rdev_auth(rdev, dev, req);
 
 
 
 292}
 293
 294/*  Do a logical ht_capa &= ht_capa_mask.  */
 295void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 296			       const struct ieee80211_ht_cap *ht_capa_mask)
 
 
 
 
 297{
 298	int i;
 299	u8 *p1, *p2;
 300	if (!ht_capa_mask) {
 301		memset(ht_capa, 0, sizeof(*ht_capa));
 302		return;
 303	}
 
 304
 305	p1 = (u8*)(ht_capa);
 306	p2 = (u8*)(ht_capa_mask);
 307	for (i = 0; i < sizeof(*ht_capa); i++)
 308		p1[i] &= p2[i];
 309}
 310
 311/*  Do a logical vht_capa &= vht_capa_mask.  */
 312void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 313				const struct ieee80211_vht_cap *vht_capa_mask)
 
 
 
 
 314{
 315	int i;
 316	u8 *p1, *p2;
 317	if (!vht_capa_mask) {
 318		memset(vht_capa, 0, sizeof(*vht_capa));
 319		return;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 320	}
 321
 322	p1 = (u8*)(vht_capa);
 323	p2 = (u8*)(vht_capa_mask);
 324	for (i = 0; i < sizeof(*vht_capa); i++)
 325		p1[i] &= p2[i];
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 326}
 327
 328/* Note: caller must cfg80211_put_bss() regardless of result */
 329int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 330			struct net_device *dev,
 331			struct cfg80211_assoc_request *req)
 
 
 
 
 332{
 333	struct wireless_dev *wdev = dev->ieee80211_ptr;
 334	int err, i, j;
 335
 336	lockdep_assert_wiphy(wdev->wiphy);
 
 
 
 337
 338	for (i = 1; i < ARRAY_SIZE(req->links); i++) {
 339		if (!req->links[i].bss)
 340			continue;
 341		for (j = 0; j < i; j++) {
 342			if (req->links[i].bss == req->links[j].bss)
 343				return -EINVAL;
 344		}
 345
 346		if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr))
 347			return -EINVAL;
 348	}
 349
 350	if (wdev->connected &&
 351	    (!req->prev_bssid ||
 352	     !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
 353		return -EALREADY;
 
 
 
 
 354
 355	if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
 356	    (req->link_id >= 0 &&
 357	     ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 358		return -EINVAL;
 359
 360	cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 361				  rdev->wiphy.ht_capa_mod_mask);
 362	cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 363				   rdev->wiphy.vht_capa_mod_mask);
 364
 365	err = rdev_assoc(rdev, dev, req);
 366	if (!err) {
 367		int link_id;
 368
 369		if (req->bss) {
 370			cfg80211_ref_bss(&rdev->wiphy, req->bss);
 371			cfg80211_hold_bss(bss_from_pub(req->bss));
 
 372		}
 373
 374		for (link_id = 0; link_id < ARRAY_SIZE(req->links); link_id++) {
 375			if (!req->links[link_id].bss)
 376				continue;
 377			cfg80211_ref_bss(&rdev->wiphy, req->links[link_id].bss);
 378			cfg80211_hold_bss(bss_from_pub(req->links[link_id].bss));
 379		}
 380	}
 381	return err;
 
 
 
 
 382}
 383
 384int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 385			 struct net_device *dev, const u8 *bssid,
 386			 const u8 *ie, int ie_len, u16 reason,
 387			 bool local_state_change)
 388{
 389	struct wireless_dev *wdev = dev->ieee80211_ptr;
 390	struct cfg80211_deauth_request req = {
 391		.bssid = bssid,
 392		.reason_code = reason,
 393		.ie = ie,
 394		.ie_len = ie_len,
 395		.local_state_change = local_state_change,
 396	};
 397
 398	lockdep_assert_wiphy(wdev->wiphy);
 399
 400	if (local_state_change &&
 401	    (!wdev->connected ||
 402	     !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 403		return 0;
 404
 405	if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
 406	    (wdev->connected &&
 407	     ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 408		wdev->conn_owner_nlportid = 0;
 409
 410	return rdev_deauth(rdev, dev, &req);
 411}
 412
 413int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 414			   struct net_device *dev, const u8 *ap_addr,
 415			   const u8 *ie, int ie_len, u16 reason,
 416			   bool local_state_change)
 417{
 418	struct wireless_dev *wdev = dev->ieee80211_ptr;
 419	struct cfg80211_disassoc_request req = {
 420		.reason_code = reason,
 421		.local_state_change = local_state_change,
 422		.ie = ie,
 423		.ie_len = ie_len,
 424		.ap_addr = ap_addr,
 425	};
 426	int err;
 427
 428	lockdep_assert_wiphy(wdev->wiphy);
 429
 430	if (!wdev->connected)
 431		return -ENOTCONN;
 432
 433	if (memcmp(wdev->u.client.connected_addr, ap_addr, ETH_ALEN))
 434		return -ENOTCONN;
 435
 436	err = rdev_disassoc(rdev, dev, &req);
 437	if (err)
 438		return err;
 
 
 
 
 
 
 439
 440	/* driver should have reported the disassoc */
 441	WARN_ON(wdev->connected);
 442	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 443}
 444
 445void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 446			struct net_device *dev)
 447{
 448	struct wireless_dev *wdev = dev->ieee80211_ptr;
 449	u8 bssid[ETH_ALEN];
 
 450
 451	lockdep_assert_wiphy(wdev->wiphy);
 452
 453	if (!rdev->ops->deauth)
 454		return;
 455
 456	if (!wdev->connected)
 457		return;
 
 
 
 
 
 
 
 
 
 
 
 
 458
 459	memcpy(bssid, wdev->u.client.connected_addr, ETH_ALEN);
 460	cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 461			     WLAN_REASON_DEAUTH_LEAVING, false);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 462}
 463
 464struct cfg80211_mgmt_registration {
 465	struct list_head list;
 466	struct wireless_dev *wdev;
 467
 468	u32 nlportid;
 469
 470	int match_len;
 471
 472	__le16 frame_type;
 
 
 
 473
 474	bool multicast_rx;
 
 
 
 
 
 
 
 475
 476	u8 match[];
 477};
 
 
 478
 479static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
 
 480{
 481	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 482	struct wireless_dev *tmp;
 483	struct cfg80211_mgmt_registration *reg;
 484	struct mgmt_frame_regs upd = {};
 485
 486	lockdep_assert_held(&rdev->wiphy.mtx);
 
 
 487
 488	spin_lock_bh(&rdev->mgmt_registrations_lock);
 489	if (!wdev->mgmt_registrations_need_update) {
 490		spin_unlock_bh(&rdev->mgmt_registrations_lock);
 491		return;
 492	}
 493
 494	rcu_read_lock();
 495	list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) {
 496		list_for_each_entry(reg, &tmp->mgmt_registrations, list) {
 497			u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4);
 498			u32 mcast_mask = 0;
 499
 500			if (reg->multicast_rx)
 501				mcast_mask = mask;
 502
 503			upd.global_stypes |= mask;
 504			upd.global_mcast_stypes |= mcast_mask;
 505
 506			if (tmp == wdev) {
 507				upd.interface_stypes |= mask;
 508				upd.interface_mcast_stypes |= mcast_mask;
 509			}
 510		}
 511	}
 512	rcu_read_unlock();
 513
 514	wdev->mgmt_registrations_need_update = 0;
 515	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 516
 517	rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
 518}
 519
 520void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk)
 521{
 522	struct cfg80211_registered_device *rdev;
 523	struct wireless_dev *wdev;
 524
 525	rdev = container_of(wk, struct cfg80211_registered_device,
 526			    mgmt_registrations_update_wk);
 527
 528	wiphy_lock(&rdev->wiphy);
 529	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
 530		cfg80211_mgmt_registrations_update(wdev);
 531	wiphy_unlock(&rdev->wiphy);
 532}
 533
 534int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 535				u16 frame_type, const u8 *match_data,
 536				int match_len, bool multicast_rx,
 537				struct netlink_ext_ack *extack)
 538{
 539	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
 540	struct cfg80211_mgmt_registration *reg, *nreg;
 541	int err = 0;
 542	u16 mgmt_type;
 543	bool update_multicast = false;
 544
 545	if (!wdev->wiphy->mgmt_stypes)
 546		return -EOPNOTSUPP;
 547
 548	if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
 549		NL_SET_ERR_MSG(extack, "frame type not management");
 550		return -EINVAL;
 551	}
 552
 553	if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
 554		NL_SET_ERR_MSG(extack, "Invalid frame type");
 555		return -EINVAL;
 556	}
 557
 558	mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 559	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
 560		NL_SET_ERR_MSG(extack,
 561			       "Registration to specific type not supported");
 562		return -EINVAL;
 563	}
 564
 565	/*
 566	 * To support Pre Association Security Negotiation (PASN), registration
 567	 * for authentication frames should be supported. However, as some
 568	 * versions of the user space daemons wrongly register to all types of
 569	 * authentication frames (which might result in unexpected behavior)
 570	 * allow such registration if the request is for a specific
 571	 * authentication algorithm number.
 572	 */
 573	if (wdev->iftype == NL80211_IFTYPE_STATION &&
 574	    (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
 575	    !(match_data && match_len >= 2)) {
 576		NL_SET_ERR_MSG(extack,
 577			       "Authentication algorithm number required");
 578		return -EINVAL;
 579	}
 580
 581	nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 582	if (!nreg)
 583		return -ENOMEM;
 584
 585	spin_lock_bh(&rdev->mgmt_registrations_lock);
 586
 587	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 588		int mlen = min(match_len, reg->match_len);
 589
 590		if (frame_type != le16_to_cpu(reg->frame_type))
 591			continue;
 592
 593		if (memcmp(reg->match, match_data, mlen) == 0) {
 594			if (reg->multicast_rx != multicast_rx) {
 595				update_multicast = true;
 596				reg->multicast_rx = multicast_rx;
 597				break;
 598			}
 599			NL_SET_ERR_MSG(extack, "Match already configured");
 600			err = -EALREADY;
 601			break;
 602		}
 603	}
 604
 605	if (err)
 606		goto out;
 607
 608	if (update_multicast) {
 609		kfree(nreg);
 610	} else {
 611		memcpy(nreg->match, match_data, match_len);
 612		nreg->match_len = match_len;
 613		nreg->nlportid = snd_portid;
 614		nreg->frame_type = cpu_to_le16(frame_type);
 615		nreg->wdev = wdev;
 616		nreg->multicast_rx = multicast_rx;
 617		list_add(&nreg->list, &wdev->mgmt_registrations);
 618	}
 619	wdev->mgmt_registrations_need_update = 1;
 620	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 621
 622	cfg80211_mgmt_registrations_update(wdev);
 623
 624	return 0;
 
 
 
 
 
 
 
 
 625
 626 out:
 627	kfree(nreg);
 628	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 629
 630	return err;
 631}
 632
 633void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 634{
 635	struct wiphy *wiphy = wdev->wiphy;
 636	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 637	struct cfg80211_mgmt_registration *reg, *tmp;
 638
 639	spin_lock_bh(&rdev->mgmt_registrations_lock);
 640
 641	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 642		if (reg->nlportid != nlportid)
 643			continue;
 644
 645		list_del(&reg->list);
 646		kfree(reg);
 647
 648		wdev->mgmt_registrations_need_update = 1;
 649		schedule_work(&rdev->mgmt_registrations_update_wk);
 650	}
 651
 652	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 
 653
 654	if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 655		rdev->crit_proto_nlportid = 0;
 656		rdev_crit_proto_stop(rdev, wdev);
 657	}
 658
 659	if (nlportid == wdev->ap_unexpected_nlportid)
 660		wdev->ap_unexpected_nlportid = 0;
 661}
 662
 663void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 664{
 665	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 666	struct cfg80211_mgmt_registration *reg, *tmp;
 667
 668	spin_lock_bh(&rdev->mgmt_registrations_lock);
 
 669	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 670		list_del(&reg->list);
 671		kfree(reg);
 672	}
 673	wdev->mgmt_registrations_need_update = 1;
 674	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 675
 676	cfg80211_mgmt_registrations_update(wdev);
 677}
 678
 679static bool cfg80211_allowed_address(struct wireless_dev *wdev, const u8 *addr)
 680{
 681	int i;
 682
 683	for_each_valid_link(wdev, i) {
 684		if (ether_addr_equal(addr, wdev->links[i].addr))
 685			return true;
 686	}
 687
 688	return ether_addr_equal(addr, wdev_address(wdev));
 689}
 690
 691static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,
 692					    const struct ieee80211_mgmt *mgmt)
 693{
 694	if (ieee80211_is_auth(mgmt->frame_control) ||
 695	    ieee80211_is_deauth(mgmt->frame_control)) {
 696		/* Allow random TA to be used with authentication and
 697		 * deauthentication frames if the driver has indicated support.
 698		 */
 699		if (wiphy_ext_feature_isset(
 700			    wdev->wiphy,
 701			    NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA))
 702			return true;
 703	} else if (ieee80211_is_action(mgmt->frame_control) &&
 704		   mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
 705		/* Allow random TA to be used with Public Action frames if the
 706		 * driver has indicated support.
 707		 */
 708		if (!wdev->connected &&
 709		    wiphy_ext_feature_isset(
 710			    wdev->wiphy,
 711			    NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
 712			return true;
 713
 714		if (wdev->connected &&
 715		    wiphy_ext_feature_isset(
 716			    wdev->wiphy,
 717			    NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
 718			return true;
 719	}
 720
 721	return false;
 722}
 723
 724int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 725			  struct wireless_dev *wdev,
 726			  struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 
 
 
 727{
 
 728	const struct ieee80211_mgmt *mgmt;
 729	u16 stype;
 730
 731	lockdep_assert_wiphy(&rdev->wiphy);
 732
 733	if (!wdev->wiphy->mgmt_stypes)
 734		return -EOPNOTSUPP;
 735
 736	if (!rdev->ops->mgmt_tx)
 737		return -EOPNOTSUPP;
 738
 739	if (params->len < 24 + 1)
 740		return -EINVAL;
 741
 742	mgmt = (const struct ieee80211_mgmt *)params->buf;
 743
 744	if (!ieee80211_is_mgmt(mgmt->frame_control))
 745		return -EINVAL;
 746
 747	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 748	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 749		return -EINVAL;
 750
 751	if (ieee80211_is_action(mgmt->frame_control) &&
 752	    mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 753		int err = 0;
 754
 
 
 755		switch (wdev->iftype) {
 756		case NL80211_IFTYPE_ADHOC:
 757			/*
 758			 * check for IBSS DA must be done by driver as
 759			 * cfg80211 doesn't track the stations
 760			 */
 761			if (!wdev->u.ibss.current_bss ||
 762			    !ether_addr_equal(wdev->u.ibss.current_bss->pub.bssid,
 763					      mgmt->bssid)) {
 764				err = -ENOTCONN;
 765				break;
 766			}
 767			break;
 768		case NL80211_IFTYPE_STATION:
 769		case NL80211_IFTYPE_P2P_CLIENT:
 770			if (!wdev->connected) {
 771				err = -ENOTCONN;
 772				break;
 773			}
 774
 775			/* FIXME: MLD may address this differently */
 776
 777			if (!ether_addr_equal(wdev->u.client.connected_addr,
 778					      mgmt->bssid)) {
 779				err = -ENOTCONN;
 780				break;
 781			}
 782
 
 
 
 
 
 
 
 783			/* for station, check that DA is the AP */
 784			if (!ether_addr_equal(wdev->u.client.connected_addr,
 785					      mgmt->da)) {
 786				err = -ENOTCONN;
 787				break;
 788			}
 789			break;
 790		case NL80211_IFTYPE_AP:
 791		case NL80211_IFTYPE_P2P_GO:
 792		case NL80211_IFTYPE_AP_VLAN:
 793			if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)) &&
 794			    (params->link_id < 0 ||
 795			     !ether_addr_equal(mgmt->bssid,
 796					       wdev->links[params->link_id].addr)))
 797				err = -EINVAL;
 798			break;
 799		case NL80211_IFTYPE_MESH_POINT:
 800			if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 801				err = -EINVAL;
 802				break;
 803			}
 804			/*
 805			 * check for mesh DA must be done by driver as
 806			 * cfg80211 doesn't track the stations
 807			 */
 808			break;
 809		case NL80211_IFTYPE_P2P_DEVICE:
 810			/*
 811			 * fall through, P2P device only supports
 812			 * public action frames
 813			 */
 814		case NL80211_IFTYPE_NAN:
 815		default:
 816			err = -EOPNOTSUPP;
 817			break;
 818		}
 
 819
 820		if (err)
 821			return err;
 822	}
 823
 824	if (!cfg80211_allowed_address(wdev, mgmt->sa) &&
 825	    !cfg80211_allowed_random_address(wdev, mgmt))
 826		return -EINVAL;
 827
 828	/* Transmit the management frame as requested by user space */
 829	return rdev_mgmt_tx(rdev, wdev, params, cookie);
 
 
 830}
 831
 832bool cfg80211_rx_mgmt_ext(struct wireless_dev *wdev,
 833			  struct cfg80211_rx_info *info)
 834{
 
 835	struct wiphy *wiphy = wdev->wiphy;
 836	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 837	struct cfg80211_mgmt_registration *reg;
 838	const struct ieee80211_txrx_stypes *stypes =
 839		&wiphy->mgmt_stypes[wdev->iftype];
 840	struct ieee80211_mgmt *mgmt = (void *)info->buf;
 841	const u8 *data;
 842	int data_len;
 843	bool result = false;
 844	__le16 ftype = mgmt->frame_control &
 845		cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 846	u16 stype;
 847
 848	trace_cfg80211_rx_mgmt(wdev, info);
 849	stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 850
 851	if (!(stypes->rx & BIT(stype))) {
 852		trace_cfg80211_return_bool(false);
 853		return false;
 854	}
 855
 856	data = info->buf + ieee80211_hdrlen(mgmt->frame_control);
 857	data_len = info->len - ieee80211_hdrlen(mgmt->frame_control);
 858
 859	spin_lock_bh(&rdev->mgmt_registrations_lock);
 860
 861	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 862		if (reg->frame_type != ftype)
 863			continue;
 864
 865		if (reg->match_len > data_len)
 866			continue;
 867
 868		if (memcmp(reg->match, data, reg->match_len))
 869			continue;
 870
 871		/* found match! */
 872
 873		/* Indicate the received Action frame to user space */
 874		if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, info,
 875				      GFP_ATOMIC))
 876			continue;
 877
 878		result = true;
 879		break;
 880	}
 881
 882	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 883
 884	trace_cfg80211_return_bool(result);
 885	return result;
 886}
 887EXPORT_SYMBOL(cfg80211_rx_mgmt_ext);
 888
 889void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
 890{
 891	cancel_delayed_work(&rdev->dfs_update_channels_wk);
 892	queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
 893}
 894
 895void cfg80211_dfs_channels_update_work(struct work_struct *work)
 896{
 897	struct delayed_work *delayed_work = to_delayed_work(work);
 898	struct cfg80211_registered_device *rdev;
 899	struct cfg80211_chan_def chandef;
 900	struct ieee80211_supported_band *sband;
 901	struct ieee80211_channel *c;
 902	struct wiphy *wiphy;
 903	bool check_again = false;
 904	unsigned long timeout, next_time = 0;
 905	unsigned long time_dfs_update;
 906	enum nl80211_radar_event radar_event;
 907	int bandid, i;
 908
 909	rdev = container_of(delayed_work, struct cfg80211_registered_device,
 910			    dfs_update_channels_wk);
 911	wiphy = &rdev->wiphy;
 912
 913	rtnl_lock();
 914	for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
 915		sband = wiphy->bands[bandid];
 916		if (!sband)
 917			continue;
 918
 919		for (i = 0; i < sband->n_channels; i++) {
 920			c = &sband->channels[i];
 921
 922			if (!(c->flags & IEEE80211_CHAN_RADAR))
 923				continue;
 924
 925			if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
 926			    c->dfs_state != NL80211_DFS_AVAILABLE)
 927				continue;
 928
 929			if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
 930				time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
 931				radar_event = NL80211_RADAR_NOP_FINISHED;
 932			} else {
 933				if (regulatory_pre_cac_allowed(wiphy) ||
 934				    cfg80211_any_wiphy_oper_chan(wiphy, c))
 935					continue;
 936
 937				time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
 938				radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
 939			}
 940
 941			timeout = c->dfs_state_entered +
 942				  msecs_to_jiffies(time_dfs_update);
 943
 944			if (time_after_eq(jiffies, timeout)) {
 945				c->dfs_state = NL80211_DFS_USABLE;
 946				c->dfs_state_entered = jiffies;
 947
 948				cfg80211_chandef_create(&chandef, c,
 949							NL80211_CHAN_NO_HT);
 950
 951				nl80211_radar_notify(rdev, &chandef,
 952						     radar_event, NULL,
 953						     GFP_ATOMIC);
 954
 955				regulatory_propagate_dfs_state(wiphy, &chandef,
 956							       c->dfs_state,
 957							       radar_event);
 958				continue;
 959			}
 960
 961			if (!check_again)
 962				next_time = timeout - jiffies;
 963			else
 964				next_time = min(next_time, timeout - jiffies);
 965			check_again = true;
 966		}
 967	}
 968	rtnl_unlock();
 969
 970	/* reschedule if there are other channels waiting to be cleared again */
 971	if (check_again)
 972		queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 973				   next_time);
 974}
 975
 976
 977void __cfg80211_radar_event(struct wiphy *wiphy,
 978			    struct cfg80211_chan_def *chandef,
 979			    bool offchan, gfp_t gfp)
 980{
 981	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 982
 983	trace_cfg80211_radar_event(wiphy, chandef, offchan);
 984
 985	/* only set the chandef supplied channel to unavailable, in
 986	 * case the radar is detected on only one of multiple channels
 987	 * spanned by the chandef.
 988	 */
 989	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 990
 991	if (offchan)
 992		queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
 993
 994	cfg80211_sched_dfs_chan_update(rdev);
 995
 996	nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 997
 998	memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
 999	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
1000}
1001EXPORT_SYMBOL(__cfg80211_radar_event);
1002
1003void cfg80211_cac_event(struct net_device *netdev,
1004			const struct cfg80211_chan_def *chandef,
1005			enum nl80211_radar_event event, gfp_t gfp)
1006{
1007	struct wireless_dev *wdev = netdev->ieee80211_ptr;
1008	struct wiphy *wiphy = wdev->wiphy;
1009	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1010	unsigned long timeout;
1011
1012	/* not yet supported */
1013	if (wdev->valid_links)
1014		return;
1015
1016	trace_cfg80211_cac_event(netdev, event);
1017
1018	if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
1019		return;
1020
1021	switch (event) {
1022	case NL80211_RADAR_CAC_FINISHED:
1023		timeout = wdev->cac_start_time +
1024			  msecs_to_jiffies(wdev->cac_time_ms);
1025		WARN_ON(!time_after_eq(jiffies, timeout));
1026		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1027		memcpy(&rdev->cac_done_chandef, chandef,
1028		       sizeof(struct cfg80211_chan_def));
1029		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1030		cfg80211_sched_dfs_chan_update(rdev);
1031		fallthrough;
1032	case NL80211_RADAR_CAC_ABORTED:
1033		wdev->cac_started = false;
1034		break;
1035	case NL80211_RADAR_CAC_STARTED:
1036		wdev->cac_started = true;
1037		break;
1038	default:
1039		WARN_ON(1);
1040		return;
1041	}
1042
1043	nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
1044}
1045EXPORT_SYMBOL(cfg80211_cac_event);
1046
1047static void
1048__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1049				struct wireless_dev *wdev,
1050				const struct cfg80211_chan_def *chandef,
1051				enum nl80211_radar_event event)
1052{
1053	struct wiphy *wiphy = &rdev->wiphy;
1054	struct net_device *netdev;
1055
1056	lockdep_assert_wiphy(&rdev->wiphy);
1057
1058	if (!cfg80211_chandef_valid(chandef))
1059		return;
1060
1061	if (!rdev->background_radar_wdev)
1062		return;
1063
1064	switch (event) {
1065	case NL80211_RADAR_CAC_FINISHED:
1066		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1067		memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
1068		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1069		cfg80211_sched_dfs_chan_update(rdev);
1070		wdev = rdev->background_radar_wdev;
1071		break;
1072	case NL80211_RADAR_CAC_ABORTED:
1073		if (!cancel_delayed_work(&rdev->background_cac_done_wk))
1074			return;
1075		wdev = rdev->background_radar_wdev;
1076		break;
1077	case NL80211_RADAR_CAC_STARTED:
1078		break;
1079	default:
1080		return;
1081	}
1082
1083	netdev = wdev ? wdev->netdev : NULL;
1084	nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
1085}
1086
1087static void
1088cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1089			      const struct cfg80211_chan_def *chandef,
1090			      enum nl80211_radar_event event)
1091{
1092	wiphy_lock(&rdev->wiphy);
1093	__cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
1094					chandef, event);
1095	wiphy_unlock(&rdev->wiphy);
1096}
1097
1098void cfg80211_background_cac_done_wk(struct work_struct *work)
1099{
1100	struct delayed_work *delayed_work = to_delayed_work(work);
1101	struct cfg80211_registered_device *rdev;
1102
1103	rdev = container_of(delayed_work, struct cfg80211_registered_device,
1104			    background_cac_done_wk);
1105	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1106				      NL80211_RADAR_CAC_FINISHED);
1107}
 
1108
1109void cfg80211_background_cac_abort_wk(struct work_struct *work)
 
 
1110{
1111	struct cfg80211_registered_device *rdev;
1112
1113	rdev = container_of(work, struct cfg80211_registered_device,
1114			    background_cac_abort_wk);
1115	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1116				      NL80211_RADAR_CAC_ABORTED);
1117}
1118
1119void cfg80211_background_cac_abort(struct wiphy *wiphy)
1120{
1121	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1122
1123	queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
 
1124}
1125EXPORT_SYMBOL(cfg80211_background_cac_abort);
1126
1127int
1128cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
1129					  struct wireless_dev *wdev,
1130					  struct cfg80211_chan_def *chandef)
1131{
1132	unsigned int cac_time_ms;
1133	int err;
1134
1135	lockdep_assert_wiphy(&rdev->wiphy);
1136
1137	if (!wiphy_ext_feature_isset(&rdev->wiphy,
1138				     NL80211_EXT_FEATURE_RADAR_BACKGROUND))
1139		return -EOPNOTSUPP;
1140
1141	/* Offchannel chain already locked by another wdev */
1142	if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
1143		return -EBUSY;
1144
1145	/* CAC already in progress on the offchannel chain */
1146	if (rdev->background_radar_wdev == wdev &&
1147	    delayed_work_pending(&rdev->background_cac_done_wk))
1148		return -EBUSY;
1149
1150	err = rdev_set_radar_background(rdev, chandef);
1151	if (err)
1152		return err;
1153
1154	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
1155	if (!cac_time_ms)
1156		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1157
1158	rdev->background_radar_chandef = *chandef;
1159	rdev->background_radar_wdev = wdev; /* Get offchain ownership */
1160
1161	__cfg80211_background_cac_event(rdev, wdev, chandef,
1162					NL80211_RADAR_CAC_STARTED);
1163	queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
1164			   msecs_to_jiffies(cac_time_ms));
1165
1166	return 0;
 
1167}
 
1168
1169void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
 
1170{
 
1171	struct wiphy *wiphy = wdev->wiphy;
1172	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1173
1174	lockdep_assert_wiphy(wiphy);
1175
1176	if (wdev != rdev->background_radar_wdev)
1177		return;
1178
1179	rdev_set_radar_background(rdev, NULL);
1180	rdev->background_radar_wdev = NULL; /* Release offchain ownership */
1181
1182	__cfg80211_background_cac_event(rdev, wdev,
1183					&rdev->background_radar_chandef,
1184					NL80211_RADAR_CAC_ABORTED);
1185}
v3.1
 
   1/*
   2 * cfg80211 MLME SAP interface
   3 *
   4 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
 
 
   5 */
   6
   7#include <linux/kernel.h>
   8#include <linux/module.h>
 
   9#include <linux/netdevice.h>
  10#include <linux/nl80211.h>
  11#include <linux/slab.h>
  12#include <linux/wireless.h>
  13#include <net/cfg80211.h>
  14#include <net/iw_handler.h>
  15#include "core.h"
  16#include "nl80211.h"
 
  17
  18void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
 
 
  19{
  20	struct wireless_dev *wdev = dev->ieee80211_ptr;
  21	struct wiphy *wiphy = wdev->wiphy;
  22	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  23	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  24	u8 *bssid = mgmt->bssid;
  25	int i;
  26	u16 status = le16_to_cpu(mgmt->u.auth.status_code);
  27	bool done = false;
 
 
 
 
 
 
 
 
 
 
 
 
  28
  29	wdev_lock(wdev);
 
  30
  31	for (i = 0; i < MAX_AUTH_BSSES; i++) {
  32		if (wdev->authtry_bsses[i] &&
  33		    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
  34							ETH_ALEN) == 0) {
  35			if (status == WLAN_STATUS_SUCCESS) {
  36				wdev->auth_bsses[i] = wdev->authtry_bsses[i];
  37			} else {
  38				cfg80211_unhold_bss(wdev->authtry_bsses[i]);
  39				cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
  40			}
  41			wdev->authtry_bsses[i] = NULL;
  42			done = true;
  43			break;
 
 
 
  44		}
  45	}
  46
  47	if (done) {
  48		nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
  49		cfg80211_sme_rx_auth(dev, buf, len);
  50	}
  51
  52	wdev_unlock(wdev);
  53}
  54EXPORT_SYMBOL(cfg80211_send_rx_auth);
  55
  56void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
  57{
  58	u16 status_code;
  59	struct wireless_dev *wdev = dev->ieee80211_ptr;
  60	struct wiphy *wiphy = wdev->wiphy;
  61	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  62	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  63	u8 *ie = mgmt->u.assoc_resp.variable;
  64	int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  65	struct cfg80211_internal_bss *bss = NULL;
  66
  67	wdev_lock(wdev);
  68
  69	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  70
  71	/*
  72	 * This is a bit of a hack, we don't notify userspace of
  73	 * a (re-)association reply if we tried to send a reassoc
  74	 * and got a reject -- we only try again with an assoc
  75	 * frame instead of reassoc.
  76	 */
  77	if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
  78	    cfg80211_sme_failed_reassoc(wdev))
  79		goto out;
  80
  81	nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
 
  82
  83	if (status_code == WLAN_STATUS_SUCCESS) {
  84		for (i = 0; i < MAX_AUTH_BSSES; i++) {
  85			if (!wdev->auth_bsses[i])
  86				continue;
  87			if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
  88				   ETH_ALEN) == 0) {
  89				bss = wdev->auth_bsses[i];
  90				wdev->auth_bsses[i] = NULL;
  91				/* additional reference to drop hold */
  92				cfg80211_ref_bss(bss);
  93				break;
  94			}
  95		}
  96
  97		/*
  98		 * We might be coming here because the driver reported
  99		 * a successful association at the same time as the
 100		 * user requested a deauth. In that case, we will have
 101		 * removed the BSS from the auth_bsses list due to the
 102		 * deauth request when the assoc response makes it. If
 103		 * the two code paths acquire the lock the other way
 104		 * around, that's just the standard situation of a
 105		 * deauth being requested while connected.
 106		 */
 107		if (!bss)
 108			goto out;
 109	} else if (wdev->conn) {
 110		cfg80211_sme_failed_assoc(wdev);
 111		/*
 112		 * do not call connect_result() now because the
 113		 * sme will schedule work that does it later.
 114		 */
 115		goto out;
 116	}
 117
 118	if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
 119		/*
 120		 * This is for the userspace SME, the CONNECTING
 121		 * state will be changed to CONNECTED by
 122		 * __cfg80211_connect_result() below.
 123		 */
 124		wdev->sme_state = CFG80211_SME_CONNECTING;
 125	}
 126
 127	/* this consumes one bss reference (unless bss is NULL) */
 128	__cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
 129				  status_code,
 130				  status_code == WLAN_STATUS_SUCCESS,
 131				  bss ? &bss->pub : NULL);
 132	/* drop hold now, and also reference acquired above */
 133	if (bss) {
 134		cfg80211_unhold_bss(bss);
 135		cfg80211_put_bss(&bss->pub);
 136	}
 137
 138 out:
 139	wdev_unlock(wdev);
 140}
 141EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 142
 143void __cfg80211_send_deauth(struct net_device *dev,
 144				   const u8 *buf, size_t len)
 
 145{
 146	struct wireless_dev *wdev = dev->ieee80211_ptr;
 147	struct wiphy *wiphy = wdev->wiphy;
 148	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 149	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 150	const u8 *bssid = mgmt->bssid;
 151	int i;
 152	bool found = false, was_current = false;
 153
 154	ASSERT_WDEV_LOCK(wdev);
 155
 156	if (wdev->current_bss &&
 157	    memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 158		cfg80211_unhold_bss(wdev->current_bss);
 159		cfg80211_put_bss(&wdev->current_bss->pub);
 160		wdev->current_bss = NULL;
 161		found = true;
 162		was_current = true;
 163	} else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 164		if (wdev->auth_bsses[i] &&
 165		    memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
 166			cfg80211_unhold_bss(wdev->auth_bsses[i]);
 167			cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 168			wdev->auth_bsses[i] = NULL;
 169			found = true;
 170			break;
 171		}
 172		if (wdev->authtry_bsses[i] &&
 173		    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
 174			   ETH_ALEN) == 0 &&
 175		    memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
 176			cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 177			cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 178			wdev->authtry_bsses[i] = NULL;
 179			found = true;
 180			break;
 181		}
 182	}
 183
 184	if (!found)
 185		return;
 186
 187	nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 188
 189	if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
 190		u16 reason_code;
 191		bool from_ap;
 192
 193		reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 194
 195		from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 196		__cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 197	} else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
 198		__cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 199					  WLAN_STATUS_UNSPECIFIED_FAILURE,
 200					  false, NULL);
 201	}
 202}
 203EXPORT_SYMBOL(__cfg80211_send_deauth);
 204
 205void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 
 
 206{
 207	struct wireless_dev *wdev = dev->ieee80211_ptr;
 208
 209	wdev_lock(wdev);
 210	__cfg80211_send_deauth(dev, buf, len);
 211	wdev_unlock(wdev);
 212}
 213EXPORT_SYMBOL(cfg80211_send_deauth);
 214
 215void __cfg80211_send_disassoc(struct net_device *dev,
 216				     const u8 *buf, size_t len)
 217{
 218	struct wireless_dev *wdev = dev->ieee80211_ptr;
 219	struct wiphy *wiphy = wdev->wiphy;
 220	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 221	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 222	const u8 *bssid = mgmt->bssid;
 223	int i;
 224	u16 reason_code;
 225	bool from_ap;
 226	bool done = false;
 227
 228	ASSERT_WDEV_LOCK(wdev);
 
 229
 230	nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
 231
 232	if (wdev->sme_state != CFG80211_SME_CONNECTED)
 233		return;
 234
 235	if (wdev->current_bss &&
 236	    memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 237		for (i = 0; i < MAX_AUTH_BSSES; i++) {
 238			if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
 239				continue;
 240			wdev->auth_bsses[i] = wdev->current_bss;
 241			wdev->current_bss = NULL;
 242			done = true;
 243			cfg80211_sme_disassoc(dev, i);
 244			break;
 245		}
 246		WARN_ON(!done);
 247	} else
 248		WARN_ON(1);
 249
 
 
 
 
 250
 251	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 252
 253	from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 254	__cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 255}
 256EXPORT_SYMBOL(__cfg80211_send_disassoc);
 257
 258void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 259{
 260	struct wireless_dev *wdev = dev->ieee80211_ptr;
 261
 262	wdev_lock(wdev);
 263	__cfg80211_send_disassoc(dev, buf, len);
 264	wdev_unlock(wdev);
 
 
 
 265}
 266EXPORT_SYMBOL(cfg80211_send_disassoc);
 267
 268void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
 269				 size_t len)
 270{
 271	struct wireless_dev *wdev = dev->ieee80211_ptr;
 272	struct wiphy *wiphy = wdev->wiphy;
 273	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 274
 275	nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
 
 276}
 277EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
 278
 279void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
 280				   size_t len)
 281{
 282	struct wireless_dev *wdev = dev->ieee80211_ptr;
 283	struct wiphy *wiphy = wdev->wiphy;
 284	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 285
 286	nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
 287}
 288EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
 289
 290static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
 291{
 292	int i;
 293	bool done = false;
 294
 295	ASSERT_WDEV_LOCK(wdev);
 296
 297	for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 298		if (wdev->authtry_bsses[i] &&
 299		    memcmp(wdev->authtry_bsses[i]->pub.bssid,
 300			   addr, ETH_ALEN) == 0) {
 301			cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 302			cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 303			wdev->authtry_bsses[i] = NULL;
 304			done = true;
 305			break;
 306		}
 307	}
 308
 309	WARN_ON(!done);
 310}
 311
 312void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
 313{
 314	__cfg80211_auth_remove(dev->ieee80211_ptr, addr);
 315}
 316EXPORT_SYMBOL(__cfg80211_auth_canceled);
 317
 318void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 319{
 320	struct wireless_dev *wdev = dev->ieee80211_ptr;
 321	struct wiphy *wiphy = wdev->wiphy;
 322	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 323
 324	wdev_lock(wdev);
 325
 326	nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 327	if (wdev->sme_state == CFG80211_SME_CONNECTING)
 328		__cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 329					  WLAN_STATUS_UNSPECIFIED_FAILURE,
 330					  false, NULL);
 331
 332	__cfg80211_auth_remove(wdev, addr);
 333
 334	wdev_unlock(wdev);
 335}
 336EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 337
 338void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 
 339{
 340	struct wireless_dev *wdev = dev->ieee80211_ptr;
 341	struct wiphy *wiphy = wdev->wiphy;
 342	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 343	int i;
 344	bool done = false;
 345
 346	wdev_lock(wdev);
 347
 348	nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 349	if (wdev->sme_state == CFG80211_SME_CONNECTING)
 350		__cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 351					  WLAN_STATUS_UNSPECIFIED_FAILURE,
 352					  false, NULL);
 353
 354	for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 355		if (wdev->auth_bsses[i] &&
 356		    memcmp(wdev->auth_bsses[i]->pub.bssid,
 357			   addr, ETH_ALEN) == 0) {
 358			cfg80211_unhold_bss(wdev->auth_bsses[i]);
 359			cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 360			wdev->auth_bsses[i] = NULL;
 361			done = true;
 362			break;
 363		}
 364	}
 365
 366	WARN_ON(!done);
 
 367
 368	wdev_unlock(wdev);
 
 
 
 369}
 370EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 371
 372void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 373				  enum nl80211_key_type key_type, int key_id,
 374				  const u8 *tsc, gfp_t gfp)
 375{
 376	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 377	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 378#ifdef CONFIG_CFG80211_WEXT
 379	union iwreq_data wrqu;
 380	char *buf = kmalloc(128, gfp);
 381
 382	if (buf) {
 383		sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 384			"keyid=%d %scast addr=%pM)", key_id,
 385			key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 386			addr);
 387		memset(&wrqu, 0, sizeof(wrqu));
 388		wrqu.data.length = strlen(buf);
 389		wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 390		kfree(buf);
 391	}
 392#endif
 393
 
 394	nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 395}
 396EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 397
 398/* some MLME handling for userspace SME */
 399int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 400			 struct net_device *dev,
 401			 struct ieee80211_channel *chan,
 402			 enum nl80211_auth_type auth_type,
 403			 const u8 *bssid,
 404			 const u8 *ssid, int ssid_len,
 405			 const u8 *ie, int ie_len,
 406			 const u8 *key, int key_len, int key_idx,
 407			 bool local_state_change)
 408{
 409	struct wireless_dev *wdev = dev->ieee80211_ptr;
 410	struct cfg80211_auth_request req;
 411	struct cfg80211_internal_bss *bss;
 412	int i, err, slot = -1, nfree = 0;
 413
 414	ASSERT_WDEV_LOCK(wdev);
 415
 416	if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 417		if (!key || !key_len || key_idx < 0 || key_idx > 4)
 418			return -EINVAL;
 419
 420	if (wdev->current_bss &&
 421	    memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
 422		return -EALREADY;
 423
 424	for (i = 0; i < MAX_AUTH_BSSES; i++) {
 425		if (wdev->authtry_bsses[i] &&
 426		    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
 427						ETH_ALEN) == 0)
 428			return -EALREADY;
 429		if (wdev->auth_bsses[i] &&
 430		    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
 431						ETH_ALEN) == 0)
 432			return -EALREADY;
 433	}
 434
 435	memset(&req, 0, sizeof(req));
 436
 437	req.local_state_change = local_state_change;
 438	req.ie = ie;
 439	req.ie_len = ie_len;
 440	req.auth_type = auth_type;
 441	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 442				   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 443	req.key = key;
 444	req.key_len = key_len;
 445	req.key_idx = key_idx;
 446	if (!req.bss)
 447		return -ENOENT;
 448
 449	bss = bss_from_pub(req.bss);
 
 
 450
 451	for (i = 0; i < MAX_AUTH_BSSES; i++) {
 452		if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
 453			slot = i;
 454			nfree++;
 455		}
 456	}
 457
 458	/* we need one free slot for disassoc and one for this auth */
 459	if (nfree < 2) {
 460		err = -ENOSPC;
 461		goto out;
 462	}
 463
 464	if (local_state_change)
 465		wdev->auth_bsses[slot] = bss;
 466	else
 467		wdev->authtry_bsses[slot] = bss;
 468	cfg80211_hold_bss(bss);
 469
 470	err = rdev->ops->auth(&rdev->wiphy, dev, &req);
 471	if (err) {
 472		if (local_state_change)
 473			wdev->auth_bsses[slot] = NULL;
 474		else
 475			wdev->authtry_bsses[slot] = NULL;
 476		cfg80211_unhold_bss(bss);
 477	}
 478
 479 out:
 480	if (err)
 481		cfg80211_put_bss(req.bss);
 482	return err;
 483}
 484
 485int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 486		       struct net_device *dev, struct ieee80211_channel *chan,
 487		       enum nl80211_auth_type auth_type, const u8 *bssid,
 488		       const u8 *ssid, int ssid_len,
 489		       const u8 *ie, int ie_len,
 490		       const u8 *key, int key_len, int key_idx,
 491		       bool local_state_change)
 492{
 493	int err;
 494
 495	wdev_lock(dev->ieee80211_ptr);
 496	err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
 497				   ssid, ssid_len, ie, ie_len,
 498				   key, key_len, key_idx, local_state_change);
 499	wdev_unlock(dev->ieee80211_ptr);
 500
 501	return err;
 
 
 
 502}
 503
 504int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 505			  struct net_device *dev,
 506			  struct ieee80211_channel *chan,
 507			  const u8 *bssid, const u8 *prev_bssid,
 508			  const u8 *ssid, int ssid_len,
 509			  const u8 *ie, int ie_len, bool use_mfp,
 510			  struct cfg80211_crypto_settings *crypt)
 511{
 512	struct wireless_dev *wdev = dev->ieee80211_ptr;
 513	struct cfg80211_assoc_request req;
 514	struct cfg80211_internal_bss *bss;
 515	int i, err, slot = -1;
 516	bool was_connected = false;
 517
 518	ASSERT_WDEV_LOCK(wdev);
 519
 520	memset(&req, 0, sizeof(req));
 521
 522	if (wdev->current_bss && prev_bssid &&
 523	    memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
 524		/*
 525		 * Trying to reassociate: Allow this to proceed and let the old
 526		 * association to be dropped when the new one is completed.
 527		 */
 528		if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 529			was_connected = true;
 530			wdev->sme_state = CFG80211_SME_CONNECTING;
 531		}
 532	} else if (wdev->current_bss)
 533		return -EALREADY;
 534
 535	req.ie = ie;
 536	req.ie_len = ie_len;
 537	memcpy(&req.crypto, crypt, sizeof(req.crypto));
 538	req.use_mfp = use_mfp;
 539	req.prev_bssid = prev_bssid;
 540	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 541				   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 542	if (!req.bss) {
 543		if (was_connected)
 544			wdev->sme_state = CFG80211_SME_CONNECTED;
 545		return -ENOENT;
 546	}
 547
 548	bss = bss_from_pub(req.bss);
 549
 550	for (i = 0; i < MAX_AUTH_BSSES; i++) {
 551		if (bss == wdev->auth_bsses[i]) {
 552			slot = i;
 553			break;
 554		}
 555	}
 556
 557	if (slot < 0) {
 558		err = -ENOTCONN;
 559		goto out;
 560	}
 561
 562	err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
 563 out:
 564	if (err && was_connected)
 565		wdev->sme_state = CFG80211_SME_CONNECTED;
 566	/* still a reference in wdev->auth_bsses[slot] */
 567	cfg80211_put_bss(req.bss);
 568	return err;
 569}
 570
 
 571int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 572			struct net_device *dev,
 573			struct ieee80211_channel *chan,
 574			const u8 *bssid, const u8 *prev_bssid,
 575			const u8 *ssid, int ssid_len,
 576			const u8 *ie, int ie_len, bool use_mfp,
 577			struct cfg80211_crypto_settings *crypt)
 578{
 579	struct wireless_dev *wdev = dev->ieee80211_ptr;
 580	int err;
 581
 582	wdev_lock(wdev);
 583	err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
 584				    ssid, ssid_len, ie, ie_len, use_mfp, crypt);
 585	wdev_unlock(wdev);
 586
 587	return err;
 588}
 
 
 
 
 
 
 
 
 
 589
 590int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 591			   struct net_device *dev, const u8 *bssid,
 592			   const u8 *ie, int ie_len, u16 reason,
 593			   bool local_state_change)
 594{
 595	struct wireless_dev *wdev = dev->ieee80211_ptr;
 596	struct cfg80211_deauth_request req;
 597	int i;
 598
 599	ASSERT_WDEV_LOCK(wdev);
 
 
 
 600
 601	memset(&req, 0, sizeof(req));
 602	req.reason_code = reason;
 603	req.local_state_change = local_state_change;
 604	req.ie = ie;
 605	req.ie_len = ie_len;
 606	if (wdev->current_bss &&
 607	    memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 608		req.bss = &wdev->current_bss->pub;
 609	} else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 610		if (wdev->auth_bsses[i] &&
 611		    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 612			req.bss = &wdev->auth_bsses[i]->pub;
 613			break;
 614		}
 615		if (wdev->authtry_bsses[i] &&
 616		    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 617			req.bss = &wdev->authtry_bsses[i]->pub;
 618			break;
 
 
 619		}
 620	}
 621
 622	if (!req.bss)
 623		return -ENOTCONN;
 624
 625	return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 626}
 627
 628int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 629			 struct net_device *dev, const u8 *bssid,
 630			 const u8 *ie, int ie_len, u16 reason,
 631			 bool local_state_change)
 632{
 633	struct wireless_dev *wdev = dev->ieee80211_ptr;
 634	int err;
 635
 636	wdev_lock(wdev);
 637	err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
 638				     local_state_change);
 639	wdev_unlock(wdev);
 
 
 
 
 
 
 
 
 
 
 
 
 
 640
 641	return err;
 642}
 643
 644static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 645				    struct net_device *dev, const u8 *bssid,
 646				    const u8 *ie, int ie_len, u16 reason,
 647				    bool local_state_change)
 648{
 649	struct wireless_dev *wdev = dev->ieee80211_ptr;
 650	struct cfg80211_disassoc_request req;
 
 
 
 
 
 
 
 651
 652	ASSERT_WDEV_LOCK(wdev);
 653
 654	if (wdev->sme_state != CFG80211_SME_CONNECTED)
 655		return -ENOTCONN;
 656
 657	if (WARN_ON(!wdev->current_bss))
 658		return -ENOTCONN;
 659
 660	memset(&req, 0, sizeof(req));
 661	req.reason_code = reason;
 662	req.local_state_change = local_state_change;
 663	req.ie = ie;
 664	req.ie_len = ie_len;
 665	if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
 666		req.bss = &wdev->current_bss->pub;
 667	else
 668		return -ENOTCONN;
 669
 670	return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
 671}
 672
 673int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 674			   struct net_device *dev, const u8 *bssid,
 675			   const u8 *ie, int ie_len, u16 reason,
 676			   bool local_state_change)
 677{
 678	struct wireless_dev *wdev = dev->ieee80211_ptr;
 679	int err;
 680
 681	wdev_lock(wdev);
 682	err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
 683				       local_state_change);
 684	wdev_unlock(wdev);
 685
 686	return err;
 687}
 688
 689void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 690			struct net_device *dev)
 691{
 692	struct wireless_dev *wdev = dev->ieee80211_ptr;
 693	struct cfg80211_deauth_request req;
 694	int i;
 695
 696	ASSERT_WDEV_LOCK(wdev);
 697
 698	if (!rdev->ops->deauth)
 699		return;
 700
 701	memset(&req, 0, sizeof(req));
 702	req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 703	req.ie = NULL;
 704	req.ie_len = 0;
 705
 706	if (wdev->current_bss) {
 707		req.bss = &wdev->current_bss->pub;
 708		rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 709		if (wdev->current_bss) {
 710			cfg80211_unhold_bss(wdev->current_bss);
 711			cfg80211_put_bss(&wdev->current_bss->pub);
 712			wdev->current_bss = NULL;
 713		}
 714	}
 715
 716	for (i = 0; i < MAX_AUTH_BSSES; i++) {
 717		if (wdev->auth_bsses[i]) {
 718			req.bss = &wdev->auth_bsses[i]->pub;
 719			rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 720			if (wdev->auth_bsses[i]) {
 721				cfg80211_unhold_bss(wdev->auth_bsses[i]);
 722				cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 723				wdev->auth_bsses[i] = NULL;
 724			}
 725		}
 726		if (wdev->authtry_bsses[i]) {
 727			req.bss = &wdev->authtry_bsses[i]->pub;
 728			rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 729			if (wdev->authtry_bsses[i]) {
 730				cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 731				cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 732				wdev->authtry_bsses[i] = NULL;
 733			}
 734		}
 735	}
 736}
 737
 738void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
 739			       struct ieee80211_channel *chan,
 740			       enum nl80211_channel_type channel_type,
 741			       unsigned int duration, gfp_t gfp)
 742{
 743	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 744	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 745
 746	nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
 747				       duration, gfp);
 748}
 749EXPORT_SYMBOL(cfg80211_ready_on_channel);
 750
 751void cfg80211_remain_on_channel_expired(struct net_device *dev,
 752					u64 cookie,
 753					struct ieee80211_channel *chan,
 754					enum nl80211_channel_type channel_type,
 755					gfp_t gfp)
 756{
 757	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 758	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 759
 760	nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
 761					      channel_type, gfp);
 762}
 763EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
 764
 765void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 766		      struct station_info *sinfo, gfp_t gfp)
 767{
 768	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 769	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 770
 771	nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
 772}
 773EXPORT_SYMBOL(cfg80211_new_sta);
 774
 775void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 776{
 777	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 778	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 779
 780	nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
 781}
 782EXPORT_SYMBOL(cfg80211_del_sta);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 783
 784struct cfg80211_mgmt_registration {
 785	struct list_head list;
 786
 787	u32 nlpid;
 
 788
 789	int match_len;
 
 
 
 790
 791	__le16 frame_type;
 
 792
 793	u8 match[];
 794};
 
 
 
 795
 796int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
 797				u16 frame_type, const u8 *match_data,
 798				int match_len)
 
 799{
 800	struct wiphy *wiphy = wdev->wiphy;
 801	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 802	struct cfg80211_mgmt_registration *reg, *nreg;
 803	int err = 0;
 804	u16 mgmt_type;
 
 805
 806	if (!wdev->wiphy->mgmt_stypes)
 807		return -EOPNOTSUPP;
 808
 809	if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
 
 810		return -EINVAL;
 
 811
 812	if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
 
 813		return -EINVAL;
 
 814
 815	mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 816	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 817		return -EINVAL;
 
 818
 819	nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 820	if (!nreg)
 821		return -ENOMEM;
 822
 823	spin_lock_bh(&wdev->mgmt_registrations_lock);
 824
 825	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 826		int mlen = min(match_len, reg->match_len);
 827
 828		if (frame_type != le16_to_cpu(reg->frame_type))
 829			continue;
 830
 831		if (memcmp(reg->match, match_data, mlen) == 0) {
 
 
 
 
 
 
 832			err = -EALREADY;
 833			break;
 834		}
 835	}
 836
 837	if (err) {
 
 
 
 838		kfree(nreg);
 839		goto out;
 
 
 
 
 
 
 
 840	}
 
 
 
 
 841
 842	memcpy(nreg->match, match_data, match_len);
 843	nreg->match_len = match_len;
 844	nreg->nlpid = snd_pid;
 845	nreg->frame_type = cpu_to_le16(frame_type);
 846	list_add(&nreg->list, &wdev->mgmt_registrations);
 847
 848	if (rdev->ops->mgmt_frame_register)
 849		rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 850					       frame_type, true);
 851
 852 out:
 853	spin_unlock_bh(&wdev->mgmt_registrations_lock);
 
 854
 855	return err;
 856}
 857
 858void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
 859{
 860	struct wiphy *wiphy = wdev->wiphy;
 861	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 862	struct cfg80211_mgmt_registration *reg, *tmp;
 863
 864	spin_lock_bh(&wdev->mgmt_registrations_lock);
 865
 866	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 867		if (reg->nlpid != nlpid)
 868			continue;
 869
 870		if (rdev->ops->mgmt_frame_register) {
 871			u16 frame_type = le16_to_cpu(reg->frame_type);
 
 
 
 
 872
 873			rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 874						       frame_type, false);
 875		}
 876
 877		list_del(&reg->list);
 878		kfree(reg);
 
 879	}
 880
 881	spin_unlock_bh(&wdev->mgmt_registrations_lock);
 
 882}
 883
 884void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 885{
 
 886	struct cfg80211_mgmt_registration *reg, *tmp;
 887
 888	spin_lock_bh(&wdev->mgmt_registrations_lock);
 889
 890	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 891		list_del(&reg->list);
 892		kfree(reg);
 893	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 894
 895	spin_unlock_bh(&wdev->mgmt_registrations_lock);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 896}
 897
 898int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 899			  struct net_device *dev,
 900			  struct ieee80211_channel *chan, bool offchan,
 901			  enum nl80211_channel_type channel_type,
 902			  bool channel_type_valid, unsigned int wait,
 903			  const u8 *buf, size_t len, u64 *cookie)
 904{
 905	struct wireless_dev *wdev = dev->ieee80211_ptr;
 906	const struct ieee80211_mgmt *mgmt;
 907	u16 stype;
 908
 
 
 909	if (!wdev->wiphy->mgmt_stypes)
 910		return -EOPNOTSUPP;
 911
 912	if (!rdev->ops->mgmt_tx)
 913		return -EOPNOTSUPP;
 914
 915	if (len < 24 + 1)
 916		return -EINVAL;
 917
 918	mgmt = (const struct ieee80211_mgmt *) buf;
 919
 920	if (!ieee80211_is_mgmt(mgmt->frame_control))
 921		return -EINVAL;
 922
 923	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 924	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 925		return -EINVAL;
 926
 927	if (ieee80211_is_action(mgmt->frame_control) &&
 928	    mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 929		int err = 0;
 930
 931		wdev_lock(wdev);
 932
 933		switch (wdev->iftype) {
 934		case NL80211_IFTYPE_ADHOC:
 
 
 
 
 
 
 
 
 
 
 
 935		case NL80211_IFTYPE_STATION:
 936		case NL80211_IFTYPE_P2P_CLIENT:
 937			if (!wdev->current_bss) {
 938				err = -ENOTCONN;
 939				break;
 940			}
 941
 942			if (memcmp(wdev->current_bss->pub.bssid,
 943				   mgmt->bssid, ETH_ALEN)) {
 
 
 944				err = -ENOTCONN;
 945				break;
 946			}
 947
 948			/*
 949			 * check for IBSS DA must be done by driver as
 950			 * cfg80211 doesn't track the stations
 951			 */
 952			if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 953				break;
 954
 955			/* for station, check that DA is the AP */
 956			if (memcmp(wdev->current_bss->pub.bssid,
 957				   mgmt->da, ETH_ALEN)) {
 958				err = -ENOTCONN;
 959				break;
 960			}
 961			break;
 962		case NL80211_IFTYPE_AP:
 963		case NL80211_IFTYPE_P2P_GO:
 964		case NL80211_IFTYPE_AP_VLAN:
 965			if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
 
 
 
 966				err = -EINVAL;
 967			break;
 968		case NL80211_IFTYPE_MESH_POINT:
 969			if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
 970				err = -EINVAL;
 971				break;
 972			}
 973			/*
 974			 * check for mesh DA must be done by driver as
 975			 * cfg80211 doesn't track the stations
 976			 */
 977			break;
 
 
 
 
 
 
 978		default:
 979			err = -EOPNOTSUPP;
 980			break;
 981		}
 982		wdev_unlock(wdev);
 983
 984		if (err)
 985			return err;
 986	}
 987
 988	if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
 
 989		return -EINVAL;
 990
 991	/* Transmit the Action frame as requested by user space */
 992	return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
 993				  channel_type, channel_type_valid,
 994				  wait, buf, len, cookie);
 995}
 996
 997bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
 998		      size_t len, gfp_t gfp)
 999{
1000	struct wireless_dev *wdev = dev->ieee80211_ptr;
1001	struct wiphy *wiphy = wdev->wiphy;
1002	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1003	struct cfg80211_mgmt_registration *reg;
1004	const struct ieee80211_txrx_stypes *stypes =
1005		&wiphy->mgmt_stypes[wdev->iftype];
1006	struct ieee80211_mgmt *mgmt = (void *)buf;
1007	const u8 *data;
1008	int data_len;
1009	bool result = false;
1010	__le16 ftype = mgmt->frame_control &
1011		cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
1012	u16 stype;
1013
 
1014	stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
1015
1016	if (!(stypes->rx & BIT(stype)))
 
1017		return false;
 
1018
1019	data = buf + ieee80211_hdrlen(mgmt->frame_control);
1020	data_len = len - ieee80211_hdrlen(mgmt->frame_control);
1021
1022	spin_lock_bh(&wdev->mgmt_registrations_lock);
1023
1024	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
1025		if (reg->frame_type != ftype)
1026			continue;
1027
1028		if (reg->match_len > data_len)
1029			continue;
1030
1031		if (memcmp(reg->match, data, reg->match_len))
1032			continue;
1033
1034		/* found match! */
1035
1036		/* Indicate the received Action frame to user space */
1037		if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
1038				      buf, len, gfp))
1039			continue;
1040
1041		result = true;
1042		break;
1043	}
1044
1045	spin_unlock_bh(&wdev->mgmt_registrations_lock);
1046
 
1047	return result;
1048}
1049EXPORT_SYMBOL(cfg80211_rx_mgmt);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1050
1051void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
1052			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
 
1053{
1054	struct wireless_dev *wdev = dev->ieee80211_ptr;
1055	struct wiphy *wiphy = wdev->wiphy;
1056	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 
 
 
 
 
1057
1058	/* Indicate TX status of the Action frame to user space */
1059	nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1060}
1061EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
1062
1063void cfg80211_cqm_rssi_notify(struct net_device *dev,
1064			      enum nl80211_cqm_rssi_threshold_event rssi_event,
1065			      gfp_t gfp)
1066{
1067	struct wireless_dev *wdev = dev->ieee80211_ptr;
1068	struct wiphy *wiphy = wdev->wiphy;
1069	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 
 
 
 
 
 
1070
1071	/* Indicate roaming trigger event to user space */
1072	nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
1073}
1074EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
1075
1076void cfg80211_cqm_pktloss_notify(struct net_device *dev,
1077				 const u8 *peer, u32 num_packets, gfp_t gfp)
 
 
1078{
1079	struct wireless_dev *wdev = dev->ieee80211_ptr;
1080	struct wiphy *wiphy = wdev->wiphy;
1081	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1082
1083	/* Indicate roaming trigger event to user space */
1084	nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
1085}
1086EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
1087
1088void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
1089			       const u8 *replay_ctr, gfp_t gfp)
1090{
1091	struct wireless_dev *wdev = dev->ieee80211_ptr;
1092	struct wiphy *wiphy = wdev->wiphy;
1093	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
 
 
 
 
 
 
 
1094
1095	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
 
 
1096}
1097EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);