net/wireless/mlme.c

   1 /*
   2  * cfg80211 MLME SAP interface
   3  *
   4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2015           Intel Deutschland GmbH
   6  */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/module.h>
  10 #include <linux/etherdevice.h>
  11 #include <linux/netdevice.h>
  12 #include <linux/nl80211.h>
  13 #include <linux/slab.h>
  14 #include <linux/wireless.h>
  15 #include <net/cfg80211.h>
  16 #include <net/iw_handler.h>
  17 #include "core.h"
  18 #include "nl80211.h"
  19 #include "rdev-ops.h"
  20
  21
  22 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
  23                             const u8 *buf, size_t len, int uapsd_queues)
  24 {
  25         struct wireless_dev *wdev = dev->ieee80211_ptr;
  26         struct wiphy *wiphy = wdev->wiphy;
  27         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  28         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  29         u8 *ie = mgmt->u.assoc_resp.variable;
  30         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  31         u16 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  32
  33         trace_cfg80211_send_rx_assoc(dev, bss);
  34
  35         /*
  36          * This is a bit of a hack, we don't notify userspace of
  37          * a (re-)association reply if we tried to send a reassoc
  38          * and got a reject -- we only try again with an assoc
  39          * frame instead of reassoc.
  40          */
  41         if (cfg80211_sme_rx_assoc_resp(wdev, status_code)) {
  42                 cfg80211_unhold_bss(bss_from_pub(bss));
  43                 cfg80211_put_bss(wiphy, bss);
  44                 return;
  45         }
  46
  47         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues);
  48         /* update current_bss etc., consumes the bss reference */
  49         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
  50                                   status_code,
  51                                   status_code == WLAN_STATUS_SUCCESS, bss);
  52 }
  53 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  54
  55 static void cfg80211_process_auth(struct wireless_dev *wdev,
  56                                   const u8 *buf, size_t len)
  57 {
  58         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  59
  60         nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  61         cfg80211_sme_rx_auth(wdev, buf, len);
  62 }
  63
  64 static void cfg80211_process_deauth(struct wireless_dev *wdev,
  65                                     const u8 *buf, size_t len)
  66 {
  67         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  68         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  69         const u8 *bssid = mgmt->bssid;
  70         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
  71         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
  72
  73         nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  74
  75         if (!wdev->current_bss ||
  76             !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
  77                 return;
  78
  79         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
  80         cfg80211_sme_deauth(wdev);
  81 }
  82
  83 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
  84                                       const u8 *buf, size_t len)
  85 {
  86         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  87         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  88         const u8 *bssid = mgmt->bssid;
  89         u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
  90         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
  91
  92         nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  93
  94         if (WARN_ON(!wdev->current_bss ||
  95                     !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
  96                 return;
  97
  98         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
  99         cfg80211_sme_disassoc(wdev);
 100 }
 101
 102 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 103 {
 104         struct wireless_dev *wdev = dev->ieee80211_ptr;
 105         struct ieee80211_mgmt *mgmt = (void *)buf;
 106
 107         ASSERT_WDEV_LOCK(wdev);
 108
 109         trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 110
 111         if (WARN_ON(len < 2))
 112                 return;
 113
 114         if (ieee80211_is_auth(mgmt->frame_control))
 115                 cfg80211_process_auth(wdev, buf, len);
 116         else if (ieee80211_is_deauth(mgmt->frame_control))
 117                 cfg80211_process_deauth(wdev, buf, len);
 118         else if (ieee80211_is_disassoc(mgmt->frame_control))
 119                 cfg80211_process_disassoc(wdev, buf, len);
 120 }
 121 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 122
 123 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 124 {
 125         struct wireless_dev *wdev = dev->ieee80211_ptr;
 126         struct wiphy *wiphy = wdev->wiphy;
 127         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 128
 129         trace_cfg80211_send_auth_timeout(dev, addr);
 130
 131         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 132         cfg80211_sme_auth_timeout(wdev);
 133 }
 134 EXPORT_SYMBOL(cfg80211_auth_timeout);
 135
 136 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
 137 {
 138         struct wireless_dev *wdev = dev->ieee80211_ptr;
 139         struct wiphy *wiphy = wdev->wiphy;
 140         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 141
 142         trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
 143
 144         nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
 145         cfg80211_sme_assoc_timeout(wdev);
 146
 147         cfg80211_unhold_bss(bss_from_pub(bss));
 148         cfg80211_put_bss(wiphy, bss);
 149 }
 150 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 151
 152 void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
 153 {
 154         struct wireless_dev *wdev = dev->ieee80211_ptr;
 155         struct wiphy *wiphy = wdev->wiphy;
 156
 157         cfg80211_sme_abandon_assoc(wdev);
 158
 159         cfg80211_unhold_bss(bss_from_pub(bss));
 160         cfg80211_put_bss(wiphy, bss);
 161 }
 162 EXPORT_SYMBOL(cfg80211_abandon_assoc);
 163
 164 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 165 {
 166         struct wireless_dev *wdev = dev->ieee80211_ptr;
 167         struct ieee80211_mgmt *mgmt = (void *)buf;
 168
 169         ASSERT_WDEV_LOCK(wdev);
 170
 171         trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
 172
 173         if (WARN_ON(len < 2))
 174                 return;
 175
 176         if (ieee80211_is_deauth(mgmt->frame_control))
 177                 cfg80211_process_deauth(wdev, buf, len);
 178         else
 179                 cfg80211_process_disassoc(wdev, buf, len);
 180 }
 181 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 182
 183 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 184                                   enum nl80211_key_type key_type, int key_id,
 185                                   const u8 *tsc, gfp_t gfp)
 186 {
 187         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 188         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 189 #ifdef CONFIG_CFG80211_WEXT
 190         union iwreq_data wrqu;
 191         char *buf = kmalloc(128, gfp);
 192
 193         if (buf) {
 194                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 195                         "keyid=%d %scast addr=%pM)", key_id,
 196                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 197                         addr);
 198                 memset(&wrqu, 0, sizeof(wrqu));
 199                 wrqu.data.length = strlen(buf);
 200                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 201                 kfree(buf);
 202         }
 203 #endif
 204
 205         trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 206         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 207 }
 208 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 209
 210 /* some MLME handling for userspace SME */
 211 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 212                        struct net_device *dev,
 213                        struct ieee80211_channel *chan,
 214                        enum nl80211_auth_type auth_type,
 215                        const u8 *bssid,
 216                        const u8 *ssid, int ssid_len,
 217                        const u8 *ie, int ie_len,
 218                        const u8 *key, int key_len, int key_idx,
 219                        const u8 *auth_data, int auth_data_len)
 220 {
 221         struct wireless_dev *wdev = dev->ieee80211_ptr;
 222         struct cfg80211_auth_request req = {
 223                 .ie = ie,
 224                 .ie_len = ie_len,
 225                 .auth_data = auth_data,
 226                 .auth_data_len = auth_data_len,
 227                 .auth_type = auth_type,
 228                 .key = key,
 229                 .key_len = key_len,
 230                 .key_idx = key_idx,
 231         };
 232         int err;
 233
 234         ASSERT_WDEV_LOCK(wdev);
 235
 236         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 237                 if (!key || !key_len || key_idx < 0 || key_idx > 3)
 238                         return -EINVAL;
 239
 240         if (wdev->current_bss &&
 241             ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
 242                 return -EALREADY;
 243
 244         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 245                                    IEEE80211_BSS_TYPE_ESS,
 246                                    IEEE80211_PRIVACY_ANY);
 247         if (!req.bss)
 248                 return -ENOENT;
 249
 250         err = rdev_auth(rdev, dev, &req);
 251
 252         cfg80211_put_bss(&rdev->wiphy, req.bss);
 253         return err;
 254 }
 255
 256 /*  Do a logical ht_capa &= ht_capa_mask.  */
 257 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 258                                const struct ieee80211_ht_cap *ht_capa_mask)
 259 {
 260         int i;
 261         u8 *p1, *p2;
 262         if (!ht_capa_mask) {
 263                 memset(ht_capa, 0, sizeof(*ht_capa));
 264                 return;
 265         }
 266
 267         p1 = (u8*)(ht_capa);
 268         p2 = (u8*)(ht_capa_mask);
 269         for (i = 0; i<sizeof(*ht_capa); i++)
 270                 p1[i] &= p2[i];
 271 }
 272
 273 /*  Do a logical ht_capa &= ht_capa_mask.  */
 274 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 275                                 const struct ieee80211_vht_cap *vht_capa_mask)
 276 {
 277         int i;
 278         u8 *p1, *p2;
 279         if (!vht_capa_mask) {
 280                 memset(vht_capa, 0, sizeof(*vht_capa));
 281                 return;
 282         }
 283
 284         p1 = (u8*)(vht_capa);
 285         p2 = (u8*)(vht_capa_mask);
 286         for (i = 0; i < sizeof(*vht_capa); i++)
 287                 p1[i] &= p2[i];
 288 }
 289
 290 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 291                         struct net_device *dev,
 292                         struct ieee80211_channel *chan,
 293                         const u8 *bssid,
 294                         const u8 *ssid, int ssid_len,
 295                         struct cfg80211_assoc_request *req)
 296 {
 297         struct wireless_dev *wdev = dev->ieee80211_ptr;
 298         int err;
 299
 300         ASSERT_WDEV_LOCK(wdev);
 301
 302         if (wdev->current_bss &&
 303             (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
 304                                                    req->prev_bssid)))
 305                 return -EALREADY;
 306
 307         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 308                                   rdev->wiphy.ht_capa_mod_mask);
 309         cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 310                                    rdev->wiphy.vht_capa_mod_mask);
 311
 312         req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 313                                     IEEE80211_BSS_TYPE_ESS,
 314                                     IEEE80211_PRIVACY_ANY);
 315         if (!req->bss)
 316                 return -ENOENT;
 317
 318         err = rdev_assoc(rdev, dev, req);
 319         if (!err)
 320                 cfg80211_hold_bss(bss_from_pub(req->bss));
 321         else
 322                 cfg80211_put_bss(&rdev->wiphy, req->bss);
 323
 324         return err;
 325 }
 326
 327 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 328                          struct net_device *dev, const u8 *bssid,
 329                          const u8 *ie, int ie_len, u16 reason,
 330                          bool local_state_change)
 331 {
 332         struct wireless_dev *wdev = dev->ieee80211_ptr;
 333         struct cfg80211_deauth_request req = {
 334                 .bssid = bssid,
 335                 .reason_code = reason,
 336                 .ie = ie,
 337                 .ie_len = ie_len,
 338                 .local_state_change = local_state_change,
 339         };
 340
 341         ASSERT_WDEV_LOCK(wdev);
 342
 343         if (local_state_change &&
 344             (!wdev->current_bss ||
 345              !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 346                 return 0;
 347
 348         if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
 349             (wdev->current_bss &&
 350              ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 351                 wdev->conn_owner_nlportid = 0;
 352
 353         return rdev_deauth(rdev, dev, &req);
 354 }
 355
 356 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 357                            struct net_device *dev, const u8 *bssid,
 358                            const u8 *ie, int ie_len, u16 reason,
 359                            bool local_state_change)
 360 {
 361         struct wireless_dev *wdev = dev->ieee80211_ptr;
 362         struct cfg80211_disassoc_request req = {
 363                 .reason_code = reason,
 364                 .local_state_change = local_state_change,
 365                 .ie = ie,
 366                 .ie_len = ie_len,
 367         };
 368         int err;
 369
 370         ASSERT_WDEV_LOCK(wdev);
 371
 372         if (!wdev->current_bss)
 373                 return -ENOTCONN;
 374
 375         if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
 376                 req.bss = &wdev->current_bss->pub;
 377         else
 378                 return -ENOTCONN;
 379
 380         err = rdev_disassoc(rdev, dev, &req);
 381         if (err)
 382                 return err;
 383
 384         /* driver should have reported the disassoc */
 385         WARN_ON(wdev->current_bss);
 386         return 0;
 387 }
 388
 389 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 390                         struct net_device *dev)
 391 {
 392         struct wireless_dev *wdev = dev->ieee80211_ptr;
 393         u8 bssid[ETH_ALEN];
 394
 395         ASSERT_WDEV_LOCK(wdev);
 396
 397         if (!rdev->ops->deauth)
 398                 return;
 399
 400         if (!wdev->current_bss)
 401                 return;
 402
 403         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
 404         cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 405                              WLAN_REASON_DEAUTH_LEAVING, false);
 406 }
 407
 408 struct cfg80211_mgmt_registration {
 409         struct list_head list;
 410         struct wireless_dev *wdev;
 411
 412         u32 nlportid;
 413
 414         int match_len;
 415
 416         __le16 frame_type;
 417
 418         u8 match[];
 419 };
 420
 421 static void
 422 cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device *rdev)
 423 {
 424         struct cfg80211_mgmt_registration *reg;
 425
 426         ASSERT_RTNL();
 427
 428         spin_lock_bh(&rdev->mlme_unreg_lock);
 429         while ((reg = list_first_entry_or_null(&rdev->mlme_unreg,
 430                                                struct cfg80211_mgmt_registration,
 431                                                list))) {
 432                 list_del(&reg->list);
 433                 spin_unlock_bh(&rdev->mlme_unreg_lock);
 434
 435                 if (rdev->ops->mgmt_frame_register) {
 436                         u16 frame_type = le16_to_cpu(reg->frame_type);
 437
 438                         rdev_mgmt_frame_register(rdev, reg->wdev,
 439                                                  frame_type, false);
 440                 }
 441
 442                 kfree(reg);
 443
 444                 spin_lock_bh(&rdev->mlme_unreg_lock);
 445         }
 446         spin_unlock_bh(&rdev->mlme_unreg_lock);
 447 }
 448
 449 void cfg80211_mlme_unreg_wk(struct work_struct *wk)
 450 {
 451         struct cfg80211_registered_device *rdev;
 452
 453         rdev = container_of(wk, struct cfg80211_registered_device,
 454                             mlme_unreg_wk);
 455
 456         rtnl_lock();
 457         cfg80211_process_mlme_unregistrations(rdev);
 458         rtnl_unlock();
 459 }
 460
 461 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 462                                 u16 frame_type, const u8 *match_data,
 463                                 int match_len)
 464 {
 465         struct wiphy *wiphy = wdev->wiphy;
 466         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 467         struct cfg80211_mgmt_registration *reg, *nreg;
 468         int err = 0;
 469         u16 mgmt_type;
 470
 471         if (!wdev->wiphy->mgmt_stypes)
 472                 return -EOPNOTSUPP;
 473
 474         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
 475                 return -EINVAL;
 476
 477         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
 478                 return -EINVAL;
 479
 480         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 481         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
 482                 return -EINVAL;
 483
 484         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 485         if (!nreg)
 486                 return -ENOMEM;
 487
 488         spin_lock_bh(&wdev->mgmt_registrations_lock);
 489
 490         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 491                 int mlen = min(match_len, reg->match_len);
 492
 493                 if (frame_type != le16_to_cpu(reg->frame_type))
 494                         continue;
 495
 496                 if (memcmp(reg->match, match_data, mlen) == 0) {
 497                         err = -EALREADY;
 498                         break;
 499                 }
 500         }
 501
 502         if (err) {
 503                 kfree(nreg);
 504                 goto out;
 505         }
 506
 507         memcpy(nreg->match, match_data, match_len);
 508         nreg->match_len = match_len;
 509         nreg->nlportid = snd_portid;
 510         nreg->frame_type = cpu_to_le16(frame_type);
 511         nreg->wdev = wdev;
 512         list_add(&nreg->list, &wdev->mgmt_registrations);
 513         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 514
 515         /* process all unregistrations to avoid driver confusion */
 516         cfg80211_process_mlme_unregistrations(rdev);
 517
 518         if (rdev->ops->mgmt_frame_register)
 519                 rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
 520
 521         return 0;
 522
 523  out:
 524         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 525
 526         return err;
 527 }
 528
 529 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 530 {
 531         struct wiphy *wiphy = wdev->wiphy;
 532         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 533         struct cfg80211_mgmt_registration *reg, *tmp;
 534
 535         spin_lock_bh(&wdev->mgmt_registrations_lock);
 536
 537         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 538                 if (reg->nlportid != nlportid)
 539                         continue;
 540
 541                 list_del(&reg->list);
 542                 spin_lock(&rdev->mlme_unreg_lock);
 543                 list_add_tail(&reg->list, &rdev->mlme_unreg);
 544                 spin_unlock(&rdev->mlme_unreg_lock);
 545
 546                 schedule_work(&rdev->mlme_unreg_wk);
 547         }
 548
 549         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 550
 551         if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 552                 rdev->crit_proto_nlportid = 0;
 553                 rdev_crit_proto_stop(rdev, wdev);
 554         }
 555
 556         if (nlportid == wdev->ap_unexpected_nlportid)
 557                 wdev->ap_unexpected_nlportid = 0;
 558 }
 559
 560 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 561 {
 562         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 563
 564         spin_lock_bh(&wdev->mgmt_registrations_lock);
 565         spin_lock(&rdev->mlme_unreg_lock);
 566         list_splice_tail_init(&wdev->mgmt_registrations, &rdev->mlme_unreg);
 567         spin_unlock(&rdev->mlme_unreg_lock);
 568         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 569
 570         cfg80211_process_mlme_unregistrations(rdev);
 571 }
 572
 573 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 574                           struct wireless_dev *wdev,
 575                           struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 576 {
 577         const struct ieee80211_mgmt *mgmt;
 578         u16 stype;
 579
 580         if (!wdev->wiphy->mgmt_stypes)
 581                 return -EOPNOTSUPP;
 582
 583         if (!rdev->ops->mgmt_tx)
 584                 return -EOPNOTSUPP;
 585
 586         if (params->len < 24 + 1)
 587                 return -EINVAL;
 588
 589         mgmt = (const struct ieee80211_mgmt *)params->buf;
 590
 591         if (!ieee80211_is_mgmt(mgmt->frame_control))
 592                 return -EINVAL;
 593
 594         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 595         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 596                 return -EINVAL;
 597
 598         if (ieee80211_is_action(mgmt->frame_control) &&
 599             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 600                 int err = 0;
 601
 602                 wdev_lock(wdev);
 603
 604                 switch (wdev->iftype) {
 605                 case NL80211_IFTYPE_ADHOC:
 606                 case NL80211_IFTYPE_STATION:
 607                 case NL80211_IFTYPE_P2P_CLIENT:
 608                         if (!wdev->current_bss) {
 609                                 err = -ENOTCONN;
 610                                 break;
 611                         }
 612
 613                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 614                                               mgmt->bssid)) {
 615                                 err = -ENOTCONN;
 616                                 break;
 617                         }
 618
 619                         /*
 620                          * check for IBSS DA must be done by driver as
 621                          * cfg80211 doesn't track the stations
 622                          */
 623                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 624                                 break;
 625
 626                         /* for station, check that DA is the AP */
 627                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 628                                               mgmt->da)) {
 629                                 err = -ENOTCONN;
 630                                 break;
 631                         }
 632                         break;
 633                 case NL80211_IFTYPE_AP:
 634                 case NL80211_IFTYPE_P2P_GO:
 635                 case NL80211_IFTYPE_AP_VLAN:
 636                         if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
 637                                 err = -EINVAL;
 638                         break;
 639                 case NL80211_IFTYPE_MESH_POINT:
 640                         if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 641                                 err = -EINVAL;
 642                                 break;
 643                         }
 644                         /*
 645                          * check for mesh DA must be done by driver as
 646                          * cfg80211 doesn't track the stations
 647                          */
 648                         break;
 649                 case NL80211_IFTYPE_P2P_DEVICE:
 650                         /*
 651                          * fall through, P2P device only supports
 652                          * public action frames
 653                          */
 654                 case NL80211_IFTYPE_NAN:
 655                 default:
 656                         err = -EOPNOTSUPP;
 657                         break;
 658                 }
 659                 wdev_unlock(wdev);
 660
 661                 if (err)
 662                         return err;
 663         }
 664
 665         if (!ether_addr_equal(mgmt->sa, wdev_address(wdev)))
 666                 return -EINVAL;
 667
 668         /* Transmit the Action frame as requested by user space */
 669         return rdev_mgmt_tx(rdev, wdev, params, cookie);
 670 }
 671
 672 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
 673                       const u8 *buf, size_t len, u32 flags)
 674 {
 675         struct wiphy *wiphy = wdev->wiphy;
 676         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 677         struct cfg80211_mgmt_registration *reg;
 678         const struct ieee80211_txrx_stypes *stypes =
 679                 &wiphy->mgmt_stypes[wdev->iftype];
 680         struct ieee80211_mgmt *mgmt = (void *)buf;
 681         const u8 *data;
 682         int data_len;
 683         bool result = false;
 684         __le16 ftype = mgmt->frame_control &
 685                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 686         u16 stype;
 687
 688         trace_cfg80211_rx_mgmt(wdev, freq, sig_mbm);
 689         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 690
 691         if (!(stypes->rx & BIT(stype))) {
 692                 trace_cfg80211_return_bool(false);
 693                 return false;
 694         }
 695
 696         data = buf + ieee80211_hdrlen(mgmt->frame_control);
 697         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
 698
 699         spin_lock_bh(&wdev->mgmt_registrations_lock);
 700
 701         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 702                 if (reg->frame_type != ftype)
 703                         continue;
 704
 705                 if (reg->match_len > data_len)
 706                         continue;
 707
 708                 if (memcmp(reg->match, data, reg->match_len))
 709                         continue;
 710
 711                 /* found match! */
 712
 713                 /* Indicate the received Action frame to user space */
 714                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
 715                                       freq, sig_mbm,
 716                                       buf, len, flags, GFP_ATOMIC))
 717                         continue;
 718
 719                 result = true;
 720                 break;
 721         }
 722
 723         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 724
 725         trace_cfg80211_return_bool(result);
 726         return result;
 727 }
 728 EXPORT_SYMBOL(cfg80211_rx_mgmt);
 729
 730 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 731 {
 732         struct delayed_work *delayed_work = to_delayed_work(work);
 733         struct cfg80211_registered_device *rdev;
 734         struct cfg80211_chan_def chandef;
 735         struct ieee80211_supported_band *sband;
 736         struct ieee80211_channel *c;
 737         struct wiphy *wiphy;
 738         bool check_again = false;
 739         unsigned long timeout, next_time = 0;
 740         int bandid, i;
 741
 742         rdev = container_of(delayed_work, struct cfg80211_registered_device,
 743                             dfs_update_channels_wk);
 744         wiphy = &rdev->wiphy;
 745
 746         rtnl_lock();
 747         for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
 748                 sband = wiphy->bands[bandid];
 749                 if (!sband)
 750                         continue;
 751
 752                 for (i = 0; i < sband->n_channels; i++) {
 753                         c = &sband->channels[i];
 754
 755                         if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
 756                                 continue;
 757
 758                         timeout = c->dfs_state_entered + msecs_to_jiffies(
 759                                         IEEE80211_DFS_MIN_NOP_TIME_MS);
 760
 761                         if (time_after_eq(jiffies, timeout)) {
 762                                 c->dfs_state = NL80211_DFS_USABLE;
 763                                 c->dfs_state_entered = jiffies;
 764
 765                                 cfg80211_chandef_create(&chandef, c,
 766                                                         NL80211_CHAN_NO_HT);
 767
 768                                 nl80211_radar_notify(rdev, &chandef,
 769                                                      NL80211_RADAR_NOP_FINISHED,
 770                                                      NULL, GFP_ATOMIC);
 771                                 continue;
 772                         }
 773
 774                         if (!check_again)
 775                                 next_time = timeout - jiffies;
 776                         else
 777                                 next_time = min(next_time, timeout - jiffies);
 778                         check_again = true;
 779                 }
 780         }
 781         rtnl_unlock();
 782
 783         /* reschedule if there are other channels waiting to be cleared again */
 784         if (check_again)
 785                 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 786                                    next_time);
 787 }
 788
 789
 790 void cfg80211_radar_event(struct wiphy *wiphy,
 791                           struct cfg80211_chan_def *chandef,
 792                           gfp_t gfp)
 793 {
 794         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 795         unsigned long timeout;
 796
 797         trace_cfg80211_radar_event(wiphy, chandef);
 798
 799         /* only set the chandef supplied channel to unavailable, in
 800          * case the radar is detected on only one of multiple channels
 801          * spanned by the chandef.
 802          */
 803         cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 804
 805         timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
 806         queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 807                            timeout);
 808
 809         nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 810 }
 811 EXPORT_SYMBOL(cfg80211_radar_event);
 812
 813 void cfg80211_cac_event(struct net_device *netdev,
 814                         const struct cfg80211_chan_def *chandef,
 815                         enum nl80211_radar_event event, gfp_t gfp)
 816 {
 817         struct wireless_dev *wdev = netdev->ieee80211_ptr;
 818         struct wiphy *wiphy = wdev->wiphy;
 819         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 820         unsigned long timeout;
 821
 822         trace_cfg80211_cac_event(netdev, event);
 823
 824         if (WARN_ON(!wdev->cac_started))
 825                 return;
 826
 827         if (WARN_ON(!wdev->chandef.chan))
 828                 return;
 829
 830         switch (event) {
 831         case NL80211_RADAR_CAC_FINISHED:
 832                 timeout = wdev->cac_start_time +
 833                           msecs_to_jiffies(wdev->cac_time_ms);
 834                 WARN_ON(!time_after_eq(jiffies, timeout));
 835                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
 836                 break;
 837         case NL80211_RADAR_CAC_ABORTED:
 838                 break;
 839         default:
 840                 WARN_ON(1);
 841                 return;
 842         }
 843         wdev->cac_started = false;
 844
 845         nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
 846 }
 847 EXPORT_SYMBOL(cfg80211_cac_event);