net/wireless/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * cfg80211 MLME SAP interface
   4  *
   5  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   6  * Copyright (c) 2015           Intel Deutschland GmbH
   7  * Copyright (C) 2019 Intel Corporation
   8  */
   9
  10 #include <linux/kernel.h>
  11 #include <linux/module.h>
  12 #include <linux/etherdevice.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/slab.h>
  16 #include <linux/wireless.h>
  17 #include <net/cfg80211.h>
  18 #include <net/iw_handler.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "rdev-ops.h"
  22
  23
  24 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
  25                             const u8 *buf, size_t len, int uapsd_queues,
  26                             const u8 *req_ies, size_t req_ies_len)
  27 {
  28         struct wireless_dev *wdev = dev->ieee80211_ptr;
  29         struct wiphy *wiphy = wdev->wiphy;
  30         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  31         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  32         struct cfg80211_connect_resp_params cr;
  33
  34         memset(&cr, 0, sizeof(cr));
  35         cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code);
  36         cr.bssid = mgmt->bssid;
  37         cr.bss = bss;
  38         cr.req_ie = req_ies;
  39         cr.req_ie_len = req_ies_len;
  40         cr.resp_ie = mgmt->u.assoc_resp.variable;
  41         cr.resp_ie_len =
  42                 len - offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  43         cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED;
  44
  45         trace_cfg80211_send_rx_assoc(dev, bss);
  46
  47         /*
  48          * This is a bit of a hack, we don't notify userspace of
  49          * a (re-)association reply if we tried to send a reassoc
  50          * and got a reject -- we only try again with an assoc
  51          * frame instead of reassoc.
  52          */
  53         if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
  54                 cfg80211_unhold_bss(bss_from_pub(bss));
  55                 cfg80211_put_bss(wiphy, bss);
  56                 return;
  57         }
  58
  59         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues,
  60                               req_ies, req_ies_len);
  61         /* update current_bss etc., consumes the bss reference */
  62         __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
  63 }
  64 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  65
  66 static void cfg80211_process_auth(struct wireless_dev *wdev,
  67                                   const u8 *buf, size_t len)
  68 {
  69         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  70
  71         nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  72         cfg80211_sme_rx_auth(wdev, buf, len);
  73 }
  74
  75 static void cfg80211_process_deauth(struct wireless_dev *wdev,
  76                                     const u8 *buf, size_t len)
  77 {
  78         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  79         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  80         const u8 *bssid = mgmt->bssid;
  81         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
  82         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
  83
  84         nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  85
  86         if (!wdev->current_bss ||
  87             !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
  88                 return;
  89
  90         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
  91         cfg80211_sme_deauth(wdev);
  92 }
  93
  94 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
  95                                       const u8 *buf, size_t len)
  96 {
  97         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  98         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  99         const u8 *bssid = mgmt->bssid;
 100         u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 101         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 102
 103         nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
 104
 105         if (WARN_ON(!wdev->current_bss ||
 106                     !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 107                 return;
 108
 109         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 110         cfg80211_sme_disassoc(wdev);
 111 }
 112
 113 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 114 {
 115         struct wireless_dev *wdev = dev->ieee80211_ptr;
 116         struct ieee80211_mgmt *mgmt = (void *)buf;
 117
 118         ASSERT_WDEV_LOCK(wdev);
 119
 120         trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 121
 122         if (WARN_ON(len < 2))
 123                 return;
 124
 125         if (ieee80211_is_auth(mgmt->frame_control))
 126                 cfg80211_process_auth(wdev, buf, len);
 127         else if (ieee80211_is_deauth(mgmt->frame_control))
 128                 cfg80211_process_deauth(wdev, buf, len);
 129         else if (ieee80211_is_disassoc(mgmt->frame_control))
 130                 cfg80211_process_disassoc(wdev, buf, len);
 131 }
 132 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 133
 134 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 135 {
 136         struct wireless_dev *wdev = dev->ieee80211_ptr;
 137         struct wiphy *wiphy = wdev->wiphy;
 138         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 139
 140         trace_cfg80211_send_auth_timeout(dev, addr);
 141
 142         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 143         cfg80211_sme_auth_timeout(wdev);
 144 }
 145 EXPORT_SYMBOL(cfg80211_auth_timeout);
 146
 147 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
 148 {
 149         struct wireless_dev *wdev = dev->ieee80211_ptr;
 150         struct wiphy *wiphy = wdev->wiphy;
 151         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 152
 153         trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
 154
 155         nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
 156         cfg80211_sme_assoc_timeout(wdev);
 157
 158         cfg80211_unhold_bss(bss_from_pub(bss));
 159         cfg80211_put_bss(wiphy, bss);
 160 }
 161 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 162
 163 void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
 164 {
 165         struct wireless_dev *wdev = dev->ieee80211_ptr;
 166         struct wiphy *wiphy = wdev->wiphy;
 167
 168         cfg80211_sme_abandon_assoc(wdev);
 169
 170         cfg80211_unhold_bss(bss_from_pub(bss));
 171         cfg80211_put_bss(wiphy, bss);
 172 }
 173 EXPORT_SYMBOL(cfg80211_abandon_assoc);
 174
 175 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 176 {
 177         struct wireless_dev *wdev = dev->ieee80211_ptr;
 178         struct ieee80211_mgmt *mgmt = (void *)buf;
 179
 180         ASSERT_WDEV_LOCK(wdev);
 181
 182         trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
 183
 184         if (WARN_ON(len < 2))
 185                 return;
 186
 187         if (ieee80211_is_deauth(mgmt->frame_control))
 188                 cfg80211_process_deauth(wdev, buf, len);
 189         else
 190                 cfg80211_process_disassoc(wdev, buf, len);
 191 }
 192 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 193
 194 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 195                                   enum nl80211_key_type key_type, int key_id,
 196                                   const u8 *tsc, gfp_t gfp)
 197 {
 198         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 199         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 200 #ifdef CONFIG_CFG80211_WEXT
 201         union iwreq_data wrqu;
 202         char *buf = kmalloc(128, gfp);
 203
 204         if (buf) {
 205                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 206                         "keyid=%d %scast addr=%pM)", key_id,
 207                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 208                         addr);
 209                 memset(&wrqu, 0, sizeof(wrqu));
 210                 wrqu.data.length = strlen(buf);
 211                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 212                 kfree(buf);
 213         }
 214 #endif
 215
 216         trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 217         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 218 }
 219 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 220
 221 /* some MLME handling for userspace SME */
 222 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 223                        struct net_device *dev,
 224                        struct ieee80211_channel *chan,
 225                        enum nl80211_auth_type auth_type,
 226                        const u8 *bssid,
 227                        const u8 *ssid, int ssid_len,
 228                        const u8 *ie, int ie_len,
 229                        const u8 *key, int key_len, int key_idx,
 230                        const u8 *auth_data, int auth_data_len)
 231 {
 232         struct wireless_dev *wdev = dev->ieee80211_ptr;
 233         struct cfg80211_auth_request req = {
 234                 .ie = ie,
 235                 .ie_len = ie_len,
 236                 .auth_data = auth_data,
 237                 .auth_data_len = auth_data_len,
 238                 .auth_type = auth_type,
 239                 .key = key,
 240                 .key_len = key_len,
 241                 .key_idx = key_idx,
 242         };
 243         int err;
 244
 245         ASSERT_WDEV_LOCK(wdev);
 246
 247         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 248                 if (!key || !key_len || key_idx < 0 || key_idx > 3)
 249                         return -EINVAL;
 250
 251         if (wdev->current_bss &&
 252             ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
 253                 return -EALREADY;
 254
 255         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 256                                    IEEE80211_BSS_TYPE_ESS,
 257                                    IEEE80211_PRIVACY_ANY);
 258         if (!req.bss)
 259                 return -ENOENT;
 260
 261         err = rdev_auth(rdev, dev, &req);
 262
 263         cfg80211_put_bss(&rdev->wiphy, req.bss);
 264         return err;
 265 }
 266
 267 /*  Do a logical ht_capa &= ht_capa_mask.  */
 268 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 269                                const struct ieee80211_ht_cap *ht_capa_mask)
 270 {
 271         int i;
 272         u8 *p1, *p2;
 273         if (!ht_capa_mask) {
 274                 memset(ht_capa, 0, sizeof(*ht_capa));
 275                 return;
 276         }
 277
 278         p1 = (u8*)(ht_capa);
 279         p2 = (u8*)(ht_capa_mask);
 280         for (i = 0; i < sizeof(*ht_capa); i++)
 281                 p1[i] &= p2[i];
 282 }
 283
 284 /*  Do a logical vht_capa &= vht_capa_mask.  */
 285 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 286                                 const struct ieee80211_vht_cap *vht_capa_mask)
 287 {
 288         int i;
 289         u8 *p1, *p2;
 290         if (!vht_capa_mask) {
 291                 memset(vht_capa, 0, sizeof(*vht_capa));
 292                 return;
 293         }
 294
 295         p1 = (u8*)(vht_capa);
 296         p2 = (u8*)(vht_capa_mask);
 297         for (i = 0; i < sizeof(*vht_capa); i++)
 298                 p1[i] &= p2[i];
 299 }
 300
 301 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 302                         struct net_device *dev,
 303                         struct ieee80211_channel *chan,
 304                         const u8 *bssid,
 305                         const u8 *ssid, int ssid_len,
 306                         struct cfg80211_assoc_request *req)
 307 {
 308         struct wireless_dev *wdev = dev->ieee80211_ptr;
 309         int err;
 310
 311         ASSERT_WDEV_LOCK(wdev);
 312
 313         if (wdev->current_bss &&
 314             (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
 315                                                    req->prev_bssid)))
 316                 return -EALREADY;
 317
 318         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 319                                   rdev->wiphy.ht_capa_mod_mask);
 320         cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 321                                    rdev->wiphy.vht_capa_mod_mask);
 322
 323         req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 324                                     IEEE80211_BSS_TYPE_ESS,
 325                                     IEEE80211_PRIVACY_ANY);
 326         if (!req->bss)
 327                 return -ENOENT;
 328
 329         err = rdev_assoc(rdev, dev, req);
 330         if (!err)
 331                 cfg80211_hold_bss(bss_from_pub(req->bss));
 332         else
 333                 cfg80211_put_bss(&rdev->wiphy, req->bss);
 334
 335         return err;
 336 }
 337
 338 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 339                          struct net_device *dev, const u8 *bssid,
 340                          const u8 *ie, int ie_len, u16 reason,
 341                          bool local_state_change)
 342 {
 343         struct wireless_dev *wdev = dev->ieee80211_ptr;
 344         struct cfg80211_deauth_request req = {
 345                 .bssid = bssid,
 346                 .reason_code = reason,
 347                 .ie = ie,
 348                 .ie_len = ie_len,
 349                 .local_state_change = local_state_change,
 350         };
 351
 352         ASSERT_WDEV_LOCK(wdev);
 353
 354         if (local_state_change &&
 355             (!wdev->current_bss ||
 356              !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 357                 return 0;
 358
 359         if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
 360             (wdev->current_bss &&
 361              ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 362                 wdev->conn_owner_nlportid = 0;
 363
 364         return rdev_deauth(rdev, dev, &req);
 365 }
 366
 367 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 368                            struct net_device *dev, const u8 *bssid,
 369                            const u8 *ie, int ie_len, u16 reason,
 370                            bool local_state_change)
 371 {
 372         struct wireless_dev *wdev = dev->ieee80211_ptr;
 373         struct cfg80211_disassoc_request req = {
 374                 .reason_code = reason,
 375                 .local_state_change = local_state_change,
 376                 .ie = ie,
 377                 .ie_len = ie_len,
 378         };
 379         int err;
 380
 381         ASSERT_WDEV_LOCK(wdev);
 382
 383         if (!wdev->current_bss)
 384                 return -ENOTCONN;
 385
 386         if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
 387                 req.bss = &wdev->current_bss->pub;
 388         else
 389                 return -ENOTCONN;
 390
 391         err = rdev_disassoc(rdev, dev, &req);
 392         if (err)
 393                 return err;
 394
 395         /* driver should have reported the disassoc */
 396         WARN_ON(wdev->current_bss);
 397         return 0;
 398 }
 399
 400 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 401                         struct net_device *dev)
 402 {
 403         struct wireless_dev *wdev = dev->ieee80211_ptr;
 404         u8 bssid[ETH_ALEN];
 405
 406         ASSERT_WDEV_LOCK(wdev);
 407
 408         if (!rdev->ops->deauth)
 409                 return;
 410
 411         if (!wdev->current_bss)
 412                 return;
 413
 414         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
 415         cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 416                              WLAN_REASON_DEAUTH_LEAVING, false);
 417 }
 418
 419 struct cfg80211_mgmt_registration {
 420         struct list_head list;
 421         struct wireless_dev *wdev;
 422
 423         u32 nlportid;
 424
 425         int match_len;
 426
 427         __le16 frame_type;
 428
 429         u8 match[];
 430 };
 431
 432 static void
 433 cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device *rdev)
 434 {
 435         struct cfg80211_mgmt_registration *reg;
 436
 437         ASSERT_RTNL();
 438
 439         spin_lock_bh(&rdev->mlme_unreg_lock);
 440         while ((reg = list_first_entry_or_null(&rdev->mlme_unreg,
 441                                                struct cfg80211_mgmt_registration,
 442                                                list))) {
 443                 list_del(&reg->list);
 444                 spin_unlock_bh(&rdev->mlme_unreg_lock);
 445
 446                 if (rdev->ops->mgmt_frame_register) {
 447                         u16 frame_type = le16_to_cpu(reg->frame_type);
 448
 449                         rdev_mgmt_frame_register(rdev, reg->wdev,
 450                                                  frame_type, false);
 451                 }
 452
 453                 kfree(reg);
 454
 455                 spin_lock_bh(&rdev->mlme_unreg_lock);
 456         }
 457         spin_unlock_bh(&rdev->mlme_unreg_lock);
 458 }
 459
 460 void cfg80211_mlme_unreg_wk(struct work_struct *wk)
 461 {
 462         struct cfg80211_registered_device *rdev;
 463
 464         rdev = container_of(wk, struct cfg80211_registered_device,
 465                             mlme_unreg_wk);
 466
 467         rtnl_lock();
 468         cfg80211_process_mlme_unregistrations(rdev);
 469         rtnl_unlock();
 470 }
 471
 472 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 473                                 u16 frame_type, const u8 *match_data,
 474                                 int match_len, struct netlink_ext_ack *extack)
 475 {
 476         struct wiphy *wiphy = wdev->wiphy;
 477         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 478         struct cfg80211_mgmt_registration *reg, *nreg;
 479         int err = 0;
 480         u16 mgmt_type;
 481
 482         if (!wdev->wiphy->mgmt_stypes)
 483                 return -EOPNOTSUPP;
 484
 485         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
 486                 NL_SET_ERR_MSG(extack, "frame type not management");
 487                 return -EINVAL;
 488         }
 489
 490         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
 491                 NL_SET_ERR_MSG(extack, "Invalid frame type");
 492                 return -EINVAL;
 493         }
 494
 495         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 496         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
 497                 NL_SET_ERR_MSG(extack,
 498                                "Registration to specific type not supported");
 499                 return -EINVAL;
 500         }
 501
 502         /*
 503          * To support Pre Association Security Negotiation (PASN), registration
 504          * for authentication frames should be supported. However, as some
 505          * versions of the user space daemons wrongly register to all types of
 506          * authentication frames (which might result in unexpected behavior)
 507          * allow such registration if the request is for a specific
 508          * authentication algorithm number.
 509          */
 510         if (wdev->iftype == NL80211_IFTYPE_STATION &&
 511             (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
 512             !(match_data && match_len >= 2)) {
 513                 NL_SET_ERR_MSG(extack,
 514                                "Authentication algorithm number required");
 515                 return -EINVAL;
 516         }
 517
 518         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 519         if (!nreg)
 520                 return -ENOMEM;
 521
 522         spin_lock_bh(&wdev->mgmt_registrations_lock);
 523
 524         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 525                 int mlen = min(match_len, reg->match_len);
 526
 527                 if (frame_type != le16_to_cpu(reg->frame_type))
 528                         continue;
 529
 530                 if (memcmp(reg->match, match_data, mlen) == 0) {
 531                         NL_SET_ERR_MSG(extack, "Match already configured");
 532                         err = -EALREADY;
 533                         break;
 534                 }
 535         }
 536
 537         if (err) {
 538                 kfree(nreg);
 539                 goto out;
 540         }
 541
 542         memcpy(nreg->match, match_data, match_len);
 543         nreg->match_len = match_len;
 544         nreg->nlportid = snd_portid;
 545         nreg->frame_type = cpu_to_le16(frame_type);
 546         nreg->wdev = wdev;
 547         list_add(&nreg->list, &wdev->mgmt_registrations);
 548         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 549
 550         /* process all unregistrations to avoid driver confusion */
 551         cfg80211_process_mlme_unregistrations(rdev);
 552
 553         if (rdev->ops->mgmt_frame_register)
 554                 rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
 555
 556         return 0;
 557
 558  out:
 559         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 560
 561         return err;
 562 }
 563
 564 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 565 {
 566         struct wiphy *wiphy = wdev->wiphy;
 567         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 568         struct cfg80211_mgmt_registration *reg, *tmp;
 569
 570         spin_lock_bh(&wdev->mgmt_registrations_lock);
 571
 572         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 573                 if (reg->nlportid != nlportid)
 574                         continue;
 575
 576                 list_del(&reg->list);
 577                 spin_lock(&rdev->mlme_unreg_lock);
 578                 list_add_tail(&reg->list, &rdev->mlme_unreg);
 579                 spin_unlock(&rdev->mlme_unreg_lock);
 580
 581                 schedule_work(&rdev->mlme_unreg_wk);
 582         }
 583
 584         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 585
 586         if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 587                 rdev->crit_proto_nlportid = 0;
 588                 rdev_crit_proto_stop(rdev, wdev);
 589         }
 590
 591         if (nlportid == wdev->ap_unexpected_nlportid)
 592                 wdev->ap_unexpected_nlportid = 0;
 593 }
 594
 595 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 596 {
 597         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 598
 599         spin_lock_bh(&wdev->mgmt_registrations_lock);
 600         spin_lock(&rdev->mlme_unreg_lock);
 601         list_splice_tail_init(&wdev->mgmt_registrations, &rdev->mlme_unreg);
 602         spin_unlock(&rdev->mlme_unreg_lock);
 603         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 604
 605         cfg80211_process_mlme_unregistrations(rdev);
 606 }
 607
 608 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 609                           struct wireless_dev *wdev,
 610                           struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 611 {
 612         const struct ieee80211_mgmt *mgmt;
 613         u16 stype;
 614
 615         if (!wdev->wiphy->mgmt_stypes)
 616                 return -EOPNOTSUPP;
 617
 618         if (!rdev->ops->mgmt_tx)
 619                 return -EOPNOTSUPP;
 620
 621         if (params->len < 24 + 1)
 622                 return -EINVAL;
 623
 624         mgmt = (const struct ieee80211_mgmt *)params->buf;
 625
 626         if (!ieee80211_is_mgmt(mgmt->frame_control))
 627                 return -EINVAL;
 628
 629         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 630         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 631                 return -EINVAL;
 632
 633         if (ieee80211_is_action(mgmt->frame_control) &&
 634             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 635                 int err = 0;
 636
 637                 wdev_lock(wdev);
 638
 639                 switch (wdev->iftype) {
 640                 case NL80211_IFTYPE_ADHOC:
 641                 case NL80211_IFTYPE_STATION:
 642                 case NL80211_IFTYPE_P2P_CLIENT:
 643                         if (!wdev->current_bss) {
 644                                 err = -ENOTCONN;
 645                                 break;
 646                         }
 647
 648                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 649                                               mgmt->bssid)) {
 650                                 err = -ENOTCONN;
 651                                 break;
 652                         }
 653
 654                         /*
 655                          * check for IBSS DA must be done by driver as
 656                          * cfg80211 doesn't track the stations
 657                          */
 658                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 659                                 break;
 660
 661                         /* for station, check that DA is the AP */
 662                         if (!ether_addr_equal(wdev->current_bss->pub.bssid,
 663                                               mgmt->da)) {
 664                                 err = -ENOTCONN;
 665                                 break;
 666                         }
 667                         break;
 668                 case NL80211_IFTYPE_AP:
 669                 case NL80211_IFTYPE_P2P_GO:
 670                 case NL80211_IFTYPE_AP_VLAN:
 671                         if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
 672                                 err = -EINVAL;
 673                         break;
 674                 case NL80211_IFTYPE_MESH_POINT:
 675                         if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 676                                 err = -EINVAL;
 677                                 break;
 678                         }
 679                         /*
 680                          * check for mesh DA must be done by driver as
 681                          * cfg80211 doesn't track the stations
 682                          */
 683                         break;
 684                 case NL80211_IFTYPE_P2P_DEVICE:
 685                         /*
 686                          * fall through, P2P device only supports
 687                          * public action frames
 688                          */
 689                 case NL80211_IFTYPE_NAN:
 690                 default:
 691                         err = -EOPNOTSUPP;
 692                         break;
 693                 }
 694                 wdev_unlock(wdev);
 695
 696                 if (err)
 697                         return err;
 698         }
 699
 700         if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) {
 701                 /* Allow random TA to be used with Public Action frames if the
 702                  * driver has indicated support for this. Otherwise, only allow
 703                  * the local address to be used.
 704                  */
 705                 if (!ieee80211_is_action(mgmt->frame_control) ||
 706                     mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
 707                         return -EINVAL;
 708                 if (!wdev->current_bss &&
 709                     !wiphy_ext_feature_isset(
 710                             &rdev->wiphy,
 711                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
 712                         return -EINVAL;
 713                 if (wdev->current_bss &&
 714                     !wiphy_ext_feature_isset(
 715                             &rdev->wiphy,
 716                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
 717                         return -EINVAL;
 718         }
 719
 720         /* Transmit the Action frame as requested by user space */
 721         return rdev_mgmt_tx(rdev, wdev, params, cookie);
 722 }
 723
 724 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
 725                       const u8 *buf, size_t len, u32 flags)
 726 {
 727         struct wiphy *wiphy = wdev->wiphy;
 728         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 729         struct cfg80211_mgmt_registration *reg;
 730         const struct ieee80211_txrx_stypes *stypes =
 731                 &wiphy->mgmt_stypes[wdev->iftype];
 732         struct ieee80211_mgmt *mgmt = (void *)buf;
 733         const u8 *data;
 734         int data_len;
 735         bool result = false;
 736         __le16 ftype = mgmt->frame_control &
 737                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 738         u16 stype;
 739
 740         trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm);
 741         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 742
 743         if (!(stypes->rx & BIT(stype))) {
 744                 trace_cfg80211_return_bool(false);
 745                 return false;
 746         }
 747
 748         data = buf + ieee80211_hdrlen(mgmt->frame_control);
 749         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
 750
 751         spin_lock_bh(&wdev->mgmt_registrations_lock);
 752
 753         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 754                 if (reg->frame_type != ftype)
 755                         continue;
 756
 757                 if (reg->match_len > data_len)
 758                         continue;
 759
 760                 if (memcmp(reg->match, data, reg->match_len))
 761                         continue;
 762
 763                 /* found match! */
 764
 765                 /* Indicate the received Action frame to user space */
 766                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
 767                                       freq, sig_dbm,
 768                                       buf, len, flags, GFP_ATOMIC))
 769                         continue;
 770
 771                 result = true;
 772                 break;
 773         }
 774
 775         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 776
 777         trace_cfg80211_return_bool(result);
 778         return result;
 779 }
 780 EXPORT_SYMBOL(cfg80211_rx_mgmt);
 781
 782 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
 783 {
 784         cancel_delayed_work(&rdev->dfs_update_channels_wk);
 785         queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
 786 }
 787
 788 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 789 {
 790         struct delayed_work *delayed_work = to_delayed_work(work);
 791         struct cfg80211_registered_device *rdev;
 792         struct cfg80211_chan_def chandef;
 793         struct ieee80211_supported_band *sband;
 794         struct ieee80211_channel *c;
 795         struct wiphy *wiphy;
 796         bool check_again = false;
 797         unsigned long timeout, next_time = 0;
 798         unsigned long time_dfs_update;
 799         enum nl80211_radar_event radar_event;
 800         int bandid, i;
 801
 802         rdev = container_of(delayed_work, struct cfg80211_registered_device,
 803                             dfs_update_channels_wk);
 804         wiphy = &rdev->wiphy;
 805
 806         rtnl_lock();
 807         for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
 808                 sband = wiphy->bands[bandid];
 809                 if (!sband)
 810                         continue;
 811
 812                 for (i = 0; i < sband->n_channels; i++) {
 813                         c = &sband->channels[i];
 814
 815                         if (!(c->flags & IEEE80211_CHAN_RADAR))
 816                                 continue;
 817
 818                         if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
 819                             c->dfs_state != NL80211_DFS_AVAILABLE)
 820                                 continue;
 821
 822                         if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
 823                                 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
 824                                 radar_event = NL80211_RADAR_NOP_FINISHED;
 825                         } else {
 826                                 if (regulatory_pre_cac_allowed(wiphy) ||
 827                                     cfg80211_any_wiphy_oper_chan(wiphy, c))
 828                                         continue;
 829
 830                                 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
 831                                 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
 832                         }
 833
 834                         timeout = c->dfs_state_entered +
 835                                   msecs_to_jiffies(time_dfs_update);
 836
 837                         if (time_after_eq(jiffies, timeout)) {
 838                                 c->dfs_state = NL80211_DFS_USABLE;
 839                                 c->dfs_state_entered = jiffies;
 840
 841                                 cfg80211_chandef_create(&chandef, c,
 842                                                         NL80211_CHAN_NO_HT);
 843
 844                                 nl80211_radar_notify(rdev, &chandef,
 845                                                      radar_event, NULL,
 846                                                      GFP_ATOMIC);
 847
 848                                 regulatory_propagate_dfs_state(wiphy, &chandef,
 849                                                                c->dfs_state,
 850                                                                radar_event);
 851                                 continue;
 852                         }
 853
 854                         if (!check_again)
 855                                 next_time = timeout - jiffies;
 856                         else
 857                                 next_time = min(next_time, timeout - jiffies);
 858                         check_again = true;
 859                 }
 860         }
 861         rtnl_unlock();
 862
 863         /* reschedule if there are other channels waiting to be cleared again */
 864         if (check_again)
 865                 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 866                                    next_time);
 867 }
 868
 869
 870 void cfg80211_radar_event(struct wiphy *wiphy,
 871                           struct cfg80211_chan_def *chandef,
 872                           gfp_t gfp)
 873 {
 874         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 875
 876         trace_cfg80211_radar_event(wiphy, chandef);
 877
 878         /* only set the chandef supplied channel to unavailable, in
 879          * case the radar is detected on only one of multiple channels
 880          * spanned by the chandef.
 881          */
 882         cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 883
 884         cfg80211_sched_dfs_chan_update(rdev);
 885
 886         nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 887
 888         memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
 889         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
 890 }
 891 EXPORT_SYMBOL(cfg80211_radar_event);
 892
 893 void cfg80211_cac_event(struct net_device *netdev,
 894                         const struct cfg80211_chan_def *chandef,
 895                         enum nl80211_radar_event event, gfp_t gfp)
 896 {
 897         struct wireless_dev *wdev = netdev->ieee80211_ptr;
 898         struct wiphy *wiphy = wdev->wiphy;
 899         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 900         unsigned long timeout;
 901
 902         trace_cfg80211_cac_event(netdev, event);
 903
 904         if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
 905                 return;
 906
 907         if (WARN_ON(!wdev->chandef.chan))
 908                 return;
 909
 910         switch (event) {
 911         case NL80211_RADAR_CAC_FINISHED:
 912                 timeout = wdev->cac_start_time +
 913                           msecs_to_jiffies(wdev->cac_time_ms);
 914                 WARN_ON(!time_after_eq(jiffies, timeout));
 915                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
 916                 memcpy(&rdev->cac_done_chandef, chandef,
 917                        sizeof(struct cfg80211_chan_def));
 918                 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
 919                 cfg80211_sched_dfs_chan_update(rdev);
 920                 /* fall through */
 921         case NL80211_RADAR_CAC_ABORTED:
 922                 wdev->cac_started = false;
 923                 break;
 924         case NL80211_RADAR_CAC_STARTED:
 925                 wdev->cac_started = true;
 926                 break;
 927         default:
 928                 WARN_ON(1);
 929                 return;
 930         }
 931
 932         nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
 933 }
 934 EXPORT_SYMBOL(cfg80211_cac_event);