mlme.c 20.3 KB
Newer Older
1 2 3 4 5 6 7 8
/*
 * cfg80211 MLME SAP interface
 *
 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
 */

#include <linux/kernel.h>
#include <linux/module.h>
9
#include <linux/etherdevice.h>
10 11
#include <linux/netdevice.h>
#include <linux/nl80211.h>
12
#include <linux/slab.h>
13
#include <linux/wireless.h>
14
#include <net/cfg80211.h>
15
#include <net/iw_handler.h>
16 17
#include "core.h"
#include "nl80211.h"
18 19
#include "rdev-ops.h"

20

21
void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
22
			    const u8 *buf, size_t len)
23
{
24 25
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
26
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
27 28
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
	u8 *ie = mgmt->u.assoc_resp.variable;
29
	int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
30
	u16 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
31

32
	trace_cfg80211_send_rx_assoc(dev, bss);
33

34 35 36 37 38 39
	/*
	 * This is a bit of a hack, we don't notify userspace of
	 * a (re-)association reply if we tried to send a reassoc
	 * and got a reject -- we only try again with an assoc
	 * frame instead of reassoc.
	 */
40
	if (cfg80211_sme_rx_assoc_resp(wdev, status_code)) {
41
		cfg80211_unhold_bss(bss_from_pub(bss));
42
		cfg80211_put_bss(wiphy, bss);
43
		return;
44
	}
45

46
	nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
47
	/* update current_bss etc., consumes the bss reference */
48 49
	__cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
				  status_code,
50
				  status_code == WLAN_STATUS_SUCCESS, bss);
51
}
52
EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
53

54 55 56 57 58 59 60 61 62 63
static void cfg80211_process_auth(struct wireless_dev *wdev,
				  const u8 *buf, size_t len)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);

	nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
	cfg80211_sme_rx_auth(wdev, buf, len);
}

static void cfg80211_process_deauth(struct wireless_dev *wdev,
64
				    const u8 *buf, size_t len)
65
{
66
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
67
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
J
Johannes Berg 已提交
68
	const u8 *bssid = mgmt->bssid;
69 70
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
71

72
	nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
J
Johannes Berg 已提交
73

74 75 76
	if (!wdev->current_bss ||
	    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
		return;
77

78 79
	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
	cfg80211_sme_deauth(wdev);
J
Johannes Berg 已提交
80
}
81

82
static void cfg80211_process_disassoc(struct wireless_dev *wdev,
83
				      const u8 *buf, size_t len)
84
{
85
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
86
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
J
Johannes Berg 已提交
87
	const u8 *bssid = mgmt->bssid;
88 89
	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
90

91
	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
92

93 94
	if (WARN_ON(!wdev->current_bss ||
		    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
95
		return;
96

97 98
	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
	cfg80211_sme_disassoc(wdev);
J
Johannes Berg 已提交
99
}
100

101 102 103 104 105 106 107 108 109 110 111 112
void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct ieee80211_mgmt *mgmt = (void *)buf;

	ASSERT_WDEV_LOCK(wdev);

	trace_cfg80211_rx_mlme_mgmt(dev, buf, len);

	if (WARN_ON(len < 2))
		return;

113 114 115 116 117 118
	if (ieee80211_is_auth(mgmt->frame_control))
		cfg80211_process_auth(wdev, buf, len);
	else if (ieee80211_is_deauth(mgmt->frame_control))
		cfg80211_process_deauth(wdev, buf, len);
	else if (ieee80211_is_disassoc(mgmt->frame_control))
		cfg80211_process_disassoc(wdev, buf, len);
119 120 121 122
}
EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);

void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
123 124 125 126 127
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

128
	trace_cfg80211_send_auth_timeout(dev, addr);
129 130

	nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
131
	cfg80211_sme_auth_timeout(wdev);
132
}
133
EXPORT_SYMBOL(cfg80211_auth_timeout);
134

135
void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
136
{
137 138
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
139
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
J
Johannes Berg 已提交
140

141
	trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
142

143
	nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
144
	cfg80211_sme_assoc_timeout(wdev);
145

146
	cfg80211_unhold_bss(bss_from_pub(bss));
147
	cfg80211_put_bss(wiphy, bss);
148
}
149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
EXPORT_SYMBOL(cfg80211_assoc_timeout);

void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct ieee80211_mgmt *mgmt = (void *)buf;

	ASSERT_WDEV_LOCK(wdev);

	trace_cfg80211_tx_mlme_mgmt(dev, buf, len);

	if (WARN_ON(len < 2))
		return;

	if (ieee80211_is_deauth(mgmt->frame_control))
164
		cfg80211_process_deauth(wdev, buf, len);
165
	else
166
		cfg80211_process_disassoc(wdev, buf, len);
167 168
}
EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
169

170 171
void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
				  enum nl80211_key_type key_type, int key_id,
172
				  const u8 *tsc, gfp_t gfp)
173 174 175
{
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
J
Johannes Berg 已提交
176
#ifdef CONFIG_CFG80211_WEXT
177
	union iwreq_data wrqu;
178
	char *buf = kmalloc(128, gfp);
179 180 181 182 183 184 185 186 187 188 189 190 191

	if (buf) {
		sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
			"keyid=%d %scast addr=%pM)", key_id,
			key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
			addr);
		memset(&wrqu, 0, sizeof(wrqu));
		wrqu.data.length = strlen(buf);
		wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
		kfree(buf);
	}
#endif

192
	trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
193
	nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
194 195
}
EXPORT_SYMBOL(cfg80211_michael_mic_failure);
J
Johannes Berg 已提交
196 197

/* some MLME handling for userspace SME */
198 199 200 201 202 203 204 205 206
int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
		       struct net_device *dev,
		       struct ieee80211_channel *chan,
		       enum nl80211_auth_type auth_type,
		       const u8 *bssid,
		       const u8 *ssid, int ssid_len,
		       const u8 *ie, int ie_len,
		       const u8 *key, int key_len, int key_idx,
		       const u8 *sae_data, int sae_data_len)
J
Johannes Berg 已提交
207 208
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
209 210 211 212 213 214 215 216 217 218
	struct cfg80211_auth_request req = {
		.ie = ie,
		.ie_len = ie_len,
		.sae_data = sae_data,
		.sae_data_len = sae_data_len,
		.auth_type = auth_type,
		.key = key,
		.key_len = key_len,
		.key_idx = key_idx,
	};
219
	int err;
J
Johannes Berg 已提交
220

J
Johannes Berg 已提交
221 222
	ASSERT_WDEV_LOCK(wdev);

J
Johannes Berg 已提交
223 224 225 226
	if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
		if (!key || !key_len || key_idx < 0 || key_idx > 4)
			return -EINVAL;

227
	if (wdev->current_bss &&
228
	    ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
229 230
		return -EALREADY;

J
Johannes Berg 已提交
231 232 233 234 235
	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
				   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
	if (!req.bss)
		return -ENOENT;

236 237 238 239 240
	err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
				    CHAN_MODE_SHARED);
	if (err)
		goto out;

241
	err = rdev_auth(rdev, dev, &req);
J
Johannes Berg 已提交
242

243
out:
244
	cfg80211_put_bss(&rdev->wiphy, req.bss);
J
Johannes Berg 已提交
245 246 247
	return err;
}

248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264
/*  Do a logical ht_capa &= ht_capa_mask.  */
void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
			       const struct ieee80211_ht_cap *ht_capa_mask)
{
	int i;
	u8 *p1, *p2;
	if (!ht_capa_mask) {
		memset(ht_capa, 0, sizeof(*ht_capa));
		return;
	}

	p1 = (u8*)(ht_capa);
	p2 = (u8*)(ht_capa_mask);
	for (i = 0; i<sizeof(*ht_capa); i++)
		p1[i] &= p2[i];
}

265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281
/*  Do a logical ht_capa &= ht_capa_mask.  */
void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
				const struct ieee80211_vht_cap *vht_capa_mask)
{
	int i;
	u8 *p1, *p2;
	if (!vht_capa_mask) {
		memset(vht_capa, 0, sizeof(*vht_capa));
		return;
	}

	p1 = (u8*)(vht_capa);
	p2 = (u8*)(vht_capa_mask);
	for (i = 0; i < sizeof(*vht_capa); i++)
		p1[i] &= p2[i];
}

282 283 284 285 286 287
int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
			struct net_device *dev,
			struct ieee80211_channel *chan,
			const u8 *bssid,
			const u8 *ssid, int ssid_len,
			struct cfg80211_assoc_request *req)
J
Johannes Berg 已提交
288 289
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
290
	int err;
J
Johannes Berg 已提交
291

J
Johannes Berg 已提交
292 293
	ASSERT_WDEV_LOCK(wdev);

294 295 296
	if (wdev->current_bss &&
	    (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
						   req->prev_bssid)))
J
Johannes Berg 已提交
297 298
		return -EALREADY;

299
	cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
300
				  rdev->wiphy.ht_capa_mod_mask);
301
	cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
302
				   rdev->wiphy.vht_capa_mod_mask);
303

304 305
	req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
				    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
306
	if (!req->bss)
J
Johannes Berg 已提交
307 308
		return -ENOENT;

309
	err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
310 311 312
	if (err)
		goto out;

313
	err = rdev_assoc(rdev, dev, req);
314 315
	if (!err)
		cfg80211_hold_bss(bss_from_pub(req->bss));
J
Johannes Berg 已提交
316

317
out:
318
	if (err)
319
		cfg80211_put_bss(&rdev->wiphy, req->bss);
J
Johannes Berg 已提交
320 321 322 323

	return err;
}

324 325 326 327
int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
			 struct net_device *dev, const u8 *bssid,
			 const u8 *ie, int ie_len, u16 reason,
			 bool local_state_change)
J
Johannes Berg 已提交
328 329
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
330 331 332 333 334
	struct cfg80211_deauth_request req = {
		.bssid = bssid,
		.reason_code = reason,
		.ie = ie,
		.ie_len = ie_len,
335
		.local_state_change = local_state_change,
336
	};
J
Johannes Berg 已提交
337

J
Johannes Berg 已提交
338 339
	ASSERT_WDEV_LOCK(wdev);

340 341 342
	if (local_state_change &&
	    (!wdev->current_bss ||
	     !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
343
		return 0;
J
Johannes Berg 已提交
344

345
	return rdev_deauth(rdev, dev, &req);
J
Johannes Berg 已提交
346 347
}

348 349 350 351
int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
			   struct net_device *dev, const u8 *bssid,
			   const u8 *ie, int ie_len, u16 reason,
			   bool local_state_change)
J
Johannes Berg 已提交
352 353
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
354 355 356 357 358 359
	struct cfg80211_disassoc_request req = {
		.reason_code = reason,
		.local_state_change = local_state_change,
		.ie = ie,
		.ie_len = ie_len,
	};
360
	int err;
J
Johannes Berg 已提交
361

J
Johannes Berg 已提交
362 363
	ASSERT_WDEV_LOCK(wdev);

364
	if (!wdev->current_bss)
365 366
		return -ENOTCONN;

367
	if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
J
Johannes Berg 已提交
368 369 370 371
		req.bss = &wdev->current_bss->pub;
	else
		return -ENOTCONN;

372 373 374 375 376 377 378
	err = rdev_disassoc(rdev, dev, &req);
	if (err)
		return err;

	/* driver should have reported the disassoc */
	WARN_ON(wdev->current_bss);
	return 0;
J
Johannes Berg 已提交
379 380
}

J
Johannes Berg 已提交
381 382 383 384
void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
			struct net_device *dev)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
385
	u8 bssid[ETH_ALEN];
J
Johannes Berg 已提交
386

J
Johannes Berg 已提交
387 388
	ASSERT_WDEV_LOCK(wdev);

J
Johannes Berg 已提交
389 390 391
	if (!rdev->ops->deauth)
		return;

392 393
	if (!wdev->current_bss)
		return;
J
Johannes Berg 已提交
394

395
	memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
396 397
	cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
			     WLAN_REASON_DEAUTH_LEAVING, false);
J
Johannes Berg 已提交
398
}
399

400
struct cfg80211_mgmt_registration {
401 402
	struct list_head list;

403
	u32 nlportid;
404 405 406

	int match_len;

407 408
	__le16 frame_type;

409 410 411
	u8 match[];
};

412
int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
413 414
				u16 frame_type, const u8 *match_data,
				int match_len)
415
{
416 417
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
418
	struct cfg80211_mgmt_registration *reg, *nreg;
419
	int err = 0;
420 421 422 423 424 425 426 427 428 429 430 431 432 433
	u16 mgmt_type;

	if (!wdev->wiphy->mgmt_stypes)
		return -EOPNOTSUPP;

	if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
		return -EINVAL;

	if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
		return -EINVAL;

	mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
		return -EINVAL;
434 435 436 437 438

	nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
	if (!nreg)
		return -ENOMEM;

439
	spin_lock_bh(&wdev->mgmt_registrations_lock);
440

441
	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
442 443
		int mlen = min(match_len, reg->match_len);

444 445 446
		if (frame_type != le16_to_cpu(reg->frame_type))
			continue;

447 448 449 450 451 452 453 454 455 456 457 458 459
		if (memcmp(reg->match, match_data, mlen) == 0) {
			err = -EALREADY;
			break;
		}
	}

	if (err) {
		kfree(nreg);
		goto out;
	}

	memcpy(nreg->match, match_data, match_len);
	nreg->match_len = match_len;
460
	nreg->nlportid = snd_portid;
461 462
	nreg->frame_type = cpu_to_le16(frame_type);
	list_add(&nreg->list, &wdev->mgmt_registrations);
463

464
	if (rdev->ops->mgmt_frame_register)
465
		rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
466

467
 out:
468
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
469

470 471 472
	return err;
}

473
void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
474
{
475 476
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
477
	struct cfg80211_mgmt_registration *reg, *tmp;
478

479
	spin_lock_bh(&wdev->mgmt_registrations_lock);
480

481
	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
482
		if (reg->nlportid != nlportid)
483 484 485 486 487
			continue;

		if (rdev->ops->mgmt_frame_register) {
			u16 frame_type = le16_to_cpu(reg->frame_type);

488 489
			rdev_mgmt_frame_register(rdev, wdev,
						 frame_type, false);
490
		}
491 492 493

		list_del(&reg->list);
		kfree(reg);
494 495
	}

496
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
497

498 499 500 501 502
	if (nlportid && rdev->crit_proto_nlportid == nlportid) {
		rdev->crit_proto_nlportid = 0;
		rdev_crit_proto_stop(rdev, wdev);
	}

503 504
	if (nlportid == wdev->ap_unexpected_nlportid)
		wdev->ap_unexpected_nlportid = 0;
505 506
}

507
void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
508
{
509
	struct cfg80211_mgmt_registration *reg, *tmp;
510

511
	spin_lock_bh(&wdev->mgmt_registrations_lock);
512

513
	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
514 515 516 517
		list_del(&reg->list);
		kfree(reg);
	}

518
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
519 520
}

521
int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
522
			  struct wireless_dev *wdev,
523
			  struct ieee80211_channel *chan, bool offchan,
524 525
			  unsigned int wait, const u8 *buf, size_t len,
			  bool no_cck, bool dont_wait_for_ack, u64 *cookie)
526 527
{
	const struct ieee80211_mgmt *mgmt;
528 529 530 531
	u16 stype;

	if (!wdev->wiphy->mgmt_stypes)
		return -EOPNOTSUPP;
532

533
	if (!rdev->ops->mgmt_tx)
534
		return -EOPNOTSUPP;
535

536 537 538 539
	if (len < 24 + 1)
		return -EINVAL;

	mgmt = (const struct ieee80211_mgmt *) buf;
540 541

	if (!ieee80211_is_mgmt(mgmt->frame_control))
542
		return -EINVAL;
543 544 545 546 547 548 549

	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
		return -EINVAL;

	if (ieee80211_is_action(mgmt->frame_control) &&
	    mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
550 551
		int err = 0;

552 553
		wdev_lock(wdev);

554 555 556 557 558 559 560 561 562
		switch (wdev->iftype) {
		case NL80211_IFTYPE_ADHOC:
		case NL80211_IFTYPE_STATION:
		case NL80211_IFTYPE_P2P_CLIENT:
			if (!wdev->current_bss) {
				err = -ENOTCONN;
				break;
			}

563 564
			if (!ether_addr_equal(wdev->current_bss->pub.bssid,
					      mgmt->bssid)) {
565 566 567 568 569 570 571 572 573 574
				err = -ENOTCONN;
				break;
			}

			/*
			 * check for IBSS DA must be done by driver as
			 * cfg80211 doesn't track the stations
			 */
			if (wdev->iftype == NL80211_IFTYPE_ADHOC)
				break;
575

576
			/* for station, check that DA is the AP */
577 578
			if (!ether_addr_equal(wdev->current_bss->pub.bssid,
					      mgmt->da)) {
579 580 581 582 583 584 585
				err = -ENOTCONN;
				break;
			}
			break;
		case NL80211_IFTYPE_AP:
		case NL80211_IFTYPE_P2P_GO:
		case NL80211_IFTYPE_AP_VLAN:
586
			if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
587 588
				err = -EINVAL;
			break;
589
		case NL80211_IFTYPE_MESH_POINT:
590
			if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
591 592 593 594 595 596 597 598
				err = -EINVAL;
				break;
			}
			/*
			 * check for mesh DA must be done by driver as
			 * cfg80211 doesn't track the stations
			 */
			break;
599 600 601 602 603
		case NL80211_IFTYPE_P2P_DEVICE:
			/*
			 * fall through, P2P device only supports
			 * public action frames
			 */
604 605 606 607
		default:
			err = -EOPNOTSUPP;
			break;
		}
608
		wdev_unlock(wdev);
609 610 611

		if (err)
			return err;
612 613
	}

614
	if (!ether_addr_equal(mgmt->sa, wdev_address(wdev)))
615 616 617
		return -EINVAL;

	/* Transmit the Action frame as requested by user space */
618 619 620
	return rdev_mgmt_tx(rdev, wdev, chan, offchan,
			    wait, buf, len, no_cck, dont_wait_for_ack,
			    cookie);
621 622
}

623
bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
624
		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
625 626 627
{
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
628 629 630 631 632 633
	struct cfg80211_mgmt_registration *reg;
	const struct ieee80211_txrx_stypes *stypes =
		&wiphy->mgmt_stypes[wdev->iftype];
	struct ieee80211_mgmt *mgmt = (void *)buf;
	const u8 *data;
	int data_len;
634
	bool result = false;
635 636 637
	__le16 ftype = mgmt->frame_control &
		cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
	u16 stype;
638

639
	trace_cfg80211_rx_mgmt(wdev, freq, sig_mbm);
640
	stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
641

642 643
	if (!(stypes->rx & BIT(stype))) {
		trace_cfg80211_return_bool(false);
644
		return false;
645
	}
646

647 648 649 650 651 652 653 654
	data = buf + ieee80211_hdrlen(mgmt->frame_control);
	data_len = len - ieee80211_hdrlen(mgmt->frame_control);

	spin_lock_bh(&wdev->mgmt_registrations_lock);

	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
		if (reg->frame_type != ftype)
			continue;
655

656
		if (reg->match_len > data_len)
657 658
			continue;

659
		if (memcmp(reg->match, data, reg->match_len))
660 661 662 663 664
			continue;

		/* found match! */

		/* Indicate the received Action frame to user space */
665
		if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
666
				      freq, sig_mbm,
667
				      buf, len, flags, gfp))
668 669 670 671 672 673
			continue;

		result = true;
		break;
	}

674
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
675

676
	trace_cfg80211_return_bool(result);
677 678
	return result;
}
679
EXPORT_SYMBOL(cfg80211_rx_mgmt);
680

681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697
void cfg80211_dfs_channels_update_work(struct work_struct *work)
{
	struct delayed_work *delayed_work;
	struct cfg80211_registered_device *rdev;
	struct cfg80211_chan_def chandef;
	struct ieee80211_supported_band *sband;
	struct ieee80211_channel *c;
	struct wiphy *wiphy;
	bool check_again = false;
	unsigned long timeout, next_time = 0;
	int bandid, i;

	delayed_work = container_of(work, struct delayed_work, work);
	rdev = container_of(delayed_work, struct cfg80211_registered_device,
			    dfs_update_channels_wk);
	wiphy = &rdev->wiphy;

698
	rtnl_lock();
699 700 701 702 703 704 705 706 707 708 709
	for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
		sband = wiphy->bands[bandid];
		if (!sband)
			continue;

		for (i = 0; i < sband->n_channels; i++) {
			c = &sband->channels[i];

			if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
				continue;

710 711
			timeout = c->dfs_state_entered + msecs_to_jiffies(
					IEEE80211_DFS_MIN_NOP_TIME_MS);
712 713 714

			if (time_after_eq(jiffies, timeout)) {
				c->dfs_state = NL80211_DFS_USABLE;
715 716
				c->dfs_state_entered = jiffies;

717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732
				cfg80211_chandef_create(&chandef, c,
							NL80211_CHAN_NO_HT);

				nl80211_radar_notify(rdev, &chandef,
						     NL80211_RADAR_NOP_FINISHED,
						     NULL, GFP_ATOMIC);
				continue;
			}

			if (!check_again)
				next_time = timeout - jiffies;
			else
				next_time = min(next_time, timeout - jiffies);
			check_again = true;
		}
	}
733
	rtnl_unlock();
734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765

	/* reschedule if there are other channels waiting to be cleared again */
	if (check_again)
		queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
				   next_time);
}


void cfg80211_radar_event(struct wiphy *wiphy,
			  struct cfg80211_chan_def *chandef,
			  gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	unsigned long timeout;

	trace_cfg80211_radar_event(wiphy, chandef);

	/* only set the chandef supplied channel to unavailable, in
	 * case the radar is detected on only one of multiple channels
	 * spanned by the chandef.
	 */
	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);

	timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
	queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
			   timeout);

	nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
}
EXPORT_SYMBOL(cfg80211_radar_event);

void cfg80211_cac_event(struct net_device *netdev,
766
			const struct cfg80211_chan_def *chandef,
767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786
			enum nl80211_radar_event event, gfp_t gfp)
{
	struct wireless_dev *wdev = netdev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	unsigned long timeout;

	trace_cfg80211_cac_event(netdev, event);

	if (WARN_ON(!wdev->cac_started))
		return;

	if (WARN_ON(!wdev->channel))
		return;

	switch (event) {
	case NL80211_RADAR_CAC_FINISHED:
		timeout = wdev->cac_start_time +
			  msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
		WARN_ON(!time_after_eq(jiffies, timeout));
787
		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
788 789 790 791 792 793 794 795 796
		break;
	case NL80211_RADAR_CAC_ABORTED:
		break;
	default:
		WARN_ON(1);
		return;
	}
	wdev->cac_started = false;

797
	nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
798 799
}
EXPORT_SYMBOL(cfg80211_cac_event);