mlme.c 20.2 KB
Newer Older
1 2 3 4 5 6 7 8
/*
 * cfg80211 MLME SAP interface
 *
 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
 */

#include <linux/kernel.h>
#include <linux/module.h>
9
#include <linux/etherdevice.h>
10 11
#include <linux/netdevice.h>
#include <linux/nl80211.h>
12
#include <linux/slab.h>
13
#include <linux/wireless.h>
14
#include <net/cfg80211.h>
15
#include <net/iw_handler.h>
16 17
#include "core.h"
#include "nl80211.h"
18 19
#include "rdev-ops.h"

20

21
void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
22
			    const u8 *buf, size_t len)
23
{
24 25
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
26
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
27 28
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
	u8 *ie = mgmt->u.assoc_resp.variable;
29
	int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
30
	u16 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
31

32
	trace_cfg80211_send_rx_assoc(dev, bss);
33

34 35 36 37 38 39
	/*
	 * This is a bit of a hack, we don't notify userspace of
	 * a (re-)association reply if we tried to send a reassoc
	 * and got a reject -- we only try again with an assoc
	 * frame instead of reassoc.
	 */
40
	if (cfg80211_sme_rx_assoc_resp(wdev, status_code)) {
41
		cfg80211_unhold_bss(bss_from_pub(bss));
42
		cfg80211_put_bss(wiphy, bss);
43
		return;
44
	}
45

46
	nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
47
	/* update current_bss etc., consumes the bss reference */
48 49
	__cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
				  status_code,
50
				  status_code == WLAN_STATUS_SUCCESS, bss);
51
}
52
EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
53

54 55 56 57 58 59 60 61 62 63
static void cfg80211_process_auth(struct wireless_dev *wdev,
				  const u8 *buf, size_t len)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);

	nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
	cfg80211_sme_rx_auth(wdev, buf, len);
}

static void cfg80211_process_deauth(struct wireless_dev *wdev,
64
				    const u8 *buf, size_t len)
65
{
66
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
67
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
J
Johannes Berg 已提交
68
	const u8 *bssid = mgmt->bssid;
69 70
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
71

72
	nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
J
Johannes Berg 已提交
73

74 75 76
	if (!wdev->current_bss ||
	    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
		return;
77

78 79
	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
	cfg80211_sme_deauth(wdev);
J
Johannes Berg 已提交
80
}
81

82
static void cfg80211_process_disassoc(struct wireless_dev *wdev,
83
				      const u8 *buf, size_t len)
84
{
85
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
86
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
J
Johannes Berg 已提交
87
	const u8 *bssid = mgmt->bssid;
88 89
	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
90

91
	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
92

93 94
	if (WARN_ON(!wdev->current_bss ||
		    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
95
		return;
96

97 98
	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
	cfg80211_sme_disassoc(wdev);
J
Johannes Berg 已提交
99
}
100

101 102 103 104 105 106 107 108 109 110 111 112
void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct ieee80211_mgmt *mgmt = (void *)buf;

	ASSERT_WDEV_LOCK(wdev);

	trace_cfg80211_rx_mlme_mgmt(dev, buf, len);

	if (WARN_ON(len < 2))
		return;

113 114 115 116 117 118
	if (ieee80211_is_auth(mgmt->frame_control))
		cfg80211_process_auth(wdev, buf, len);
	else if (ieee80211_is_deauth(mgmt->frame_control))
		cfg80211_process_deauth(wdev, buf, len);
	else if (ieee80211_is_disassoc(mgmt->frame_control))
		cfg80211_process_disassoc(wdev, buf, len);
119 120 121 122
}
EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);

void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
123 124 125 126 127
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

128
	trace_cfg80211_send_auth_timeout(dev, addr);
129 130

	nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
131
	cfg80211_sme_auth_timeout(wdev);
132
}
133
EXPORT_SYMBOL(cfg80211_auth_timeout);
134

135
void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
136
{
137 138
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
139
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
J
Johannes Berg 已提交
140

141
	trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
142

143
	nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
144
	cfg80211_sme_assoc_timeout(wdev);
145

146
	cfg80211_unhold_bss(bss_from_pub(bss));
147
	cfg80211_put_bss(wiphy, bss);
148
}
149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
EXPORT_SYMBOL(cfg80211_assoc_timeout);

void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct ieee80211_mgmt *mgmt = (void *)buf;

	ASSERT_WDEV_LOCK(wdev);

	trace_cfg80211_tx_mlme_mgmt(dev, buf, len);

	if (WARN_ON(len < 2))
		return;

	if (ieee80211_is_deauth(mgmt->frame_control))
164
		cfg80211_process_deauth(wdev, buf, len);
165
	else
166
		cfg80211_process_disassoc(wdev, buf, len);
167 168
}
EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
169

170 171
void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
				  enum nl80211_key_type key_type, int key_id,
172
				  const u8 *tsc, gfp_t gfp)
173 174 175
{
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
J
Johannes Berg 已提交
176
#ifdef CONFIG_CFG80211_WEXT
177
	union iwreq_data wrqu;
178
	char *buf = kmalloc(128, gfp);
179 180 181 182 183 184 185 186 187 188 189 190 191

	if (buf) {
		sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
			"keyid=%d %scast addr=%pM)", key_id,
			key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
			addr);
		memset(&wrqu, 0, sizeof(wrqu));
		wrqu.data.length = strlen(buf);
		wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
		kfree(buf);
	}
#endif

192
	trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
193
	nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
194 195
}
EXPORT_SYMBOL(cfg80211_michael_mic_failure);
J
Johannes Berg 已提交
196 197

/* some MLME handling for userspace SME */
198 199 200 201 202 203 204 205 206
int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
		       struct net_device *dev,
		       struct ieee80211_channel *chan,
		       enum nl80211_auth_type auth_type,
		       const u8 *bssid,
		       const u8 *ssid, int ssid_len,
		       const u8 *ie, int ie_len,
		       const u8 *key, int key_len, int key_idx,
		       const u8 *sae_data, int sae_data_len)
J
Johannes Berg 已提交
207 208
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
209 210 211 212 213 214 215 216 217 218
	struct cfg80211_auth_request req = {
		.ie = ie,
		.ie_len = ie_len,
		.sae_data = sae_data,
		.sae_data_len = sae_data_len,
		.auth_type = auth_type,
		.key = key,
		.key_len = key_len,
		.key_idx = key_idx,
	};
219
	int err;
J
Johannes Berg 已提交
220

J
Johannes Berg 已提交
221 222
	ASSERT_WDEV_LOCK(wdev);

J
Johannes Berg 已提交
223 224 225 226
	if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
		if (!key || !key_len || key_idx < 0 || key_idx > 4)
			return -EINVAL;

227
	if (wdev->current_bss &&
228
	    ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
229 230
		return -EALREADY;

J
Johannes Berg 已提交
231 232 233 234 235
	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
				   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
	if (!req.bss)
		return -ENOENT;

236 237 238 239 240
	err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
				    CHAN_MODE_SHARED);
	if (err)
		goto out;

241
	err = rdev_auth(rdev, dev, &req);
J
Johannes Berg 已提交
242

243
out:
244
	cfg80211_put_bss(&rdev->wiphy, req.bss);
J
Johannes Berg 已提交
245 246 247
	return err;
}

248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264
/*  Do a logical ht_capa &= ht_capa_mask.  */
void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
			       const struct ieee80211_ht_cap *ht_capa_mask)
{
	int i;
	u8 *p1, *p2;
	if (!ht_capa_mask) {
		memset(ht_capa, 0, sizeof(*ht_capa));
		return;
	}

	p1 = (u8*)(ht_capa);
	p2 = (u8*)(ht_capa_mask);
	for (i = 0; i<sizeof(*ht_capa); i++)
		p1[i] &= p2[i];
}

265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281
/*  Do a logical ht_capa &= ht_capa_mask.  */
void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
				const struct ieee80211_vht_cap *vht_capa_mask)
{
	int i;
	u8 *p1, *p2;
	if (!vht_capa_mask) {
		memset(vht_capa, 0, sizeof(*vht_capa));
		return;
	}

	p1 = (u8*)(vht_capa);
	p2 = (u8*)(vht_capa_mask);
	for (i = 0; i < sizeof(*vht_capa); i++)
		p1[i] &= p2[i];
}

282 283 284 285 286 287
int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
			struct net_device *dev,
			struct ieee80211_channel *chan,
			const u8 *bssid,
			const u8 *ssid, int ssid_len,
			struct cfg80211_assoc_request *req)
J
Johannes Berg 已提交
288 289
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
290
	int err;
J
Johannes Berg 已提交
291

J
Johannes Berg 已提交
292 293
	ASSERT_WDEV_LOCK(wdev);

294 295 296
	if (wdev->current_bss &&
	    (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
						   req->prev_bssid)))
J
Johannes Berg 已提交
297 298
		return -EALREADY;

299
	cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
300
				  rdev->wiphy.ht_capa_mod_mask);
301
	cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
302
				   rdev->wiphy.vht_capa_mod_mask);
303

304 305
	req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
				    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
306
	if (!req->bss)
J
Johannes Berg 已提交
307 308
		return -ENOENT;

309
	err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
310 311 312
	if (err)
		goto out;

313
	err = rdev_assoc(rdev, dev, req);
314 315
	if (!err)
		cfg80211_hold_bss(bss_from_pub(req->bss));
J
Johannes Berg 已提交
316

317
out:
318
	if (err)
319
		cfg80211_put_bss(&rdev->wiphy, req->bss);
J
Johannes Berg 已提交
320 321 322 323

	return err;
}

324 325 326 327
int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
			 struct net_device *dev, const u8 *bssid,
			 const u8 *ie, int ie_len, u16 reason,
			 bool local_state_change)
J
Johannes Berg 已提交
328 329
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
330 331 332 333 334
	struct cfg80211_deauth_request req = {
		.bssid = bssid,
		.reason_code = reason,
		.ie = ie,
		.ie_len = ie_len,
335
		.local_state_change = local_state_change,
336
	};
J
Johannes Berg 已提交
337

J
Johannes Berg 已提交
338 339
	ASSERT_WDEV_LOCK(wdev);

340 341 342
	if (local_state_change &&
	    (!wdev->current_bss ||
	     !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
343
		return 0;
J
Johannes Berg 已提交
344

345
	return rdev_deauth(rdev, dev, &req);
J
Johannes Berg 已提交
346 347
}

348 349 350 351
int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
			   struct net_device *dev, const u8 *bssid,
			   const u8 *ie, int ie_len, u16 reason,
			   bool local_state_change)
J
Johannes Berg 已提交
352 353
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
354 355 356 357 358 359
	struct cfg80211_disassoc_request req = {
		.reason_code = reason,
		.local_state_change = local_state_change,
		.ie = ie,
		.ie_len = ie_len,
	};
360
	int err;
J
Johannes Berg 已提交
361

J
Johannes Berg 已提交
362 363
	ASSERT_WDEV_LOCK(wdev);

364
	if (!wdev->current_bss)
365 366
		return -ENOTCONN;

367
	if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
J
Johannes Berg 已提交
368 369 370 371
		req.bss = &wdev->current_bss->pub;
	else
		return -ENOTCONN;

372 373 374 375 376 377 378
	err = rdev_disassoc(rdev, dev, &req);
	if (err)
		return err;

	/* driver should have reported the disassoc */
	WARN_ON(wdev->current_bss);
	return 0;
J
Johannes Berg 已提交
379 380
}

J
Johannes Berg 已提交
381 382 383 384
void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
			struct net_device *dev)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
385
	u8 bssid[ETH_ALEN];
J
Johannes Berg 已提交
386

J
Johannes Berg 已提交
387 388
	ASSERT_WDEV_LOCK(wdev);

J
Johannes Berg 已提交
389 390 391
	if (!rdev->ops->deauth)
		return;

392 393
	if (!wdev->current_bss)
		return;
J
Johannes Berg 已提交
394

395
	memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
396 397
	cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
			     WLAN_REASON_DEAUTH_LEAVING, false);
J
Johannes Berg 已提交
398
}
399

400
struct cfg80211_mgmt_registration {
401 402
	struct list_head list;

403
	u32 nlportid;
404 405 406

	int match_len;

407 408
	__le16 frame_type;

409 410 411
	u8 match[];
};

412
int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
413 414
				u16 frame_type, const u8 *match_data,
				int match_len)
415
{
416 417
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
418
	struct cfg80211_mgmt_registration *reg, *nreg;
419
	int err = 0;
420 421 422 423 424 425 426 427 428 429 430 431 432 433
	u16 mgmt_type;

	if (!wdev->wiphy->mgmt_stypes)
		return -EOPNOTSUPP;

	if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
		return -EINVAL;

	if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
		return -EINVAL;

	mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
		return -EINVAL;
434 435 436 437 438

	nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
	if (!nreg)
		return -ENOMEM;

439
	spin_lock_bh(&wdev->mgmt_registrations_lock);
440

441
	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
442 443
		int mlen = min(match_len, reg->match_len);

444 445 446
		if (frame_type != le16_to_cpu(reg->frame_type))
			continue;

447 448 449 450 451 452 453 454 455 456 457 458 459
		if (memcmp(reg->match, match_data, mlen) == 0) {
			err = -EALREADY;
			break;
		}
	}

	if (err) {
		kfree(nreg);
		goto out;
	}

	memcpy(nreg->match, match_data, match_len);
	nreg->match_len = match_len;
460
	nreg->nlportid = snd_portid;
461 462
	nreg->frame_type = cpu_to_le16(frame_type);
	list_add(&nreg->list, &wdev->mgmt_registrations);
463

464
	if (rdev->ops->mgmt_frame_register)
465
		rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
466

467
 out:
468
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
469

470 471 472
	return err;
}

473
void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
474
{
475 476
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
477
	struct cfg80211_mgmt_registration *reg, *tmp;
478

479
	spin_lock_bh(&wdev->mgmt_registrations_lock);
480

481
	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
482
		if (reg->nlportid != nlportid)
483 484 485 486 487
			continue;

		if (rdev->ops->mgmt_frame_register) {
			u16 frame_type = le16_to_cpu(reg->frame_type);

488 489
			rdev_mgmt_frame_register(rdev, wdev,
						 frame_type, false);
490
		}
491 492 493

		list_del(&reg->list);
		kfree(reg);
494 495
	}

496
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
497

498 499 500 501 502
	if (nlportid && rdev->crit_proto_nlportid == nlportid) {
		rdev->crit_proto_nlportid = 0;
		rdev_crit_proto_stop(rdev, wdev);
	}

503 504
	if (nlportid == wdev->ap_unexpected_nlportid)
		wdev->ap_unexpected_nlportid = 0;
505 506
}

507
void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
508
{
509
	struct cfg80211_mgmt_registration *reg, *tmp;
510

511
	spin_lock_bh(&wdev->mgmt_registrations_lock);
512

513
	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
514 515 516 517
		list_del(&reg->list);
		kfree(reg);
	}

518
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
519 520
}

521
int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
522
			  struct wireless_dev *wdev,
523
			  struct cfg80211_mgmt_tx_params *params, u64 *cookie)
524 525
{
	const struct ieee80211_mgmt *mgmt;
526 527 528 529
	u16 stype;

	if (!wdev->wiphy->mgmt_stypes)
		return -EOPNOTSUPP;
530

531
	if (!rdev->ops->mgmt_tx)
532
		return -EOPNOTSUPP;
533

534
	if (params->len < 24 + 1)
535 536
		return -EINVAL;

537
	mgmt = (const struct ieee80211_mgmt *)params->buf;
538 539

	if (!ieee80211_is_mgmt(mgmt->frame_control))
540
		return -EINVAL;
541 542 543 544 545 546 547

	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
	if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
		return -EINVAL;

	if (ieee80211_is_action(mgmt->frame_control) &&
	    mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
548 549
		int err = 0;

550 551
		wdev_lock(wdev);

552 553 554 555 556 557 558 559 560
		switch (wdev->iftype) {
		case NL80211_IFTYPE_ADHOC:
		case NL80211_IFTYPE_STATION:
		case NL80211_IFTYPE_P2P_CLIENT:
			if (!wdev->current_bss) {
				err = -ENOTCONN;
				break;
			}

561 562
			if (!ether_addr_equal(wdev->current_bss->pub.bssid,
					      mgmt->bssid)) {
563 564 565 566 567 568 569 570 571 572
				err = -ENOTCONN;
				break;
			}

			/*
			 * check for IBSS DA must be done by driver as
			 * cfg80211 doesn't track the stations
			 */
			if (wdev->iftype == NL80211_IFTYPE_ADHOC)
				break;
573

574
			/* for station, check that DA is the AP */
575 576
			if (!ether_addr_equal(wdev->current_bss->pub.bssid,
					      mgmt->da)) {
577 578 579 580 581 582 583
				err = -ENOTCONN;
				break;
			}
			break;
		case NL80211_IFTYPE_AP:
		case NL80211_IFTYPE_P2P_GO:
		case NL80211_IFTYPE_AP_VLAN:
584
			if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
585 586
				err = -EINVAL;
			break;
587
		case NL80211_IFTYPE_MESH_POINT:
588
			if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
589 590 591 592 593 594 595 596
				err = -EINVAL;
				break;
			}
			/*
			 * check for mesh DA must be done by driver as
			 * cfg80211 doesn't track the stations
			 */
			break;
597 598 599 600 601
		case NL80211_IFTYPE_P2P_DEVICE:
			/*
			 * fall through, P2P device only supports
			 * public action frames
			 */
602 603 604 605
		default:
			err = -EOPNOTSUPP;
			break;
		}
606
		wdev_unlock(wdev);
607 608 609

		if (err)
			return err;
610 611
	}

612
	if (!ether_addr_equal(mgmt->sa, wdev_address(wdev)))
613 614 615
		return -EINVAL;

	/* Transmit the Action frame as requested by user space */
616
	return rdev_mgmt_tx(rdev, wdev, params, cookie);
617 618
}

619
bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
620
		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
621 622 623
{
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
624 625 626 627 628 629
	struct cfg80211_mgmt_registration *reg;
	const struct ieee80211_txrx_stypes *stypes =
		&wiphy->mgmt_stypes[wdev->iftype];
	struct ieee80211_mgmt *mgmt = (void *)buf;
	const u8 *data;
	int data_len;
630
	bool result = false;
631 632 633
	__le16 ftype = mgmt->frame_control &
		cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
	u16 stype;
634

635
	trace_cfg80211_rx_mgmt(wdev, freq, sig_mbm);
636
	stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
637

638 639
	if (!(stypes->rx & BIT(stype))) {
		trace_cfg80211_return_bool(false);
640
		return false;
641
	}
642

643 644 645 646 647 648 649 650
	data = buf + ieee80211_hdrlen(mgmt->frame_control);
	data_len = len - ieee80211_hdrlen(mgmt->frame_control);

	spin_lock_bh(&wdev->mgmt_registrations_lock);

	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
		if (reg->frame_type != ftype)
			continue;
651

652
		if (reg->match_len > data_len)
653 654
			continue;

655
		if (memcmp(reg->match, data, reg->match_len))
656 657 658 659 660
			continue;

		/* found match! */

		/* Indicate the received Action frame to user space */
661
		if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
662
				      freq, sig_mbm,
663
				      buf, len, flags, gfp))
664 665 666 667 668 669
			continue;

		result = true;
		break;
	}

670
	spin_unlock_bh(&wdev->mgmt_registrations_lock);
671

672
	trace_cfg80211_return_bool(result);
673 674
	return result;
}
675
EXPORT_SYMBOL(cfg80211_rx_mgmt);
676

677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693
void cfg80211_dfs_channels_update_work(struct work_struct *work)
{
	struct delayed_work *delayed_work;
	struct cfg80211_registered_device *rdev;
	struct cfg80211_chan_def chandef;
	struct ieee80211_supported_band *sband;
	struct ieee80211_channel *c;
	struct wiphy *wiphy;
	bool check_again = false;
	unsigned long timeout, next_time = 0;
	int bandid, i;

	delayed_work = container_of(work, struct delayed_work, work);
	rdev = container_of(delayed_work, struct cfg80211_registered_device,
			    dfs_update_channels_wk);
	wiphy = &rdev->wiphy;

694
	rtnl_lock();
695 696 697 698 699 700 701 702 703 704 705
	for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
		sband = wiphy->bands[bandid];
		if (!sband)
			continue;

		for (i = 0; i < sband->n_channels; i++) {
			c = &sband->channels[i];

			if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
				continue;

706 707
			timeout = c->dfs_state_entered + msecs_to_jiffies(
					IEEE80211_DFS_MIN_NOP_TIME_MS);
708 709 710

			if (time_after_eq(jiffies, timeout)) {
				c->dfs_state = NL80211_DFS_USABLE;
711 712
				c->dfs_state_entered = jiffies;

713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728
				cfg80211_chandef_create(&chandef, c,
							NL80211_CHAN_NO_HT);

				nl80211_radar_notify(rdev, &chandef,
						     NL80211_RADAR_NOP_FINISHED,
						     NULL, GFP_ATOMIC);
				continue;
			}

			if (!check_again)
				next_time = timeout - jiffies;
			else
				next_time = min(next_time, timeout - jiffies);
			check_again = true;
		}
	}
729
	rtnl_unlock();
730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761

	/* reschedule if there are other channels waiting to be cleared again */
	if (check_again)
		queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
				   next_time);
}


void cfg80211_radar_event(struct wiphy *wiphy,
			  struct cfg80211_chan_def *chandef,
			  gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	unsigned long timeout;

	trace_cfg80211_radar_event(wiphy, chandef);

	/* only set the chandef supplied channel to unavailable, in
	 * case the radar is detected on only one of multiple channels
	 * spanned by the chandef.
	 */
	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);

	timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
	queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
			   timeout);

	nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
}
EXPORT_SYMBOL(cfg80211_radar_event);

void cfg80211_cac_event(struct net_device *netdev,
762
			const struct cfg80211_chan_def *chandef,
763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782
			enum nl80211_radar_event event, gfp_t gfp)
{
	struct wireless_dev *wdev = netdev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	unsigned long timeout;

	trace_cfg80211_cac_event(netdev, event);

	if (WARN_ON(!wdev->cac_started))
		return;

	if (WARN_ON(!wdev->channel))
		return;

	switch (event) {
	case NL80211_RADAR_CAC_FINISHED:
		timeout = wdev->cac_start_time +
			  msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
		WARN_ON(!time_after_eq(jiffies, timeout));
783
		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
784 785 786 787 788 789 790 791 792
		break;
	case NL80211_RADAR_CAC_ABORTED:
		break;
	default:
		WARN_ON(1);
		return;
	}
	wdev->cac_started = false;

793
	nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
794 795
}
EXPORT_SYMBOL(cfg80211_cac_event);