1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 MLME SAP interface 4 * 5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi> 6 * Copyright (c) 2015 Intel Deutschland GmbH 7 * Copyright (C) 2019 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/etherdevice.h> 13 #include <linux/netdevice.h> 14 #include <linux/nl80211.h> 15 #include <linux/slab.h> 16 #include <linux/wireless.h> 17 #include <net/cfg80211.h> 18 #include <net/iw_handler.h> 19 #include "core.h" 20 #include "nl80211.h" 21 #include "rdev-ops.h" 22 23 24 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss, 25 const u8 *buf, size_t len, int uapsd_queues, 26 const u8 *req_ies, size_t req_ies_len) 27 { 28 struct wireless_dev *wdev = dev->ieee80211_ptr; 29 struct wiphy *wiphy = wdev->wiphy; 30 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 31 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 32 struct cfg80211_connect_resp_params cr; 33 34 memset(&cr, 0, sizeof(cr)); 35 cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code); 36 cr.bssid = mgmt->bssid; 37 cr.bss = bss; 38 cr.req_ie = req_ies; 39 cr.req_ie_len = req_ies_len; 40 cr.resp_ie = mgmt->u.assoc_resp.variable; 41 cr.resp_ie_len = 42 len - offsetof(struct ieee80211_mgmt, u.assoc_resp.variable); 43 cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED; 44 45 trace_cfg80211_send_rx_assoc(dev, bss); 46 47 /* 48 * This is a bit of a hack, we don't notify userspace of 49 * a (re-)association reply if we tried to send a reassoc 50 * and got a reject -- we only try again with an assoc 51 * frame instead of reassoc. 52 */ 53 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) { 54 cfg80211_unhold_bss(bss_from_pub(bss)); 55 cfg80211_put_bss(wiphy, bss); 56 return; 57 } 58 59 nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues, 60 req_ies, req_ies_len); 61 /* update current_bss etc., consumes the bss reference */ 62 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS); 63 } 64 EXPORT_SYMBOL(cfg80211_rx_assoc_resp); 65 66 static void cfg80211_process_auth(struct wireless_dev *wdev, 67 const u8 *buf, size_t len) 68 { 69 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 70 71 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL); 72 cfg80211_sme_rx_auth(wdev, buf, len); 73 } 74 75 static void cfg80211_process_deauth(struct wireless_dev *wdev, 76 const u8 *buf, size_t len) 77 { 78 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 79 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 80 const u8 *bssid = mgmt->bssid; 81 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); 82 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 83 84 nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL); 85 86 if (!wdev->current_bss || 87 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) 88 return; 89 90 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 91 cfg80211_sme_deauth(wdev); 92 } 93 94 static void cfg80211_process_disassoc(struct wireless_dev *wdev, 95 const u8 *buf, size_t len) 96 { 97 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 98 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 99 const u8 *bssid = mgmt->bssid; 100 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); 101 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 102 103 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL); 104 105 if (WARN_ON(!wdev->current_bss || 106 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 107 return; 108 109 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 110 cfg80211_sme_disassoc(wdev); 111 } 112 113 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) 114 { 115 struct wireless_dev *wdev = dev->ieee80211_ptr; 116 struct ieee80211_mgmt *mgmt = (void *)buf; 117 118 ASSERT_WDEV_LOCK(wdev); 119 120 trace_cfg80211_rx_mlme_mgmt(dev, buf, len); 121 122 if (WARN_ON(len < 2)) 123 return; 124 125 if (ieee80211_is_auth(mgmt->frame_control)) 126 cfg80211_process_auth(wdev, buf, len); 127 else if (ieee80211_is_deauth(mgmt->frame_control)) 128 cfg80211_process_deauth(wdev, buf, len); 129 else if (ieee80211_is_disassoc(mgmt->frame_control)) 130 cfg80211_process_disassoc(wdev, buf, len); 131 } 132 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt); 133 134 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr) 135 { 136 struct wireless_dev *wdev = dev->ieee80211_ptr; 137 struct wiphy *wiphy = wdev->wiphy; 138 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 139 140 trace_cfg80211_send_auth_timeout(dev, addr); 141 142 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL); 143 cfg80211_sme_auth_timeout(wdev); 144 } 145 EXPORT_SYMBOL(cfg80211_auth_timeout); 146 147 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss) 148 { 149 struct wireless_dev *wdev = dev->ieee80211_ptr; 150 struct wiphy *wiphy = wdev->wiphy; 151 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 152 153 trace_cfg80211_send_assoc_timeout(dev, bss->bssid); 154 155 nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL); 156 cfg80211_sme_assoc_timeout(wdev); 157 158 cfg80211_unhold_bss(bss_from_pub(bss)); 159 cfg80211_put_bss(wiphy, bss); 160 } 161 EXPORT_SYMBOL(cfg80211_assoc_timeout); 162 163 void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss) 164 { 165 struct wireless_dev *wdev = dev->ieee80211_ptr; 166 struct wiphy *wiphy = wdev->wiphy; 167 168 cfg80211_sme_abandon_assoc(wdev); 169 170 cfg80211_unhold_bss(bss_from_pub(bss)); 171 cfg80211_put_bss(wiphy, bss); 172 } 173 EXPORT_SYMBOL(cfg80211_abandon_assoc); 174 175 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) 176 { 177 struct wireless_dev *wdev = dev->ieee80211_ptr; 178 struct ieee80211_mgmt *mgmt = (void *)buf; 179 180 ASSERT_WDEV_LOCK(wdev); 181 182 trace_cfg80211_tx_mlme_mgmt(dev, buf, len); 183 184 if (WARN_ON(len < 2)) 185 return; 186 187 if (ieee80211_is_deauth(mgmt->frame_control)) 188 cfg80211_process_deauth(wdev, buf, len); 189 else 190 cfg80211_process_disassoc(wdev, buf, len); 191 } 192 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt); 193 194 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr, 195 enum nl80211_key_type key_type, int key_id, 196 const u8 *tsc, gfp_t gfp) 197 { 198 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 199 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 200 #ifdef CONFIG_CFG80211_WEXT 201 union iwreq_data wrqu; 202 char *buf = kmalloc(128, gfp); 203 204 if (buf) { 205 sprintf(buf, "MLME-MICHAELMICFAILURE.indication(" 206 "keyid=%d %scast addr=%pM)", key_id, 207 key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni", 208 addr); 209 memset(&wrqu, 0, sizeof(wrqu)); 210 wrqu.data.length = strlen(buf); 211 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf); 212 kfree(buf); 213 } 214 #endif 215 216 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc); 217 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp); 218 } 219 EXPORT_SYMBOL(cfg80211_michael_mic_failure); 220 221 /* some MLME handling for userspace SME */ 222 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev, 223 struct net_device *dev, 224 struct ieee80211_channel *chan, 225 enum nl80211_auth_type auth_type, 226 const u8 *bssid, 227 const u8 *ssid, int ssid_len, 228 const u8 *ie, int ie_len, 229 const u8 *key, int key_len, int key_idx, 230 const u8 *auth_data, int auth_data_len) 231 { 232 struct wireless_dev *wdev = dev->ieee80211_ptr; 233 struct cfg80211_auth_request req = { 234 .ie = ie, 235 .ie_len = ie_len, 236 .auth_data = auth_data, 237 .auth_data_len = auth_data_len, 238 .auth_type = auth_type, 239 .key = key, 240 .key_len = key_len, 241 .key_idx = key_idx, 242 }; 243 int err; 244 245 ASSERT_WDEV_LOCK(wdev); 246 247 if (auth_type == NL80211_AUTHTYPE_SHARED_KEY) 248 if (!key || !key_len || key_idx < 0 || key_idx > 3) 249 return -EINVAL; 250 251 if (wdev->current_bss && 252 ether_addr_equal(bssid, wdev->current_bss->pub.bssid)) 253 return -EALREADY; 254 255 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 256 IEEE80211_BSS_TYPE_ESS, 257 IEEE80211_PRIVACY_ANY); 258 if (!req.bss) 259 return -ENOENT; 260 261 err = rdev_auth(rdev, dev, &req); 262 263 cfg80211_put_bss(&rdev->wiphy, req.bss); 264 return err; 265 } 266 267 /* Do a logical ht_capa &= ht_capa_mask. */ 268 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa, 269 const struct ieee80211_ht_cap *ht_capa_mask) 270 { 271 int i; 272 u8 *p1, *p2; 273 if (!ht_capa_mask) { 274 memset(ht_capa, 0, sizeof(*ht_capa)); 275 return; 276 } 277 278 p1 = (u8*)(ht_capa); 279 p2 = (u8*)(ht_capa_mask); 280 for (i = 0; i < sizeof(*ht_capa); i++) 281 p1[i] &= p2[i]; 282 } 283 284 /* Do a logical vht_capa &= vht_capa_mask. */ 285 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa, 286 const struct ieee80211_vht_cap *vht_capa_mask) 287 { 288 int i; 289 u8 *p1, *p2; 290 if (!vht_capa_mask) { 291 memset(vht_capa, 0, sizeof(*vht_capa)); 292 return; 293 } 294 295 p1 = (u8*)(vht_capa); 296 p2 = (u8*)(vht_capa_mask); 297 for (i = 0; i < sizeof(*vht_capa); i++) 298 p1[i] &= p2[i]; 299 } 300 301 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev, 302 struct net_device *dev, 303 struct ieee80211_channel *chan, 304 const u8 *bssid, 305 const u8 *ssid, int ssid_len, 306 struct cfg80211_assoc_request *req) 307 { 308 struct wireless_dev *wdev = dev->ieee80211_ptr; 309 int err; 310 311 ASSERT_WDEV_LOCK(wdev); 312 313 if (wdev->current_bss && 314 (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid, 315 req->prev_bssid))) 316 return -EALREADY; 317 318 cfg80211_oper_and_ht_capa(&req->ht_capa_mask, 319 rdev->wiphy.ht_capa_mod_mask); 320 cfg80211_oper_and_vht_capa(&req->vht_capa_mask, 321 rdev->wiphy.vht_capa_mod_mask); 322 323 req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 324 IEEE80211_BSS_TYPE_ESS, 325 IEEE80211_PRIVACY_ANY); 326 if (!req->bss) 327 return -ENOENT; 328 329 err = rdev_assoc(rdev, dev, req); 330 if (!err) 331 cfg80211_hold_bss(bss_from_pub(req->bss)); 332 else 333 cfg80211_put_bss(&rdev->wiphy, req->bss); 334 335 return err; 336 } 337 338 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev, 339 struct net_device *dev, const u8 *bssid, 340 const u8 *ie, int ie_len, u16 reason, 341 bool local_state_change) 342 { 343 struct wireless_dev *wdev = dev->ieee80211_ptr; 344 struct cfg80211_deauth_request req = { 345 .bssid = bssid, 346 .reason_code = reason, 347 .ie = ie, 348 .ie_len = ie_len, 349 .local_state_change = local_state_change, 350 }; 351 352 ASSERT_WDEV_LOCK(wdev); 353 354 if (local_state_change && 355 (!wdev->current_bss || 356 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 357 return 0; 358 359 if (ether_addr_equal(wdev->disconnect_bssid, bssid) || 360 (wdev->current_bss && 361 ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 362 wdev->conn_owner_nlportid = 0; 363 364 return rdev_deauth(rdev, dev, &req); 365 } 366 367 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev, 368 struct net_device *dev, const u8 *bssid, 369 const u8 *ie, int ie_len, u16 reason, 370 bool local_state_change) 371 { 372 struct wireless_dev *wdev = dev->ieee80211_ptr; 373 struct cfg80211_disassoc_request req = { 374 .reason_code = reason, 375 .local_state_change = local_state_change, 376 .ie = ie, 377 .ie_len = ie_len, 378 }; 379 int err; 380 381 ASSERT_WDEV_LOCK(wdev); 382 383 if (!wdev->current_bss) 384 return -ENOTCONN; 385 386 if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) 387 req.bss = &wdev->current_bss->pub; 388 else 389 return -ENOTCONN; 390 391 err = rdev_disassoc(rdev, dev, &req); 392 if (err) 393 return err; 394 395 /* driver should have reported the disassoc */ 396 WARN_ON(wdev->current_bss); 397 return 0; 398 } 399 400 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev, 401 struct net_device *dev) 402 { 403 struct wireless_dev *wdev = dev->ieee80211_ptr; 404 u8 bssid[ETH_ALEN]; 405 406 ASSERT_WDEV_LOCK(wdev); 407 408 if (!rdev->ops->deauth) 409 return; 410 411 if (!wdev->current_bss) 412 return; 413 414 memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN); 415 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0, 416 WLAN_REASON_DEAUTH_LEAVING, false); 417 } 418 419 struct cfg80211_mgmt_registration { 420 struct list_head list; 421 struct wireless_dev *wdev; 422 423 u32 nlportid; 424 425 int match_len; 426 427 __le16 frame_type; 428 429 u8 match[]; 430 }; 431 432 static void 433 cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device *rdev) 434 { 435 struct cfg80211_mgmt_registration *reg; 436 437 ASSERT_RTNL(); 438 439 spin_lock_bh(&rdev->mlme_unreg_lock); 440 while ((reg = list_first_entry_or_null(&rdev->mlme_unreg, 441 struct cfg80211_mgmt_registration, 442 list))) { 443 list_del(®->list); 444 spin_unlock_bh(&rdev->mlme_unreg_lock); 445 446 if (rdev->ops->mgmt_frame_register) { 447 u16 frame_type = le16_to_cpu(reg->frame_type); 448 449 rdev_mgmt_frame_register(rdev, reg->wdev, 450 frame_type, false); 451 } 452 453 kfree(reg); 454 455 spin_lock_bh(&rdev->mlme_unreg_lock); 456 } 457 spin_unlock_bh(&rdev->mlme_unreg_lock); 458 } 459 460 void cfg80211_mlme_unreg_wk(struct work_struct *wk) 461 { 462 struct cfg80211_registered_device *rdev; 463 464 rdev = container_of(wk, struct cfg80211_registered_device, 465 mlme_unreg_wk); 466 467 rtnl_lock(); 468 cfg80211_process_mlme_unregistrations(rdev); 469 rtnl_unlock(); 470 } 471 472 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid, 473 u16 frame_type, const u8 *match_data, 474 int match_len, struct netlink_ext_ack *extack) 475 { 476 struct wiphy *wiphy = wdev->wiphy; 477 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 478 struct cfg80211_mgmt_registration *reg, *nreg; 479 int err = 0; 480 u16 mgmt_type; 481 482 if (!wdev->wiphy->mgmt_stypes) 483 return -EOPNOTSUPP; 484 485 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) { 486 NL_SET_ERR_MSG(extack, "frame type not management"); 487 return -EINVAL; 488 } 489 490 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) { 491 NL_SET_ERR_MSG(extack, "Invalid frame type"); 492 return -EINVAL; 493 } 494 495 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4; 496 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) { 497 NL_SET_ERR_MSG(extack, 498 "Registration to specific type not supported"); 499 return -EINVAL; 500 } 501 502 /* 503 * To support Pre Association Security Negotiation (PASN), registration 504 * for authentication frames should be supported. However, as some 505 * versions of the user space daemons wrongly register to all types of 506 * authentication frames (which might result in unexpected behavior) 507 * allow such registration if the request is for a specific 508 * authentication algorithm number. 509 */ 510 if (wdev->iftype == NL80211_IFTYPE_STATION && 511 (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH && 512 !(match_data && match_len >= 2)) { 513 NL_SET_ERR_MSG(extack, 514 "Authentication algorithm number required"); 515 return -EINVAL; 516 } 517 518 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL); 519 if (!nreg) 520 return -ENOMEM; 521 522 spin_lock_bh(&wdev->mgmt_registrations_lock); 523 524 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 525 int mlen = min(match_len, reg->match_len); 526 527 if (frame_type != le16_to_cpu(reg->frame_type)) 528 continue; 529 530 if (memcmp(reg->match, match_data, mlen) == 0) { 531 NL_SET_ERR_MSG(extack, "Match already configured"); 532 err = -EALREADY; 533 break; 534 } 535 } 536 537 if (err) { 538 kfree(nreg); 539 goto out; 540 } 541 542 memcpy(nreg->match, match_data, match_len); 543 nreg->match_len = match_len; 544 nreg->nlportid = snd_portid; 545 nreg->frame_type = cpu_to_le16(frame_type); 546 nreg->wdev = wdev; 547 list_add(&nreg->list, &wdev->mgmt_registrations); 548 spin_unlock_bh(&wdev->mgmt_registrations_lock); 549 550 /* process all unregistrations to avoid driver confusion */ 551 cfg80211_process_mlme_unregistrations(rdev); 552 553 if (rdev->ops->mgmt_frame_register) 554 rdev_mgmt_frame_register(rdev, wdev, frame_type, true); 555 556 return 0; 557 558 out: 559 spin_unlock_bh(&wdev->mgmt_registrations_lock); 560 561 return err; 562 } 563 564 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid) 565 { 566 struct wiphy *wiphy = wdev->wiphy; 567 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 568 struct cfg80211_mgmt_registration *reg, *tmp; 569 570 spin_lock_bh(&wdev->mgmt_registrations_lock); 571 572 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 573 if (reg->nlportid != nlportid) 574 continue; 575 576 list_del(®->list); 577 spin_lock(&rdev->mlme_unreg_lock); 578 list_add_tail(®->list, &rdev->mlme_unreg); 579 spin_unlock(&rdev->mlme_unreg_lock); 580 581 schedule_work(&rdev->mlme_unreg_wk); 582 } 583 584 spin_unlock_bh(&wdev->mgmt_registrations_lock); 585 586 if (nlportid && rdev->crit_proto_nlportid == nlportid) { 587 rdev->crit_proto_nlportid = 0; 588 rdev_crit_proto_stop(rdev, wdev); 589 } 590 591 if (nlportid == wdev->ap_unexpected_nlportid) 592 wdev->ap_unexpected_nlportid = 0; 593 } 594 595 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev) 596 { 597 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 598 599 spin_lock_bh(&wdev->mgmt_registrations_lock); 600 spin_lock(&rdev->mlme_unreg_lock); 601 list_splice_tail_init(&wdev->mgmt_registrations, &rdev->mlme_unreg); 602 spin_unlock(&rdev->mlme_unreg_lock); 603 spin_unlock_bh(&wdev->mgmt_registrations_lock); 604 605 cfg80211_process_mlme_unregistrations(rdev); 606 } 607 608 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev, 609 struct wireless_dev *wdev, 610 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 611 { 612 const struct ieee80211_mgmt *mgmt; 613 u16 stype; 614 615 if (!wdev->wiphy->mgmt_stypes) 616 return -EOPNOTSUPP; 617 618 if (!rdev->ops->mgmt_tx) 619 return -EOPNOTSUPP; 620 621 if (params->len < 24 + 1) 622 return -EINVAL; 623 624 mgmt = (const struct ieee80211_mgmt *)params->buf; 625 626 if (!ieee80211_is_mgmt(mgmt->frame_control)) 627 return -EINVAL; 628 629 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE; 630 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4))) 631 return -EINVAL; 632 633 if (ieee80211_is_action(mgmt->frame_control) && 634 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) { 635 int err = 0; 636 637 wdev_lock(wdev); 638 639 switch (wdev->iftype) { 640 case NL80211_IFTYPE_ADHOC: 641 case NL80211_IFTYPE_STATION: 642 case NL80211_IFTYPE_P2P_CLIENT: 643 if (!wdev->current_bss) { 644 err = -ENOTCONN; 645 break; 646 } 647 648 if (!ether_addr_equal(wdev->current_bss->pub.bssid, 649 mgmt->bssid)) { 650 err = -ENOTCONN; 651 break; 652 } 653 654 /* 655 * check for IBSS DA must be done by driver as 656 * cfg80211 doesn't track the stations 657 */ 658 if (wdev->iftype == NL80211_IFTYPE_ADHOC) 659 break; 660 661 /* for station, check that DA is the AP */ 662 if (!ether_addr_equal(wdev->current_bss->pub.bssid, 663 mgmt->da)) { 664 err = -ENOTCONN; 665 break; 666 } 667 break; 668 case NL80211_IFTYPE_AP: 669 case NL80211_IFTYPE_P2P_GO: 670 case NL80211_IFTYPE_AP_VLAN: 671 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev))) 672 err = -EINVAL; 673 break; 674 case NL80211_IFTYPE_MESH_POINT: 675 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) { 676 err = -EINVAL; 677 break; 678 } 679 /* 680 * check for mesh DA must be done by driver as 681 * cfg80211 doesn't track the stations 682 */ 683 break; 684 case NL80211_IFTYPE_P2P_DEVICE: 685 /* 686 * fall through, P2P device only supports 687 * public action frames 688 */ 689 case NL80211_IFTYPE_NAN: 690 default: 691 err = -EOPNOTSUPP; 692 break; 693 } 694 wdev_unlock(wdev); 695 696 if (err) 697 return err; 698 } 699 700 if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) { 701 /* Allow random TA to be used with Public Action frames if the 702 * driver has indicated support for this. Otherwise, only allow 703 * the local address to be used. 704 */ 705 if (!ieee80211_is_action(mgmt->frame_control) || 706 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) 707 return -EINVAL; 708 if (!wdev->current_bss && 709 !wiphy_ext_feature_isset( 710 &rdev->wiphy, 711 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA)) 712 return -EINVAL; 713 if (wdev->current_bss && 714 !wiphy_ext_feature_isset( 715 &rdev->wiphy, 716 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED)) 717 return -EINVAL; 718 } 719 720 /* Transmit the Action frame as requested by user space */ 721 return rdev_mgmt_tx(rdev, wdev, params, cookie); 722 } 723 724 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm, 725 const u8 *buf, size_t len, u32 flags) 726 { 727 struct wiphy *wiphy = wdev->wiphy; 728 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 729 struct cfg80211_mgmt_registration *reg; 730 const struct ieee80211_txrx_stypes *stypes = 731 &wiphy->mgmt_stypes[wdev->iftype]; 732 struct ieee80211_mgmt *mgmt = (void *)buf; 733 const u8 *data; 734 int data_len; 735 bool result = false; 736 __le16 ftype = mgmt->frame_control & 737 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE); 738 u16 stype; 739 740 trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm); 741 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4; 742 743 if (!(stypes->rx & BIT(stype))) { 744 trace_cfg80211_return_bool(false); 745 return false; 746 } 747 748 data = buf + ieee80211_hdrlen(mgmt->frame_control); 749 data_len = len - ieee80211_hdrlen(mgmt->frame_control); 750 751 spin_lock_bh(&wdev->mgmt_registrations_lock); 752 753 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 754 if (reg->frame_type != ftype) 755 continue; 756 757 if (reg->match_len > data_len) 758 continue; 759 760 if (memcmp(reg->match, data, reg->match_len)) 761 continue; 762 763 /* found match! */ 764 765 /* Indicate the received Action frame to user space */ 766 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, 767 freq, sig_dbm, 768 buf, len, flags, GFP_ATOMIC)) 769 continue; 770 771 result = true; 772 break; 773 } 774 775 spin_unlock_bh(&wdev->mgmt_registrations_lock); 776 777 trace_cfg80211_return_bool(result); 778 return result; 779 } 780 EXPORT_SYMBOL(cfg80211_rx_mgmt); 781 782 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev) 783 { 784 cancel_delayed_work(&rdev->dfs_update_channels_wk); 785 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0); 786 } 787 788 void cfg80211_dfs_channels_update_work(struct work_struct *work) 789 { 790 struct delayed_work *delayed_work = to_delayed_work(work); 791 struct cfg80211_registered_device *rdev; 792 struct cfg80211_chan_def chandef; 793 struct ieee80211_supported_band *sband; 794 struct ieee80211_channel *c; 795 struct wiphy *wiphy; 796 bool check_again = false; 797 unsigned long timeout, next_time = 0; 798 unsigned long time_dfs_update; 799 enum nl80211_radar_event radar_event; 800 int bandid, i; 801 802 rdev = container_of(delayed_work, struct cfg80211_registered_device, 803 dfs_update_channels_wk); 804 wiphy = &rdev->wiphy; 805 806 rtnl_lock(); 807 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) { 808 sband = wiphy->bands[bandid]; 809 if (!sband) 810 continue; 811 812 for (i = 0; i < sband->n_channels; i++) { 813 c = &sband->channels[i]; 814 815 if (!(c->flags & IEEE80211_CHAN_RADAR)) 816 continue; 817 818 if (c->dfs_state != NL80211_DFS_UNAVAILABLE && 819 c->dfs_state != NL80211_DFS_AVAILABLE) 820 continue; 821 822 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) { 823 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS; 824 radar_event = NL80211_RADAR_NOP_FINISHED; 825 } else { 826 if (regulatory_pre_cac_allowed(wiphy) || 827 cfg80211_any_wiphy_oper_chan(wiphy, c)) 828 continue; 829 830 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS; 831 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED; 832 } 833 834 timeout = c->dfs_state_entered + 835 msecs_to_jiffies(time_dfs_update); 836 837 if (time_after_eq(jiffies, timeout)) { 838 c->dfs_state = NL80211_DFS_USABLE; 839 c->dfs_state_entered = jiffies; 840 841 cfg80211_chandef_create(&chandef, c, 842 NL80211_CHAN_NO_HT); 843 844 nl80211_radar_notify(rdev, &chandef, 845 radar_event, NULL, 846 GFP_ATOMIC); 847 848 regulatory_propagate_dfs_state(wiphy, &chandef, 849 c->dfs_state, 850 radar_event); 851 continue; 852 } 853 854 if (!check_again) 855 next_time = timeout - jiffies; 856 else 857 next_time = min(next_time, timeout - jiffies); 858 check_again = true; 859 } 860 } 861 rtnl_unlock(); 862 863 /* reschedule if there are other channels waiting to be cleared again */ 864 if (check_again) 865 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 866 next_time); 867 } 868 869 870 void cfg80211_radar_event(struct wiphy *wiphy, 871 struct cfg80211_chan_def *chandef, 872 gfp_t gfp) 873 { 874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 875 876 trace_cfg80211_radar_event(wiphy, chandef); 877 878 /* only set the chandef supplied channel to unavailable, in 879 * case the radar is detected on only one of multiple channels 880 * spanned by the chandef. 881 */ 882 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE); 883 884 cfg80211_sched_dfs_chan_update(rdev); 885 886 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp); 887 888 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def)); 889 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 890 } 891 EXPORT_SYMBOL(cfg80211_radar_event); 892 893 void cfg80211_cac_event(struct net_device *netdev, 894 const struct cfg80211_chan_def *chandef, 895 enum nl80211_radar_event event, gfp_t gfp) 896 { 897 struct wireless_dev *wdev = netdev->ieee80211_ptr; 898 struct wiphy *wiphy = wdev->wiphy; 899 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 900 unsigned long timeout; 901 902 trace_cfg80211_cac_event(netdev, event); 903 904 if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED)) 905 return; 906 907 if (WARN_ON(!wdev->chandef.chan)) 908 return; 909 910 switch (event) { 911 case NL80211_RADAR_CAC_FINISHED: 912 timeout = wdev->cac_start_time + 913 msecs_to_jiffies(wdev->cac_time_ms); 914 WARN_ON(!time_after_eq(jiffies, timeout)); 915 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE); 916 memcpy(&rdev->cac_done_chandef, chandef, 917 sizeof(struct cfg80211_chan_def)); 918 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk); 919 cfg80211_sched_dfs_chan_update(rdev); 920 /* fall through */ 921 case NL80211_RADAR_CAC_ABORTED: 922 wdev->cac_started = false; 923 break; 924 case NL80211_RADAR_CAC_STARTED: 925 wdev->cac_started = true; 926 break; 927 default: 928 WARN_ON(1); 929 return; 930 } 931 932 nl80211_radar_notify(rdev, chandef, event, netdev, gfp); 933 } 934 EXPORT_SYMBOL(cfg80211_cac_event); 935