wireless/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * cfg80211 MLME SAP interface
   4  *
   5  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   6  * Copyright (c) 2015           Intel Deutschland GmbH
   7  * Copyright (C) 2019-2020, 2022 Intel Corporation
   8  */
   9
  10 #include <linux/kernel.h>
  11 #include <linux/module.h>
  12 #include <linux/etherdevice.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/slab.h>
  16 #include <linux/wireless.h>
  17 #include <net/cfg80211.h>
  18 #include <net/iw_handler.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "rdev-ops.h"
  22
  23
  24 void cfg80211_rx_assoc_resp(struct net_device *dev,
  25                             struct cfg80211_rx_assoc_resp *data)
  26 {
  27         struct wireless_dev *wdev = dev->ieee80211_ptr;
  28         struct wiphy *wiphy = wdev->wiphy;
  29         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  30         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf;
  31         struct cfg80211_connect_resp_params cr = {
  32                 .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED,
  33                 .req_ie = data->req_ies,
  34                 .req_ie_len = data->req_ies_len,
  35                 .resp_ie = mgmt->u.assoc_resp.variable,
  36                 .resp_ie_len = data->len -
  37                                offsetof(struct ieee80211_mgmt,
  38                                         u.assoc_resp.variable),
  39                 .status = le16_to_cpu(mgmt->u.assoc_resp.status_code),
  40                 .ap_mld_addr = data->ap_mld_addr,
  41         };
  42         unsigned int link_id;
  43
  44         for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  45                 cr.links[link_id].bss = data->links[link_id].bss;
  46                 if (!cr.links[link_id].bss)
  47                         continue;
  48                 cr.links[link_id].bssid = data->links[link_id].bss->bssid;
  49                 cr.links[link_id].addr = data->links[link_id].addr;
  50                 /* need to have local link addresses for MLO connections */
  51                 WARN_ON(cr.ap_mld_addr && !cr.links[link_id].addr);
  52
  53                 BUG_ON(!cr.links[link_id].bss->channel);
  54
  55                 if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) {
  56                         WARN_ON(link_id);
  57                         cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;
  58                         cr.resp_ie_len = data->len -
  59                                          offsetof(struct ieee80211_mgmt,
  60                                                   u.s1g_assoc_resp.variable);
  61                 }
  62
  63                 if (cr.ap_mld_addr)
  64                         cr.valid_links |= BIT(link_id);
  65         }
  66
  67         trace_cfg80211_send_rx_assoc(dev, data);
  68
  69         /*
  70          * This is a bit of a hack, we don't notify userspace of
  71          * a (re-)association reply if we tried to send a reassoc
  72          * and got a reject -- we only try again with an assoc
  73          * frame instead of reassoc.
  74          */
  75         if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
  76                 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  77                         struct cfg80211_bss *bss = data->links[link_id].bss;
  78
  79                         if (!bss)
  80                                 continue;
  81
  82                         cfg80211_unhold_bss(bss_from_pub(bss));
  83                         cfg80211_put_bss(wiphy, bss);
  84                 }
  85                 return;
  86         }
  87
  88         nl80211_send_rx_assoc(rdev, dev, data);
  89         /* update current_bss etc., consumes the bss reference */
  90         __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
  91 }
  92 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  93
  94 static void cfg80211_process_auth(struct wireless_dev *wdev,
  95                                   const u8 *buf, size_t len)
  96 {
  97         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  98
  99         nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
 100         cfg80211_sme_rx_auth(wdev, buf, len);
 101 }
 102
 103 static void cfg80211_process_deauth(struct wireless_dev *wdev,
 104                                     const u8 *buf, size_t len,
 105                                     bool reconnect)
 106 {
 107         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 108         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 109         const u8 *bssid = mgmt->bssid;
 110         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 111         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 112
 113         nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
 114
 115         if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid))
 116                 return;
 117
 118         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 119         cfg80211_sme_deauth(wdev);
 120 }
 121
 122 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
 123                                       const u8 *buf, size_t len,
 124                                       bool reconnect)
 125 {
 126         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 127         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 128         const u8 *bssid = mgmt->bssid;
 129         u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 130         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 131
 132         nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
 133                               GFP_KERNEL);
 134
 135         if (WARN_ON(!wdev->connected ||
 136                     !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 137                 return;
 138
 139         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 140         cfg80211_sme_disassoc(wdev);
 141 }
 142
 143 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 144 {
 145         struct wireless_dev *wdev = dev->ieee80211_ptr;
 146         struct ieee80211_mgmt *mgmt = (void *)buf;
 147
 148         ASSERT_WDEV_LOCK(wdev);
 149
 150         trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 151
 152         if (WARN_ON(len < 2))
 153                 return;
 154
 155         if (ieee80211_is_auth(mgmt->frame_control))
 156                 cfg80211_process_auth(wdev, buf, len);
 157         else if (ieee80211_is_deauth(mgmt->frame_control))
 158                 cfg80211_process_deauth(wdev, buf, len, false);
 159         else if (ieee80211_is_disassoc(mgmt->frame_control))
 160                 cfg80211_process_disassoc(wdev, buf, len, false);
 161 }
 162 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 163
 164 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 165 {
 166         struct wireless_dev *wdev = dev->ieee80211_ptr;
 167         struct wiphy *wiphy = wdev->wiphy;
 168         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 169
 170         trace_cfg80211_send_auth_timeout(dev, addr);
 171
 172         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 173         cfg80211_sme_auth_timeout(wdev);
 174 }
 175 EXPORT_SYMBOL(cfg80211_auth_timeout);
 176
 177 void cfg80211_assoc_failure(struct net_device *dev,
 178                             struct cfg80211_assoc_failure *data)
 179 {
 180         struct wireless_dev *wdev = dev->ieee80211_ptr;
 181         struct wiphy *wiphy = wdev->wiphy;
 182         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 183         const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid;
 184         int i;
 185
 186         trace_cfg80211_send_assoc_failure(dev, data);
 187
 188         if (data->timeout) {
 189                 nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 190                 cfg80211_sme_assoc_timeout(wdev);
 191         } else {
 192                 cfg80211_sme_abandon_assoc(wdev);
 193         }
 194
 195         for (i = 0; i < ARRAY_SIZE(data->bss); i++) {
 196                 struct cfg80211_bss *bss = data->bss[i];
 197
 198                 if (!bss)
 199                         continue;
 200
 201                 cfg80211_unhold_bss(bss_from_pub(bss));
 202                 cfg80211_put_bss(wiphy, bss);
 203         }
 204 }
 205 EXPORT_SYMBOL(cfg80211_assoc_failure);
 206
 207 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
 208                            bool reconnect)
 209 {
 210         struct wireless_dev *wdev = dev->ieee80211_ptr;
 211         struct ieee80211_mgmt *mgmt = (void *)buf;
 212
 213         ASSERT_WDEV_LOCK(wdev);
 214
 215         trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
 216
 217         if (WARN_ON(len < 2))
 218                 return;
 219
 220         if (ieee80211_is_deauth(mgmt->frame_control))
 221                 cfg80211_process_deauth(wdev, buf, len, reconnect);
 222         else
 223                 cfg80211_process_disassoc(wdev, buf, len, reconnect);
 224 }
 225 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 226
 227 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 228                                   enum nl80211_key_type key_type, int key_id,
 229                                   const u8 *tsc, gfp_t gfp)
 230 {
 231         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 232         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 233 #ifdef CONFIG_CFG80211_WEXT
 234         union iwreq_data wrqu;
 235         char *buf = kmalloc(128, gfp);
 236
 237         if (buf) {
 238                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 239                         "keyid=%d %scast addr=%pM)", key_id,
 240                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 241                         addr);
 242                 memset(&wrqu, 0, sizeof(wrqu));
 243                 wrqu.data.length = strlen(buf);
 244                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 245                 kfree(buf);
 246         }
 247 #endif
 248
 249         trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 250         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 251 }
 252 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 253
 254 /* some MLME handling for userspace SME */
 255 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 256                        struct net_device *dev,
 257                        struct cfg80211_auth_request *req)
 258 {
 259         struct wireless_dev *wdev = dev->ieee80211_ptr;
 260
 261         ASSERT_WDEV_LOCK(wdev);
 262
 263         if (!req->bss)
 264                 return -ENOENT;
 265
 266         if (req->link_id >= 0 &&
 267             !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
 268                 return -EINVAL;
 269
 270         if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
 271                 if (!req->key || !req->key_len ||
 272                     req->key_idx < 0 || req->key_idx > 3)
 273                         return -EINVAL;
 274         }
 275
 276         if (wdev->connected &&
 277             ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
 278                 return -EALREADY;
 279
 280         if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
 281             (req->link_id >= 0 &&
 282              ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 283                 return -EINVAL;
 284
 285         return rdev_auth(rdev, dev, req);
 286 }
 287
 288 /*  Do a logical ht_capa &= ht_capa_mask.  */
 289 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 290                                const struct ieee80211_ht_cap *ht_capa_mask)
 291 {
 292         int i;
 293         u8 *p1, *p2;
 294         if (!ht_capa_mask) {
 295                 memset(ht_capa, 0, sizeof(*ht_capa));
 296                 return;
 297         }
 298
 299         p1 = (u8*)(ht_capa);
 300         p2 = (u8*)(ht_capa_mask);
 301         for (i = 0; i < sizeof(*ht_capa); i++)
 302                 p1[i] &= p2[i];
 303 }
 304
 305 /*  Do a logical vht_capa &= vht_capa_mask.  */
 306 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 307                                 const struct ieee80211_vht_cap *vht_capa_mask)
 308 {
 309         int i;
 310         u8 *p1, *p2;
 311         if (!vht_capa_mask) {
 312                 memset(vht_capa, 0, sizeof(*vht_capa));
 313                 return;
 314         }
 315
 316         p1 = (u8*)(vht_capa);
 317         p2 = (u8*)(vht_capa_mask);
 318         for (i = 0; i < sizeof(*vht_capa); i++)
 319                 p1[i] &= p2[i];
 320 }
 321
 322 /* Note: caller must cfg80211_put_bss() regardless of result */
 323 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 324                         struct net_device *dev,
 325                         struct cfg80211_assoc_request *req)
 326 {
 327         struct wireless_dev *wdev = dev->ieee80211_ptr;
 328         int err, i, j;
 329
 330         ASSERT_WDEV_LOCK(wdev);
 331
 332         for (i = 1; i < ARRAY_SIZE(req->links); i++) {
 333                 if (!req->links[i].bss)
 334                         continue;
 335                 for (j = 0; j < i; j++) {
 336                         if (req->links[i].bss == req->links[j].bss)
 337                                 return -EINVAL;
 338                 }
 339
 340                 if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr))
 341                         return -EINVAL;
 342         }
 343
 344         if (wdev->connected &&
 345             (!req->prev_bssid ||
 346              !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
 347                 return -EALREADY;
 348
 349         if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
 350             (req->link_id >= 0 &&
 351              ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 352                 return -EINVAL;
 353
 354         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 355                                   rdev->wiphy.ht_capa_mod_mask);
 356         cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 357                                    rdev->wiphy.vht_capa_mod_mask);
 358
 359         err = rdev_assoc(rdev, dev, req);
 360         if (!err) {
 361                 int link_id;
 362
 363                 if (req->bss) {
 364                         cfg80211_ref_bss(&rdev->wiphy, req->bss);
 365                         cfg80211_hold_bss(bss_from_pub(req->bss));
 366                 }
 367
 368                 for (link_id = 0; link_id < ARRAY_SIZE(req->links); link_id++) {
 369                         if (!req->links[link_id].bss)
 370                                 continue;
 371                         cfg80211_ref_bss(&rdev->wiphy, req->links[link_id].bss);
 372                         cfg80211_hold_bss(bss_from_pub(req->links[link_id].bss));
 373                 }
 374         }
 375         return err;
 376 }
 377
 378 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 379                          struct net_device *dev, const u8 *bssid,
 380                          const u8 *ie, int ie_len, u16 reason,
 381                          bool local_state_change)
 382 {
 383         struct wireless_dev *wdev = dev->ieee80211_ptr;
 384         struct cfg80211_deauth_request req = {
 385                 .bssid = bssid,
 386                 .reason_code = reason,
 387                 .ie = ie,
 388                 .ie_len = ie_len,
 389                 .local_state_change = local_state_change,
 390         };
 391
 392         ASSERT_WDEV_LOCK(wdev);
 393
 394         if (local_state_change &&
 395             (!wdev->connected ||
 396              !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 397                 return 0;
 398
 399         if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
 400             (wdev->connected &&
 401              ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 402                 wdev->conn_owner_nlportid = 0;
 403
 404         return rdev_deauth(rdev, dev, &req);
 405 }
 406
 407 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 408                            struct net_device *dev, const u8 *ap_addr,
 409                            const u8 *ie, int ie_len, u16 reason,
 410                            bool local_state_change)
 411 {
 412         struct wireless_dev *wdev = dev->ieee80211_ptr;
 413         struct cfg80211_disassoc_request req = {
 414                 .reason_code = reason,
 415                 .local_state_change = local_state_change,
 416                 .ie = ie,
 417                 .ie_len = ie_len,
 418                 .ap_addr = ap_addr,
 419         };
 420         int err;
 421
 422         ASSERT_WDEV_LOCK(wdev);
 423
 424         if (!wdev->connected)
 425                 return -ENOTCONN;
 426
 427         if (memcmp(wdev->u.client.connected_addr, ap_addr, ETH_ALEN))
 428                 return -ENOTCONN;
 429
 430         err = rdev_disassoc(rdev, dev, &req);
 431         if (err)
 432                 return err;
 433
 434         /* driver should have reported the disassoc */
 435         WARN_ON(wdev->connected);
 436         return 0;
 437 }
 438
 439 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 440                         struct net_device *dev)
 441 {
 442         struct wireless_dev *wdev = dev->ieee80211_ptr;
 443         u8 bssid[ETH_ALEN];
 444
 445         ASSERT_WDEV_LOCK(wdev);
 446
 447         if (!rdev->ops->deauth)
 448                 return;
 449
 450         if (!wdev->connected)
 451                 return;
 452
 453         memcpy(bssid, wdev->u.client.connected_addr, ETH_ALEN);
 454         cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 455                              WLAN_REASON_DEAUTH_LEAVING, false);
 456 }
 457
 458 struct cfg80211_mgmt_registration {
 459         struct list_head list;
 460         struct wireless_dev *wdev;
 461
 462         u32 nlportid;
 463
 464         int match_len;
 465
 466         __le16 frame_type;
 467
 468         bool multicast_rx;
 469
 470         u8 match[];
 471 };
 472
 473 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
 474 {
 475         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 476         struct wireless_dev *tmp;
 477         struct cfg80211_mgmt_registration *reg;
 478         struct mgmt_frame_regs upd = {};
 479
 480         lockdep_assert_held(&rdev->wiphy.mtx);
 481
 482         spin_lock_bh(&rdev->mgmt_registrations_lock);
 483         if (!wdev->mgmt_registrations_need_update) {
 484                 spin_unlock_bh(&rdev->mgmt_registrations_lock);
 485                 return;
 486         }
 487
 488         rcu_read_lock();
 489         list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) {
 490                 list_for_each_entry(reg, &tmp->mgmt_registrations, list) {
 491                         u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4);
 492                         u32 mcast_mask = 0;
 493
 494                         if (reg->multicast_rx)
 495                                 mcast_mask = mask;
 496
 497                         upd.global_stypes |= mask;
 498                         upd.global_mcast_stypes |= mcast_mask;
 499
 500                         if (tmp == wdev) {
 501                                 upd.interface_stypes |= mask;
 502                                 upd.interface_mcast_stypes |= mcast_mask;
 503                         }
 504                 }
 505         }
 506         rcu_read_unlock();
 507
 508         wdev->mgmt_registrations_need_update = 0;
 509         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 510
 511         rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
 512 }
 513
 514 void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk)
 515 {
 516         struct cfg80211_registered_device *rdev;
 517         struct wireless_dev *wdev;
 518
 519         rdev = container_of(wk, struct cfg80211_registered_device,
 520                             mgmt_registrations_update_wk);
 521
 522         wiphy_lock(&rdev->wiphy);
 523         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
 524                 cfg80211_mgmt_registrations_update(wdev);
 525         wiphy_unlock(&rdev->wiphy);
 526 }
 527
 528 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 529                                 u16 frame_type, const u8 *match_data,
 530                                 int match_len, bool multicast_rx,
 531                                 struct netlink_ext_ack *extack)
 532 {
 533         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 534         struct cfg80211_mgmt_registration *reg, *nreg;
 535         int err = 0;
 536         u16 mgmt_type;
 537         bool update_multicast = false;
 538
 539         if (!wdev->wiphy->mgmt_stypes)
 540                 return -EOPNOTSUPP;
 541
 542         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
 543                 NL_SET_ERR_MSG(extack, "frame type not management");
 544                 return -EINVAL;
 545         }
 546
 547         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
 548                 NL_SET_ERR_MSG(extack, "Invalid frame type");
 549                 return -EINVAL;
 550         }
 551
 552         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 553         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
 554                 NL_SET_ERR_MSG(extack,
 555                                "Registration to specific type not supported");
 556                 return -EINVAL;
 557         }
 558
 559         /*
 560          * To support Pre Association Security Negotiation (PASN), registration
 561          * for authentication frames should be supported. However, as some
 562          * versions of the user space daemons wrongly register to all types of
 563          * authentication frames (which might result in unexpected behavior)
 564          * allow such registration if the request is for a specific
 565          * authentication algorithm number.
 566          */
 567         if (wdev->iftype == NL80211_IFTYPE_STATION &&
 568             (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
 569             !(match_data && match_len >= 2)) {
 570                 NL_SET_ERR_MSG(extack,
 571                                "Authentication algorithm number required");
 572                 return -EINVAL;
 573         }
 574
 575         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 576         if (!nreg)
 577                 return -ENOMEM;
 578
 579         spin_lock_bh(&rdev->mgmt_registrations_lock);
 580
 581         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 582                 int mlen = min(match_len, reg->match_len);
 583
 584                 if (frame_type != le16_to_cpu(reg->frame_type))
 585                         continue;
 586
 587                 if (memcmp(reg->match, match_data, mlen) == 0) {
 588                         if (reg->multicast_rx != multicast_rx) {
 589                                 update_multicast = true;
 590                                 reg->multicast_rx = multicast_rx;
 591                                 break;
 592                         }
 593                         NL_SET_ERR_MSG(extack, "Match already configured");
 594                         err = -EALREADY;
 595                         break;
 596                 }
 597         }
 598
 599         if (err)
 600                 goto out;
 601
 602         if (update_multicast) {
 603                 kfree(nreg);
 604         } else {
 605                 memcpy(nreg->match, match_data, match_len);
 606                 nreg->match_len = match_len;
 607                 nreg->nlportid = snd_portid;
 608                 nreg->frame_type = cpu_to_le16(frame_type);
 609                 nreg->wdev = wdev;
 610                 nreg->multicast_rx = multicast_rx;
 611                 list_add(&nreg->list, &wdev->mgmt_registrations);
 612         }
 613         wdev->mgmt_registrations_need_update = 1;
 614         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 615
 616         cfg80211_mgmt_registrations_update(wdev);
 617
 618         return 0;
 619
 620  out:
 621         kfree(nreg);
 622         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 623
 624         return err;
 625 }
 626
 627 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 628 {
 629         struct wiphy *wiphy = wdev->wiphy;
 630         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 631         struct cfg80211_mgmt_registration *reg, *tmp;
 632
 633         spin_lock_bh(&rdev->mgmt_registrations_lock);
 634
 635         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 636                 if (reg->nlportid != nlportid)
 637                         continue;
 638
 639                 list_del(&reg->list);
 640                 kfree(reg);
 641
 642                 wdev->mgmt_registrations_need_update = 1;
 643                 schedule_work(&rdev->mgmt_registrations_update_wk);
 644         }
 645
 646         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 647
 648         if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 649                 rdev->crit_proto_nlportid = 0;
 650                 rdev_crit_proto_stop(rdev, wdev);
 651         }
 652
 653         if (nlportid == wdev->ap_unexpected_nlportid)
 654                 wdev->ap_unexpected_nlportid = 0;
 655 }
 656
 657 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 658 {
 659         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 660         struct cfg80211_mgmt_registration *reg, *tmp;
 661
 662         spin_lock_bh(&rdev->mgmt_registrations_lock);
 663         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 664                 list_del(&reg->list);
 665                 kfree(reg);
 666         }
 667         wdev->mgmt_registrations_need_update = 1;
 668         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 669
 670         cfg80211_mgmt_registrations_update(wdev);
 671 }
 672
 673 static bool cfg80211_allowed_address(struct wireless_dev *wdev, const u8 *addr)
 674 {
 675         int i;
 676
 677         for_each_valid_link(wdev, i) {
 678                 if (ether_addr_equal(addr, wdev->links[i].addr))
 679                         return true;
 680         }
 681
 682         return ether_addr_equal(addr, wdev_address(wdev));
 683 }
 684
 685 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 686                           struct wireless_dev *wdev,
 687                           struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 688 {
 689         const struct ieee80211_mgmt *mgmt;
 690         u16 stype;
 691
 692         if (!wdev->wiphy->mgmt_stypes)
 693                 return -EOPNOTSUPP;
 694
 695         if (!rdev->ops->mgmt_tx)
 696                 return -EOPNOTSUPP;
 697
 698         if (params->len < 24 + 1)
 699                 return -EINVAL;
 700
 701         mgmt = (const struct ieee80211_mgmt *)params->buf;
 702
 703         if (!ieee80211_is_mgmt(mgmt->frame_control))
 704                 return -EINVAL;
 705
 706         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 707         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 708                 return -EINVAL;
 709
 710         if (ieee80211_is_action(mgmt->frame_control) &&
 711             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 712                 int err = 0;
 713
 714                 wdev_lock(wdev);
 715
 716                 switch (wdev->iftype) {
 717                 case NL80211_IFTYPE_ADHOC:
 718                         /*
 719                          * check for IBSS DA must be done by driver as
 720                          * cfg80211 doesn't track the stations
 721                          */
 722                         if (!wdev->u.ibss.current_bss ||
 723                             !ether_addr_equal(wdev->u.ibss.current_bss->pub.bssid,
 724                                               mgmt->bssid)) {
 725                                 err = -ENOTCONN;
 726                                 break;
 727                         }
 728                         break;
 729                 case NL80211_IFTYPE_STATION:
 730                 case NL80211_IFTYPE_P2P_CLIENT:
 731                         if (!wdev->connected) {
 732                                 err = -ENOTCONN;
 733                                 break;
 734                         }
 735
 736                         /* FIXME: MLD may address this differently */
 737
 738                         if (!ether_addr_equal(wdev->u.client.connected_addr,
 739                                               mgmt->bssid)) {
 740                                 err = -ENOTCONN;
 741                                 break;
 742                         }
 743
 744                         /* for station, check that DA is the AP */
 745                         if (!ether_addr_equal(wdev->u.client.connected_addr,
 746                                               mgmt->da)) {
 747                                 err = -ENOTCONN;
 748                                 break;
 749                         }
 750                         break;
 751                 case NL80211_IFTYPE_AP:
 752                 case NL80211_IFTYPE_P2P_GO:
 753                 case NL80211_IFTYPE_AP_VLAN:
 754                         if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
 755                                 err = -EINVAL;
 756                         break;
 757                 case NL80211_IFTYPE_MESH_POINT:
 758                         if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 759                                 err = -EINVAL;
 760                                 break;
 761                         }
 762                         /*
 763                          * check for mesh DA must be done by driver as
 764                          * cfg80211 doesn't track the stations
 765                          */
 766                         break;
 767                 case NL80211_IFTYPE_P2P_DEVICE:
 768                         /*
 769                          * fall through, P2P device only supports
 770                          * public action frames
 771                          */
 772                 case NL80211_IFTYPE_NAN:
 773                 default:
 774                         err = -EOPNOTSUPP;
 775                         break;
 776                 }
 777                 wdev_unlock(wdev);
 778
 779                 if (err)
 780                         return err;
 781         }
 782
 783         if (!cfg80211_allowed_address(wdev, mgmt->sa)) {
 784                 /* Allow random TA to be used with Public Action frames if the
 785                  * driver has indicated support for this. Otherwise, only allow
 786                  * the local address to be used.
 787                  */
 788                 if (!ieee80211_is_action(mgmt->frame_control) ||
 789                     mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
 790                         return -EINVAL;
 791                 if (!wdev->connected &&
 792                     !wiphy_ext_feature_isset(
 793                             &rdev->wiphy,
 794                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
 795                         return -EINVAL;
 796                 if (wdev->connected &&
 797                     !wiphy_ext_feature_isset(
 798                             &rdev->wiphy,
 799                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
 800                         return -EINVAL;
 801         }
 802
 803         /* Transmit the management frame as requested by user space */
 804         return rdev_mgmt_tx(rdev, wdev, params, cookie);
 805 }
 806
 807 bool cfg80211_rx_mgmt_ext(struct wireless_dev *wdev,
 808                           struct cfg80211_rx_info *info)
 809 {
 810         struct wiphy *wiphy = wdev->wiphy;
 811         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 812         struct cfg80211_mgmt_registration *reg;
 813         const struct ieee80211_txrx_stypes *stypes =
 814                 &wiphy->mgmt_stypes[wdev->iftype];
 815         struct ieee80211_mgmt *mgmt = (void *)info->buf;
 816         const u8 *data;
 817         int data_len;
 818         bool result = false;
 819         __le16 ftype = mgmt->frame_control &
 820                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 821         u16 stype;
 822
 823         trace_cfg80211_rx_mgmt(wdev, info);
 824         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 825
 826         if (!(stypes->rx & BIT(stype))) {
 827                 trace_cfg80211_return_bool(false);
 828                 return false;
 829         }
 830
 831         data = info->buf + ieee80211_hdrlen(mgmt->frame_control);
 832         data_len = info->len - ieee80211_hdrlen(mgmt->frame_control);
 833
 834         spin_lock_bh(&rdev->mgmt_registrations_lock);
 835
 836         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 837                 if (reg->frame_type != ftype)
 838                         continue;
 839
 840                 if (reg->match_len > data_len)
 841                         continue;
 842
 843                 if (memcmp(reg->match, data, reg->match_len))
 844                         continue;
 845
 846                 /* found match! */
 847
 848                 /* Indicate the received Action frame to user space */
 849                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, info,
 850                                       GFP_ATOMIC))
 851                         continue;
 852
 853                 result = true;
 854                 break;
 855         }
 856
 857         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 858
 859         trace_cfg80211_return_bool(result);
 860         return result;
 861 }
 862 EXPORT_SYMBOL(cfg80211_rx_mgmt_ext);
 863
 864 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
 865 {
 866         cancel_delayed_work(&rdev->dfs_update_channels_wk);
 867         queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
 868 }
 869
 870 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 871 {
 872         struct delayed_work *delayed_work = to_delayed_work(work);
 873         struct cfg80211_registered_device *rdev;
 874         struct cfg80211_chan_def chandef;
 875         struct ieee80211_supported_band *sband;
 876         struct ieee80211_channel *c;
 877         struct wiphy *wiphy;
 878         bool check_again = false;
 879         unsigned long timeout, next_time = 0;
 880         unsigned long time_dfs_update;
 881         enum nl80211_radar_event radar_event;
 882         int bandid, i;
 883
 884         rdev = container_of(delayed_work, struct cfg80211_registered_device,
 885                             dfs_update_channels_wk);
 886         wiphy = &rdev->wiphy;
 887
 888         rtnl_lock();
 889         for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
 890                 sband = wiphy->bands[bandid];
 891                 if (!sband)
 892                         continue;
 893
 894                 for (i = 0; i < sband->n_channels; i++) {
 895                         c = &sband->channels[i];
 896
 897                         if (!(c->flags & IEEE80211_CHAN_RADAR))
 898                                 continue;
 899
 900                         if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
 901                             c->dfs_state != NL80211_DFS_AVAILABLE)
 902                                 continue;
 903
 904                         if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
 905                                 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
 906                                 radar_event = NL80211_RADAR_NOP_FINISHED;
 907                         } else {
 908                                 if (regulatory_pre_cac_allowed(wiphy) ||
 909                                     cfg80211_any_wiphy_oper_chan(wiphy, c))
 910                                         continue;
 911
 912                                 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
 913                                 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
 914                         }
 915
 916                         timeout = c->dfs_state_entered +
 917                                   msecs_to_jiffies(time_dfs_update);
 918
 919                         if (time_after_eq(jiffies, timeout)) {
 920                                 c->dfs_state = NL80211_DFS_USABLE;
 921                                 c->dfs_state_entered = jiffies;
 922
 923                                 cfg80211_chandef_create(&chandef, c,
 924                                                         NL80211_CHAN_NO_HT);
 925
 926                                 nl80211_radar_notify(rdev, &chandef,
 927                                                      radar_event, NULL,
 928                                                      GFP_ATOMIC);
 929
 930                                 regulatory_propagate_dfs_state(wiphy, &chandef,
 931                                                                c->dfs_state,
 932                                                                radar_event);
 933                                 continue;
 934                         }
 935
 936                         if (!check_again)
 937                                 next_time = timeout - jiffies;
 938                         else
 939                                 next_time = min(next_time, timeout - jiffies);
 940                         check_again = true;
 941                 }
 942         }
 943         rtnl_unlock();
 944
 945         /* reschedule if there are other channels waiting to be cleared again */
 946         if (check_again)
 947                 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 948                                    next_time);
 949 }
 950
 951
 952 void __cfg80211_radar_event(struct wiphy *wiphy,
 953                             struct cfg80211_chan_def *chandef,
 954                             bool offchan, gfp_t gfp)
 955 {
 956         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 957
 958         trace_cfg80211_radar_event(wiphy, chandef, offchan);
 959
 960         /* only set the chandef supplied channel to unavailable, in
 961          * case the radar is detected on only one of multiple channels
 962          * spanned by the chandef.
 963          */
 964         cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 965
 966         if (offchan)
 967                 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
 968
 969         cfg80211_sched_dfs_chan_update(rdev);
 970
 971         nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 972
 973         memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
 974         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
 975 }
 976 EXPORT_SYMBOL(__cfg80211_radar_event);
 977
 978 void cfg80211_cac_event(struct net_device *netdev,
 979                         const struct cfg80211_chan_def *chandef,
 980                         enum nl80211_radar_event event, gfp_t gfp)
 981 {
 982         struct wireless_dev *wdev = netdev->ieee80211_ptr;
 983         struct wiphy *wiphy = wdev->wiphy;
 984         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 985         unsigned long timeout;
 986
 987         /* not yet supported */
 988         if (wdev->valid_links)
 989                 return;
 990
 991         trace_cfg80211_cac_event(netdev, event);
 992
 993         if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
 994                 return;
 995
 996         switch (event) {
 997         case NL80211_RADAR_CAC_FINISHED:
 998                 timeout = wdev->cac_start_time +
 999                           msecs_to_jiffies(wdev->cac_time_ms);
1000                 WARN_ON(!time_after_eq(jiffies, timeout));
1001                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1002                 memcpy(&rdev->cac_done_chandef, chandef,
1003                        sizeof(struct cfg80211_chan_def));
1004                 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1005                 cfg80211_sched_dfs_chan_update(rdev);
1006                 fallthrough;
1007         case NL80211_RADAR_CAC_ABORTED:
1008                 wdev->cac_started = false;
1009                 break;
1010         case NL80211_RADAR_CAC_STARTED:
1011                 wdev->cac_started = true;
1012                 break;
1013         default:
1014                 WARN_ON(1);
1015                 return;
1016         }
1017
1018         nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
1019 }
1020 EXPORT_SYMBOL(cfg80211_cac_event);
1021
1022 static void
1023 __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1024                                 struct wireless_dev *wdev,
1025                                 const struct cfg80211_chan_def *chandef,
1026                                 enum nl80211_radar_event event)
1027 {
1028         struct wiphy *wiphy = &rdev->wiphy;
1029         struct net_device *netdev;
1030
1031         lockdep_assert_wiphy(&rdev->wiphy);
1032
1033         if (!cfg80211_chandef_valid(chandef))
1034                 return;
1035
1036         if (!rdev->background_radar_wdev)
1037                 return;
1038
1039         switch (event) {
1040         case NL80211_RADAR_CAC_FINISHED:
1041                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1042                 memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
1043                 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1044                 cfg80211_sched_dfs_chan_update(rdev);
1045                 wdev = rdev->background_radar_wdev;
1046                 break;
1047         case NL80211_RADAR_CAC_ABORTED:
1048                 if (!cancel_delayed_work(&rdev->background_cac_done_wk))
1049                         return;
1050                 wdev = rdev->background_radar_wdev;
1051                 break;
1052         case NL80211_RADAR_CAC_STARTED:
1053                 break;
1054         default:
1055                 return;
1056         }
1057
1058         netdev = wdev ? wdev->netdev : NULL;
1059         nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
1060 }
1061
1062 static void
1063 cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1064                               const struct cfg80211_chan_def *chandef,
1065                               enum nl80211_radar_event event)
1066 {
1067         wiphy_lock(&rdev->wiphy);
1068         __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
1069                                         chandef, event);
1070         wiphy_unlock(&rdev->wiphy);
1071 }
1072
1073 void cfg80211_background_cac_done_wk(struct work_struct *work)
1074 {
1075         struct delayed_work *delayed_work = to_delayed_work(work);
1076         struct cfg80211_registered_device *rdev;
1077
1078         rdev = container_of(delayed_work, struct cfg80211_registered_device,
1079                             background_cac_done_wk);
1080         cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1081                                       NL80211_RADAR_CAC_FINISHED);
1082 }
1083
1084 void cfg80211_background_cac_abort_wk(struct work_struct *work)
1085 {
1086         struct cfg80211_registered_device *rdev;
1087
1088         rdev = container_of(work, struct cfg80211_registered_device,
1089                             background_cac_abort_wk);
1090         cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1091                                       NL80211_RADAR_CAC_ABORTED);
1092 }
1093
1094 void cfg80211_background_cac_abort(struct wiphy *wiphy)
1095 {
1096         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1097
1098         queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
1099 }
1100 EXPORT_SYMBOL(cfg80211_background_cac_abort);
1101
1102 int
1103 cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
1104                                           struct wireless_dev *wdev,
1105                                           struct cfg80211_chan_def *chandef)
1106 {
1107         unsigned int cac_time_ms;
1108         int err;
1109
1110         lockdep_assert_wiphy(&rdev->wiphy);
1111
1112         if (!wiphy_ext_feature_isset(&rdev->wiphy,
1113                                      NL80211_EXT_FEATURE_RADAR_BACKGROUND))
1114                 return -EOPNOTSUPP;
1115
1116         /* Offchannel chain already locked by another wdev */
1117         if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
1118                 return -EBUSY;
1119
1120         /* CAC already in progress on the offchannel chain */
1121         if (rdev->background_radar_wdev == wdev &&
1122             delayed_work_pending(&rdev->background_cac_done_wk))
1123                 return -EBUSY;
1124
1125         err = rdev_set_radar_background(rdev, chandef);
1126         if (err)
1127                 return err;
1128
1129         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
1130         if (!cac_time_ms)
1131                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1132
1133         rdev->background_radar_chandef = *chandef;
1134         rdev->background_radar_wdev = wdev; /* Get offchain ownership */
1135
1136         __cfg80211_background_cac_event(rdev, wdev, chandef,
1137                                         NL80211_RADAR_CAC_STARTED);
1138         queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
1139                            msecs_to_jiffies(cac_time_ms));
1140
1141         return 0;
1142 }
1143
1144 void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
1145 {
1146         struct wiphy *wiphy = wdev->wiphy;
1147         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1148
1149         lockdep_assert_wiphy(wiphy);
1150
1151         if (wdev != rdev->background_radar_wdev)
1152                 return;
1153
1154         rdev_set_radar_background(rdev, NULL);
1155         rdev->background_radar_wdev = NULL; /* Release offchain ownership */
1156
1157         __cfg80211_background_cac_event(rdev, wdev,
1158                                         &rdev->background_radar_chandef,
1159                                         NL80211_RADAR_CAC_ABORTED);
1160 }