projects/linux·blob master · refs

1477 lines · 39.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * cfg80211 MLME SAP interface
4 *
5 * Copyright (c) 2009, Jouni Malinen <[email protected]>
6 * Copyright (c) 2015 Intel Deutschland GmbH
7 * Copyright (C) 2019-2020, 2022-2026 Intel Corporation
8 */
9
10#include <linux/kernel.h>
11#include <linux/module.h>
12#include <linux/etherdevice.h>
13#include <linux/netdevice.h>
14#include <linux/nl80211.h>
15#include <linux/slab.h>
16#include <linux/wireless.h>
17#include <net/cfg80211.h>
18#include <net/iw_handler.h>
19#include "core.h"
20#include "nl80211.h"
21#include "rdev-ops.h"
22
23
24void cfg80211_rx_assoc_resp(struct net_device *dev,
25 const struct cfg80211_rx_assoc_resp_data *data)
26{
27 struct wireless_dev *wdev = dev->ieee80211_ptr;
28 struct wiphy *wiphy = wdev->wiphy;
29 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
30 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf;
31 struct cfg80211_connect_resp_params cr = {
32 .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED,
33 .req_ie = data->req_ies,
34 .req_ie_len = data->req_ies_len,
35 .ap_mld_addr = data->ap_mld_addr,
36 .assoc_encrypted = data->assoc_encrypted,
37 };
38 unsigned int link_id;
39 bool is_s1g = false;
40
41 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
42 cr.links[link_id].status = data->links[link_id].status;
43 cr.links[link_id].bss = data->links[link_id].bss;
44
45 WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&
46 (!cr.ap_mld_addr || !cr.links[link_id].bss));
47
48 if (!cr.links[link_id].bss)
49 continue;
50 cr.links[link_id].bssid = data->links[link_id].bss->bssid;
51 cr.links[link_id].addr = data->links[link_id].addr;
52 /* need to have local link addresses for MLO connections */
53 WARN_ON(cr.ap_mld_addr &&
54 !is_valid_ether_addr(cr.links[link_id].addr));
55
56 BUG_ON(!cr.links[link_id].bss->channel);
57
58 if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) {
59 WARN_ON(link_id);
60 is_s1g = true;
61 }
62
63 if (cr.ap_mld_addr)
64 cr.valid_links |= BIT(link_id);
65 }
66
67 if (is_s1g) {
68 if (data->len < offsetof(struct ieee80211_mgmt,
69 u.s1g_assoc_resp.variable))
70 goto free_bss;
71 cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;
72 cr.resp_ie_len = data->len -
73 offsetof(struct ieee80211_mgmt,
74 u.s1g_assoc_resp.variable);
75 } else {
76 if (data->len < offsetof(struct ieee80211_mgmt,
77 u.assoc_resp.variable))
78 goto free_bss;
79 cr.resp_ie = mgmt->u.assoc_resp.variable;
80 cr.resp_ie_len = data->len -
81 offsetof(struct ieee80211_mgmt,
82 u.assoc_resp.variable);
83 }
84 cr.status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
85
86 trace_cfg80211_send_rx_assoc(dev, data);
87
88 /*
89 * This is a bit of a hack, we don't notify userspace of
90 * a (re-)association reply if we tried to send a reassoc
91 * and got a reject -- we only try again with an assoc
92 * frame instead of reassoc.
93 */
94 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status))
95 goto free_bss;
96
97 nl80211_send_rx_assoc(rdev, dev, data);
98 /* update current_bss etc., consumes the bss reference */
99 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
100 return;
101
102free_bss:
103 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
104 struct cfg80211_bss *bss = data->links[link_id].bss;
105
106 if (!bss)
107 continue;
108
109 cfg80211_unhold_bss(bss_from_pub(bss));
110 cfg80211_put_bss(wiphy, bss);
111 }
112}
113EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
114
115static void cfg80211_process_auth(struct wireless_dev *wdev,
116 const u8 *buf, size_t len)
117{
118 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
119
120 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
121 cfg80211_sme_rx_auth(wdev, buf, len);
122}
123
124static void cfg80211_process_deauth(struct wireless_dev *wdev,
125 const u8 *buf, size_t len,
126 bool reconnect)
127{
128 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
129 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
130 const u8 *bssid = mgmt->bssid;
131 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
132 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
133
134 nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
135
136 if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid))
137 return;
138
139 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
140 cfg80211_sme_deauth(wdev);
141}
142
143static void cfg80211_process_disassoc(struct wireless_dev *wdev,
144 const u8 *buf, size_t len,
145 bool reconnect)
146{
147 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
148 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
149 const u8 *bssid = mgmt->bssid;
150 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
151 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
152
153 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
154 GFP_KERNEL);
155
156 if (WARN_ON(!wdev->connected ||
157 !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
158 return;
159
160 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
161 cfg80211_sme_disassoc(wdev);
162}
163
164void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
165{
166 struct wireless_dev *wdev = dev->ieee80211_ptr;
167 struct ieee80211_mgmt *mgmt = (void *)buf;
168 __le16 fc;
169
170 lockdep_assert_wiphy(wdev->wiphy);
171
172 if (len < sizeof(fc))
173 return;
174
175 fc = mgmt->frame_control;
176
177 if (ieee80211_is_auth(fc)) {
178 if (len < offsetofend(struct ieee80211_mgmt, u.auth.status_code))
179 return;
180 } else if (ieee80211_is_deauth(fc)) {
181 if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))
182 return;
183 } else if (ieee80211_is_disassoc(fc)) {
184 if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code))
185 return;
186 } else {
187 return;
188 }
189
190 trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
191
192 if (ieee80211_is_auth(fc))
193 cfg80211_process_auth(wdev, buf, len);
194 else if (ieee80211_is_deauth(fc))
195 cfg80211_process_deauth(wdev, buf, len, false);
196 else
197 cfg80211_process_disassoc(wdev, buf, len, false);
198}
199EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
200
201void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
202{
203 struct wireless_dev *wdev = dev->ieee80211_ptr;
204 struct wiphy *wiphy = wdev->wiphy;
205 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
206
207 trace_cfg80211_send_auth_timeout(dev, addr);
208
209 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
210 cfg80211_sme_auth_timeout(wdev);
211}
212EXPORT_SYMBOL(cfg80211_auth_timeout);
213
214void cfg80211_assoc_failure(struct net_device *dev,
215 struct cfg80211_assoc_failure *data)
216{
217 struct wireless_dev *wdev = dev->ieee80211_ptr;
218 struct wiphy *wiphy = wdev->wiphy;
219 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
220 const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid;
221 int i;
222
223 trace_cfg80211_send_assoc_failure(dev, data);
224
225 if (data->timeout) {
226 nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
227 cfg80211_sme_assoc_timeout(wdev);
228 } else {
229 cfg80211_sme_abandon_assoc(wdev);
230 }
231
232 for (i = 0; i < ARRAY_SIZE(data->bss); i++) {
233 struct cfg80211_bss *bss = data->bss[i];
234
235 if (!bss)
236 continue;
237
238 cfg80211_unhold_bss(bss_from_pub(bss));
239 cfg80211_put_bss(wiphy, bss);
240 }
241}
242EXPORT_SYMBOL(cfg80211_assoc_failure);
243
244void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
245 bool reconnect)
246{
247 struct wireless_dev *wdev = dev->ieee80211_ptr;
248 struct ieee80211_mgmt *mgmt = (void *)buf;
249 __le16 fc;
250
251 lockdep_assert_wiphy(wdev->wiphy);
252
253 if (len < sizeof(fc))
254 return;
255
256 fc = mgmt->frame_control;
257
258 if (ieee80211_is_deauth(fc)) {
259 if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))
260 return;
261 } else if (ieee80211_is_disassoc(fc)) {
262 if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code))
263 return;
264 } else {
265 return;
266 }
267
268 trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
269
270 if (ieee80211_is_deauth(fc))
271 cfg80211_process_deauth(wdev, buf, len, reconnect);
272 else
273 cfg80211_process_disassoc(wdev, buf, len, reconnect);
274}
275EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
276
277void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
278 enum nl80211_key_type key_type, int key_id,
279 const u8 *tsc, gfp_t gfp)
280{
281 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
282 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
283#ifdef CONFIG_CFG80211_WEXT
284 union iwreq_data wrqu;
285 char *buf = kmalloc(128, gfp);
286
287 if (buf) {
288 memset(&wrqu, 0, sizeof(wrqu));
289 wrqu.data.length =
290 sprintf(buf, "MLME-MICHAELMICFAILURE."
291 "indication(keyid=%d %scast addr=%pM)",
292 key_id, key_type == NL80211_KEYTYPE_GROUP
293 ? "broad" : "uni", addr);
294 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
295 kfree(buf);
296 }
297#endif
298
299 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
300 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
301}
302EXPORT_SYMBOL(cfg80211_michael_mic_failure);
303
304/* some MLME handling for userspace SME */
305int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
306 struct net_device *dev,
307 struct cfg80211_auth_request *req)
308{
309 struct wireless_dev *wdev = dev->ieee80211_ptr;
310
311 lockdep_assert_wiphy(wdev->wiphy);
312
313 if (!req->bss)
314 return -ENOENT;
315
316 if (req->link_id >= 0 &&
317 !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
318 return -EINVAL;
319
320 if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
321 if (!req->key || !req->key_len ||
322 req->key_idx < 0 || req->key_idx > 3)
323 return -EINVAL;
324 }
325
326 if (wdev->connected &&
327 ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
328 return -EALREADY;
329
330 if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
331 (req->link_id >= 0 &&
332 ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
333 return -EINVAL;
334
335 return rdev_auth(rdev, dev, req);
336}
337
338/* Do a logical ht_capa &= ht_capa_mask. */
339void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
340 const struct ieee80211_ht_cap *ht_capa_mask)
341{
342 int i;
343 u8 *p1, *p2;
344 if (!ht_capa_mask) {
345 memset(ht_capa, 0, sizeof(*ht_capa));
346 return;
347 }
348
349 p1 = (u8*)(ht_capa);
350 p2 = (u8*)(ht_capa_mask);
351 for (i = 0; i < sizeof(*ht_capa); i++)
352 p1[i] &= p2[i];
353}
354
355/* Do a logical vht_capa &= vht_capa_mask. */
356void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
357 const struct ieee80211_vht_cap *vht_capa_mask)
358{
359 int i;
360 u8 *p1, *p2;
361 if (!vht_capa_mask) {
362 memset(vht_capa, 0, sizeof(*vht_capa));
363 return;
364 }
365
366 p1 = (u8*)(vht_capa);
367 p2 = (u8*)(vht_capa_mask);
368 for (i = 0; i < sizeof(*vht_capa); i++)
369 p1[i] &= p2[i];
370}
371
372static int
373cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,
374 const struct ieee80211_multi_link_elem *mle_b,
375 struct netlink_ext_ack *extack)
376{
377 const struct ieee80211_mle_basic_common_info *common_a, *common_b;
378
379 common_a = (const void *)mle_a->variable;
380 common_b = (const void *)mle_b->variable;
381
382 if (memcmp(common_a->mld_mac_addr, common_b->mld_mac_addr, ETH_ALEN)) {
383 NL_SET_ERR_MSG(extack, "AP MLD address mismatch");
384 return -EINVAL;
385 }
386
387 if (ieee80211_mle_get_eml_cap((const u8 *)mle_a) !=
388 ieee80211_mle_get_eml_cap((const u8 *)mle_b)) {
389 NL_SET_ERR_MSG(extack, "link EML capabilities mismatch");
390 return -EINVAL;
391 }
392
393 if (ieee80211_mle_get_mld_capa_op((const u8 *)mle_a) !=
394 ieee80211_mle_get_mld_capa_op((const u8 *)mle_b)) {
395 NL_SET_ERR_MSG(extack, "link MLD capabilities/ops mismatch");
396 return -EINVAL;
397 }
398
399 /*
400 * Only verify the values in Extended MLD Capabilities that are
401 * not reserved when transmitted by an AP (and expected to remain the
402 * same over time).
403 * The Recommended Max Simultaneous Links subfield in particular is
404 * reserved when included in a unicast Probe Response frame and may
405 * also change when the AP adds/removes links. The BTM MLD
406 * Recommendation For Multiple APs Support subfield is reserved when
407 * transmitted by an AP.
408 */
409 if ((ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_a) &
410 (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE |
411 IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE |
412 IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK |
413 IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM)) !=
414 (ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_b) &
415 (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE |
416 IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE |
417 IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK |
418 IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM))) {
419 NL_SET_ERR_MSG(extack,
420 "extended link MLD capabilities/ops mismatch");
421 return -EINVAL;
422 }
423
424 return 0;
425}
426
427static int cfg80211_mlme_check_mlo(struct net_device *dev,
428 struct cfg80211_assoc_request *req,
429 struct netlink_ext_ack *extack)
430{
431 const struct ieee80211_multi_link_elem *mles[ARRAY_SIZE(req->links)] = {};
432 int i;
433
434 if (req->link_id < 0)
435 return 0;
436
437 if (!req->links[req->link_id].bss) {
438 NL_SET_ERR_MSG(extack, "no BSS for assoc link");
439 return -EINVAL;
440 }
441
442 rcu_read_lock();
443 for (i = 0; i < ARRAY_SIZE(req->links); i++) {
444 const struct cfg80211_bss_ies *ies;
445 const struct element *ml;
446
447 if (!req->links[i].bss)
448 continue;
449
450 if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr)) {
451 NL_SET_ERR_MSG(extack, "BSSID must not be our address");
452 req->links[i].error = -EINVAL;
453 goto error;
454 }
455
456 ies = rcu_dereference(req->links[i].bss->ies);
457 ml = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
458 ies->data, ies->len);
459 if (!ml) {
460 NL_SET_ERR_MSG(extack, "MLO BSS w/o ML element");
461 req->links[i].error = -EINVAL;
462 goto error;
463 }
464
465 if (!ieee80211_mle_type_ok(ml->data + 1,
466 IEEE80211_ML_CONTROL_TYPE_BASIC,
467 ml->datalen - 1)) {
468 NL_SET_ERR_MSG(extack, "BSS with invalid ML element");
469 req->links[i].error = -EINVAL;
470 goto error;
471 }
472
473 mles[i] = (const void *)(ml->data + 1);
474
475 if (ieee80211_mle_get_link_id((const u8 *)mles[i]) != i) {
476 NL_SET_ERR_MSG(extack, "link ID mismatch");
477 req->links[i].error = -EINVAL;
478 goto error;
479 }
480 }
481
482 if (WARN_ON(!mles[req->link_id]))
483 goto error;
484
485 for (i = 0; i < ARRAY_SIZE(req->links); i++) {
486 if (i == req->link_id || !req->links[i].bss)
487 continue;
488
489 if (WARN_ON(!mles[i]))
490 goto error;
491
492 if (cfg80211_mlme_check_mlo_compat(mles[req->link_id], mles[i],
493 extack)) {
494 req->links[i].error = -EINVAL;
495 goto error;
496 }
497 }
498
499 rcu_read_unlock();
500 return 0;
501error:
502 rcu_read_unlock();
503 return -EINVAL;
504}
505
506/* Note: caller must cfg80211_put_bss() regardless of result */
507int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
508 struct net_device *dev,
509 struct cfg80211_assoc_request *req,
510 struct netlink_ext_ack *extack)
511{
512 struct wireless_dev *wdev = dev->ieee80211_ptr;
513 int err;
514
515 lockdep_assert_wiphy(wdev->wiphy);
516
517 err = cfg80211_mlme_check_mlo(dev, req, extack);
518 if (err)
519 return err;
520
521 if (wdev->connected &&
522 (!req->prev_bssid ||
523 !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
524 return -EALREADY;
525
526 if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
527 (req->link_id >= 0 &&
528 ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
529 return -EINVAL;
530
531 cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
532 rdev->wiphy.ht_capa_mod_mask);
533 cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
534 rdev->wiphy.vht_capa_mod_mask);
535
536 err = rdev_assoc(rdev, dev, req);
537 if (!err) {
538 int link_id;
539
540 if (req->bss) {
541 cfg80211_ref_bss(&rdev->wiphy, req->bss);
542 cfg80211_hold_bss(bss_from_pub(req->bss));
543 }
544
545 for (link_id = 0; link_id < ARRAY_SIZE(req->links); link_id++) {
546 if (!req->links[link_id].bss)
547 continue;
548 cfg80211_ref_bss(&rdev->wiphy, req->links[link_id].bss);
549 cfg80211_hold_bss(bss_from_pub(req->links[link_id].bss));
550 }
551 }
552 return err;
553}
554
555int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
556 struct net_device *dev, const u8 *bssid,
557 const u8 *ie, int ie_len, u16 reason,
558 bool local_state_change)
559{
560 struct wireless_dev *wdev = dev->ieee80211_ptr;
561 struct cfg80211_deauth_request req = {
562 .bssid = bssid,
563 .reason_code = reason,
564 .ie = ie,
565 .ie_len = ie_len,
566 .local_state_change = local_state_change,
567 };
568
569 lockdep_assert_wiphy(wdev->wiphy);
570
571 if (local_state_change &&
572 (!wdev->connected ||
573 !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
574 return 0;
575
576 if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
577 (wdev->connected &&
578 ether_addr_equal(wdev->u.client.connected_addr, bssid)))
579 wdev->conn_owner_nlportid = 0;
580
581 return rdev_deauth(rdev, dev, &req);
582}
583
584int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
585 struct net_device *dev, const u8 *ap_addr,
586 const u8 *ie, int ie_len, u16 reason,
587 bool local_state_change)
588{
589 struct wireless_dev *wdev = dev->ieee80211_ptr;
590 struct cfg80211_disassoc_request req = {
591 .reason_code = reason,
592 .local_state_change = local_state_change,
593 .ie = ie,
594 .ie_len = ie_len,
595 .ap_addr = ap_addr,
596 };
597 int err;
598
599 lockdep_assert_wiphy(wdev->wiphy);
600
601 if (!wdev->connected)
602 return -ENOTCONN;
603
604 if (memcmp(wdev->u.client.connected_addr, ap_addr, ETH_ALEN))
605 return -ENOTCONN;
606
607 err = rdev_disassoc(rdev, dev, &req);
608 if (err)
609 return err;
610
611 /* driver should have reported the disassoc */
612 WARN_ON(wdev->connected);
613 return 0;
614}
615
616void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
617 struct net_device *dev)
618{
619 struct wireless_dev *wdev = dev->ieee80211_ptr;
620 u8 bssid[ETH_ALEN];
621
622 lockdep_assert_wiphy(wdev->wiphy);
623
624 if (!rdev->ops->deauth)
625 return;
626
627 if (!wdev->connected)
628 return;
629
630 memcpy(bssid, wdev->u.client.connected_addr, ETH_ALEN);
631 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
632 WLAN_REASON_DEAUTH_LEAVING, false);
633}
634
635struct cfg80211_mgmt_registration {
636 struct list_head list;
637 struct wireless_dev *wdev;
638
639 u32 nlportid;
640
641 int match_len;
642
643 __le16 frame_type;
644
645 bool multicast_rx;
646
647 u8 match[];
648};
649
650static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
651{
652 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
653 struct wireless_dev *tmp;
654 struct cfg80211_mgmt_registration *reg;
655 struct mgmt_frame_regs upd = {};
656
657 lockdep_assert_held(&rdev->wiphy.mtx);
658
659 spin_lock_bh(&rdev->mgmt_registrations_lock);
660 if (!wdev->mgmt_registrations_need_update) {
661 spin_unlock_bh(&rdev->mgmt_registrations_lock);
662 return;
663 }
664
665 rcu_read_lock();
666 list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) {
667 list_for_each_entry(reg, &tmp->mgmt_registrations, list) {
668 u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4);
669 u32 mcast_mask = 0;
670
671 if (reg->multicast_rx)
672 mcast_mask = mask;
673
674 upd.global_stypes |= mask;
675 upd.global_mcast_stypes |= mcast_mask;
676
677 if (tmp == wdev) {
678 upd.interface_stypes |= mask;
679 upd.interface_mcast_stypes |= mcast_mask;
680 }
681 }
682 }
683 rcu_read_unlock();
684
685 wdev->mgmt_registrations_need_update = 0;
686 spin_unlock_bh(&rdev->mgmt_registrations_lock);
687
688 rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
689}
690
691void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk)
692{
693 struct cfg80211_registered_device *rdev;
694 struct wireless_dev *wdev;
695
696 rdev = container_of(wk, struct cfg80211_registered_device,
697 mgmt_registrations_update_wk);
698
699 guard(wiphy)(&rdev->wiphy);
700
701 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
702 cfg80211_mgmt_registrations_update(wdev);
703}
704
705int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
706 u16 frame_type, const u8 *match_data,
707 int match_len, bool multicast_rx,
708 struct netlink_ext_ack *extack)
709{
710 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
711 struct cfg80211_mgmt_registration *reg, *nreg;
712 int err = 0;
713 u16 mgmt_type;
714 bool update_multicast = false;
715
716 if (!wdev->wiphy->mgmt_stypes)
717 return -EOPNOTSUPP;
718
719 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
720 NL_SET_ERR_MSG(extack, "frame type not management");
721 return -EINVAL;
722 }
723
724 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
725 NL_SET_ERR_MSG(extack, "Invalid frame type");
726 return -EINVAL;
727 }
728
729 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
730 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
731 NL_SET_ERR_MSG(extack,
732 "Registration to specific type not supported");
733 return -EINVAL;
734 }
735
736 /*
737 * To support Pre Association Security Negotiation (PASN), registration
738 * for authentication frames should be supported. However, as some
739 * versions of the user space daemons wrongly register to all types of
740 * authentication frames (which might result in unexpected behavior)
741 * allow such registration if the request is for a specific
742 * authentication algorithm number.
743 */
744 if (wdev->iftype == NL80211_IFTYPE_STATION &&
745 (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
746 !(match_data && match_len >= 2)) {
747 NL_SET_ERR_MSG(extack,
748 "Authentication algorithm number required");
749 return -EINVAL;
750 }
751
752 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
753 if (!nreg)
754 return -ENOMEM;
755
756 spin_lock_bh(&rdev->mgmt_registrations_lock);
757
758 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
759 int mlen = min(match_len, reg->match_len);
760
761 if (frame_type != le16_to_cpu(reg->frame_type))
762 continue;
763
764 if (memcmp(reg->match, match_data, mlen) == 0) {
765 if (reg->multicast_rx != multicast_rx) {
766 update_multicast = true;
767 reg->multicast_rx = multicast_rx;
768 break;
769 }
770 NL_SET_ERR_MSG(extack, "Match already configured");
771 err = -EALREADY;
772 break;
773 }
774 }
775
776 if (err)
777 goto out;
778
779 if (update_multicast) {
780 kfree(nreg);
781 } else {
782 memcpy(nreg->match, match_data, match_len);
783 nreg->match_len = match_len;
784 nreg->nlportid = snd_portid;
785 nreg->frame_type = cpu_to_le16(frame_type);
786 nreg->wdev = wdev;
787 nreg->multicast_rx = multicast_rx;
788 list_add(&nreg->list, &wdev->mgmt_registrations);
789 }
790 wdev->mgmt_registrations_need_update = 1;
791 spin_unlock_bh(&rdev->mgmt_registrations_lock);
792
793 cfg80211_mgmt_registrations_update(wdev);
794
795 return 0;
796
797 out:
798 kfree(nreg);
799 spin_unlock_bh(&rdev->mgmt_registrations_lock);
800
801 return err;
802}
803
804void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
805{
806 struct wiphy *wiphy = wdev->wiphy;
807 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
808 struct cfg80211_mgmt_registration *reg, *tmp;
809
810 spin_lock_bh(&rdev->mgmt_registrations_lock);
811
812 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
813 if (reg->nlportid != nlportid)
814 continue;
815
816 list_del(&reg->list);
817 kfree(reg);
818
819 wdev->mgmt_registrations_need_update = 1;
820 schedule_work(&rdev->mgmt_registrations_update_wk);
821 }
822
823 spin_unlock_bh(&rdev->mgmt_registrations_lock);
824
825 if (nlportid && rdev->crit_proto_nlportid == nlportid) {
826 rdev->crit_proto_nlportid = 0;
827 rdev_crit_proto_stop(rdev, wdev);
828 }
829
830 if (nlportid == wdev->unexpected_nlportid)
831 wdev->unexpected_nlportid = 0;
832}
833
834void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
835{
836 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
837 struct cfg80211_mgmt_registration *reg, *tmp;
838
839 spin_lock_bh(&rdev->mgmt_registrations_lock);
840 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
841 list_del(&reg->list);
842 kfree(reg);
843 }
844 wdev->mgmt_registrations_need_update = 1;
845 spin_unlock_bh(&rdev->mgmt_registrations_lock);
846
847 cfg80211_mgmt_registrations_update(wdev);
848}
849
850static bool cfg80211_allowed_address(struct wireless_dev *wdev, const u8 *addr)
851{
852 int i;
853
854 for_each_valid_link(wdev, i) {
855 if (ether_addr_equal(addr, wdev->links[i].addr))
856 return true;
857 }
858
859 return ether_addr_equal(addr, wdev_address(wdev));
860}
861
862static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,
863 const struct ieee80211_mgmt *mgmt)
864{
865 if (ieee80211_is_auth(mgmt->frame_control) ||
866 ieee80211_is_deauth(mgmt->frame_control)) {
867 /* Allow random TA to be used with authentication and
868 * deauthentication frames if the driver has indicated support.
869 */
870 if (wiphy_ext_feature_isset(
871 wdev->wiphy,
872 NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA))
873 return true;
874 } else if (ieee80211_is_action(mgmt->frame_control) &&
875 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
876 /* Allow random TA to be used with Public Action frames if the
877 * driver has indicated support.
878 */
879 if (!wdev->connected &&
880 wiphy_ext_feature_isset(
881 wdev->wiphy,
882 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
883 return true;
884
885 if (wdev->connected &&
886 wiphy_ext_feature_isset(
887 wdev->wiphy,
888 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
889 return true;
890 }
891
892 return false;
893}
894
895int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
896 struct wireless_dev *wdev,
897 struct cfg80211_mgmt_tx_params *params, u64 cookie)
898{
899 const struct ieee80211_mgmt *mgmt;
900 u16 stype;
901
902 lockdep_assert_wiphy(&rdev->wiphy);
903
904 if (!wdev->wiphy->mgmt_stypes)
905 return -EOPNOTSUPP;
906
907 if (!rdev->ops->mgmt_tx)
908 return -EOPNOTSUPP;
909
910 if (params->len < 24 + 1)
911 return -EINVAL;
912
913 mgmt = (const struct ieee80211_mgmt *)params->buf;
914
915 if (!ieee80211_is_mgmt(mgmt->frame_control) ||
916 ieee80211_has_order(mgmt->frame_control))
917 return -EINVAL;
918
919 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
920 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
921 return -EINVAL;
922
923 if (ieee80211_is_action(mgmt->frame_control) &&
924 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
925 int err = 0;
926
927 switch (wdev->iftype) {
928 case NL80211_IFTYPE_ADHOC:
929 /*
930 * check for IBSS DA must be done by driver as
931 * cfg80211 doesn't track the stations
932 */
933 if (!wdev->u.ibss.current_bss ||
934 !ether_addr_equal(wdev->u.ibss.current_bss->pub.bssid,
935 mgmt->bssid)) {
936 err = -ENOTCONN;
937 break;
938 }
939 break;
940 case NL80211_IFTYPE_STATION:
941 case NL80211_IFTYPE_P2P_CLIENT:
942 if (!wdev->connected) {
943 err = -ENOTCONN;
944 break;
945 }
946
947 /* FIXME: MLD may address this differently */
948
949 if (!ether_addr_equal(wdev->u.client.connected_addr,
950 mgmt->bssid)) {
951 err = -ENOTCONN;
952 break;
953 }
954
955 /* for station, check that DA is the AP */
956 if (!ether_addr_equal(wdev->u.client.connected_addr,
957 mgmt->da)) {
958 err = -ENOTCONN;
959 break;
960 }
961 break;
962 case NL80211_IFTYPE_AP:
963 case NL80211_IFTYPE_P2P_GO:
964 case NL80211_IFTYPE_AP_VLAN:
965 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)) &&
966 (params->link_id < 0 ||
967 !ether_addr_equal(mgmt->bssid,
968 wdev->links[params->link_id].addr)))
969 err = -EINVAL;
970 break;
971 case NL80211_IFTYPE_MESH_POINT:
972 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
973 err = -EINVAL;
974 break;
975 }
976 /*
977 * check for mesh DA must be done by driver as
978 * cfg80211 doesn't track the stations
979 */
980 break;
981 case NL80211_IFTYPE_NAN:
982 case NL80211_IFTYPE_NAN_DATA:
983 if (mgmt->u.action.category !=
984 WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
985 err = -EOPNOTSUPP;
986 break;
987 case NL80211_IFTYPE_P2P_DEVICE:
988 /*
989 * fall through, P2P device only supports
990 * public action frames
991 */
992 case NL80211_IFTYPE_PD:
993 default:
994 err = -EOPNOTSUPP;
995 break;
996 }
997
998 if (err)
999 return err;
1000 }
1001
1002 if (!cfg80211_allowed_address(wdev, mgmt->sa) &&
1003 !cfg80211_allowed_random_address(wdev, mgmt))
1004 return -EINVAL;
1005
1006 /* Transmit the management frame as requested by user space */
1007 return rdev_mgmt_tx(rdev, wdev, params, cookie);
1008}
1009
1010bool cfg80211_rx_mgmt_ext(struct wireless_dev *wdev,
1011 struct cfg80211_rx_info *info)
1012{
1013 struct wiphy *wiphy = wdev->wiphy;
1014 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1015 struct cfg80211_mgmt_registration *reg;
1016 const struct ieee80211_txrx_stypes *stypes =
1017 &wiphy->mgmt_stypes[wdev->iftype];
1018 struct ieee80211_mgmt *mgmt = (void *)info->buf;
1019 const u8 *data;
1020 int data_len;
1021 bool result = false;
1022 __le16 ftype = mgmt->frame_control &
1023 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
1024 u16 stype;
1025
1026 trace_cfg80211_rx_mgmt(wdev, info);
1027 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
1028
1029 if (!(stypes->rx & BIT(stype))) {
1030 trace_cfg80211_return_bool(false);
1031 return false;
1032 }
1033
1034 data = info->buf + ieee80211_hdrlen(mgmt->frame_control);
1035 data_len = info->len - ieee80211_hdrlen(mgmt->frame_control);
1036
1037 spin_lock_bh(&rdev->mgmt_registrations_lock);
1038
1039 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
1040 if (reg->frame_type != ftype)
1041 continue;
1042
1043 if (reg->match_len > data_len)
1044 continue;
1045
1046 if (memcmp(reg->match, data, reg->match_len))
1047 continue;
1048
1049 /* found match! */
1050
1051 /* Indicate the received Action frame to user space */
1052 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, info,
1053 GFP_ATOMIC))
1054 continue;
1055
1056 result = true;
1057 break;
1058 }
1059
1060 spin_unlock_bh(&rdev->mgmt_registrations_lock);
1061
1062 trace_cfg80211_return_bool(result);
1063 return result;
1064}
1065EXPORT_SYMBOL(cfg80211_rx_mgmt_ext);
1066
1067void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
1068{
1069 cancel_delayed_work(&rdev->dfs_update_channels_wk);
1070 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
1071}
1072
1073void cfg80211_dfs_channels_update_work(struct work_struct *work)
1074{
1075 struct delayed_work *delayed_work = to_delayed_work(work);
1076 struct cfg80211_registered_device *rdev;
1077 struct cfg80211_chan_def chandef;
1078 struct ieee80211_supported_band *sband;
1079 struct ieee80211_channel *c;
1080 struct wiphy *wiphy;
1081 bool check_again = false;
1082 unsigned long timeout, next_time = 0;
1083 unsigned long time_dfs_update;
1084 enum nl80211_radar_event radar_event;
1085 int bandid, i;
1086
1087 rdev = container_of(delayed_work, struct cfg80211_registered_device,
1088 dfs_update_channels_wk);
1089 wiphy = &rdev->wiphy;
1090
1091 rtnl_lock();
1092 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
1093 sband = wiphy->bands[bandid];
1094 if (!sband)
1095 continue;
1096
1097 for (i = 0; i < sband->n_channels; i++) {
1098 c = &sband->channels[i];
1099
1100 if (!(c->flags & IEEE80211_CHAN_RADAR))
1101 continue;
1102
1103 if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
1104 c->dfs_state != NL80211_DFS_AVAILABLE)
1105 continue;
1106
1107 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
1108 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
1109 radar_event = NL80211_RADAR_NOP_FINISHED;
1110 } else {
1111 if (regulatory_pre_cac_allowed(wiphy) ||
1112 cfg80211_any_wiphy_oper_chan(wiphy, c))
1113 continue;
1114
1115 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
1116 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
1117 }
1118
1119 timeout = c->dfs_state_entered +
1120 msecs_to_jiffies(time_dfs_update);
1121
1122 if (time_after_eq(jiffies, timeout)) {
1123 c->dfs_state = NL80211_DFS_USABLE;
1124 c->dfs_state_entered = jiffies;
1125
1126 cfg80211_chandef_create(&chandef, c,
1127 NL80211_CHAN_NO_HT);
1128
1129 nl80211_radar_notify(rdev, &chandef,
1130 radar_event, NULL,
1131 GFP_ATOMIC);
1132
1133 regulatory_propagate_dfs_state(wiphy, &chandef,
1134 c->dfs_state,
1135 radar_event);
1136 continue;
1137 }
1138
1139 if (!check_again)
1140 next_time = timeout - jiffies;
1141 else
1142 next_time = min(next_time, timeout - jiffies);
1143 check_again = true;
1144 }
1145 }
1146 rtnl_unlock();
1147
1148 /* reschedule if there are other channels waiting to be cleared again */
1149 if (check_again)
1150 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
1151 next_time);
1152}
1153
1154
1155void __cfg80211_radar_event(struct wiphy *wiphy,
1156 struct cfg80211_chan_def *chandef,
1157 bool offchan, gfp_t gfp)
1158{
1159 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1160
1161 trace_cfg80211_radar_event(wiphy, chandef, offchan);
1162
1163 /* only set the chandef supplied channel to unavailable, in
1164 * case the radar is detected on only one of multiple channels
1165 * spanned by the chandef.
1166 */
1167 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
1168
1169 if (offchan) {
1170 cancel_delayed_work(&rdev->background_cac_done_wk);
1171 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
1172 }
1173
1174 cfg80211_sched_dfs_chan_update(rdev);
1175
1176 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
1177
1178 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
1179 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
1180}
1181EXPORT_SYMBOL(__cfg80211_radar_event);
1182
1183void cfg80211_cac_event(struct net_device *netdev,
1184 const struct cfg80211_chan_def *chandef,
1185 enum nl80211_radar_event event, gfp_t gfp,
1186 unsigned int link_id)
1187{
1188 struct wireless_dev *wdev = netdev->ieee80211_ptr;
1189 struct wiphy *wiphy = wdev->wiphy;
1190 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1191 unsigned long timeout;
1192
1193 if (WARN_ON(wdev->valid_links &&
1194 !(wdev->valid_links & BIT(link_id))))
1195 return;
1196
1197 trace_cfg80211_cac_event(netdev, event, link_id);
1198
1199 if (WARN_ON(!wdev->links[link_id].cac_started &&
1200 event != NL80211_RADAR_CAC_STARTED))
1201 return;
1202
1203 switch (event) {
1204 case NL80211_RADAR_CAC_FINISHED:
1205 timeout = wdev->links[link_id].cac_start_time +
1206 msecs_to_jiffies(wdev->links[link_id].cac_time_ms);
1207 WARN_ON(!time_after_eq(jiffies, timeout));
1208 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1209 memcpy(&rdev->cac_done_chandef, chandef,
1210 sizeof(struct cfg80211_chan_def));
1211 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1212 cfg80211_sched_dfs_chan_update(rdev);
1213 fallthrough;
1214 case NL80211_RADAR_CAC_ABORTED:
1215 wdev->links[link_id].cac_started = false;
1216 cfg80211_set_cac_state(wiphy, chandef, false);
1217 break;
1218 case NL80211_RADAR_CAC_STARTED:
1219 wdev->links[link_id].cac_started = true;
1220 cfg80211_set_cac_state(wiphy, chandef, true);
1221 break;
1222 default:
1223 WARN_ON(1);
1224 return;
1225 }
1226
1227 nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
1228}
1229EXPORT_SYMBOL(cfg80211_cac_event);
1230
1231static void
1232__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1233 struct wireless_dev *wdev,
1234 const struct cfg80211_chan_def *chandef,
1235 enum nl80211_radar_event event)
1236{
1237 struct wiphy *wiphy = &rdev->wiphy;
1238 struct net_device *netdev;
1239
1240 lockdep_assert_wiphy(&rdev->wiphy);
1241
1242 if (!cfg80211_chandef_valid(chandef))
1243 return;
1244
1245 switch (event) {
1246 case NL80211_RADAR_CAC_FINISHED:
1247 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1248 cfg80211_set_cac_state(wiphy, chandef, false);
1249 memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
1250 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1251 cfg80211_sched_dfs_chan_update(rdev);
1252 break;
1253 case NL80211_RADAR_CAC_ABORTED:
1254 cfg80211_set_cac_state(wiphy, chandef, false);
1255 if (!cancel_delayed_work(&rdev->background_cac_done_wk))
1256 return;
1257 break;
1258 case NL80211_RADAR_CAC_STARTED:
1259 cfg80211_set_cac_state(wiphy, chandef, true);
1260 break;
1261 default:
1262 return;
1263 }
1264
1265 netdev = wdev ? wdev->netdev : NULL;
1266 nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
1267}
1268
1269void cfg80211_background_cac_done_wk(struct work_struct *work)
1270{
1271 struct delayed_work *delayed_work = to_delayed_work(work);
1272 struct cfg80211_registered_device *rdev;
1273
1274 rdev = container_of(delayed_work, struct cfg80211_registered_device,
1275 background_cac_done_wk);
1276
1277 guard(wiphy)(&rdev->wiphy);
1278
1279 rdev_set_radar_background(rdev, NULL);
1280
1281 __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
1282 &rdev->background_radar_chandef,
1283 NL80211_RADAR_CAC_FINISHED);
1284
1285 rdev->background_radar_wdev = NULL;
1286}
1287
1288void cfg80211_background_cac_abort_wk(struct work_struct *work)
1289{
1290 struct cfg80211_registered_device *rdev;
1291 struct wireless_dev *wdev;
1292
1293 rdev = container_of(work, struct cfg80211_registered_device,
1294 background_cac_abort_wk);
1295
1296 guard(wiphy)(&rdev->wiphy);
1297
1298 wdev = rdev->background_radar_wdev;
1299 if (wdev)
1300 cfg80211_stop_background_radar_detection(wdev);
1301}
1302
1303void cfg80211_background_cac_abort(struct wiphy *wiphy)
1304{
1305 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1306
1307 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
1308}
1309EXPORT_SYMBOL(cfg80211_background_cac_abort);
1310
1311int
1312cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
1313 struct wireless_dev *wdev,
1314 struct cfg80211_chan_def *chandef)
1315{
1316 unsigned int cac_time_ms;
1317 int err;
1318
1319 lockdep_assert_wiphy(&rdev->wiphy);
1320
1321 if (!wiphy_ext_feature_isset(&rdev->wiphy,
1322 NL80211_EXT_FEATURE_RADAR_BACKGROUND))
1323 return -EOPNOTSUPP;
1324
1325 /* Offchannel chain already locked by another wdev */
1326 if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
1327 return -EBUSY;
1328
1329 /* CAC already in progress on the offchannel chain */
1330 if (rdev->background_radar_wdev == wdev &&
1331 delayed_work_pending(&rdev->background_cac_done_wk))
1332 return -EBUSY;
1333
1334 err = rdev_set_radar_background(rdev, chandef);
1335 if (err)
1336 return err;
1337
1338 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
1339 if (!cac_time_ms)
1340 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1341
1342 rdev->background_radar_chandef = *chandef;
1343 rdev->background_radar_wdev = wdev; /* Get offchain ownership */
1344
1345 __cfg80211_background_cac_event(rdev, wdev, chandef,
1346 NL80211_RADAR_CAC_STARTED);
1347 queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
1348 msecs_to_jiffies(cac_time_ms));
1349
1350 return 0;
1351}
1352
1353void cfg80211_stop_radar_detection(struct wireless_dev *wdev)
1354{
1355 struct wiphy *wiphy = wdev->wiphy;
1356 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1357 int link_id;
1358
1359 for_each_valid_link(wdev, link_id) {
1360 struct cfg80211_chan_def chandef;
1361
1362 if (!wdev->links[link_id].cac_started)
1363 continue;
1364
1365 chandef = *wdev_chandef(wdev, link_id);
1366 rdev_end_cac(rdev, wdev->netdev, link_id);
1367 wdev->links[link_id].cac_started = false;
1368 cfg80211_set_cac_state(wiphy, &chandef, false);
1369 nl80211_radar_notify(rdev, &chandef, NL80211_RADAR_CAC_ABORTED,
1370 wdev->netdev, GFP_KERNEL);
1371 }
1372}
1373
1374void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
1375{
1376 struct wiphy *wiphy = wdev->wiphy;
1377 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1378
1379 lockdep_assert_wiphy(wiphy);
1380
1381 if (wdev != rdev->background_radar_wdev)
1382 return;
1383
1384 rdev_set_radar_background(rdev, NULL);
1385
1386 __cfg80211_background_cac_event(rdev, wdev,
1387 &rdev->background_radar_chandef,
1388 NL80211_RADAR_CAC_ABORTED);
1389
1390 rdev->background_radar_wdev = NULL;
1391}
1392
1393int cfg80211_assoc_ml_reconf(struct cfg80211_registered_device *rdev,
1394 struct net_device *dev,
1395 struct cfg80211_ml_reconf_req *req)
1396{
1397 struct wireless_dev *wdev = dev->ieee80211_ptr;
1398 int err;
1399
1400 lockdep_assert_wiphy(wdev->wiphy);
1401
1402 err = rdev_assoc_ml_reconf(rdev, dev, req);
1403 if (!err) {
1404 int link_id;
1405
1406 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
1407 link_id++) {
1408 if (!req->add_links[link_id].bss)
1409 continue;
1410
1411 cfg80211_ref_bss(&rdev->wiphy, req->add_links[link_id].bss);
1412 cfg80211_hold_bss(bss_from_pub(req->add_links[link_id].bss));
1413 }
1414 }
1415
1416 return err;
1417}
1418
1419void cfg80211_mlo_reconf_add_done(struct net_device *dev,
1420 struct cfg80211_mlo_reconf_done_data *data)
1421{
1422 struct wireless_dev *wdev = dev->ieee80211_ptr;
1423 struct wiphy *wiphy = wdev->wiphy;
1424 int link_id;
1425
1426 lockdep_assert_wiphy(wiphy);
1427
1428 trace_cfg80211_mlo_reconf_add_done(dev, data->added_links,
1429 data->buf, data->len,
1430 data->driver_initiated);
1431
1432 if (WARN_ON(!wdev->valid_links))
1433 return;
1434
1435 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
1436 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
1437 return;
1438
1439 /* validate that a BSS is given for each added link */
1440 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
1441 struct cfg80211_bss *bss = data->links[link_id].bss;
1442
1443 if (!(data->added_links & BIT(link_id)))
1444 continue;
1445
1446 if (WARN_ON(!bss))
1447 return;
1448 }
1449
1450 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
1451 struct cfg80211_bss *bss = data->links[link_id].bss;
1452
1453 if (!bss)
1454 continue;
1455
1456 if (data->added_links & BIT(link_id)) {
1457 wdev->links[link_id].client.current_bss =
1458 bss_from_pub(bss);
1459
1460 if (data->driver_initiated)
1461 cfg80211_hold_bss(bss_from_pub(bss));
1462
1463 memcpy(wdev->links[link_id].addr,
1464 data->links[link_id].addr,
1465 ETH_ALEN);
1466 } else {
1467 if (!data->driver_initiated)
1468 cfg80211_unhold_bss(bss_from_pub(bss));
1469
1470 cfg80211_put_bss(wiphy, bss);
1471 }
1472 }
1473
1474 wdev->valid_links |= data->added_links;
1475 nl80211_mlo_reconf_add_done(dev, data);
1476}
1477EXPORT_SYMBOL(cfg80211_mlo_reconf_add_done);