1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 MLME SAP interface 4 * 5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi> 6 * Copyright (c) 2015 Intel Deutschland GmbH 7 * Copyright (C) 2019-2020, 2022-2026 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/etherdevice.h> 13 #include <linux/netdevice.h> 14 #include <linux/nl80211.h> 15 #include <linux/slab.h> 16 #include <linux/wireless.h> 17 #include <net/cfg80211.h> 18 #include <net/iw_handler.h> 19 #include "core.h" 20 #include "nl80211.h" 21 #include "rdev-ops.h" 22 23 24 void cfg80211_rx_assoc_resp(struct net_device *dev, 25 const struct cfg80211_rx_assoc_resp_data *data) 26 { 27 struct wireless_dev *wdev = dev->ieee80211_ptr; 28 struct wiphy *wiphy = wdev->wiphy; 29 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 30 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf; 31 struct cfg80211_connect_resp_params cr = { 32 .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED, 33 .req_ie = data->req_ies, 34 .req_ie_len = data->req_ies_len, 35 .resp_ie = mgmt->u.assoc_resp.variable, 36 .resp_ie_len = data->len - 37 offsetof(struct ieee80211_mgmt, 38 u.assoc_resp.variable), 39 .status = le16_to_cpu(mgmt->u.assoc_resp.status_code), 40 .ap_mld_addr = data->ap_mld_addr, 41 .assoc_encrypted = data->assoc_encrypted, 42 }; 43 unsigned int link_id; 44 45 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { 46 cr.links[link_id].status = data->links[link_id].status; 47 cr.links[link_id].bss = data->links[link_id].bss; 48 49 WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS && 50 (!cr.ap_mld_addr || !cr.links[link_id].bss)); 51 52 if (!cr.links[link_id].bss) 53 continue; 54 cr.links[link_id].bssid = data->links[link_id].bss->bssid; 55 cr.links[link_id].addr = data->links[link_id].addr; 56 /* need to have local link addresses for MLO connections */ 57 WARN_ON(cr.ap_mld_addr && 58 !is_valid_ether_addr(cr.links[link_id].addr)); 59 60 BUG_ON(!cr.links[link_id].bss->channel); 61 62 if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) { 63 WARN_ON(link_id); 64 cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; 65 cr.resp_ie_len = data->len - 66 offsetof(struct ieee80211_mgmt, 67 u.s1g_assoc_resp.variable); 68 } 69 70 if (cr.ap_mld_addr) 71 cr.valid_links |= BIT(link_id); 72 } 73 74 trace_cfg80211_send_rx_assoc(dev, data); 75 76 /* 77 * This is a bit of a hack, we don't notify userspace of 78 * a (re-)association reply if we tried to send a reassoc 79 * and got a reject -- we only try again with an assoc 80 * frame instead of reassoc. 81 */ 82 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) { 83 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { 84 struct cfg80211_bss *bss = data->links[link_id].bss; 85 86 if (!bss) 87 continue; 88 89 cfg80211_unhold_bss(bss_from_pub(bss)); 90 cfg80211_put_bss(wiphy, bss); 91 } 92 return; 93 } 94 95 nl80211_send_rx_assoc(rdev, dev, data); 96 /* update current_bss etc., consumes the bss reference */ 97 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS); 98 } 99 EXPORT_SYMBOL(cfg80211_rx_assoc_resp); 100 101 static void cfg80211_process_auth(struct wireless_dev *wdev, 102 const u8 *buf, size_t len) 103 { 104 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 105 106 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL); 107 cfg80211_sme_rx_auth(wdev, buf, len); 108 } 109 110 static void cfg80211_process_deauth(struct wireless_dev *wdev, 111 const u8 *buf, size_t len, 112 bool reconnect) 113 { 114 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 115 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 116 const u8 *bssid = mgmt->bssid; 117 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); 118 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 119 120 nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL); 121 122 if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid)) 123 return; 124 125 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 126 cfg80211_sme_deauth(wdev); 127 } 128 129 static void cfg80211_process_disassoc(struct wireless_dev *wdev, 130 const u8 *buf, size_t len, 131 bool reconnect) 132 { 133 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 134 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 135 const u8 *bssid = mgmt->bssid; 136 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); 137 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 138 139 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect, 140 GFP_KERNEL); 141 142 if (WARN_ON(!wdev->connected || 143 !ether_addr_equal(wdev->u.client.connected_addr, bssid))) 144 return; 145 146 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 147 cfg80211_sme_disassoc(wdev); 148 } 149 150 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) 151 { 152 struct wireless_dev *wdev = dev->ieee80211_ptr; 153 struct ieee80211_mgmt *mgmt = (void *)buf; 154 155 lockdep_assert_wiphy(wdev->wiphy); 156 157 trace_cfg80211_rx_mlme_mgmt(dev, buf, len); 158 159 if (WARN_ON(len < 2)) 160 return; 161 162 if (ieee80211_is_auth(mgmt->frame_control)) 163 cfg80211_process_auth(wdev, buf, len); 164 else if (ieee80211_is_deauth(mgmt->frame_control)) 165 cfg80211_process_deauth(wdev, buf, len, false); 166 else if (ieee80211_is_disassoc(mgmt->frame_control)) 167 cfg80211_process_disassoc(wdev, buf, len, false); 168 } 169 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt); 170 171 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr) 172 { 173 struct wireless_dev *wdev = dev->ieee80211_ptr; 174 struct wiphy *wiphy = wdev->wiphy; 175 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 176 177 trace_cfg80211_send_auth_timeout(dev, addr); 178 179 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL); 180 cfg80211_sme_auth_timeout(wdev); 181 } 182 EXPORT_SYMBOL(cfg80211_auth_timeout); 183 184 void cfg80211_assoc_failure(struct net_device *dev, 185 struct cfg80211_assoc_failure *data) 186 { 187 struct wireless_dev *wdev = dev->ieee80211_ptr; 188 struct wiphy *wiphy = wdev->wiphy; 189 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 190 const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid; 191 int i; 192 193 trace_cfg80211_send_assoc_failure(dev, data); 194 195 if (data->timeout) { 196 nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL); 197 cfg80211_sme_assoc_timeout(wdev); 198 } else { 199 cfg80211_sme_abandon_assoc(wdev); 200 } 201 202 for (i = 0; i < ARRAY_SIZE(data->bss); i++) { 203 struct cfg80211_bss *bss = data->bss[i]; 204 205 if (!bss) 206 continue; 207 208 cfg80211_unhold_bss(bss_from_pub(bss)); 209 cfg80211_put_bss(wiphy, bss); 210 } 211 } 212 EXPORT_SYMBOL(cfg80211_assoc_failure); 213 214 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len, 215 bool reconnect) 216 { 217 struct wireless_dev *wdev = dev->ieee80211_ptr; 218 struct ieee80211_mgmt *mgmt = (void *)buf; 219 220 lockdep_assert_wiphy(wdev->wiphy); 221 222 trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect); 223 224 if (WARN_ON(len < 2)) 225 return; 226 227 if (ieee80211_is_deauth(mgmt->frame_control)) 228 cfg80211_process_deauth(wdev, buf, len, reconnect); 229 else 230 cfg80211_process_disassoc(wdev, buf, len, reconnect); 231 } 232 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt); 233 234 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr, 235 enum nl80211_key_type key_type, int key_id, 236 const u8 *tsc, gfp_t gfp) 237 { 238 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 239 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 240 #ifdef CONFIG_CFG80211_WEXT 241 union iwreq_data wrqu; 242 char *buf = kmalloc(128, gfp); 243 244 if (buf) { 245 memset(&wrqu, 0, sizeof(wrqu)); 246 wrqu.data.length = 247 sprintf(buf, "MLME-MICHAELMICFAILURE." 248 "indication(keyid=%d %scast addr=%pM)", 249 key_id, key_type == NL80211_KEYTYPE_GROUP 250 ? "broad" : "uni", addr); 251 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf); 252 kfree(buf); 253 } 254 #endif 255 256 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc); 257 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp); 258 } 259 EXPORT_SYMBOL(cfg80211_michael_mic_failure); 260 261 /* some MLME handling for userspace SME */ 262 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev, 263 struct net_device *dev, 264 struct cfg80211_auth_request *req) 265 { 266 struct wireless_dev *wdev = dev->ieee80211_ptr; 267 268 lockdep_assert_wiphy(wdev->wiphy); 269 270 if (!req->bss) 271 return -ENOENT; 272 273 if (req->link_id >= 0 && 274 !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)) 275 return -EINVAL; 276 277 if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) { 278 if (!req->key || !req->key_len || 279 req->key_idx < 0 || req->key_idx > 3) 280 return -EINVAL; 281 } 282 283 if (wdev->connected && 284 ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr)) 285 return -EALREADY; 286 287 if (ether_addr_equal(req->bss->bssid, dev->dev_addr) || 288 (req->link_id >= 0 && 289 ether_addr_equal(req->ap_mld_addr, dev->dev_addr))) 290 return -EINVAL; 291 292 return rdev_auth(rdev, dev, req); 293 } 294 295 /* Do a logical ht_capa &= ht_capa_mask. */ 296 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa, 297 const struct ieee80211_ht_cap *ht_capa_mask) 298 { 299 int i; 300 u8 *p1, *p2; 301 if (!ht_capa_mask) { 302 memset(ht_capa, 0, sizeof(*ht_capa)); 303 return; 304 } 305 306 p1 = (u8*)(ht_capa); 307 p2 = (u8*)(ht_capa_mask); 308 for (i = 0; i < sizeof(*ht_capa); i++) 309 p1[i] &= p2[i]; 310 } 311 312 /* Do a logical vht_capa &= vht_capa_mask. */ 313 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa, 314 const struct ieee80211_vht_cap *vht_capa_mask) 315 { 316 int i; 317 u8 *p1, *p2; 318 if (!vht_capa_mask) { 319 memset(vht_capa, 0, sizeof(*vht_capa)); 320 return; 321 } 322 323 p1 = (u8*)(vht_capa); 324 p2 = (u8*)(vht_capa_mask); 325 for (i = 0; i < sizeof(*vht_capa); i++) 326 p1[i] &= p2[i]; 327 } 328 329 static int 330 cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a, 331 const struct ieee80211_multi_link_elem *mle_b, 332 struct netlink_ext_ack *extack) 333 { 334 const struct ieee80211_mle_basic_common_info *common_a, *common_b; 335 336 common_a = (const void *)mle_a->variable; 337 common_b = (const void *)mle_b->variable; 338 339 if (memcmp(common_a->mld_mac_addr, common_b->mld_mac_addr, ETH_ALEN)) { 340 NL_SET_ERR_MSG(extack, "AP MLD address mismatch"); 341 return -EINVAL; 342 } 343 344 if (ieee80211_mle_get_eml_cap((const u8 *)mle_a) != 345 ieee80211_mle_get_eml_cap((const u8 *)mle_b)) { 346 NL_SET_ERR_MSG(extack, "link EML capabilities mismatch"); 347 return -EINVAL; 348 } 349 350 if (ieee80211_mle_get_mld_capa_op((const u8 *)mle_a) != 351 ieee80211_mle_get_mld_capa_op((const u8 *)mle_b)) { 352 NL_SET_ERR_MSG(extack, "link MLD capabilities/ops mismatch"); 353 return -EINVAL; 354 } 355 356 /* 357 * Only verify the values in Extended MLD Capabilities that are 358 * not reserved when transmitted by an AP (and expected to remain the 359 * same over time). 360 * The Recommended Max Simultaneous Links subfield in particular is 361 * reserved when included in a unicast Probe Response frame and may 362 * also change when the AP adds/removes links. The BTM MLD 363 * Recommendation For Multiple APs Support subfield is reserved when 364 * transmitted by an AP. 365 */ 366 if ((ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_a) & 367 (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE | 368 IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE | 369 IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK | 370 IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM)) != 371 (ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_b) & 372 (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE | 373 IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE | 374 IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK | 375 IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM))) { 376 NL_SET_ERR_MSG(extack, 377 "extended link MLD capabilities/ops mismatch"); 378 return -EINVAL; 379 } 380 381 return 0; 382 } 383 384 static int cfg80211_mlme_check_mlo(struct net_device *dev, 385 struct cfg80211_assoc_request *req, 386 struct netlink_ext_ack *extack) 387 { 388 const struct ieee80211_multi_link_elem *mles[ARRAY_SIZE(req->links)] = {}; 389 int i; 390 391 if (req->link_id < 0) 392 return 0; 393 394 if (!req->links[req->link_id].bss) { 395 NL_SET_ERR_MSG(extack, "no BSS for assoc link"); 396 return -EINVAL; 397 } 398 399 rcu_read_lock(); 400 for (i = 0; i < ARRAY_SIZE(req->links); i++) { 401 const struct cfg80211_bss_ies *ies; 402 const struct element *ml; 403 404 if (!req->links[i].bss) 405 continue; 406 407 if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr)) { 408 NL_SET_ERR_MSG(extack, "BSSID must not be our address"); 409 req->links[i].error = -EINVAL; 410 goto error; 411 } 412 413 ies = rcu_dereference(req->links[i].bss->ies); 414 ml = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK, 415 ies->data, ies->len); 416 if (!ml) { 417 NL_SET_ERR_MSG(extack, "MLO BSS w/o ML element"); 418 req->links[i].error = -EINVAL; 419 goto error; 420 } 421 422 if (!ieee80211_mle_type_ok(ml->data + 1, 423 IEEE80211_ML_CONTROL_TYPE_BASIC, 424 ml->datalen - 1)) { 425 NL_SET_ERR_MSG(extack, "BSS with invalid ML element"); 426 req->links[i].error = -EINVAL; 427 goto error; 428 } 429 430 mles[i] = (const void *)(ml->data + 1); 431 432 if (ieee80211_mle_get_link_id((const u8 *)mles[i]) != i) { 433 NL_SET_ERR_MSG(extack, "link ID mismatch"); 434 req->links[i].error = -EINVAL; 435 goto error; 436 } 437 } 438 439 if (WARN_ON(!mles[req->link_id])) 440 goto error; 441 442 for (i = 0; i < ARRAY_SIZE(req->links); i++) { 443 if (i == req->link_id || !req->links[i].bss) 444 continue; 445 446 if (WARN_ON(!mles[i])) 447 goto error; 448 449 if (cfg80211_mlme_check_mlo_compat(mles[req->link_id], mles[i], 450 extack)) { 451 req->links[i].error = -EINVAL; 452 goto error; 453 } 454 } 455 456 rcu_read_unlock(); 457 return 0; 458 error: 459 rcu_read_unlock(); 460 return -EINVAL; 461 } 462 463 /* Note: caller must cfg80211_put_bss() regardless of result */ 464 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev, 465 struct net_device *dev, 466 struct cfg80211_assoc_request *req, 467 struct netlink_ext_ack *extack) 468 { 469 struct wireless_dev *wdev = dev->ieee80211_ptr; 470 int err; 471 472 lockdep_assert_wiphy(wdev->wiphy); 473 474 err = cfg80211_mlme_check_mlo(dev, req, extack); 475 if (err) 476 return err; 477 478 if (wdev->connected && 479 (!req->prev_bssid || 480 !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid))) 481 return -EALREADY; 482 483 if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) || 484 (req->link_id >= 0 && 485 ether_addr_equal(req->ap_mld_addr, dev->dev_addr))) 486 return -EINVAL; 487 488 cfg80211_oper_and_ht_capa(&req->ht_capa_mask, 489 rdev->wiphy.ht_capa_mod_mask); 490 cfg80211_oper_and_vht_capa(&req->vht_capa_mask, 491 rdev->wiphy.vht_capa_mod_mask); 492 493 err = rdev_assoc(rdev, dev, req); 494 if (!err) { 495 int link_id; 496 497 if (req->bss) { 498 cfg80211_ref_bss(&rdev->wiphy, req->bss); 499 cfg80211_hold_bss(bss_from_pub(req->bss)); 500 } 501 502 for (link_id = 0; link_id < ARRAY_SIZE(req->links); link_id++) { 503 if (!req->links[link_id].bss) 504 continue; 505 cfg80211_ref_bss(&rdev->wiphy, req->links[link_id].bss); 506 cfg80211_hold_bss(bss_from_pub(req->links[link_id].bss)); 507 } 508 } 509 return err; 510 } 511 512 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev, 513 struct net_device *dev, const u8 *bssid, 514 const u8 *ie, int ie_len, u16 reason, 515 bool local_state_change) 516 { 517 struct wireless_dev *wdev = dev->ieee80211_ptr; 518 struct cfg80211_deauth_request req = { 519 .bssid = bssid, 520 .reason_code = reason, 521 .ie = ie, 522 .ie_len = ie_len, 523 .local_state_change = local_state_change, 524 }; 525 526 lockdep_assert_wiphy(wdev->wiphy); 527 528 if (local_state_change && 529 (!wdev->connected || 530 !ether_addr_equal(wdev->u.client.connected_addr, bssid))) 531 return 0; 532 533 if (ether_addr_equal(wdev->disconnect_bssid, bssid) || 534 (wdev->connected && 535 ether_addr_equal(wdev->u.client.connected_addr, bssid))) 536 wdev->conn_owner_nlportid = 0; 537 538 return rdev_deauth(rdev, dev, &req); 539 } 540 541 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev, 542 struct net_device *dev, const u8 *ap_addr, 543 const u8 *ie, int ie_len, u16 reason, 544 bool local_state_change) 545 { 546 struct wireless_dev *wdev = dev->ieee80211_ptr; 547 struct cfg80211_disassoc_request req = { 548 .reason_code = reason, 549 .local_state_change = local_state_change, 550 .ie = ie, 551 .ie_len = ie_len, 552 .ap_addr = ap_addr, 553 }; 554 int err; 555 556 lockdep_assert_wiphy(wdev->wiphy); 557 558 if (!wdev->connected) 559 return -ENOTCONN; 560 561 if (memcmp(wdev->u.client.connected_addr, ap_addr, ETH_ALEN)) 562 return -ENOTCONN; 563 564 err = rdev_disassoc(rdev, dev, &req); 565 if (err) 566 return err; 567 568 /* driver should have reported the disassoc */ 569 WARN_ON(wdev->connected); 570 return 0; 571 } 572 573 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev, 574 struct net_device *dev) 575 { 576 struct wireless_dev *wdev = dev->ieee80211_ptr; 577 u8 bssid[ETH_ALEN]; 578 579 lockdep_assert_wiphy(wdev->wiphy); 580 581 if (!rdev->ops->deauth) 582 return; 583 584 if (!wdev->connected) 585 return; 586 587 memcpy(bssid, wdev->u.client.connected_addr, ETH_ALEN); 588 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0, 589 WLAN_REASON_DEAUTH_LEAVING, false); 590 } 591 592 struct cfg80211_mgmt_registration { 593 struct list_head list; 594 struct wireless_dev *wdev; 595 596 u32 nlportid; 597 598 int match_len; 599 600 __le16 frame_type; 601 602 bool multicast_rx; 603 604 u8 match[]; 605 }; 606 607 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev) 608 { 609 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 610 struct wireless_dev *tmp; 611 struct cfg80211_mgmt_registration *reg; 612 struct mgmt_frame_regs upd = {}; 613 614 lockdep_assert_held(&rdev->wiphy.mtx); 615 616 spin_lock_bh(&rdev->mgmt_registrations_lock); 617 if (!wdev->mgmt_registrations_need_update) { 618 spin_unlock_bh(&rdev->mgmt_registrations_lock); 619 return; 620 } 621 622 rcu_read_lock(); 623 list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) { 624 list_for_each_entry(reg, &tmp->mgmt_registrations, list) { 625 u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4); 626 u32 mcast_mask = 0; 627 628 if (reg->multicast_rx) 629 mcast_mask = mask; 630 631 upd.global_stypes |= mask; 632 upd.global_mcast_stypes |= mcast_mask; 633 634 if (tmp == wdev) { 635 upd.interface_stypes |= mask; 636 upd.interface_mcast_stypes |= mcast_mask; 637 } 638 } 639 } 640 rcu_read_unlock(); 641 642 wdev->mgmt_registrations_need_update = 0; 643 spin_unlock_bh(&rdev->mgmt_registrations_lock); 644 645 rdev_update_mgmt_frame_registrations(rdev, wdev, &upd); 646 } 647 648 void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk) 649 { 650 struct cfg80211_registered_device *rdev; 651 struct wireless_dev *wdev; 652 653 rdev = container_of(wk, struct cfg80211_registered_device, 654 mgmt_registrations_update_wk); 655 656 guard(wiphy)(&rdev->wiphy); 657 658 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) 659 cfg80211_mgmt_registrations_update(wdev); 660 } 661 662 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid, 663 u16 frame_type, const u8 *match_data, 664 int match_len, bool multicast_rx, 665 struct netlink_ext_ack *extack) 666 { 667 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 668 struct cfg80211_mgmt_registration *reg, *nreg; 669 int err = 0; 670 u16 mgmt_type; 671 bool update_multicast = false; 672 673 if (!wdev->wiphy->mgmt_stypes) 674 return -EOPNOTSUPP; 675 676 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) { 677 NL_SET_ERR_MSG(extack, "frame type not management"); 678 return -EINVAL; 679 } 680 681 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) { 682 NL_SET_ERR_MSG(extack, "Invalid frame type"); 683 return -EINVAL; 684 } 685 686 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4; 687 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) { 688 NL_SET_ERR_MSG(extack, 689 "Registration to specific type not supported"); 690 return -EINVAL; 691 } 692 693 /* 694 * To support Pre Association Security Negotiation (PASN), registration 695 * for authentication frames should be supported. However, as some 696 * versions of the user space daemons wrongly register to all types of 697 * authentication frames (which might result in unexpected behavior) 698 * allow such registration if the request is for a specific 699 * authentication algorithm number. 700 */ 701 if (wdev->iftype == NL80211_IFTYPE_STATION && 702 (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH && 703 !(match_data && match_len >= 2)) { 704 NL_SET_ERR_MSG(extack, 705 "Authentication algorithm number required"); 706 return -EINVAL; 707 } 708 709 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL); 710 if (!nreg) 711 return -ENOMEM; 712 713 spin_lock_bh(&rdev->mgmt_registrations_lock); 714 715 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 716 int mlen = min(match_len, reg->match_len); 717 718 if (frame_type != le16_to_cpu(reg->frame_type)) 719 continue; 720 721 if (memcmp(reg->match, match_data, mlen) == 0) { 722 if (reg->multicast_rx != multicast_rx) { 723 update_multicast = true; 724 reg->multicast_rx = multicast_rx; 725 break; 726 } 727 NL_SET_ERR_MSG(extack, "Match already configured"); 728 err = -EALREADY; 729 break; 730 } 731 } 732 733 if (err) 734 goto out; 735 736 if (update_multicast) { 737 kfree(nreg); 738 } else { 739 memcpy(nreg->match, match_data, match_len); 740 nreg->match_len = match_len; 741 nreg->nlportid = snd_portid; 742 nreg->frame_type = cpu_to_le16(frame_type); 743 nreg->wdev = wdev; 744 nreg->multicast_rx = multicast_rx; 745 list_add(&nreg->list, &wdev->mgmt_registrations); 746 } 747 wdev->mgmt_registrations_need_update = 1; 748 spin_unlock_bh(&rdev->mgmt_registrations_lock); 749 750 cfg80211_mgmt_registrations_update(wdev); 751 752 return 0; 753 754 out: 755 kfree(nreg); 756 spin_unlock_bh(&rdev->mgmt_registrations_lock); 757 758 return err; 759 } 760 761 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid) 762 { 763 struct wiphy *wiphy = wdev->wiphy; 764 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 765 struct cfg80211_mgmt_registration *reg, *tmp; 766 767 spin_lock_bh(&rdev->mgmt_registrations_lock); 768 769 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 770 if (reg->nlportid != nlportid) 771 continue; 772 773 list_del(®->list); 774 kfree(reg); 775 776 wdev->mgmt_registrations_need_update = 1; 777 schedule_work(&rdev->mgmt_registrations_update_wk); 778 } 779 780 spin_unlock_bh(&rdev->mgmt_registrations_lock); 781 782 if (nlportid && rdev->crit_proto_nlportid == nlportid) { 783 rdev->crit_proto_nlportid = 0; 784 rdev_crit_proto_stop(rdev, wdev); 785 } 786 787 if (nlportid == wdev->unexpected_nlportid) 788 wdev->unexpected_nlportid = 0; 789 } 790 791 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev) 792 { 793 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 794 struct cfg80211_mgmt_registration *reg, *tmp; 795 796 spin_lock_bh(&rdev->mgmt_registrations_lock); 797 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 798 list_del(®->list); 799 kfree(reg); 800 } 801 wdev->mgmt_registrations_need_update = 1; 802 spin_unlock_bh(&rdev->mgmt_registrations_lock); 803 804 cfg80211_mgmt_registrations_update(wdev); 805 } 806 807 static bool cfg80211_allowed_address(struct wireless_dev *wdev, const u8 *addr) 808 { 809 int i; 810 811 for_each_valid_link(wdev, i) { 812 if (ether_addr_equal(addr, wdev->links[i].addr)) 813 return true; 814 } 815 816 return ether_addr_equal(addr, wdev_address(wdev)); 817 } 818 819 static bool cfg80211_allowed_random_address(struct wireless_dev *wdev, 820 const struct ieee80211_mgmt *mgmt) 821 { 822 if (ieee80211_is_auth(mgmt->frame_control) || 823 ieee80211_is_deauth(mgmt->frame_control)) { 824 /* Allow random TA to be used with authentication and 825 * deauthentication frames if the driver has indicated support. 826 */ 827 if (wiphy_ext_feature_isset( 828 wdev->wiphy, 829 NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA)) 830 return true; 831 } else if (ieee80211_is_action(mgmt->frame_control) && 832 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) { 833 /* Allow random TA to be used with Public Action frames if the 834 * driver has indicated support. 835 */ 836 if (!wdev->connected && 837 wiphy_ext_feature_isset( 838 wdev->wiphy, 839 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA)) 840 return true; 841 842 if (wdev->connected && 843 wiphy_ext_feature_isset( 844 wdev->wiphy, 845 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED)) 846 return true; 847 } 848 849 return false; 850 } 851 852 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev, 853 struct wireless_dev *wdev, 854 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 855 { 856 const struct ieee80211_mgmt *mgmt; 857 u16 stype; 858 859 lockdep_assert_wiphy(&rdev->wiphy); 860 861 if (!wdev->wiphy->mgmt_stypes) 862 return -EOPNOTSUPP; 863 864 if (!rdev->ops->mgmt_tx) 865 return -EOPNOTSUPP; 866 867 if (params->len < 24 + 1) 868 return -EINVAL; 869 870 mgmt = (const struct ieee80211_mgmt *)params->buf; 871 872 if (!ieee80211_is_mgmt(mgmt->frame_control) || 873 ieee80211_has_order(mgmt->frame_control)) 874 return -EINVAL; 875 876 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE; 877 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4))) 878 return -EINVAL; 879 880 if (ieee80211_is_action(mgmt->frame_control) && 881 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) { 882 int err = 0; 883 884 switch (wdev->iftype) { 885 case NL80211_IFTYPE_ADHOC: 886 /* 887 * check for IBSS DA must be done by driver as 888 * cfg80211 doesn't track the stations 889 */ 890 if (!wdev->u.ibss.current_bss || 891 !ether_addr_equal(wdev->u.ibss.current_bss->pub.bssid, 892 mgmt->bssid)) { 893 err = -ENOTCONN; 894 break; 895 } 896 break; 897 case NL80211_IFTYPE_STATION: 898 case NL80211_IFTYPE_P2P_CLIENT: 899 if (!wdev->connected) { 900 err = -ENOTCONN; 901 break; 902 } 903 904 /* FIXME: MLD may address this differently */ 905 906 if (!ether_addr_equal(wdev->u.client.connected_addr, 907 mgmt->bssid)) { 908 err = -ENOTCONN; 909 break; 910 } 911 912 /* for station, check that DA is the AP */ 913 if (!ether_addr_equal(wdev->u.client.connected_addr, 914 mgmt->da)) { 915 err = -ENOTCONN; 916 break; 917 } 918 break; 919 case NL80211_IFTYPE_AP: 920 case NL80211_IFTYPE_P2P_GO: 921 case NL80211_IFTYPE_AP_VLAN: 922 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)) && 923 (params->link_id < 0 || 924 !ether_addr_equal(mgmt->bssid, 925 wdev->links[params->link_id].addr))) 926 err = -EINVAL; 927 break; 928 case NL80211_IFTYPE_MESH_POINT: 929 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) { 930 err = -EINVAL; 931 break; 932 } 933 /* 934 * check for mesh DA must be done by driver as 935 * cfg80211 doesn't track the stations 936 */ 937 break; 938 case NL80211_IFTYPE_NAN: 939 case NL80211_IFTYPE_NAN_DATA: 940 if (mgmt->u.action.category != 941 WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION) 942 err = -EOPNOTSUPP; 943 break; 944 case NL80211_IFTYPE_P2P_DEVICE: 945 /* 946 * fall through, P2P device only supports 947 * public action frames 948 */ 949 case NL80211_IFTYPE_PD: 950 default: 951 err = -EOPNOTSUPP; 952 break; 953 } 954 955 if (err) 956 return err; 957 } 958 959 if (!cfg80211_allowed_address(wdev, mgmt->sa) && 960 !cfg80211_allowed_random_address(wdev, mgmt)) 961 return -EINVAL; 962 963 /* Transmit the management frame as requested by user space */ 964 return rdev_mgmt_tx(rdev, wdev, params, cookie); 965 } 966 967 bool cfg80211_rx_mgmt_ext(struct wireless_dev *wdev, 968 struct cfg80211_rx_info *info) 969 { 970 struct wiphy *wiphy = wdev->wiphy; 971 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 972 struct cfg80211_mgmt_registration *reg; 973 const struct ieee80211_txrx_stypes *stypes = 974 &wiphy->mgmt_stypes[wdev->iftype]; 975 struct ieee80211_mgmt *mgmt = (void *)info->buf; 976 const u8 *data; 977 int data_len; 978 bool result = false; 979 __le16 ftype = mgmt->frame_control & 980 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE); 981 u16 stype; 982 983 trace_cfg80211_rx_mgmt(wdev, info); 984 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4; 985 986 if (!(stypes->rx & BIT(stype))) { 987 trace_cfg80211_return_bool(false); 988 return false; 989 } 990 991 data = info->buf + ieee80211_hdrlen(mgmt->frame_control); 992 data_len = info->len - ieee80211_hdrlen(mgmt->frame_control); 993 994 spin_lock_bh(&rdev->mgmt_registrations_lock); 995 996 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 997 if (reg->frame_type != ftype) 998 continue; 999 1000 if (reg->match_len > data_len) 1001 continue; 1002 1003 if (memcmp(reg->match, data, reg->match_len)) 1004 continue; 1005 1006 /* found match! */ 1007 1008 /* Indicate the received Action frame to user space */ 1009 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, info, 1010 GFP_ATOMIC)) 1011 continue; 1012 1013 result = true; 1014 break; 1015 } 1016 1017 spin_unlock_bh(&rdev->mgmt_registrations_lock); 1018 1019 trace_cfg80211_return_bool(result); 1020 return result; 1021 } 1022 EXPORT_SYMBOL(cfg80211_rx_mgmt_ext); 1023 1024 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev) 1025 { 1026 cancel_delayed_work(&rdev->dfs_update_channels_wk); 1027 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0); 1028 } 1029 1030 void cfg80211_dfs_channels_update_work(struct work_struct *work) 1031 { 1032 struct delayed_work *delayed_work = to_delayed_work(work); 1033 struct cfg80211_registered_device *rdev; 1034 struct cfg80211_chan_def chandef; 1035 struct ieee80211_supported_band *sband; 1036 struct ieee80211_channel *c; 1037 struct wiphy *wiphy; 1038 bool check_again = false; 1039 unsigned long timeout, next_time = 0; 1040 unsigned long time_dfs_update; 1041 enum nl80211_radar_event radar_event; 1042 int bandid, i; 1043 1044 rdev = container_of(delayed_work, struct cfg80211_registered_device, 1045 dfs_update_channels_wk); 1046 wiphy = &rdev->wiphy; 1047 1048 rtnl_lock(); 1049 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) { 1050 sband = wiphy->bands[bandid]; 1051 if (!sband) 1052 continue; 1053 1054 for (i = 0; i < sband->n_channels; i++) { 1055 c = &sband->channels[i]; 1056 1057 if (!(c->flags & IEEE80211_CHAN_RADAR)) 1058 continue; 1059 1060 if (c->dfs_state != NL80211_DFS_UNAVAILABLE && 1061 c->dfs_state != NL80211_DFS_AVAILABLE) 1062 continue; 1063 1064 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) { 1065 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS; 1066 radar_event = NL80211_RADAR_NOP_FINISHED; 1067 } else { 1068 if (regulatory_pre_cac_allowed(wiphy) || 1069 cfg80211_any_wiphy_oper_chan(wiphy, c)) 1070 continue; 1071 1072 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS; 1073 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED; 1074 } 1075 1076 timeout = c->dfs_state_entered + 1077 msecs_to_jiffies(time_dfs_update); 1078 1079 if (time_after_eq(jiffies, timeout)) { 1080 c->dfs_state = NL80211_DFS_USABLE; 1081 c->dfs_state_entered = jiffies; 1082 1083 cfg80211_chandef_create(&chandef, c, 1084 NL80211_CHAN_NO_HT); 1085 1086 nl80211_radar_notify(rdev, &chandef, 1087 radar_event, NULL, 1088 GFP_ATOMIC); 1089 1090 regulatory_propagate_dfs_state(wiphy, &chandef, 1091 c->dfs_state, 1092 radar_event); 1093 continue; 1094 } 1095 1096 if (!check_again) 1097 next_time = timeout - jiffies; 1098 else 1099 next_time = min(next_time, timeout - jiffies); 1100 check_again = true; 1101 } 1102 } 1103 rtnl_unlock(); 1104 1105 /* reschedule if there are other channels waiting to be cleared again */ 1106 if (check_again) 1107 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 1108 next_time); 1109 } 1110 1111 1112 void __cfg80211_radar_event(struct wiphy *wiphy, 1113 struct cfg80211_chan_def *chandef, 1114 bool offchan, gfp_t gfp) 1115 { 1116 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1117 1118 trace_cfg80211_radar_event(wiphy, chandef, offchan); 1119 1120 /* only set the chandef supplied channel to unavailable, in 1121 * case the radar is detected on only one of multiple channels 1122 * spanned by the chandef. 1123 */ 1124 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE); 1125 1126 if (offchan) { 1127 cancel_delayed_work(&rdev->background_cac_done_wk); 1128 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk); 1129 } 1130 1131 cfg80211_sched_dfs_chan_update(rdev); 1132 1133 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp); 1134 1135 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def)); 1136 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 1137 } 1138 EXPORT_SYMBOL(__cfg80211_radar_event); 1139 1140 void cfg80211_cac_event(struct net_device *netdev, 1141 const struct cfg80211_chan_def *chandef, 1142 enum nl80211_radar_event event, gfp_t gfp, 1143 unsigned int link_id) 1144 { 1145 struct wireless_dev *wdev = netdev->ieee80211_ptr; 1146 struct wiphy *wiphy = wdev->wiphy; 1147 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1148 unsigned long timeout; 1149 1150 if (WARN_ON(wdev->valid_links && 1151 !(wdev->valid_links & BIT(link_id)))) 1152 return; 1153 1154 trace_cfg80211_cac_event(netdev, event, link_id); 1155 1156 if (WARN_ON(!wdev->links[link_id].cac_started && 1157 event != NL80211_RADAR_CAC_STARTED)) 1158 return; 1159 1160 switch (event) { 1161 case NL80211_RADAR_CAC_FINISHED: 1162 timeout = wdev->links[link_id].cac_start_time + 1163 msecs_to_jiffies(wdev->links[link_id].cac_time_ms); 1164 WARN_ON(!time_after_eq(jiffies, timeout)); 1165 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE); 1166 memcpy(&rdev->cac_done_chandef, chandef, 1167 sizeof(struct cfg80211_chan_def)); 1168 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk); 1169 cfg80211_sched_dfs_chan_update(rdev); 1170 fallthrough; 1171 case NL80211_RADAR_CAC_ABORTED: 1172 wdev->links[link_id].cac_started = false; 1173 cfg80211_set_cac_state(wiphy, chandef, false); 1174 break; 1175 case NL80211_RADAR_CAC_STARTED: 1176 wdev->links[link_id].cac_started = true; 1177 cfg80211_set_cac_state(wiphy, chandef, true); 1178 break; 1179 default: 1180 WARN_ON(1); 1181 return; 1182 } 1183 1184 nl80211_radar_notify(rdev, chandef, event, netdev, gfp); 1185 } 1186 EXPORT_SYMBOL(cfg80211_cac_event); 1187 1188 static void 1189 __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev, 1190 struct wireless_dev *wdev, 1191 const struct cfg80211_chan_def *chandef, 1192 enum nl80211_radar_event event) 1193 { 1194 struct wiphy *wiphy = &rdev->wiphy; 1195 struct net_device *netdev; 1196 1197 lockdep_assert_wiphy(&rdev->wiphy); 1198 1199 if (!cfg80211_chandef_valid(chandef)) 1200 return; 1201 1202 switch (event) { 1203 case NL80211_RADAR_CAC_FINISHED: 1204 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE); 1205 cfg80211_set_cac_state(wiphy, chandef, false); 1206 memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef)); 1207 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk); 1208 cfg80211_sched_dfs_chan_update(rdev); 1209 break; 1210 case NL80211_RADAR_CAC_ABORTED: 1211 cfg80211_set_cac_state(wiphy, chandef, false); 1212 if (!cancel_delayed_work(&rdev->background_cac_done_wk)) 1213 return; 1214 break; 1215 case NL80211_RADAR_CAC_STARTED: 1216 cfg80211_set_cac_state(wiphy, chandef, true); 1217 break; 1218 default: 1219 return; 1220 } 1221 1222 netdev = wdev ? wdev->netdev : NULL; 1223 nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL); 1224 } 1225 1226 void cfg80211_background_cac_done_wk(struct work_struct *work) 1227 { 1228 struct delayed_work *delayed_work = to_delayed_work(work); 1229 struct cfg80211_registered_device *rdev; 1230 1231 rdev = container_of(delayed_work, struct cfg80211_registered_device, 1232 background_cac_done_wk); 1233 1234 guard(wiphy)(&rdev->wiphy); 1235 1236 rdev_set_radar_background(rdev, NULL); 1237 1238 __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev, 1239 &rdev->background_radar_chandef, 1240 NL80211_RADAR_CAC_FINISHED); 1241 1242 rdev->background_radar_wdev = NULL; 1243 } 1244 1245 void cfg80211_background_cac_abort_wk(struct work_struct *work) 1246 { 1247 struct cfg80211_registered_device *rdev; 1248 struct wireless_dev *wdev; 1249 1250 rdev = container_of(work, struct cfg80211_registered_device, 1251 background_cac_abort_wk); 1252 1253 guard(wiphy)(&rdev->wiphy); 1254 1255 wdev = rdev->background_radar_wdev; 1256 if (wdev) 1257 cfg80211_stop_background_radar_detection(wdev); 1258 } 1259 1260 void cfg80211_background_cac_abort(struct wiphy *wiphy) 1261 { 1262 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1263 1264 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk); 1265 } 1266 EXPORT_SYMBOL(cfg80211_background_cac_abort); 1267 1268 int 1269 cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev, 1270 struct wireless_dev *wdev, 1271 struct cfg80211_chan_def *chandef) 1272 { 1273 unsigned int cac_time_ms; 1274 int err; 1275 1276 lockdep_assert_wiphy(&rdev->wiphy); 1277 1278 if (!wiphy_ext_feature_isset(&rdev->wiphy, 1279 NL80211_EXT_FEATURE_RADAR_BACKGROUND)) 1280 return -EOPNOTSUPP; 1281 1282 /* Offchannel chain already locked by another wdev */ 1283 if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev) 1284 return -EBUSY; 1285 1286 /* CAC already in progress on the offchannel chain */ 1287 if (rdev->background_radar_wdev == wdev && 1288 delayed_work_pending(&rdev->background_cac_done_wk)) 1289 return -EBUSY; 1290 1291 err = rdev_set_radar_background(rdev, chandef); 1292 if (err) 1293 return err; 1294 1295 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef); 1296 if (!cac_time_ms) 1297 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 1298 1299 rdev->background_radar_chandef = *chandef; 1300 rdev->background_radar_wdev = wdev; /* Get offchain ownership */ 1301 1302 __cfg80211_background_cac_event(rdev, wdev, chandef, 1303 NL80211_RADAR_CAC_STARTED); 1304 queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk, 1305 msecs_to_jiffies(cac_time_ms)); 1306 1307 return 0; 1308 } 1309 1310 void cfg80211_stop_radar_detection(struct wireless_dev *wdev) 1311 { 1312 struct wiphy *wiphy = wdev->wiphy; 1313 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1314 int link_id; 1315 1316 for_each_valid_link(wdev, link_id) { 1317 struct cfg80211_chan_def chandef; 1318 1319 if (!wdev->links[link_id].cac_started) 1320 continue; 1321 1322 chandef = *wdev_chandef(wdev, link_id); 1323 rdev_end_cac(rdev, wdev->netdev, link_id); 1324 wdev->links[link_id].cac_started = false; 1325 cfg80211_set_cac_state(wiphy, &chandef, false); 1326 nl80211_radar_notify(rdev, &chandef, NL80211_RADAR_CAC_ABORTED, 1327 wdev->netdev, GFP_KERNEL); 1328 } 1329 } 1330 1331 void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev) 1332 { 1333 struct wiphy *wiphy = wdev->wiphy; 1334 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 1335 1336 lockdep_assert_wiphy(wiphy); 1337 1338 if (wdev != rdev->background_radar_wdev) 1339 return; 1340 1341 rdev_set_radar_background(rdev, NULL); 1342 1343 __cfg80211_background_cac_event(rdev, wdev, 1344 &rdev->background_radar_chandef, 1345 NL80211_RADAR_CAC_ABORTED); 1346 1347 rdev->background_radar_wdev = NULL; 1348 } 1349 1350 int cfg80211_assoc_ml_reconf(struct cfg80211_registered_device *rdev, 1351 struct net_device *dev, 1352 struct cfg80211_ml_reconf_req *req) 1353 { 1354 struct wireless_dev *wdev = dev->ieee80211_ptr; 1355 int err; 1356 1357 lockdep_assert_wiphy(wdev->wiphy); 1358 1359 err = rdev_assoc_ml_reconf(rdev, dev, req); 1360 if (!err) { 1361 int link_id; 1362 1363 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; 1364 link_id++) { 1365 if (!req->add_links[link_id].bss) 1366 continue; 1367 1368 cfg80211_ref_bss(&rdev->wiphy, req->add_links[link_id].bss); 1369 cfg80211_hold_bss(bss_from_pub(req->add_links[link_id].bss)); 1370 } 1371 } 1372 1373 return err; 1374 } 1375 1376 void cfg80211_mlo_reconf_add_done(struct net_device *dev, 1377 struct cfg80211_mlo_reconf_done_data *data) 1378 { 1379 struct wireless_dev *wdev = dev->ieee80211_ptr; 1380 struct wiphy *wiphy = wdev->wiphy; 1381 int link_id; 1382 1383 lockdep_assert_wiphy(wiphy); 1384 1385 trace_cfg80211_mlo_reconf_add_done(dev, data->added_links, 1386 data->buf, data->len, 1387 data->driver_initiated); 1388 1389 if (WARN_ON(!wdev->valid_links)) 1390 return; 1391 1392 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION && 1393 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) 1394 return; 1395 1396 /* validate that a BSS is given for each added link */ 1397 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { 1398 struct cfg80211_bss *bss = data->links[link_id].bss; 1399 1400 if (!(data->added_links & BIT(link_id))) 1401 continue; 1402 1403 if (WARN_ON(!bss)) 1404 return; 1405 } 1406 1407 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) { 1408 struct cfg80211_bss *bss = data->links[link_id].bss; 1409 1410 if (!bss) 1411 continue; 1412 1413 if (data->added_links & BIT(link_id)) { 1414 wdev->links[link_id].client.current_bss = 1415 bss_from_pub(bss); 1416 1417 if (data->driver_initiated) 1418 cfg80211_hold_bss(bss_from_pub(bss)); 1419 1420 memcpy(wdev->links[link_id].addr, 1421 data->links[link_id].addr, 1422 ETH_ALEN); 1423 } else { 1424 if (!data->driver_initiated) 1425 cfg80211_unhold_bss(bss_from_pub(bss)); 1426 1427 cfg80211_put_bss(wiphy, bss); 1428 } 1429 } 1430 1431 wdev->valid_links |= data->added_links; 1432 nl80211_mlo_reconf_add_done(dev, data); 1433 } 1434 EXPORT_SYMBOL(cfg80211_mlo_reconf_add_done); 1435