net/wireless/mlme.c

   1 /*
   2  * cfg80211 MLME SAP interface
   3  *
   4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   5  */
   6
   7 #include <linux/kernel.h>
   8 #include <linux/module.h>
   9 #include <linux/netdevice.h>
  10 #include <linux/nl80211.h>
  11 #include <linux/slab.h>
  12 #include <linux/wireless.h>
  13 #include <net/cfg80211.h>
  14 #include <net/iw_handler.h>
  15 #include "core.h"
  16 #include "nl80211.h"
  17
  18 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
  19 {
  20         struct wireless_dev *wdev = dev->ieee80211_ptr;
  21         struct wiphy *wiphy = wdev->wiphy;
  22         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  23
  24         wdev_lock(wdev);
  25
  26         nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
  27         cfg80211_sme_rx_auth(dev, buf, len);
  28
  29         wdev_unlock(wdev);
  30 }
  31 EXPORT_SYMBOL(cfg80211_send_rx_auth);
  32
  33 void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
  34                             const u8 *buf, size_t len)
  35 {
  36         u16 status_code;
  37         struct wireless_dev *wdev = dev->ieee80211_ptr;
  38         struct wiphy *wiphy = wdev->wiphy;
  39         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  40         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  41         u8 *ie = mgmt->u.assoc_resp.variable;
  42         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  43
  44         wdev_lock(wdev);
  45
  46         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  47
  48         /*
  49          * This is a bit of a hack, we don't notify userspace of
  50          * a (re-)association reply if we tried to send a reassoc
  51          * and got a reject -- we only try again with an assoc
  52          * frame instead of reassoc.
  53          */
  54         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
  55             cfg80211_sme_failed_reassoc(wdev)) {
  56                 cfg80211_put_bss(bss);
  57                 goto out;
  58         }
  59
  60         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
  61
  62         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn) {
  63                 cfg80211_sme_failed_assoc(wdev);
  64                 /*
  65                  * do not call connect_result() now because the
  66                  * sme will schedule work that does it later.
  67                  */
  68                 cfg80211_put_bss(bss);
  69                 goto out;
  70         }
  71
  72         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
  73                 /*
  74                  * This is for the userspace SME, the CONNECTING
  75                  * state will be changed to CONNECTED by
  76                  * __cfg80211_connect_result() below.
  77                  */
  78                 wdev->sme_state = CFG80211_SME_CONNECTING;
  79         }
  80
  81         /* this consumes the bss reference */
  82         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
  83                                   status_code,
  84                                   status_code == WLAN_STATUS_SUCCESS, bss);
  85  out:
  86         wdev_unlock(wdev);
  87 }
  88 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
  89
  90 void __cfg80211_send_deauth(struct net_device *dev,
  91                                    const u8 *buf, size_t len)
  92 {
  93         struct wireless_dev *wdev = dev->ieee80211_ptr;
  94         struct wiphy *wiphy = wdev->wiphy;
  95         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  96         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  97         const u8 *bssid = mgmt->bssid;
  98         bool was_current = false;
  99
 100         ASSERT_WDEV_LOCK(wdev);
 101
 102         if (wdev->current_bss &&
 103             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 104                 cfg80211_unhold_bss(wdev->current_bss);
 105                 cfg80211_put_bss(&wdev->current_bss->pub);
 106                 wdev->current_bss = NULL;
 107                 was_current = true;
 108         }
 109
 110         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 111
 112         if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
 113                 u16 reason_code;
 114                 bool from_ap;
 115
 116                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 117
 118                 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 119                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 120         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
 121                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 122                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 123                                           false, NULL);
 124         }
 125 }
 126 EXPORT_SYMBOL(__cfg80211_send_deauth);
 127
 128 void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 129 {
 130         struct wireless_dev *wdev = dev->ieee80211_ptr;
 131
 132         wdev_lock(wdev);
 133         __cfg80211_send_deauth(dev, buf, len);
 134         wdev_unlock(wdev);
 135 }
 136 EXPORT_SYMBOL(cfg80211_send_deauth);
 137
 138 void __cfg80211_send_disassoc(struct net_device *dev,
 139                                      const u8 *buf, size_t len)
 140 {
 141         struct wireless_dev *wdev = dev->ieee80211_ptr;
 142         struct wiphy *wiphy = wdev->wiphy;
 143         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 144         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 145         const u8 *bssid = mgmt->bssid;
 146         u16 reason_code;
 147         bool from_ap;
 148
 149         ASSERT_WDEV_LOCK(wdev);
 150
 151         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
 152
 153         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 154                 return;
 155
 156         if (wdev->current_bss &&
 157             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 158                 cfg80211_sme_disassoc(dev, wdev->current_bss);
 159                 cfg80211_unhold_bss(wdev->current_bss);
 160                 cfg80211_put_bss(&wdev->current_bss->pub);
 161                 wdev->current_bss = NULL;
 162         } else
 163                 WARN_ON(1);
 164
 165
 166         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 167
 168         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 169         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 170 }
 171 EXPORT_SYMBOL(__cfg80211_send_disassoc);
 172
 173 void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 174 {
 175         struct wireless_dev *wdev = dev->ieee80211_ptr;
 176
 177         wdev_lock(wdev);
 178         __cfg80211_send_disassoc(dev, buf, len);
 179         wdev_unlock(wdev);
 180 }
 181 EXPORT_SYMBOL(cfg80211_send_disassoc);
 182
 183 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
 184                                  size_t len)
 185 {
 186         struct wireless_dev *wdev = dev->ieee80211_ptr;
 187         struct wiphy *wiphy = wdev->wiphy;
 188         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 189
 190         nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
 191 }
 192 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
 193
 194 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
 195                                    size_t len)
 196 {
 197         struct wireless_dev *wdev = dev->ieee80211_ptr;
 198         struct wiphy *wiphy = wdev->wiphy;
 199         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 200
 201         nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
 202 }
 203 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
 204
 205 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 206 {
 207         struct wireless_dev *wdev = dev->ieee80211_ptr;
 208         struct wiphy *wiphy = wdev->wiphy;
 209         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 210
 211         wdev_lock(wdev);
 212
 213         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 214         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 215                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 216                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 217                                           false, NULL);
 218
 219         wdev_unlock(wdev);
 220 }
 221 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 222
 223 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 224 {
 225         struct wireless_dev *wdev = dev->ieee80211_ptr;
 226         struct wiphy *wiphy = wdev->wiphy;
 227         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 228
 229         wdev_lock(wdev);
 230
 231         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 232         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 233                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 234                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 235                                           false, NULL);
 236
 237         wdev_unlock(wdev);
 238 }
 239 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 240
 241 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 242                                   enum nl80211_key_type key_type, int key_id,
 243                                   const u8 *tsc, gfp_t gfp)
 244 {
 245         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 246         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 247 #ifdef CONFIG_CFG80211_WEXT
 248         union iwreq_data wrqu;
 249         char *buf = kmalloc(128, gfp);
 250
 251         if (buf) {
 252                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 253                         "keyid=%d %scast addr=%pM)", key_id,
 254                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 255                         addr);
 256                 memset(&wrqu, 0, sizeof(wrqu));
 257                 wrqu.data.length = strlen(buf);
 258                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 259                 kfree(buf);
 260         }
 261 #endif
 262
 263         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 264 }
 265 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 266
 267 /* some MLME handling for userspace SME */
 268 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 269                          struct net_device *dev,
 270                          struct ieee80211_channel *chan,
 271                          enum nl80211_auth_type auth_type,
 272                          const u8 *bssid,
 273                          const u8 *ssid, int ssid_len,
 274                          const u8 *ie, int ie_len,
 275                          const u8 *key, int key_len, int key_idx)
 276 {
 277         struct wireless_dev *wdev = dev->ieee80211_ptr;
 278         struct cfg80211_auth_request req;
 279         int err;
 280
 281         ASSERT_WDEV_LOCK(wdev);
 282
 283         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 284                 if (!key || !key_len || key_idx < 0 || key_idx > 4)
 285                         return -EINVAL;
 286
 287         if (wdev->current_bss &&
 288             memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
 289                 return -EALREADY;
 290
 291         memset(&req, 0, sizeof(req));
 292
 293         req.ie = ie;
 294         req.ie_len = ie_len;
 295         req.auth_type = auth_type;
 296         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 297                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 298         req.key = key;
 299         req.key_len = key_len;
 300         req.key_idx = key_idx;
 301         if (!req.bss)
 302                 return -ENOENT;
 303
 304         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
 305
 306         cfg80211_put_bss(req.bss);
 307         return err;
 308 }
 309
 310 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 311                        struct net_device *dev, struct ieee80211_channel *chan,
 312                        enum nl80211_auth_type auth_type, const u8 *bssid,
 313                        const u8 *ssid, int ssid_len,
 314                        const u8 *ie, int ie_len,
 315                        const u8 *key, int key_len, int key_idx)
 316 {
 317         int err;
 318
 319         wdev_lock(dev->ieee80211_ptr);
 320         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
 321                                    ssid, ssid_len, ie, ie_len,
 322                                    key, key_len, key_idx);
 323         wdev_unlock(dev->ieee80211_ptr);
 324
 325         return err;
 326 }
 327
 328 /*  Do a logical ht_capa &= ht_capa_mask.  */
 329 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 330                                const struct ieee80211_ht_cap *ht_capa_mask)
 331 {
 332         int i;
 333         u8 *p1, *p2;
 334         if (!ht_capa_mask) {
 335                 memset(ht_capa, 0, sizeof(*ht_capa));
 336                 return;
 337         }
 338
 339         p1 = (u8*)(ht_capa);
 340         p2 = (u8*)(ht_capa_mask);
 341         for (i = 0; i<sizeof(*ht_capa); i++)
 342                 p1[i] &= p2[i];
 343 }
 344
 345 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 346                           struct net_device *dev,
 347                           struct ieee80211_channel *chan,
 348                           const u8 *bssid, const u8 *prev_bssid,
 349                           const u8 *ssid, int ssid_len,
 350                           const u8 *ie, int ie_len, bool use_mfp,
 351                           struct cfg80211_crypto_settings *crypt,
 352                           u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
 353                           struct ieee80211_ht_cap *ht_capa_mask)
 354 {
 355         struct wireless_dev *wdev = dev->ieee80211_ptr;
 356         struct cfg80211_assoc_request req;
 357         int err;
 358         bool was_connected = false;
 359
 360         ASSERT_WDEV_LOCK(wdev);
 361
 362         memset(&req, 0, sizeof(req));
 363
 364         if (wdev->current_bss && prev_bssid &&
 365             memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
 366                 /*
 367                  * Trying to reassociate: Allow this to proceed and let the old
 368                  * association to be dropped when the new one is completed.
 369                  */
 370                 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 371                         was_connected = true;
 372                         wdev->sme_state = CFG80211_SME_CONNECTING;
 373                 }
 374         } else if (wdev->current_bss)
 375                 return -EALREADY;
 376
 377         req.ie = ie;
 378         req.ie_len = ie_len;
 379         memcpy(&req.crypto, crypt, sizeof(req.crypto));
 380         req.use_mfp = use_mfp;
 381         req.prev_bssid = prev_bssid;
 382         req.flags = assoc_flags;
 383         if (ht_capa)
 384                 memcpy(&req.ht_capa, ht_capa, sizeof(req.ht_capa));
 385         if (ht_capa_mask)
 386                 memcpy(&req.ht_capa_mask, ht_capa_mask,
 387                        sizeof(req.ht_capa_mask));
 388         cfg80211_oper_and_ht_capa(&req.ht_capa_mask,
 389                                   rdev->wiphy.ht_capa_mod_mask);
 390
 391         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 392                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 393         if (!req.bss) {
 394                 if (was_connected)
 395                         wdev->sme_state = CFG80211_SME_CONNECTED;
 396                 return -ENOENT;
 397         }
 398
 399         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
 400
 401         if (err) {
 402                 if (was_connected)
 403                         wdev->sme_state = CFG80211_SME_CONNECTED;
 404                 cfg80211_put_bss(req.bss);
 405         }
 406
 407         return err;
 408 }
 409
 410 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 411                         struct net_device *dev,
 412                         struct ieee80211_channel *chan,
 413                         const u8 *bssid, const u8 *prev_bssid,
 414                         const u8 *ssid, int ssid_len,
 415                         const u8 *ie, int ie_len, bool use_mfp,
 416                         struct cfg80211_crypto_settings *crypt,
 417                         u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
 418                         struct ieee80211_ht_cap *ht_capa_mask)
 419 {
 420         struct wireless_dev *wdev = dev->ieee80211_ptr;
 421         int err;
 422
 423         wdev_lock(wdev);
 424         err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
 425                                     ssid, ssid_len, ie, ie_len, use_mfp, crypt,
 426                                     assoc_flags, ht_capa, ht_capa_mask);
 427         wdev_unlock(wdev);
 428
 429         return err;
 430 }
 431
 432 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 433                            struct net_device *dev, const u8 *bssid,
 434                            const u8 *ie, int ie_len, u16 reason,
 435                            bool local_state_change)
 436 {
 437         struct wireless_dev *wdev = dev->ieee80211_ptr;
 438         struct cfg80211_deauth_request req = {
 439                 .bssid = bssid,
 440                 .reason_code = reason,
 441                 .ie = ie,
 442                 .ie_len = ie_len,
 443         };
 444
 445         ASSERT_WDEV_LOCK(wdev);
 446
 447         if (local_state_change) {
 448                 if (wdev->current_bss &&
 449                     memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 450                         cfg80211_unhold_bss(wdev->current_bss);
 451                         cfg80211_put_bss(&wdev->current_bss->pub);
 452                         wdev->current_bss = NULL;
 453                 }
 454
 455                 return 0;
 456         }
 457
 458         return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 459 }
 460
 461 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 462                          struct net_device *dev, const u8 *bssid,
 463                          const u8 *ie, int ie_len, u16 reason,
 464                          bool local_state_change)
 465 {
 466         struct wireless_dev *wdev = dev->ieee80211_ptr;
 467         int err;
 468
 469         wdev_lock(wdev);
 470         err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
 471                                      local_state_change);
 472         wdev_unlock(wdev);
 473
 474         return err;
 475 }
 476
 477 static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 478                                     struct net_device *dev, const u8 *bssid,
 479                                     const u8 *ie, int ie_len, u16 reason,
 480                                     bool local_state_change)
 481 {
 482         struct wireless_dev *wdev = dev->ieee80211_ptr;
 483         struct cfg80211_disassoc_request req;
 484
 485         ASSERT_WDEV_LOCK(wdev);
 486
 487         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 488                 return -ENOTCONN;
 489
 490         if (WARN_ON(!wdev->current_bss))
 491                 return -ENOTCONN;
 492
 493         memset(&req, 0, sizeof(req));
 494         req.reason_code = reason;
 495         req.local_state_change = local_state_change;
 496         req.ie = ie;
 497         req.ie_len = ie_len;
 498         if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
 499                 req.bss = &wdev->current_bss->pub;
 500         else
 501                 return -ENOTCONN;
 502
 503         return rdev->ops->disassoc(&rdev->wiphy, dev, &req);
 504 }
 505
 506 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 507                            struct net_device *dev, const u8 *bssid,
 508                            const u8 *ie, int ie_len, u16 reason,
 509                            bool local_state_change)
 510 {
 511         struct wireless_dev *wdev = dev->ieee80211_ptr;
 512         int err;
 513
 514         wdev_lock(wdev);
 515         err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
 516                                        local_state_change);
 517         wdev_unlock(wdev);
 518
 519         return err;
 520 }
 521
 522 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 523                         struct net_device *dev)
 524 {
 525         struct wireless_dev *wdev = dev->ieee80211_ptr;
 526         struct cfg80211_deauth_request req;
 527         u8 bssid[ETH_ALEN];
 528
 529         ASSERT_WDEV_LOCK(wdev);
 530
 531         if (!rdev->ops->deauth)
 532                 return;
 533
 534         memset(&req, 0, sizeof(req));
 535         req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 536         req.ie = NULL;
 537         req.ie_len = 0;
 538
 539         if (!wdev->current_bss)
 540                 return;
 541
 542         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
 543         req.bssid = bssid;
 544         rdev->ops->deauth(&rdev->wiphy, dev, &req);
 545
 546         if (wdev->current_bss) {
 547                 cfg80211_unhold_bss(wdev->current_bss);
 548                 cfg80211_put_bss(&wdev->current_bss->pub);
 549                 wdev->current_bss = NULL;
 550         }
 551 }
 552
 553 void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
 554                                struct ieee80211_channel *chan,
 555                                enum nl80211_channel_type channel_type,
 556                                unsigned int duration, gfp_t gfp)
 557 {
 558         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 559         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 560
 561         nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
 562                                        duration, gfp);
 563 }
 564 EXPORT_SYMBOL(cfg80211_ready_on_channel);
 565
 566 void cfg80211_remain_on_channel_expired(struct net_device *dev,
 567                                         u64 cookie,
 568                                         struct ieee80211_channel *chan,
 569                                         enum nl80211_channel_type channel_type,
 570                                         gfp_t gfp)
 571 {
 572         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 573         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 574
 575         nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
 576                                               channel_type, gfp);
 577 }
 578 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
 579
 580 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 581                       struct station_info *sinfo, gfp_t gfp)
 582 {
 583         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 584         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 585
 586         nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
 587 }
 588 EXPORT_SYMBOL(cfg80211_new_sta);
 589
 590 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 591 {
 592         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 593         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 594
 595         nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
 596 }
 597 EXPORT_SYMBOL(cfg80211_del_sta);
 598
 599 struct cfg80211_mgmt_registration {
 600         struct list_head list;
 601
 602         u32 nlpid;
 603
 604         int match_len;
 605
 606         __le16 frame_type;
 607
 608         u8 match[];
 609 };
 610
 611 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
 612                                 u16 frame_type, const u8 *match_data,
 613                                 int match_len)
 614 {
 615         struct wiphy *wiphy = wdev->wiphy;
 616         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 617         struct cfg80211_mgmt_registration *reg, *nreg;
 618         int err = 0;
 619         u16 mgmt_type;
 620
 621         if (!wdev->wiphy->mgmt_stypes)
 622                 return -EOPNOTSUPP;
 623
 624         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
 625                 return -EINVAL;
 626
 627         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
 628                 return -EINVAL;
 629
 630         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 631         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
 632                 return -EINVAL;
 633
 634         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 635         if (!nreg)
 636                 return -ENOMEM;
 637
 638         spin_lock_bh(&wdev->mgmt_registrations_lock);
 639
 640         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 641                 int mlen = min(match_len, reg->match_len);
 642
 643                 if (frame_type != le16_to_cpu(reg->frame_type))
 644                         continue;
 645
 646                 if (memcmp(reg->match, match_data, mlen) == 0) {
 647                         err = -EALREADY;
 648                         break;
 649                 }
 650         }
 651
 652         if (err) {
 653                 kfree(nreg);
 654                 goto out;
 655         }
 656
 657         memcpy(nreg->match, match_data, match_len);
 658         nreg->match_len = match_len;
 659         nreg->nlpid = snd_pid;
 660         nreg->frame_type = cpu_to_le16(frame_type);
 661         list_add(&nreg->list, &wdev->mgmt_registrations);
 662
 663         if (rdev->ops->mgmt_frame_register)
 664                 rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 665                                                frame_type, true);
 666
 667  out:
 668         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 669
 670         return err;
 671 }
 672
 673 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
 674 {
 675         struct wiphy *wiphy = wdev->wiphy;
 676         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 677         struct cfg80211_mgmt_registration *reg, *tmp;
 678
 679         spin_lock_bh(&wdev->mgmt_registrations_lock);
 680
 681         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 682                 if (reg->nlpid != nlpid)
 683                         continue;
 684
 685                 if (rdev->ops->mgmt_frame_register) {
 686                         u16 frame_type = le16_to_cpu(reg->frame_type);
 687
 688                         rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 689                                                        frame_type, false);
 690                 }
 691
 692                 list_del(&reg->list);
 693                 kfree(reg);
 694         }
 695
 696         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 697
 698         if (nlpid == wdev->ap_unexpected_nlpid)
 699                 wdev->ap_unexpected_nlpid = 0;
 700 }
 701
 702 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 703 {
 704         struct cfg80211_mgmt_registration *reg, *tmp;
 705
 706         spin_lock_bh(&wdev->mgmt_registrations_lock);
 707
 708         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 709                 list_del(&reg->list);
 710                 kfree(reg);
 711         }
 712
 713         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 714 }
 715
 716 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 717                           struct net_device *dev,
 718                           struct ieee80211_channel *chan, bool offchan,
 719                           enum nl80211_channel_type channel_type,
 720                           bool channel_type_valid, unsigned int wait,
 721                           const u8 *buf, size_t len, bool no_cck,
 722                           bool dont_wait_for_ack, u64 *cookie)
 723 {
 724         struct wireless_dev *wdev = dev->ieee80211_ptr;
 725         const struct ieee80211_mgmt *mgmt;
 726         u16 stype;
 727
 728         if (!wdev->wiphy->mgmt_stypes)
 729                 return -EOPNOTSUPP;
 730
 731         if (!rdev->ops->mgmt_tx)
 732                 return -EOPNOTSUPP;
 733
 734         if (len < 24 + 1)
 735                 return -EINVAL;
 736
 737         mgmt = (const struct ieee80211_mgmt *) buf;
 738
 739         if (!ieee80211_is_mgmt(mgmt->frame_control))
 740                 return -EINVAL;
 741
 742         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 743         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 744                 return -EINVAL;
 745
 746         if (ieee80211_is_action(mgmt->frame_control) &&
 747             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 748                 int err = 0;
 749
 750                 wdev_lock(wdev);
 751
 752                 switch (wdev->iftype) {
 753                 case NL80211_IFTYPE_ADHOC:
 754                 case NL80211_IFTYPE_STATION:
 755                 case NL80211_IFTYPE_P2P_CLIENT:
 756                         if (!wdev->current_bss) {
 757                                 err = -ENOTCONN;
 758                                 break;
 759                         }
 760
 761                         if (memcmp(wdev->current_bss->pub.bssid,
 762                                    mgmt->bssid, ETH_ALEN)) {
 763                                 err = -ENOTCONN;
 764                                 break;
 765                         }
 766
 767                         /*
 768                          * check for IBSS DA must be done by driver as
 769                          * cfg80211 doesn't track the stations
 770                          */
 771                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 772                                 break;
 773
 774                         /* for station, check that DA is the AP */
 775                         if (memcmp(wdev->current_bss->pub.bssid,
 776                                    mgmt->da, ETH_ALEN)) {
 777                                 err = -ENOTCONN;
 778                                 break;
 779                         }
 780                         break;
 781                 case NL80211_IFTYPE_AP:
 782                 case NL80211_IFTYPE_P2P_GO:
 783                 case NL80211_IFTYPE_AP_VLAN:
 784                         if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
 785                                 err = -EINVAL;
 786                         break;
 787                 case NL80211_IFTYPE_MESH_POINT:
 788                         if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
 789                                 err = -EINVAL;
 790                                 break;
 791                         }
 792                         /*
 793                          * check for mesh DA must be done by driver as
 794                          * cfg80211 doesn't track the stations
 795                          */
 796                         break;
 797                 default:
 798                         err = -EOPNOTSUPP;
 799                         break;
 800                 }
 801                 wdev_unlock(wdev);
 802
 803                 if (err)
 804                         return err;
 805         }
 806
 807         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
 808                 return -EINVAL;
 809
 810         /* Transmit the Action frame as requested by user space */
 811         return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
 812                                   channel_type, channel_type_valid,
 813                                   wait, buf, len, no_cck, dont_wait_for_ack,
 814                                   cookie);
 815 }
 816
 817 bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_mbm,
 818                       const u8 *buf, size_t len, gfp_t gfp)
 819 {
 820         struct wireless_dev *wdev = dev->ieee80211_ptr;
 821         struct wiphy *wiphy = wdev->wiphy;
 822         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 823         struct cfg80211_mgmt_registration *reg;
 824         const struct ieee80211_txrx_stypes *stypes =
 825                 &wiphy->mgmt_stypes[wdev->iftype];
 826         struct ieee80211_mgmt *mgmt = (void *)buf;
 827         const u8 *data;
 828         int data_len;
 829         bool result = false;
 830         __le16 ftype = mgmt->frame_control &
 831                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 832         u16 stype;
 833
 834         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 835
 836         if (!(stypes->rx & BIT(stype)))
 837                 return false;
 838
 839         data = buf + ieee80211_hdrlen(mgmt->frame_control);
 840         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
 841
 842         spin_lock_bh(&wdev->mgmt_registrations_lock);
 843
 844         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 845                 if (reg->frame_type != ftype)
 846                         continue;
 847
 848                 if (reg->match_len > data_len)
 849                         continue;
 850
 851                 if (memcmp(reg->match, data, reg->match_len))
 852                         continue;
 853
 854                 /* found match! */
 855
 856                 /* Indicate the received Action frame to user space */
 857                 if (nl80211_send_mgmt(rdev, dev, reg->nlpid,
 858                                       freq, sig_mbm,
 859                                       buf, len, gfp))
 860                         continue;
 861
 862                 result = true;
 863                 break;
 864         }
 865
 866         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 867
 868         return result;
 869 }
 870 EXPORT_SYMBOL(cfg80211_rx_mgmt);
 871
 872 void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
 873                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
 874 {
 875         struct wireless_dev *wdev = dev->ieee80211_ptr;
 876         struct wiphy *wiphy = wdev->wiphy;
 877         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 878
 879         /* Indicate TX status of the Action frame to user space */
 880         nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
 881 }
 882 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
 883
 884 void cfg80211_cqm_rssi_notify(struct net_device *dev,
 885                               enum nl80211_cqm_rssi_threshold_event rssi_event,
 886                               gfp_t gfp)
 887 {
 888         struct wireless_dev *wdev = dev->ieee80211_ptr;
 889         struct wiphy *wiphy = wdev->wiphy;
 890         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 891
 892         /* Indicate roaming trigger event to user space */
 893         nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
 894 }
 895 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
 896
 897 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
 898                                  const u8 *peer, u32 num_packets, gfp_t gfp)
 899 {
 900         struct wireless_dev *wdev = dev->ieee80211_ptr;
 901         struct wiphy *wiphy = wdev->wiphy;
 902         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 903
 904         /* Indicate roaming trigger event to user space */
 905         nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
 906 }
 907 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
 908
 909 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
 910                                const u8 *replay_ctr, gfp_t gfp)
 911 {
 912         struct wireless_dev *wdev = dev->ieee80211_ptr;
 913         struct wiphy *wiphy = wdev->wiphy;
 914         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 915
 916         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
 917 }
 918 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
 919
 920 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
 921                                      const u8 *bssid, bool preauth, gfp_t gfp)
 922 {
 923         struct wireless_dev *wdev = dev->ieee80211_ptr;
 924         struct wiphy *wiphy = wdev->wiphy;
 925         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 926
 927         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
 928 }
 929 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
 930
 931 bool cfg80211_rx_spurious_frame(struct net_device *dev,
 932                                 const u8 *addr, gfp_t gfp)
 933 {
 934         struct wireless_dev *wdev = dev->ieee80211_ptr;
 935
 936         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
 937                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
 938                 return false;
 939
 940         return nl80211_unexpected_frame(dev, addr, gfp);
 941 }
 942 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
 943
 944 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
 945                                         const u8 *addr, gfp_t gfp)
 946 {
 947         struct wireless_dev *wdev = dev->ieee80211_ptr;
 948
 949         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
 950                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
 951                     wdev->iftype != NL80211_IFTYPE_AP_VLAN))
 952                 return false;
 953
 954         return nl80211_unexpected_4addr_frame(dev, addr, gfp);
 955 }
 956 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);