net/wireless/sme.c

   1 /*
   2  * SME code for cfg80211's connect emulation.
   3  *
   4  * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright (C) 2009   Intel Corporation. All rights reserved.
   6  */
   7
   8 #include <linux/etherdevice.h>
   9 #include <linux/if_arp.h>
  10 #include <linux/slab.h>
  11 #include <linux/workqueue.h>
  12 #include <linux/wireless.h>
  13 #include <net/iw_handler.h>
  14 #include <net/cfg80211.h>
  15 #include <net/rtnetlink.h>
  16 #include "nl80211.h"
  17 #include "reg.h"
  18
  19 struct cfg80211_conn {
  20         struct cfg80211_connect_params params;
  21         /* these are sub-states of the _CONNECTING sme_state */
  22         enum {
  23                 CFG80211_CONN_IDLE,
  24                 CFG80211_CONN_SCANNING,
  25                 CFG80211_CONN_SCAN_AGAIN,
  26                 CFG80211_CONN_AUTHENTICATE_NEXT,
  27                 CFG80211_CONN_AUTHENTICATING,
  28                 CFG80211_CONN_ASSOCIATE_NEXT,
  29                 CFG80211_CONN_ASSOCIATING,
  30                 CFG80211_CONN_DEAUTH_ASSOC_FAIL,
  31         } state;
  32         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
  33         u8 *ie;
  34         size_t ie_len;
  35         bool auto_auth, prev_bssid_valid;
  36 };
  37
  38 static bool cfg80211_is_all_idle(void)
  39 {
  40         struct cfg80211_registered_device *rdev;
  41         struct wireless_dev *wdev;
  42         bool is_all_idle = true;
  43
  44         mutex_lock(&cfg80211_mutex);
  45
  46         /*
  47          * All devices must be idle as otherwise if you are actively
  48          * scanning some new beacon hints could be learned and would
  49          * count as new regulatory hints.
  50          */
  51         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  52                 cfg80211_lock_rdev(rdev);
  53                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
  54                         wdev_lock(wdev);
  55                         if (wdev->sme_state != CFG80211_SME_IDLE)
  56                                 is_all_idle = false;
  57                         wdev_unlock(wdev);
  58                 }
  59                 cfg80211_unlock_rdev(rdev);
  60         }
  61
  62         mutex_unlock(&cfg80211_mutex);
  63
  64         return is_all_idle;
  65 }
  66
  67 static void disconnect_work(struct work_struct *work)
  68 {
  69         if (!cfg80211_is_all_idle())
  70                 return;
  71
  72         regulatory_hint_disconnect();
  73 }
  74
  75 static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
  76
  77 static int cfg80211_conn_scan(struct wireless_dev *wdev)
  78 {
  79         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
  80         struct cfg80211_scan_request *request;
  81         int n_channels, err;
  82
  83         ASSERT_RTNL();
  84         ASSERT_RDEV_LOCK(rdev);
  85         ASSERT_WDEV_LOCK(wdev);
  86
  87         if (rdev->scan_req)
  88                 return -EBUSY;
  89
  90         if (wdev->conn->params.channel) {
  91                 n_channels = 1;
  92         } else {
  93                 enum ieee80211_band band;
  94                 n_channels = 0;
  95
  96                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
  97                         if (!wdev->wiphy->bands[band])
  98                                 continue;
  99                         n_channels += wdev->wiphy->bands[band]->n_channels;
 100                 }
 101         }
 102         request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
 103                           sizeof(request->channels[0]) * n_channels,
 104                           GFP_KERNEL);
 105         if (!request)
 106                 return -ENOMEM;
 107
 108         if (wdev->conn->params.channel)
 109                 request->channels[0] = wdev->conn->params.channel;
 110         else {
 111                 int i = 0, j;
 112                 enum ieee80211_band band;
 113                 struct ieee80211_supported_band *bands;
 114                 struct ieee80211_channel *channel;
 115
 116                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 117                         bands = wdev->wiphy->bands[band];
 118                         if (!bands)
 119                                 continue;
 120                         for (j = 0; j < bands->n_channels; j++) {
 121                                 channel = &bands->channels[j];
 122                                 if (channel->flags & IEEE80211_CHAN_DISABLED)
 123                                         continue;
 124                                 request->channels[i++] = channel;
 125                         }
 126                         request->rates[band] = (1 << bands->n_bitrates) - 1;
 127                 }
 128                 n_channels = i;
 129         }
 130         request->n_channels = n_channels;
 131         request->ssids = (void *)&request->channels[n_channels];
 132         request->n_ssids = 1;
 133
 134         memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
 135                 wdev->conn->params.ssid_len);
 136         request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
 137
 138         request->dev = wdev->netdev;
 139         request->wiphy = &rdev->wiphy;
 140
 141         rdev->scan_req = request;
 142
 143         err = rdev->ops->scan(wdev->wiphy, wdev->netdev, request);
 144         if (!err) {
 145                 wdev->conn->state = CFG80211_CONN_SCANNING;
 146                 nl80211_send_scan_start(rdev, wdev->netdev);
 147                 dev_hold(wdev->netdev);
 148         } else {
 149                 rdev->scan_req = NULL;
 150                 kfree(request);
 151         }
 152         return err;
 153 }
 154
 155 static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 156 {
 157         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 158         struct cfg80211_connect_params *params;
 159         const u8 *prev_bssid = NULL;
 160         int err;
 161
 162         ASSERT_WDEV_LOCK(wdev);
 163
 164         if (!wdev->conn)
 165                 return 0;
 166
 167         params = &wdev->conn->params;
 168
 169         switch (wdev->conn->state) {
 170         case CFG80211_CONN_SCAN_AGAIN:
 171                 return cfg80211_conn_scan(wdev);
 172         case CFG80211_CONN_AUTHENTICATE_NEXT:
 173                 BUG_ON(!rdev->ops->auth);
 174                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
 175                 return __cfg80211_mlme_auth(rdev, wdev->netdev,
 176                                             params->channel, params->auth_type,
 177                                             params->bssid,
 178                                             params->ssid, params->ssid_len,
 179                                             NULL, 0,
 180                                             params->key, params->key_len,
 181                                             params->key_idx, false);
 182         case CFG80211_CONN_ASSOCIATE_NEXT:
 183                 BUG_ON(!rdev->ops->assoc);
 184                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
 185                 if (wdev->conn->prev_bssid_valid)
 186                         prev_bssid = wdev->conn->prev_bssid;
 187                 err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
 188                                             params->channel, params->bssid,
 189                                             prev_bssid,
 190                                             params->ssid, params->ssid_len,
 191                                             params->ie, params->ie_len,
 192                                             false, &params->crypto);
 193                 if (err)
 194                         __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 195                                                NULL, 0,
 196                                                WLAN_REASON_DEAUTH_LEAVING,
 197                                                false);
 198                 return err;
 199         case CFG80211_CONN_DEAUTH_ASSOC_FAIL:
 200                 __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 201                                        NULL, 0,
 202                                        WLAN_REASON_DEAUTH_LEAVING, false);
 203                 /* return an error so that we call __cfg80211_connect_result() */
 204                 return -EINVAL;
 205         default:
 206                 return 0;
 207         }
 208 }
 209
 210 void cfg80211_conn_work(struct work_struct *work)
 211 {
 212         struct cfg80211_registered_device *rdev =
 213                 container_of(work, struct cfg80211_registered_device, conn_work);
 214         struct wireless_dev *wdev;
 215         u8 bssid_buf[ETH_ALEN], *bssid = NULL;
 216
 217         rtnl_lock();
 218         cfg80211_lock_rdev(rdev);
 219         mutex_lock(&rdev->devlist_mtx);
 220
 221         list_for_each_entry(wdev, &rdev->netdev_list, list) {
 222                 wdev_lock(wdev);
 223                 if (!netif_running(wdev->netdev)) {
 224                         wdev_unlock(wdev);
 225                         continue;
 226                 }
 227                 if (wdev->sme_state != CFG80211_SME_CONNECTING) {
 228                         wdev_unlock(wdev);
 229                         continue;
 230                 }
 231                 if (wdev->conn->params.bssid) {
 232                         memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
 233                         bssid = bssid_buf;
 234                 }
 235                 if (cfg80211_conn_do_work(wdev))
 236                         __cfg80211_connect_result(
 237                                         wdev->netdev, bssid,
 238                                         NULL, 0, NULL, 0,
 239                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
 240                                         false, NULL);
 241                 wdev_unlock(wdev);
 242         }
 243
 244         mutex_unlock(&rdev->devlist_mtx);
 245         cfg80211_unlock_rdev(rdev);
 246         rtnl_unlock();
 247 }
 248
 249 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 250 {
 251         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 252         struct cfg80211_bss *bss;
 253         u16 capa = WLAN_CAPABILITY_ESS;
 254
 255         ASSERT_WDEV_LOCK(wdev);
 256
 257         if (wdev->conn->params.privacy)
 258                 capa |= WLAN_CAPABILITY_PRIVACY;
 259
 260         bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
 261                                wdev->conn->params.bssid,
 262                                wdev->conn->params.ssid,
 263                                wdev->conn->params.ssid_len,
 264                                WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
 265                                capa);
 266         if (!bss)
 267                 return NULL;
 268
 269         memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
 270         wdev->conn->params.bssid = wdev->conn->bssid;
 271         wdev->conn->params.channel = bss->channel;
 272         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
 273         schedule_work(&rdev->conn_work);
 274
 275         return bss;
 276 }
 277
 278 static void __cfg80211_sme_scan_done(struct net_device *dev)
 279 {
 280         struct wireless_dev *wdev = dev->ieee80211_ptr;
 281         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 282         struct cfg80211_bss *bss;
 283
 284         ASSERT_WDEV_LOCK(wdev);
 285
 286         if (wdev->sme_state != CFG80211_SME_CONNECTING)
 287                 return;
 288
 289         if (!wdev->conn)
 290                 return;
 291
 292         if (wdev->conn->state != CFG80211_CONN_SCANNING &&
 293             wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
 294                 return;
 295
 296         bss = cfg80211_get_conn_bss(wdev);
 297         if (bss) {
 298                 cfg80211_put_bss(bss);
 299         } else {
 300                 /* not found */
 301                 if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
 302                         schedule_work(&rdev->conn_work);
 303                 else
 304                         __cfg80211_connect_result(
 305                                         wdev->netdev,
 306                                         wdev->conn->params.bssid,
 307                                         NULL, 0, NULL, 0,
 308                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
 309                                         false, NULL);
 310         }
 311 }
 312
 313 void cfg80211_sme_scan_done(struct net_device *dev)
 314 {
 315         struct wireless_dev *wdev = dev->ieee80211_ptr;
 316
 317         mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 318         wdev_lock(wdev);
 319         __cfg80211_sme_scan_done(dev);
 320         wdev_unlock(wdev);
 321         mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 322 }
 323
 324 void cfg80211_sme_rx_auth(struct net_device *dev,
 325                           const u8 *buf, size_t len)
 326 {
 327         struct wireless_dev *wdev = dev->ieee80211_ptr;
 328         struct wiphy *wiphy = wdev->wiphy;
 329         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 330         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 331         u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
 332
 333         ASSERT_WDEV_LOCK(wdev);
 334
 335         /* should only RX auth frames when connecting */
 336         if (wdev->sme_state != CFG80211_SME_CONNECTING)
 337                 return;
 338
 339         if (WARN_ON(!wdev->conn))
 340                 return;
 341
 342         if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
 343             wdev->conn->auto_auth &&
 344             wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
 345                 /* select automatically between only open, shared, leap */
 346                 switch (wdev->conn->params.auth_type) {
 347                 case NL80211_AUTHTYPE_OPEN_SYSTEM:
 348                         if (wdev->connect_keys)
 349                                 wdev->conn->params.auth_type =
 350                                         NL80211_AUTHTYPE_SHARED_KEY;
 351                         else
 352                                 wdev->conn->params.auth_type =
 353                                         NL80211_AUTHTYPE_NETWORK_EAP;
 354                         break;
 355                 case NL80211_AUTHTYPE_SHARED_KEY:
 356                         wdev->conn->params.auth_type =
 357                                 NL80211_AUTHTYPE_NETWORK_EAP;
 358                         break;
 359                 default:
 360                         /* huh? */
 361                         wdev->conn->params.auth_type =
 362                                 NL80211_AUTHTYPE_OPEN_SYSTEM;
 363                         break;
 364                 }
 365                 wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
 366                 schedule_work(&rdev->conn_work);
 367         } else if (status_code != WLAN_STATUS_SUCCESS) {
 368                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 369                                           status_code, false, NULL);
 370         } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
 371                  wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
 372                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
 373                 schedule_work(&rdev->conn_work);
 374         }
 375 }
 376
 377 bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
 378 {
 379         struct wiphy *wiphy = wdev->wiphy;
 380         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 381
 382         if (WARN_ON(!wdev->conn))
 383                 return false;
 384
 385         if (!wdev->conn->prev_bssid_valid)
 386                 return false;
 387
 388         /*
 389          * Some stupid APs don't accept reassoc, so we
 390          * need to fall back to trying regular assoc.
 391          */
 392         wdev->conn->prev_bssid_valid = false;
 393         wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
 394         schedule_work(&rdev->conn_work);
 395
 396         return true;
 397 }
 398
 399 void cfg80211_sme_failed_assoc(struct wireless_dev *wdev)
 400 {
 401         struct wiphy *wiphy = wdev->wiphy;
 402         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 403
 404         wdev->conn->state = CFG80211_CONN_DEAUTH_ASSOC_FAIL;
 405         schedule_work(&rdev->conn_work);
 406 }
 407
 408 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 409                                const u8 *req_ie, size_t req_ie_len,
 410                                const u8 *resp_ie, size_t resp_ie_len,
 411                                u16 status, bool wextev,
 412                                struct cfg80211_bss *bss)
 413 {
 414         struct wireless_dev *wdev = dev->ieee80211_ptr;
 415         u8 *country_ie;
 416 #ifdef CONFIG_CFG80211_WEXT
 417         union iwreq_data wrqu;
 418 #endif
 419
 420         ASSERT_WDEV_LOCK(wdev);
 421
 422         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 423                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
 424                 return;
 425
 426         if (wdev->sme_state != CFG80211_SME_CONNECTING)
 427                 return;
 428
 429         nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
 430                                     bssid, req_ie, req_ie_len,
 431                                     resp_ie, resp_ie_len,
 432                                     status, GFP_KERNEL);
 433
 434 #ifdef CONFIG_CFG80211_WEXT
 435         if (wextev) {
 436                 if (req_ie && status == WLAN_STATUS_SUCCESS) {
 437                         memset(&wrqu, 0, sizeof(wrqu));
 438                         wrqu.data.length = req_ie_len;
 439                         wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, req_ie);
 440                 }
 441
 442                 if (resp_ie && status == WLAN_STATUS_SUCCESS) {
 443                         memset(&wrqu, 0, sizeof(wrqu));
 444                         wrqu.data.length = resp_ie_len;
 445                         wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, resp_ie);
 446                 }
 447
 448                 memset(&wrqu, 0, sizeof(wrqu));
 449                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 450                 if (bssid && status == WLAN_STATUS_SUCCESS) {
 451                         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
 452                         memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
 453                         wdev->wext.prev_bssid_valid = true;
 454                 }
 455                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 456         }
 457 #endif
 458
 459         if (wdev->current_bss) {
 460                 cfg80211_unhold_bss(wdev->current_bss);
 461                 cfg80211_put_bss(&wdev->current_bss->pub);
 462                 wdev->current_bss = NULL;
 463         }
 464
 465         if (wdev->conn)
 466                 wdev->conn->state = CFG80211_CONN_IDLE;
 467
 468         if (status != WLAN_STATUS_SUCCESS) {
 469                 wdev->sme_state = CFG80211_SME_IDLE;
 470                 if (wdev->conn)
 471                         kfree(wdev->conn->ie);
 472                 kfree(wdev->conn);
 473                 wdev->conn = NULL;
 474                 kfree(wdev->connect_keys);
 475                 wdev->connect_keys = NULL;
 476                 wdev->ssid_len = 0;
 477                 return;
 478         }
 479
 480         if (!bss)
 481                 bss = cfg80211_get_bss(wdev->wiphy,
 482                                        wdev->conn ? wdev->conn->params.channel :
 483                                        NULL,
 484                                        bssid,
 485                                        wdev->ssid, wdev->ssid_len,
 486                                        WLAN_CAPABILITY_ESS,
 487                                        WLAN_CAPABILITY_ESS);
 488
 489         if (WARN_ON(!bss))
 490                 return;
 491
 492         cfg80211_hold_bss(bss_from_pub(bss));
 493         wdev->current_bss = bss_from_pub(bss);
 494
 495         wdev->sme_state = CFG80211_SME_CONNECTED;
 496         cfg80211_upload_connect_keys(wdev);
 497
 498         country_ie = (u8 *) ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
 499
 500         if (!country_ie)
 501                 return;
 502
 503         /*
 504          * ieee80211_bss_get_ie() ensures we can access:
 505          * - country_ie + 2, the start of the country ie data, and
 506          * - and country_ie[1] which is the IE length
 507          */
 508         regulatory_hint_11d(wdev->wiphy,
 509                             bss->channel->band,
 510                             country_ie + 2,
 511                             country_ie[1]);
 512 }
 513
 514 void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 515                              const u8 *req_ie, size_t req_ie_len,
 516                              const u8 *resp_ie, size_t resp_ie_len,
 517                              u16 status, gfp_t gfp)
 518 {
 519         struct wireless_dev *wdev = dev->ieee80211_ptr;
 520         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 521         struct cfg80211_event *ev;
 522         unsigned long flags;
 523
 524         CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
 525
 526         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
 527         if (!ev)
 528                 return;
 529
 530         ev->type = EVENT_CONNECT_RESULT;
 531         if (bssid)
 532                 memcpy(ev->cr.bssid, bssid, ETH_ALEN);
 533         if (req_ie_len) {
 534                 ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
 535                 ev->cr.req_ie_len = req_ie_len;
 536                 memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
 537         }
 538         if (resp_ie_len) {
 539                 ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
 540                 ev->cr.resp_ie_len = resp_ie_len;
 541                 memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
 542         }
 543         ev->cr.status = status;
 544
 545         spin_lock_irqsave(&wdev->event_lock, flags);
 546         list_add_tail(&ev->list, &wdev->event_list);
 547         spin_unlock_irqrestore(&wdev->event_lock, flags);
 548         queue_work(cfg80211_wq, &rdev->event_work);
 549 }
 550 EXPORT_SYMBOL(cfg80211_connect_result);
 551
 552 void __cfg80211_roamed(struct wireless_dev *wdev,
 553                        struct ieee80211_channel *channel,
 554                        const u8 *bssid,
 555                        const u8 *req_ie, size_t req_ie_len,
 556                        const u8 *resp_ie, size_t resp_ie_len)
 557 {
 558         struct cfg80211_bss *bss;
 559 #ifdef CONFIG_CFG80211_WEXT
 560         union iwreq_data wrqu;
 561 #endif
 562
 563         ASSERT_WDEV_LOCK(wdev);
 564
 565         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 566                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
 567                 return;
 568
 569         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 570                 return;
 571
 572         /* internal error -- how did we get to CONNECTED w/o BSS? */
 573         if (WARN_ON(!wdev->current_bss)) {
 574                 return;
 575         }
 576
 577         cfg80211_unhold_bss(wdev->current_bss);
 578         cfg80211_put_bss(&wdev->current_bss->pub);
 579         wdev->current_bss = NULL;
 580
 581         bss = cfg80211_get_bss(wdev->wiphy, channel, bssid,
 582                                wdev->ssid, wdev->ssid_len,
 583                                WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 584
 585         if (WARN_ON(!bss))
 586                 return;
 587
 588         cfg80211_hold_bss(bss_from_pub(bss));
 589         wdev->current_bss = bss_from_pub(bss);
 590
 591         nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), wdev->netdev, bssid,
 592                             req_ie, req_ie_len, resp_ie, resp_ie_len,
 593                             GFP_KERNEL);
 594
 595 #ifdef CONFIG_CFG80211_WEXT
 596         if (req_ie) {
 597                 memset(&wrqu, 0, sizeof(wrqu));
 598                 wrqu.data.length = req_ie_len;
 599                 wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
 600                                     &wrqu, req_ie);
 601         }
 602
 603         if (resp_ie) {
 604                 memset(&wrqu, 0, sizeof(wrqu));
 605                 wrqu.data.length = resp_ie_len;
 606                 wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
 607                                     &wrqu, resp_ie);
 608         }
 609
 610         memset(&wrqu, 0, sizeof(wrqu));
 611         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 612         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
 613         memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
 614         wdev->wext.prev_bssid_valid = true;
 615         wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
 616 #endif
 617 }
 618
 619 void cfg80211_roamed(struct net_device *dev,
 620                      struct ieee80211_channel *channel,
 621                      const u8 *bssid,
 622                      const u8 *req_ie, size_t req_ie_len,
 623                      const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
 624 {
 625         struct wireless_dev *wdev = dev->ieee80211_ptr;
 626         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 627         struct cfg80211_event *ev;
 628         unsigned long flags;
 629
 630         CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
 631
 632         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
 633         if (!ev)
 634                 return;
 635
 636         ev->type = EVENT_ROAMED;
 637         ev->rm.channel = channel;
 638         memcpy(ev->rm.bssid, bssid, ETH_ALEN);
 639         ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
 640         ev->rm.req_ie_len = req_ie_len;
 641         memcpy((void *)ev->rm.req_ie, req_ie, req_ie_len);
 642         ev->rm.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
 643         ev->rm.resp_ie_len = resp_ie_len;
 644         memcpy((void *)ev->rm.resp_ie, resp_ie, resp_ie_len);
 645
 646         spin_lock_irqsave(&wdev->event_lock, flags);
 647         list_add_tail(&ev->list, &wdev->event_list);
 648         spin_unlock_irqrestore(&wdev->event_lock, flags);
 649         queue_work(cfg80211_wq, &rdev->event_work);
 650 }
 651 EXPORT_SYMBOL(cfg80211_roamed);
 652
 653 void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 654                              size_t ie_len, u16 reason, bool from_ap)
 655 {
 656         struct wireless_dev *wdev = dev->ieee80211_ptr;
 657         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 658         int i;
 659 #ifdef CONFIG_CFG80211_WEXT
 660         union iwreq_data wrqu;
 661 #endif
 662
 663         ASSERT_WDEV_LOCK(wdev);
 664
 665         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 666                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
 667                 return;
 668
 669         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 670                 return;
 671
 672         if (wdev->current_bss) {
 673                 cfg80211_unhold_bss(wdev->current_bss);
 674                 cfg80211_put_bss(&wdev->current_bss->pub);
 675         }
 676
 677         wdev->current_bss = NULL;
 678         wdev->sme_state = CFG80211_SME_IDLE;
 679         wdev->ssid_len = 0;
 680
 681         if (wdev->conn) {
 682                 const u8 *bssid;
 683                 int ret;
 684
 685                 kfree(wdev->conn->ie);
 686                 wdev->conn->ie = NULL;
 687                 kfree(wdev->conn);
 688                 wdev->conn = NULL;
 689
 690                 /*
 691                  * If this disconnect was due to a disassoc, we
 692                  * we might still have an auth BSS around. For
 693                  * the userspace SME that's currently expected,
 694                  * but for the kernel SME (nl80211 CONNECT or
 695                  * wireless extensions) we want to clear up all
 696                  * state.
 697                  */
 698                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
 699                         if (!wdev->auth_bsses[i])
 700                                 continue;
 701                         bssid = wdev->auth_bsses[i]->pub.bssid;
 702                         ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 703                                                 WLAN_REASON_DEAUTH_LEAVING,
 704                                                 false);
 705                         WARN(ret, "deauth failed: %d\n", ret);
 706                 }
 707         }
 708
 709         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
 710
 711         /*
 712          * Delete all the keys ... pairwise keys can't really
 713          * exist any more anyway, but default keys might.
 714          */
 715         if (rdev->ops->del_key)
 716                 for (i = 0; i < 6; i++)
 717                         rdev->ops->del_key(wdev->wiphy, dev, i, false, NULL);
 718
 719 #ifdef CONFIG_CFG80211_WEXT
 720         memset(&wrqu, 0, sizeof(wrqu));
 721         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 722         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 723         wdev->wext.connect.ssid_len = 0;
 724 #endif
 725
 726         schedule_work(&cfg80211_disconnect_work);
 727 }
 728
 729 void cfg80211_disconnected(struct net_device *dev, u16 reason,
 730                            u8 *ie, size_t ie_len, gfp_t gfp)
 731 {
 732         struct wireless_dev *wdev = dev->ieee80211_ptr;
 733         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 734         struct cfg80211_event *ev;
 735         unsigned long flags;
 736
 737         CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
 738
 739         ev = kzalloc(sizeof(*ev) + ie_len, gfp);
 740         if (!ev)
 741                 return;
 742
 743         ev->type = EVENT_DISCONNECTED;
 744         ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
 745         ev->dc.ie_len = ie_len;
 746         memcpy((void *)ev->dc.ie, ie, ie_len);
 747         ev->dc.reason = reason;
 748
 749         spin_lock_irqsave(&wdev->event_lock, flags);
 750         list_add_tail(&ev->list, &wdev->event_list);
 751         spin_unlock_irqrestore(&wdev->event_lock, flags);
 752         queue_work(cfg80211_wq, &rdev->event_work);
 753 }
 754 EXPORT_SYMBOL(cfg80211_disconnected);
 755
 756 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
 757                        struct net_device *dev,
 758                        struct cfg80211_connect_params *connect,
 759                        struct cfg80211_cached_keys *connkeys,
 760                        const u8 *prev_bssid)
 761 {
 762         struct wireless_dev *wdev = dev->ieee80211_ptr;
 763         struct cfg80211_bss *bss = NULL;
 764         int err;
 765
 766         ASSERT_WDEV_LOCK(wdev);
 767
 768         if (wdev->sme_state != CFG80211_SME_IDLE)
 769                 return -EALREADY;
 770
 771         if (WARN_ON(wdev->connect_keys)) {
 772                 kfree(wdev->connect_keys);
 773                 wdev->connect_keys = NULL;
 774         }
 775
 776         if (connkeys && connkeys->def >= 0) {
 777                 int idx;
 778                 u32 cipher;
 779
 780                 idx = connkeys->def;
 781                 cipher = connkeys->params[idx].cipher;
 782                 /* If given a WEP key we may need it for shared key auth */
 783                 if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
 784                     cipher == WLAN_CIPHER_SUITE_WEP104) {
 785                         connect->key_idx = idx;
 786                         connect->key = connkeys->params[idx].key;
 787                         connect->key_len = connkeys->params[idx].key_len;
 788
 789                         /*
 790                          * If ciphers are not set (e.g. when going through
 791                          * iwconfig), we have to set them appropriately here.
 792                          */
 793                         if (connect->crypto.cipher_group == 0)
 794                                 connect->crypto.cipher_group = cipher;
 795
 796                         if (connect->crypto.n_ciphers_pairwise == 0) {
 797                                 connect->crypto.n_ciphers_pairwise = 1;
 798                                 connect->crypto.ciphers_pairwise[0] = cipher;
 799                         }
 800                 }
 801         }
 802
 803         if (!rdev->ops->connect) {
 804                 if (!rdev->ops->auth || !rdev->ops->assoc)
 805                         return -EOPNOTSUPP;
 806
 807                 if (WARN_ON(wdev->conn))
 808                         return -EINPROGRESS;
 809
 810                 wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
 811                 if (!wdev->conn)
 812                         return -ENOMEM;
 813
 814                 /*
 815                  * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
 816                  */
 817                 memcpy(&wdev->conn->params, connect, sizeof(*connect));
 818                 if (connect->bssid) {
 819                         wdev->conn->params.bssid = wdev->conn->bssid;
 820                         memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
 821                 }
 822
 823                 if (connect->ie) {
 824                         wdev->conn->ie = kmemdup(connect->ie, connect->ie_len,
 825                                                 GFP_KERNEL);
 826                         wdev->conn->params.ie = wdev->conn->ie;
 827                         if (!wdev->conn->ie) {
 828                                 kfree(wdev->conn);
 829                                 wdev->conn = NULL;
 830                                 return -ENOMEM;
 831                         }
 832                 }
 833
 834                 if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
 835                         wdev->conn->auto_auth = true;
 836                         /* start with open system ... should mostly work */
 837                         wdev->conn->params.auth_type =
 838                                 NL80211_AUTHTYPE_OPEN_SYSTEM;
 839                 } else {
 840                         wdev->conn->auto_auth = false;
 841                 }
 842
 843                 memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
 844                 wdev->ssid_len = connect->ssid_len;
 845                 wdev->conn->params.ssid = wdev->ssid;
 846                 wdev->conn->params.ssid_len = connect->ssid_len;
 847
 848                 /* see if we have the bss already */
 849                 bss = cfg80211_get_conn_bss(wdev);
 850
 851                 wdev->sme_state = CFG80211_SME_CONNECTING;
 852                 wdev->connect_keys = connkeys;
 853
 854                 if (prev_bssid) {
 855                         memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
 856                         wdev->conn->prev_bssid_valid = true;
 857                 }
 858
 859                 /* we're good if we have a matching bss struct */
 860                 if (bss) {
 861                         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
 862                         err = cfg80211_conn_do_work(wdev);
 863                         cfg80211_put_bss(bss);
 864                 } else {
 865                         /* otherwise we'll need to scan for the AP first */
 866                         err = cfg80211_conn_scan(wdev);
 867                         /*
 868                          * If we can't scan right now, then we need to scan again
 869                          * after the current scan finished, since the parameters
 870                          * changed (unless we find a good AP anyway).
 871                          */
 872                         if (err == -EBUSY) {
 873                                 err = 0;
 874                                 wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
 875                         }
 876                 }
 877                 if (err) {
 878                         kfree(wdev->conn->ie);
 879                         kfree(wdev->conn);
 880                         wdev->conn = NULL;
 881                         wdev->sme_state = CFG80211_SME_IDLE;
 882                         wdev->connect_keys = NULL;
 883                         wdev->ssid_len = 0;
 884                 }
 885
 886                 return err;
 887         } else {
 888                 wdev->sme_state = CFG80211_SME_CONNECTING;
 889                 wdev->connect_keys = connkeys;
 890                 err = rdev->ops->connect(&rdev->wiphy, dev, connect);
 891                 if (err) {
 892                         wdev->connect_keys = NULL;
 893                         wdev->sme_state = CFG80211_SME_IDLE;
 894                         return err;
 895                 }
 896
 897                 memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
 898                 wdev->ssid_len = connect->ssid_len;
 899
 900                 return 0;
 901         }
 902 }
 903
 904 int cfg80211_connect(struct cfg80211_registered_device *rdev,
 905                      struct net_device *dev,
 906                      struct cfg80211_connect_params *connect,
 907                      struct cfg80211_cached_keys *connkeys)
 908 {
 909         int err;
 910
 911         mutex_lock(&rdev->devlist_mtx);
 912         wdev_lock(dev->ieee80211_ptr);
 913         err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
 914         wdev_unlock(dev->ieee80211_ptr);
 915         mutex_unlock(&rdev->devlist_mtx);
 916
 917         return err;
 918 }
 919
 920 int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
 921                           struct net_device *dev, u16 reason, bool wextev)
 922 {
 923         struct wireless_dev *wdev = dev->ieee80211_ptr;
 924         int err;
 925
 926         ASSERT_WDEV_LOCK(wdev);
 927
 928         if (wdev->sme_state == CFG80211_SME_IDLE)
 929                 return -EINVAL;
 930
 931         kfree(wdev->connect_keys);
 932         wdev->connect_keys = NULL;
 933
 934         if (!rdev->ops->disconnect) {
 935                 if (!rdev->ops->deauth)
 936                         return -EOPNOTSUPP;
 937
 938                 /* was it connected by userspace SME? */
 939                 if (!wdev->conn) {
 940                         cfg80211_mlme_down(rdev, dev);
 941                         return 0;
 942                 }
 943
 944                 if (wdev->sme_state == CFG80211_SME_CONNECTING &&
 945                     (wdev->conn->state == CFG80211_CONN_SCANNING ||
 946                      wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
 947                         wdev->sme_state = CFG80211_SME_IDLE;
 948                         kfree(wdev->conn->ie);
 949                         kfree(wdev->conn);
 950                         wdev->conn = NULL;
 951                         wdev->ssid_len = 0;
 952                         return 0;
 953                 }
 954
 955                 /* wdev->conn->params.bssid must be set if > SCANNING */
 956                 err = __cfg80211_mlme_deauth(rdev, dev,
 957                                              wdev->conn->params.bssid,
 958                                              NULL, 0, reason, false);
 959                 if (err)
 960                         return err;
 961         } else {
 962                 err = rdev->ops->disconnect(&rdev->wiphy, dev, reason);
 963                 if (err)
 964                         return err;
 965         }
 966
 967         if (wdev->sme_state == CFG80211_SME_CONNECTED)
 968                 __cfg80211_disconnected(dev, NULL, 0, 0, false);
 969         else if (wdev->sme_state == CFG80211_SME_CONNECTING)
 970                 __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
 971                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 972                                           wextev, NULL);
 973
 974         return 0;
 975 }
 976
 977 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
 978                         struct net_device *dev,
 979                         u16 reason, bool wextev)
 980 {
 981         int err;
 982
 983         wdev_lock(dev->ieee80211_ptr);
 984         err = __cfg80211_disconnect(rdev, dev, reason, wextev);
 985         wdev_unlock(dev->ieee80211_ptr);
 986
 987         return err;
 988 }
 989
 990 void cfg80211_sme_disassoc(struct net_device *dev, int idx)
 991 {
 992         struct wireless_dev *wdev = dev->ieee80211_ptr;
 993         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
 994         u8 bssid[ETH_ALEN];
 995
 996         ASSERT_WDEV_LOCK(wdev);
 997
 998         if (!wdev->conn)
 999                 return;
1000
1001         if (wdev->conn->state == CFG80211_CONN_IDLE)
1002                 return;
1003
1004         /*
1005          * Ok, so the association was made by this SME -- we don't
1006          * want it any more so deauthenticate too.
1007          */
1008
1009         if (!wdev->auth_bsses[idx])
1010                 return;
1011
1012         memcpy(bssid, wdev->auth_bsses[idx]->pub.bssid, ETH_ALEN);
1013         if (__cfg80211_mlme_deauth(rdev, dev, bssid,
1014                                    NULL, 0, WLAN_REASON_DEAUTH_LEAVING,
1015                                    false)) {
1016                 /* whatever -- assume gone anyway */
1017                 cfg80211_unhold_bss(wdev->auth_bsses[idx]);
1018                 cfg80211_put_bss(&wdev->auth_bsses[idx]->pub);
1019                 wdev->auth_bsses[idx] = NULL;
1020         }
1021 }