xref: /openbmc/linux/net/wireless/sme.c (revision b96fc2f3)
1 /*
2  * SME code for cfg80211
3  * both driver SME event handling and the SME implementation
4  * (for nl80211's connect() and wext)
5  *
6  * Copyright 2009	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright (C) 2009   Intel Corporation. All rights reserved.
8  */
9 
10 #include <linux/etherdevice.h>
11 #include <linux/if_arp.h>
12 #include <linux/slab.h>
13 #include <linux/workqueue.h>
14 #include <linux/wireless.h>
15 #include <linux/export.h>
16 #include <net/iw_handler.h>
17 #include <net/cfg80211.h>
18 #include <net/rtnetlink.h>
19 #include "nl80211.h"
20 #include "reg.h"
21 #include "rdev-ops.h"
22 
23 /*
24  * Software SME in cfg80211, using auth/assoc/deauth calls to the
25  * driver. This is is for implementing nl80211's connect/disconnect
26  * and wireless extensions (if configured.)
27  */
28 
29 struct cfg80211_conn {
30 	struct cfg80211_connect_params params;
31 	/* these are sub-states of the _CONNECTING sme_state */
32 	enum {
33 		CFG80211_CONN_SCANNING,
34 		CFG80211_CONN_SCAN_AGAIN,
35 		CFG80211_CONN_AUTHENTICATE_NEXT,
36 		CFG80211_CONN_AUTHENTICATING,
37 		CFG80211_CONN_AUTH_FAILED,
38 		CFG80211_CONN_ASSOCIATE_NEXT,
39 		CFG80211_CONN_ASSOCIATING,
40 		CFG80211_CONN_ASSOC_FAILED,
41 		CFG80211_CONN_DEAUTH,
42 		CFG80211_CONN_CONNECTED,
43 	} state;
44 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
45 	const u8 *ie;
46 	size_t ie_len;
47 	bool auto_auth, prev_bssid_valid;
48 };
49 
50 static void cfg80211_sme_free(struct wireless_dev *wdev)
51 {
52 	if (!wdev->conn)
53 		return;
54 
55 	kfree(wdev->conn->ie);
56 	kfree(wdev->conn);
57 	wdev->conn = NULL;
58 }
59 
60 static int cfg80211_conn_scan(struct wireless_dev *wdev)
61 {
62 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
63 	struct cfg80211_scan_request *request;
64 	int n_channels, err;
65 
66 	ASSERT_RTNL();
67 	ASSERT_WDEV_LOCK(wdev);
68 
69 	if (rdev->scan_req || rdev->scan_msg)
70 		return -EBUSY;
71 
72 	if (wdev->conn->params.channel)
73 		n_channels = 1;
74 	else
75 		n_channels = ieee80211_get_num_supported_channels(wdev->wiphy);
76 
77 	request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
78 			  sizeof(request->channels[0]) * n_channels,
79 			  GFP_KERNEL);
80 	if (!request)
81 		return -ENOMEM;
82 
83 	if (wdev->conn->params.channel) {
84 		enum ieee80211_band band = wdev->conn->params.channel->band;
85 		struct ieee80211_supported_band *sband =
86 			wdev->wiphy->bands[band];
87 
88 		if (!sband) {
89 			kfree(request);
90 			return -EINVAL;
91 		}
92 		request->channels[0] = wdev->conn->params.channel;
93 		request->rates[band] = (1 << sband->n_bitrates) - 1;
94 	} else {
95 		int i = 0, j;
96 		enum ieee80211_band band;
97 		struct ieee80211_supported_band *bands;
98 		struct ieee80211_channel *channel;
99 
100 		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
101 			bands = wdev->wiphy->bands[band];
102 			if (!bands)
103 				continue;
104 			for (j = 0; j < bands->n_channels; j++) {
105 				channel = &bands->channels[j];
106 				if (channel->flags & IEEE80211_CHAN_DISABLED)
107 					continue;
108 				request->channels[i++] = channel;
109 			}
110 			request->rates[band] = (1 << bands->n_bitrates) - 1;
111 		}
112 		n_channels = i;
113 	}
114 	request->n_channels = n_channels;
115 	request->ssids = (void *)&request->channels[n_channels];
116 	request->n_ssids = 1;
117 
118 	memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
119 		wdev->conn->params.ssid_len);
120 	request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
121 
122 	request->wdev = wdev;
123 	request->wiphy = &rdev->wiphy;
124 	request->scan_start = jiffies;
125 
126 	rdev->scan_req = request;
127 
128 	err = rdev_scan(rdev, request);
129 	if (!err) {
130 		wdev->conn->state = CFG80211_CONN_SCANNING;
131 		nl80211_send_scan_start(rdev, wdev);
132 		dev_hold(wdev->netdev);
133 	} else {
134 		rdev->scan_req = NULL;
135 		kfree(request);
136 	}
137 	return err;
138 }
139 
140 static int cfg80211_conn_do_work(struct wireless_dev *wdev)
141 {
142 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
143 	struct cfg80211_connect_params *params;
144 	struct cfg80211_assoc_request req = {};
145 	int err;
146 
147 	ASSERT_WDEV_LOCK(wdev);
148 
149 	if (!wdev->conn)
150 		return 0;
151 
152 	params = &wdev->conn->params;
153 
154 	switch (wdev->conn->state) {
155 	case CFG80211_CONN_SCANNING:
156 		/* didn't find it during scan ... */
157 		return -ENOENT;
158 	case CFG80211_CONN_SCAN_AGAIN:
159 		return cfg80211_conn_scan(wdev);
160 	case CFG80211_CONN_AUTHENTICATE_NEXT:
161 		if (WARN_ON(!rdev->ops->auth))
162 			return -EOPNOTSUPP;
163 		wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
164 		return cfg80211_mlme_auth(rdev, wdev->netdev,
165 					  params->channel, params->auth_type,
166 					  params->bssid,
167 					  params->ssid, params->ssid_len,
168 					  NULL, 0,
169 					  params->key, params->key_len,
170 					  params->key_idx, NULL, 0);
171 	case CFG80211_CONN_AUTH_FAILED:
172 		return -ENOTCONN;
173 	case CFG80211_CONN_ASSOCIATE_NEXT:
174 		if (WARN_ON(!rdev->ops->assoc))
175 			return -EOPNOTSUPP;
176 		wdev->conn->state = CFG80211_CONN_ASSOCIATING;
177 		if (wdev->conn->prev_bssid_valid)
178 			req.prev_bssid = wdev->conn->prev_bssid;
179 		req.ie = params->ie;
180 		req.ie_len = params->ie_len;
181 		req.use_mfp = params->mfp != NL80211_MFP_NO;
182 		req.crypto = params->crypto;
183 		req.flags = params->flags;
184 		req.ht_capa = params->ht_capa;
185 		req.ht_capa_mask = params->ht_capa_mask;
186 		req.vht_capa = params->vht_capa;
187 		req.vht_capa_mask = params->vht_capa_mask;
188 
189 		err = cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
190 					  params->bssid, params->ssid,
191 					  params->ssid_len, &req);
192 		if (err)
193 			cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
194 					     NULL, 0,
195 					     WLAN_REASON_DEAUTH_LEAVING,
196 					     false);
197 		return err;
198 	case CFG80211_CONN_ASSOC_FAILED:
199 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
200 				     NULL, 0,
201 				     WLAN_REASON_DEAUTH_LEAVING, false);
202 		return -ENOTCONN;
203 	case CFG80211_CONN_DEAUTH:
204 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
205 				     NULL, 0,
206 				     WLAN_REASON_DEAUTH_LEAVING, false);
207 		/* free directly, disconnected event already sent */
208 		cfg80211_sme_free(wdev);
209 		return 0;
210 	default:
211 		return 0;
212 	}
213 }
214 
215 void cfg80211_conn_work(struct work_struct *work)
216 {
217 	struct cfg80211_registered_device *rdev =
218 		container_of(work, struct cfg80211_registered_device, conn_work);
219 	struct wireless_dev *wdev;
220 	u8 bssid_buf[ETH_ALEN], *bssid = NULL;
221 
222 	rtnl_lock();
223 
224 	list_for_each_entry(wdev, &rdev->wdev_list, list) {
225 		if (!wdev->netdev)
226 			continue;
227 
228 		wdev_lock(wdev);
229 		if (!netif_running(wdev->netdev)) {
230 			wdev_unlock(wdev);
231 			continue;
232 		}
233 		if (!wdev->conn ||
234 		    wdev->conn->state == CFG80211_CONN_CONNECTED) {
235 			wdev_unlock(wdev);
236 			continue;
237 		}
238 		if (wdev->conn->params.bssid) {
239 			memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
240 			bssid = bssid_buf;
241 		}
242 		if (cfg80211_conn_do_work(wdev)) {
243 			__cfg80211_connect_result(
244 					wdev->netdev, bssid,
245 					NULL, 0, NULL, 0,
246 					WLAN_STATUS_UNSPECIFIED_FAILURE,
247 					false, NULL);
248 		}
249 		wdev_unlock(wdev);
250 	}
251 
252 	rtnl_unlock();
253 }
254 
255 /* Returned bss is reference counted and must be cleaned up appropriately. */
256 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
257 {
258 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
259 	struct cfg80211_bss *bss;
260 
261 	ASSERT_WDEV_LOCK(wdev);
262 
263 	bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
264 			       wdev->conn->params.bssid,
265 			       wdev->conn->params.ssid,
266 			       wdev->conn->params.ssid_len,
267 			       IEEE80211_BSS_TYPE_ESS,
268 			       IEEE80211_PRIVACY(wdev->conn->params.privacy));
269 	if (!bss)
270 		return NULL;
271 
272 	memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
273 	wdev->conn->params.bssid = wdev->conn->bssid;
274 	wdev->conn->params.channel = bss->channel;
275 	wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
276 	schedule_work(&rdev->conn_work);
277 
278 	return bss;
279 }
280 
281 static void __cfg80211_sme_scan_done(struct net_device *dev)
282 {
283 	struct wireless_dev *wdev = dev->ieee80211_ptr;
284 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
285 	struct cfg80211_bss *bss;
286 
287 	ASSERT_WDEV_LOCK(wdev);
288 
289 	if (!wdev->conn)
290 		return;
291 
292 	if (wdev->conn->state != CFG80211_CONN_SCANNING &&
293 	    wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
294 		return;
295 
296 	bss = cfg80211_get_conn_bss(wdev);
297 	if (bss)
298 		cfg80211_put_bss(&rdev->wiphy, bss);
299 	else
300 		schedule_work(&rdev->conn_work);
301 }
302 
303 void cfg80211_sme_scan_done(struct net_device *dev)
304 {
305 	struct wireless_dev *wdev = dev->ieee80211_ptr;
306 
307 	wdev_lock(wdev);
308 	__cfg80211_sme_scan_done(dev);
309 	wdev_unlock(wdev);
310 }
311 
312 void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
313 {
314 	struct wiphy *wiphy = wdev->wiphy;
315 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
316 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
317 	u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
318 
319 	ASSERT_WDEV_LOCK(wdev);
320 
321 	if (!wdev->conn || wdev->conn->state == CFG80211_CONN_CONNECTED)
322 		return;
323 
324 	if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
325 	    wdev->conn->auto_auth &&
326 	    wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
327 		/* select automatically between only open, shared, leap */
328 		switch (wdev->conn->params.auth_type) {
329 		case NL80211_AUTHTYPE_OPEN_SYSTEM:
330 			if (wdev->connect_keys)
331 				wdev->conn->params.auth_type =
332 					NL80211_AUTHTYPE_SHARED_KEY;
333 			else
334 				wdev->conn->params.auth_type =
335 					NL80211_AUTHTYPE_NETWORK_EAP;
336 			break;
337 		case NL80211_AUTHTYPE_SHARED_KEY:
338 			wdev->conn->params.auth_type =
339 				NL80211_AUTHTYPE_NETWORK_EAP;
340 			break;
341 		default:
342 			/* huh? */
343 			wdev->conn->params.auth_type =
344 				NL80211_AUTHTYPE_OPEN_SYSTEM;
345 			break;
346 		}
347 		wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
348 		schedule_work(&rdev->conn_work);
349 	} else if (status_code != WLAN_STATUS_SUCCESS) {
350 		__cfg80211_connect_result(wdev->netdev, mgmt->bssid,
351 					  NULL, 0, NULL, 0,
352 					  status_code, false, NULL);
353 	} else if (wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
354 		wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
355 		schedule_work(&rdev->conn_work);
356 	}
357 }
358 
359 bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
360 {
361 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
362 
363 	if (!wdev->conn)
364 		return false;
365 
366 	if (status == WLAN_STATUS_SUCCESS) {
367 		wdev->conn->state = CFG80211_CONN_CONNECTED;
368 		return false;
369 	}
370 
371 	if (wdev->conn->prev_bssid_valid) {
372 		/*
373 		 * Some stupid APs don't accept reassoc, so we
374 		 * need to fall back to trying regular assoc;
375 		 * return true so no event is sent to userspace.
376 		 */
377 		wdev->conn->prev_bssid_valid = false;
378 		wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
379 		schedule_work(&rdev->conn_work);
380 		return true;
381 	}
382 
383 	wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
384 	schedule_work(&rdev->conn_work);
385 	return false;
386 }
387 
388 void cfg80211_sme_deauth(struct wireless_dev *wdev)
389 {
390 	cfg80211_sme_free(wdev);
391 }
392 
393 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
394 {
395 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
396 
397 	if (!wdev->conn)
398 		return;
399 
400 	wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
401 	schedule_work(&rdev->conn_work);
402 }
403 
404 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
405 {
406 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
407 
408 	if (!wdev->conn)
409 		return;
410 
411 	wdev->conn->state = CFG80211_CONN_DEAUTH;
412 	schedule_work(&rdev->conn_work);
413 }
414 
415 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
416 {
417 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
418 
419 	if (!wdev->conn)
420 		return;
421 
422 	wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
423 	schedule_work(&rdev->conn_work);
424 }
425 
426 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
427 				     const u8 *ies, size_t ies_len,
428 				     const u8 **out_ies, size_t *out_ies_len)
429 {
430 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
431 	u8 *buf;
432 	size_t offs;
433 
434 	if (!rdev->wiphy.extended_capabilities_len ||
435 	    (ies && cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY, ies, ies_len))) {
436 		*out_ies = kmemdup(ies, ies_len, GFP_KERNEL);
437 		if (!*out_ies)
438 			return -ENOMEM;
439 		*out_ies_len = ies_len;
440 		return 0;
441 	}
442 
443 	buf = kmalloc(ies_len + rdev->wiphy.extended_capabilities_len + 2,
444 		      GFP_KERNEL);
445 	if (!buf)
446 		return -ENOMEM;
447 
448 	if (ies_len) {
449 		static const u8 before_extcapa[] = {
450 			/* not listing IEs expected to be created by driver */
451 			WLAN_EID_RSN,
452 			WLAN_EID_QOS_CAPA,
453 			WLAN_EID_RRM_ENABLED_CAPABILITIES,
454 			WLAN_EID_MOBILITY_DOMAIN,
455 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
456 			WLAN_EID_BSS_COEX_2040,
457 		};
458 
459 		offs = ieee80211_ie_split(ies, ies_len, before_extcapa,
460 					  ARRAY_SIZE(before_extcapa), 0);
461 		memcpy(buf, ies, offs);
462 		/* leave a whole for extended capabilities IE */
463 		memcpy(buf + offs + rdev->wiphy.extended_capabilities_len + 2,
464 		       ies + offs, ies_len - offs);
465 	} else {
466 		offs = 0;
467 	}
468 
469 	/* place extended capabilities IE (with only driver capabilities) */
470 	buf[offs] = WLAN_EID_EXT_CAPABILITY;
471 	buf[offs + 1] = rdev->wiphy.extended_capabilities_len;
472 	memcpy(buf + offs + 2,
473 	       rdev->wiphy.extended_capabilities,
474 	       rdev->wiphy.extended_capabilities_len);
475 
476 	*out_ies = buf;
477 	*out_ies_len = ies_len + rdev->wiphy.extended_capabilities_len + 2;
478 
479 	return 0;
480 }
481 
482 static int cfg80211_sme_connect(struct wireless_dev *wdev,
483 				struct cfg80211_connect_params *connect,
484 				const u8 *prev_bssid)
485 {
486 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
487 	struct cfg80211_bss *bss;
488 	int err;
489 
490 	if (!rdev->ops->auth || !rdev->ops->assoc)
491 		return -EOPNOTSUPP;
492 
493 	if (wdev->current_bss)
494 		return -EALREADY;
495 
496 	if (WARN_ON(wdev->conn))
497 		return -EINPROGRESS;
498 
499 	wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
500 	if (!wdev->conn)
501 		return -ENOMEM;
502 
503 	/*
504 	 * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
505 	 */
506 	memcpy(&wdev->conn->params, connect, sizeof(*connect));
507 	if (connect->bssid) {
508 		wdev->conn->params.bssid = wdev->conn->bssid;
509 		memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
510 	}
511 
512 	if (cfg80211_sme_get_conn_ies(wdev, connect->ie, connect->ie_len,
513 				      &wdev->conn->ie,
514 				      &wdev->conn->params.ie_len)) {
515 		kfree(wdev->conn);
516 		wdev->conn = NULL;
517 		return -ENOMEM;
518 	}
519 	wdev->conn->params.ie = wdev->conn->ie;
520 
521 	if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
522 		wdev->conn->auto_auth = true;
523 		/* start with open system ... should mostly work */
524 		wdev->conn->params.auth_type =
525 			NL80211_AUTHTYPE_OPEN_SYSTEM;
526 	} else {
527 		wdev->conn->auto_auth = false;
528 	}
529 
530 	wdev->conn->params.ssid = wdev->ssid;
531 	wdev->conn->params.ssid_len = wdev->ssid_len;
532 
533 	/* see if we have the bss already */
534 	bss = cfg80211_get_conn_bss(wdev);
535 
536 	if (prev_bssid) {
537 		memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
538 		wdev->conn->prev_bssid_valid = true;
539 	}
540 
541 	/* we're good if we have a matching bss struct */
542 	if (bss) {
543 		err = cfg80211_conn_do_work(wdev);
544 		cfg80211_put_bss(wdev->wiphy, bss);
545 	} else {
546 		/* otherwise we'll need to scan for the AP first */
547 		err = cfg80211_conn_scan(wdev);
548 
549 		/*
550 		 * If we can't scan right now, then we need to scan again
551 		 * after the current scan finished, since the parameters
552 		 * changed (unless we find a good AP anyway).
553 		 */
554 		if (err == -EBUSY) {
555 			err = 0;
556 			wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
557 		}
558 	}
559 
560 	if (err)
561 		cfg80211_sme_free(wdev);
562 
563 	return err;
564 }
565 
566 static int cfg80211_sme_disconnect(struct wireless_dev *wdev, u16 reason)
567 {
568 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
569 	int err;
570 
571 	if (!wdev->conn)
572 		return 0;
573 
574 	if (!rdev->ops->deauth)
575 		return -EOPNOTSUPP;
576 
577 	if (wdev->conn->state == CFG80211_CONN_SCANNING ||
578 	    wdev->conn->state == CFG80211_CONN_SCAN_AGAIN) {
579 		err = 0;
580 		goto out;
581 	}
582 
583 	/* wdev->conn->params.bssid must be set if > SCANNING */
584 	err = cfg80211_mlme_deauth(rdev, wdev->netdev,
585 				   wdev->conn->params.bssid,
586 				   NULL, 0, reason, false);
587  out:
588 	cfg80211_sme_free(wdev);
589 	return err;
590 }
591 
592 /*
593  * code shared for in-device and software SME
594  */
595 
596 static bool cfg80211_is_all_idle(void)
597 {
598 	struct cfg80211_registered_device *rdev;
599 	struct wireless_dev *wdev;
600 	bool is_all_idle = true;
601 
602 	/*
603 	 * All devices must be idle as otherwise if you are actively
604 	 * scanning some new beacon hints could be learned and would
605 	 * count as new regulatory hints.
606 	 */
607 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
608 		list_for_each_entry(wdev, &rdev->wdev_list, list) {
609 			wdev_lock(wdev);
610 			if (wdev->conn || wdev->current_bss)
611 				is_all_idle = false;
612 			wdev_unlock(wdev);
613 		}
614 	}
615 
616 	return is_all_idle;
617 }
618 
619 static void disconnect_work(struct work_struct *work)
620 {
621 	rtnl_lock();
622 	if (cfg80211_is_all_idle())
623 		regulatory_hint_disconnect();
624 	rtnl_unlock();
625 }
626 
627 static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
628 
629 
630 /*
631  * API calls for drivers implementing connect/disconnect and
632  * SME event handling
633  */
634 
635 /* This method must consume bss one way or another */
636 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
637 			       const u8 *req_ie, size_t req_ie_len,
638 			       const u8 *resp_ie, size_t resp_ie_len,
639 			       u16 status, bool wextev,
640 			       struct cfg80211_bss *bss)
641 {
642 	struct wireless_dev *wdev = dev->ieee80211_ptr;
643 	const u8 *country_ie;
644 #ifdef CONFIG_CFG80211_WEXT
645 	union iwreq_data wrqu;
646 #endif
647 
648 	ASSERT_WDEV_LOCK(wdev);
649 
650 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
651 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
652 		cfg80211_put_bss(wdev->wiphy, bss);
653 		return;
654 	}
655 
656 	nl80211_send_connect_result(wiphy_to_rdev(wdev->wiphy), dev,
657 				    bssid, req_ie, req_ie_len,
658 				    resp_ie, resp_ie_len,
659 				    status, GFP_KERNEL);
660 
661 #ifdef CONFIG_CFG80211_WEXT
662 	if (wextev) {
663 		if (req_ie && status == WLAN_STATUS_SUCCESS) {
664 			memset(&wrqu, 0, sizeof(wrqu));
665 			wrqu.data.length = req_ie_len;
666 			wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, req_ie);
667 		}
668 
669 		if (resp_ie && status == WLAN_STATUS_SUCCESS) {
670 			memset(&wrqu, 0, sizeof(wrqu));
671 			wrqu.data.length = resp_ie_len;
672 			wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, resp_ie);
673 		}
674 
675 		memset(&wrqu, 0, sizeof(wrqu));
676 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
677 		if (bssid && status == WLAN_STATUS_SUCCESS) {
678 			memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
679 			memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
680 			wdev->wext.prev_bssid_valid = true;
681 		}
682 		wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
683 	}
684 #endif
685 
686 	if (!bss && (status == WLAN_STATUS_SUCCESS)) {
687 		WARN_ON_ONCE(!wiphy_to_rdev(wdev->wiphy)->ops->connect);
688 		bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
689 				       wdev->ssid, wdev->ssid_len,
690 				       IEEE80211_BSS_TYPE_ESS,
691 				       IEEE80211_PRIVACY_ANY);
692 		if (bss)
693 			cfg80211_hold_bss(bss_from_pub(bss));
694 	}
695 
696 	if (wdev->current_bss) {
697 		cfg80211_unhold_bss(wdev->current_bss);
698 		cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
699 		wdev->current_bss = NULL;
700 	}
701 
702 	if (status != WLAN_STATUS_SUCCESS) {
703 		kzfree(wdev->connect_keys);
704 		wdev->connect_keys = NULL;
705 		wdev->ssid_len = 0;
706 		if (bss) {
707 			cfg80211_unhold_bss(bss_from_pub(bss));
708 			cfg80211_put_bss(wdev->wiphy, bss);
709 		}
710 		cfg80211_sme_free(wdev);
711 		return;
712 	}
713 
714 	if (WARN_ON(!bss))
715 		return;
716 
717 	wdev->current_bss = bss_from_pub(bss);
718 
719 	cfg80211_upload_connect_keys(wdev);
720 
721 	rcu_read_lock();
722 	country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
723 	if (!country_ie) {
724 		rcu_read_unlock();
725 		return;
726 	}
727 
728 	country_ie = kmemdup(country_ie, 2 + country_ie[1], GFP_ATOMIC);
729 	rcu_read_unlock();
730 
731 	if (!country_ie)
732 		return;
733 
734 	/*
735 	 * ieee80211_bss_get_ie() ensures we can access:
736 	 * - country_ie + 2, the start of the country ie data, and
737 	 * - and country_ie[1] which is the IE length
738 	 */
739 	regulatory_hint_country_ie(wdev->wiphy, bss->channel->band,
740 				   country_ie + 2, country_ie[1]);
741 	kfree(country_ie);
742 }
743 
744 void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
745 			     const u8 *req_ie, size_t req_ie_len,
746 			     const u8 *resp_ie, size_t resp_ie_len,
747 			     u16 status, gfp_t gfp)
748 {
749 	struct wireless_dev *wdev = dev->ieee80211_ptr;
750 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
751 	struct cfg80211_event *ev;
752 	unsigned long flags;
753 
754 	ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
755 	if (!ev)
756 		return;
757 
758 	ev->type = EVENT_CONNECT_RESULT;
759 	if (bssid)
760 		memcpy(ev->cr.bssid, bssid, ETH_ALEN);
761 	if (req_ie_len) {
762 		ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
763 		ev->cr.req_ie_len = req_ie_len;
764 		memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
765 	}
766 	if (resp_ie_len) {
767 		ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
768 		ev->cr.resp_ie_len = resp_ie_len;
769 		memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
770 	}
771 	ev->cr.status = status;
772 
773 	spin_lock_irqsave(&wdev->event_lock, flags);
774 	list_add_tail(&ev->list, &wdev->event_list);
775 	spin_unlock_irqrestore(&wdev->event_lock, flags);
776 	queue_work(cfg80211_wq, &rdev->event_work);
777 }
778 EXPORT_SYMBOL(cfg80211_connect_result);
779 
780 /* Consumes bss object one way or another */
781 void __cfg80211_roamed(struct wireless_dev *wdev,
782 		       struct cfg80211_bss *bss,
783 		       const u8 *req_ie, size_t req_ie_len,
784 		       const u8 *resp_ie, size_t resp_ie_len)
785 {
786 #ifdef CONFIG_CFG80211_WEXT
787 	union iwreq_data wrqu;
788 #endif
789 	ASSERT_WDEV_LOCK(wdev);
790 
791 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
792 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
793 		goto out;
794 
795 	if (WARN_ON(!wdev->current_bss))
796 		goto out;
797 
798 	cfg80211_unhold_bss(wdev->current_bss);
799 	cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
800 	wdev->current_bss = NULL;
801 
802 	cfg80211_hold_bss(bss_from_pub(bss));
803 	wdev->current_bss = bss_from_pub(bss);
804 
805 	nl80211_send_roamed(wiphy_to_rdev(wdev->wiphy),
806 			    wdev->netdev, bss->bssid,
807 			    req_ie, req_ie_len, resp_ie, resp_ie_len,
808 			    GFP_KERNEL);
809 
810 #ifdef CONFIG_CFG80211_WEXT
811 	if (req_ie) {
812 		memset(&wrqu, 0, sizeof(wrqu));
813 		wrqu.data.length = req_ie_len;
814 		wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
815 				    &wrqu, req_ie);
816 	}
817 
818 	if (resp_ie) {
819 		memset(&wrqu, 0, sizeof(wrqu));
820 		wrqu.data.length = resp_ie_len;
821 		wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
822 				    &wrqu, resp_ie);
823 	}
824 
825 	memset(&wrqu, 0, sizeof(wrqu));
826 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
827 	memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
828 	memcpy(wdev->wext.prev_bssid, bss->bssid, ETH_ALEN);
829 	wdev->wext.prev_bssid_valid = true;
830 	wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
831 #endif
832 
833 	return;
834 out:
835 	cfg80211_put_bss(wdev->wiphy, bss);
836 }
837 
838 void cfg80211_roamed(struct net_device *dev,
839 		     struct ieee80211_channel *channel,
840 		     const u8 *bssid,
841 		     const u8 *req_ie, size_t req_ie_len,
842 		     const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
843 {
844 	struct wireless_dev *wdev = dev->ieee80211_ptr;
845 	struct cfg80211_bss *bss;
846 
847 	bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, wdev->ssid,
848 			       wdev->ssid_len,
849 			       IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
850 	if (WARN_ON(!bss))
851 		return;
852 
853 	cfg80211_roamed_bss(dev, bss, req_ie, req_ie_len, resp_ie,
854 			    resp_ie_len, gfp);
855 }
856 EXPORT_SYMBOL(cfg80211_roamed);
857 
858 /* Consumes bss object one way or another */
859 void cfg80211_roamed_bss(struct net_device *dev,
860 			 struct cfg80211_bss *bss, const u8 *req_ie,
861 			 size_t req_ie_len, const u8 *resp_ie,
862 			 size_t resp_ie_len, gfp_t gfp)
863 {
864 	struct wireless_dev *wdev = dev->ieee80211_ptr;
865 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
866 	struct cfg80211_event *ev;
867 	unsigned long flags;
868 
869 	if (WARN_ON(!bss))
870 		return;
871 
872 	ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
873 	if (!ev) {
874 		cfg80211_put_bss(wdev->wiphy, bss);
875 		return;
876 	}
877 
878 	ev->type = EVENT_ROAMED;
879 	ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
880 	ev->rm.req_ie_len = req_ie_len;
881 	memcpy((void *)ev->rm.req_ie, req_ie, req_ie_len);
882 	ev->rm.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
883 	ev->rm.resp_ie_len = resp_ie_len;
884 	memcpy((void *)ev->rm.resp_ie, resp_ie, resp_ie_len);
885 	ev->rm.bss = bss;
886 
887 	spin_lock_irqsave(&wdev->event_lock, flags);
888 	list_add_tail(&ev->list, &wdev->event_list);
889 	spin_unlock_irqrestore(&wdev->event_lock, flags);
890 	queue_work(cfg80211_wq, &rdev->event_work);
891 }
892 EXPORT_SYMBOL(cfg80211_roamed_bss);
893 
894 void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
895 			     size_t ie_len, u16 reason, bool from_ap)
896 {
897 	struct wireless_dev *wdev = dev->ieee80211_ptr;
898 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
899 	int i;
900 #ifdef CONFIG_CFG80211_WEXT
901 	union iwreq_data wrqu;
902 #endif
903 
904 	ASSERT_WDEV_LOCK(wdev);
905 
906 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
907 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
908 		return;
909 
910 	if (wdev->current_bss) {
911 		cfg80211_unhold_bss(wdev->current_bss);
912 		cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
913 	}
914 
915 	wdev->current_bss = NULL;
916 	wdev->ssid_len = 0;
917 
918 	nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
919 
920 	/*
921 	 * Delete all the keys ... pairwise keys can't really
922 	 * exist any more anyway, but default keys might.
923 	 */
924 	if (rdev->ops->del_key)
925 		for (i = 0; i < 6; i++)
926 			rdev_del_key(rdev, dev, i, false, NULL);
927 
928 	rdev_set_qos_map(rdev, dev, NULL);
929 
930 #ifdef CONFIG_CFG80211_WEXT
931 	memset(&wrqu, 0, sizeof(wrqu));
932 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
933 	wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
934 	wdev->wext.connect.ssid_len = 0;
935 #endif
936 
937 	schedule_work(&cfg80211_disconnect_work);
938 }
939 
940 void cfg80211_disconnected(struct net_device *dev, u16 reason,
941 			   const u8 *ie, size_t ie_len,
942 			   bool locally_generated, gfp_t gfp)
943 {
944 	struct wireless_dev *wdev = dev->ieee80211_ptr;
945 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
946 	struct cfg80211_event *ev;
947 	unsigned long flags;
948 
949 	ev = kzalloc(sizeof(*ev) + ie_len, gfp);
950 	if (!ev)
951 		return;
952 
953 	ev->type = EVENT_DISCONNECTED;
954 	ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
955 	ev->dc.ie_len = ie_len;
956 	memcpy((void *)ev->dc.ie, ie, ie_len);
957 	ev->dc.reason = reason;
958 	ev->dc.locally_generated = locally_generated;
959 
960 	spin_lock_irqsave(&wdev->event_lock, flags);
961 	list_add_tail(&ev->list, &wdev->event_list);
962 	spin_unlock_irqrestore(&wdev->event_lock, flags);
963 	queue_work(cfg80211_wq, &rdev->event_work);
964 }
965 EXPORT_SYMBOL(cfg80211_disconnected);
966 
967 /*
968  * API calls for nl80211/wext compatibility code
969  */
970 int cfg80211_connect(struct cfg80211_registered_device *rdev,
971 		     struct net_device *dev,
972 		     struct cfg80211_connect_params *connect,
973 		     struct cfg80211_cached_keys *connkeys,
974 		     const u8 *prev_bssid)
975 {
976 	struct wireless_dev *wdev = dev->ieee80211_ptr;
977 	int err;
978 
979 	ASSERT_WDEV_LOCK(wdev);
980 
981 	if (WARN_ON(wdev->connect_keys)) {
982 		kzfree(wdev->connect_keys);
983 		wdev->connect_keys = NULL;
984 	}
985 
986 	cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
987 				  rdev->wiphy.ht_capa_mod_mask);
988 
989 	if (connkeys && connkeys->def >= 0) {
990 		int idx;
991 		u32 cipher;
992 
993 		idx = connkeys->def;
994 		cipher = connkeys->params[idx].cipher;
995 		/* If given a WEP key we may need it for shared key auth */
996 		if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
997 		    cipher == WLAN_CIPHER_SUITE_WEP104) {
998 			connect->key_idx = idx;
999 			connect->key = connkeys->params[idx].key;
1000 			connect->key_len = connkeys->params[idx].key_len;
1001 
1002 			/*
1003 			 * If ciphers are not set (e.g. when going through
1004 			 * iwconfig), we have to set them appropriately here.
1005 			 */
1006 			if (connect->crypto.cipher_group == 0)
1007 				connect->crypto.cipher_group = cipher;
1008 
1009 			if (connect->crypto.n_ciphers_pairwise == 0) {
1010 				connect->crypto.n_ciphers_pairwise = 1;
1011 				connect->crypto.ciphers_pairwise[0] = cipher;
1012 			}
1013 		}
1014 	}
1015 
1016 	wdev->connect_keys = connkeys;
1017 	memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
1018 	wdev->ssid_len = connect->ssid_len;
1019 
1020 	if (!rdev->ops->connect)
1021 		err = cfg80211_sme_connect(wdev, connect, prev_bssid);
1022 	else
1023 		err = rdev_connect(rdev, dev, connect);
1024 
1025 	if (err) {
1026 		wdev->connect_keys = NULL;
1027 		wdev->ssid_len = 0;
1028 		return err;
1029 	}
1030 
1031 	return 0;
1032 }
1033 
1034 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
1035 			struct net_device *dev, u16 reason, bool wextev)
1036 {
1037 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1038 	int err = 0;
1039 
1040 	ASSERT_WDEV_LOCK(wdev);
1041 
1042 	kzfree(wdev->connect_keys);
1043 	wdev->connect_keys = NULL;
1044 
1045 	if (wdev->conn)
1046 		err = cfg80211_sme_disconnect(wdev, reason);
1047 	else if (!rdev->ops->disconnect)
1048 		cfg80211_mlme_down(rdev, dev);
1049 	else if (wdev->current_bss)
1050 		err = rdev_disconnect(rdev, dev, reason);
1051 
1052 	return err;
1053 }
1054