net/wireless/mlme.c

   1 /*
   2  * cfg80211 MLME SAP interface
   3  *
   4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   5  */
   6
   7 #include <linux/kernel.h>
   8 #include <linux/module.h>
   9 #include <linux/netdevice.h>
  10 #include <linux/nl80211.h>
  11 #include <linux/slab.h>
  12 #include <linux/wireless.h>
  13 #include <net/cfg80211.h>
  14 #include <net/iw_handler.h>
  15 #include "core.h"
  16 #include "nl80211.h"
  17
  18 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
  19 {
  20         struct wireless_dev *wdev = dev->ieee80211_ptr;
  21         struct wiphy *wiphy = wdev->wiphy;
  22         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  23         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  24         u8 *bssid = mgmt->bssid;
  25         int i;
  26         u16 status = le16_to_cpu(mgmt->u.auth.status_code);
  27         bool done = false;
  28
  29         wdev_lock(wdev);
  30
  31         for (i = 0; i < MAX_AUTH_BSSES; i++) {
  32                 if (wdev->authtry_bsses[i] &&
  33                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
  34                                                         ETH_ALEN) == 0) {
  35                         if (status == WLAN_STATUS_SUCCESS) {
  36                                 wdev->auth_bsses[i] = wdev->authtry_bsses[i];
  37                         } else {
  38                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
  39                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
  40                         }
  41                         wdev->authtry_bsses[i] = NULL;
  42                         done = true;
  43                         break;
  44                 }
  45         }
  46
  47         if (done) {
  48                 nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
  49                 cfg80211_sme_rx_auth(dev, buf, len);
  50         }
  51
  52         wdev_unlock(wdev);
  53 }
  54 EXPORT_SYMBOL(cfg80211_send_rx_auth);
  55
  56 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
  57 {
  58         u16 status_code;
  59         struct wireless_dev *wdev = dev->ieee80211_ptr;
  60         struct wiphy *wiphy = wdev->wiphy;
  61         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  62         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  63         u8 *ie = mgmt->u.assoc_resp.variable;
  64         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  65         struct cfg80211_internal_bss *bss = NULL;
  66
  67         wdev_lock(wdev);
  68
  69         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  70
  71         /*
  72          * This is a bit of a hack, we don't notify userspace of
  73          * a (re-)association reply if we tried to send a reassoc
  74          * and got a reject -- we only try again with an assoc
  75          * frame instead of reassoc.
  76          */
  77         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
  78             cfg80211_sme_failed_reassoc(wdev))
  79                 goto out;
  80
  81         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
  82
  83         if (status_code == WLAN_STATUS_SUCCESS) {
  84                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
  85                         if (!wdev->auth_bsses[i])
  86                                 continue;
  87                         if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
  88                                    ETH_ALEN) == 0) {
  89                                 bss = wdev->auth_bsses[i];
  90                                 wdev->auth_bsses[i] = NULL;
  91                                 /* additional reference to drop hold */
  92                                 cfg80211_ref_bss(bss);
  93                                 break;
  94                         }
  95                 }
  96
  97                 /*
  98                  * We might be coming here because the driver reported
  99                  * a successful association at the same time as the
 100                  * user requested a deauth. In that case, we will have
 101                  * removed the BSS from the auth_bsses list due to the
 102                  * deauth request when the assoc response makes it. If
 103                  * the two code paths acquire the lock the other way
 104                  * around, that's just the standard situation of a
 105                  * deauth being requested while connected.
 106                  */
 107                 if (!bss)
 108                         goto out;
 109         } else if (wdev->conn) {
 110                 cfg80211_sme_failed_assoc(wdev);
 111                 /*
 112                  * do not call connect_result() now because the
 113                  * sme will schedule work that does it later.
 114                  */
 115                 goto out;
 116         }
 117
 118         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
 119                 /*
 120                  * This is for the userspace SME, the CONNECTING
 121                  * state will be changed to CONNECTED by
 122                  * __cfg80211_connect_result() below.
 123                  */
 124                 wdev->sme_state = CFG80211_SME_CONNECTING;
 125         }
 126
 127         /* this consumes one bss reference (unless bss is NULL) */
 128         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
 129                                   status_code,
 130                                   status_code == WLAN_STATUS_SUCCESS,
 131                                   bss ? &bss->pub : NULL);
 132         /* drop hold now, and also reference acquired above */
 133         if (bss) {
 134                 cfg80211_unhold_bss(bss);
 135                 cfg80211_put_bss(&bss->pub);
 136         }
 137
 138  out:
 139         wdev_unlock(wdev);
 140 }
 141 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 142
 143 void __cfg80211_send_deauth(struct net_device *dev,
 144                                    const u8 *buf, size_t len)
 145 {
 146         struct wireless_dev *wdev = dev->ieee80211_ptr;
 147         struct wiphy *wiphy = wdev->wiphy;
 148         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 149         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 150         const u8 *bssid = mgmt->bssid;
 151         int i;
 152         bool found = false;
 153
 154         ASSERT_WDEV_LOCK(wdev);
 155
 156         if (wdev->current_bss &&
 157             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 158                 cfg80211_unhold_bss(wdev->current_bss);
 159                 cfg80211_put_bss(&wdev->current_bss->pub);
 160                 wdev->current_bss = NULL;
 161                 found = true;
 162         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 163                 if (wdev->auth_bsses[i] &&
 164                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
 165                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
 166                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 167                         wdev->auth_bsses[i] = NULL;
 168                         found = true;
 169                         break;
 170                 }
 171                 if (wdev->authtry_bsses[i] &&
 172                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
 173                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 174                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 175                         wdev->authtry_bsses[i] = NULL;
 176                         found = true;
 177                         break;
 178                 }
 179         }
 180
 181         if (!found)
 182                 return;
 183
 184         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 185
 186         if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 187                 u16 reason_code;
 188                 bool from_ap;
 189
 190                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 191
 192                 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 193                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 194         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
 195                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 196                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 197                                           false, NULL);
 198         }
 199 }
 200 EXPORT_SYMBOL(__cfg80211_send_deauth);
 201
 202 void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 203 {
 204         struct wireless_dev *wdev = dev->ieee80211_ptr;
 205
 206         wdev_lock(wdev);
 207         __cfg80211_send_deauth(dev, buf, len);
 208         wdev_unlock(wdev);
 209 }
 210 EXPORT_SYMBOL(cfg80211_send_deauth);
 211
 212 void __cfg80211_send_disassoc(struct net_device *dev,
 213                                      const u8 *buf, size_t len)
 214 {
 215         struct wireless_dev *wdev = dev->ieee80211_ptr;
 216         struct wiphy *wiphy = wdev->wiphy;
 217         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 218         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 219         const u8 *bssid = mgmt->bssid;
 220         int i;
 221         u16 reason_code;
 222         bool from_ap;
 223         bool done = false;
 224
 225         ASSERT_WDEV_LOCK(wdev);
 226
 227         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
 228
 229         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 230                 return;
 231
 232         if (wdev->current_bss &&
 233             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 234                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
 235                         if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
 236                                 continue;
 237                         wdev->auth_bsses[i] = wdev->current_bss;
 238                         wdev->current_bss = NULL;
 239                         done = true;
 240                         cfg80211_sme_disassoc(dev, i);
 241                         break;
 242                 }
 243                 WARN_ON(!done);
 244         } else
 245                 WARN_ON(1);
 246
 247
 248         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 249
 250         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 251         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 252 }
 253 EXPORT_SYMBOL(__cfg80211_send_disassoc);
 254
 255 void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 256 {
 257         struct wireless_dev *wdev = dev->ieee80211_ptr;
 258
 259         wdev_lock(wdev);
 260         __cfg80211_send_disassoc(dev, buf, len);
 261         wdev_unlock(wdev);
 262 }
 263 EXPORT_SYMBOL(cfg80211_send_disassoc);
 264
 265 static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
 266 {
 267         int i;
 268         bool done = false;
 269
 270         ASSERT_WDEV_LOCK(wdev);
 271
 272         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 273                 if (wdev->authtry_bsses[i] &&
 274                     memcmp(wdev->authtry_bsses[i]->pub.bssid,
 275                            addr, ETH_ALEN) == 0) {
 276                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 277                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 278                         wdev->authtry_bsses[i] = NULL;
 279                         done = true;
 280                         break;
 281                 }
 282         }
 283
 284         WARN_ON(!done);
 285 }
 286
 287 void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
 288 {
 289         __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
 290 }
 291 EXPORT_SYMBOL(__cfg80211_auth_canceled);
 292
 293 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 294 {
 295         struct wireless_dev *wdev = dev->ieee80211_ptr;
 296         struct wiphy *wiphy = wdev->wiphy;
 297         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 298
 299         wdev_lock(wdev);
 300
 301         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 302         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 303                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 304                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 305                                           false, NULL);
 306
 307         __cfg80211_auth_remove(wdev, addr);
 308
 309         wdev_unlock(wdev);
 310 }
 311 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 312
 313 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 314 {
 315         struct wireless_dev *wdev = dev->ieee80211_ptr;
 316         struct wiphy *wiphy = wdev->wiphy;
 317         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 318         int i;
 319         bool done = false;
 320
 321         wdev_lock(wdev);
 322
 323         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 324         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 325                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 326                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 327                                           false, NULL);
 328
 329         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 330                 if (wdev->auth_bsses[i] &&
 331                     memcmp(wdev->auth_bsses[i]->pub.bssid,
 332                            addr, ETH_ALEN) == 0) {
 333                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
 334                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 335                         wdev->auth_bsses[i] = NULL;
 336                         done = true;
 337                         break;
 338                 }
 339         }
 340
 341         WARN_ON(!done);
 342
 343         wdev_unlock(wdev);
 344 }
 345 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 346
 347 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 348                                   enum nl80211_key_type key_type, int key_id,
 349                                   const u8 *tsc, gfp_t gfp)
 350 {
 351         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 352         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 353 #ifdef CONFIG_CFG80211_WEXT
 354         union iwreq_data wrqu;
 355         char *buf = kmalloc(128, gfp);
 356
 357         if (buf) {
 358                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 359                         "keyid=%d %scast addr=%pM)", key_id,
 360                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 361                         addr);
 362                 memset(&wrqu, 0, sizeof(wrqu));
 363                 wrqu.data.length = strlen(buf);
 364                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 365                 kfree(buf);
 366         }
 367 #endif
 368
 369         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 370 }
 371 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 372
 373 /* some MLME handling for userspace SME */
 374 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 375                          struct net_device *dev,
 376                          struct ieee80211_channel *chan,
 377                          enum nl80211_auth_type auth_type,
 378                          const u8 *bssid,
 379                          const u8 *ssid, int ssid_len,
 380                          const u8 *ie, int ie_len,
 381                          const u8 *key, int key_len, int key_idx,
 382                          bool local_state_change)
 383 {
 384         struct wireless_dev *wdev = dev->ieee80211_ptr;
 385         struct cfg80211_auth_request req;
 386         struct cfg80211_internal_bss *bss;
 387         int i, err, slot = -1, nfree = 0;
 388
 389         ASSERT_WDEV_LOCK(wdev);
 390
 391         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 392                 if (!key || !key_len || key_idx < 0 || key_idx > 4)
 393                         return -EINVAL;
 394
 395         if (wdev->current_bss &&
 396             memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
 397                 return -EALREADY;
 398
 399         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 400                 if (wdev->authtry_bsses[i] &&
 401                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
 402                                                 ETH_ALEN) == 0)
 403                         return -EALREADY;
 404                 if (wdev->auth_bsses[i] &&
 405                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
 406                                                 ETH_ALEN) == 0)
 407                         return -EALREADY;
 408         }
 409
 410         memset(&req, 0, sizeof(req));
 411
 412         req.local_state_change = local_state_change;
 413         req.ie = ie;
 414         req.ie_len = ie_len;
 415         req.auth_type = auth_type;
 416         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 417                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 418         req.key = key;
 419         req.key_len = key_len;
 420         req.key_idx = key_idx;
 421         if (!req.bss)
 422                 return -ENOENT;
 423
 424         bss = bss_from_pub(req.bss);
 425
 426         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 427                 if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
 428                         slot = i;
 429                         nfree++;
 430                 }
 431         }
 432
 433         /* we need one free slot for disassoc and one for this auth */
 434         if (nfree < 2) {
 435                 err = -ENOSPC;
 436                 goto out;
 437         }
 438
 439         if (local_state_change)
 440                 wdev->auth_bsses[slot] = bss;
 441         else
 442                 wdev->authtry_bsses[slot] = bss;
 443         cfg80211_hold_bss(bss);
 444
 445         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
 446         if (err) {
 447                 if (local_state_change)
 448                         wdev->auth_bsses[slot] = NULL;
 449                 else
 450                         wdev->authtry_bsses[slot] = NULL;
 451                 cfg80211_unhold_bss(bss);
 452         }
 453
 454  out:
 455         if (err)
 456                 cfg80211_put_bss(req.bss);
 457         return err;
 458 }
 459
 460 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 461                        struct net_device *dev, struct ieee80211_channel *chan,
 462                        enum nl80211_auth_type auth_type, const u8 *bssid,
 463                        const u8 *ssid, int ssid_len,
 464                        const u8 *ie, int ie_len,
 465                        const u8 *key, int key_len, int key_idx,
 466                        bool local_state_change)
 467 {
 468         int err;
 469
 470         wdev_lock(dev->ieee80211_ptr);
 471         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
 472                                    ssid, ssid_len, ie, ie_len,
 473                                    key, key_len, key_idx, local_state_change);
 474         wdev_unlock(dev->ieee80211_ptr);
 475
 476         return err;
 477 }
 478
 479 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 480                           struct net_device *dev,
 481                           struct ieee80211_channel *chan,
 482                           const u8 *bssid, const u8 *prev_bssid,
 483                           const u8 *ssid, int ssid_len,
 484                           const u8 *ie, int ie_len, bool use_mfp,
 485                           struct cfg80211_crypto_settings *crypt)
 486 {
 487         struct wireless_dev *wdev = dev->ieee80211_ptr;
 488         struct cfg80211_assoc_request req;
 489         struct cfg80211_internal_bss *bss;
 490         int i, err, slot = -1;
 491         bool was_connected = false;
 492
 493         ASSERT_WDEV_LOCK(wdev);
 494
 495         memset(&req, 0, sizeof(req));
 496
 497         if (wdev->current_bss && prev_bssid &&
 498             memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
 499                 /*
 500                  * Trying to reassociate: Allow this to proceed and let the old
 501                  * association to be dropped when the new one is completed.
 502                  */
 503                 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 504                         was_connected = true;
 505                         wdev->sme_state = CFG80211_SME_CONNECTING;
 506                 }
 507         } else if (wdev->current_bss)
 508                 return -EALREADY;
 509
 510         req.ie = ie;
 511         req.ie_len = ie_len;
 512         memcpy(&req.crypto, crypt, sizeof(req.crypto));
 513         req.use_mfp = use_mfp;
 514         req.prev_bssid = prev_bssid;
 515         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 516                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 517         if (!req.bss) {
 518                 if (was_connected)
 519                         wdev->sme_state = CFG80211_SME_CONNECTED;
 520                 return -ENOENT;
 521         }
 522
 523         bss = bss_from_pub(req.bss);
 524
 525         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 526                 if (bss == wdev->auth_bsses[i]) {
 527                         slot = i;
 528                         break;
 529                 }
 530         }
 531
 532         if (slot < 0) {
 533                 err = -ENOTCONN;
 534                 goto out;
 535         }
 536
 537         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
 538  out:
 539         if (err && was_connected)
 540                 wdev->sme_state = CFG80211_SME_CONNECTED;
 541         /* still a reference in wdev->auth_bsses[slot] */
 542         cfg80211_put_bss(req.bss);
 543         return err;
 544 }
 545
 546 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 547                         struct net_device *dev,
 548                         struct ieee80211_channel *chan,
 549                         const u8 *bssid, const u8 *prev_bssid,
 550                         const u8 *ssid, int ssid_len,
 551                         const u8 *ie, int ie_len, bool use_mfp,
 552                         struct cfg80211_crypto_settings *crypt)
 553 {
 554         struct wireless_dev *wdev = dev->ieee80211_ptr;
 555         int err;
 556
 557         wdev_lock(wdev);
 558         err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
 559                                     ssid, ssid_len, ie, ie_len, use_mfp, crypt);
 560         wdev_unlock(wdev);
 561
 562         return err;
 563 }
 564
 565 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 566                            struct net_device *dev, const u8 *bssid,
 567                            const u8 *ie, int ie_len, u16 reason,
 568                            bool local_state_change)
 569 {
 570         struct wireless_dev *wdev = dev->ieee80211_ptr;
 571         struct cfg80211_deauth_request req;
 572         int i;
 573
 574         ASSERT_WDEV_LOCK(wdev);
 575
 576         memset(&req, 0, sizeof(req));
 577         req.reason_code = reason;
 578         req.local_state_change = local_state_change;
 579         req.ie = ie;
 580         req.ie_len = ie_len;
 581         if (wdev->current_bss &&
 582             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 583                 req.bss = &wdev->current_bss->pub;
 584         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 585                 if (wdev->auth_bsses[i] &&
 586                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 587                         req.bss = &wdev->auth_bsses[i]->pub;
 588                         break;
 589                 }
 590                 if (wdev->authtry_bsses[i] &&
 591                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 592                         req.bss = &wdev->authtry_bsses[i]->pub;
 593                         break;
 594                 }
 595         }
 596
 597         if (!req.bss)
 598                 return -ENOTCONN;
 599
 600         return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 601 }
 602
 603 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 604                          struct net_device *dev, const u8 *bssid,
 605                          const u8 *ie, int ie_len, u16 reason,
 606                          bool local_state_change)
 607 {
 608         struct wireless_dev *wdev = dev->ieee80211_ptr;
 609         int err;
 610
 611         wdev_lock(wdev);
 612         err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
 613                                      local_state_change);
 614         wdev_unlock(wdev);
 615
 616         return err;
 617 }
 618
 619 static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 620                                     struct net_device *dev, const u8 *bssid,
 621                                     const u8 *ie, int ie_len, u16 reason,
 622                                     bool local_state_change)
 623 {
 624         struct wireless_dev *wdev = dev->ieee80211_ptr;
 625         struct cfg80211_disassoc_request req;
 626
 627         ASSERT_WDEV_LOCK(wdev);
 628
 629         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 630                 return -ENOTCONN;
 631
 632         if (WARN_ON(!wdev->current_bss))
 633                 return -ENOTCONN;
 634
 635         memset(&req, 0, sizeof(req));
 636         req.reason_code = reason;
 637         req.local_state_change = local_state_change;
 638         req.ie = ie;
 639         req.ie_len = ie_len;
 640         if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
 641                 req.bss = &wdev->current_bss->pub;
 642         else
 643                 return -ENOTCONN;
 644
 645         return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
 646 }
 647
 648 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 649                            struct net_device *dev, const u8 *bssid,
 650                            const u8 *ie, int ie_len, u16 reason,
 651                            bool local_state_change)
 652 {
 653         struct wireless_dev *wdev = dev->ieee80211_ptr;
 654         int err;
 655
 656         wdev_lock(wdev);
 657         err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
 658                                        local_state_change);
 659         wdev_unlock(wdev);
 660
 661         return err;
 662 }
 663
 664 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 665                         struct net_device *dev)
 666 {
 667         struct wireless_dev *wdev = dev->ieee80211_ptr;
 668         struct cfg80211_deauth_request req;
 669         int i;
 670
 671         ASSERT_WDEV_LOCK(wdev);
 672
 673         if (!rdev->ops->deauth)
 674                 return;
 675
 676         memset(&req, 0, sizeof(req));
 677         req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 678         req.ie = NULL;
 679         req.ie_len = 0;
 680
 681         if (wdev->current_bss) {
 682                 req.bss = &wdev->current_bss->pub;
 683                 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 684                 if (wdev->current_bss) {
 685                         cfg80211_unhold_bss(wdev->current_bss);
 686                         cfg80211_put_bss(&wdev->current_bss->pub);
 687                         wdev->current_bss = NULL;
 688                 }
 689         }
 690
 691         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 692                 if (wdev->auth_bsses[i]) {
 693                         req.bss = &wdev->auth_bsses[i]->pub;
 694                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 695                         if (wdev->auth_bsses[i]) {
 696                                 cfg80211_unhold_bss(wdev->auth_bsses[i]);
 697                                 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 698                                 wdev->auth_bsses[i] = NULL;
 699                         }
 700                 }
 701                 if (wdev->authtry_bsses[i]) {
 702                         req.bss = &wdev->authtry_bsses[i]->pub;
 703                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 704                         if (wdev->authtry_bsses[i]) {
 705                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 706                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 707                                 wdev->authtry_bsses[i] = NULL;
 708                         }
 709                 }
 710         }
 711 }
 712
 713 void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
 714                                struct ieee80211_channel *chan,
 715                                enum nl80211_channel_type channel_type,
 716                                unsigned int duration, gfp_t gfp)
 717 {
 718         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 719         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 720
 721         nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
 722                                        duration, gfp);
 723 }
 724 EXPORT_SYMBOL(cfg80211_ready_on_channel);
 725
 726 void cfg80211_remain_on_channel_expired(struct net_device *dev,
 727                                         u64 cookie,
 728                                         struct ieee80211_channel *chan,
 729                                         enum nl80211_channel_type channel_type,
 730                                         gfp_t gfp)
 731 {
 732         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 733         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 734
 735         nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
 736                                               channel_type, gfp);
 737 }
 738 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
 739
 740 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 741                       struct station_info *sinfo, gfp_t gfp)
 742 {
 743         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 744         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 745
 746         nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
 747 }
 748 EXPORT_SYMBOL(cfg80211_new_sta);
 749
 750 struct cfg80211_action_registration {
 751         struct list_head list;
 752
 753         u32 nlpid;
 754
 755         int match_len;
 756
 757         u8 match[];
 758 };
 759
 760 int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
 761                                   const u8 *match_data, int match_len)
 762 {
 763         struct cfg80211_action_registration *reg, *nreg;
 764         int err = 0;
 765
 766         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 767         if (!nreg)
 768                 return -ENOMEM;
 769
 770         spin_lock_bh(&wdev->action_registrations_lock);
 771
 772         list_for_each_entry(reg, &wdev->action_registrations, list) {
 773                 int mlen = min(match_len, reg->match_len);
 774
 775                 if (memcmp(reg->match, match_data, mlen) == 0) {
 776                         err = -EALREADY;
 777                         break;
 778                 }
 779         }
 780
 781         if (err) {
 782                 kfree(nreg);
 783                 goto out;
 784         }
 785
 786         memcpy(nreg->match, match_data, match_len);
 787         nreg->match_len = match_len;
 788         nreg->nlpid = snd_pid;
 789         list_add(&nreg->list, &wdev->action_registrations);
 790
 791  out:
 792         spin_unlock_bh(&wdev->action_registrations_lock);
 793         return err;
 794 }
 795
 796 void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid)
 797 {
 798         struct cfg80211_action_registration *reg, *tmp;
 799
 800         spin_lock_bh(&wdev->action_registrations_lock);
 801
 802         list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
 803                 if (reg->nlpid == nlpid) {
 804                         list_del(&reg->list);
 805                         kfree(reg);
 806                 }
 807         }
 808
 809         spin_unlock_bh(&wdev->action_registrations_lock);
 810 }
 811
 812 void cfg80211_mlme_purge_actions(struct wireless_dev *wdev)
 813 {
 814         struct cfg80211_action_registration *reg, *tmp;
 815
 816         spin_lock_bh(&wdev->action_registrations_lock);
 817
 818         list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
 819                 list_del(&reg->list);
 820                 kfree(reg);
 821         }
 822
 823         spin_unlock_bh(&wdev->action_registrations_lock);
 824 }
 825
 826 int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
 827                          struct net_device *dev,
 828                          struct ieee80211_channel *chan,
 829                          enum nl80211_channel_type channel_type,
 830                          bool channel_type_valid,
 831                          const u8 *buf, size_t len, u64 *cookie)
 832 {
 833         struct wireless_dev *wdev = dev->ieee80211_ptr;
 834         const struct ieee80211_mgmt *mgmt;
 835
 836         if (rdev->ops->action == NULL)
 837                 return -EOPNOTSUPP;
 838         if (len < 24 + 1)
 839                 return -EINVAL;
 840
 841         mgmt = (const struct ieee80211_mgmt *) buf;
 842         if (!ieee80211_is_action(mgmt->frame_control))
 843                 return -EINVAL;
 844         if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 845                 /* Verify that we are associated with the destination AP */
 846                 wdev_lock(wdev);
 847
 848                 if (!wdev->current_bss ||
 849                     memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
 850                            ETH_ALEN) != 0 ||
 851                     (wdev->iftype == NL80211_IFTYPE_STATION &&
 852                      memcmp(wdev->current_bss->pub.bssid, mgmt->da,
 853                             ETH_ALEN) != 0)) {
 854                         wdev_unlock(wdev);
 855                         return -ENOTCONN;
 856                 }
 857
 858                 wdev_unlock(wdev);
 859         }
 860
 861         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
 862                 return -EINVAL;
 863
 864         /* Transmit the Action frame as requested by user space */
 865         return rdev->ops->action(&rdev->wiphy, dev, chan, channel_type,
 866                                  channel_type_valid, buf, len, cookie);
 867 }
 868
 869 bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
 870                         size_t len, gfp_t gfp)
 871 {
 872         struct wireless_dev *wdev = dev->ieee80211_ptr;
 873         struct wiphy *wiphy = wdev->wiphy;
 874         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 875         struct cfg80211_action_registration *reg;
 876         const u8 *action_data;
 877         int action_data_len;
 878         bool result = false;
 879
 880         /* frame length - min size excluding category */
 881         action_data_len = len - (IEEE80211_MIN_ACTION_SIZE - 1);
 882
 883         /* action data starts with category */
 884         action_data = buf + IEEE80211_MIN_ACTION_SIZE - 1;
 885
 886         spin_lock_bh(&wdev->action_registrations_lock);
 887
 888         list_for_each_entry(reg, &wdev->action_registrations, list) {
 889                 if (reg->match_len > action_data_len)
 890                         continue;
 891
 892                 if (memcmp(reg->match, action_data, reg->match_len))
 893                         continue;
 894
 895                 /* found match! */
 896
 897                 /* Indicate the received Action frame to user space */
 898                 if (nl80211_send_action(rdev, dev, reg->nlpid, freq,
 899                                         buf, len, gfp))
 900                         continue;
 901
 902                 result = true;
 903                 break;
 904         }
 905
 906         spin_unlock_bh(&wdev->action_registrations_lock);
 907
 908         return result;
 909 }
 910 EXPORT_SYMBOL(cfg80211_rx_action);
 911
 912 void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
 913                                const u8 *buf, size_t len, bool ack, gfp_t gfp)
 914 {
 915         struct wireless_dev *wdev = dev->ieee80211_ptr;
 916         struct wiphy *wiphy = wdev->wiphy;
 917         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 918
 919         /* Indicate TX status of the Action frame to user space */
 920         nl80211_send_action_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
 921 }
 922 EXPORT_SYMBOL(cfg80211_action_tx_status);
 923
 924 void cfg80211_cqm_rssi_notify(struct net_device *dev,
 925                               enum nl80211_cqm_rssi_threshold_event rssi_event,
 926                               gfp_t gfp)
 927 {
 928         struct wireless_dev *wdev = dev->ieee80211_ptr;
 929         struct wiphy *wiphy = wdev->wiphy;
 930         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 931
 932         /* Indicate roaming trigger event to user space */
 933         nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
 934 }
 935 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);