net/wireless/sme.c

   1 /*
   2  * SME code for cfg80211
   3  * both driver SME event handling and the SME implementation
   4  * (for nl80211's connect() and wext)
   5  *
   6  * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (C) 2009   Intel Corporation. All rights reserved.
   8  */
   9
  10 #include <linux/etherdevice.h>
  11 #include <linux/if_arp.h>
  12 #include <linux/slab.h>
  13 #include <linux/workqueue.h>
  14 #include <linux/wireless.h>
  15 #include <linux/export.h>
  16 #include <net/iw_handler.h>
  17 #include <net/cfg80211.h>
  18 #include <net/rtnetlink.h>
  19 #include "nl80211.h"
  20 #include "reg.h"
  21 #include "rdev-ops.h"
  22
  23 /*
  24  * Software SME in cfg80211, using auth/assoc/deauth calls to the
  25  * driver. This is is for implementing nl80211's connect/disconnect
  26  * and wireless extensions (if configured.)
  27  */
  28
  29 struct cfg80211_conn {
  30         struct cfg80211_connect_params params;
  31         /* these are sub-states of the _CONNECTING sme_state */
  32         enum {
  33                 CFG80211_CONN_SCANNING,
  34                 CFG80211_CONN_SCAN_AGAIN,
  35                 CFG80211_CONN_AUTHENTICATE_NEXT,
  36                 CFG80211_CONN_AUTHENTICATING,
  37                 CFG80211_CONN_AUTH_FAILED,
  38                 CFG80211_CONN_ASSOCIATE_NEXT,
  39                 CFG80211_CONN_ASSOCIATING,
  40                 CFG80211_CONN_ASSOC_FAILED,
  41                 CFG80211_CONN_DEAUTH,
  42                 CFG80211_CONN_CONNECTED,
  43         } state;
  44         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
  45         const u8 *ie;
  46         size_t ie_len;
  47         bool auto_auth, prev_bssid_valid;
  48 };
  49
  50 static void cfg80211_sme_free(struct wireless_dev *wdev)
  51 {
  52         if (!wdev->conn)
  53                 return;
  54
  55         kfree(wdev->conn->ie);
  56         kfree(wdev->conn);
  57         wdev->conn = NULL;
  58 }
  59
  60 static int cfg80211_conn_scan(struct wireless_dev *wdev)
  61 {
  62         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  63         struct cfg80211_scan_request *request;
  64         int n_channels, err;
  65
  66         ASSERT_RTNL();
  67         ASSERT_WDEV_LOCK(wdev);
  68
  69         if (rdev->scan_req || rdev->scan_msg)
  70                 return -EBUSY;
  71
  72         if (wdev->conn->params.channel)
  73                 n_channels = 1;
  74         else
  75                 n_channels = ieee80211_get_num_supported_channels(wdev->wiphy);
  76
  77         request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
  78                           sizeof(request->channels[0]) * n_channels,
  79                           GFP_KERNEL);
  80         if (!request)
  81                 return -ENOMEM;
  82
  83         if (wdev->conn->params.channel) {
  84                 enum ieee80211_band band = wdev->conn->params.channel->band;
  85                 struct ieee80211_supported_band *sband =
  86                         wdev->wiphy->bands[band];
  87
  88                 if (!sband) {
  89                         kfree(request);
  90                         return -EINVAL;
  91                 }
  92                 request->channels[0] = wdev->conn->params.channel;
  93                 request->rates[band] = (1 << sband->n_bitrates) - 1;
  94         } else {
  95                 int i = 0, j;
  96                 enum ieee80211_band band;
  97                 struct ieee80211_supported_band *bands;
  98                 struct ieee80211_channel *channel;
  99
 100                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 101                         bands = wdev->wiphy->bands[band];
 102                         if (!bands)
 103                                 continue;
 104                         for (j = 0; j < bands->n_channels; j++) {
 105                                 channel = &bands->channels[j];
 106                                 if (channel->flags & IEEE80211_CHAN_DISABLED)
 107                                         continue;
 108                                 request->channels[i++] = channel;
 109                         }
 110                         request->rates[band] = (1 << bands->n_bitrates) - 1;
 111                 }
 112                 n_channels = i;
 113         }
 114         request->n_channels = n_channels;
 115         request->ssids = (void *)&request->channels[n_channels];
 116         request->n_ssids = 1;
 117
 118         memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
 119                 wdev->conn->params.ssid_len);
 120         request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
 121
 122         request->wdev = wdev;
 123         request->wiphy = &rdev->wiphy;
 124         request->scan_start = jiffies;
 125
 126         rdev->scan_req = request;
 127
 128         err = rdev_scan(rdev, request);
 129         if (!err) {
 130                 wdev->conn->state = CFG80211_CONN_SCANNING;
 131                 nl80211_send_scan_start(rdev, wdev);
 132                 dev_hold(wdev->netdev);
 133         } else {
 134                 rdev->scan_req = NULL;
 135                 kfree(request);
 136         }
 137         return err;
 138 }
 139
 140 static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 141 {
 142         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 143         struct cfg80211_connect_params *params;
 144         struct cfg80211_assoc_request req = {};
 145         int err;
 146
 147         ASSERT_WDEV_LOCK(wdev);
 148
 149         if (!wdev->conn)
 150                 return 0;
 151
 152         params = &wdev->conn->params;
 153
 154         switch (wdev->conn->state) {
 155         case CFG80211_CONN_SCANNING:
 156                 /* didn't find it during scan ... */
 157                 return -ENOENT;
 158         case CFG80211_CONN_SCAN_AGAIN:
 159                 return cfg80211_conn_scan(wdev);
 160         case CFG80211_CONN_AUTHENTICATE_NEXT:
 161                 if (WARN_ON(!rdev->ops->auth))
 162                         return -EOPNOTSUPP;
 163                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
 164                 return cfg80211_mlme_auth(rdev, wdev->netdev,
 165                                           params->channel, params->auth_type,
 166                                           params->bssid,
 167                                           params->ssid, params->ssid_len,
 168                                           NULL, 0,
 169                                           params->key, params->key_len,
 170                                           params->key_idx, NULL, 0);
 171         case CFG80211_CONN_AUTH_FAILED:
 172                 return -ENOTCONN;
 173         case CFG80211_CONN_ASSOCIATE_NEXT:
 174                 if (WARN_ON(!rdev->ops->assoc))
 175                         return -EOPNOTSUPP;
 176                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
 177                 if (wdev->conn->prev_bssid_valid)
 178                         req.prev_bssid = wdev->conn->prev_bssid;
 179                 req.ie = params->ie;
 180                 req.ie_len = params->ie_len;
 181                 req.use_mfp = params->mfp != NL80211_MFP_NO;
 182                 req.crypto = params->crypto;
 183                 req.flags = params->flags;
 184                 req.ht_capa = params->ht_capa;
 185                 req.ht_capa_mask = params->ht_capa_mask;
 186                 req.vht_capa = params->vht_capa;
 187                 req.vht_capa_mask = params->vht_capa_mask;
 188
 189                 err = cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
 190                                           params->bssid, params->ssid,
 191                                           params->ssid_len, &req);
 192                 if (err)
 193                         cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 194                                              NULL, 0,
 195                                              WLAN_REASON_DEAUTH_LEAVING,
 196                                              false);
 197                 return err;
 198         case CFG80211_CONN_ASSOC_FAILED:
 199                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 200                                      NULL, 0,
 201                                      WLAN_REASON_DEAUTH_LEAVING, false);
 202                 return -ENOTCONN;
 203         case CFG80211_CONN_DEAUTH:
 204                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 205                                      NULL, 0,
 206                                      WLAN_REASON_DEAUTH_LEAVING, false);
 207                 /* free directly, disconnected event already sent */
 208                 cfg80211_sme_free(wdev);
 209                 return 0;
 210         default:
 211                 return 0;
 212         }
 213 }
 214
 215 void cfg80211_conn_work(struct work_struct *work)
 216 {
 217         struct cfg80211_registered_device *rdev =
 218                 container_of(work, struct cfg80211_registered_device, conn_work);
 219         struct wireless_dev *wdev;
 220         u8 bssid_buf[ETH_ALEN], *bssid = NULL;
 221
 222         rtnl_lock();
 223
 224         list_for_each_entry(wdev, &rdev->wdev_list, list) {
 225                 if (!wdev->netdev)
 226                         continue;
 227
 228                 wdev_lock(wdev);
 229                 if (!netif_running(wdev->netdev)) {
 230                         wdev_unlock(wdev);
 231                         continue;
 232                 }
 233                 if (!wdev->conn ||
 234                     wdev->conn->state == CFG80211_CONN_CONNECTED) {
 235                         wdev_unlock(wdev);
 236                         continue;
 237                 }
 238                 if (wdev->conn->params.bssid) {
 239                         memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
 240                         bssid = bssid_buf;
 241                 }
 242                 if (cfg80211_conn_do_work(wdev)) {
 243                         __cfg80211_connect_result(
 244                                         wdev->netdev, bssid,
 245                                         NULL, 0, NULL, 0,
 246                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
 247                                         false, NULL);
 248                 }
 249                 wdev_unlock(wdev);
 250         }
 251
 252         rtnl_unlock();
 253 }
 254
 255 /* Returned bss is reference counted and must be cleaned up appropriately. */
 256 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 257 {
 258         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 259         struct cfg80211_bss *bss;
 260
 261         ASSERT_WDEV_LOCK(wdev);
 262
 263         bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
 264                                wdev->conn->params.bssid,
 265                                wdev->conn->params.ssid,
 266                                wdev->conn->params.ssid_len,
 267                                wdev->conn_bss_type,
 268                                IEEE80211_PRIVACY(wdev->conn->params.privacy));
 269         if (!bss)
 270                 return NULL;
 271
 272         memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
 273         wdev->conn->params.bssid = wdev->conn->bssid;
 274         wdev->conn->params.channel = bss->channel;
 275         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
 276         schedule_work(&rdev->conn_work);
 277
 278         return bss;
 279 }
 280
 281 static void __cfg80211_sme_scan_done(struct net_device *dev)
 282 {
 283         struct wireless_dev *wdev = dev->ieee80211_ptr;
 284         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 285         struct cfg80211_bss *bss;
 286
 287         ASSERT_WDEV_LOCK(wdev);
 288
 289         if (!wdev->conn)
 290                 return;
 291
 292         if (wdev->conn->state != CFG80211_CONN_SCANNING &&
 293             wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
 294                 return;
 295
 296         bss = cfg80211_get_conn_bss(wdev);
 297         if (bss)
 298                 cfg80211_put_bss(&rdev->wiphy, bss);
 299         else
 300                 schedule_work(&rdev->conn_work);
 301 }
 302
 303 void cfg80211_sme_scan_done(struct net_device *dev)
 304 {
 305         struct wireless_dev *wdev = dev->ieee80211_ptr;
 306
 307         wdev_lock(wdev);
 308         __cfg80211_sme_scan_done(dev);
 309         wdev_unlock(wdev);
 310 }
 311
 312 void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
 313 {
 314         struct wiphy *wiphy = wdev->wiphy;
 315         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 316         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 317         u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
 318
 319         ASSERT_WDEV_LOCK(wdev);
 320
 321         if (!wdev->conn || wdev->conn->state == CFG80211_CONN_CONNECTED)
 322                 return;
 323
 324         if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
 325             wdev->conn->auto_auth &&
 326             wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
 327                 /* select automatically between only open, shared, leap */
 328                 switch (wdev->conn->params.auth_type) {
 329                 case NL80211_AUTHTYPE_OPEN_SYSTEM:
 330                         if (wdev->connect_keys)
 331                                 wdev->conn->params.auth_type =
 332                                         NL80211_AUTHTYPE_SHARED_KEY;
 333                         else
 334                                 wdev->conn->params.auth_type =
 335                                         NL80211_AUTHTYPE_NETWORK_EAP;
 336                         break;
 337                 case NL80211_AUTHTYPE_SHARED_KEY:
 338                         wdev->conn->params.auth_type =
 339                                 NL80211_AUTHTYPE_NETWORK_EAP;
 340                         break;
 341                 default:
 342                         /* huh? */
 343                         wdev->conn->params.auth_type =
 344                                 NL80211_AUTHTYPE_OPEN_SYSTEM;
 345                         break;
 346                 }
 347                 wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
 348                 schedule_work(&rdev->conn_work);
 349         } else if (status_code != WLAN_STATUS_SUCCESS) {
 350                 __cfg80211_connect_result(wdev->netdev, mgmt->bssid,
 351                                           NULL, 0, NULL, 0,
 352                                           status_code, false, NULL);
 353         } else if (wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
 354                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
 355                 schedule_work(&rdev->conn_work);
 356         }
 357 }
 358
 359 bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
 360 {
 361         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 362
 363         if (!wdev->conn)
 364                 return false;
 365
 366         if (status == WLAN_STATUS_SUCCESS) {
 367                 wdev->conn->state = CFG80211_CONN_CONNECTED;
 368                 return false;
 369         }
 370
 371         if (wdev->conn->prev_bssid_valid) {
 372                 /*
 373                  * Some stupid APs don't accept reassoc, so we
 374                  * need to fall back to trying regular assoc;
 375                  * return true so no event is sent to userspace.
 376                  */
 377                 wdev->conn->prev_bssid_valid = false;
 378                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
 379                 schedule_work(&rdev->conn_work);
 380                 return true;
 381         }
 382
 383         wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
 384         schedule_work(&rdev->conn_work);
 385         return false;
 386 }
 387
 388 void cfg80211_sme_deauth(struct wireless_dev *wdev)
 389 {
 390         cfg80211_sme_free(wdev);
 391 }
 392
 393 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 394 {
 395         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 396
 397         if (!wdev->conn)
 398                 return;
 399
 400         wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
 401         schedule_work(&rdev->conn_work);
 402 }
 403
 404 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 405 {
 406         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 407
 408         if (!wdev->conn)
 409                 return;
 410
 411         wdev->conn->state = CFG80211_CONN_DEAUTH;
 412         schedule_work(&rdev->conn_work);
 413 }
 414
 415 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 416 {
 417         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 418
 419         if (!wdev->conn)
 420                 return;
 421
 422         wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
 423         schedule_work(&rdev->conn_work);
 424 }
 425
 426 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
 427                                      const u8 *ies, size_t ies_len,
 428                                      const u8 **out_ies, size_t *out_ies_len)
 429 {
 430         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 431         u8 *buf;
 432         size_t offs;
 433
 434         if (!rdev->wiphy.extended_capabilities_len ||
 435             (ies && cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY, ies, ies_len))) {
 436                 *out_ies = kmemdup(ies, ies_len, GFP_KERNEL);
 437                 if (!*out_ies)
 438                         return -ENOMEM;
 439                 *out_ies_len = ies_len;
 440                 return 0;
 441         }
 442
 443         buf = kmalloc(ies_len + rdev->wiphy.extended_capabilities_len + 2,
 444                       GFP_KERNEL);
 445         if (!buf)
 446                 return -ENOMEM;
 447
 448         if (ies_len) {
 449                 static const u8 before_extcapa[] = {
 450                         /* not listing IEs expected to be created by driver */
 451                         WLAN_EID_RSN,
 452                         WLAN_EID_QOS_CAPA,
 453                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
 454                         WLAN_EID_MOBILITY_DOMAIN,
 455                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 456                         WLAN_EID_BSS_COEX_2040,
 457                 };
 458
 459                 offs = ieee80211_ie_split(ies, ies_len, before_extcapa,
 460                                           ARRAY_SIZE(before_extcapa), 0);
 461                 memcpy(buf, ies, offs);
 462                 /* leave a whole for extended capabilities IE */
 463                 memcpy(buf + offs + rdev->wiphy.extended_capabilities_len + 2,
 464                        ies + offs, ies_len - offs);
 465         } else {
 466                 offs = 0;
 467         }
 468
 469         /* place extended capabilities IE (with only driver capabilities) */
 470         buf[offs] = WLAN_EID_EXT_CAPABILITY;
 471         buf[offs + 1] = rdev->wiphy.extended_capabilities_len;
 472         memcpy(buf + offs + 2,
 473                rdev->wiphy.extended_capabilities,
 474                rdev->wiphy.extended_capabilities_len);
 475
 476         *out_ies = buf;
 477         *out_ies_len = ies_len + rdev->wiphy.extended_capabilities_len + 2;
 478
 479         return 0;
 480 }
 481
 482 static int cfg80211_sme_connect(struct wireless_dev *wdev,
 483                                 struct cfg80211_connect_params *connect,
 484                                 const u8 *prev_bssid)
 485 {
 486         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 487         struct cfg80211_bss *bss;
 488         int err;
 489
 490         if (!rdev->ops->auth || !rdev->ops->assoc)
 491                 return -EOPNOTSUPP;
 492
 493         if (wdev->current_bss)
 494                 return -EALREADY;
 495
 496         if (WARN_ON(wdev->conn))
 497                 return -EINPROGRESS;
 498
 499         wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
 500         if (!wdev->conn)
 501                 return -ENOMEM;
 502
 503         /*
 504          * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
 505          */
 506         memcpy(&wdev->conn->params, connect, sizeof(*connect));
 507         if (connect->bssid) {
 508                 wdev->conn->params.bssid = wdev->conn->bssid;
 509                 memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
 510         }
 511
 512         if (cfg80211_sme_get_conn_ies(wdev, connect->ie, connect->ie_len,
 513                                       &wdev->conn->ie,
 514                                       &wdev->conn->params.ie_len)) {
 515                 kfree(wdev->conn);
 516                 wdev->conn = NULL;
 517                 return -ENOMEM;
 518         }
 519         wdev->conn->params.ie = wdev->conn->ie;
 520
 521         if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
 522                 wdev->conn->auto_auth = true;
 523                 /* start with open system ... should mostly work */
 524                 wdev->conn->params.auth_type =
 525                         NL80211_AUTHTYPE_OPEN_SYSTEM;
 526         } else {
 527                 wdev->conn->auto_auth = false;
 528         }
 529
 530         wdev->conn->params.ssid = wdev->ssid;
 531         wdev->conn->params.ssid_len = wdev->ssid_len;
 532
 533         /* see if we have the bss already */
 534         bss = cfg80211_get_conn_bss(wdev);
 535
 536         if (prev_bssid) {
 537                 memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
 538                 wdev->conn->prev_bssid_valid = true;
 539         }
 540
 541         /* we're good if we have a matching bss struct */
 542         if (bss) {
 543                 err = cfg80211_conn_do_work(wdev);
 544                 cfg80211_put_bss(wdev->wiphy, bss);
 545         } else {
 546                 /* otherwise we'll need to scan for the AP first */
 547                 err = cfg80211_conn_scan(wdev);
 548
 549                 /*
 550                  * If we can't scan right now, then we need to scan again
 551                  * after the current scan finished, since the parameters
 552                  * changed (unless we find a good AP anyway).
 553                  */
 554                 if (err == -EBUSY) {
 555                         err = 0;
 556                         wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
 557                 }
 558         }
 559
 560         if (err)
 561                 cfg80211_sme_free(wdev);
 562
 563         return err;
 564 }
 565
 566 static int cfg80211_sme_disconnect(struct wireless_dev *wdev, u16 reason)
 567 {
 568         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 569         int err;
 570
 571         if (!wdev->conn)
 572                 return 0;
 573
 574         if (!rdev->ops->deauth)
 575                 return -EOPNOTSUPP;
 576
 577         if (wdev->conn->state == CFG80211_CONN_SCANNING ||
 578             wdev->conn->state == CFG80211_CONN_SCAN_AGAIN) {
 579                 err = 0;
 580                 goto out;
 581         }
 582
 583         /* wdev->conn->params.bssid must be set if > SCANNING */
 584         err = cfg80211_mlme_deauth(rdev, wdev->netdev,
 585                                    wdev->conn->params.bssid,
 586                                    NULL, 0, reason, false);
 587  out:
 588         cfg80211_sme_free(wdev);
 589         return err;
 590 }
 591
 592 /*
 593  * code shared for in-device and software SME
 594  */
 595
 596 static bool cfg80211_is_all_idle(void)
 597 {
 598         struct cfg80211_registered_device *rdev;
 599         struct wireless_dev *wdev;
 600         bool is_all_idle = true;
 601
 602         /*
 603          * All devices must be idle as otherwise if you are actively
 604          * scanning some new beacon hints could be learned and would
 605          * count as new regulatory hints.
 606          */
 607         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 608                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 609                         wdev_lock(wdev);
 610                         if (wdev->conn || wdev->current_bss)
 611                                 is_all_idle = false;
 612                         wdev_unlock(wdev);
 613                 }
 614         }
 615
 616         return is_all_idle;
 617 }
 618
 619 static void disconnect_work(struct work_struct *work)
 620 {
 621         rtnl_lock();
 622         if (cfg80211_is_all_idle())
 623                 regulatory_hint_disconnect();
 624         rtnl_unlock();
 625 }
 626
 627 static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
 628
 629
 630 /*
 631  * API calls for drivers implementing connect/disconnect and
 632  * SME event handling
 633  */
 634
 635 /* This method must consume bss one way or another */
 636 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 637                                const u8 *req_ie, size_t req_ie_len,
 638                                const u8 *resp_ie, size_t resp_ie_len,
 639                                u16 status, bool wextev,
 640                                struct cfg80211_bss *bss)
 641 {
 642         struct wireless_dev *wdev = dev->ieee80211_ptr;
 643         const u8 *country_ie;
 644 #ifdef CONFIG_CFG80211_WEXT
 645         union iwreq_data wrqu;
 646 #endif
 647
 648         ASSERT_WDEV_LOCK(wdev);
 649
 650         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 651                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
 652                 cfg80211_put_bss(wdev->wiphy, bss);
 653                 return;
 654         }
 655
 656         nl80211_send_connect_result(wiphy_to_rdev(wdev->wiphy), dev,
 657                                     bssid, req_ie, req_ie_len,
 658                                     resp_ie, resp_ie_len,
 659                                     status, GFP_KERNEL);
 660
 661 #ifdef CONFIG_CFG80211_WEXT
 662         if (wextev) {
 663                 if (req_ie && status == WLAN_STATUS_SUCCESS) {
 664                         memset(&wrqu, 0, sizeof(wrqu));
 665                         wrqu.data.length = req_ie_len;
 666                         wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, req_ie);
 667                 }
 668
 669                 if (resp_ie && status == WLAN_STATUS_SUCCESS) {
 670                         memset(&wrqu, 0, sizeof(wrqu));
 671                         wrqu.data.length = resp_ie_len;
 672                         wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, resp_ie);
 673                 }
 674
 675                 memset(&wrqu, 0, sizeof(wrqu));
 676                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 677                 if (bssid && status == WLAN_STATUS_SUCCESS) {
 678                         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
 679                         memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
 680                         wdev->wext.prev_bssid_valid = true;
 681                 }
 682                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 683         }
 684 #endif
 685
 686         if (!bss && (status == WLAN_STATUS_SUCCESS)) {
 687                 WARN_ON_ONCE(!wiphy_to_rdev(wdev->wiphy)->ops->connect);
 688                 bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
 689                                        wdev->ssid, wdev->ssid_len,
 690                                        wdev->conn_bss_type,
 691                                        IEEE80211_PRIVACY_ANY);
 692                 if (bss)
 693                         cfg80211_hold_bss(bss_from_pub(bss));
 694         }
 695
 696         if (wdev->current_bss) {
 697                 cfg80211_unhold_bss(wdev->current_bss);
 698                 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
 699                 wdev->current_bss = NULL;
 700         }
 701
 702         if (status != WLAN_STATUS_SUCCESS) {
 703                 kzfree(wdev->connect_keys);
 704                 wdev->connect_keys = NULL;
 705                 wdev->ssid_len = 0;
 706                 if (bss) {
 707                         cfg80211_unhold_bss(bss_from_pub(bss));
 708                         cfg80211_put_bss(wdev->wiphy, bss);
 709                 }
 710                 cfg80211_sme_free(wdev);
 711                 return;
 712         }
 713
 714         if (WARN_ON(!bss))
 715                 return;
 716
 717         wdev->current_bss = bss_from_pub(bss);
 718
 719         cfg80211_upload_connect_keys(wdev);
 720
 721         rcu_read_lock();
 722         country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
 723         if (!country_ie) {
 724                 rcu_read_unlock();
 725                 return;
 726         }
 727
 728         country_ie = kmemdup(country_ie, 2 + country_ie[1], GFP_ATOMIC);
 729         rcu_read_unlock();
 730
 731         if (!country_ie)
 732                 return;
 733
 734         /*
 735          * ieee80211_bss_get_ie() ensures we can access:
 736          * - country_ie + 2, the start of the country ie data, and
 737          * - and country_ie[1] which is the IE length
 738          */
 739         regulatory_hint_country_ie(wdev->wiphy, bss->channel->band,
 740                                    country_ie + 2, country_ie[1]);
 741         kfree(country_ie);
 742 }
 743
 744 void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 745                              const u8 *req_ie, size_t req_ie_len,
 746                              const u8 *resp_ie, size_t resp_ie_len,
 747                              u16 status, gfp_t gfp)
 748 {
 749         struct wireless_dev *wdev = dev->ieee80211_ptr;
 750         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 751         struct cfg80211_event *ev;
 752         unsigned long flags;
 753
 754         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
 755         if (!ev)
 756                 return;
 757
 758         ev->type = EVENT_CONNECT_RESULT;
 759         if (bssid)
 760                 memcpy(ev->cr.bssid, bssid, ETH_ALEN);
 761         if (req_ie_len) {
 762                 ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
 763                 ev->cr.req_ie_len = req_ie_len;
 764                 memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
 765         }
 766         if (resp_ie_len) {
 767                 ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
 768                 ev->cr.resp_ie_len = resp_ie_len;
 769                 memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
 770         }
 771         ev->cr.status = status;
 772
 773         spin_lock_irqsave(&wdev->event_lock, flags);
 774         list_add_tail(&ev->list, &wdev->event_list);
 775         spin_unlock_irqrestore(&wdev->event_lock, flags);
 776         queue_work(cfg80211_wq, &rdev->event_work);
 777 }
 778 EXPORT_SYMBOL(cfg80211_connect_result);
 779
 780 /* Consumes bss object one way or another */
 781 void __cfg80211_roamed(struct wireless_dev *wdev,
 782                        struct cfg80211_bss *bss,
 783                        const u8 *req_ie, size_t req_ie_len,
 784                        const u8 *resp_ie, size_t resp_ie_len)
 785 {
 786 #ifdef CONFIG_CFG80211_WEXT
 787         union iwreq_data wrqu;
 788 #endif
 789         ASSERT_WDEV_LOCK(wdev);
 790
 791         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 792                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
 793                 goto out;
 794
 795         if (WARN_ON(!wdev->current_bss))
 796                 goto out;
 797
 798         cfg80211_unhold_bss(wdev->current_bss);
 799         cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
 800         wdev->current_bss = NULL;
 801
 802         cfg80211_hold_bss(bss_from_pub(bss));
 803         wdev->current_bss = bss_from_pub(bss);
 804
 805         nl80211_send_roamed(wiphy_to_rdev(wdev->wiphy),
 806                             wdev->netdev, bss->bssid,
 807                             req_ie, req_ie_len, resp_ie, resp_ie_len,
 808                             GFP_KERNEL);
 809
 810 #ifdef CONFIG_CFG80211_WEXT
 811         if (req_ie) {
 812                 memset(&wrqu, 0, sizeof(wrqu));
 813                 wrqu.data.length = req_ie_len;
 814                 wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
 815                                     &wrqu, req_ie);
 816         }
 817
 818         if (resp_ie) {
 819                 memset(&wrqu, 0, sizeof(wrqu));
 820                 wrqu.data.length = resp_ie_len;
 821                 wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
 822                                     &wrqu, resp_ie);
 823         }
 824
 825         memset(&wrqu, 0, sizeof(wrqu));
 826         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 827         memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
 828         memcpy(wdev->wext.prev_bssid, bss->bssid, ETH_ALEN);
 829         wdev->wext.prev_bssid_valid = true;
 830         wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
 831 #endif
 832
 833         return;
 834 out:
 835         cfg80211_put_bss(wdev->wiphy, bss);
 836 }
 837
 838 void cfg80211_roamed(struct net_device *dev,
 839                      struct ieee80211_channel *channel,
 840                      const u8 *bssid,
 841                      const u8 *req_ie, size_t req_ie_len,
 842                      const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
 843 {
 844         struct wireless_dev *wdev = dev->ieee80211_ptr;
 845         struct cfg80211_bss *bss;
 846
 847         bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, wdev->ssid,
 848                                wdev->ssid_len,
 849                                wdev->conn_bss_type, IEEE80211_PRIVACY_ANY);
 850         if (WARN_ON(!bss))
 851                 return;
 852
 853         cfg80211_roamed_bss(dev, bss, req_ie, req_ie_len, resp_ie,
 854                             resp_ie_len, gfp);
 855 }
 856 EXPORT_SYMBOL(cfg80211_roamed);
 857
 858 /* Consumes bss object one way or another */
 859 void cfg80211_roamed_bss(struct net_device *dev,
 860                          struct cfg80211_bss *bss, const u8 *req_ie,
 861                          size_t req_ie_len, const u8 *resp_ie,
 862                          size_t resp_ie_len, gfp_t gfp)
 863 {
 864         struct wireless_dev *wdev = dev->ieee80211_ptr;
 865         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 866         struct cfg80211_event *ev;
 867         unsigned long flags;
 868
 869         if (WARN_ON(!bss))
 870                 return;
 871
 872         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
 873         if (!ev) {
 874                 cfg80211_put_bss(wdev->wiphy, bss);
 875                 return;
 876         }
 877
 878         ev->type = EVENT_ROAMED;
 879         ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
 880         ev->rm.req_ie_len = req_ie_len;
 881         memcpy((void *)ev->rm.req_ie, req_ie, req_ie_len);
 882         ev->rm.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
 883         ev->rm.resp_ie_len = resp_ie_len;
 884         memcpy((void *)ev->rm.resp_ie, resp_ie, resp_ie_len);
 885         ev->rm.bss = bss;
 886
 887         spin_lock_irqsave(&wdev->event_lock, flags);
 888         list_add_tail(&ev->list, &wdev->event_list);
 889         spin_unlock_irqrestore(&wdev->event_lock, flags);
 890         queue_work(cfg80211_wq, &rdev->event_work);
 891 }
 892 EXPORT_SYMBOL(cfg80211_roamed_bss);
 893
 894 void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 895                              size_t ie_len, u16 reason, bool from_ap)
 896 {
 897         struct wireless_dev *wdev = dev->ieee80211_ptr;
 898         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 899         int i;
 900 #ifdef CONFIG_CFG80211_WEXT
 901         union iwreq_data wrqu;
 902 #endif
 903
 904         ASSERT_WDEV_LOCK(wdev);
 905
 906         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
 907                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
 908                 return;
 909
 910         if (wdev->current_bss) {
 911                 cfg80211_unhold_bss(wdev->current_bss);
 912                 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
 913         }
 914
 915         wdev->current_bss = NULL;
 916         wdev->ssid_len = 0;
 917
 918         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
 919
 920         /* stop critical protocol if supported */
 921         if (rdev->ops->crit_proto_stop && rdev->crit_proto_nlportid) {
 922                 rdev->crit_proto_nlportid = 0;
 923                 rdev_crit_proto_stop(rdev, wdev);
 924         }
 925
 926         /*
 927          * Delete all the keys ... pairwise keys can't really
 928          * exist any more anyway, but default keys might.
 929          */
 930         if (rdev->ops->del_key)
 931                 for (i = 0; i < 6; i++)
 932                         rdev_del_key(rdev, dev, i, false, NULL);
 933
 934         rdev_set_qos_map(rdev, dev, NULL);
 935
 936 #ifdef CONFIG_CFG80211_WEXT
 937         memset(&wrqu, 0, sizeof(wrqu));
 938         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 939         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 940         wdev->wext.connect.ssid_len = 0;
 941 #endif
 942
 943         schedule_work(&cfg80211_disconnect_work);
 944 }
 945
 946 void cfg80211_disconnected(struct net_device *dev, u16 reason,
 947                            const u8 *ie, size_t ie_len,
 948                            bool locally_generated, gfp_t gfp)
 949 {
 950         struct wireless_dev *wdev = dev->ieee80211_ptr;
 951         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 952         struct cfg80211_event *ev;
 953         unsigned long flags;
 954
 955         ev = kzalloc(sizeof(*ev) + ie_len, gfp);
 956         if (!ev)
 957                 return;
 958
 959         ev->type = EVENT_DISCONNECTED;
 960         ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
 961         ev->dc.ie_len = ie_len;
 962         memcpy((void *)ev->dc.ie, ie, ie_len);
 963         ev->dc.reason = reason;
 964         ev->dc.locally_generated = locally_generated;
 965
 966         spin_lock_irqsave(&wdev->event_lock, flags);
 967         list_add_tail(&ev->list, &wdev->event_list);
 968         spin_unlock_irqrestore(&wdev->event_lock, flags);
 969         queue_work(cfg80211_wq, &rdev->event_work);
 970 }
 971 EXPORT_SYMBOL(cfg80211_disconnected);
 972
 973 /*
 974  * API calls for nl80211/wext compatibility code
 975  */
 976 int cfg80211_connect(struct cfg80211_registered_device *rdev,
 977                      struct net_device *dev,
 978                      struct cfg80211_connect_params *connect,
 979                      struct cfg80211_cached_keys *connkeys,
 980                      const u8 *prev_bssid)
 981 {
 982         struct wireless_dev *wdev = dev->ieee80211_ptr;
 983         int err;
 984
 985         ASSERT_WDEV_LOCK(wdev);
 986
 987         if (WARN_ON(wdev->connect_keys)) {
 988                 kzfree(wdev->connect_keys);
 989                 wdev->connect_keys = NULL;
 990         }
 991
 992         cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
 993                                   rdev->wiphy.ht_capa_mod_mask);
 994
 995         if (connkeys && connkeys->def >= 0) {
 996                 int idx;
 997                 u32 cipher;
 998
 999                 idx = connkeys->def;
1000                 cipher = connkeys->params[idx].cipher;
1001                 /* If given a WEP key we may need it for shared key auth */
1002                 if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
1003                     cipher == WLAN_CIPHER_SUITE_WEP104) {
1004                         connect->key_idx = idx;
1005                         connect->key = connkeys->params[idx].key;
1006                         connect->key_len = connkeys->params[idx].key_len;
1007
1008                         /*
1009                          * If ciphers are not set (e.g. when going through
1010                          * iwconfig), we have to set them appropriately here.
1011                          */
1012                         if (connect->crypto.cipher_group == 0)
1013                                 connect->crypto.cipher_group = cipher;
1014
1015                         if (connect->crypto.n_ciphers_pairwise == 0) {
1016                                 connect->crypto.n_ciphers_pairwise = 1;
1017                                 connect->crypto.ciphers_pairwise[0] = cipher;
1018                         }
1019                 }
1020         }
1021
1022         wdev->connect_keys = connkeys;
1023         memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
1024         wdev->ssid_len = connect->ssid_len;
1025
1026         wdev->conn_bss_type = connect->pbss ? IEEE80211_BSS_TYPE_PBSS :
1027                                               IEEE80211_BSS_TYPE_ESS;
1028
1029         if (!rdev->ops->connect)
1030                 err = cfg80211_sme_connect(wdev, connect, prev_bssid);
1031         else
1032                 err = rdev_connect(rdev, dev, connect);
1033
1034         if (err) {
1035                 wdev->connect_keys = NULL;
1036                 wdev->ssid_len = 0;
1037                 return err;
1038         }
1039
1040         return 0;
1041 }
1042
1043 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
1044                         struct net_device *dev, u16 reason, bool wextev)
1045 {
1046         struct wireless_dev *wdev = dev->ieee80211_ptr;
1047         int err = 0;
1048
1049         ASSERT_WDEV_LOCK(wdev);
1050
1051         kzfree(wdev->connect_keys);
1052         wdev->connect_keys = NULL;
1053
1054         if (wdev->conn)
1055                 err = cfg80211_sme_disconnect(wdev, reason);
1056         else if (!rdev->ops->disconnect)
1057                 cfg80211_mlme_down(rdev, dev);
1058         else if (wdev->current_bss)
1059                 err = rdev_disconnect(rdev, dev, reason);
1060
1061         return err;
1062 }