media: video: tegra: Focuser range tuning support
[linux-2.6.git] / net / wireless / mlme.c
1 /*
2  * cfg80211 MLME SAP interface
3  *
4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
5  */
6
7 #include <linux/kernel.h>
8 #include <linux/module.h>
9 #include <linux/netdevice.h>
10 #include <linux/nl80211.h>
11 #include <linux/slab.h>
12 #include <linux/wireless.h>
13 #include <net/cfg80211.h>
14 #include <net/iw_handler.h>
15 #include "core.h"
16 #include "nl80211.h"
17
18 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
19 {
20         struct wireless_dev *wdev = dev->ieee80211_ptr;
21         struct wiphy *wiphy = wdev->wiphy;
22         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
23         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
24         u8 *bssid = mgmt->bssid;
25         int i;
26         u16 status = le16_to_cpu(mgmt->u.auth.status_code);
27         bool done = false;
28
29         wdev_lock(wdev);
30
31         for (i = 0; i < MAX_AUTH_BSSES; i++) {
32                 if (wdev->authtry_bsses[i] &&
33                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
34                                                         ETH_ALEN) == 0) {
35                         if (status == WLAN_STATUS_SUCCESS) {
36                                 wdev->auth_bsses[i] = wdev->authtry_bsses[i];
37                         } else {
38                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
39                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
40                         }
41                         wdev->authtry_bsses[i] = NULL;
42                         done = true;
43                         break;
44                 }
45         }
46
47         if (done) {
48                 nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
49                 cfg80211_sme_rx_auth(dev, buf, len);
50         }
51
52         wdev_unlock(wdev);
53 }
54 EXPORT_SYMBOL(cfg80211_send_rx_auth);
55
56 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
57 {
58         u16 status_code;
59         struct wireless_dev *wdev = dev->ieee80211_ptr;
60         struct wiphy *wiphy = wdev->wiphy;
61         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
62         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
63         u8 *ie = mgmt->u.assoc_resp.variable;
64         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
65         struct cfg80211_internal_bss *bss = NULL;
66
67         wdev_lock(wdev);
68
69         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
70
71         /*
72          * This is a bit of a hack, we don't notify userspace of
73          * a (re-)association reply if we tried to send a reassoc
74          * and got a reject -- we only try again with an assoc
75          * frame instead of reassoc.
76          */
77         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
78             cfg80211_sme_failed_reassoc(wdev))
79                 goto out;
80
81         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
82
83         if (status_code == WLAN_STATUS_SUCCESS) {
84                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
85                         if (!wdev->auth_bsses[i])
86                                 continue;
87                         if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
88                                    ETH_ALEN) == 0) {
89                                 bss = wdev->auth_bsses[i];
90                                 wdev->auth_bsses[i] = NULL;
91                                 /* additional reference to drop hold */
92                                 cfg80211_ref_bss(bss);
93                                 break;
94                         }
95                 }
96
97                 /*
98                  * We might be coming here because the driver reported
99                  * a successful association at the same time as the
100                  * user requested a deauth. In that case, we will have
101                  * removed the BSS from the auth_bsses list due to the
102                  * deauth request when the assoc response makes it. If
103                  * the two code paths acquire the lock the other way
104                  * around, that's just the standard situation of a
105                  * deauth being requested while connected.
106                  */
107                 if (!bss)
108                         goto out;
109         } else if (wdev->conn) {
110                 cfg80211_sme_failed_assoc(wdev);
111                 /*
112                  * do not call connect_result() now because the
113                  * sme will schedule work that does it later.
114                  */
115                 goto out;
116         }
117
118         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
119                 /*
120                  * This is for the userspace SME, the CONNECTING
121                  * state will be changed to CONNECTED by
122                  * __cfg80211_connect_result() below.
123                  */
124                 wdev->sme_state = CFG80211_SME_CONNECTING;
125         }
126
127         /* this consumes one bss reference (unless bss is NULL) */
128         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
129                                   status_code,
130                                   status_code == WLAN_STATUS_SUCCESS,
131                                   bss ? &bss->pub : NULL);
132         /* drop hold now, and also reference acquired above */
133         if (bss) {
134                 cfg80211_unhold_bss(bss);
135                 cfg80211_put_bss(&bss->pub);
136         }
137
138  out:
139         wdev_unlock(wdev);
140 }
141 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
142
143 void __cfg80211_send_deauth(struct net_device *dev,
144                                    const u8 *buf, size_t len)
145 {
146         struct wireless_dev *wdev = dev->ieee80211_ptr;
147         struct wiphy *wiphy = wdev->wiphy;
148         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
149         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
150         const u8 *bssid = mgmt->bssid;
151         int i;
152         bool found = false, was_current = false;
153
154         ASSERT_WDEV_LOCK(wdev);
155
156         if (wdev->current_bss &&
157             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
158                 cfg80211_unhold_bss(wdev->current_bss);
159                 cfg80211_put_bss(&wdev->current_bss->pub);
160                 wdev->current_bss = NULL;
161                 found = true;
162                 was_current = true;
163         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
164                 if (wdev->auth_bsses[i] &&
165                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
166                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
167                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
168                         wdev->auth_bsses[i] = NULL;
169                         found = true;
170                         break;
171                 }
172                 if (wdev->authtry_bsses[i] &&
173                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
174                            ETH_ALEN) == 0 &&
175                     memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
176                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
177                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
178                         wdev->authtry_bsses[i] = NULL;
179                         found = true;
180                         break;
181                 }
182         }
183
184         if (!found)
185                 return;
186
187         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
188
189         if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
190                 u16 reason_code;
191                 bool from_ap;
192
193                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
194
195                 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
196                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
197         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
198                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
199                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
200                                           false, NULL);
201         }
202 }
203 EXPORT_SYMBOL(__cfg80211_send_deauth);
204
205 void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
206 {
207         struct wireless_dev *wdev = dev->ieee80211_ptr;
208
209         wdev_lock(wdev);
210         __cfg80211_send_deauth(dev, buf, len);
211         wdev_unlock(wdev);
212 }
213 EXPORT_SYMBOL(cfg80211_send_deauth);
214
215 void __cfg80211_send_disassoc(struct net_device *dev,
216                                      const u8 *buf, size_t len)
217 {
218         struct wireless_dev *wdev = dev->ieee80211_ptr;
219         struct wiphy *wiphy = wdev->wiphy;
220         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
221         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
222         const u8 *bssid = mgmt->bssid;
223         int i;
224         u16 reason_code;
225         bool from_ap;
226         bool done = false;
227
228         ASSERT_WDEV_LOCK(wdev);
229
230         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
231
232         if (wdev->sme_state != CFG80211_SME_CONNECTED)
233                 return;
234
235         if (wdev->current_bss &&
236             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
237                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
238                         if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
239                                 continue;
240                         wdev->auth_bsses[i] = wdev->current_bss;
241                         wdev->current_bss = NULL;
242                         done = true;
243                         cfg80211_sme_disassoc(dev, i);
244                         break;
245                 }
246                 WARN_ON(!done);
247         } else
248                 WARN_ON(1);
249
250
251         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
252
253         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
254         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
255 }
256 EXPORT_SYMBOL(__cfg80211_send_disassoc);
257
258 void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
259 {
260         struct wireless_dev *wdev = dev->ieee80211_ptr;
261
262         wdev_lock(wdev);
263         __cfg80211_send_disassoc(dev, buf, len);
264         wdev_unlock(wdev);
265 }
266 EXPORT_SYMBOL(cfg80211_send_disassoc);
267
268 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
269                                  size_t len)
270 {
271         struct wireless_dev *wdev = dev->ieee80211_ptr;
272         struct wiphy *wiphy = wdev->wiphy;
273         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
274
275         nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
276 }
277 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
278
279 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
280                                    size_t len)
281 {
282         struct wireless_dev *wdev = dev->ieee80211_ptr;
283         struct wiphy *wiphy = wdev->wiphy;
284         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
285
286         nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
287 }
288 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
289
290 static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
291 {
292         int i;
293         bool done = false;
294
295         ASSERT_WDEV_LOCK(wdev);
296
297         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
298                 if (wdev->authtry_bsses[i] &&
299                     memcmp(wdev->authtry_bsses[i]->pub.bssid,
300                            addr, ETH_ALEN) == 0) {
301                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
302                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
303                         wdev->authtry_bsses[i] = NULL;
304                         done = true;
305                         break;
306                 }
307         }
308
309         WARN_ON(!done);
310 }
311
312 void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
313 {
314         __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
315 }
316 EXPORT_SYMBOL(__cfg80211_auth_canceled);
317
318 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
319 {
320         struct wireless_dev *wdev = dev->ieee80211_ptr;
321         struct wiphy *wiphy = wdev->wiphy;
322         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
323
324         wdev_lock(wdev);
325
326         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
327         if (wdev->sme_state == CFG80211_SME_CONNECTING)
328                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
329                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
330                                           false, NULL);
331
332         __cfg80211_auth_remove(wdev, addr);
333
334         wdev_unlock(wdev);
335 }
336 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
337
338 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
339 {
340         struct wireless_dev *wdev = dev->ieee80211_ptr;
341         struct wiphy *wiphy = wdev->wiphy;
342         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
343         int i;
344         bool done = false;
345
346         wdev_lock(wdev);
347
348         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
349         if (wdev->sme_state == CFG80211_SME_CONNECTING)
350                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
351                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
352                                           false, NULL);
353
354         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
355                 if (wdev->auth_bsses[i] &&
356                     memcmp(wdev->auth_bsses[i]->pub.bssid,
357                            addr, ETH_ALEN) == 0) {
358                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
359                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
360                         wdev->auth_bsses[i] = NULL;
361                         done = true;
362                         break;
363                 }
364         }
365
366         WARN_ON(!done);
367
368         wdev_unlock(wdev);
369 }
370 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
371
372 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
373                                   enum nl80211_key_type key_type, int key_id,
374                                   const u8 *tsc, gfp_t gfp)
375 {
376         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
377         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
378 #ifdef CONFIG_CFG80211_WEXT
379         union iwreq_data wrqu;
380         char *buf = kmalloc(128, gfp);
381
382         if (buf) {
383                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
384                         "keyid=%d %scast addr=%pM)", key_id,
385                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
386                         addr);
387                 memset(&wrqu, 0, sizeof(wrqu));
388                 wrqu.data.length = strlen(buf);
389                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
390                 kfree(buf);
391         }
392 #endif
393
394         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
395 }
396 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
397
398 /* some MLME handling for userspace SME */
399 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
400                          struct net_device *dev,
401                          struct ieee80211_channel *chan,
402                          enum nl80211_auth_type auth_type,
403                          const u8 *bssid,
404                          const u8 *ssid, int ssid_len,
405                          const u8 *ie, int ie_len,
406                          const u8 *key, int key_len, int key_idx,
407                          bool local_state_change)
408 {
409         struct wireless_dev *wdev = dev->ieee80211_ptr;
410         struct cfg80211_auth_request req;
411         struct cfg80211_internal_bss *bss;
412         int i, err, slot = -1, nfree = 0;
413
414         ASSERT_WDEV_LOCK(wdev);
415
416         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
417                 if (!key || !key_len || key_idx < 0 || key_idx > 4)
418                         return -EINVAL;
419
420         if (wdev->current_bss &&
421             memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
422                 return -EALREADY;
423
424         for (i = 0; i < MAX_AUTH_BSSES; i++) {
425                 if (wdev->authtry_bsses[i] &&
426                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
427                                                 ETH_ALEN) == 0)
428                         return -EALREADY;
429                 if (wdev->auth_bsses[i] &&
430                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
431                                                 ETH_ALEN) == 0)
432                         return -EALREADY;
433         }
434
435         memset(&req, 0, sizeof(req));
436
437         req.local_state_change = local_state_change;
438         req.ie = ie;
439         req.ie_len = ie_len;
440         req.auth_type = auth_type;
441         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
442                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
443         req.key = key;
444         req.key_len = key_len;
445         req.key_idx = key_idx;
446         if (!req.bss)
447                 return -ENOENT;
448
449         bss = bss_from_pub(req.bss);
450
451         for (i = 0; i < MAX_AUTH_BSSES; i++) {
452                 if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
453                         slot = i;
454                         nfree++;
455                 }
456         }
457
458         /* we need one free slot for disassoc and one for this auth */
459         if (nfree < 2) {
460                 err = -ENOSPC;
461                 goto out;
462         }
463
464         if (local_state_change)
465                 wdev->auth_bsses[slot] = bss;
466         else
467                 wdev->authtry_bsses[slot] = bss;
468         cfg80211_hold_bss(bss);
469
470         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
471         if (err) {
472                 if (local_state_change)
473                         wdev->auth_bsses[slot] = NULL;
474                 else
475                         wdev->authtry_bsses[slot] = NULL;
476                 cfg80211_unhold_bss(bss);
477         }
478
479  out:
480         if (err)
481                 cfg80211_put_bss(req.bss);
482         return err;
483 }
484
485 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
486                        struct net_device *dev, struct ieee80211_channel *chan,
487                        enum nl80211_auth_type auth_type, const u8 *bssid,
488                        const u8 *ssid, int ssid_len,
489                        const u8 *ie, int ie_len,
490                        const u8 *key, int key_len, int key_idx,
491                        bool local_state_change)
492 {
493         int err;
494
495         wdev_lock(dev->ieee80211_ptr);
496         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
497                                    ssid, ssid_len, ie, ie_len,
498                                    key, key_len, key_idx, local_state_change);
499         wdev_unlock(dev->ieee80211_ptr);
500
501         return err;
502 }
503
504 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
505                           struct net_device *dev,
506                           struct ieee80211_channel *chan,
507                           const u8 *bssid, const u8 *prev_bssid,
508                           const u8 *ssid, int ssid_len,
509                           const u8 *ie, int ie_len, bool use_mfp,
510                           struct cfg80211_crypto_settings *crypt)
511 {
512         struct wireless_dev *wdev = dev->ieee80211_ptr;
513         struct cfg80211_assoc_request req;
514         struct cfg80211_internal_bss *bss;
515         int i, err, slot = -1;
516         bool was_connected = false;
517
518         ASSERT_WDEV_LOCK(wdev);
519
520         memset(&req, 0, sizeof(req));
521
522         if (wdev->current_bss && prev_bssid &&
523             memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
524                 /*
525                  * Trying to reassociate: Allow this to proceed and let the old
526                  * association to be dropped when the new one is completed.
527                  */
528                 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
529                         was_connected = true;
530                         wdev->sme_state = CFG80211_SME_CONNECTING;
531                 }
532         } else if (wdev->current_bss)
533                 return -EALREADY;
534
535         req.ie = ie;
536         req.ie_len = ie_len;
537         memcpy(&req.crypto, crypt, sizeof(req.crypto));
538         req.use_mfp = use_mfp;
539         req.prev_bssid = prev_bssid;
540         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
541                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
542         if (!req.bss) {
543                 if (was_connected)
544                         wdev->sme_state = CFG80211_SME_CONNECTED;
545                 return -ENOENT;
546         }
547
548         bss = bss_from_pub(req.bss);
549
550         for (i = 0; i < MAX_AUTH_BSSES; i++) {
551                 if (bss == wdev->auth_bsses[i]) {
552                         slot = i;
553                         break;
554                 }
555         }
556
557         if (slot < 0) {
558                 err = -ENOTCONN;
559                 goto out;
560         }
561
562         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
563  out:
564         if (err && was_connected)
565                 wdev->sme_state = CFG80211_SME_CONNECTED;
566         /* still a reference in wdev->auth_bsses[slot] */
567         cfg80211_put_bss(req.bss);
568         return err;
569 }
570
571 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
572                         struct net_device *dev,
573                         struct ieee80211_channel *chan,
574                         const u8 *bssid, const u8 *prev_bssid,
575                         const u8 *ssid, int ssid_len,
576                         const u8 *ie, int ie_len, bool use_mfp,
577                         struct cfg80211_crypto_settings *crypt)
578 {
579         struct wireless_dev *wdev = dev->ieee80211_ptr;
580         int err;
581
582         wdev_lock(wdev);
583         err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
584                                     ssid, ssid_len, ie, ie_len, use_mfp, crypt);
585         wdev_unlock(wdev);
586
587         return err;
588 }
589
590 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
591                            struct net_device *dev, const u8 *bssid,
592                            const u8 *ie, int ie_len, u16 reason,
593                            bool local_state_change)
594 {
595         struct wireless_dev *wdev = dev->ieee80211_ptr;
596         struct cfg80211_deauth_request req;
597         int i;
598
599         ASSERT_WDEV_LOCK(wdev);
600
601         memset(&req, 0, sizeof(req));
602         req.reason_code = reason;
603         req.local_state_change = local_state_change;
604         req.ie = ie;
605         req.ie_len = ie_len;
606         if (wdev->current_bss &&
607             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
608                 req.bss = &wdev->current_bss->pub;
609         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
610                 if (wdev->auth_bsses[i] &&
611                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
612                         req.bss = &wdev->auth_bsses[i]->pub;
613                         break;
614                 }
615                 if (wdev->authtry_bsses[i] &&
616                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
617                         req.bss = &wdev->authtry_bsses[i]->pub;
618                         break;
619                 }
620         }
621
622         if (!req.bss)
623                 return -ENOTCONN;
624
625         return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
626 }
627
628 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
629                          struct net_device *dev, const u8 *bssid,
630                          const u8 *ie, int ie_len, u16 reason,
631                          bool local_state_change)
632 {
633         struct wireless_dev *wdev = dev->ieee80211_ptr;
634         int err;
635
636         wdev_lock(wdev);
637         err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
638                                      local_state_change);
639         wdev_unlock(wdev);
640
641         return err;
642 }
643
644 static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
645                                     struct net_device *dev, const u8 *bssid,
646                                     const u8 *ie, int ie_len, u16 reason,
647                                     bool local_state_change)
648 {
649         struct wireless_dev *wdev = dev->ieee80211_ptr;
650         struct cfg80211_disassoc_request req;
651
652         ASSERT_WDEV_LOCK(wdev);
653
654         if (wdev->sme_state != CFG80211_SME_CONNECTED)
655                 return -ENOTCONN;
656
657         if (WARN_ON(!wdev->current_bss))
658                 return -ENOTCONN;
659
660         memset(&req, 0, sizeof(req));
661         req.reason_code = reason;
662         req.local_state_change = local_state_change;
663         req.ie = ie;
664         req.ie_len = ie_len;
665         if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
666                 req.bss = &wdev->current_bss->pub;
667         else
668                 return -ENOTCONN;
669
670         return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
671 }
672
673 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
674                            struct net_device *dev, const u8 *bssid,
675                            const u8 *ie, int ie_len, u16 reason,
676                            bool local_state_change)
677 {
678         struct wireless_dev *wdev = dev->ieee80211_ptr;
679         int err;
680
681         wdev_lock(wdev);
682         err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
683                                        local_state_change);
684         wdev_unlock(wdev);
685
686         return err;
687 }
688
689 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
690                         struct net_device *dev)
691 {
692         struct wireless_dev *wdev = dev->ieee80211_ptr;
693         struct cfg80211_deauth_request req;
694         int i;
695
696         ASSERT_WDEV_LOCK(wdev);
697
698         if (!rdev->ops->deauth)
699                 return;
700
701         memset(&req, 0, sizeof(req));
702         req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
703         req.ie = NULL;
704         req.ie_len = 0;
705
706         if (wdev->current_bss) {
707                 req.bss = &wdev->current_bss->pub;
708                 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
709                 if (wdev->current_bss) {
710                         cfg80211_unhold_bss(wdev->current_bss);
711                         cfg80211_put_bss(&wdev->current_bss->pub);
712                         wdev->current_bss = NULL;
713                 }
714         }
715
716         for (i = 0; i < MAX_AUTH_BSSES; i++) {
717                 if (wdev->auth_bsses[i]) {
718                         req.bss = &wdev->auth_bsses[i]->pub;
719                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
720                         if (wdev->auth_bsses[i]) {
721                                 cfg80211_unhold_bss(wdev->auth_bsses[i]);
722                                 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
723                                 wdev->auth_bsses[i] = NULL;
724                         }
725                 }
726                 if (wdev->authtry_bsses[i]) {
727                         req.bss = &wdev->authtry_bsses[i]->pub;
728                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
729                         if (wdev->authtry_bsses[i]) {
730                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
731                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
732                                 wdev->authtry_bsses[i] = NULL;
733                         }
734                 }
735         }
736 }
737
738 void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
739                                struct ieee80211_channel *chan,
740                                enum nl80211_channel_type channel_type,
741                                unsigned int duration, gfp_t gfp)
742 {
743         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
744         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
745
746         nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
747                                        duration, gfp);
748 }
749 EXPORT_SYMBOL(cfg80211_ready_on_channel);
750
751 void cfg80211_remain_on_channel_expired(struct net_device *dev,
752                                         u64 cookie,
753                                         struct ieee80211_channel *chan,
754                                         enum nl80211_channel_type channel_type,
755                                         gfp_t gfp)
756 {
757         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
758         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
759
760         nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
761                                               channel_type, gfp);
762 }
763 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
764
765 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
766                       struct station_info *sinfo, gfp_t gfp)
767 {
768         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
769         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
770
771         nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
772 }
773 EXPORT_SYMBOL(cfg80211_new_sta);
774
775 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
776 {
777         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
778         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
779
780         nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
781 }
782 EXPORT_SYMBOL(cfg80211_del_sta);
783
784 struct cfg80211_mgmt_registration {
785         struct list_head list;
786
787         u32 nlpid;
788
789         int match_len;
790
791         __le16 frame_type;
792
793         u8 match[];
794 };
795
796 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
797                                 u16 frame_type, const u8 *match_data,
798                                 int match_len)
799 {
800         struct wiphy *wiphy = wdev->wiphy;
801         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
802         struct cfg80211_mgmt_registration *reg, *nreg;
803         int err = 0;
804         u16 mgmt_type;
805
806         if (!wdev->wiphy->mgmt_stypes)
807                 return -EOPNOTSUPP;
808
809         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
810                 return -EINVAL;
811
812         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
813                 return -EINVAL;
814
815         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
816         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
817                 return -EINVAL;
818
819         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
820         if (!nreg)
821                 return -ENOMEM;
822
823         spin_lock_bh(&wdev->mgmt_registrations_lock);
824
825         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
826                 int mlen = min(match_len, reg->match_len);
827
828                 if (frame_type != le16_to_cpu(reg->frame_type))
829                         continue;
830
831                 if (memcmp(reg->match, match_data, mlen) == 0) {
832                         err = -EALREADY;
833                         break;
834                 }
835         }
836
837         if (err) {
838                 kfree(nreg);
839                 goto out;
840         }
841
842         memcpy(nreg->match, match_data, match_len);
843         nreg->match_len = match_len;
844         nreg->nlpid = snd_pid;
845         nreg->frame_type = cpu_to_le16(frame_type);
846         list_add(&nreg->list, &wdev->mgmt_registrations);
847
848         if (rdev->ops->mgmt_frame_register)
849                 rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
850                                                frame_type, true);
851
852  out:
853         spin_unlock_bh(&wdev->mgmt_registrations_lock);
854
855         return err;
856 }
857
858 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
859 {
860         struct wiphy *wiphy = wdev->wiphy;
861         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
862         struct cfg80211_mgmt_registration *reg, *tmp;
863
864         spin_lock_bh(&wdev->mgmt_registrations_lock);
865
866         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
867                 if (reg->nlpid != nlpid)
868                         continue;
869
870                 if (rdev->ops->mgmt_frame_register) {
871                         u16 frame_type = le16_to_cpu(reg->frame_type);
872
873                         rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
874                                                        frame_type, false);
875                 }
876
877                 list_del(&reg->list);
878                 kfree(reg);
879         }
880
881         spin_unlock_bh(&wdev->mgmt_registrations_lock);
882 }
883
884 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
885 {
886         struct cfg80211_mgmt_registration *reg, *tmp;
887
888         spin_lock_bh(&wdev->mgmt_registrations_lock);
889
890         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
891                 list_del(&reg->list);
892                 kfree(reg);
893         }
894
895         spin_unlock_bh(&wdev->mgmt_registrations_lock);
896 }
897
898 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
899                           struct net_device *dev,
900                           struct ieee80211_channel *chan, bool offchan,
901                           enum nl80211_channel_type channel_type,
902                           bool channel_type_valid, unsigned int wait,
903                           const u8 *buf, size_t len, u64 *cookie)
904 {
905         struct wireless_dev *wdev = dev->ieee80211_ptr;
906         const struct ieee80211_mgmt *mgmt;
907         u16 stype;
908
909         if (!wdev->wiphy->mgmt_stypes)
910                 return -EOPNOTSUPP;
911
912         if (!rdev->ops->mgmt_tx)
913                 return -EOPNOTSUPP;
914
915         if (len < 24 + 1)
916                 return -EINVAL;
917
918         mgmt = (const struct ieee80211_mgmt *) buf;
919
920         if (!ieee80211_is_mgmt(mgmt->frame_control))
921                 return -EINVAL;
922
923         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
924         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
925                 return -EINVAL;
926
927         if (ieee80211_is_action(mgmt->frame_control) &&
928             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
929                 int err = 0;
930
931                 wdev_lock(wdev);
932
933                 switch (wdev->iftype) {
934                 case NL80211_IFTYPE_ADHOC:
935                 case NL80211_IFTYPE_STATION:
936                 case NL80211_IFTYPE_P2P_CLIENT:
937                         if (!wdev->current_bss) {
938                                 err = -ENOTCONN;
939                                 break;
940                         }
941
942                         if (memcmp(wdev->current_bss->pub.bssid,
943                                    mgmt->bssid, ETH_ALEN)) {
944                                 err = -ENOTCONN;
945                                 break;
946                         }
947
948                         /*
949                          * check for IBSS DA must be done by driver as
950                          * cfg80211 doesn't track the stations
951                          */
952                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
953                                 break;
954
955                         /* for station, check that DA is the AP */
956                         if (memcmp(wdev->current_bss->pub.bssid,
957                                    mgmt->da, ETH_ALEN)) {
958                                 err = -ENOTCONN;
959                                 break;
960                         }
961                         break;
962                 case NL80211_IFTYPE_AP:
963                 case NL80211_IFTYPE_P2P_GO:
964                 case NL80211_IFTYPE_AP_VLAN:
965                         if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
966                                 err = -EINVAL;
967                         break;
968                 case NL80211_IFTYPE_MESH_POINT:
969                         if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
970                                 err = -EINVAL;
971                                 break;
972                         }
973                         /*
974                          * check for mesh DA must be done by driver as
975                          * cfg80211 doesn't track the stations
976                          */
977                         break;
978                 default:
979                         err = -EOPNOTSUPP;
980                         break;
981                 }
982                 wdev_unlock(wdev);
983
984                 if (err)
985                         return err;
986         }
987
988         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
989                 return -EINVAL;
990
991         /* Transmit the Action frame as requested by user space */
992         return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
993                                   channel_type, channel_type_valid,
994                                   wait, buf, len, cookie);
995 }
996
997 bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
998                       size_t len, gfp_t gfp)
999 {
1000         struct wireless_dev *wdev = dev->ieee80211_ptr;
1001         struct wiphy *wiphy = wdev->wiphy;
1002         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1003         struct cfg80211_mgmt_registration *reg;
1004         const struct ieee80211_txrx_stypes *stypes =
1005                 &wiphy->mgmt_stypes[wdev->iftype];
1006         struct ieee80211_mgmt *mgmt = (void *)buf;
1007         const u8 *data;
1008         int data_len;
1009         bool result = false;
1010         __le16 ftype = mgmt->frame_control &
1011                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
1012         u16 stype;
1013
1014         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
1015
1016         if (!(stypes->rx & BIT(stype)))
1017                 return false;
1018
1019         data = buf + ieee80211_hdrlen(mgmt->frame_control);
1020         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
1021
1022         spin_lock_bh(&wdev->mgmt_registrations_lock);
1023
1024         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
1025                 if (reg->frame_type != ftype)
1026                         continue;
1027
1028                 if (reg->match_len > data_len)
1029                         continue;
1030
1031                 if (memcmp(reg->match, data, reg->match_len))
1032                         continue;
1033
1034                 /* found match! */
1035
1036                 /* Indicate the received Action frame to user space */
1037                 if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
1038                                       buf, len, gfp))
1039                         continue;
1040
1041                 result = true;
1042                 break;
1043         }
1044
1045         spin_unlock_bh(&wdev->mgmt_registrations_lock);
1046
1047         return result;
1048 }
1049 EXPORT_SYMBOL(cfg80211_rx_mgmt);
1050
1051 void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
1052                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
1053 {
1054         struct wireless_dev *wdev = dev->ieee80211_ptr;
1055         struct wiphy *wiphy = wdev->wiphy;
1056         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1057
1058         /* Indicate TX status of the Action frame to user space */
1059         nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
1060 }
1061 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
1062
1063 void cfg80211_cqm_rssi_notify(struct net_device *dev,
1064                               enum nl80211_cqm_rssi_threshold_event rssi_event,
1065                               gfp_t gfp)
1066 {
1067         struct wireless_dev *wdev = dev->ieee80211_ptr;
1068         struct wiphy *wiphy = wdev->wiphy;
1069         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1070
1071         /* Indicate roaming trigger event to user space */
1072         nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
1073 }
1074 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
1075
1076 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
1077                                  const u8 *peer, u32 num_packets, gfp_t gfp)
1078 {
1079         struct wireless_dev *wdev = dev->ieee80211_ptr;
1080         struct wiphy *wiphy = wdev->wiphy;
1081         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1082
1083         /* Indicate roaming trigger event to user space */
1084         nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
1085 }
1086 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
1087
1088 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
1089                                const u8 *replay_ctr, gfp_t gfp)
1090 {
1091         struct wireless_dev *wdev = dev->ieee80211_ptr;
1092         struct wiphy *wiphy = wdev->wiphy;
1093         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1094
1095         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
1096 }
1097 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);