[deliverable/linux.git] / net / mac80211 / key.c

/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
#include <linux/rcupdate.h>
#include <linux/rtnetlink.h>
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"


/**
 * DOC: Key handling basics
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
 * All key operations are protected internally so you can call them at
 * any time.
 *
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
	/* only add if not already added */
	if (list_empty(&key->todo))
		list_add(&key->todo, &todo_list);
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
	    (key->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
	     key->sdata->vif.type == IEEE80211_IF_TYPE_VLAN))
		addr = zero_addr;

	if (key->sta)
		addr = key->sta->addr;

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
	DECLARE_MAC_BUF(mac);

	assert_key_lock();
	might_sleep();

	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (!ret) {
		spin_lock(&todo_lock);
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
		spin_unlock(&todo_lock);
	}

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
		       "(%d, %s) to hardware (%d)\n",
		       wiphy_name(key->local->hw.wiphy),
		       key->conf.keyidx, print_mac(mac, addr), ret);
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
	DECLARE_MAC_BUF(mac);

	assert_key_lock();
	might_sleep();

	if (!key || !key->local->ops->set_key)
		return;

	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
		return;
	}
	spin_unlock(&todo_lock);

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
		       "(%d, %s) from hardware (%d)\n",
		       wiphy_name(key->local->hw.wiphy),
		       key->conf.keyidx, print_mac(mac, addr), ret);

	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

	spin_lock_irqsave(&sdata->local->key_lock, flags);
	__ieee80211_set_default_key(sdata, idx);
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
}

struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
{
	struct ieee80211_key *key;

	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
	if (!key)
		return NULL;

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
	memcpy(key->conf.key, key_data, key_len);
	INIT_LIST_HEAD(&key->list);
	INIT_LIST_HEAD(&key->todo);

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
			kfree(key);
			return NULL;
		}
	}

	return key;
}

void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
	unsigned long flags;
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
		if (sta->flags & WLAN_STA_WME)
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
	} else {
		if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
			struct sta_info *ap;

			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */

			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
				if (ap->flags & WLAN_STA_WME)
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

	spin_lock_irqsave(&sdata->local->key_lock, flags);

	if (sta)
		old_key = sta->key;
	else
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);

	spin_unlock_irqrestore(&sdata->local->key_lock, flags);

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);

	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
	if (netif_running(sdata->dev))
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
}

static void __ieee80211_key_free(struct ieee80211_key *key)
{
	/*
	 * Replace key with nothingness if it was ever used.
	 */
	if (key->sdata)
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);

	add_todo(key, KEY_FLAG_TODO_DELETE);
}

void ieee80211_key_free(struct ieee80211_key *key)
{
	unsigned long flags;

	if (!key)
		return;

	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
	__ieee80211_key_free(key);
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;

	might_sleep();

	spin_lock_irqsave(&sdata->local->key_lock, flags);
	list_for_each_entry(key, &sdata->key_list, list)
		add_todo(key, todo_flags);
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);

	ieee80211_key_todo();
}

void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();

	if (WARN_ON(!netif_running(sdata->dev)))
		return;

	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}

void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();

	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
}

static void __ieee80211_key_destroy(struct ieee80211_key *key)
{
	if (!key)
		return;

	ieee80211_key_disable_hw_accel(key);

	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
}

static void __ieee80211_key_todo(void)
{
	struct ieee80211_key *key;
	bool work_done;
	u32 todoflags;

	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DELETE) {
			__ieee80211_key_destroy(key);
			work_done = true;
		}

		WARN_ON(!work_done);

		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
}

void ieee80211_key_todo(void)
{
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}

void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
	unsigned long flags;

	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

	spin_lock_irqsave(&sdata->local->key_lock, flags);
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
		__ieee80211_key_free(key);
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);

	__ieee80211_key_todo();

	ieee80211_key_unlock();
}
Commit	Line	Data
1f5a7e47 JB	1	/*
	2	* Copyright 2002-2005, Instant802 Networks, Inc.
	3	* Copyright 2005-2006, Devicescape Software, Inc.
	4	* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
3b96766f	5	* Copyright 2007-2008 Johannes Berg <johannes@sipsolutions.net>
1f5a7e47 JB	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
11a843b7 JB	12	#include <linux/if_ether.h>
	13	#include <linux/etherdevice.h>
	14	#include <linux/list.h>
d4e46a3d	15	#include <linux/rcupdate.h>
db4d1169	16	#include <linux/rtnetlink.h>
1f5a7e47 JB	17	#include <net/mac80211.h>
	18	#include "ieee80211_i.h"
	19	#include "debugfs_key.h"
	20	#include "aes_ccm.h"
	21
11a843b7	22
dbbea671 JB	23	/**
dbbea671 JB	24	* DOC: Key handling basics
11a843b7 JB	25	*
	26	* Key handling in mac80211 is done based on per-interface (sub_if_data)
	27	* keys and per-station keys. Since each station belongs to an interface,
	28	* each station key also belongs to that interface.
	29	*
	30	* Hardware acceleration is done on a best-effort basis, for each key
	31	* that is eligible the hardware is asked to enable that key but if
	32	* it cannot do that they key is simply kept for software encryption.
	33	* There is currently no way of knowing this except by looking into
	34	* debugfs.
	35	*
3b96766f JB	36	* All key operations are protected internally so you can call them at
3b96766f JB	37	* any time.
db4d1169	38	*
3b96766f JB	39	* Within mac80211, key references are, just as STA structure references,
	40	* protected by RCU. Note, however, that some things are unprotected,
	41	* namely the key->sta dereferences within the hardware acceleration
	42	* functions. This means that sta_info_destroy() must flush the key todo
	43	* list.
	44	*
	45	* All the direct key list manipulation functions must not sleep because
	46	* they can operate on STA info structs that are protected by RCU.
11a843b7 JB	47	*/
	48
	49	static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
	50	static const u8 zero_addr[ETH_ALEN];
	51
3b96766f JB	52	/* key mutex: used to synchronise todo runners */
	53	static DEFINE_MUTEX(key_mutex);
	54	static DEFINE_SPINLOCK(todo_lock);
	55	static LIST_HEAD(todo_list);
	56
	57	static void key_todo(struct work_struct *work)
	58	{
	59	ieee80211_key_todo();
	60	}
	61
	62	static DECLARE_WORK(todo_work, key_todo);
	63
	64	/**
	65	* add_todo - add todo item for a key
	66	*
	67	* @key: key to add to do item for
	68	* @flag: todo flag(s)
	69	*/
	70	static void add_todo(struct ieee80211_key *key, u32 flag)
	71	{
	72	if (!key)
	73	return;
	74
	75	spin_lock(&todo_lock);
	76	key->flags \|= flag;
	77	/* only add if not already added */
	78	if (list_empty(&key->todo))
	79	list_add(&key->todo, &todo_list);
	80	schedule_work(&todo_work);
	81	spin_unlock(&todo_lock);
	82	}
	83
	84	/**
	85	* ieee80211_key_lock - lock the mac80211 key operation lock
	86	*
	87	* This locks the (global) mac80211 key operation lock, all
	88	* key operations must be done under this lock.
	89	*/
	90	static void ieee80211_key_lock(void)
	91	{
	92	mutex_lock(&key_mutex);
	93	}
	94
	95	/**
	96	* ieee80211_key_unlock - unlock the mac80211 key operation lock
	97	*/
	98	static void ieee80211_key_unlock(void)
	99	{
	100	mutex_unlock(&key_mutex);
	101	}
	102
	103	static void assert_key_lock(void)
	104	{
	105	WARN_ON(!mutex_is_locked(&key_mutex));
	106	}
	107
11a843b7 JB	108	static const u8 get_mac_for_key(struct ieee80211_key key)
	109	{
	110	const u8 *addr = bcast_addr;
	111
	112	/*
	113	* If we're an AP we won't ever receive frames with a non-WEP
	114	* group key so we tell the driver that by using the zero MAC
	115	* address to indicate a transmit-only key.
	116	*/
	117	if (key->conf.alg != ALG_WEP &&
51fb61e7 JB	118	(key->sdata->vif.type == IEEE80211_IF_TYPE_AP \|\|
51fb61e7 JB	119	key->sdata->vif.type == IEEE80211_IF_TYPE_VLAN))
11a843b7 JB	120	addr = zero_addr;
	121
	122	if (key->sta)
	123	addr = key->sta->addr;
	124
	125	return addr;
	126	}
	127
	128	static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
	129	{
	130	const u8 *addr;
	131	int ret;
0795af57	132	DECLARE_MAC_BUF(mac);
11a843b7	133
3b96766f JB	134	assert_key_lock();
	135	might_sleep();
	136
11a843b7 JB	137	if (!key->local->ops->set_key)
	138	return;
	139
	140	addr = get_mac_for_key(key);
	141
	142	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
	143	key->sdata->dev->dev_addr, addr,
	144	&key->conf);
	145
3b96766f JB	146	if (!ret) {
3b96766f JB	147	spin_lock(&todo_lock);
11a843b7	148	key->flags \|= KEY_FLAG_UPLOADED_TO_HARDWARE;
3b96766f JB	149	spin_unlock(&todo_lock);
3b96766f JB	150	}
11a843b7 JB	151
	152	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
	153	printk(KERN_ERR "mac80211-%s: failed to set key "
0795af57	154	"(%d, %s) to hardware (%d)\n",
11a843b7	155	wiphy_name(key->local->hw.wiphy),
0795af57	156	key->conf.keyidx, print_mac(mac, addr), ret);
11a843b7 JB	157	}
	158
	159	static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
	160	{
	161	const u8 *addr;
	162	int ret;
0795af57	163	DECLARE_MAC_BUF(mac);
11a843b7	164
3b96766f JB	165	assert_key_lock();
	166	might_sleep();
	167
db4d1169	168	if (!key \|\| !key->local->ops->set_key)
11a843b7 JB	169	return;
11a843b7 JB	170
3b96766f JB	171	spin_lock(&todo_lock);
	172	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
	173	spin_unlock(&todo_lock);
11a843b7	174	return;
3b96766f JB	175	}
3b96766f JB	176	spin_unlock(&todo_lock);
11a843b7 JB	177
	178	addr = get_mac_for_key(key);
	179
	180	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
	181	key->sdata->dev->dev_addr, addr,
	182	&key->conf);
	183
	184	if (ret)
	185	printk(KERN_ERR "mac80211-%s: failed to remove key "
0795af57	186	"(%d, %s) from hardware (%d)\n",
11a843b7	187	wiphy_name(key->local->hw.wiphy),
0795af57	188	key->conf.keyidx, print_mac(mac, addr), ret);
11a843b7	189
3b96766f JB	190	spin_lock(&todo_lock);
	191	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	192	spin_unlock(&todo_lock);
	193	}
	194
	195	static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
	196	int idx)
	197	{
	198	struct ieee80211_key *key = NULL;
	199
	200	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
	201	key = sdata->keys[idx];
	202
	203	rcu_assign_pointer(sdata->default_key, key);
	204
	205	if (key)
	206	add_todo(key, KEY_FLAG_TODO_DEFKEY);
	207	}
	208
	209	void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
	210	{
	211	unsigned long flags;
	212
b16bd15c	213	spin_lock_irqsave(&sdata->local->key_lock, flags);
3b96766f	214	__ieee80211_set_default_key(sdata, idx);
b16bd15c	215	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
3b96766f JB	216	}
	217
	218
	219	static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
	220	struct sta_info *sta,
	221	struct ieee80211_key *old,
	222	struct ieee80211_key *new)
	223	{
	224	int idx, defkey;
	225
	226	if (new)
	227	list_add(&new->list, &sdata->key_list);
	228
	229	if (sta) {
	230	rcu_assign_pointer(sta->key, new);
	231	} else {
	232	WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);
	233
	234	if (old)
	235	idx = old->conf.keyidx;
	236	else
	237	idx = new->conf.keyidx;
	238
	239	defkey = old && sdata->default_key == old;
	240
	241	if (defkey && !new)
	242	__ieee80211_set_default_key(sdata, -1);
	243
	244	rcu_assign_pointer(sdata->keys[idx], new);
	245	if (defkey && new)
	246	__ieee80211_set_default_key(sdata, new->conf.keyidx);
	247	}
	248
	249	if (old) {
	250	/*
	251	* We'll use an empty list to indicate that the key
	252	* has already been removed.
	253	*/
	254	list_del_init(&old->list);
	255	}
11a843b7 JB	256	}
11a843b7 JB	257
db4d1169	258	struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
11a843b7 JB	259	int idx,
	260	size_t key_len,
	261	const u8 *key_data)
1f5a7e47 JB	262	{
	263	struct ieee80211_key *key;
	264
d4e46a3d	265	BUG_ON(idx < 0 \|\| idx >= NUM_DEFAULT_KEYS);
11a843b7 JB	266
11a843b7 JB	267	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
1f5a7e47 JB	268	if (!key)
1f5a7e47 JB	269	return NULL;
11a843b7 JB	270
	271	/*
	272	* Default to software encryption; we'll later upload the
	273	* key to the hardware if possible.
	274	*/
11a843b7 JB	275	key->conf.flags = 0;
	276	key->flags = 0;
	277
	278	key->conf.alg = alg;
	279	key->conf.keyidx = idx;
	280	key->conf.keylen = key_len;
	281	memcpy(key->conf.key, key_data, key_len);
e4861829	282	INIT_LIST_HEAD(&key->list);
3b96766f	283	INIT_LIST_HEAD(&key->todo);
11a843b7	284
11a843b7 JB	285	if (alg == ALG_CCMP) {
	286	/*
	287	* Initialize AES key state here as an optimization so that
	288	* it does not need to be initialized for every packet.
	289	*/
	290	key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
	291	if (!key->u.ccmp.tfm) {
3b96766f	292	kfree(key);
11a843b7 JB	293	return NULL;
	294	}
	295	}
	296
db4d1169 JB	297	return key;
db4d1169 JB	298	}
11a843b7	299
db4d1169 JB	300	void ieee80211_key_link(struct ieee80211_key *key,
	301	struct ieee80211_sub_if_data *sdata,
	302	struct sta_info *sta)
	303	{
	304	struct ieee80211_key *old_key;
3b96766f	305	unsigned long flags;
db4d1169 JB	306	int idx;
db4d1169 JB	307
db4d1169 JB	308	BUG_ON(!sdata);
	309	BUG_ON(!key);
	310
	311	idx = key->conf.keyidx;
	312	key->local = sdata->local;
	313	key->sdata = sdata;
	314	key->sta = sta;
	315
11a843b7	316	if (sta) {
11a843b7 JB	317	/*
	318	* some hardware cannot handle TKIP with QoS, so
	319	* we indicate whether QoS could be in use.
	320	*/
	321	if (sta->flags & WLAN_STA_WME)
	322	key->conf.flags \|= IEEE80211_KEY_FLAG_WMM_STA;
	323	} else {
51fb61e7	324	if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
11a843b7 JB	325	struct sta_info *ap;
11a843b7 JB	326
3b96766f JB	327	/*
	328	* We're getting a sta pointer in,
	329	* so must be under RCU read lock.
	330	*/
d0709a65	331
11a843b7 JB	332	/* same here, the AP could be using QoS */
	333	ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
	334	if (ap) {
	335	if (ap->flags & WLAN_STA_WME)
	336	key->conf.flags \|=
	337	IEEE80211_KEY_FLAG_WMM_STA;
11a843b7 JB	338	}
11a843b7 JB	339	}
11a843b7 JB	340	}
11a843b7 JB	341
b16bd15c	342	spin_lock_irqsave(&sdata->local->key_lock, flags);
3b96766f	343
d4e46a3d	344	if (sta)
db4d1169	345	old_key = sta->key;
d4e46a3d	346	else
db4d1169 JB	347	old_key = sdata->keys[idx];
	348
	349	__ieee80211_key_replace(sdata, sta, old_key, key);
d4e46a3d	350
b16bd15c	351	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
3b96766f JB	352
	353	/* free old key later */
	354	add_todo(old_key, KEY_FLAG_TODO_DELETE);
db4d1169	355
3b96766f	356	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
e4861829	357	if (netif_running(sdata->dev))
3a245766	358	add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
1f5a7e47 JB	359	}
1f5a7e47 JB	360
3a245766	361	static void __ieee80211_key_free(struct ieee80211_key *key)
1f5a7e47	362	{
3b96766f JB	363	/*
	364	* Replace key with nothingness if it was ever used.
	365	*/
3a245766	366	if (key->sdata)
3b96766f JB	367	__ieee80211_key_replace(key->sdata, key->sta,
3b96766f JB	368	key, NULL);
11a843b7	369
3b96766f JB	370	add_todo(key, KEY_FLAG_TODO_DELETE);
3b96766f JB	371	}
d4e46a3d	372
3a245766	373	void ieee80211_key_free(struct ieee80211_key *key)
3b96766f	374	{
3a245766	375	unsigned long flags;
11a843b7	376
3a245766	377	if (!key)
3b96766f JB	378	return;
3b96766f JB	379
b16bd15c	380	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
3a245766	381	__ieee80211_key_free(key);
b16bd15c	382	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
3a245766 JB	383	}
	384
	385	/*
	386	* To be safe against concurrent manipulations of the list (which shouldn't
	387	* actually happen) we need to hold the spinlock. But under the spinlock we
	388	* can't actually do much, so we defer processing to the todo list. Then run
	389	* the todo list to be sure the operation and possibly previously pending
	390	* operations are completed.
	391	*/
	392	static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
	393	u32 todo_flags)
	394	{
	395	struct ieee80211_key *key;
	396	unsigned long flags;
3b96766f	397
3a245766 JB	398	might_sleep();
3a245766 JB	399
b16bd15c	400	spin_lock_irqsave(&sdata->local->key_lock, flags);
3b96766f	401	list_for_each_entry(key, &sdata->key_list, list)
3a245766	402	add_todo(key, todo_flags);
b16bd15c	403	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
3b96766f	404
3a245766	405	ieee80211_key_todo();
1f5a7e47	406	}
11a843b7	407
3a245766	408	void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
11a843b7	409	{
3a245766	410	ASSERT_RTNL();
11a843b7	411
3a245766 JB	412	if (WARN_ON(!netif_running(sdata->dev)))
3a245766 JB	413	return;
11a843b7	414
3a245766 JB	415	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
3a245766 JB	416	}
11a843b7	417
3a245766 JB	418	void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
	419	{
	420	ASSERT_RTNL();
11a843b7	421
3a245766	422	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
11a843b7 JB	423	}
11a843b7 JB	424
3a245766	425	static void __ieee80211_key_destroy(struct ieee80211_key *key)
11a843b7	426	{
3b96766f JB	427	if (!key)
3b96766f JB	428	return;
db4d1169	429
3b96766f	430	ieee80211_key_disable_hw_accel(key);
11a843b7	431
3b96766f JB	432	if (key->conf.alg == ALG_CCMP)
	433	ieee80211_aes_key_free(key->u.ccmp.tfm);
	434	ieee80211_debugfs_key_remove(key);
	435
	436	kfree(key);
11a843b7 JB	437	}
11a843b7 JB	438
3b96766f	439	static void __ieee80211_key_todo(void)
11a843b7 JB	440	{
11a843b7 JB	441	struct ieee80211_key *key;
3b96766f JB	442	bool work_done;
3b96766f JB	443	u32 todoflags;
11a843b7	444
3b96766f JB	445	/*
	446	* NB: sta_info_destroy relies on this!
	447	*/
	448	synchronize_rcu();
	449
	450	spin_lock(&todo_lock);
	451	while (!list_empty(&todo_list)) {
	452	key = list_first_entry(&todo_list, struct ieee80211_key, todo);
	453	list_del_init(&key->todo);
	454	todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS \|
	455	KEY_FLAG_TODO_DEFKEY \|
3a245766 JB	456	KEY_FLAG_TODO_HWACCEL_ADD \|
3a245766 JB	457	KEY_FLAG_TODO_HWACCEL_REMOVE \|
3b96766f JB	458	KEY_FLAG_TODO_DELETE);
	459	key->flags &= ~todoflags;
	460	spin_unlock(&todo_lock);
	461
	462	work_done = false;
	463
	464	if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
	465	ieee80211_debugfs_key_add(key);
	466	work_done = true;
	467	}
	468	if (todoflags & KEY_FLAG_TODO_DEFKEY) {
	469	ieee80211_debugfs_key_remove_default(key->sdata);
	470	ieee80211_debugfs_key_add_default(key->sdata);
	471	work_done = true;
	472	}
3a245766	473	if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
3b96766f JB	474	ieee80211_key_enable_hw_accel(key);
	475	work_done = true;
	476	}
3a245766 JB	477	if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
	478	ieee80211_key_disable_hw_accel(key);
	479	work_done = true;
	480	}
3b96766f	481	if (todoflags & KEY_FLAG_TODO_DELETE) {
3a245766	482	__ieee80211_key_destroy(key);
3b96766f JB	483	work_done = true;
3b96766f JB	484	}
db4d1169	485
3b96766f	486	WARN_ON(!work_done);
11a843b7	487
3b96766f JB	488	spin_lock(&todo_lock);
	489	}
	490	spin_unlock(&todo_lock);
11a843b7 JB	491	}
11a843b7 JB	492
3b96766f	493	void ieee80211_key_todo(void)
11a843b7	494	{
3b96766f JB	495	ieee80211_key_lock();
	496	__ieee80211_key_todo();
	497	ieee80211_key_unlock();
	498	}
11a843b7	499
3b96766f JB	500	void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
	501	{
	502	struct ieee80211_key key, tmp;
3a245766	503	unsigned long flags;
db4d1169	504
3b96766f JB	505	ieee80211_key_lock();
	506
	507	ieee80211_debugfs_key_remove_default(sdata);
	508
b16bd15c	509	spin_lock_irqsave(&sdata->local->key_lock, flags);
3b96766f	510	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
3a245766	511	__ieee80211_key_free(key);
b16bd15c	512	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
3b96766f JB	513
	514	__ieee80211_key_todo();
	515
	516	ieee80211_key_unlock();
11a843b7	517	}