git.oblomov.eu Git - linux-2.6/blob - net/mac80211/ieee80211_sta.c

   1 /*
   2  * BSS client mode implementation
   3  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   4  * Copyright 2004, Instant802 Networks, Inc.
   5  * Copyright 2005, Devicescape Software, Inc.
   6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 /* TODO:
  15  * order BSS list by RSSI(?) ("quality of AP")
  16  * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
  17  *    SSID)
  18  */
  19 #include <linux/delay.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/wireless.h>
  25 #include <linux/random.h>
  26 #include <linux/etherdevice.h>
  27 #include <net/iw_handler.h>
  28 #include <asm/types.h>
  29
  30 #include <net/mac80211.h>
  31 #include "ieee80211_i.h"
  32 #include "ieee80211_rate.h"
  33 #include "ieee80211_led.h"
  34 #include "mesh.h"
  35
  36 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
  37 #define IEEE80211_AUTH_MAX_TRIES 3
  38 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
  39 #define IEEE80211_ASSOC_MAX_TRIES 3
  40 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
  41 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
  42 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
  43 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
  44 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
  45 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
  46 #define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
  47
  48 #define IEEE80211_PROBE_DELAY (HZ / 33)
  49 #define IEEE80211_CHANNEL_TIME (HZ / 33)
  50 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
  51 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
  52 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
  53 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
  54 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
  55
  56 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  57
  58
  59 #define IEEE80211_FC(type, stype) cpu_to_le16(type | stype)
  60
  61 #define ERP_INFO_USE_PROTECTION BIT(1)
  62
  63 /* mgmt header + 1 byte action code */
  64 #define IEEE80211_MIN_ACTION_SIZE (24 + 1)
  65
  66 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
  67 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
  68 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
  69 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
  70 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
  71
  72 /* next values represent the buffer size for A-MPDU frame.
  73  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
  74 #define IEEE80211_MIN_AMPDU_BUF 0x8
  75 #define IEEE80211_MAX_AMPDU_BUF 0x40
  76
  77 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
  78                                      u8 *ssid, size_t ssid_len);
  79 static struct ieee80211_sta_bss *
  80 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
  81                      u8 *ssid, u8 ssid_len);
  82 static void ieee80211_rx_bss_put(struct net_device *dev,
  83                                  struct ieee80211_sta_bss *bss);
  84 static int ieee80211_sta_find_ibss(struct net_device *dev,
  85                                    struct ieee80211_if_sta *ifsta);
  86 static int ieee80211_sta_wep_configured(struct net_device *dev);
  87 static int ieee80211_sta_start_scan(struct net_device *dev,
  88                                     u8 *ssid, size_t ssid_len);
  89 static int ieee80211_sta_config_auth(struct net_device *dev,
  90                                      struct ieee80211_if_sta *ifsta);
  91
  92
  93 void ieee802_11_parse_elems(u8 *start, size_t len,
  94                             struct ieee802_11_elems *elems)
  95 {
  96         size_t left = len;
  97         u8 *pos = start;
  98
  99         memset(elems, 0, sizeof(*elems));
 100
 101         while (left >= 2) {
 102                 u8 id, elen;
 103
 104                 id = *pos++;
 105                 elen = *pos++;
 106                 left -= 2;
 107
 108                 if (elen > left)
 109                         return;
 110
 111                 switch (id) {
 112                 case WLAN_EID_SSID:
 113                         elems->ssid = pos;
 114                         elems->ssid_len = elen;
 115                         break;
 116                 case WLAN_EID_SUPP_RATES:
 117                         elems->supp_rates = pos;
 118                         elems->supp_rates_len = elen;
 119                         break;
 120                 case WLAN_EID_FH_PARAMS:
 121                         elems->fh_params = pos;
 122                         elems->fh_params_len = elen;
 123                         break;
 124                 case WLAN_EID_DS_PARAMS:
 125                         elems->ds_params = pos;
 126                         elems->ds_params_len = elen;
 127                         break;
 128                 case WLAN_EID_CF_PARAMS:
 129                         elems->cf_params = pos;
 130                         elems->cf_params_len = elen;
 131                         break;
 132                 case WLAN_EID_TIM:
 133                         elems->tim = pos;
 134                         elems->tim_len = elen;
 135                         break;
 136                 case WLAN_EID_IBSS_PARAMS:
 137                         elems->ibss_params = pos;
 138                         elems->ibss_params_len = elen;
 139                         break;
 140                 case WLAN_EID_CHALLENGE:
 141                         elems->challenge = pos;
 142                         elems->challenge_len = elen;
 143                         break;
 144                 case WLAN_EID_WPA:
 145                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 146                             pos[2] == 0xf2) {
 147                                 /* Microsoft OUI (00:50:F2) */
 148                                 if (pos[3] == 1) {
 149                                         /* OUI Type 1 - WPA IE */
 150                                         elems->wpa = pos;
 151                                         elems->wpa_len = elen;
 152                                 } else if (elen >= 5 && pos[3] == 2) {
 153                                         if (pos[4] == 0) {
 154                                                 elems->wmm_info = pos;
 155                                                 elems->wmm_info_len = elen;
 156                                         } else if (pos[4] == 1) {
 157                                                 elems->wmm_param = pos;
 158                                                 elems->wmm_param_len = elen;
 159                                         }
 160                                 }
 161                         }
 162                         break;
 163                 case WLAN_EID_RSN:
 164                         elems->rsn = pos;
 165                         elems->rsn_len = elen;
 166                         break;
 167                 case WLAN_EID_ERP_INFO:
 168                         elems->erp_info = pos;
 169                         elems->erp_info_len = elen;
 170                         break;
 171                 case WLAN_EID_EXT_SUPP_RATES:
 172                         elems->ext_supp_rates = pos;
 173                         elems->ext_supp_rates_len = elen;
 174                         break;
 175                 case WLAN_EID_HT_CAPABILITY:
 176                         elems->ht_cap_elem = pos;
 177                         elems->ht_cap_elem_len = elen;
 178                         break;
 179                 case WLAN_EID_HT_EXTRA_INFO:
 180                         elems->ht_info_elem = pos;
 181                         elems->ht_info_elem_len = elen;
 182                         break;
 183                 case WLAN_EID_MESH_ID:
 184                         elems->mesh_id = pos;
 185                         elems->mesh_id_len = elen;
 186                         break;
 187                 case WLAN_EID_MESH_CONFIG:
 188                         elems->mesh_config = pos;
 189                         elems->mesh_config_len = elen;
 190                         break;
 191                 case WLAN_EID_PEER_LINK:
 192                         elems->peer_link = pos;
 193                         elems->peer_link_len = elen;
 194                         break;
 195                 case WLAN_EID_PREQ:
 196                         elems->preq = pos;
 197                         elems->preq_len = elen;
 198                         break;
 199                 case WLAN_EID_PREP:
 200                         elems->prep = pos;
 201                         elems->prep_len = elen;
 202                         break;
 203                 case WLAN_EID_PERR:
 204                         elems->perr = pos;
 205                         elems->perr_len = elen;
 206                         break;
 207                 default:
 208                         break;
 209                 }
 210
 211                 left -= elen;
 212                 pos += elen;
 213         }
 214 }
 215
 216
 217 static int ecw2cw(int ecw)
 218 {
 219         return (1 << ecw) - 1;
 220 }
 221
 222 static void ieee80211_sta_wmm_params(struct net_device *dev,
 223                                      struct ieee80211_if_sta *ifsta,
 224                                      u8 *wmm_param, size_t wmm_param_len)
 225 {
 226         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 227         struct ieee80211_tx_queue_params params;
 228         size_t left;
 229         int count;
 230         u8 *pos;
 231
 232         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 233                 return;
 234         count = wmm_param[6] & 0x0f;
 235         if (count == ifsta->wmm_last_param_set)
 236                 return;
 237         ifsta->wmm_last_param_set = count;
 238
 239         pos = wmm_param + 8;
 240         left = wmm_param_len - 8;
 241
 242         memset(&params, 0, sizeof(params));
 243
 244         if (!local->ops->conf_tx)
 245                 return;
 246
 247         local->wmm_acm = 0;
 248         for (; left >= 4; left -= 4, pos += 4) {
 249                 int aci = (pos[0] >> 5) & 0x03;
 250                 int acm = (pos[0] >> 4) & 0x01;
 251                 int queue;
 252
 253                 switch (aci) {
 254                 case 1:
 255                         queue = IEEE80211_TX_QUEUE_DATA3;
 256                         if (acm) {
 257                                 local->wmm_acm |= BIT(0) | BIT(3);
 258                         }
 259                         break;
 260                 case 2:
 261                         queue = IEEE80211_TX_QUEUE_DATA1;
 262                         if (acm) {
 263                                 local->wmm_acm |= BIT(4) | BIT(5);
 264                         }
 265                         break;
 266                 case 3:
 267                         queue = IEEE80211_TX_QUEUE_DATA0;
 268                         if (acm) {
 269                                 local->wmm_acm |= BIT(6) | BIT(7);
 270                         }
 271                         break;
 272                 case 0:
 273                 default:
 274                         queue = IEEE80211_TX_QUEUE_DATA2;
 275                         if (acm) {
 276                                 local->wmm_acm |= BIT(1) | BIT(2);
 277                         }
 278                         break;
 279                 }
 280
 281                 params.aifs = pos[0] & 0x0f;
 282                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 283                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 284                 params.txop = pos[2] | (pos[3] << 8);
 285 #ifdef CONFIG_MAC80211_DEBUG
 286                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
 287                        "cWmin=%d cWmax=%d txop=%d\n",
 288                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
 289                        params.cw_max, params.txop);
 290 #endif
 291                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 292                  * AC for now) */
 293                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
 294                         printk(KERN_DEBUG "%s: failed to set TX queue "
 295                                "parameters for queue %d\n", dev->name, queue);
 296                 }
 297         }
 298 }
 299
 300
 301 static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
 302                                    u8 erp_value)
 303 {
 304         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
 305         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 306         bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
 307         bool preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
 308         DECLARE_MAC_BUF(mac);
 309         u32 changed = 0;
 310
 311         if (use_protection != bss_conf->use_cts_prot) {
 312                 if (net_ratelimit()) {
 313                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
 314                                "%s)\n",
 315                                sdata->dev->name,
 316                                use_protection ? "enabled" : "disabled",
 317                                print_mac(mac, ifsta->bssid));
 318                 }
 319                 bss_conf->use_cts_prot = use_protection;
 320                 changed |= BSS_CHANGED_ERP_CTS_PROT;
 321         }
 322
 323         if (preamble_mode != bss_conf->use_short_preamble) {
 324                 if (net_ratelimit()) {
 325                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
 326                                " (BSSID=%s)\n",
 327                                sdata->dev->name,
 328                                (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
 329                                         "short" : "long",
 330                                print_mac(mac, ifsta->bssid));
 331                 }
 332                 bss_conf->use_short_preamble = preamble_mode;
 333                 changed |= BSS_CHANGED_ERP_PREAMBLE;
 334         }
 335
 336         return changed;
 337 }
 338
 339 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 340                                    struct ieee80211_ht_info *ht_info)
 341 {
 342
 343         if (ht_info == NULL)
 344                 return -EINVAL;
 345
 346         memset(ht_info, 0, sizeof(*ht_info));
 347
 348         if (ht_cap_ie) {
 349                 u8 ampdu_info = ht_cap_ie->ampdu_params_info;
 350
 351                 ht_info->ht_supported = 1;
 352                 ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
 353                 ht_info->ampdu_factor =
 354                         ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
 355                 ht_info->ampdu_density =
 356                         (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
 357                 memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
 358         } else
 359                 ht_info->ht_supported = 0;
 360
 361         return 0;
 362 }
 363
 364 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 365                         struct ieee80211_ht_addt_info *ht_add_info_ie,
 366                         struct ieee80211_ht_bss_info *bss_info)
 367 {
 368         if (bss_info == NULL)
 369                 return -EINVAL;
 370
 371         memset(bss_info, 0, sizeof(*bss_info));
 372
 373         if (ht_add_info_ie) {
 374                 u16 op_mode;
 375                 op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
 376
 377                 bss_info->primary_channel = ht_add_info_ie->control_chan;
 378                 bss_info->bss_cap = ht_add_info_ie->ht_param;
 379                 bss_info->bss_op_mode = (u8)(op_mode & 0xff);
 380         }
 381
 382         return 0;
 383 }
 384
 385 static void ieee80211_sta_send_associnfo(struct net_device *dev,
 386                                          struct ieee80211_if_sta *ifsta)
 387 {
 388         char *buf;
 389         size_t len;
 390         int i;
 391         union iwreq_data wrqu;
 392
 393         if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
 394                 return;
 395
 396         buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
 397                                 ifsta->assocresp_ies_len), GFP_KERNEL);
 398         if (!buf)
 399                 return;
 400
 401         len = sprintf(buf, "ASSOCINFO(");
 402         if (ifsta->assocreq_ies) {
 403                 len += sprintf(buf + len, "ReqIEs=");
 404                 for (i = 0; i < ifsta->assocreq_ies_len; i++) {
 405                         len += sprintf(buf + len, "%02x",
 406                                        ifsta->assocreq_ies[i]);
 407                 }
 408         }
 409         if (ifsta->assocresp_ies) {
 410                 if (ifsta->assocreq_ies)
 411                         len += sprintf(buf + len, " ");
 412                 len += sprintf(buf + len, "RespIEs=");
 413                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 414                         len += sprintf(buf + len, "%02x",
 415                                        ifsta->assocresp_ies[i]);
 416                 }
 417         }
 418         len += sprintf(buf + len, ")");
 419
 420         if (len > IW_CUSTOM_MAX) {
 421                 len = sprintf(buf, "ASSOCRESPIE=");
 422                 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
 423                         len += sprintf(buf + len, "%02x",
 424                                        ifsta->assocresp_ies[i]);
 425                 }
 426         }
 427
 428         memset(&wrqu, 0, sizeof(wrqu));
 429         wrqu.data.length = len;
 430         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 431
 432         kfree(buf);
 433 }
 434
 435
 436 static void ieee80211_set_associated(struct net_device *dev,
 437                                      struct ieee80211_if_sta *ifsta,
 438                                      bool assoc)
 439 {
 440         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 441         struct ieee80211_local *local = sdata->local;
 442         union iwreq_data wrqu;
 443         u32 changed = BSS_CHANGED_ASSOC;
 444
 445         if (assoc) {
 446                 struct ieee80211_sta_bss *bss;
 447
 448                 ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 449
 450                 if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
 451                         return;
 452
 453                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 454                                            local->hw.conf.channel->center_freq,
 455                                            ifsta->ssid, ifsta->ssid_len);
 456                 if (bss) {
 457                         if (bss->has_erp_value)
 458                                 changed |= ieee80211_handle_erp_ie(
 459                                                 sdata, bss->erp_value);
 460                         ieee80211_rx_bss_put(dev, bss);
 461                 }
 462
 463                 netif_carrier_on(dev);
 464                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
 465                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
 466                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
 467                 ieee80211_sta_send_associnfo(dev, ifsta);
 468         } else {
 469                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
 470
 471                 netif_carrier_off(dev);
 472                 ieee80211_reset_erp_info(dev);
 473                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 474         }
 475         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 476         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 477         ifsta->last_probe = jiffies;
 478         ieee80211_led_assoc(local, assoc);
 479
 480         sdata->bss_conf.assoc = assoc;
 481         ieee80211_bss_info_change_notify(sdata, changed);
 482 }
 483
 484 static void ieee80211_set_disassoc(struct net_device *dev,
 485                                    struct ieee80211_if_sta *ifsta, int deauth)
 486 {
 487         if (deauth)
 488                 ifsta->auth_tries = 0;
 489         ifsta->assoc_tries = 0;
 490         ieee80211_set_associated(dev, ifsta, 0);
 491 }
 492
 493 void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
 494                       int encrypt)
 495 {
 496         struct ieee80211_sub_if_data *sdata;
 497         struct ieee80211_tx_packet_data *pkt_data;
 498
 499         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 500         skb->dev = sdata->local->mdev;
 501         skb_set_mac_header(skb, 0);
 502         skb_set_network_header(skb, 0);
 503         skb_set_transport_header(skb, 0);
 504
 505         pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
 506         memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
 507         pkt_data->ifindex = sdata->dev->ifindex;
 508         if (!encrypt)
 509                 pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
 510
 511         dev_queue_xmit(skb);
 512 }
 513
 514
 515 static void ieee80211_send_auth(struct net_device *dev,
 516                                 struct ieee80211_if_sta *ifsta,
 517                                 int transaction, u8 *extra, size_t extra_len,
 518                                 int encrypt)
 519 {
 520         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 521         struct sk_buff *skb;
 522         struct ieee80211_mgmt *mgmt;
 523
 524         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 525                             sizeof(*mgmt) + 6 + extra_len);
 526         if (!skb) {
 527                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
 528                        "frame\n", dev->name);
 529                 return;
 530         }
 531         skb_reserve(skb, local->hw.extra_tx_headroom);
 532
 533         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
 534         memset(mgmt, 0, 24 + 6);
 535         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 536                                            IEEE80211_STYPE_AUTH);
 537         if (encrypt)
 538                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 539         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 540         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 541         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 542         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
 543         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
 544         ifsta->auth_transaction = transaction + 1;
 545         mgmt->u.auth.status_code = cpu_to_le16(0);
 546         if (extra)
 547                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 548
 549         ieee80211_sta_tx(dev, skb, encrypt);
 550 }
 551
 552
 553 static void ieee80211_authenticate(struct net_device *dev,
 554                                    struct ieee80211_if_sta *ifsta)
 555 {
 556         DECLARE_MAC_BUF(mac);
 557
 558         ifsta->auth_tries++;
 559         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 560                 printk(KERN_DEBUG "%s: authentication with AP %s"
 561                        " timed out\n",
 562                        dev->name, print_mac(mac, ifsta->bssid));
 563                 ifsta->state = IEEE80211_DISABLED;
 564                 return;
 565         }
 566
 567         ifsta->state = IEEE80211_AUTHENTICATE;
 568         printk(KERN_DEBUG "%s: authenticate with AP %s\n",
 569                dev->name, print_mac(mac, ifsta->bssid));
 570
 571         ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
 572
 573         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 574 }
 575
 576
 577 static void ieee80211_send_assoc(struct net_device *dev,
 578                                  struct ieee80211_if_sta *ifsta)
 579 {
 580         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 581         struct sk_buff *skb;
 582         struct ieee80211_mgmt *mgmt;
 583         u8 *pos, *ies;
 584         int i, len;
 585         u16 capab;
 586         struct ieee80211_sta_bss *bss;
 587         int wmm = 0;
 588         struct ieee80211_supported_band *sband;
 589
 590         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
 591                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
 592                             ifsta->ssid_len);
 593         if (!skb) {
 594                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
 595                        "frame\n", dev->name);
 596                 return;
 597         }
 598         skb_reserve(skb, local->hw.extra_tx_headroom);
 599
 600         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 601
 602         capab = ifsta->capab;
 603
 604         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
 605                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
 606                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 607                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
 608                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 609         }
 610
 611         bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 612                                    local->hw.conf.channel->center_freq,
 613                                    ifsta->ssid, ifsta->ssid_len);
 614         if (bss) {
 615                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 616                         capab |= WLAN_CAPABILITY_PRIVACY;
 617                 if (bss->wmm_ie) {
 618                         wmm = 1;
 619                 }
 620                 ieee80211_rx_bss_put(dev, bss);
 621         }
 622
 623         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 624         memset(mgmt, 0, 24);
 625         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 626         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 627         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 628
 629         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
 630                 skb_put(skb, 10);
 631                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 632                                                    IEEE80211_STYPE_REASSOC_REQ);
 633                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
 634                 mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
 635                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
 636                        ETH_ALEN);
 637         } else {
 638                 skb_put(skb, 4);
 639                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 640                                                    IEEE80211_STYPE_ASSOC_REQ);
 641                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
 642                 mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
 643         }
 644
 645         /* SSID */
 646         ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
 647         *pos++ = WLAN_EID_SSID;
 648         *pos++ = ifsta->ssid_len;
 649         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 650
 651         len = sband->n_bitrates;
 652         if (len > 8)
 653                 len = 8;
 654         pos = skb_put(skb, len + 2);
 655         *pos++ = WLAN_EID_SUPP_RATES;
 656         *pos++ = len;
 657         for (i = 0; i < len; i++) {
 658                 int rate = sband->bitrates[i].bitrate;
 659                 *pos++ = (u8) (rate / 5);
 660         }
 661
 662         if (sband->n_bitrates > len) {
 663                 pos = skb_put(skb, sband->n_bitrates - len + 2);
 664                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 665                 *pos++ = sband->n_bitrates - len;
 666                 for (i = len; i < sband->n_bitrates; i++) {
 667                         int rate = sband->bitrates[i].bitrate;
 668                         *pos++ = (u8) (rate / 5);
 669                 }
 670         }
 671
 672         if (ifsta->extra_ie) {
 673                 pos = skb_put(skb, ifsta->extra_ie_len);
 674                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
 675         }
 676
 677         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
 678                 pos = skb_put(skb, 9);
 679                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 680                 *pos++ = 7; /* len */
 681                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 682                 *pos++ = 0x50;
 683                 *pos++ = 0xf2;
 684                 *pos++ = 2; /* WME */
 685                 *pos++ = 0; /* WME info */
 686                 *pos++ = 1; /* WME ver */
 687                 *pos++ = 0;
 688         }
 689         /* wmm support is a must to HT */
 690         if (wmm && sband->ht_info.ht_supported) {
 691                 __le16 tmp = cpu_to_le16(sband->ht_info.cap);
 692                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
 693                 *pos++ = WLAN_EID_HT_CAPABILITY;
 694                 *pos++ = sizeof(struct ieee80211_ht_cap);
 695                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
 696                 memcpy(pos, &tmp, sizeof(u16));
 697                 pos += sizeof(u16);
 698                 /* TODO: needs a define here for << 2 */
 699                 *pos++ = sband->ht_info.ampdu_factor |
 700                          (sband->ht_info.ampdu_density << 2);
 701                 memcpy(pos, sband->ht_info.supp_mcs_set, 16);
 702         }
 703
 704         kfree(ifsta->assocreq_ies);
 705         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
 706         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
 707         if (ifsta->assocreq_ies)
 708                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 709
 710         ieee80211_sta_tx(dev, skb, 0);
 711 }
 712
 713
 714 static void ieee80211_send_deauth(struct net_device *dev,
 715                                   struct ieee80211_if_sta *ifsta, u16 reason)
 716 {
 717         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 718         struct sk_buff *skb;
 719         struct ieee80211_mgmt *mgmt;
 720
 721         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 722         if (!skb) {
 723                 printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
 724                        "frame\n", dev->name);
 725                 return;
 726         }
 727         skb_reserve(skb, local->hw.extra_tx_headroom);
 728
 729         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 730         memset(mgmt, 0, 24);
 731         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 732         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 733         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 734         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 735                                            IEEE80211_STYPE_DEAUTH);
 736         skb_put(skb, 2);
 737         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 738
 739         ieee80211_sta_tx(dev, skb, 0);
 740 }
 741
 742
 743 static void ieee80211_send_disassoc(struct net_device *dev,
 744                                     struct ieee80211_if_sta *ifsta, u16 reason)
 745 {
 746         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 747         struct sk_buff *skb;
 748         struct ieee80211_mgmt *mgmt;
 749
 750         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
 751         if (!skb) {
 752                 printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
 753                        "frame\n", dev->name);
 754                 return;
 755         }
 756         skb_reserve(skb, local->hw.extra_tx_headroom);
 757
 758         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 759         memset(mgmt, 0, 24);
 760         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
 761         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 762         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 763         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 764                                            IEEE80211_STYPE_DISASSOC);
 765         skb_put(skb, 2);
 766         mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
 767
 768         ieee80211_sta_tx(dev, skb, 0);
 769 }
 770
 771
 772 static int ieee80211_privacy_mismatch(struct net_device *dev,
 773                                       struct ieee80211_if_sta *ifsta)
 774 {
 775         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 776         struct ieee80211_sta_bss *bss;
 777         int bss_privacy;
 778         int wep_privacy;
 779         int privacy_invoked;
 780
 781         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
 782                 return 0;
 783
 784         bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
 785                                    local->hw.conf.channel->center_freq,
 786                                    ifsta->ssid, ifsta->ssid_len);
 787         if (!bss)
 788                 return 0;
 789
 790         bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
 791         wep_privacy = !!ieee80211_sta_wep_configured(dev);
 792         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 793
 794         ieee80211_rx_bss_put(dev, bss);
 795
 796         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
 797                 return 0;
 798
 799         return 1;
 800 }
 801
 802
 803 static void ieee80211_associate(struct net_device *dev,
 804                                 struct ieee80211_if_sta *ifsta)
 805 {
 806         DECLARE_MAC_BUF(mac);
 807
 808         ifsta->assoc_tries++;
 809         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 810                 printk(KERN_DEBUG "%s: association with AP %s"
 811                        " timed out\n",
 812                        dev->name, print_mac(mac, ifsta->bssid));
 813                 ifsta->state = IEEE80211_DISABLED;
 814                 return;
 815         }
 816
 817         ifsta->state = IEEE80211_ASSOCIATE;
 818         printk(KERN_DEBUG "%s: associate with AP %s\n",
 819                dev->name, print_mac(mac, ifsta->bssid));
 820         if (ieee80211_privacy_mismatch(dev, ifsta)) {
 821                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
 822                        "mixed-cell disabled - abort association\n", dev->name);
 823                 ifsta->state = IEEE80211_DISABLED;
 824                 return;
 825         }
 826
 827         ieee80211_send_assoc(dev, ifsta);
 828
 829         mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 830 }
 831
 832
 833 static void ieee80211_associated(struct net_device *dev,
 834                                  struct ieee80211_if_sta *ifsta)
 835 {
 836         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 837         struct sta_info *sta;
 838         int disassoc;
 839         DECLARE_MAC_BUF(mac);
 840
 841         /* TODO: start monitoring current AP signal quality and number of
 842          * missed beacons. Scan other channels every now and then and search
 843          * for better APs. */
 844         /* TODO: remove expired BSSes */
 845
 846         ifsta->state = IEEE80211_ASSOCIATED;
 847
 848         sta = sta_info_get(local, ifsta->bssid);
 849         if (!sta) {
 850                 printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
 851                        dev->name, print_mac(mac, ifsta->bssid));
 852                 disassoc = 1;
 853         } else {
 854                 disassoc = 0;
 855                 if (time_after(jiffies,
 856                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 857                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
 858                                 printk(KERN_DEBUG "%s: No ProbeResp from "
 859                                        "current AP %s - assume out of "
 860                                        "range\n",
 861                                        dev->name, print_mac(mac, ifsta->bssid));
 862                                 disassoc = 1;
 863                                 sta_info_free(sta);
 864                         } else
 865                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 866                                                          local->scan_ssid,
 867                                                          local->scan_ssid_len);
 868                         ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
 869                 } else {
 870                         ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 871                         if (time_after(jiffies, ifsta->last_probe +
 872                                        IEEE80211_PROBE_INTERVAL)) {
 873                                 ifsta->last_probe = jiffies;
 874                                 ieee80211_send_probe_req(dev, ifsta->bssid,
 875                                                          ifsta->ssid,
 876                                                          ifsta->ssid_len);
 877                         }
 878                 }
 879                 sta_info_put(sta);
 880         }
 881         if (disassoc) {
 882                 ifsta->state = IEEE80211_DISABLED;
 883                 ieee80211_set_associated(dev, ifsta, 0);
 884         } else {
 885                 mod_timer(&ifsta->timer, jiffies +
 886                                       IEEE80211_MONITORING_INTERVAL);
 887         }
 888 }
 889
 890
 891 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 892                                      u8 *ssid, size_t ssid_len)
 893 {
 894         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 895         struct ieee80211_supported_band *sband;
 896         struct sk_buff *skb;
 897         struct ieee80211_mgmt *mgmt;
 898         u8 *pos, *supp_rates, *esupp_rates = NULL;
 899         int i;
 900
 901         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
 902         if (!skb) {
 903                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
 904                        "request\n", dev->name);
 905                 return;
 906         }
 907         skb_reserve(skb, local->hw.extra_tx_headroom);
 908
 909         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 910         memset(mgmt, 0, 24);
 911         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
 912                                            IEEE80211_STYPE_PROBE_REQ);
 913         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
 914         if (dst) {
 915                 memcpy(mgmt->da, dst, ETH_ALEN);
 916                 memcpy(mgmt->bssid, dst, ETH_ALEN);
 917         } else {
 918                 memset(mgmt->da, 0xff, ETH_ALEN);
 919                 memset(mgmt->bssid, 0xff, ETH_ALEN);
 920         }
 921         pos = skb_put(skb, 2 + ssid_len);
 922         *pos++ = WLAN_EID_SSID;
 923         *pos++ = ssid_len;
 924         memcpy(pos, ssid, ssid_len);
 925
 926         supp_rates = skb_put(skb, 2);
 927         supp_rates[0] = WLAN_EID_SUPP_RATES;
 928         supp_rates[1] = 0;
 929         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 930
 931         for (i = 0; i < sband->n_bitrates; i++) {
 932                 struct ieee80211_rate *rate = &sband->bitrates[i];
 933                 if (esupp_rates) {
 934                         pos = skb_put(skb, 1);
 935                         esupp_rates[1]++;
 936                 } else if (supp_rates[1] == 8) {
 937                         esupp_rates = skb_put(skb, 3);
 938                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 939                         esupp_rates[1] = 1;
 940                         pos = &esupp_rates[2];
 941                 } else {
 942                         pos = skb_put(skb, 1);
 943                         supp_rates[1]++;
 944                 }
 945                 *pos = rate->bitrate / 5;
 946         }
 947
 948         ieee80211_sta_tx(dev, skb, 0);
 949 }
 950
 951
 952 static int ieee80211_sta_wep_configured(struct net_device *dev)
 953 {
 954         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 955         if (!sdata || !sdata->default_key ||
 956             sdata->default_key->conf.alg != ALG_WEP)
 957                 return 0;
 958         return 1;
 959 }
 960
 961
 962 static void ieee80211_auth_completed(struct net_device *dev,
 963                                      struct ieee80211_if_sta *ifsta)
 964 {
 965         printk(KERN_DEBUG "%s: authenticated\n", dev->name);
 966         ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
 967         ieee80211_associate(dev, ifsta);
 968 }
 969
 970
 971 static void ieee80211_auth_challenge(struct net_device *dev,
 972                                      struct ieee80211_if_sta *ifsta,
 973                                      struct ieee80211_mgmt *mgmt,
 974                                      size_t len)
 975 {
 976         u8 *pos;
 977         struct ieee802_11_elems elems;
 978
 979         printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
 980         pos = mgmt->u.auth.variable;
 981         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 982         if (!elems.challenge) {
 983                 printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
 984                        "frame\n", dev->name);
 985                 return;
 986         }
 987         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
 988                             elems.challenge_len + 2, 1);
 989 }
 990
 991 static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
 992                                         u8 dialog_token, u16 status, u16 policy,
 993                                         u16 buf_size, u16 timeout)
 994 {
 995         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 996         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 997         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 998         struct sk_buff *skb;
 999         struct ieee80211_mgmt *mgmt;
1000         u16 capab;
1001
1002         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
1003                                         sizeof(mgmt->u.action.u.addba_resp));
1004         if (!skb) {
1005                 printk(KERN_DEBUG "%s: failed to allocate buffer "
1006                        "for addba resp frame\n", dev->name);
1007                 return;
1008         }
1009
1010         skb_reserve(skb, local->hw.extra_tx_headroom);
1011         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1012         memset(mgmt, 0, 24);
1013         memcpy(mgmt->da, da, ETH_ALEN);
1014         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1015         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1016                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1017         else
1018                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1019         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1020                                            IEEE80211_STYPE_ACTION);
1021
1022         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
1023         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1024         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
1025         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
1026
1027         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
1028         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1029         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
1030
1031         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
1032         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
1033         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
1034
1035         ieee80211_sta_tx(dev, skb, 0);
1036
1037         return;
1038 }
1039
1040 void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
1041                                 u16 tid, u8 dialog_token, u16 start_seq_num,
1042                                 u16 agg_size, u16 timeout)
1043 {
1044         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1045         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1046         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1047         struct sk_buff *skb;
1048         struct ieee80211_mgmt *mgmt;
1049         u16 capab;
1050
1051         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
1052                                 sizeof(mgmt->u.action.u.addba_req));
1053
1054
1055         if (!skb) {
1056                 printk(KERN_ERR "%s: failed to allocate buffer "
1057                                 "for addba request frame\n", dev->name);
1058                 return;
1059         }
1060         skb_reserve(skb, local->hw.extra_tx_headroom);
1061         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1062         memset(mgmt, 0, 24);
1063         memcpy(mgmt->da, da, ETH_ALEN);
1064         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1065         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1066                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1067         else
1068                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1069
1070         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1071                                         IEEE80211_STYPE_ACTION);
1072
1073         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
1074
1075         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1076         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
1077
1078         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
1079         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
1080         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
1081         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
1082
1083         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
1084
1085         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
1086         mgmt->u.action.u.addba_req.start_seq_num =
1087                                         cpu_to_le16(start_seq_num << 4);
1088
1089         ieee80211_sta_tx(dev, skb, 0);
1090 }
1091
1092 static void ieee80211_sta_process_addba_request(struct net_device *dev,
1093                                                 struct ieee80211_mgmt *mgmt,
1094                                                 size_t len)
1095 {
1096         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1097         struct ieee80211_hw *hw = &local->hw;
1098         struct ieee80211_conf *conf = &hw->conf;
1099         struct sta_info *sta;
1100         struct tid_ampdu_rx *tid_agg_rx;
1101         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
1102         u8 dialog_token;
1103         int ret = -EOPNOTSUPP;
1104         DECLARE_MAC_BUF(mac);
1105
1106         sta = sta_info_get(local, mgmt->sa);
1107         if (!sta)
1108                 return;
1109
1110         /* extract session parameters from addba request frame */
1111         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
1112         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
1113         start_seq_num =
1114                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
1115
1116         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1117         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
1118         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1119         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
1120
1121         status = WLAN_STATUS_REQUEST_DECLINED;
1122
1123         /* sanity check for incoming parameters:
1124          * check if configuration can support the BA policy
1125          * and if buffer size does not exceeds max value */
1126         if (((ba_policy != 1)
1127                 && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
1128                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
1129                 status = WLAN_STATUS_INVALID_QOS_PARAM;
1130 #ifdef CONFIG_MAC80211_HT_DEBUG
1131                 if (net_ratelimit())
1132                         printk(KERN_DEBUG "Block Ack Req with bad params from "
1133                                 "%s on tid %u. policy %d, buffer size %d\n",
1134                                 print_mac(mac, mgmt->sa), tid, ba_policy,
1135                                 buf_size);
1136 #endif /* CONFIG_MAC80211_HT_DEBUG */
1137                 goto end_no_lock;
1138         }
1139         /* determine default buffer size */
1140         if (buf_size == 0) {
1141                 struct ieee80211_supported_band *sband;
1142
1143                 sband = local->hw.wiphy->bands[conf->channel->band];
1144                 buf_size = IEEE80211_MIN_AMPDU_BUF;
1145                 buf_size = buf_size << sband->ht_info.ampdu_factor;
1146         }
1147
1148         tid_agg_rx = &sta->ampdu_mlme.tid_rx[tid];
1149
1150         /* examine state machine */
1151         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1152
1153         if (tid_agg_rx->state != HT_AGG_STATE_IDLE) {
1154 #ifdef CONFIG_MAC80211_HT_DEBUG
1155                 if (net_ratelimit())
1156                         printk(KERN_DEBUG "unexpected Block Ack Req from "
1157                                 "%s on tid %u\n",
1158                                 print_mac(mac, mgmt->sa), tid);
1159 #endif /* CONFIG_MAC80211_HT_DEBUG */
1160                 goto end;
1161         }
1162
1163         /* prepare reordering buffer */
1164         tid_agg_rx->reorder_buf =
1165                 kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
1166         if (!tid_agg_rx->reorder_buf) {
1167                 if (net_ratelimit())
1168                         printk(KERN_ERR "can not allocate reordering buffer "
1169                                "to tid %d\n", tid);
1170                 goto end;
1171         }
1172         memset(tid_agg_rx->reorder_buf, 0,
1173                 buf_size * sizeof(struct sk_buf *));
1174
1175         if (local->ops->ampdu_action)
1176                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
1177                                                sta->addr, tid, &start_seq_num);
1178 #ifdef CONFIG_MAC80211_HT_DEBUG
1179         printk(KERN_DEBUG "Rx A-MPDU on tid %d result %d", tid, ret);
1180 #endif /* CONFIG_MAC80211_HT_DEBUG */
1181
1182         if (ret) {
1183                 kfree(tid_agg_rx->reorder_buf);
1184                 goto end;
1185         }
1186
1187         /* change state and send addba resp */
1188         tid_agg_rx->state = HT_AGG_STATE_OPERATIONAL;
1189         tid_agg_rx->dialog_token = dialog_token;
1190         tid_agg_rx->ssn = start_seq_num;
1191         tid_agg_rx->head_seq_num = start_seq_num;
1192         tid_agg_rx->buf_size = buf_size;
1193         tid_agg_rx->timeout = timeout;
1194         tid_agg_rx->stored_mpdu_num = 0;
1195         status = WLAN_STATUS_SUCCESS;
1196 end:
1197         spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1198
1199 end_no_lock:
1200         ieee80211_send_addba_resp(sta->dev, sta->addr, tid, dialog_token,
1201                                 status, 1, buf_size, timeout);
1202         sta_info_put(sta);
1203 }
1204
1205 static void ieee80211_sta_process_addba_resp(struct net_device *dev,
1206                                              struct ieee80211_mgmt *mgmt,
1207                                              size_t len)
1208 {
1209         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1210         struct ieee80211_hw *hw = &local->hw;
1211         struct sta_info *sta;
1212         u16 capab;
1213         u16 tid;
1214         u8 *state;
1215
1216         sta = sta_info_get(local, mgmt->sa);
1217         if (!sta)
1218                 return;
1219
1220         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
1221         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1222
1223         state = &sta->ampdu_mlme.tid_tx[tid].state;
1224
1225         spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1226
1227         if (mgmt->u.action.u.addba_resp.dialog_token !=
1228                 sta->ampdu_mlme.tid_tx[tid].dialog_token) {
1229                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1230 #ifdef CONFIG_MAC80211_HT_DEBUG
1231                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1232 #endif /* CONFIG_MAC80211_HT_DEBUG */
1233                 sta_info_put(sta);
1234                 return;
1235         }
1236
1237         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid].addba_resp_timer);
1238 #ifdef CONFIG_MAC80211_HT_DEBUG
1239         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1240 #endif /* CONFIG_MAC80211_HT_DEBUG */
1241         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1242                         == WLAN_STATUS_SUCCESS) {
1243                 if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1244                         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1245                         printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
1246                                 "%d\n", *state);
1247                         sta_info_put(sta);
1248                         return;
1249                 }
1250
1251                 if (*state & HT_ADDBA_RECEIVED_MSK)
1252                         printk(KERN_DEBUG "double addBA response\n");
1253
1254                 *state |= HT_ADDBA_RECEIVED_MSK;
1255                 sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
1256
1257                 if (*state == HT_AGG_STATE_OPERATIONAL) {
1258                         printk(KERN_DEBUG "Aggregation on for tid %d \n", tid);
1259                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1260                 }
1261
1262                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1263                 printk(KERN_DEBUG "recipient accepted agg: tid %d \n", tid);
1264         } else {
1265                 printk(KERN_DEBUG "recipient rejected agg: tid %d \n", tid);
1266
1267                 sta->ampdu_mlme.tid_tx[tid].addba_req_num++;
1268                 /* this will allow the state check in stop_BA_session */
1269                 *state = HT_AGG_STATE_OPERATIONAL;
1270                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1271                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
1272                                              WLAN_BACK_INITIATOR);
1273         }
1274         sta_info_put(sta);
1275 }
1276
1277 void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
1278                           u16 initiator, u16 reason_code)
1279 {
1280         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1281         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1282         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1283         struct sk_buff *skb;
1284         struct ieee80211_mgmt *mgmt;
1285         u16 params;
1286
1287         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
1288                                         sizeof(mgmt->u.action.u.delba));
1289
1290         if (!skb) {
1291                 printk(KERN_ERR "%s: failed to allocate buffer "
1292                                         "for delba frame\n", dev->name);
1293                 return;
1294         }
1295
1296         skb_reserve(skb, local->hw.extra_tx_headroom);
1297         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
1298         memset(mgmt, 0, 24);
1299         memcpy(mgmt->da, da, ETH_ALEN);
1300         memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
1301         if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
1302                 memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
1303         else
1304                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
1305         mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
1306                                         IEEE80211_STYPE_ACTION);
1307
1308         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
1309
1310         mgmt->u.action.category = WLAN_CATEGORY_BACK;
1311         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
1312         params = (u16)(initiator << 11);        /* bit 11 initiator */
1313         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
1314
1315         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1316         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1317
1318         ieee80211_sta_tx(dev, skb, 0);
1319 }
1320
1321 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
1322                                         u16 initiator, u16 reason)
1323 {
1324         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1325         struct ieee80211_hw *hw = &local->hw;
1326         struct sta_info *sta;
1327         int ret, i;
1328
1329         sta = sta_info_get(local, ra);
1330         if (!sta)
1331                 return;
1332
1333         /* check if TID is in operational state */
1334         spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
1335         if (sta->ampdu_mlme.tid_rx[tid].state
1336                                 != HT_AGG_STATE_OPERATIONAL) {
1337                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1338                 sta_info_put(sta);
1339                 return;
1340         }
1341         sta->ampdu_mlme.tid_rx[tid].state =
1342                 HT_AGG_STATE_REQ_STOP_BA_MSK |
1343                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
1344                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
1345
1346         /* stop HW Rx aggregation. ampdu_action existence
1347          * already verified in session init so we add the BUG_ON */
1348         BUG_ON(!local->ops->ampdu_action);
1349
1350         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
1351                                         ra, tid, NULL);
1352         if (ret)
1353                 printk(KERN_DEBUG "HW problem - can not stop rx "
1354                                 "aggergation for tid %d\n", tid);
1355
1356         /* shutdown timer has not expired */
1357         if (initiator != WLAN_BACK_TIMER)
1358                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid].
1359                                         session_timer);
1360
1361         /* check if this is a self generated aggregation halt */
1362         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
1363                 ieee80211_send_delba(dev, ra, tid, 0, reason);
1364
1365         /* free the reordering buffer */
1366         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid].buf_size; i++) {
1367                 if (sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]) {
1368                         /* release the reordered frames */
1369                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]);
1370                         sta->ampdu_mlme.tid_rx[tid].stored_mpdu_num--;
1371                         sta->ampdu_mlme.tid_rx[tid].reorder_buf[i] = NULL;
1372                 }
1373         }
1374         kfree(sta->ampdu_mlme.tid_rx[tid].reorder_buf);
1375
1376         sta->ampdu_mlme.tid_rx[tid].state = HT_AGG_STATE_IDLE;
1377         sta_info_put(sta);
1378 }
1379
1380
1381 static void ieee80211_sta_process_delba(struct net_device *dev,
1382                         struct ieee80211_mgmt *mgmt, size_t len)
1383 {
1384         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1385         struct sta_info *sta;
1386         u16 tid, params;
1387         u16 initiator;
1388         DECLARE_MAC_BUF(mac);
1389
1390         sta = sta_info_get(local, mgmt->sa);
1391         if (!sta)
1392                 return;
1393
1394         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1395         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1396         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1397
1398 #ifdef CONFIG_MAC80211_HT_DEBUG
1399         if (net_ratelimit())
1400                 printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
1401                         print_mac(mac, mgmt->sa),
1402                         initiator ? "recipient" : "initiator", tid,
1403                         mgmt->u.action.u.delba.reason_code);
1404 #endif /* CONFIG_MAC80211_HT_DEBUG */
1405
1406         if (initiator == WLAN_BACK_INITIATOR)
1407                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
1408                                                  WLAN_BACK_INITIATOR, 0);
1409         else { /* WLAN_BACK_RECIPIENT */
1410                 spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1411                 sta->ampdu_mlme.tid_tx[tid].state =
1412                                 HT_AGG_STATE_OPERATIONAL;
1413                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1414                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
1415                                              WLAN_BACK_RECIPIENT);
1416         }
1417         sta_info_put(sta);
1418 }
1419
1420 /*
1421  * After sending add Block Ack request we activated a timer until
1422  * add Block Ack response will arrive from the recipient.
1423  * If this timer expires sta_addba_resp_timer_expired will be executed.
1424  */
1425 void sta_addba_resp_timer_expired(unsigned long data)
1426 {
1427         /* not an elegant detour, but there is no choice as the timer passes
1428          * only one argument, and both sta_info and TID are needed, so init
1429          * flow in sta_info_add gives the TID as data, while the timer_to_id
1430          * array gives the sta through container_of */
1431         u16 tid = *(int *)data;
1432         struct sta_info *temp_sta = container_of((void *)data,
1433                 struct sta_info, timer_to_tid[tid]);
1434
1435         struct ieee80211_local *local = temp_sta->local;
1436         struct ieee80211_hw *hw = &local->hw;
1437         struct sta_info *sta;
1438         u8 *state;
1439
1440         sta = sta_info_get(local, temp_sta->addr);
1441         if (!sta)
1442                 return;
1443
1444         state = &sta->ampdu_mlme.tid_tx[tid].state;
1445         /* check if the TID waits for addBA response */
1446         spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
1447         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
1448                 spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1449                 *state = HT_AGG_STATE_IDLE;
1450                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
1451                                 "expecting addBA response there", tid);
1452                 goto timer_expired_exit;
1453         }
1454
1455         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
1456
1457         /* go through the state check in stop_BA_session */
1458         *state = HT_AGG_STATE_OPERATIONAL;
1459         spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
1460         ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
1461                                      WLAN_BACK_INITIATOR);
1462
1463 timer_expired_exit:
1464         sta_info_put(sta);
1465 }
1466
1467 /*
1468  * After receiving Block Ack Request (BAR) we activated a
1469  * timer after each frame arrives from the originator.
1470  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
1471  */
1472 void sta_rx_agg_session_timer_expired(unsigned long data)
1473 {
1474         /* not an elegant detour, but there is no choice as the timer passes
1475          * only one argument, and verious sta_info are needed here, so init
1476          * flow in sta_info_add gives the TID as data, while the timer_to_id
1477          * array gives the sta through container_of */
1478         u8 *ptid = (u8 *)data;
1479         u8 *timer_to_id = ptid - *ptid;
1480         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
1481                                          timer_to_tid[0]);
1482
1483         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
1484         ieee80211_sta_stop_rx_ba_session(sta->dev, sta->addr, (u16)*ptid,
1485                                          WLAN_BACK_TIMER,
1486                                          WLAN_REASON_QSTA_TIMEOUT);
1487 }
1488
1489
1490 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
1491                                    struct ieee80211_if_sta *ifsta,
1492                                    struct ieee80211_mgmt *mgmt,
1493                                    size_t len)
1494 {
1495         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1496         u16 auth_alg, auth_transaction, status_code;
1497         DECLARE_MAC_BUF(mac);
1498
1499         if (ifsta->state != IEEE80211_AUTHENTICATE &&
1500             sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1501                 printk(KERN_DEBUG "%s: authentication frame received from "
1502                        "%s, but not in authenticate state - ignored\n",
1503                        dev->name, print_mac(mac, mgmt->sa));
1504                 return;
1505         }
1506
1507         if (len < 24 + 6) {
1508                 printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
1509                        "received from %s - ignored\n",
1510                        dev->name, len, print_mac(mac, mgmt->sa));
1511                 return;
1512         }
1513
1514         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1515             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1516                 printk(KERN_DEBUG "%s: authentication frame received from "
1517                        "unknown AP (SA=%s BSSID=%s) - "
1518                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1519                        print_mac(mac, mgmt->bssid));
1520                 return;
1521         }
1522
1523         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
1524             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
1525                 printk(KERN_DEBUG "%s: authentication frame received from "
1526                        "unknown BSSID (SA=%s BSSID=%s) - "
1527                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1528                        print_mac(mac, mgmt->bssid));
1529                 return;
1530         }
1531
1532         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1533         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1534         status_code = le16_to_cpu(mgmt->u.auth.status_code);
1535
1536         printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
1537                "transaction=%d status=%d)\n",
1538                dev->name, print_mac(mac, mgmt->sa), auth_alg,
1539                auth_transaction, status_code);
1540
1541         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
1542                 /* IEEE 802.11 standard does not require authentication in IBSS
1543                  * networks and most implementations do not seem to use it.
1544                  * However, try to reply to authentication attempts if someone
1545                  * has actually implemented this.
1546                  * TODO: Could implement shared key authentication. */
1547                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
1548                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
1549                                "frame (alg=%d transaction=%d)\n",
1550                                dev->name, auth_alg, auth_transaction);
1551                         return;
1552                 }
1553                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
1554         }
1555
1556         if (auth_alg != ifsta->auth_alg ||
1557             auth_transaction != ifsta->auth_transaction) {
1558                 printk(KERN_DEBUG "%s: unexpected authentication frame "
1559                        "(alg=%d transaction=%d)\n",
1560                        dev->name, auth_alg, auth_transaction);
1561                 return;
1562         }
1563
1564         if (status_code != WLAN_STATUS_SUCCESS) {
1565                 printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
1566                        "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
1567                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1568                         u8 algs[3];
1569                         const int num_algs = ARRAY_SIZE(algs);
1570                         int i, pos;
1571                         algs[0] = algs[1] = algs[2] = 0xff;
1572                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
1573                                 algs[0] = WLAN_AUTH_OPEN;
1574                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
1575                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1576                         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
1577                                 algs[2] = WLAN_AUTH_LEAP;
1578                         if (ifsta->auth_alg == WLAN_AUTH_OPEN)
1579                                 pos = 0;
1580                         else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
1581                                 pos = 1;
1582                         else
1583                                 pos = 2;
1584                         for (i = 0; i < num_algs; i++) {
1585                                 pos++;
1586                                 if (pos >= num_algs)
1587                                         pos = 0;
1588                                 if (algs[pos] == ifsta->auth_alg ||
1589                                     algs[pos] == 0xff)
1590                                         continue;
1591                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1592                                     !ieee80211_sta_wep_configured(dev))
1593                                         continue;
1594                                 ifsta->auth_alg = algs[pos];
1595                                 printk(KERN_DEBUG "%s: set auth_alg=%d for "
1596                                        "next try\n",
1597                                        dev->name, ifsta->auth_alg);
1598                                 break;
1599                         }
1600                 }
1601                 return;
1602         }
1603
1604         switch (ifsta->auth_alg) {
1605         case WLAN_AUTH_OPEN:
1606         case WLAN_AUTH_LEAP:
1607                 ieee80211_auth_completed(dev, ifsta);
1608                 break;
1609         case WLAN_AUTH_SHARED_KEY:
1610                 if (ifsta->auth_transaction == 4)
1611                         ieee80211_auth_completed(dev, ifsta);
1612                 else
1613                         ieee80211_auth_challenge(dev, ifsta, mgmt, len);
1614                 break;
1615         }
1616 }
1617
1618
1619 static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
1620                                      struct ieee80211_if_sta *ifsta,
1621                                      struct ieee80211_mgmt *mgmt,
1622                                      size_t len)
1623 {
1624         u16 reason_code;
1625         DECLARE_MAC_BUF(mac);
1626
1627         if (len < 24 + 2) {
1628                 printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
1629                        "received from %s - ignored\n",
1630                        dev->name, len, print_mac(mac, mgmt->sa));
1631                 return;
1632         }
1633
1634         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1635                 printk(KERN_DEBUG "%s: deauthentication frame received from "
1636                        "unknown AP (SA=%s BSSID=%s) - "
1637                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1638                        print_mac(mac, mgmt->bssid));
1639                 return;
1640         }
1641
1642         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
1643
1644         printk(KERN_DEBUG "%s: RX deauthentication from %s"
1645                " (reason=%d)\n",
1646                dev->name, print_mac(mac, mgmt->sa), reason_code);
1647
1648         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
1649                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
1650         }
1651
1652         if (ifsta->state == IEEE80211_AUTHENTICATE ||
1653             ifsta->state == IEEE80211_ASSOCIATE ||
1654             ifsta->state == IEEE80211_ASSOCIATED) {
1655                 ifsta->state = IEEE80211_AUTHENTICATE;
1656                 mod_timer(&ifsta->timer, jiffies +
1657                                       IEEE80211_RETRY_AUTH_INTERVAL);
1658         }
1659
1660         ieee80211_set_disassoc(dev, ifsta, 1);
1661         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
1662 }
1663
1664
1665 static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
1666                                        struct ieee80211_if_sta *ifsta,
1667                                        struct ieee80211_mgmt *mgmt,
1668                                        size_t len)
1669 {
1670         u16 reason_code;
1671         DECLARE_MAC_BUF(mac);
1672
1673         if (len < 24 + 2) {
1674                 printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
1675                        "received from %s - ignored\n",
1676                        dev->name, len, print_mac(mac, mgmt->sa));
1677                 return;
1678         }
1679
1680         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1681                 printk(KERN_DEBUG "%s: disassociation frame received from "
1682                        "unknown AP (SA=%s BSSID=%s) - "
1683                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1684                        print_mac(mac, mgmt->bssid));
1685                 return;
1686         }
1687
1688         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
1689
1690         printk(KERN_DEBUG "%s: RX disassociation from %s"
1691                " (reason=%d)\n",
1692                dev->name, print_mac(mac, mgmt->sa), reason_code);
1693
1694         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
1695                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
1696
1697         if (ifsta->state == IEEE80211_ASSOCIATED) {
1698                 ifsta->state = IEEE80211_ASSOCIATE;
1699                 mod_timer(&ifsta->timer, jiffies +
1700                                       IEEE80211_RETRY_AUTH_INTERVAL);
1701         }
1702
1703         ieee80211_set_disassoc(dev, ifsta, 0);
1704 }
1705
1706
1707 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
1708                                          struct ieee80211_if_sta *ifsta,
1709                                          struct ieee80211_mgmt *mgmt,
1710                                          size_t len,
1711                                          int reassoc)
1712 {
1713         struct ieee80211_local *local = sdata->local;
1714         struct net_device *dev = sdata->dev;
1715         struct ieee80211_supported_band *sband;
1716         struct sta_info *sta;
1717         u64 rates, basic_rates;
1718         u16 capab_info, status_code, aid;
1719         struct ieee802_11_elems elems;
1720         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
1721         u8 *pos;
1722         int i, j;
1723         DECLARE_MAC_BUF(mac);
1724         bool have_higher_than_11mbit = false;
1725
1726         /* AssocResp and ReassocResp have identical structure, so process both
1727          * of them in this function. */
1728
1729         if (ifsta->state != IEEE80211_ASSOCIATE) {
1730                 printk(KERN_DEBUG "%s: association frame received from "
1731                        "%s, but not in associate state - ignored\n",
1732                        dev->name, print_mac(mac, mgmt->sa));
1733                 return;
1734         }
1735
1736         if (len < 24 + 6) {
1737                 printk(KERN_DEBUG "%s: too short (%zd) association frame "
1738                        "received from %s - ignored\n",
1739                        dev->name, len, print_mac(mac, mgmt->sa));
1740                 return;
1741         }
1742
1743         if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
1744                 printk(KERN_DEBUG "%s: association frame received from "
1745                        "unknown AP (SA=%s BSSID=%s) - "
1746                        "ignored\n", dev->name, print_mac(mac, mgmt->sa),
1747                        print_mac(mac, mgmt->bssid));
1748                 return;
1749         }
1750
1751         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
1752         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
1753         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
1754
1755         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
1756                "status=%d aid=%d)\n",
1757                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
1758                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
1759
1760         if (status_code != WLAN_STATUS_SUCCESS) {
1761                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
1762                        dev->name, status_code);
1763                 /* if this was a reassociation, ensure we try a "full"
1764                  * association next time. This works around some broken APs
1765                  * which do not correctly reject reassociation requests. */
1766                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
1767                 return;
1768         }
1769
1770         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1771                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
1772                        "set\n", dev->name, aid);
1773         aid &= ~(BIT(15) | BIT(14));
1774
1775         pos = mgmt->u.assoc_resp.variable;
1776         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1777
1778         if (!elems.supp_rates) {
1779                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
1780                        dev->name);
1781                 return;
1782         }
1783
1784         printk(KERN_DEBUG "%s: associated\n", dev->name);
1785         ifsta->aid = aid;
1786         ifsta->ap_capab = capab_info;
1787
1788         kfree(ifsta->assocresp_ies);
1789         ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
1790         ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
1791         if (ifsta->assocresp_ies)
1792                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
1793
1794         /* Add STA entry for the AP */
1795         sta = sta_info_get(local, ifsta->bssid);
1796         if (!sta) {
1797                 struct ieee80211_sta_bss *bss;
1798                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
1799                 if (IS_ERR(sta)) {
1800                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
1801                                " AP (error %ld)\n", dev->name, PTR_ERR(sta));
1802                         return;
1803                 }
1804                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
1805                                            local->hw.conf.channel->center_freq,
1806                                            ifsta->ssid, ifsta->ssid_len);
1807                 if (bss) {
1808                         sta->last_rssi = bss->rssi;
1809                         sta->last_signal = bss->signal;
1810                         sta->last_noise = bss->noise;
1811                         ieee80211_rx_bss_put(dev, bss);
1812                 }
1813         }
1814
1815         sta->dev = dev;
1816         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
1817                       WLAN_STA_AUTHORIZED;
1818
1819         rates = 0;
1820         basic_rates = 0;
1821         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
1822
1823         for (i = 0; i < elems.supp_rates_len; i++) {
1824                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
1825
1826                 if (rate > 110)
1827                         have_higher_than_11mbit = true;
1828
1829                 for (j = 0; j < sband->n_bitrates; j++) {
1830                         if (sband->bitrates[j].bitrate == rate)
1831                                 rates |= BIT(j);
1832                         if (elems.supp_rates[i] & 0x80)
1833                                 basic_rates |= BIT(j);
1834                 }
1835         }
1836
1837         for (i = 0; i < elems.ext_supp_rates_len; i++) {
1838                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
1839
1840                 if (rate > 110)
1841                         have_higher_than_11mbit = true;
1842
1843                 for (j = 0; j < sband->n_bitrates; j++) {
1844                         if (sband->bitrates[j].bitrate == rate)
1845                                 rates |= BIT(j);
1846                         if (elems.ext_supp_rates[i] & 0x80)
1847                                 basic_rates |= BIT(j);
1848                 }
1849         }
1850
1851         sta->supp_rates[local->hw.conf.channel->band] = rates;
1852         sdata->basic_rates = basic_rates;
1853
1854         /* cf. IEEE 802.11 9.2.12 */
1855         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
1856             have_higher_than_11mbit)
1857                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
1858         else
1859                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
1860
1861         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
1862             local->ops->conf_ht) {
1863                 struct ieee80211_ht_bss_info bss_info;
1864
1865                 ieee80211_ht_cap_ie_to_ht_info(
1866                                 (struct ieee80211_ht_cap *)
1867                                 elems.ht_cap_elem, &sta->ht_info);
1868                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
1869                                 (struct ieee80211_ht_addt_info *)
1870                                 elems.ht_info_elem, &bss_info);
1871                 ieee80211_hw_config_ht(local, 1, &sta->ht_info, &bss_info);
1872         }
1873
1874         rate_control_rate_init(sta, local);
1875
1876         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
1877                 sta->flags |= WLAN_STA_WME;
1878                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
1879                                          elems.wmm_param_len);
1880         }
1881
1882         /* set AID, ieee80211_set_associated() will tell the driver */
1883         bss_conf->aid = aid;
1884         ieee80211_set_associated(dev, ifsta, 1);
1885
1886         sta_info_put(sta);
1887
1888         ieee80211_associated(dev, ifsta);
1889 }
1890
1891
1892 /* Caller must hold local->sta_bss_lock */
1893 static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
1894                                         struct ieee80211_sta_bss *bss)
1895 {
1896         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1897         u8 hash_idx;
1898
1899         if (bss_mesh_cfg(bss))
1900                 hash_idx = mesh_id_hash(bss_mesh_id(bss),
1901                                         bss_mesh_id_len(bss));
1902         else
1903                 hash_idx = STA_HASH(bss->bssid);
1904
1905         bss->hnext = local->sta_bss_hash[hash_idx];
1906         local->sta_bss_hash[hash_idx] = bss;
1907 }
1908
1909
1910 /* Caller must hold local->sta_bss_lock */
1911 static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
1912                                         struct ieee80211_sta_bss *bss)
1913 {
1914         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1915         struct ieee80211_sta_bss *b, *prev = NULL;
1916         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
1917         while (b) {
1918                 if (b == bss) {
1919                         if (!prev)
1920                                 local->sta_bss_hash[STA_HASH(bss->bssid)] =
1921                                         bss->hnext;
1922                         else
1923                                 prev->hnext = bss->hnext;
1924                         break;
1925                 }
1926                 prev = b;
1927                 b = b->hnext;
1928         }
1929 }
1930
1931
1932 static struct ieee80211_sta_bss *
1933 ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int freq,
1934                      u8 *ssid, u8 ssid_len)
1935 {
1936         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1937         struct ieee80211_sta_bss *bss;
1938
1939         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
1940         if (!bss)
1941                 return NULL;
1942         atomic_inc(&bss->users);
1943         atomic_inc(&bss->users);
1944         memcpy(bss->bssid, bssid, ETH_ALEN);
1945         bss->freq = freq;
1946         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
1947                 memcpy(bss->ssid, ssid, ssid_len);
1948                 bss->ssid_len = ssid_len;
1949         }
1950
1951         spin_lock_bh(&local->sta_bss_lock);
1952         /* TODO: order by RSSI? */
1953         list_add_tail(&bss->list, &local->sta_bss_list);
1954         __ieee80211_rx_bss_hash_add(dev, bss);
1955         spin_unlock_bh(&local->sta_bss_lock);
1956         return bss;
1957 }
1958
1959 static struct ieee80211_sta_bss *
1960 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
1961                      u8 *ssid, u8 ssid_len)
1962 {
1963         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1964         struct ieee80211_sta_bss *bss;
1965
1966         spin_lock_bh(&local->sta_bss_lock);
1967         bss = local->sta_bss_hash[STA_HASH(bssid)];
1968         while (bss) {
1969                 if (!bss_mesh_cfg(bss) &&
1970                     !memcmp(bss->bssid, bssid, ETH_ALEN) &&
1971                     bss->freq == freq &&
1972                     bss->ssid_len == ssid_len &&
1973                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
1974                         atomic_inc(&bss->users);
1975                         break;
1976                 }
1977                 bss = bss->hnext;
1978         }
1979         spin_unlock_bh(&local->sta_bss_lock);
1980         return bss;
1981 }
1982
1983 #ifdef CONFIG_MAC80211_MESH
1984 static struct ieee80211_sta_bss *
1985 ieee80211_rx_mesh_bss_get(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
1986                           u8 *mesh_cfg, int freq)
1987 {
1988         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1989         struct ieee80211_sta_bss *bss;
1990
1991         spin_lock_bh(&local->sta_bss_lock);
1992         bss = local->sta_bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
1993         while (bss) {
1994                 if (bss_mesh_cfg(bss) &&
1995                     !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
1996                     bss->freq == freq &&
1997                     mesh_id_len == bss->mesh_id_len &&
1998                     (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
1999                                                  mesh_id_len))) {
2000                         atomic_inc(&bss->users);
2001                         break;
2002                 }
2003                 bss = bss->hnext;
2004         }
2005         spin_unlock_bh(&local->sta_bss_lock);
2006         return bss;
2007 }
2008
2009 static struct ieee80211_sta_bss *
2010 ieee80211_rx_mesh_bss_add(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
2011                           u8 *mesh_cfg, int freq)
2012 {
2013         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2014         struct ieee80211_sta_bss *bss;
2015
2016         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
2017         if (!bss)
2018                 return NULL;
2019
2020         bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
2021         if (!bss->mesh_cfg) {
2022                 kfree(bss);
2023                 return NULL;
2024         }
2025
2026         if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
2027                 bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
2028                 if (!bss->mesh_id) {
2029                         kfree(bss->mesh_cfg);
2030                         kfree(bss);
2031                         return NULL;
2032                 }
2033                 memcpy(bss->mesh_id, mesh_id, mesh_id_len);
2034         }
2035
2036         atomic_inc(&bss->users);
2037         atomic_inc(&bss->users);
2038         memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
2039         bss->mesh_id_len = mesh_id_len;
2040         bss->freq = freq;
2041         spin_lock_bh(&local->sta_bss_lock);
2042         /* TODO: order by RSSI? */
2043         list_add_tail(&bss->list, &local->sta_bss_list);
2044         __ieee80211_rx_bss_hash_add(dev, bss);
2045         spin_unlock_bh(&local->sta_bss_lock);
2046         return bss;
2047 }
2048 #endif
2049
2050 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
2051 {
2052         kfree(bss->wpa_ie);
2053         kfree(bss->rsn_ie);
2054         kfree(bss->wmm_ie);
2055         kfree(bss->ht_ie);
2056         kfree(bss_mesh_id(bss));
2057         kfree(bss_mesh_cfg(bss));
2058         kfree(bss);
2059 }
2060
2061
2062 static void ieee80211_rx_bss_put(struct net_device *dev,
2063                                  struct ieee80211_sta_bss *bss)
2064 {
2065         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2066         if (!atomic_dec_and_test(&bss->users))
2067                 return;
2068
2069         spin_lock_bh(&local->sta_bss_lock);
2070         __ieee80211_rx_bss_hash_del(dev, bss);
2071         list_del(&bss->list);
2072         spin_unlock_bh(&local->sta_bss_lock);
2073         ieee80211_rx_bss_free(bss);
2074 }
2075
2076
2077 void ieee80211_rx_bss_list_init(struct net_device *dev)
2078 {
2079         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2080         spin_lock_init(&local->sta_bss_lock);
2081         INIT_LIST_HEAD(&local->sta_bss_list);
2082 }
2083
2084
2085 void ieee80211_rx_bss_list_deinit(struct net_device *dev)
2086 {
2087         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2088         struct ieee80211_sta_bss *bss, *tmp;
2089
2090         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
2091                 ieee80211_rx_bss_put(dev, bss);
2092 }
2093
2094
2095 static int ieee80211_sta_join_ibss(struct net_device *dev,
2096                                    struct ieee80211_if_sta *ifsta,
2097                                    struct ieee80211_sta_bss *bss)
2098 {
2099         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2100         int res, rates, i, j;
2101         struct sk_buff *skb;
2102         struct ieee80211_mgmt *mgmt;
2103         struct ieee80211_tx_control control;
2104         struct rate_selection ratesel;
2105         u8 *pos;
2106         struct ieee80211_sub_if_data *sdata;
2107         struct ieee80211_supported_band *sband;
2108
2109         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2110
2111         /* Remove possible STA entries from other IBSS networks. */
2112         sta_info_flush(local, NULL);
2113
2114         if (local->ops->reset_tsf) {
2115                 /* Reset own TSF to allow time synchronization work. */
2116                 local->ops->reset_tsf(local_to_hw(local));
2117         }
2118         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
2119         res = ieee80211_if_config(dev);
2120         if (res)
2121                 return res;
2122
2123         local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2124
2125         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2126         sdata->drop_unencrypted = bss->capability &
2127                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2128
2129         res = ieee80211_set_freq(local, bss->freq);
2130
2131         if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
2132                 printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
2133                        "%d MHz\n", dev->name, local->oper_channel->center_freq);
2134                 return -1;
2135         }
2136
2137         /* Set beacon template */
2138         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
2139         do {
2140                 if (!skb)
2141                         break;
2142
2143                 skb_reserve(skb, local->hw.extra_tx_headroom);
2144
2145                 mgmt = (struct ieee80211_mgmt *)
2146                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2147                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2148                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2149                                                    IEEE80211_STYPE_BEACON);
2150                 memset(mgmt->da, 0xff, ETH_ALEN);
2151                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
2152                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
2153                 mgmt->u.beacon.beacon_int =
2154                         cpu_to_le16(local->hw.conf.beacon_int);
2155                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
2156
2157                 pos = skb_put(skb, 2 + ifsta->ssid_len);
2158                 *pos++ = WLAN_EID_SSID;
2159                 *pos++ = ifsta->ssid_len;
2160                 memcpy(pos, ifsta->ssid, ifsta->ssid_len);
2161
2162                 rates = bss->supp_rates_len;
2163                 if (rates > 8)
2164                         rates = 8;
2165                 pos = skb_put(skb, 2 + rates);
2166                 *pos++ = WLAN_EID_SUPP_RATES;
2167                 *pos++ = rates;
2168                 memcpy(pos, bss->supp_rates, rates);
2169
2170                 if (bss->band == IEEE80211_BAND_2GHZ) {
2171                         pos = skb_put(skb, 2 + 1);
2172                         *pos++ = WLAN_EID_DS_PARAMS;
2173                         *pos++ = 1;
2174                         *pos++ = ieee80211_frequency_to_channel(bss->freq);
2175                 }
2176
2177                 pos = skb_put(skb, 2 + 2);
2178                 *pos++ = WLAN_EID_IBSS_PARAMS;
2179                 *pos++ = 2;
2180                 /* FIX: set ATIM window based on scan results */
2181                 *pos++ = 0;
2182                 *pos++ = 0;
2183
2184                 if (bss->supp_rates_len > 8) {
2185                         rates = bss->supp_rates_len - 8;
2186                         pos = skb_put(skb, 2 + rates);
2187                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2188                         *pos++ = rates;
2189                         memcpy(pos, &bss->supp_rates[8], rates);
2190                 }
2191
2192                 memset(&control, 0, sizeof(control));
2193                 rate_control_get_rate(dev, sband, skb, &ratesel);
2194                 if (!ratesel.rate) {
2195                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
2196                                "for IBSS beacon\n", dev->name);
2197                         break;
2198                 }
2199                 control.vif = &sdata->vif;
2200                 control.tx_rate = ratesel.rate;
2201                 if (sdata->bss_conf.use_short_preamble &&
2202                     ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
2203                         control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
2204                 control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
2205                 control.flags |= IEEE80211_TXCTL_NO_ACK;
2206                 control.retry_limit = 1;
2207
2208                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
2209                 if (ifsta->probe_resp) {
2210                         mgmt = (struct ieee80211_mgmt *)
2211                                 ifsta->probe_resp->data;
2212                         mgmt->frame_control =
2213                                 IEEE80211_FC(IEEE80211_FTYPE_MGMT,
2214                                              IEEE80211_STYPE_PROBE_RESP);
2215                 } else {
2216                         printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
2217                                "template for IBSS\n", dev->name);
2218                 }
2219
2220                 if (local->ops->beacon_update &&
2221                     local->ops->beacon_update(local_to_hw(local),
2222                                              skb, &control) == 0) {
2223                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
2224                                "template\n", dev->name);
2225                         skb = NULL;
2226                 }
2227
2228                 rates = 0;
2229                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2230                 for (i = 0; i < bss->supp_rates_len; i++) {
2231                         int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
2232                         for (j = 0; j < sband->n_bitrates; j++)
2233                                 if (sband->bitrates[j].bitrate == bitrate)
2234                                         rates |= BIT(j);
2235                 }
2236                 ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
2237         } while (0);
2238
2239         if (skb) {
2240                 printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
2241                        "template\n", dev->name);
2242                 dev_kfree_skb(skb);
2243         }
2244
2245         ifsta->state = IEEE80211_IBSS_JOINED;
2246         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2247
2248         ieee80211_rx_bss_put(dev, bss);
2249
2250         return res;
2251 }
2252
2253 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
2254                             struct ieee802_11_elems *elems,
2255                             enum ieee80211_band band)
2256 {
2257         struct ieee80211_supported_band *sband;
2258         struct ieee80211_rate *bitrates;
2259         size_t num_rates;
2260         u64 supp_rates;
2261         int i, j;
2262         sband = local->hw.wiphy->bands[band];
2263
2264         if (!sband) {
2265                 WARN_ON(1);
2266                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2267         }
2268
2269         bitrates = sband->bitrates;
2270         num_rates = sband->n_bitrates;
2271         supp_rates = 0;
2272         for (i = 0; i < elems->supp_rates_len +
2273                      elems->ext_supp_rates_len; i++) {
2274                 u8 rate = 0;
2275                 int own_rate;
2276                 if (i < elems->supp_rates_len)
2277                         rate = elems->supp_rates[i];
2278                 else if (elems->ext_supp_rates)
2279                         rate = elems->ext_supp_rates
2280                                 [i - elems->supp_rates_len];
2281                 own_rate = 5 * (rate & 0x7f);
2282                 for (j = 0; j < num_rates; j++)
2283                         if (bitrates[j].bitrate == own_rate)
2284                                 supp_rates |= BIT(j);
2285         }
2286         return supp_rates;
2287 }
2288
2289
2290 static void ieee80211_rx_bss_info(struct net_device *dev,
2291                                   struct ieee80211_mgmt *mgmt,
2292                                   size_t len,
2293                                   struct ieee80211_rx_status *rx_status,
2294                                   int beacon)
2295 {
2296         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2297         struct ieee802_11_elems elems;
2298         size_t baselen;
2299         int freq, clen;
2300         struct ieee80211_sta_bss *bss;
2301         struct sta_info *sta;
2302         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2303         u64 beacon_timestamp, rx_timestamp;
2304         DECLARE_MAC_BUF(mac);
2305         DECLARE_MAC_BUF(mac2);
2306
2307         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
2308                 return; /* ignore ProbeResp to foreign address */
2309
2310 #if 0
2311         printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
2312                dev->name, beacon ? "Beacon" : "Probe Response",
2313                print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
2314 #endif
2315
2316         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2317         if (baselen > len)
2318                 return;
2319
2320         beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
2321         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2322
2323         if (ieee80211_vif_is_mesh(&sdata->vif) && elems.mesh_id &&
2324             elems.mesh_config && mesh_matches_local(&elems, dev)) {
2325                 u64 rates = ieee80211_sta_get_rates(local, &elems,
2326                                                 rx_status->band);
2327
2328                 mesh_neighbour_update(mgmt->sa, rates, dev,
2329                                       mesh_peer_accepts_plinks(&elems, dev));
2330         }
2331
2332         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
2333             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
2334             (sta = sta_info_get(local, mgmt->sa))) {
2335                 u64 prev_rates;
2336                 u64 supp_rates = ieee80211_sta_get_rates(local, &elems,
2337                                                         rx_status->band);
2338
2339                 prev_rates = sta->supp_rates[rx_status->band];
2340                 sta->supp_rates[rx_status->band] &= supp_rates;
2341                 if (sta->supp_rates[rx_status->band] == 0) {
2342                         /* No matching rates - this should not really happen.
2343                          * Make sure that at least one rate is marked
2344                          * supported to avoid issues with TX rate ctrl. */
2345                         sta->supp_rates[rx_status->band] =
2346                                 sdata->u.sta.supp_rates_bits[rx_status->band];
2347                 }
2348                 if (sta->supp_rates[rx_status->band] != prev_rates) {
2349                         printk(KERN_DEBUG "%s: updated supp_rates set for "
2350                                "%s based on beacon info (0x%llx & 0x%llx -> "
2351                                "0x%llx)\n",
2352                                dev->name, print_mac(mac, sta->addr),
2353                                (unsigned long long) prev_rates,
2354                                (unsigned long long) supp_rates,
2355                                (unsigned long long) sta->supp_rates[rx_status->band]);
2356                 }
2357                 sta_info_put(sta);
2358         }
2359
2360         if (elems.ds_params && elems.ds_params_len == 1)
2361                 freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
2362         else
2363                 freq = rx_status->freq;
2364
2365 #ifdef CONFIG_MAC80211_MESH
2366         if (elems.mesh_config)
2367                 bss = ieee80211_rx_mesh_bss_get(dev, elems.mesh_id,
2368                                 elems.mesh_id_len, elems.mesh_config, freq);
2369         else
2370 #endif
2371                 bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
2372                                            elems.ssid, elems.ssid_len);
2373         if (!bss) {
2374 #ifdef CONFIG_MAC80211_MESH
2375                 if (elems.mesh_config)
2376                         bss = ieee80211_rx_mesh_bss_add(dev, elems.mesh_id,
2377                                 elems.mesh_id_len, elems.mesh_config, freq);
2378                 else
2379 #endif
2380                         bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
2381                                                    elems.ssid, elems.ssid_len);
2382                 if (!bss)
2383                         return;
2384         } else {
2385 #if 0
2386                 /* TODO: order by RSSI? */
2387                 spin_lock_bh(&local->sta_bss_lock);
2388                 list_move_tail(&bss->list, &local->sta_bss_list);
2389                 spin_unlock_bh(&local->sta_bss_lock);
2390 #endif
2391         }
2392
2393         bss->band = rx_status->band;
2394
2395         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
2396             bss->probe_resp && beacon) {
2397                 /* STA mode:
2398                  * Do not allow beacon to override data from Probe Response. */
2399                 ieee80211_rx_bss_put(dev, bss);
2400                 return;
2401         }
2402
2403         /* save the ERP value so that it is available at association time */
2404         if (elems.erp_info && elems.erp_info_len >= 1) {
2405                 bss->erp_value = elems.erp_info[0];
2406                 bss->has_erp_value = 1;
2407         }
2408
2409         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
2410         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
2411
2412         bss->supp_rates_len = 0;
2413         if (elems.supp_rates) {
2414                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2415                 if (clen > elems.supp_rates_len)
2416                         clen = elems.supp_rates_len;
2417                 memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
2418                        clen);
2419                 bss->supp_rates_len += clen;
2420         }
2421         if (elems.ext_supp_rates) {
2422                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
2423                 if (clen > elems.ext_supp_rates_len)
2424                         clen = elems.ext_supp_rates_len;
2425                 memcpy(&bss->supp_rates[bss->supp_rates_len],
2426                        elems.ext_supp_rates, clen);
2427                 bss->supp_rates_len += clen;
2428         }
2429
2430         if (elems.wpa &&
2431             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
2432              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
2433                 kfree(bss->wpa_ie);
2434                 bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
2435                 if (bss->wpa_ie) {
2436                         memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
2437                         bss->wpa_ie_len = elems.wpa_len + 2;
2438                 } else
2439                         bss->wpa_ie_len = 0;
2440         } else if (!elems.wpa && bss->wpa_ie) {
2441                 kfree(bss->wpa_ie);
2442                 bss->wpa_ie = NULL;
2443                 bss->wpa_ie_len = 0;
2444         }
2445
2446         if (elems.rsn &&
2447             (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
2448              memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
2449                 kfree(bss->rsn_ie);
2450                 bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
2451                 if (bss->rsn_ie) {
2452                         memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
2453                         bss->rsn_ie_len = elems.rsn_len + 2;
2454                 } else
2455                         bss->rsn_ie_len = 0;
2456         } else if (!elems.rsn && bss->rsn_ie) {
2457                 kfree(bss->rsn_ie);
2458                 bss->rsn_ie = NULL;
2459                 bss->rsn_ie_len = 0;
2460         }
2461
2462         if (elems.wmm_param &&
2463             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
2464              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
2465                 kfree(bss->wmm_ie);
2466                 bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
2467                 if (bss->wmm_ie) {
2468                         memcpy(bss->wmm_ie, elems.wmm_param - 2,
2469                                elems.wmm_param_len + 2);
2470                         bss->wmm_ie_len = elems.wmm_param_len + 2;
2471                 } else
2472                         bss->wmm_ie_len = 0;
2473         } else if (!elems.wmm_param && bss->wmm_ie) {
2474                 kfree(bss->wmm_ie);
2475                 bss->wmm_ie = NULL;
2476                 bss->wmm_ie_len = 0;
2477         }
2478         if (elems.ht_cap_elem &&
2479             (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
2480              memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
2481                 kfree(bss->ht_ie);
2482                 bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
2483                 if (bss->ht_ie) {
2484                         memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
2485                                elems.ht_cap_elem_len + 2);
2486                         bss->ht_ie_len = elems.ht_cap_elem_len + 2;
2487                 } else
2488                         bss->ht_ie_len = 0;
2489         } else if (!elems.ht_cap_elem && bss->ht_ie) {
2490                 kfree(bss->ht_ie);
2491                 bss->ht_ie = NULL;
2492                 bss->ht_ie_len = 0;
2493         }
2494
2495         bss->timestamp = beacon_timestamp;
2496         bss->last_update = jiffies;
2497         bss->rssi = rx_status->ssi;
2498         bss->signal = rx_status->signal;
2499         bss->noise = rx_status->noise;
2500         if (!beacon)
2501                 bss->probe_resp++;
2502
2503         /* check if we need to merge IBSS */
2504         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
2505             !local->sta_sw_scanning && !local->sta_hw_scanning &&
2506             bss->capability & WLAN_CAPABILITY_IBSS &&
2507             bss->freq == local->oper_channel->center_freq &&
2508             elems.ssid_len == sdata->u.sta.ssid_len &&
2509             memcmp(elems.ssid, sdata->u.sta.ssid, sdata->u.sta.ssid_len) == 0) {
2510                 if (rx_status->flag & RX_FLAG_TSFT) {
2511                         /* in order for correct IBSS merging we need mactime
2512                          *
2513                          * since mactime is defined as the time the first data
2514                          * symbol of the frame hits the PHY, and the timestamp
2515                          * of the beacon is defined as "the time that the data
2516                          * symbol containing the first bit of the timestamp is
2517                          * transmitted to the PHY plus the transmitting STA’s
2518                          * delays through its local PHY from the MAC-PHY
2519                          * interface to its interface with the WM"
2520                          * (802.11 11.1.2) - equals the time this bit arrives at
2521                          * the receiver - we have to take into account the
2522                          * offset between the two.
2523                          * e.g: at 1 MBit that means mactime is 192 usec earlier
2524                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
2525                          */
2526                         int rate = local->hw.wiphy->bands[rx_status->band]->
2527                                         bitrates[rx_status->rate_idx].bitrate;
2528                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
2529                 } else if (local && local->ops && local->ops->get_tsf)
2530                         /* second best option: get current TSF */
2531                         rx_timestamp = local->ops->get_tsf(local_to_hw(local));
2532                 else
2533                         /* can't merge without knowing the TSF */
2534                         rx_timestamp = -1LLU;
2535 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2536                 printk(KERN_DEBUG "RX beacon SA=%s BSSID="
2537                        "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
2538                        print_mac(mac, mgmt->sa),
2539                        print_mac(mac2, mgmt->bssid),
2540                        (unsigned long long)rx_timestamp,
2541                        (unsigned long long)beacon_timestamp,
2542                        (unsigned long long)(rx_timestamp - beacon_timestamp),
2543                        jiffies);
2544 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2545                 if (beacon_timestamp > rx_timestamp) {
2546 #ifndef CONFIG_MAC80211_IBSS_DEBUG
2547                         if (net_ratelimit())
2548 #endif
2549                                 printk(KERN_DEBUG "%s: beacon TSF higher than "
2550                                        "local TSF - IBSS merge with BSSID %s\n",
2551                                        dev->name, print_mac(mac, mgmt->bssid));
2552                         ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
2553                         ieee80211_ibss_add_sta(dev, NULL,
2554                                                mgmt->bssid, mgmt->sa);
2555                 }
2556         }
2557
2558         ieee80211_rx_bss_put(dev, bss);
2559 }
2560
2561
2562 static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
2563                                          struct ieee80211_mgmt *mgmt,
2564                                          size_t len,
2565                                          struct ieee80211_rx_status *rx_status)
2566 {
2567         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
2568 }
2569
2570
2571 static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
2572                                      struct ieee80211_mgmt *mgmt,
2573                                      size_t len,
2574                                      struct ieee80211_rx_status *rx_status)
2575 {
2576         struct ieee80211_sub_if_data *sdata;
2577         struct ieee80211_if_sta *ifsta;
2578         size_t baselen;
2579         struct ieee802_11_elems elems;
2580         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2581         struct ieee80211_conf *conf = &local->hw.conf;
2582         u32 changed = 0;
2583
2584         ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
2585
2586         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2587         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
2588                 return;
2589         ifsta = &sdata->u.sta;
2590
2591         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
2592             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
2593                 return;
2594
2595         /* Process beacon from the current BSS */
2596         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2597         if (baselen > len)
2598                 return;
2599
2600         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
2601
2602         if (elems.erp_info && elems.erp_info_len >= 1)
2603                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
2604
2605         if (elems.ht_cap_elem && elems.ht_info_elem &&
2606             elems.wmm_param && local->ops->conf_ht &&
2607             conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
2608                 struct ieee80211_ht_bss_info bss_info;
2609
2610                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
2611                                 (struct ieee80211_ht_addt_info *)
2612                                 elems.ht_info_elem, &bss_info);
2613                 /* check if AP changed bss inforamation */
2614                 if ((conf->ht_bss_conf.primary_channel !=
2615                      bss_info.primary_channel) ||
2616                     (conf->ht_bss_conf.bss_cap != bss_info.bss_cap) ||
2617                     (conf->ht_bss_conf.bss_op_mode != bss_info.bss_op_mode))
2618                         ieee80211_hw_config_ht(local, 1, &conf->ht_conf,
2619                                                 &bss_info);
2620         }
2621
2622         if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
2623                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
2624                                          elems.wmm_param_len);
2625         }
2626
2627         ieee80211_bss_info_change_notify(sdata, changed);
2628 }
2629
2630
2631 static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
2632                                         struct ieee80211_if_sta *ifsta,
2633                                         struct ieee80211_mgmt *mgmt,
2634                                         size_t len,
2635                                         struct ieee80211_rx_status *rx_status)
2636 {
2637         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2638         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2639         int tx_last_beacon;
2640         struct sk_buff *skb;
2641         struct ieee80211_mgmt *resp;
2642         u8 *pos, *end;
2643         DECLARE_MAC_BUF(mac);
2644 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2645         DECLARE_MAC_BUF(mac2);
2646         DECLARE_MAC_BUF(mac3);
2647 #endif
2648
2649         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
2650             ifsta->state != IEEE80211_IBSS_JOINED ||
2651             len < 24 + 2 || !ifsta->probe_resp)
2652                 return;
2653
2654         if (local->ops->tx_last_beacon)
2655                 tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
2656         else
2657                 tx_last_beacon = 1;
2658
2659 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2660         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
2661                "%s (tx_last_beacon=%d)\n",
2662                dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
2663                print_mac(mac3, mgmt->bssid), tx_last_beacon);
2664 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2665
2666         if (!tx_last_beacon)
2667                 return;
2668
2669         if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
2670             memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2671                 return;
2672
2673         end = ((u8 *) mgmt) + len;
2674         pos = mgmt->u.probe_req.variable;
2675         if (pos[0] != WLAN_EID_SSID ||
2676             pos + 2 + pos[1] > end) {
2677                 if (net_ratelimit()) {
2678                         printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
2679                                "from %s\n",
2680                                dev->name, print_mac(mac, mgmt->sa));
2681                 }
2682                 return;
2683         }
2684         if (pos[1] != 0 &&
2685             (pos[1] != ifsta->ssid_len ||
2686              memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
2687                 /* Ignore ProbeReq for foreign SSID */
2688                 return;
2689         }
2690
2691         /* Reply with ProbeResp */
2692         skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
2693         if (!skb)
2694                 return;
2695
2696         resp = (struct ieee80211_mgmt *) skb->data;
2697         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2698 #ifdef CONFIG_MAC80211_IBSS_DEBUG
2699         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
2700                dev->name, print_mac(mac, resp->da));
2701 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
2702         ieee80211_sta_tx(dev, skb, 0);
2703 }
2704
2705 static void ieee80211_rx_mgmt_action(struct net_device *dev,
2706                                      struct ieee80211_if_sta *ifsta,
2707                                      struct ieee80211_mgmt *mgmt,
2708                                      size_t len,
2709                                      struct ieee80211_rx_status *rx_status)
2710 {
2711         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2712
2713         if (len < IEEE80211_MIN_ACTION_SIZE)
2714                 return;
2715
2716         switch (mgmt->u.action.category) {
2717         case WLAN_CATEGORY_BACK:
2718                 switch (mgmt->u.action.u.addba_req.action_code) {
2719                 case WLAN_ACTION_ADDBA_REQ:
2720                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2721                                    sizeof(mgmt->u.action.u.addba_req)))
2722                                 break;
2723                         ieee80211_sta_process_addba_request(dev, mgmt, len);
2724                         break;
2725                 case WLAN_ACTION_ADDBA_RESP:
2726                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2727                                    sizeof(mgmt->u.action.u.addba_resp)))
2728                                 break;
2729                         ieee80211_sta_process_addba_resp(dev, mgmt, len);
2730                         break;
2731                 case WLAN_ACTION_DELBA:
2732                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2733                                    sizeof(mgmt->u.action.u.delba)))
2734                                 break;
2735                         ieee80211_sta_process_delba(dev, mgmt, len);
2736                         break;
2737                 default:
2738                         if (net_ratelimit())
2739                            printk(KERN_DEBUG "%s: Rx unknown A-MPDU action\n",
2740                                         dev->name);
2741                         break;
2742                 }
2743                 break;
2744         case PLINK_CATEGORY:
2745                 if (ieee80211_vif_is_mesh(&sdata->vif))
2746                         mesh_rx_plink_frame(dev, mgmt, len, rx_status);
2747                 break;
2748         case MESH_PATH_SEL_CATEGORY:
2749                 if (ieee80211_vif_is_mesh(&sdata->vif))
2750                         mesh_rx_path_sel_frame(dev, mgmt, len);
2751                 break;
2752         default:
2753                 if (net_ratelimit())
2754                         printk(KERN_DEBUG "%s: Rx unknown action frame - "
2755                         "category=%d\n", dev->name, mgmt->u.action.category);
2756                 break;
2757         }
2758 }
2759
2760 void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
2761                            struct ieee80211_rx_status *rx_status)
2762 {
2763         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2764         struct ieee80211_sub_if_data *sdata;
2765         struct ieee80211_if_sta *ifsta;
2766         struct ieee80211_mgmt *mgmt;
2767         u16 fc;
2768
2769         if (skb->len < 24)
2770                 goto fail;
2771
2772         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2773         ifsta = &sdata->u.sta;
2774
2775         mgmt = (struct ieee80211_mgmt *) skb->data;
2776         fc = le16_to_cpu(mgmt->frame_control);
2777
2778         switch (fc & IEEE80211_FCTL_STYPE) {
2779         case IEEE80211_STYPE_PROBE_REQ:
2780         case IEEE80211_STYPE_PROBE_RESP:
2781         case IEEE80211_STYPE_BEACON:
2782         case IEEE80211_STYPE_ACTION:
2783                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
2784         case IEEE80211_STYPE_AUTH:
2785         case IEEE80211_STYPE_ASSOC_RESP:
2786         case IEEE80211_STYPE_REASSOC_RESP:
2787         case IEEE80211_STYPE_DEAUTH:
2788         case IEEE80211_STYPE_DISASSOC:
2789                 skb_queue_tail(&ifsta->skb_queue, skb);
2790                 queue_work(local->hw.workqueue, &ifsta->work);
2791                 return;
2792         default:
2793                 printk(KERN_DEBUG "%s: received unknown management frame - "
2794                        "stype=%d\n", dev->name,
2795                        (fc & IEEE80211_FCTL_STYPE) >> 4);
2796                 break;
2797         }
2798
2799  fail:
2800         kfree_skb(skb);
2801 }
2802
2803
2804 static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
2805                                          struct sk_buff *skb)
2806 {
2807         struct ieee80211_rx_status *rx_status;
2808         struct ieee80211_sub_if_data *sdata;
2809         struct ieee80211_if_sta *ifsta;
2810         struct ieee80211_mgmt *mgmt;
2811         u16 fc;
2812
2813         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2814         ifsta = &sdata->u.sta;
2815
2816         rx_status = (struct ieee80211_rx_status *) skb->cb;
2817         mgmt = (struct ieee80211_mgmt *) skb->data;
2818         fc = le16_to_cpu(mgmt->frame_control);
2819
2820         switch (fc & IEEE80211_FCTL_STYPE) {
2821         case IEEE80211_STYPE_PROBE_REQ:
2822                 ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
2823                                             rx_status);
2824                 break;
2825         case IEEE80211_STYPE_PROBE_RESP:
2826                 ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
2827                 break;
2828         case IEEE80211_STYPE_BEACON:
2829                 ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
2830                 break;
2831         case IEEE80211_STYPE_AUTH:
2832                 ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
2833                 break;
2834         case IEEE80211_STYPE_ASSOC_RESP:
2835                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
2836                 break;
2837         case IEEE80211_STYPE_REASSOC_RESP:
2838                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
2839                 break;
2840         case IEEE80211_STYPE_DEAUTH:
2841                 ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
2842                 break;
2843         case IEEE80211_STYPE_DISASSOC:
2844                 ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
2845                 break;
2846         case IEEE80211_STYPE_ACTION:
2847                 ieee80211_rx_mgmt_action(dev, ifsta, mgmt, skb->len, rx_status);
2848                 break;
2849         }
2850
2851         kfree_skb(skb);
2852 }
2853
2854
2855 ieee80211_rx_result
2856 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
2857                       struct ieee80211_rx_status *rx_status)
2858 {
2859         struct ieee80211_mgmt *mgmt;
2860         u16 fc;
2861
2862         if (skb->len < 2)
2863                 return RX_DROP_UNUSABLE;
2864
2865         mgmt = (struct ieee80211_mgmt *) skb->data;
2866         fc = le16_to_cpu(mgmt->frame_control);
2867
2868         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
2869                 return RX_CONTINUE;
2870
2871         if (skb->len < 24)
2872                 return RX_DROP_MONITOR;
2873
2874         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
2875                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
2876                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
2877                                                      skb->len, rx_status);
2878                         dev_kfree_skb(skb);
2879                         return RX_QUEUED;
2880                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
2881                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
2882                                                  rx_status);
2883                         dev_kfree_skb(skb);
2884                         return RX_QUEUED;
2885                 }
2886         }
2887         return RX_CONTINUE;
2888 }
2889
2890
2891 static int ieee80211_sta_active_ibss(struct net_device *dev)
2892 {
2893         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2894         int active = 0;
2895         struct sta_info *sta;
2896
2897         read_lock_bh(&local->sta_lock);
2898         list_for_each_entry(sta, &local->sta_list, list) {
2899                 if (sta->dev == dev &&
2900                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2901                                jiffies)) {
2902                         active++;
2903                         break;
2904                 }
2905         }
2906         read_unlock_bh(&local->sta_lock);
2907
2908         return active;
2909 }
2910
2911
2912 static void ieee80211_sta_expire(struct net_device *dev, unsigned long exp_time)
2913 {
2914         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2915         struct sta_info *sta, *tmp;
2916         LIST_HEAD(tmp_list);
2917         DECLARE_MAC_BUF(mac);
2918
2919         write_lock_bh(&local->sta_lock);
2920         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
2921                 if (time_after(jiffies, sta->last_rx + exp_time)) {
2922                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
2923                                dev->name, print_mac(mac, sta->addr));
2924                         __sta_info_get(sta);
2925                         sta_info_remove(sta);
2926                         list_add(&sta->list, &tmp_list);
2927                 }
2928         write_unlock_bh(&local->sta_lock);
2929
2930         list_for_each_entry_safe(sta, tmp, &tmp_list, list) {
2931                 sta_info_free(sta);
2932                 sta_info_put(sta);
2933         }
2934 }
2935
2936
2937 static void ieee80211_sta_merge_ibss(struct net_device *dev,
2938                                      struct ieee80211_if_sta *ifsta)
2939 {
2940         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2941
2942         ieee80211_sta_expire(dev, IEEE80211_IBSS_INACTIVITY_LIMIT);
2943         if (ieee80211_sta_active_ibss(dev))
2944                 return;
2945
2946         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
2947                "IBSS networks with same SSID (merge)\n", dev->name);
2948         ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
2949 }
2950
2951
2952 #ifdef CONFIG_MAC80211_MESH
2953 static void ieee80211_mesh_housekeeping(struct net_device *dev,
2954                            struct ieee80211_if_sta *ifsta)
2955 {
2956         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2957         bool free_plinks;
2958
2959         ieee80211_sta_expire(dev, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
2960         mesh_path_expire(dev);
2961
2962         free_plinks = mesh_plink_availables(sdata);
2963         if (free_plinks != sdata->u.sta.accepting_plinks)
2964                 ieee80211_if_config_beacon(dev);
2965
2966         mod_timer(&ifsta->timer, jiffies +
2967                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
2968 }
2969
2970
2971 void ieee80211_start_mesh(struct net_device *dev)
2972 {
2973         struct ieee80211_if_sta *ifsta;
2974         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2975         ifsta = &sdata->u.sta;
2976         ifsta->state = IEEE80211_MESH_UP;
2977         ieee80211_sta_timer((unsigned long)sdata);
2978 }
2979 #endif
2980
2981
2982 void ieee80211_sta_timer(unsigned long data)
2983 {
2984         struct ieee80211_sub_if_data *sdata =
2985                 (struct ieee80211_sub_if_data *) data;
2986         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
2987         struct ieee80211_local *local = wdev_priv(&sdata->wdev);
2988
2989         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
2990         queue_work(local->hw.workqueue, &ifsta->work);
2991 }
2992
2993 void ieee80211_sta_work(struct work_struct *work)
2994 {
2995         struct ieee80211_sub_if_data *sdata =
2996                 container_of(work, struct ieee80211_sub_if_data, u.sta.work);
2997         struct net_device *dev = sdata->dev;
2998         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2999         struct ieee80211_if_sta *ifsta;
3000         struct sk_buff *skb;
3001
3002         if (!netif_running(dev))
3003                 return;
3004
3005         if (local->sta_sw_scanning || local->sta_hw_scanning)
3006                 return;
3007
3008         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
3009             sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
3010             sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT) {
3011                 printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
3012                        "(type=%d)\n", dev->name, sdata->vif.type);
3013                 return;
3014         }
3015         ifsta = &sdata->u.sta;
3016
3017         while ((skb = skb_dequeue(&ifsta->skb_queue)))
3018                 ieee80211_sta_rx_queued_mgmt(dev, skb);
3019
3020 #ifdef CONFIG_MAC80211_MESH
3021         if (ifsta->preq_queue_len &&
3022             time_after(jiffies,
3023                        ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
3024                 mesh_path_start_discovery(dev);
3025 #endif
3026
3027         if (ifsta->state != IEEE80211_AUTHENTICATE &&
3028             ifsta->state != IEEE80211_ASSOCIATE &&
3029             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
3030                 if (ifsta->scan_ssid_len)
3031                         ieee80211_sta_start_scan(dev, ifsta->scan_ssid, ifsta->scan_ssid_len);
3032                 else
3033                         ieee80211_sta_start_scan(dev, NULL, 0);
3034                 return;
3035         }
3036
3037         if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
3038                 if (ieee80211_sta_config_auth(dev, ifsta))
3039                         return;
3040                 clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
3041         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
3042                 return;
3043
3044         switch (ifsta->state) {
3045         case IEEE80211_DISABLED:
3046                 break;
3047         case IEEE80211_AUTHENTICATE:
3048                 ieee80211_authenticate(dev, ifsta);
3049                 break;
3050         case IEEE80211_ASSOCIATE:
3051                 ieee80211_associate(dev, ifsta);
3052                 break;
3053         case IEEE80211_ASSOCIATED:
3054                 ieee80211_associated(dev, ifsta);
3055                 break;
3056         case IEEE80211_IBSS_SEARCH:
3057                 ieee80211_sta_find_ibss(dev, ifsta);
3058                 break;
3059         case IEEE80211_IBSS_JOINED:
3060                 ieee80211_sta_merge_ibss(dev, ifsta);
3061                 break;
3062 #ifdef CONFIG_MAC80211_MESH
3063         case IEEE80211_MESH_UP:
3064                 ieee80211_mesh_housekeeping(dev, ifsta);
3065                 break;
3066 #endif
3067         default:
3068                 printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
3069                        ifsta->state);
3070                 break;
3071         }
3072
3073         if (ieee80211_privacy_mismatch(dev, ifsta)) {
3074                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
3075                        "mixed-cell disabled - disassociate\n", dev->name);
3076
3077                 ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
3078                 ieee80211_set_disassoc(dev, ifsta, 0);
3079         }
3080 }
3081
3082
3083 static void ieee80211_sta_reset_auth(struct net_device *dev,
3084                                      struct ieee80211_if_sta *ifsta)
3085 {
3086         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3087
3088         if (local->ops->reset_tsf) {
3089                 /* Reset own TSF to allow time synchronization work. */
3090                 local->ops->reset_tsf(local_to_hw(local));
3091         }
3092
3093         ifsta->wmm_last_param_set = -1; /* allow any WMM update */
3094
3095
3096         if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
3097                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3098         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
3099                 ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
3100         else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
3101                 ifsta->auth_alg = WLAN_AUTH_LEAP;
3102         else
3103                 ifsta->auth_alg = WLAN_AUTH_OPEN;
3104         printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
3105                ifsta->auth_alg);
3106         ifsta->auth_transaction = -1;
3107         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
3108         ifsta->auth_tries = ifsta->assoc_tries = 0;
3109         netif_carrier_off(dev);
3110 }
3111
3112
3113 void ieee80211_sta_req_auth(struct net_device *dev,
3114                             struct ieee80211_if_sta *ifsta)
3115 {
3116         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3117         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3118
3119         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3120                 return;
3121
3122         if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
3123                                 IEEE80211_STA_AUTO_BSSID_SEL)) &&
3124             (ifsta->flags & (IEEE80211_STA_SSID_SET |
3125                                 IEEE80211_STA_AUTO_SSID_SEL))) {
3126                 set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3127                 queue_work(local->hw.workqueue, &ifsta->work);
3128         }
3129 }
3130
3131 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
3132                                     const char *ssid, int ssid_len)
3133 {
3134         int tmp, hidden_ssid;
3135
3136         if (ssid_len == ifsta->ssid_len &&
3137             !memcmp(ifsta->ssid, ssid, ssid_len))
3138                 return 1;
3139
3140         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
3141                 return 0;
3142
3143         hidden_ssid = 1;
3144         tmp = ssid_len;
3145         while (tmp--) {
3146                 if (ssid[tmp] != '\0') {
3147                         hidden_ssid = 0;
3148                         break;
3149                 }
3150         }
3151
3152         if (hidden_ssid && ifsta->ssid_len == ssid_len)
3153                 return 1;
3154
3155         if (ssid_len == 1 && ssid[0] == ' ')
3156                 return 1;
3157
3158         return 0;
3159 }
3160
3161 static int ieee80211_sta_config_auth(struct net_device *dev,
3162                                      struct ieee80211_if_sta *ifsta)
3163 {
3164         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3165         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3166         struct ieee80211_sta_bss *bss, *selected = NULL;
3167         int top_rssi = 0, freq;
3168
3169         if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
3170             IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
3171                 ifsta->state = IEEE80211_AUTHENTICATE;
3172                 ieee80211_sta_reset_auth(dev, ifsta);
3173                 return 0;
3174         }
3175
3176         spin_lock_bh(&local->sta_bss_lock);
3177         freq = local->oper_channel->center_freq;
3178         list_for_each_entry(bss, &local->sta_bss_list, list) {
3179                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
3180                         continue;
3181
3182                 if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
3183                     !!sdata->default_key)
3184                         continue;
3185
3186                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
3187                     bss->freq != freq)
3188                         continue;
3189
3190                 if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
3191                     memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
3192                         continue;
3193
3194                 if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
3195                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
3196                         continue;
3197
3198                 if (!selected || top_rssi < bss->rssi) {
3199                         selected = bss;
3200                         top_rssi = bss->rssi;
3201                 }
3202         }
3203         if (selected)
3204                 atomic_inc(&selected->users);
3205         spin_unlock_bh(&local->sta_bss_lock);
3206
3207         if (selected) {
3208                 ieee80211_set_freq(local, selected->freq);
3209                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
3210                         ieee80211_sta_set_ssid(dev, selected->ssid,
3211                                                selected->ssid_len);
3212                 ieee80211_sta_set_bssid(dev, selected->bssid);
3213                 ieee80211_rx_bss_put(dev, selected);
3214                 ifsta->state = IEEE80211_AUTHENTICATE;
3215                 ieee80211_sta_reset_auth(dev, ifsta);
3216                 return 0;
3217         } else {
3218                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
3219                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
3220                                 ieee80211_sta_start_scan(dev, NULL, 0);
3221                         else
3222                                 ieee80211_sta_start_scan(dev, ifsta->ssid,
3223                                                          ifsta->ssid_len);
3224                         ifsta->state = IEEE80211_AUTHENTICATE;
3225                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
3226                 } else
3227                         ifsta->state = IEEE80211_DISABLED;
3228         }
3229         return -1;
3230 }
3231
3232
3233 static int ieee80211_sta_create_ibss(struct net_device *dev,
3234                                      struct ieee80211_if_sta *ifsta)
3235 {
3236         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3237         struct ieee80211_sta_bss *bss;
3238         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3239         struct ieee80211_supported_band *sband;
3240         u8 bssid[ETH_ALEN], *pos;
3241         int i;
3242         DECLARE_MAC_BUF(mac);
3243
3244 #if 0
3245         /* Easier testing, use fixed BSSID. */
3246         memset(bssid, 0xfe, ETH_ALEN);
3247 #else
3248         /* Generate random, not broadcast, locally administered BSSID. Mix in
3249          * own MAC address to make sure that devices that do not have proper
3250          * random number generator get different BSSID. */
3251         get_random_bytes(bssid, ETH_ALEN);
3252         for (i = 0; i < ETH_ALEN; i++)
3253                 bssid[i] ^= dev->dev_addr[i];
3254         bssid[0] &= ~0x01;
3255         bssid[0] |= 0x02;
3256 #endif
3257
3258         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
3259                dev->name, print_mac(mac, bssid));
3260
3261         bss = ieee80211_rx_bss_add(dev, bssid,
3262                                    local->hw.conf.channel->center_freq,
3263                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
3264         if (!bss)
3265                 return -ENOMEM;
3266
3267         bss->band = local->hw.conf.channel->band;
3268         sband = local->hw.wiphy->bands[bss->band];
3269
3270         if (local->hw.conf.beacon_int == 0)
3271                 local->hw.conf.beacon_int = 10000;
3272         bss->beacon_int = local->hw.conf.beacon_int;
3273         bss->last_update = jiffies;
3274         bss->capability = WLAN_CAPABILITY_IBSS;
3275         if (sdata->default_key) {
3276                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
3277         } else
3278                 sdata->drop_unencrypted = 0;
3279         bss->supp_rates_len = sband->n_bitrates;
3280         pos = bss->supp_rates;
3281         for (i = 0; i < sband->n_bitrates; i++) {
3282                 int rate = sband->bitrates[i].bitrate;
3283                 *pos++ = (u8) (rate / 5);
3284         }
3285
3286         return ieee80211_sta_join_ibss(dev, ifsta, bss);
3287 }
3288
3289
3290 static int ieee80211_sta_find_ibss(struct net_device *dev,
3291                                    struct ieee80211_if_sta *ifsta)
3292 {
3293         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3294         struct ieee80211_sta_bss *bss;
3295         int found = 0;
3296         u8 bssid[ETH_ALEN];
3297         int active_ibss;
3298         DECLARE_MAC_BUF(mac);
3299         DECLARE_MAC_BUF(mac2);
3300
3301         if (ifsta->ssid_len == 0)
3302                 return -EINVAL;
3303
3304         active_ibss = ieee80211_sta_active_ibss(dev);
3305 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3306         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
3307                dev->name, active_ibss);
3308 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3309         spin_lock_bh(&local->sta_bss_lock);
3310         list_for_each_entry(bss, &local->sta_bss_list, list) {
3311                 if (ifsta->ssid_len != bss->ssid_len ||
3312                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
3313                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
3314                         continue;
3315 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3316                 printk(KERN_DEBUG "   bssid=%s found\n",
3317                        print_mac(mac, bss->bssid));
3318 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3319                 memcpy(bssid, bss->bssid, ETH_ALEN);
3320                 found = 1;
3321                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
3322                         break;
3323         }
3324         spin_unlock_bh(&local->sta_bss_lock);
3325
3326 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3327         printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
3328                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
3329 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3330         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
3331             (bss = ieee80211_rx_bss_get(dev, bssid,
3332                                         local->hw.conf.channel->center_freq,
3333                                         ifsta->ssid, ifsta->ssid_len))) {
3334                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
3335                        " based on configured SSID\n",
3336                        dev->name, print_mac(mac, bssid));
3337                 return ieee80211_sta_join_ibss(dev, ifsta, bss);
3338         }
3339 #ifdef CONFIG_MAC80211_IBSS_DEBUG
3340         printk(KERN_DEBUG "   did not try to join ibss\n");
3341 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
3342
3343         /* Selected IBSS not found in current scan results - try to scan */
3344         if (ifsta->state == IEEE80211_IBSS_JOINED &&
3345             !ieee80211_sta_active_ibss(dev)) {
3346                 mod_timer(&ifsta->timer, jiffies +
3347                                       IEEE80211_IBSS_MERGE_INTERVAL);
3348         } else if (time_after(jiffies, local->last_scan_completed +
3349                               IEEE80211_SCAN_INTERVAL)) {
3350                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
3351                        "join\n", dev->name);
3352                 return ieee80211_sta_req_scan(dev, ifsta->ssid,
3353                                               ifsta->ssid_len);
3354         } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
3355                 int interval = IEEE80211_SCAN_INTERVAL;
3356
3357                 if (time_after(jiffies, ifsta->ibss_join_req +
3358                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
3359                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
3360                             (!(local->oper_channel->flags &
3361                                         IEEE80211_CHAN_NO_IBSS)))
3362                                 return ieee80211_sta_create_ibss(dev, ifsta);
3363                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
3364                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
3365                                        " %d MHz\n", dev->name,
3366                                        local->hw.conf.channel->center_freq);
3367                         }
3368
3369                         /* No IBSS found - decrease scan interval and continue
3370                          * scanning. */
3371                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
3372                 }
3373
3374                 ifsta->state = IEEE80211_IBSS_SEARCH;
3375                 mod_timer(&ifsta->timer, jiffies + interval);
3376                 return 0;
3377         }
3378
3379         return 0;
3380 }
3381
3382
3383 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
3384 {
3385         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3386         struct ieee80211_if_sta *ifsta;
3387         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3388
3389         if (len > IEEE80211_MAX_SSID_LEN)
3390                 return -EINVAL;
3391
3392         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
3393          * not defined. */
3394         if (local->ops->conf_tx) {
3395                 struct ieee80211_tx_queue_params qparam;
3396                 int i;
3397
3398                 memset(&qparam, 0, sizeof(qparam));
3399
3400                 qparam.aifs = 2;
3401
3402                 if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
3403                     !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
3404                         qparam.cw_min = 31;
3405                 else
3406                         qparam.cw_min = 15;
3407
3408                 qparam.cw_max = 1023;
3409                 qparam.txop = 0;
3410
3411                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
3412                         local->ops->conf_tx(local_to_hw(local),
3413                                            i + IEEE80211_TX_QUEUE_DATA0,
3414                                            &qparam);
3415
3416                 /* IBSS uses different parameters for Beacon sending */
3417                 qparam.cw_min++;
3418                 qparam.cw_min *= 2;
3419                 qparam.cw_min--;
3420                 local->ops->conf_tx(local_to_hw(local),
3421                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
3422         }
3423
3424         ifsta = &sdata->u.sta;
3425
3426         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
3427                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
3428         memcpy(ifsta->ssid, ssid, len);
3429         memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
3430         ifsta->ssid_len = len;
3431
3432         if (len)
3433                 ifsta->flags |= IEEE80211_STA_SSID_SET;
3434         else
3435                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
3436         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3437             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
3438                 ifsta->ibss_join_req = jiffies;
3439                 ifsta->state = IEEE80211_IBSS_SEARCH;
3440                 return ieee80211_sta_find_ibss(dev, ifsta);
3441         }
3442         return 0;
3443 }
3444
3445
3446 int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
3447 {
3448         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3449         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3450         memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
3451         *len = ifsta->ssid_len;
3452         return 0;
3453 }
3454
3455
3456 int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
3457 {
3458         struct ieee80211_sub_if_data *sdata;
3459         struct ieee80211_if_sta *ifsta;
3460         int res;
3461
3462         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3463         ifsta = &sdata->u.sta;
3464
3465         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
3466                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
3467                 res = ieee80211_if_config(dev);
3468                 if (res) {
3469                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
3470                                "the low-level driver\n", dev->name);
3471                         return res;
3472                 }
3473         }
3474
3475         if (is_valid_ether_addr(bssid))
3476                 ifsta->flags |= IEEE80211_STA_BSSID_SET;
3477         else
3478                 ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
3479
3480         return 0;
3481 }
3482
3483
3484 static void ieee80211_send_nullfunc(struct ieee80211_local *local,
3485                                     struct ieee80211_sub_if_data *sdata,
3486                                     int powersave)
3487 {
3488         struct sk_buff *skb;
3489         struct ieee80211_hdr *nullfunc;
3490         u16 fc;
3491
3492         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
3493         if (!skb) {
3494                 printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
3495                        "frame\n", sdata->dev->name);
3496                 return;
3497         }
3498         skb_reserve(skb, local->hw.extra_tx_headroom);
3499
3500         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
3501         memset(nullfunc, 0, 24);
3502         fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
3503              IEEE80211_FCTL_TODS;
3504         if (powersave)
3505                 fc |= IEEE80211_FCTL_PM;
3506         nullfunc->frame_control = cpu_to_le16(fc);
3507         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
3508         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
3509         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
3510
3511         ieee80211_sta_tx(sdata->dev, skb, 0);
3512 }
3513
3514
3515 void ieee80211_scan_completed(struct ieee80211_hw *hw)
3516 {
3517         struct ieee80211_local *local = hw_to_local(hw);
3518         struct net_device *dev = local->scan_dev;
3519         struct ieee80211_sub_if_data *sdata;
3520         union iwreq_data wrqu;
3521
3522         local->last_scan_completed = jiffies;
3523         memset(&wrqu, 0, sizeof(wrqu));
3524         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
3525
3526         if (local->sta_hw_scanning) {
3527                 local->sta_hw_scanning = 0;
3528                 goto done;
3529         }
3530
3531         local->sta_sw_scanning = 0;
3532         if (ieee80211_hw_config(local))
3533                 printk(KERN_DEBUG "%s: failed to restore operational "
3534                        "channel after scan\n", dev->name);
3535
3536
3537         netif_tx_lock_bh(local->mdev);
3538         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
3539         local->ops->configure_filter(local_to_hw(local),
3540                                      FIF_BCN_PRBRESP_PROMISC,
3541                                      &local->filter_flags,
3542                                      local->mdev->mc_count,
3543                                      local->mdev->mc_list);
3544
3545         netif_tx_unlock_bh(local->mdev);
3546
3547         rcu_read_lock();
3548         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3549
3550                 /* No need to wake the master device. */
3551                 if (sdata->dev == local->mdev)
3552                         continue;
3553
3554                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
3555                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
3556                                 ieee80211_send_nullfunc(local, sdata, 0);
3557                         ieee80211_sta_timer((unsigned long)sdata);
3558                 }
3559
3560                 if (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT)
3561                         ieee80211_sta_timer((unsigned long)sdata);
3562
3563                 netif_wake_queue(sdata->dev);
3564         }
3565         rcu_read_unlock();
3566
3567 done:
3568         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3569         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
3570                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3571                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
3572                     (!ifsta->state == IEEE80211_IBSS_JOINED &&
3573                     !ieee80211_sta_active_ibss(dev)))
3574                         ieee80211_sta_find_ibss(dev, ifsta);
3575         }
3576 }
3577 EXPORT_SYMBOL(ieee80211_scan_completed);
3578
3579 void ieee80211_sta_scan_work(struct work_struct *work)
3580 {
3581         struct ieee80211_local *local =
3582                 container_of(work, struct ieee80211_local, scan_work.work);
3583         struct net_device *dev = local->scan_dev;
3584         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3585         struct ieee80211_supported_band *sband;
3586         struct ieee80211_channel *chan;
3587         int skip;
3588         unsigned long next_delay = 0;
3589
3590         if (!local->sta_sw_scanning)
3591                 return;
3592
3593         switch (local->scan_state) {
3594         case SCAN_SET_CHANNEL:
3595                 /*
3596                  * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
3597                  * after we successfully scanned the last channel of the last
3598                  * band (and the last band is supported by the hw)
3599                  */
3600                 if (local->scan_band < IEEE80211_NUM_BANDS)
3601                         sband = local->hw.wiphy->bands[local->scan_band];
3602                 else
3603                         sband = NULL;
3604
3605                 /*
3606                  * If we are at an unsupported band and have more bands
3607                  * left to scan, advance to the next supported one.
3608                  */
3609                 while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
3610                         local->scan_band++;
3611                         sband = local->hw.wiphy->bands[local->scan_band];
3612                         local->scan_channel_idx = 0;
3613                 }
3614
3615                 /* if no more bands/channels left, complete scan */
3616                 if (!sband || local->scan_channel_idx >= sband->n_channels) {
3617                         ieee80211_scan_completed(local_to_hw(local));
3618                         return;
3619                 }
3620                 skip = 0;
3621                 chan = &sband->channels[local->scan_channel_idx];
3622
3623                 if (chan->flags & IEEE80211_CHAN_DISABLED ||
3624                     (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
3625                      chan->flags & IEEE80211_CHAN_NO_IBSS))
3626                         skip = 1;
3627
3628                 if (!skip) {
3629                         local->scan_channel = chan;
3630                         if (ieee80211_hw_config(local)) {
3631                                 printk(KERN_DEBUG "%s: failed to set freq to "
3632                                        "%d MHz for scan\n", dev->name,
3633                                        chan->center_freq);
3634                                 skip = 1;
3635                         }
3636                 }
3637
3638                 /* advance state machine to next channel/band */
3639                 local->scan_channel_idx++;
3640                 if (local->scan_channel_idx >= sband->n_channels) {
3641                         /*
3642                          * scan_band may end up == IEEE80211_NUM_BANDS, but
3643                          * we'll catch that case above and complete the scan
3644                          * if that is the case.
3645                          */
3646                         local->scan_band++;
3647                         local->scan_channel_idx = 0;
3648                 }
3649
3650                 if (skip)
3651                         break;
3652
3653                 next_delay = IEEE80211_PROBE_DELAY +
3654                              usecs_to_jiffies(local->hw.channel_change_time);
3655                 local->scan_state = SCAN_SEND_PROBE;
3656                 break;
3657         case SCAN_SEND_PROBE:
3658                 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
3659                 local->scan_state = SCAN_SET_CHANNEL;
3660
3661                 if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
3662                         break;
3663                 ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
3664                                          local->scan_ssid_len);
3665                 next_delay = IEEE80211_CHANNEL_TIME;
3666                 break;
3667         }
3668
3669         if (local->sta_sw_scanning)
3670                 queue_delayed_work(local->hw.workqueue, &local->scan_work,
3671                                    next_delay);
3672 }
3673
3674
3675 static int ieee80211_sta_start_scan(struct net_device *dev,
3676                                     u8 *ssid, size_t ssid_len)
3677 {
3678         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3679         struct ieee80211_sub_if_data *sdata;
3680
3681         if (ssid_len > IEEE80211_MAX_SSID_LEN)
3682                 return -EINVAL;
3683
3684         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
3685          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
3686          * BSSID: MACAddress
3687          * SSID
3688          * ScanType: ACTIVE, PASSIVE
3689          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
3690          *    a Probe frame during active scanning
3691          * ChannelList
3692          * MinChannelTime (>= ProbeDelay), in TU
3693          * MaxChannelTime: (>= MinChannelTime), in TU
3694          */
3695
3696          /* MLME-SCAN.confirm
3697           * BSSDescriptionSet
3698           * ResultCode: SUCCESS, INVALID_PARAMETERS
3699          */
3700
3701         if (local->sta_sw_scanning || local->sta_hw_scanning) {
3702                 if (local->scan_dev == dev)
3703                         return 0;
3704                 return -EBUSY;
3705         }
3706
3707         if (local->ops->hw_scan) {
3708                 int rc = local->ops->hw_scan(local_to_hw(local),
3709                                              ssid, ssid_len);
3710                 if (!rc) {
3711                         local->sta_hw_scanning = 1;
3712                         local->scan_dev = dev;
3713                 }
3714                 return rc;
3715         }
3716
3717         local->sta_sw_scanning = 1;
3718
3719         rcu_read_lock();
3720         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3721
3722                 /* Don't stop the master interface, otherwise we can't transmit
3723                  * probes! */
3724                 if (sdata->dev == local->mdev)
3725                         continue;
3726
3727                 netif_stop_queue(sdata->dev);
3728                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
3729                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
3730                         ieee80211_send_nullfunc(local, sdata, 1);
3731         }
3732         rcu_read_unlock();
3733
3734         if (ssid) {
3735                 local->scan_ssid_len = ssid_len;
3736                 memcpy(local->scan_ssid, ssid, ssid_len);
3737         } else
3738                 local->scan_ssid_len = 0;
3739         local->scan_state = SCAN_SET_CHANNEL;
3740         local->scan_channel_idx = 0;
3741         local->scan_band = IEEE80211_BAND_2GHZ;
3742         local->scan_dev = dev;
3743
3744         netif_tx_lock_bh(local->mdev);
3745         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
3746         local->ops->configure_filter(local_to_hw(local),
3747                                      FIF_BCN_PRBRESP_PROMISC,
3748                                      &local->filter_flags,
3749                                      local->mdev->mc_count,
3750                                      local->mdev->mc_list);
3751         netif_tx_unlock_bh(local->mdev);
3752
3753         /* TODO: start scan as soon as all nullfunc frames are ACKed */
3754         queue_delayed_work(local->hw.workqueue, &local->scan_work,
3755                            IEEE80211_CHANNEL_TIME);
3756
3757         return 0;
3758 }
3759
3760
3761 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
3762 {
3763         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3764         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3765         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3766
3767         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
3768                 return ieee80211_sta_start_scan(dev, ssid, ssid_len);
3769
3770         if (local->sta_sw_scanning || local->sta_hw_scanning) {
3771                 if (local->scan_dev == dev)
3772                         return 0;
3773                 return -EBUSY;
3774         }
3775
3776         ifsta->scan_ssid_len = ssid_len;
3777         if (ssid_len)
3778                 memcpy(ifsta->scan_ssid, ssid, ssid_len);
3779         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
3780         queue_work(local->hw.workqueue, &ifsta->work);
3781         return 0;
3782 }
3783
3784 static char *
3785 ieee80211_sta_scan_result(struct net_device *dev,
3786                           struct ieee80211_sta_bss *bss,
3787                           char *current_ev, char *end_buf)
3788 {
3789         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3790         struct iw_event iwe;
3791
3792         if (time_after(jiffies,
3793                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
3794                 return current_ev;
3795
3796         memset(&iwe, 0, sizeof(iwe));
3797         iwe.cmd = SIOCGIWAP;
3798         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3799         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
3800         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3801                                           IW_EV_ADDR_LEN);
3802
3803         memset(&iwe, 0, sizeof(iwe));
3804         iwe.cmd = SIOCGIWESSID;
3805         if (bss_mesh_cfg(bss)) {
3806                 iwe.u.data.length = bss_mesh_id_len(bss);
3807                 iwe.u.data.flags = 1;
3808                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3809                                                   bss_mesh_id(bss));
3810         } else {
3811                 iwe.u.data.length = bss->ssid_len;
3812                 iwe.u.data.flags = 1;
3813                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3814                                                   bss->ssid);
3815         }
3816
3817         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS
3818             || bss_mesh_cfg(bss))) {
3819                 memset(&iwe, 0, sizeof(iwe));
3820                 iwe.cmd = SIOCGIWMODE;
3821                 if (bss_mesh_cfg(bss))
3822                         iwe.u.mode = IW_MODE_MESH;
3823                 else if (bss->capability & WLAN_CAPABILITY_ESS)
3824                         iwe.u.mode = IW_MODE_MASTER;
3825                 else
3826                         iwe.u.mode = IW_MODE_ADHOC;
3827                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3828                                                   IW_EV_UINT_LEN);
3829         }
3830
3831         memset(&iwe, 0, sizeof(iwe));
3832         iwe.cmd = SIOCGIWFREQ;
3833         iwe.u.freq.m = bss->freq;
3834         iwe.u.freq.e = 6;
3835         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3836                                           IW_EV_FREQ_LEN);
3837
3838         memset(&iwe, 0, sizeof(iwe));
3839         iwe.cmd = SIOCGIWFREQ;
3840         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
3841         iwe.u.freq.e = 0;
3842         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3843                                           IW_EV_FREQ_LEN);
3844
3845         memset(&iwe, 0, sizeof(iwe));
3846         iwe.cmd = IWEVQUAL;
3847         iwe.u.qual.qual = bss->signal;
3848         iwe.u.qual.level = bss->rssi;
3849         iwe.u.qual.noise = bss->noise;
3850         iwe.u.qual.updated = local->wstats_flags;
3851         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
3852                                           IW_EV_QUAL_LEN);
3853
3854         memset(&iwe, 0, sizeof(iwe));
3855         iwe.cmd = SIOCGIWENCODE;
3856         if (bss->capability & WLAN_CAPABILITY_PRIVACY)
3857                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3858         else
3859                 iwe.u.data.flags = IW_ENCODE_DISABLED;
3860         iwe.u.data.length = 0;
3861         current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
3862
3863         if (bss && bss->wpa_ie) {
3864                 memset(&iwe, 0, sizeof(iwe));
3865                 iwe.cmd = IWEVGENIE;
3866                 iwe.u.data.length = bss->wpa_ie_len;
3867                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3868                                                   bss->wpa_ie);
3869         }
3870
3871         if (bss && bss->rsn_ie) {
3872                 memset(&iwe, 0, sizeof(iwe));
3873                 iwe.cmd = IWEVGENIE;
3874                 iwe.u.data.length = bss->rsn_ie_len;
3875                 current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
3876                                                   bss->rsn_ie);
3877         }
3878
3879         if (bss && bss->supp_rates_len > 0) {
3880                 /* display all supported rates in readable format */
3881                 char *p = current_ev + IW_EV_LCP_LEN;
3882                 int i;
3883
3884                 memset(&iwe, 0, sizeof(iwe));
3885                 iwe.cmd = SIOCGIWRATE;
3886                 /* Those two flags are ignored... */
3887                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3888
3889                 for (i = 0; i < bss->supp_rates_len; i++) {
3890                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
3891                                                         0x7f) * 500000);
3892                         p = iwe_stream_add_value(current_ev, p,
3893                                         end_buf, &iwe, IW_EV_PARAM_LEN);
3894                 }
3895                 current_ev = p;
3896         }
3897
3898         if (bss) {
3899                 char *buf;
3900                 buf = kmalloc(30, GFP_ATOMIC);
3901                 if (buf) {
3902                         memset(&iwe, 0, sizeof(iwe));
3903                         iwe.cmd = IWEVCUSTOM;
3904                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
3905                         iwe.u.data.length = strlen(buf);
3906                         current_ev = iwe_stream_add_point(current_ev, end_buf,
3907                                                           &iwe, buf);
3908                         kfree(buf);
3909                 }
3910         }
3911
3912         if (bss_mesh_cfg(bss)) {
3913                 char *buf;
3914                 u8 *cfg = bss_mesh_cfg(bss);
3915                 buf = kmalloc(200, GFP_ATOMIC);
3916                 if (buf) {
3917                         memset(&iwe, 0, sizeof(iwe));
3918                         iwe.cmd = IWEVCUSTOM;
3919                         sprintf(buf, "Mesh network (version %d)\n"
3920                         "\t\t\tPath Selection Protocol ID: 0x%02X%02X%02X%02X\n"
3921                         "\t\t\tPath Selection Metric ID: 0x%02X%02X%02X%02X\n"
3922                         "\t\t\tCongestion Control Mode ID: 0x%02X%02X%02X%02X\n"
3923                         "\t\t\tChannel Precedence: 0x%02X%02X%02X%02X",
3924                         cfg[0], cfg[1], cfg[2], cfg[3], cfg[4], cfg[5], cfg[6],
3925                         cfg[7], cfg[8], cfg[9], cfg[10], cfg[11], cfg[12],
3926                         cfg[13], cfg[14], cfg[15], cfg[16]);
3927                         iwe.u.data.length = strlen(buf);
3928                         current_ev = iwe_stream_add_point(current_ev, end_buf,
3929                                                           &iwe, buf);
3930                         kfree(buf);
3931                 }
3932         }
3933
3934         return current_ev;
3935 }
3936
3937
3938 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
3939 {
3940         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3941         char *current_ev = buf;
3942         char *end_buf = buf + len;
3943         struct ieee80211_sta_bss *bss;
3944
3945         spin_lock_bh(&local->sta_bss_lock);
3946         list_for_each_entry(bss, &local->sta_bss_list, list) {
3947                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3948                         spin_unlock_bh(&local->sta_bss_lock);
3949                         return -E2BIG;
3950                 }
3951                 current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
3952                                                        end_buf);
3953         }
3954         spin_unlock_bh(&local->sta_bss_lock);
3955         return current_ev - buf;
3956 }
3957
3958
3959 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
3960 {
3961         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3962         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
3963         kfree(ifsta->extra_ie);
3964         if (len == 0) {
3965                 ifsta->extra_ie = NULL;
3966                 ifsta->extra_ie_len = 0;
3967                 return 0;
3968         }
3969         ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
3970         if (!ifsta->extra_ie) {
3971                 ifsta->extra_ie_len = 0;
3972                 return -ENOMEM;
3973         }
3974         memcpy(ifsta->extra_ie, ie, len);
3975         ifsta->extra_ie_len = len;
3976         return 0;
3977 }
3978
3979
3980 struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
3981                                          struct sk_buff *skb, u8 *bssid,
3982                                          u8 *addr)
3983 {
3984         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
3985         struct sta_info *sta;
3986         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3987         DECLARE_MAC_BUF(mac);
3988
3989         /* TODO: Could consider removing the least recently used entry and
3990          * allow new one to be added. */
3991         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
3992                 if (net_ratelimit()) {
3993                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
3994                                "entry %s\n", dev->name, print_mac(mac, addr));
3995                 }
3996                 return NULL;
3997         }
3998
3999         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
4000                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
4001
4002         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
4003         if (IS_ERR(sta))
4004                 return NULL;
4005
4006         sta->flags |= WLAN_STA_AUTHORIZED;
4007
4008         sta->supp_rates[local->hw.conf.channel->band] =
4009                 sdata->u.sta.supp_rates_bits[local->hw.conf.channel->band];
4010
4011         rate_control_rate_init(sta, local);
4012
4013         return sta; /* caller will call sta_info_put() */
4014 }
4015
4016
4017 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
4018 {
4019         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4020         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4021
4022         printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
4023                dev->name, reason);
4024
4025         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
4026             sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
4027                 return -EINVAL;
4028
4029         ieee80211_send_deauth(dev, ifsta, reason);
4030         ieee80211_set_disassoc(dev, ifsta, 1);
4031         return 0;
4032 }
4033
4034
4035 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
4036 {
4037         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4038         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
4039
4040         printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
4041                dev->name, reason);
4042
4043         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
4044                 return -EINVAL;
4045
4046         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
4047                 return -1;
4048
4049         ieee80211_send_disassoc(dev, ifsta, reason);
4050         ieee80211_set_disassoc(dev, ifsta, 0);
4051         return 0;
4052 }